Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 02:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a522d01bd8ec7dd4c0781ba725d30c65536756f9c32f153709e2b23e2f589cfc.exe
Resource
win7-20240419-en
windows7-x64
6 signatures
150 seconds
General
-
Target
a522d01bd8ec7dd4c0781ba725d30c65536756f9c32f153709e2b23e2f589cfc.exe
-
Size
72KB
-
MD5
d3959f56b1dc048f388884e6c281cdaa
-
SHA1
b5eda6a06f833d2b87d3fbb65a639ef280d19165
-
SHA256
a522d01bd8ec7dd4c0781ba725d30c65536756f9c32f153709e2b23e2f589cfc
-
SHA512
b3bf38d44aa2c7fb28a893964b9185c665efe190894018d69e6165908caf637b48065ae3953c29a680899ce641a425634a5364bea462a3ad01b1608fe612ea75
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbKQPVxg:ymb3NkkiQ3mdBjFIfvTfCD+HlQLg
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/836-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-31-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/840-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
Processes:
resource yara_rule behavioral2/memory/836-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2384-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3340-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3688-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3680-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/216-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4652-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3372-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5060-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2704-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3124-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3124-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3124-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3124-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4964-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5052-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3732-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4156-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4212-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1916-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2692-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/840-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2732-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1400-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4016-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4324-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3404-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3380-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3932-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3712-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
