Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
09e37adbcdb16c9edc1eb1edc04eb7bee426e9e6c004247cdb3a22ff8217f087.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
09e37adbcdb16c9edc1eb1edc04eb7bee426e9e6c004247cdb3a22ff8217f087.exe
-
Size
65KB
-
MD5
3f83517756baebc4d62e903d8077b26d
-
SHA1
ecdb3d90e4263e54c035917075a76e73368005c8
-
SHA256
09e37adbcdb16c9edc1eb1edc04eb7bee426e9e6c004247cdb3a22ff8217f087
-
SHA512
b3359c13a6040a0c467cea25b7181079d159ef0dea813acd8a9b1c8e454b9991ba23cadcbb11d227b0044065d1372572c24947d5a4df16aceb17e2c3e162dec9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh12N:ymb3NkkiQ3mdBjFIFdJmC
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4808-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/564-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-2205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4808-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5004-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2588-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4952-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1068-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3592-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/464-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1964-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2004-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4072-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/564-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2196-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2384-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4884-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1080-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2564-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3244-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4456-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1200-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2756-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4536-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4068-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3724-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5044-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4804-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4952-2205-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
lxrlflf.exevjppv.exexlllfxf.exe3btnhh.exebhbbtt.exe3pjdv.exerllxrlf.exerrflfxx.exetnnnhh.exejdddd.exe5xlfxfx.exerxlrxff.exebtbbnt.exejdddd.exeddvpv.exelllxrrx.exehnthbt.exe3hbbtt.exeddvpp.exe1xxllxx.exethhtnt.exehtnbtt.exedpvvd.exerlrffll.exethhhhh.exe7vvvv.exevjjpp.exe7xxxrll.exe3thntb.exebtbbtt.exe1jjjp.exexfrfxxx.exexfllfrx.exe3thbtb.exe1hhbbh.exepjppp.exe9vppp.exejdjjd.exexxffxff.exeffrlfff.exettbbbb.exentbnbb.exevvdvp.exejdvvp.exe9rrrfll.exe1xflrrx.exebntthh.exebtbbbb.exehtbbtt.exevpvdd.exejvddp.exexrxxffx.exexxxxxfl.exennnbbh.exehhbnnn.exepvvvv.exepvddd.exelflrlxr.exexxxxrxx.exetnnttb.exebhnhht.exepppdv.exedvvvp.exe7xfxrxx.exepid process 2588 lxrlflf.exe 5004 vjppv.exe 4952 xlllfxf.exe 1068 3btnhh.exe 3036 bhbbtt.exe 3592 3pjdv.exe 464 rllxrlf.exe 1964 rrflfxx.exe 2004 tnnnhh.exe 4072 jdddd.exe 564 5xlfxfx.exe 2196 rxlrxff.exe 2384 btbbnt.exe 4884 jdddd.exe 1080 ddvpv.exe 552 lllxrrx.exe 2564 hnthbt.exe 4204 3hbbtt.exe 4160 ddvpp.exe 4988 1xxllxx.exe 3244 thhtnt.exe 4456 htnbtt.exe 1200 dpvvd.exe 2756 rlrffll.exe 4560 thhhhh.exe 4536 7vvvv.exe 4068 vjjpp.exe 3724 7xxxrll.exe 5044 3thntb.exe 4804 btbbtt.exe 3884 1jjjp.exe 816 xfrfxxx.exe 4372 xfllfrx.exe 2396 3thbtb.exe 2116 1hhbbh.exe 1048 pjppp.exe 2676 9vppp.exe 1212 jdjjd.exe 4960 xxffxff.exe 4516 ffrlfff.exe 4604 ttbbbb.exe 4440 ntbnbb.exe 924 vvdvp.exe 4608 jdvvp.exe 3164 9rrrfll.exe 5020 1xflrrx.exe 3108 bntthh.exe 4872 btbbbb.exe 2640 htbbtt.exe 1084 vpvdd.exe 1016 jvddp.exe 1536 xrxxffx.exe 464 xxxxxfl.exe 3400 nnnbbh.exe 1964 hhbnnn.exe 1548 pvvvv.exe 1416 pvddd.exe 928 lflrlxr.exe 2604 xxxxrxx.exe 3864 tnnttb.exe 1040 bhnhht.exe 4380 pppdv.exe 3784 dvvvp.exe 1504 7xfxrxx.exe -
Processes:
resource yara_rule behavioral2/memory/4808-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/564-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-2205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
09e37adbcdb16c9edc1eb1edc04eb7bee426e9e6c004247cdb3a22ff8217f087.exelxrlflf.exevjppv.exexlllfxf.exe3btnhh.exebhbbtt.exe3pjdv.exerllxrlf.exerrflfxx.exetnnnhh.exejdddd.exe5xlfxfx.exerxlrxff.exebtbbnt.exejdddd.exeddvpv.exelllxrrx.exehnthbt.exe3hbbtt.exeddvpp.exe1xxllxx.exethhtnt.exedescription pid process target process PID 4808 wrote to memory of 2588 4808 09e37adbcdb16c9edc1eb1edc04eb7bee426e9e6c004247cdb3a22ff8217f087.exe lxrlflf.exe PID 4808 wrote to memory of 2588 4808 09e37adbcdb16c9edc1eb1edc04eb7bee426e9e6c004247cdb3a22ff8217f087.exe lxrlflf.exe PID 4808 wrote to memory of 2588 4808 09e37adbcdb16c9edc1eb1edc04eb7bee426e9e6c004247cdb3a22ff8217f087.exe lxrlflf.exe PID 2588 wrote to memory of 5004 2588 lxrlflf.exe vjppv.exe PID 2588 wrote to memory of 5004 2588 lxrlflf.exe vjppv.exe PID 2588 wrote to memory of 5004 2588 lxrlflf.exe vjppv.exe PID 5004 wrote to memory of 4952 5004 vjppv.exe xlllfxf.exe PID 5004 wrote to memory of 4952 5004 vjppv.exe xlllfxf.exe PID 5004 wrote to memory of 4952 5004 vjppv.exe xlllfxf.exe PID 4952 wrote to memory of 1068 4952 