Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 10:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3469cc45353e56ce90c4d3ed02788998b05e9edf42ee8c5541755bb8598970df.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3469cc45353e56ce90c4d3ed02788998b05e9edf42ee8c5541755bb8598970df.exe
-
Size
64KB
-
MD5
0651852c0373060e36078b06dcf80a30
-
SHA1
c375e8b0cadffc7d58baf8bb7e08763467d51bf5
-
SHA256
3469cc45353e56ce90c4d3ed02788998b05e9edf42ee8c5541755bb8598970df
-
SHA512
de803a3a9c8084c77b6f06f97d04db7e4304c60dae22299ac33afefbd7981b29d6c177569a7b4be1fd8a05e8e9c03fb4cb584541c3a8e841e52a000e7d7c2972
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJm/wn:ymb3NkkiQ3mdBjFILmM
Malware Config
Signatures
-
Detect Blackmoon payload 32 IoCs
Processes:
resource yara_rule behavioral2/memory/5080-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-16-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-44-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-65-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-79-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-72-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-58-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2840-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-52-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-37-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3nhbtt.exelfxfrfr.exentbbth.exehbtnbn.exevvdjj.exe7pdpv.exe9llxffr.exe5frfrlx.exe7tnbhb.exenbnbtn.exepvpdj.exe7vdpj.exelllxfxl.exelrrrfxl.exe5tbtth.exedddvj.exedjjdd.exerrrfrlf.exe5xrlrlx.exebtnbtn.exebbthth.exe9ppvj.exe1frfxrr.exeflfxlfx.exe1bhttn.exe5btnbt.exedpdpd.exejdpdj.exenhhtbt.exe3dvvp.exefrlxfxl.exe3nhbtn.exejpdvv.exe7jvjj.exelxrfxxl.exe7frfrlr.exentthtn.exejjdvd.exexxfrlfr.exenttnhb.exe1btnnh.exe9vdvp.exepjjdp.exe9llflfr.exexxfffrr.exebbnhtn.exedjvpv.exerfrfxrf.exehhbbbh.exepjvjj.exedpvpd.exelrrlffx.exefrrlxrl.exe7nhttb.exehttnbt.exepvjvj.exerxxxxlr.exexrfrxll.exe7bbthb.exejvjvj.exejvjvj.exedvjdd.exe9rfxrrf.exe3nntth.exepid process 2260 3nhbtt.exe 1828 lfxfrfr.exe 208 ntbbth.exe 4004 hbtnbn.exe 4972 vvdjj.exe 4380 7pdpv.exe 2840 9llxffr.exe 4612 5frfrlx.exe 3316 7tnbhb.exe 4272 nbnbtn.exe 2152 pvpdj.exe 2792 7vdpj.exe 3604 lllxfxl.exe 1688 lrrrfxl.exe 1708 5tbtth.exe 1816 dddvj.exe 624 djjdd.exe 3592 rrrfrlf.exe 2028 5xrlrlx.exe 4704 btnbtn.exe 3904 bbthth.exe 4624 9ppvj.exe 3768 1frfxrr.exe 4588 flfxlfx.exe 4264 1bhttn.exe 4268 5btnbt.exe 1012 dpdpd.exe 4628 jdpdj.exe 4528 nhhtbt.exe 2484 3dvvp.exe 3484 frlxfxl.exe 