Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 20:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe
-
Size
91KB
-
MD5
51cdd6629b5948817acc173d965d724d
-
SHA1
ee904d16b6d24023b0cf28da33510e33d5fce97b
-
SHA256
42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3
-
SHA512
7a0472beefb8c3a483f4866ee231ca64fea0dfe79b0fdc8d7177d08dfad12698e31187aaeb3dfa638c73293179baf7b345dde7a1aaca20513065ab957d617f15
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDvPGB1haZJ2:ymb3NkkiQ3mdBjFIk7+cz2
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/3056-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/716-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 31 IoCs
Processes:
resource yara_rule behavioral2/memory/3056-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4968-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3848-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4456-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4496-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1920-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1920-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1920-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2968-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2964-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2980-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2980-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2980-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1420-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1420-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1420-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1420-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3844-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4796-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3572-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1936-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2492-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1716-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4852-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3672-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/716-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2248-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4912-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3908-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4816-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3272-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
nbhbth.exe9jpdv.exexrrrrrr.exelxflfxr.exevvddv.exetbhhhh.exeddjdj.exexrrlffx.exehbhbbb.exejjpjj.exexrlfffl.exe3hhbtt.exevjppp.exexxxfffr.exe3hnnnt.exeffrflxf.exelxrfrfr.exetbnbnh.exerxffflf.exennbbth.exejvppd.exe9lfffff.exe7flffrl.exejpddd.exe1rrxrff.exethnhhn.exejdpdp.exerrxxxxx.exelfffxxx.exehtbbbb.exevvvdj.exelxxrxxf.exevpvpp.exerrrxxxr.exefxlxlxl.exe1bnhbb.exejvdjp.exejddvp.exevpddd.exehttthn.exehtbhbb.exe9pjdv.exevpvdd.exexrfxrff.exe3tnnnt.exe9hhhbb.exevpvvp.exevjvdv.exepjpvv.exeflrlfff.exe3rrxrxx.exenbbhhn.exedjjvj.exeflrrxrr.exexllllll.exennttnn.exebhntth.exeddpvj.exexrlrfrf.exelxxrlxx.exethnhhb.exejdddv.exejdddd.exellfffff.exepid process 4968 nbhbth.exe 4456 9jpdv.exe 3848 xrrrrrr.exe 4496 lxflfxr.exe 1920 vvddv.exe 2968 tbhhhh.exe 2964 ddjdj.exe 2980 xrrlffx.exe 1420 hbhbbb.exe 3844 jjpjj.exe 4796 xrlfffl.exe 1800 3hhbtt.exe 3572 vjppp.exe 1936 xxxfffr.exe 4436 3hnnnt.exe 2492 ffrflxf.exe 1716 lxrfrfr.exe 3540 tbnbnh.exe 4852 rxffflf.exe 4164 nnbbth.exe 3672 jvppd.exe 716 9lfffff.exe 2248 7flffrl.exe 60 jpddd.exe 4912 1rrxrff.exe 3908 thnhhn.exe 456 jdpdp.exe 1664 rrxxxxx.exe 4000 lfffxxx.exe 4816 htbbbb.exe 3272 vvvdj.exe 4016 lxxrxxf.exe 1204 vpvpp.exe 4076 rrrxxxr.exe 536 fxlxlxl.exe 1568 1bnhbb.exe 1720 jvdjp.exe 4204 jddvp.exe 1560 vpddd.exe 1324 httthn.exe 552 htbhbb.exe 2324 9pjdv.exe 5004 vpvdd.exe 4516 xrfxrff.exe 4696 3tnnnt.exe 928 9hhhbb.exe 4220 vpvvp.exe 3616 vjvdv.exe 4276 pjpvv.exe 3540 flrlfff.exe 4400 3rrxrxx.exe 4692 nbbhhn.exe 4164 djjvj.exe 3316 flrrxrr.exe 1112 xllllll.exe 440 nnttnn.exe 3632 bhntth.exe 2828 ddpvj.exe 4304 xrlrfrf.exe 4280 lxxrlxx.exe 4360 thnhhb.exe 4968 jdddv.exe 4364 jdddd.exe 2548 llfffff.exe -
Processes:
resource yara_rule behavioral2/memory/3056-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/716-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exenbhbth.exe9jpdv.exexrrrrrr.exelxflfxr.exevvddv.exetbhhhh.exeddjdj.exexrrlffx.exehbhbbb.exejjpjj.exexrlfffl.exe3hhbtt.exevjppp.exexxxfffr.exe3hnnnt.exeffrflxf.exelxrfrfr.exetbnbnh.exerxffflf.exennbbth.exejvppd.exedescription pid process target process PID 3056 wrote to memory of 4968 3056 42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe nbhbth.exe PID 3056 wrote to memory of 4968 3056 42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe nbhbth.exe PID 3056 wrote to memory of 4968 3056 42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe nbhbth.exe PID 4968 wrote to memory of 4456 4968 nbhbth.exe 9jpdv.exe PID 4968 wrote to memory of 4456 4968 nbhbth.exe 9jpdv.exe PID 4968 wrote to memory of 4456 4968 nbhbth.exe 9jpdv.exe PID 4456 wrote to memory of 3848 4456 9jpdv.exe xrrrrrr.exe PID 4456 wrote to memory of 3848 4456 9jpdv.exe xrrrrrr.exe PID 4456 wrote to memory of 3848 4456 9jpdv.exe