Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e6bffaa7ccd3608b1d9be2abc5a1e93014ffdb2ff3813f32a31cae0d4f04a00c.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
e6bffaa7ccd3608b1d9be2abc5a1e93014ffdb2ff3813f32a31cae0d4f04a00c.exe
-
Size
54KB
-
MD5
146f4a09c337b78018ade4454f945b6a
-
SHA1
add45c93ab846e456d5509ab78ae8069dde93365
-
SHA256
e6bffaa7ccd3608b1d9be2abc5a1e93014ffdb2ff3813f32a31cae0d4f04a00c
-
SHA512
78aa9a45e575ca6557f136a093e5384cfcd907a7d885af4afec4dc385096aa04fa66f044995e1482d7ce5d1ac25f107fa271ddc366204237d25d4bea0ab56c7a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFt:ymb3NkkiQ3mdBjFIFt
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2988-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1448-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2988-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1448-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2068-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2068-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2068-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2068-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3020-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2772-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2820-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2820-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2636-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2344-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1520-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1792-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2228-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1072-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/484-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1404-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2276-218-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2084-280-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/900-298-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
hbhhbh.exe5rxlxfx.exe1bbhnt.exe3pppd.exepjpvj.exelfrrflr.exe7nbhnt.exehhtntt.exevvvvd.exellrrlrl.exenhbbnb.exenhbhtb.exeppjvv.exexrlrxlr.exellflrxf.exenhbtth.exe1dpdj.exejjdvp.exe7rlrxrf.exebbttbt.exebbbnth.exedvvvp.exellfxxxl.exe5xlrlrx.exehtnthn.exedddvj.exelrllffx.exefrflxxl.exehhhtht.exebbtnbh.exepjdpd.exeffrrxxl.exe3frfrfl.exe9nnhhn.exetnhnnt.exe3dpjp.exejdvdp.exerlxfrfl.exehbtnth.exetthhtt.exejddpv.exeppjdj.exe7rflrxf.exellflrfl.exebbbhtb.exenhnthh.exevvjjp.exejvjjj.exelrxxxrx.exexrfxffr.exetnnbtb.exe5pdvj.exe9ddjp.exerllrxfl.exexxxlfrr.exettnbhn.exetthhtt.exedvjpp.exexrllrrf.exexxrxlrr.exe1tnntb.exenhnthh.exedvjpd.exe1jvjp.exepid