Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e2852207c8a34c404e0b69ddff0ad670730a135cb34466670f9b618cb1561c92.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
e2852207c8a34c404e0b69ddff0ad670730a135cb34466670f9b618cb1561c92.exe
-
Size
306KB
-
MD5
693c1aaaef7076cb4e027f766860003a
-
SHA1
36701e4a89b13e0099ea36679f23b320103edb4c
-
SHA256
e2852207c8a34c404e0b69ddff0ad670730a135cb34466670f9b618cb1561c92
-
SHA512
a27356609d2ecaf232afb7a658160bae992f43394209a4b02eccc780f44e40a1cccef547c611263b43575bf79a0cba7739101fd9c351af1a3e61427a07f478a1
-
SSDEEP
6144:n3C9BRo/CH26ZAmaOXicLrnRukAPXt1UP+3OgEbXeTiDSd2vh:n3C9uUnAvtd3Ogld2vh
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1936-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
Processes:
resource yara_rule behavioral1/memory/1936-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2252-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2252-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2252-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2348-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2992-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2976-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2472-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2948-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2132-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2880-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2788-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/944-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1784-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2324-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2336-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/604-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/588-229-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2128-239-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2168-292-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
nhttnn.exerlfflrf.exe5hthnt.exellfrlll.exe5bbnbn.exejjppd.exeffrfllx.exetththt.exedddpd.exehbhbnn.exejjdjp.exexlflffl.exe5tbnhn.exejdpdj.exelfffxxl.exebnhnhn.exeddvvp.exexxxfxlf.exe9ntnbb.exedvpvj.exerlrrflr.exebnbhbh.exepvpvp.exexrxxflx.exeppdjv.exe3xfrrxl.exevjpdp.exelflrfll.exe7thbhb.exe1vvjv.exexxrxlxf.exe9xflfxr.exe9nnhbn.exevpvjv.exe1xxfrrx.exe5lflrxr.exettnthh.exettnbht.exe7jpvv.exe1ffxrxf.exe5frrxrf.exennhnbh.exebbnbht.exe3dvdp.exellllxfl.exefxrfflf.exennhtbh.exepvjdd.exepjjdv.exelfxlxfl.exebbbntb.exettntht.exepjpdv.exepjjpv.exe5lxfllx.exeffxlxfr.exetnhnth.exejdvpd.exe1pjpp.exerlxxlxl.exexrrfxrr.exennbhbn.exeddjdj.exedjdpd.exepid process 2252 