Analysis
-
max time kernel
149s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe
-
Size
59KB
-
MD5
6f9ff796d7cc3caa5ecc3e544fbcb8b7
-
SHA1
6e3a33e525f5c682581d19927575d7d70b714a31
-
SHA256
b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde
-
SHA512
a29f9968191a42cef27a54b76b9a50b8b0f7e4aeb8dd5ee6a8ccd28edad4ac6a4bc54d3627549cf724adce77120df26e98f5b7a5b107d1faf82cb6943ab5c303
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UgS:ymb3NkkiQ3mdBjFIvlqgS
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/4872-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral2/memory/4872-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2864-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3436-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3628-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4428-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4320-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1176-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1176-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1176-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1176-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2784-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2784-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2784-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4112-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2372-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2960-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4876-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4380-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1488-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/976-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4896-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3196-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3976-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1740-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4100-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4268-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5060-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1616-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
1tbtnn.exe5ppvj.exe5flrrll.exehbthht.exevpjdd.exevdjpp.exebbnntb.exebnhbbn.exepjvdj.exehbhhtt.exe7vdjp.exefrrxlrr.exehbbnnb.exejpppd.exefxfrxff.exenhttbb.exetttnnt.exevdvpd.exerlfxffl.exetbbtnh.exevdppd.exe3xffxxr.exehbbnhh.exe1vvpj.exe9rxxrxr.exebntttt.exefxfxllf.exennnnnn.exe5vdvv.exejdjdp.exelfrrlfx.exehbntnh.exenbttnt.exedppjd.exefxlfrrl.exennnnnt.exevpddd.exedppjv.exevppjj.exexlrlffx.exebbbtnn.exebbbhht.exevvjvp.exelrrlfxx.exerrllxxx.exenbbtbh.exerfrlfff.exefrrfxxx.exetnhhnn.exe9bnhhh.exeppppd.exe9ffxrrl.exenbbbbb.exehttnnn.exejpjdv.exe5rxrfff.exenbhnbt.exennnnhh.exejvpjv.exepvpvj.exennntbn.exe7vpjj.exefxxrllr.exennnhtt.exepid