Analysis
-
max time kernel
109s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 09:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
016b4780ce21e159c54f8105c6a3b8a0.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
016b4780ce21e159c54f8105c6a3b8a0.exe
-
Size
54KB
-
MD5
016b4780ce21e159c54f8105c6a3b8a0
-
SHA1
2930be7948378c9d75d6678ef7214ac5eead133a
-
SHA256
0d91655b7895e4f473846a2918f1d89aad678da4919c23e5cb33ff60cef22f68
-
SHA512
ac412bf3d3dac0e5c380fc34eb54229871d37dab44835a71dc169491ccbe6e2d597cf23b8b87fdae074fd6c6b4a9873aaa1b414c586a2aa18c05255ba6229408
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFz:ymb3NkkiQ3mdBjFIFz
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
Processes:
resource yara_rule behavioral2/memory/3300-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-50-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-43-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xffxrlf.exexlxxlll.exenbtntn.exe1btnbh.exejdpjv.exefxffffl.exerflfrrl.exexlrrlxr.exenhnhbt.exejppjv.exevppjd.exe5fxrrll.exexxlxrlf.exe9bhhnh.exebtnhhh.exevpjdv.exefxrrlrl.exerrrrllf.exehbbhtt.exejpdjd.exevjjvj.exe9xrfxrf.exexxxxrrr.exebnbtnh.exevjdvp.exepvdvj.exelfrrxfr.exenhhbtn.exebntnbh.exejdjjv.exedvvpj.exefxrfrlf.exexlxxrrl.exe7bhbtt.exehthbtb.exefrlfxrl.exexllffxr.exe5hhhbb.exehhnhhb.exe7dvpj.exepjpjd.exerfrlfff.exefxflfff.exenbbnbb.exe5bbthh.exe3pdpd.exejvvpj.exelrxlfxr.exerxfxrlf.exetnhbtn.exe1ttnbt.exejvvdp.exepdppp.exe3jjdp.exe9flrflx.exellxrrrx.exe7nbthh.exe3hhthb.exedvdpv.exejdpdv.exerlfxlfx.exerrrrxfr.exe7hbnbt.exettnhbh.exepid process 3300 xffxrlf.exe 4208 xlxxlll.exe 1288 nbtntn.exe 1740 1btnbh.exe 3484 jdpjv.exe 3288 fxffffl.exe 4216 rflfrrl.exe 5100 xlrrlxr.exe 1484 nhnhbt.exe 4064 jppjv.exe 1132 vppjd.exe 4428 5fxrrll.exe 4828 xxlxrlf.exe 2980 9bhhnh.exe 4572 btnhhh.exe 1688 vpjdv.exe 3628 fxrrlrl.exe 1612 rrrrllf.exe 1052 hbbhtt.exe 3232 jpdjd.exe 60 vjjvj.exe 3944 9xrfxrf.exe 2252 xxxxrrr.exe 4420 bnbtnh.exe 1976 vjdvp.exe 4120 pvdvj.exe 2776 lfrrxfr.exe 3780 nhhbtn.exe 3596 bntnbh.exe 3016 jdjjv.exe 2256 dvvpj.exe 5084 fxrfrlf.exe 1056 xlxxrrl.exe 1228 7bhbtt.exe 1916 hthbtb.exe 2544 frlfxrl.exe 3300 xllffxr.exe 4208 5hhhbb.exe 1288 hhnhhb.exe 396 7dvpj.exe 4908 pjpjd.exe 3000 rfrlfff.exe 2664 fxflfff.exe 1500 nbbnbb.exe 2300 5bbthh.exe 1852 3pdpd.exe 872 jvvpj.exe 1044 lrxlfxr.exe 2428 rxfxrlf.exe 3792 tnhbtn.exe 804 1ttnbt.exe 3284 jvvdp.exe 3868 pdppp.exe 4652 3jjdp.exe 460 9flrflx.exe 2140 llxrrrx.exe 3804 7nbthh.exe 1588 3hhthb.exe 992 dvdpv.exe 3564 jdpdv.exe 1584 rlfxlfx.exe 4968 rrrrxfr.exe 3512 7hbnbt.exe 2344 ttnhbh.exe -
