Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 03:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b722eddc7cdfa67211dae57410169d75dbd873d8a61d7478f7c89764368f8b4a.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
b722eddc7cdfa67211dae57410169d75dbd873d8a61d7478f7c89764368f8b4a.exe
-
Size
382KB
-
MD5
7fb793cdf3e86a01901b65a0843ccfe0
-
SHA1
cb7de5555af0c2d72f500535acbabae9be46075f
-
SHA256
b722eddc7cdfa67211dae57410169d75dbd873d8a61d7478f7c89764368f8b4a
-
SHA512
635308fdd6642b1739c927a5775337c68c8df9a9c3299c2e376513a005f694f97fb6801e656bc9426449a2298881e81669e21bc86b2d8e0df59e65204c15932c
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwD:n3C9uYA7okVqdKwaO5CV4
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/2624-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2660-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 31 IoCs
Processes:
resource yara_rule behavioral2/memory/2624-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1772-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4280-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1228-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1104-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1104-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3772-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1104-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4888-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/516-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2752-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4228-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3328-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2444-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2716-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3456-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2660-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1080-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4668-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3856-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2932-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4324-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4248-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5056-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1668-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2752-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2752-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/516-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/516-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/516-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3116-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
jvdvp.exefxxrxlf.exehbtnhh.exepjpdv.exelfffxrr.exe9nnbhb.exevvdvj.exefxfxrrl.exefxrlxxr.exepdjdv.exepjdvp.exe1xxxxrr.exeddjdd.exelfrlllr.exerrllfll.exenhbttb.exejdppj.exerfrlflf.exerrfxfxx.exenbbbtt.exeddjpp.exejvdpd.exelffrlrr.exe1nnnhn.exe3ddvp.exerflfxxr.exehntnhn.exenbhtnn.exerlxlfxl.exebbhbth.exevvjjv.exerffxlll.exehbnbnh.exenhbnhb.exexrrlxrx.exexflffxf.exehtthbb.exevdpjv.exedddvd.exexrfxlfx.exehbtnhh.exe7jdvp.exe7fxrxxr.exe5rlxlll.exehbbttt.exejddvj.exevpdvp.exeffllllr.exebhhbhh.exedjdvd.exepjpjv.exerlfrrrl.exenhhbbt.exe5dvvj.exevvvjd.exeflxlrll.exebhtttb.exenbbthb.exepjvjd.exejddpd.exerlrrrxf.exethhbtn.exehnbttt.exe3vdvp.exepid process 1772 jvdvp.exe 4280 fxxrxlf.exe 1228 hbtnhh.exe 1104 pjpdv.exe 3772 lfffxrr.exe 3116 9nnbhb.exe 2208 vvdvj.exe 4888 fxfxrrl.exe 516 fxrlxxr.exe 2752 pdjdv.exe 4228 pjdvp.exe 1668 1xxxxrr.exe 332 ddjdd.exe 3328 lfrlllr.exe 5056 rrllfll.exe 1752 nhbttb.exe 3584 jdppj.exe 2444 rfrlflf.exe 4248 rrfxfxx.exe 4324 nbbbtt.exe 2716 ddjpp.exe 2712 jvdpd.exe 2932 lffrlrr.exe 436 1nnnhn.exe 740 3ddvp.exe 3856 rflfxxr.exe 4668 hntnhn.exe 4780 nbhtnn.exe 1080 rlxlfxl.exe 2660 bbhbth.exe 3456 vvjjv.exe 1916 rffxlll.exe 4220 hbnbnh.exe 1692 nhbnhb.exe 4280 xrrlxrx.exe 1144 xflffxf.exe 1104 htthbb.exe 3772 vdpjv.exe 2104 dddvd.exe 4640 xrfxlfx.exe 3140 hbtnhh.exe 2812 7jdvp.exe 1852 7fxrxxr.exe 4952 5rlxlll.exe 2808 hbbttt.exe 2496 jddvj.exe 3612 vpdvp.exe 1688 ffllllr.exe 1668 bhhbhh.exe 2064 djdvd.exe 4936 pjpjv.exe 4040 rlfrrrl.exe 3520 nhhbbt.exe 5056 5dvvj.exe 1752 vvvjd.exe 1604 flxlrll.exe 376 bhtttb.exe 1560 nbbthb.exe 2816 pjvjd.exe 4568 jddpd.exe 688 rlrrrxf.exe 3288 thhbtn.exe 1960 hnbttt.exe 3160 3vdvp.exe -
Processes:
resource yara_rule behavioral2/memory/2624-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-49-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b722eddc7cdfa67211dae57410169d75dbd873d8a61d7478f7c89764368f8b4a.exejvdvp.exefxxrxlf.exehbtnhh.exepjpdv.exelfffxrr.exe9nnbhb.exevvdvj.exefxfxrrl.exefxrlxxr.exepdjdv.exepjdvp.exe1xxxxrr.exeddjdd.exelfrlllr.exerrllfll.exenhbttb.exejdppj.exerfrlflf.exerrfxfxx.exenbbbtt.exeddjpp.exedescription pid process target process PID 2624 wrote to memory of 1772 2624 b722eddc7cdfa67211dae57410169d75dbd873d8a61d7478f7c89764368f8b4a.exe jvdvp.exe PID 2624 wrote to memory of 1772 2624 b722eddc7cdfa67211dae57410169d75dbd873d8a61d7478f7c89764368f8b4a.exe jvdvp.exe PID 2624 wrote to memory of 1772 2624 b722eddc7cdfa67211dae57410169d75dbd873d8a61d7478f7c89764368f8b4a.exe jvdvp.exe PID 1772 wrote to memory of 4280 1772 jvdvp.exe xrrlxrx.exe PID 1772 wrote to memory of 4280 1772 jvdvp.exe xrrlxrx.exe PID 1772 wrote to memory of 4280 1772 jvdvp.exe xrrlxrx.exe