process 1448 hbhhbh.exe 2068 5rxlxfx.exe 3020 1bbhnt.exe 2772 3pppd.exe 2860 pjpvj.exe 2820 lfrrflr.exe 2636 7nbhnt.exe 2564 hhtntt.exe 2344 vvvvd.exe 2416 llrrlrl.exe 672 nhbbnb.exe 2700 nhbhtb.exe 2828 ppjvv.exe 1520 xrlrxlr.exe 1792 llflrxf.exe 2228 nhbtth.exe 1072 1dpdj.exe 484 jjdvp.exe 1404 7rlrxrf.exe 2560 bbttbt.exe 3052 bbbnth.exe 2276 dvvvp.exe 2284 llfxxxl.exe 572 5xlrlrx.exe 912 htnthn.exe 1612 dddvj.exe 1824 lrllffx.exe 944 frflxxl.exe 2084 hhhtht.exe 2116 bbtnbh.exe 900 pjdpd.exe 2132 ffrrxxl.exe 1688 3frfrfl.exe 1704 9nnhhn.exe 1872 tnhnnt.exe 1172 3dpjp.exe 2704 jdvdp.exe 2628 rlxfrfl.exe 2724 hbtnth.exe 2772 tthhtt.exe 2860 jddpv.exe 2688 ppjdj.exe 2532 7rflrxf.exe 2576 llflrfl.exe 2564 bbbhtb.exe 1668 nhnthh.exe 1552 vvjjp.exe 2508 jvjjj.exe 1032 lrxxxrx.exe 2764 xrfxffr.exe 2224 tnnbtb.exe 1956 5pdvj.exe 2260 9ddjp.exe 1268 rllrxfl.exe 584 xxxlfrr.exe 1044 ttnbhn.exe 1456 tthhtt.exe 1336 dvjpp.exe 2308 xrllrrf.exe 2292 xxrxlrr.exe 2716 1tnntb.exe 2064 nhnthh.exe 2624 dvjpd.exe 2612 1jvjp.exe -
Processes:
resource yara_rule behavioral1/memory/2988-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e6bffaa7ccd3608b1d9be2abc5a1e93014ffdb2ff3813f32a31cae0d4f04a00c.exehbhhbh.exe5rxlxfx.exe1bbhnt.exe3pppd.exepjpvj.exelfrrflr.exe7nbhnt.exehhtntt.exevvvvd.exellrrlrl.exenhbbnb.exenhbhtb.exeppjvv.exexrlrxlr.exellflrxf.exedescription pid process target process PID 2988 wrote to memory of 1448 2988 e6bffaa7ccd3608b1d9be2abc5a1e93014ffdb2ff3813f32a31cae0d4f04a00c.exe hbhhbh.exe PID 2988 wrote to memory of 1448 2988 e6bffaa7ccd3608b1d9be2abc5a1e93014ffdb2ff3813f32a31cae0d4f04a00c.exe hbhhbh.exe PID 2988 wrote to memory of 1448 2988 e6bffaa7ccd3608b1d9be2abc5a1e93014ffdb2ff3813f32a31cae0d4f04a00c.exe hbhhbh.exe PID 2988 wrote to memory of 1448 2988 e6bffaa7ccd3608b1d9be2abc5a1e93014ffdb2ff3813f32a31cae0d4f04a00c.exe hbhhbh.exe PID 1448 wrote to memory of 2068 1448 hbhhbh.exe 5rxlxfx.exe PID 1448 wrote to memory of 2068 1448 hbhhbh.exe 5rxlxfx.exe PID 1448 wrote to memory of 2068 1448 hbhhbh.exe 5rxlxfx.exe PID 1448 wrote to memory of 2068 1448 hbhhbh.exe 5rxlxfx.exe PID 2068 wrote to memory of 3020 2068 5rxlxfx.exe 1bbhnt.exe PID 2068 wrote to memory of 3020 2068 5rxlxfx.exe 1bbhnt.exe PID 2068 wrote to memory of 3020 2068 5rxlxfx.exe 1bbhnt.exe PID 2068 wrote to memory of 3020 2068 5rxlxfx.exe 1bbhnt.exe PID 3020 wrote to memory of 2772 3020 1bbhnt.exe 3pppd.exe PID 3020 wrote to memory of 2772 3020 1bbhnt.exe 3pppd.exe PID 3020 wrote to memory of 2772 3020 1bbhnt.exe 3pppd.exe PID 3020 wrote to memory of 2772 3020 1bbhnt.exe 3pppd.exe PID 2772 