Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 19:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23acc4417910610065119f24ad54e5b9bcd024f8629922bbd1df64c9c036f81c.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
23acc4417910610065119f24ad54e5b9bcd024f8629922bbd1df64c9c036f81c.exe
-
Size
128KB
-
MD5
b70a203afbc921759dcc4b771a79afcf
-
SHA1
e29447e64e46a939cb8de133449322fe9406121e
-
SHA256
23acc4417910610065119f24ad54e5b9bcd024f8629922bbd1df64c9c036f81c
-
SHA512
f9e91ac5e9a41c30d9aa5b2499c9f7e6b55b3768ba64325f76655155b1567a1af1f02e13d1bba7e79fc26de7cb323986ad6ed64e453de12b540f33476765c5cd
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX/x6gtc:n3C9BRW0j/uVEZFJvm
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2492-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2492-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2492-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2688-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2776-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2776-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2776-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2776-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2432-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2408-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2408-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2880-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1764-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2728-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2868-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2900-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1892-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2928-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/324-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1472-240-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1672-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2840-302-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
xrxxrff.exe3bnhnn.exehbtbnt.exejdppv.exexrllrrx.exe1tbbhh.exe1vvjj.exexxxrlfx.exetthtbn.exethtbbh.exejjjpp.exerlrffff.exehnnnht.exetnhntt.exe9jjjj.exe7rrxrlr.exehbnhhn.exe5nbbnh.exejjjjd.exeppddd.exerlfrxfx.exetnbhnt.exetthbhh.exevpjjv.exepjdjp.exellfxrrf.exexrxfllx.exehththh.exejdjvv.exerfxrlrr.exehbntbh.exejdjjj.exe5thhnb.exejpdvp.exevjppv.exeffxlflx.exelxlrffr.exebbbbhn.exedpdvp.exejvjvd.exe9vjdd.exelflllrx.exelfxfrfr.exe5bbhtb.exehbnttb.exedvddj.exevddjp.exerflxflf.exexfrrfxf.exetthhnh.exejddvd.exevvpdj.exelfrrffx.exe9xrfllx.exebtbbnh.exevpjvd.exejvvpv.exelfxxfxf.exexrlrffx.exerfxlxfl.exe1bttbn.exeddppd.exeppdvd.exexrxrffr.exepid