Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 10:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c035b3b7df743cc179f723060852c524ad0fd1c2eb594d0dc033860b2578060.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6c035b3b7df743cc179f723060852c524ad0fd1c2eb594d0dc033860b2578060.exe
-
Size
74KB
-
MD5
0bc22e0eaaccefea20c16c45f787a250
-
SHA1
fa671e0c1f34fdc8bc37e79470051b8d217b2f98
-
SHA256
6c035b3b7df743cc179f723060852c524ad0fd1c2eb594d0dc033860b2578060
-
SHA512
be2b8bbd90d628cff3a2a8efe28ee2e849502607dff391f540c62bcb6ed612818250cbddf455941e722f561c767f58cc0a3faf4da3ce7e18c7748914e29f8f77
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbKQPV790638y:ymb3NkkiQ3mdBjFIfvTfCD+HlQgVy
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/2484-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nntbbn.exepjdvp.exevpjpj.exexxfffll.exeflxfffx.exetbhhhn.exejdvvv.exexxrrflf.exenhbbtt.exevpddd.exedvddv.exetthbhn.exebhbbtt.exevvjdj.exerllrlll.exe3tbbtt.exethhnhh.exejvvjj.exexllxxff.exethbtnt.exehhhbtt.exeddddp.exexrxxxxr.exetbbbtt.exeddpjv.exepddjj.exefflxxxx.exefxlflll.exetbbtbb.exe5ppjv.exe5xxrrxr.exerlffxxr.exenbtnhb.exe3vjdj.exeppjjd.exe3fxrfrr.exefxrlffx.exenhnnhh.exe1bbbtt.exevppjd.exe3ppjd.exelxllxrr.exexxrrxrl.exenhhbtn.exehbhbtn.exe5vvpj.exexflxfrx.exe1ffxrxr.exehbhhhh.exe1pvpd.exepdjjp.exe3lxrllf.exerrfflxl.exebnhbbt.exehntbhb.exe9pjdv.exedvddd.exefxlxrlf.exehtthbb.exennhtnh.exeddpjp.exelxllffx.exefxffllr.exe7bttnh.exepid process 2440 nntbbn.exe 60 pjdvp.exe 2552 vpjpj.exe 1028 xxfffll.exe 4144 flxfffx.exe 800 tbhhhn.exe 2456 jdvvv.exe 3360 xxrrflf.exe 2236 nhbbtt.exe 1312 vpddd.exe 1820 dvddv.exe 1100 tthbhn.exe 3400 bhbbtt.exe 4208 vvjdj.exe 2104 rllrlll.exe 1224 3tbbtt.exe 4876 thhnhh.exe 2504 jvvjj.exe 3296 xllxxff.exe 4360 thbtnt.exe 3708 hhhbtt.exe 2388 ddddp.exe 5060 xrxxxxr.exe 4428 tbbbtt.exe 3440 ddpjv.exe 1776 pddjj.exe 1092 fflxxxx.exe 4060 fxlflll.exe 2984 tbbtbb.exe 4632 5ppjv.exe 3716 5xxrrxr.exe 3232 rlffxxr.exe 5020 nbtnhb.exe 220 3vjdj.exe 2684 ppjjd.exe 2160 3fxrfrr.exe 4412 fxrlffx.exe 4024 nhnnhh.exe 2072 1bbbtt.exe 3088 vppjd.exe 4204 3ppjd.exe 1372 lxllxrr.exe 1724 xxrrxrl.exe 2472 nhhbtn.exe 4240 hbhbtn.exe 5004 5vvpj.exe 4676 xflxfrx.exe 2960 1ffxrxr.exe 464 hbhhhh.exe 3292 1pvpd.exe 2084 pdjjp.exe 1808 3lxrllf.exe 2860 rrfflxl.exe 1868 bnhbbt.exe 3364 hntbhb.exe 3180 9pjdv.exe 2756 dvddd.exe 2720 fxlxrlf.exe 3684 htthbb.exe 4996 nnhtnh.exe 4844 ddpjp.exe 1064 lxllffx.exe 3116 fxffllr.exe 2612 7bttnh.exe -
