Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b17e72e67a6201fd131948e6b476f875cf0d4dac290a4fe200c678028e372a23.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b17e72e67a6201fd131948e6b476f875cf0d4dac290a4fe200c678028e372a23.exe
-
Size
313KB
-
MD5
b29b25c124e190c51b445349706db6b0
-
SHA1
e9bc4ac4fd11b6db17eeef00a053816bf71a09ae
-
SHA256
b17e72e67a6201fd131948e6b476f875cf0d4dac290a4fe200c678028e372a23
-
SHA512
9036d6a2410e4ffede4dfd41076c3a04a8980b04ffe8275d193b895c0d51f1b8109e0a465f2fa695ea24d66dc25c1853cf0ef2a942d61ce3e1cc2e6b861b7c48
-
SSDEEP
6144:n3C9BRo/AIX2h97aUzpbBj3+b2ziJC39QS8hDJd+Q7ZLbjwmI:n3C9uDC97aUFbZ42ziM39QS8hDJd+Q7s
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1052-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-65-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/592-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jpjjj.exennbtbh.exe3vjjj.exethnbhh.exevjjjd.exellrlfrl.exehbbnnt.exevppjj.exe3vjjj.exefflffxx.exexrxxrxx.exebthbbh.exevvvpp.exe7nhhhn.exe3hhhbh.exejdjjj.exepvpjv.exejpvdd.exerflllll.exe1nttnn.exevvdvp.exefrrffll.exebtbtbn.exe3djvp.exexrrrllx.exehhhntb.exepjvvv.exe9rfffrr.exe9lxrffl.exenbbttn.exevpdvd.exebtbhhn.exe7nhnbh.exejpjjj.exexxlxxxl.exebntttb.exehbttbh.exeddjdd.exelfffxfr.exenhnhht.exejvddv.exejdjvp.exerlffffl.exehhtnht.exebbtnbb.exedddvj.exefflfffx.exe7thnnn.exe1pdvd.exejddvp.exeflxllfx.exehtnttt.exehhthtn.exeddjpp.exe5lrrrxr.exefxllfll.exetthhnt.exe9vdvv.exeffrlxlr.exerllxxxx.exebbtttb.exevpvpj.exevjvpp.exexlrlflf.exepid process 3100 jpjjj.exe 4688 nnbtbh.exe 4284 3vjjj.exe 592 thnbhh.exe 1560 vjjjd.exe 228 llrlfrl.exe 3912 hbbnnt.exe 4016 vppjj.exe 3516 3vjjj.exe 2184 fflffxx.exe 4044 xrxxrxx.exe 5032 bthbbh.exe 2904 vvvpp.exe 2736 7nhhhn.exe 1980 3hhhbh.exe 2256 jdjjj.exe 4520 pvpjv.exe 2984 jpvdd.exe 4428 rflllll.exe 1536 1nttnn.exe 3324 vvdvp.exe 5016 frrffll.exe 4264 btbtbn.exe 336 3djvp.exe 1712 xrrrllx.exe 4912 hhhntb.exe 5088 pjvvv.exe 1664 9rfffrr.exe 3404 9lxrffl.exe 4004 nbbttn.exe 4288 vpdvd.exe 1220 btbhhn.exe 3720 7nhnbh.exe 1416 jpjjj.exe 892 xxlxxxl.exe 4360 bntttb.exe 1052 hbttbh.exe 1420 ddjdd.exe 2936 lfffxfr.exe 4656 nhnhht.exe 3932 jvddv.exe 1688 jdjvp.exe 3228 rlffffl.exe 1760 hhtnht.exe 3912 bbtnbb.exe 2732 dddvj.exe 4600 fflfffx.exe 1028 7thnnn.exe 388 1pdvd.exe 2948 jddvp.exe 4860 flxllfx.exe 4644 htnttt.exe 392 hhthtn.exe 4012 ddjpp.exe 4632 5lrrrxr.exe 2148 fxllfll.exe 2408 tthhnt.exe 2984 9vdvv.exe 2772 ffrlxlr.exe 1536 rllxxxx.exe 220 bbtttb.exe 2912 vpvpj.exe 1944 vjvpp.exe 3988 xlrlflf.exe -
