Analysis
-
max time kernel
135s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d.exe
-
Size
200KB
-
MD5
e4777e975db8e4eb21c579c3fed15ed9
-
SHA1
e912968867961c142b752b2b95c8cb198c5e4532
-
SHA256
cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d
-
SHA512
1849c030ea9859f2c4495c0b32eac8bdb75ba7e24969670f9ddfdb88462de9f76334f9fe57a1ce8e7146d727c77056d5c7b94f1c8b22f06cc1d28685c7f255c3
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUVv1Tu:n3C9BRIG0asYFm71m8+GdkB9Cv1i
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/3520-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
Processes:
resource yara_rule behavioral2/memory/3520-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1656-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2820-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2856-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1268-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4232-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2824-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3184-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4600-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3708-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1916-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2412-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1652-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4464-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4808-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1356-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3432-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/384-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1848-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1544-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3284-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3688-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4852-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
5llxrrl.exeffxxffl.exehttnhb.exehhbtht.exejdjdj.exeffrlfrl.exenhhbbb.exebbttvv.exepjddv.exefxfxxxf.exefflllrl.exe3bbhhh.exenhnhhh.exepvvpj.exevpppd.exexxllfff.exethtbtt.exebbhbbt.exepvvdj.exexrxxffl.exenbhtnh.exehtbthh.exejvdpj.exefxrxxrr.exehhhhnn.exehhhhbt.exe1djdv.exefxrllll.exelxfxxrr.exebhbtnh.exebtnhbb.exedvdvd.exe5vjdj.exefrrrrrr.exe7lxrrrr.exe3bnhbb.exe5bttbb.exevdddv.exerffflxr.exenhtnnh.exehhnbnh.exejppjj.exevjppj.exelfffflf.exelxxxrrl.exe3bhbht.exetnnhbb.exevvvvv.exelfrrlll.exerrxrfll.exehnhttt.exepvdpd.exevddpj.exeffxrlll.exelfrrrll.exehntttt.exeddppj.exepvjdp.exelxxrffx.exebnhnbb.exe7ttnhh.exevdvdp.exepdddj.exelffxlfl.exepid