xlllfxf.exe 3btnhh.exe PID 4952 wrote to memory of 1068 4952 xlllfxf.exe 3btnhh.exe PID 4952 wrote to memory of 1068 4952 xlllfxf.exe 3btnhh.exe PID 1068 wrote to memory of 3036 1068 3btnhh.exe bhbbtt.exe PID 1068 wrote to memory of 3036 1068 3btnhh.exe bhbbtt.exe PID 1068 wrote to memory of 3036 1068 3btnhh.exe bhbbtt.exe PID 3036 wrote to memory of 3592 3036 bhbbtt.exe 3pjdv.exe PID 3036 wrote to memory of 3592 3036 bhbbtt.exe 3pjdv.exe PID 3036 wrote to memory of 3592 3036 bhbbtt.exe 3pjdv.exe PID 3592 wrote to memory of 464 3592 3pjdv.exe rllxrlf.exe PID 3592 wrote to memory of 464 3592 3pjdv.exe rllxrlf.exe PID 3592 wrote to memory of 464 3592 3pjdv.exe rllxrlf.exe PID 464 wrote to memory of 1964 464 rllxrlf.exe rrflfxx.exe PID 464 wrote to memory of 1964 464 rllxrlf.exe rrflfxx.exe PID 464 wrote to memory of 1964 464 rllxrlf.exe rrflfxx.exe PID 1964 wrote to memory of 2004 1964 rrflfxx.exe tnnnhh.exe PID 1964 wrote to memory of 2004 1964 rrflfxx.exe tnnnhh.exe PID 1964 wrote to memory of 2004 1964 rrflfxx.exe tnnnhh.exe PID 2004 wrote to memory of 4072 2004 tnnnhh.exe jdddd.exe PID 2004 wrote to memory of 4072 2004 tnnnhh.exe jdddd.exe PID 2004 wrote to memory of 4072 2004 tnnnhh.exe jdddd.exe PID 4072 wrote to memory of 564 4072 jdddd.exe 5xlfxfx.exe PID 4072 wrote to memory of 564 4072 jdddd.exe 5xlfxfx.exe PID 4072 wrote to memory of 564 4072 jdddd.exe 5xlfxfx.exe PID 564 wrote to memory of 2196 564 5xlfxfx.exe rxlrxff.exe PID 564 wrote to memory of 2196 564 5xlfxfx.exe rxlrxff.exe PID 564 wrote to memory of 2196 564 5xlfxfx.exe rxlrxff.exe PID 2196 wrote to memory of 2384 2196 rxlrxff.exe btbbnt.exe PID 2196 wrote to memory of 2384 2196 rxlrxff.exe btbbnt.exe PID 2196 wrote to memory of 2384 2196 rxlrxff.exe btbbnt.exe PID 2384 wrote to memory of 4884 2384 btbbnt.exe jdddd.exe PID 2384 wrote to memory of 4884 2384 btbbnt.exe jdddd.exe PID 2384 wrote to memory of 4884 2384 btbbnt.exe jdddd.exe PID 4884 wrote to memory of 1080 4884 jdddd.exe ddvpv.exe PID 4884 wrote to memory of 1080 4884 jdddd.exe ddvpv.exe PID 4884 wrote to memory of 1080 4884 jdddd.exe ddvpv.exe PID 1080 wrote to memory of 552 1080 ddvpv.exe lllxrrx.exe PID 1080 wrote to memory of 552 1080 ddvpv.exe lllxrrx.exe PID 1080 wrote to memory of 552 1080 ddvpv.exe lllxrrx.exe PID 552 wrote to memory of 2564 552 lllxrrx.exe hnthbt.exe PID 552 wrote to memory of 2564 552 lllxrrx.exe hnthbt.exe PID 552 wrote to memory of 2564 552 lllxrrx.exe hnthbt.exe PID 2564 wrote to memory of 4204 2564 hnthbt.exe 3hbbtt.exe PID 2564 wrote to memory of 4204 2564 hnthbt.exe 3hbbtt.exe PID 2564 wrote to memory of 4204 2564 hnthbt.exe 3hbbtt.exe PID 4204 wrote to memory