Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0938ddb998b765feaf5017821daa7d41169af2d257397de8156d557b058eadab.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0938ddb998b765feaf5017821daa7d41169af2d257397de8156d557b058eadab.exe
-
Size
55KB
-
MD5
c9bebe2d63ce5ba0e60bfb71ed34e673
-
SHA1
4a60cea2c515e9e2841e83347faa63925f2bc5b0
-
SHA256
0938ddb998b765feaf5017821daa7d41169af2d257397de8156d557b058eadab
-
SHA512
bb26fee5163e777875682c0f717bdd3eab3e45998af9a9de94db6d8343f31f2a7c79bdcbfc637fd535d239f23799d46ebc5a73bd5b19c719b59a7e555eabe2d2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFP:ymb3NkkiQ3mdBjFIFP
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/2400-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-33-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
Processes:
resource yara_rule behavioral2/memory/2400-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/452-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1432-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1848-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4580-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4676-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3536-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3536-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3536-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3536-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1896-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3528-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3272-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4836-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3216-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1608-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5040-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4552-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5028-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5024-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4992-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4704-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2084-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3060-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
ntbnht.exebbbthb.exejjjpv.exepjvdp.exe9rlxlff.exebnnbtn.exehtbthh.exe1ppjp.exe3jjpv.exelxrfrxr.exelxxxlfx.exetbbthn.exevddvj.exevddpd.exerxlfxxr.exelxxxxrr.exe5hhthb.exenbbtnh.exejdpdj.exe1vpdp.exefrlxfxr.exe1xrrrrl.exethtnhb.exejvppj.exe1dpdp.exerflxrfx.exenntnnh.exe5pvjd.exe1vvjv.exeffxlrrl.exehhtnnt.exenbtnbn.exedvpjp.exepdjdp.exelxrfrlf.exefxxrfxr.exebnhbnh.exehtnnth.exe1vjvj.exevpvpj.exerrfffff.exe7nnhtt.exebttnhh.exepjdvp.exerlfxxxf.exehbnnnn.exeththbt.exeppjjj.exe3vjdp.exexffxrxx.exexrrlllx.exe7btbtb.exevvjdp.exevjpjd.exe7lllxxx.exelfxxrrr.exe3ntnhh.exe9nhbtn.exe5dppd.exe9pvvp.exelffxrll.exelrxrrrr.exe1nbbnn.exebnbthn.exepid