Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 05:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f15b7a54359bb613e4f27fa6632dba4968a8522d876b8f0b5ab84711b9aa6ad8.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
f15b7a54359bb613e4f27fa6632dba4968a8522d876b8f0b5ab84711b9aa6ad8.exe
-
Size
81KB
-
MD5
b147399446e2715118189b3ef30c3df7
-
SHA1
7e929a592a52c084baa185c838827ce2ef251f98
-
SHA256
f15b7a54359bb613e4f27fa6632dba4968a8522d876b8f0b5ab84711b9aa6ad8
-
SHA512
f8c6ed2c7898e8d19428dbbeba86240f2be949613785640d6086d0132675d4465b11f0cc13480fd3203d44b676bbff4430a82a2fc9ca8abb8b334f1f20c86439
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIwtOa2dYS8nj8:ymb3NkkiQ3mdBjFo7LAIbT6j8
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/5028-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/604-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
Processes:
resource yara_rule behavioral2/memory/5028-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2960-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2960-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2504-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3612-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1428-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/604-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/604-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/604-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/604-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4068-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2448-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4444-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1200-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1004-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2364-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2488-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2968-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4684-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3112-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1472-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/384-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3500-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1960-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1968-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4016-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
xrfrffl.exennnnnt.exevpjdp.exejdvdp.exerrlfllx.exebtbtnn.exejvddp.exe7llfxxx.exehnhhtt.exejvpdp.exerlxrxxl.exenhhbhb.exebhbtnn.exedjvvd.exe7ffxrrf.exetthnnt.exentbtnn.exepjjdv.exexlrlrrl.exebbhntt.exebbhhbt.exeppjdv.exe5xrlxxl.exexxxrrlf.exethnhbb.exerxflflf.exexllffff.exettbttt.exedjjdd.exexxfxrrr.exe5bhbtt.exebhbtnh.exeppjpp.exerxrrfxl.exennnnnh.exe9dpdj.exevvvvd.exerlxlfxr.exe1ntnth.exetbhhbb.exevjjjj.exe9xfxlrl.exexrxxxfl.exe7hhntb.exedvdjp.exepjppj.exe7rxxrrr.exethbnbt.exe9hbhtb.exe3ppjd.exerxxrffx.exefrffxxr.exebtbbtt.exejppjd.exevpvvp.exedpjdp.exe3lrrllr.exethbhhh.exetnnhhb.exevpvpd.exevpvpp.exelrxrffx.exe3hnhhb.exehnnhbt.exepid process 2960 xrfrffl.exe 3612 nnnnnt.exe 2504 vpjdp.exe 1428 jdvdp.exe 604 rrlfllx.exe 4068 btbtnn.exe 2448 jvddp.exe 3860 7llfxxx.exe 4444 hnhhtt.exe 1200 jvpdp.exe 1004 rlxrxxl.exe 2364 nhhbhb.exe 2488 bhbtnn.exe 3744 djvvd.exe 1392 7ffxrrf.exe 1596 tthnnt.exe 2968 ntbtnn.exe 4804 pjjdv.exe 4684 xlrlrrl.exe 3112 bbhntt.exe 4100 bbhhbt.exe 1472 ppjdv.exe 384 5xrlxxl.exe 2080 xxxrrlf.exe 3500 thnhbb.exe 2588 rxflflf.exe 1960 xllffff.exe 1968 ttbttt.exe 2984 djjdd.exe 4016 xxfxrrr.exe 3528 5bhbtt.exe 3228 bhbtnh.exe 4776 ppjpp.exe 2052 rxrrfxl.exe 4812 nnnnnh.exe 4656 9dpdj.exe 2292 vvvvd.exe 3216 rlxlfxr.exe 1496 1ntnth.exe 4432 tbhhbb.exe 2524 vjjjj.exe 5064 9xfxlrl.exe 4960 xrxxxfl.exe 2848 7hhntb.exe 3732 dvdjp.exe 1756 pjppj.exe 3188 7rxxrrr.exe 1936 thbnbt.exe 4512 9hbhtb.exe 5068 3ppjd.exe 3240 rxxrffx.exe 4588 frffxxr.exe 540 btbbtt.exe 2880 jppjd.exe 4460 vpvvp.exe 508 dpjdp.exe 2264 3lrrllr.exe 3176 thbhhh.exe 3792 tnnhhb.exe 1384 vpvpd.exe 344 vpvpp.exe 4832 lrxrffx.exe 4972 3hnhhb.exe 1848 hnnhbt.exe -
Processes:
resource yara_rule behavioral2/memory/5028-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/604-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/604-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/604-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/604-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f15b7a54359bb613e4f27fa6632dba4968a8522d876b8f0b5ab84711b9aa6ad8.exexrfrffl.exennnnnt.exevpjdp.exejdvdp.exerrlfllx.exebtbtnn.exejvddp.exe7llfxxx.exehnhhtt.exejvpdp.exerlxrxxl.exenhhbhb.exebhbtnn.exedjvvd.exe7ffxrrf.exetthnnt.exentbtnn.exepjjdv.exexlrlrrl.exebbhntt.exebbhhbt.exedescription pid process target process PID 5028 wrote to memory of 2960 5028 f15b7a54359bb613e4f27fa6632dba4968a8522d876b8f0b5ab84711b9aa6ad8.exe xrfrffl.exe PID 5028 wrote to memory of 2960 5028 f15b7a54359bb613e4f27fa6632dba4968a8522d876b8f0b5ab84711b9aa6ad8.exe xrfrffl.exe PID 5028 wrote to memory of 2960 5028 f15b7a54359bb613e4f27fa6632dba4968a8522d876b8f0b5ab84711b9aa6ad8.exe xrfrffl.exe PID 2960 wrote to memory of 3612 2960 xrfrffl.exe nnnnnt.exe PID 2960 wrote to memory of 3612 2960 xrfrffl.exe nnnnnt.exe PID 2960 wrote to memory of 3612 2960 xrfrffl.exe nnnnnt.exe PID 3612 wrote to memory of 2504 3612 nnnnnt.exe vpjdp.exe PID 3612 wrote to