of 4160 4204 3hbbtt.exe ddvpp.exe PID 4204 wrote to memory of 4160 4204 3hbbtt.exe ddvpp.exe PID 4204 wrote to memory of 4160 4204 3hbbtt.exe ddvpp.exe PID 4160 wrote to memory of 4988 4160 ddvpp.exe 1xxllxx.exe PID 4160 wrote to memory of 4988 4160 ddvpp.exe 1xxllxx.exe PID 4160 wrote to memory of 4988 4160 ddvpp.exe 1xxllxx.exe PID 4988 wrote to memory of 3244 4988 1xxllxx.exe thhtnt.exe PID 4988 wrote to memory of 3244 4988 1xxllxx.exe thhtnt.exe PID 4988 wrote to memory of 3244 4988 1xxllxx.exe thhtnt.exe PID 3244 wrote to memory of 4456 3244 thhtnt.exe htnbtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09e37adbcdb16c9edc1eb1edc04eb7bee426e9e6c004247cdb3a22ff8217f087.exe"C:\Users\Admin\AppData\Local\Temp\09e37adbcdb16c9edc1eb1edc04eb7bee426e9e6c004247cdb3a22ff8217f087.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\lxrlflf.exec:\lxrlflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\vjppv.exec:\vjppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\xlllfxf.exec:\xlllfxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\3btnhh.exec:\3btnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\bhbbtt.exec:\bhbbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\3pjdv.exec:\3pjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\rllxrlf.exec:\rllxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\rrflfxx.exec:\rrflfxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\tnnnhh.exec:\tnnnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\jdddd.exec:\jdddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\5xlfxfx.exec:\5xlfxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\rxlrxff.exec:\rxlrxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\btbbnt.exec:\btbbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\jdddd.exec:\jdddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\ddvpv.exec:\ddvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\lllxrrx.exec:\lllxrrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\hnthbt.exec:\hnthbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\3hbbtt.exec:\3hbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\ddvpp.exec:\ddvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\1xxllxx.exec:\1xxllxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\thhtnt.exec:\thhtnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\htnbtt.exec:\htnbtt.exe23⤵
- Executes dropped EXE
PID:4456 -
\??\c:\dpvvd.exec:\dpvvd.exe24⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rlrffll.exec:\rlrffll.exe25⤵
- Executes dropped EXE
PID:2756 -
\??\c:\thhhhh.exec:\thhhhh.exe26⤵
- Executes dropped EXE
PID:4560 -
\??\c:\7vvvv.exec:\7vvvv.exe27⤵
- Executes dropped EXE