wrote to memory of 2860 2772 3pppd.exe pjpvj.exe PID 2772 wrote to memory of 2860 2772 3pppd.exe pjpvj.exe PID 2772 wrote to memory of 2860 2772 3pppd.exe pjpvj.exe PID 2772 wrote to memory of 2860 2772 3pppd.exe pjpvj.exe PID 2860 wrote to memory of 2820 2860 pjpvj.exe lfrrflr.exe PID 2860 wrote to memory of 2820 2860 pjpvj.exe lfrrflr.exe PID 2860 wrote to memory of 2820 2860 pjpvj.exe lfrrflr.exe PID 2860 wrote to memory of 2820 2860 pjpvj.exe lfrrflr.exe PID 2820 wrote to memory of 2636 2820 lfrrflr.exe 7nbhnt.exe PID 2820 wrote to memory of 2636 2820 lfrrflr.exe 7nbhnt.exe PID 2820 wrote to memory of 2636 2820 lfrrflr.exe 7nbhnt.exe PID 2820 wrote to memory of 2636 2820 lfrrflr.exe 7nbhnt.exe PID 2636 wrote to memory of 2564 2636 7nbhnt.exe hhtntt.exe PID 2636 wrote to memory of 2564 2636 7nbhnt.exe hhtntt.exe PID 2636 wrote to memory of 2564 2636 7nbhnt.exe hhtntt.exe PID 2636 wrote to memory of 2564 2636 7nbhnt.exe hhtntt.exe PID 2564 wrote to memory of 2344 2564 hhtntt.exe vvvvd.exe PID 2564 wrote to memory of 2344 2564 hhtntt.exe vvvvd.exe PID 2564 wrote to memory of 2344 2564 hhtntt.exe vvvvd.exe PID 2564 wrote to memory of 2344 2564 hhtntt.exe vvvvd.exe PID 2344 wrote to memory of 2416 2344 vvvvd.exe llrrlrl.exe PID 2344 wrote to memory of 2416 2344 vvvvd.exe llrrlrl.exe PID 2344 wrote to memory of 2416 2344 vvvvd.exe llrrlrl.exe PID 2344 wrote to memory of 2416 2344 vvvvd.exe llrrlrl.exe PID 2416 wrote to memory of 672 2416 llrrlrl.exe nhbbnb.exe PID 2416 wrote to memory of 672 2416 llrrlrl.exe nhbbnb.exe PID 2416 wrote to memory of 672 2416 llrrlrl.exe nhbbnb.exe PID 2416 wrote to memory of 672 2416 llrrlrl.exe nhbbnb.exe PID 672 wrote to memory of 2700 672 nhbbnb.exe nhbhtb.exe PID 672 wrote to memory of 2700 672 nhbbnb.exe nhbhtb.exe PID 672 wrote to memory of 2700 672 nhbbnb.exe nhbhtb.exe PID 672 wrote to memory of 2700 672 nhbbnb.exe nhbhtb.exe PID 2700 wrote to memory of 2828 2700 nhbhtb.exe ppjvv.exe PID 2700 wrote to memory of 2828 2700 nhbhtb.exe ppjvv.exe PID 2700 wrote to memory of 2828 2700 nhbhtb.exe ppjvv.exe PID 2700 wrote to memory of 2828 2700 nhbhtb.exe ppjvv.exe PID 2828 wrote to memory of 1520 2828 ppjvv.exe xrlrxlr.exe PID 2828 wrote to memory of 1520 2828 ppjvv.exe xrlrxlr.exe PID 2828 wrote to memory of 1520 2828 ppjvv.exe xrlrxlr.exe PID 2828 wrote to memory of 1520 2828 ppjvv.exe xrlrxlr.exe PID 1520 wrote to memory of 1792 1520 xrlrxlr.exe llflrxf.exe PID 1520 wrote to memory of 1792 1520 xrlrxlr.exe llflrxf.exe PID 1520 wrote to memory of 1792 1520 xrlrxlr.exe llflrxf.exe PID 1520 wrote to memory of 1792 1520 xrlrxlr.exe llflrxf.exe PID 1792 wrote to memory of 2228 1792 llflrxf.exe nhbtth.exe PID 1792 wrote to memory of 2228 1792 llflrxf.exe nhbtth.exe PID 1792 wrote to memory of 2228 1792 llflrxf.exe nhbtth.exe PID 1792 wrote to memory of 2228 1792 llflrxf.exe nhbtth.