Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe
-
Size
59KB
-
MD5
6f9ff796d7cc3caa5ecc3e544fbcb8b7
-
SHA1
6e3a33e525f5c682581d19927575d7d70b714a31
-
SHA256
b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde
-
SHA512
a29f9968191a42cef27a54b76b9a50b8b0f7e4aeb8dd5ee6a8ccd28edad4ac6a4bc54d3627549cf724adce77120df26e98f5b7a5b107d1faf82cb6943ab5c303
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UgS:ymb3NkkiQ3mdBjFIvlqgS
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/316-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/688-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2056-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2916-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2556-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2232-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2232-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2232-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1976-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/316-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2224-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1688-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1772-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2052-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1924-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/688-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/668-238-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1800-265-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-283-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1164-292-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
dvjjv.exepdvvd.exelxfllxr.exe5btntt.exepjvvv.exe9xrrllr.exefxlxxfr.exe5vjvj.exedvppd.exe5rxlllr.exefrxxxrf.exebnnhnn.exevjppv.exedpddd.exejvddj.exexrxlrrx.exebbhtnt.exehbhnnt.exevjvpp.exexrfflrx.exelxllxfl.exe5btbnn.exehthnnb.exe1vjvj.exejdvdj.exerlffffl.exexlxxffr.exebthnth.exe7jjpj.exe9ddjp.exe5fxlflr.exebtbhnt.exebthhnn.exejdvdp.exevpvdp.exejvdvv.exe3rffxxx.exelxfrlfx.exebnthnt.exe7tnnnn.exe9ppjp.exedjvpj.exexlrrxxf.exennnbht.exetnbthh.exevdpjj.exepdpjv.exelxfffll.exe9rfxxxf.exe5hhnhh.exenhbhbb.exevpppv.exe9dppd.exe3rlflfl.exerlrxllr.exe9rxxflr.exebbhhhb.exebthhhn.exejdjjj.exe3pjdp.exe7fxxxff.exefrxrxxl.exe7lxxffr.exebtbhtt.exepid process 2056 dvjjv.exe 2344 pdvvd.exe 2668 lxfllxr.exe 2916 5btntt.exe 2700 pjvvv.exe 2556 9xrrllr.exe 2532 fxlxxfr.exe 2232 5vjvj.exe 1976 dvppd.exe 2760 5rxlllr.exe 2856 frxxxrf.exe 1984 bnnhnn.exe 1188 vjppv.exe 316 dpddd.exe 2224 jvddj.exe 560 xrxlrrx.exe 1688 bbhtnt.exe 1772 hbhnnt.exe 2052 vjvpp.exe 1924 xrfflrx.exe 2092 lxllxfl.exe 688 5btbnn.exe 580 hthnnb.exe 668 1vjvj.exe 1068 jdvdj.exe 772 rlffffl.exe 1800 xlxxffr.exe 2312 bthnth.exe 2616 7jjpj.exe 1164 9ddjp.exe 2996 5fxlflr.exe 3024 btbhnt.exe 2892 bthhnn.exe 1592 jdvdp.exe 2056 vpvdp.exe 2628 jvdvv.exe 2908 3rffxxx.exe 2688 lxfrlfx.exe 2812 bnthnt.exe 2560 7tnnnn.exe 2704 9ppjp.exe 2544 djvpj.exe 2612 xlrrxxf.exe 2348 nnnbht.exe 1960 tnbthh.exe 2836 vdpjj.exe 2768 pdpjv.exe 1964 lxfffll.exe 1060 9rfxxxf.exe 1940 5hhnhh.exe 2464 nhbhbb.exe 316 vpppv.exe 1452 9dppd.exe 1044 3rlflfl.exe 1564 rlrxllr.exe 2104 9rxxflr.exe 2116 bbhhhb.exe 2260 bthhhn.exe 2936 jdjjj.exe 2512 3pjdp.exe 544 7fxxxff.exe 3040 frxrxxl.exe 1488 7lxxffr.exe 1860 btbhtt.exe -
