Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 09:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04ee4cd7e7574936b9aea6ee2cdd1fbcbb2fc1b0a9e4e2c2e43ef1450e88a9fc.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
04ee4cd7e7574936b9aea6ee2cdd1fbcbb2fc1b0a9e4e2c2e43ef1450e88a9fc.exe
-
Size
277KB
-
MD5
d1ee59a92917dd10adf2589ac66a12d0
-
SHA1
1e843e956d1360f249380b3550be08a348ec4f42
-
SHA256
04ee4cd7e7574936b9aea6ee2cdd1fbcbb2fc1b0a9e4e2c2e43ef1450e88a9fc
-
SHA512
622793da1593174234ac95d253edfc5826ffff8f4d54ba0e30ad039fdbe6c570c07c77dbeb358e516cd1c8590bf7be22072f0c41fd47f0fe1d9448f19c2b111c
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7Vveme:n3C9uYA71kSMuk
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/3568-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xfrlffx.exebhntbb.exepdjvp.exelrxlfrf.exefrrfxrf.exexrxlfxx.exejpjdp.exexxlxrlx.exenhhtnh.exepvvvp.exejjjdd.exefxffxxx.exenhtnbb.exelxfffxr.exehttnhb.exevjdvp.exexlrlfff.exe9rrllff.exepjjdd.exepjddj.exetnhhbb.exepjjdp.exennhbbb.exeppdvp.exelfxrxrl.exejdpjd.exelflfxfx.exepjjdd.exe7xrrllr.exellllxff.exejvjpj.exe3jppj.exelfrrxxf.exenhtnhh.exeppvpj.exe5djdp.exerflfxrr.exexrxrrrr.exetnnhhh.exedvdvv.exeppdvj.exeflrlffx.exe3xrlffx.exennhbhh.exe3vddv.exepjdvj.exefffxlrl.exenhtnnn.exenbhbtt.exevpjjj.exevvjdv.exexlrrlff.exenhbbnn.exettnnnh.exepdpjj.exexrlffff.exehbbbtt.exehnbhnt.exepvpjd.exe7xxrlfx.exe9rxxlll.exebhhbtn.exedddvp.exepvdvp.exepid process 1284 xfrlffx.exe 2532 bhntbb.exe 4208 pdjvp.exe 1776 lrxlfrf.exe 3308 frrfxrf.exe 1596 xrxlfxx.exe 1324 jpjdp.exe 2016 xxlxrlx.exe 64 nhhtnh.exe 3612 pvvvp.exe 2852 jjjdd.exe 3432 fxffxxx.exe 3240 nhtnbb.exe 3836 lxfffxr.exe 1924 httnhb.exe 4464 vjdvp.exe 2932 xlrlfff.exe 4608 9rrllff.exe 2104 pjjdd.exe 1304 pjddj.exe 2288 tnhhbb.exe 3500 pjjdp.exe 4568 nnhbbb.exe 2300 ppdvp.exe 3448 lfxrxrl.exe 528 jdpjd.exe 5052 lflfxfx.exe 3144 pjjdd.exe 3492 7xrrllr.exe 944 llllxff.exe 1864 jvjpj.exe 4544 3jppj.exe 4888 lfrrxxf.exe 2644 nhtnhh.exe 4924 ppvpj.exe 2484 5djdp.exe 2992 rflfxrr.exe 1336 xrxrrrr.exe 3628 tnnhhh.exe 3632 dvdvv.exe 2324 ppdvj.exe 2332 flrlffx.exe 3928 3xrlffx.exe 1272 nnhbhh.exe 1176 3vddv.exe 3936 pjdvj.exe 2784 fffxlrl.exe 2056 nhtnnn.exe 3284 nbhbtt.exe 64 vpjjj.exe 2876 vvjdv.exe 3152 xlrrlff.exe 5088 nhbbnn.exe 4552 ttnnnh.exe 4416 pdpjj.exe 2136 xrlffff.exe 4264 hbbbtt.exe 2280 hnbhnt.exe 2680 pvpjd.exe 3404 7xxrlfx.exe 3300 9rxxlll.exe 2808 bhhbtn.exe 4484 dddvp.exe 2000 pvdvp.exe -