process 452 ntbnht.exe 1432 bbbthb.exe 1848 jjjpv.exe 4580 pjvdp.exe 4676 9rlxlff.exe 408 bnnbtn.exe 3536 htbthh.exe 1896 1ppjp.exe 3272 3jjpv.exe 3528 lxrfrxr.exe 2504 lxxxlfx.exe 4836 tbbthn.exe 4020 vddvj.exe 3216 vddpd.exe 1608 rxlfxxr.exe 5040 lxxxxrr.exe 4552 5hhthb.exe 5028 nbbtnh.exe 4980 jdpdj.exe 5024 1vpdp.exe 724 frlxfxr.exe 4012 1xrrrrl.exe 4992 thtnhb.exe 3644 jvppj.exe 3392 1dpdp.exe 2868 rflxrfx.exe 4704 nntnnh.exe 4060 5pvjd.exe 2084 1vvjv.exe 1116 ffxlrrl.exe 3060 hhtnnt.exe 1092 nbtnbn.exe 4600 dvpjp.exe 524 pdjdp.exe 3888 lxrfrlf.exe 3280 fxxrfxr.exe 5000 bnhbnh.exe 1128 htnnth.exe 1764 1vjvj.exe 2248 vpvpj.exe 4596 rrfffff.exe 1848 7nnhtt.exe 952 bttnhh.exe 1372 pjdvp.exe 2620 rlfxxxf.exe 392 hbnnnn.exe 5060 ththbt.exe 1660 ppjjj.exe 4660 3vjdp.exe 3128 xffxrxx.exe 2424 xrrlllx.exe 3772 7btbtb.exe 4836 vvjdp.exe 4792 vjpjd.exe 2408 7lllxxx.exe 1428 lfxxrrr.exe 1964 3ntnhh.exe 1204 9nhbtn.exe 4552 5dppd.exe 4352 9pvvp.exe 4320 lffxrll.exe 4560 lrxrrrr.exe 424 1nbbnn.exe 3372 bnbthn.exe -
Processes:
resource yara_rule behavioral2/memory/2400-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0938ddb998b765feaf5017821daa7d41169af2d257397de8156d557b058eadab.exentbnht.exebbbthb.exejjjpv.exepjvdp.exe9rlxlff.exebnnbtn.exehtbthh.exe1ppjp.exe3jjpv.exelxrfrxr.exelxxxlfx.exetbbthn.exevddvj.exevddpd.exerxlfxxr.exelxxxxrr.exe5hhthb.exenbbtnh.exejdpdj.exe1vpdp.exefrlxfxr.exedescription pid process target process PID 2400 wrote to memory of 452 2400 0938ddb998b765feaf5017821daa7d41169af2d257397de8156d557b058eadab.exe ntbnht.exe PID 2400 wrote to memory of 452 2400 0938ddb998b765feaf5017821daa7d41169af2d257397de8156d557b058eadab.exe ntbnht.exe PID 2400 wrote to memory of 452 2400 0938ddb998b765feaf5017821daa7d41169af2d257397de8156d557b058eadab.exe ntbnht.exe PID 452 wrote to memory of 1432 452 ntbnht.exe bbbthb.exe PID 452 wrote to memory of 1432 452 ntbnht.exe bbbthb.exe PID 452 wrote to memory of 1432 452 ntbnht.exe bbbthb.exe PID 1432 wrote to memory of 1848 1432 bbbthb.exe jjjpv.exe PID 1432 wrote to memory of 1848 1432 bbbthb.exe jjjpv.exe PID 1432 wrote to memory of 1848 1432 bbbthb.exe jjjpv.exe PID 1848 wrote to memory of 4580 1848 jjjpv.exe pjvdp.exe PID 1848 wrote to memory of 4580 1848 jjjpv.exe pjvdp.exe PID 1848 wrote to memory of 4580 1848 jjjpv.exe pjvdp.exe PID 4580 wrote to memory of 4676 4580 pjvdp.exe 9rlxlff.exe PID 4580 wrote