Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 04:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b.exe
-
Size
65KB
-
MD5
135fc4914e879247fd8951963012db10
-
SHA1
066e34c413d54a9b4988b58957e64799c8f4d1ac
-
SHA256
b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b
-
SHA512
2b0a039a3472fc82e10daf84ac6b2764557ab80e720d0a6c5a8163efd2eaf0d74fa2ab3c3ed41491e880acf4b9f31b947ff6d66383a1615433c993a871eab9a5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfQ:ymb3NkkiQ3mdBjFI4Vc
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
Processes:
resource yara_rule behavioral2/memory/4284-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lffxxrr.exe1ttbbb.exepjdvv.exe1xflxxr.exefrfxrrl.exe7btnhb.exe3jppj.exefrxrllf.exerllrllf.exenthnhh.exe5vpdp.exelfrrffl.exe1fllrxr.exethhnnn.exevdjjj.exevvvvp.exerxxxrff.exe9rxfxxl.exenhnntt.exedvvpv.exe1djdv.exeflrlrll.exerrxfxff.exebttttb.exejvdvp.exerrfxrrl.exehbhhnn.exetbttbh.exevpppd.exerrxxllf.exebnnhbb.exebnhbbb.exedjjjp.exejddvd.exexxlfrff.exetntttt.exebttnnn.exejdddv.exe7dppd.exevvvdd.exerrxxxxx.exetntnhn.exetthbth.exedvdpj.exexrffxxx.exerrrrlll.exetnbhnt.exejdppj.exejvjdv.exerlllfll.exebbhhbn.exejjjjd.exevjppj.exerfrlfxx.exe7bbtbb.exe7tnnnn.exedpppj.exepjppv.exelfxrrrl.exefxxrrrl.exehhhhhh.exehbbtnh.exejdjpd.exejddvj.exepid process 4368 lffxxrr.exe 4568 1ttbbb.exe 2936 pjdvv.exe 1000 1xflxxr.exe 3720 frfxrrl.exe 1692 7btnhb.exe 4888 3jppj.exe 1732 frxrllf.exe 2264 rllrllf.exe 1152 nthnhh.exe 1944 5vpdp.exe 1084 lfrrffl.exe 3140 1fllrxr.exe 5064 thhnnn.exe 2356 vdjjj.exe 4864 vvvvp.exe 2184 rxxxrff.exe 4448 9rxfxxl.exe 640 nhnntt.exe 3892 dvvpv.exe 4372 1djdv.exe 4348 flrlrll.exe 2072 rrxfxff.exe 2008 bttttb.exe 3020 jvdvp.exe 3920 rrfxrrl.exe 4136 hbhhnn.exe 5092 tbttbh.exe 4272 vpppd.exe 2720 rrxxllf.exe 2772 bnnhbb.exe 1816 bnhbbb.exe 3472 djjjp.exe 3464 jddvd.exe 2576 xxlfrff.exe 636 tntttt.exe 780 bttnnn.exe 4500 jdddv.exe 692 7dppd.exe 4368 vvvdd.exe 1952 rrxxxxx.exe 2176 tntnhn.exe 4408 tthbth.exe 2892 dvdpj.exe 4444 xrffxxx.exe 3808 rrrrlll.exe 548 tnbhnt.exe 2020 jdppj.exe 400 jvjdv.exe 2076 rlllfll.exe 4332 bbhhbn.exe 412 jjjjd.exe 4256 vjppj.exe 3692 rfrlfxx.exe 4700 7bbtbb.exe 624 7tnnnn.exe 936 dpppj.exe 696 pjppv.exe 1048 lfxrrrl.exe 2632 fxxrrrl.exe 4468 hhhhhh.exe 3488 hbbtnh.exe 2196 jdjpd.exe 880 jddvj.exe -
Processes:
resource yara_rule behavioral2/memory/4284-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b.exelffxxrr.exe1ttbbb.exepjdvv.exe1xflxxr.exefrfxrrl.exe7btnhb.exe3jppj.exefrxrllf.exerllrllf.exenthnhh.exe5vpdp.exelfrrffl.exe1fllrxr.exethhnnn.exevdjjj.exevvvvp.exerxxxrff.exe9rxfxxl.exenhnntt.exedvvpv.exe1djdv.exedescription pid process target process PID 4284 wrote to memory of 4368 4284 b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b.exe lffxxrr.exe PID 4284 wrote to memory of 4368 4284 b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b.exe lffxxrr.exe PID 4284 wrote to memory of 4368 4284 b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b.exe lffxxrr.exe PID 4368 wrote to memory of 4568 4368 lffxxrr.exe 1ttbbb.exe PID 4368 wrote to memory of 4568 4368 lffxxrr.exe 1ttbbb.exe PID 4368 wrote to memory of 4568 4368 lffxxrr.exe 1ttbbb.exe PID 4568 wrote to memory of 2936 4568 1ttbbb.exe pjdvv.exe PID 4568 wrote to memory of 2936 4568 1ttbbb.exe pjdvv.exe PID 4568 wrote to memory of 2936 4568 1ttbbb.exe pjdvv.exe PID 2936 wrote to memory of 1000 2936 pjdvv.exe 1xflxxr.exe PID 2936 wrote to memory of 1000 2936 pjdvv.exe 1xflxxr.exe PID 2936 wrote to memory of 1000 2936 pjdvv.exe 1xflxxr.exe PID 1000 wrote to memory of 3720 1000 1xflxxr.exe frfxrrl.exe PID 1000 wrote to memory of 3720 1000 1xflxxr.exe frfxrrl.exe PID 1000 wrote to memory of 3720 1000 1xflxxr.exe frfxrrl.exe PID 3720 wrote to memory of 1692 3720 frfxrrl.exe 7btnhb.exe PID 3720 wrote to memory of 1692 3720 frfxrrl.exe 7btnhb.exe PID 3720 wrote to memory of 1692 3720 frfxrrl.exe 7btnhb.exe PID 1692 wrote to memory of 4888 1692 7btnhb.exe 3jppj.exe PID 1692 wrote to memory of 4888 1692 7btnhb.exe 3jppj.exe PID 1692 wrote to memory of 4888 1692 7btnhb.exe 3jppj.exe PID 4888 wrote to memory of 1732 4888 3jppj.exe frxrllf.exe PID 4888 wrote to memory of 1732 4888 3jppj.exe frxrllf.exe PID 4888 wrote to memory of 1732 4888 3jppj.exe frxrllf.exe PID 1732 wrote to memory of 2264 1732 frxrllf.exe rllrllf.exe PID 1732 wrote to memory of 2264 1732 frxrllf.exe rllrllf.exe PID 1732 wrote to memory of 2264 1732 frxrllf.exe rllrllf.exe PID 2264 wrote to memory of 1152 2264 rllrllf.exe nthnhh.exe PID 2264 wrote to memory of 1152 2264 rllrllf.exe nthnhh.exe PID 2264 wrote to memory of 1152 2264 rllrllf.exe nthnhh.exe PID 1152 wrote to memory of 1944 1152 nthnhh.exe 5vpdp.exe PID 1152 wrote to memory of 1944 1152 nthnhh.exe 5vpdp.exe PID 1152 wrote to memory of 1944 1152 nthnhh.exe 5vpdp.exe PID 1944 wrote to memory of 1084 1944 