process 2864 1tbtnn.exe 3436 5ppvj.exe 3628 5flrrll.exe 1788 hbthht.exe 4152 vpjdd.exe 4428 vdjpp.exe 4320 bbnntb.exe 1176 bnhbbn.exe 2784 pjvdj.exe 4112 hbhhtt.exe 2372 7vdjp.exe 2960 frrxlrr.exe 3152 hbbnnb.exe 4876 jpppd.exe 4380 fxfrxff.exe 1488 nhttbb.exe 976 tttnnt.exe 4896 vdvpd.exe 3952 rlfxffl.exe 3196 tbbtnh.exe 896 vdppd.exe 2104 3xffxxr.exe 3976 hbbnhh.exe 1740 1vvpj.exe 4100 9rxxrxr.exe 4268 bntttt.exe 5060 fxfxllf.exe 3012 nnnnnn.exe 1772 5vdvv.exe 2452 jdjdp.exe 1616 lfrrlfx.exe 1736 hbntnh.exe 3340 nbttnt.exe 4556 dppjd.exe 4904 fxlfrrl.exe 2556 nnnnnt.exe 2900 vpddd.exe 1592 dppjv.exe 3596 vppjj.exe 4372 xlrlffx.exe 2408 bbbtnn.exe 1848 bbbhht.exe 3284 vvjvp.exe 5008 lrrlfxx.exe 1336 rrllxxx.exe 2032 nbbtbh.exe 2388 rfrlfff.exe 1080 frrfxxx.exe 1000 tnhhnn.exe 1324 9bnhhh.exe 1860 ppppd.exe 2908 9ffxrrl.exe 3032 nbbbbb.exe 2296 httnnn.exe 5048 jpjdv.exe 2980 5rxrfff.exe 4908 nbhnbt.exe 4600 nnnnhh.exe 1792 jvpjv.exe 2136 pvpvj.exe 4768 nnntbn.exe 5076 7vpjj.exe 220 fxxrllr.exe 4604 nnnhtt.exe -
Processes:
resource yara_rule behavioral2/memory/4872-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe1tbtnn.exe5ppvj.exe5flrrll.exehbthht.exevpjdd.exevdjpp.exebbnntb.exebnhbbn.exepjvdj.exehbhhtt.exe7vdjp.exefrrxlrr.exehbbnnb.exejpppd.exefxfrxff.exenhttbb.exetttnnt.exevdvpd.exerlfxffl.exetbbtnh.exevdppd.exedescription pid process target process PID 4872 wrote to memory of 2864 4872 b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe 1tbtnn.exe PID 4872 wrote to memory of 2864 4872 b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe 1tbtnn.exe PID 4872 wrote to memory of 2864 4872 b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe 1tbtnn.exe PID 2864 wrote to memory of 3436 2864 1tbtnn.exe 5ppvj.exe PID 2864 wrote to memory of 3436 2864 1tbtnn.exe 5ppvj.exe PID 2864 wrote to memory of 3436 2864 1tbtnn.exe 5ppvj.exe PID 3436 wrote to memory of 3628 3436 5ppvj.exe 5flrrll.exe PID 3436 wrote to memory of 3628 3436 5ppvj.exe 5flrrll.exe PID 3436 wrote to memory of 3628 3436 5ppvj.exe 5flrrll.exe PID 3628 wrote to memory of 1788 3628 5flrrll.exe hbthht.exe PID 3628 wrote to memory of 1788 3628 5flrrll.exe hbthht.exe PID 3628 wrote to memory of 1788 3628 5flrrll.exe hbthht.exe PID 1788 wrote to memory of 4152 1788 hbthht.exe vpjdd.exe PID 1788 wrote to memory of 4152 1788 hbthht.exe vpjdd.exe PID 1788 wrote to