process 2688 xrxxrff.exe 2624 3bnhnn.exe 2632 hbtbnt.exe 2776 jdppv.exe 2432 xrllrrx.exe 2408 1tbbhh.exe 2880 1vvjj.exe 1764 xxxrlfx.exe 2728 tthtbn.exe 2868 thtbbh.exe 2900 jjjpp.exe 1452 rlrffff.exe 1892 hnnnht.exe 2380 tnhntt.exe 2656 9jjjj.exe 2928 7rrxrlr.exe 1028 hbnhhn.exe 2260 5nbbnh.exe 324 jjjjd.exe 2100 ppddd.exe 2088 rlfrxfx.exe 1420 tnbhnt.exe 852 tthbhh.exe 1472 vpjjv.exe 452 pjdjp.exe 776 llfxrrf.exe 472 xrxfllx.exe 108 hththh.exe 712 jdjvv.exe 1672 rfxrlrr.exe 2840 hbntbh.exe 3020 jdjjj.exe 1896 5thhnb.exe 2192 jpdvp.exe 2980 vjppv.exe 1532 ffxlflx.exe 2564 lxlrffr.exe 2988 bbbbhn.exe 2560 dpdvp.exe 2600 jvjvd.exe 2776 9vjdd.exe 2404 lflllrx.exe 2480 lfxfrfr.exe 2876 5bbhtb.exe 2584 hbnttb.exe 2704 dvddj.exe 2724 vddjp.exe 2864 rflxflf.exe 2836 xfrrfxf.exe 2900 tthhnh.exe 1624 jddvd.exe 1808 vvpdj.exe 1520 lfrrffx.exe 2896 9xrfllx.exe 2212 btbbnh.exe 2032 vpjvd.exe 2504 jvvpv.exe 688 lfxxfxf.exe 1928 xrlrffx.exe 2068 rfxlxfl.exe 2240 1bttbn.exe 1076 ddppd.exe 2804 ppdvd.exe 1712 xrxrffr.exe -
Processes:
resource yara_rule behavioral1/memory/2492-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
23acc4417910610065119f24ad54e5b9bcd024f8629922bbd1df64c9c036f81c.exexrxxrff.exe3bnhnn.exehbtbnt.exejdppv.exexrllrrx.exe1tbbhh.exe1vvjj.exexxxrlfx.exetthtbn.exethtbbh.exejjjpp.exerlrffff.exehnnnht.exetnhntt.exe9jjjj.exedescription pid process target process PID 2492 wrote to memory of 2688 2492 23acc4417910610065119f24ad54e5b9bcd024f8629922bbd1df64c9c036f81c.exe xrxxrff.exe PID 2492 wrote to memory of 2688 2492 23acc4417910610065119f24ad54e5b9bcd024f8629922bbd1df64c9c036f81c.exe xrxxrff.exe PID 2492 wrote to memory of 2688 2492 23acc4417910610065119f24ad54e5b9bcd024f8629922bbd1df64c9c036f81c.exe xrxxrff.exe PID 2492 wrote to memory of 2688 2492 23acc4417910610065119f24ad54e5b9bcd024f8629922bbd1df64c9c036f81c.exe xrxxrff.exe PID 2688 wrote to memory of 2624 2688 xrxxrff.exe 3bnhnn.exe PID 2688 wrote to memory of 2624 2688 xrxxrff.exe 3bnhnn.exe PID 2688 wrote to memory of 2624 2688 xrxxrff.exe 3bnhnn.exe PID 2688 wrote to memory of 2624 2688 xrxxrff.exe 3bnhnn.exe PID 2624 wrote to memory of 2632 2624 3bnhnn.exe hbtbnt.exe PID 2624 wrote to memory of 2632 2624 3bnhnn.exe hbtbnt.exe PID 2624 wrote to memory of 2632 2624 3bnhnn.exe hbtbnt.exe PID 2624 wrote to memory of 2632 2624 3bnhnn.exe hbtbnt.exe PID 2632 wrote to memory of 2776 2632 hbtbnt.exe jdppv.exe PID 2632 wrote to memory of 2776 2632 hbtbnt.exe jdppv.exe PID 2632 wrote to memory of 2776 2632 hbtbnt.exe jdppv.exe PID 2632 wrote to memory of 2776 2632 hbtbnt.exe