memory of 2504 3612 nnnnnt.exe vpjdp.exe PID 3612 wrote to memory of 2504 3612 nnnnnt.exe vpjdp.exe PID 2504 wrote to memory of 1428 2504 vpjdp.exe jdvdp.exe PID 2504 wrote to memory of 1428 2504 vpjdp.exe jdvdp.exe PID 2504 wrote to memory of 1428 2504 vpjdp.exe jdvdp.exe PID 1428 wrote to memory of 604 1428 jdvdp.exe rrlfllx.exe PID 1428 wrote to memory of 604 1428 jdvdp.exe rrlfllx.exe PID 1428 wrote to memory of 604 1428 jdvdp.exe rrlfllx.exe PID 604 wrote to memory of 4068 604 rrlfllx.exe btbtnn.exe PID 604 wrote to memory of 4068 604 rrlfllx.exe btbtnn.exe PID 604 wrote to memory of 4068 604 rrlfllx.exe btbtnn.exe PID 4068 wrote to memory of 2448 4068 btbtnn.exe jvddp.exe PID 4068 wrote to memory of 2448 4068 btbtnn.exe jvddp.exe PID 4068 wrote to memory of 2448 4068 btbtnn.exe jvddp.exe PID 2448 wrote to memory of 3860 2448 jvddp.exe 7llfxxx.exe PID 2448 wrote to memory of 3860 2448 jvddp.exe 7llfxxx.exe PID 2448 wrote to memory of 3860 2448 jvddp.exe 7llfxxx.exe PID 3860 wrote to memory of 4444 3860 7llfxxx.exe hnhhtt.exe PID 3860 wrote to memory of 4444 3860 7llfxxx.exe hnhhtt.exe PID 3860 wrote to memory of 4444 3860 7llfxxx.exe hnhhtt.exe PID 4444 wrote to memory of 1200 4444 hnhhtt.exe jvpdp.exe PID 4444 wrote to memory of 1200 4444 hnhhtt.exe jvpdp.exe PID 4444 wrote to memory of 1200 4444 hnhhtt.exe jvpdp.exe PID 1200 wrote to memory of 1004 1200 jvpdp.exe rlxrxxl.exe PID 1200 wrote to memory of 1004 1200 jvpdp.exe rlxrxxl.exe PID 1200 wrote to memory of 1004 1200 jvpdp.exe rlxrxxl.exe PID 1004 wrote to memory of 2364 1004 rlxrxxl.exe nhhbhb.exe PID 1004 wrote to memory of 2364 1004 rlxrxxl.exe nhhbhb.exe PID 1004 wrote to memory of 2364 1004 rlxrxxl.exe nhhbhb.exe PID 2364 wrote to memory of 2488 2364 nhhbhb.exe bhbtnn.exe PID 2364 wrote to memory of 2488 2364 nhhbhb.exe bhbtnn.exe PID 2364 wrote to memory of 2488 2364 nhhbhb.exe bhbtnn.exe PID 2488 wrote to memory of 3744 2488 bhbtnn.exe djvvd.exe PID 2488 wrote to memory of 3744 2488 bhbtnn.exe djvvd.exe PID 2488 wrote to memory of 3744 2488 bhbtnn.exe djvvd.exe PID 3744 wrote to memory of 1392 3744 djvvd.exe 7ffxrrf.exe PID 3744 wrote to memory of 1392 3744 djvvd.exe 7ffxrrf.exe PID 3744 wrote to memory of 1392 3744 djvvd.exe 7ffxrrf.exe PID 1392 wrote to memory of 1596 1392 7ffxrrf.exe tthnnt.exe PID 1392 wrote to memory of 1596 1392 7ffxrrf.exe tthnnt.exe PID 1392 wrote to memory of 1596 1392 7ffxrrf.exe tthnnt.exe PID 1596 wrote to memory of 2968 1596 tthnnt.exe ntbtnn.exe PID 1596 wrote to memory of 2968 1596 tthnnt.exe ntbtnn.exe PID 1596 wrote to memory of 2968 1596 tthnnt.exe ntbtnn.exe PID 2968 wrote to memory of 4804 2968 ntbtnn.exe pjjdv.exe PID 2968 wrote to