nhttnn.exe 2348 rlfflrf.exe 2616 5hthnt.exe 2992 llfrlll.exe 2976 5bbnbn.exe 2768 jjppd.exe 2472 ffrfllx.exe 2948 tththt.exe 2132 dddpd.exe 2880 hbhbnn.exe 2712 jjdjp.exe 2788 xlflffl.exe 944 5tbnhn.exe 2872 jdpdj.exe 948 lfffxxl.exe 1784 bnhnhn.exe 2324 ddvvp.exe 2336 xxxfxlf.exe 2452 9ntnbb.exe 1696 dvpvj.exe 784 rlrrflr.exe 604 bnbhbh.exe 588 pvpvp.exe 2128 xrxxflx.exe 1496 ppdjv.exe 2280 3xfrrxl.exe 1076 vjpdp.exe 2004 lflrfll.exe 2232 7thbhb.exe 2168 1vvjv.exe 1276 xxrxlxf.exe 1628 9xflfxr.exe 1752 9nnhbn.exe 2844 vpvjv.exe 2120 1xxfrrx.exe 2672 5lflrxr.exe 2572 ttnthh.exe 2740 ttnbht.exe 2992 7jpvv.exe 2632 1ffxrxf.exe 2468 5frrxrf.exe 2524 nnhnbh.exe 2520 bbnbht.exe 1660 3dvdp.exe 2864 llllxfl.exe 2792 fxrfflf.exe 2888 nnhtbh.exe 2892 pvjdd.exe 1096 pjjdv.exe 944 lfxlxfl.exe 2932 bbbntb.exe 956 ttntht.exe 1700 pjpdv.exe 2308 pjjpv.exe 1456 5lxfllx.exe 2400 ffxlxfr.exe 2448 tnhnth.exe 692 jdvpd.exe 1696 1pjpp.exe 1488 rlxxlxl.exe 1668 xrrfxrr.exe 1048 nnbhbn.exe 708 ddjdj.exe 2428 djdpd.exe -
Processes:
resource yara_rule behavioral1/memory/1936-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/604-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e2852207c8a34c404e0b69ddff0ad670730a135cb34466670f9b618cb1561c92.exenhttnn.exerlfflrf.exe5hthnt.exellfrlll.exe5bbnbn.exejjppd.exeffrfllx.exetththt.exedddpd.exehbhbnn.exejjdjp.exexlflffl.exe5tbnhn.exejdpdj.exelfffxxl.exedescription pid process target process PID 1936 wrote to memory of 2252 1936 e2852207c8a34c404e0b69ddff0ad670730a135cb34466670f9b618cb1561c92.exe nhttnn.exe PID 1936 wrote to memory of 2252 1936 e2852207c8a34c404e0b69ddff0ad670730a135cb34466670f9b618cb1561c92.exe nhttnn.exe PID 1936 wrote to memory of 2252 1936 e2852207c8a34c404e0b69ddff0ad670730a135cb34466670f9b618cb1561c92.exe nhttnn.exe PID 1936 wrote to memory of 2252 1936 e2852207c8a34c404e0b69ddff0ad670730a135cb34466670f9b618cb1561c92.exe nhttnn.exe PID 2252 wrote to memory of 2348 2252 nhttnn.exe rlfflrf.exe PID 2252 wrote to memory of 2348 2252 nhttnn.exe rlfflrf.exe PID 2252 wrote to memory of 2348 2252 nhttnn.exe rlfflrf.exe PID 2252 wrote to memory of 2348 2252 nhttnn.exe rlfflrf.exe PID 2348 wrote to memory of 2616 2348 rlfflrf.exe 5hthnt.exe PID 2348 wrote to memory of 2616 2348 rlfflrf.exe 5hthnt.exe PID 2348 wrote to memory of 2616 2348 rlfflrf.exe 5hthnt.exe PID 2348 wrote to memory of 2616 2348 rlfflrf.exe 5hthnt.exe PID 2616 wrote to memory of 2992 2616 5hthnt.exe llfrlll.exe PID 2616 wrote to memory of 2992 2616 5hthnt.exe llfrlll.exe PID 2616 wrote to memory of 2992 2616 5hthnt.exe llfrlll.exe PID 2616 wrote to memory of 2992 2616 5hthnt.exe