jdppv.exe PID 2776 wrote to memory of 2432 2776 jdppv.exe xrllrrx.exe PID 2776 wrote to memory of 2432 2776 jdppv.exe xrllrrx.exe PID 2776 wrote to memory of 2432 2776 jdppv.exe xrllrrx.exe PID 2776 wrote to memory of 2432 2776 jdppv.exe xrllrrx.exe PID 2432 wrote to memory of 2408 2432 xrllrrx.exe 1tbbhh.exe PID 2432 wrote to memory of 2408 2432 xrllrrx.exe 1tbbhh.exe PID 2432 wrote to memory of 2408 2432 xrllrrx.exe 1tbbhh.exe PID 2432 wrote to memory of 2408 2432 xrllrrx.exe 1tbbhh.exe PID 2408 wrote to memory of 2880 2408 1tbbhh.exe 1vvjj.exe PID 2408 wrote to memory of 2880 2408 1tbbhh.exe 1vvjj.exe PID 2408 wrote to memory of 2880 2408 1tbbhh.exe 1vvjj.exe PID 2408 wrote to memory of 2880 2408 1tbbhh.exe 1vvjj.exe PID 2880 wrote to memory of 1764 2880 1vvjj.exe xxxrlfx.exe PID 2880 wrote to memory of 1764 2880 1vvjj.exe xxxrlfx.exe PID 2880 wrote to memory of 1764 2880 1vvjj.exe xxxrlfx.exe PID 2880 wrote to memory of 1764 2880 1vvjj.exe xxxrlfx.exe PID 1764 wrote to memory of 2728 1764 xxxrlfx.exe tthtbn.exe PID 1764 wrote to memory of 2728 1764 xxxrlfx.exe tthtbn.exe PID 1764 wrote to memory of 2728 1764 xxxrlfx.exe tthtbn.exe PID 1764 wrote to memory of 2728 1764 xxxrlfx.exe tthtbn.exe PID 2728 wrote to memory of 2868 2728 tthtbn.exe thtbbh.exe PID 2728 wrote to memory of 2868 2728 tthtbn.exe thtbbh.exe PID 2728 wrote to memory of 2868 2728 tthtbn.exe thtbbh.exe PID 2728 wrote to memory of 2868 2728 tthtbn.exe thtbbh.exe PID 2868 wrote to memory of 2900 2868 thtbbh.exe jjjpp.exe PID 2868 wrote to memory of 2900 2868 thtbbh.exe jjjpp.exe PID 2868 wrote to memory of 2900 2868 thtbbh.exe jjjpp.exe PID 2868 wrote to memory of 2900 2868 thtbbh.exe jjjpp.exe PID 2900 wrote to memory of 1452 2900 jjjpp.exe rlrffff.exe PID 2900 wrote to memory of 1452 2900 jjjpp.exe rlrffff.exe PID 2900 wrote to memory of 1452 2900 jjjpp.exe rlrffff.exe PID 2900 wrote to memory of 1452 2900 jjjpp.exe rlrffff.exe PID 1452 wrote to memory of 1892 1452 rlrffff.exe hnnnht.exe PID 1452 wrote to memory of 1892 1452 rlrffff.exe hnnnht.exe PID 1452 wrote to memory of 1892 1452 rlrffff.exe hnnnht.exe PID 1452 wrote to memory of 1892 1452 rlrffff.exe hnnnht.exe PID 1892 wrote to memory of 2380 1892 hnnnht.exe tnhntt.exe PID 1892 wrote to memory of 2380 1892 hnnnht.exe tnhntt.exe PID 1892 wrote to memory of 2380 1892 hnnnht.exe tnhntt.exe PID 1892 wrote to memory of 2380 1892 hnnnht.exe tnhntt.exe PID 2380 wrote to memory of 2656 2380 tnhntt.exe 9jjjj.exe PID 2380 wrote to memory of 2656 2380 tnhntt.exe 9jjjj.exe PID 2380 wrote to memory of 2656 2380 tnhntt.exe 9jjjj.exe PID 2380 wrote to memory of 