PID:4536 -
\??\c:\vjjpp.exec:\vjjpp.exe28⤵
- Executes dropped EXE
PID:4068 -
\??\c:\7xxxrll.exec:\7xxxrll.exe29⤵
- Executes dropped EXE
PID:3724 -
\??\c:\3thntb.exec:\3thntb.exe30⤵
- Executes dropped EXE
PID:5044 -
\??\c:\btbbtt.exec:\btbbtt.exe31⤵
- Executes dropped EXE
PID:4804 -
\??\c:\1jjjp.exec:\1jjjp.exe32⤵
- Executes dropped EXE
PID:3884 -
\??\c:\xfrfxxx.exec:\xfrfxxx.exe33⤵
- Executes dropped EXE
PID:816 -
\??\c:\xfllfrx.exec:\xfllfrx.exe34⤵
- Executes dropped EXE
PID:4372 -
\??\c:\3thbtb.exec:\3thbtb.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\1hhbbh.exec:\1hhbbh.exe36⤵
- Executes dropped EXE
PID:2116 -
\??\c:\pjppp.exec:\pjppp.exe37⤵
- Executes dropped EXE
PID:1048 -
\??\c:\9vppp.exec:\9vppp.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jdjjd.exec:\jdjjd.exe39⤵
- Executes dropped EXE
PID:1212 -
\??\c:\xxffxff.exec:\xxffxff.exe40⤵
- Executes dropped EXE
PID:4960 -
\??\c:\ffrlfff.exec:\ffrlfff.exe41⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ttbbbb.exec:\ttbbbb.exe42⤵
- Executes dropped EXE
PID:4604 -
\??\c:\ntbnbb.exec:\ntbnbb.exe43⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vvdvp.exec:\vvdvp.exe44⤵
- Executes dropped EXE
PID:924 -
\??\c:\jdvvp.exec:\jdvvp.exe45⤵
- Executes dropped EXE
PID:4608 -
\??\c:\9rrrfll.exec:\9rrrfll.exe46⤵
- Executes dropped EXE
PID:3164 -
\??\c:\1xflrrx.exec:\1xflrrx.exe47⤵
- Executes dropped EXE
PID:5020 -
\??\c:\bntthh.exec:\bntthh.exe48⤵
- Executes dropped EXE
PID:3108 -
\??\c:\btbbbb.exec:\btbbbb.exe49⤵
- Executes dropped EXE
PID:4872 -
\??\c:\htbbtt.exec:\htbbtt.exe50⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vpvdd.exec:\vpvdd.exe51⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jvddp.exec:\jvddp.exe52⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xrxxffx.exec:\xrxxffx.exe53⤵
- Executes dropped EXE
PID:1536 -
\??\c:\xxxxxfl.exec:\xxxxxfl.exe54⤵
- Executes dropped EXE
PID:464 -
\??\c:\nnnbbh.exec:\nnnbbh.exe55⤵
- Executes dropped EXE
PID:3400 -
\??\c:\hhbnnn.exec:\hhbnnn.exe56⤵
- Executes dropped EXE
PID:1964 -
\??\c:\pvvvv.exec:\pvvvv.exe57⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pvddd.exec:\pvddd.exe58⤵
- Executes dropped EXE
PID:1416 -
\??\c:\lflrlxr.exec:\lflrlxr.exe59⤵
- Executes dropped EXE
PID:928 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe60⤵
- Executes dropped EXE
PID:2604 -
\??\c:\tnnttb.exec:\tnnttb.exe61⤵
- Executes dropped EXE
PID:3864 -
\??\c:\bhnhht.exec:\bhnhht.exe62⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pppdv.exec:\pppdv.exe63⤵
- Executes dropped EXE
PID:4380 -
\??\c:\dvvvp.exec:\dvvvp.exe64⤵
- Executes dropped EXE
PID:3784 -
\??\c:\7xfxrxx.exec:\7xfxrxx.exe65⤵