memory of 4152 1788 hbthht.exe vpjdd.exe PID 4152 wrote to memory of 4428 4152 vpjdd.exe vdjpp.exe PID 4152 wrote to memory of 4428 4152 vpjdd.exe vdjpp.exe PID 4152 wrote to memory of 4428 4152 vpjdd.exe vdjpp.exe PID 4428 wrote to memory of 4320 4428 vdjpp.exe bbnntb.exe PID 4428 wrote to memory of 4320 4428 vdjpp.exe bbnntb.exe PID 4428 wrote to memory of 4320 4428 vdjpp.exe bbnntb.exe PID 4320 wrote to memory of 1176 4320 bbnntb.exe bnhbbn.exe PID 4320 wrote to memory of 1176 4320 bbnntb.exe bnhbbn.exe PID 4320 wrote to memory of 1176 4320 bbnntb.exe bnhbbn.exe PID 1176 wrote to memory of 2784 1176 bnhbbn.exe pjvdj.exe PID 1176 wrote to memory of 2784 1176 bnhbbn.exe pjvdj.exe PID 1176 wrote to memory of 2784 1176 bnhbbn.exe pjvdj.exe PID 2784 wrote to memory of 4112 2784 pjvdj.exe hbhhtt.exe PID 2784 wrote to memory of 4112 2784 pjvdj.exe hbhhtt.exe PID 2784 wrote to memory of 4112 2784 pjvdj.exe hbhhtt.exe PID 4112 wrote to memory of 2372 4112 hbhhtt.exe 7vdjp.exe PID 4112 wrote to memory of 2372 4112 hbhhtt.exe 7vdjp.exe PID 4112 wrote to memory of 2372 4112 hbhhtt.exe 7vdjp.exe PID 2372 wrote to memory of 2960 2372 7vdjp.exe frrxlrr.exe PID 2372 wrote to memory of 2960 2372 7vdjp.exe frrxlrr.exe PID 2372 wrote to memory of 2960 2372 7vdjp.exe frrxlrr.exe PID 2960 wrote to memory of 3152 2960 frrxlrr.exe hbbnnb.exe PID 2960 wrote to memory of 3152 2960 frrxlrr.exe hbbnnb.exe PID 2960 wrote to memory of 3152 2960 frrxlrr.exe hbbnnb.exe PID 3152 wrote to memory of 4876 3152 hbbnnb.exe jpppd.exe PID 3152 wrote to memory of 4876 3152 hbbnnb.exe jpppd.exe PID 3152 wrote to memory of 4876 3152 hbbnnb.exe jpppd.exe PID 4876 wrote to memory of 4380 4876 jpppd.exe fxfrxff.exe PID 4876 wrote to memory of 4380 4876 jpppd.exe fxfrxff.exe PID 4876 wrote to memory of 4380 4876 jpppd.exe fxfrxff.exe PID 4380 wrote to memory of 1488 4380 fxfrxff.exe nhttbb.exe PID 4380 wrote to memory of 1488 4380 fxfrxff.exe nhttbb.exe PID 4380 wrote to memory of 1488 4380 fxfrxff.exe nhttbb.exe PID 1488 wrote to memory of 976 1488 nhttbb.exe tttnnt.exe PID 1488 wrote to memory of 976 1488 nhttbb.exe tttnnt.exe PID 1488 wrote to memory of 976 1488 nhttbb.exe tttnnt.exe PID 976 wrote to memory of 4896 976 tttnnt.exe vdvpd.exe PID 976 wrote to memory of 4896 976 tttnnt.exe vdvpd.exe PID 976 wrote to memory of 4896 976 tttnnt.exe vdvpd.exe PID 4896 wrote to memory of 3952 4896 vdvpd.exe rlfxffl.exe PID 4896 wrote to memory of 3952 4896 vdvpd.exe rlfxffl.exe PID 4896 wrote to memory of 3952 4896 vdvpd.exe rlfxffl.exe PID 3952 wrote to memory of 3196 3952 rlfxffl.exe tbbtnh.exe PID 3952 wrote to