Processes:
resource yara_rule behavioral2/memory/3300-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
016b4780ce21e159c54f8105c6a3b8a0.exexffxrlf.exexlxxlll.exenbtntn.exe1btnbh.exejdpjv.exefxffffl.exerflfrrl.exexlrrlxr.exenhnhbt.exejppjv.exevppjd.exe5fxrrll.exexxlxrlf.exe9bhhnh.exebtnhhh.exevpjdv.exefxrrlrl.exerrrrllf.exehbbhtt.exejpdjd.exevjjvj.exedescription pid process target process PID 1164 wrote to memory of 3300 1164 016b4780ce21e159c54f8105c6a3b8a0.exe xffxrlf.exe PID 1164 wrote to memory of 3300 1164 016b4780ce21e159c54f8105c6a3b8a0.exe xffxrlf.exe PID 1164 wrote to memory of 3300 1164 016b4780ce21e159c54f8105c6a3b8a0.exe xffxrlf.exe PID 3300 wrote to memory of 4208 3300 xffxrlf.exe xlxxlll.exe PID 3300 wrote to memory of 4208 3300 xffxrlf.exe xlxxlll.exe PID 3300 wrote to memory of 4208 3300 xffxrlf.exe xlxxlll.exe PID 4208 wrote to memory of 1288 4208 xlxxlll.exe nbtntn.exe PID 4208 wrote to memory of 1288 4208 xlxxlll.exe nbtntn.exe PID 4208 wrote to memory of 1288 4208 xlxxlll.exe nbtntn.exe PID 1288 wrote to memory of 1740 1288 nbtntn.exe 1btnbh.exe PID 1288 wrote to memory of 1740 1288 nbtntn.exe 1btnbh.exe PID 1288 wrote to memory of 1740 1288 nbtntn.exe 1btnbh.exe PID 1740 wrote to memory of 3484 1740 1btnbh.exe jdpjv.exe PID 1740 wrote to memory of 3484 1740 1btnbh.exe jdpjv.exe PID 1740 wrote to memory of 3484 1740 1btnbh.exe jdpjv.exe PID 3484 wrote to memory of 3288 3484 jdpjv.exe fxffffl.exe PID 3484 wrote to memory of 3288 3484 jdpjv.exe fxffffl.exe PID 3484 wrote to memory of 3288 3484 jdpjv.exe fxffffl.exe PID 3288 wrote to memory of 4216 3288 fxffffl.exe rflfrrl.exe PID 3288 wrote to memory of 4216 3288 fxffffl.exe rflfrrl.exe PID 3288 wrote to memory of 4216 3288 fxffffl.exe rflfrrl.exe PID 4216 wrote to memory of 5100 4216 rflfrrl.exe xlrrlxr.exe PID 4216 wrote to memory of 5100 4216 rflfrrl.exe xlrrlxr.exe PID 4216 wrote to memory of 5100 4216 rflfrrl.exe xlrrlxr.exe PID 5100 wrote to memory of 1484 5100 xlrrlxr.exe nhnhbt.exe PID 5100 wrote to memory of 1484 5100 xlrrlxr.exe nhnhbt.exe PID 5100 wrote to memory of 1484 5100 xlrrlxr.exe nhnhbt.exe PID 1484 wrote to memory of 4064 1484 nhnhbt.exe jppjv.exe PID 1484 wrote to memory of 4064 1484 nhnhbt.exe jppjv.exe PID 1484 wrote to memory of 4064 1484 nhnhbt.exe jppjv.exe PID 4064 wrote to memory of 1132 4064 jppjv.exe vppjd.exe PID 4064 wrote to memory