xxfxlll.exexxlrlrf.exethnnhh.exettbhbh.exeppvvp.exerflfxxx.exe9xffxfx.exehnhbbb.exexxllfff.exehhtnnn.exejjpjd.exelxfxlll.exebbnntt.exeppjpp.exepjvpj.exexrfxrrl.exenhbbbb.exe9vddj.exe5jddv.exe9lrrxxx.exenthnbh.exepppjj.exevvppj.exe3fffxxr.exebbbbnt.exevvddv.exerllllrx.exenbhnhn.exevvppd.exedjpjj.exellffxxr.exerfxrrxr.exebhhttn.exeppvpv.exepdddp.exeflrflxx.exeffffxfx.exetthhhn.exedvpvp.exerrxxrrx.exexxffxxx.exehnhnhn.exepjvvp.exe3jjdv.exexfxrflx.exefffffll.exentbtbt.exevjvvv.exelxlfxxx.exelxxxfll.exebbbttt.exepdvpd.exejvpdj.exerflrxlr.exebhthnn.exe7nbnnt.exe5pddv.exexlfffff.exe3flflll.exehnbbbh.exehntnhh.exeppvvp.exelfxffxx.exexrrfxrr.exepid process 2384 xxfxlll.exe 3372 xxlrlrf.exe 4652 thnnhh.exe 3340 ttbhbh.exe 216 ppvvp.exe 3680 rflfxxx.exe 3688 9xffxfx.exe 5060 hnhbbb.exe 2704 xxllfff.exe 3124 hhtnnn.exe 5052 jjpjd.exe 4964 lxfxlll.exe 3732 bbnntt.exe 4048 ppjpp.exe 4156 pjvpj.exe 4212 xrfxrrl.exe 3208 nhbbbb.exe 2092 9vddj.exe 1916 5jddv.exe 2692 9lrrxxx.exe 840 nthnbh.exe 2732 pppjj.exe 1400 vvppj.exe 4016 3fffxxr.exe 4324 bbbbnt.exe 3404 vvddv.exe 3380 rllllrx.exe 3932 nbhnhn.exe 4300 vvppd.exe 4548 djpjj.exe 3712 llffxxr.exe 1420 rfxrrxr.exe 2288 bhhttn.exe 3720 ppvpv.exe 1852 pdddp.exe 4352 flrflxx.exe 836 ffffxfx.exe 436 tthhhn.exe 3828 dvpvp.exe 3432 rrxxrrx.exe 1712 xxffxxx.exe 4816 hnhnhn.exe 3896 pjvvp.exe 4004 3jjdv.exe 4756 xfxrflx.exe 2000 fffffll.exe 1720 ntbtbt.exe 3488 vjvvv.exe 3936 lxlfxxx.exe 1924 lxxxfll.exe 3960 bbbttt.exe 3044 pdvpd.exe 4296 jvpdj.exe 3732 rflrxlr.exe 2944 bhthnn.exe 4648 7nbnnt.exe 4124 5pddv.exe 448 xlfffff.exe 3208 3flflll.exe 2272 hnbbbh.exe 4868 hntnhh.exe 4448 ppvvp.exe 1724 lfxffxx.exe 840 xrrfxrr.exe -
Processes:
resource yara_rule behavioral2/memory/836-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/840-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a522d01bd8ec7dd4c0781ba725d30c65536756f9c32f153709e2b23e2f589cfc.exexxfxlll.exexxlrlrf.exethnnhh.exettbhbh.exeppvvp.exerflfxxx.exe9xffxfx.exehnhbbb.exexxllfff.exehhtnnn.exejjpjd.exelxfxlll.exebbnntt.exeppjpp.exepjvpj.exexrfxrrl.exenhbbbb.exe9vddj.exe5jddv.exe9lrrxxx.exenthnbh.exedescription pid process target process PID 836 wrote to memory of 2384 836 a522d01bd8ec7dd4c0781ba725d30c65536756f9c32f153709e2b23e2f589cfc.exe xxfxlll.exe PID 836 wrote to memory of 2384 836 a522d01bd8ec7dd4c0781ba725d30c65536756f9c32f153709e2b23e2f589cfc.exe xxfxlll.exe PID 836 wrote to memory of 2384 836 a522d01bd8ec7dd4c0781ba725d30c65536756f9c32f153709e2b23e2f589cfc.exe xxfxlll.exe PID 2384 wrote to memory of 3372 2384 xxfxlll.exe xxlrlrf.exe PID 2384 wrote to memory of 3372 2384 xxfxlll.exe xxlrlrf.exe PID 2384 wrote to