Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c2399a3ffea4b5f33a4474c02dce3e44847e61f1e6ce2665dd0c89bc18a8491.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
6c2399a3ffea4b5f33a4474c02dce3e44847e61f1e6ce2665dd0c89bc18a8491.exe
-
Size
66KB
-
MD5
084734274535f7960c809dd4d7c8ca8a
-
SHA1
5a41275a92158c966188af9d94d3d484e40c4127
-
SHA256
6c2399a3ffea4b5f33a4474c02dce3e44847e61f1e6ce2665dd0c89bc18a8491
-
SHA512
7d53cfb8464ff681086047bdcba0ab9fd558c5daabda00144f6563931d08ba8e7a701bca33262ade8f353c38c5af96dc6ef14e14b37e3482d207d64a275ef2c1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZs:ymb3NkkiQ3mdBjF0yUmW
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/4896-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-27-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4896-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5040-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2180-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4360-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/884-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1448-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3448-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3968-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4356-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1536-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1704-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2100-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4356-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4356-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4356-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1372-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3040-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3088-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1816-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2052-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4336-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1888-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3408-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1652-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4984-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2308-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
tnnhhb.exenhhbtn.exellfflff.exettbbnn.exedvddv.exelfflxxf.exe5hnhbt.exetbtbbh.exerfxxlrf.exellfxxxx.exenbbbnb.exeppvvd.exeddjjj.exexxrrfff.exebnnbhh.exeddvvv.exelrxflrx.exehthhhn.exevdddv.exevvpdv.exefxrxlfr.exe1tnnth.exebntttb.exepvjpj.exerlrrflf.exe5ffxlxx.exenbbhhn.exevvvpj.exe3ddvj.exefrrrlll.exe1tnttn.exepjdvj.exepvddv.exefllrrlf.exebbhbhn.exejvpjj.exepjvjd.exebbhhnn.exetttnbt.exedpppv.exerlfxxff.exerlfxrlf.exenhnthn.exepvdvp.exerrllxfl.exebhnnbh.exejdjjd.exedpppv.exe5frfxrr.exehttthh.exenhbbtb.exeddjpp.exefxxrlrr.exehtnnnn.exevpvpj.exerllffrr.exe3ffxrrl.exehttnhh.exe1bhbtb.exejjvjv.exerlflfff.exehbhbtb.exehhhhbb.exevvppp.exepid process 5040 tnnhhb.exe 4360 nhhbtn.exe 2180 llfflff.exe 884 ttbbnn.exe 1448 dvddv.exe 3968 lfflxxf.exe 3448 5hnhbt.exe 4356 tbtbbh.exe 2100 rfxxlrf.exe 4420 llfxxxx.exe 1536 nbbbnb.exe 1704 ppvvd.exe 1372 ddjjj.exe 3040 xxrrfff.exe 1096 bnnbhh.exe 3088 ddvvv.exe 1816 lrxflrx.exe 2716 hthhhn.exe 1856 vdddv.exe 2052 vvpdv.exe 4328 fxrxlfr.exe 4336 1tnnth.exe 3244 bntttb.exe 1888 pvjpj.exe 3408 rlrrflf.exe 4116 5ffxlxx.exe 1064 nbbhhn.exe 1652 vvvpj.exe 3084 3ddvj.exe 4984 frrrlll.exe 2308 1tnttn.exe 4524 pjdvj.exe 2452 pvddv.exe 1376 fllrrlf.exe 2432 bbhbhn.exe 3228 jvpjj.exe 3096 pjvjd.exe 4668 bbhhnn.exe 4536 tttnbt.exe 184 dpppv.exe 1388 rlfxxff.exe 1104 rlfxrlf.exe 4048 nhnthn.exe 3248 pvdvp.exe 2168 rrllxfl.exe 2272 bhnnbh.exe 4780 jdjjd.exe 2460 dpppv.exe 4344 5frfxrr.exe 2940 httthh.exe 4888 nhbbtb.exe 2132 ddjpp.exe 3296 fxxrlrr.exe 2484 htnnnn.exe 3452 vpvpj.exe 4436 rllffrr.exe 4508 3ffxrrl.exe 1220 httnhh.exe 5012 1bhbtb.exe 3016 jjvjv.exe 2096 rlflfff.exe 4544 hbhbtb.exe 4812 hhhhbb.exe 3056 vvppp.exe -
Processes:
resource yara_rule behavioral2/memory/4896-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6c2399a3ffea4b5f33a4474c02dce3e44847e61f1e6ce2665dd0c89bc18a8491.exetnnhhb.exenhhbtn.exellfflff.exettbbnn.exedvddv.exelfflxxf.exe5hnhbt.exetbtbbh.exerfxxlrf.exellfxxxx.exenbbbnb.exeppvvd.exeddjjj.exexxrrfff.exebnnbhh.exeddvvv.exelrxflrx.exehthhhn.exevdddv.exevvpdv.exefxrxlfr.exedescription pid process target process PID 4896 wrote to memory of 5040 4896 6c2399a3ffea4b5f33a4474c02dce3e44847e61f1e6ce2665dd0c89bc18a8491.exe tnnhhb.exe PID 4896 wrote to memory of 5040 4896 6c2399a3ffea4b5f33a4474c02dce3e44847e61f1e6ce2665dd0c89bc18a8491.exe tnnhhb.exe PID 4896 wrote to memory of 5040 4896 6c2399a3ffea4b5f33a4474c02dce3e44847e61f1e6ce2665dd0c89bc18a8491.exe tnnhhb.exe PID 5040 wrote to memory of 4360 5040 tnnhhb.exe nhhbtn.exe PID 5040 wrote to memory of 4360 5040 tnnhhb.exe nhhbtn.exe PID 5040 wrote to memory of 4360 5040 tnnhhb.exe nhhbtn.exe PID 4360 wrote to memory of 2180 4360 nhhbtn.exe llfflff.exe PID 4360 wrote to memory of 2180 4360 nhhbtn.exe llfflff.exe PID 4360 wrote to memory of 2180 4360 nhhbtn.exe llfflff.exe PID 2180 wrote to memory of 884 2180 llfflff.exe ttbbnn.exe PID 2180 wrote to memory of 884 2180 llfflff.exe ttbbnn.exe PID 2180 wrote to memory of 884 2180 llfflff.exe ttbbnn.exe PID 884 