2656 2380 tnhntt.exe 9jjjj.exe PID 2656 wrote to memory of 2928 2656 9jjjj.exe 7rrxrlr.exe PID 2656 wrote to memory of 2928 2656 9jjjj.exe 7rrxrlr.exe PID 2656 wrote to memory of 2928 2656 9jjjj.exe 7rrxrlr.exe PID 2656 wrote to memory of 2928 2656 9jjjj.exe 7rrxrlr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23acc4417910610065119f24ad54e5b9bcd024f8629922bbd1df64c9c036f81c.exe"C:\Users\Admin\AppData\Local\Temp\23acc4417910610065119f24ad54e5b9bcd024f8629922bbd1df64c9c036f81c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\xrxxrff.exec:\xrxxrff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\3bnhnn.exec:\3bnhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\hbtbnt.exec:\hbtbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\jdppv.exec:\jdppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xrllrrx.exec:\xrllrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\1tbbhh.exec:\1tbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\1vvjj.exec:\1vvjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\tthtbn.exec:\tthtbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\thtbbh.exec:\thtbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\jjjpp.exec:\jjjpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\rlrffff.exec:\rlrffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\hnnnht.exec:\hnnnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\tnhntt.exec:\tnhntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\9jjjj.exec:\9jjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\7rrxrlr.exec:\7rrxrlr.exe17⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hbnhhn.exec:\hbnhhn.exe18⤵
- Executes dropped EXE
PID:1028 -
\??\c:\5nbbnh.exec:\5nbbnh.exe19⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jjjjd.exec:\jjjjd.exe20⤵
- Executes dropped EXE
PID:324 -
\??\c:\ppddd.exec:\ppddd.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rlfrxfx.exec:\rlfrxfx.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tnbhnt.exec:\tnbhnt.exe23⤵
- Executes dropped EXE
PID:1420 -
\??\c:\tthbhh.exec:\tthbhh.exe24⤵
- Executes dropped EXE
PID:852 -
\??\c:\vpjjv.exec:\vpjjv.exe25⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pjdjp.exec:\pjdjp.exe26⤵
- Executes dropped EXE
PID:452 -
\??\c:\llfxrrf.exec:\llfxrrf.exe27⤵
- Executes dropped EXE
PID:776 -
\??\c:\xrxfllx.exec:\xrxfllx.exe28⤵
- Executes dropped EXE
PID:472 -
\??\c:\hththh.exec:\hththh.exe29⤵
- Executes dropped EXE
PID:108 -
\??\c:\jdjvv.exec:\jdjvv.exe30⤵
- Executes dropped EXE
PID:712 -