xrrrrrr.exe PID 3848 wrote to memory of 4496 3848 xrrrrrr.exe lxflfxr.exe PID 3848 wrote to memory of 4496 3848 xrrrrrr.exe lxflfxr.exe PID 3848 wrote to memory of 4496 3848 xrrrrrr.exe lxflfxr.exe PID 4496 wrote to memory of 1920 4496 lxflfxr.exe vvddv.exe PID 4496 wrote to memory of 1920 4496 lxflfxr.exe vvddv.exe PID 4496 wrote to memory of 1920 4496 lxflfxr.exe vvddv.exe PID 1920 wrote to memory of 2968 1920 vvddv.exe tbhhhh.exe PID 1920 wrote to memory of 2968 1920 vvddv.exe tbhhhh.exe PID 1920 wrote to memory of 2968 1920 vvddv.exe tbhhhh.exe PID 2968 wrote to memory of 2964 2968 tbhhhh.exe ddjdj.exe PID 2968 wrote to memory of 2964 2968 tbhhhh.exe ddjdj.exe PID 2968 wrote to memory of 2964 2968 tbhhhh.exe ddjdj.exe PID 2964 wrote to memory of 2980 2964 ddjdj.exe xrrlffx.exe PID 2964 wrote to memory of 2980 2964 ddjdj.exe xrrlffx.exe PID 2964 wrote to memory of 2980 2964 ddjdj.exe xrrlffx.exe PID 2980 wrote to memory of 1420 2980 xrrlffx.exe hbhbbb.exe PID 2980 wrote to memory of 1420 2980 xrrlffx.exe hbhbbb.exe PID 2980 wrote to memory of 1420 2980 xrrlffx.exe hbhbbb.exe PID 1420 wrote to memory of 3844 1420 hbhbbb.exe jjpjj.exe PID 1420 wrote to memory of 3844 1420 hbhbbb.exe jjpjj.exe PID 1420 wrote to memory of 3844 1420 hbhbbb.exe jjpjj.exe PID 3844 wrote to memory of 4796 3844 jjpjj.exe xrlfffl.exe PID 3844 wrote to memory of 4796 3844 jjpjj.exe xrlfffl.exe PID 3844 wrote to memory of 4796 3844 jjpjj.exe xrlfffl.exe PID 4796 wrote to memory of 1800 4796 xrlfffl.exe 3hhbtt.exe PID 4796 wrote to memory of 1800 4796 xrlfffl.exe 3hhbtt.exe PID 4796 wrote to memory of 1800 4796 xrlfffl.exe 3hhbtt.exe PID 1800 wrote to memory of 3572 1800 3hhbtt.exe vjppp.exe PID 1800 wrote to memory of 3572 1800 3hhbtt.exe vjppp.exe PID 1800 wrote to memory of 3572 1800 3hhbtt.exe vjppp.exe PID 3572 wrote to memory of 1936 3572 vjppp.exe xxxfffr.exe PID 3572 wrote to memory of 1936 3572 vjppp.exe xxxfffr.exe PID 3572 wrote to memory of 1936 3572 vjppp.exe xxxfffr.exe PID 1936 wrote to memory of 4436 1936 xxxfffr.exe 3hnnnt.exe PID 1936 wrote to memory of 4436 1936 xxxfffr.exe 3hnnnt.exe PID 1936 wrote to memory of 4436 1936 xxxfffr.exe 3hnnnt.exe PID 4436 wrote to memory of 2492 4436 3hnnnt.exe ffrflxf.exe PID 4436 wrote to memory of 2492 4436 3hnnnt.exe ffrflxf.exe PID 4436 wrote to memory of 2492 4436 3hnnnt.exe ffrflxf.exe PID 2492 wrote to memory of 1716 2492 ffrflxf.exe lxrfrfr.exe PID 2492 wrote to memory of 1716 2492 ffrflxf.exe lxrfrfr.exe PID 2492 wrote to memory of 1716 2492 ffrflxf.exe lxrfrfr.exe PID 1716 wrote to memory of 3540 1716 lxrfrfr.exe tbnbnh.exe PID 1716 wrote to memory of 3540 1716 lxrfrfr.exe