of 1132 4064 jppjv.exe vppjd.exe PID 4064 wrote to memory of 1132 4064 jppjv.exe vppjd.exe PID 1132 wrote to memory of 4428 1132 vppjd.exe 5fxrrll.exe PID 1132 wrote to memory of 4428 1132 vppjd.exe 5fxrrll.exe PID 1132 wrote to memory of 4428 1132 vppjd.exe 5fxrrll.exe PID 4428 wrote to memory of 4828 4428 5fxrrll.exe xxlxrlf.exe PID 4428 wrote to memory of 4828 4428 5fxrrll.exe xxlxrlf.exe PID 4428 wrote to memory of 4828 4428 5fxrrll.exe xxlxrlf.exe PID 4828 wrote to memory of 2980 4828 xxlxrlf.exe 9bhhnh.exe PID 4828 wrote to memory of 2980 4828 xxlxrlf.exe 9bhhnh.exe PID 4828 wrote to memory of 2980 4828 xxlxrlf.exe 9bhhnh.exe PID 2980 wrote to memory of 4572 2980 9bhhnh.exe btnhhh.exe PID 2980 wrote to memory of 4572 2980 9bhhnh.exe btnhhh.exe PID 2980 wrote to memory of 4572 2980 9bhhnh.exe btnhhh.exe PID 4572 wrote to memory of 1688 4572 btnhhh.exe vpjdv.exe PID 4572 wrote to memory of 1688 4572 btnhhh.exe vpjdv.exe PID 4572 wrote to memory of 1688 4572 btnhhh.exe vpjdv.exe PID 1688 wrote to memory of 3628 1688 vpjdv.exe fxrrlrl.exe PID 1688 wrote to memory of 3628 1688 vpjdv.exe fxrrlrl.exe PID 1688 wrote to memory of 3628 1688 vpjdv.exe fxrrlrl.exe PID 3628 wrote to memory of 1612 3628 fxrrlrl.exe rrrrllf.exe PID 3628 wrote to memory of 1612 3628 fxrrlrl.exe rrrrllf.exe PID 3628 wrote to memory of 1612 3628 fxrrlrl.exe rrrrllf.exe PID 1612 wrote to memory of 1052 1612 rrrrllf.exe hbbhtt.exe PID 1612 wrote to memory of 1052 1612 rrrrllf.exe hbbhtt.exe PID 1612 wrote to memory of 1052 1612 rrrrllf.exe hbbhtt.exe PID 1052 wrote to memory of 3232 1052 hbbhtt.exe jpdjd.exe PID 1052 wrote to memory of 3232 1052 hbbhtt.exe jpdjd.exe PID 1052 wrote to memory of 3232 1052 hbbhtt.exe jpdjd.exe PID 3232 wrote to memory of 60 3232 jpdjd.exe vjjvj.exe PID 3232 wrote to memory of 60 3232 jpdjd.exe vjjvj.exe PID 3232 wrote to memory of 60 3232 jpdjd.exe vjjvj.exe PID 60 wrote to memory of 3944 60 vjjvj.exe 9xrfxrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2453694363\zmstage.exeC:\Users\Admin\AppData\Local\Temp\2453694363\zmstage.exe1⤵PID:1916
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\016b4780ce21e159c54f8105c6a3b8a0.exe"C:\Users\Admin\AppData\Local\Temp\016b4780ce21e159c54f8105c6a3b8a0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\xffxrlf.exec:\xffxrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\xlxxlll.exec:\xlxxlll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\nbtntn.exec:\nbtntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