Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 04:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc6c12fc48a96c881c7a0459937de74c75aee4a33082e90af15629bd45f47c9d.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
cc6c12fc48a96c881c7a0459937de74c75aee4a33082e90af15629bd45f47c9d.exe
-
Size
366KB
-
MD5
900951e596172ffb105a8b4cf8d78b7e
-
SHA1
1183583ef0c7a9a31bf547538903b1c3c94fdcf2
-
SHA256
cc6c12fc48a96c881c7a0459937de74c75aee4a33082e90af15629bd45f47c9d
-
SHA512
4a2ed5cb769f55bf2410f7371035cca6b5611c8997c31c3ff4e961bacb813c6041d9f5603a7b0b1c824d26759b1a9db0b30d34f92301de35c1114f3d44bd448e
-
SSDEEP
6144:n3C9BRo7tvnJ99T/KZEL3RUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFh5:n3C9ytvnVXFUXoSWlnwJv90aKToFqwfb
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/1552-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-63-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1552-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4756-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4352-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1724-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1496-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3700-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3700-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3232-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3700-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1988-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3344-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1668-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4672-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3328-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3896-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2808-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1272-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3312-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1120-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2736-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4496-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1664-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2312-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/880-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2892-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4340-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
lffxfxx.exehnbtnh.exepdjdv.exeddjdv.exejdjjd.exetnhbbb.exexrrlfxr.exentbtnt.exetbhhbt.exejjjjd.exenbbbtt.exebntnbt.exevvpvv.exelfffrrl.exenbnhbb.exe1rrfxxl.exehttnhb.exejdppj.exepdvvv.exedvdvd.exellrfxrf.exe3ntnbb.exeddppd.exeffxrxxl.exevpjdd.exebtnhbt.exelfrlfxr.exethtnnh.exe3rrlxxl.exetnnbtn.exebhtnhb.exe7vvjd.exefxrlfxl.exefxxrlff.exehhhnhn.exejjjvp.exelrrlfll.exenbnhtt.exevdjdp.exe9flfxrr.exethnhhb.exepjpjd.exerflxrlf.exetttnhb.exedppjd.exefrlfrlx.exe7nnhbh.exerfrrffx.exenbhhbt.exenbtnhn.exexxfxrrl.exefrxrllf.exebntnhh.exedpdjd.exepvvpp.exelfrfllr.exehbhhhb.exepdpjv.exexrrrrrr.exe9lrrlxr.exenhtnbt.exe9jjdv.exe7fxfxfx.exetbbnhn.exepid process 4756 lffxfxx.exe 4352 hnbtnh.exe 1724 pdjdv.exe 4416 ddjdv.exe 1496 jdjjd.exe 3700 tnhbbb.exe 3232 xrrlfxr.exe 4744 ntbtnt.exe 1988 tbhhbt.exe 3344 jjjjd.exe 1668 nbbbtt.exe 4672 bntnbt.exe 3552 vvpvv.exe 3328 lfffrrl.exe 3896 nbnhbb.exe 2808 1rrfxxl.exe 1272 httnhb.exe 3312 jdppj.exe 1120 pdvvv.exe 4496 dvdvd.exe 2736 llrfxrf.exe 3952 3ntnbb.exe 1664 ddppd.exe 2312 ffxrxxl.exe 3540 vpjdd.exe 880 btnhbt.exe 3948 lfrlfxr.exe 1992 thtnnh.exe 2892 3rrlxxl.exe 3092 tnnbtn.exe 4340 bhtnhb.exe 548 7vvjd.exe 2840 fxrlfxl.exe 4472 fxxrlff.exe 776 hhhnhn.exe 1608 jjjvp.exe 4468 lrrlfll.exe 4356 nbnhtt.exe 3964 vdjdp.exe 3152 9flfxrr.exe 3880 thnhhb.exe 1540 pjpjd.exe 212 rflxrlf.exe 3500 tttnhb.exe 2476 dppjd.exe 4872 frlfrlx.exe 4856 7nnhbh.exe 4584 rfrrffx.exe 2128 nbhhbt.exe 3344 nbtnhn.exe 1892 xxfxrrl.exe 3316 frxrllf.exe 3832 bntnhh.exe 1116 dpdjd.exe 1760 pvvpp.exe 4060 lfrfllr.exe 808 hbhhhb.exe 2040 pdpjv.exe 4320 xrrrrrr.exe 1272 9lrrlxr.exe 3168 nhtnbt.exe 3460 9jjdv.exe 4316 7fxfxfx.exe 628 tbbnhn.exe -
Processes:
resource yara_rule behavioral2/memory/1552-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cc6c12fc48a96c881c7a0459937de74c75aee4a33082e90af15629bd45f47c9d.exelffxfxx.exehnbtnh.exepdjdv.exeddjdv.exejdjjd.exetnhbbb.exexrrlfxr.exentbtnt.exetbhhbt.exejjjjd.exenbbbtt.exebntnbt.exevvpvv.exelfffrrl.exenbnhbb.exe1rrfxxl.exehttnhb.exejdppj.exepdvvv.exedvdvd.exellrfxrf.exedescription pid process target process PID 1552 wrote to memory of 4756 1552 cc6c12fc48a96c881c7a0459937de74c75aee4a33082e90af15629bd45f47c9d.exe lffxfxx.exe PID 1552 wrote to memory of 4756 1552 cc6c12fc48a96c881c7a0459937de74c75aee4a33082e90af15629bd45f47c9d.exe lffxfxx.exe PID 1552 wrote to memory of 4756 1552 cc6c12fc48a96c881c7a0459937de74c75aee4a33082e90af15629bd45f47c9d.exe lffxfxx.exe PID 4756 wrote to memory of 4352 4756 lffxfxx.exe hnbtnh.exe PID 4756 wrote to memory of 4352 4756 lffxfxx.exe hnbtnh.exe PID 4756 wrote to memory of 4352 4756 lffxfxx.exe hnbtnh.exe PID 4352 wrote to memory of 1724 4352 hnbtnh.exe pdjdv.exe PID 4352 wrote to memory of 1724 4352 hnbtnh.exe pdjdv.exe PID 4352 wrote to memory of 1724 4352 hnbtnh.exe pdjdv.exe PID 1724 wrote to memory of 4416 1724 pdjdv.exe ddjdv.exe PID 1724 wrote to memory of 4416 1724 