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6bffaa7ccd3608b1d9be2abc5a1e93014ffdb2ff3813f32a31cae0d4f04a00c.exe"C:\Users\Admin\AppData\Local\Temp\e6bffaa7ccd3608b1d9be2abc5a1e93014ffdb2ff3813f32a31cae0d4f04a00c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\hbhhbh.exec:\hbhhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\5rxlxfx.exec:\5rxlxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\1bbhnt.exec:\1bbhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\3pppd.exec:\3pppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\pjpvj.exec:\pjpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\lfrrflr.exec:\lfrrflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\7nbhnt.exec:\7nbhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\hhtntt.exec:\hhtntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\vvvvd.exec:\vvvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\llrrlrl.exec:\llrrlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\nhbbnb.exec:\nhbbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\nhbhtb.exec:\nhbhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ppjvv.exec:\ppjvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xrlrxlr.exec:\xrlrxlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\llflrxf.exec:\llflrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\nhbtth.exec:\nhbtth.exe17⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1dpdj.exec:\1dpdj.exe18⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jjdvp.exec:\jjdvp.exe19⤵
- Executes dropped EXE
PID:484 -
\??\c:\7rlrxrf.exec:\7rlrxrf.exe20⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bbttbt.exec:\bbttbt.exe21⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bbbnth.exec:\bbbnth.exe22⤵
- Executes dropped EXE
PID:3052 -
\??\c:\dvvvp.exec:\dvvvp.exe23⤵
- Executes dropped EXE
PID:2276 -
\??\c:\llfxxxl.exec:\llfxxxl.exe24⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5xlrlrx.exec:\5xlrlrx.exe25⤵
- Executes dropped EXE
PID:572 -
\??\c:\htnthn.exec:\htnthn.exe26⤵
- Executes dropped EXE
PID:912 -
\??\c:\dddvj.exec:\dddvj.exe27⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lrllffx.exec:\lrllffx.exe28⤵
- Executes dropped EXE
PID:1824 -
\??\c:\frflxxl.exec:\frflxxl.exe29⤵
- Executes dropped EXE
PID:944 -
\??\c:\hhhtht.exec:\hhhtht.exe30⤵
- Executes dropped EXE
PID:2084 -
\??\c:\bbtnbh.exec:\bbtnbh.exe31⤵
- Executes dropped EXE