llfrlll.exe PID 2992 wrote to memory of 2976 2992 llfrlll.exe 5bbnbn.exe PID 2992 wrote to memory of 2976 2992 llfrlll.exe 5bbnbn.exe PID 2992 wrote to memory of 2976 2992 llfrlll.exe 5bbnbn.exe PID 2992 wrote to memory of 2976 2992 llfrlll.exe 5bbnbn.exe PID 2976 wrote to memory of 2768 2976 5bbnbn.exe jjppd.exe PID 2976 wrote to memory of 2768 2976 5bbnbn.exe jjppd.exe PID 2976 wrote to memory of 2768 2976 5bbnbn.exe jjppd.exe PID 2976 wrote to memory of 2768 2976 5bbnbn.exe jjppd.exe PID 2768 wrote to memory of 2472 2768 jjppd.exe ffrfllx.exe PID 2768 wrote to memory of 2472 2768 jjppd.exe ffrfllx.exe PID 2768 wrote to memory of 2472 2768 jjppd.exe ffrfllx.exe PID 2768 wrote to memory of 2472 2768 jjppd.exe ffrfllx.exe PID 2472 wrote to memory of 2948 2472 ffrfllx.exe tththt.exe PID 2472 wrote to memory of 2948 2472 ffrfllx.exe tththt.exe PID 2472 wrote to memory of 2948 2472 ffrfllx.exe tththt.exe PID 2472 wrote to memory of 2948 2472 ffrfllx.exe tththt.exe PID 2948 wrote to memory of 2132 2948 tththt.exe dddpd.exe PID 2948 wrote to memory of 2132 2948 tththt.exe dddpd.exe PID 2948 wrote to memory of 2132 2948 tththt.exe dddpd.exe PID 2948 wrote to memory of 2132 2948 tththt.exe dddpd.exe PID 2132 wrote to memory of 2880 2132 dddpd.exe hbhbnn.exe PID 2132 wrote to memory of 2880 2132 dddpd.exe hbhbnn.exe PID 2132 wrote to memory of 2880 2132 dddpd.exe hbhbnn.exe PID 2132 wrote to memory of 2880 2132 dddpd.exe hbhbnn.exe PID 2880 wrote to memory of 2712 2880 hbhbnn.exe jjdjp.exe PID 2880 wrote to memory of 2712 2880 hbhbnn.exe jjdjp.exe PID 2880 wrote to memory of 2712 2880 hbhbnn.exe jjdjp.exe PID 2880 wrote to memory of 2712 2880 hbhbnn.exe jjdjp.exe PID 2712 wrote to memory of 2788 2712 jjdjp.exe xlflffl.exe PID 2712 wrote to memory of 2788 2712 jjdjp.exe xlflffl.exe PID 2712 wrote to memory of 2788 2712 jjdjp.exe xlflffl.exe PID 2712 wrote to memory of 2788 2712 jjdjp.exe xlflffl.exe PID 2788 wrote to memory of 944 2788 xlflffl.exe 5tbnhn.exe PID 2788 wrote to memory of 944 2788 xlflffl.exe 5tbnhn.exe PID 2788 wrote to memory of 944 2788 xlflffl.exe 5tbnhn.exe PID 2788 wrote to memory of 944 2788 xlflffl.exe 5tbnhn.exe PID 944 wrote to memory of 2872 944 5tbnhn.exe jdpdj.exe PID 944 wrote to memory of 2872 944 5tbnhn.exe jdpdj.exe PID 944 wrote to memory of 2872 944 5tbnhn.exe jdpdj.exe PID 944 wrote to memory of 2872 944 5tbnhn.exe jdpdj.exe PID 2872 wrote to memory of 948 2872 jdpdj.exe lfffxxl.exe PID 2872 wrote to memory of 948 2872 jdpdj.exe lfffxxl.exe PID 2872 wrote to memory of 948 2872 jdpdj.exe lfffxxl.exe PID 2872 wrote to memory of 948 2872 jdpdj.exe lfffxxl.exe PID 948 