pdjdv.exe ddjdv.exe PID 1724 wrote to memory of 4416 1724 pdjdv.exe ddjdv.exe PID 4416 wrote to memory of 1496 4416 ddjdv.exe jdjjd.exe PID 4416 wrote to memory of 1496 4416 ddjdv.exe jdjjd.exe PID 4416 wrote to memory of 1496 4416 ddjdv.exe jdjjd.exe PID 1496 wrote to memory of 3700 1496 jdjjd.exe tnhbbb.exe PID 1496 wrote to memory of 3700 1496 jdjjd.exe tnhbbb.exe PID 1496 wrote to memory of 3700 1496 jdjjd.exe tnhbbb.exe PID 3700 wrote to memory of 3232 3700 tnhbbb.exe xrrlfxr.exe PID 3700 wrote to memory of 3232 3700 tnhbbb.exe xrrlfxr.exe PID 3700 wrote to memory of 3232 3700 tnhbbb.exe xrrlfxr.exe PID 3232 wrote to memory of 4744 3232 xrrlfxr.exe ntbtnt.exe PID 3232 wrote to memory of 4744 3232 xrrlfxr.exe ntbtnt.exe PID 3232 wrote to memory of 4744 3232 xrrlfxr.exe ntbtnt.exe PID 4744 wrote to memory of 1988 4744 ntbtnt.exe tbhhbt.exe PID 4744 wrote to memory of 1988 4744 ntbtnt.exe tbhhbt.exe PID 4744 wrote to memory of 1988 4744 ntbtnt.exe tbhhbt.exe PID 1988 wrote to memory of 3344 1988 tbhhbt.exe jjjjd.exe PID 1988 wrote to memory of 3344 1988 tbhhbt.exe jjjjd.exe PID 1988 wrote to memory of 3344 1988 tbhhbt.exe jjjjd.exe PID 3344 wrote to memory of 1668 3344 jjjjd.exe nbbbtt.exe PID 3344 wrote to memory of 1668 3344 jjjjd.exe nbbbtt.exe PID 3344 wrote to memory of 1668 3344 jjjjd.exe nbbbtt.exe PID 1668 wrote to memory of 4672 1668 nbbbtt.exe bntnbt.exe PID 1668 wrote to memory of 4672 1668 nbbbtt.exe bntnbt.exe PID 1668 wrote to memory of 4672 1668 nbbbtt.exe bntnbt.exe PID 4672 wrote to memory of 3552 4672 bntnbt.exe vvpvv.exe PID 4672 wrote to memory of 3552 4672 bntnbt.exe vvpvv.exe PID 4672 wrote to memory of 3552 4672 bntnbt.exe vvpvv.exe PID 3552 wrote to memory of 3328 3552 vvpvv.exe lfffrrl.exe PID 3552 wrote to memory of 3328 3552 vvpvv.exe lfffrrl.exe PID 3552 wrote to memory of 3328 3552 vvpvv.exe lfffrrl.exe PID 3328 wrote to memory of 3896 3328 lfffrrl.exe nbnhbb.exe PID 3328 wrote to memory of 3896 3328 lfffrrl.exe nbnhbb.exe PID 3328 wrote to memory of 3896 3328 lfffrrl.exe nbnhbb.exe PID 3896 wrote to memory of 2808 3896 nbnhbb.exe 1rrfxxl.exe PID 3896 wrote to memory of 2808 3896 nbnhbb.exe 1rrfxxl.exe PID 3896 wrote to memory of 2808 3896 nbnhbb.exe 1rrfxxl.exe PID 2808 wrote to memory of 1272 2808 1rrfxxl.exe httnhb.exe PID 2808 wrote to memory of 1272 2808 1rrfxxl.exe httnhb.exe PID 2808 wrote to memory of 1272 2808 1rrfxxl.exe httnhb.exe PID 1272 wrote to memory of 3312 1272 httnhb.exe jdppj.exe PID 1272 wrote to memory of 3312 1272 httnhb.exe jdppj.exe PID 1272 wrote to memory of 3312 1272 httnhb.exe jdppj.exe PID 3312 wrote to memory of 1120 3312 jdppj.exe pdvvv.exe PID 3312 wrote