Processes:
resource yara_rule behavioral1/memory/1704-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/688-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exedvjjv.exepdvvd.exelxfllxr.exe5btntt.exepjvvv.exe9xrrllr.exefxlxxfr.exe5vjvj.exedvppd.exe5rxlllr.exefrxxxrf.exebnnhnn.exevjppv.exedpddd.exejvddj.exedescription pid process target process PID 1704 wrote to memory of 2056 1704 b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe dvjjv.exe PID 1704 wrote to memory of 2056 1704 b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe dvjjv.exe PID 1704 wrote to memory of 2056 1704 b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe dvjjv.exe PID 1704 wrote to memory of 2056 1704 b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe dvjjv.exe PID 2056 wrote to memory of 2344 2056 dvjjv.exe pdvvd.exe PID 2056 wrote to memory of 2344 2056 dvjjv.exe pdvvd.exe PID 2056 wrote to memory of 2344 2056 dvjjv.exe pdvvd.exe PID 2056 wrote to memory of 2344 2056 dvjjv.exe pdvvd.exe PID 2344 wrote to memory of 2668 2344 pdvvd.exe lxfllxr.exe PID 2344 wrote to memory of 2668 2344 pdvvd.exe lxfllxr.exe PID 2344 wrote to memory of 2668 2344 pdvvd.exe lxfllxr.exe PID 2344 wrote to memory of 2668 2344 pdvvd.exe lxfllxr.exe PID 2668 wrote to memory of 2916 2668 lxfllxr.exe 5btntt.exe PID 2668 wrote to memory of 2916 2668 lxfllxr.exe 5btntt.exe PID 2668 wrote to memory of 2916 2668 lxfllxr.exe 5btntt.exe PID 2668 wrote to memory of 2916 2668 lxfllxr.exe 5btntt.exe PID 2916 wrote to memory of 2700 2916 5btntt.exe pjvvv.exe PID 2916 wrote to memory of 2700 2916 5btntt.exe pjvvv.exe PID 2916 wrote to memory of 2700 2916 5btntt.exe pjvvv.exe PID 2916 wrote to memory of 2700 2916 5btntt.exe pjvvv.exe PID 2700 wrote to memory of 2556 2700 pjvvv.exe 9xrrllr.exe PID 2700 wrote to memory of 2556 2700 pjvvv.exe 9xrrllr.exe PID 2700 wrote to memory of 2556 2700 pjvvv.exe 9xrrllr.exe PID 2700 wrote to memory of 2556 2700 pjvvv.exe 9xrrllr.exe PID 2556 wrote to memory of 2532 2556 9xrrllr.exe fxlxxfr.exe PID 2556 wrote to memory of 2532 2556 9xrrllr.exe fxlxxfr.exe PID 2556 wrote to memory of 2532 2556 9xrrllr.exe fxlxxfr.exe PID 2556 wrote to memory of 2532 2556 9xrrllr.exe fxlxxfr.exe PID 2532 wrote to memory of 2232 2532 fxlxxfr.exe 5vjvj.exe PID 2532 wrote to memory of 2232 2532 fxlxxfr.exe 5vjvj.exe PID 2532 wrote to memory of 2232 2532 fxlxxfr.exe 5vjvj.exe PID 2532 wrote to memory of 2232 2532 fxlxxfr.exe 5vjvj.exe PID 2232 wrote to memory of 1976 2232 5vjvj.exe dvppd.exe PID 