to memory of 4676 4580 pjvdp.exe 9rlxlff.exe PID 4580 wrote to memory of 4676 4580 pjvdp.exe 9rlxlff.exe PID 4676 wrote to memory of 408 4676 9rlxlff.exe bnnbtn.exe PID 4676 wrote to memory of 408 4676 9rlxlff.exe bnnbtn.exe PID 4676 wrote to memory of 408 4676 9rlxlff.exe bnnbtn.exe PID 408 wrote to memory of 3536 408 bnnbtn.exe htbthh.exe PID 408 wrote to memory of 3536 408 bnnbtn.exe htbthh.exe PID 408 wrote to memory of 3536 408 bnnbtn.exe htbthh.exe PID 3536 wrote to memory of 1896 3536 htbthh.exe 1ppjp.exe PID 3536 wrote to memory of 1896 3536 htbthh.exe 1ppjp.exe PID 3536 wrote to memory of 1896 3536 htbthh.exe 1ppjp.exe PID 1896 wrote to memory of 3272 1896 1ppjp.exe 3jjpv.exe PID 1896 wrote to memory of 3272 1896 1ppjp.exe 3jjpv.exe PID 1896 wrote to memory of 3272 1896 1ppjp.exe 3jjpv.exe PID 3272 wrote to memory of 3528 3272 3jjpv.exe lxrfrxr.exe PID 3272 wrote to memory of 3528 3272 3jjpv.exe lxrfrxr.exe PID 3272 wrote to memory of 3528 3272 3jjpv.exe lxrfrxr.exe PID 3528 wrote to memory of 2504 3528 lxrfrxr.exe lxxxlfx.exe PID 3528 wrote to memory of 2504 3528 lxrfrxr.exe lxxxlfx.exe PID 3528 wrote to memory of 2504 3528 lxrfrxr.exe lxxxlfx.exe PID 2504 wrote to memory of 4836 2504 lxxxlfx.exe tbbthn.exe PID 2504 wrote to memory of 4836 2504 lxxxlfx.exe tbbthn.exe PID 2504 wrote to memory of 4836 2504 lxxxlfx.exe tbbthn.exe PID 4836 wrote to memory of 4020 4836 tbbthn.exe vddvj.exe PID 4836 wrote to memory of 4020 4836 tbbthn.exe vddvj.exe PID 4836 wrote to memory of 4020 4836 tbbthn.exe vddvj.exe PID 4020 wrote to memory of 3216 4020 vddvj.exe vddpd.exe PID 4020 wrote to memory of 3216 4020 vddvj.exe vddpd.exe PID 4020 wrote to memory of 3216 4020 vddvj.exe vddpd.exe PID 3216 wrote to memory of 1608 3216 vddpd.exe rxlfxxr.exe PID 3216 wrote to memory of 1608 3216 vddpd.exe rxlfxxr.exe PID 3216 wrote to memory of 1608 3216 vddpd.exe rxlfxxr.exe PID 1608 wrote to memory of 5040 1608 rxlfxxr.exe lxxxxrr.exe PID 1608 wrote to memory of 5040 1608 rxlfxxr.exe lxxxxrr.exe PID 1608 wrote to memory of 5040 1608 rxlfxxr.exe lxxxxrr.exe PID 5040 wrote to memory of 4552 5040 lxxxxrr.exe 5hhthb.exe PID 5040 wrote to memory of 4552 5040 lxxxxrr.exe 5hhthb.exe PID 5040 wrote to memory of 4552 5040 lxxxxrr.exe 5hhthb.exe PID 4552 wrote to memory of 5028 4552 5hhthb.exe nbbtnh.exe PID 4552 wrote to memory of 5028 4552 5hhthb.exe nbbtnh.exe PID 4552 wrote to memory of 5028 4552 5hhthb.exe nbbtnh.exe PID 5028 wrote to memory of 4980 5028 nbbtnh.exe jdpdj.exe PID 5028 wrote to memory of 4980 5028 nbbtnh.exe jdpdj.exe PID 5028 wrote to memory of 4980 5028 nbbtnh.exe jdpdj.exe PID 4980 wrote to