to memory of 1120 3312 jdppj.exe pdvvv.exe PID 3312 wrote to memory of 1120 3312 jdppj.exe pdvvv.exe PID 1120 wrote to memory of 4496 1120 pdvvv.exe dvdvd.exe PID 1120 wrote to memory of 4496 1120 pdvvv.exe dvdvd.exe PID 1120 wrote to memory of 4496 1120 pdvvv.exe dvdvd.exe PID 4496 wrote to memory of 2736 4496 dvdvd.exe llrfxrf.exe PID 4496 wrote to memory of 2736 4496 dvdvd.exe llrfxrf.exe PID 4496 wrote to memory of 2736 4496 dvdvd.exe llrfxrf.exe PID 2736 wrote to memory of 3952 2736 llrfxrf.exe 3ntnbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc6c12fc48a96c881c7a0459937de74c75aee4a33082e90af15629bd45f47c9d.exe"C:\Users\Admin\AppData\Local\Temp\cc6c12fc48a96c881c7a0459937de74c75aee4a33082e90af15629bd45f47c9d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\lffxfxx.exec:\lffxfxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\hnbtnh.exec:\hnbtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\pdjdv.exec:\pdjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ddjdv.exec:\ddjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\jdjjd.exec:\jdjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\tnhbbb.exec:\tnhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\ntbtnt.exec:\ntbtnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\tbhhbt.exec:\tbhhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\jjjjd.exec:\jjjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\nbbbtt.exec:\nbbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bntnbt.exec:\bntnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\vvpvv.exec:\vvpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\lfffrrl.exec:\lfffrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\nbnhbb.exec:\nbnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\1rrfxxl.exec:\1rrfxxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\httnhb.exec:\httnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\jdppj.exec:\jdppj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\pdvvv.exec:\pdvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\dvdvd.exec:\dvdvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\llrfxrf.exec:\llrfxrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\3ntnbb.exec:\3ntnbb.exe23⤵
- Executes dropped EXE
PID:3952 -
\??\c:\ddppd.exec:\ddppd.exe24⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ffxrxxl.exec:\ffxrxxl.exe25⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vpjdd.exec:\vpjdd.exe26⤵
- Executes dropped EXE
PID:3540 -
\??\c:\btnhbt.exec:\btnhbt.exe27⤵
- Executes dropped EXE
PID:880 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe28⤵
- Executes dropped EXE
PID:3948 -
\??\c:\thtnnh.exec:\thtnnh.exe29⤵
