Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe
-
Size
75KB
-
MD5
4a1f040e92c885521bfeebbc6fd6f3df
-
SHA1
c89f5f10b72fed135e14f9155323320d0fb4d549
-
SHA256
856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556
-
SHA512
20dd59551c915333abf88e30d1cf47a929eaa90b996e10340903f310e850f641777e12503967382512c81b9ba254fc2ee367f1442f37535f469e759e1b276fed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5K:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCM
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/436-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-64-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bhnbth.exevpdvp.exelxxxlrl.exerlfrlxr.exehtbttn.exepddvp.exexrxrfxx.exe9btntb.exepdjdv.exerlrffxr.exevppdj.exeflfxxrf.exennhbbt.exejddvp.exelfrxxff.exefrrlffx.exehntnhn.exe5vpjd.exexlrrrrx.exetbnnbn.exepddvp.exejdjdv.exerlrxrrl.exe5hbtnn.exethhhbt.exepjjdv.exexffxlxf.exe5ntnbt.exethnhbt.exexllffxx.exe3ntnnn.exepdjdp.exepjddd.exetntnbb.exehbnhbb.exeddddv.exelfxxlll.exehhbbbn.exehhnhhn.exevvvpp.exevjpjd.exelxrrxfl.exenbhbbb.exehhtnbt.exe7jvvp.exelxxxxxf.exe5lrllfx.exetthhhb.exebbbttb.exeppppp.exelxfffff.exexxxxrxr.exehnthbh.exethtbbt.exevvvpp.exevdvvp.exerxrlrfr.exe1xrxlff.exetntbbb.exepvjvp.exe1djdj.exelffxrrr.exebnnhhb.exenthbtb.exepid process 1564 bhnbth.exe 4356 vpdvp.exe 2924 lxxxlrl.exe 2576 rlfrlxr.exe 3172 htbttn.exe 4280 pddvp.exe 2968 xrxrfxx.exe 4136 9btntb.exe 4448 pdjdv.exe 2996 rlrffxr.exe 3468 vppdj.exe 3500 flfxxrf.exe 624 nnhbbt.exe 2076 jddvp.exe 4552 lfrxxff.exe 1068 frrlffx.exe 5084 hntnhn.exe 1568 5vpjd.exe 4544 xlrrrrx.exe 2936 tbnnbn.exe 1800 pddvp.exe 840 jdjdv.exe 1292 rlrxrrl.exe 2128 5hbtnn.exe 2580 thhhbt.exe 4712 pjjdv.exe 3796 xffxlxf.exe 4184 5ntnbt.exe 2756 thnhbt.exe 3448 xllffxx.exe 1180 3ntnnn.exe 5072 pdjdp.exe 2260 pjddd.exe 3748 tntnbb.exe 1740 hbnhbb.exe 4104 ddddv.exe 4520 lfxxlll.exe 4180 hhbbbn.exe 1684 hhnhhn.exe 1564 vvvpp.exe 4540 vjpjd.exe 3364 lxrrxfl.exe 2064 nbhbbb.exe 1444 hhtnbt.exe 3172 7jvvp.exe 4164 lxxxxxf.exe 1624 5lrllfx.exe 3104 tthhhb.exe 2816 bbbttb.exe 2208 ppppp.exe 4004 lxfffff.exe 448 xxxxrxr.exe 4496 hnthbh.exe 1228 thtbbt.exe 2540 vvvpp.exe 5052 vdvvp.exe 2760 rxrlrfr.exe 3224 1xrxlff.exe 2584 tntbbb.exe 5084 pvjvp.exe 1608 1djdj.exe 2136 lffxrrr.exe 2704 bnnhhb.exe 1104 nthbtb.exe -
Processes:
resource yara_rule behavioral2/memory/436-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exebhnbth.exevpdvp.exelxxxlrl.exerlfrlxr.exehtbttn.exepddvp.exexrxrfxx.exe9btntb.exepdjdv.exerlrffxr.exevppdj.exeflfxxrf.exennhbbt.exejddvp.exelfrxxff.exefrrlffx.exehntnhn.exe5vpjd.exexlrrrrx.exetbnnbn.exepddvp.exedescription pid process target process PID 436 wrote to memory of 1564 436 856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe bhnbth.exe PID 436 wrote to memory of 1564 436 856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe bhnbth.exe PID 436 wrote to memory of 1564 436 856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe bhnbth.exe PID 1564 wrote to memory of 4356 1564 bhnbth.exe vpdvp.exe PID 1564 wrote to memory of 4356 1564 bhnbth.exe vpdvp.exe PID 1564 wrote to memory of 4356 1564 bhnbth.exe vpdvp.exe PID 4356 wrote to memory of 2924 4356 vpdvp.exe lxxxlrl.exe PID 4356 wrote to memory of 2924 4356 vpdvp.exe lxxxlrl.exe PID 4356 wrote to memory of 2924 4356 vpdvp.exe lxxxlrl.exe PID 2924 wrote to memory of 2576 2924 lxxxlrl.exe rlfrlxr.exe PID 2924 wrote to memory of 2576 2924 lxxxlrl.exe rlfrlxr.exe PID 2924 wrote to memory of 2576 2924 lxxxlrl.exe rlfrlxr.exe PID 2576 wrote to memory of 3172 2576 rlfrlxr.exe htbttn.exe PID 2576 wrote to memory of 3172 2576 rlfrlxr.exe htbttn.exe PID 2576 wrote to memory of 3172 2576 rlfrlxr.exe htbttn.exe PID 3172 wrote to memory of 4280 3172 htbttn.exe pddvp.exe PID 3172 wrote to memory of 4280 3172 htbttn.exe pddvp.exe PID 3172 wrote to memory of 4280 3172 htbttn.exe pddvp.exe PID 4280 wrote to memory of 2968 4280 pddvp.exe xrxrfxx.exe PID 4280 wrote to memory of 2968 4280 pddvp.exe xrxrfxx.exe PID 4280 wrote to memory of 2968 4280 pddvp.exe xrxrfxx.exe PID 2968 wrote to memory of 4136 2968 xrxrfxx.exe 9btntb.exe PID 2968 wrote to memory of 4136 2968 xrxrfxx.exe 9btntb.exe PID 2968 wrote to memory of 4136 2968 xrxrfxx.exe 9btntb.exe PID 4136 wrote to memory of 4448 4136 9btntb.exe pdjdv.exe PID 4136 wrote to memory of 4448 4136 9btntb.exe pdjdv.exe PID 4136 wrote to memory of 4448 4136 9btntb.exe pdjdv.exe PID 4448 wrote to memory of 2996 4448 pdjdv.exe rlrffxr.exe PID 4448 wrote to memory of 2996 4448 pdjdv.exe rlrffxr.exe PID 4448 wrote to memory of 2996 4448 pdjdv.exe rlrffxr.exe PID 2996 wrote to memory of 3468 2996 rlrffxr.exe vppdj.exe PID 2996 wrote to memory of 3468 2996 rlrffxr.exe vppdj.exe PID 2996 wrote to memory of 3468 2996 rlrffxr.exe vppdj.exe PID 3468 wrote to memory of 3500 3468 