tbnbnh.exe PID 1716 wrote to memory of 3540 1716 lxrfrfr.exe tbnbnh.exe PID 3540 wrote to memory of 4852 3540 tbnbnh.exe rxffflf.exe PID 3540 wrote to memory of 4852 3540 tbnbnh.exe rxffflf.exe PID 3540 wrote to memory of 4852 3540 tbnbnh.exe rxffflf.exe PID 4852 wrote to memory of 4164 4852 rxffflf.exe nnbbth.exe PID 4852 wrote to memory of 4164 4852 rxffflf.exe nnbbth.exe PID 4852 wrote to memory of 4164 4852 rxffflf.exe nnbbth.exe PID 4164 wrote to memory of 3672 4164 nnbbth.exe jvppd.exe PID 4164 wrote to memory of 3672 4164 nnbbth.exe jvppd.exe PID 4164 wrote to memory of 3672 4164 nnbbth.exe jvppd.exe PID 3672 wrote to memory of 716 3672 jvppd.exe 9lfffff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe"C:\Users\Admin\AppData\Local\Temp\42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\nbhbth.exec:\nbhbth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\9jpdv.exec:\9jpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\lxflfxr.exec:\lxflfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\vvddv.exec:\vvddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\tbhhhh.exec:\tbhhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\ddjdj.exec:\ddjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\xrrlffx.exec:\xrrlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\hbhbbb.exec:\hbhbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\jjpjj.exec:\jjpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\xrlfffl.exec:\xrlfffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\3hhbtt.exec:\3hhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\vjppp.exec:\vjppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\xxxfffr.exec:\xxxfffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\3hnnnt.exec:\3hnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\ffrflxf.exec:\ffrflxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\lxrfrfr.exec:\lxrfrfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\tbnbnh.exec:\tbnbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\rxffflf.exec:\rxffflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\nnbbth.exec:\nnbbth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\jvppd.exec:\jvppd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\9lfffff.exec:\9lfffff.exe23⤵
- Executes dropped EXE
PID:716 -
\??\c:\7flffrl.exec:\7flffrl.exe24⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jpddd.exec:\jpddd.exe25⤵
- Executes dropped EXE
PID:60 -
\??\c:\1rrxrff.exec:\1rrxrff.exe26⤵
- Executes dropped EXE
PID:4912 -
\??\c:\thnhhn.exec:\thnhhn.exe27⤵
- Executes dropped EXE
PID:3908 -
\??\c:\jdpdp.exec:\jdpdp.exe28⤵
- Executes dropped EXE