process 1656 5llxrrl.exe 2820 ffxxffl.exe 4852 httnhb.exe 3688 hhbtht.exe 3576 jdjdj.exe 3284 ffrlfrl.exe 1544 nhhbbb.exe 1848 bbttvv.exe 384 pjddv.exe 2496 fxfxxxf.exe 2856 fflllrl.exe 3432 3bbhhh.exe 1268 nhnhhh.exe 4280 pvvpj.exe 4316 vpppd.exe 1356 xxllfff.exe 2684 thtbtt.exe 4808 bbhbbt.exe 4464 pvvdj.exe 1652 xrxxffl.exe 2412 nbhtnh.exe 1068 htbthh.exe 1916 jvdpj.exe 1960 fxrxxrr.exe 1724 hhhhnn.exe 3132 hhhhbt.exe 4232 1djdv.exe 3708 fxrllll.exe 4600 lxfxxrr.exe 3184 bhbtnh.exe 2824 btnhbb.exe 1988 dvdvd.exe 1564 5vjdj.exe 4340 frrrrrr.exe 644 7lxrrrr.exe 2324 3bnhbb.exe 4396 5bttbb.exe 2264 vdddv.exe 4852 rffflxr.exe 4428 nhtnnh.exe 3576 hhnbnh.exe 1448 jppjj.exe 4524 vjppj.exe 4296 lfffflf.exe 1848 lxxxrrl.exe 2972 3bhbht.exe 3104 tnnhbb.exe 2236 vvvvv.exe 4204 lfrrlll.exe 792 rrxrfll.exe 4920 hnhttt.exe 3120 pvdpd.exe 4748 vddpj.exe 2464 ffxrlll.exe 3848 lfrrrll.exe 2684 hntttt.exe 4808 ddppj.exe 4784 pvjdp.exe 4420 lxxrffx.exe 2932 bnhnbb.exe 3876 7ttnhh.exe 1068 vdvdp.exe 856 pdddj.exe 1960 lffxlfl.exe -
Processes:
resource yara_rule behavioral2/memory/3520-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-24-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d.exe5llxrrl.exeffxxffl.exehttnhb.exehhbtht.exejdjdj.exeffrlfrl.exenhhbbb.exebbttvv.exepjddv.exefxfxxxf.exefflllrl.exe3bbhhh.exenhnhhh.exepvvpj.exevpppd.exexxllfff.exethtbtt.exebbhbbt.exepvvdj.exexrxxffl.exenbhtnh.exedescription pid process target process PID 3520 wrote to memory of 1656 3520 cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d.exe bttbnh.exe PID 3520 wrote to memory of 1656 3520 cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d.exe bttbnh.exe PID 3520 wrote to memory of 1656 3520 cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d.exe bttbnh.exe PID 1656 wrote to memory of 2820 1656 5llxrrl.exe ffxxffl.exe PID 1656 wrote to memory of 2820 1656 5llxrrl.exe ffxxffl.exe PID 1656 wrote to memory of 2820 1656 5llxrrl.exe ffxxffl.exe PID 2820 wrote to memory of 4852 2820 ffxxffl.exe rffflxr.exe PID 2820 wrote to memory of 4852 2820 ffxxffl.exe rffflxr.exe PID 2820 wrote to memory of 4852 2820 ffxxffl.exe rffflxr.exe PID 4852 wrote to memory of 3688 4852 httnhb.exe hhbtht.exe PID 4852 wrote to memory of 3688 4852 httnhb.exe hhbtht.exe PID 4852 wrote to memory of 3688 4852 httnhb.exe hhbtht.exe PID 3688 wrote to memory of 3576 3688 hhbtht.exe jdjdj.exe PID 3688 wrote to memory of 3576 3688 hhbtht.exe jdjdj.exe PID 3688 wrote to memory of 3576 3688 hhbtht.exe jdjdj.exe PID 3576 wrote to memory of 3284 3576 jdjdj.exe ffrlfrl.exe PID 3576 wrote to