640 3nhbtn.exe 4024 jpdvv.exe 3348 7jvjj.exe 3824 lxrfxxl.exe 3296 7frfrlr.exe 788 ntthtn.exe 2924 jjdvd.exe 1616 xxfrlfr.exe 1460 nttnhb.exe 4416 1btnnh.exe 5080 9vdvp.exe 4436 pjjdp.exe 2432 9llflfr.exe 224 xxfffrr.exe 212 bbnhtn.exe 3044 djvpv.exe 5100 rfrfxrf.exe 3184 hhbbbh.exe 3316 pjvjj.exe 1592 dpvpd.exe 1148 lrrlffx.exe 3724 frrlxrl.exe 384 7nhttb.exe 2340 httnbt.exe 1472 pvjvj.exe 1848 rxxxxlr.exe 1224 xrfrxll.exe 624 7bbthb.exe 932 jvjvj.exe 5084 jvjvj.exe 3664 dvjdd.exe 1516 9rfxrrf.exe 4172 3nntth.exe -
Processes:
resource yara_rule behavioral2/memory/5080-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3469cc45353e56ce90c4d3ed02788998b05e9edf42ee8c5541755bb8598970df.exe3nhbtt.exelfxfrfr.exentbbth.exehbtnbn.exevvdjj.exe7pdpv.exe9llxffr.exe5frfrlx.exe7tnbhb.exenbnbtn.exepvpdj.exe7vdpj.exelllxfxl.exelrrrfxl.exe5tbtth.exedddvj.exedjjdd.exerrrfrlf.exe5xrlrlx.exebtnbtn.exebbthth.exedescription pid process target process PID 5080 wrote to memory of 2260 5080 3469cc45353e56ce90c4d3ed02788998b05e9edf42ee8c5541755bb8598970df.exe 3nhbtt.exe PID 5080 wrote to memory of 2260 5080 3469cc45353e56ce90c4d3ed02788998b05e9edf42ee8c5541755bb8598970df.exe 3nhbtt.exe PID 5080 wrote to memory of 2260 5080 3469cc45353e56ce90c4d3ed02788998b05e9edf42ee8c5541755bb8598970df.exe 3nhbtt.exe PID 2260 wrote to memory of 1828 2260 3nhbtt.exe lfxfrfr.exe PID 2260 wrote to memory of 1828 2260 3nhbtt.exe lfxfrfr.exe PID 2260 wrote to memory of 1828 2260 3nhbtt.exe lfxfrfr.exe PID 1828 wrote to memory of 208 1828 lfxfrfr.exe ntbbth.exe PID 1828 wrote to memory of 208 1828 lfxfrfr.exe ntbbth.exe PID 1828 wrote to memory of 208 1828 lfxfrfr.exe ntbbth.exe PID 208 wrote to memory of 4004 208 ntbbth.exe hbtnbn.exe PID 208 wrote to memory of 4004 208 ntbbth.exe hbtnbn.exe PID 208 wrote to memory of 4004 208 ntbbth.exe hbtnbn.exe PID 4004 wrote to memory of 4972 4004 hbtnbn.exe vvdjj.exe PID 4004 wrote to memory of 4972 4004 hbtnbn.exe vvdjj.exe PID 4004 wrote to memory of 4972 4004 hbtnbn.exe vvdjj.exe PID 4972 wrote to memory of 4380 4972 vvdjj.exe 7pdpv.exe PID 4972 wrote to memory of 4380 4972 vvdjj.exe 7pdpv.exe PID 4972 wrote to memory of 4380 4972 vvdjj.exe 7pdpv.exe PID 4380 wrote to memory of 2840 4380 7pdpv.exe 9llxffr.exe PID 4380 wrote to memory of 2840 4380 7pdpv.exe 9llxffr.exe PID 4380 wrote to memory of 2840 4380 7pdpv.exe 9llxffr.exe PID 2840 wrote to memory of 4612 2840 9llxffr.exe 5frfrlx.exe PID 2840 wrote to memory of 4612 2840 9llxffr.exe 5frfrlx.exe PID 2840 wrote to