- Executes dropped EXE
PID:1504 -
\??\c:\9rxxxfr.exec:\9rxxxfr.exe66⤵PID:552
-
\??\c:\9nbhhn.exec:\9nbhhn.exe67⤵PID:3188
-
\??\c:\hbtntb.exec:\hbtntb.exe68⤵PID:4812
-
\??\c:\ntthbn.exec:\ntthbn.exe69⤵PID:4160
-
\??\c:\jpvdd.exec:\jpvdd.exe70⤵PID:3328
-
\??\c:\7llllrr.exec:\7llllrr.exe71⤵PID:3904
-
\??\c:\fxrxflx.exec:\fxrxflx.exe72⤵PID:3124
-
\??\c:\3bbbbb.exec:\3bbbbb.exe73⤵PID:3576
-
\??\c:\tbnnnn.exec:\tbnnnn.exe74⤵PID:1200
-
\??\c:\jjjvv.exec:\jjjvv.exe75⤵PID:4448
-
\??\c:\ppvpj.exec:\ppvpj.exe76⤵PID:4044
-
\??\c:\vppvp.exec:\vppvp.exe77⤵PID:652
-
\??\c:\7xxxrrr.exec:\7xxxrrr.exe78⤵PID:2216
-
\??\c:\9lrxxxl.exec:\9lrxxxl.exe79⤵PID:1612
-
\??\c:\nhhnhh.exec:\nhhnhh.exe80⤵PID:4616
-
\??\c:\bttnbb.exec:\bttnbb.exe81⤵PID:3324
-
\??\c:\3jppp.exec:\3jppp.exe82⤵PID:1936
-
\??\c:\vvjpd.exec:\vvjpd.exe83⤵PID:1320
-
\??\c:\fxfffrl.exec:\fxfffrl.exe84⤵PID:456
-
\??\c:\tnhhhh.exec:\tnhhhh.exe85⤵PID:2624
-
\??\c:\hhnthh.exec:\hhnthh.exe86⤵PID:4796
-
\??\c:\5tttbn.exec:\5tttbn.exe87⤵PID:4720
-
\??\c:\jjjpd.exec:\jjjpd.exe88⤵PID:3060
-
\??\c:\jjdvd.exec:\jjdvd.exe89⤵PID:4704
-
\??\c:\rxxxrlr.exec:\rxxxrlr.exe90⤵PID:2396
-
\??\c:\flxffll.exec:\flxffll.exe91⤵PID:3460
-
\??\c:\htnbbh.exec:\htnbbh.exe92⤵PID:4652
-
\??\c:\bthnnn.exec:\bthnnn.exe93⤵PID:1392
-
\??\c:\nhhbtt.exec:\nhhbtt.exe94⤵PID:3540
-
\??\c:\jvddv.exec:\jvddv.exe95⤵PID:3268
-
\??\c:\pjvvj.exec:\pjvvj.exe96⤵PID:3224
-
\??\c:\7xfrlrx.exec:\7xfrlrx.exe97⤵PID:4480
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe98⤵PID:1560
-
\??\c:\9ththt.exec:\9ththt.exe99⤵PID:924
-
\??\c:\jvvvp.exec:\jvvvp.exe100⤵PID:4528
-
\??\c:\xfxxxxf.exec:\xfxxxxf.exe101⤵PID:5092
-
\??\c:\fxflllf.exec:\fxflllf.exe102⤵PID:4568
-
\??\c:\nbnnnt.exec:\nbnnnt.exe103⤵PID:2708
-
\??\c:\tbbbtb.exec:\tbbbtb.exe104⤵PID:1636
-
\??\c:\pdjpj.exec:\pdjpj.exe105⤵PID:4512
-
\??\c:\5jvpj.exec:\5jvpj.exe106⤵PID:4876
-
\??\c:\7fflfff.exec:\7fflfff.exe107⤵PID:1016
-
\??\c:\7rxxxxx.exec:\7rxxxxx.exe108⤵PID:4016
-
\??\c:\thhnnt.exec:\thhnnt.exe109⤵PID:5040
-
\??\c:\bhntnb.exec:\bhntnb.exe110⤵PID:3048
-
\??\c:\jpppj.exec:\jpppj.exe111⤵PID:4136
-
\??\c:\jvppj.exec:\jvppj.exe112⤵PID:4072
-
\??\c:\9xlrxfr.exec:\9xlrxfr.exe113⤵PID:2252
-
\??\c:\9xflllr.exec:\9xflllr.exe114⤵PID:928
-
\??\c:\bnhbtb.exec:\bnhbtb.exe115⤵PID:1496
-
\??\c:\bhhhnh.exec:\bhhhnh.exe116⤵PID:2540
-
\??\c:\jpdvv.exec:\jpdvv.exe117⤵PID:2188
-
\??\c:\pdvvj.exec:\pdvvj.exe118⤵PID:576
-
\??\c:\xflllll.exec:\xflllll.exe119⤵PID:3352
-
\??\c:\hbnttt.exec:\hbnttt.exe120⤵PID:2184
-
\??\c:\nnthhh.exec:\nnthhh.exe121⤵PID:1792
-
\??\c:\jdvvp.exec:\jdvvp.exe122⤵PID:556
-
\??\c:\djjjv.exec:\djjjv.exe123⤵PID:1776
-
\??\c:\ffffxxx.exec:\ffffxxx.exe124⤵PID:4212
-