Processes:
resource yara_rule behavioral2/memory/3568-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
04ee4cd7e7574936b9aea6ee2cdd1fbcbb2fc1b0a9e4e2c2e43ef1450e88a9fc.exexfrlffx.exebhntbb.exepdjvp.exelrxlfrf.exefrrfxrf.exexrxlfxx.exejpjdp.exexxlxrlx.exenhhtnh.exepvvvp.exejjjdd.exefxffxxx.exenhtnbb.exelxfffxr.exehttnhb.exevjdvp.exexlrlfff.exe9rrllff.exepjjdd.exepjddj.exetnhhbb.exedescription pid process target process PID 3568 wrote to memory of 1284 3568 04ee4cd7e7574936b9aea6ee2cdd1fbcbb2fc1b0a9e4e2c2e43ef1450e88a9fc.exe xfrlffx.exe PID 3568 wrote to memory of 1284 3568 04ee4cd7e7574936b9aea6ee2cdd1fbcbb2fc1b0a9e4e2c2e43ef1450e88a9fc.exe xfrlffx.exe PID 3568 wrote to memory of 1284 3568 04ee4cd7e7574936b9aea6ee2cdd1fbcbb2fc1b0a9e4e2c2e43ef1450e88a9fc.exe xfrlffx.exe PID 1284 wrote to memory of 2532 1284 xfrlffx.exe bhntbb.exe PID 1284 wrote to memory of 2532 1284 xfrlffx.exe bhntbb.exe PID 1284 wrote to memory of 2532 1284 xfrlffx.exe bhntbb.exe PID 2532 wrote to memory of 4208 2532 bhntbb.exe pdjvp.exe PID 2532 wrote to memory of 4208 2532 bhntbb.exe pdjvp.exe PID 2532 wrote to memory of 4208 2532 bhntbb.exe pdjvp.exe PID 4208 wrote to memory of 1776 4208 pdjvp.exe lrxlfrf.exe PID 4208 wrote to memory of 1776 4208 pdjvp.exe lrxlfrf.exe PID 4208 wrote to memory of 1776 4208 pdjvp.exe lrxlfrf.exe PID 1776 wrote to memory of 3308 1776 lrxlfrf.exe frrfxrf.exe PID 1776 wrote to memory of 3308 1776 lrxlfrf.exe frrfxrf.exe PID 1776 wrote to memory of 3308 1776 lrxlfrf.exe frrfxrf.exe PID 3308 wrote to memory of 1596 3308 frrfxrf.exe xrxlfxx.exe PID 3308 wrote to memory of 1596 3308 frrfxrf.exe xrxlfxx.exe PID 3308 wrote to memory of 1596 3308 frrfxrf.exe xrxlfxx.exe PID 1596 wrote to memory of 1324 1596 xrxlfxx.exe jpjdp.exe PID 1596 wrote to memory of 1324 1596 xrxlfxx.exe jpjdp.exe PID 1596 wrote to memory of 1324 1596 xrxlfxx.exe jpjdp.exe PID 1324 wrote to memory of 2016 1324 jpjdp.exe xxlxrlx.exe PID 1324 wrote to memory of 2016 1324 jpjdp.exe xxlxrlx.exe PID 1324 wrote to memory of 2016 1324 jpjdp.exe xxlxrlx.exe PID 2016 wrote to memory of 64 2016 xxlxrlx.exe nhhtnh.exe PID 2016 wrote to memory of 64 2016 xxlxrlx.exe nhhtnh.exe PID 2016 wrote to memory of 64 2016 xxlxrlx.exe nhhtnh.exe PID 64 wrote to memory of 3612 64 nhhtnh.exe pvvvp.exe PID 64 wrote to memory of 3612 64 nhhtnh.exe pvvvp.exe PID 64 wrote to memory of 3612 64 nhhtnh.exe pvvvp.exe PID 3612 wrote to memory of 2852 3612 pvvvp.exe