2232 wrote to memory of 1976 2232 5vjvj.exe dvppd.exe PID 2232 wrote to memory of 1976 2232 5vjvj.exe dvppd.exe PID 2232 wrote to memory of 1976 2232 5vjvj.exe dvppd.exe PID 1976 wrote to memory of 2760 1976 dvppd.exe 5rxlllr.exe PID 1976 wrote to memory of 2760 1976 dvppd.exe 5rxlllr.exe PID 1976 wrote to memory of 2760 1976 dvppd.exe 5rxlllr.exe PID 1976 wrote to memory of 2760 1976 dvppd.exe 5rxlllr.exe PID 2760 wrote to memory of 2856 2760 5rxlllr.exe frxxxrf.exe PID 2760 wrote to memory of 2856 2760 5rxlllr.exe frxxxrf.exe PID 2760 wrote to memory of 2856 2760 5rxlllr.exe frxxxrf.exe PID 2760 wrote to memory of 2856 2760 5rxlllr.exe frxxxrf.exe PID 2856 wrote to memory of 1984 2856 frxxxrf.exe bnnhnn.exe PID 2856 wrote to memory of 1984 2856 frxxxrf.exe bnnhnn.exe PID 2856 wrote to memory of 1984 2856 frxxxrf.exe bnnhnn.exe PID 2856 wrote to memory of 1984 2856 frxxxrf.exe bnnhnn.exe PID 1984 wrote to memory of 1188 1984 bnnhnn.exe vjppv.exe PID 1984 wrote to memory of 1188 1984 bnnhnn.exe vjppv.exe PID 1984 wrote to memory of 1188 1984 bnnhnn.exe vjppv.exe PID 1984 wrote to memory of 1188 1984 bnnhnn.exe vjppv.exe PID 1188 wrote to memory of 316 1188 vjppv.exe dpddd.exe PID 1188 wrote to memory of 316 1188 vjppv.exe dpddd.exe PID 1188 wrote to memory of 316 1188 vjppv.exe dpddd.exe PID 1188 wrote to memory of 316 1188 vjppv.exe dpddd.exe PID 316 wrote to memory of 2224 316 dpddd.exe jvddj.exe PID 316 wrote to memory of 2224 316 dpddd.exe jvddj.exe PID 316 wrote to memory of 2224 316 dpddd.exe jvddj.exe PID 316 wrote to memory of 2224 316 dpddd.exe jvddj.exe PID 2224 wrote to memory of 560 2224 jvddj.exe xrxlrrx.exe PID 2224 wrote to memory of 560 2224 jvddj.exe xrxlrrx.exe PID 2224 wrote to memory of 560 2224 jvddj.exe xrxlrrx.exe PID 2224 wrote to memory of 560 2224 jvddj.exe xrxlrrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe"C:\Users\Admin\AppData\Local\Temp\b266341dc6eaa5fed50e6eb662574cb9691150436647b1f38f4794098b1dafde.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\dvjjv.exec:\dvjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\pdvvd.exec:\pdvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\lxfllxr.exec:\lxfllxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\5btntt.exec:\5btntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\pjvvv.exec:\pjvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\9xrrllr.exec:\9xrrllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\fxlxxfr.exec:\fxlxxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\5vjvj.exec:\5vjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\dvppd.exec:\dvppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\5rxlllr.exec:\5rxlllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\frxxxrf.exec:\frxxxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\bnnhnn.exec:\bnnhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\vjppv.exec:\vjppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\dpddd.exec:\dpddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\jvddj.exec:\jvddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\xrxlrrx.exec:\xrxlrrx.exe17⤵