memory of 4804 2968 ntbtnn.exe pjjdv.exe PID 2968 wrote to memory of 4804 2968 ntbtnn.exe pjjdv.exe PID 4804 wrote to memory of 4684 4804 pjjdv.exe xlrlrrl.exe PID 4804 wrote to memory of 4684 4804 pjjdv.exe xlrlrrl.exe PID 4804 wrote to memory of 4684 4804 pjjdv.exe xlrlrrl.exe PID 4684 wrote to memory of 3112 4684 xlrlrrl.exe bbhntt.exe PID 4684 wrote to memory of 3112 4684 xlrlrrl.exe bbhntt.exe PID 4684 wrote to memory of 3112 4684 xlrlrrl.exe bbhntt.exe PID 3112 wrote to memory of 4100 3112 bbhntt.exe bbhhbt.exe PID 3112 wrote to memory of 4100 3112 bbhntt.exe bbhhbt.exe PID 3112 wrote to memory of 4100 3112 bbhntt.exe bbhhbt.exe PID 4100 wrote to memory of 1472 4100 bbhhbt.exe ppjdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f15b7a54359bb613e4f27fa6632dba4968a8522d876b8f0b5ab84711b9aa6ad8.exe"C:\Users\Admin\AppData\Local\Temp\f15b7a54359bb613e4f27fa6632dba4968a8522d876b8f0b5ab84711b9aa6ad8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\xrfrffl.exec:\xrfrffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\nnnnnt.exec:\nnnnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\vpjdp.exec:\vpjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jdvdp.exec:\jdvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\rrlfllx.exec:\rrlfllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\btbtnn.exec:\btbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\jvddp.exec:\jvddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\7llfxxx.exec:\7llfxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\hnhhtt.exec:\hnhhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\jvpdp.exec:\jvpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\nhhbhb.exec:\nhhbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\bhbtnn.exec:\bhbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\djvvd.exec:\djvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\7ffxrrf.exec:\7ffxrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\tthnnt.exec:\tthnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\ntbtnn.exec:\ntbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\pjjdv.exec:\pjjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\xlrlrrl.exec:\xlrlrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\bbhntt.exec:\bbhntt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\bbhhbt.exec:\bbhhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\ppjdv.exec:\ppjdv.exe23⤵
- Executes dropped EXE
PID:1472 -
\??\c:\5xrlxxl.exec:\5xrlxxl.exe24⤵
- Executes dropped EXE
PID:384 -
\??\c:\xxxrrlf.exec:\xxxrrlf.exe25⤵
- Executes dropped EXE
PID:2080 -
\??\c:\thnhbb.exec:\thnhbb.exe26⤵
- Executes dropped EXE
PID:3500 -