jjjdd.exe PID 3612 wrote to memory of 2852 3612 pvvvp.exe jjjdd.exe PID 3612 wrote to memory of 2852 3612 pvvvp.exe jjjdd.exe PID 2852 wrote to memory of 3432 2852 jjjdd.exe fxffxxx.exe PID 2852 wrote to memory of 3432 2852 jjjdd.exe fxffxxx.exe PID 2852 wrote to memory of 3432 2852 jjjdd.exe fxffxxx.exe PID 3432 wrote to memory of 3240 3432 fxffxxx.exe nhtnbb.exe PID 3432 wrote to memory of 3240 3432 fxffxxx.exe nhtnbb.exe PID 3432 wrote to memory of 3240 3432 fxffxxx.exe nhtnbb.exe PID 3240 wrote to memory of 3836 3240 nhtnbb.exe lxfffxr.exe PID 3240 wrote to memory of 3836 3240 nhtnbb.exe lxfffxr.exe PID 3240 wrote to memory of 3836 3240 nhtnbb.exe lxfffxr.exe PID 3836 wrote to memory of 1924 3836 lxfffxr.exe httnhb.exe PID 3836 wrote to memory of 1924 3836 lxfffxr.exe httnhb.exe PID 3836 wrote to memory of 1924 3836 lxfffxr.exe httnhb.exe PID 1924 wrote to memory of 4464 1924 httnhb.exe vjdvp.exe PID 1924 wrote to memory of 4464 1924 httnhb.exe vjdvp.exe PID 1924 wrote to memory of 4464 1924 httnhb.exe vjdvp.exe PID 4464 wrote to memory of 2932 4464 vjdvp.exe xlrlfff.exe PID 4464 wrote to memory of 2932 4464 vjdvp.exe xlrlfff.exe PID 4464 wrote to memory of 2932 4464 vjdvp.exe xlrlfff.exe PID 2932 wrote to memory of 4608 2932 xlrlfff.exe 9rrllff.exe PID 2932 wrote to memory of 4608 2932 xlrlfff.exe 9rrllff.exe PID 2932 wrote to memory of 4608 2932 xlrlfff.exe 9rrllff.exe PID 4608 wrote to memory of 2104 4608 9rrllff.exe pjjdd.exe PID 4608 wrote to memory of 2104 4608 9rrllff.exe pjjdd.exe PID 4608 wrote to memory of 2104 4608 9rrllff.exe pjjdd.exe PID 2104 wrote to memory of 1304 2104 pjjdd.exe pjddj.exe PID 2104 wrote to memory of 1304 2104 pjjdd.exe pjddj.exe PID 2104 wrote to memory of 1304 2104 pjjdd.exe pjddj.exe PID 1304 wrote to memory of 2288 1304 pjddj.exe tnhhbb.exe PID 1304 wrote to memory of 2288 1304 pjddj.exe tnhhbb.exe PID 1304 wrote to memory of 2288 1304 pjddj.exe tnhhbb.exe PID 2288 wrote to memory of 3500 2288 tnhhbb.exe pjjdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04ee4cd7e7574936b9aea6ee2cdd1fbcbb2fc1b0a9e4e2c2e43ef1450e88a9fc.exe"C:\Users\Admin\AppData\Local\Temp\04ee4cd7e7574936b9aea6ee2cdd1fbcbb2fc1b0a9e4e2c2e43ef1450e88a9fc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\xfrlffx.exec:\xfrlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\bhntbb.exec:\bhntbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\pdjvp.exec:\pdjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