memory of 3284 3576 jdjdj.exe ffrlfrl.exe PID 3576 wrote to memory of 3284 3576 jdjdj.exe ffrlfrl.exe PID 3284 wrote to memory of 1544 3284 ffrlfrl.exe nhhbbb.exe PID 3284 wrote to memory of 1544 3284 ffrlfrl.exe nhhbbb.exe PID 3284 wrote to memory of 1544 3284 ffrlfrl.exe nhhbbb.exe PID 1544 wrote to memory of 1848 1544 nhhbbb.exe bbttvv.exe PID 1544 wrote to memory of 1848 1544 nhhbbb.exe bbttvv.exe PID 1544 wrote to memory of 1848 1544 nhhbbb.exe bbttvv.exe PID 1848 wrote to memory of 384 1848 bbttvv.exe pjddv.exe PID 1848 wrote to memory of 384 1848 bbttvv.exe pjddv.exe PID 1848 wrote to memory of 384 1848 bbttvv.exe pjddv.exe PID 384 wrote to memory of 2496 384 pjddv.exe fxfxxxf.exe PID 384 wrote to memory of 2496 384 pjddv.exe fxfxxxf.exe PID 384 wrote to memory of 2496 384 pjddv.exe fxfxxxf.exe PID 2496 wrote to memory of 2856 2496 fxfxxxf.exe fflllrl.exe PID 2496 wrote to memory of 2856 2496 fxfxxxf.exe fflllrl.exe PID 2496 wrote to memory of 2856 2496 fxfxxxf.exe fflllrl.exe PID 2856 wrote to memory of 3432 2856 fflllrl.exe 3bbhhh.exe PID 2856 wrote to memory of 3432 2856 fflllrl.exe 3bbhhh.exe PID 2856 wrote to memory of 3432 2856 fflllrl.exe 3bbhhh.exe PID 3432 wrote to memory of 1268 3432 3bbhhh.exe nhnhhh.exe PID 3432 wrote to memory of 1268 3432 3bbhhh.exe nhnhhh.exe PID 3432 wrote to memory of 1268 3432 3bbhhh.exe nhnhhh.exe PID 1268 wrote to memory of 4280 1268 nhnhhh.exe pvvpj.exe PID 1268 wrote to memory of 4280 1268 nhnhhh.exe pvvpj.exe PID 1268 wrote to memory of 4280 1268 nhnhhh.exe pvvpj.exe PID 4280 wrote to memory of 4316 4280 pvvpj.exe vpppd.exe PID 4280 wrote to memory of 4316 4280 pvvpj.exe vpppd.exe PID 4280 wrote to memory of 4316 4280 pvvpj.exe vpppd.exe PID 4316 wrote to memory of 1356 4316 vpppd.exe xxllfff.exe PID 4316 wrote to memory of 1356 4316 vpppd.exe xxllfff.exe PID 4316 wrote to memory of 1356 4316 vpppd.exe xxllfff.exe PID 1356 wrote to memory of 2684 1356 xxllfff.exe hntttt.exe PID 1356 wrote to memory of 2684 1356 xxllfff.exe hntttt.exe PID 1356 wrote to memory of 2684 1356 xxllfff.exe hntttt.exe PID 2684 wrote to memory of 4808 2684 thtbtt.exe bbhbbt.exe PID 2684 wrote to memory of 4808 2684 thtbtt.exe bbhbbt.exe PID 2684 wrote to memory of 4808 2684 thtbtt.exe bbhbbt.exe PID 4808 wrote to memory of 4464 4808 bbhbbt.exe pvvdj.exe PID 4808 wrote to memory of 4464 4808 bbhbbt.exe pvvdj.exe PID 4808 wrote to memory of 4464 4808 bbhbbt.exe pvvdj.exe PID 4464 wrote to memory of 1652 4464 pvvdj.exe xrxxffl.exe PID 4464 wrote to memory of 1652 4464 pvvdj.exe xrxxffl.exe PID 4464 wrote to memory of 1652 4464 pvvdj.exe xrxxffl.exe