PID:456 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe29⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lfffxxx.exec:\lfffxxx.exe30⤵
- Executes dropped EXE
PID:4000 -
\??\c:\htbbbb.exec:\htbbbb.exe31⤵
- Executes dropped EXE
PID:4816 -
\??\c:\vvvdj.exec:\vvvdj.exe32⤵
- Executes dropped EXE
PID:3272 -
\??\c:\lxxrxxf.exec:\lxxrxxf.exe33⤵
- Executes dropped EXE
PID:4016 -
\??\c:\vpvpp.exec:\vpvpp.exe34⤵
- Executes dropped EXE
PID:1204 -
\??\c:\rrrxxxr.exec:\rrrxxxr.exe35⤵
- Executes dropped EXE
PID:4076 -
\??\c:\fxlxlxl.exec:\fxlxlxl.exe36⤵
- Executes dropped EXE
PID:536 -
\??\c:\1bnhbb.exec:\1bnhbb.exe37⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jvdjp.exec:\jvdjp.exe38⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jddvp.exec:\jddvp.exe39⤵
- Executes dropped EXE
PID:4204 -
\??\c:\vpddd.exec:\vpddd.exe40⤵
- Executes dropped EXE
PID:1560 -
\??\c:\httthn.exec:\httthn.exe41⤵
- Executes dropped EXE
PID:1324 -
\??\c:\htbhbb.exec:\htbhbb.exe42⤵
- Executes dropped EXE
PID:552 -
\??\c:\9pjdv.exec:\9pjdv.exe43⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vpvdd.exec:\vpvdd.exe44⤵
- Executes dropped EXE
PID:5004 -
\??\c:\xrfxrff.exec:\xrfxrff.exe45⤵
- Executes dropped EXE
PID:4516 -
\??\c:\3tnnnt.exec:\3tnnnt.exe46⤵
- Executes dropped EXE
PID:4696 -
\??\c:\9hhhbb.exec:\9hhhbb.exe47⤵
- Executes dropped EXE
PID:928 -
\??\c:\vpvvp.exec:\vpvvp.exe48⤵
- Executes dropped EXE
PID:4220 -
\??\c:\vjvdv.exec:\vjvdv.exe49⤵
- Executes dropped EXE
PID:3616 -
\??\c:\pjpvv.exec:\pjpvv.exe50⤵
- Executes dropped EXE
PID:4276 -
\??\c:\flrlfff.exec:\flrlfff.exe51⤵
- Executes dropped EXE
PID:3540 -
\??\c:\3rrxrxx.exec:\3rrxrxx.exe52⤵
- Executes dropped EXE
PID:4400 -
\??\c:\nbbhhn.exec:\nbbhhn.exe53⤵
- Executes dropped EXE
PID:4692 -
\??\c:\djjvj.exec:\djjvj.exe54⤵
- Executes dropped EXE
PID:4164 -
\??\c:\flrrxrr.exec:\flrrxrr.exe55⤵
- Executes dropped EXE
PID:3316 -
\??\c:\xllllll.exec:\xllllll.exe56⤵
- Executes dropped EXE
PID:1112 -
\??\c:\nnttnn.exec:\nnttnn.exe57⤵
- Executes dropped EXE
PID:440 -
\??\c:\bhntth.exec:\bhntth.exe58⤵
- Executes dropped EXE
PID:3632 -
\??\c:\ddpvj.exec:\ddpvj.exe59⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xrlrfrf.exec:\xrlrfrf.exe60⤵
- Executes dropped EXE
PID:4304 -
\??\c:\lxxrlxx.exec:\lxxrlxx.exe61⤵
- Executes dropped EXE
PID:4280 -
\??\c:\thnhhb.exec:\thnhhb.exe62⤵
- Executes dropped EXE
PID:4360 -
\??\c:\jdddv.exec:\jdddv.exe63⤵
- Executes dropped EXE
PID:4968 -
\??\c:\jdddd.exec:\jdddd.exe64⤵
- Executes dropped EXE
PID:4364 -
\??\c:\llfffff.exec:\llfffff.exe65⤵
- Executes dropped EXE
PID:2548 -
\??\c:\tnbhnt.exec:\tnbhnt.exe66⤵PID:464
-