wrote to memory of 1448 884 ttbbnn.exe dvddv.exe PID 884 wrote to memory of 1448 884 ttbbnn.exe dvddv.exe PID 884 wrote to memory of 1448 884 ttbbnn.exe dvddv.exe PID 1448 wrote to memory of 3968 1448 dvddv.exe lfflxxf.exe PID 1448 wrote to memory of 3968 1448 dvddv.exe lfflxxf.exe PID 1448 wrote to memory of 3968 1448 dvddv.exe lfflxxf.exe PID 3968 wrote to memory of 3448 3968 lfflxxf.exe 5hnhbt.exe PID 3968 wrote to memory of 3448 3968 lfflxxf.exe 5hnhbt.exe PID 3968 wrote to memory of 3448 3968 lfflxxf.exe 5hnhbt.exe PID 3448 wrote to memory of 4356 3448 5hnhbt.exe tbtbbh.exe PID 3448 wrote to memory of 4356 3448 5hnhbt.exe tbtbbh.exe PID 3448 wrote to memory of 4356 3448 5hnhbt.exe tbtbbh.exe PID 4356 wrote to memory of 2100 4356 tbtbbh.exe rfxxlrf.exe PID 4356 wrote to memory of 2100 4356 tbtbbh.exe rfxxlrf.exe PID 4356 wrote to memory of 2100 4356 tbtbbh.exe rfxxlrf.exe PID 2100 wrote to memory of 4420 2100 rfxxlrf.exe llfxxxx.exe PID 2100 wrote to memory of 4420 2100 rfxxlrf.exe llfxxxx.exe PID 2100 wrote to memory of 4420 2100 rfxxlrf.exe llfxxxx.exe PID 4420 wrote to memory of 1536 4420 llfxxxx.exe nbbbnb.exe PID 4420 wrote to memory of 1536 4420 llfxxxx.exe nbbbnb.exe PID 4420 wrote to memory of 1536 4420 llfxxxx.exe nbbbnb.exe PID 1536 wrote to memory of 1704 1536 nbbbnb.exe ppvvd.exe PID 1536 wrote to memory of 1704 1536 nbbbnb.exe ppvvd.exe PID 1536 wrote to memory of 1704 1536 nbbbnb.exe ppvvd.exe PID 1704 wrote to memory of 1372 1704 ppvvd.exe ddjjj.exe PID 1704 wrote to memory of 1372 1704 ppvvd.exe ddjjj.exe PID 1704 wrote to memory of 1372 1704 ppvvd.exe ddjjj.exe PID 1372 wrote to memory of 3040 1372 ddjjj.exe xxrrfff.exe PID 1372 wrote to memory of 3040 1372 ddjjj.exe xxrrfff.exe PID 1372 wrote to memory of 3040 1372 ddjjj.exe xxrrfff.exe PID 3040 wrote to memory of 1096 3040 xxrrfff.exe bnnbhh.exe PID 3040 wrote to memory of 1096 3040 xxrrfff.exe bnnbhh.exe PID 3040 wrote to memory of 1096 3040 xxrrfff.exe bnnbhh.exe PID 1096 wrote to memory of 3088 1096 bnnbhh.exe ddvvv.exe PID 1096 wrote to memory of 3088 1096 bnnbhh.exe ddvvv.exe PID 1096 wrote to memory of 3088 1096 bnnbhh.exe ddvvv.exe PID 3088 wrote to memory of 1816 3088 ddvvv.exe lrxflrx.exe PID 3088 wrote to memory of 1816 3088 ddvvv.exe lrxflrx.exe PID 3088 wrote to memory of 1816 3088 ddvvv.exe lrxflrx.exe PID 1816 wrote to memory of 2716 1816 lrxflrx.exe hthhhn.exe PID 1816 wrote to memory of 2716 1816 lrxflrx.exe hthhhn.exe PID 1816 wrote to memory of 2716 1816 lrxflrx.exe hthhhn.exe PID 2716 wrote to memory of 1856 2716 hthhhn.exe vdddv.exe PID 2716 wrote to memory of 1856 2716 hthhhn.exe vdddv.exe PID 2716 wrote to memory