\??\c:\rfxrlrr.exec:\rfxrlrr.exe31⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hbntbh.exec:\hbntbh.exe32⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jdjjj.exec:\jdjjj.exe33⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5thhnb.exec:\5thhnb.exe34⤵
- Executes dropped EXE
PID:1896 -
\??\c:\jpdvp.exec:\jpdvp.exe35⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vjppv.exec:\vjppv.exe36⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ffxlflx.exec:\ffxlflx.exe37⤵
- Executes dropped EXE
PID:1532 -
\??\c:\lxlrffr.exec:\lxlrffr.exe38⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bbbbhn.exec:\bbbbhn.exe39⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dpdvp.exec:\dpdvp.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jvjvd.exec:\jvjvd.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\9vjdd.exec:\9vjdd.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lflllrx.exec:\lflllrx.exe43⤵
- Executes dropped EXE
PID:2404 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe44⤵
- Executes dropped EXE
PID:2480 -
\??\c:\5bbhtb.exec:\5bbhtb.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hbnttb.exec:\hbnttb.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dvddj.exec:\dvddj.exe47⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vddjp.exec:\vddjp.exe48⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rflxflf.exec:\rflxflf.exe49⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xfrrfxf.exec:\xfrrfxf.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\tthhnh.exec:\tthhnh.exe51⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jddvd.exec:\jddvd.exe52⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vvpdj.exec:\vvpdj.exe53⤵
- Executes dropped EXE
PID:1808 -
\??\c:\lfrrffx.exec:\lfrrffx.exe54⤵
- Executes dropped EXE
PID:1520 -
\??\c:\9xrfllx.exec:\9xrfllx.exe55⤵
- Executes dropped EXE
PID:2896 -
\??\c:\btbbnh.exec:\btbbnh.exe56⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vpjvd.exec:\vpjvd.exe57⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jvvpv.exec:\jvvpv.exe58⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lfxxfxf.exec:\lfxxfxf.exe59⤵
- Executes dropped EXE
PID:688 -
\??\c:\xrlrffx.exec:\xrlrffx.exe60⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rfxlxfl.exec:\rfxlxfl.exe61⤵
- Executes dropped EXE
PID:2068 -
\??\c:\1bttbn.exec:\1bttbn.exe62⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ddppd.exec:\ddppd.exe63⤵
- Executes dropped EXE
PID:1076 -
\??\c:\ppdvd.exec:\ppdvd.exe64⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xrxrffr.exec:\xrxrffr.exe65⤵
- Executes dropped EXE
PID:1712 -
\??\c:\btnnbh.exec:\btnnbh.exe66⤵PID:1400
-
\??\c:\bntttn.exec:\bntttn.exe67⤵PID:1472
-