PID:2116 -
\??\c:\pjdpd.exec:\pjdpd.exe32⤵
- Executes dropped EXE
PID:900 -
\??\c:\ffrrxxl.exec:\ffrrxxl.exe33⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3frfrfl.exec:\3frfrfl.exe34⤵
- Executes dropped EXE
PID:1688 -
\??\c:\9nnhhn.exec:\9nnhhn.exe35⤵
- Executes dropped EXE
PID:1704 -
\??\c:\tnhnnt.exec:\tnhnnt.exe36⤵
- Executes dropped EXE
PID:1872 -
\??\c:\3dpjp.exec:\3dpjp.exe37⤵
- Executes dropped EXE
PID:1172 -
\??\c:\jdvdp.exec:\jdvdp.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rlxfrfl.exec:\rlxfrfl.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hbtnth.exec:\hbtnth.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tthhtt.exec:\tthhtt.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jddpv.exec:\jddpv.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ppjdj.exec:\ppjdj.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7rflrxf.exec:\7rflrxf.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\llflrfl.exec:\llflrfl.exe45⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bbbhtb.exec:\bbbhtb.exe46⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nhnthh.exec:\nhnthh.exe47⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vvjjp.exec:\vvjjp.exe48⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jvjjj.exec:\jvjjj.exe49⤵
- Executes dropped EXE
PID:2508 -
\??\c:\lrxxxrx.exec:\lrxxxrx.exe50⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xrfxffr.exec:\xrfxffr.exe51⤵
- Executes dropped EXE
PID:2764 -
\??\c:\tnnbtb.exec:\tnnbtb.exe52⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5pdvj.exec:\5pdvj.exe53⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9ddjp.exec:\9ddjp.exe54⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rllrxfl.exec:\rllrxfl.exe55⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xxxlfrr.exec:\xxxlfrr.exe56⤵
- Executes dropped EXE
PID:584 -
\??\c:\ttnbhn.exec:\ttnbhn.exe57⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tthhtt.exec:\tthhtt.exe58⤵
- Executes dropped EXE
PID:1456 -
\??\c:\dvjpp.exec:\dvjpp.exe59⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xrllrrf.exec:\xrllrrf.exe60⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xxrxlrr.exec:\xxrxlrr.exe61⤵
- Executes dropped EXE
PID:2292 -
\??\c:\1tnntb.exec:\1tnntb.exe62⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nhnthh.exec:\nhnthh.exe63⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dvjpd.exec:\dvjpd.exe64⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1jvjp.exec:\1jvjp.exe65⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3xrxlrr.exec:\3xrxlrr.exe66⤵PID:1780
-
\??\c:\rrfxxfl.exec:\rrfxxfl.exe67⤵PID:772