memory of 4612 2840 9llxffr.exe 5frfrlx.exe PID 4612 wrote to memory of 3316 4612 5frfrlx.exe 7tnbhb.exe PID 4612 wrote to memory of 3316 4612 5frfrlx.exe 7tnbhb.exe PID 4612 wrote to memory of 3316 4612 5frfrlx.exe 7tnbhb.exe PID 3316 wrote to memory of 4272 3316 7tnbhb.exe nbnbtn.exe PID 3316 wrote to memory of 4272 3316 7tnbhb.exe nbnbtn.exe PID 3316 wrote to memory of 4272 3316 7tnbhb.exe nbnbtn.exe PID 4272 wrote to memory of 2152 4272 nbnbtn.exe pvpdj.exe PID 4272 wrote to memory of 2152 4272 nbnbtn.exe pvpdj.exe PID 4272 wrote to memory of 2152 4272 nbnbtn.exe pvpdj.exe PID 2152 wrote to memory of 2792 2152 pvpdj.exe 7vdpj.exe PID 2152 wrote to memory of 2792 2152 pvpdj.exe 7vdpj.exe PID 2152 wrote to memory of 2792 2152 pvpdj.exe 7vdpj.exe PID 2792 wrote to memory of 3604 2792 7vdpj.exe lllxfxl.exe PID 2792 wrote to memory of 3604 2792 7vdpj.exe lllxfxl.exe PID 2792 wrote to memory of 3604 2792 7vdpj.exe lllxfxl.exe PID 3604 wrote to memory of 1688 3604 lllxfxl.exe lrrrfxl.exe PID 3604 wrote to memory of 1688 3604 lllxfxl.exe lrrrfxl.exe PID 3604 wrote to memory of 1688 3604 lllxfxl.exe lrrrfxl.exe PID 1688 wrote to memory of 1708 1688 lrrrfxl.exe 5tbtth.exe PID 1688 wrote to memory of 1708 1688 lrrrfxl.exe 5tbtth.exe PID 1688 wrote to memory of 1708 1688 lrrrfxl.exe 5tbtth.exe PID 1708 wrote to memory of 1816 1708 5tbtth.exe dddvj.exe PID 1708 wrote to memory of 1816 1708 5tbtth.exe dddvj.exe PID 1708 wrote to memory of 1816 1708 5tbtth.exe dddvj.exe PID 1816 wrote to memory of 624 1816 dddvj.exe djjdd.exe PID 1816 wrote to memory of 624 1816 dddvj.exe djjdd.exe PID 1816 wrote to memory of 624 1816 dddvj.exe djjdd.exe PID 624 wrote to memory of 3592 624 djjdd.exe rrrfrlf.exe PID 624 wrote to memory of 3592 624 djjdd.exe rrrfrlf.exe PID 624 wrote to memory of 3592 624 djjdd.exe rrrfrlf.exe PID 3592 wrote to memory of 2028 3592 rrrfrlf.exe 5xrlrlx.exe PID 3592 wrote to memory of 2028 3592 rrrfrlf.exe 5xrlrlx.exe PID 3592 wrote to memory of 2028 3592 rrrfrlf.exe 5xrlrlx.exe PID 2028 wrote to memory of 4704 2028 5xrlrlx.exe btnbtn.exe PID 2028 wrote to memory of 4704 2028 5xrlrlx.exe btnbtn.exe PID 2028 wrote to memory of 4704 2028 5xrlrlx.exe btnbtn.exe PID 4704 wrote to memory of 3904 4704 btnbtn.exe bbthth.exe PID 4704 wrote to memory of 3904 4704 btnbtn.exe bbthth.exe PID 4704 wrote to memory of 3904 4704 btnbtn.exe bbthth.exe PID 3904 wrote to memory of 4624 3904 bbthth.exe 9ppvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3469cc45353e56ce90c4d3ed02788998b05e9edf42ee8c5541755bb8598970df.exe"C:\Users\Admin\AppData\Local\Temp\3469cc45353e56ce90c4d3ed02788998b05e9edf42ee8c5541755bb8598970df.