\??\c:\9jpdj.exec:\9jpdj.exe68⤵PID:2964
-
\??\c:\9pdjp.exec:\9pdjp.exe69⤵PID:1556
-
\??\c:\frxrlxx.exec:\frxrlxx.exe70⤵PID:780
-
\??\c:\9hhtbb.exec:\9hhtbb.exe71⤵PID:2932
-
\??\c:\tnhhhh.exec:\tnhhhh.exe72⤵PID:280
-
\??\c:\dvdjp.exec:\dvdjp.exe73⤵PID:1628
-
\??\c:\jvppd.exec:\jvppd.exe74⤵PID:1948
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe75⤵PID:648
-
\??\c:\xlrfxxf.exec:\xlrfxxf.exe76⤵PID:2840
-
\??\c:\nbtbhn.exec:\nbtbhn.exe77⤵PID:1444
-
\??\c:\btbbhh.exec:\btbbhh.exe78⤵PID:2492
-
\??\c:\vppvp.exec:\vppvp.exe79⤵PID:2548
-
\??\c:\1jvvj.exec:\1jvvj.exe80⤵PID:1540
-
\??\c:\fxllffr.exec:\fxllffr.exe81⤵PID:3008
-
\??\c:\xxlrxlr.exec:\xxlrxlr.exe82⤵PID:2976
-
\??\c:\tnbtbb.exec:\tnbtbb.exe83⤵PID:2524
-
\??\c:\5ntbbb.exec:\5ntbbb.exe84⤵PID:2696
-
\??\c:\vpjpv.exec:\vpjpv.exe85⤵PID:2576
-
\??\c:\fxlrflr.exec:\fxlrflr.exe86⤵PID:2440
-
\??\c:\1rlrxxr.exec:\1rlrxxr.exe87⤵PID:2872
-
\??\c:\nnhnbh.exec:\nnhnbh.exe88⤵PID:2884
-
\??\c:\tthhtn.exec:\tthhtn.exe89⤵PID:2880
-
\??\c:\ddvvj.exec:\ddvvj.exe90⤵PID:2588
-
\??\c:\jdjjp.exec:\jdjjp.exe91⤵PID:2756
-
\??\c:\xlxfllf.exec:\xlxfllf.exe92⤵PID:2852
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe93⤵PID:1496
-
\??\c:\tnhnnt.exec:\tnhnnt.exe94⤵PID:2144
-
\??\c:\7bnttt.exec:\7bnttt.exe95⤵PID:1800
-
\??\c:\jpjpp.exec:\jpjpp.exe96⤵PID:868
-
\??\c:\xffxfxl.exec:\xffxfxl.exe97⤵PID:1292
-
\??\c:\fffllrf.exec:\fffllrf.exe98⤵PID:536
-
\??\c:\7thbhb.exec:\7thbhb.exe99⤵PID:860
-
\??\c:\nbbthh.exec:\nbbthh.exe100⤵PID:1168
-
\??\c:\9vvjv.exec:\9vvjv.exe101⤵PID:2036
-
\??\c:\rlxfffl.exec:\rlxfffl.exe102⤵PID:1916
-
\??\c:\lxxlrff.exec:\lxxlrff.exe103⤵PID:2124
-
\??\c:\tnbhhn.exec:\tnbhhn.exe104⤵PID:2260
-
\??\c:\nhnnbb.exec:\nhnnbb.exe105⤵PID:2100
-
\??\c:\djvdj.exec:\djvdj.exe106⤵PID:2256
-
\??\c:\ddddv.exec:\ddddv.exe107⤵PID:1792
-
\??\c:\lxlrffl.exec:\lxlrffl.exe108⤵PID:652
-
\??\c:\btnthb.exec:\btnthb.exe109⤵PID:2008
-
\??\c:\btbhnn.exec:\btbhnn.exe110⤵PID:2984
-
\??\c:\llllffl.exec:\llllffl.exe111⤵PID:964
-
\??\c:\bththn.exec:\bththn.exe112⤵PID:320
-
\??\c:\1nnntt.exec:\1nnntt.exe113⤵PID:820
-
\??\c:\jdpdp.exec:\jdpdp.exe114⤵PID:1708
-
\??\c:\vvjpd.exec:\vvjpd.exe115⤵PID:2132
-
\??\c:\xrlrxlx.exec:\xrlrxlx.exe116⤵PID:712
-
\??\c:\fxlllrx.exec:\fxlllrx.exe117⤵PID:1628
-
\??\c:\3bbhtn.exec:\3bbhtn.exe118⤵PID:1948
-
\??\c:\tnnbnn.exec:\tnnbnn.exe119⤵PID:1736
-
\??\c:\vjppv.exec:\vjppv.exe120⤵PID:1732
-
\??\c:\vpvvv.exec:\vpvvv.exe121⤵PID:1896
-
\??\c:\xrrfffr.exec:\xrrfffr.exe122⤵PID:2192
-
\??\c:\flllflf.exec:\flllflf.exe123⤵PID:1536
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe124⤵PID:1532
-
\??\c:\9tthnn.exec:\9tthnn.exe125⤵PID:2624
-