memory of 3372 2384 xxfxlll.exe xxlrlrf.exe PID 3372 wrote to memory of 4652 3372 xxlrlrf.exe thnnhh.exe PID 3372 wrote to memory of 4652 3372 xxlrlrf.exe thnnhh.exe PID 3372 wrote to memory of 4652 3372 xxlrlrf.exe thnnhh.exe PID 4652 wrote to memory of 3340 4652 thnnhh.exe ttbhbh.exe PID 4652 wrote to memory of 3340 4652 thnnhh.exe ttbhbh.exe PID 4652 wrote to memory of 3340 4652 thnnhh.exe ttbhbh.exe PID 3340 wrote to memory of 216 3340 ttbhbh.exe ppvvp.exe PID 3340 wrote to memory of 216 3340 ttbhbh.exe ppvvp.exe PID 3340 wrote to memory of 216 3340 ttbhbh.exe ppvvp.exe PID 216 wrote to memory of 3680 216 ppvvp.exe rflfxxx.exe PID 216 wrote to memory of 3680 216 ppvvp.exe rflfxxx.exe PID 216 wrote to memory of 3680 216 ppvvp.exe rflfxxx.exe PID 3680 wrote to memory of 3688 3680 rflfxxx.exe 9xffxfx.exe PID 3680 wrote to memory of 3688 3680 rflfxxx.exe 9xffxfx.exe PID 3680 wrote to memory of 3688 3680 rflfxxx.exe 9xffxfx.exe PID 3688 wrote to memory of 5060 3688 9xffxfx.exe hnhbbb.exe PID 3688 wrote to memory of 5060 3688 9xffxfx.exe hnhbbb.exe PID 3688 wrote to memory of 5060 3688 9xffxfx.exe hnhbbb.exe PID 5060 wrote to memory of 2704 5060 hnhbbb.exe xxllfff.exe PID 5060 wrote to memory of 2704 5060 hnhbbb.exe xxllfff.exe PID 5060 wrote to memory of 2704 5060 hnhbbb.exe xxllfff.exe PID 2704 wrote to memory of 3124 2704 xxllfff.exe hhtnnn.exe PID 2704 wrote to memory of 3124 2704 xxllfff.exe hhtnnn.exe PID 2704 wrote to memory of 3124 2704 xxllfff.exe hhtnnn.exe PID 3124 wrote to memory of 5052 3124 hhtnnn.exe jjpjd.exe PID 3124 wrote to memory of 5052 3124 hhtnnn.exe jjpjd.exe PID 3124 wrote to memory of 5052 3124 hhtnnn.exe jjpjd.exe PID 5052 wrote to memory of 4964 5052 jjpjd.exe lxfxlll.exe PID 5052 wrote to memory of 4964 5052 jjpjd.exe lxfxlll.exe PID 5052 wrote to memory of 4964 5052 jjpjd.exe lxfxlll.exe PID 4964 wrote to memory of 3732 4964 lxfxlll.exe bbnntt.exe PID 4964 wrote to memory of 3732 4964 lxfxlll.exe bbnntt.exe PID 4964 wrote to memory of 3732 4964 lxfxlll.exe bbnntt.exe PID 3732 wrote to memory of 4048 3732 bbnntt.exe ppjpp.exe PID 3732 wrote to memory of 4048 3732 bbnntt.exe ppjpp.exe PID 3732 wrote to memory of 4048 3732 bbnntt.exe ppjpp.exe PID 4048 wrote to memory of 4156 4048 ppjpp.exe pjvpj.exe PID 4048 wrote to memory of 4156 4048 ppjpp.exe pjvpj.exe PID 4048 wrote to memory of 4156 4048 ppjpp.exe pjvpj.exe PID 4156 wrote to memory of 4212 4156 pjvpj.exe xrfxrrl.exe PID 4156 wrote to memory of 4212 4156 pjvpj.exe xrfxrrl.exe PID 4156 wrote to memory of 4212 4156 pjvpj.exe xrfxrrl.exe PID 4212 wrote to memory of 3208 4212 xrfxrrl.exe nhbbbb.exe PID 4212 wrote to memory of 3208 4212 xrfxrrl.exe nhbbbb.exe PID 4212 wrote to memory