-
\??\c:\nnbhhh.exec:\nnbhhh.exe68⤵PID:896
-
\??\c:\nhhtth.exec:\nhhtth.exe69⤵PID:888
-
\??\c:\jvpvd.exec:\jvpvd.exe70⤵PID:2168
-
\??\c:\jdvpd.exec:\jdvpd.exe71⤵PID:1712
-
\??\c:\frrrffr.exec:\frrrffr.exe72⤵PID:288
-
\??\c:\rrfllrx.exec:\rrfllrx.exe73⤵PID:2116
-
\??\c:\7bhnbh.exec:\7bhnbh.exe74⤵PID:1996
-
\??\c:\tnbthh.exec:\tnbthh.exe75⤵PID:2124
-
\??\c:\pdjjv.exec:\pdjjv.exe76⤵PID:1980
-
\??\c:\1jpjp.exec:\1jpjp.exe77⤵PID:2148
-
\??\c:\1lxfflr.exec:\1lxfflr.exe78⤵PID:1448
-
\??\c:\lflxlfl.exec:\lflxlfl.exe79⤵PID:2632
-
\??\c:\3hhntb.exec:\3hhntb.exe80⤵PID:2736
-
\??\c:\ttnhnn.exec:\ttnhnn.exe81⤵PID:2680
-
\??\c:\vpdvd.exec:\vpdvd.exe82⤵PID:1136
-
\??\c:\pjpdp.exec:\pjpdp.exe83⤵PID:2548
-
\??\c:\xrfxffl.exec:\xrfxffl.exe84⤵PID:2712
-
\??\c:\rrrxxfl.exec:\rrrxxfl.exe85⤵PID:2820
-
\??\c:\nntbbh.exec:\nntbbh.exe86⤵PID:2644
-
\??\c:\nbthbn.exec:\nbthbn.exe87⤵PID:2580
-
\??\c:\ttnnbn.exec:\ttnnbn.exe88⤵PID:2496
-
\??\c:\vpdpv.exec:\vpdpv.exe89⤵PID:1608
-
\??\c:\vjddd.exec:\vjddd.exe90⤵PID:2584
-
\??\c:\1rlfffl.exec:\1rlfffl.exe91⤵PID:2832
-
\??\c:\1ffrxlx.exec:\1ffrxlx.exe92⤵PID:272
-
\??\c:\1bbntb.exec:\1bbntb.exe93⤵PID:2432
-
\??\c:\hbbhtb.exec:\hbbhtb.exe94⤵PID:812
-
\??\c:\dvjpp.exec:\dvjpp.exe95⤵PID:2256
-
\??\c:\vjvvd.exec:\vjvvd.exe96⤵PID:1952
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe97⤵PID:1040
-
\??\c:\frfrflr.exec:\frfrflr.exe98⤵PID:1072
-
\??\c:\btnhhh.exec:\btnhhh.exe99⤵PID:844
-
\??\c:\bbtbhn.exec:\bbtbhn.exe100⤵PID:1212
-
\??\c:\vpvdj.exec:\vpvdj.exe101⤵PID:1404
-
\??\c:\7dvpj.exec:\7dvpj.exe102⤵PID:2560
-
\??\c:\xxrflrr.exec:\xxrflrr.exe103⤵PID:2484
-
\??\c:\fxrxffl.exec:\fxrxffl.exe104⤵PID:2888
-
\??\c:\bttttb.exec:\bttttb.exe105⤵PID:1488
-
\??\c:\7bntbb.exec:\7bntbb.exe106⤵PID:3008
-
\??\c:\dvddj.exec:\dvddj.exe107⤵PID:2100
-
\??\c:\jdvjp.exec:\jdvjp.exe108⤵PID:1368
-
\??\c:\fxflxfr.exec:\fxflxfr.exe109⤵PID:1856
-
\??\c:\lllxflr.exec:\lllxflr.exe110⤵PID:236
-
\??\c:\hbbhtt.exec:\hbbhtt.exe111⤵PID:3040
-
\??\c:\bbttth.exec:\bbttth.exe112⤵PID:2856
-
\??\c:\vpvdp.exec:\vpvdp.exe113⤵PID:2084
-
\??\c:\9pjdj.exec:\9pjdj.exe114⤵PID:2216
-
\??\c:\pdpvd.exec:\pdpvd.exe115⤵PID:2456
-
\??\c:\3rlxfff.exec:\3rlxfff.exe116⤵PID:1992
-
\??\c:\rlxfllf.exec:\rlxfllf.exe117⤵PID:2132
-
\??\c:\5hthnb.exec:\5hthnb.exe118⤵PID:2040
-
\??\c:\9hbhth.exec:\9hbhth.exe119⤵PID:3024
-
\??\c:\vjvdd.exec:\vjvdd.exe120⤵PID:2144
-
\??\c:\vpdpv.exec:\vpdpv.exe121⤵PID:2672
-
\??\c:\xxrxxfr.exec:\xxrxxfr.exe122⤵PID:2068
-
\??\c:\lfffrfx.exec:\lfffrfx.exe123⤵PID:3064
-
\??\c:\nnntbb.exec:\nnntbb.exe124⤵PID:2780
-
\??\c:\thtttt.exec:\thtttt.exe125⤵PID:2660
-
\??\c:\jdvvj.exec:\jdvvj.exe126⤵PID:2692
-