PID 4280 wrote to memory of 1228 4280 fxxrxlf.exe hbtnhh.exe PID 4280 wrote to memory of 1228 4280 fxxrxlf.exe hbtnhh.exe PID 4280 wrote to memory of 1228 4280 fxxrxlf.exe hbtnhh.exe PID 1228 wrote to memory of 1104 1228 hbtnhh.exe htthbb.exe PID 1228 wrote to memory of 1104 1228 hbtnhh.exe htthbb.exe PID 1228 wrote to memory of 1104 1228 hbtnhh.exe htthbb.exe PID 1104 wrote to memory of 3772 1104 pjpdv.exe lfffxrr.exe PID 1104 wrote to memory of 3772 1104 pjpdv.exe lfffxrr.exe PID 1104 wrote to memory of 3772 1104 pjpdv.exe lfffxrr.exe PID 3772 wrote to memory of 3116 3772 lfffxrr.exe 9nnbhb.exe PID 3772 wrote to memory of 3116 3772 lfffxrr.exe 9nnbhb.exe PID 3772 wrote to memory of 3116 3772 lfffxrr.exe 9nnbhb.exe PID 3116 wrote to memory of 2208 3116 9nnbhb.exe vvdvj.exe PID 3116 wrote to memory of 2208 3116 9nnbhb.exe vvdvj.exe PID 3116 wrote to memory of 2208 3116 9nnbhb.exe vvdvj.exe PID 2208 wrote to memory of 4888 2208 vvdvj.exe fxfxrrl.exe PID 2208 wrote to memory of 4888 2208 vvdvj.exe fxfxrrl.exe PID 2208 wrote to memory of 4888 2208 vvdvj.exe fxfxrrl.exe PID 4888 wrote to memory of 516 4888 fxfxrrl.exe fxrlxxr.exe PID 4888 wrote to memory of 516 4888 fxfxrrl.exe fxrlxxr.exe PID 4888 wrote to memory of 516 4888 fxfxrrl.exe fxrlxxr.exe PID 516 wrote to memory of 2752 516 fxrlxxr.exe pdjdv.exe PID 516 wrote to memory of 2752 516 fxrlxxr.exe pdjdv.exe PID 516 wrote to memory of 2752 516 fxrlxxr.exe pdjdv.exe PID 2752 wrote to memory of 4228 2752 pdjdv.exe pjdvp.exe PID 2752 wrote to memory of 4228 2752 pdjdv.exe pjdvp.exe PID 2752 wrote to memory of 4228 2752 pdjdv.exe pjdvp.exe PID 4228 wrote to memory of 1668 4228 pjdvp.exe bhhbhh.exe PID 4228 wrote to memory of 1668 4228 pjdvp.exe bhhbhh.exe PID 4228 wrote to memory of 1668 4228 pjdvp.exe bhhbhh.exe PID 1668 wrote to memory of 332 1668 1xxxxrr.exe ddjdd.exe PID 1668 wrote to memory of 332 1668 1xxxxrr.exe ddjdd.exe PID 1668 wrote to memory of 332 1668 1xxxxrr.exe ddjdd.exe PID 332 wrote to memory of 3328 332 ddjdd.exe lfrlllr.exe PID 332 wrote to memory of 3328 332 ddjdd.exe lfrlllr.exe PID 332 wrote to memory of 3328 332 ddjdd.exe lfrlllr.exe PID 3328 wrote to memory of 5056 3328 lfrlllr.exe xllfxrl.exe PID 3328 wrote to memory of 5056 3328 lfrlllr.exe xllfxrl.exe PID 3328 wrote to memory of 5056 3328 lfrlllr.exe xllfxrl.exe PID 5056 wrote to memory of 1752 5056 rrllfll.exe tbbntn.exe PID 5056 wrote to memory of 1752 5056 rrllfll.exe tbbntn.exe PID 5056 wrote to memory of 1752 5056 rrllfll.exe tbbntn.exe PID 1752 wrote to memory of 3584 1752 nhbttb.exe jdppj.exe PID 1752 wrote to memory of 3584 1752 nhbttb.exe jdppj.exe PID 1752 wrote to memory of 3584 1752 nhbttb.exe jdppj.exe PID 3584 wrote