memory of 3196 3952 rlfxffl.exe tbbtnh.exe PID 3952 wrote to memory of 3196 3952 rlfxffl.exe tbbtnh.exe PID 3196 wrote to memory of 896 3196 tbbtnh.exe vdppd.exe PID 3196 wrote to memory of 896 3196 tbbtnh.exe vdppd.exe PID 3196 wrote to memory of 896 3196 tbbtnh.exe vdppd.exe PID 896 wrote to memory of 2104 896 vdppd.exe 3xffxxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe"C:\Users\Admin\AppData\Local\Temp\b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\1tbtnn.exec:\1tbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\5ppvj.exec:\5ppvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\5flrrll.exec:\5flrrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\hbthht.exec:\hbthht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\vpjdd.exec:\vpjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\vdjpp.exec:\vdjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\bbnntb.exec:\bbnntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\bnhbbn.exec:\bnhbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\pjvdj.exec:\pjvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\hbhhtt.exec:\hbhhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\7vdjp.exec:\7vdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\frrxlrr.exec:\frrxlrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\hbbnnb.exec:\hbbnnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\jpppd.exec:\jpppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\fxfrxff.exec:\fxfrxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\nhttbb.exec:\nhttbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\tttnnt.exec:\tttnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\vdvpd.exec:\vdvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\rlfxffl.exec:\rlfxffl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\tbbtnh.exec:\tbbtnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\vdppd.exec:\vdppd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\3xffxxr.exec:\3xffxxr.exe23⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hbbnhh.exec:\hbbnhh.exe24⤵
- Executes dropped EXE
PID:3976 -
\??\c:\1vvpj.exec:\1vvpj.exe25⤵
- Executes dropped EXE
PID:1740 -
\??\c:\9rxxrxr.exec:\9rxxrxr.exe26⤵
- Executes dropped EXE
PID:4100 -
\??\c:\bntttt.exec:\bntttt.exe27⤵
- Executes dropped EXE
PID:4268 -
\??\c:\fxfxllf.exec:\fxfxllf.exe28⤵
- Executes dropped EXE
PID:5060 -
\??\c:\nnnnnn.exec:\nnnnnn.exe29⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5vdvv.exec:\5vdvv.exe30⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jdjdp.exec:\jdjdp.exe31⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lfrrlfx.exec:\lfrrlfx.exe32⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hbntnh.exec:\hbntnh.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nbttnt.exec:\nbttnt.exe34⤵