\lrxlfrf.exec:\lrxlfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\frrfxrf.exec:\frrfxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\xrxlfxx.exec:\xrxlfxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\jpjdp.exec:\jpjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\xxlxrlx.exec:\xxlxrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\nhhtnh.exec:\nhhtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\pvvvp.exec:\pvvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\jjjdd.exec:\jjjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\fxffxxx.exec:\fxffxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\nhtnbb.exec:\nhtnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\lxfffxr.exec:\lxfffxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\httnhb.exec:\httnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\vjdvp.exec:\vjdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\xlrlfff.exec:\xlrlfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\9rrllff.exec:\9rrllff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\pjjdd.exec:\pjjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\pjddj.exec:\pjddj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\tnhhbb.exec:\tnhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\pjjdp.exec:\pjjdp.exe23⤵
- Executes dropped EXE
PID:3500 -
\??\c:\nnhbbb.exec:\nnhbbb.exe24⤵
- Executes dropped EXE
PID:4568 -
\??\c:\ppdvp.exec:\ppdvp.exe25⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lfxrxrl.exec:\lfxrxrl.exe26⤵
- Executes dropped EXE
PID:3448 -
\??\c:\jdpjd.exec:\jdpjd.exe27⤵
- Executes dropped EXE
PID:528 -
\??\c:\lflfxfx.exec:\lflfxfx.exe28⤵
- Executes dropped EXE
PID:5052 -
\??\c:\pjjdd.exec:\pjjdd.exe29⤵
- Executes dropped EXE
PID:3144 -
\??\c:\7xrrllr.exec:\7xrrllr.exe30⤵
- Executes dropped EXE
PID:3492 -
\??\c:\llllxff.exec:\llllxff.exe31⤵
- Executes dropped EXE
PID:944 -
\??\c:\jvjpj.exec:\jvjpj.exe32⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3jppj.exec:\3jppj.exe33⤵
- Executes dropped EXE
PID:4544 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe34⤵
- Executes dropped EXE
PID:4888 -
\??\c:\nhtnhh.exec:\nhtnhh.exe35⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ppvpj.exec:\ppvpj.exe36⤵
- Executes dropped EXE
PID:4924 -
\??\c:\5djdp.exec:\5djdp.exe37⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rflfxrr.exec:\rflfxrr.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe39⤵