to memory of 2444 3584 jdppj.exe rfrlflf.exe PID 3584 wrote to memory of 2444 3584 jdppj.exe rfrlflf.exe PID 3584 wrote to memory of 2444 3584 jdppj.exe rfrlflf.exe PID 2444 wrote to memory of 4248 2444 rfrlflf.exe rrfxfxx.exe PID 2444 wrote to memory of 4248 2444 rfrlflf.exe rrfxfxx.exe PID 2444 wrote to memory of 4248 2444 rfrlflf.exe rrfxfxx.exe PID 4248 wrote to memory of 4324 4248 rrfxfxx.exe nbbbtt.exe PID 4248 wrote to memory of 4324 4248 rrfxfxx.exe nbbbtt.exe PID 4248 wrote to memory of 4324 4248 rrfxfxx.exe nbbbtt.exe PID 4324 wrote to memory of 2716 4324 nbbbtt.exe ddjpp.exe PID 4324 wrote to memory of 2716 4324 nbbbtt.exe ddjpp.exe PID 4324 wrote to memory of 2716 4324 nbbbtt.exe ddjpp.exe PID 2716 wrote to memory of 2712 2716 ddjpp.exe jvdpd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b722eddc7cdfa67211dae57410169d75dbd873d8a61d7478f7c89764368f8b4a.exe"C:\Users\Admin\AppData\Local\Temp\b722eddc7cdfa67211dae57410169d75dbd873d8a61d7478f7c89764368f8b4a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\jvdvp.exec:\jvdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\fxxrxlf.exec:\fxxrxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\hbtnhh.exec:\hbtnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\pjpdv.exec:\pjpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\lfffxrr.exec:\lfffxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\9nnbhb.exec:\9nnbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\vvdvj.exec:\vvdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\pdjdv.exec:\pdjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pjdvp.exec:\pjdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\1xxxxrr.exec:\1xxxxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\ddjdd.exec:\ddjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\lfrlllr.exec:\lfrlllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\rrllfll.exec:\rrllfll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\nhbttb.exec:\nhbttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\jdppj.exec:\jdppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\rfrlflf.exec:\rfrlflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\rrfxfxx.exec:\rrfxfxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\nbbbtt.exec:\nbbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\ddjpp.exec:\ddjpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jvdpd.exec:\jvdpd.exe23⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lffrlrr.exec:\lffrlrr.exe24⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1nnnhn.exec:\1nnnhn.exe25⤵
- Executes dropped EXE
PID:436 -
\??\c:\3ddvp.exec:\3ddvp.exe26⤵
- Executes dropped EXE
PID:740 -
\??\c:\rflfxxr.exec:\rflfxxr.exe27⤵