PID 1652 wrote to memory of 2412 1652 xrxxffl.exe nbhtnh.exe PID 1652 wrote to memory of 2412 1652 xrxxffl.exe nbhtnh.exe PID 1652 wrote to memory of 2412 1652 xrxxffl.exe nbhtnh.exe PID 2412 wrote to memory of 1068 2412 nbhtnh.exe htbthh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d.exe"C:\Users\Admin\AppData\Local\Temp\cde05ef71face0a2bf35d80554a58cfd463bd19c31f5c1013b4ac110dff56a7d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\5llxrrl.exec:\5llxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\ffxxffl.exec:\ffxxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\httnhb.exec:\httnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\hhbtht.exec:\hhbtht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\jdjdj.exec:\jdjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\ffrlfrl.exec:\ffrlfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\nhhbbb.exec:\nhhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\bbttvv.exec:\bbttvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\pjddv.exec:\pjddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\fxfxxxf.exec:\fxfxxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\fflllrl.exec:\fflllrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\3bbhhh.exec:\3bbhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\nhnhhh.exec:\nhnhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\pvvpj.exec:\pvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\vpppd.exec:\vpppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\xxllfff.exec:\xxllfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\thtbtt.exec:\thtbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\bbhbbt.exec:\bbhbbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\pvvdj.exec:\pvvdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\xrxxffl.exec:\xrxxffl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\nbhtnh.exec:\nbhtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\htbthh.exec:\htbthh.exe23⤵
- Executes dropped EXE
PID:1068 -
\??\c:\jvdpj.exec:\jvdpj.exe24⤵
- Executes dropped EXE
PID:1916 -
\??\c:\fxrxxrr.exec:\fxrxxrr.exe25⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hhhhnn.exec:\hhhhnn.exe26⤵
- Executes dropped EXE
PID:1724 -
\??\c:\hhhhbt.exec:\hhhhbt.exe27⤵
- Executes dropped EXE
PID:3132 -
\??\c:\1djdv.exec:\1djdv.exe28⤵
- Executes dropped EXE
PID:4232 -
\??\c:\fxrllll.exec:\fxrllll.exe29⤵
- Executes dropped EXE
PID:3708 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe30⤵
- Executes dropped EXE
PID:4600 -
\??\c:\bhbtnh.exec:\bhbtnh.exe31⤵
- Executes dropped EXE
PID:3184 -
