Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe
-
Size
122KB
-
MD5
d4fc4182c3eb642461b64c107ecc3200
-
SHA1
3fefe16296f825cf7c9e8ef9a485f99ef6aa8967
-
SHA256
aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b
-
SHA512
6faf5009c7d489ae52c932f09c13c74ae9a324bce146a3bac1454729914f5aa020d288a3c8c306ce8283961ca09439ecc4630323d6d7b0709ecd272e9fbaca12
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX90Ifcr:n3C9BRW0j/uVEZFmIkr
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/1020-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jddvv.exe7ffxllf.exe9bbtnn.exe9bbnnn.exexlflfff.exebttbtt.exebhnttn.exepvdvj.exexfrrllf.exerflfxxr.exebbbtnh.exevdvpd.exexrrrrlr.exetttnnh.exejjdvd.exefxrlffx.exe5bnnhn.exevjvdp.exedjpjv.exeffrlfxx.exexllflff.exe5thtnh.exe5ppjv.exepvdpj.exerrrlxxl.exe5hbtbt.exejpdjv.exelxxlxxr.exentthhn.exefrlfrrl.exerlxrlfx.exehbhbhh.exepjjdv.exevddvp.exelxrlffx.exe5ddvp.exejvvjd.exefxxrxxr.exe3ttnnn.exeflllfff.exetntnhh.exevpdvp.exelrxxlfx.exenhnthh.exebnhtnh.exelfrrllx.exebtbhht.exehbhntn.exejvjdp.exexxrllff.exebthhth.exevjddp.exejvdvj.exexflxfxr.exettbtnt.exedppjv.exeflxxrrl.exe7hhbtn.exe9nnbnh.exejdjjv.exeffllfxf.exe1hnnhh.exedpvpj.exe7pvjj.exepid process 1352 jddvv.exe 4816 7ffxllf.exe 4472 9bbtnn.exe 3096 9bbnnn.exe 1396 xlflfff.exe 4116 bttbtt.exe 4488 bhnttn.exe 1468 pvdvj.exe 3652 xfrrllf.exe 952 rflfxxr.exe 3472 bbbtnh.exe 4788 vdvpd.exe 3304 xrrrrlr.exe 1564 tttnnh.exe 4932 jjdvd.exe 2204 fxrlffx.exe 5068 5bnnhn.exe 1280 vjvdp.exe 5016 djpjv.exe 3876 ffrlfxx.exe 4476 xllflff.exe 2104 5thtnh.exe 1380 5ppjv.exe 2624 pvdpj.exe 2464 rrrlxxl.exe 4512 5hbtbt.exe 1404 jpdjv.exe 1012 lxxlxxr.exe 3488 ntthhn.exe 3248 frlfrrl.exe 1624 rlxrlfx.exe 4908 hbhbhh.exe 3356 pjjdv.exe 3268 vddvp.exe 632 lxrlffx.exe 1784 5ddvp.exe 3968 jvvjd.exe 4080 fxxrxxr.exe 2980 3ttnnn.exe 4648 flllfff.exe 2536 tntnhh.exe 4524 vpdvp.exe 4792 lrxxlfx.exe 2560 nhnthh.exe 4556 bnhtnh.exe 4328 lfrrllx.exe 4296 btbhht.exe 4452 hbhntn.exe 2552 jvjdp.exe 3180 xxrllff.exe 4196 bthhth.exe 3372 vjddp.exe 2968 jvdvj.exe 2424 xflxfxr.exe 2960 ttbtnt.exe 2316 dppjv.exe 1908 flxxrrl.exe 684 7hhbtn.exe 4228 9nnbnh.exe 1952 jdjjv.exe 3288 ffllfxf.exe 3092 1hnnhh.exe 2900 dpvpj.exe 3552 7pvjj.exe -
Processes:
resource yara_rule behavioral2/memory/1020-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exejddvv.exe7ffxllf.exe9bbtnn.exe9bbnnn.exexlflfff.exebttbtt.exebhnttn.exepvdvj.exexfrrllf.exerflfxxr.exebbbtnh.exevdvpd.exexrrrrlr.exetttnnh.exejjdvd.exefxrlffx.exe5bnnhn.exevjvdp.exedjpjv.exeffrlfxx.exexllflff.exedescription pid process target process PID 1020 wrote to memory of 1352 1020 aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe jddvv.exe PID 1020 wrote to memory of 1352 1020 aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe jddvv.exe PID 1020 wrote to memory of 1352 1020 aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe jddvv.exe PID 1352 wrote to memory of 4816 1352 jddvv.exe 7ffxllf.exe PID 1352 wrote to memory of 4816 1352 jddvv.exe 7ffxllf.exe PID 1352 wrote to memory of 4816 1352 jddvv.exe 7ffxllf.exe PID 4816 wrote to memory of 4472 4816 7ffxllf.exe 9bbtnn.exe PID 4816 wrote to memory of 4472 4816 7ffxllf.exe 9bbtnn.exe PID 4816 wrote to memory of 4472 4816 7ffxllf.exe 9bbtnn.exe PID 4472 wrote to memory of 3096 4472 9bbtnn.exe 9bbnnn.exe PID 4472 wrote to memory of 3096 4472 9bbtnn.exe 9bbnnn.exe PID 4472 wrote to memory of 3096 4472 9bbtnn.exe 9bbnnn.exe PID 3096 wrote to memory of 1396 3096 9bbnnn.exe xlflfff.exe PID 3096 wrote to memory of 1396 3096 9bbnnn.exe xlflfff.exe PID 3096 wrote to memory of 1396 3096 9bbnnn.exe xlflfff.exe PID 1396 wrote to memory of 4116 1396 xlflfff.exe bttbtt.exe PID 1396 wrote to memory of 4116 1396 xlflfff.exe bttbtt.exe PID 1396 wrote to memory of 4116 1396 xlflfff.exe bttbtt.exe PID 4116 wrote to memory of 4488 4116 bttbtt.exe bhnttn.exe PID 4116 wrote to memory of 4488 4116 bttbtt.exe bhnttn.exe PID 4116 wrote to memory of 4488 4116 bttbtt.exe bhnttn.exe PID 4488 wrote to memory of 1468 4488 bhnttn.exe pvdvj.exe PID 4488 wrote to memory of 1468 4488 bhnttn.exe pvdvj.exe PID 4488 wrote to memory of 1468 4488 bhnttn.exe pvdvj.exe PID 1468 wrote to memory of 3652 1468 pvdvj.exe xfrrllf.exe PID 1468 wrote to memory of 3652 1468 pvdvj.exe xfrrllf.exe PID 1468 wrote to memory of 3652 1468 pvdvj.exe xfrrllf.exe PID 3652 wrote to memory of 952 3652 xfrrllf.exe rflfxxr.exe PID 3652 wrote to memory of 952 3652 xfrrllf.exe rflfxxr.exe PID 3652 wrote to memory of 952 3652 xfrrllf.exe rflfxxr.exe PID 952 wrote to memory of 3472 952 rflfxxr.exe bbbtnh.exe PID 952 wrote to memory of 3472 952 rflfxxr.exe bbbtnh.exe PID 952 wrote to memory of 3472 952 rflfxxr.exe bbbtnh.exe PID 3472 wrote to memory of 4788 3472 bbbtnh.exe vdvpd.exe PID 3472 wrote to memory of 4788 3472 bbbtnh.exe