Processes:
resource yara_rule behavioral2/memory/2484-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6c035b3b7df743cc179f723060852c524ad0fd1c2eb594d0dc033860b2578060.exenntbbn.exepjdvp.exevpjpj.exexxfffll.exeflxfffx.exetbhhhn.exejdvvv.exexxrrflf.exenhbbtt.exevpddd.exedvddv.exetthbhn.exebhbbtt.exevvjdj.exerllrlll.exe3tbbtt.exethhnhh.exejvvjj.exexllxxff.exethbtnt.exehhhbtt.exedescription pid process target process PID 2484 wrote to memory of 2440 2484 6c035b3b7df743cc179f723060852c524ad0fd1c2eb594d0dc033860b2578060.exe nntbbn.exe PID 2484 wrote to memory of 2440 2484 6c035b3b7df743cc179f723060852c524ad0fd1c2eb594d0dc033860b2578060.exe nntbbn.exe PID 2484 wrote to memory of 2440 2484 6c035b3b7df743cc179f723060852c524ad0fd1c2eb594d0dc033860b2578060.exe nntbbn.exe PID 2440 wrote to memory of 60 2440 nntbbn.exe pjdvp.exe PID 2440 wrote to memory of 60 2440 nntbbn.exe pjdvp.exe PID 2440 wrote to memory of 60 2440 nntbbn.exe pjdvp.exe PID 60 wrote to memory of 2552 60 pjdvp.exe vpjpj.exe PID 60 wrote to memory of 2552 60 pjdvp.exe vpjpj.exe PID 60 wrote to memory of 2552 60 pjdvp.exe vpjpj.exe PID 2552 wrote to memory of 1028 2552 vpjpj.exe xxfffll.exe PID 2552 wrote to memory of 1028 2552 vpjpj.exe xxfffll.exe PID 2552 wrote to memory of 1028 2552 vpjpj.exe xxfffll.exe PID 1028 wrote to memory of 4144 1028 xxfffll.exe flxfffx.exe PID 1028 wrote to memory of 4144 1028 xxfffll.exe flxfffx.exe PID 1028 wrote to memory of 4144 1028 xxfffll.exe flxfffx.exe PID 4144 wrote to memory of 800 4144 flxfffx.exe tbhhhn.exe PID 4144 wrote to memory of 800 4144 flxfffx.exe tbhhhn.exe PID 4144 wrote to memory of 800 4144 flxfffx.exe tbhhhn.exe PID 800 wrote to memory of 2456 800 tbhhhn.exe jdvvv.exe PID 800 wrote to memory of 2456 800 tbhhhn.exe jdvvv.exe PID 800 wrote to memory of 2456 800 tbhhhn.exe jdvvv.exe PID 2456 wrote to memory of 3360 2456 jdvvv.exe xxrrflf.exe PID 2456 wrote to memory of 3360 2456 jdvvv.exe xxrrflf.exe PID 2456 wrote to memory of 3360 2456 jdvvv.exe xxrrflf.exe PID 3360 wrote to memory of 2236 3360 xxrrflf.exe nhbbtt.exe PID 3360 wrote to memory of 2236 3360 xxrrflf.exe nhbbtt.exe PID 3360 wrote to memory of 2236 3360 xxrrflf.exe nhbbtt.exe PID 2236 wrote to memory of 1312 2236 nhbbtt.exe vpddd.exe PID 2236 wrote to memory of 1312 2236 nhbbtt.exe vpddd.exe PID 2236 wrote to memory of 1312 2236 nhbbtt.exe vpddd.exe PID 1312 wrote to memory of 1820 1312 vpddd.exe dvddv.exe PID 1312 