of 3208 4212 xrfxrrl.exe nhbbbb.exe PID 3208 wrote to memory of 2092 3208 nhbbbb.exe 9vddj.exe PID 3208 wrote to memory of 2092 3208 nhbbbb.exe 9vddj.exe PID 3208 wrote to memory of 2092 3208 nhbbbb.exe 9vddj.exe PID 2092 wrote to memory of 1916 2092 9vddj.exe 5jddv.exe PID 2092 wrote to memory of 1916 2092 9vddj.exe 5jddv.exe PID 2092 wrote to memory of 1916 2092 9vddj.exe 5jddv.exe PID 1916 wrote to memory of 2692 1916 5jddv.exe 9lrrxxx.exe PID 1916 wrote to memory of 2692 1916 5jddv.exe 9lrrxxx.exe PID 1916 wrote to memory of 2692 1916 5jddv.exe 9lrrxxx.exe PID 2692 wrote to memory of 840 2692 9lrrxxx.exe nthnbh.exe PID 2692 wrote to memory of 840 2692 9lrrxxx.exe nthnbh.exe PID 2692 wrote to memory of 840 2692 9lrrxxx.exe nthnbh.exe PID 840 wrote to memory of 2732 840 nthnbh.exe pppjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a522d01bd8ec7dd4c0781ba725d30c65536756f9c32f153709e2b23e2f589cfc.exe"C:\Users\Admin\AppData\Local\Temp\a522d01bd8ec7dd4c0781ba725d30c65536756f9c32f153709e2b23e2f589cfc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\xxfxlll.exec:\xxfxlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\xxlrlrf.exec:\xxlrlrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\thnnhh.exec:\thnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\ttbhbh.exec:\ttbhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\ppvvp.exec:\ppvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\rflfxxx.exec:\rflfxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\9xffxfx.exec:\9xffxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\hnhbbb.exec:\hnhbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\xxllfff.exec:\xxllfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hhtnnn.exec:\hhtnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\jjpjd.exec:\jjpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\lxfxlll.exec:\lxfxlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\bbnntt.exec:\bbnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\ppjpp.exec:\ppjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\pjvpj.exec:\pjvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\nhbbbb.exec:\nhbbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\9vddj.exec:\9vddj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\5jddv.exec:\5jddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\9lrrxxx.exec:\9lrrxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nthnbh.exec:\nthnbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\pppjj.exec:\pppjj.exe23⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vvppj.exec:\vvppj.exe24⤵
- Executes dropped EXE
PID:1400 -
\??\c:\3fffxxr.exec:\3fffxxr.exe25⤵
- Executes dropped EXE
PID:4016 -