- Executes dropped EXE
PID:3856 -
\??\c:\hntnhn.exec:\hntnhn.exe28⤵
- Executes dropped EXE
PID:4668 -
\??\c:\nbhtnn.exec:\nbhtnn.exe29⤵
- Executes dropped EXE
PID:4780 -
\??\c:\rlxlfxl.exec:\rlxlfxl.exe30⤵
- Executes dropped EXE
PID:1080 -
\??\c:\bbhbth.exec:\bbhbth.exe31⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vvjjv.exec:\vvjjv.exe32⤵
- Executes dropped EXE
PID:3456 -
\??\c:\rffxlll.exec:\rffxlll.exe33⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hbnbnh.exec:\hbnbnh.exe34⤵
- Executes dropped EXE
PID:4220 -
\??\c:\nhbnhb.exec:\nhbnhb.exe35⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xrrlxrx.exec:\xrrlxrx.exe36⤵
- Executes dropped EXE
PID:4280 -
\??\c:\xflffxf.exec:\xflffxf.exe37⤵
- Executes dropped EXE
PID:1144 -
\??\c:\htthbb.exec:\htthbb.exe38⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vdpjv.exec:\vdpjv.exe39⤵
- Executes dropped EXE
PID:3772 -
\??\c:\dddvd.exec:\dddvd.exe40⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xrfxlfx.exec:\xrfxlfx.exe41⤵
- Executes dropped EXE
PID:4640 -
\??\c:\hbtnhh.exec:\hbtnhh.exe42⤵
- Executes dropped EXE
PID:3140 -
\??\c:\7jdvp.exec:\7jdvp.exe43⤵
- Executes dropped EXE
PID:2812 -
\??\c:\7fxrxxr.exec:\7fxrxxr.exe44⤵
- Executes dropped EXE
PID:1852 -
\??\c:\5rlxlll.exec:\5rlxlll.exe45⤵
- Executes dropped EXE
PID:4952 -
\??\c:\hbbttt.exec:\hbbttt.exe46⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jddvj.exec:\jddvj.exe47⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vpdvp.exec:\vpdvp.exe48⤵
- Executes dropped EXE
PID:3612 -
\??\c:\ffllllr.exec:\ffllllr.exe49⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bhhbhh.exec:\bhhbhh.exe50⤵
- Executes dropped EXE
PID:1668 -
\??\c:\djdvd.exec:\djdvd.exe51⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pjpjv.exec:\pjpjv.exe52⤵
- Executes dropped EXE
PID:4936 -
\??\c:\rlfrrrl.exec:\rlfrrrl.exe53⤵
- Executes dropped EXE
PID:4040 -
\??\c:\nhhbbt.exec:\nhhbbt.exe54⤵
- Executes dropped EXE
PID:3520 -
\??\c:\5dvvj.exec:\5dvvj.exe55⤵
- Executes dropped EXE
PID:5056 -
\??\c:\vvvjd.exec:\vvvjd.exe56⤵
- Executes dropped EXE
PID:1752 -
\??\c:\flxlrll.exec:\flxlrll.exe57⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bhtttb.exec:\bhtttb.exe58⤵
- Executes dropped EXE
PID:376 -
\??\c:\nbbthb.exec:\nbbthb.exe59⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pjvjd.exec:\pjvjd.exe60⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jddpd.exec:\jddpd.exe61⤵
- Executes dropped EXE
PID:4568 -
\??\c:\rlrrrxf.exec:\rlrrrxf.exe62⤵
- Executes dropped EXE
PID:688 -
\??\c:\thhbtn.exec:\thhbtn.exe63⤵
- Executes dropped EXE
PID:3288 -
\??\c:\hnbttt.exec:\hnbttt.exe64⤵
- Executes dropped EXE
PID:1960 -