\??\c:\dpdvv.exec:\dpdvv.exe127⤵PID:2756
-
\??\c:\9xrrxfl.exec:\9xrrxfl.exe128⤵PID:2940
-
\??\c:\9rxllfr.exec:\9rxllfr.exe129⤵PID:2572
-
\??\c:\btnbbb.exec:\btnbbb.exe130⤵PID:2580
-
\??\c:\bnhbbn.exec:\bnhbbn.exe131⤵PID:1920
-
\??\c:\hthhhh.exec:\hthhhh.exe132⤵PID:2808
-
\??\c:\dpjpv.exec:\dpjpv.exe133⤵PID:1940
-
\??\c:\3vjvd.exec:\3vjvd.exe134⤵PID:1672
-
\??\c:\9lfllxf.exec:\9lfllxf.exe135⤵PID:2220
-
\??\c:\1xllxfl.exec:\1xllxfl.exe136⤵PID:2224
-
\??\c:\nbhhhb.exec:\nbhhhb.exe137⤵PID:1936
-
\??\c:\bttnbt.exec:\bttnbt.exe138⤵PID:1512
-
\??\c:\pdpdj.exec:\pdpdj.exe139⤵PID:604
-
\??\c:\9vjpv.exec:\9vjpv.exe140⤵PID:1040
-
\??\c:\lfxxfxx.exec:\lfxxfxx.exe141⤵PID:484
-
\??\c:\rrflxfl.exec:\rrflxfl.exe142⤵PID:2312
-
\??\c:\nbttbt.exec:\nbttbt.exe143⤵PID:2956
-
\??\c:\bbtbhh.exec:\bbtbhh.exe144⤵PID:1716
-
\??\c:\dddjv.exec:\dddjv.exe145⤵PID:1684
-
\??\c:\ppjpp.exec:\ppjpp.exe146⤵PID:2328
-
\??\c:\lrlxxlx.exec:\lrlxxlx.exe147⤵PID:2324
-
\??\c:\xrlrfll.exec:\xrlrfll.exe148⤵PID:1488
-
\??\c:\nhbtbb.exec:\nhbtbb.exe149⤵PID:1568
-
\??\c:\1nhbtn.exec:\1nhbtn.exe150⤵PID:3012
-
\??\c:\7vdjp.exec:\7vdjp.exe151⤵PID:772
-
\??\c:\jdddj.exec:\jdddj.exe152⤵PID:1612
-
\??\c:\lfrxflr.exec:\lfrxflr.exe153⤵PID:968
-
\??\c:\fxflxxl.exec:\fxflxxl.exe154⤵PID:3040
-
\??\c:\btnnbb.exec:\btnnbb.exe155⤵PID:1720
-
\??\c:\7nhthn.exec:\7nhthn.exe156⤵PID:3016
-
\??\c:\dvpjj.exec:\dvpjj.exe157⤵PID:892
-
\??\c:\pjdjv.exec:\pjdjv.exe158⤵PID:1288
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe159⤵PID:1988
-
\??\c:\lfxlllx.exec:\lfxlllx.exe160⤵PID:1588
-
\??\c:\nnbbbb.exec:\nnbbbb.exe161⤵PID:2616
-
\??\c:\nhhhhb.exec:\nhhhhb.exe162⤵PID:2396
-
\??\c:\jvpjp.exec:\jvpjp.exe163⤵PID:2748
-
\??\c:\vppjv.exec:\vppjv.exe164⤵PID:2676
-
\??\c:\lfxffff.exec:\lfxffff.exe165⤵PID:2776
-
\??\c:\9fxlrxf.exec:\9fxlrxf.exe166⤵PID:2724
-
\??\c:\nhtbnt.exec:\nhtbnt.exe167⤵PID:2784
-
\??\c:\btnhbn.exec:\btnhbn.exe168⤵PID:2812
-
\??\c:\7nhbbb.exec:\7nhbbb.exe169⤵PID:2516
-
\??\c:\dpvvv.exec:\dpvvv.exe170⤵PID:2540
-
\??\c:\dvdjj.exec:\dvdjj.exe171⤵PID:2420
-
\??\c:\rfllrlx.exec:\rfllrlx.exe172⤵PID:1628
-
\??\c:\ffxxxfr.exec:\ffxxxfr.exe173⤵PID:1508
-
\??\c:\nhthhh.exec:\nhthhh.exe174⤵PID:1060
-
\??\c:\hbhnnh.exec:\hbhnnh.exe175⤵PID:2448
-
\??\c:\5btbbb.exec:\5btbbb.exe176⤵PID:1652
-
\??\c:\vpppj.exec:\vpppj.exe177⤵PID:1656
-
\??\c:\vpddd.exec:\vpddd.exe178⤵PID:812
-
\??\c:\lxlffff.exec:\lxlffff.exe179⤵PID:1256
-
\??\c:\7rflxfl.exec:\7rflxfl.exe180⤵PID:1792
-
\??\c:\nhbntt.exec:\nhbntt.exe181⤵PID:788
-
\??\c:\nbnthb.exec:\nbnthb.exe182⤵PID:332
-
\??\c:\tnttnt.exec:\tnttnt.exe183⤵PID:640
-
\??\c:\3pdvd.exec:\3pdvd.exe184⤵PID:1332
-