- Executes dropped EXE
PID:1992 -
\??\c:\3rrlxxl.exec:\3rrlxxl.exe30⤵
- Executes dropped EXE
PID:2892 -
\??\c:\tnnbtn.exec:\tnnbtn.exe31⤵
- Executes dropped EXE
PID:3092 -
\??\c:\bhtnhb.exec:\bhtnhb.exe32⤵
- Executes dropped EXE
PID:4340 -
\??\c:\7vvjd.exec:\7vvjd.exe33⤵
- Executes dropped EXE
PID:548 -
\??\c:\fxrlfxl.exec:\fxrlfxl.exe34⤵
- Executes dropped EXE
PID:2840 -
\??\c:\fxxrlff.exec:\fxxrlff.exe35⤵
- Executes dropped EXE
PID:4472 -
\??\c:\hhhnhn.exec:\hhhnhn.exe36⤵
- Executes dropped EXE
PID:776 -
\??\c:\jjjvp.exec:\jjjvp.exe37⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lrrlfll.exec:\lrrlfll.exe38⤵
- Executes dropped EXE
PID:4468 -
\??\c:\nbnhtt.exec:\nbnhtt.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\vdjdp.exec:\vdjdp.exe40⤵
- Executes dropped EXE
PID:3964 -
\??\c:\9flfxrr.exec:\9flfxrr.exe41⤵
- Executes dropped EXE
PID:3152 -
\??\c:\thnhhb.exec:\thnhhb.exe42⤵
- Executes dropped EXE
PID:3880 -
\??\c:\pjpjd.exec:\pjpjd.exe43⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rflxrlf.exec:\rflxrlf.exe44⤵
- Executes dropped EXE
PID:212 -
\??\c:\tttnhb.exec:\tttnhb.exe45⤵
- Executes dropped EXE
PID:3500 -
\??\c:\dppjd.exec:\dppjd.exe46⤵
- Executes dropped EXE
PID:2476 -
\??\c:\frlfrlx.exec:\frlfrlx.exe47⤵
- Executes dropped EXE
PID:4872 -
\??\c:\7nnhbh.exec:\7nnhbh.exe48⤵
- Executes dropped EXE
PID:4856 -
\??\c:\rfrrffx.exec:\rfrrffx.exe49⤵
- Executes dropped EXE
PID:4584 -
\??\c:\nbhhbt.exec:\nbhhbt.exe50⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nbtnhn.exec:\nbtnhn.exe51⤵
- Executes dropped EXE
PID:3344 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe52⤵
- Executes dropped EXE
PID:1892 -
\??\c:\frxrllf.exec:\frxrllf.exe53⤵
- Executes dropped EXE
PID:3316 -
\??\c:\bntnhh.exec:\bntnhh.exe54⤵
- Executes dropped EXE
PID:3832 -
\??\c:\dpdjd.exec:\dpdjd.exe55⤵
- Executes dropped EXE
PID:1116 -
\??\c:\pvvpp.exec:\pvvpp.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lfrfllr.exec:\lfrfllr.exe57⤵
- Executes dropped EXE
PID:4060 -
\??\c:\hbhhhb.exec:\hbhhhb.exe58⤵
- Executes dropped EXE
PID:808 -
\??\c:\pdpjv.exec:\pdpjv.exe59⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe60⤵
- Executes dropped EXE
PID:4320 -
\??\c:\9lrrlxr.exec:\9lrrlxr.exe61⤵
- Executes dropped EXE
PID:1272 -
\??\c:\nhtnbt.exec:\nhtnbt.exe62⤵
- Executes dropped EXE
PID:3168 -
\??\c:\9jjdv.exec:\9jjdv.exe63⤵
- Executes dropped EXE
PID:3460 -
\??\c:\7fxfxfx.exec:\7fxfxfx.exe64⤵
- Executes dropped EXE
PID:4316 -
\??\c:\tbbnhn.exec:\tbbnhn.exe65⤵
- Executes dropped EXE
PID:628 -
\??\c:\jdpjp.exec:\jdpjp.exe66⤵PID:1340
-
\??\c:\djjjj.exec:\djjjj.exe67⤵PID:4752
-
\??\c:\lffxrlf.exec:\lffxrlf.exe68⤵PID:4932