\??\c:\btnhbb.exec:\btnhbb.exe32⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dvdvd.exec:\dvdvd.exe33⤵
- Executes dropped EXE
PID:1988 -
\??\c:\5vjdj.exec:\5vjdj.exe34⤵
- Executes dropped EXE
PID:1564 -
\??\c:\frrrrrr.exec:\frrrrrr.exe35⤵
- Executes dropped EXE
PID:4340 -
\??\c:\7lxrrrr.exec:\7lxrrrr.exe36⤵
- Executes dropped EXE
PID:644 -
\??\c:\3bnhbb.exec:\3bnhbb.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\5bttbb.exec:\5bttbb.exe38⤵
- Executes dropped EXE
PID:4396 -
\??\c:\vdddv.exec:\vdddv.exe39⤵
- Executes dropped EXE
PID:2264 -
\??\c:\rffflxr.exec:\rffflxr.exe40⤵
- Executes dropped EXE
PID:4852 -
\??\c:\nhtnnh.exec:\nhtnnh.exe41⤵
- Executes dropped EXE
PID:4428 -
\??\c:\hhnbnh.exec:\hhnbnh.exe42⤵
- Executes dropped EXE
PID:3576 -
\??\c:\jppjj.exec:\jppjj.exe43⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vjppj.exec:\vjppj.exe44⤵
- Executes dropped EXE
PID:4524 -
\??\c:\lfffflf.exec:\lfffflf.exe45⤵
- Executes dropped EXE
PID:4296 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe46⤵
- Executes dropped EXE
PID:1848 -
\??\c:\3bhbht.exec:\3bhbht.exe47⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tnnhbb.exec:\tnnhbb.exe48⤵
- Executes dropped EXE
PID:3104 -
\??\c:\vvvvv.exec:\vvvvv.exe49⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lfrrlll.exec:\lfrrlll.exe50⤵
- Executes dropped EXE
PID:4204 -
\??\c:\rrxrfll.exec:\rrxrfll.exe51⤵
- Executes dropped EXE
PID:792 -
\??\c:\hnhttt.exec:\hnhttt.exe52⤵
- Executes dropped EXE
PID:4920 -
\??\c:\pvdpd.exec:\pvdpd.exe53⤵
- Executes dropped EXE
PID:3120 -
\??\c:\vddpj.exec:\vddpj.exe54⤵
- Executes dropped EXE
PID:4748 -
\??\c:\ffxrlll.exec:\ffxrlll.exe55⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lfrrrll.exec:\lfrrrll.exe56⤵
- Executes dropped EXE
PID:3848 -
\??\c:\hntttt.exec:\hntttt.exe57⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ddppj.exec:\ddppj.exe58⤵
- Executes dropped EXE
PID:4808 -
\??\c:\pvjdp.exec:\pvjdp.exe59⤵
- Executes dropped EXE
PID:4784 -
\??\c:\lxxrffx.exec:\lxxrffx.exe60⤵
- Executes dropped EXE
PID:4420 -
\??\c:\bnhnbb.exec:\bnhnbb.exe61⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7ttnhh.exec:\7ttnhh.exe62⤵
- Executes dropped EXE
PID:3876 -
\??\c:\vdvdp.exec:\vdvdp.exe63⤵
- Executes dropped EXE
PID:1068 -
\??\c:\pdddj.exec:\pdddj.exe64⤵
- Executes dropped EXE
PID:856 -
\??\c:\lffxlfl.exec:\lffxlfl.exe65⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rllxrlx.exec:\rllxrlx.exe66⤵PID:2028
-
\??\c:\1btnhb.exec:\1btnhb.exe67⤵PID:1808
-
\??\c:\hhnnbb.exec:\hhnnbb.exe68⤵PID:2832
-
\??\c:\djvpj.exec:\djvpj.exe69⤵PID:4092
-
\??\c:\dppvp.exec:\dppvp.exe70⤵PID:2852