Processes:
resource yara_rule behavioral2/memory/1052-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/592-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/592-31-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b17e72e67a6201fd131948e6b476f875cf0d4dac290a4fe200c678028e372a23.exejpjjj.exennbtbh.exe3vjjj.exethnbhh.exevjjjd.exellrlfrl.exehbbnnt.exevppjj.exe3vjjj.exefflffxx.exexrxxrxx.exebthbbh.exevvvpp.exe7nhhhn.exe3hhhbh.exejdjjj.exepvpjv.exejpvdd.exerflllll.exe1nttnn.exevvdvp.exedescription pid process target process PID 1052 wrote to memory of 3100 1052 b17e72e67a6201fd131948e6b476f875cf0d4dac290a4fe200c678028e372a23.exe jpjjj.exe PID 1052 wrote to memory of 3100 1052 b17e72e67a6201fd131948e6b476f875cf0d4dac290a4fe200c678028e372a23.exe jpjjj.exe PID 1052 wrote to memory of 3100 1052 b17e72e67a6201fd131948e6b476f875cf0d4dac290a4fe200c678028e372a23.exe jpjjj.exe PID 3100 wrote to memory of 4688 3100 jpjjj.exe nnbtbh.exe PID 3100 wrote to memory of 4688 3100 jpjjj.exe nnbtbh.exe PID 3100 wrote to memory of 4688 3100 jpjjj.exe nnbtbh.exe PID 4688 wrote to memory of 4284 4688 nnbtbh.exe 3vjjj.exe PID 4688 wrote to memory of 4284 4688 nnbtbh.exe 3vjjj.exe PID 4688 wrote to memory of 4284 4688 nnbtbh.exe 3vjjj.exe PID 4284 wrote to memory of 592 4284 3vjjj.exe thnbhh.exe PID 4284 wrote to memory of 592 4284 3vjjj.exe thnbhh.exe PID 4284 wrote to memory of 592 4284 3vjjj.exe thnbhh.exe PID 592 wrote to memory of 1560 592 thnbhh.exe vjjjd.exe PID 592 wrote to memory of 1560 592 thnbhh.exe vjjjd.exe PID 592 wrote to memory of 1560 592 thnbhh.exe vjjjd.exe PID 1560 wrote to memory of 228 1560 vjjjd.exe llrlfrl.exe PID 1560 wrote to memory of 228 1560 vjjjd.exe llrlfrl.exe PID 1560 wrote to memory of 228 1560 vjjjd.exe llrlfrl.exe PID 228 wrote to memory of 3912 228 llrlfrl.exe fxfxlfx.exe PID 228 wrote to memory of 3912 228 llrlfrl.exe fxfxlfx.exe PID 228 wrote to memory of 3912 228 llrlfrl.exe fxfxlfx.exe PID 3912 wrote to memory of 4016 3912 hbbnnt.exe vdvdv.exe PID 3912 wrote to memory of 4016 3912 hbbnnt.exe vdvdv.exe PID 3912 wrote to memory of 4016 3912 hbbnnt.exe vdvdv.exe PID 4016 wrote to memory of 3516 4016 vppjj.exe 3vjjj.exe PID 4016 wrote to memory of 3516 4016 vppjj.exe 3vjjj.exe PID 4016 wrote to memory of 3516 4016 vppjj.exe 3vjjj.exe PID 3516 wrote to memory of 2184 3516 3vjjj.exe fflffxx.exe PID 3516 wrote to memory of 2184 3516 3vjjj.exe