5vpdp.exe lfrrffl.exe PID 1944 wrote to memory of 1084 1944 5vpdp.exe lfrrffl.exe PID 1944 wrote to memory of 1084 1944 5vpdp.exe lfrrffl.exe PID 1084 wrote to memory of 3140 1084 lfrrffl.exe 1fllrxr.exe PID 1084 wrote to memory of 3140 1084 lfrrffl.exe 1fllrxr.exe PID 1084 wrote to memory of 3140 1084 lfrrffl.exe 1fllrxr.exe PID 3140 wrote to memory of 5064 3140 1fllrxr.exe thhnnn.exe PID 3140 wrote to memory of 5064 3140 1fllrxr.exe thhnnn.exe PID 3140 wrote to memory of 5064 3140 1fllrxr.exe thhnnn.exe PID 5064 wrote to memory of 2356 5064 thhnnn.exe vdjjj.exe PID 5064 wrote to memory of 2356 5064 thhnnn.exe vdjjj.exe PID 5064 wrote to memory of 2356 5064 thhnnn.exe vdjjj.exe PID 2356 wrote to memory of 4864 2356 vdjjj.exe vvvvp.exe PID 2356 wrote to memory of 4864 2356 vdjjj.exe vvvvp.exe PID 2356 wrote to memory of 4864 2356 vdjjj.exe vvvvp.exe PID 4864 wrote to memory of 2184 4864 vvvvp.exe rxxxrff.exe PID 4864 wrote to memory of 2184 4864 vvvvp.exe rxxxrff.exe PID 4864 wrote to memory of 2184 4864 vvvvp.exe rxxxrff.exe PID 2184 wrote to memory of 4448 2184 rxxxrff.exe 9rxfxxl.exe PID 2184 wrote to memory of 4448 2184 rxxxrff.exe 9rxfxxl.exe PID 2184 wrote to memory of 4448 2184 rxxxrff.exe 9rxfxxl.exe PID 4448 wrote to memory of 640 4448 9rxfxxl.exe nhnntt.exe PID 4448 wrote to memory of 640 4448 9rxfxxl.exe nhnntt.exe PID 4448 wrote to memory of 640 4448 9rxfxxl.exe nhnntt.exe PID 640 wrote to memory of 3892 640 nhnntt.exe dvvpv.exe PID 640 wrote to memory of 3892 640 nhnntt.exe dvvpv.exe PID 640 wrote to memory of 3892 640 nhnntt.exe dvvpv.exe PID 3892 wrote to memory of 4372 3892 dvvpv.exe 1djdv.exe PID 3892 wrote to memory of 4372 3892 dvvpv.exe 1djdv.exe PID 3892 wrote to memory of 4372 3892 dvvpv.exe 1djdv.exe PID 4372 wrote to memory of 4348 4372 1djdv.exe flrlrll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b.exe"C:\Users\Admin\AppData\Local\Temp\b2432b844c7a40263894904a48b2675c207c57bb23f5239fbb405b1628075c9b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\lffxxrr.exec:\lffxxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\1ttbbb.exec:\1ttbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\pjdvv.exec:\pjdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\1xflxxr.exec:\1xflxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\frfxrrl.exec:\frfxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\7btnhb.exec:\7btnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