Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 10:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84d1963cdef0996a7b20a8f4b092ba7a33f02326f753317865f3640105e6a2e9.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
84d1963cdef0996a7b20a8f4b092ba7a33f02326f753317865f3640105e6a2e9.exe
-
Size
94KB
-
MD5
15aabe3ce919ebcbef36d032cd0d35c0
-
SHA1
deccf6316d3023b3bb23d3db50ec3f25e3f50c7b
-
SHA256
84d1963cdef0996a7b20a8f4b092ba7a33f02326f753317865f3640105e6a2e9
-
SHA512
cf5da920146eabf6b78dc3e83bbe079f42a78a0f8b021a0ac52842731e307cc00bd6a704f5a33f5935f2a80c2793c92e2505657ce7137403813a35723b7d0d5d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQ5:ymb3NkkiQ3mdBjFIj+qNhvZuHQY05
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/640-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpvdv.exentnbnn.exehtnhtn.exerflxlfx.exelxrlxrl.exebttnht.exejpvvj.exejvvpd.exe7xrlffr.exenbhbbh.exepjdjd.exefxrlxrl.exe5nhbbn.exehnnhhh.exevpjdj.exeffxxrrl.exehbbthb.exehtnhhb.exepjppp.exefflrlfx.exethhhbb.exeppddv.exepddvj.exelfrlfxr.exerxlfxrl.exenhhbbb.exevpvpd.exe9lxrffx.exennntnt.exevvppd.exexfrlxfr.exerrxxrxf.exehttthh.exebhbbtn.exepjdpd.exelfxlflf.exelflrrff.exedpjjd.exepjjdp.exexlrlflf.exetthhnn.exehhnttb.exedvddj.exelfxlxrl.exetbhbnn.exe9pvpv.exe9djdp.exexlxrrrl.exexfxrrll.exe1ttnhh.exeddvpj.exexxfrfll.exe1xxlfff.exenbnnnh.exehtttbb.exedjvpj.exexffxrlf.exe7lfxrrl.exebhbhbh.exehnnbtn.exedddvj.exedvvjd.exexrlflfl.exeflrlllf.exepid process 2712 vpvdv.exe 4348 ntnbnn.exe 2216 htnhtn.exe 552 rflxlfx.exe 1960 lxrlxrl.exe 2780 bttnht.exe 2608 jpvvj.exe 3004 jvvpd.exe 1772 7xrlffr.exe 1372 nbhbbh.exe 4232 pjdjd.exe 3212 fxrlxrl.exe 2980 5nhbbn.exe 2892 hnnhhh.exe 2344 vpjdj.exe 5068 ffxxrrl.exe 4660 hbbthb.exe 2348 htnhhb.exe 2876 pjppp.exe 748 fflrlfx.exe 2984 thhhbb.exe 3088 ppddv.exe 2180 pddvj.exe 5064 lfrlfxr.exe 380 rxlfxrl.exe 1420 nhhbbb.exe 528 vpvpd.exe 4984 9lxrffx.exe 1036 nnntnt.exe 404 vvppd.exe 2072 xfrlxfr.exe 716 rrxxrxf.exe 1972 httthh.exe 5092 bhbbtn.exe 4636 pjdpd.exe 1788 lfxlflf.exe 2660 lflrrff.exe 2296 dpjjd.exe 2188 pjjdp.exe 4520 xlrlflf.exe 100 tthhnn.exe 656 hhnttb.exe 3732 dvddj.exe 3604 lfxlxrl.exe 3004 tbhbnn.exe 1772 9pvpv.exe 3736 9djdp.exe 1224 xlxrrrl.exe 3644 xfxrrll.exe 4940 1ttnhh.exe 2492 ddvpj.exe 4816 xxfrfll.exe 448 1xxlfff.exe 2816 nbnnnh.exe 1760 htttbb.exe 1900 djvpj.exe 1400 xffxrlf.exe 3344 7lfxrrl.exe 916 bhbhbh.exe 1924 hnnbtn.exe 2872 dddvj.exe 3088 dvvjd.exe 3444 xrlflfl.exe 812 flrlllf.exe -