\1btnbh.exec:\1btnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\jdpjv.exec:\jdpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\fxffffl.exec:\fxffffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\rflfrrl.exec:\rflfrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\xlrrlxr.exec:\xlrrlxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\nhnhbt.exec:\nhnhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\jppjv.exec:\jppjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\vppjd.exec:\vppjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\5fxrrll.exec:\5fxrrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\xxlxrlf.exec:\xxlxrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\9bhhnh.exec:\9bhhnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\btnhhh.exec:\btnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\vpjdv.exec:\vpjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\fxrrlrl.exec:\fxrrlrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\rrrrllf.exec:\rrrrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\hbbhtt.exec:\hbbhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\jpdjd.exec:\jpdjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\vjjvj.exec:\vjjvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\9xrfxrf.exec:\9xrfxrf.exe23⤵
- Executes dropped EXE
PID:3944 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe24⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bnbtnh.exec:\bnbtnh.exe25⤵
- Executes dropped EXE
PID:4420 -
\??\c:\vjdvp.exec:\vjdvp.exe26⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pvdvj.exec:\pvdvj.exe27⤵
- Executes dropped EXE
PID:4120 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe28⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nhhbtn.exec:\nhhbtn.exe29⤵
- Executes dropped EXE
PID:3780 -
\??\c:\bntnbh.exec:\bntnbh.exe30⤵
- Executes dropped EXE
PID:3596 -
\??\c:\jdjjv.exec:\jdjjv.exe31⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dvvpj.exec:\dvvpj.exe32⤵
- Executes dropped EXE
PID:2256 -
\??\c:\fxrfrlf.exec:\fxrfrlf.exe33⤵
- Executes dropped EXE
PID:5084 -
\??\c:\xlxxrrl.exec:\xlxxrrl.exe34⤵
- Executes dropped EXE
PID:1056 -
\??\c:\7bhbtt.exec:\7bhbtt.exe35⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hthbtb.exec:\hthbtb.exe36⤵
- Executes dropped EXE
PID:1916 -
\??\c:\dpjdv.exec:\dpjdv.exe37⤵PID:2168
-
\??\c:\frlfxrl.exec:\frlfxrl.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xllffxr.exec:\xllffxr.exe39⤵