wrote to memory of 1784 948 lfffxxl.exe bnhnhn.exe PID 948 wrote to memory of 1784 948 lfffxxl.exe bnhnhn.exe PID 948 wrote to memory of 1784 948 lfffxxl.exe bnhnhn.exe PID 948 wrote to memory of 1784 948 lfffxxl.exe bnhnhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2852207c8a34c404e0b69ddff0ad670730a135cb34466670f9b618cb1561c92.exe"C:\Users\Admin\AppData\Local\Temp\e2852207c8a34c404e0b69ddff0ad670730a135cb34466670f9b618cb1561c92.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\nhttnn.exec:\nhttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\rlfflrf.exec:\rlfflrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\5hthnt.exec:\5hthnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\llfrlll.exec:\llfrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\5bbnbn.exec:\5bbnbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\jjppd.exec:\jjppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ffrfllx.exec:\ffrfllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\tththt.exec:\tththt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\dddpd.exec:\dddpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\hbhbnn.exec:\hbhbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\jjdjp.exec:\jjdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xlflffl.exec:\xlflffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\5tbnhn.exec:\5tbnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\jdpdj.exec:\jdpdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\lfffxxl.exec:\lfffxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\bnhnhn.exec:\bnhnhn.exe17⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ddvvp.exec:\ddvvp.exe18⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xxxfxlf.exec:\xxxfxlf.exe19⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9ntnbb.exec:\9ntnbb.exe20⤵
- Executes dropped EXE
PID:2452 -
\??\c:\dvpvj.exec:\dvpvj.exe21⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rlrrflr.exec:\rlrrflr.exe22⤵
- Executes dropped EXE
PID:784 -
\??\c:\bnbhbh.exec:\bnbhbh.exe23⤵
- Executes dropped EXE
PID:604 -
\??\c:\pvpvp.exec:\pvpvp.exe24⤵
- Executes dropped EXE
PID:588 -
\??\c:\xrxxflx.exec:\xrxxflx.exe25⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ppdjv.exec:\ppdjv.exe26⤵
- Executes dropped EXE
PID:1496 -
\??\c:\3xfrrxl.exec:\3xfrrxl.exe27⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vjpdp.exec:\vjpdp.exe28⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lflrfll.exec:\lflrfll.exe29⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7thbhb.exec:\7thbhb.exe30⤵
- Executes dropped EXE
PID:2232 -