wrote to memory of 1820 1312 vpddd.exe dvddv.exe PID 1312 wrote to memory of 1820 1312 vpddd.exe dvddv.exe PID 1820 wrote to memory of 1100 1820 dvddv.exe tthbhn.exe PID 1820 wrote to memory of 1100 1820 dvddv.exe tthbhn.exe PID 1820 wrote to memory of 1100 1820 dvddv.exe tthbhn.exe PID 1100 wrote to memory of 3400 1100 tthbhn.exe bhbbtt.exe PID 1100 wrote to memory of 3400 1100 tthbhn.exe bhbbtt.exe PID 1100 wrote to memory of 3400 1100 tthbhn.exe bhbbtt.exe PID 3400 wrote to memory of 4208 3400 bhbbtt.exe vvjdj.exe PID 3400 wrote to memory of 4208 3400 bhbbtt.exe vvjdj.exe PID 3400 wrote to memory of 4208 3400 bhbbtt.exe vvjdj.exe PID 4208 wrote to memory of 2104 4208 vvjdj.exe rllrlll.exe PID 4208 wrote to memory of 2104 4208 vvjdj.exe rllrlll.exe PID 4208 wrote to memory of 2104 4208 vvjdj.exe rllrlll.exe PID 2104 wrote to memory of 1224 2104 rllrlll.exe 3tbbtt.exe PID 2104 wrote to memory of 1224 2104 rllrlll.exe 3tbbtt.exe PID 2104 wrote to memory of 1224 2104 rllrlll.exe 3tbbtt.exe PID 1224 wrote to memory of 4876 1224 3tbbtt.exe thhnhh.exe PID 1224 wrote to memory of 4876 1224 3tbbtt.exe thhnhh.exe PID 1224 wrote to memory of 4876 1224 3tbbtt.exe thhnhh.exe PID 4876 wrote to memory of 2504 4876 thhnhh.exe jvvjj.exe PID 4876 wrote to memory of 2504 4876 thhnhh.exe jvvjj.exe PID 4876 wrote to memory of 2504 4876 thhnhh.exe jvvjj.exe PID 2504 wrote to memory of 3296 2504 jvvjj.exe xllxxff.exe PID 2504 wrote to memory of 3296 2504 jvvjj.exe xllxxff.exe PID 2504 wrote to memory of 3296 2504 jvvjj.exe xllxxff.exe PID 3296 wrote to memory of 4360 3296 xllxxff.exe thbtnt.exe PID 3296 wrote to memory of 4360 3296 xllxxff.exe thbtnt.exe PID 3296 wrote to memory of 4360 3296 xllxxff.exe thbtnt.exe PID 4360 wrote to memory of 3708 4360 thbtnt.exe hhhbtt.exe PID 4360 wrote to memory of 3708 4360 thbtnt.exe hhhbtt.exe PID 4360 wrote to memory of 3708 4360 thbtnt.exe hhhbtt.exe PID 3708 wrote to memory of 2388 3708 hhhbtt.exe ddddp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c035b3b7df743cc179f723060852c524ad0fd1c2eb594d0dc033860b2578060.exe"C:\Users\Admin\AppData\Local\Temp\6c035b3b7df743cc179f723060852c524ad0fd1c2eb594d0dc033860b2578060.