\??\c:\rxflflf.exec:\rxflflf.exe27⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xllffff.exec:\xllffff.exe28⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ttbttt.exec:\ttbttt.exe29⤵
- Executes dropped EXE
PID:1968 -
\??\c:\djjdd.exec:\djjdd.exe30⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe31⤵
- Executes dropped EXE
PID:4016 -
\??\c:\5bhbtt.exec:\5bhbtt.exe32⤵
- Executes dropped EXE
PID:3528 -
\??\c:\bhbtnh.exec:\bhbtnh.exe33⤵
- Executes dropped EXE
PID:3228 -
\??\c:\ppjpp.exec:\ppjpp.exe34⤵
- Executes dropped EXE
PID:4776 -
\??\c:\rxrrfxl.exec:\rxrrfxl.exe35⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nnnnnh.exec:\nnnnnh.exe36⤵
- Executes dropped EXE
PID:4812 -
\??\c:\9dpdj.exec:\9dpdj.exe37⤵
- Executes dropped EXE
PID:4656 -
\??\c:\vvvvd.exec:\vvvvd.exe38⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rlxlfxr.exec:\rlxlfxr.exe39⤵
- Executes dropped EXE
PID:3216 -
\??\c:\1ntnth.exec:\1ntnth.exe40⤵
- Executes dropped EXE
PID:1496 -
\??\c:\tbhhbb.exec:\tbhhbb.exe41⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vjjjj.exec:\vjjjj.exe42⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9xfxlrl.exec:\9xfxlrl.exe43⤵
- Executes dropped EXE
PID:5064 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe44⤵
- Executes dropped EXE
PID:4960 -
\??\c:\7hhntb.exec:\7hhntb.exe45⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dvdjp.exec:\dvdjp.exe46⤵
- Executes dropped EXE
PID:3732 -
\??\c:\pjppj.exec:\pjppj.exe47⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7rxxrrr.exec:\7rxxrrr.exe48⤵
- Executes dropped EXE
PID:3188 -
\??\c:\thbnbt.exec:\thbnbt.exe49⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9hbhtb.exec:\9hbhtb.exe50⤵
- Executes dropped EXE
PID:4512 -
\??\c:\3ppjd.exec:\3ppjd.exe51⤵
- Executes dropped EXE
PID:5068 -
\??\c:\rxxrffx.exec:\rxxrffx.exe52⤵
- Executes dropped EXE
PID:3240 -
\??\c:\frffxxr.exec:\frffxxr.exe53⤵
- Executes dropped EXE
PID:4588 -
\??\c:\btbbtt.exec:\btbbtt.exe54⤵
- Executes dropped EXE
PID:540 -
\??\c:\jppjd.exec:\jppjd.exe55⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vpvvp.exec:\vpvvp.exe56⤵
- Executes dropped EXE
PID:4460 -
\??\c:\dpjdp.exec:\dpjdp.exe57⤵
- Executes dropped EXE
PID:508 -
\??\c:\3lrrllr.exec:\3lrrllr.exe58⤵
- Executes dropped EXE
PID:2264 -
\??\c:\thbhhh.exec:\thbhhh.exe59⤵
- Executes dropped EXE
PID:3176 -
\??\c:\tnnhhb.exec:\tnnhhb.exe60⤵
- Executes dropped EXE
PID:3792 -
\??\c:\vpvpd.exec:\vpvpd.exe61⤵
- Executes dropped EXE
PID:1384 -
\??\c:\vpvpp.exec:\vpvpp.exe62⤵
- Executes dropped EXE
PID:344 -
\??\c:\lrxrffx.exec:\lrxrffx.exe63⤵
- Executes dropped EXE
PID:4832 -
\??\c:\3hnhhb.exec:\3hnhhb.exe64⤵
- Executes dropped EXE
PID:4972 -
\??\c:\hnnhbt.exec:\hnnhbt.exe65⤵