vppdj.exe flfxxrf.exe PID 3468 wrote to memory of 3500 3468 vppdj.exe flfxxrf.exe PID 3468 wrote to memory of 3500 3468 vppdj.exe flfxxrf.exe PID 3500 wrote to memory of 624 3500 flfxxrf.exe nnhbbt.exe PID 3500 wrote to memory of 624 3500 flfxxrf.exe nnhbbt.exe PID 3500 wrote to memory of 624 3500 flfxxrf.exe nnhbbt.exe PID 624 wrote to memory of 2076 624 nnhbbt.exe jddvp.exe PID 624 wrote to memory of 2076 624 nnhbbt.exe jddvp.exe PID 624 wrote to memory of 2076 624 nnhbbt.exe jddvp.exe PID 2076 wrote to memory of 4552 2076 jddvp.exe lfrxxff.exe PID 2076 wrote to memory of 4552 2076 jddvp.exe lfrxxff.exe PID 2076 wrote to memory of 4552 2076 jddvp.exe lfrxxff.exe PID 4552 wrote to memory of 1068 4552 lfrxxff.exe frrlffx.exe PID 4552 wrote to memory of 1068 4552 lfrxxff.exe frrlffx.exe PID 4552 wrote to memory of 1068 4552 lfrxxff.exe frrlffx.exe PID 1068 wrote to memory of 5084 1068 frrlffx.exe hntnhn.exe PID 1068 wrote to memory of 5084 1068 frrlffx.exe hntnhn.exe PID 1068 wrote to memory of 5084 1068 frrlffx.exe hntnhn.exe PID 5084 wrote to memory of 1568 5084 hntnhn.exe 5vpjd.exe PID 5084 wrote to memory of 1568 5084 hntnhn.exe 5vpjd.exe PID 5084 wrote to memory of 1568 5084 hntnhn.exe 5vpjd.exe PID 1568 wrote to memory of 4544 1568 5vpjd.exe xlrrrrx.exe PID 1568 wrote to memory of 4544 1568 5vpjd.exe xlrrrrx.exe PID 1568 wrote to memory of 4544 1568 5vpjd.exe xlrrrrx.exe PID 4544 wrote to memory of 2936 4544 xlrrrrx.exe tbnnbn.exe PID 4544 wrote to memory of 2936 4544 xlrrrrx.exe tbnnbn.exe PID 4544 wrote to memory of 2936 4544 xlrrrrx.exe tbnnbn.exe PID 2936 wrote to memory of 1800 2936 tbnnbn.exe pddvp.exe PID 2936 wrote to memory of 1800 2936 tbnnbn.exe pddvp.exe PID 2936 wrote to memory of 1800 2936 tbnnbn.exe pddvp.exe PID 1800 wrote to memory of 840 1800 pddvp.exe jdjdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe"C:\Users\Admin\AppData\Local\Temp\856bc470e00d7c7038958eb04e61a0e4ae82ae786618c0b086b76b10af834556.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\bhnbth.exec:\bhnbth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\vpdvp.exec:\vpdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\lxxxlrl.exec:\lxxxlrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rlfrlxr.exec:\rlfrlxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\htbttn.exec:\htbttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\pddvp.exec:\pddvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