\3jppj.exec:\3jppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\frxrllf.exec:\frxrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\rllrllf.exec:\rllrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\nthnhh.exec:\nthnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\5vpdp.exec:\5vpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\lfrrffl.exec:\lfrrffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\1fllrxr.exec:\1fllrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\thhnnn.exec:\thhnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vdjjj.exec:\vdjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\vvvvp.exec:\vvvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\rxxxrff.exec:\rxxxrff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\9rxfxxl.exec:\9rxfxxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\nhnntt.exec:\nhnntt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\dvvpv.exec:\dvvpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\1djdv.exec:\1djdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\flrlrll.exec:\flrlrll.exe23⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rrxfxff.exec:\rrxfxff.exe24⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bttttb.exec:\bttttb.exe25⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jvdvp.exec:\jvdvp.exe26⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe27⤵
- Executes dropped EXE
PID:3920 -
\??\c:\hbhhnn.exec:\hbhhnn.exe28⤵
- Executes dropped EXE
PID:4136 -
\??\c:\tbttbh.exec:\tbttbh.exe29⤵
- Executes dropped EXE
PID:5092 -
\??\c:\vpppd.exec:\vpppd.exe30⤵
- Executes dropped EXE
PID:4272 -
\??\c:\rrxxllf.exec:\rrxxllf.exe31⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bnnhbb.exec:\bnnhbb.exe32⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bnhbbb.exec:\bnhbbb.exe33⤵
- Executes dropped EXE
PID:1816 -
\??\c:\djjjp.exec:\djjjp.exe34⤵
- Executes dropped EXE
PID:3472 -
\??\c:\jddvd.exec:\jddvd.exe35⤵
- Executes dropped EXE
PID:3464 -
\??\c:\xxlfrff.exec:\xxlfrff.exe36⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tntttt.exec:\tntttt.exe37⤵
- Executes dropped EXE
PID:636 -
\??\c:\bttnnn.exec:\bttnnn.exe38⤵
- Executes dropped EXE
PID:780 -
\??\c:\jdddv.exec:\jdddv.exe39⤵
- Executes dropped EXE
PID:4500 -
\??\c:\7dppd.exec:\7dppd.exe40⤵
- Executes dropped EXE
PID:692 -
\??\c:\vvvdd.exec:\vvvdd.exe41⤵
- Executes dropped EXE