of 1856 2716 hthhhn.exe vdddv.exe PID 1856 wrote to memory of 2052 1856 vdddv.exe vvpdv.exe PID 1856 wrote to memory of 2052 1856 vdddv.exe vvpdv.exe PID 1856 wrote to memory of 2052 1856 vdddv.exe vvpdv.exe PID 2052 wrote to memory of 4328 2052 vvpdv.exe fxrxlfr.exe PID 2052 wrote to memory of 4328 2052 vvpdv.exe fxrxlfr.exe PID 2052 wrote to memory of 4328 2052 vvpdv.exe fxrxlfr.exe PID 4328 wrote to memory of 4336 4328 fxrxlfr.exe 1tnnth.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c2399a3ffea4b5f33a4474c02dce3e44847e61f1e6ce2665dd0c89bc18a8491.exe"C:\Users\Admin\AppData\Local\Temp\6c2399a3ffea4b5f33a4474c02dce3e44847e61f1e6ce2665dd0c89bc18a8491.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\tnnhhb.exec:\tnnhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\nhhbtn.exec:\nhhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\llfflff.exec:\llfflff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\ttbbnn.exec:\ttbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\dvddv.exec:\dvddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\lfflxxf.exec:\lfflxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\5hnhbt.exec:\5hnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\tbtbbh.exec:\tbtbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\rfxxlrf.exec:\rfxxlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\llfxxxx.exec:\llfxxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\nbbbnb.exec:\nbbbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\ppvvd.exec:\ppvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\ddjjj.exec:\ddjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\xxrrfff.exec:\xxrrfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\bnnbhh.exec:\bnnbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\ddvvv.exec:\ddvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\lrxflrx.exec:\lrxflrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\hthhhn.exec:\hthhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\vdddv.exec:\vdddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\vvpdv.exec:\vvpdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\fxrxlfr.exec:\fxrxlfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\1tnnth.exec:\1tnnth.exe23⤵
- Executes dropped EXE
PID:4336 -
\??\c:\bntttb.exec:\bntttb.exe24⤵
- Executes dropped EXE
PID:3244 -
\??\c:\pvjpj.exec:\pvjpj.exe25⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rlrrflf.exec:\rlrrflf.exe26⤵
- Executes dropped EXE
PID:3408 -
\??\c:\5ffxlxx.exec:\5ffxlxx.exe27⤵
- Executes dropped EXE
PID:4116 -
\??\c:\nbbhhn.exec:\nbbhhn.exe28⤵
- Executes dropped EXE
PID:1064 -