\??\c:\bbbbnt.exec:\bbbbnt.exe26⤵
- Executes dropped EXE
PID:4324 -
\??\c:\vvddv.exec:\vvddv.exe27⤵
- Executes dropped EXE
PID:3404 -
\??\c:\rllllrx.exec:\rllllrx.exe28⤵
- Executes dropped EXE
PID:3380 -
\??\c:\nbhnhn.exec:\nbhnhn.exe29⤵
- Executes dropped EXE
PID:3932 -
\??\c:\vvppd.exec:\vvppd.exe30⤵
- Executes dropped EXE
PID:4300 -
\??\c:\djpjj.exec:\djpjj.exe31⤵
- Executes dropped EXE
PID:4548 -
\??\c:\llffxxr.exec:\llffxxr.exe32⤵
- Executes dropped EXE
PID:3712 -
\??\c:\rfxrrxr.exec:\rfxrrxr.exe33⤵
- Executes dropped EXE
PID:1420 -
\??\c:\bhhttn.exec:\bhhttn.exe34⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ppvpv.exec:\ppvpv.exe35⤵
- Executes dropped EXE
PID:3720 -
\??\c:\pdddp.exec:\pdddp.exe36⤵
- Executes dropped EXE
PID:1852 -
\??\c:\flrflxx.exec:\flrflxx.exe37⤵
- Executes dropped EXE
PID:4352 -
\??\c:\ffffxfx.exec:\ffffxfx.exe38⤵
- Executes dropped EXE
PID:836 -
\??\c:\tthhhn.exec:\tthhhn.exe39⤵
- Executes dropped EXE
PID:436 -
\??\c:\dvpvp.exec:\dvpvp.exe40⤵
- Executes dropped EXE
PID:3828 -
\??\c:\rrxxrrx.exec:\rrxxrrx.exe41⤵
- Executes dropped EXE
PID:3432 -
\??\c:\xxffxxx.exec:\xxffxxx.exe42⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hnhnhn.exec:\hnhnhn.exe43⤵
- Executes dropped EXE
PID:4816 -
\??\c:\pjvvp.exec:\pjvvp.exe44⤵
- Executes dropped EXE
PID:3896 -
\??\c:\3jjdv.exec:\3jjdv.exe45⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xfxrflx.exec:\xfxrflx.exe46⤵
- Executes dropped EXE
PID:4756 -
\??\c:\fffffll.exec:\fffffll.exe47⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ntbtbt.exec:\ntbtbt.exe48⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vjvvv.exec:\vjvvv.exe49⤵
- Executes dropped EXE
PID:3488 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe50⤵
- Executes dropped EXE
PID:3936 -
\??\c:\lxxxfll.exec:\lxxxfll.exe51⤵
- Executes dropped EXE
PID:1924 -
\??\c:\bbbttt.exec:\bbbttt.exe52⤵
- Executes dropped EXE
PID:3960 -
\??\c:\pdvpd.exec:\pdvpd.exe53⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jvpdj.exec:\jvpdj.exe54⤵
- Executes dropped EXE
PID:4296 -
\??\c:\rflrxlr.exec:\rflrxlr.exe55⤵
- Executes dropped EXE
PID:3732 -
\??\c:\bhthnn.exec:\bhthnn.exe56⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7nbnnt.exec:\7nbnnt.exe57⤵
- Executes dropped EXE
PID:4648 -
\??\c:\5pddv.exec:\5pddv.exe58⤵
- Executes dropped EXE
PID:4124 -
\??\c:\xlfffff.exec:\xlfffff.exe59⤵
- Executes dropped EXE
PID:448 -
\??\c:\3flflll.exec:\3flflll.exe60⤵
- Executes dropped EXE
PID:3208 -
\??\c:\hnbbbh.exec:\hnbbbh.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hntnhh.exec:\hntnhh.exe62⤵
- Executes dropped EXE
PID:4868 -
\??\c:\ppvvp.exec:\ppvvp.exe63⤵
- Executes dropped EXE
PID:4448 -