\??\c:\1vvjv.exec:\1vvjv.exe31⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xxrxlxf.exec:\xxrxlxf.exe32⤵
- Executes dropped EXE
PID:1276 -
\??\c:\9xflfxr.exec:\9xflfxr.exe33⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9nnhbn.exec:\9nnhbn.exe34⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vpvjv.exec:\vpvjv.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1xxfrrx.exec:\1xxfrrx.exe36⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5lflrxr.exec:\5lflrxr.exe37⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ttnthh.exec:\ttnthh.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ttnbht.exec:\ttnbht.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7jpvv.exec:\7jpvv.exe40⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1ffxrxf.exec:\1ffxrxf.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5frrxrf.exec:\5frrxrf.exe42⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nnhnbh.exec:\nnhnbh.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bbnbht.exec:\bbnbht.exe44⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3dvdp.exec:\3dvdp.exe45⤵
- Executes dropped EXE
PID:1660 -
\??\c:\llllxfl.exec:\llllxfl.exe46⤵
- Executes dropped EXE
PID:2864 -
\??\c:\fxrfflf.exec:\fxrfflf.exe47⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nnhtbh.exec:\nnhtbh.exe48⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pvjdd.exec:\pvjdd.exe49⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pjjdv.exec:\pjjdv.exe50⤵
- Executes dropped EXE
PID:1096 -
\??\c:\lfxlxfl.exec:\lfxlxfl.exe51⤵
- Executes dropped EXE
PID:944 -
\??\c:\bbbntb.exec:\bbbntb.exe52⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ttntht.exec:\ttntht.exe53⤵
- Executes dropped EXE
PID:956 -
\??\c:\pjpdv.exec:\pjpdv.exe54⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pjjpv.exec:\pjjpv.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5lxfllx.exec:\5lxfllx.exe56⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe57⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tnhnth.exec:\tnhnth.exe58⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jdvpd.exec:\jdvpd.exe59⤵
- Executes dropped EXE
PID:692 -
\??\c:\1pjpp.exec:\1pjpp.exe60⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rlxxlxl.exec:\rlxxlxl.exe61⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xrrfxrr.exec:\xrrfxrr.exe62⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nnbhbn.exec:\nnbhbn.exe63⤵
- Executes dropped EXE
PID:1048 -
\??\c:\ddjdj.exec:\ddjdj.exe64⤵
- Executes dropped EXE
PID:708 -
\??\c:\djdpd.exec:\djdpd.exe65⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lflrflx.exec:\lflrflx.exe66⤵PID:2152
-