\??\c:\tntbbt.exec:\tntbbt.exe67⤵PID:1788
-
\??\c:\vdpdp.exec:\vdpdp.exe68⤵PID:4016
-
\??\c:\rrxrlxr.exec:\rrxrlxr.exe69⤵PID:2968
-
\??\c:\nbhbtb.exec:\nbhbtb.exe70⤵PID:448
-
\??\c:\hbhhnh.exec:\hbhhnh.exe71⤵PID:1404
-
\??\c:\pjdvv.exec:\pjdvv.exe72⤵PID:536
-
\??\c:\fffxrxx.exec:\fffxrxx.exe73⤵PID:5008
-
\??\c:\rrlrflr.exec:\rrlrflr.exe74⤵PID:1420
-
\??\c:\1ntnhh.exec:\1ntnhh.exe75⤵PID:3844
-
\??\c:\3pvpj.exec:\3pvpj.exe76⤵PID:768
-
\??\c:\lfflxxf.exec:\lfflxxf.exe77⤵PID:4284
-
\??\c:\rfllxfl.exec:\rfllxfl.exe78⤵PID:3812
-
\??\c:\nntnhh.exec:\nntnhh.exe79⤵PID:412
-
\??\c:\9nhhbn.exec:\9nhhbn.exe80⤵PID:3648
-
\??\c:\pvppp.exec:\pvppp.exe81⤵PID:4516
-
\??\c:\ppddd.exec:\ppddd.exe82⤵PID:4696
-
\??\c:\xllfxrl.exec:\xllfxrl.exe83⤵PID:928
-
\??\c:\hnnttt.exec:\hnnttt.exe84⤵PID:3684
-
\??\c:\tthbtb.exec:\tthbtb.exe85⤵PID:4492
-
\??\c:\dvjjv.exec:\dvjjv.exe86⤵PID:4480
-
\??\c:\lrllrfl.exec:\lrllrfl.exe87⤵PID:2568
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe88⤵PID:2888
-
\??\c:\tntttb.exec:\tntttb.exe89⤵PID:3316
-
\??\c:\hhbbhh.exec:\hhbbhh.exe90⤵PID:1112
-
\??\c:\dvjvv.exec:\dvjvv.exe91⤵PID:440
-
\??\c:\nnhbbb.exec:\nnhbbb.exe92⤵PID:5012
-
\??\c:\dpvpd.exec:\dpvpd.exe93⤵PID:3048
-
\??\c:\dpvdj.exec:\dpvdj.exe94⤵PID:456
-
\??\c:\rfrlllx.exec:\rfrlllx.exe95⤵PID:4484
-
\??\c:\lllrrxx.exec:\lllrrxx.exe96⤵PID:2700
-
\??\c:\hhthnn.exec:\hhthnn.exe97⤵PID:4784
-
\??\c:\ppddv.exec:\ppddv.exe98⤵PID:3776
-
\??\c:\frffxfl.exec:\frffxfl.exe99⤵PID:4044
-
\??\c:\hhtttt.exec:\hhtttt.exe100⤵PID:2236
-
\??\c:\thbbbb.exec:\thbbbb.exe101⤵PID:1920
-
\??\c:\hbnntt.exec:\hbnntt.exe102⤵PID:4948
-
\??\c:\vdpjd.exec:\vdpjd.exe103⤵PID:5040
-
\??\c:\vpvvd.exec:\vpvvd.exe104⤵PID:2044
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe105⤵PID:2956
-
\??\c:\xrlllll.exec:\xrlllll.exe106⤵PID:3960
-
\??\c:\ffrrlrr.exec:\ffrrlrr.exe107⤵PID:1420
-
\??\c:\ttnhhh.exec:\ttnhhh.exe108⤵PID:3224
-
\??\c:\tnnbtt.exec:\tnnbtt.exe109⤵PID:4216
-
\??\c:\ddpvp.exec:\ddpvp.exe110⤵PID:4924
-
\??\c:\vdpjd.exec:\vdpjd.exe111⤵PID:4068
-
\??\c:\rlfxllf.exec:\rlfxllf.exe112⤵PID:412
-
\??\c:\nhhhhn.exec:\nhhhhn.exe113⤵PID:2148
-
\??\c:\htnnbn.exec:\htnnbn.exe114⤵PID:3948
-
\??\c:\vjvpj.exec:\vjvpj.exe115⤵PID:3852
-
\??\c:\vpjjd.exec:\vpjjd.exe116⤵PID:1440
-
\??\c:\rflrlrr.exec:\rflrlrr.exe117⤵PID:396
-
\??\c:\lrxlxrr.exec:\lrxlxrr.exe118⤵PID:4492
-
\??\c:\thnnnt.exec:\thnnnt.exe119⤵PID:4460
-
\??\c:\htbthb.exec:\htbthb.exe120⤵PID:2568
-
\??\c:\ppppd.exec:\ppppd.exe121⤵PID:388
-
\??\c:\djpdp.exec:\djpdp.exe122⤵PID:1112
-
\??\c:\xrxxllr.exec:\xrxxllr.exe123⤵PID:4308
-
\??\c:\lfllflf.exec:\lfllflf.exe124⤵PID:3112
-
\??\c:\nnnttb.exec:\nnnttb.exe125⤵PID:1600