memory of 5024 4980 jdpdj.exe 1vpdp.exe PID 4980 wrote to memory of 5024 4980 jdpdj.exe 1vpdp.exe PID 4980 wrote to memory of 5024 4980 jdpdj.exe 1vpdp.exe PID 5024 wrote to memory of 724 5024 1vpdp.exe frlxfxr.exe PID 5024 wrote to memory of 724 5024 1vpdp.exe frlxfxr.exe PID 5024 wrote to memory of 724 5024 1vpdp.exe frlxfxr.exe PID 724 wrote to memory of 4012 724 frlxfxr.exe 1xrrrrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0938ddb998b765feaf5017821daa7d41169af2d257397de8156d557b058eadab.exe"C:\Users\Admin\AppData\Local\Temp\0938ddb998b765feaf5017821daa7d41169af2d257397de8156d557b058eadab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\ntbnht.exec:\ntbnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\bbbthb.exec:\bbbthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\jjjpv.exec:\jjjpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\pjvdp.exec:\pjvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\9rlxlff.exec:\9rlxlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\bnnbtn.exec:\bnnbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\htbthh.exec:\htbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\1ppjp.exec:\1ppjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\3jjpv.exec:\3jjpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\lxrfrxr.exec:\lxrfrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\lxxxlfx.exec:\lxxxlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\tbbthn.exec:\tbbthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\vddvj.exec:\vddvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\vddpd.exec:\vddpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\lxxxxrr.exec:\lxxxxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\5hhthb.exec:\5hhthb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\nbbtnh.exec:\nbbtnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\jdpdj.exec:\jdpdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\1vpdp.exec:\1vpdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\frlxfxr.exec:\frlxfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\1xrrrrl.exec:\1xrrrrl.exe23⤵
- Executes dropped EXE
PID:4012 -
\??\c:\thtnhb.exec:\thtnhb.exe24⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jvppj.exec:\jvppj.exe25⤵
- Executes dropped EXE
PID:3644 -
\??\c:\1dpdp.exec:\1dpdp.exe26⤵
- Executes dropped EXE
PID:3392 -
\??\c:\rflxrfx.exec:\rflxrfx.exe27⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nntnnh.exec:\nntnnh.exe28⤵
- Executes dropped EXE
PID:4704 -
\??\c:\5pvjd.exec:\5pvjd.exe29⤵
- Executes dropped EXE
PID:4060 -
\??\c:\1vvjv.exec:\1vvjv.exe30⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ffxlrrl.exec:\ffxlrrl.exe31⤵