-
\??\c:\bnbbtt.exec:\bnbbtt.exe71⤵PID:3588
-
\??\c:\9jdpd.exec:\9jdpd.exe72⤵PID:2400
-
\??\c:\lfxxffl.exec:\lfxxffl.exe73⤵PID:3228
-
\??\c:\frfxlxf.exec:\frfxlxf.exe74⤵PID:2772
-
\??\c:\7hbnhb.exec:\7hbnhb.exe75⤵PID:2396
-
\??\c:\nbbtnn.exec:\nbbtnn.exe76⤵PID:764
-
\??\c:\jdvpp.exec:\jdvpp.exe77⤵PID:1324
-
\??\c:\5vvpd.exec:\5vvpd.exe78⤵PID:3796
-
\??\c:\rffxrrl.exec:\rffxrrl.exe79⤵PID:4068
-
\??\c:\frrllfx.exec:\frrllfx.exe80⤵PID:4396
-
\??\c:\hnhhtt.exec:\hnhhtt.exe81⤵PID:4272
-
\??\c:\hbntnt.exec:\hbntnt.exe82⤵PID:5052
-
\??\c:\ppvjv.exec:\ppvjv.exe83⤵PID:940
-
\??\c:\pvdvd.exec:\pvdvd.exe84⤵PID:612
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe85⤵PID:3620
-
\??\c:\fffxrlf.exec:\fffxrlf.exe86⤵PID:4832
-
\??\c:\1pjdp.exec:\1pjdp.exe87⤵PID:4368
-
\??\c:\pjvpj.exec:\pjvpj.exe88⤵PID:2276
-
\??\c:\rrlfrff.exec:\rrlfrff.exe89⤵PID:4216
-
\??\c:\9xfxrll.exec:\9xfxrll.exe90⤵PID:3536
-
\??\c:\bhnhbb.exec:\bhnhbb.exe91⤵PID:3104
-
\??\c:\htnhnn.exec:\htnhnn.exe92⤵PID:2236
-
\??\c:\pdvpd.exec:\pdvpd.exe93⤵PID:1016
-
\??\c:\jdjvp.exec:\jdjvp.exe94⤵PID:2804
-
\??\c:\lfxlxfx.exec:\lfxlxfx.exe95⤵PID:3508
-
\??\c:\5ffxrrl.exec:\5ffxrrl.exe96⤵PID:3732
-
\??\c:\hbbttt.exec:\hbbttt.exe97⤵PID:948
-
\??\c:\bttnhh.exec:\bttnhh.exe98⤵PID:3924
-
\??\c:\pdpjd.exec:\pdpjd.exe99⤵PID:3848
-
\??\c:\pvppd.exec:\pvppd.exe100⤵PID:2684
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe101⤵PID:4488
-
\??\c:\xlxrlrl.exec:\xlxrlrl.exe102⤵PID:1652
-
\??\c:\5nnhhb.exec:\5nnhhb.exe103⤵PID:2004
-
\??\c:\9tbttn.exec:\9tbttn.exe104⤵PID:400
-
\??\c:\dvjdd.exec:\dvjdd.exe105⤵PID:1964
-
\??\c:\djjvj.exec:\djjvj.exe106⤵PID:1828
-
\??\c:\ffllrrx.exec:\ffllrrx.exe107⤵PID:1068
-
\??\c:\thtnnh.exec:\thtnnh.exe108⤵PID:4996
-
\??\c:\thnhbb.exec:\thnhbb.exe109⤵PID:4032
-
\??\c:\ppppj.exec:\ppppj.exe110⤵PID:3328
-
\??\c:\dppjd.exec:\dppjd.exe111⤵PID:4728
-
\??\c:\llfxxrr.exec:\llfxxrr.exe112⤵PID:2944
-
\??\c:\frrlfxx.exec:\frrlfxx.exe113⤵PID:4516
-
\??\c:\hnnhbb.exec:\hnnhbb.exe114⤵PID:5084
-
\??\c:\btbbtb.exec:\btbbtb.exe115⤵PID:2840
-
\??\c:\jpjdv.exec:\jpjdv.exe116⤵PID:4540
-
\??\c:\ffrfrrr.exec:\ffrfrrr.exe117⤵PID:452
-
\??\c:\hbttnt.exec:\hbttnt.exe118⤵PID:4424
-
\??\c:\bttbnh.exec:\bttbnh.exe119⤵PID:1656
-
\??\c:\7jpjv.exec:\7jpjv.exe120⤵PID:4460
-
\??\c:\flrfrlx.exec:\flrfrlx.exe121⤵PID:3816
-
\??\c:\htntnh.exec:\htntnh.exe122⤵PID:4984
-
\??\c:\nbthth.exec:\nbthth.exe123⤵PID:4408
-
\??\c:\ppjvp.exec:\ppjvp.exe124⤵PID:4852
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe125⤵PID:2288
-
\??\c:\hnnbnh.exec:\hnnbnh.exe126⤵PID:3100
-
\??\c:\pjvpd.exec:\pjvpd.exe127⤵PID:940
-