- Executes dropped EXE
PID:3340 -
\??\c:\dppjd.exec:\dppjd.exe35⤵
- Executes dropped EXE
PID:4556 -
\??\c:\fxlfrrl.exec:\fxlfrrl.exe36⤵
- Executes dropped EXE
PID:4904 -
\??\c:\nnnnnt.exec:\nnnnnt.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vpddd.exec:\vpddd.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dppjv.exec:\dppjv.exe39⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vppjj.exec:\vppjj.exe40⤵
- Executes dropped EXE
PID:3596 -
\??\c:\xlrlffx.exec:\xlrlffx.exe41⤵
- Executes dropped EXE
PID:4372 -
\??\c:\bbbtnn.exec:\bbbtnn.exe42⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bbbhht.exec:\bbbhht.exe43⤵
- Executes dropped EXE
PID:1848 -
\??\c:\vvjvp.exec:\vvjvp.exe44⤵
- Executes dropped EXE
PID:3284 -
\??\c:\lrrlfxx.exec:\lrrlfxx.exe45⤵
- Executes dropped EXE
PID:5008 -
\??\c:\rrllxxx.exec:\rrllxxx.exe46⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nbbtbh.exec:\nbbtbh.exe47⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rfrlfff.exec:\rfrlfff.exe48⤵
- Executes dropped EXE
PID:2388 -
\??\c:\frrfxxx.exec:\frrfxxx.exe49⤵
- Executes dropped EXE
PID:1080 -
\??\c:\tnhhnn.exec:\tnhhnn.exe50⤵
- Executes dropped EXE
PID:1000 -
\??\c:\9bnhhh.exec:\9bnhhh.exe51⤵
- Executes dropped EXE
PID:1324 -
\??\c:\ppppd.exec:\ppppd.exe52⤵
- Executes dropped EXE
PID:1860 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe53⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nbbbbb.exec:\nbbbbb.exe54⤵
- Executes dropped EXE
PID:3032 -
\??\c:\httnnn.exec:\httnnn.exe55⤵
- Executes dropped EXE
PID:2296 -
\??\c:\jpjdv.exec:\jpjdv.exe56⤵
- Executes dropped EXE
PID:5048 -
\??\c:\5rxrfff.exec:\5rxrfff.exe57⤵
- Executes dropped EXE
PID:2980 -
\??\c:\nbhnbt.exec:\nbhnbt.exe58⤵
- Executes dropped EXE
PID:4908 -
\??\c:\nnnnhh.exec:\nnnnhh.exe59⤵
- Executes dropped EXE
PID:4600 -
\??\c:\jvpjv.exec:\jvpjv.exe60⤵
- Executes dropped EXE
PID:1792 -
\??\c:\pvpvj.exec:\pvpvj.exe61⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nnntbn.exec:\nnntbn.exe62⤵
- Executes dropped EXE
PID:4768 -
\??\c:\7vpjj.exec:\7vpjj.exe63⤵
- Executes dropped EXE
PID:5076 -
\??\c:\fxxrllr.exec:\fxxrllr.exe64⤵
- Executes dropped EXE
PID:220 -
\??\c:\nnnhtt.exec:\nnnhtt.exe65⤵
- Executes dropped EXE
PID:4604 -
\??\c:\bhhhbh.exec:\bhhhbh.exe66⤵PID:60
-
\??\c:\vpvvj.exec:\vpvvj.exe67⤵PID:3696
-
\??\c:\lxxxlrr.exec:\lxxxlrr.exe68⤵PID:2336
-
\??\c:\1llrllr.exec:\1llrllr.exe69⤵PID:4960
-