- Executes dropped EXE
PID:560 -
\??\c:\bbhtnt.exec:\bbhtnt.exe18⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hbhnnt.exec:\hbhnnt.exe19⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vjvpp.exec:\vjvpp.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xrfflrx.exec:\xrfflrx.exe21⤵
- Executes dropped EXE
PID:1924 -
\??\c:\lxllxfl.exec:\lxllxfl.exe22⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5btbnn.exec:\5btbnn.exe23⤵
- Executes dropped EXE
PID:688 -
\??\c:\hthnnb.exec:\hthnnb.exe24⤵
- Executes dropped EXE
PID:580 -
\??\c:\1vjvj.exec:\1vjvj.exe25⤵
- Executes dropped EXE
PID:668 -
\??\c:\jdvdj.exec:\jdvdj.exe26⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rlffffl.exec:\rlffffl.exe27⤵
- Executes dropped EXE
PID:772 -
\??\c:\xlxxffr.exec:\xlxxffr.exe28⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bthnth.exec:\bthnth.exe29⤵
- Executes dropped EXE
PID:2312 -
\??\c:\7jjpj.exec:\7jjpj.exe30⤵
- Executes dropped EXE
PID:2616 -
\??\c:\9ddjp.exec:\9ddjp.exe31⤵
- Executes dropped EXE
PID:1164 -
\??\c:\5fxlflr.exec:\5fxlflr.exe32⤵
- Executes dropped EXE
PID:2996 -
\??\c:\btbhnt.exec:\btbhnt.exe33⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bthhnn.exec:\bthhnn.exe34⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdvdp.exec:\jdvdp.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vpvdp.exec:\vpvdp.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jvdvv.exec:\jvdvv.exe37⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3rffxxx.exec:\3rffxxx.exe38⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lxfrlfx.exec:\lxfrlfx.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bnthnt.exec:\bnthnt.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\7tnnnn.exec:\7tnnnn.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\9ppjp.exec:\9ppjp.exe42⤵
- Executes dropped EXE
PID:2704 -
\??\c:\djvpj.exec:\djvpj.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nnnbht.exec:\nnnbht.exe45⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tnbthh.exec:\tnbthh.exe46⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vdpjj.exec:\vdpjj.exe47⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pdpjv.exec:\pdpjv.exe48⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lxfffll.exec:\lxfffll.exe49⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9rfxxxf.exec:\9rfxxxf.exe50⤵
- Executes dropped EXE
PID:1060 -
\??\c:\5hhnhh.exec:\5hhnhh.exe51⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nhbhbb.exec:\nhbhbb.exe52⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vpppv.exec:\vpppv.exe53⤵
- Executes dropped EXE
PID:316 -
\??\c:\9dppd.exec:\9dppd.exe54⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3rlflfl.exec:\3rlflfl.exe55⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rlrxllr.exec:\rlrxllr.exe56⤵