Processes:
resource yara_rule behavioral2/memory/640-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
84d1963cdef0996a7b20a8f4b092ba7a33f02326f753317865f3640105e6a2e9.exevpvdv.exentnbnn.exehtnhtn.exerflxlfx.exelxrlxrl.exebttnht.exejpvvj.exejvvpd.exe7xrlffr.exenbhbbh.exepjdjd.exefxrlxrl.exe5nhbbn.exehnnhhh.exevpjdj.exeffxxrrl.exehbbthb.exehtnhhb.exepjppp.exefflrlfx.exethhhbb.exedescription pid process target process PID 640 wrote to memory of 2712 640 84d1963cdef0996a7b20a8f4b092ba7a33f02326f753317865f3640105e6a2e9.exe vpvdv.exe PID 640 wrote to memory of 2712 640 84d1963cdef0996a7b20a8f4b092ba7a33f02326f753317865f3640105e6a2e9.exe vpvdv.exe PID 640 wrote to memory of 2712 640 84d1963cdef0996a7b20a8f4b092ba7a33f02326f753317865f3640105e6a2e9.exe vpvdv.exe PID 2712 wrote to memory of 4348 2712 vpvdv.exe ntnbnn.exe PID 2712 wrote to memory of 4348 2712 vpvdv.exe ntnbnn.exe PID 2712 wrote to memory of 4348 2712 vpvdv.exe ntnbnn.exe PID 4348 wrote to memory of 2216 4348 ntnbnn.exe htnhtn.exe PID 4348 wrote to memory of 2216 4348 ntnbnn.exe htnhtn.exe PID 4348 wrote to memory of 2216 4348 ntnbnn.exe htnhtn.exe PID 2216 wrote to memory of 552 2216 htnhtn.exe rflxlfx.exe PID 2216 wrote to memory of 552 2216 htnhtn.exe rflxlfx.exe PID 2216 wrote to memory of 552 2216 htnhtn.exe rflxlfx.exe PID 552 wrote to memory of 1960 552 rflxlfx.exe lxrlxrl.exe PID 552 wrote to memory of 1960 552 rflxlfx.exe lxrlxrl.exe PID 552 wrote to memory of 1960 552 rflxlfx.exe lxrlxrl.exe PID 1960 wrote to memory of 2780 1960 lxrlxrl.exe bttnht.exe PID 1960 wrote to memory of 2780 1960 lxrlxrl.exe bttnht.exe PID 1960 wrote to memory of 2780 1960 lxrlxrl.exe bttnht.exe PID 2780 wrote to memory of 2608 2780 bttnht.exe jpvvj.exe PID 2780 wrote to memory of 2608 2780 bttnht.exe jpvvj.exe PID 2780 wrote to memory of 2608 2780 bttnht.exe jpvvj.exe PID 2608 wrote to memory of 3004 2608 jpvvj.exe jvvpd.exe PID 2608 wrote to memory of 3004 2608 jpvvj.exe jvvpd.exe PID 2608 wrote to memory of 3004 2608 jpvvj.exe jvvpd.exe PID 3004 wrote to memory of 1772 3004 jvvpd.exe 7xrlffr.exe PID 3004 wrote to memory of 1772 3004 jvvpd.exe 7xrlffr.exe PID 3004 wrote to memory of 1772 3004 jvvpd.exe 7xrlffr.exe PID 1772 wrote to memory of 1372 1772 7xrlffr.exe nbhbbh.exe PID 1772 wrote to memory of 1372 1772 7xrlffr.exe nbhbbh.exe PID 1772 wrote to memory of 1372 1772 7xrlffr.exe nbhbbh.exe PID 1372 wrote to memory of 4232 1372 nbhbbh.exe pjdjd.exe PID 