\??\c:\1vjjj.exec:\1vjjj.exe126⤵PID:2988
-
\??\c:\3vjpv.exec:\3vjpv.exe127⤵PID:2436
-
\??\c:\3xllllf.exec:\3xllllf.exe128⤵PID:2600
-
\??\c:\lfxlffr.exec:\lfxlffr.exe129⤵PID:2472
-
\??\c:\7btbbt.exec:\7btbbt.exe130⤵PID:2404
-
\??\c:\htnbbn.exec:\htnbbn.exe131⤵PID:2460
-
\??\c:\3jpdd.exec:\3jpdd.exe132⤵PID:2876
-
\??\c:\vdjvv.exec:\vdjvv.exe133⤵PID:2584
-
\??\c:\xxxffrl.exec:\xxxffrl.exe134⤵PID:2716
-
\??\c:\xxfrllf.exec:\xxfrllf.exe135⤵PID:2724
-
\??\c:\htbtbb.exec:\htbtbb.exe136⤵PID:2596
-
\??\c:\nnthhn.exec:\nnthhn.exe137⤵PID:2836
-
\??\c:\vpjpp.exec:\vpjpp.exe138⤵PID:2868
-
\??\c:\xrfxlrf.exec:\xrfxlrf.exe139⤵PID:2288
-
\??\c:\lxlrffl.exec:\lxlrffl.exe140⤵PID:1808
-
\??\c:\ttbbhb.exec:\ttbbhb.exe141⤵PID:1520
-
\??\c:\nhtbbt.exec:\nhtbbt.exe142⤵PID:2896
-
\??\c:\djjvv.exec:\djjvv.exe143⤵PID:704
-
\??\c:\5jddd.exec:\5jddd.exe144⤵PID:2032
-
\??\c:\7fxrfxl.exec:\7fxrfxl.exe145⤵PID:496
-
\??\c:\7xlxrfl.exec:\7xlxrfl.exe146⤵PID:688
-
\??\c:\bnbbhb.exec:\bnbbhb.exe147⤵PID:2160
-
\??\c:\ddjpd.exec:\ddjpd.exe148⤵PID:2068
-
\??\c:\pjvjj.exec:\pjvjj.exe149⤵PID:2240
-
\??\c:\fxllrlx.exec:\fxllrlx.exe150⤵PID:1076
-
\??\c:\xxxlxxl.exec:\xxxlxxl.exe151⤵PID:2804
-
\??\c:\thbbnn.exec:\thbbnn.exe152⤵PID:1712
-
\??\c:\1bhbtt.exec:\1bhbtt.exe153⤵PID:3028
-
\??\c:\pdpjj.exec:\pdpjj.exe154⤵PID:1472
-
\??\c:\jjjdd.exec:\jjjdd.exe155⤵PID:2964
-
\??\c:\rxlfffx.exec:\rxlfffx.exe156⤵PID:1556
-
\??\c:\xrffllx.exec:\xrffllx.exe157⤵PID:812
-
\??\c:\1tnbhn.exec:\1tnbhn.exe158⤵PID:2808
-
\??\c:\tnhntt.exec:\tnhntt.exe159⤵PID:2936
-
\??\c:\vvvdv.exec:\vvvdv.exe160⤵PID:2948
-
\??\c:\7dpjj.exec:\7dpjj.exe161⤵PID:568
-
\??\c:\9fxrxrx.exec:\9fxrxrx.exe162⤵PID:648
-
\??\c:\ffxxrfr.exec:\ffxxrfr.exe163⤵PID:2840
-
\??\c:\nbnntb.exec:\nbnntb.exe164⤵PID:900
-
\??\c:\bntnbt.exec:\bntnbt.exe165⤵PID:2892
-
\??\c:\ppvjj.exec:\ppvjj.exe166⤵PID:2488
-
\??\c:\pjvdj.exec:\pjvdj.exe167⤵PID:1540
-
\??\c:\llrfllf.exec:\llrfllf.exe168⤵PID:2536
-
\??\c:\btthhn.exec:\btthhn.exe169⤵PID:2976
-
\??\c:\nbnntb.exec:\nbnntb.exe170⤵PID:2524
-
\??\c:\3pdpv.exec:\3pdpv.exe171⤵PID:2696
-
\??\c:\lrxllff.exec:\lrxllff.exe172⤵PID:2576
-
\??\c:\llrffff.exec:\llrffff.exe173⤵PID:2580
-
\??\c:\5tnbbn.exec:\5tnbbn.exe174⤵PID:2404
-
\??\c:\7ppdp.exec:\7ppdp.exe175⤵PID:2228
-
\??\c:\lllxlrf.exec:\lllxlrf.exe176⤵PID:2880
-
\??\c:\9xrrxrf.exec:\9xrrxrf.exe177⤵PID:2704
-
\??\c:\hbnhhh.exec:\hbnhhh.exe178⤵PID:2708
-
\??\c:\thbbhn.exec:\thbbhn.exe179⤵PID:2864
-
\??\c:\1dpvd.exec:\1dpvd.exe180⤵PID:1576
-
\??\c:\xlllflr.exec:\xlllflr.exe181⤵PID:2900
-
\??\c:\xrfrllx.exec:\xrfrllx.exe182⤵PID:2144
-
\??\c:\tttnbb.exec:\tttnbb.exe183⤵PID:1636
-