\??\c:\rrlfrxf.exec:\rrlfrxf.exe125⤵PID:3304
-
\??\c:\rrlllxx.exec:\rrlllxx.exe126⤵PID:3556
-
\??\c:\nntttt.exec:\nntttt.exe127⤵PID:1376
-
\??\c:\tnnnhh.exec:\tnnnhh.exe128⤵PID:3636
-
\??\c:\vppdv.exec:\vppdv.exe129⤵PID:2960
-
\??\c:\1xrfxfx.exec:\1xrfxfx.exe130⤵PID:4688
-
\??\c:\xrrrrxr.exec:\xrrrrxr.exe131⤵PID:4560
-
\??\c:\nhtnbb.exec:\nhtnbb.exe132⤵PID:4760
-
\??\c:\5bbnhn.exec:\5bbnhn.exe133⤵PID:1952
-
\??\c:\bbntnn.exec:\bbntnn.exe134⤵PID:736
-
\??\c:\vpppj.exec:\vpppj.exe135⤵PID:4916
-
\??\c:\pdddj.exec:\pdddj.exe136⤵PID:4708
-
\??\c:\rfrrlrr.exec:\rfrrlrr.exe137⤵PID:1936
-
\??\c:\rxxrfxx.exec:\rxxrfxx.exe138⤵PID:1284
-
\??\c:\tnbhhh.exec:\tnbhhh.exe139⤵PID:4300
-
\??\c:\hthhbn.exec:\hthhbn.exe140⤵PID:1860
-
\??\c:\pdjpp.exec:\pdjpp.exe141⤵PID:1640
-
\??\c:\5ppvp.exec:\5ppvp.exe142⤵PID:696
-
\??\c:\jvdpp.exec:\jvdpp.exe143⤵PID:4084
-
\??\c:\rxllxff.exec:\rxllxff.exe144⤵PID:2392
-
\??\c:\xxrrlll.exec:\xxrrlll.exe145⤵PID:2360
-
\??\c:\bhhnnn.exec:\bhhnnn.exe146⤵PID:4256
-
\??\c:\nbbhnn.exec:\nbbhnn.exe147⤵PID:4472
-
\??\c:\pvjjp.exec:\pvjjp.exe148⤵PID:3272
-
\??\c:\vvddp.exec:\vvddp.exe149⤵PID:2220
-
\??\c:\xxrrxrf.exec:\xxrrxrf.exe150⤵PID:3112
-
\??\c:\fxxffll.exec:\fxxffll.exe151⤵PID:4648
-
\??\c:\bthntb.exec:\bthntb.exe152⤵PID:4936
-
\??\c:\9bttnb.exec:\9bttnb.exe153⤵PID:2712
-
\??\c:\vdppj.exec:\vdppj.exe154⤵PID:5016
-
\??\c:\fxrrllr.exec:\fxrrllr.exe155⤵PID:3164
-
\??\c:\lllllrx.exec:\lllllrx.exe156⤵PID:2292
-
\??\c:\hntbbb.exec:\hntbbb.exe157⤵PID:3128
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe158⤵PID:1068
-
\??\c:\tbhbbb.exec:\tbhbbb.exe159⤵PID:4364
-
\??\c:\hbbbbb.exec:\hbbbbb.exe160⤵PID:1084
-
\??\c:\dddpj.exec:\dddpj.exe161⤵PID:4008
-
\??\c:\vvvvp.exec:\vvvvp.exe162⤵PID:3080
-
\??\c:\xxllxxf.exec:\xxllxxf.exe163⤵PID:464
-
\??\c:\tnbhhh.exec:\tnbhhh.exe164⤵PID:3400
-
\??\c:\hhhnnn.exec:\hhhnnn.exe165⤵PID:1964
-
\??\c:\djpvp.exec:\djpvp.exe166⤵PID:3236
-
\??\c:\llfxrxx.exec:\llfxrxx.exe167⤵PID:1416
-
\??\c:\nbhtht.exec:\nbhtht.exe168⤵PID:4896
-
\??\c:\pdpvv.exec:\pdpvv.exe169⤵PID:2604
-
\??\c:\fxlllrr.exec:\fxlllrr.exe170⤵PID:3864
-
\??\c:\nnbbbh.exec:\nnbbbh.exe171⤵PID:1040
-
\??\c:\vdjjj.exec:\vdjjj.exe172⤵PID:4380
-
\??\c:\vjpvv.exec:\vjpvv.exe173⤵PID:3784
-
\??\c:\lllrrff.exec:\lllrrff.exe174⤵PID:1504
-
\??\c:\ppppv.exec:\ppppv.exe175⤵PID:552
-
\??\c:\rllrlrr.exec:\rllrlrr.exe176⤵PID:2628
-
\??\c:\xflrrxf.exec:\xflrrxf.exe177⤵PID:4812
-
\??\c:\hhhnnt.exec:\hhhnnt.exe178⤵PID:3000
-
\??\c:\ntttbh.exec:\ntttbh.exe179⤵PID:3312
-
\??\c:\1vddv.exec:\1vddv.exe180⤵PID:2804
-
\??\c:\bhbbbt.exec:\bhbbbt.exe181⤵PID:3124
-
\??\c:\5bhhbb.exec:\5bhhbb.exe182⤵PID:3576
-
\??\c:\3vvvp.exec:\3vvvp.exe183⤵PID:3748