1372 wrote to memory of 4232 1372 nbhbbh.exe pjdjd.exe PID 1372 wrote to memory of 4232 1372 nbhbbh.exe pjdjd.exe PID 4232 wrote to memory of 3212 4232 pjdjd.exe fxrlxrl.exe PID 4232 wrote to memory of 3212 4232 pjdjd.exe fxrlxrl.exe PID 4232 wrote to memory of 3212 4232 pjdjd.exe fxrlxrl.exe PID 3212 wrote to memory of 2980 3212 fxrlxrl.exe 5nhbbn.exe PID 3212 wrote to memory of 2980 3212 fxrlxrl.exe 5nhbbn.exe PID 3212 wrote to memory of 2980 3212 fxrlxrl.exe 5nhbbn.exe PID 2980 wrote to memory of 2892 2980 5nhbbn.exe hnnhhh.exe PID 2980 wrote to memory of 2892 2980 5nhbbn.exe hnnhhh.exe PID 2980 wrote to memory of 2892 2980 5nhbbn.exe hnnhhh.exe PID 2892 wrote to memory of 2344 2892 hnnhhh.exe vpjdj.exe PID 2892 wrote to memory of 2344 2892 hnnhhh.exe vpjdj.exe PID 2892 wrote to memory of 2344 2892 hnnhhh.exe vpjdj.exe PID 2344 wrote to memory of 5068 2344 vpjdj.exe ffxxrrl.exe PID 2344 wrote to memory of 5068 2344 vpjdj.exe ffxxrrl.exe PID 2344 wrote to memory of 5068 2344 vpjdj.exe ffxxrrl.exe PID 5068 wrote to memory of 4660 5068 ffxxrrl.exe hbbthb.exe PID 5068 wrote to memory of 4660 5068 ffxxrrl.exe hbbthb.exe PID 5068 wrote to memory of 4660 5068 ffxxrrl.exe hbbthb.exe PID 4660 wrote to memory of 2348 4660 hbbthb.exe htnhhb.exe PID 4660 wrote to memory of 2348 4660 hbbthb.exe htnhhb.exe PID 4660 wrote to memory of 2348 4660 hbbthb.exe htnhhb.exe PID 2348 wrote to memory of 2876 2348 htnhhb.exe pjppp.exe PID 2348 wrote to memory of 2876 2348 htnhhb.exe pjppp.exe PID 2348 wrote to memory of 2876 2348 htnhhb.exe pjppp.exe PID 2876 wrote to memory of 748 2876 pjppp.exe fflrlfx.exe PID 2876 wrote to memory of 748 2876 pjppp.exe fflrlfx.exe PID 2876 wrote to memory of 748 2876 pjppp.exe fflrlfx.exe PID 748 wrote to memory of 2984 748 fflrlfx.exe thhhbb.exe PID 748 wrote to memory of 2984 748 fflrlfx.exe thhhbb.exe PID 748 wrote to memory of 2984 748 fflrlfx.exe thhhbb.exe PID 2984 wrote to memory of 3088 2984 thhhbb.exe ppddv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84d1963cdef0996a7b20a8f4b092ba7a33f02326f753317865f3640105e6a2e9.exe"C:\Users\Admin\AppData\Local\Temp\84d1963cdef0996a7b20a8f4b092ba7a33f02326f753317865f3640105e6a2e9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\vpvdv.exec:\vpvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ntnbnn.exec:\ntnbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\htnhtn.exec:\htnhtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\rflxlfx.exec:\rflxlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\lxrlxrl.exec:\lxrlxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\bttnht.exec:\bttnht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\jpvvj.exec:\jpvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\jvvpd.exec:\jvvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\7xrlffr.exec:\7xrlffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\nbhbbh.exec:\nbhbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\pjdjd.exec:\pjdjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\5nhbbn.exec:\5nhbbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\hnnhhh.exec:\hnnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\vpjdj.exec:\vpjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\ffxxrrl.exec:\ffxxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\hbbthb.exec:\hbbthb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\htnhhb.exec:\htnhhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\pjppp.exec:\pjppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\fflrlfx.exec:\fflrlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\thhhbb.exec:\thhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\ppddv.exec:\ppddv.exe23⤵
- Executes dropped EXE
PID:3088 -
\??\c:\pddvj.exec:\pddvj.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe25⤵
- Executes dropped EXE
PID:5064 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe26⤵
- Executes dropped EXE
PID:380 -
\??\c:\nhhbbb.exec:\nhhbbb.exe27⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vpvpd.exec:\vpvpd.exe28⤵
- Executes dropped EXE
PID:528 -
\??\c:\9lxrffx.exec:\9lxrffx.exe29⤵
- Executes dropped EXE
PID:4984 -
\??\c:\nnntnt.exec:\nnntnt.exe30⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vvppd.exec:\vvppd.exe31⤵
- Executes dropped EXE
PID:404 -
\??\c:\xfrlxfr.exec:\xfrlxfr.exe32⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rrxxrxf.exec:\rrxxrxf.exe33⤵
- Executes dropped EXE
PID:716 -
\??\c:\httthh.exec:\httthh.exe34⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bhbbtn.exec:\bhbbtn.exe35⤵
- Executes dropped EXE
PID:5092 -
\??\c:\pjdpd.exec:\pjdpd.exe36⤵
- Executes dropped EXE
PID:4636 -
\??\c:\lfxlflf.exec:\lfxlflf.exe37⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lflrrff.exec:\lflrrff.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dpjjd.exec:\dpjjd.exe39⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pjjdp.exec:\pjjdp.exe40⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xlrlflf.exec:\xlrlflf.exe41⤵