\??\c:\hhthbh.exec:\hhthbh.exe70⤵PID:4044
-
\??\c:\jdpjj.exec:\jdpjj.exe71⤵PID:4284
-
\??\c:\7rxlflr.exec:\7rxlflr.exe72⤵PID:2684
-
\??\c:\rrrxflr.exec:\rrrxflr.exe73⤵PID:5116
-
\??\c:\hhhhbb.exec:\hhhhbb.exe74⤵PID:3576
-
\??\c:\9bhbbh.exec:\9bhbbh.exe75⤵PID:1148
-
\??\c:\pjvpv.exec:\pjvpv.exe76⤵PID:1476
-
\??\c:\pvdvp.exec:\pvdvp.exe77⤵PID:4040
-
\??\c:\rlffxxr.exec:\rlffxxr.exe78⤵PID:2028
-
\??\c:\7nnhbh.exec:\7nnhbh.exe79⤵PID:3864
-
\??\c:\hhtnnn.exec:\hhtnnn.exe80⤵PID:2356
-
\??\c:\jvjpv.exec:\jvjpv.exe81⤵PID:1124
-
\??\c:\rrrlrrr.exec:\rrrlrrr.exe82⤵PID:3336
-
\??\c:\hbhhhh.exec:\hbhhhh.exe83⤵PID:2468
-
\??\c:\ttbttt.exec:\ttbttt.exe84⤵PID:1520
-
\??\c:\pjjjv.exec:\pjjjv.exe85⤵PID:4764
-
\??\c:\7vdjj.exec:\7vdjj.exe86⤵PID:3740
-
\??\c:\lrlxllf.exec:\lrlxllf.exe87⤵PID:2864
-
\??\c:\bnbbnh.exec:\bnbbnh.exe88⤵PID:4808
-
\??\c:\thbtnb.exec:\thbtnb.exe89⤵PID:3516
-
\??\c:\7pdvp.exec:\7pdvp.exe90⤵PID:4196
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe91⤵PID:2848
-
\??\c:\5xllrrf.exec:\5xllrrf.exe92⤵PID:1800
-
\??\c:\nnhnhn.exec:\nnhnhn.exe93⤵PID:1836
-
\??\c:\vjpjj.exec:\vjpjj.exe94⤵PID:1272
-
\??\c:\pppjv.exec:\pppjv.exe95⤵PID:1000
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe96⤵PID:1936
-
\??\c:\9tbhhh.exec:\9tbhhh.exe97⤵PID:1540
-
\??\c:\nhnbhh.exec:\nhnbhh.exe98⤵PID:5080
-
\??\c:\dddvv.exec:\dddvv.exe99⤵PID:4052
-
\??\c:\lllffff.exec:\lllffff.exe100⤵PID:848
-
\??\c:\nthhtt.exec:\nthhtt.exe101⤵PID:4128
-
\??\c:\3hthnn.exec:\3hthnn.exe102⤵PID:4940
-
\??\c:\pjpjd.exec:\pjpjd.exe103⤵PID:4876
-
\??\c:\pdjdp.exec:\pdjdp.exe104⤵PID:4416
-
\??\c:\7fxlxxl.exec:\7fxlxxl.exe105⤵PID:4588
-
\??\c:\7bhbtt.exec:\7bhbtt.exe106⤵PID:3580
-
\??\c:\bnnhbb.exec:\bnnhbb.exe107⤵PID:5076
-
\??\c:\pjdvd.exec:\pjdvd.exe108⤵PID:4536
-
\??\c:\5jvjv.exec:\5jvjv.exe109⤵PID:4424
-
\??\c:\rllfxrr.exec:\rllfxrr.exe110⤵PID:548
-
\??\c:\7hnhbb.exec:\7hnhbb.exe111⤵PID:3500
-
\??\c:\7ddvp.exec:\7ddvp.exe112⤵PID:1968
-
\??\c:\jjdvp.exec:\jjdvp.exe113⤵PID:3788
-
\??\c:\rfrlfff.exec:\rfrlfff.exe114⤵PID:3904
-
\??\c:\ffffxxr.exec:\ffffxxr.exe115⤵PID:720
-
\??\c:\ttnnhh.exec:\ttnnhh.exe116⤵PID:2452
-
\??\c:\dvvdd.exec:\dvvdd.exe117⤵PID:4948
-
\??\c:\vpvvp.exec:\vpvvp.exe118⤵PID:3364
-
\??\c:\rlrfrlr.exec:\rlrfrlr.exe119⤵PID:2100
-
\??\c:\hbntnt.exec:\hbntnt.exe120⤵PID:1448
-
\??\c:\pjjjj.exec:\pjjjj.exe121⤵PID:2556
-
\??\c:\xllfrrl.exec:\xllfrrl.exe122⤵PID:1696
-
\??\c:\vjvpj.exec:\vjvpj.exe123⤵PID:2900
-
\??\c:\7djdv.exec:\7djdv.exe124⤵PID:4368
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe125⤵PID:4344
-
\??\c:\xxfxffl.exec:\xxfxffl.exe126⤵PID:1284
-
\??\c:\thnhbh.exec:\thnhbh.exe127⤵PID:1668
-