-
\??\c:\hhhhbb.exec:\hhhhbb.exe69⤵PID:3496
-
\??\c:\hbtthh.exec:\hbtthh.exe70⤵PID:5040
-
\??\c:\5jppp.exec:\5jppp.exe71⤵PID:3760
-
\??\c:\rlrrlll.exec:\rlrrlll.exe72⤵PID:3948
-
\??\c:\1hnhhb.exec:\1hnhhb.exe73⤵PID:3368
-
\??\c:\httnht.exec:\httnht.exe74⤵PID:3032
-
\??\c:\ppdpp.exec:\ppdpp.exe75⤵PID:3092
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe76⤵PID:4424
-
\??\c:\flrlfff.exec:\flrlfff.exe77⤵PID:844
-
\??\c:\bbnhbb.exec:\bbnhbb.exe78⤵PID:396
-
\??\c:\vvddv.exec:\vvddv.exe79⤵PID:4720
-
\??\c:\1djdj.exec:\1djdj.exe80⤵PID:3584
-
\??\c:\1rrlllf.exec:\1rrlllf.exe81⤵PID:1916
-
\??\c:\thbtnh.exec:\thbtnh.exe82⤵PID:804
-
\??\c:\lrfxllx.exec:\lrfxllx.exe83⤵PID:4160
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe84⤵PID:2868
-
\??\c:\7bhbbb.exec:\7bhbbb.exe85⤵PID:4156
-
\??\c:\vppjd.exec:\vppjd.exe86⤵PID:1744
-
\??\c:\rxxlxxx.exec:\rxxlxxx.exe87⤵PID:4088
-
\??\c:\3tttnn.exec:\3tttnn.exe88⤵PID:2968
-
\??\c:\nhthbt.exec:\nhthbt.exe89⤵PID:3500
-
\??\c:\vvdpv.exec:\vvdpv.exe90⤵PID:1052
-
\??\c:\dvvpd.exec:\dvvpd.exe91⤵PID:4872
-
\??\c:\ffffxxr.exec:\ffffxxr.exe92⤵PID:4856
-
\??\c:\3tbttt.exec:\3tbttt.exe93⤵PID:4584
-
\??\c:\9jjdv.exec:\9jjdv.exe94⤵PID:4052
-
\??\c:\ddddd.exec:\ddddd.exe95⤵PID:2392
-
\??\c:\3lrlxxr.exec:\3lrlxxr.exe96⤵PID:3292
-
\??\c:\bbtnbb.exec:\bbtnbb.exe97⤵PID:3832
-
\??\c:\jjvpv.exec:\jjvpv.exe98⤵PID:3328
-
\??\c:\ppdvd.exec:\ppdvd.exe99⤵PID:964
-
\??\c:\5rxfxxx.exec:\5rxfxxx.exe100⤵PID:2488
-
\??\c:\hbnbhb.exec:\hbnbhb.exe101⤵PID:884
-
\??\c:\bhthhb.exec:\bhthhb.exe102⤵PID:4592
-
\??\c:\dvvvp.exec:\dvvvp.exe103⤵PID:4984
-
\??\c:\fxlrlrl.exec:\fxlrlrl.exe104⤵PID:4176
-
\??\c:\frxlfxr.exec:\frxlfxr.exe105⤵PID:3732
-
\??\c:\bthhbb.exec:\bthhbb.exe106⤵PID:2320
-
\??\c:\dpvvv.exec:\dpvvv.exe107⤵PID:3336
-
\??\c:\lffxrll.exec:\lffxrll.exe108⤵PID:936
-
\??\c:\bnnhtn.exec:\bnnhtn.exe109⤵PID:532
-
\??\c:\jdjdj.exec:\jdjdj.exe110⤵PID:2144
-
\??\c:\bbtnhh.exec:\bbtnhh.exe111⤵PID:4656
-
\??\c:\tnhhbb.exec:\tnhhbb.exe112⤵PID:4620
-
\??\c:\jddvj.exec:\jddvj.exe113⤵PID:2504
-
\??\c:\xrllffx.exec:\xrllffx.exe114⤵PID:4340
-
\??\c:\3tntnb.exec:\3tntnb.exe115⤵PID:4976
-
\??\c:\nthbtt.exec:\nthbtt.exe116⤵PID:2840
-
\??\c:\9pdvj.exec:\9pdvj.exe117⤵PID:1924
-
\??\c:\xrffrrx.exec:\xrffrrx.exe118⤵PID:1548
-
\??\c:\5tbtnn.exec:\5tbtnn.exe119⤵PID:1608
-
\??\c:\tbntnh.exec:\tbntnh.exe120⤵PID:404
-
\??\c:\vppjd.exec:\vppjd.exe121⤵PID:1724
-
\??\c:\rfrfxrr.exec:\rfrfxrr.exe122⤵PID:848
-
\??\c:\ntbttt.exec:\ntbttt.exe123⤵PID:1496
-
\??\c:\nntbbt.exec:\nntbbt.exe124⤵PID:3440
-
\??\c:\ddpjj.exec:\ddpjj.exe125⤵PID:4556
-
\??\c:\rrrlxrl.exec:\rrrlxrl.exe126⤵PID:4916
-
\??\c:\hhhhbt.exec:\hhhhbt.exe127⤵PID:5048