- Executes dropped EXE
PID:4520 -
\??\c:\tthhnn.exec:\tthhnn.exe42⤵
- Executes dropped EXE
PID:100 -
\??\c:\hhnttb.exec:\hhnttb.exe43⤵
- Executes dropped EXE
PID:656 -
\??\c:\dvddj.exec:\dvddj.exe44⤵
- Executes dropped EXE
PID:3732 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe45⤵
- Executes dropped EXE
PID:3604 -
\??\c:\tbhbnn.exec:\tbhbnn.exe46⤵
- Executes dropped EXE
PID:3004 -
\??\c:\9pvpv.exec:\9pvpv.exe47⤵
- Executes dropped EXE
PID:1772 -
\??\c:\9djdp.exec:\9djdp.exe48⤵
- Executes dropped EXE
PID:3736 -
\??\c:\xlxrrrl.exec:\xlxrrrl.exe49⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xfxrrll.exec:\xfxrrll.exe50⤵
- Executes dropped EXE
PID:3644 -
\??\c:\1ttnhh.exec:\1ttnhh.exe51⤵
- Executes dropped EXE
PID:4940 -
\??\c:\ddvpj.exec:\ddvpj.exe52⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xxfrfll.exec:\xxfrfll.exe53⤵
- Executes dropped EXE
PID:4816 -
\??\c:\1xxlfff.exec:\1xxlfff.exe54⤵
- Executes dropped EXE
PID:448 -
\??\c:\nbnnnh.exec:\nbnnnh.exe55⤵
- Executes dropped EXE
PID:2816 -
\??\c:\htttbb.exec:\htttbb.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\djvpj.exec:\djvpj.exe57⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xffxrlf.exec:\xffxrlf.exe58⤵
- Executes dropped EXE
PID:1400 -
\??\c:\7lfxrrl.exec:\7lfxrrl.exe59⤵
- Executes dropped EXE
PID:3344 -
\??\c:\bhbhbh.exec:\bhbhbh.exe60⤵
- Executes dropped EXE
PID:916 -
\??\c:\hnnbtn.exec:\hnnbtn.exe61⤵
- Executes dropped EXE
PID:1924 -
\??\c:\dddvj.exec:\dddvj.exe62⤵
- Executes dropped EXE
PID:2872 -
\??\c:\dvvjd.exec:\dvvjd.exe63⤵
- Executes dropped EXE
PID:3088 -
\??\c:\xrlflfl.exec:\xrlflfl.exe64⤵
- Executes dropped EXE
PID:3444 -
\??\c:\flrlllf.exec:\flrlllf.exe65⤵
- Executes dropped EXE
PID:812 -
\??\c:\btbttn.exec:\btbttn.exe66⤵PID:3900
-
\??\c:\bhnbtn.exec:\bhnbtn.exe67⤵PID:2112
-
\??\c:\pddvp.exec:\pddvp.exe68⤵PID:5108
-
\??\c:\jddvd.exec:\jddvd.exe69⤵PID:4748
-
\??\c:\9lxrxxf.exec:\9lxrxxf.exe70⤵PID:4984
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe71⤵PID:1988
-
\??\c:\5nhbth.exec:\5nhbth.exe72⤵PID:2548
-
\??\c:\nbbbbt.exec:\nbbbbt.exe73⤵PID:2676
-
\??\c:\3ppjv.exec:\3ppjv.exe74⤵PID:1976
-
\??\c:\9llfrll.exec:\9llfrll.exe75⤵PID:3464
-
\??\c:\bnnhhb.exec:\bnnhhb.exe76⤵PID:396
-
\??\c:\nnbnnb.exec:\nnbnnb.exe77⤵PID:5092
-
\??\c:\3jvpd.exec:\3jvpd.exe78⤵PID:4636
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe79⤵PID:2976
-