\??\c:\jvvjd.exec:\jvvjd.exe128⤵PID:3932
-
\??\c:\flffrrf.exec:\flffrrf.exe129⤵PID:3156
-
\??\c:\nbbtnn.exec:\nbbtnn.exe130⤵PID:2008
-
\??\c:\frfxxff.exec:\frfxxff.exe131⤵PID:1976
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe132⤵PID:1172
-
\??\c:\hhnthh.exec:\hhnthh.exe133⤵PID:1836
-
\??\c:\djjpd.exec:\djjpd.exe134⤵PID:1464
-
\??\c:\1pddj.exec:\1pddj.exe135⤵PID:1324
-
\??\c:\tthbnt.exec:\tthbnt.exe136⤵PID:1936
-
\??\c:\vvdjp.exec:\vvdjp.exe137⤵PID:2784
-
\??\c:\rffxllf.exec:\rffxllf.exe138⤵PID:2660
-
\??\c:\lxxrlrl.exec:\lxxrlrl.exe139⤵PID:5044
-
\??\c:\jjjjp.exec:\jjjjp.exe140⤵PID:2212
-
\??\c:\vdjdv.exec:\vdjdv.exe141⤵PID:3152
-
\??\c:\xrxlrll.exec:\xrxlrll.exe142⤵PID:4692
-
\??\c:\bhnbtb.exec:\bhnbtb.exe143⤵PID:4464
-
\??\c:\tnnhhb.exec:\tnnhhb.exe144⤵PID:4768
-
\??\c:\dvdvd.exec:\dvdvd.exe145⤵PID:4608
-
\??\c:\fxlfxlx.exec:\fxlfxlx.exe146⤵PID:2128
-
\??\c:\nthbtt.exec:\nthbtt.exe147⤵PID:4604
-
\??\c:\dvvvp.exec:\dvvvp.exe148⤵PID:2104
-
\??\c:\dddpd.exec:\dddpd.exe149⤵PID:2336
-
\??\c:\lxffrrl.exec:\lxffrrl.exe150⤵PID:3124
-
\??\c:\lxrlffx.exec:\lxrlffx.exe151⤵PID:4664
-
\??\c:\7tnnhh.exec:\7tnnhh.exe152⤵PID:2684
-
\??\c:\bbhbtn.exec:\bbhbtn.exe153⤵PID:448
-
\??\c:\pddpd.exec:\pddpd.exe154⤵PID:1772
-
\??\c:\rrxflxr.exec:\rrxflxr.exe155⤵PID:2740
-
\??\c:\nnhbnh.exec:\nnhbnh.exe156⤵PID:1476
-
\??\c:\tbhbbb.exec:\tbhbbb.exe157⤵PID:4032
-
\??\c:\vjjjd.exec:\vjjjd.exe158⤵PID:3900
-
\??\c:\rflfxxx.exec:\rflfxxx.exe159⤵PID:3492
-
\??\c:\rflfxxx.exec:\rflfxxx.exe160⤵PID:2496
-
\??\c:\llrrfrl.exec:\llrrfrl.exe161⤵PID:1564
-
\??\c:\3bbbtt.exec:\3bbbtt.exe162⤵PID:4500
-
\??\c:\vpvvj.exec:\vpvvj.exe163⤵PID:3384
-
\??\c:\lfffffr.exec:\lfffffr.exe164⤵PID:4372
-
\??\c:\lfllllr.exec:\lfllllr.exe165⤵PID:3604
-
\??\c:\7hbbnh.exec:\7hbbnh.exe166⤵PID:3436
-
\??\c:\hbhbtb.exec:\hbhbtb.exe167⤵PID:4808
-
\??\c:\jddpv.exec:\jddpv.exe168⤵PID:3516
-
\??\c:\xrxxfxr.exec:\xrxxfxr.exe169⤵PID:892
-
\??\c:\hthbbb.exec:\hthbbb.exe170⤵PID:3928
-
\??\c:\nhthbb.exec:\nhthbb.exe171⤵PID:1560
-
\??\c:\5hhtnh.exec:\5hhtnh.exe172⤵PID:4436
-
\??\c:\vjpjj.exec:\vjpjj.exe173⤵PID:2332
-
\??\c:\vjjvj.exec:\vjjvj.exe174⤵PID:1540
-
\??\c:\9xlfffl.exec:\9xlfffl.exe175⤵PID:3324
-
\??\c:\llxxffr.exec:\llxxffr.exe176⤵PID:3432
-
\??\c:\hbbbtb.exec:\hbbbtb.exe177⤵PID:2660
-
\??\c:\hbhtbb.exec:\hbhtbb.exe178⤵PID:1784
-
\??\c:\5jpjd.exec:\5jpjd.exe179⤵PID:2840
-
\??\c:\frlrxxf.exec:\frlrxxf.exe180⤵PID:1120
-
\??\c:\xxfxlfr.exec:\xxfxlfr.exe181⤵PID:912
-
\??\c:\7nnhnh.exec:\7nnhnh.exe182⤵PID:4928
-
\??\c:\tntttb.exec:\tntttb.exe183⤵PID:3744
-
\??\c:\vpjdv.exec:\vpjdv.exe184⤵PID:2376
-
\??\c:\pdpjj.exec:\pdpjj.exe185⤵PID:1608