\??\c:\7tntnn.exec:\7tntnn.exe184⤵PID:1432
-
\??\c:\jjpvj.exec:\jjpvj.exe185⤵PID:600
-
\??\c:\xrfflrx.exec:\xrfflrx.exe186⤵PID:1620
-
\??\c:\9hbbtb.exec:\9hbbtb.exe187⤵PID:604
-
\??\c:\5bbhnn.exec:\5bbhnn.exe188⤵PID:828
-
\??\c:\nhnnth.exec:\nhnnth.exe189⤵PID:2028
-
\??\c:\9vdvd.exec:\9vdvd.exe190⤵PID:2504
-
\??\c:\dpvpj.exec:\dpvpj.exe191⤵PID:2232
-
\??\c:\xrlxlrr.exec:\xrlxlrr.exe192⤵PID:996
-
\??\c:\lfllllr.exec:\lfllllr.exe193⤵PID:2256
-
\??\c:\9bbbtn.exec:\9bbbtn.exe194⤵PID:1076
-
\??\c:\tnhtbb.exec:\tnhtbb.exe195⤵PID:1244
-
\??\c:\7dvjp.exec:\7dvjp.exe196⤵PID:1740
-
\??\c:\5ppdj.exec:\5ppdj.exe197⤵PID:1136
-
\??\c:\lrllrlf.exec:\lrllrlf.exe198⤵PID:776
-
\??\c:\7flrflx.exec:\7flrflx.exe199⤵PID:1252
-
\??\c:\bhhbbt.exec:\bhhbbt.exe200⤵PID:1300
-
\??\c:\nhbhhh.exec:\nhbhhh.exe201⤵PID:2300
-
\??\c:\jvvjp.exec:\jvvjp.exe202⤵PID:2164
-
\??\c:\pjvdp.exec:\pjvdp.exe203⤵PID:2132
-
\??\c:\xxfxrll.exec:\xxfxrll.exe204⤵PID:2948
-
\??\c:\fxlxxrl.exec:\fxlxxrl.exe205⤵PID:2072
-
\??\c:\bbbbtb.exec:\bbbbtb.exe206⤵PID:1884
-
\??\c:\tthbnt.exec:\tthbnt.exe207⤵PID:2304
-
\??\c:\jdjpj.exec:\jdjpj.exe208⤵PID:2644
-
\??\c:\vvpdp.exec:\vvpdp.exe209⤵PID:1896
-
\??\c:\lfrlxrx.exec:\lfrlxrx.exe210⤵PID:2488
-
\??\c:\frllffl.exec:\frllffl.exe211⤵PID:2688
-
\??\c:\nnbbhh.exec:\nnbbhh.exe212⤵PID:1544
-
\??\c:\hhnbbh.exec:\hhnbbh.exe213⤵PID:1512
-
\??\c:\jdppd.exec:\jdppd.exe214⤵PID:2564
-
\??\c:\jdpvv.exec:\jdpvv.exe215⤵PID:2696
-
\??\c:\ffrrrrl.exec:\ffrrrrl.exe216⤵PID:2952
-
\??\c:\xxfllrl.exec:\xxfllrl.exe217⤵PID:2472
-
\??\c:\3httbt.exec:\3httbt.exe218⤵PID:2992
-
\??\c:\7nhntt.exec:\7nhntt.exe219⤵PID:2424
-
\??\c:\ppjpv.exec:\ppjpv.exe220⤵PID:2880
-
\??\c:\jvjjv.exec:\jvjjv.exe221⤵PID:2024
-
\??\c:\1rflrxf.exec:\1rflrxf.exe222⤵PID:2716
-
\??\c:\rrxfffx.exec:\rrxfffx.exe223⤵PID:284
-
\??\c:\bnnhtn.exec:\bnnhtn.exe224⤵PID:2292
-
\??\c:\tnbbnt.exec:\tnbbnt.exe225⤵PID:1552
-
\??\c:\hbhhhb.exec:\hbhhhb.exe226⤵PID:1616
-
\??\c:\5vpvd.exec:\5vpvd.exe227⤵PID:2144
-
\??\c:\rxxlxrr.exec:\rxxlxrr.exe228⤵PID:1636
-
\??\c:\lrrlflx.exec:\lrrlflx.exe229⤵PID:1432
-
\??\c:\9hnhhb.exec:\9hnhhb.exe230⤵PID:600
-
\??\c:\nnhnnn.exec:\nnhnnn.exe231⤵PID:2896
-
\??\c:\jvppp.exec:\jvppp.exe232⤵PID:604
-
\??\c:\9jddp.exec:\9jddp.exe233⤵PID:828
-
\??\c:\llflrxf.exec:\llflrxf.exe234⤵PID:2028
-
\??\c:\fxrxrxf.exec:\fxrxrxf.exe235⤵PID:2504
-
\??\c:\hhnhnb.exec:\hhnhnb.exe236⤵PID:2232
-
\??\c:\vvjpj.exec:\vvjpj.exe237⤵PID:996
-
\??\c:\jjdjd.exec:\jjdjd.exe238⤵PID:2256
-
\??\c:\1pddp.exec:\1pddp.exe239⤵PID:412
-
\??\c:\7llflxf.exec:\7llflxf.exe240⤵PID:1244
-
\??\c:\nnbbhb.exec:\nnbbhb.exe241⤵PID:1804
-
\??\c:\nhtthn.exec:\nhtthn.exe242⤵PID:1136