\??\c:\3vdvp.exec:\3vdvp.exe65⤵
- Executes dropped EXE
PID:3160 -
\??\c:\jdvjd.exec:\jdvjd.exe66⤵PID:2584
-
\??\c:\llffxxr.exec:\llffxxr.exe67⤵PID:3856
-
\??\c:\fflfxxr.exec:\fflfxxr.exe68⤵PID:1956
-
\??\c:\bnhhhb.exec:\bnhhhb.exe69⤵PID:520
-
\??\c:\jjpdj.exec:\jjpdj.exe70⤵PID:4364
-
\??\c:\pjdvp.exec:\pjdvp.exe71⤵PID:4580
-
\??\c:\7lrrlll.exec:\7lrrlll.exe72⤵PID:680
-
\??\c:\xrrlfll.exec:\xrrlfll.exe73⤵PID:2144
-
\??\c:\tnnnhh.exec:\tnnnhh.exe74⤵PID:220
-
\??\c:\jdvjd.exec:\jdvjd.exe75⤵PID:2980
-
\??\c:\3xlfffx.exec:\3xlfffx.exe76⤵PID:3196
-
\??\c:\lrllfxx.exec:\lrllfxx.exe77⤵PID:892
-
\??\c:\btttnn.exec:\btttnn.exe78⤵PID:2112
-
\??\c:\nnnhht.exec:\nnnhht.exe79⤵PID:3448
-
\??\c:\pjjdp.exec:\pjjdp.exe80⤵PID:3600
-
\??\c:\3jpjj.exec:\3jpjj.exe81⤵PID:1000
-
\??\c:\xrrrllf.exec:\xrrrllf.exe82⤵PID:4428
-
\??\c:\lffxrlf.exec:\lffxrlf.exe83⤵PID:1828
-
\??\c:\thhhhh.exec:\thhhhh.exe84⤵PID:3040
-
\??\c:\jvvpj.exec:\jvvpj.exe85⤵PID:2332
-
\??\c:\vvdpd.exec:\vvdpd.exe86⤵PID:3140
-
\??\c:\fxxrllf.exec:\fxxrllf.exe87⤵PID:1236
-
\??\c:\xxllfff.exec:\xxllfff.exe88⤵PID:4164
-
\??\c:\hnbthn.exec:\hnbthn.exe89⤵PID:4628
-
\??\c:\tnhbtn.exec:\tnhbtn.exe90⤵PID:4776
-
\??\c:\pppjv.exec:\pppjv.exe91⤵PID:4144
-
\??\c:\5xfxrlf.exec:\5xfxrlf.exe92⤵PID:1988
-
\??\c:\lfrllrr.exec:\lfrllrr.exe93⤵PID:3616
-
\??\c:\tntnhh.exec:\tntnhh.exe94⤵PID:4684
-
\??\c:\jdjdv.exec:\jdjdv.exe95⤵PID:2244
-
\??\c:\5fxrlll.exec:\5fxrlll.exe96⤵PID:1656
-
\??\c:\lfxrllx.exec:\lfxrllx.exe97⤵PID:4872
-
\??\c:\hbtttt.exec:\hbtttt.exe98⤵PID:1328
-
\??\c:\dddvj.exec:\dddvj.exe99⤵PID:1148
-
\??\c:\xllfxrl.exec:\xllfxrl.exe100⤵PID:5056
-
\??\c:\tbbntn.exec:\tbbntn.exe101⤵PID:1752
-
\??\c:\pjjdv.exec:\pjjdv.exe102⤵PID:1604
-
\??\c:\ntbnbt.exec:\ntbnbt.exe103⤵PID:376
-
\??\c:\ddpdj.exec:\ddpdj.exe104⤵PID:2708
-
\??\c:\jvpdp.exec:\jvpdp.exe105⤵PID:3504
-
\??\c:\bhntth.exec:\bhntth.exe106⤵PID:4568
-
\??\c:\pjjdv.exec:\pjjdv.exe107⤵PID:688
-
\??\c:\ffrxrxr.exec:\ffrxrxr.exe108⤵PID:3288
-
\??\c:\9tthbh.exec:\9tthbh.exe109⤵PID:1960
-
\??\c:\nbtnht.exec:\nbtnht.exe110⤵PID:1768
-
\??\c:\vpvvv.exec:\vpvvv.exe111⤵PID:232
-
\??\c:\xxflxff.exec:\xxflxff.exe112⤵PID:3548
-
\??\c:\hbtnhb.exec:\hbtnhb.exe113⤵PID:1608
-
\??\c:\xfrrfff.exec:\xfrrfff.exe114⤵PID:1080
-
\??\c:\hhhbtn.exec:\hhhbtn.exe115⤵PID:4512
-
\??\c:\ttttbh.exec:\ttttbh.exe116⤵PID:3456
-
\??\c:\vjjdp.exec:\vjjdp.exe117⤵PID:4124
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe118⤵PID:1704
-
\??\c:\rrrfllr.exec:\rrrfllr.exe119⤵PID:1400
-
\??\c:\bbbhbb.exec:\bbbhbb.exe120⤵PID:3112
-
\??\c:\bthbtt.exec:\bthbtt.exe121⤵PID:4556
-
\??\c:\jjppj.exec:\jjppj.exe122⤵PID:920
-
\??\c:\xrrxrxx.exec:\xrrxrxx.exe123⤵PID:2208
-
\??\c:\rrrlffx.exec:\rrrlffx.exe124⤵PID:2624
-