\??\c:\vvvpj.exec:\vvvpj.exe29⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3ddvj.exec:\3ddvj.exe30⤵
- Executes dropped EXE
PID:3084 -
\??\c:\frrrlll.exec:\frrrlll.exe31⤵
- Executes dropped EXE
PID:4984 -
\??\c:\1tnttn.exec:\1tnttn.exe32⤵
- Executes dropped EXE
PID:2308 -
\??\c:\pjdvj.exec:\pjdvj.exe33⤵
- Executes dropped EXE
PID:4524 -
\??\c:\pvddv.exec:\pvddv.exe34⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fllrrlf.exec:\fllrrlf.exe35⤵
- Executes dropped EXE
PID:1376 -
\??\c:\bbhbhn.exec:\bbhbhn.exe36⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jvpjj.exec:\jvpjj.exe37⤵
- Executes dropped EXE
PID:3228 -
\??\c:\pjvjd.exec:\pjvjd.exe38⤵
- Executes dropped EXE
PID:3096 -
\??\c:\bbhhnn.exec:\bbhhnn.exe39⤵
- Executes dropped EXE
PID:4668 -
\??\c:\tttnbt.exec:\tttnbt.exe40⤵
- Executes dropped EXE
PID:4536 -
\??\c:\dpppv.exec:\dpppv.exe41⤵
- Executes dropped EXE
PID:184 -
\??\c:\rlfxxff.exec:\rlfxxff.exe42⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe43⤵
- Executes dropped EXE
PID:1104 -
\??\c:\nhnthn.exec:\nhnthn.exe44⤵
- Executes dropped EXE
PID:4048 -
\??\c:\pvdvp.exec:\pvdvp.exe45⤵
- Executes dropped EXE
PID:3248 -
\??\c:\3jvpp.exec:\3jvpp.exe46⤵PID:4432
-
\??\c:\rrllxfl.exec:\rrllxfl.exe47⤵
- Executes dropped EXE
PID:2168 -
\??\c:\bhnnbh.exec:\bhnnbh.exe48⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jdjjd.exec:\jdjjd.exe49⤵
- Executes dropped EXE
PID:4780 -
\??\c:\dpppv.exec:\dpppv.exe50⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5frfxrr.exec:\5frfxrr.exe51⤵
- Executes dropped EXE
PID:4344 -
\??\c:\httthh.exec:\httthh.exe52⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nhbbtb.exec:\nhbbtb.exe53⤵
- Executes dropped EXE
PID:4888 -
\??\c:\ddjpp.exec:\ddjpp.exe54⤵
- Executes dropped EXE
PID:2132 -
\??\c:\fxxrlrr.exec:\fxxrlrr.exe55⤵
- Executes dropped EXE
PID:3296 -
\??\c:\htnnnn.exec:\htnnnn.exe56⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpvpj.exec:\vpvpj.exe57⤵
- Executes dropped EXE
PID:3452 -
\??\c:\rllffrr.exec:\rllffrr.exe58⤵
- Executes dropped EXE
PID:4436 -
\??\c:\3ffxrrl.exec:\3ffxrrl.exe59⤵
- Executes dropped EXE
PID:4508 -
\??\c:\httnhh.exec:\httnhh.exe60⤵
- Executes dropped EXE
PID:1220 -
\??\c:\1bhbtb.exec:\1bhbtb.exe61⤵
- Executes dropped EXE
PID:5012 -
\??\c:\jjvjv.exec:\jjvjv.exe62⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rlflfff.exec:\rlflfff.exe63⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hbhbtb.exec:\hbhbtb.exe64⤵
- Executes dropped EXE
PID:4544 -
\??\c:\hhhhbb.exec:\hhhhbb.exe65⤵
- Executes dropped EXE
PID:4812 -
\??\c:\vvppp.exec:\vvppp.exe66⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rrffxxr.exec:\rrffxxr.exe67⤵PID:4640