- Executes dropped EXE
PID:1564 -
\??\c:\9rxxflr.exec:\9rxxflr.exe57⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bbhhhb.exec:\bbhhhb.exe58⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bthhhn.exec:\bthhhn.exe59⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jdjjj.exec:\jdjjj.exe60⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3pjdp.exec:\3pjdp.exe61⤵
- Executes dropped EXE
PID:2512 -
\??\c:\7fxxxff.exec:\7fxxxff.exe62⤵
- Executes dropped EXE
PID:544 -
\??\c:\frxrxxl.exec:\frxrxxl.exe63⤵
- Executes dropped EXE
PID:3040 -
\??\c:\7lxxffr.exec:\7lxxffr.exe64⤵
- Executes dropped EXE
PID:1488 -
\??\c:\btbhtt.exec:\btbhtt.exe65⤵
- Executes dropped EXE
PID:1860 -
\??\c:\7thtbb.exec:\7thtbb.exe66⤵PID:2324
-
\??\c:\pjdpv.exec:\pjdpv.exe67⤵PID:2120
-
\??\c:\vdjdd.exec:\vdjdd.exe68⤵PID:1824
-
\??\c:\xxrrffx.exec:\xxrrffx.exe69⤵PID:1160
-
\??\c:\7rlxrff.exec:\7rlxrff.exe70⤵PID:1612
-
\??\c:\nbhthn.exec:\nbhthn.exe71⤵PID:3032
-
\??\c:\hbtbbh.exec:\hbtbbh.exe72⤵PID:1684
-
\??\c:\pdjjp.exec:\pdjjp.exe73⤵PID:1756
-
\??\c:\vpjvv.exec:\vpjvv.exe74⤵PID:2940
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe75⤵PID:2192
-
\??\c:\rllrfrl.exec:\rllrfrl.exe76⤵PID:2828
-
\??\c:\tnbntt.exec:\tnbntt.exe77⤵PID:2184
-
\??\c:\hbbhhn.exec:\hbbhhn.exe78⤵PID:2720
-
\??\c:\jvjvp.exec:\jvjvp.exe79⤵PID:2748
-
\??\c:\vdppv.exec:\vdppv.exe80⤵PID:2644
-
\??\c:\jdvjp.exec:\jdvjp.exe81⤵PID:2664
-
\??\c:\rlrxxxf.exec:\rlrxxxf.exe82⤵PID:2816
-
\??\c:\hhtbbb.exec:\hhtbbb.exe83⤵PID:2776
-
\??\c:\thbhhb.exec:\thbhhb.exe84⤵PID:2712
-
\??\c:\pjvvv.exec:\pjvvv.exe85⤵PID:2576
-
\??\c:\vjppv.exec:\vjppv.exe86⤵PID:2660
-
\??\c:\3pvpp.exec:\3pvpp.exe87⤵PID:2232
-
\??\c:\xrxxffr.exec:\xrxxffr.exe88⤵PID:712
-
\??\c:\3fxfrxl.exec:\3fxfrxl.exe89⤵PID:2604
-
\??\c:\nnthbh.exec:\nnthbh.exe90⤵PID:2880
-
\??\c:\nnbnth.exec:\nnbnth.exe91⤵PID:2336
-
\??\c:\jdjdp.exec:\jdjdp.exe92⤵PID:1984
-
\??\c:\7vpdv.exec:\7vpdv.exe93⤵PID:2020
-
\??\c:\1rllrrl.exec:\1rllrrl.exe94⤵PID:2016
-
\??\c:\3rxxxxf.exec:\3rxxxxf.exe95⤵PID:1624
-
\??\c:\5xlllrx.exec:\5xlllrx.exe96⤵PID:2224
-
\??\c:\bnnnhh.exec:\bnnnhh.exe97⤵PID:1620
-
\??\c:\bntnbb.exec:\bntnbb.exe98⤵PID:1660
-
\??\c:\jvjjp.exec:\jvjjp.exe99⤵PID:1604
-
\??\c:\jvddp.exec:\jvddp.exe100⤵PID:2284
-
\??\c:\frffllr.exec:\frffllr.exe101⤵PID:2052
-
\??\c:\rrxlxfl.exec:\rrxlxfl.exe102⤵PID:2728
-
\??\c:\btbhtt.exec:\btbhtt.exe103⤵PID:596
-
\??\c:\5ntbhb.exec:\5ntbhb.exe104⤵PID:688
-
\??\c:\nbnntt.exec:\nbnntt.exe105⤵PID:592
-
\??\c:\7pvpv.exec:\7pvpv.exe106⤵PID:2500
-
\??\c:\pdpvv.exec:\pdpvv.exe107⤵PID:2412
-
\??\c:\fflffxf.exec:\fflffxf.exe108⤵PID:1068
-
\??\c:\fxlrflx.exec:\fxlrflx.exe109⤵PID:1876
-
\??\c:\lrrxxfx.exec:\lrrxxfx.exe110⤵PID:920
-
\??\c:\tnhhnn.exec:\tnhhnn.exe111⤵PID:1648
-
\??\c:\bbtnnh.exec:\bbtnnh.exe112⤵PID:2312
-
\??\c:\7jdvv.exec:\7jdvv.exe113⤵PID:2476