fflffxx.exe PID 3516 wrote to memory of 2184 3516 3vjjj.exe fflffxx.exe PID 2184 wrote to memory of 4044 2184 fflffxx.exe xrxxrxx.exe PID 2184 wrote to memory of 4044 2184 fflffxx.exe xrxxrxx.exe PID 2184 wrote to memory of 4044 2184 fflffxx.exe xrxxrxx.exe PID 4044 wrote to memory of 5032 4044 xrxxrxx.exe bthbbh.exe PID 4044 wrote to memory of 5032 4044 xrxxrxx.exe bthbbh.exe PID 4044 wrote to memory of 5032 4044 xrxxrxx.exe bthbbh.exe PID 5032 wrote to memory of 2904 5032 bthbbh.exe vvvpp.exe PID 5032 wrote to memory of 2904 5032 bthbbh.exe vvvpp.exe PID 5032 wrote to memory of 2904 5032 bthbbh.exe vvvpp.exe PID 2904 wrote to memory of 2736 2904 vvvpp.exe 7nhhhn.exe PID 2904 wrote to memory of 2736 2904 vvvpp.exe 7nhhhn.exe PID 2904 wrote to memory of 2736 2904 vvvpp.exe 7nhhhn.exe PID 2736 wrote to memory of 1980 2736 7nhhhn.exe bbnnnh.exe PID 2736 wrote to memory of 1980 2736 7nhhhn.exe bbnnnh.exe PID 2736 wrote to memory of 1980 2736 7nhhhn.exe bbnnnh.exe PID 1980 wrote to memory of 2256 1980 3hhhbh.exe jdjjj.exe PID 1980 wrote to memory of 2256 1980 3hhhbh.exe jdjjj.exe PID 1980 wrote to memory of 2256 1980 3hhhbh.exe jdjjj.exe PID 2256 wrote to memory of 4520 2256 jdjjj.exe pjpvv.exe PID 2256 wrote to memory of 4520 2256 jdjjj.exe pjpvv.exe PID 2256 wrote to memory of 4520 2256 jdjjj.exe pjpvv.exe PID 4520 wrote to memory of 2984 4520 pvpjv.exe jpvdd.exe PID 4520 wrote to memory of 2984 4520 pvpjv.exe jpvdd.exe PID 4520 wrote to memory of 2984 4520 pvpjv.exe jpvdd.exe PID 2984 wrote to memory of 4428 2984 jpvdd.exe rflllll.exe PID 2984 wrote to memory of 4428 2984 jpvdd.exe rflllll.exe PID 2984 wrote to memory of 4428 2984 jpvdd.exe rflllll.exe PID 4428 wrote to memory of 1536 4428 rflllll.exe 1nttnn.exe PID 4428 wrote to memory of 1536 4428 rflllll.exe 1nttnn.exe PID 4428 wrote to memory of 1536 4428 rflllll.exe 1nttnn.exe PID 1536 wrote to memory of 3324 1536 1nttnn.exe vvdvp.exe PID 1536 wrote to memory of 3324 1536 1nttnn.exe vvdvp.exe PID 1536 wrote to memory of 3324 1536 1nttnn.exe vvdvp.exe PID 3324 wrote to memory of 5016 3324 vvdvp.exe frrffll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b17e72e67a6201fd131948e6b476f875cf0d4dac290a4fe200c678028e372a23.exe"C:\Users\Admin\AppData\Local\Temp\b17e72e67a6201fd131948e6b476f875cf0d4dac290a4fe200c678028e372a23.