PID:4368 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe42⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tntnhn.exec:\tntnhn.exe43⤵
- Executes dropped EXE
PID:2176 -
\??\c:\tthbth.exec:\tthbth.exe44⤵
- Executes dropped EXE
PID:4408 -
\??\c:\dvdpj.exec:\dvdpj.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xrffxxx.exec:\xrffxxx.exe46⤵
- Executes dropped EXE
PID:4444 -
\??\c:\rrrrlll.exec:\rrrrlll.exe47⤵
- Executes dropped EXE
PID:3808 -
\??\c:\tnbhnt.exec:\tnbhnt.exe48⤵
- Executes dropped EXE
PID:548 -
\??\c:\jdppj.exec:\jdppj.exe49⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jvjdv.exec:\jvjdv.exe50⤵
- Executes dropped EXE
PID:400 -
\??\c:\rlllfll.exec:\rlllfll.exe51⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bbhhbn.exec:\bbhhbn.exe52⤵
- Executes dropped EXE
PID:4332 -
\??\c:\jjjjd.exec:\jjjjd.exe53⤵
- Executes dropped EXE
PID:412 -
\??\c:\vjppj.exec:\vjppj.exe54⤵
- Executes dropped EXE
PID:4256 -
\??\c:\rfrlfxx.exec:\rfrlfxx.exe55⤵
- Executes dropped EXE
PID:3692 -
\??\c:\7bbtbb.exec:\7bbtbb.exe56⤵
- Executes dropped EXE
PID:4700 -
\??\c:\7tnnnn.exec:\7tnnnn.exe57⤵
- Executes dropped EXE
PID:624 -
\??\c:\dpppj.exec:\dpppj.exe58⤵
- Executes dropped EXE
PID:936 -
\??\c:\pjppv.exec:\pjppv.exe59⤵
- Executes dropped EXE
PID:696 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe60⤵
- Executes dropped EXE
PID:1048 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe61⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hhhhhh.exec:\hhhhhh.exe62⤵
- Executes dropped EXE
PID:4468 -
\??\c:\hbbtnh.exec:\hbbtnh.exe63⤵
- Executes dropped EXE
PID:3488 -
\??\c:\jdjpd.exec:\jdjpd.exe64⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jddvj.exec:\jddvj.exe65⤵
- Executes dropped EXE
PID:880 -
\??\c:\1lxrrrx.exec:\1lxrrrx.exe66⤵PID:752
-
\??\c:\xrlfffx.exec:\xrlfffx.exe67⤵PID:4492
-
\??\c:\rxfflff.exec:\rxfflff.exe68⤵PID:3644
-
\??\c:\nbnnhh.exec:\nbnnhh.exe69⤵PID:4792
-
\??\c:\jvddv.exec:\jvddv.exe70⤵PID:1888
-
\??\c:\jpdjj.exec:\jpdjj.exe71⤵PID:3128
-
\??\c:\ddjjd.exec:\ddjjd.exe72⤵PID:1696
-
\??\c:\ffrrxxx.exec:\ffrrxxx.exe73⤵PID:1708
-
\??\c:\rfllrrr.exec:\rfllrrr.exe74⤵PID:468
-
\??\c:\nnbbtt.exec:\nnbbtt.exe75⤵PID:3976
-
\??\c:\djddv.exec:\djddv.exe76⤵PID:3168
-
\??\c:\vdpvd.exec:\vdpvd.exe77⤵PID:3180
-
\??\c:\fxxfffr.exec:\fxxfffr.exe78⤵PID:4544
-
\??\c:\3xxfxxr.exec:\3xxfxxr.exe79⤵PID:1684
-
\??\c:\frrlfrl.exec:\frrlfrl.exe80⤵PID:1028
-
\??\c:\hnbtbh.exec:\hnbtbh.exe81⤵PID:408