\??\c:\hbthth.exec:\hbthth.exe67⤵PID:1964
-
\??\c:\hhbnhn.exec:\hhbnhn.exe68⤵PID:1460
-
\??\c:\9jjpv.exec:\9jjpv.exe69⤵PID:2972
-
\??\c:\3vvdp.exec:\3vvdp.exe70⤵PID:712
-
\??\c:\3xrflrl.exec:\3xrflrl.exe71⤵PID:1884
-
\??\c:\tbnbth.exec:\tbnbth.exe72⤵PID:1588
-
\??\c:\hbtttt.exec:\hbtttt.exe73⤵PID:2456
-
\??\c:\1vvdp.exec:\1vvdp.exe74⤵PID:3044
-
\??\c:\7lrlllr.exec:\7lrlllr.exe75⤵PID:2124
-
\??\c:\rlrrllf.exec:\rlrrllf.exe76⤵PID:2288
-
\??\c:\hbttbb.exec:\hbttbb.exe77⤵PID:2844
-
\??\c:\hhbtnn.exec:\hhbtnn.exe78⤵PID:2608
-
\??\c:\jdvdj.exec:\jdvdj.exe79⤵PID:2828
-
\??\c:\rrlfxfx.exec:\rrlfxfx.exe80⤵PID:2160
-
\??\c:\ffxlxrf.exec:\ffxlxrf.exe81⤵PID:2832
-
\??\c:\tthnbh.exec:\tthnbh.exe82⤵PID:2640
-
\??\c:\pppdp.exec:\pppdp.exe83⤵PID:2532
-
\??\c:\7dppd.exec:\7dppd.exe84⤵PID:2940
-
\??\c:\lfllllx.exec:\lfllllx.exe85⤵PID:2544
-
\??\c:\llfxlxl.exec:\llfxlxl.exe86⤵PID:2948
-
\??\c:\7nbbnn.exec:\7nbbnn.exe87⤵PID:2644
-
\??\c:\dvvjp.exec:\dvvjp.exe88⤵PID:2692
-
\??\c:\vvppd.exec:\vvppd.exe89⤵PID:2808
-
\??\c:\rrlfxfx.exec:\rrlfxfx.exe90⤵PID:2916
-
\??\c:\rrfrlrf.exec:\rrfrlrf.exe91⤵PID:2788
-
\??\c:\hhthnt.exec:\hhthnt.exe92⤵PID:2928
-
\??\c:\nhhtbt.exec:\nhhtbt.exe93⤵PID:472
-
\??\c:\dvjjv.exec:\dvjjv.exe94⤵PID:3068
-
\??\c:\xxllflx.exec:\xxllflx.exe95⤵PID:2332
-
\??\c:\hhthhh.exec:\hhthhh.exe96⤵PID:1428
-
\??\c:\hhtntt.exec:\hhtntt.exe97⤵PID:1728
-
\??\c:\jjjpj.exec:\jjjpj.exe98⤵PID:2384
-
\??\c:\ppvvp.exec:\ppvvp.exe99⤵PID:2340
-
\??\c:\xxlrlrf.exec:\xxlrlrf.exe100⤵PID:2312
-
\??\c:\9nntbh.exec:\9nntbh.exe101⤵PID:1344
-
\??\c:\htbbbb.exec:\htbbbb.exe102⤵PID:652
-
\??\c:\vvjpd.exec:\vvjpd.exe103⤵PID:1476
-
\??\c:\lfxfxlx.exec:\lfxfxlx.exe104⤵PID:668
-
\??\c:\xxrlxlx.exec:\xxrlxlx.exe105⤵PID:448
-
\??\c:\bbbbth.exec:\bbbbth.exe106⤵PID:2044
-
\??\c:\nbbnth.exec:\nbbnth.exe107⤵PID:2860
-
\??\c:\1dvjd.exec:\1dvjd.exe108⤵PID:600
-
\??\c:\9lllxxl.exec:\9lllxxl.exe109⤵PID:2372
-
\??\c:\1rlfrxr.exec:\1rlfrxr.exe110⤵PID:2116
-
\??\c:\7nnbtb.exec:\7nnbtb.exe111⤵PID:1560
-
\??\c:\5thhht.exec:\5thhht.exe112⤵PID:320
-
\??\c:\3pjdp.exec:\3pjdp.exe113⤵PID:1884
-
\??\c:\rrflrxr.exec:\rrflrxr.exe114⤵PID:1572
-
\??\c:\rrlrffr.exec:\rrlrffr.exe115⤵PID:2228
-
\??\c:\9nhbnt.exec:\9nhbnt.exe116⤵PID:2296
-
\??\c:\tthntb.exec:\tthntb.exe117⤵PID:2840
-
\??\c:\vvpdp.exec:\vvpdp.exe118⤵PID:2288
-
\??\c:\pvjdp.exec:\pvjdp.exe119⤵PID:2668
-
\??\c:\llflrfr.exec:\llflrfr.exe120⤵PID:2596
-
\??\c:\fxfxrfx.exec:\fxfxrfx.exe121⤵PID:2628
-
\??\c:\1nbntt.exec:\1nbntt.exe122⤵PID:2852
-
\??\c:\htnhnb.exec:\htnhnb.exe123⤵PID:2480
-
\??\c:\dddjd.exec:\dddjd.exe124⤵PID:2768
-
\??\c:\1frlxlr.exec:\1frlxlr.exe125⤵PID:2464