- Executes dropped EXE
PID:1336 -
\??\c:\tnnhhh.exec:\tnnhhh.exe40⤵
- Executes dropped EXE
PID:3628 -
\??\c:\dvdvv.exec:\dvdvv.exe41⤵
- Executes dropped EXE
PID:3632 -
\??\c:\ppdvj.exec:\ppdvj.exe42⤵
- Executes dropped EXE
PID:2324 -
\??\c:\flrlffx.exec:\flrlffx.exe43⤵
- Executes dropped EXE
PID:2332 -
\??\c:\3xrlffx.exec:\3xrlffx.exe44⤵
- Executes dropped EXE
PID:3928 -
\??\c:\nnhbhh.exec:\nnhbhh.exe45⤵
- Executes dropped EXE
PID:1272 -
\??\c:\3vddv.exec:\3vddv.exe46⤵
- Executes dropped EXE
PID:1176 -
\??\c:\pjdvj.exec:\pjdvj.exe47⤵
- Executes dropped EXE
PID:3936 -
\??\c:\fffxlrl.exec:\fffxlrl.exe48⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nhtnnn.exec:\nhtnnn.exe49⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nbhbtt.exec:\nbhbtt.exe50⤵
- Executes dropped EXE
PID:3284 -
\??\c:\vpjjj.exec:\vpjjj.exe51⤵
- Executes dropped EXE
PID:64 -
\??\c:\vvjdv.exec:\vvjdv.exe52⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xlrrlff.exec:\xlrrlff.exe53⤵
- Executes dropped EXE
PID:3152 -
\??\c:\nhbbnn.exec:\nhbbnn.exe54⤵
- Executes dropped EXE
PID:5088 -
\??\c:\ttnnnh.exec:\ttnnnh.exe55⤵
- Executes dropped EXE
PID:4552 -
\??\c:\pdpjj.exec:\pdpjj.exe56⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xrlffff.exec:\xrlffff.exe57⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hbbbtt.exec:\hbbbtt.exe58⤵
- Executes dropped EXE
PID:4264 -
\??\c:\hnbhnt.exec:\hnbhnt.exe59⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pvpjd.exec:\pvpjd.exe60⤵
- Executes dropped EXE
PID:2680 -
\??\c:\7xxrlfx.exec:\7xxrlfx.exe61⤵
- Executes dropped EXE
PID:3404 -
\??\c:\9rxxlll.exec:\9rxxlll.exe62⤵
- Executes dropped EXE
PID:3300 -
\??\c:\bhhbtn.exec:\bhhbtn.exe63⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dddvp.exec:\dddvp.exe64⤵
- Executes dropped EXE
PID:4484 -
\??\c:\pvdvp.exec:\pvdvp.exe65⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe66⤵PID:4656
-
\??\c:\hntnnh.exec:\hntnnh.exe67⤵PID:2464
-
\??\c:\btnhbt.exec:\btnhbt.exe68⤵PID:4440
-
\??\c:\9vddp.exec:\9vddp.exe69⤵PID:316
-
\??\c:\3lrrfff.exec:\3lrrfff.exe70⤵PID:2300
-
\??\c:\nbbttt.exec:\nbbttt.exe71⤵PID:2632
-
\??\c:\7jdvp.exec:\7jdvp.exe72⤵PID:528
-
\??\c:\xxlffxx.exec:\xxlffxx.exe73⤵PID:3188
-
\??\c:\3nnnhb.exec:\3nnnhb.exe74⤵PID:3340
-
\??\c:\hbnhnn.exec:\hbnhnn.exe75⤵PID:3944
-
\??\c:\vjvvj.exec:\vjvvj.exe76⤵PID:4632
-
\??\c:\llffxll.exec:\llffxll.exe77⤵PID:4620
-
\??\c:\bhttnn.exec:\bhttnn.exe78⤵PID:2012
-