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\3nhbtt.exec:\3nhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\ntbbth.exec:\ntbbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\hbtnbn.exec:\hbtnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\vvdjj.exec:\vvdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\7pdpv.exec:\7pdpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\9llxffr.exec:\9llxffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\5frfrlx.exec:\5frfrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\7tnbhb.exec:\7tnbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\nbnbtn.exec:\nbnbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\pvpdj.exec:\pvpdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\7vdpj.exec:\7vdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lllxfxl.exec:\lllxfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\lrrrfxl.exec:\lrrrfxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\5tbtth.exec:\5tbtth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\dddvj.exec:\dddvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\djjdd.exec:\djjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\rrrfrlf.exec:\rrrfrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\5xrlrlx.exec:\5xrlrlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\btnbtn.exec:\btnbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\bbthth.exec:\bbthth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\9ppvj.exec:\9ppvj.exe23⤵
- Executes dropped EXE
PID:4624 -
\??\c:\1frfxrr.exec:\1frfxrr.exe24⤵
- Executes dropped EXE
PID:3768 -
\??\c:\flfxlfx.exec:\flfxlfx.exe25⤵
- Executes dropped EXE
PID:4588 -
\??\c:\1bhttn.exec:\1bhttn.exe26⤵
- Executes dropped EXE
PID:4264 -
\??\c:\5btnbt.exec:\5btnbt.exe27⤵
- Executes dropped EXE
PID:4268 -
\??\c:\dpdpd.exec:\dpdpd.exe28⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jdpdj.exec:\jdpdj.exe29⤵
- Executes dropped EXE
PID:4628 -
\??\c:\nhhtbt.exec:\nhhtbt.exe30⤵
- Executes dropped EXE
PID:4528 -
\??\c:\3dvvp.exec:\3dvvp.exe31⤵
- Executes dropped EXE
PID:2484 -
\??\c:\frlxfxl.exec:\frlxfxl.exe32⤵
- Executes dropped EXE
PID:3484 -
\??\c:\3nhbtn.exec:\3nhbtn.exe33⤵
- Executes dropped EXE
PID:640 -
\??\c:\jpdvv.exec:\jpdvv.exe34⤵
- Executes dropped EXE
PID:4024 -
\??\c:\7jvjj.exec:\7jvjj.exe35⤵
- Executes dropped EXE
PID:3348 -