- Executes dropped EXE
PID:3300 -
\??\c:\5hhhbb.exec:\5hhhbb.exe40⤵
- Executes dropped EXE
PID:4208 -
\??\c:\hhnhhb.exec:\hhnhhb.exe41⤵
- Executes dropped EXE
PID:1288 -
\??\c:\7dvpj.exec:\7dvpj.exe42⤵
- Executes dropped EXE
PID:396 -
\??\c:\pjpjd.exec:\pjpjd.exe43⤵
- Executes dropped EXE
PID:4908 -
\??\c:\rfrlfff.exec:\rfrlfff.exe44⤵
- Executes dropped EXE
PID:3000 -
\??\c:\fxflfff.exec:\fxflfff.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nbbnbb.exec:\nbbnbb.exe46⤵
- Executes dropped EXE
PID:1500 -
\??\c:\5bbthh.exec:\5bbthh.exe47⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3pdpd.exec:\3pdpd.exe48⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jvvpj.exec:\jvvpj.exe49⤵
- Executes dropped EXE
PID:872 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe50⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe51⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tnhbtn.exec:\tnhbtn.exe52⤵
- Executes dropped EXE
PID:3792 -
\??\c:\1ttnbt.exec:\1ttnbt.exe53⤵
- Executes dropped EXE
PID:804 -
\??\c:\jvvdp.exec:\jvvdp.exe54⤵
- Executes dropped EXE
PID:3284 -
\??\c:\pdppp.exec:\pdppp.exe55⤵
- Executes dropped EXE
PID:3868 -
\??\c:\3jjdp.exec:\3jjdp.exe56⤵
- Executes dropped EXE
PID:4652 -
\??\c:\9flrflx.exec:\9flrflx.exe57⤵
- Executes dropped EXE
PID:460 -
\??\c:\llxrrrx.exec:\llxrrrx.exe58⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7nbthh.exec:\7nbthh.exe59⤵
- Executes dropped EXE
PID:3804 -
\??\c:\3hhthb.exec:\3hhthb.exe60⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dvdpv.exec:\dvdpv.exe61⤵
- Executes dropped EXE
PID:992 -
\??\c:\jdpdv.exec:\jdpdv.exe62⤵
- Executes dropped EXE
PID:3564 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe63⤵
- Executes dropped EXE
PID:1584 -
\??\c:\rrrrxfr.exec:\rrrrxfr.exe64⤵
- Executes dropped EXE
PID:4968 -
\??\c:\7hbnbt.exec:\7hbnbt.exe65⤵
- Executes dropped EXE
PID:3512 -
\??\c:\ttnhbh.exec:\ttnhbh.exe66⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jpdvp.exec:\jpdvp.exe67⤵PID:4796
-
\??\c:\ppvdv.exec:\ppvdv.exe68⤵PID:4820
-
\??\c:\xlfxffx.exec:\xlfxffx.exe69⤵PID:3504
-
\??\c:\frrlffx.exec:\frrlffx.exe70⤵PID:1156
-
\??\c:\thtnbb.exec:\thtnbb.exe71⤵PID:1748
-
\??\c:\5bbthn.exec:\5bbthn.exe72⤵PID:1796
-
\??\c:\tthbtb.exec:\tthbtb.exe73⤵PID:4192
-
\??\c:\dpjdv.exec:\dpjdv.exe74⤵PID:2776
-
\??\c:\vjppv.exec:\vjppv.exe75⤵PID:3292
-
\??\c:\fxlxxlr.exec:\fxlxxlr.exe76⤵PID:2296
-
\??\c:\rllllrx.exec:\rllllrx.exe77⤵PID:452
-
\??\c:\hnhbnt.exec:\hnhbnt.exe78⤵PID:3296