\??\c:\7pddd.exec:\7pddd.exe185⤵PID:2268
-
\??\c:\ffxxlxf.exec:\ffxxlxf.exe186⤵PID:2480
-
\??\c:\lxlrfxr.exec:\lxlrfxr.exe187⤵PID:2320
-
\??\c:\thtthh.exec:\thtthh.exe188⤵PID:1744
-
\??\c:\3httbt.exec:\3httbt.exe189⤵PID:2836
-
\??\c:\1pppv.exec:\1pppv.exe190⤵PID:556
-
\??\c:\3vjpd.exec:\3vjpd.exe191⤵PID:1116
-
\??\c:\lfxxffr.exec:\lfxxffr.exe192⤵PID:964
-
\??\c:\fxrflll.exec:\fxrflll.exe193⤵PID:2332
-
\??\c:\3hhthn.exec:\3hhthn.exe194⤵PID:1160
-
\??\c:\1ttnbh.exec:\1ttnbh.exe195⤵PID:1708
-
\??\c:\hbtttb.exec:\hbtttb.exe196⤵PID:1452
-
\??\c:\1dvjv.exec:\1dvjv.exe197⤵PID:1928
-
\??\c:\dpvvj.exec:\dpvvj.exe198⤵PID:2076
-
\??\c:\fllfrlr.exec:\fllfrlr.exe199⤵PID:2488
-
\??\c:\fxrlxfl.exec:\fxrlxfl.exe200⤵PID:1592
-
\??\c:\nbntbt.exec:\nbntbt.exe201⤵PID:1688
-
\??\c:\hhthnt.exec:\hhthnt.exe202⤵PID:2796
-
\??\c:\ddvdp.exec:\ddvdp.exe203⤵PID:2864
-
\??\c:\ddpvv.exec:\ddpvv.exe204⤵PID:1172
-
\??\c:\vjjvp.exec:\vjjvp.exe205⤵PID:2876
-
\??\c:\llxxllr.exec:\llxxllr.exe206⤵PID:2684
-
\??\c:\fffrffx.exec:\fffrffx.exe207⤵PID:2556
-
\??\c:\ttnnbb.exec:\ttnnbb.exe208⤵PID:2696
-
\??\c:\3pjpp.exec:\3pjpp.exe209⤵PID:2208
-
\??\c:\lflflfl.exec:\lflflfl.exe210⤵PID:2784
-
\??\c:\frlllfl.exec:\frlllfl.exe211⤵PID:2644
-
\??\c:\fxrlrrf.exec:\fxrlrrf.exe212⤵PID:2540
-
\??\c:\nhnbnt.exec:\nhnbnt.exe213⤵PID:820
-
\??\c:\7vdjp.exec:\7vdjp.exe214⤵PID:2580
-
\??\c:\ppdvd.exec:\ppdvd.exe215⤵PID:2708
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe216⤵PID:2808
-
\??\c:\fllxrfr.exec:\fllxrfr.exe217⤵PID:1940
-
\??\c:\ttnthh.exec:\ttnthh.exe218⤵PID:1672
-
\??\c:\7pdjj.exec:\7pdjj.exe219⤵PID:316
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe220⤵PID:2256
-
\??\c:\xrrxffl.exec:\xrrxffl.exe221⤵PID:2236
-
\??\c:\tthhnn.exec:\tthhnn.exe222⤵PID:600
-
\??\c:\nnhnbh.exec:\nnhnbh.exe223⤵PID:2920
-
\??\c:\9jjpj.exec:\9jjpj.exe224⤵PID:1040
-
\??\c:\7pjjd.exec:\7pjjd.exe225⤵PID:2368
-
\??\c:\llffrrx.exec:\llffrrx.exe226⤵PID:2936
-
\??\c:\fxxflff.exec:\fxxflff.exe227⤵PID:2104
-
\??\c:\xrlrrfl.exec:\xrlrrfl.exe228⤵PID:2292
-
\??\c:\thntbb.exec:\thntbb.exe229⤵PID:1864
-
\??\c:\tnhnbn.exec:\tnhnbn.exe230⤵PID:852
-
\??\c:\jvdjj.exec:\jvdjj.exe231⤵PID:2424
-
\??\c:\rfxxffl.exec:\rfxxffl.exe232⤵PID:912
-
\??\c:\lxrffff.exec:\lxrffff.exe233⤵PID:1780
-
\??\c:\5nbhtt.exec:\5nbhtt.exe234⤵PID:1076
-
\??\c:\nhhbtt.exec:\nhhbtt.exe235⤵PID:2140
-
\??\c:\vpdvd.exec:\vpdvd.exe236⤵PID:2264
-
\??\c:\1dppv.exec:\1dppv.exe237⤵PID:2372
-
\??\c:\9lllrxx.exec:\9lllrxx.exe238⤵PID:2156
-
\??\c:\xrlrrlr.exec:\xrlrrlr.exe239⤵PID:288
-
\??\c:\nhtnbb.exec:\nhtnbb.exe240⤵PID:3016
-
\??\c:\bthbtt.exec:\bthbtt.exe241⤵PID:2852
-
\??\c:\jvdjp.exec:\jvdjp.exe242⤵PID:1580