\??\c:\hbnhnn.exec:\hbnhnn.exe125⤵PID:4640
-
\??\c:\bhbtnt.exec:\bhbtnt.exe126⤵PID:2312
-
\??\c:\pdddv.exec:\pdddv.exe127⤵PID:4224
-
\??\c:\rllfffx.exec:\rllfffx.exe128⤵PID:3528
-
\??\c:\3lxxrrl.exec:\3lxxrrl.exe129⤵PID:1236
-
\??\c:\3tnhbt.exec:\3tnhbt.exe130⤵PID:2164
-
\??\c:\5jvdv.exec:\5jvdv.exe131⤵PID:3104
-
\??\c:\vpdvd.exec:\vpdvd.exe132⤵PID:4228
-
\??\c:\xrxrffx.exec:\xrxrffx.exe133⤵PID:3264
-
\??\c:\htnhbb.exec:\htnhbb.exe134⤵PID:2680
-
\??\c:\tntthh.exec:\tntthh.exe135⤵PID:3832
-
\??\c:\pppdp.exec:\pppdp.exe136⤵PID:2376
-
\??\c:\rlrllll.exec:\rlrllll.exe137⤵PID:1336
-
\??\c:\rlfrlff.exec:\rlfrlff.exe138⤵PID:3144
-
\??\c:\tttnnn.exec:\tttnnn.exe139⤵PID:5060
-
\??\c:\pvvpj.exec:\pvvpj.exe140⤵PID:1148
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe141⤵PID:4328
-
\??\c:\rxfxxrl.exec:\rxfxxrl.exe142⤵PID:1792
-
\??\c:\nbbthh.exec:\nbbthh.exe143⤵PID:4612
-
\??\c:\vpvpd.exec:\vpvpd.exe144⤵PID:4104
-
\??\c:\vvpjd.exec:\vvpjd.exe145⤵PID:1920
-
\??\c:\rxllffx.exec:\rxllffx.exe146⤵PID:4568
-
\??\c:\thbtnh.exec:\thbtnh.exe147⤵PID:4080
-
\??\c:\bbhbtn.exec:\bbhbtn.exe148⤵PID:3292
-
\??\c:\9pvpj.exec:\9pvpj.exe149⤵PID:4892
-
\??\c:\xxxrffx.exec:\xxxrffx.exe150⤵PID:816
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe151⤵PID:2660
-
\??\c:\hhtnnn.exec:\hhtnnn.exe152⤵PID:4008
-
\??\c:\vvpdp.exec:\vvpdp.exe153⤵PID:1916
-
\??\c:\lfflllf.exec:\lfflllf.exe154⤵PID:432
-
\??\c:\llllfll.exec:\llllfll.exe155⤵PID:1484
-
\??\c:\tnhtnt.exec:\tnhtnt.exe156⤵PID:3164
-
\??\c:\jjppd.exec:\jjppd.exe157⤵PID:632
-
\??\c:\7llfrrx.exec:\7llfrrx.exe158⤵PID:456
-
\??\c:\bnnnbb.exec:\bnnnbb.exe159⤵PID:3628
-
\??\c:\btnhtt.exec:\btnhtt.exe160⤵PID:1052
-
\??\c:\vvdvj.exec:\vvdvj.exe161⤵PID:4912
-
\??\c:\rrrrlll.exec:\rrrrlll.exe162⤵PID:4176
-
\??\c:\thhhbb.exec:\thhhbb.exe163⤵PID:2812
-
\??\c:\ppppv.exec:\ppppv.exe164⤵PID:1720
-
\??\c:\flrrfxr.exec:\flrrfxr.exe165⤵PID:1132
-
\??\c:\lxlrxxx.exec:\lxlrxxx.exe166⤵PID:3036
-
\??\c:\hbbtnh.exec:\hbbtnh.exe167⤵PID:2808
-
\??\c:\dvdvp.exec:\dvdvp.exe168⤵PID:5032
-
\??\c:\pjjjv.exec:\pjjjv.exe169⤵PID:332
-
\??\c:\frrlxrl.exec:\frrlxrl.exe170⤵PID:4684
-
\??\c:\nbhbbb.exec:\nbhbbb.exe171⤵PID:4480
-
\??\c:\vvdvd.exec:\vvdvd.exe172⤵PID:3364
-
\??\c:\fxxllll.exec:\fxxllll.exe173⤵PID:4084
-
\??\c:\fxllffx.exec:\fxllffx.exe174⤵PID:3876
-
\??\c:\htbhht.exec:\htbhht.exe175⤵PID:1056
-
\??\c:\xlrllrl.exec:\xlrllrl.exe176⤵PID:1420
-
\??\c:\bttnbb.exec:\bttnbb.exe177⤵PID:1752
-
\??\c:\xrfxrlf.exec:\xrfxrlf.exe178⤵PID:4284
-
\??\c:\tttbtt.exec:\tttbtt.exe179⤵PID:4460
-
\??\c:\nbbthb.exec:\nbbthb.exe180⤵PID:4104
-
\??\c:\xrrrfxr.exec:\xrrrfxr.exe181⤵PID:1920
-
\??\c:\bhbnbt.exec:\bhbnbt.exe182⤵PID:3288
-
\??\c:\bhtnhb.exec:\bhtnhb.exe183⤵PID:4080