\??\c:\pppjd.exec:\pppjd.exe79⤵PID:4888
-
\??\c:\xxfxllf.exec:\xxfxllf.exe80⤵PID:2644
-
\??\c:\lxfrfxr.exec:\lxfrfxr.exe81⤵PID:4924
-
\??\c:\nhhhbt.exec:\nhhhbt.exe82⤵PID:4572
-
\??\c:\3dddp.exec:\3dddp.exe83⤵PID:2992
-
\??\c:\xllfffx.exec:\xllfffx.exe84⤵PID:900
-
\??\c:\hntnnt.exec:\hntnnt.exe85⤵PID:2444
-
\??\c:\3nhnbb.exec:\3nhnbb.exe86⤵PID:3632
-
\??\c:\jdjdp.exec:\jdjdp.exe87⤵PID:2008
-
\??\c:\lllflfl.exec:\lllflfl.exe88⤵PID:1852
-
\??\c:\bnttnn.exec:\bnttnn.exe89⤵PID:4808
-
\??\c:\jvjdv.exec:\jvjdv.exe90⤵PID:2904
-
\??\c:\dvjjd.exec:\dvjjd.exe91⤵PID:4460
-
\??\c:\rllllll.exec:\rllllll.exe92⤵PID:2340
-
\??\c:\hbbthb.exec:\hbbthb.exe93⤵PID:2056
-
\??\c:\1nnhbb.exec:\1nnhbb.exe94⤵PID:2372
-
\??\c:\jddvj.exec:\jddvj.exe95⤵PID:756
-
\??\c:\nbtnhb.exec:\nbtnhb.exe96⤵PID:2960
-
\??\c:\hbhbtn.exec:\hbhbtn.exe97⤵PID:5048
-
\??\c:\vppjd.exec:\vppjd.exe98⤵PID:5068
-
\??\c:\fxfxfxr.exec:\fxfxfxr.exe99⤵PID:4392
-
\??\c:\5xfrrll.exec:\5xfrrll.exe100⤵PID:4464
-
\??\c:\ntnnbt.exec:\ntnnbt.exe101⤵PID:3760
-
\??\c:\pdjdd.exec:\pdjdd.exe102⤵PID:4752
-
\??\c:\lfllrll.exec:\lfllrll.exe103⤵PID:3696
-
\??\c:\nnnhbb.exec:\nnnhbb.exe104⤵PID:2488
-
\??\c:\hnbbhn.exec:\hnbbhn.exe105⤵PID:3652
-
\??\c:\pdjjj.exec:\pdjjj.exe106⤵PID:3948
-
\??\c:\pjvpp.exec:\pjvpp.exe107⤵PID:4484
-
\??\c:\rlxrrlf.exec:\rlxrrlf.exe108⤵PID:4912
-
\??\c:\rxfrfxx.exec:\rxfrfxx.exe109⤵PID:4284
-
\??\c:\htnnhb.exec:\htnnhb.exe110⤵PID:3472
-
\??\c:\7djvv.exec:\7djvv.exe111⤵PID:720
-
\??\c:\ddjvj.exec:\ddjvj.exe112⤵PID:3428
-
\??\c:\llrlrlr.exec:\llrlrlr.exe113⤵PID:528
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe114⤵PID:3144
-
\??\c:\tbhhhh.exec:\tbhhhh.exe115⤵PID:4824
-
\??\c:\vpddp.exec:\vpddp.exe116⤵PID:3336
-
\??\c:\vpppp.exec:\vpppp.exe117⤵PID:4536
-
\??\c:\rrxrffx.exec:\rrxrffx.exe118⤵PID:3740
-
\??\c:\9xfxffl.exec:\9xfxffl.exe119⤵PID:3604
-
\??\c:\hhhbtn.exec:\hhhbtn.exe120⤵PID:940
-
\??\c:\ttttnh.exec:\ttttnh.exe121⤵PID:892
-
\??\c:\5pppd.exec:\5pppd.exe122⤵PID:4784
-
\??\c:\ththbh.exec:\ththbh.exe123⤵PID:2848
-
\??\c:\5tbtnn.exec:\5tbtnn.exe124⤵PID:1976
-
\??\c:\3vvpj.exec:\3vvpj.exe125⤵PID:2164
-
\??\c:\fflfrrx.exec:\fflfrrx.exe126⤵PID:2692
-
\??\c:\hbbbtn.exec:\hbbbtn.exe127⤵PID:1176
-
\??\c:\ddddp.exec:\ddddp.exe128⤵PID:3936
-
\??\c:\rlrxrlf.exec:\rlrxrlf.exe129⤵PID:2784
-
\??\c:\frxrrrx.exec:\frxrrrx.exe130⤵PID:1936
-
\??\c:\tntnbb.exec:\tntnbb.exe131⤵PID:3032
-
\??\c:\pjvpj.exec:\pjvpj.exe132⤵PID:2660
-
\??\c:\rffrlrx.exec:\rffrlrx.exe133⤵PID:756