-
\??\c:\rffxrxx.exec:\rffxrxx.exe186⤵PID:5040
-
\??\c:\rllxxll.exec:\rllxxll.exe187⤵PID:3472
-
\??\c:\7tbbtt.exec:\7tbbtt.exe188⤵PID:3124
-
\??\c:\pdvjv.exec:\pdvjv.exe189⤵PID:3720
-
\??\c:\ddvpj.exec:\ddvpj.exe190⤵PID:2684
-
\??\c:\lxllfff.exec:\lxllfff.exe191⤵PID:448
-
\??\c:\1ffxllf.exec:\1ffxllf.exe192⤵PID:3144
-
\??\c:\tthhbb.exec:\tthhbb.exe193⤵PID:2028
-
\??\c:\ttnhbb.exec:\ttnhbb.exe194⤵PID:1084
-
\??\c:\ddvvp.exec:\ddvvp.exe195⤵PID:2024
-
\??\c:\vvjvv.exec:\vvjvv.exe196⤵PID:1472
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe197⤵PID:2468
-
\??\c:\hnbtbh.exec:\hnbtbh.exe198⤵PID:2900
-
\??\c:\nhhbtt.exec:\nhhbtt.exe199⤵PID:2992
-
\??\c:\vjvdd.exec:\vjvdd.exe200⤵PID:3796
-
\??\c:\ddppd.exec:\ddppd.exe201⤵PID:4472
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe202⤵PID:2864
-
\??\c:\hbhbhh.exec:\hbhbhh.exe203⤵PID:4208
-
\??\c:\3hbtnb.exec:\3hbtnb.exe204⤵PID:4196
-
\??\c:\3pjdv.exec:\3pjdv.exe205⤵PID:2692
-
\??\c:\rfrxrrx.exec:\rfrxrrx.exe206⤵PID:1000
-
\??\c:\ffxrllf.exec:\ffxrllf.exe207⤵PID:4784
-
\??\c:\bbhbnn.exec:\bbhbnn.exe208⤵PID:1676
-
\??\c:\1pjdp.exec:\1pjdp.exe209⤵PID:2908
-
\??\c:\frrlxxx.exec:\frrlxxx.exe210⤵PID:4052
-
\??\c:\fxffxll.exec:\fxffxll.exe211⤵PID:2812
-
\??\c:\thnbtb.exec:\thnbtb.exe212⤵PID:4956
-
\??\c:\vpjjv.exec:\vpjjv.exe213⤵PID:2036
-
\??\c:\pppjd.exec:\pppjd.exe214⤵PID:4692
-
\??\c:\llflffx.exec:\llflffx.exe215⤵PID:4896
-
\??\c:\bnttbb.exec:\bnttbb.exe216⤵PID:4464
-
\??\c:\pddvj.exec:\pddvj.exe217⤵PID:896
-
\??\c:\1lfxllf.exec:\1lfxllf.exe218⤵PID:3580
-
\??\c:\lxlxrrr.exec:\lxlxrrr.exe219⤵PID:4424
-
\??\c:\tbhbhb.exec:\tbhbhb.exe220⤵PID:1496
-
\??\c:\vpvvp.exec:\vpvvp.exe221⤵PID:3572
-
\??\c:\dvjdp.exec:\dvjdp.exe222⤵PID:316
-
\??\c:\9fxlxlx.exec:\9fxlxlx.exe223⤵PID:3788
-
\??\c:\hbhbtt.exec:\hbhbtt.exe224⤵PID:3720
-
\??\c:\bbbbnh.exec:\bbbbnh.exe225⤵PID:1836
-
\??\c:\dpjdp.exec:\dpjdp.exe226⤵PID:728
-
\??\c:\jdpvp.exec:\jdpvp.exe227⤵PID:3592
-
\??\c:\frrfxrl.exec:\frrfxrl.exe228⤵PID:2824
-
\??\c:\fllfxxl.exec:\fllfxxl.exe229⤵PID:3364
-
\??\c:\thhbtn.exec:\thhbtn.exe230⤵PID:2216
-
\??\c:\jvpjv.exec:\jvpjv.exe231⤵PID:1124
-
\??\c:\pjjdp.exec:\pjjdp.exe232⤵PID:3464
-
\??\c:\1rlllll.exec:\1rlllll.exe233⤵PID:4408
-
\??\c:\fxffxll.exec:\fxffxll.exe234⤵PID:2900
-
\??\c:\htntnn.exec:\htntnn.exe235⤵PID:2992
-
\??\c:\ntbnhb.exec:\ntbnhb.exe236⤵PID:1848
-
\??\c:\3pjdv.exec:\3pjdv.exe237⤵PID:4808
-
\??\c:\dvjjd.exec:\dvjjd.exe238⤵PID:4080
-
\??\c:\9fxxrrl.exec:\9fxxrrl.exe239⤵PID:1800
-
\??\c:\fxrrrrl.exec:\fxrrrrl.exe240⤵PID:1204
-
\??\c:\htbnnh.exec:\htbnnh.exe241⤵PID:900
-
\??\c:\nntttt.exec:\nntttt.exe242⤵PID:4916