vdvpd.exe PID 3472 wrote to memory of 4788 3472 bbbtnh.exe vdvpd.exe PID 4788 wrote to memory of 3304 4788 vdvpd.exe xrrrrlr.exe PID 4788 wrote to memory of 3304 4788 vdvpd.exe xrrrrlr.exe PID 4788 wrote to memory of 3304 4788 vdvpd.exe xrrrrlr.exe PID 3304 wrote to memory of 1564 3304 xrrrrlr.exe tttnnh.exe PID 3304 wrote to memory of 1564 3304 xrrrrlr.exe tttnnh.exe PID 3304 wrote to memory of 1564 3304 xrrrrlr.exe tttnnh.exe PID 1564 wrote to memory of 4932 1564 tttnnh.exe jjdvd.exe PID 1564 wrote to memory of 4932 1564 tttnnh.exe jjdvd.exe PID 1564 wrote to memory of 4932 1564 tttnnh.exe jjdvd.exe PID 4932 wrote to memory of 2204 4932 jjdvd.exe fxrlffx.exe PID 4932 wrote to memory of 2204 4932 jjdvd.exe fxrlffx.exe PID 4932 wrote to memory of 2204 4932 jjdvd.exe fxrlffx.exe PID 2204 wrote to memory of 5068 2204 fxrlffx.exe 5bnnhn.exe PID 2204 wrote to memory of 5068 2204 fxrlffx.exe 5bnnhn.exe PID 2204 wrote to memory of 5068 2204 fxrlffx.exe 5bnnhn.exe PID 5068 wrote to memory of 1280 5068 5bnnhn.exe vjvdp.exe PID 5068 wrote to memory of 1280 5068 5bnnhn.exe vjvdp.exe PID 5068 wrote to memory of 1280 5068 5bnnhn.exe vjvdp.exe PID 1280 wrote to memory of 5016 1280 vjvdp.exe djpjv.exe PID 1280 wrote to memory of 5016 1280 vjvdp.exe djpjv.exe PID 1280 wrote to memory of 5016 1280 vjvdp.exe djpjv.exe PID 5016 wrote to memory of 3876 5016 djpjv.exe ffrlfxx.exe PID 5016 wrote to memory of 3876 5016 djpjv.exe ffrlfxx.exe PID 5016 wrote to memory of 3876 5016 djpjv.exe ffrlfxx.exe PID 3876 wrote to memory of 4476 3876 ffrlfxx.exe xllflff.exe PID 3876 wrote to memory of 4476 3876 ffrlfxx.exe xllflff.exe PID 3876 wrote to memory of 4476 3876 ffrlfxx.exe xllflff.exe PID 4476 wrote to memory of 2104 4476 xllflff.exe 5thtnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe"C:\Users\Admin\AppData\Local\Temp\aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\jddvv.exec:\jddvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\7ffxllf.exec:\7ffxllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\9bbtnn.exec:\9bbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\9bbnnn.exec:\9bbnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\xlflfff.exec:\xlflfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\bttbtt.exec:\bttbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\bhnttn.exec:\bhnttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\pvdvj.exec:\pvdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\xfrrllf.exec:\xfrrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\rflfxxr.exec:\rflfxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\bbbtnh.exec:\bbbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\vdvpd.exec:\vdvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\xrrrrlr.exec:\xrrrrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\tttnnh.exec:\tttnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\jjdvd.exec:\jjdvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\fxrlffx.exec:\fxrlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\5bnnhn.exec:\5bnnhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\vjvdp.exec:\vjvdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\djpjv.exec:\djpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\ffrlfxx.exec:\ffrlfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\xllflff.exec:\xllflff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\5thtnh.exec:\5thtnh.exe23⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5ppjv.exec:\5ppjv.exe24⤵
- Executes dropped EXE
PID:1380 -
\??\c:\pvdpj.exec:\pvdpj.exe25⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rrrlxxl.exec:\rrrlxxl.exe26⤵
- Executes dropped EXE
PID:2464 -
\??\c:\5hbtbt.exec:\5hbtbt.exe27⤵
- Executes dropped EXE
PID:4512 -
\??\c:\jpdjv.exec:\jpdjv.exe28⤵
- Executes dropped EXE
PID:1404 -
\??\c:\lxxlxxr.exec:\lxxlxxr.exe29⤵
- Executes dropped EXE
PID:1012 -
\??\c:\ntthhn.exec:\ntthhn.exe30⤵
- Executes dropped EXE
PID:3488 -
\??\c:\frlfrrl.exec:\frlfrrl.exe31⤵
- Executes dropped EXE
PID:3248 -
\??\c:\rlxrlfx.exec:\rlxrlfx.exe32⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hbhbhh.exec:\hbhbhh.exe33⤵
- Executes dropped EXE
PID:4908 -
\??\c:\pjjdv.exec:\pjjdv.exe34⤵
- Executes dropped EXE
PID:3356 -
\??\c:\vddvp.exec:\vddvp.exe35⤵
- Executes dropped EXE
PID:3268 -
\??\c:\lxrlffx.exec:\lxrlffx.exe36⤵
- Executes dropped EXE
PID:632 -
\??\c:\5ddvp.exec:\5ddvp.exe37⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jvvjd.exec:\jvvjd.exe38⤵
- Executes dropped EXE
PID:3968 -
\??\c:\fxxrxxr.exec:\fxxrxxr.exe39⤵
- Executes dropped EXE
PID:4080 -
\??\c:\3ttnnn.exec:\3ttnnn.exe40⤵
- Executes dropped EXE
PID:2980 -
\??\c:\flllfff.exec:\flllfff.exe41⤵
- Executes dropped EXE
PID:4648 -
\??\c:\tntnhh.exec:\tntnhh.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vpdvp.exec:\vpdvp.exe43⤵