\??\c:\lxrfxxl.exec:\lxrfxxl.exe36⤵
- Executes dropped EXE
PID:3824 -
\??\c:\7frfrlr.exec:\7frfrlr.exe37⤵
- Executes dropped EXE
PID:3296 -
\??\c:\ntthtn.exec:\ntthtn.exe38⤵
- Executes dropped EXE
PID:788 -
\??\c:\jjdvd.exec:\jjdvd.exe39⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xxfrlfr.exec:\xxfrlfr.exe40⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nttnhb.exec:\nttnhb.exe41⤵
- Executes dropped EXE
PID:1460 -
\??\c:\1btnnh.exec:\1btnnh.exe42⤵
- Executes dropped EXE
PID:4416 -
\??\c:\9vdvp.exec:\9vdvp.exe43⤵
- Executes dropped EXE
PID:5080 -
\??\c:\pjjdp.exec:\pjjdp.exe44⤵
- Executes dropped EXE
PID:4436 -
\??\c:\9llflfr.exec:\9llflfr.exe45⤵
- Executes dropped EXE
PID:2432 -
\??\c:\xxfffrr.exec:\xxfffrr.exe46⤵
- Executes dropped EXE
PID:224 -
\??\c:\bbnhtn.exec:\bbnhtn.exe47⤵
- Executes dropped EXE
PID:212 -
\??\c:\djvpv.exec:\djvpv.exe48⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rfrfxrf.exec:\rfrfxrf.exe49⤵
- Executes dropped EXE
PID:5100 -
\??\c:\hhbbbh.exec:\hhbbbh.exe50⤵
- Executes dropped EXE
PID:3184 -
\??\c:\pjvjj.exec:\pjvjj.exe51⤵
- Executes dropped EXE
PID:3316 -
\??\c:\dpvpd.exec:\dpvpd.exe52⤵
- Executes dropped EXE
PID:1592 -
\??\c:\lrrlffx.exec:\lrrlffx.exe53⤵
- Executes dropped EXE
PID:1148 -
\??\c:\frrlxrl.exec:\frrlxrl.exe54⤵
- Executes dropped EXE
PID:3724 -
\??\c:\7nhttb.exec:\7nhttb.exe55⤵
- Executes dropped EXE
PID:384 -
\??\c:\httnbt.exec:\httnbt.exe56⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pvjvj.exec:\pvjvj.exe57⤵
- Executes dropped EXE
PID:1472 -
\??\c:\rxxxxlr.exec:\rxxxxlr.exe58⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xrfrxll.exec:\xrfrxll.exe59⤵
- Executes dropped EXE
PID:1224 -
\??\c:\7bbthb.exec:\7bbthb.exe60⤵
- Executes dropped EXE
PID:624 -
\??\c:\jvjvj.exec:\jvjvj.exe61⤵
- Executes dropped EXE
PID:932 -
\??\c:\jvjvj.exec:\jvjvj.exe62⤵
- Executes dropped EXE
PID:5084 -
\??\c:\dvjdd.exec:\dvjdd.exe63⤵
- Executes dropped EXE
PID:3664 -
\??\c:\9rfxrrf.exec:\9rfxrrf.exe64⤵
- Executes dropped EXE
PID:1516 -
\??\c:\3nntth.exec:\3nntth.exe65⤵
- Executes dropped EXE
PID:4172 -
\??\c:\tttnbt.exec:\tttnbt.exe66⤵PID:2616
-
\??\c:\jvjdj.exec:\jvjdj.exe67⤵PID:1784
-
\??\c:\1rlxfrl.exec:\1rlxfrl.exe68⤵PID:2072
-
\??\c:\1xxlxrl.exec:\1xxlxrl.exe69⤵PID:2140
-
\??\c:\1thhtn.exec:\1thhtn.exe70⤵PID:4968
-
\??\c:\hbthnn.exec:\hbthnn.exe71⤵PID:2908
-
\??\c:\3vjpd.exec:\3vjpd.exe72⤵PID:1116
-
\??\c:\dpppv.exec:\dpppv.exe73⤵PID:5000
-
\??\c:\rrxrrrx.exec:\rrxrrrx.exe74⤵PID:4604
-
\??\c:\7lrfrrf.exec:\7lrfrrf.exe75⤵PID:1380