- Executes dropped EXE
PID:1848 -
\??\c:\vjjdp.exec:\vjjdp.exe66⤵PID:944
-
\??\c:\pvpdp.exec:\pvpdp.exe67⤵PID:1248
-
\??\c:\lxffrrr.exec:\lxffrrr.exe68⤵PID:3892
-
\??\c:\bbthbt.exec:\bbthbt.exe69⤵PID:3160
-
\??\c:\pvppd.exec:\pvppd.exe70⤵PID:3352
-
\??\c:\vjvvj.exec:\vjvvj.exe71⤵PID:2172
-
\??\c:\llrlrlr.exec:\llrlrlr.exe72⤵PID:908
-
\??\c:\rlrlffl.exec:\rlrlffl.exe73⤵PID:3500
-
\??\c:\bnnhbb.exec:\bnnhbb.exe74⤵PID:1732
-
\??\c:\vdjdd.exec:\vdjdd.exe75⤵PID:1632
-
\??\c:\xrrlfff.exec:\xrrlfff.exe76⤵PID:4576
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe77⤵PID:3236
-
\??\c:\1hbtnn.exec:\1hbtnn.exe78⤵PID:4060
-
\??\c:\ddppj.exec:\ddppj.exe79⤵PID:2740
-
\??\c:\pjppp.exec:\pjppp.exe80⤵PID:3736
-
\??\c:\xxrrfff.exec:\xxrrfff.exe81⤵PID:2860
-
\??\c:\lxflrrf.exec:\lxflrrf.exe82⤵PID:2544
-
\??\c:\nthhtn.exec:\nthhtn.exe83⤵PID:2612
-
\??\c:\vjppv.exec:\vjppv.exe84⤵PID:2052
-
\??\c:\dvvdv.exec:\dvvdv.exe85⤵PID:3808
-
\??\c:\5flllrl.exec:\5flllrl.exe86⤵PID:2320
-
\??\c:\3nhhbh.exec:\3nhhbh.exe87⤵PID:1108
-
\??\c:\pppjv.exec:\pppjv.exe88⤵PID:4980
-
\??\c:\3llfffr.exec:\3llfffr.exe89⤵PID:4448
-
\??\c:\rrrlfff.exec:\rrrlfff.exe90⤵PID:2128
-
\??\c:\thnnnb.exec:\thnnnb.exe91⤵PID:4532
-
\??\c:\dddvp.exec:\dddvp.exe92⤵PID:3612
-
\??\c:\7lrlllr.exec:\7lrlllr.exe93⤵PID:2584
-
\??\c:\lffxrrl.exec:\lffxrrl.exe94⤵PID:2260
-
\??\c:\nhnnbt.exec:\nhnnbt.exe95⤵PID:3396
-
\??\c:\9ddpp.exec:\9ddpp.exe96⤵PID:2240
-
\??\c:\djpjd.exec:\djpjd.exe97⤵PID:3488
-
\??\c:\3lxrfxr.exec:\3lxrfxr.exe98⤵PID:3180
-
\??\c:\hhnnhh.exec:\hhnnhh.exe99⤵PID:1648
-
\??\c:\jjjdv.exec:\jjjdv.exe100⤵PID:4444
-
\??\c:\7xrfrrl.exec:\7xrfrrl.exe101⤵PID:2000
-
\??\c:\nhhbtt.exec:\nhhbtt.exe102⤵PID:540
-
\??\c:\tnhtnh.exec:\tnhtnh.exe103⤵PID:2880
-
\??\c:\vjjjd.exec:\vjjjd.exe104⤵PID:4460
-
\??\c:\1xxrllf.exec:\1xxrllf.exe105⤵PID:508
-
\??\c:\hhhbnn.exec:\hhhbnn.exe106⤵PID:1860
-
\??\c:\9vvvp.exec:\9vvvp.exe107⤵PID:3176
-
\??\c:\ddddp.exec:\ddddp.exe108⤵PID:3792
-
\??\c:\xlxrllf.exec:\xlxrllf.exe109⤵PID:1384
-
\??\c:\bnbbtb.exec:\bnbbtb.exe110⤵PID:4332
-
\??\c:\vpjdj.exec:\vpjdj.exe111⤵PID:1080
-
\??\c:\5jjdp.exec:\5jjdp.exe112⤵PID:4428
-
\??\c:\9lllxrf.exec:\9lllxrf.exe113⤵PID:856
-
\??\c:\nhhtnn.exec:\nhhtnn.exe114⤵PID:4028
-
\??\c:\hnhhbn.exec:\hnhhbn.exe115⤵PID:4196
-
\??\c:\rrlfxll.exec:\rrlfxll.exe116⤵PID:3432
-
\??\c:\hbbttt.exec:\hbbttt.exe117⤵PID:1460
-
\??\c:\ppvpv.exec:\ppvpv.exe118⤵PID:4200
-
\??\c:\lrrrfff.exec:\lrrrfff.exe119⤵PID:1192
-
\??\c:\1tttnt.exec:\1tttnt.exe120⤵PID:4712
-
\??\c:\3ntttb.exec:\3ntttb.exe121⤵PID:4488
-
\??\c:\jdppp.exec:\jdppp.exe122⤵PID:1932
-
\??\c:\ppdvd.exec:\ppdvd.exe123⤵PID:1968
-
\??\c:\fxxlfff.exec:\fxxlfff.exe124⤵PID:3492
-