-
\??\c:\jvdvv.exec:\jvdvv.exe184⤵PID:232
-
\??\c:\xxfffll.exec:\xxfffll.exe185⤵PID:4892
-
\??\c:\flrxrrl.exec:\flrxrrl.exe186⤵PID:3460
-
\??\c:\nhnnhh.exec:\nhnnhh.exe187⤵PID:4584
-
\??\c:\thtnnh.exec:\thtnnh.exe188⤵PID:4860
-
\??\c:\jdddj.exec:\jdddj.exe189⤵PID:1244
-
\??\c:\3rrlxrl.exec:\3rrlxrl.exe190⤵PID:4372
-
\??\c:\bbhbbb.exec:\bbhbbb.exe191⤵PID:1144
-
\??\c:\ttbbbb.exec:\ttbbbb.exe192⤵PID:632
-
\??\c:\vdvpj.exec:\vdvpj.exe193⤵PID:2176
-
\??\c:\rxrfxxr.exec:\rxrfxxr.exe194⤵PID:4692
-
\??\c:\xfxrllf.exec:\xfxrllf.exe195⤵PID:1052
-
\??\c:\nhtnht.exec:\nhtnht.exe196⤵PID:1972
-
\??\c:\bbbnnn.exec:\bbbnnn.exe197⤵PID:1068
-
\??\c:\ppvjd.exec:\ppvjd.exe198⤵PID:2812
-
\??\c:\lxlrxrf.exec:\lxlrxrf.exe199⤵PID:5020
-
\??\c:\rrrrffl.exec:\rrrrffl.exe200⤵PID:4952
-
\??\c:\1bbbtt.exec:\1bbbtt.exe201⤵PID:3036
-
\??\c:\dpvvj.exec:\dpvvj.exe202⤵PID:2808
-
\??\c:\jjvpj.exec:\jjvpj.exe203⤵PID:3220
-
\??\c:\xxrfxfl.exec:\xxrfxfl.exe204⤵PID:3768
-
\??\c:\fflxxxr.exec:\fflxxxr.exe205⤵PID:1700
-
\??\c:\bttnhb.exec:\bttnhb.exe206⤵PID:2376
-
\??\c:\jdjdp.exec:\jdjdp.exe207⤵PID:4984
-
\??\c:\jpvpj.exec:\jpvpj.exe208⤵PID:2196
-
\??\c:\5xfrllf.exec:\5xfrllf.exe209⤵PID:3876
-
\??\c:\llrlrlr.exec:\llrlrlr.exe210⤵PID:3520
-
\??\c:\nntttt.exec:\nntttt.exe211⤵PID:1420
-
\??\c:\pjdjj.exec:\pjdjj.exe212⤵PID:4492
-
\??\c:\vpvpp.exec:\vpvpp.exe213⤵PID:2040
-
\??\c:\xlrrfff.exec:\xlrrfff.exe214⤵PID:3396
-
\??\c:\xxxlffr.exec:\xxxlffr.exe215⤵PID:4104
-
\??\c:\3ttnnn.exec:\3ttnnn.exe216⤵PID:416
-
\??\c:\tbhtnh.exec:\tbhtnh.exe217⤵PID:3500
-
\??\c:\vdjdp.exec:\vdjdp.exe218⤵PID:4364
-
\??\c:\3rxlffx.exec:\3rxlffx.exe219⤵PID:1964
-
\??\c:\rxffxxr.exec:\rxffxxr.exe220⤵PID:4992
-
\??\c:\nhhhbb.exec:\nhhhbb.exe221⤵PID:2780
-
\??\c:\tbbbnn.exec:\tbbbnn.exe222⤵PID:4892
-
\??\c:\ppjjd.exec:\ppjjd.exe223⤵PID:4512
-
\??\c:\xrxrfff.exec:\xrxrfff.exe224⤵PID:2144
-
\??\c:\lfffxrr.exec:\lfffxrr.exe225⤵PID:4860
-
\??\c:\nhhbtn.exec:\nhhbtn.exe226⤵PID:1244
-
\??\c:\ddddd.exec:\ddddd.exe227⤵PID:224
-
\??\c:\djpjv.exec:\djpjv.exe228⤵PID:456
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe229⤵PID:2208
-
\??\c:\fxrrrrl.exec:\fxrrrrl.exe230⤵PID:3448
-
\??\c:\hbtnnn.exec:\hbtnnn.exe231⤵PID:2464
-
\??\c:\vjjdv.exec:\vjjdv.exe232⤵PID:4692
-
\??\c:\dvdvv.exec:\dvdvv.exe233⤵PID:2312
-
\??\c:\xrrlflf.exec:\xrrlflf.exe234⤵PID:1972
-
\??\c:\lrfxrxx.exec:\lrfxrxx.exe235⤵PID:1720
-
\??\c:\5hnhhh.exec:\5hnhhh.exe236⤵PID:2812
-
\??\c:\bbhbtt.exec:\bbhbtt.exe237⤵PID:5020
-
\??\c:\jvdvj.exec:\jvdvj.exe238⤵PID:4952
-
\??\c:\xlrlxxl.exec:\xlrlxxl.exe239⤵PID:3036
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe240⤵PID:2808
-
\??\c:\nbbbbt.exec:\nbbbbt.exe241⤵PID:3220
-
\??\c:\pjdvv.exec:\pjdvv.exe242⤵PID:2244