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\jpjjj.exec:\jpjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\nnbtbh.exec:\nnbtbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\3vjjj.exec:\3vjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\thnbhh.exec:\thnbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\vjjjd.exec:\vjjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\llrlfrl.exec:\llrlfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\hbbnnt.exec:\hbbnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\vppjj.exec:\vppjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\3vjjj.exec:\3vjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\fflffxx.exec:\fflffxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\bthbbh.exec:\bthbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\vvvpp.exec:\vvvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\7nhhhn.exec:\7nhhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\3hhhbh.exec:\3hhhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\jdjjj.exec:\jdjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\pvpjv.exec:\pvpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\jpvdd.exec:\jpvdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rflllll.exec:\rflllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\1nttnn.exec:\1nttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\vvdvp.exec:\vvdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\frrffll.exec:\frrffll.exe23⤵
- Executes dropped EXE
PID:5016 -
\??\c:\btbtbn.exec:\btbtbn.exe24⤵
- Executes dropped EXE
PID:4264 -
\??\c:\3djvp.exec:\3djvp.exe25⤵
- Executes dropped EXE
PID:336 -
\??\c:\xrrrllx.exec:\xrrrllx.exe26⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hhhntb.exec:\hhhntb.exe27⤵
- Executes dropped EXE
PID:4912 -
\??\c:\pjvvv.exec:\pjvvv.exe28⤵
- Executes dropped EXE
PID:5088 -
\??\c:\9rfffrr.exec:\9rfffrr.exe29⤵
- Executes dropped EXE
PID:1664 -
\??\c:\9lxrffl.exec:\9lxrffl.exe30⤵
- Executes dropped EXE
PID:3404 -
\??\c:\nbbttn.exec:\nbbttn.exe31⤵
- Executes dropped EXE
PID:4004 -
\??\c:\vpdvd.exec:\vpdvd.exe32⤵
- Executes dropped EXE
PID:4288 -
\??\c:\btbhhn.exec:\btbhhn.exe33⤵
- Executes dropped EXE
PID:1220 -
\??\c:\7nhnbh.exec:\7nhnbh.exe34⤵
- Executes dropped EXE
PID:3720 -
\??\c:\jpjjj.exec:\jpjjj.exe35⤵
- Executes dropped EXE
PID:1416 -
\??\c:\xxlxxxl.exec:\xxlxxxl.exe36⤵
- Executes dropped EXE
PID:892 -
\??\c:\bntttb.exec:\bntttb.exe37⤵
- Executes dropped EXE
PID:4360 -