- Executes dropped EXE
PID:4524 -
\??\c:\lrxxlfx.exec:\lrxxlfx.exe44⤵
- Executes dropped EXE
PID:4792 -
\??\c:\nhnthh.exec:\nhnthh.exe45⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bnhtnh.exec:\bnhtnh.exe46⤵
- Executes dropped EXE
PID:4556 -
\??\c:\lfrrllx.exec:\lfrrllx.exe47⤵
- Executes dropped EXE
PID:4328 -
\??\c:\btbhht.exec:\btbhht.exe48⤵
- Executes dropped EXE
PID:4296 -
\??\c:\hbhntn.exec:\hbhntn.exe49⤵
- Executes dropped EXE
PID:4452 -
\??\c:\jvjdp.exec:\jvjdp.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xxrllff.exec:\xxrllff.exe51⤵
- Executes dropped EXE
PID:3180 -
\??\c:\bthhth.exec:\bthhth.exe52⤵
- Executes dropped EXE
PID:4196 -
\??\c:\vjddp.exec:\vjddp.exe53⤵
- Executes dropped EXE
PID:3372 -
\??\c:\jvdvj.exec:\jvdvj.exe54⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xflxfxr.exec:\xflxfxr.exe55⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ttbtnt.exec:\ttbtnt.exe56⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dppjv.exec:\dppjv.exe57⤵
- Executes dropped EXE
PID:2316 -
\??\c:\flxxrrl.exec:\flxxrrl.exe58⤵
- Executes dropped EXE
PID:1908 -
\??\c:\7hhbtn.exec:\7hhbtn.exe59⤵
- Executes dropped EXE
PID:684 -
\??\c:\9nnbnh.exec:\9nnbnh.exe60⤵
- Executes dropped EXE
PID:4228 -
\??\c:\jdjjv.exec:\jdjjv.exe61⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ffllfxf.exec:\ffllfxf.exe62⤵
- Executes dropped EXE
PID:3288 -
\??\c:\1hnnhh.exec:\1hnnhh.exe63⤵
- Executes dropped EXE
PID:3092 -
\??\c:\dpvpj.exec:\dpvpj.exe64⤵
- Executes dropped EXE
PID:2900 -
\??\c:\7pvjj.exec:\7pvjj.exe65⤵
- Executes dropped EXE
PID:3552 -
\??\c:\frlfxxx.exec:\frlfxxx.exe66⤵PID:4880
-
\??\c:\7btnbb.exec:\7btnbb.exe67⤵PID:4352
-
\??\c:\9ppdp.exec:\9ppdp.exe68⤵PID:3168
-
\??\c:\xxfrffx.exec:\xxfrffx.exe69⤵PID:4944
-
\??\c:\3lfxllx.exec:\3lfxllx.exe70⤵PID:2728
-
\??\c:\hbbthh.exec:\hbbthh.exe71⤵PID:2972
-
\??\c:\jdjjd.exec:\jdjjd.exe72⤵PID:1280
-
\??\c:\vvdvp.exec:\vvdvp.exe73⤵PID:4160
-
\??\c:\vvddd.exec:\vvddd.exe74⤵PID:4872
-
\??\c:\frfrrrr.exec:\frfrrrr.exe75⤵PID:3044
-
\??\c:\xxfxllx.exec:\xxfxllx.exe76⤵PID:2112
-
\??\c:\hbbtnn.exec:\hbbtnn.exe77⤵PID:2116
-
\??\c:\dpvvp.exec:\dpvvp.exe78⤵PID:3024
-
\??\c:\frlxlfl.exec:\frlxlfl.exe79⤵PID:1764
-
\??\c:\rffxrlf.exec:\rffxrlf.exe80⤵PID:1044
-
\??\c:\hnhtnh.exec:\hnhtnh.exe81⤵PID:4644
-
\??\c:\htthbh.exec:\htthbh.exe82⤵PID:4904
-
\??\c:\9pjdv.exec:\9pjdv.exe83⤵PID:1384
-