-
\??\c:\ntbbtt.exec:\ntbbtt.exe68⤵PID:4868
-
\??\c:\btnnnn.exec:\btnnnn.exe69⤵PID:4920
-
\??\c:\dvdvv.exec:\dvdvv.exe70⤵PID:2960
-
\??\c:\rxxflrr.exec:\rxxflrr.exe71⤵PID:3620
-
\??\c:\tnhhbn.exec:\tnhhbn.exe72⤵PID:4148
-
\??\c:\jjvvj.exec:\jjvvj.exe73⤵PID:2552
-
\??\c:\5ffrfrx.exec:\5ffrfrx.exe74⤵PID:4864
-
\??\c:\nhtttt.exec:\nhtttt.exe75⤵PID:1360
-
\??\c:\vppvp.exec:\vppvp.exe76⤵PID:2036
-
\??\c:\dpjpp.exec:\dpjpp.exe77⤵PID:3080
-
\??\c:\rfrxlfr.exec:\rfrxlfr.exe78⤵PID:2780
-
\??\c:\3lfxflx.exec:\3lfxflx.exe79⤵PID:2116
-
\??\c:\ttnttn.exec:\ttnttn.exe80⤵PID:4564
-
\??\c:\dpjpp.exec:\dpjpp.exe81⤵PID:2344
-
\??\c:\rlflffx.exec:\rlflffx.exe82⤵PID:1588
-
\??\c:\rxfllxx.exec:\rxfllxx.exe83⤵PID:4472
-
\??\c:\bbbbbb.exec:\bbbbbb.exe84⤵PID:4272
-
\??\c:\djvvd.exec:\djvvd.exe85⤵PID:2008
-
\??\c:\pjdjd.exec:\pjdjd.exe86⤵PID:4644
-
\??\c:\ntbnth.exec:\ntbnth.exe87⤵PID:4552
-
\??\c:\9tnhbh.exec:\9tnhbh.exe88⤵PID:436
-
\??\c:\vvjpv.exec:\vvjpv.exe89⤵PID:5016
-
\??\c:\ddjvv.exec:\ddjvv.exe90⤵PID:3708
-
\??\c:\rfrffxr.exec:\rfrffxr.exe91⤵PID:2392
-
\??\c:\fxlllll.exec:\fxlllll.exe92⤵PID:2208
-
\??\c:\9hhhhn.exec:\9hhhhn.exe93⤵PID:1368
-
\??\c:\djdjp.exec:\djdjp.exe94⤵PID:1104
-
\??\c:\jdpjv.exec:\jdpjv.exe95⤵PID:4048
-
\??\c:\1lfflrr.exec:\1lfflrr.exe96⤵PID:4068
-
\??\c:\bbhtbh.exec:\bbhtbh.exe97⤵PID:2272
-
\??\c:\nbhhhh.exec:\nbhhhh.exe98⤵PID:1084
-
\??\c:\ppdjv.exec:\ppdjv.exe99⤵PID:3464
-
\??\c:\3pjvd.exec:\3pjvd.exe100⤵PID:4168
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe101⤵PID:348
-
\??\c:\tttbtt.exec:\tttbtt.exe102⤵PID:3380
-
\??\c:\bhhtnn.exec:\bhhtnn.exe103⤵PID:1072
-
\??\c:\djvdv.exec:\djvdv.exe104⤵PID:3296
-
\??\c:\1lrlrrr.exec:\1lrlrrr.exe105⤵PID:2880
-
\??\c:\llrrlxx.exec:\llrrlxx.exe106⤵PID:2100
-
\??\c:\pppvv.exec:\pppvv.exe107⤵PID:2528
-
\??\c:\jpvvv.exec:\jpvvv.exe108⤵PID:4508
-
\??\c:\xfxflxx.exec:\xfxflxx.exe109⤵PID:1220
-
\??\c:\tbnnnt.exec:\tbnnnt.exe110⤵PID:3524
-
\??\c:\ttnnnb.exec:\ttnnnb.exe111⤵PID:1592
-
\??\c:\pdppp.exec:\pdppp.exe112⤵PID:2632
-
\??\c:\lxxxflr.exec:\lxxxflr.exe113⤵PID:1816
-
\??\c:\vjjvp.exec:\vjjvp.exe114⤵PID:384
-
\??\c:\rfxxrll.exec:\rfxxrll.exe115⤵PID:3056
-
\??\c:\5ntnhh.exec:\5ntnhh.exe116⤵PID:2596
-
\??\c:\nnnnhh.exec:\nnnnhh.exe117⤵PID:1856
-
\??\c:\9jvjp.exec:\9jvjp.exe118⤵PID:1136
-
\??\c:\rlxflfx.exec:\rlxflfx.exe119⤵PID:4912
-
\??\c:\nhhbhh.exec:\nhhbhh.exe120⤵PID:4336
-
\??\c:\dvjpp.exec:\dvjpp.exe121⤵PID:3620
-
\??\c:\jvddd.exec:\jvddd.exe122⤵PID:4468
-
\??\c:\llrrllf.exec:\llrrllf.exe123⤵PID:1724
-
\??\c:\hbttbh.exec:\hbttbh.exe124⤵PID:2444
-
\??\c:\ttbbbn.exec:\ttbbbn.exe125⤵PID:1064
-
\??\c:\pjppj.exec:\pjppj.exe126⤵PID:2816
-