-
\??\c:\9nttnn.exec:\9nttnn.exe82⤵PID:4528
-
\??\c:\vppjp.exec:\vppjp.exe83⤵PID:652
-
\??\c:\jppjj.exec:\jppjj.exe84⤵PID:3012
-
\??\c:\xrxrrll.exec:\xrxrrll.exe85⤵PID:3820
-
\??\c:\nbbbhh.exec:\nbbbhh.exe86⤵PID:4228
-
\??\c:\vvddv.exec:\vvddv.exe87⤵PID:692
-
\??\c:\pjjdp.exec:\pjjdp.exe88⤵PID:3052
-
\??\c:\xfrrllf.exec:\xfrrllf.exe89⤵PID:852
-
\??\c:\7djjd.exec:\7djjd.exe90⤵PID:4684
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe91⤵PID:4564
-
\??\c:\btbbth.exec:\btbbth.exe92⤵PID:4388
-
\??\c:\5jjdd.exec:\5jjdd.exe93⤵PID:3636
-
\??\c:\jddvv.exec:\jddvv.exe94⤵PID:2420
-
\??\c:\1ffxxfr.exec:\1ffxxfr.exe95⤵PID:60
-
\??\c:\lxxxfll.exec:\lxxxfll.exe96⤵PID:1556
-
\??\c:\7bnhhh.exec:\7bnhhh.exe97⤵PID:2724
-
\??\c:\ntbbbh.exec:\ntbbbh.exe98⤵PID:704
-
\??\c:\jpvdv.exec:\jpvdv.exe99⤵PID:1152
-
\??\c:\fxrrlxx.exec:\fxrrlxx.exe100⤵PID:412
-
\??\c:\htttnt.exec:\htttnt.exe101⤵PID:4772
-
\??\c:\nntthn.exec:\nntthn.exe102⤵PID:3692
-
\??\c:\bnbbbh.exec:\bnbbbh.exe103⤵PID:3104
-
\??\c:\jdpvp.exec:\jdpvp.exe104⤵PID:3980
-
\??\c:\xrllfrr.exec:\xrllfrr.exe105⤵PID:1880
-
\??\c:\xfffflf.exec:\xfffflf.exe106⤵PID:2872
-
\??\c:\bthhbb.exec:\bthhbb.exe107⤵PID:2432
-
\??\c:\nhtttt.exec:\nhtttt.exe108⤵PID:2856
-
\??\c:\pjppp.exec:\pjppp.exe109⤵PID:4288
-
\??\c:\lxfllxr.exec:\lxfllxr.exe110⤵PID:1128
-
\??\c:\9fllrlr.exec:\9fllrlr.exe111⤵PID:540
-
\??\c:\9hnnhh.exec:\9hnnhh.exe112⤵PID:1532
-
\??\c:\vvvvv.exec:\vvvvv.exe113⤵PID:3600
-
\??\c:\lxxrllf.exec:\lxxrllf.exe114⤵PID:2044
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe115⤵PID:2876
-
\??\c:\bbhbtn.exec:\bbhbtn.exe116⤵PID:3048
-
\??\c:\5nnhhh.exec:\5nnhhh.exe117⤵PID:3112
-
\??\c:\pjdvv.exec:\pjdvv.exe118⤵PID:4316
-
\??\c:\ppppp.exec:\ppppp.exe119⤵PID:3396
-
\??\c:\rfrxlxx.exec:\rfrxlxx.exe120⤵PID:4208
-
\??\c:\ttbhhh.exec:\ttbhhh.exe121⤵PID:1852
-
\??\c:\tnnhbb.exec:\tnnhbb.exe122⤵PID:3108
-
\??\c:\3vvpp.exec:\3vvpp.exe123⤵PID:228
-
\??\c:\vpjdv.exec:\vpjdv.exe124⤵PID:3472
-
\??\c:\lrxxrrf.exec:\lrxxrrf.exe125⤵PID:1028
-
\??\c:\rfrxrrf.exec:\rfrxrrf.exe126⤵PID:3772
-
\??\c:\1ntnhh.exec:\1ntnhh.exe127⤵PID:4528
-
\??\c:\pdvvv.exec:\pdvvv.exe128⤵PID:2024
-
\??\c:\rrrlxrf.exec:\rrrlxrf.exe129⤵PID:3532
-
\??\c:\1bbhbt.exec:\1bbhbt.exe130⤵PID:3832
-
\??\c:\thhbtt.exec:\thhbtt.exe131⤵PID:4228
-
\??\c:\vppvp.exec:\vppvp.exe132⤵PID:692
-
\??\c:\fxxrflf.exec:\fxxrflf.exe133⤵PID:948
-
\??\c:\rlrxxfx.exec:\rlrxxfx.exe134⤵PID:4172
-