\??\c:\5pjdp.exec:\5pjdp.exe84⤵PID:1436
-
\??\c:\fxlxllf.exec:\fxlxllf.exe85⤵PID:1656
-
\??\c:\1lfrlrl.exec:\1lfrlrl.exe86⤵PID:4584
-
\??\c:\btnhnh.exec:\btnhnh.exe87⤵PID:2952
-
\??\c:\djpjv.exec:\djpjv.exe88⤵PID:1140
-
\??\c:\3jddd.exec:\3jddd.exe89⤵PID:5044
-
\??\c:\xxlffxf.exec:\xxlffxf.exe90⤵PID:5104
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe91⤵PID:3356
-
\??\c:\tbttnn.exec:\tbttnn.exe92⤵PID:4996
-
\??\c:\pvjvj.exec:\pvjvj.exe93⤵PID:2368
-
\??\c:\5pjdp.exec:\5pjdp.exe94⤵PID:2296
-
\??\c:\xfflxrl.exec:\xfflxrl.exe95⤵PID:740
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe96⤵PID:3360
-
\??\c:\btnhnn.exec:\btnhnn.exe97⤵PID:4112
-
\??\c:\3jpjd.exec:\3jpjd.exe98⤵PID:2044
-
\??\c:\jdvpd.exec:\jdvpd.exe99⤵PID:2832
-
\??\c:\3rrlffx.exec:\3rrlffx.exe100⤵PID:368
-
\??\c:\frxllll.exec:\frxllll.exe101⤵PID:2804
-
\??\c:\btnhbn.exec:\btnhbn.exe102⤵PID:4616
-
\??\c:\hnbbbn.exec:\hnbbbn.exe103⤵PID:4556
-
\??\c:\7pjpj.exec:\7pjpj.exe104⤵PID:2068
-
\??\c:\3vpdv.exec:\3vpdv.exe105⤵PID:2724
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe106⤵PID:4816
-
\??\c:\xffxrll.exec:\xffxrll.exe107⤵PID:1940
-
\??\c:\5hnntn.exec:\5hnntn.exe108⤵PID:3052
-
\??\c:\nhhtnh.exec:\nhhtnh.exe109⤵PID:2968
-
\??\c:\7pvpp.exec:\7pvpp.exe110⤵PID:2932
-
\??\c:\jjpjv.exec:\jjpjv.exe111⤵PID:3012
-
\??\c:\lrxfllr.exec:\lrxfllr.exe112⤵PID:3932
-
\??\c:\5xxxxrl.exec:\5xxxxrl.exe113⤵PID:1936
-
\??\c:\bhnhbt.exec:\bhnhbt.exe114⤵PID:1952
-
\??\c:\9nbthb.exec:\9nbthb.exe115⤵PID:952
-
\??\c:\frxrffr.exec:\frxrffr.exe116⤵PID:4024
-
\??\c:\5xxrlll.exec:\5xxrlll.exe117⤵PID:4828
-
\??\c:\3nhbtb.exec:\3nhbtb.exe118⤵PID:5032
-
\??\c:\rrrlffx.exec:\rrrlffx.exe119⤵PID:4352
-
\??\c:\bttnhb.exec:\bttnhb.exe120⤵PID:2448
-
\??\c:\thnhnn.exec:\thnhnn.exe121⤵PID:4944
-
\??\c:\pdvpd.exec:\pdvpd.exe122⤵PID:2740
-
\??\c:\lrrlfxl.exec:\lrrlfxl.exe123⤵PID:5068
-
\??\c:\xrrlffx.exec:\xrrlffx.exe124⤵PID:1280
-
\??\c:\btnnnt.exec:\btnnnt.exe125⤵PID:4160
-
\??\c:\bbntbb.exec:\bbntbb.exe126⤵PID:4872
-
\??\c:\djpjj.exec:\djpjj.exe127⤵PID:4888
-
\??\c:\lxfxrlr.exec:\lxfxrlr.exe128⤵PID:2104
-
\??\c:\lffxrrf.exec:\lffxrrf.exe129⤵PID:3736
-
\??\c:\5tnhht.exec:\5tnhht.exe130⤵PID:3024
-
\??\c:\ddjdp.exec:\ddjdp.exe131⤵PID:432
-
\??\c:\vvvpj.exec:\vvvpj.exe132⤵PID:1044
-
\??\c:\1fllllr.exec:\1fllllr.exe133⤵PID:4644
-
\??\c:\3btnhb.exec:\3btnhb.exe134⤵PID:1700
-
\??\c:\nttnhb.exec:\nttnhb.exe135⤵PID:1384
-
\??\c:\jdvpd.exec:\jdvpd.exe136⤵PID:1436