\??\c:\rllllrl.exec:\rllllrl.exe127⤵PID:1804
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe128⤵PID:1728
-
\??\c:\bnhnhn.exec:\bnhnhn.exe129⤵PID:392
-
\??\c:\7dvpj.exec:\7dvpj.exe130⤵PID:2232
-
\??\c:\rfllxrf.exec:\rfllxrf.exe131⤵PID:2424
-
\??\c:\lrffllr.exec:\lrffllr.exe132⤵PID:3176
-
\??\c:\rllllrr.exec:\rllllrr.exe133⤵PID:4996
-
\??\c:\bhbbtb.exec:\bhbbtb.exe134⤵PID:1676
-
\??\c:\ttbbbb.exec:\ttbbbb.exe135⤵PID:924
-
\??\c:\dpvdj.exec:\dpvdj.exe136⤵PID:412
-
\??\c:\pvpvv.exec:\pvpvv.exe137⤵PID:1224
-
\??\c:\3rfflrx.exec:\3rfflrx.exe138⤵PID:4504
-
\??\c:\xfrrllf.exec:\xfrrllf.exe139⤵PID:4896
-
\??\c:\ttntbt.exec:\ttntbt.exe140⤵PID:4432
-
\??\c:\pdjjv.exec:\pdjjv.exe141⤵PID:4532
-
\??\c:\ppvvv.exec:\ppvvv.exe142⤵PID:3136
-
\??\c:\5frxfxl.exec:\5frxfxl.exe143⤵PID:2288
-
\??\c:\btthnb.exec:\btthnb.exe144⤵PID:4768
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe145⤵PID:2280
-
\??\c:\tnhntn.exec:\tnhntn.exe146⤵PID:3104
-
\??\c:\9jppv.exec:\9jppv.exe147⤵PID:4356
-
\??\c:\3flfxfx.exec:\3flfxfx.exe148⤵PID:3296
-
\??\c:\ppjjj.exec:\ppjjj.exe149⤵PID:2704
-
\??\c:\rrllrrr.exec:\rrllrrr.exe150⤵PID:2100
-
\??\c:\hnbhnb.exec:\hnbhnb.exe151⤵PID:2528
-
\??\c:\djvjd.exec:\djvjd.exe152⤵PID:4508
-
\??\c:\5fxxlxr.exec:\5fxxlxr.exe153⤵PID:3304
-
\??\c:\jjvpj.exec:\jjvpj.exe154⤵PID:3524
-
\??\c:\rxrllff.exec:\rxrllff.exe155⤵PID:1592
-
\??\c:\7bnhbt.exec:\7bnhbt.exe156⤵PID:652
-
\??\c:\jvvdd.exec:\jvvdd.exe157⤵PID:512
-
\??\c:\flrrrrx.exec:\flrrrrx.exe158⤵PID:2504
-
\??\c:\pdjdp.exec:\pdjdp.exe159⤵PID:1268
-
\??\c:\xrfffll.exec:\xrfffll.exe160⤵PID:1896
-
\??\c:\nhnnnh.exec:\nhnnnh.exe161⤵PID:1988
-
\??\c:\3pvpj.exec:\3pvpj.exe162⤵PID:1088
-
\??\c:\ffxflrx.exec:\ffxflrx.exe163⤵PID:4736
-
\??\c:\bhhhnb.exec:\bhhhnb.exe164⤵PID:3208
-
\??\c:\1nbntn.exec:\1nbntn.exe165⤵PID:2276
-
\??\c:\jpdvd.exec:\jpdvd.exe166⤵PID:4412
-
\??\c:\9pjjp.exec:\9pjjp.exe167⤵PID:4076
-
\??\c:\7rfrfrl.exec:\7rfrfrl.exe168⤵PID:3992
-
\??\c:\tthntb.exec:\tthntb.exe169⤵PID:244
-
\??\c:\djpvj.exec:\djpvj.exe170⤵PID:4144
-
\??\c:\dpvpp.exec:\dpvpp.exe171⤵PID:2236
-
\??\c:\llflxxr.exec:\llflxxr.exe172⤵PID:4524
-
\??\c:\5tbtnn.exec:\5tbtnn.exe173⤵PID:1696
-
\??\c:\7nhtbt.exec:\7nhtbt.exe174⤵PID:2008
-
\??\c:\pjjpj.exec:\pjjpj.exe175⤵PID:5076
-
\??\c:\vvpdd.exec:\vvpdd.exe176⤵PID:2572
-
\??\c:\7ffrfrl.exec:\7ffrfrl.exe177⤵PID:1676
-
\??\c:\rlrrflr.exec:\rlrrflr.exe178⤵PID:4520
-
\??\c:\hhhthb.exec:\hhhthb.exe179⤵PID:1104
-
\??\c:\5btthn.exec:\5btthn.exe180⤵PID:1780
-
\??\c:\dddjd.exec:\dddjd.exe181⤵PID:4048
-
\??\c:\dvvpp.exec:\dvvpp.exe182⤵PID:4276
-
\??\c:\3llfxfr.exec:\3llfxfr.exe183⤵PID:4532
-
\??\c:\tbtnbn.exec:\tbtnbn.exe184⤵PID:224
-