\??\c:\hbttbh.exec:\hbttbh.exe38⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ddjdd.exec:\ddjdd.exe39⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lfffxfr.exec:\lfffxfr.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nhnhht.exec:\nhnhht.exe41⤵
- Executes dropped EXE
PID:4656 -
\??\c:\jvddv.exec:\jvddv.exe42⤵
- Executes dropped EXE
PID:3932 -
\??\c:\jdjvp.exec:\jdjvp.exe43⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rlffffl.exec:\rlffffl.exe44⤵
- Executes dropped EXE
PID:3228 -
\??\c:\hhtnht.exec:\hhtnht.exe45⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bbtnbb.exec:\bbtnbb.exe46⤵
- Executes dropped EXE
PID:3912 -
\??\c:\dddvj.exec:\dddvj.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\fflfffx.exec:\fflfffx.exe48⤵
- Executes dropped EXE
PID:4600 -
\??\c:\7thnnn.exec:\7thnnn.exe49⤵
- Executes dropped EXE
PID:1028 -
\??\c:\1pdvd.exec:\1pdvd.exe50⤵
- Executes dropped EXE
PID:388 -
\??\c:\jddvp.exec:\jddvp.exe51⤵
- Executes dropped EXE
PID:2948 -
\??\c:\flxllfx.exec:\flxllfx.exe52⤵
- Executes dropped EXE
PID:4860 -
\??\c:\htnttt.exec:\htnttt.exe53⤵
- Executes dropped EXE
PID:4644 -
\??\c:\hhthtn.exec:\hhthtn.exe54⤵
- Executes dropped EXE
PID:392 -
\??\c:\ddjpp.exec:\ddjpp.exe55⤵
- Executes dropped EXE
PID:4012 -
\??\c:\5lrrrxr.exec:\5lrrrxr.exe56⤵
- Executes dropped EXE
PID:4632 -
\??\c:\fxllfll.exec:\fxllfll.exe57⤵
- Executes dropped EXE
PID:2148 -
\??\c:\tthhnt.exec:\tthhnt.exe58⤵
- Executes dropped EXE
PID:2408 -
\??\c:\9vdvv.exec:\9vdvv.exe59⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ffrlxlr.exec:\ffrlxlr.exe60⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rllxxxx.exec:\rllxxxx.exe61⤵
- Executes dropped EXE
PID:1536 -
\??\c:\bbtttb.exec:\bbtttb.exe62⤵
- Executes dropped EXE
PID:220 -
\??\c:\vpvpj.exec:\vpvpj.exe63⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vjvpp.exec:\vjvpp.exe64⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xlrlflf.exec:\xlrlflf.exe65⤵
- Executes dropped EXE
PID:3988 -
\??\c:\fxllfrr.exec:\fxllfrr.exe66⤵PID:3644
-
\??\c:\tnhhtn.exec:\tnhhtn.exe67⤵PID:1712
-
\??\c:\3jdjj.exec:\3jdjj.exe68⤵PID:2316
-
\??\c:\frffrrl.exec:\frffrrl.exe69⤵PID:1664
-
\??\c:\tnbhth.exec:\tnbhth.exe70⤵PID:3428
-
\??\c:\bbbbtt.exec:\bbbbtt.exe71⤵PID:4572
-
\??\c:\5pjjd.exec:\5pjjd.exe72⤵PID:1632
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe73⤵PID:4920
-
\??\c:\5llrxxx.exec:\5llrxxx.exe74⤵PID:5104
-
\??\c:\bhnnbt.exec:\bhnnbt.exe75⤵PID:1700
-
\??\c:\pvvdp.exec:\pvvdp.exe76⤵PID:1220
-
\??\c:\fflllrr.exec:\fflllrr.exe77⤵PID:4548
-
\??\c:\lxllllr.exec:\lxllllr.exe78⤵PID:1292