\??\c:\lfxffxx.exec:\lfxffxx.exe64⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xrrfxrr.exec:\xrrfxrr.exe65⤵
- Executes dropped EXE
PID:840 -
\??\c:\nhnnhh.exec:\nhnnhh.exe66⤵PID:1568
-
\??\c:\dpppj.exec:\dpppj.exe67⤵PID:1656
-
\??\c:\9pddv.exec:\9pddv.exe68⤵PID:672
-
\??\c:\rflflrf.exec:\rflflrf.exe69⤵PID:3312
-
\??\c:\btnhbt.exec:\btnhbt.exe70⤵PID:4672
-
\??\c:\btnbnh.exec:\btnbnh.exe71⤵PID:432
-
\??\c:\dpjjp.exec:\dpjjp.exe72⤵PID:1528
-
\??\c:\lffrfxf.exec:\lffrfxf.exe73⤵PID:3396
-
\??\c:\tbbnnh.exec:\tbbnnh.exe74⤵PID:4972
-
\??\c:\vpvpd.exec:\vpvpd.exe75⤵PID:740
-
\??\c:\llrxrrl.exec:\llrxrrl.exe76⤵PID:2636
-
\??\c:\bnhnhn.exec:\bnhnhn.exe77⤵PID:2852
-
\??\c:\jvpvp.exec:\jvpvp.exe78⤵PID:2928
-
\??\c:\fxrrrff.exec:\fxrrrff.exe79⤵PID:2552
-
\??\c:\rrxxffr.exec:\rrxxffr.exe80⤵PID:844
-
\??\c:\pdjjp.exec:\pdjjp.exe81⤵PID:4384
-
\??\c:\jjjvv.exec:\jjjvv.exe82⤵PID:2032
-
\??\c:\nbhhbt.exec:\nbhhbt.exe83⤵PID:4356
-
\??\c:\hhhbbb.exec:\hhhbbb.exe84⤵PID:1608
-
\??\c:\vjvpv.exec:\vjvpv.exe85⤵PID:2796
-
\??\c:\lxrllll.exec:\lxrllll.exe86⤵PID:548
-
\??\c:\bnnnnn.exec:\bnnnnn.exe87⤵PID:5116
-
\??\c:\3ddvp.exec:\3ddvp.exe88⤵PID:3148
-
\??\c:\jjppd.exec:\jjppd.exe89⤵PID:4116
-
\??\c:\xlxfxff.exec:\xlxfxff.exe90⤵PID:2100
-
\??\c:\tththb.exec:\tththb.exe91⤵PID:2104
-
\??\c:\htttnt.exec:\htttnt.exe92⤵PID:4140
-
\??\c:\pvppj.exec:\pvppj.exe93⤵PID:3648
-
\??\c:\rlllrxl.exec:\rlllrxl.exe94⤵PID:3104
-
\??\c:\frfllrr.exec:\frfllrr.exe95⤵PID:5016
-
\??\c:\tntttb.exec:\tntttb.exe96⤵PID:5024
-
\??\c:\pppdd.exec:\pppdd.exe97⤵PID:5064
-
\??\c:\jjjjj.exec:\jjjjj.exe98⤵PID:3124
-
\??\c:\7llfffx.exec:\7llfffx.exe99⤵PID:1212
-
\??\c:\llxxffr.exec:\llxxffr.exe100⤵PID:1668
-
\??\c:\nhhnhh.exec:\nhhnhh.exe101⤵PID:3288
-
\??\c:\ddddv.exec:\ddddv.exe102⤵PID:3408
-
\??\c:\flxrrlr.exec:\flxrrlr.exe103⤵PID:1240
-
\??\c:\rxfxlxf.exec:\rxfxlxf.exe104⤵PID:4212
-
\??\c:\hthnhh.exec:\hthnhh.exe105⤵PID:4728
-
\??\c:\jjdvj.exec:\jjdvj.exe106⤵PID:4744
-
\??\c:\5vjpd.exec:\5vjpd.exe107⤵PID:2040
-
\??\c:\5lllrll.exec:\5lllrll.exe108⤵PID:4372
-
\??\c:\frxlfxf.exec:\frxlfxf.exe109⤵PID:4436
-
\??\c:\nbhnhh.exec:\nbhnhh.exe110⤵PID:888
-
\??\c:\pddvd.exec:\pddvd.exe111⤵PID:1724
-
\??\c:\pvvvd.exec:\pvvvd.exe112⤵PID:840
-
\??\c:\3lrfflr.exec:\3lrfflr.exe113⤵PID:1568
-
\??\c:\1tnntt.exec:\1tnntt.exe114⤵PID:1656
-
\??\c:\7jdvv.exec:\7jdvv.exe115⤵PID:748
-
\??\c:\bbbtnt.exec:\bbbtnt.exe116⤵PID:4168
-
\??\c:\btnhbn.exec:\btnhbn.exe117⤵PID:3632
-
\??\c:\vdpjv.exec:\vdpjv.exe118⤵PID:3404
-
\??\c:\lrxffll.exec:\lrxffll.exe119⤵PID:2452
-
\??\c:\thnthn.exec:\thnthn.exe120⤵PID:224
-
\??\c:\tbbbbt.exec:\tbbbbt.exe121⤵PID:4796
-
\??\c:\pdpvv.exec:\pdpvv.exe122⤵PID:4872
-
\??\c:\1rrxxlf.exec:\1rrxxlf.exe123⤵PID:4444
-