-
\??\c:\pjdpp.exec:\pjdpp.exe114⤵PID:2912
-
\??\c:\lxrfflx.exec:\lxrfflx.exe115⤵PID:912
-
\??\c:\3lxffxf.exec:\3lxffxf.exe116⤵PID:1288
-
\??\c:\thnnnt.exec:\thnnnt.exe117⤵PID:3024
-
\??\c:\thnnhh.exec:\thnnhh.exe118⤵PID:2892
-
\??\c:\jddjp.exec:\jddjp.exe119⤵PID:3064
-
\??\c:\7pdvv.exec:\7pdvv.exe120⤵PID:2056
-
\??\c:\9xrrlfl.exec:\9xrrlfl.exe121⤵PID:2344
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe122⤵PID:2780
-
\??\c:\ttnthn.exec:\ttnthn.exe123⤵PID:2788
-
\??\c:\nhhbtt.exec:\nhhbtt.exe124⤵PID:2844
-
\??\c:\jddvd.exec:\jddvd.exe125⤵PID:2580
-
\??\c:\jvdvd.exec:\jvdvd.exe126⤵PID:2704
-
\??\c:\xrfrxlx.exec:\xrfrxlx.exe127⤵PID:2600
-
\??\c:\rfllrrx.exec:\rfllrrx.exe128⤵PID:2608
-
\??\c:\9ttttn.exec:\9ttttn.exe129⤵PID:1852
-
\??\c:\btbttb.exec:\btbttb.exe130⤵PID:1960
-
\??\c:\hthbnh.exec:\hthbnh.exe131⤵PID:2764
-
\??\c:\vjdjv.exec:\vjdjv.exe132⤵PID:1036
-
\??\c:\dppjv.exec:\dppjv.exe133⤵PID:1964
-
\??\c:\dvjjd.exec:\dvjjd.exe134⤵PID:1060
-
\??\c:\7rllrrf.exec:\7rllrrf.exe135⤵PID:2332
-
\??\c:\5xlrxxx.exec:\5xlrxxx.exe136⤵PID:1956
-
\??\c:\bthhnn.exec:\bthhnn.exe137⤵PID:1764
-
\??\c:\thbhbn.exec:\thbhbn.exe138⤵PID:2632
-
\??\c:\httbbb.exec:\httbbb.exe139⤵PID:352
-
\??\c:\vjpjv.exec:\vjpjv.exe140⤵PID:2452
-
\??\c:\jdjjv.exec:\jdjjv.exe141⤵PID:2636
-
\??\c:\3lfffxl.exec:\3lfffxl.exe142⤵PID:2932
-
\??\c:\frfxfll.exec:\frfxfll.exe143⤵PID:2372
-
\??\c:\hthntt.exec:\hthntt.exe144⤵PID:1920
-
\??\c:\thnhhh.exec:\thnhhh.exe145⤵PID:484
-
\??\c:\tntttt.exec:\tntttt.exe146⤵PID:1148
-
\??\c:\pjdjv.exec:\pjdjv.exe147⤵PID:1404
-
\??\c:\vpddj.exec:\vpddj.exe148⤵PID:580
-
\??\c:\lfrxxrr.exec:\lfrxxrr.exe149⤵PID:2572
-
\??\c:\rflrrxl.exec:\rflrrxl.exe150⤵PID:1052
-
\??\c:\nbntbt.exec:\nbntbt.exe151⤵PID:2120
-
\??\c:\tnhnbb.exec:\tnhnbb.exe152⤵PID:1824
-
\??\c:\7pdjj.exec:\7pdjj.exe153⤵PID:1264
-
\??\c:\dvjjj.exec:\dvjjj.exe154⤵PID:1612
-
\??\c:\7lllrrx.exec:\7lllrrx.exe155⤵PID:2616
-
\??\c:\lflxflx.exec:\lflxflx.exe156⤵PID:336
-
\??\c:\bnbnnh.exec:\bnbnnh.exe157⤵PID:896
-
\??\c:\hbtttt.exec:\hbtttt.exe158⤵PID:1948
-
\??\c:\vpjpv.exec:\vpjpv.exe159⤵PID:1556
-
\??\c:\pjjjp.exec:\pjjjp.exe160⤵PID:1580
-
\??\c:\vjvdp.exec:\vjvdp.exe161⤵PID:1692
-
\??\c:\7rlrrrf.exec:\7rlrrrf.exe162⤵PID:3028
-
\??\c:\rlllrlx.exec:\rlllrlx.exe163⤵PID:2748
-
\??\c:\hhtbhh.exec:\hhtbhh.exe164⤵PID:2668
-
\??\c:\thnhtn.exec:\thnhtn.exe165⤵PID:2664
-
\??\c:\dvjpp.exec:\dvjpp.exe166⤵PID:2568
-
\??\c:\jvpjp.exec:\jvpjp.exe167⤵PID:2204
-
\??\c:\frffllr.exec:\frffllr.exe168⤵PID:2548
-
\??\c:\7rrxllx.exec:\7rrxllx.exe169⤵PID:2984
-
\??\c:\5thhtb.exec:\5thhtb.exe170⤵PID:2600
-
\??\c:\bthnnn.exec:\bthnnn.exe171⤵PID:2824
-
\??\c:\9tntbh.exec:\9tntbh.exe172⤵PID:2840
-
\??\c:\jvjjp.exec:\jvjjp.exe173⤵PID:2764
-
\??\c:\jdjpj.exec:\jdjpj.exe174⤵PID:2884
-
\??\c:\llxxlfl.exec:\llxxlfl.exe175⤵PID:2028
-
\??\c:\lxlllrx.exec:\lxlllrx.exe176⤵PID:784
-
\??\c:\7nbhhn.exec:\7nbhhn.exe177⤵PID:1768
-
\??\c:\btnntt.exec:\btnntt.exe178⤵PID:1968