- Executes dropped EXE
PID:1116 -
\??\c:\hhtnnt.exec:\hhtnnt.exe32⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nbtnbn.exec:\nbtnbn.exe33⤵
- Executes dropped EXE
PID:1092 -
\??\c:\dvpjp.exec:\dvpjp.exe34⤵
- Executes dropped EXE
PID:4600 -
\??\c:\pdjdp.exec:\pdjdp.exe35⤵
- Executes dropped EXE
PID:524 -
\??\c:\lxrfrlf.exec:\lxrfrlf.exe36⤵
- Executes dropped EXE
PID:3888 -
\??\c:\fxxrfxr.exec:\fxxrfxr.exe37⤵
- Executes dropped EXE
PID:3280 -
\??\c:\bnhbnh.exec:\bnhbnh.exe38⤵
- Executes dropped EXE
PID:5000 -
\??\c:\htnnth.exec:\htnnth.exe39⤵
- Executes dropped EXE
PID:1128 -
\??\c:\1vjvj.exec:\1vjvj.exe40⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vpvpj.exec:\vpvpj.exe41⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rrfffff.exec:\rrfffff.exe42⤵
- Executes dropped EXE
PID:4596 -
\??\c:\7nnhtt.exec:\7nnhtt.exe43⤵
- Executes dropped EXE
PID:1848 -
\??\c:\bttnhh.exec:\bttnhh.exe44⤵
- Executes dropped EXE
PID:952 -
\??\c:\pjdvp.exec:\pjdvp.exe45⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rlfxxxf.exec:\rlfxxxf.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\hbnnnn.exec:\hbnnnn.exe47⤵
- Executes dropped EXE
PID:392 -
\??\c:\ththbt.exec:\ththbt.exe48⤵
- Executes dropped EXE
PID:5060 -
\??\c:\ppjjj.exec:\ppjjj.exe49⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3vjdp.exec:\3vjdp.exe50⤵
- Executes dropped EXE
PID:4660 -
\??\c:\xffxrxx.exec:\xffxrxx.exe51⤵
- Executes dropped EXE
PID:3128 -
\??\c:\xrrlllx.exec:\xrrlllx.exe52⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7btbtb.exec:\7btbtb.exe53⤵
- Executes dropped EXE
PID:3772 -
\??\c:\vvjdp.exec:\vvjdp.exe54⤵
- Executes dropped EXE
PID:4836 -
\??\c:\vjpjd.exec:\vjpjd.exe55⤵
- Executes dropped EXE
PID:4792 -
\??\c:\7lllxxx.exec:\7lllxxx.exe56⤵
- Executes dropped EXE
PID:2408 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe57⤵
- Executes dropped EXE
PID:1428 -
\??\c:\3ntnhh.exec:\3ntnhh.exe58⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9nhbtn.exec:\9nhbtn.exe59⤵
- Executes dropped EXE
PID:1204 -
\??\c:\5dppd.exec:\5dppd.exe60⤵
- Executes dropped EXE
PID:4552 -
\??\c:\9pvvp.exec:\9pvvp.exe61⤵
- Executes dropped EXE
PID:4352 -
\??\c:\lffxrll.exec:\lffxrll.exe62⤵
- Executes dropped EXE
PID:4320 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe63⤵
- Executes dropped EXE
PID:4560 -
\??\c:\1nbbnn.exec:\1nbbnn.exe64⤵
- Executes dropped EXE
PID:424 -
\??\c:\bnbthn.exec:\bnbthn.exe65⤵
- Executes dropped EXE
PID:3372 -
\??\c:\vvjjd.exec:\vvjjd.exe66⤵PID:1284
-
\??\c:\vdjdd.exec:\vdjdd.exe67⤵PID:3996
-
\??\c:\3rfxrrl.exec:\3rfxrrl.exe68⤵PID:4992