\??\c:\7lfrlrf.exec:\7lfrlrf.exe124⤵PID:4988
-
\??\c:\btbbnb.exec:\btbbnb.exe125⤵PID:3628
-
\??\c:\5vvdp.exec:\5vvdp.exe126⤵PID:2304
-
\??\c:\dddpp.exec:\dddpp.exe127⤵PID:728
-
\??\c:\1flxlfl.exec:\1flxlfl.exe128⤵PID:1392
-
\??\c:\9bnnbt.exec:\9bnnbt.exe129⤵PID:1852
-
\??\c:\7ddvj.exec:\7ddvj.exe130⤵PID:2728
-
\??\c:\rxxlflr.exec:\rxxlflr.exe131⤵PID:2924
-
\??\c:\7nnhbt.exec:\7nnhbt.exe132⤵PID:4052
-
\??\c:\btntbt.exec:\btntbt.exe133⤵PID:3952
-
\??\c:\5jjpd.exec:\5jjpd.exe134⤵PID:1036
-
\??\c:\frlrxlx.exec:\frlrxlx.exe135⤵PID:624
-
\??\c:\lllxxfl.exec:\lllxxfl.exe136⤵PID:2880
-
\??\c:\thhtbt.exec:\thhtbt.exe137⤵PID:556
-
\??\c:\dvvvd.exec:\dvvvd.exe138⤵PID:2844
-
\??\c:\xrlffff.exec:\xrlffff.exe139⤵PID:4076
-
\??\c:\rfrlrlx.exec:\rfrlrlx.exe140⤵PID:4008
-
\??\c:\nnhhtt.exec:\nnhhtt.exe141⤵PID:5024
-
\??\c:\nhtbbb.exec:\nhtbbb.exe142⤵PID:5080
-
\??\c:\vpvpv.exec:\vpvpv.exe143⤵PID:1772
-
\??\c:\dvvpv.exec:\dvvpv.exe144⤵PID:2964
-
\??\c:\fxfllrr.exec:\fxfllrr.exe145⤵PID:1932
-
\??\c:\nbbtnt.exec:\nbbtnt.exe146⤵PID:4432
-
\??\c:\nnhbtn.exec:\nnhbtn.exe147⤵PID:4456
-
\??\c:\dvdjv.exec:\dvdjv.exe148⤵PID:4852
-
\??\c:\vddvj.exec:\vddvj.exe149⤵PID:552
-
\??\c:\9rxrrrx.exec:\9rxrrrx.exe150⤵PID:2500
-
\??\c:\thbnhb.exec:\thbnhb.exe151⤵PID:4948
-
\??\c:\htnhtn.exec:\htnhtn.exe152⤵PID:2272
-
\??\c:\frrlllr.exec:\frrlllr.exe153⤵PID:4252
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe154⤵PID:3272
-
\??\c:\thhtnt.exec:\thhtnt.exe155⤵PID:1584
-
\??\c:\tnbntt.exec:\tnbntt.exe156⤵PID:3328
-
\??\c:\dvvjv.exec:\dvvjv.exe157⤵PID:1400
-
\??\c:\pdppd.exec:\pdppd.exe158⤵PID:3532
-
\??\c:\rlllrrl.exec:\rlllrrl.exe159⤵PID:2156
-
\??\c:\xffxrxr.exec:\xffxrxr.exe160⤵PID:748
-
\??\c:\thhbtn.exec:\thhbtn.exe161⤵PID:4168
-
\??\c:\jddvv.exec:\jddvv.exe162⤵PID:3632
-
\??\c:\vjpdp.exec:\vjpdp.exe163⤵PID:2588
-
\??\c:\fxrxlfl.exec:\fxrxlfl.exe164⤵PID:3232
-
\??\c:\frfxlfr.exec:\frfxlfr.exe165⤵PID:3972
-
\??\c:\bnbtnh.exec:\bnbtnh.exe166⤵PID:4796
-
\??\c:\3hbthh.exec:\3hbthh.exe167⤵PID:2636
-
\??\c:\jpddd.exec:\jpddd.exe168⤵PID:2852
-
\??\c:\jdvvj.exec:\jdvvj.exe169⤵PID:4928
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe170⤵PID:1140
-
\??\c:\rxrflxx.exec:\rxrflxx.exe171⤵PID:2660
-
\??\c:\hnnbtb.exec:\hnnbtb.exe172⤵PID:4364
-
\??\c:\3bhbhh.exec:\3bhbhh.exe173⤵PID:1920
-
\??\c:\vpvdv.exec:\vpvdv.exe174⤵PID:1852
-
\??\c:\jvddj.exec:\jvddj.exe175⤵PID:1776
-
\??\c:\rfxxxrr.exec:\rfxxxrr.exe176⤵PID:2924
-
\??\c:\nntthh.exec:\nntthh.exe177⤵PID:4052
-
\??\c:\7bhnbn.exec:\7bhnbn.exe178⤵PID:548
-
\??\c:\dpvpj.exec:\dpvpj.exe179⤵PID:3464
-
\??\c:\1jjpd.exec:\1jjpd.exe180⤵PID:4816
-
\??\c:\lfflrxx.exec:\lfflrxx.exe181⤵PID:232
-
\??\c:\nntbnn.exec:\nntbnn.exe182⤵PID:3672
-
\??\c:\bbhntb.exec:\bbhntb.exe183⤵PID:772