-
\??\c:\nbthnh.exec:\nbthnh.exe76⤵PID:1780
-
\??\c:\bbhnhb.exec:\bbhnhb.exe77⤵PID:1944
-
\??\c:\pvpdj.exec:\pvpdj.exe78⤵PID:912
-
\??\c:\5pdvd.exec:\5pdvd.exe79⤵PID:4476
-
\??\c:\9ffrxrf.exec:\9ffrxrf.exe80⤵PID:368
-
\??\c:\flxfrxl.exec:\flxfrxl.exe81⤵PID:1308
-
\??\c:\nthnbt.exec:\nthnbt.exe82⤵PID:512
-
\??\c:\1jjdj.exec:\1jjdj.exe83⤵PID:3296
-
\??\c:\3frxlxr.exec:\3frxlxr.exe84⤵PID:1324
-
\??\c:\rfxllfx.exec:\rfxllfx.exe85⤵PID:2924
-
\??\c:\nhtntt.exec:\nhtntt.exe86⤵PID:3164
-
\??\c:\tbthtn.exec:\tbthtn.exe87⤵PID:4392
-
\??\c:\5jdjd.exec:\5jdjd.exe88⤵PID:4352
-
\??\c:\7lrlrlf.exec:\7lrlrlf.exe89⤵PID:2920
-
\??\c:\7rrffrx.exec:\7rrffrx.exe90⤵PID:636
-
\??\c:\thhbbn.exec:\thhbbn.exe91⤵PID:1020
-
\??\c:\jvpdp.exec:\jvpdp.exe92⤵PID:3820
-
\??\c:\xlxlxlx.exec:\xlxlxlx.exe93⤵PID:3172
-
\??\c:\xlrllrf.exec:\xlrllrf.exe94⤵PID:5100
-
\??\c:\1bbbnh.exec:\1bbbnh.exe95⤵PID:1624
-
\??\c:\bnbtbt.exec:\bnbtbt.exe96⤵PID:2492
-
\??\c:\1dvdp.exec:\1dvdp.exe97⤵PID:2040
-
\??\c:\jdjdj.exec:\jdjdj.exe98⤵PID:1016
-
\??\c:\3xxlrlx.exec:\3xxlrlx.exe99⤵PID:3064
-
\??\c:\1xfrrll.exec:\1xfrrll.exe100⤵PID:4244
-
\??\c:\vvjdp.exec:\vvjdp.exe101⤵PID:4304
-
\??\c:\rlflxlf.exec:\rlflxlf.exe102⤵PID:3940
-
\??\c:\lffxrfx.exec:\lffxrfx.exe103⤵PID:3332
-
\??\c:\tbtnbt.exec:\tbtnbt.exe104⤵PID:1224
-
\??\c:\hntttn.exec:\hntttn.exe105⤵PID:1252
-
\??\c:\tntnhh.exec:\tntnhh.exe106⤵PID:4936
-
\??\c:\vjpjv.exec:\vjpjv.exe107⤵PID:1176
-
\??\c:\fxlxfxr.exec:\fxlxfxr.exe108⤵PID:4920
-
\??\c:\bhbtnh.exec:\bhbtnh.exe109⤵PID:4056
-
\??\c:\pddpv.exec:\pddpv.exe110⤵PID:1784
-
\??\c:\vjvdv.exec:\vjvdv.exe111⤵PID:3392
-
\??\c:\ffxlxlf.exec:\ffxlxlf.exe112⤵PID:4504
-
\??\c:\9lfrfxl.exec:\9lfrfxl.exe113⤵PID:1628
-
\??\c:\hnbnbn.exec:\hnbnbn.exe114⤵PID:396
-
\??\c:\nbbtnh.exec:\nbbtnh.exe115⤵PID:1092
-
\??\c:\5ddpj.exec:\5ddpj.exe116⤵PID:1392
-
\??\c:\rfxlfxx.exec:\rfxlfxx.exe117⤵PID:5068
-
\??\c:\rfxlfxl.exec:\rfxlfxl.exe118⤵PID:1880
-
\??\c:\3ttnth.exec:\3ttnth.exe119⤵PID:3484
-
\??\c:\hhnnnt.exec:\hhnnnt.exe120⤵PID:1428
-
\??\c:\vdvpd.exec:\vdvpd.exe121⤵PID:1240
-
\??\c:\djdpd.exec:\djdpd.exe122⤵PID:4460
-
\??\c:\7jdpd.exec:\7jdpd.exe123⤵PID:2348
-
\??\c:\lxlxrfx.exec:\lxlxrfx.exe124⤵PID:788
-
\??\c:\thhtnh.exec:\thhtnh.exe125⤵PID:3052
-
\??\c:\hnthnh.exec:\hnthnh.exe126⤵PID:4844
-
\??\c:\xxlxlxl.exec:\xxlxlxl.exe127⤵PID:4996
-
\??\c:\3rlfxrf.exec:\3rlfxrf.exe128⤵PID:4852
-
\??\c:\1bbbnh.exec:\1bbbnh.exe129⤵PID:4360
-
\??\c:\nnhtbh.exec:\nnhtbh.exe130⤵PID:2176
-
\??\c:\djdpd.exec:\djdpd.exe131⤵PID:2920
-