-
\??\c:\lxlllll.exec:\lxlllll.exe69⤵PID:4336
-
\??\c:\9bhbtt.exec:\9bhbtt.exe70⤵PID:1520
-
\??\c:\nhtnhn.exec:\nhtnhn.exe71⤵PID:1796
-
\??\c:\vjdvp.exec:\vjdvp.exe72⤵PID:4488
-
\??\c:\pvjdv.exec:\pvjdv.exe73⤵PID:4704
-
\??\c:\flxrlfx.exec:\flxrlfx.exe74⤵PID:2496
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe75⤵PID:4808
-
\??\c:\ttnhth.exec:\ttnhth.exe76⤵PID:3200
-
\??\c:\5bbnbb.exec:\5bbnbb.exe77⤵PID:2188
-
\??\c:\vpjvp.exec:\vpjvp.exe78⤵PID:4332
-
\??\c:\7dvjd.exec:\7dvjd.exe79⤵PID:5100
-
\??\c:\frlxlll.exec:\frlxlll.exe80⤵PID:4600
-
\??\c:\5tthbt.exec:\5tthbt.exe81⤵PID:4312
-
\??\c:\bthbbt.exec:\bthbbt.exe82⤵PID:4976
-
\??\c:\jvddd.exec:\jvddd.exe83⤵PID:4284
-
\??\c:\dpjvj.exec:\dpjvj.exe84⤵PID:3104
-
\??\c:\5xrfrrl.exec:\5xrfrrl.exe85⤵PID:3432
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe86⤵PID:1716
-
\??\c:\tbnthn.exec:\tbnthn.exe87⤵PID:1004
-
\??\c:\9tnbnh.exec:\9tnbnh.exe88⤵PID:4844
-
\??\c:\jvppj.exec:\jvppj.exe89⤵PID:3504
-
\??\c:\7vvpv.exec:\7vvpv.exe90⤵PID:1080
-
\??\c:\xlxrfxr.exec:\xlxrfxr.exe91⤵PID:2416
-
\??\c:\rlrllfl.exec:\rlrllfl.exe92⤵PID:1372
-
\??\c:\hhbtnh.exec:\hhbtnh.exe93⤵PID:2620
-
\??\c:\tnnbnh.exec:\tnnbnh.exe94⤵PID:392
-
\??\c:\1dpjd.exec:\1dpjd.exe95⤵PID:2276
-
\??\c:\vddpd.exec:\vddpd.exe96⤵PID:5012
-
\??\c:\xllxrlx.exec:\xllxrlx.exe97⤵PID:1868
-
\??\c:\9lxfrlx.exec:\9lxfrlx.exe98⤵PID:2856
-
\??\c:\1hbthb.exec:\1hbthb.exe99⤵PID:4064
-
\??\c:\jjdvj.exec:\jjdvj.exe100⤵PID:2044
-
\??\c:\xlfrlfx.exec:\xlfrlfx.exe101⤵PID:4020
-
\??\c:\5btthb.exec:\5btthb.exe102⤵PID:1412
-
\??\c:\5jvpv.exec:\5jvpv.exe103⤵PID:2492
-
\??\c:\vvdpd.exec:\vvdpd.exe104⤵PID:5040
-
\??\c:\1lrflfr.exec:\1lrflfr.exe105⤵PID:1936
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe106⤵PID:3716
-
\??\c:\vppjd.exec:\vppjd.exe107⤵PID:3064
-
\??\c:\vddpd.exec:\vddpd.exe108⤵PID:1384
-
\??\c:\llrrffr.exec:\llrrffr.exe109⤵PID:1992
-
\??\c:\3hbbhh.exec:\3hbbhh.exe110⤵PID:2720
-
\??\c:\btnbtt.exec:\btnbtt.exe111⤵PID:724
-
\??\c:\ppjvj.exec:\ppjvj.exe112⤵PID:4912
-
\??\c:\lflfxrr.exec:\lflfxrr.exe113⤵PID:764
-
\??\c:\3ffrfxx.exec:\3ffrfxx.exe114⤵PID:1208
-
\??\c:\hntbhb.exec:\hntbhb.exe115⤵PID:988
-
\??\c:\1vpjv.exec:\1vpjv.exe116⤵PID:3960
-
\??\c:\ppjvj.exec:\ppjvj.exe117⤵PID:2652
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe118⤵PID:4812
-
\??\c:\lrxlxrf.exec:\lrxlxrf.exe119⤵PID:3988
-
\??\c:\bthhtn.exec:\bthhtn.exe120⤵PID:1020
-
\??\c:\nhbtht.exec:\nhbtht.exe121⤵PID:3252
-
\??\c:\jdpjv.exec:\jdpjv.exe122⤵PID:3852
-
\??\c:\9pjdp.exec:\9pjdp.exe123⤵PID:4140
-
\??\c:\5llflxr.exec:\5llflxr.exe124⤵PID:4544
-
\??\c:\xfrlfxl.exec:\xfrlfxl.exe125⤵PID:1988
-