-
\??\c:\7tbbbt.exec:\7tbbbt.exe126⤵PID:2864
-
\??\c:\ppvjv.exec:\ppvjv.exe127⤵PID:404
-
\??\c:\pvddd.exec:\pvddd.exe128⤵PID:4816
-
\??\c:\rrllfff.exec:\rrllfff.exe129⤵PID:3344
-
\??\c:\3xrlflf.exec:\3xrlflf.exe130⤵PID:1840
-
\??\c:\bhnhtn.exec:\bhnhtn.exe131⤵PID:1076
-
\??\c:\thntnb.exec:\thntnb.exe132⤵PID:3584
-
\??\c:\5dvvp.exec:\5dvvp.exe133⤵PID:2992
-
\??\c:\pdjjd.exec:\pdjjd.exe134⤵PID:1336
-
\??\c:\lfllfrr.exec:\lfllfrr.exe135⤵PID:2980
-
\??\c:\flrllfr.exec:\flrllfr.exe136⤵PID:4432
-
\??\c:\bbtbnb.exec:\bbtbnb.exe137⤵PID:4204
-
\??\c:\hnbbtn.exec:\hnbbtn.exe138⤵PID:4796
-
\??\c:\dvvdj.exec:\dvvdj.exe139⤵PID:2776
-
\??\c:\jpjvp.exec:\jpjvp.exe140⤵PID:3572
-
\??\c:\xxxfrlf.exec:\xxxfrlf.exe141⤵PID:2324
-
\??\c:\xlrllrl.exec:\xlrllrl.exe142⤵PID:5096
-
\??\c:\tnbhbh.exec:\tnbhbh.exe143⤵PID:1124
-
\??\c:\tttnnn.exec:\tttnnn.exe144⤵PID:3564
-
\??\c:\pdvvp.exec:\pdvvp.exe145⤵PID:3948
-
\??\c:\lfrlfrf.exec:\lfrlfrf.exe146⤵PID:4728
-
\??\c:\rlllfxf.exec:\rlllfxf.exe147⤵PID:3176
-
\??\c:\7hhbtt.exec:\7hhbtt.exe148⤵PID:4480
-
\??\c:\ddppp.exec:\ddppp.exe149⤵PID:1196
-
\??\c:\pvdjj.exec:\pvdjj.exe150⤵PID:1912
-
\??\c:\xffxxxf.exec:\xffxxxf.exe151⤵PID:4664
-
\??\c:\ttnhhh.exec:\ttnhhh.exe152⤵PID:4308
-
\??\c:\hhtttt.exec:\hhtttt.exe153⤵PID:8
-
\??\c:\jddpj.exec:\jddpj.exe154⤵PID:4980
-
\??\c:\jpvvj.exec:\jpvvj.exe155⤵PID:4816
-
\??\c:\xffxllf.exec:\xffxllf.exe156⤵PID:3756
-
\??\c:\ththbt.exec:\ththbt.exe157⤵PID:4016
-
\??\c:\lfrxfxx.exec:\lfrxfxx.exe158⤵PID:2964
-
\??\c:\hntnht.exec:\hntnht.exe159⤵PID:2244
-
\??\c:\nbtthn.exec:\nbtthn.exe160⤵PID:3504
-
\??\c:\ppvdj.exec:\ppvdj.exe161⤵PID:4128
-
\??\c:\pjjvv.exec:\pjjvv.exe162⤵PID:1544
-
\??\c:\rlrrllf.exec:\rlrrllf.exe163⤵PID:2488
-
\??\c:\lxrlfff.exec:\lxrlfff.exe164⤵PID:2772
-
\??\c:\tnhtnt.exec:\tnhtnt.exe165⤵PID:5004
-
\??\c:\5hhbnn.exec:\5hhbnn.exe166⤵PID:3532
-
\??\c:\pddjv.exec:\pddjv.exe167⤵PID:4584
-
\??\c:\jvdvp.exec:\jvdvp.exe168⤵PID:868
-
\??\c:\rrrlfff.exec:\rrrlfff.exe169⤵PID:3708
-
\??\c:\lffxxll.exec:\lffxxll.exe170⤵PID:1268
-
\??\c:\vpddj.exec:\vpddj.exe171⤵PID:4116
-
\??\c:\xrxlrfr.exec:\xrxlrfr.exe172⤵PID:3280
-
\??\c:\rffffff.exec:\rffffff.exe173⤵PID:1940
-
\??\c:\1rxrrrr.exec:\1rxrrrr.exe174⤵PID:2984
-
\??\c:\thtnnt.exec:\thtnnt.exe175⤵PID:4712
-
\??\c:\pvdvv.exec:\pvdvv.exe176⤵PID:3056
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe177⤵PID:5000
-
\??\c:\thhhhh.exec:\thhhhh.exe178⤵PID:4496
-
\??\c:\dvvjj.exec:\dvvjj.exe179⤵PID:1756
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe180⤵PID:2680
-
\??\c:\1pdvj.exec:\1pdvj.exe181⤵PID:1204
-
\??\c:\jjdpj.exec:\jjdpj.exe182⤵PID:1920
-
\??\c:\hbnntt.exec:\hbnntt.exe183⤵PID:3180