-
\??\c:\ntnntn.exec:\ntnntn.exe79⤵PID:2212
-
\??\c:\pppjj.exec:\pppjj.exe80⤵PID:5084
-
\??\c:\dvjvv.exec:\dvjvv.exe81⤵PID:2348
-
\??\c:\rxrrfrx.exec:\rxrrfrx.exe82⤵PID:4464
-
\??\c:\llxrffx.exec:\llxrffx.exe83⤵PID:4460
-
\??\c:\hthbtt.exec:\hthbtt.exe84⤵PID:740
-
\??\c:\bbbthb.exec:\bbbthb.exe85⤵PID:64
-
\??\c:\btnhtb.exec:\btnhtb.exe86⤵PID:4568
-
\??\c:\vjvjv.exec:\vjvjv.exe87⤵PID:948
-
\??\c:\vjjdd.exec:\vjjdd.exe88⤵PID:2616
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe89⤵PID:5044
-
\??\c:\lxlfxrr.exec:\lxlfxrr.exe90⤵PID:4068
-
\??\c:\nhbbnn.exec:\nhbbnn.exe91⤵PID:5012
-
\??\c:\9nhbnh.exec:\9nhbnh.exe92⤵PID:2440
-
\??\c:\dvjdp.exec:\dvjdp.exe93⤵PID:3664
-
\??\c:\pdjdj.exec:\pdjdj.exe94⤵PID:2080
-
\??\c:\xxxrxxr.exec:\xxxrxxr.exe95⤵PID:860
-
\??\c:\lffrlfx.exec:\lffrlfx.exe96⤵PID:2108
-
\??\c:\rlxrlll.exec:\rlxrlll.exe97⤵PID:828
-
\??\c:\tthbtt.exec:\tthbtt.exe98⤵PID:1044
-
\??\c:\hbbthh.exec:\hbbthh.exe99⤵PID:3760
-
\??\c:\jddpd.exec:\jddpd.exe100⤵PID:4200
-
\??\c:\lxxrrlf.exec:\lxxrrlf.exe101⤵PID:1252
-
\??\c:\lxxrrfx.exec:\lxxrrfx.exe102⤵PID:3068
-
\??\c:\tbtnhh.exec:\tbtnhh.exe103⤵PID:4500
-
\??\c:\3ppjv.exec:\3ppjv.exe104⤵PID:2840
-
\??\c:\1ppvv.exec:\1ppvv.exe105⤵PID:936
-
\??\c:\jdjjd.exec:\jdjjd.exe106⤵PID:4260
-
\??\c:\lfxlfff.exec:\lfxlfff.exe107⤵PID:5032
-
\??\c:\vdpvp.exec:\vdpvp.exe108⤵PID:4680
-
\??\c:\fxlrfll.exec:\fxlrfll.exe109⤵PID:1944
-
\??\c:\lrlflfx.exec:\lrlflfx.exe110⤵PID:4676
-
\??\c:\tbtnhb.exec:\tbtnhb.exe111⤵PID:4796
-
\??\c:\bnbnbh.exec:\bnbnbh.exe112⤵PID:2764
-
\??\c:\nnnhth.exec:\nnnhth.exe113⤵PID:1040
-
\??\c:\jjdvd.exec:\jjdvd.exe114⤵PID:2696
-
\??\c:\pdvjv.exec:\pdvjv.exe115⤵PID:2204
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe116⤵PID:688
-
\??\c:\1frrllr.exec:\1frrllr.exe117⤵PID:4204
-
\??\c:\xlxxlfl.exec:\xlxxlfl.exe118⤵PID:3096
-
\??\c:\nhhthh.exec:\nhhthh.exe119⤵PID:2608
-
\??\c:\bhnhbt.exec:\bhnhbt.exe120⤵PID:2256
-
\??\c:\dvpjv.exec:\dvpjv.exe121⤵PID:3964
-
\??\c:\pdpdd.exec:\pdpdd.exe122⤵PID:228
-
\??\c:\xxrlxrl.exec:\xxrlxrl.exe123⤵PID:2224
-
\??\c:\5lrlffx.exec:\5lrlffx.exe124⤵PID:1184
-
\??\c:\hbttnn.exec:\hbttnn.exe125⤵PID:4444
-
\??\c:\7hbthh.exec:\7hbthh.exe126⤵PID:3012
-
\??\c:\nhhthh.exec:\nhhthh.exe127⤵PID:1008
-
\??\c:\vppjd.exec:\vppjd.exe128⤵PID:3248
-
\??\c:\vjdvv.exec:\vjdvv.exe129⤵PID:3580
-
\??\c:\ffxlxrl.exec:\ffxlxrl.exe130⤵PID:2320
-
\??\c:\lxrlffr.exec:\lxrlffr.exe131⤵PID:2616
-
\??\c:\xfxrrll.exec:\xfxrrll.exe132⤵PID:1124
-
\??\c:\hbbbtb.exec:\hbbbtb.exe133⤵PID:4216