\??\c:\1rlxrfr.exec:\1rlxrfr.exe80⤵PID:2660
-
\??\c:\lllxrrr.exec:\lllxrrr.exe81⤵PID:3536
-
\??\c:\hhhhht.exec:\hhhhht.exe82⤵PID:3240
-
\??\c:\jdddp.exec:\jdddp.exe83⤵PID:2884
-
\??\c:\fxrrxxx.exec:\fxrrxxx.exe84⤵PID:3928
-
\??\c:\llrrrrr.exec:\llrrrrr.exe85⤵PID:2712
-
\??\c:\nnntnn.exec:\nnntnn.exe86⤵PID:1968
-
\??\c:\ddvdv.exec:\ddvdv.exe87⤵PID:3480
-
\??\c:\rrllfll.exec:\rrllfll.exe88⤵PID:552
-
\??\c:\1ffffff.exec:\1ffffff.exe89⤵PID:3524
-
\??\c:\7thhnt.exec:\7thhnt.exe90⤵PID:3244
-
\??\c:\bbhhbb.exec:\bbhhbb.exe91⤵PID:3236
-
\??\c:\dpjpj.exec:\dpjpj.exe92⤵PID:2956
-
\??\c:\flllllr.exec:\flllllr.exe93⤵PID:5048
-
\??\c:\3xxxxxr.exec:\3xxxxxr.exe94⤵PID:2752
-
\??\c:\nnttnt.exec:\nnttnt.exe95⤵PID:1772
-
\??\c:\hnbtbb.exec:\hnbtbb.exe96⤵PID:1296
-
\??\c:\ddjdd.exec:\ddjdd.exe97⤵PID:1740
-
\??\c:\ppdvv.exec:\ppdvv.exe98⤵PID:2412
-
\??\c:\flfxrxr.exec:\flfxrxr.exe99⤵PID:4740
-
\??\c:\frfrxff.exec:\frfrxff.exe100⤵PID:4956
-
\??\c:\ntbhhn.exec:\ntbhhn.exe101⤵PID:4816
-
\??\c:\hthhtn.exec:\hthhtn.exe102⤵PID:448
-
\??\c:\pvddd.exec:\pvddd.exe103⤵PID:964
-
\??\c:\djpvv.exec:\djpvv.exe104⤵PID:2456
-
\??\c:\3rfxrrr.exec:\3rfxrrr.exe105⤵PID:2348
-
\??\c:\rlrlrxx.exec:\rlrlrxx.exe106⤵PID:2672
-
\??\c:\hnntnt.exec:\hnntnt.exe107⤵PID:2876
-
\??\c:\nbhbbb.exec:\nbhbbb.exe108⤵PID:4500
-
\??\c:\1hnhnt.exec:\1hnhnt.exe109⤵PID:1484
-
\??\c:\ddjdv.exec:\ddjdv.exe110⤵PID:4396
-
\??\c:\ddddv.exec:\ddddv.exe111⤵PID:1312
-
\??\c:\rrxrlrl.exec:\rrxrlrl.exe112⤵PID:4184
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe113⤵PID:4416
-
\??\c:\3thhbh.exec:\3thhbh.exe114⤵PID:4012
-
\??\c:\tbnnhn.exec:\tbnnhn.exe115⤵PID:1108
-
\??\c:\dddvd.exec:\dddvd.exe116⤵PID:1692
-
\??\c:\pvdjj.exec:\pvdjj.exe117⤵PID:1200
-
\??\c:\jjdjv.exec:\jjdjv.exe118⤵PID:3168
-
\??\c:\xllffff.exec:\xllffff.exe119⤵PID:3888
-
\??\c:\lfllffx.exec:\lfllffx.exe120⤵PID:1172
-
\??\c:\tbntnt.exec:\tbntnt.exe121⤵PID:2760
-
\??\c:\1nthbh.exec:\1nthbh.exe122⤵PID:1972
-
\??\c:\vpvdp.exec:\vpvdp.exe123⤵PID:4564
-
\??\c:\pppjd.exec:\pppjd.exe124⤵PID:4008
-
\??\c:\pvppp.exec:\pvppp.exe125⤵PID:1272
-
\??\c:\fxxrrlf.exec:\fxxrrlf.exe126⤵PID:4508
-
\??\c:\flxxxxf.exec:\flxxxxf.exe127⤵PID:1732
-
\??\c:\3hnttb.exec:\3hnttb.exe128⤵PID:2572
-
\??\c:\bnttnt.exec:\bnttnt.exe129⤵PID:2884
-
\??\c:\jdddv.exec:\jdddv.exe130⤵PID:3928
-
\??\c:\ppvjj.exec:\ppvjj.exe131⤵PID:1416
-
\??\c:\xxrlffl.exec:\xxrlffl.exe132⤵PID:1968
-
\??\c:\7xrrrxx.exec:\7xrrrxx.exe133⤵PID:2064
-
\??\c:\rfxxxxx.exec:\rfxxxxx.exe134⤵PID:4756