-
\??\c:\ntbttt.exec:\ntbttt.exe79⤵PID:4224
-
\??\c:\dpjvp.exec:\dpjvp.exe80⤵PID:4676
-
\??\c:\vvddj.exec:\vvddj.exe81⤵PID:3716
-
\??\c:\xlfrrff.exec:\xlfrrff.exe82⤵PID:3612
-
\??\c:\lxlfrxr.exec:\lxlfrxr.exe83⤵PID:2160
-
\??\c:\nthhbb.exec:\nthhbb.exe84⤵PID:3936
-
\??\c:\bttnbb.exec:\bttnbb.exe85⤵PID:2088
-
\??\c:\dddjv.exec:\dddjv.exe86⤵PID:2068
-
\??\c:\9xlfrxx.exec:\9xlfrxx.exe87⤵PID:3608
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe88⤵PID:864
-
\??\c:\hhhnnb.exec:\hhhnnb.exe89⤵PID:2356
-
\??\c:\vdvdv.exec:\vdvdv.exe90⤵PID:4016
-
\??\c:\fxfxlfx.exec:\fxfxlfx.exe91⤵PID:3912
-
\??\c:\fllllfl.exec:\fllllfl.exe92⤵PID:2732
-
\??\c:\nhthbh.exec:\nhthbh.exe93⤵PID:4600
-
\??\c:\vpjjj.exec:\vpjjj.exe94⤵PID:1356
-
\??\c:\ffrrrfl.exec:\ffrrrfl.exe95⤵PID:3560
-
\??\c:\tnnhht.exec:\tnnhht.exe96⤵PID:1148
-
\??\c:\jjjjj.exec:\jjjjj.exe97⤵PID:872
-
\??\c:\djjjv.exec:\djjjv.exe98⤵PID:468
-
\??\c:\fffxfxx.exec:\fffxfxx.exe99⤵PID:4748
-
\??\c:\ffxrxxl.exec:\ffxrxxl.exe100⤵PID:4632
-
\??\c:\1dpjp.exec:\1dpjp.exe101⤵PID:1864
-
\??\c:\vjppp.exec:\vjppp.exe102⤵PID:3856
-
\??\c:\rrrrllf.exec:\rrrrllf.exe103⤵PID:2856
-
\??\c:\9lxffxf.exec:\9lxffxf.exe104⤵PID:2284
-
\??\c:\bntttt.exec:\bntttt.exe105⤵PID:2924
-
\??\c:\pjvvv.exec:\pjvvv.exe106⤵PID:3544
-
\??\c:\pppjd.exec:\pppjd.exe107⤵PID:764
-
\??\c:\lflxrll.exec:\lflxrll.exe108⤵PID:2316
-
\??\c:\ntntbb.exec:\ntntbb.exe109⤵PID:5100
-
\??\c:\ppdvv.exec:\ppdvv.exe110⤵PID:4376
-
\??\c:\9vdvv.exec:\9vdvv.exe111⤵PID:3976
-
\??\c:\1fffxxx.exec:\1fffxxx.exe112⤵PID:656
-
\??\c:\btttbb.exec:\btttbb.exe113⤵PID:4228
-
\??\c:\hnthbb.exec:\hnthbb.exe114⤵PID:2816
-
\??\c:\ppjdd.exec:\ppjdd.exe115⤵PID:1700
-
\??\c:\ppjdv.exec:\ppjdv.exe116⤵PID:2544
-
\??\c:\rfllfxl.exec:\rfllfxl.exe117⤵PID:4548
-
\??\c:\hnbbtt.exec:\hnbbtt.exe118⤵PID:1292
-
\??\c:\bhtttt.exec:\bhtttt.exe119⤵PID:2136
-
\??\c:\jppdj.exec:\jppdj.exe120⤵PID:1424
-
\??\c:\jvpjv.exec:\jvpjv.exe121⤵PID:3716
-
\??\c:\rxlxflr.exec:\rxlxflr.exe122⤵PID:3196
-
\??\c:\ntthbt.exec:\ntthbt.exe123⤵PID:3628
-
\??\c:\dvjjv.exec:\dvjjv.exe124⤵PID:3936
-
\??\c:\jvpjd.exec:\jvpjd.exe125⤵PID:3504
-
\??\c:\lrlflrr.exec:\lrlflrr.exe126⤵PID:2068
-
\??\c:\thhhth.exec:\thhhth.exe127⤵PID:5048
-
\??\c:\hnbbhh.exec:\hnbbhh.exe128⤵PID:4672
-
\??\c:\ppjjj.exec:\ppjjj.exe129⤵PID:1388
-
\??\c:\rfxrrxr.exec:\rfxrrxr.exe130⤵PID:3344
-
\??\c:\5ffllxf.exec:\5ffllxf.exe131⤵PID:2752
-
\??\c:\nthnth.exec:\nthnth.exe132⤵PID:2916
-
\??\c:\bhhbbh.exec:\bhhbbh.exe133⤵PID:4740
-