\??\c:\htnnnt.exec:\htnnnt.exe135⤵PID:216
-
\??\c:\nhnbtt.exec:\nhnbtt.exe136⤵PID:1144
-
\??\c:\lffxxxx.exec:\lffxxxx.exe137⤵PID:1368
-
\??\c:\5lrlrrx.exec:\5lrlrrx.exe138⤵PID:2420
-
\??\c:\3nbhhh.exec:\3nbhhh.exe139⤵PID:2056
-
\??\c:\httntn.exec:\httntn.exe140⤵PID:1556
-
\??\c:\dpddd.exec:\dpddd.exe141⤵PID:4332
-
\??\c:\jdvpj.exec:\jdvpj.exe142⤵PID:2296
-
\??\c:\5llflrl.exec:\5llflrl.exe143⤵PID:2116
-
\??\c:\1fxxxxx.exec:\1fxxxxx.exe144⤵PID:3524
-
\??\c:\rrrrlll.exec:\rrrrlll.exe145⤵PID:3140
-
\??\c:\nnbbbn.exec:\nnbbbn.exe146⤵PID:624
-
\??\c:\hhhbnn.exec:\hhhbnn.exe147⤵PID:936
-
\??\c:\7jvdp.exec:\7jvdp.exe148⤵PID:1980
-
\??\c:\pvddv.exec:\pvddv.exe149⤵PID:2860
-
\??\c:\dppjv.exec:\dppjv.exe150⤵PID:3328
-
\??\c:\3xxrflf.exec:\3xxrflf.exe151⤵PID:3984
-
\??\c:\7xrrrrr.exec:\7xrrrrr.exe152⤵PID:3488
-
\??\c:\ttttnt.exec:\ttttnt.exe153⤵PID:1128
-
\??\c:\tbhtnn.exec:\tbhtnn.exe154⤵PID:540
-
\??\c:\jdvpp.exec:\jdvpp.exe155⤵PID:1532
-
\??\c:\vpjvp.exec:\vpjvp.exe156⤵PID:3600
-
\??\c:\rffrlff.exec:\rffrlff.exe157⤵PID:1716
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe158⤵PID:1748
-
\??\c:\nbbbtn.exec:\nbbbtn.exe159⤵PID:4952
-
\??\c:\hhnntt.exec:\hhnntt.exe160⤵PID:3860
-
\??\c:\dvvpj.exec:\dvvpj.exe161⤵PID:3396
-
\??\c:\pddvj.exec:\pddvj.exe162⤵PID:4396
-
\??\c:\7rxxxxr.exec:\7rxxxxr.exe163⤵PID:1816
-
\??\c:\hnnnhh.exec:\hnnnhh.exe164⤵PID:3108
-
\??\c:\tntnbt.exec:\tntnbt.exe165⤵PID:5056
-
\??\c:\tnhtnh.exec:\tnhtnh.exe166⤵PID:4436
-
\??\c:\vvdpd.exec:\vvdpd.exe167⤵PID:5112
-
\??\c:\pjjdv.exec:\pjjdv.exe168⤵PID:780
-
\??\c:\9frlrrx.exec:\9frlrrx.exe169⤵PID:3040
-
\??\c:\rlflfrl.exec:\rlflfrl.exe170⤵PID:2692
-
\??\c:\bnbtnh.exec:\bnbtnh.exe171⤵PID:4428
-
\??\c:\bhnhhh.exec:\bhnhhh.exe172⤵PID:2176
-
\??\c:\7hnhhh.exec:\7hnhhh.exe173⤵PID:4416
-
\??\c:\pjjdv.exec:\pjjdv.exe174⤵PID:2304
-
\??\c:\3djjd.exec:\3djjd.exe175⤵PID:2732
-
\??\c:\lffxrrl.exec:\lffxrrl.exe176⤵PID:548
-
\??\c:\rlxrrxr.exec:\rlxrrxr.exe177⤵PID:3444
-
\??\c:\9hbbtn.exec:\9hbbtn.exe178⤵PID:2076
-
\??\c:\hbhhhn.exec:\hbhhhn.exe179⤵PID:2100
-
\??\c:\vjjvv.exec:\vjjvv.exe180⤵PID:3988
-
\??\c:\vdjvd.exec:\vdjvd.exe181⤵PID:4700
-
\??\c:\pddvj.exec:\pddvj.exe182⤵PID:3524
-
\??\c:\3fxrxxf.exec:\3fxrxxf.exe183⤵PID:3140
-
\??\c:\xxlfllr.exec:\xxlfllr.exe184⤵PID:624
-
\??\c:\9rrllll.exec:\9rrllll.exe185⤵PID:2928
-
\??\c:\nhhhbb.exec:\nhhhbb.exe186⤵PID:1980
-
\??\c:\7pvpp.exec:\7pvpp.exe187⤵PID:4468
-
\??\c:\vppjj.exec:\vppjj.exe188⤵PID:1392
-