-
\??\c:\tbtnbt.exec:\tbtnbt.exe134⤵PID:2172
-
\??\c:\pddvd.exec:\pddvd.exe135⤵PID:1900
-
\??\c:\pdjdv.exec:\pdjdv.exe136⤵PID:1428
-
\??\c:\7pjjv.exec:\7pjjv.exe137⤵PID:2796
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe138⤵PID:3440
-
\??\c:\1flfrlf.exec:\1flfrlf.exe139⤵PID:3180
-
\??\c:\hnthbb.exec:\hnthbb.exe140⤵PID:4280
-
\??\c:\9nhnbb.exec:\9nhnbb.exe141⤵PID:4000
-
\??\c:\dvpdp.exec:\dvpdp.exe142⤵PID:2980
-
\??\c:\jjvpd.exec:\jjvpd.exe143⤵PID:3276
-
\??\c:\pvvpd.exec:\pvvpd.exe144⤵PID:5096
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe145⤵PID:4684
-
\??\c:\frrrllr.exec:\frrrllr.exe146⤵PID:408
-
\??\c:\bthbht.exec:\bthbht.exe147⤵PID:2472
-
\??\c:\hbhbtt.exec:\hbhbtt.exe148⤵PID:2752
-
\??\c:\tbbtnh.exec:\tbbtnh.exe149⤵PID:2956
-
\??\c:\3pvdp.exec:\3pvdp.exe150⤵PID:3628
-
\??\c:\ddppd.exec:\ddppd.exe151⤵PID:1016
-
\??\c:\7lrlfxr.exec:\7lrlfxr.exe152⤵PID:2848
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe153⤵PID:1152
-
\??\c:\bbbtbn.exec:\bbbtbn.exe154⤵PID:1944
-
\??\c:\bbthtn.exec:\bbthtn.exe155⤵PID:2096
-
\??\c:\hhbbtt.exec:\hhbbtt.exe156⤵PID:3504
-
\??\c:\7jjvj.exec:\7jjvj.exe157⤵PID:1156
-
\??\c:\dpjdj.exec:\dpjdj.exe158⤵PID:1748
-
\??\c:\xlllxxx.exec:\xlllxxx.exe159⤵PID:5004
-
\??\c:\ffrrlff.exec:\ffrrlff.exe160⤵PID:4192
-
\??\c:\rffllff.exec:\rffllff.exe161⤵PID:4320
-
\??\c:\nbhbtb.exec:\nbhbtb.exe162⤵PID:4140
-
\??\c:\bttntt.exec:\bttntt.exe163⤵PID:4196
-
\??\c:\dpjjj.exec:\dpjjj.exe164⤵PID:2332
-
\??\c:\vjvpd.exec:\vjvpd.exe165⤵PID:2492
-
\??\c:\jvpjd.exec:\jvpjd.exe166⤵PID:4704
-
\??\c:\vpdvp.exec:\vpdvp.exe167⤵PID:5084
-
\??\c:\xlfrffx.exec:\xlfrffx.exe168⤵PID:4508
-
\??\c:\frlfxrl.exec:\frlfxrl.exe169⤵PID:3964
-
\??\c:\rllllrl.exec:\rllllrl.exe170⤵PID:4460
-
\??\c:\tthbnn.exec:\tthbnn.exe171⤵PID:4584
-
\??\c:\3bthbt.exec:\3bthbt.exe172⤵PID:2484
-
\??\c:\vpjvj.exec:\vpjvj.exe173⤵PID:64
-
\??\c:\pjjdp.exec:\pjjdp.exe174⤵PID:2132
-
\??\c:\vdjdv.exec:\vdjdv.exe175⤵PID:4872
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe176⤵PID:4908
-
\??\c:\9fffxxx.exec:\9fffxxx.exe177⤵PID:400
-
\??\c:\7pvjp.exec:\7pvjp.exe178⤵PID:2124
-
\??\c:\frrllfr.exec:\frrllfr.exe179⤵PID:2340
-
\??\c:\ttbbht.exec:\ttbbht.exe180⤵PID:2888
-
\??\c:\thhbbt.exec:\thhbbt.exe181⤵PID:2464
-
\??\c:\tntnbb.exec:\tntnbb.exe182⤵PID:2300
-
\??\c:\vpjdv.exec:\vpjdv.exe183⤵PID:2068
-
\??\c:\ppvpj.exec:\ppvpj.exe184⤵PID:4588
-
\??\c:\jvjdd.exec:\jvjdd.exe185⤵PID:1132
-
\??\c:\xflfrlf.exec:\xflfrlf.exe186⤵PID:3860
-
\??\c:\rfffxxx.exec:\rfffxxx.exe187⤵PID:3760