-
\??\c:\5thnnb.exec:\5thnnb.exe135⤵PID:1040
-
\??\c:\tbhhnn.exec:\tbhhnn.exe136⤵PID:3244
-
\??\c:\dvjjd.exec:\dvjjd.exe137⤵PID:3236
-
\??\c:\dvdvp.exec:\dvdvp.exe138⤵PID:1784
-
\??\c:\xlrrlll.exec:\xlrrlll.exe139⤵PID:1372
-
\??\c:\rlfxrlx.exec:\rlfxrlx.exe140⤵PID:3448
-
\??\c:\djdvp.exec:\djdvp.exe141⤵PID:1740
-
\??\c:\llrxfrx.exec:\llrxfrx.exe142⤵PID:2504
-
\??\c:\rflllll.exec:\rflllll.exe143⤵PID:4148
-
\??\c:\3bhhbb.exec:\3bhhbb.exe144⤵PID:4156
-
\??\c:\hntttt.exec:\hntttt.exe145⤵PID:712
-
\??\c:\jdddj.exec:\jdddj.exe146⤵PID:1400
-
\??\c:\pvppv.exec:\pvppv.exe147⤵PID:2124
-
\??\c:\rrfllrl.exec:\rrfllrl.exe148⤵PID:4372
-
\??\c:\7xrrrrl.exec:\7xrrrrl.exe149⤵PID:3784
-
\??\c:\ntnnhn.exec:\ntnnhn.exe150⤵PID:512
-
\??\c:\nbhhbn.exec:\nbhhbn.exe151⤵PID:3444
-
\??\c:\jjppp.exec:\jjppp.exe152⤵PID:1792
-
\??\c:\ffxxxxf.exec:\ffxxxxf.exe153⤵PID:4632
-
\??\c:\lllllll.exec:\lllllll.exe154⤵PID:4012
-
\??\c:\hnhnnt.exec:\hnhnnt.exe155⤵PID:1108
-
\??\c:\djjjd.exec:\djjjd.exe156⤵PID:2588
-
\??\c:\jdjjd.exec:\jdjjd.exe157⤵PID:3740
-
\??\c:\hhnnhb.exec:\hhnnhb.exe158⤵PID:3168
-
\??\c:\3jvvp.exec:\3jvvp.exe159⤵PID:2676
-
\??\c:\3vjjj.exec:\3vjjj.exe160⤵PID:1976
-
\??\c:\lxxxrrf.exec:\lxxxrrf.exe161⤵PID:2432
-
\??\c:\9xlrxxx.exec:\9xlrxxx.exe162⤵PID:4760
-
\??\c:\pppvv.exec:\pppvv.exe163⤵PID:3148
-
\??\c:\jdjdv.exec:\jdjdv.exe164⤵PID:2188
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe165⤵PID:516
-
\??\c:\hnhhtn.exec:\hnhhtn.exe166⤵PID:3772
-
\??\c:\1jpvd.exec:\1jpvd.exe167⤵PID:4284
-
\??\c:\xfxxfll.exec:\xfxxfll.exe168⤵PID:2904
-
\??\c:\btttbh.exec:\btttbh.exe169⤵PID:3160
-
\??\c:\jjddd.exec:\jjddd.exe170⤵PID:1812
-
\??\c:\rrllrrf.exec:\rrllrrf.exe171⤵PID:1408
-
\??\c:\9frlfll.exec:\9frlfll.exe172⤵PID:4088
-
\??\c:\bbhhbh.exec:\bbhhbh.exe173⤵PID:668
-
\??\c:\pvjjp.exec:\pvjjp.exe174⤵PID:656
-
\??\c:\lxrrfff.exec:\lxrrfff.exe175⤵PID:1996
-
\??\c:\5nnntb.exec:\5nnntb.exe176⤵PID:4080
-
\??\c:\ddvjj.exec:\ddvjj.exe177⤵PID:3440
-
\??\c:\jvddd.exec:\jvddd.exe178⤵PID:4252
-
\??\c:\rrffrxl.exec:\rrffrxl.exe179⤵PID:3212
-
\??\c:\rllllxf.exec:\rllllxf.exe180⤵PID:4900
-
\??\c:\nbbbbb.exec:\nbbbbb.exe181⤵PID:4740
-
\??\c:\bbntbh.exec:\bbntbh.exe182⤵PID:4064
-
\??\c:\dppdd.exec:\dppdd.exe183⤵PID:1436
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe184⤵PID:1900
-
\??\c:\xxrlfll.exec:\xxrlfll.exe185⤵PID:2600
-
\??\c:\nhnnhn.exec:\nhnnhn.exe186⤵PID:1924
-
\??\c:\tttbnn.exec:\tttbnn.exe187⤵PID:708
-
\??\c:\1ddvp.exec:\1ddvp.exe188⤵PID:1484