\??\c:\xrlffxx.exec:\xrlffxx.exe189⤵PID:4412
-
\??\c:\thnnhb.exec:\thnnhb.exe190⤵PID:880
-
\??\c:\xlllfrl.exec:\xlllfrl.exe191⤵PID:752
-
\??\c:\5rfxflr.exec:\5rfxflr.exe192⤵PID:2008
-
\??\c:\nthbbb.exec:\nthbbb.exe193⤵PID:2044
-
\??\c:\vddjj.exec:\vddjj.exe194⤵PID:3920
-
\??\c:\9rlfxlf.exec:\9rlfxlf.exe195⤵PID:3828
-
\??\c:\bhhhnh.exec:\bhhhnh.exe196⤵PID:1708
-
\??\c:\xfflflf.exec:\xfflflf.exe197⤵PID:4952
-
\??\c:\hhttnn.exec:\hhttnn.exe198⤵PID:3664
-
\??\c:\djppp.exec:\djppp.exe199⤵PID:1156
-
\??\c:\tnthbh.exec:\tnthbh.exe200⤵PID:3484
-
\??\c:\hbbtnb.exec:\hbbtnb.exe201⤵PID:4384
-
\??\c:\9vddv.exec:\9vddv.exe202⤵PID:4936
-
\??\c:\bnbtnb.exec:\bnbtnb.exe203⤵PID:636
-
\??\c:\1vpvp.exec:\1vpvp.exe204⤵PID:3916
-
\??\c:\jdjdp.exec:\jdjdp.exe205⤵PID:2344
-
\??\c:\1fllfrl.exec:\1fllfrl.exe206⤵PID:2456
-
\??\c:\rllxrlx.exec:\rllxrlx.exe207⤵PID:2520
-
\??\c:\bbhhhh.exec:\bbhhhh.exe208⤵PID:948
-
\??\c:\tnbnhh.exec:\tnbnhh.exe209⤵PID:4684
-
\??\c:\dpppv.exec:\dpppv.exe210⤵PID:216
-
\??\c:\vpdvp.exec:\vpdvp.exe211⤵PID:2292
-
\??\c:\frxrrlr.exec:\frxrrlr.exe212⤵PID:64
-
\??\c:\xlfxllf.exec:\xlfxllf.exe213⤵PID:536
-
\??\c:\fxxlffr.exec:\fxxlffr.exe214⤵PID:1556
-
\??\c:\httthh.exec:\httthh.exe215⤵PID:2148
-
\??\c:\bnnnhh.exec:\bnnnhh.exe216⤵PID:1616
-
\??\c:\pjjjp.exec:\pjjjp.exe217⤵PID:1084
-
\??\c:\jddvp.exec:\jddvp.exe218⤵PID:5108
-
\??\c:\7jddd.exec:\7jddd.exe219⤵PID:3676
-
\??\c:\xxxrxff.exec:\xxxrxff.exe220⤵PID:3104
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe221⤵PID:4504
-
\??\c:\bnhnnn.exec:\bnhnnn.exe222⤵PID:4352
-
\??\c:\5hnnhn.exec:\5hnnhn.exe223⤵PID:2184
-
\??\c:\jdjjp.exec:\jdjjp.exe224⤵PID:4468
-
\??\c:\jdpjd.exec:\jdpjd.exe225⤵PID:4592
-
\??\c:\dvdjd.exec:\dvdjd.exe226⤵PID:960
-
\??\c:\lflffxl.exec:\lflffxl.exe227⤵PID:1128
-
\??\c:\lrfffxx.exec:\lrfffxx.exe228⤵PID:3092
-
\??\c:\xrrrlll.exec:\xrrrlll.exe229⤵PID:3644
-
\??\c:\nbbtnh.exec:\nbbtnh.exe230⤵PID:2044
-
\??\c:\btbhbh.exec:\btbhbh.exe231⤵PID:3920
-
\??\c:\pvpdp.exec:\pvpdp.exe232⤵PID:3632
-
\??\c:\jdvpj.exec:\jdvpj.exe233⤵PID:3992
-
\??\c:\lfrflxr.exec:\lfrflxr.exe234⤵PID:884
-
\??\c:\rrlflfl.exec:\rrlflfl.exe235⤵PID:1156
-
\??\c:\tbbnnh.exec:\tbbnnh.exe236⤵PID:3464
-
\??\c:\bhbbbb.exec:\bhbbbb.exe237⤵PID:4384
-
\??\c:\vpjpj.exec:\vpjpj.exe238⤵PID:652
-
\??\c:\jpvjv.exec:\jpvjv.exe239⤵PID:636
-
\??\c:\rlllffx.exec:\rlllffx.exe240⤵PID:3408
-
\??\c:\rrxflfl.exec:\rrxflfl.exe241⤵PID:3680
-
\??\c:\hbbttn.exec:\hbbttn.exe242⤵PID:2520