\??\c:\1pdvj.exec:\1pdvj.exe128⤵PID:4660
-
\??\c:\xrxlrlf.exec:\xrxlrlf.exe129⤵PID:4524
-
\??\c:\hbnbhb.exec:\hbnbhb.exe130⤵PID:1900
-
\??\c:\bnhbtn.exec:\bnhbtn.exe131⤵PID:4368
-
\??\c:\9vvpd.exec:\9vvpd.exe132⤵PID:2972
-
\??\c:\ffxrffx.exec:\ffxrffx.exe133⤵PID:1232
-
\??\c:\ffllffr.exec:\ffllffr.exe134⤵PID:1048
-
\??\c:\pjdvp.exec:\pjdvp.exe135⤵PID:1268
-
\??\c:\nthnhb.exec:\nthnhb.exe136⤵PID:4484
-
\??\c:\rfllfff.exec:\rfllfff.exe137⤵PID:4280
-
\??\c:\hthhnh.exec:\hthhnh.exe138⤵PID:4836
-
\??\c:\dpddp.exec:\dpddp.exe139⤵PID:2216
-
\??\c:\jppdp.exec:\jppdp.exe140⤵PID:928
-
\??\c:\llrrrrx.exec:\llrrrrx.exe141⤵PID:2748
-
\??\c:\llrlfff.exec:\llrlfff.exe142⤵PID:2676
-
\??\c:\tbhbtn.exec:\tbhbtn.exe143⤵PID:4784
-
\??\c:\pjvvd.exec:\pjvvd.exe144⤵PID:2004
-
\??\c:\jpjvp.exec:\jpjvp.exe145⤵PID:4520
-
\??\c:\5xxxrxr.exec:\5xxxrxr.exe146⤵PID:3096
-
\??\c:\9fllrrr.exec:\9fllrrr.exe147⤵PID:4996
-
\??\c:\bhnntn.exec:\bhnntn.exe148⤵PID:4032
-
\??\c:\thbnhb.exec:\thbnhb.exe149⤵PID:4804
-
\??\c:\jjdvp.exec:\jjdvp.exe150⤵PID:4728
-
\??\c:\dppjv.exec:\dppjv.exe151⤵PID:4468
-
\??\c:\fxfllxl.exec:\fxfllxl.exe152⤵PID:2600
-
\??\c:\9hthnh.exec:\9hthnh.exe153⤵PID:5084
-
\??\c:\tbhhbh.exec:\tbhhbh.exe154⤵PID:1940
-
\??\c:\1pdvd.exec:\1pdvd.exe155⤵PID:1564
-
\??\c:\bhhtnh.exec:\bhhtnh.exe156⤵PID:964
-
\??\c:\1vvjd.exec:\1vvjd.exe157⤵PID:1656
-
\??\c:\xrlxxfr.exec:\xrlxxfr.exe158⤵PID:868
-
\??\c:\3hnhnn.exec:\3hnhnn.exe159⤵PID:3816
-
\??\c:\nhtbnt.exec:\nhtbnt.exe160⤵PID:4984
-
\??\c:\vjvpd.exec:\vjvpd.exe161⤵PID:1344
-
\??\c:\xrlxllf.exec:\xrlxllf.exe162⤵PID:4272
-
\??\c:\1tbhbn.exec:\1tbhbn.exe163⤵PID:2288
-
\??\c:\nhbttb.exec:\nhbttb.exe164⤵PID:768
-
\??\c:\7llfllx.exec:\7llfllx.exe165⤵PID:940
-
\??\c:\llrxfll.exec:\llrxfll.exe166⤵PID:1544
-
\??\c:\dvjjv.exec:\dvjjv.exe167⤵PID:2268
-
\??\c:\vvdjd.exec:\vvdjd.exe168⤵PID:1576
-
\??\c:\fxxrrlr.exec:\fxxrrlr.exe169⤵PID:408
-
\??\c:\bntnbb.exec:\bntnbb.exe170⤵PID:2972
-
\??\c:\rlrfxrr.exec:\rlrfxrr.exe171⤵PID:4992
-
\??\c:\hntbhn.exec:\hntbhn.exe172⤵PID:2236
-
\??\c:\hnnnhb.exec:\hnnnhb.exe173⤵PID:2896
-
\??\c:\pdpdj.exec:\pdpdj.exe174⤵PID:392
-
\??\c:\9pdpd.exec:\9pdpd.exe175⤵PID:3508
-
\??\c:\rffrflf.exec:\rffrflf.exe176⤵PID:4080
-
\??\c:\ttthbb.exec:\ttthbb.exe177⤵PID:2684
-
\??\c:\bbhttt.exec:\bbhttt.exe178⤵PID:2540
-
\??\c:\djjvj.exec:\djjvj.exe179⤵PID:2640
-
\??\c:\pddvp.exec:\pddvp.exe180⤵PID:2004
-
\??\c:\xxxrlrl.exec:\xxxrlrl.exe181⤵PID:4520
-
\??\c:\fxxrllf.exec:\fxxrllf.exe182⤵PID:1332
-
\??\c:\thtnbt.exec:\thtnbt.exe183⤵PID:4996
-
\??\c:\htbtnn.exec:\htbtnn.exe184⤵PID:4380
-
\??\c:\7dvpj.exec:\7dvpj.exe185⤵PID:4804
-