\??\c:\btbthn.exec:\btbthn.exe185⤵PID:1824
-
\??\c:\dppjj.exec:\dppjj.exe186⤵PID:744
-
\??\c:\7vdpj.exec:\7vdpj.exe187⤵PID:5044
-
\??\c:\rlfxlfr.exec:\rlfxlfr.exe188⤵PID:1072
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe189⤵PID:4004
-
\??\c:\hnhhhh.exec:\hnhhhh.exe190⤵PID:4064
-
\??\c:\nhhhhn.exec:\nhhhhn.exe191⤵PID:3944
-
\??\c:\jdppv.exec:\jdppv.exe192⤵PID:844
-
\??\c:\pjvvv.exec:\pjvvv.exe193⤵PID:1932
-
\??\c:\ffxrlrr.exec:\ffxrlrr.exe194⤵PID:5112
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe195⤵PID:2096
-
\??\c:\hbnhtn.exec:\hbnhtn.exe196⤵PID:4812
-
\??\c:\dvjpd.exec:\dvjpd.exe197⤵PID:3216
-
\??\c:\fflrrlr.exec:\fflrrlr.exe198⤵PID:4296
-
\??\c:\rfxffll.exec:\rfxffll.exe199⤵PID:3520
-
\??\c:\1rxxxff.exec:\1rxxxff.exe200⤵PID:3760
-
\??\c:\nntbhn.exec:\nntbhn.exe201⤵PID:2960
-
\??\c:\htbbhn.exec:\htbbhn.exe202⤵PID:4376
-
\??\c:\dvjjp.exec:\dvjjp.exe203⤵PID:3244
-
\??\c:\5djdp.exec:\5djdp.exe204⤵PID:3620
-
\??\c:\rxlrrxr.exec:\rxlrrxr.exe205⤵PID:4748
-
\??\c:\xxxxxfl.exec:\xxxxxfl.exe206⤵PID:1360
-
\??\c:\tnnhnt.exec:\tnnhnt.exe207⤵PID:764
-
\??\c:\ttbhbn.exec:\ttbhbn.exe208⤵PID:1064
-
\??\c:\1vvvp.exec:\1vvvp.exe209⤵PID:4564
-
\??\c:\vpvvp.exec:\vpvvp.exe210⤵PID:4984
-
\??\c:\rfxrlrr.exec:\rfxrlrr.exe211⤵PID:2344
-
\??\c:\hhhhhh.exec:\hhhhhh.exe212⤵PID:392
-
\??\c:\3nnnht.exec:\3nnnht.exe213⤵PID:1376
-
\??\c:\vpddd.exec:\vpddd.exe214⤵PID:4644
-
\??\c:\rlxlffx.exec:\rlxlffx.exe215⤵PID:5076
-
\??\c:\rflrfff.exec:\rflrfff.exe216⤵PID:3960
-
\??\c:\ntbbtb.exec:\ntbbtb.exe217⤵PID:2392
-
\??\c:\7nttnt.exec:\7nttnt.exe218⤵PID:1224
-
\??\c:\djddj.exec:\djddj.exe219⤵PID:4320
-
\??\c:\lxlrfxx.exec:\lxlrfxx.exe220⤵PID:2168
-
\??\c:\xlflffr.exec:\xlflffr.exe221⤵PID:916
-
\??\c:\hbbbhb.exec:\hbbbhb.exe222⤵PID:4344
-
\??\c:\dpvvv.exec:\dpvvv.exe223⤵PID:4300
-
\??\c:\pjvjj.exec:\pjvjj.exe224⤵PID:4168
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe225⤵PID:2280
-
\??\c:\nntnnn.exec:\nntnnn.exe226⤵PID:1424
-
\??\c:\ppppv.exec:\ppppv.exe227⤵PID:4724
-
\??\c:\fxrllrx.exec:\fxrllrx.exe228⤵PID:4004
-
\??\c:\lfxxxff.exec:\lfxxxff.exe229⤵PID:3440
-
\??\c:\tnbhhh.exec:\tnbhhh.exe230⤵PID:836
-
\??\c:\bttntb.exec:\bttntb.exe231⤵PID:844
-
\??\c:\ppvdd.exec:\ppvdd.exe232⤵PID:3040
-
\??\c:\lfllflr.exec:\lfllflr.exe233⤵PID:1096
-
\??\c:\7xrrlfr.exec:\7xrrlfr.exe234⤵PID:2096
-
\??\c:\9bbttb.exec:\9bbttb.exe235⤵PID:4996
-
\??\c:\7tbthh.exec:\7tbthh.exe236⤵PID:1788
-
\??\c:\vpdjv.exec:\vpdjv.exe237⤵PID:760
-
\??\c:\ddddj.exec:\ddddj.exe238⤵PID:512
-
\??\c:\fflllrr.exec:\fflllrr.exe239⤵PID:3024
-
\??\c:\9lxrrrr.exec:\9lxrrrr.exe240⤵PID:1136
-
\??\c:\hhbbtt.exec:\hhbbtt.exe241⤵PID:2956
-
\??\c:\htnntb.exec:\htnntb.exe242⤵PID:2404