\??\c:\nhthnb.exec:\nhthnb.exe126⤵PID:4292
-
\??\c:\dddvd.exec:\dddvd.exe127⤵PID:4564
-
\??\c:\vjjdv.exec:\vjjdv.exe128⤵PID:4228
-
\??\c:\frrrrrf.exec:\frrrrrf.exe129⤵PID:2608
-
\??\c:\3rrlrll.exec:\3rrlrll.exe130⤵PID:1128
-
\??\c:\hnbttn.exec:\hnbttn.exe131⤵PID:4696
-
\??\c:\vjvpd.exec:\vjvpd.exe132⤵PID:3524
-
\??\c:\jdvjd.exec:\jdvjd.exe133⤵PID:4440
-
\??\c:\xlffrrf.exec:\xlffrrf.exe134⤵PID:1704
-
\??\c:\rlrfrlx.exec:\rlrfrlx.exe135⤵PID:1300
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe136⤵PID:3184
-
\??\c:\nbnbtn.exec:\nbnbtn.exe137⤵PID:3708
-
\??\c:\dpdpp.exec:\dpdpp.exe138⤵PID:1708
-
\??\c:\jvvvj.exec:\jvvvj.exe139⤵PID:4536
-
\??\c:\pppdp.exec:\pppdp.exe140⤵PID:4244
-
\??\c:\fllxrlf.exec:\fllxrlf.exe141⤵PID:3236
-
\??\c:\xrrllff.exec:\xrrllff.exe142⤵PID:1480
-
\??\c:\thnnnt.exec:\thnnnt.exe143⤵PID:3144
-
\??\c:\jjjdj.exec:\jjjdj.exe144⤵PID:1700
-
\??\c:\dddvj.exec:\dddvj.exe145⤵PID:3268
-
\??\c:\rllxlfx.exec:\rllxlfx.exe146⤵PID:1428
-
\??\c:\llrfrlr.exec:\llrfrlr.exe147⤵PID:4608
-
\??\c:\htbhnb.exec:\htbhnb.exe148⤵PID:4712
-
\??\c:\tbbnhb.exec:\tbbnhb.exe149⤵PID:1768
-
\??\c:\jvdvv.exec:\jvdvv.exe150⤵PID:3716
-
\??\c:\jjjvd.exec:\jjjvd.exe151⤵PID:3064
-
\??\c:\5vpdp.exec:\5vpdp.exe152⤵PID:3208
-
\??\c:\vjvpd.exec:\vjvpd.exe153⤵PID:2820
-
\??\c:\5llflxr.exec:\5llflxr.exe154⤵PID:2720
-
\??\c:\lflxrlx.exec:\lflxrlx.exe155⤵PID:4160
-
\??\c:\bbnntn.exec:\bbnntn.exe156⤵PID:3992
-
\??\c:\hbntbb.exec:\hbntbb.exe157⤵PID:1520
-
\??\c:\vppjp.exec:\vppjp.exe158⤵PID:1796
-
\??\c:\pvdpv.exec:\pvdpv.exe159⤵PID:4060
-
\??\c:\lxrxxll.exec:\lxrxxll.exe160⤵PID:4680
-
\??\c:\3frlfxr.exec:\3frlfxr.exe161⤵PID:4804
-
\??\c:\llfrlfx.exec:\llfrlfx.exe162⤵PID:4756
-
\??\c:\nnnhbt.exec:\nnnhbt.exe163⤵PID:4332
-
\??\c:\ttbnhb.exec:\ttbnhb.exe164⤵PID:444
-
\??\c:\jvdvd.exec:\jvdvd.exe165⤵PID:1352
-
\??\c:\jddjp.exec:\jddjp.exe166⤵PID:1628
-
\??\c:\rxfflll.exec:\rxfflll.exe167⤵PID:5000
-
\??\c:\3rrlxrf.exec:\3rrlxrf.exe168⤵PID:4200
-
\??\c:\bnbnbt.exec:\bnbnbt.exe169⤵PID:1764
-
\??\c:\nhbtbt.exec:\nhbtbt.exe170⤵PID:4696
-
\??\c:\vvpdv.exec:\vvpdv.exe171⤵PID:4904
-
\??\c:\vdvpd.exec:\vdvpd.exe172⤵PID:4676
-
\??\c:\lfrfrrl.exec:\lfrfrrl.exe173⤵PID:4824
-
\??\c:\rlffrll.exec:\rlffrll.exe174⤵PID:1300
-
\??\c:\htnbbt.exec:\htnbbt.exe175⤵PID:4880
-
\??\c:\nbbnth.exec:\nbbnth.exe176⤵PID:2072
-
\??\c:\9bthnh.exec:\9bthnh.exe177⤵PID:4516
-
\??\c:\vddvd.exec:\vddvd.exe178⤵PID:4664
-
\??\c:\1jjdj.exec:\1jjdj.exe179⤵PID:4360
-
\??\c:\xxfrlfx.exec:\xxfrlfx.exe180⤵PID:3356
-
\??\c:\xlrlflx.exec:\xlrlflx.exe181⤵PID:3772
-
\??\c:\1nhthh.exec:\1nhthh.exe182⤵PID:2044
-
\??\c:\7pjvv.exec:\7pjvv.exe183⤵PID:4084
-
\??\c:\fxxrfxl.exec:\fxxrfxl.exe184⤵PID:508