\xrxrfxx.exec:\xrxrfxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\9btntb.exec:\9btntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\pdjdv.exec:\pdjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\rlrffxr.exec:\rlrffxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\vppdj.exec:\vppdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\flfxxrf.exec:\flfxxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\nnhbbt.exec:\nnhbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\jddvp.exec:\jddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\lfrxxff.exec:\lfrxxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\frrlffx.exec:\frrlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\hntnhn.exec:\hntnhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\5vpjd.exec:\5vpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\tbnnbn.exec:\tbnnbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\pddvp.exec:\pddvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\jdjdv.exec:\jdjdv.exe23⤵
- Executes dropped EXE
PID:840 -
\??\c:\rlrxrrl.exec:\rlrxrrl.exe24⤵
- Executes dropped EXE
PID:1292 -
\??\c:\5hbtnn.exec:\5hbtnn.exe25⤵
- Executes dropped EXE
PID:2128 -
\??\c:\thhhbt.exec:\thhhbt.exe26⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pjjdv.exec:\pjjdv.exe27⤵
- Executes dropped EXE
PID:4712 -
\??\c:\xffxlxf.exec:\xffxlxf.exe28⤵
- Executes dropped EXE
PID:3796 -
\??\c:\5ntnbt.exec:\5ntnbt.exe29⤵
- Executes dropped EXE
PID:4184 -
\??\c:\thnhbt.exec:\thnhbt.exe30⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xllffxx.exec:\xllffxx.exe31⤵
- Executes dropped EXE
PID:3448 -
\??\c:\3ntnnn.exec:\3ntnnn.exe32⤵
- Executes dropped EXE
PID:1180 -
\??\c:\pdjdp.exec:\pdjdp.exe33⤵
- Executes dropped EXE
PID:5072 -
\??\c:\pjddd.exec:\pjddd.exe34⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tntnbb.exec:\tntnbb.exe35⤵
- Executes dropped EXE
PID:3748 -
\??\c:\hbnhbb.exec:\hbnhbb.exe36⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ddddv.exec:\ddddv.exe37⤵
- Executes dropped EXE
PID:4104 -
\??\c:\lfxxlll.exec:\lfxxlll.exe38⤵
- Executes dropped EXE
PID:4520 -
\??\c:\hhbbbn.exec:\hhbbbn.exe39⤵
- Executes dropped EXE
PID:4180 -
\??\c:\hhnhhn.exec:\hhnhhn.exe40⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vvvpp.exec:\vvvpp.exe41⤵
- Executes dropped EXE
PID:1564 -
\??\c:\vjpjd.exec:\vjpjd.exe42⤵
- Executes dropped EXE