-
\??\c:\5frfxrl.exec:\5frfxrl.exe137⤵PID:5100
-
\??\c:\xrrlffl.exec:\xrrlffl.exe138⤵PID:2196
-
\??\c:\btnhhb.exec:\btnhhb.exe139⤵PID:1624
-
\??\c:\5ddvv.exec:\5ddvv.exe140⤵PID:1140
-
\??\c:\djjdp.exec:\djjdp.exe141⤵PID:5044
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe142⤵PID:3684
-
\??\c:\hnhtnt.exec:\hnhtnt.exe143⤵PID:5096
-
\??\c:\9hthnb.exec:\9hthnb.exe144⤵PID:3616
-
\??\c:\7ddvj.exec:\7ddvj.exe145⤵PID:2368
-
\??\c:\pjdpj.exec:\pjdpj.exe146⤵PID:2664
-
\??\c:\rlxxxrx.exec:\rlxxxrx.exe147⤵PID:740
-
\??\c:\xrllfxf.exec:\xrllfxf.exe148⤵PID:1816
-
\??\c:\nnnbtt.exec:\nnnbtt.exe149⤵PID:624
-
\??\c:\djdvp.exec:\djdvp.exe150⤵PID:4536
-
\??\c:\vdjvj.exec:\vdjvj.exe151⤵PID:1328
-
\??\c:\rflxfff.exec:\rflxfff.exe152⤵PID:3192
-
\??\c:\3fxrxxr.exec:\3fxrxxr.exe153⤵PID:4332
-
\??\c:\bhbtnh.exec:\bhbtnh.exe154⤵PID:4924
-
\??\c:\tntnhb.exec:\tntnhb.exe155⤵PID:4864
-
\??\c:\jpvpj.exec:\jpvpj.exe156⤵PID:3400
-
\??\c:\5rfxfxr.exec:\5rfxfxr.exe157⤵PID:2724
-
\??\c:\7btnhh.exec:\7btnhh.exe158⤵PID:4600
-
\??\c:\nhbtnb.exec:\nhbtnb.exe159⤵PID:2884
-
\??\c:\pdvdp.exec:\pdvdp.exe160⤵PID:4048
-
\??\c:\5vdvp.exec:\5vdvp.exe161⤵PID:60
-
\??\c:\rrflfxr.exec:\rrflfxr.exe162⤵PID:2960
-
\??\c:\9bbhbn.exec:\9bbhbn.exe163⤵PID:1908
-
\??\c:\jdvpd.exec:\jdvpd.exe164⤵PID:3352
-
\??\c:\1vvvv.exec:\1vvvv.exe165⤵PID:1936
-
\??\c:\rllrlrl.exec:\rllrlrl.exe166⤵PID:1792
-
\??\c:\hnhbnb.exec:\hnhbnb.exe167⤵PID:2080
-
\??\c:\nbhbhb.exec:\nbhbhb.exe168⤵PID:2900
-
\??\c:\pvvvj.exec:\pvvvj.exe169⤵PID:4364
-
\??\c:\lxfrrll.exec:\lxfrrll.exe170⤵PID:5008
-
\??\c:\1flffff.exec:\1flffff.exe171⤵PID:3900
-
\??\c:\hhbtnh.exec:\hhbtnh.exe172⤵PID:1244
-
\??\c:\5jjpd.exec:\5jjpd.exe173⤵PID:2420
-
\??\c:\ppdpd.exec:\ppdpd.exe174⤵PID:3828
-
\??\c:\xfflffx.exec:\xfflffx.exe175⤵PID:2972
-
\??\c:\5lfxllf.exec:\5lfxllf.exe176⤵PID:3956
-
\??\c:\nbhtnh.exec:\nbhtnh.exe177⤵PID:1832
-
\??\c:\vvdvj.exec:\vvdvj.exe178⤵PID:3876
-
\??\c:\jdddv.exec:\jdddv.exe179⤵PID:4928
-
\??\c:\fxrxfrx.exec:\fxrxfrx.exe180⤵PID:3128
-
\??\c:\hhbtnh.exec:\hhbtnh.exe181⤵PID:964
-
\??\c:\1tttnt.exec:\1tttnt.exe182⤵PID:1056
-
\??\c:\jvdvj.exec:\jvdvj.exe183⤵PID:2624
-
\??\c:\vvvvp.exec:\vvvvp.exe184⤵PID:408
-
\??\c:\1xxrffx.exec:\1xxrffx.exe185⤵PID:2464
-
\??\c:\btbtnh.exec:\btbtnh.exe186⤵PID:3744
-
\??\c:\tbtthb.exec:\tbtthb.exe187⤵PID:2180
-
\??\c:\ddvpp.exec:\ddvpp.exe188⤵PID:4744
-
\??\c:\fxlfffr.exec:\fxlfffr.exe189⤵PID:3844
-