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\nntbbn.exec:\nntbbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\pjdvp.exec:\pjdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\vpjpj.exec:\vpjpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\xxfffll.exec:\xxfffll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\flxfffx.exec:\flxfffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\tbhhhn.exec:\tbhhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\jdvvv.exec:\jdvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\xxrrflf.exec:\xxrrflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\nhbbtt.exec:\nhbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\vpddd.exec:\vpddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\dvddv.exec:\dvddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\tthbhn.exec:\tthbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\bhbbtt.exec:\bhbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\vvjdj.exec:\vvjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\rllrlll.exec:\rllrlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\3tbbtt.exec:\3tbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\thhnhh.exec:\thhnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\jvvjj.exec:\jvvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xllxxff.exec:\xllxxff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\thbtnt.exec:\thbtnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\hhhbtt.exec:\hhhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\ddddp.exec:\ddddp.exe23⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xrxxxxr.exec:\xrxxxxr.exe24⤵
- Executes dropped EXE
PID:5060 -
\??\c:\tbbbtt.exec:\tbbbtt.exe25⤵
- Executes dropped EXE
PID:4428 -
\??\c:\ddpjv.exec:\ddpjv.exe26⤵
- Executes dropped EXE
PID:3440 -
\??\c:\pddjj.exec:\pddjj.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\fflxxxx.exec:\fflxxxx.exe28⤵
- Executes dropped EXE
PID:1092 -
\??\c:\fxlflll.exec:\fxlflll.exe29⤵
- Executes dropped EXE
PID:4060 -
\??\c:\tbbtbb.exec:\tbbtbb.exe30⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5ppjv.exec:\5ppjv.exe31⤵
- Executes dropped EXE
PID:4632 -
\??\c:\5xxrrxr.exec:\5xxrrxr.exe32⤵
- Executes dropped EXE
PID:3716 -
\??\c:\rlffxxr.exec:\rlffxxr.exe33⤵
- Executes dropped EXE
PID:3232 -
\??\c:\nbtnhb.exec:\nbtnhb.exe34⤵
- Executes dropped EXE
PID:5020 -
\??\c:\3vjdj.exec:\3vjdj.exe35⤵
- Executes dropped EXE
PID:220 -
\??\c:\ppjjd.exec:\ppjjd.exe36⤵
- Executes dropped EXE
PID:2684 -
\??\c:\3fxrfrr.exec:\3fxrfrr.exe37⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fxrlffx.exec:\fxrlffx.exe38⤵
- Executes dropped EXE
PID:4412 -
\??\c:\nhnnhh.exec:\nhnnhh.exe39⤵
- Executes dropped EXE
PID:4024 -