PID:4540 -
\??\c:\lxrrxfl.exec:\lxrrxfl.exe43⤵
- Executes dropped EXE
PID:3364 -
\??\c:\nbhbbb.exec:\nbhbbb.exe44⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hhtnbt.exec:\hhtnbt.exe45⤵
- Executes dropped EXE
PID:1444 -
\??\c:\7jvvp.exec:\7jvvp.exe46⤵
- Executes dropped EXE
PID:3172 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe47⤵
- Executes dropped EXE
PID:4164 -
\??\c:\5lrllfx.exec:\5lrllfx.exe48⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tthhhb.exec:\tthhhb.exe49⤵
- Executes dropped EXE
PID:3104 -
\??\c:\bbbttb.exec:\bbbttb.exe50⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ppppp.exec:\ppppp.exe51⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lxfffff.exec:\lxfffff.exe52⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xxxxrxr.exec:\xxxxrxr.exe53⤵
- Executes dropped EXE
PID:448 -
\??\c:\hnthbh.exec:\hnthbh.exe54⤵
- Executes dropped EXE
PID:4496 -
\??\c:\thtbbt.exec:\thtbbt.exe55⤵
- Executes dropped EXE
PID:1228 -
\??\c:\vvvpp.exec:\vvvpp.exe56⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vdvvp.exec:\vdvvp.exe57⤵
- Executes dropped EXE
PID:5052 -
\??\c:\rxrlrfr.exec:\rxrlrfr.exe58⤵
- Executes dropped EXE
PID:2760 -
\??\c:\1xrxlff.exec:\1xrxlff.exe59⤵
- Executes dropped EXE
PID:3224 -
\??\c:\tntbbb.exec:\tntbbb.exe60⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pvjvp.exec:\pvjvp.exe61⤵
- Executes dropped EXE
PID:5084 -
\??\c:\1djdj.exec:\1djdj.exe62⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lffxrrr.exec:\lffxrrr.exe63⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bnnhhb.exec:\bnnhhb.exe64⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nthbtb.exec:\nthbtb.exe65⤵
- Executes dropped EXE
PID:1104 -
\??\c:\dpvpd.exec:\dpvpd.exe66⤵PID:4124
-
\??\c:\jjdvp.exec:\jjdvp.exe67⤵PID:4112
-
\??\c:\3rxlxxr.exec:\3rxlxxr.exe68⤵PID:4284
-
\??\c:\frlfxlf.exec:\frlfxlf.exe69⤵PID:2844
-
\??\c:\nbhhhn.exec:\nbhhhn.exe70⤵PID:4700
-
\??\c:\tttthh.exec:\tttthh.exe71⤵PID:3248
-
\??\c:\7vdvp.exec:\7vdvp.exe72⤵PID:1988
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe73⤵PID:2264
-
\??\c:\nnhbtn.exec:\nnhbtn.exe74⤵PID:332
-
\??\c:\tnnnbt.exec:\tnnnbt.exe75⤵PID:4760
-
\??\c:\dppvj.exec:\dppvj.exe76⤵PID:2200
-
\??\c:\pjjjv.exec:\pjjjv.exe77⤵PID:1500
-
\??\c:\7flfxff.exec:\7flfxff.exe78⤵PID:4168
-
\??\c:\ttnnbh.exec:\ttnnbh.exe79⤵PID:5072
-
\??\c:\1pvpd.exec:\1pvpd.exe80⤵PID:4876
-
\??\c:\jjvpp.exec:\jjvpp.exe81⤵PID:1552