\??\c:\3lffxrl.exec:\3lffxrl.exe190⤵PID:3248
-
\??\c:\hhtbtn.exec:\hhtbtn.exe191⤵PID:4292
-
\??\c:\hhnbbt.exec:\hhnbbt.exe192⤵PID:3324
-
\??\c:\djjjv.exec:\djjjv.exe193⤵PID:2144
-
\??\c:\pdddd.exec:\pdddd.exe194⤵PID:2684
-
\??\c:\lxfxlxr.exec:\lxfxlxr.exe195⤵PID:3532
-
\??\c:\fllrllf.exec:\fllrllf.exe196⤵PID:2472
-
\??\c:\3tbnhb.exec:\3tbnhb.exe197⤵PID:3380
-
\??\c:\vddvp.exec:\vddvp.exe198⤵PID:2956
-
\??\c:\pdvjv.exec:\pdvjv.exe199⤵PID:4400
-
\??\c:\fxxrfxr.exec:\fxxrfxr.exe200⤵PID:1588
-
\??\c:\lxrrlfx.exec:\lxrrlfx.exe201⤵PID:3992
-
\??\c:\htbbbh.exec:\htbbbh.exe202⤵PID:2536
-
\??\c:\btnhbt.exec:\btnhbt.exe203⤵PID:1484
-
\??\c:\ppvpv.exec:\ppvpv.exe204⤵PID:5028
-
\??\c:\vddvj.exec:\vddvj.exe205⤵PID:928
-
\??\c:\7rlfrrl.exec:\7rlfrrl.exe206⤵PID:4556
-
\??\c:\httntn.exec:\httntn.exe207⤵PID:1812
-
\??\c:\hntthb.exec:\hntthb.exe208⤵PID:1944
-
\??\c:\1dvdj.exec:\1dvdj.exe209⤵PID:4008
-
\??\c:\9ppdv.exec:\9ppdv.exe210⤵PID:3372
-
\??\c:\3ffxfxl.exec:\3ffxfxl.exe211⤵PID:2656
-
\??\c:\llfxxrl.exec:\llfxxrl.exe212⤵PID:2316
-
\??\c:\htbnht.exec:\htbnht.exe213⤵PID:4488
-
\??\c:\nbhhhb.exec:\nbhhhb.exe214⤵PID:2436
-
\??\c:\7ppjj.exec:\7ppjj.exe215⤵PID:3920
-
\??\c:\7vvvp.exec:\7vvvp.exe216⤵PID:3076
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe217⤵PID:1792
-
\??\c:\htnbtb.exec:\htnbtb.exe218⤵PID:2080
-
\??\c:\hntnbb.exec:\hntnbb.exe219⤵PID:412
-
\??\c:\dppjv.exec:\dppjv.exe220⤵PID:4364
-
\??\c:\5vvvj.exec:\5vvvj.exe221⤵PID:32
-
\??\c:\7flxlfx.exec:\7flxlfx.exe222⤵PID:4832
-
\??\c:\thttnh.exec:\thttnh.exe223⤵PID:4260
-
\??\c:\nbhbtt.exec:\nbhbtt.exe224⤵PID:2420
-
\??\c:\3ppdj.exec:\3ppdj.exe225⤵PID:5068
-
\??\c:\3jdpd.exec:\3jdpd.exe226⤵PID:2128
-
\??\c:\rrxrlll.exec:\rrxrlll.exe227⤵PID:4476
-
\??\c:\tntntn.exec:\tntntn.exe228⤵PID:1832
-
\??\c:\btnbnh.exec:\btnbnh.exe229⤵PID:3876
-
\??\c:\3vpdv.exec:\3vpdv.exe230⤵PID:2116
-
\??\c:\pjvvp.exec:\pjvvp.exe231⤵PID:3128
-
\??\c:\rrlfxff.exec:\rrlfxff.exe232⤵PID:4672
-
\??\c:\ttnhbb.exec:\ttnhbb.exe233⤵PID:4020
-
\??\c:\7nnhbt.exec:\7nnhbt.exe234⤵PID:2624
-
\??\c:\jvpjd.exec:\jvpjd.exe235⤵PID:4812
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe236⤵PID:2072
-
\??\c:\xrffxrr.exec:\xrffxrr.exe237⤵PID:2008
-
\??\c:\nnbtbb.exec:\nnbtbb.exe238⤵PID:64
-
\??\c:\tnhbnn.exec:\tnhbnn.exe239⤵PID:4584
-
\??\c:\9djdd.exec:\9djdd.exe240⤵PID:804
-
\??\c:\lxfffxr.exec:\lxfffxr.exe241⤵PID:4376
-
\??\c:\rrlffxx.exec:\rrlffxx.exe242⤵PID:908