-
\??\c:\bhhnnn.exec:\bhhnnn.exe128⤵PID:2524
-
\??\c:\vpdvj.exec:\vpdvj.exe129⤵PID:4872
-
\??\c:\pdjvp.exec:\pdjvp.exe130⤵PID:4584
-
\??\c:\xfffrrl.exec:\xfffrrl.exe131⤵PID:4052
-
\??\c:\bnbtnh.exec:\bnbtnh.exe132⤵PID:2012
-
\??\c:\bttnhb.exec:\bttnhb.exe133⤵PID:1116
-
\??\c:\pjdvv.exec:\pjdvv.exe134⤵PID:2496
-
\??\c:\xrlxlfl.exec:\xrlxlfl.exe135⤵PID:808
-
\??\c:\frrlfrl.exec:\frrlfrl.exe136⤵PID:2040
-
\??\c:\9ttnhb.exec:\9ttnhb.exe137⤵PID:1912
-
\??\c:\1nnhbb.exec:\1nnhbb.exe138⤵PID:3856
-
\??\c:\vjjdv.exec:\vjjdv.exe139⤵PID:3736
-
\??\c:\3ffxlrl.exec:\3ffxlrl.exe140⤵PID:436
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe141⤵PID:2908
-
\??\c:\1tnhhh.exec:\1tnhhh.exe142⤵PID:2544
-
\??\c:\dvjdv.exec:\dvjdv.exe143⤵PID:4624
-
\??\c:\fffxxrr.exec:\fffxxrr.exe144⤵PID:5012
-
\??\c:\llfxrrr.exec:\llfxrrr.exe145⤵PID:3948
-
\??\c:\bbnhbb.exec:\bbnhbb.exe146⤵PID:4580
-
\??\c:\pjdvp.exec:\pjdvp.exe147⤵PID:3528
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe148⤵PID:1444
-
\??\c:\bbbttn.exec:\bbbttn.exe149⤵PID:1268
-
\??\c:\7hbttt.exec:\7hbttt.exe150⤵PID:4836
-
\??\c:\ppjpp.exec:\ppjpp.exe151⤵PID:4976
-
\??\c:\9rlfrrf.exec:\9rlfrrf.exe152⤵PID:2840
-
\??\c:\fflxxrf.exec:\fflxxrf.exe153⤵PID:4452
-
\??\c:\7tbttt.exec:\7tbttt.exe154⤵PID:1548
-
\??\c:\jdjdd.exec:\jdjdd.exe155⤵PID:4520
-
\??\c:\frxrfxr.exec:\frxrfxr.exe156⤵PID:3060
-
\??\c:\xrrlffr.exec:\xrrlffr.exe157⤵PID:3964
-
\??\c:\bnbbtb.exec:\bnbbtb.exe158⤵PID:3880
-
\??\c:\pjvvp.exec:\pjvvp.exe159⤵PID:2904
-
\??\c:\3pvvp.exec:\3pvvp.exe160⤵PID:3708
-
\??\c:\llllfff.exec:\llllfff.exe161⤵PID:4556
-
\??\c:\thtnhb.exec:\thtnhb.exe162⤵PID:1644
-
\??\c:\7nhtnh.exec:\7nhtnh.exe163⤵PID:5048
-
\??\c:\vjjdp.exec:\vjjdp.exe164⤵PID:3044
-
\??\c:\1xxrlrf.exec:\1xxrlrf.exe165⤵PID:3724
-
\??\c:\lffxllf.exec:\lffxllf.exe166⤵PID:4200
-
\??\c:\htbtnt.exec:\htbtnt.exe167⤵PID:336
-
\??\c:\dvjdp.exec:\dvjdp.exe168⤵PID:3352
-
\??\c:\rrxrlrl.exec:\rrxrlrl.exe169⤵PID:4924
-
\??\c:\xxfxllx.exec:\xxfxllx.exe170⤵PID:4036
-
\??\c:\hntbtn.exec:\hntbtn.exe171⤵PID:432
-
\??\c:\bnttnh.exec:\bnttnh.exe172⤵PID:3460
-
\??\c:\vppjv.exec:\vppjv.exe173⤵PID:4728
-
\??\c:\1llfxxr.exec:\1llfxxr.exe174⤵PID:4592
-
\??\c:\1fxrllf.exec:\1fxrllf.exe175⤵PID:2676
-
\??\c:\hbbnbt.exec:\hbbnbt.exe176⤵PID:2996
-
\??\c:\bhhbnn.exec:\bhhbnn.exe177⤵PID:1696
-
\??\c:\pjjpp.exec:\pjjpp.exe178⤵PID:2360
-
\??\c:\fxrrllf.exec:\fxrrllf.exe179⤵PID:4972
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe180⤵PID:3904
-
\??\c:\hhnhtn.exec:\hhnhtn.exe181⤵PID:1264
-
\??\c:\hhtnnn.exec:\hhtnnn.exe182⤵PID:3368
-
\??\c:\jpvdv.exec:\jpvdv.exe183⤵PID:2400
-
\??\c:\1lllffr.exec:\1lllffr.exe184⤵PID:3132
-