\??\c:\1bbbtt.exec:\1bbbtt.exe40⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vppjd.exec:\vppjd.exe41⤵
- Executes dropped EXE
PID:3088 -
\??\c:\3ppjd.exec:\3ppjd.exe42⤵
- Executes dropped EXE
PID:4204 -
\??\c:\lxllxrr.exec:\lxllxrr.exe43⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xxrrxrl.exec:\xxrrxrl.exe44⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nhhbtn.exec:\nhhbtn.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hbhbtn.exec:\hbhbtn.exe46⤵
- Executes dropped EXE
PID:4240 -
\??\c:\5vvpj.exec:\5vvpj.exe47⤵
- Executes dropped EXE
PID:5004 -
\??\c:\xflxfrx.exec:\xflxfrx.exe48⤵
- Executes dropped EXE
PID:4676 -
\??\c:\1ffxrxr.exec:\1ffxrxr.exe49⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hbhhhh.exec:\hbhhhh.exe50⤵
- Executes dropped EXE
PID:464 -
\??\c:\1pvpd.exec:\1pvpd.exe51⤵
- Executes dropped EXE
PID:3292 -
\??\c:\pdjjp.exec:\pdjjp.exe52⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3lxrllf.exec:\3lxrllf.exe53⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rrfflxl.exec:\rrfflxl.exe54⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bnhbbt.exec:\bnhbbt.exe55⤵
- Executes dropped EXE
PID:1868 -
\??\c:\hntbhb.exec:\hntbhb.exe56⤵
- Executes dropped EXE
PID:3364 -
\??\c:\9pjdv.exec:\9pjdv.exe57⤵
- Executes dropped EXE
PID:3180 -
\??\c:\dvddd.exec:\dvddd.exe58⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fxlxrlf.exec:\fxlxrlf.exe59⤵
- Executes dropped EXE
PID:2720 -
\??\c:\htthbb.exec:\htthbb.exe60⤵
- Executes dropped EXE
PID:3684 -
\??\c:\nnhtnh.exec:\nnhtnh.exe61⤵
- Executes dropped EXE
PID:4996 -
\??\c:\ddpjp.exec:\ddpjp.exe62⤵
- Executes dropped EXE
PID:4844 -
\??\c:\lxllffx.exec:\lxllffx.exe63⤵
- Executes dropped EXE
PID:1064 -
\??\c:\fxffllr.exec:\fxffllr.exe64⤵
- Executes dropped EXE
PID:3116 -
\??\c:\7bttnh.exec:\7bttnh.exe65⤵
- Executes dropped EXE
PID:2612 -
\??\c:\thtnnn.exec:\thtnnn.exe66⤵PID:3296
-
\??\c:\5nhtnn.exec:\5nhtnn.exe67⤵PID:1920
-
\??\c:\vpvpj.exec:\vpvpj.exe68⤵PID:3096
-
\??\c:\jddpj.exec:\jddpj.exe69⤵PID:2848
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe70⤵PID:3060
-
\??\c:\7xffflf.exec:\7xffflf.exe71⤵PID:3164
-
\??\c:\lffxxxr.exec:\lffxxxr.exe72⤵PID:916
-
\??\c:\tnhbtn.exec:\tnhbtn.exe73⤵PID:4400
-
\??\c:\7dpjj.exec:\7dpjj.exe74⤵PID:5108
-
\??\c:\3jpjv.exec:\3jpjv.exe75⤵PID:1136
-
\??\c:\xfllfxx.exec:\xfllfxx.exe76⤵PID:3572
-
\??\c:\1lffxrr.exec:\1lffxrr.exe77⤵PID:2676
-
\??\c:\hbhbtn.exec:\hbhbtn.exe78⤵PID:2088
-