\??\c:\rfflffl.exec:\rfflffl.exe125⤵PID:2944
-
\??\c:\hbhnnn.exec:\hbhnnn.exe126⤵PID:464
-
\??\c:\7btnnt.exec:\7btnnt.exe127⤵PID:3720
-
\??\c:\vvdvv.exec:\vvdvv.exe128⤵PID:2884
-
\??\c:\7xlllxx.exec:\7xlllxx.exe129⤵PID:4812
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe130⤵PID:2292
-
\??\c:\lfxxrxr.exec:\lfxxrxr.exe131⤵PID:5088
-
\??\c:\btbhtb.exec:\btbhtb.exe132⤵PID:2432
-
\??\c:\bnntht.exec:\bnntht.exe133⤵PID:2128
-
\??\c:\dvvpp.exec:\dvvpp.exe134⤵PID:1008
-
\??\c:\xrfffll.exec:\xrfffll.exe135⤵PID:3612
-
\??\c:\llfflxf.exec:\llfflxf.exe136⤵PID:2584
-
\??\c:\bhbbhh.exec:\bhbbhh.exe137⤵PID:3556
-
\??\c:\dpdpd.exec:\dpdpd.exe138⤵PID:964
-
\??\c:\lllffll.exec:\lllffll.exe139⤵PID:1948
-
\??\c:\bbhhnn.exec:\bbhhnn.exe140⤵PID:3860
-
\??\c:\vjvvv.exec:\vjvvv.exe141⤵PID:3532
-
\??\c:\5rlfrxf.exec:\5rlfrxf.exe142⤵PID:4084
-
\??\c:\hnthnt.exec:\hnthnt.exe143⤵PID:1980
-
\??\c:\dvddp.exec:\dvddp.exe144⤵PID:2252
-
\??\c:\xlrllfx.exec:\xlrllfx.exe145⤵PID:3116
-
\??\c:\9ttttt.exec:\9ttttt.exe146⤵PID:2880
-
\??\c:\bttbhh.exec:\bttbhh.exe147⤵PID:1508
-
\??\c:\jdjpd.exec:\jdjpd.exe148⤵PID:3744
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe149⤵PID:2332
-
\??\c:\lrxfffl.exec:\lrxfffl.exe150⤵PID:3516
-
\??\c:\btttnt.exec:\btttnt.exe151⤵PID:2968
-
\??\c:\xlffxxr.exec:\xlffxxr.exe152⤵PID:1384
-
\??\c:\nhbttt.exec:\nhbttt.exe153⤵PID:3224
-
\??\c:\dpddv.exec:\dpddv.exe154⤵PID:2296
-
\??\c:\pjppp.exec:\pjppp.exe155⤵PID:4040
-
\??\c:\nntttb.exec:\nntttb.exe156⤵PID:1248
-
\??\c:\pjvpj.exec:\pjvpj.exe157⤵PID:2948
-
\??\c:\lrfxrxr.exec:\lrfxrxr.exe158⤵PID:3552
-
\??\c:\bnnnnn.exec:\bnnnnn.exe159⤵PID:3352
-
\??\c:\5dppd.exec:\5dppd.exe160⤵PID:4964
-
\??\c:\llffxxr.exec:\llffxxr.exe161⤵PID:908
-
\??\c:\thtbbb.exec:\thtbbb.exe162⤵PID:4888
-
\??\c:\pvjdv.exec:\pvjdv.exe163⤵PID:4712
-
\??\c:\rrfffll.exec:\rrfffll.exe164⤵PID:5000
-
\??\c:\lfrrlrr.exec:\lfrrlrr.exe165⤵PID:3236
-
\??\c:\ttnnhb.exec:\ttnnhb.exe166⤵PID:1700
-
\??\c:\vddpj.exec:\vddpj.exe167⤵PID:3208
-
\??\c:\vjvpj.exec:\vjvpj.exe168⤵PID:4008
-
\??\c:\rrrlfff.exec:\rrrlfff.exe169⤵PID:3060
-
\??\c:\hbbbtt.exec:\hbbbtt.exe170⤵PID:3688
-
\??\c:\dpdvv.exec:\dpdvv.exe171⤵PID:1096
-
\??\c:\fllxllx.exec:\fllxllx.exe172⤵PID:1408
-
\??\c:\rlllrrx.exec:\rlllrrx.exe173⤵PID:2136
-
\??\c:\1nnnnn.exec:\1nnnnn.exe174⤵PID:800
-
\??\c:\ppdvv.exec:\ppdvv.exe175⤵PID:1856
-
\??\c:\dvddv.exec:\dvddv.exe176⤵PID:4520
-
\??\c:\lfrlffl.exec:\lfrlffl.exe177⤵PID:4820
-
\??\c:\xxffffl.exec:\xxffffl.exe178⤵PID:3096
-
\??\c:\ttbtnn.exec:\ttbtnn.exe179⤵PID:1208
-
\??\c:\vjjdp.exec:\vjjdp.exe180⤵PID:4288
-
\??\c:\vpvvp.exec:\vpvvp.exe181⤵PID:2388
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe182⤵PID:1520
-
\??\c:\nhhhbn.exec:\nhhhbn.exe183⤵PID:3464