-
\??\c:\rrxfrlr.exec:\rrxfrlr.exe82⤵PID:2820
-
\??\c:\lrlxrfl.exec:\lrlxrfl.exe83⤵PID:4596
-
\??\c:\btbttt.exec:\btbttt.exe84⤵PID:1968
-
\??\c:\btbtth.exec:\btbtth.exe85⤵PID:632
-
\??\c:\ppppv.exec:\ppppv.exe86⤵PID:3240
-
\??\c:\pdjvp.exec:\pdjvp.exe87⤵PID:4264
-
\??\c:\5xxrlll.exec:\5xxrlll.exe88⤵PID:2956
-
\??\c:\httnhb.exec:\httnhb.exe89⤵PID:2344
-
\??\c:\hbhtnn.exec:\hbhtnn.exe90⤵PID:4240
-
\??\c:\jppjj.exec:\jppjj.exe91⤵PID:2484
-
\??\c:\vvddj.exec:\vvddj.exe92⤵PID:396
-
\??\c:\rlrllff.exec:\rlrllff.exe93⤵PID:1444
-
\??\c:\bhbnbt.exec:\bhbnbt.exe94⤵PID:3372
-
\??\c:\btnhnn.exec:\btnhnn.exe95⤵PID:700
-
\??\c:\ddjdp.exec:\ddjdp.exe96⤵PID:440
-
\??\c:\fxxrllf.exec:\fxxrllf.exe97⤵PID:2328
-
\??\c:\tbtttt.exec:\tbtttt.exe98⤵PID:228
-
\??\c:\tttnhh.exec:\tttnhh.exe99⤵PID:3404
-
\??\c:\1vdvp.exec:\1vdvp.exe100⤵PID:4676
-
\??\c:\pjpdp.exec:\pjpdp.exe101⤵PID:4024
-
\??\c:\rlxxfll.exec:\rlxxfll.exe102⤵PID:4500
-
\??\c:\bbtttt.exec:\bbtttt.exe103⤵PID:1060
-
\??\c:\5bhbtn.exec:\5bhbtn.exe104⤵PID:3736
-
\??\c:\jdpjv.exec:\jdpjv.exe105⤵PID:1972
-
\??\c:\vpjvj.exec:\vpjvj.exe106⤵PID:3540
-
\??\c:\rrlxfff.exec:\rrlxfff.exe107⤵PID:4572
-
\??\c:\rlrlffx.exec:\rlrlffx.exe108⤵PID:3944
-
\??\c:\hbhbbb.exec:\hbhbbb.exe109⤵PID:3768
-
\??\c:\dvdvj.exec:\dvdvj.exe110⤵PID:4652
-
\??\c:\pddvp.exec:\pddvp.exe111⤵PID:3568
-
\??\c:\1vvvj.exec:\1vvvj.exe112⤵PID:4728
-
\??\c:\5lrlxxr.exec:\5lrlxxr.exe113⤵PID:2988
-
\??\c:\nnnhbb.exec:\nnnhbb.exe114⤵PID:816
-
\??\c:\hntbtn.exec:\hntbtn.exe115⤵PID:116
-
\??\c:\pjjjd.exec:\pjjjd.exe116⤵PID:4700
-
\??\c:\jvppj.exec:\jvppj.exe117⤵PID:4680
-
\??\c:\xrxlfxx.exec:\xrxlfxx.exe118⤵PID:5044
-
\??\c:\ffrrllf.exec:\ffrrllf.exe119⤵PID:4032
-
\??\c:\btbtnh.exec:\btbtnh.exe120⤵PID:4740
-
\??\c:\hbhbnn.exec:\hbhbnn.exe121⤵PID:1908
-
\??\c:\hhtbhn.exec:\hhtbhn.exe122⤵PID:2184
-
\??\c:\jddvp.exec:\jddvp.exe123⤵PID:2720
-
\??\c:\jdvpj.exec:\jdvpj.exe124⤵PID:2688
-
\??\c:\lfrlfxf.exec:\lfrlfxf.exe125⤵PID:1552
-
\??\c:\rxfrxrf.exec:\rxfrxrf.exe126⤵PID:1736
-
\??\c:\5tbhbt.exec:\5tbhbt.exe127⤵PID:4508
-
\??\c:\btbbnn.exec:\btbbnn.exe128⤵PID:1968
-
\??\c:\7vdpj.exec:\7vdpj.exe129⤵PID:632
-
\??\c:\pdpjv.exec:\pdpjv.exe130⤵PID:3240
-
\??\c:\lxxlxll.exec:\lxxlxll.exe131⤵PID:4408
-
\??\c:\5lrlxlf.exec:\5lrlxlf.exe132⤵PID:3260
-
\??\c:\jddvj.exec:\jddvj.exe133⤵PID:2576
-
\??\c:\fxrxrrr.exec:\fxrxrrr.exe134⤵PID:2596
-
\??\c:\1lfxrxr.exec:\1lfxrxr.exe135⤵PID:4036
-