-
\??\c:\bnnhhb.exec:\bnnhhb.exe188⤵PID:1252
-
\??\c:\nhnnbt.exec:\nhnnbt.exe189⤵PID:1444
-
\??\c:\btnthb.exec:\btnthb.exe190⤵PID:4268
-
\??\c:\vjdvj.exec:\vjdvj.exe191⤵PID:4288
-
\??\c:\jdjvp.exec:\jdjvp.exe192⤵PID:5112
-
\??\c:\djdpp.exec:\djdpp.exe193⤵PID:3748
-
\??\c:\3rrlrrf.exec:\3rrlrrf.exe194⤵PID:2472
-
\??\c:\bhnttb.exec:\bhnttb.exe195⤵PID:992
-
\??\c:\thtbtn.exec:\thtbtn.exe196⤵PID:2384
-
\??\c:\vvdvp.exec:\vvdvp.exe197⤵PID:3536
-
\??\c:\jdpjv.exec:\jdpjv.exe198⤵PID:4772
-
\??\c:\3rllfll.exec:\3rllfll.exe199⤵PID:1268
-
\??\c:\fxfxlfx.exec:\fxfxlfx.exe200⤵PID:2144
-
\??\c:\rlffxrl.exec:\rlffxrl.exe201⤵PID:1644
-
\??\c:\hbbbhh.exec:\hbbbhh.exe202⤵PID:1896
-
\??\c:\tntthh.exec:\tntthh.exe203⤵PID:4192
-
\??\c:\ppvvd.exec:\ppvvd.exe204⤵PID:60
-
\??\c:\pvvpd.exec:\pvvpd.exe205⤵PID:208
-
\??\c:\fffxrrl.exec:\fffxrrl.exe206⤵PID:452
-
\??\c:\lrrllfx.exec:\lrrllfx.exe207⤵PID:1940
-
\??\c:\nbtnhh.exec:\nbtnhh.exe208⤵PID:3056
-
\??\c:\hbtntt.exec:\hbtntt.exe209⤵PID:220
-
\??\c:\9bhbhb.exec:\9bhbhb.exe210⤵PID:2224
-
\??\c:\dvddv.exec:\dvddv.exe211⤵PID:712
-
\??\c:\dvjdv.exec:\dvjdv.exe212⤵PID:2544
-
\??\c:\rlxrfrf.exec:\rlxrfrf.exe213⤵PID:3788
-
\??\c:\llxflrx.exec:\llxflrx.exe214⤵PID:3184
-
\??\c:\htnhbb.exec:\htnhbb.exe215⤵PID:2128
-
\??\c:\ththbt.exec:\ththbt.exe216⤵PID:3616
-
\??\c:\jvvpv.exec:\jvvpv.exe217⤵PID:4872
-
\??\c:\1vvjv.exec:\1vvjv.exe218⤵PID:4908
-
\??\c:\vpvjp.exec:\vpvjp.exe219⤵PID:400
-
\??\c:\frlfxrl.exec:\frlfxrl.exe220⤵PID:5036
-
\??\c:\lxllflf.exec:\lxllflf.exe221⤵PID:2440
-
\??\c:\ttnhtt.exec:\ttnhtt.exe222⤵PID:4384
-
\??\c:\tthbtn.exec:\tthbtn.exe223⤵PID:3148
-
\??\c:\vppjd.exec:\vppjd.exe224⤵PID:2864
-
\??\c:\pjjdp.exec:\pjjdp.exe225⤵PID:4052
-
\??\c:\jvvpj.exec:\jvvpj.exe226⤵PID:2428
-
\??\c:\vjvjd.exec:\vjvjd.exe227⤵PID:4076
-
\??\c:\ffrrlff.exec:\ffrrlff.exe228⤵PID:2284
-
\??\c:\xrlxrlr.exec:\xrlxrlr.exe229⤵PID:3868
-
\??\c:\fxxrllx.exec:\fxxrllx.exe230⤵PID:5092
-
\??\c:\tttbtn.exec:\tttbtn.exe231⤵PID:2720
-
\??\c:\bhnntn.exec:\bhnntn.exe232⤵PID:1452
-
\??\c:\pdvvj.exec:\pdvvj.exe233⤵PID:5064
-
\??\c:\dpvpj.exec:\dpvpj.exe234⤵PID:936
-
\??\c:\3fxxlrl.exec:\3fxxlrl.exe235⤵PID:4732
-
\??\c:\lxxfllr.exec:\lxxfllr.exe236⤵PID:2472
-
\??\c:\3pvpp.exec:\3pvpp.exe237⤵PID:3628
-
\??\c:\vjvpp.exec:\vjvpp.exe238⤵PID:2384
-
\??\c:\dpvpp.exec:\dpvpp.exe239⤵PID:4496
-
\??\c:\9xrfrlf.exec:\9xrfrlf.exe240⤵PID:3200
-
\??\c:\xrfxxrl.exec:\xrfxxrl.exe241⤵PID:2772
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe242⤵PID:2144