\??\c:\9nnbbt.exec:\9nnbbt.exe79⤵PID:4628
-
\??\c:\ddvpd.exec:\ddvpd.exe80⤵PID:3636
-
\??\c:\vvppd.exec:\vvppd.exe81⤵PID:4196
-
\??\c:\frxlxxf.exec:\frxlxxf.exe82⤵PID:1132
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe83⤵PID:3232
-
\??\c:\7hnnnn.exec:\7hnnnn.exe84⤵PID:1384
-
\??\c:\nhbtnn.exec:\nhbtnn.exe85⤵PID:220
-
\??\c:\7jpjd.exec:\7jpjd.exe86⤵PID:4392
-
\??\c:\fxrrlfx.exec:\fxrrlfx.exe87⤵PID:4564
-
\??\c:\llxfrlf.exec:\llxfrlf.exe88⤵PID:5076
-
\??\c:\nhbtnh.exec:\nhbtnh.exe89⤵PID:4140
-
\??\c:\btbttn.exec:\btbttn.exe90⤵PID:4960
-
\??\c:\vvvjv.exec:\vvvjv.exe91⤵PID:3188
-
\??\c:\fllfxrr.exec:\fllfxrr.exe92⤵PID:1720
-
\??\c:\hhbtnn.exec:\hhbtnn.exe93⤵PID:4892
-
\??\c:\ttbnth.exec:\ttbnth.exe94⤵PID:1540
-
\??\c:\1djdd.exec:\1djdd.exe95⤵PID:4144
-
\??\c:\pddjv.exec:\pddjv.exe96⤵PID:4612
-
\??\c:\rlfllfr.exec:\rlfllfr.exe97⤵PID:5004
-
\??\c:\lrlrrll.exec:\lrlrrll.exe98⤵PID:3012
-
\??\c:\nhhhbh.exec:\nhhhbh.exe99⤵PID:2100
-
\??\c:\3tthnn.exec:\3tthnn.exe100⤵PID:316
-
\??\c:\pddjv.exec:\pddjv.exe101⤵PID:2116
-
\??\c:\xrrfrff.exec:\xrrfrff.exe102⤵PID:388
-
\??\c:\nthhbb.exec:\nthhbb.exe103⤵PID:4740
-
\??\c:\tbnthb.exec:\tbnthb.exe104⤵PID:2860
-
\??\c:\jpvpd.exec:\jpvpd.exe105⤵PID:3604
-
\??\c:\dvjpv.exec:\dvjpv.exe106⤵PID:4284
-
\??\c:\7fffxlf.exec:\7fffxlf.exe107⤵PID:2468
-
\??\c:\1ffffll.exec:\1ffffll.exe108⤵PID:1128
-
\??\c:\bbhnhh.exec:\bbhnhh.exe109⤵PID:4184
-
\??\c:\nhhhbb.exec:\nhhhbb.exe110⤵PID:2740
-
\??\c:\dvpjd.exec:\dvpjd.exe111⤵PID:4836
-
\??\c:\jvpvp.exec:\jvpvp.exe112⤵PID:1556
-
\??\c:\frrrllf.exec:\frrrllf.exe113⤵PID:2504
-
\??\c:\lfrrlll.exec:\lfrrlll.exe114⤵PID:3416
-
\??\c:\3nnhbb.exec:\3nnhbb.exe115⤵PID:2424
-
\??\c:\nthhhh.exec:\nthhhh.exe116⤵PID:4052
-
\??\c:\ppjvp.exec:\ppjvp.exe117⤵PID:1896
-
\??\c:\jpdpp.exec:\jpdpp.exe118⤵PID:2388
-
\??\c:\xlrrlll.exec:\xlrrlll.exe119⤵PID:4044
-
\??\c:\fxxrffl.exec:\fxxrffl.exe120⤵PID:3524
-
\??\c:\9nnhbb.exec:\9nnhbb.exe121⤵PID:712
-
\??\c:\bttnbb.exec:\bttnbb.exe122⤵PID:2744
-
\??\c:\vvppd.exec:\vvppd.exe123⤵PID:4004
-
\??\c:\1jpjd.exec:\1jpjd.exe124⤵PID:3932
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe125⤵PID:940
-
\??\c:\fllrxfr.exec:\fllrxfr.exe126⤵PID:4764
-
\??\c:\nnbbtt.exec:\nnbbtt.exe127⤵PID:1116
-
\??\c:\hthhth.exec:\hthhth.exe128⤵PID:448
-
\??\c:\vppvv.exec:\vppvv.exe129⤵PID:3792
-
\??\c:\ddjjp.exec:\ddjjp.exe130⤵PID:2376
-
\??\c:\xrrlffx.exec:\xrrlffx.exe131⤵PID:4772
-
\??\c:\frrfxrl.exec:\frrfxrl.exe132⤵PID:2244
-
\??\c:\nhnnbt.exec:\nhnnbt.exe133⤵PID:2524