-
\??\c:\xlrllff.exec:\xlrllff.exe185⤵PID:5040
-
\??\c:\nhtnbt.exec:\nhtnbt.exe186⤵PID:4444
-
\??\c:\3hbbhh.exec:\3hbbhh.exe187⤵PID:3700
-
\??\c:\jvpdv.exec:\jvpdv.exe188⤵PID:1380
-
\??\c:\jvpdp.exec:\jvpdp.exe189⤵PID:1384
-
\??\c:\3xfrfxr.exec:\3xfrfxr.exe190⤵PID:1348
-
\??\c:\xfrxxxf.exec:\xfrxxxf.exe191⤵PID:2840
-
\??\c:\5hhbth.exec:\5hhbth.exe192⤵PID:1668
-
\??\c:\jvdvp.exec:\jvdvp.exe193⤵PID:804
-
\??\c:\frrxlrf.exec:\frrxlrf.exe194⤵PID:4760
-
\??\c:\rrxlrfl.exec:\rrxlrfl.exe195⤵PID:1712
-
\??\c:\dvdvv.exec:\dvdvv.exe196⤵PID:4488
-
\??\c:\tnntnb.exec:\tnntnb.exe197⤵PID:3844
-
\??\c:\5vjpv.exec:\5vjpv.exe198⤵PID:60
-
\??\c:\xlfrxrl.exec:\xlfrxrl.exe199⤵PID:4940
-
\??\c:\rlrrlll.exec:\rlrrlll.exe200⤵PID:3852
-
\??\c:\nbbtnn.exec:\nbbtnn.exe201⤵PID:956
-
\??\c:\ttnhbt.exec:\ttnhbt.exe202⤵PID:1140
-
\??\c:\vjpdv.exec:\vjpdv.exe203⤵PID:2340
-
\??\c:\vpjvj.exec:\vpjvj.exe204⤵PID:1352
-
\??\c:\5xrxlfr.exec:\5xrxlfr.exe205⤵PID:4228
-
\??\c:\bhnnbb.exec:\bhnnbb.exe206⤵PID:992
-
\??\c:\hnntth.exec:\hnntth.exe207⤵PID:4200
-
\??\c:\7ttnbt.exec:\7ttnbt.exe208⤵PID:3760
-
\??\c:\3vvjv.exec:\3vvjv.exe209⤵PID:4480
-
\??\c:\vvpjv.exec:\vvpjv.exe210⤵PID:616
-
\??\c:\lxfxllf.exec:\lxfxllf.exe211⤵PID:4840
-
\??\c:\lxxrfxl.exec:\lxxrfxl.exe212⤵PID:4824
-
\??\c:\bhbnhh.exec:\bhbnhh.exe213⤵PID:3708
-
\??\c:\bhnbnb.exec:\bhnbnb.exe214⤵PID:1708
-
\??\c:\dpvjv.exec:\dpvjv.exe215⤵PID:4052
-
\??\c:\vvpjd.exec:\vvpjd.exe216⤵PID:2424
-
\??\c:\fllfxxr.exec:\fllfxxr.exe217⤵PID:2008
-
\??\c:\ffrxffx.exec:\ffrxffx.exe218⤵PID:4364
-
\??\c:\1thtbt.exec:\1thtbt.exe219⤵PID:1200
-
\??\c:\9nnhtn.exec:\9nnhtn.exe220⤵PID:4128
-
\??\c:\pjvjj.exec:\pjvjj.exe221⤵PID:2044
-
\??\c:\ppvjv.exec:\ppvjv.exe222⤵PID:3152
-
\??\c:\jjdvj.exec:\jjdvj.exe223⤵PID:508
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe224⤵PID:5040
-
\??\c:\lxxrllf.exec:\lxxrllf.exe225⤵PID:2744
-
\??\c:\nbttht.exec:\nbttht.exe226⤵PID:4320
-
\??\c:\hbtnbb.exec:\hbtnbb.exe227⤵PID:1380
-
\??\c:\5jpjd.exec:\5jpjd.exe228⤵PID:1384
-
\??\c:\djjdd.exec:\djjdd.exe229⤵PID:1348
-
\??\c:\flxlxrl.exec:\flxlxrl.exe230⤵PID:2840
-
\??\c:\rfffrxl.exec:\rfffrxl.exe231⤵PID:1696
-
\??\c:\nbtntt.exec:\nbtntt.exe232⤵PID:3992
-
\??\c:\1jjdv.exec:\1jjdv.exe233⤵PID:2388
-
\??\c:\dvvvp.exec:\dvvvp.exe234⤵PID:1796
-
\??\c:\rxfrfxl.exec:\rxfrfxl.exe235⤵PID:4808
-
\??\c:\7hhbtn.exec:\7hhbtn.exe236⤵PID:4680
-
\??\c:\5tttnn.exec:\5tttnn.exe237⤵PID:2188
-
\??\c:\dpvpj.exec:\dpvpj.exe238⤵PID:4756
-
\??\c:\jdvjv.exec:\jdvjv.exe239⤵PID:928
-
\??\c:\xxlflll.exec:\xxlflll.exe240⤵PID:3280
-
\??\c:\rfrffrx.exec:\rfrffrx.exe241⤵PID:1316
-
\??\c:\hbnbnh.exec:\hbnbnh.exe242⤵PID:2472