\??\c:\3nhbtt.exec:\3nhbtt.exe136⤵PID:2968
-
\??\c:\hhhtnn.exec:\hhhtnn.exe137⤵PID:4448
-
\??\c:\jdjvd.exec:\jdjvd.exe138⤵PID:1812
-
\??\c:\dvpjd.exec:\dvpjd.exe139⤵PID:3204
-
\??\c:\rlrlllf.exec:\rlrlllf.exe140⤵PID:2080
-
\??\c:\3xxrlfx.exec:\3xxrlfx.exe141⤵PID:2648
-
\??\c:\1bhbtn.exec:\1bhbtn.exe142⤵PID:4552
-
\??\c:\5djdp.exec:\5djdp.exe143⤵PID:2760
-
\??\c:\9ppjd.exec:\9ppjd.exe144⤵PID:3736
-
\??\c:\frrlxxr.exec:\frrlxxr.exe145⤵PID:1568
-
\??\c:\5ffxllf.exec:\5ffxllf.exe146⤵PID:3956
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe147⤵PID:2136
-
\??\c:\ttnbth.exec:\ttnbth.exe148⤵PID:2764
-
\??\c:\nththb.exec:\nththb.exe149⤵PID:1800
-
\??\c:\vdvpj.exec:\vdvpj.exe150⤵PID:4656
-
\??\c:\vjpjd.exec:\vjpjd.exe151⤵PID:4372
-
\??\c:\lllxrrr.exec:\lllxrrr.exe152⤵PID:4272
-
\??\c:\7flfllf.exec:\7flfllf.exe153⤵PID:672
-
\??\c:\bhnnhh.exec:\bhnnhh.exe154⤵PID:1844
-
\??\c:\nntnnh.exec:\nntnnh.exe155⤵PID:2376
-
\??\c:\tttnhn.exec:\tttnhn.exe156⤵PID:2756
-
\??\c:\jjddv.exec:\jjddv.exe157⤵PID:428
-
\??\c:\3djdp.exec:\3djdp.exe158⤵PID:2132
-
\??\c:\rlfxxlf.exec:\rlfxxlf.exe159⤵PID:1180
-
\??\c:\tnbhbb.exec:\tnbhbb.exe160⤵PID:2652
-
\??\c:\ttbbnn.exec:\ttbbnn.exe161⤵PID:2260
-
\??\c:\jvdvv.exec:\jvdvv.exe162⤵PID:4492
-
\??\c:\9xxxrrr.exec:\9xxxrrr.exe163⤵PID:780
-
\??\c:\3tbbtb.exec:\3tbbtb.exe164⤵PID:4504
-
\??\c:\pvvvp.exec:\pvvvp.exe165⤵PID:4696
-
\??\c:\fllfffl.exec:\fllfffl.exe166⤵PID:636
-
\??\c:\rrllfll.exec:\rrllfll.exe167⤵PID:2848
-
\??\c:\5nbbbb.exec:\5nbbbb.exe168⤵PID:984
-
\??\c:\dvvjd.exec:\dvvjd.exe169⤵PID:2020
-
\??\c:\djjjd.exec:\djjjd.exe170⤵PID:4092
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe171⤵PID:3764
-
\??\c:\htbbtb.exec:\htbbtb.exe172⤵PID:2592
-
\??\c:\bhtnnt.exec:\bhtnnt.exe173⤵PID:1584
-
\??\c:\jvvjj.exec:\jvvjj.exe174⤵PID:4036
-
\??\c:\tntttt.exec:\tntttt.exe175⤵PID:3972
-
\??\c:\pddvp.exec:\pddvp.exe176⤵PID:2328
-
\??\c:\1dddp.exec:\1dddp.exe177⤵PID:3132
-
\??\c:\xxxlrrx.exec:\xxxlrrx.exe178⤵PID:3500
-
\??\c:\ppdvp.exec:\ppdvp.exe179⤵PID:872
-
\??\c:\frfrfrr.exec:\frfrfrr.exe180⤵PID:8
-
\??\c:\1bnnbh.exec:\1bnnbh.exe181⤵PID:3720
-
\??\c:\thnbbt.exec:\thnbbt.exe182⤵PID:2760
-
\??\c:\5jppj.exec:\5jppj.exe183⤵PID:952
-
\??\c:\llxxxfl.exec:\llxxxfl.exe184⤵PID:3540
-
\??\c:\ffxfrxx.exec:\ffxfrxx.exe185⤵PID:1692
-
\??\c:\5ntbbh.exec:\5ntbbh.exe186⤵PID:3668
-
\??\c:\vdjvj.exec:\vdjvj.exe187⤵PID:3568
-
\??\c:\xffffll.exec:\xffffll.exe188⤵PID:64
-