-
\??\c:\pddvp.exec:\pddvp.exe189⤵PID:4396
-
\??\c:\fxffrrr.exec:\fxffrrr.exe190⤵PID:812
-
\??\c:\bnnttt.exec:\bnnttt.exe191⤵PID:1152
-
\??\c:\hhhbbh.exec:\hhhbbh.exe192⤵PID:1516
-
\??\c:\vjjvj.exec:\vjjvj.exe193⤵PID:3180
-
\??\c:\3vjjj.exec:\3vjjj.exe194⤵PID:2896
-
\??\c:\9rrfxfr.exec:\9rrfxfr.exe195⤵PID:920
-
\??\c:\frrrllf.exec:\frrrllf.exe196⤵PID:528
-
\??\c:\hntttt.exec:\hntttt.exe197⤵PID:1192
-
\??\c:\nhhhtn.exec:\nhhhtn.exe198⤵PID:1584
-
\??\c:\pdvvv.exec:\pdvvv.exe199⤵PID:2264
-
\??\c:\jvddd.exec:\jvddd.exe200⤵PID:1872
-
\??\c:\xrxrffx.exec:\xrxrffx.exe201⤵PID:4760
-
\??\c:\fxllffr.exec:\fxllffr.exe202⤵PID:3148
-
\??\c:\bthhhn.exec:\bthhhn.exe203⤵PID:3240
-
\??\c:\djpjv.exec:\djpjv.exe204⤵PID:516
-
\??\c:\jdvpd.exec:\jdvpd.exe205⤵PID:3892
-
\??\c:\9llxrlf.exec:\9llxrlf.exe206⤵PID:4284
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe207⤵PID:1684
-
\??\c:\nnttnh.exec:\nnttnh.exe208⤵PID:3160
-
\??\c:\ntnbnh.exec:\ntnbnh.exe209⤵PID:100
-
\??\c:\jvdvv.exec:\jvdvv.exe210⤵PID:1408
-
\??\c:\9llxrlf.exec:\9llxrlf.exe211⤵PID:3524
-
\??\c:\9nhbth.exec:\9nhbth.exe212⤵PID:3112
-
\??\c:\bthttn.exec:\bthttn.exe213⤵PID:656
-
\??\c:\jdjdv.exec:\jdjdv.exe214⤵PID:5020
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe215⤵PID:4732
-
\??\c:\1hnnnn.exec:\1hnnnn.exe216⤵PID:3440
-
\??\c:\tttnhb.exec:\tttnhb.exe217⤵PID:4104
-
\??\c:\pvvpj.exec:\pvvpj.exe218⤵PID:2492
-
\??\c:\lffrffx.exec:\lffrffx.exe219⤵PID:4956
-
\??\c:\bbnhtb.exec:\bbnhtb.exe220⤵PID:3748
-
\??\c:\xxlffxx.exec:\xxlffxx.exe221⤵PID:1744
-
\??\c:\9nhbtn.exec:\9nhbtn.exe222⤵PID:2672
-
\??\c:\ddpdj.exec:\ddpdj.exe223⤵PID:1900
-
\??\c:\frxlxrl.exec:\frxlxrl.exe224⤵PID:2600
-
\??\c:\bbttnn.exec:\bbttnn.exe225⤵PID:3336
-
\??\c:\tnnnbt.exec:\tnnnbt.exe226⤵PID:2372
-
\??\c:\9vdvd.exec:\9vdvd.exe227⤵PID:1484
-
\??\c:\nnhbhn.exec:\nnhbhn.exe228⤵PID:4184
-
\??\c:\jpvvp.exec:\jpvvp.exe229⤵PID:1864
-
\??\c:\hhnnnh.exec:\hhnnnh.exe230⤵PID:1512
-
\??\c:\hnnhtb.exec:\hnnhtb.exe231⤵PID:2520
-
\??\c:\vpjjd.exec:\vpjjd.exe232⤵PID:2588
-
\??\c:\dvddv.exec:\dvddv.exe233⤵PID:4352
-
\??\c:\3xrllll.exec:\3xrllll.exe234⤵PID:3380
-
\??\c:\tnttnb.exec:\tnttnb.exe235⤵PID:4544
-
\??\c:\ddjpp.exec:\ddjpp.exe236⤵PID:1972
-
\??\c:\rflffxf.exec:\rflffxf.exe237⤵PID:1492
-
\??\c:\3xxrllf.exec:\3xxrllf.exe238⤵PID:2660
-
\??\c:\nnhbth.exec:\nnhbth.exe239⤵PID:1696
-
\??\c:\jjpjj.exec:\jjpjj.exe240⤵PID:3960
-
\??\c:\vvjdv.exec:\vvjdv.exe241⤵PID:4520
-
\??\c:\pdvdd.exec:\pdvdd.exe242⤵PID:4880