\??\c:\rllfxxr.exec:\rllfxxr.exe185⤵PID:3116
-
\??\c:\nhnhbt.exec:\nhnhbt.exe186⤵PID:844
-
\??\c:\nbnbhb.exec:\nbnbhb.exe187⤵PID:3464
-
\??\c:\vjjjd.exec:\vjjjd.exe188⤵PID:4960
-
\??\c:\lfrlfll.exec:\lfrlfll.exe189⤵PID:1600
-
\??\c:\1bhbnb.exec:\1bhbnb.exe190⤵PID:804
-
\??\c:\thnbbb.exec:\thnbbb.exe191⤵PID:4356
-
\??\c:\vjpjd.exec:\vjpjd.exe192⤵PID:2868
-
\??\c:\rrrlfrl.exec:\rrrlfrl.exe193⤵PID:2224
-
\??\c:\rrrllll.exec:\rrrllll.exe194⤵PID:2068
-
\??\c:\ththtn.exec:\ththtn.exe195⤵PID:3700
-
\??\c:\ttnhhn.exec:\ttnhhn.exe196⤵PID:1612
-
\??\c:\jddvj.exec:\jddvj.exe197⤵PID:1784
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe198⤵PID:1988
-
\??\c:\hbnbht.exec:\hbnbht.exe199⤵PID:364
-
\??\c:\thnbtt.exec:\thnbtt.exe200⤵PID:4488
-
\??\c:\3jjjd.exec:\3jjjd.exe201⤵PID:4236
-
\??\c:\fxxrxrf.exec:\fxxrxrf.exe202⤵PID:1468
-
\??\c:\tbtbnh.exec:\tbtbnh.exe203⤵PID:4932
-
\??\c:\hthbtn.exec:\hthbtn.exe204⤵PID:1944
-
\??\c:\ddppj.exec:\ddppj.exe205⤵PID:3352
-
\??\c:\pjdvp.exec:\pjdvp.exe206⤵PID:4924
-
\??\c:\xffffxl.exec:\xffffxl.exe207⤵PID:4036
-
\??\c:\bhnhbt.exec:\bhnhbt.exe208⤵PID:1048
-
\??\c:\pdjdp.exec:\pdjdp.exe209⤵PID:1664
-
\??\c:\jjvvp.exec:\jjvvp.exe210⤵PID:2472
-
\??\c:\rrxxrrx.exec:\rrxxrrx.exe211⤵PID:4984
-
\??\c:\nbhbtt.exec:\nbhbtt.exe212⤵PID:436
-
\??\c:\htttnn.exec:\htttnn.exe213⤵PID:1188
-
\??\c:\jpvvp.exec:\jpvvp.exe214⤵PID:2908
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe215⤵PID:3760
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe216⤵PID:1740
-
\??\c:\bnnntn.exec:\bnnntn.exe217⤵PID:2892
-
\??\c:\jpjdp.exec:\jpjdp.exe218⤵PID:3112
-
\??\c:\1lxrxfl.exec:\1lxrxfl.exe219⤵PID:3100
-
\??\c:\fxlxrlf.exec:\fxlxrlf.exe220⤵PID:3284
-
\??\c:\hhtnhh.exec:\hhtnhh.exe221⤵PID:4444
-
\??\c:\5djdj.exec:\5djdj.exe222⤵PID:1268
-
\??\c:\vpvdv.exec:\vpvdv.exe223⤵PID:4976
-
\??\c:\frfxrrl.exec:\frfxrrl.exe224⤵PID:636
-
\??\c:\7bhhbb.exec:\7bhhbb.exe225⤵PID:2564
-
\??\c:\1ppjd.exec:\1ppjd.exe226⤵PID:4248
-
\??\c:\dpvpj.exec:\dpvpj.exe227⤵PID:1724
-
\??\c:\rfllflr.exec:\rfllflr.exe228⤵PID:2456
-
\??\c:\nbnhbb.exec:\nbnhbb.exe229⤵PID:1496
-
\??\c:\tnthbb.exec:\tnthbb.exe230⤵PID:3880
-
\??\c:\3ppjv.exec:\3ppjv.exe231⤵PID:2904
-
\??\c:\xrrfxxl.exec:\xrrfxxl.exe232⤵PID:3700
-
\??\c:\5hhbtt.exec:\5hhbtt.exe233⤵PID:1680
-
\??\c:\bnhbnt.exec:\bnhbnt.exe234⤵PID:3640
-
\??\c:\vjpjd.exec:\vjpjd.exe235⤵PID:3044
-
\??\c:\lrxfxxx.exec:\lrxfxxx.exe236⤵PID:4872
-
\??\c:\bhttnh.exec:\bhttnh.exe237⤵PID:4584
-
\??\c:\bhnhbb.exec:\bhnhbb.exe238⤵PID:3056
-
\??\c:\ppjjv.exec:\ppjjv.exe239⤵PID:4876
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe240⤵PID:4932
-
\??\c:\3llfxrl.exec:\3llfxrl.exe241⤵PID:1760
-
\??\c:\thnttt.exec:\thnttt.exe242⤵PID:2808