\??\c:\jpvvd.exec:\jpvvd.exe132⤵PID:4428
-
\??\c:\xfxlfxl.exec:\xfxlfxl.exe133⤵PID:1728
-
\??\c:\tnnbth.exec:\tnnbth.exe134⤵PID:3360
-
\??\c:\bnbthb.exec:\bnbthb.exe135⤵PID:3128
-
\??\c:\pvpdp.exec:\pvpdp.exe136⤵PID:1272
-
\??\c:\7dvpv.exec:\7dvpv.exe137⤵PID:3708
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe138⤵PID:1624
-
\??\c:\bnhbtn.exec:\bnhbtn.exe139⤵PID:2492
-
\??\c:\1ppdj.exec:\1ppdj.exe140⤵PID:4008
-
\??\c:\jvvpd.exec:\jvvpd.exe141⤵PID:1044
-
\??\c:\fxxrxrf.exec:\fxxrxrf.exe142⤵PID:460
-
\??\c:\lxfxlfr.exec:\lxfxlfr.exe143⤵PID:1568
-
\??\c:\bhthtt.exec:\bhthtt.exe144⤵PID:4540
-
\??\c:\nbtntn.exec:\nbtntn.exe145⤵PID:3592
-
\??\c:\nbhhnh.exec:\nbhhnh.exe146⤵PID:2728
-
\??\c:\jvpjd.exec:\jvpjd.exe147⤵PID:1252
-
\??\c:\dpvjj.exec:\dpvjj.exe148⤵PID:5084
-
\??\c:\llfxfxr.exec:\llfxfxr.exe149⤵PID:3664
-
\??\c:\7ffrlfx.exec:\7ffrlfx.exe150⤵PID:4588
-
\??\c:\htbnht.exec:\htbnht.exe151⤵PID:2140
-
\??\c:\nnnbhb.exec:\nnnbhb.exe152⤵PID:1156
-
\??\c:\5vvpd.exec:\5vvpd.exe153⤵PID:4072
-
\??\c:\jvvpd.exec:\jvvpd.exe154⤵PID:1620
-
\??\c:\xrlfrlx.exec:\xrlfrlx.exe155⤵PID:3068
-
\??\c:\xrxrxrf.exec:\xrxrxrf.exe156⤵PID:1884
-
\??\c:\lllxrlx.exec:\lllxrlx.exe157⤵PID:2692
-
\??\c:\nhnbnh.exec:\nhnbnh.exe158⤵PID:4632
-
\??\c:\3thtbt.exec:\3thtbt.exe159⤵PID:3348
-
\??\c:\dpvjv.exec:\dpvjv.exe160⤵PID:5008
-
\??\c:\7ddjd.exec:\7ddjd.exe161⤵PID:880
-
\??\c:\3lfrxrf.exec:\3lfrxrf.exe162⤵PID:1036
-
\??\c:\dvvvj.exec:\dvvvj.exe163⤵PID:2356
-
\??\c:\xxxrfll.exec:\xxxrfll.exe164⤵PID:4408
-
\??\c:\nttnbn.exec:\nttnbn.exe165⤵PID:1904
-
\??\c:\7btnbt.exec:\7btnbt.exe166⤵PID:2056
-
\??\c:\jpjdp.exec:\jpjdp.exe167⤵PID:2704
-
\??\c:\3lrxrlx.exec:\3lrxrlx.exe168⤵PID:2640
-
\??\c:\fxxrflf.exec:\fxxrflf.exe169⤵PID:3824
-
\??\c:\7lflxfr.exec:\7lflxfr.exe170⤵PID:212
-
\??\c:\3ththt.exec:\3ththt.exe171⤵PID:3280
-
\??\c:\ddjjj.exec:\ddjjj.exe172⤵PID:4584
-
\??\c:\jjdpv.exec:\jjdpv.exe173⤵PID:4924
-
\??\c:\lllxlfr.exec:\lllxlfr.exe174⤵PID:3316
-
\??\c:\hbnbnh.exec:\hbnbnh.exe175⤵PID:1592
-
\??\c:\hbnhbn.exec:\hbnhbn.exe176⤵PID:408
-
\??\c:\1vpjj.exec:\1vpjj.exe177⤵PID:4816
-
\??\c:\pvpvj.exec:\pvpvj.exe178⤵PID:4276
-
\??\c:\rrfrxrf.exec:\rrfrxrf.exe179⤵PID:3288
-
\??\c:\nhbnhh.exec:\nhbnhh.exe180⤵PID:916
-
\??\c:\bthnbn.exec:\bthnbn.exe181⤵PID:4564
-
\??\c:\vjvpj.exec:\vjvpj.exe182⤵PID:2844
-
\??\c:\vvjpd.exec:\vvjpd.exe183⤵PID:1300
-
\??\c:\9xfrfxr.exec:\9xfrfxr.exe184⤵PID:3124
-
\??\c:\7nhnbb.exec:\7nhnbb.exe185⤵PID:4936
-
\??\c:\hbbntn.exec:\hbbntn.exe186⤵PID:2316
-
\??\c:\1ddpd.exec:\1ddpd.exe187⤵PID:3320
-