\??\c:\3vpjv.exec:\3vpjv.exe186⤵PID:3588
-
\??\c:\1rxlxxr.exec:\1rxlxxr.exe187⤵PID:4468
-
\??\c:\3lrfrlf.exec:\3lrfrlf.exe188⤵PID:4320
-
\??\c:\7tbbhh.exec:\7tbbhh.exe189⤵PID:2772
-
\??\c:\ttnbtn.exec:\ttnbtn.exe190⤵PID:1940
-
\??\c:\5dvpd.exec:\5dvpd.exe191⤵PID:1564
-
\??\c:\3pjdp.exec:\3pjdp.exe192⤵PID:3712
-
\??\c:\xrxxlrl.exec:\xrxxlrl.exe193⤵PID:2712
-
\??\c:\5fxxrll.exec:\5fxxrll.exe194⤵PID:4068
-
\??\c:\3bhttb.exec:\3bhttb.exe195⤵PID:4396
-
\??\c:\5dpdv.exec:\5dpdv.exe196⤵PID:1664
-
\??\c:\vpjdp.exec:\vpjdp.exe197⤵PID:4852
-
\??\c:\lrllxrf.exec:\lrllxrf.exe198⤵PID:4896
-
\??\c:\hthhhh.exec:\hthhhh.exe199⤵PID:2460
-
\??\c:\1btnbb.exec:\1btnbb.exe200⤵PID:2576
-
\??\c:\vjvjv.exec:\vjvjv.exe201⤵PID:3316
-
\??\c:\3vvjd.exec:\3vvjd.exe202⤵PID:1900
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe203⤵PID:3752
-
\??\c:\7hhnnn.exec:\7hhnnn.exe204⤵PID:2220
-
\??\c:\7dvjv.exec:\7dvjv.exe205⤵PID:1504
-
\??\c:\vpjdv.exec:\vpjdv.exe206⤵PID:1048
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe207⤵PID:1016
-
\??\c:\9lffrxr.exec:\9lffrxr.exe208⤵PID:4768
-
\??\c:\5hhtnh.exec:\5hhtnh.exe209⤵PID:4864
-
\??\c:\hbthnn.exec:\hbthnn.exe210⤵PID:948
-
\??\c:\5jjdp.exec:\5jjdp.exe211⤵PID:1552
-
\??\c:\rrlfrrl.exec:\rrlfrrl.exe212⤵PID:2976
-
\??\c:\bnnbnh.exec:\bnnbnh.exe213⤵PID:4440
-
\??\c:\hhbbnn.exec:\hhbbnn.exe214⤵PID:2932
-
\??\c:\dppdd.exec:\dppdd.exe215⤵PID:1068
-
\??\c:\xrfxrlf.exec:\xrfxrlf.exe216⤵PID:2228
-
\??\c:\rlxxrlf.exec:\rlxxrlf.exe217⤵PID:1892
-
\??\c:\1thbnb.exec:\1thbnb.exe218⤵PID:1808
-
\??\c:\bbbbnh.exec:\bbbbnh.exe219⤵PID:4536
-
\??\c:\1dvpj.exec:\1dvpj.exe220⤵PID:4976
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe221⤵PID:4804
-
\??\c:\7ttnbt.exec:\7ttnbt.exe222⤵PID:3588
-
\??\c:\hnthbt.exec:\hnthbt.exe223⤵PID:2840
-
\??\c:\hbthbb.exec:\hbthbb.exe224⤵PID:1672
-
\??\c:\pddvj.exec:\pddvj.exe225⤵PID:2772
-
\??\c:\5llfrrf.exec:\5llfrrf.exe226⤵PID:644
-
\??\c:\lrxxlfl.exec:\lrxxlfl.exe227⤵PID:2820
-
\??\c:\nbbnht.exec:\nbbnht.exe228⤵PID:3592
-
\??\c:\btnbnh.exec:\btnbnh.exe229⤵PID:2680
-
\??\c:\djddv.exec:\djddv.exe230⤵PID:1936
-
\??\c:\dpppd.exec:\dpppd.exe231⤵PID:4396
-
\??\c:\lxfxxrx.exec:\lxfxxrx.exe232⤵PID:4272
-
\??\c:\btntbh.exec:\btntbh.exe233⤵PID:2488
-
\??\c:\3ttnhh.exec:\3ttnhh.exe234⤵PID:3776
-
\??\c:\vvvdj.exec:\vvvdj.exe235⤵PID:940
-
\??\c:\pjdvv.exec:\pjdvv.exe236⤵PID:2576
-
\??\c:\jvjdj.exec:\jvjdj.exe237⤵PID:3316
-
\??\c:\hbtnbt.exec:\hbtnbt.exe238⤵PID:1900
-
\??\c:\httnbt.exec:\httnbt.exe239⤵PID:3752
-
\??\c:\dvpjv.exec:\dvpjv.exe240⤵PID:1328
-
\??\c:\7jdvj.exec:\7jdvj.exe241⤵PID:1492
-
\??\c:\frfrflf.exec:\frfrflf.exe242⤵PID:4748