\??\c:\pjdjv.exec:\pjdjv.exe134⤵PID:4452
-
\??\c:\1rfflrf.exec:\1rfflrf.exe135⤵PID:4808
-
\??\c:\lxrrxfx.exec:\lxrrxfx.exe136⤵PID:2988
-
\??\c:\bbnnnh.exec:\bbnnnh.exe137⤵PID:1980
-
\??\c:\vjdjp.exec:\vjdjp.exe138⤵PID:2692
-
\??\c:\pjpvv.exec:\pjpvv.exe139⤵PID:4520
-
\??\c:\rxlxrlx.exec:\rxlxrlx.exe140⤵PID:840
-
\??\c:\rrflrxf.exec:\rrflrxf.exe141⤵PID:2672
-
\??\c:\nttnbt.exec:\nttnbt.exe142⤵PID:1432
-
\??\c:\1vvpj.exec:\1vvpj.exe143⤵PID:4128
-
\??\c:\9ppdv.exec:\9ppdv.exe144⤵PID:4852
-
\??\c:\7frxrlf.exec:\7frxrlf.exe145⤵PID:628
-
\??\c:\ffrrxxx.exec:\ffrrxxx.exe146⤵PID:2072
-
\??\c:\nnnttt.exec:\nnnttt.exe147⤵PID:4420
-
\??\c:\5jdvp.exec:\5jdvp.exe148⤵PID:4908
-
\??\c:\xrfxffx.exec:\xrfxffx.exe149⤵PID:3288
-
\??\c:\ffffxrl.exec:\ffffxrl.exe150⤵PID:2252
-
\??\c:\7nbhht.exec:\7nbhht.exe151⤵PID:212
-
\??\c:\bttnhb.exec:\bttnhb.exe152⤵PID:4320
-
\??\c:\dvvjv.exec:\dvvjv.exe153⤵PID:1672
-
\??\c:\rrxfflr.exec:\rrxfflr.exe154⤵PID:1192
-
\??\c:\btbtnh.exec:\btbtnh.exe155⤵PID:4224
-
\??\c:\ddvpd.exec:\ddvpd.exe156⤵PID:4676
-
\??\c:\rlrfrfr.exec:\rlrfrfr.exe157⤵PID:3528
-
\??\c:\bnbnhb.exec:\bnbnhb.exe158⤵PID:3100
-
\??\c:\ppvpd.exec:\ppvpd.exe159⤵PID:3612
-
\??\c:\flfxlxf.exec:\flfxlxf.exe160⤵PID:2160
-
\??\c:\hnbtbh.exec:\hnbtbh.exe161⤵PID:592
-
\??\c:\vdppv.exec:\vdppv.exe162⤵PID:2088
-
\??\c:\vpjvv.exec:\vpjvv.exe163⤵PID:2956
-
\??\c:\frfrrfl.exec:\frfrrfl.exe164⤵PID:4680
-
\??\c:\hnhbbn.exec:\hnhbbn.exe165⤵PID:5048
-
\??\c:\pjjjv.exec:\pjjjv.exe166⤵PID:376
-
\??\c:\rrxlxxx.exec:\rrxlxxx.exe167⤵PID:1388
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe168⤵PID:1028
-
\??\c:\bntbbn.exec:\bntbbn.exe169⤵PID:5084
-
\??\c:\9vdjp.exec:\9vdjp.exe170⤵PID:2424
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe171⤵PID:4740
-
\??\c:\rflxrfx.exec:\rflxrfx.exe172⤵PID:4452
-
\??\c:\1bbhhb.exec:\1bbhhb.exe173⤵PID:4644
-
\??\c:\pvpdv.exec:\pvpdv.exe174⤵PID:1392
-
\??\c:\xxxxxrf.exec:\xxxxxrf.exe175⤵PID:2832
-
\??\c:\1rfrlfx.exec:\1rfrlfx.exe176⤵PID:4428
-
\??\c:\hnnthh.exec:\hnnthh.exe177⤵PID:2172
-
\??\c:\1vvvp.exec:\1vvvp.exe178⤵PID:220
-
\??\c:\lxrrxxl.exec:\lxrrxxl.exe179⤵PID:2284
-
\??\c:\rrlxxlx.exec:\rrlxxlx.exe180⤵PID:3672
-
\??\c:\tbhhhh.exec:\tbhhhh.exe181⤵PID:1500
-
\??\c:\5pjvp.exec:\5pjvp.exe182⤵PID:3404
-
\??\c:\dvpjv.exec:\dvpjv.exe183⤵PID:4244
-
\??\c:\xrfxxrf.exec:\xrfxxrf.exe184⤵PID:4472
-
\??\c:\nhbttt.exec:\nhbttt.exe185⤵PID:4376
-
\??\c:\hbntbt.exec:\hbntbt.exe186⤵PID:4908
-
\??\c:\vpvpj.exec:\vpvpj.exe187⤵PID:2744