\??\c:\lflxrll.exec:\lflxrll.exe188⤵PID:4620
-
\??\c:\fxxflrr.exec:\fxxflrr.exe189⤵PID:2700
-
\??\c:\hnhtnh.exec:\hnhtnh.exe190⤵PID:1116
-
\??\c:\1bthnh.exec:\1bthnh.exe191⤵PID:1392
-
\??\c:\ddvpd.exec:\ddvpd.exe192⤵PID:1096
-
\??\c:\5pvjv.exec:\5pvjv.exe193⤵PID:3264
-
\??\c:\9rxfxrr.exec:\9rxfxrr.exe194⤵PID:3484
-
\??\c:\rrrffrx.exec:\rrrffrx.exe195⤵PID:2384
-
\??\c:\hbhtnh.exec:\hbhtnh.exe196⤵PID:3868
-
\??\c:\htnhnh.exec:\htnhnh.exe197⤵PID:528
-
\??\c:\jvdjj.exec:\jvdjj.exe198⤵PID:3348
-
\??\c:\9pvjp.exec:\9pvjp.exe199⤵PID:788
-
\??\c:\rrlfrlx.exec:\rrlfrlx.exe200⤵PID:2688
-
\??\c:\llrrrll.exec:\llrrrll.exe201⤵PID:4412
-
\??\c:\thtbnh.exec:\thtbnh.exe202⤵PID:4536
-
\??\c:\htnbhb.exec:\htnbhb.exe203⤵PID:2472
-
\??\c:\1vdvp.exec:\1vdvp.exe204⤵PID:4360
-
\??\c:\pvdpj.exec:\pvdpj.exe205⤵PID:2432
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe206⤵PID:4972
-
\??\c:\lfxrfxl.exec:\lfxrfxl.exe207⤵PID:1020
-
\??\c:\5bnhtn.exec:\5bnhtn.exe208⤵PID:3820
-
\??\c:\tnhbnh.exec:\tnhbnh.exe209⤵PID:3172
-
\??\c:\dvdpj.exec:\dvdpj.exe210⤵PID:3184
-
\??\c:\dppdd.exec:\dppdd.exe211⤵PID:4584
-
\??\c:\rlxxfff.exec:\rlxxfff.exe212⤵PID:2792
-
\??\c:\rfrlxrf.exec:\rfrlxrf.exe213⤵PID:5064
-
\??\c:\7nnhbb.exec:\7nnhbb.exe214⤵PID:3776
-
\??\c:\bttnnt.exec:\bttnnt.exe215⤵PID:1016
-
\??\c:\dppjd.exec:\dppjd.exe216⤵PID:3364
-
\??\c:\xxffrrr.exec:\xxffrrr.exe217⤵PID:4244
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe218⤵PID:4272
-
\??\c:\tthbtt.exec:\tthbtt.exe219⤵PID:2408
-
\??\c:\httnhh.exec:\httnhh.exe220⤵PID:2848
-
\??\c:\dvjdj.exec:\dvjdj.exe221⤵PID:3380
-
\??\c:\3djdv.exec:\3djdv.exe222⤵PID:3972
-
\??\c:\5xllfff.exec:\5xllfff.exe223⤵PID:4492
-
\??\c:\5xfrfxr.exec:\5xfrfxr.exe224⤵PID:2400
-
\??\c:\tbbnhb.exec:\tbbnhb.exe225⤵PID:4176
-
\??\c:\9vjdd.exec:\9vjdd.exe226⤵PID:2248
-
\??\c:\dpjdp.exec:\dpjdp.exe227⤵PID:4072
-
\??\c:\xlfrllf.exec:\xlfrllf.exe228⤵PID:544
-
\??\c:\9lfrfxx.exec:\9lfrfxx.exe229⤵PID:3068
-
\??\c:\bhtnbt.exec:\bhtnbt.exe230⤵PID:1944
-
\??\c:\bnnthh.exec:\bnnthh.exe231⤵PID:2396
-
\??\c:\djdpd.exec:\djdpd.exe232⤵PID:1444
-
\??\c:\pjjdj.exec:\pjjdj.exe233⤵PID:3588
-
\??\c:\frrflfr.exec:\frrflfr.exe234⤵PID:1032
-
\??\c:\lllfrlx.exec:\lllfrlx.exe235⤵PID:4800
-
\??\c:\9nbttn.exec:\9nbttn.exe236⤵PID:1668
-
\??\c:\htthtn.exec:\htthtn.exe237⤵PID:3168
-
\??\c:\7tnhth.exec:\7tnhth.exe238⤵PID:4844
-
\??\c:\dvjdp.exec:\dvjdp.exe239⤵PID:4456
-
\??\c:\3vpdp.exec:\3vpdp.exe240⤵PID:1908
-
\??\c:\fxflrfl.exec:\fxflrfl.exe241⤵PID:224
-
\??\c:\fllrfxl.exec:\fllrfxl.exe242⤵PID:2704