\??\c:\ffffrrf.exec:\ffffrrf.exe189⤵PID:532
-
\??\c:\7nbhbh.exec:\7nbhbh.exe190⤵PID:2804
-
\??\c:\thnnth.exec:\thnnth.exe191⤵PID:116
-
\??\c:\5jpjj.exec:\5jpjj.exe192⤵PID:1548
-
\??\c:\3ddvv.exec:\3ddvv.exe193⤵PID:3604
-
\??\c:\lrlrfrf.exec:\lrlrfrf.exe194⤵PID:2200
-
\??\c:\5ntttt.exec:\5ntttt.exe195⤵PID:1080
-
\??\c:\7bttnt.exec:\7bttnt.exe196⤵PID:1500
-
\??\c:\vvvvd.exec:\vvvvd.exe197⤵PID:968
-
\??\c:\vpvjd.exec:\vpvjd.exe198⤵PID:4876
-
\??\c:\lrffflf.exec:\lrffflf.exe199⤵PID:3220
-
\??\c:\9rllrrx.exec:\9rllrrx.exe200⤵PID:3216
-
\??\c:\tttbhn.exec:\tttbhn.exe201⤵PID:888
-
\??\c:\nhhhhb.exec:\nhhhhb.exe202⤵PID:4660
-
\??\c:\dpddd.exec:\dpddd.exe203⤵PID:2368
-
\??\c:\jvddd.exec:\jvddd.exe204⤵PID:1312
-
\??\c:\7fffxff.exec:\7fffxff.exe205⤵PID:1184
-
\??\c:\nnbbhn.exec:\nnbbhn.exe206⤵PID:4540
-
\??\c:\btbbbh.exec:\btbbbh.exe207⤵PID:4008
-
\??\c:\7pdvv.exec:\7pdvv.exe208⤵PID:3764
-
\??\c:\jvddj.exec:\jvddj.exe209⤵PID:2592
-
\??\c:\pdppp.exec:\pdppp.exe210⤵PID:2240
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe211⤵PID:4732
-
\??\c:\ffrrlrr.exec:\ffrrlrr.exe212⤵PID:1452
-
\??\c:\hhnnhb.exec:\hhnnhb.exe213⤵PID:2992
-
\??\c:\jjjjd.exec:\jjjjd.exe214⤵PID:3132
-
\??\c:\3vjdp.exec:\3vjdp.exe215⤵PID:3404
-
\??\c:\rrrllll.exec:\rrrllll.exe216⤵PID:3212
-
\??\c:\lxllffx.exec:\lxllffx.exe217⤵PID:2808
-
\??\c:\hhnhhn.exec:\hhnhhn.exe218⤵PID:1468
-
\??\c:\ttbhnt.exec:\ttbhnt.exe219⤵PID:4544
-
\??\c:\jpddv.exec:\jpddv.exe220⤵PID:2636
-
\??\c:\ddjdd.exec:\ddjdd.exe221⤵PID:2936
-
\??\c:\lrfffxx.exec:\lrfffxx.exe222⤵PID:2764
-
\??\c:\xflrrrx.exec:\xflrrrx.exe223⤵PID:840
-
\??\c:\nnhhhn.exec:\nnhhhn.exe224⤵PID:4156
-
\??\c:\7nnnhh.exec:\7nnnhh.exe225⤵PID:2896
-
\??\c:\jjjvj.exec:\jjjvj.exe226⤵PID:3144
-
\??\c:\ddjjj.exec:\ddjjj.exe227⤵PID:3248
-
\??\c:\ddpdp.exec:\ddpdp.exe228⤵PID:3560
-
\??\c:\9xllrrf.exec:\9xllrrf.exe229⤵PID:1844
-
\??\c:\rrrrrxf.exec:\rrrrrxf.exe230⤵PID:3448
-
\??\c:\7tnhhh.exec:\7tnhhh.exe231⤵PID:4760
-
\??\c:\bbbhht.exec:\bbbhht.exe232⤵PID:2516
-
\??\c:\jjpdj.exec:\jjpdj.exe233⤵PID:1180
-
\??\c:\jvjvv.exec:\jvjvv.exe234⤵PID:4576
-
\??\c:\xxffffx.exec:\xxffffx.exe235⤵PID:2720
-
\??\c:\tnntnn.exec:\tnntnn.exe236⤵PID:2820
-
\??\c:\tbtttn.exec:\tbtttn.exe237⤵PID:3220
-
\??\c:\vjvvp.exec:\vjvvp.exe238⤵PID:1920
-
\??\c:\vjddd.exec:\vjddd.exe239⤵PID:888
-
\??\c:\fxffxxx.exec:\fxffxxx.exe240⤵PID:3732
-
\??\c:\xxxfrfr.exec:\xxxfrfr.exe241⤵PID:4968
-
\??\c:\hnbbhn.exec:\hnbbhn.exe242⤵PID:4180