-
\??\c:\vdvpp.exec:\vdvpp.exe184⤵PID:2956
-
\??\c:\xlrrxrl.exec:\xlrrxrl.exe185⤵PID:4432
-
\??\c:\jjjvv.exec:\jjjvv.exe186⤵PID:1752
-
\??\c:\hbhtnn.exec:\hbhtnn.exe187⤵PID:2776
-
\??\c:\nhnhhh.exec:\nhnhhh.exe188⤵PID:3572
-
\??\c:\pdvvp.exec:\pdvvp.exe189⤵PID:4068
-
\??\c:\lffxrrr.exec:\lffxrrr.exe190⤵PID:3284
-
\??\c:\bbbhhn.exec:\bbbhhn.exe191⤵PID:3456
-
\??\c:\pjjpp.exec:\pjjpp.exe192⤵PID:868
-
\??\c:\rfxlllr.exec:\rfxlllr.exe193⤵PID:3716
-
\??\c:\httnnn.exec:\httnnn.exe194⤵PID:4728
-
\??\c:\ttnthn.exec:\ttnthn.exe195⤵PID:1636
-
\??\c:\pjvpv.exec:\pjvpv.exe196⤵PID:452
-
\??\c:\djjjj.exec:\djjjj.exe197⤵PID:1940
-
\??\c:\7xxffrl.exec:\7xxffrl.exe198⤵PID:1112
-
\??\c:\tnnhbb.exec:\tnnhbb.exe199⤵PID:4664
-
\??\c:\hbhhnn.exec:\hbhhnn.exe200⤵PID:1924
-
\??\c:\vdppp.exec:\vdppp.exe201⤵PID:8
-
\??\c:\vdjdv.exec:\vdjdv.exe202⤵PID:4496
-
\??\c:\rrffrrf.exec:\rrffrrf.exe203⤵PID:1084
-
\??\c:\hnbhth.exec:\hnbhth.exe204⤵PID:1808
-
\??\c:\hbbbbb.exec:\hbbbbb.exe205⤵PID:3584
-
\??\c:\vjppp.exec:\vjppp.exe206⤵PID:2992
-
\??\c:\jjdvj.exec:\jjdvj.exe207⤵PID:2392
-
\??\c:\xrrxfxl.exec:\xrrxfxl.exe208⤵PID:3504
-
\??\c:\rxxxrll.exec:\rxxxrll.exe209⤵PID:1948
-
\??\c:\nbnnbt.exec:\nbnnbt.exe210⤵PID:1544
-
\??\c:\5hhbbb.exec:\5hhbbb.exe211⤵PID:4148
-
\??\c:\dppvp.exec:\dppvp.exe212⤵PID:3532
-
\??\c:\djdvd.exec:\djdvd.exe213⤵PID:2492
-
\??\c:\lfffxxf.exec:\lfffxxf.exe214⤵PID:928
-
\??\c:\ffffxfx.exec:\ffffxfx.exe215⤵PID:5060
-
\??\c:\nbbbnn.exec:\nbbbnn.exe216⤵PID:3672
-
\??\c:\hhhnbt.exec:\hhhnbt.exe217⤵PID:3176
-
\??\c:\jvpdp.exec:\jvpdp.exe218⤵PID:3940
-
\??\c:\llfrxrf.exec:\llfrxrf.exe219⤵PID:3908
-
\??\c:\rrffxrf.exec:\rrffxrf.exe220⤵PID:1940
-
\??\c:\bnhnhn.exec:\bnhnhn.exe221⤵PID:4308
-
\??\c:\tbttbt.exec:\tbttbt.exe222⤵PID:4664
-
\??\c:\dpjvj.exec:\dpjvj.exe223⤵PID:4980
-
\??\c:\xxfffff.exec:\xxfffff.exe224⤵PID:2236
-
\??\c:\xrlfrlx.exec:\xrlfrlx.exe225⤵PID:4076
-
\??\c:\hnhbnt.exec:\hnhbnt.exe226⤵PID:1972
-
\??\c:\1jppp.exec:\1jppp.exe227⤵PID:1788
-
\??\c:\pvpvd.exec:\pvpvd.exe228⤵PID:4016
-
\??\c:\5lrrrrx.exec:\5lrrrrx.exe229⤵PID:4948
-
\??\c:\hhnttn.exec:\hhnttn.exe230⤵PID:2244
-
\??\c:\tbtbbh.exec:\tbtbbh.exe231⤵PID:1984
-
\??\c:\vvjdj.exec:\vvjdj.exe232⤵PID:4432
-
\??\c:\vddjj.exec:\vddjj.exe233⤵PID:1324
-
\??\c:\rlxfxfx.exec:\rlxfxfx.exe234⤵PID:3812
-
\??\c:\3hnnnn.exec:\3hnnnn.exe235⤵PID:1728
-
\??\c:\bhhbhh.exec:\bhhbhh.exe236⤵PID:232
-
\??\c:\vjjjd.exec:\vjjjd.exe237⤵PID:4620
-
\??\c:\pvvvj.exec:\pvvvj.exe238⤵PID:3552
-
\??\c:\9rffrrf.exec:\9rffrrf.exe239⤵PID:3540
-
\??\c:\5rxrlll.exec:\5rxrlll.exe240⤵PID:4832
-
\??\c:\tntttb.exec:\tntttb.exe241⤵PID:1656
-
\??\c:\9hbbhh.exec:\9hbbhh.exe242⤵PID:5096