-
\??\c:\vpdjd.exec:\vpdjd.exe179⤵PID:1304
-
\??\c:\dvpdp.exec:\dvpdp.exe180⤵PID:1744
-
\??\c:\5pdjv.exec:\5pdjv.exe181⤵PID:2164
-
\??\c:\1lxlrrx.exec:\1lxlrrx.exe182⤵PID:1660
-
\??\c:\thnhnt.exec:\thnhnt.exe183⤵PID:1772
-
\??\c:\tnntbh.exec:\tnntbh.exe184⤵PID:2516
-
\??\c:\ppdvv.exec:\ppdvv.exe185⤵PID:880
-
\??\c:\vjvpv.exec:\vjvpv.exe186⤵PID:1104
-
\??\c:\dpjjj.exec:\dpjjj.exe187⤵PID:484
-
\??\c:\rlxffxl.exec:\rlxffxl.exe188⤵PID:1008
-
\??\c:\lflrrrx.exec:\lflrrrx.exe189⤵PID:1484
-
\??\c:\ttbthh.exec:\ttbthh.exe190⤵PID:1524
-
\??\c:\1nnnnh.exec:\1nnnnh.exe191⤵PID:2572
-
\??\c:\jdpvj.exec:\jdpvj.exe192⤵PID:1816
-
\??\c:\3vpvd.exec:\3vpvd.exe193⤵PID:1876
-
\??\c:\rlrxlrx.exec:\rlrxlrx.exe194⤵PID:920
-
\??\c:\rlrffff.exec:\rlrffff.exe195⤵PID:2944
-
\??\c:\3hbhnh.exec:\3hbhnh.exe196⤵PID:2316
-
\??\c:\bhnhbb.exec:\bhnhbb.exe197⤵PID:3036
-
\??\c:\ddpvj.exec:\ddpvj.exe198⤵PID:1248
-
\??\c:\7jjjj.exec:\7jjjj.exe199⤵PID:2488
-
\??\c:\7frrxxf.exec:\7frrxxf.exe200⤵PID:2428
-
\??\c:\9xllllx.exec:\9xllllx.exe201⤵PID:2896
-
\??\c:\rlxflfl.exec:\rlxflfl.exe202⤵PID:1700
-
\??\c:\tntnbh.exec:\tntnbh.exe203⤵PID:2740
-
\??\c:\pjjjd.exec:\pjjjd.exe204⤵PID:2752
-
\??\c:\vpddd.exec:\vpddd.exe205⤵PID:3028
-
\??\c:\dvpjv.exec:\dvpjv.exe206⤵PID:2672
-
\??\c:\xrxfrxf.exec:\xrxfrxf.exe207⤵PID:2668
-
\??\c:\lfxxllr.exec:\lfxxllr.exe208⤵PID:2556
-
\??\c:\btbnbb.exec:\btbnbb.exe209⤵PID:2568
-
\??\c:\1jjvp.exec:\1jjvp.exe210⤵PID:2204
-
\??\c:\pdvdp.exec:\pdvdp.exe211⤵PID:2548
-
\??\c:\xrflrrx.exec:\xrflrrx.exe212⤵PID:2592
-
\??\c:\rlllrrf.exec:\rlllrrf.exe213⤵PID:2600
-
\??\c:\bbntbb.exec:\bbntbb.exe214⤵PID:712
-
\??\c:\hbhbhh.exec:\hbhbhh.exe215⤵PID:2840
-
\??\c:\jdpvd.exec:\jdpvd.exe216⤵PID:2420
-
\??\c:\jvppv.exec:\jvppv.exe217⤵PID:2880
-
\??\c:\xxllrfl.exec:\xxllrfl.exe218⤵PID:2020
-
\??\c:\rrxfllr.exec:\rrxfllr.exe219⤵PID:784
-
\??\c:\thttbh.exec:\thttbh.exe220⤵PID:828
-
\??\c:\bnttnh.exec:\bnttnh.exe221⤵PID:2460
-
\??\c:\pdjpv.exec:\pdjpv.exe222⤵PID:2632
-
\??\c:\lxrrlll.exec:\lxrrlll.exe223⤵PID:1744
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe224⤵PID:2096
-
\??\c:\bthntn.exec:\bthntn.exe225⤵PID:1660
-
\??\c:\hbntbh.exec:\hbntbh.exe226⤵PID:1772
-
\??\c:\jjpjj.exec:\jjpjj.exe227⤵PID:2284
-
\??\c:\vpdvd.exec:\vpdvd.exe228⤵PID:2084
-
\??\c:\xrlfllx.exec:\xrlfllx.exe229⤵PID:596
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe230⤵PID:856
-
\??\c:\1nntnb.exec:\1nntnb.exe231⤵PID:668
-
\??\c:\bbtbnn.exec:\bbtbnn.exe232⤵PID:1872
-
\??\c:\dddvj.exec:\dddvj.exe233⤵PID:236
-
\??\c:\rrfrffl.exec:\rrfrffl.exe234⤵PID:900
-
\??\c:\xrfflrf.exec:\xrfflrf.exe235⤵PID:972
-
\??\c:\hhthtb.exec:\hhthtb.exe236⤵PID:1824
-
\??\c:\hbnttb.exec:\hbnttb.exe237⤵PID:920
-
\??\c:\vvdvv.exec:\vvdvv.exe238⤵PID:572
-
\??\c:\jjdjd.exec:\jjdjd.exe239⤵PID:2476
-
\??\c:\rrffxxr.exec:\rrffxxr.exe240⤵PID:1756
-
\??\c:\frrfrxl.exec:\frrfrxl.exe241⤵PID:1248
-
\??\c:\bbthtn.exec:\bbthtn.exe242⤵PID:2488