-
\??\c:\vpvpv.exec:\vpvpv.exe184⤵PID:2176
-
\??\c:\vpjdv.exec:\vpjdv.exe185⤵PID:1200
-
\??\c:\lrxxrrl.exec:\lrxxrrl.exe186⤵PID:2528
-
\??\c:\7nttbb.exec:\7nttbb.exe187⤵PID:540
-
\??\c:\9pppd.exec:\9pppd.exe188⤵PID:676
-
\??\c:\vdppv.exec:\vdppv.exe189⤵PID:4144
-
\??\c:\rlxflfx.exec:\rlxflfx.exe190⤵PID:4124
-
\??\c:\1llfxxx.exec:\1llfxxx.exe191⤵PID:3320
-
\??\c:\thhhbb.exec:\thhhbb.exe192⤵PID:4728
-
\??\c:\nhtntt.exec:\nhtntt.exe193⤵PID:344
-
\??\c:\jpvvj.exec:\jpvvj.exe194⤵PID:4580
-
\??\c:\lxrrrxr.exec:\lxrrrxr.exe195⤵PID:4332
-
\??\c:\hbbbbh.exec:\hbbbbh.exe196⤵PID:1848
-
\??\c:\hbbbhh.exec:\hbbbhh.exe197⤵PID:3112
-
\??\c:\9ppdv.exec:\9ppdv.exe198⤵PID:3104
-
\??\c:\frxfffl.exec:\frxfffl.exe199⤵PID:4456
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe200⤵PID:3160
-
\??\c:\nbnnhh.exec:\nbnnhh.exe201⤵PID:3888
-
\??\c:\nhhbtt.exec:\nhhbtt.exe202⤵PID:4948
-
\??\c:\ddpjj.exec:\ddpjj.exe203⤵PID:4200
-
\??\c:\rfrlfff.exec:\rfrlfff.exe204⤵PID:2232
-
\??\c:\hbbbbb.exec:\hbbbbb.exe205⤵PID:416
-
\??\c:\bttnnn.exec:\bttnnn.exe206⤵PID:4892
-
\??\c:\dpvvd.exec:\dpvvd.exe207⤵PID:2984
-
\??\c:\rlxfxff.exec:\rlxfxff.exe208⤵PID:3008
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe209⤵PID:4344
-
\??\c:\9ntnnn.exec:\9ntnnn.exe210⤵PID:2184
-
\??\c:\7ttthh.exec:\7ttthh.exe211⤵PID:3040
-
\??\c:\vvpjv.exec:\vvpjv.exe212⤵PID:2944
-
\??\c:\vdddv.exec:\vdddv.exe213⤵PID:3736
-
\??\c:\xflxflr.exec:\xflxflr.exe214⤵PID:2324
-
\??\c:\nhbbtt.exec:\nhbbtt.exe215⤵PID:228
-
\??\c:\dvdvd.exec:\dvdvd.exe216⤵PID:4724
-
\??\c:\vjppp.exec:\vjppp.exe217⤵PID:4432
-
\??\c:\xfxllfr.exec:\xfxllfr.exe218⤵PID:1364
-
\??\c:\nbbbbh.exec:\nbbbbh.exe219⤵PID:3456
-
\??\c:\tnhhbb.exec:\tnhhbb.exe220⤵PID:3332
-
\??\c:\9jjdv.exec:\9jjdv.exe221⤵PID:2896
-
\??\c:\3vdvp.exec:\3vdvp.exe222⤵PID:4952
-
\??\c:\rlffrrf.exec:\rlffrrf.exe223⤵PID:1012
-
\??\c:\5bntbh.exec:\5bntbh.exe224⤵PID:3324
-
\??\c:\nhnhbt.exec:\nhnhbt.exe225⤵PID:868
-
\??\c:\pjppj.exec:\pjppj.exe226⤵PID:4588
-
\??\c:\jdpvp.exec:\jdpvp.exe227⤵PID:2620
-
\??\c:\xrllxff.exec:\xrllxff.exe228⤵PID:1004
-
\??\c:\ffllflf.exec:\ffllflf.exe229⤵PID:2372
-
\??\c:\htnnnn.exec:\htnnnn.exe230⤵PID:2364
-
\??\c:\1vvjd.exec:\1vvjd.exe231⤵PID:3116
-
\??\c:\jjjdp.exec:\jjjdp.exe232⤵PID:508
-
\??\c:\xrxfrrr.exec:\xrxfrrr.exe233⤵PID:1508
-
\??\c:\tnbhtt.exec:\tnbhtt.exe234⤵PID:3804
-
\??\c:\nhbbth.exec:\nhbbth.exe235⤵PID:3792
-
\??\c:\vpdvd.exec:\vpdvd.exe236⤵PID:3628
-
\??\c:\5jppj.exec:\5jppj.exe237⤵PID:2968
-
\??\c:\rlllllx.exec:\rlllllx.exe238⤵PID:1088
-
\??\c:\hbbtnn.exec:\hbbtnn.exe239⤵PID:3896
-
\??\c:\3vddv.exec:\3vddv.exe240⤵PID:5016
-
\??\c:\dvjvj.exec:\dvjvj.exe241⤵PID:660
-
\??\c:\9xflxrx.exec:\9xflxrx.exe242⤵PID:392