-
\??\c:\nnnhbh.exec:\nnnhbh.exe134⤵PID:404
-
\??\c:\vpvvp.exec:\vpvvp.exe135⤵PID:2980
-
\??\c:\fflllll.exec:\fflllll.exe136⤵PID:4768
-
\??\c:\5rxlffr.exec:\5rxlffr.exe137⤵PID:2668
-
\??\c:\1btnhh.exec:\1btnhh.exe138⤵PID:3644
-
\??\c:\9hhttn.exec:\9hhttn.exe139⤵PID:364
-
\??\c:\jpjpp.exec:\jpjpp.exe140⤵PID:2680
-
\??\c:\flflrxx.exec:\flflrxx.exe141⤵PID:3696
-
\??\c:\rfrlfff.exec:\rfrlfff.exe142⤵PID:2488
-
\??\c:\thhhhh.exec:\thhhhh.exe143⤵PID:1356
-
\??\c:\pjjdv.exec:\pjjdv.exe144⤵PID:4380
-
\??\c:\vpjdd.exec:\vpjdd.exe145⤵PID:4780
-
\??\c:\xxlrfll.exec:\xxlrfll.exe146⤵PID:4912
-
\??\c:\9llffll.exec:\9llffll.exe147⤵PID:316
-
\??\c:\hbbtnn.exec:\hbbtnn.exe148⤵PID:3472
-
\??\c:\ntbhbt.exec:\ntbhbt.exe149⤵PID:2824
-
\??\c:\7jpjj.exec:\7jpjj.exe150⤵PID:3428
-
\??\c:\9xffffl.exec:\9xffffl.exe151⤵PID:4772
-
\??\c:\5llllrx.exec:\5llllrx.exe152⤵PID:4868
-
\??\c:\rlrxffl.exec:\rlrxffl.exe153⤵PID:3336
-
\??\c:\hnnnnn.exec:\hnnnnn.exe154⤵PID:3384
-
\??\c:\bttnnn.exec:\bttnnn.exe155⤵PID:4648
-
\??\c:\pjdpj.exec:\pjdpj.exe156⤵PID:4852
-
\??\c:\fxfrrfx.exec:\fxfrrfx.exe157⤵PID:4196
-
\??\c:\xxllffx.exec:\xxllffx.exe158⤵PID:4152
-
\??\c:\tntnhh.exec:\tntnhh.exe159⤵PID:836
-
\??\c:\btbbhh.exec:\btbbhh.exe160⤵PID:2020
-
\??\c:\jjpjd.exec:\jjpjd.exe161⤵PID:408
-
\??\c:\dvpjj.exec:\dvpjj.exe162⤵PID:1204
-
\??\c:\rxlfffx.exec:\rxlfffx.exe163⤵PID:5076
-
\??\c:\llfxffx.exec:\llfxffx.exe164⤵PID:2900
-
\??\c:\1bbtnh.exec:\1bbtnh.exe165⤵PID:2340
-
\??\c:\nntnhh.exec:\nntnhh.exe166⤵PID:5064
-
\??\c:\jddjd.exec:\jddjd.exe167⤵PID:3324
-
\??\c:\pjpjd.exec:\pjpjd.exe168⤵PID:4052
-
\??\c:\lxlfxlf.exec:\lxlfxlf.exe169⤵PID:4580
-
\??\c:\lfffxxx.exec:\lfffxxx.exe170⤵PID:4864
-
\??\c:\hthhbb.exec:\hthhbb.exe171⤵PID:1924
-
\??\c:\jvddp.exec:\jvddp.exe172⤵PID:1508
-
\??\c:\vpdvj.exec:\vpdvj.exe173⤵PID:3128
-
\??\c:\lflxrxr.exec:\lflxrxr.exe174⤵PID:4688
-
\??\c:\9rrlffx.exec:\9rrlffx.exe175⤵PID:2280
-
\??\c:\nthhnn.exec:\nthhnn.exe176⤵PID:4600
-
\??\c:\nhtnhh.exec:\nhtnhh.exe177⤵PID:2488
-
\??\c:\vvvpj.exec:\vvvpj.exe178⤵PID:4268
-
\??\c:\9pdpp.exec:\9pdpp.exe179⤵PID:4044
-
\??\c:\llrlfxx.exec:\llrlfxx.exe180⤵PID:4780
-
\??\c:\frffrrr.exec:\frffrrr.exe181⤵PID:728
-
\??\c:\bntthh.exec:\bntthh.exe182⤵PID:4496
-
\??\c:\vpdvv.exec:\vpdvv.exe183⤵PID:3584
-
\??\c:\pvddv.exec:\pvddv.exe184⤵PID:3592
-
\??\c:\fxxrlll.exec:\fxxrlll.exe185⤵PID:3428
-
\??\c:\thnhbh.exec:\thnhbh.exe186⤵PID:100
-
\??\c:\dvvpd.exec:\dvvpd.exe187⤵PID:2952
-
\??\c:\xxxfllr.exec:\xxxfllr.exe188⤵PID:3336