-
\??\c:\dpvvd.exec:\dpvvd.exe184⤵PID:3104
-
\??\c:\rllrfxx.exec:\rllrfxx.exe185⤵PID:1536
-
\??\c:\rlxrllx.exec:\rlxrllx.exe186⤵PID:1980
-
\??\c:\nhnhnn.exec:\nhnhnn.exe187⤵PID:1976
-
\??\c:\hbhnnt.exec:\hbhnnt.exe188⤵PID:3960
-
\??\c:\jjjpd.exec:\jjjpd.exe189⤵PID:4460
-
\??\c:\frrrrrx.exec:\frrrrrx.exe190⤵PID:4296
-
\??\c:\lffxllx.exec:\lffxllx.exe191⤵PID:4260
-
\??\c:\1nnnhb.exec:\1nnnhb.exe192⤵PID:1240
-
\??\c:\nnbhbn.exec:\nnbhbn.exe193⤵PID:4308
-
\??\c:\vddvj.exec:\vddvj.exe194⤵PID:4504
-
\??\c:\jdvpv.exec:\jdvpv.exe195⤵PID:4744
-
\??\c:\lflxflr.exec:\lflxflr.exe196⤵PID:4948
-
\??\c:\tnhbth.exec:\tnhbth.exe197⤵PID:2272
-
\??\c:\tnnhtn.exec:\tnnhtn.exe198⤵PID:4252
-
\??\c:\3jvpd.exec:\3jvpd.exe199⤵PID:888
-
\??\c:\frlfxxr.exec:\frlfxxr.exe200⤵PID:1584
-
\??\c:\flrrrxl.exec:\flrrrxl.exe201⤵PID:3328
-
\??\c:\bntnbt.exec:\bntnbt.exe202⤵PID:2696
-
\??\c:\fllfrlf.exec:\fllfrlf.exe203⤵PID:4944
-
\??\c:\thbtnn.exec:\thbtnn.exe204⤵PID:3312
-
\??\c:\bttnnn.exec:\bttnnn.exe205⤵PID:748
-
\??\c:\ppvvp.exec:\ppvvp.exe206⤵PID:432
-
\??\c:\dpvpd.exec:\dpvpd.exe207⤵PID:4608
-
\??\c:\flfflll.exec:\flfflll.exe208⤵PID:3444
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe209⤵PID:4668
-
\??\c:\nttthn.exec:\nttthn.exe210⤵PID:3972
-
\??\c:\jpddj.exec:\jpddj.exe211⤵PID:4676
-
\??\c:\dvdjv.exec:\dvdjv.exe212⤵PID:3852
-
\??\c:\lffrfxr.exec:\lffrfxr.exe213⤵PID:4988
-
\??\c:\ththbh.exec:\ththbh.exe214⤵PID:2976
-
\??\c:\jdvjv.exec:\jdvjv.exe215⤵PID:1392
-
\??\c:\xlrfrrl.exec:\xlrfrrl.exe216⤵PID:1920
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe217⤵PID:2748
-
\??\c:\9tnthh.exec:\9tnthh.exe218⤵PID:1828
-
\??\c:\tbbtnh.exec:\tbbtnh.exe219⤵PID:3448
-
\??\c:\pjppd.exec:\pjppd.exe220⤵PID:3952
-
\??\c:\vppjp.exec:\vppjp.exe221⤵PID:8
-
\??\c:\5xxrfrl.exec:\5xxrfrl.exe222⤵PID:3680
-
\??\c:\rxxrffr.exec:\rxxrffr.exe223⤵PID:4816
-
\??\c:\tnnhbt.exec:\tnnhbt.exe224⤵PID:4140
-
\??\c:\bnnhhb.exec:\bnnhhb.exe225⤵PID:4180
-
\??\c:\7pvvj.exec:\7pvvj.exe226⤵PID:3240
-
\??\c:\pjdvj.exec:\pjdvj.exe227⤵PID:3012
-
\??\c:\lfrlffl.exec:\lfrlffl.exe228⤵PID:5024
-
\??\c:\hbbhnt.exec:\hbbhnt.exe229⤵PID:5080
-
\??\c:\nhhthh.exec:\nhhthh.exe230⤵PID:1976
-
\??\c:\ddjdv.exec:\ddjdv.exe231⤵PID:3960
-
\??\c:\rrllfxx.exec:\rrllfxx.exe232⤵PID:4460
-
\??\c:\hbthbn.exec:\hbthbn.exe233⤵PID:4296
-
\??\c:\jpjvj.exec:\jpjvj.exe234⤵PID:4260
-
\??\c:\djpvv.exec:\djpvv.exe235⤵PID:1240
-
\??\c:\7rxrlxx.exec:\7rxrlxx.exe236⤵PID:552
-
\??\c:\bthtnh.exec:\bthtnh.exe237⤵PID:4504
-
\??\c:\thntbb.exec:\thntbb.exe238⤵PID:4868
-
\??\c:\ntnbtn.exec:\ntnbtn.exe239⤵PID:4624
-
\??\c:\jpvpj.exec:\jpvpj.exe240⤵PID:2272
-
\??\c:\1pdvv.exec:\1pdvv.exe241⤵PID:2572
-
\??\c:\htbnhn.exec:\htbnhn.exe242⤵PID:4012