-
\??\c:\7flfrxr.exec:\7flfrxr.exe184⤵PID:3644
-
\??\c:\rlfxllr.exec:\rlfxllr.exe185⤵PID:4044
-
\??\c:\tnnhbb.exec:\tnnhbb.exe186⤵PID:652
-
\??\c:\3ntnbh.exec:\3ntnbh.exe187⤵PID:2216
-
\??\c:\pppjd.exec:\pppjd.exe188⤵PID:2224
-
\??\c:\7xrlxxr.exec:\7xrlxxr.exe189⤵PID:4616
-
\??\c:\xrrlffx.exec:\xrrlffx.exe190⤵PID:2100
-
\??\c:\hhnhhh.exec:\hhnhhh.exe191⤵PID:1328
-
\??\c:\djppj.exec:\djppj.exe192⤵PID:1320
-
\??\c:\1xxlxxr.exec:\1xxlxxr.exe193⤵PID:456
-
\??\c:\nbnhbb.exec:\nbnhbb.exe194⤵PID:3104
-
\??\c:\3nnhtt.exec:\3nnhtt.exe195⤵PID:1812
-
\??\c:\1jpvj.exec:\1jpvj.exe196⤵PID:1632
-
\??\c:\3flllfx.exec:\3flllfx.exe197⤵PID:1588
-
\??\c:\rffxxxx.exec:\rffxxxx.exe198⤵PID:1220
-
\??\c:\nttbtb.exec:\nttbtb.exe199⤵PID:1048
-
\??\c:\jdpjd.exec:\jdpjd.exe200⤵PID:3620
-
\??\c:\xrrrflx.exec:\xrrrflx.exe201⤵PID:4488
-
\??\c:\hbbhhh.exec:\hbbhhh.exe202⤵PID:1204
-
\??\c:\ddjdd.exec:\ddjdd.exe203⤵PID:2616
-
\??\c:\5jjdv.exec:\5jjdv.exe204⤵PID:4920
-
\??\c:\lxxrxxr.exec:\lxxrxxr.exe205⤵PID:4808
-
\??\c:\1hnnhb.exec:\1hnnhb.exe206⤵PID:4648
-
\??\c:\bnnhth.exec:\bnnhth.exe207⤵PID:1544
-
\??\c:\dpppj.exec:\dpppj.exe208⤵PID:4996
-
\??\c:\frlrlrx.exec:\frlrlrx.exe209⤵PID:3168
-
\??\c:\pjvjv.exec:\pjvjv.exe210⤵PID:1704
-
\??\c:\1ffrffl.exec:\1ffrffl.exe211⤵PID:3296
-
\??\c:\nnbtbn.exec:\nnbtbn.exe212⤵PID:1636
-
\??\c:\dvppd.exec:\dvppd.exe213⤵PID:3408
-
\??\c:\vdddp.exec:\vdddp.exe214⤵PID:1896
-
\??\c:\xxxrrlx.exec:\xxxrrlx.exe215⤵PID:452
-
\??\c:\rflxrrl.exec:\rflxrrl.exe216⤵PID:4088
-
\??\c:\9hntbn.exec:\9hntbn.exe217⤵PID:5040
-
\??\c:\nbhbtt.exec:\nbhbtt.exe218⤵PID:1420
-
\??\c:\jdvpd.exec:\jdvpd.exe219⤵PID:1464
-
\??\c:\rllxxxx.exec:\rllxxxx.exe220⤵PID:2180
-
\??\c:\9lffflr.exec:\9lffflr.exe221⤵PID:2196
-
\??\c:\tnhnnt.exec:\tnhnnt.exe222⤵PID:1628
-
\??\c:\htnhbn.exec:\htnhbn.exe223⤵PID:532
-
\??\c:\7jvvd.exec:\7jvvd.exe224⤵PID:4520
-
\??\c:\3djdp.exec:\3djdp.exe225⤵PID:1500
-
\??\c:\rfllfff.exec:\rfllfff.exe226⤵PID:3996
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe227⤵PID:1788
-
\??\c:\tbtttt.exec:\tbtttt.exe228⤵PID:3260
-
\??\c:\hbbttt.exec:\hbbttt.exe229⤵PID:1712
-
\??\c:\5jppp.exec:\5jppp.exe230⤵PID:556
-
\??\c:\jdddv.exec:\jdddv.exe231⤵PID:3244
-
\??\c:\fxrlxxl.exec:\fxrlxxl.exe232⤵PID:1748
-
\??\c:\nnnhhn.exec:\nnnhhn.exe233⤵PID:3808
-
\??\c:\5jvvp.exec:\5jvvp.exe234⤵PID:1604
-
\??\c:\pdjdv.exec:\pdjdv.exe235⤵PID:1600
-
\??\c:\9jjdp.exec:\9jjdp.exe236⤵PID:3636
-
\??\c:\1xllfrr.exec:\1xllfrr.exe237⤵PID:4640
-
\??\c:\7tbbtb.exec:\7tbbtb.exe238⤵PID:868
-
\??\c:\vdddp.exec:\vdddp.exe239⤵PID:3644
-
\??\c:\jvdvj.exec:\jvdvj.exe240⤵PID:3252
-
\??\c:\ffrrlll.exec:\ffrrlll.exe241⤵PID:4156
-
\??\c:\lxrxxfx.exec:\lxrxxfx.exe242⤵PID:3724