-
\??\c:\frfrxxf.exec:\frfrxxf.exe188⤵PID:212
-
\??\c:\bbntth.exec:\bbntth.exe189⤵PID:2544
-
\??\c:\tbtnnb.exec:\tbtnnb.exe190⤵PID:1416
-
\??\c:\7vpdd.exec:\7vpdd.exe191⤵PID:2788
-
\??\c:\lxxxflf.exec:\lxxxflf.exe192⤵PID:2336
-
\??\c:\rrrfxxr.exec:\rrrfxxr.exe193⤵PID:1636
-
\??\c:\nnnnhh.exec:\nnnnhh.exe194⤵PID:4780
-
\??\c:\ppjjv.exec:\ppjjv.exe195⤵PID:3196
-
\??\c:\jjpjv.exec:\jjpjv.exe196⤵PID:3628
-
\??\c:\3xffrlf.exec:\3xffrlf.exe197⤵PID:3936
-
\??\c:\bthbnn.exec:\bthbnn.exe198⤵PID:3228
-
\??\c:\bhnhhh.exec:\bhnhhh.exe199⤵PID:3608
-
\??\c:\ddjdv.exec:\ddjdv.exe200⤵PID:5060
-
\??\c:\rlrxrfl.exec:\rlrxrfl.exe201⤵PID:4672
-
\??\c:\5ntnbt.exec:\5ntnbt.exe202⤵PID:2184
-
\??\c:\ddjdv.exec:\ddjdv.exe203⤵PID:2828
-
\??\c:\frfllrr.exec:\frfllrr.exe204⤵PID:2212
-
\??\c:\rfrlllr.exec:\rfrlllr.exe205⤵PID:2916
-
\??\c:\hthhhb.exec:\hthhhb.exe206⤵PID:3560
-
\??\c:\jpjdv.exec:\jpjdv.exe207⤵PID:1148
-
\??\c:\fffrfxf.exec:\fffrfxf.exe208⤵PID:872
-
\??\c:\hnnhnh.exec:\hnnhnh.exe209⤵PID:4176
-
\??\c:\3thhbh.exec:\3thhbh.exe210⤵PID:3268
-
\??\c:\9djjj.exec:\9djjj.exe211⤵PID:4268
-
\??\c:\xxxxxfx.exec:\xxxxxfx.exe212⤵PID:2352
-
\??\c:\flllrxr.exec:\flllrxr.exe213⤵PID:4632
-
\??\c:\hhnnnt.exec:\hhnnnt.exe214⤵PID:840
-
\??\c:\pdjjj.exec:\pdjjj.exe215⤵PID:1600
-
\??\c:\nbbthb.exec:\nbbthb.exe216⤵PID:3460
-
\??\c:\vdvjd.exec:\vdvjd.exe217⤵PID:1432
-
\??\c:\1thhhn.exec:\1thhhn.exe218⤵PID:3544
-
\??\c:\lfflxrl.exec:\lfflxrl.exe219⤵PID:2064
-
\??\c:\llxffrf.exec:\llxffrf.exe220⤵PID:1664
-
\??\c:\nhbbhh.exec:\nhbbhh.exe221⤵PID:4960
-
\??\c:\ddvdp.exec:\ddvdp.exe222⤵PID:2724
-
\??\c:\9tbttt.exec:\9tbttt.exe223⤵PID:3048
-
\??\c:\7jjdd.exec:\7jjdd.exe224⤵PID:4800
-
\??\c:\jddvp.exec:\jddvp.exe225⤵PID:2532
-
\??\c:\9btnhh.exec:\9btnhh.exe226⤵PID:876
-
\??\c:\hhhhbt.exec:\hhhhbt.exe227⤵PID:4476
-
\??\c:\jpjpv.exec:\jpjpv.exe228⤵PID:3400
-
\??\c:\xlxrxrf.exec:\xlxrxrf.exe229⤵PID:4360
-
\??\c:\9hhbnt.exec:\9hhbnt.exe230⤵PID:2084
-
\??\c:\nbbnbb.exec:\nbbnbb.exe231⤵PID:5024
-
\??\c:\ddpvd.exec:\ddpvd.exe232⤵PID:3972
-
\??\c:\1bthbb.exec:\1bthbb.exe233⤵PID:3612
-
\??\c:\pjjjv.exec:\pjjjv.exe234⤵PID:4104
-
\??\c:\1nnbbt.exec:\1nnbbt.exe235⤵PID:4628
-
\??\c:\9thbtt.exec:\9thbtt.exe236⤵PID:2052
-
\??\c:\nbhbtt.exec:\nbhbtt.exe237⤵PID:3112
-
\??\c:\nthhtb.exec:\nthhtb.exe238⤵PID:3516
-
\??\c:\hbbhth.exec:\hbbhth.exe239⤵PID:540
-
\??\c:\fxlxxlf.exec:\fxlxxlf.exe240⤵PID:4508
-
\??\c:\tntnbt.exec:\tntnbt.exe241⤵PID:1356
-
\??\c:\bhhbtt.exec:\bhhbtt.exe242⤵PID:2828