-
\??\c:\hnnbth.exec:\hnnbth.exe134⤵PID:4040
-
\??\c:\pdvdd.exec:\pdvdd.exe135⤵PID:4392
-
\??\c:\9ppdv.exec:\9ppdv.exe136⤵PID:1040
-
\??\c:\llrxflr.exec:\llrxflr.exe137⤵PID:228
-
\??\c:\tnntnt.exec:\tnntnt.exe138⤵PID:4084
-
\??\c:\tbhbbb.exec:\tbhbbb.exe139⤵PID:1872
-
\??\c:\dppdp.exec:\dppdp.exe140⤵PID:3308
-
\??\c:\pvjdv.exec:\pvjdv.exe141⤵PID:4192
-
\??\c:\frlfxxl.exec:\frlfxxl.exe142⤵PID:3740
-
\??\c:\5flllrr.exec:\5flllrr.exe143⤵PID:3260
-
\??\c:\lrffxrl.exec:\lrffxrl.exe144⤵PID:2180
-
\??\c:\9fffxxr.exec:\9fffxxr.exe145⤵PID:4080
-
\??\c:\9nhbbt.exec:\9nhbbt.exe146⤵PID:3108
-
\??\c:\9btnbb.exec:\9btnbb.exe147⤵PID:3776
-
\??\c:\5pjvp.exec:\5pjvp.exe148⤵PID:3732
-
\??\c:\pdjvv.exec:\pdjvv.exe149⤵PID:1212
-
\??\c:\1ntnbb.exec:\1ntnbb.exe150⤵PID:1312
-
\??\c:\1tnhtn.exec:\1tnhtn.exe151⤵PID:4484
-
\??\c:\ppdvp.exec:\ppdvp.exe152⤵PID:1924
-
\??\c:\jvvjd.exec:\jvvjd.exe153⤵PID:2444
-
\??\c:\rlrlffr.exec:\rlrlffr.exe154⤵PID:3076
-
\??\c:\rffxrlx.exec:\rffxrlx.exe155⤵PID:1148
-
\??\c:\tntntt.exec:\tntntt.exe156⤵PID:1128
-
\??\c:\bthbtt.exec:\bthbtt.exe157⤵PID:4348
-
\??\c:\dpjdj.exec:\dpjdj.exe158⤵PID:4876
-
\??\c:\vdvdd.exec:\vdvdd.exe159⤵PID:1064
-
\??\c:\rxlllll.exec:\rxlllll.exe160⤵PID:32
-
\??\c:\lxrlxrr.exec:\lxrlxrr.exe161⤵PID:2504
-
\??\c:\tnttbt.exec:\tnttbt.exe162⤵PID:3296
-
\??\c:\ntnhth.exec:\ntnhth.exe163⤵PID:1920
-
\??\c:\1pjvp.exec:\1pjvp.exe164⤵PID:4052
-
\??\c:\1djvd.exec:\1djvd.exe165⤵PID:2260
-
\??\c:\dpdpd.exec:\dpdpd.exe166⤵PID:2388
-
\??\c:\lxlxrfx.exec:\lxlxrfx.exe167⤵PID:3440
-
\??\c:\frlfxxr.exec:\frlfxxr.exe168⤵PID:3524
-
\??\c:\5thbhh.exec:\5thbhh.exe169⤵PID:712
-
\??\c:\vdvdp.exec:\vdvdp.exe170⤵PID:2744
-
\??\c:\djddp.exec:\djddp.exe171⤵PID:4004
-
\??\c:\7pdpp.exec:\7pdpp.exe172⤵PID:3932
-
\??\c:\7xrfllf.exec:\7xrfllf.exe173⤵PID:940
-
\??\c:\flfxrrl.exec:\flfxrrl.exe174⤵PID:1280
-
\??\c:\7nhbnn.exec:\7nhbnn.exe175⤵PID:4628
-
\??\c:\1vvvp.exec:\1vvvp.exe176⤵PID:3936
-
\??\c:\dddvv.exec:\dddvv.exe177⤵PID:4196
-
\??\c:\fxlfxfr.exec:\fxlfxfr.exe178⤵PID:1132
-
\??\c:\9xxxrxr.exec:\9xxxrxr.exe179⤵PID:3232
-
\??\c:\5nbtnh.exec:\5nbtnh.exe180⤵PID:8
-
\??\c:\nhbbnt.exec:\nhbbnt.exe181⤵PID:220
-
\??\c:\pddvd.exec:\pddvd.exe182⤵PID:2160
-
\??\c:\dvpjv.exec:\dvpjv.exe183⤵PID:2484
-
\??\c:\fxrflfl.exec:\fxrflfl.exe184⤵PID:2844
-
\??\c:\xlrllxr.exec:\xlrllxr.exe185⤵PID:3088
-
\??\c:\hbtnhb.exec:\hbtnhb.exe186⤵PID:60
-
\??\c:\9hbhbt.exec:\9hbhbt.exe187⤵PID:3468
-
\??\c:\vpjdp.exec:\vpjdp.exe188⤵PID:2828