-
\??\c:\5frfxlf.exec:\5frfxlf.exe189⤵PID:5008
-
\??\c:\7nbbtt.exec:\7nbbtt.exe190⤵PID:940
-
\??\c:\jvjjd.exec:\jvjjd.exe191⤵PID:224
-
\??\c:\lxrlffl.exec:\lxrlffl.exe192⤵PID:4428
-
\??\c:\hbnhhh.exec:\hbnhhh.exe193⤵PID:2404
-
\??\c:\jpdvj.exec:\jpdvj.exe194⤵PID:836
-
\??\c:\rrrrfll.exec:\rrrrfll.exe195⤵PID:2020
-
\??\c:\thtttt.exec:\thtttt.exe196⤵PID:408
-
\??\c:\ntbtnh.exec:\ntbtnh.exe197⤵PID:1204
-
\??\c:\jjjdd.exec:\jjjdd.exe198⤵PID:4616
-
\??\c:\lrxxllr.exec:\lrxxllr.exe199⤵PID:4112
-
\??\c:\ffffxrr.exec:\ffffxrr.exe200⤵PID:2056
-
\??\c:\hbhhbb.exec:\hbhhbb.exe201⤵PID:5064
-
\??\c:\nthhbb.exec:\nthhbb.exe202⤵PID:4240
-
\??\c:\pjdvd.exec:\pjdvd.exe203⤵PID:4052
-
\??\c:\rrffxxx.exec:\rrffxxx.exe204⤵PID:4632
-
\??\c:\xlxrllx.exec:\xlxrllx.exe205⤵PID:3568
-
\??\c:\1bthbb.exec:\1bthbb.exe206⤵PID:5068
-
\??\c:\btnhnt.exec:\btnhnt.exe207⤵PID:528
-
\??\c:\5djdd.exec:\5djdd.exe208⤵PID:1508
-
\??\c:\frlrrrl.exec:\frlrrrl.exe209⤵PID:980
-
\??\c:\rfxxxxx.exec:\rfxxxxx.exe210⤵PID:4424
-
\??\c:\tntnnn.exec:\tntnnn.exe211⤵PID:2264
-
\??\c:\hnnnbb.exec:\hnnnbb.exe212⤵PID:1356
-
\??\c:\ddjvv.exec:\ddjvv.exe213⤵PID:3360
-
\??\c:\5pvvj.exec:\5pvvj.exe214⤵PID:3908
-
\??\c:\rllfxxx.exec:\rllfxxx.exe215⤵PID:1476
-
\??\c:\tbbtnh.exec:\tbbtnh.exe216⤵PID:1616
-
\??\c:\bthbhn.exec:\bthbhn.exe217⤵PID:3828
-
\??\c:\jdddj.exec:\jdddj.exe218⤵PID:2320
-
\??\c:\jppjv.exec:\jppjv.exe219⤵PID:2012
-
\??\c:\rllrxrl.exec:\rllrxrl.exe220⤵PID:4764
-
\??\c:\ffffxll.exec:\ffffxll.exe221⤵PID:1284
-
\??\c:\nnnnhn.exec:\nnnnhn.exe222⤵PID:844
-
\??\c:\tbbtnt.exec:\tbbtnt.exe223⤵PID:4252
-
\??\c:\5pddp.exec:\5pddp.exe224⤵PID:4852
-
\??\c:\lrrrffx.exec:\lrrrffx.exe225⤵PID:3516
-
\??\c:\rxlrxrf.exec:\rxlrxrf.exe226⤵PID:2848
-
\??\c:\5ttnhh.exec:\5ttnhh.exe227⤵PID:1172
-
\??\c:\vjvpj.exec:\vjvpj.exe228⤵PID:1324
-
\??\c:\pjpjv.exec:\pjpjv.exe229⤵PID:4636
-
\??\c:\lfxxllr.exec:\lfxxllr.exe230⤵PID:4260
-
\??\c:\flrlfff.exec:\flrlfff.exe231⤵PID:1612
-
\??\c:\htnhnb.exec:\htnhnb.exe232⤵PID:2352
-
\??\c:\btnnhb.exec:\btnnhb.exe233⤵PID:2716
-
\??\c:\jjddj.exec:\jjddj.exe234⤵PID:5084
-
\??\c:\rlrlffx.exec:\rlrlffx.exe235⤵PID:3240
-
\??\c:\llrlfff.exec:\llrlfff.exe236⤵PID:3912
-
\??\c:\hnttnb.exec:\hnttnb.exe237⤵PID:3596
-
\??\c:\hnbbhn.exec:\hnbbhn.exe238⤵PID:976
-
\??\c:\pjvpd.exec:\pjvpd.exe239⤵PID:2136
-
\??\c:\jvddp.exec:\jvddp.exe240⤵PID:2988
-
\??\c:\xrrrxrl.exec:\xrrrxrl.exe241⤵PID:4400
-
\??\c:\rrrlffx.exec:\rrrlffx.exe242⤵PID:3404