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe126⤵PID:2940
-
\??\c:\bhbntb.exec:\bhbntb.exe127⤵PID:2700
-
\??\c:\7hhnhh.exec:\7hhnhh.exe128⤵PID:644
-
\??\c:\3jjpd.exec:\3jjpd.exe129⤵PID:2784
-
\??\c:\xrflxxl.exec:\xrflxxl.exe130⤵PID:2712
-
\??\c:\llxlrrx.exec:\llxlrrx.exe131⤵PID:776
-
\??\c:\hnnthn.exec:\hnnthn.exe132⤵PID:2720
-
\??\c:\nhhhnh.exec:\nhhhnh.exe133⤵PID:2820
-
\??\c:\dvjpd.exec:\dvjpd.exe134⤵PID:2872
-
\??\c:\fxfxrrx.exec:\fxfxrrx.exe135⤵PID:808
-
\??\c:\9rrrlrf.exec:\9rrrlrf.exe136⤵PID:1764
-
\??\c:\nbbtth.exec:\nbbtth.exe137⤵PID:2332
-
\??\c:\vvppj.exec:\vvppj.exe138⤵PID:1372
-
\??\c:\3jpvp.exec:\3jpvp.exe139⤵PID:1728
-
\??\c:\fllxrfx.exec:\fllxrfx.exe140⤵PID:1112
-
\??\c:\thtnth.exec:\thtnth.exe141⤵PID:608
-
\??\c:\ttbbbb.exec:\ttbbbb.exe142⤵PID:488
-
\??\c:\3rrllll.exec:\3rrllll.exe143⤵PID:1236
-
\??\c:\lrlxlrf.exec:\lrlxlrf.exe144⤵PID:604
-
\??\c:\hhbhtn.exec:\hhbhtn.exe145⤵PID:852
-
\??\c:\7pjjv.exec:\7pjjv.exe146⤵PID:2188
-
\??\c:\dvdvd.exec:\dvdvd.exe147⤵PID:1972
-
\??\c:\lfrxflr.exec:\lfrxflr.exe148⤵PID:1976
-
\??\c:\5hthnn.exec:\5hthnn.exe149⤵PID:960
-
\??\c:\jdjjv.exec:\jdjjv.exe150⤵PID:600
-
\??\c:\5dpjd.exec:\5dpjd.exe151⤵PID:2176
-
\??\c:\xlxfllx.exec:\xlxfllx.exe152⤵PID:2328
-
\??\c:\tntnth.exec:\tntnth.exe153⤵PID:2220
-
\??\c:\jdvdp.exec:\jdvdp.exe154⤵PID:884
-
\??\c:\7dvdd.exec:\7dvdd.exe155⤵PID:1732
-
\??\c:\3lxrxxx.exec:\3lxrxxx.exe156⤵PID:1628
-
\??\c:\7ttttb.exec:\7ttttb.exe157⤵PID:2284
-
\??\c:\bntbtt.exec:\bntbtt.exe158⤵PID:2296
-
\??\c:\ppddp.exec:\ppddp.exe159⤵PID:2748
-
\??\c:\xxrxllf.exec:\xxrxllf.exe160⤵PID:2288
-
\??\c:\bhnnhh.exec:\bhnnhh.exe161⤵PID:2616
-
\??\c:\9bttbn.exec:\9bttbn.exe162⤵PID:2596
-
\??\c:\1dvjp.exec:\1dvjp.exe163⤵PID:2976
-
\??\c:\rrrlxxf.exec:\rrrlxxf.exe164⤵PID:2636
-
\??\c:\btntht.exec:\btntht.exe165⤵PID:2468
-
\??\c:\9bbhht.exec:\9bbhht.exe166⤵PID:2588
-
\??\c:\3pdpv.exec:\3pdpv.exe167⤵PID:2520
-
\??\c:\ffxflrf.exec:\ffxflrf.exe168⤵PID:1920
-
\??\c:\xfxlfll.exec:\xfxlfll.exe169⤵PID:2804
-
\??\c:\hhhbbn.exec:\hhhbbn.exe170⤵PID:644
-
\??\c:\jjjdp.exec:\jjjdp.exe171⤵PID:2812
-
\??\c:\5jvdp.exec:\5jvdp.exe172⤵PID:2900
-
\??\c:\rrflrxx.exec:\rrflrxx.exe173⤵PID:548
-
\??\c:\bnhhbt.exec:\bnhhbt.exe174⤵PID:2856
-
\??\c:\ddppv.exec:\ddppv.exe175⤵PID:948
-
\??\c:\jdjdj.exec:\jdjdj.exe176⤵PID:1808
-
\??\c:\rrlrrfx.exec:\rrlrrfx.exe177⤵PID:1700
-
\??\c:\bnnbhh.exec:\bnnbhh.exe178⤵PID:1900
-
\??\c:\3nhhhb.exec:\3nhhhb.exe179⤵PID:2036
-
\??\c:\1vddd.exec:\1vddd.exe180⤵PID:2320
-
\??\c:\ppjjv.exec:\ppjjv.exe181⤵PID:564
-
\??\c:\xrxxffl.exec:\xrxxffl.exe182⤵PID:692
-
\??\c:\lfflxxf.exec:\lfflxxf.exe183⤵PID:2988
-
\??\c:\hhbhnn.exec:\hhbhnn.exe184⤵PID:1488