-
\??\c:\7ddjj.exec:\7ddjj.exe189⤵PID:4760
-
\??\c:\rlxlfrf.exec:\rlxlfrf.exe190⤵PID:3596
-
\??\c:\fflrllx.exec:\fflrllx.exe191⤵PID:4164
-
\??\c:\bnhbtn.exec:\bnhbtn.exe192⤵PID:4676
-
\??\c:\pppjd.exec:\pppjd.exe193⤵PID:4568
-
\??\c:\jjdvp.exec:\jjdvp.exe194⤵PID:3012
-
\??\c:\xxxxrlx.exec:\xxxxrlx.exe195⤵PID:2100
-
\??\c:\bntttb.exec:\bntttb.exe196⤵PID:1212
-
\??\c:\7thnnn.exec:\7thnnn.exe197⤵PID:1312
-
\??\c:\hhnnbn.exec:\hhnnbn.exe198⤵PID:3056
-
\??\c:\pvvvp.exec:\pvvvp.exe199⤵PID:4284
-
\??\c:\pppjp.exec:\pppjp.exe200⤵PID:3200
-
\??\c:\rxxxlrl.exec:\rxxxlrl.exe201⤵PID:4820
-
\??\c:\tttthb.exec:\tttthb.exe202⤵PID:4128
-
\??\c:\tbhhbb.exec:\tbhhbb.exe203⤵PID:4828
-
\??\c:\5jjdj.exec:\5jjdj.exe204⤵PID:5072
-
\??\c:\3vvjj.exec:\3vvjj.exe205⤵PID:2820
-
\??\c:\jdvpj.exec:\jdvpj.exe206⤵PID:888
-
\??\c:\7xrlffx.exec:\7xrlffx.exe207⤵PID:744
-
\??\c:\xxrrrff.exec:\xxrrrff.exe208⤵PID:3164
-
\??\c:\btnbbt.exec:\btnbbt.exe209⤵PID:2928
-
\??\c:\hbbbtt.exec:\hbbbtt.exe210⤵PID:856
-
\??\c:\jjdpp.exec:\jjdpp.exe211⤵PID:2872
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe212⤵PID:2216
-
\??\c:\nhhhhh.exec:\nhhhhh.exe213⤵PID:3380
-
\??\c:\jjppp.exec:\jjppp.exe214⤵PID:4048
-
\??\c:\hhtnnh.exec:\hhtnnh.exe215⤵PID:4792
-
\??\c:\hbbthh.exec:\hbbthh.exe216⤵PID:2984
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe217⤵PID:864
-
\??\c:\pjjjj.exec:\pjjjj.exe218⤵PID:4496
-
\??\c:\lrlrlfr.exec:\lrlrlfr.exe219⤵PID:2344
-
\??\c:\hnbnhb.exec:\hnbnhb.exe220⤵PID:2876
-
\??\c:\jjddp.exec:\jjddp.exe221⤵PID:2244
-
\??\c:\pdvjv.exec:\pdvjv.exe222⤵PID:1496
-
\??\c:\fflffxr.exec:\fflffxr.exe223⤵PID:4408
-
\??\c:\hthbtt.exec:\hthbtt.exe224⤵PID:5076
-
\??\c:\tbhnhh.exec:\tbhnhh.exe225⤵PID:4412
-
\??\c:\vpvpv.exec:\vpvpv.exe226⤵PID:1164
-
\??\c:\vjppj.exec:\vjppj.exe227⤵PID:4960
-
\??\c:\xrfrxlx.exec:\xrfrxlx.exe228⤵PID:3188
-
\??\c:\xffxrrf.exec:\xffxrrf.exe229⤵PID:1696
-
\??\c:\nbnhbt.exec:\nbnhbt.exe230⤵PID:2552
-
\??\c:\tnbtnn.exec:\tnbtnn.exe231⤵PID:2472
-
\??\c:\jddpj.exec:\jddpj.exe232⤵PID:2972
-
\??\c:\xxlxfxl.exec:\xxlxfxl.exe233⤵PID:4144
-
\??\c:\nhhbtn.exec:\nhhbtn.exe234⤵PID:2960
-
\??\c:\tbhnbh.exec:\tbhnbh.exe235⤵PID:2236
-
\??\c:\vvddv.exec:\vvddv.exe236⤵PID:2300
-
\??\c:\jdvvp.exec:\jdvvp.exe237⤵PID:3004
-
\??\c:\5xxxrrr.exec:\5xxxrrr.exe238⤵PID:4888
-
\??\c:\htnnhh.exec:\htnnhh.exe239⤵PID:2368
-
\??\c:\hhbntt.exec:\hhbntt.exe240⤵PID:3604
-
\??\c:\pjddv.exec:\pjddv.exe241⤵PID:1148
-
\??\c:\rlrrrxr.exec:\rlrrrxr.exe242⤵PID:3200