-
\??\c:\tnbbtt.exec:\tnbbtt.exe185⤵PID:920
-
\??\c:\dpvpv.exec:\dpvpv.exe186⤵PID:1048
-
\??\c:\9xrffrx.exec:\9xrffrx.exe187⤵PID:708
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe188⤵PID:2088
-
\??\c:\9bnnnh.exec:\9bnnnh.exe189⤵PID:2152
-
\??\c:\bbtbnn.exec:\bbtbnn.exe190⤵PID:1964
-
\??\c:\vpdvv.exec:\vpdvv.exe191⤵PID:3012
-
\??\c:\dvjjp.exec:\dvjjp.exe192⤵PID:1460
-
\??\c:\lflfrxf.exec:\lflfrxf.exe193⤵PID:3028
-
\??\c:\hnnbtt.exec:\hnnbtt.exe194⤵PID:712
-
\??\c:\bnntht.exec:\bnntht.exe195⤵PID:2028
-
\??\c:\dpvpv.exec:\dpvpv.exe196⤵PID:2408
-
\??\c:\dvvpd.exec:\dvvpd.exe197⤵PID:2552
-
\??\c:\3lxxffl.exec:\3lxxffl.exe198⤵PID:1608
-
\??\c:\tntbbh.exec:\tntbbh.exe199⤵PID:2964
-
\??\c:\btbnbt.exec:\btbnbt.exe200⤵PID:2612
-
\??\c:\jjdjv.exec:\jjdjv.exe201⤵PID:2980
-
\??\c:\7rfllrr.exec:\7rfllrr.exe202⤵PID:2748
-
\??\c:\xllfllr.exec:\xllfllr.exe203⤵PID:2592
-
\??\c:\btnbnn.exec:\btnbnn.exe204⤵PID:2508
-
\??\c:\dvpjp.exec:\dvpjp.exe205⤵PID:2580
-
\??\c:\dvddj.exec:\dvddj.exe206⤵PID:2500
-
\??\c:\7fxrffl.exec:\7fxrffl.exe207⤵PID:2768
-
\??\c:\xlxfllr.exec:\xlxfllr.exe208⤵PID:2512
-
\??\c:\thnhnn.exec:\thnhnn.exe209⤵PID:2112
-
\??\c:\jvpvd.exec:\jvpvd.exe210⤵PID:2648
-
\??\c:\dddvj.exec:\dddvj.exe211⤵PID:2644
-
\??\c:\frfrrrx.exec:\frfrrrx.exe212⤵PID:2692
-
\??\c:\9bntbh.exec:\9bntbh.exe213⤵PID:644
-
\??\c:\tbnbnb.exec:\tbnbnb.exe214⤵PID:2916
-
\??\c:\vjddj.exec:\vjddj.exe215⤵PID:2956
-
\??\c:\vpddj.exec:\vpddj.exe216⤵PID:2884
-
\??\c:\rfrfllr.exec:\rfrfllr.exe217⤵PID:940
-
\??\c:\htbhbt.exec:\htbhbt.exe218⤵PID:1548
-
\??\c:\7hnnnt.exec:\7hnnnt.exe219⤵PID:2072
-
\??\c:\jdddv.exec:\jdddv.exe220⤵PID:2324
-
\??\c:\pvvpv.exec:\pvvpv.exe221⤵PID:1904
-
\??\c:\5lrllrf.exec:\5lrllrf.exe222⤵PID:1456
-
\??\c:\htttnb.exec:\htttnb.exe223⤵PID:540
-
\??\c:\vvvvv.exec:\vvvvv.exe224⤵PID:3008
-
\??\c:\pjppv.exec:\pjppv.exe225⤵PID:1740
-
\??\c:\rxllflx.exec:\rxllflx.exe226⤵PID:1236
-
\??\c:\nbhhhb.exec:\nbhhhb.exe227⤵PID:576
-
\??\c:\hbntnn.exec:\hbntnn.exe228⤵PID:1476
-
\??\c:\vvjdv.exec:\vvjdv.exe229⤵PID:1496
-
\??\c:\lflfrxl.exec:\lflfrxl.exe230⤵PID:1652
-
\??\c:\fxxflrx.exec:\fxxflrx.exe231⤵PID:1080
-
\??\c:\btntbh.exec:\btntbh.exe232⤵PID:908
-
\??\c:\vvjpp.exec:\vvjpp.exe233⤵PID:2004
-
\??\c:\pjppd.exec:\pjppd.exe234⤵PID:2232
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe235⤵PID:1504
-
\??\c:\hbntbt.exec:\hbntbt.exe236⤵PID:2168
-
\??\c:\jdddj.exec:\jdddj.exe237⤵PID:2220
-
\??\c:\5jjjd.exec:\5jjjd.exe238⤵PID:1604
-
\??\c:\3rxxffl.exec:\3rxxffl.exe239⤵PID:2104
-
\??\c:\rxxflxf.exec:\rxxflxf.exe240⤵PID:2560
-
\??\c:\thnnnh.exec:\thnnnh.exe241⤵PID:2284
-
\??\c:\pdppv.exec:\pdppv.exe242⤵PID:2120