Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c4931873b7b1dc23086b1344d198136f38856b16ceb353699eb0733a87d0afd.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0c4931873b7b1dc23086b1344d198136f38856b16ceb353699eb0733a87d0afd.exe
-
Size
720KB
-
MD5
0c05e695ac9711cd29f30771a8775f0a
-
SHA1
f24543ebbb508baa3b7404edd603ee00d4e2ab74
-
SHA256
0c4931873b7b1dc23086b1344d198136f38856b16ceb353699eb0733a87d0afd
-
SHA512
d198a34db804c03b014088a359fc2550d0170011c87e3233f1f68043ad05e614c6d290f8c5d12e55913c61ab01f7eb68f70224906caa140eca6b011ed653bc9d
-
SSDEEP
12288:n3C9yMo+S0L9xRnoq7H9xqYL5oeEF5rna9sUxg7udOxPJVSjYg8lcmJ1MZxEkTsf:SgD4bhoqLDqYLS7w4z
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/3016-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/424-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral1/memory/3016-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3044-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3044-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3044-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1152-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1152-28-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1152-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2728-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2728-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2788-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2688-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2540-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1048-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1928-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2824-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/348-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/796-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/308-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/572-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1484-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2860-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/424-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1076-259-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/840-277-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2084-286-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
btntbb.exevpdjv.exe9rlrfrf.exexrlrflx.exelxlrxff.exe7btbhh.exexrlrflr.exenhbtbn.exetbthhb.exelxrflrx.exe9vjjp.exe9nbhnb.exexlfflll.exedvpvd.exepjdjj.exerlflfxl.exe3dpjv.exebbthnb.exeffxlflf.exebbttbh.exerrfffll.exetnhtbb.exe1nbntb.exe1vpvj.exepjjvd.exebhthnh.exerlxlxfr.exe7jddd.exenhbntt.exedvpvd.exeppvdd.exellxfrxl.exe3pjvd.exe5bttht.exedvpvj.exelrlflxf.exebthtnt.exe1dpvj.exexrflxlf.exexrlfrxl.exebtthnt.exe7vjjv.exe5llrlxl.exennhtbn.exepjvvp.exe5vjjp.exexfxflrf.exebbbbhh.exevvpvj.exellflflr.exerrxxlrx.exennbhnn.exejddpj.exellrfxfr.exehttbnn.exevpddj.exexrxfrrx.exeflfrxfl.exenbttbh.exejpvpp.exerlxlfll.exehtnhth.exevpjvd.exefffxxlf.exepid process 3044 btntbb.exe 1152 vpdjv.exe 2728 9rlrfrf.exe 2628 xrlrflx.exe 2788 lxlrxff.exe 2688 7btbhh.exe 2540 xrlrflr.exe 1048 nhbtbn.exe 1928 tbthhb.exe 2824 lxrflrx.exe 1780 9vjjp.exe 348 9nbhnb.exe 796 xlfflll.exe 2508 dvpvd.exe 1516 pjdjj.exe 1392 rlflfxl.exe 1428 3dpjv.exe 2972 bbthnb.exe 308 ffxlflf.exe 572 bbttbh.exe 1484 rrfffll.exe 2860 tnhtbb.exe 2412 1nbntb.exe 424 1vpvj.exe 1504 pjjvd.exe 1076 bhthnh.exe 1084 rlxlxfr.exe 840 7jddd.exe 2084 nhbntt.exe 1496 dvpvd.exe 2980 ppvdd.exe 2448 llxfrxl.exe 1708 3pjvd.exe 2204 5bttht.exe 2712 dvpvj.exe 1088 lrlflxf.exe 2744 bthtnt.exe 2676 1dpvj.exe 2148 xrflxlf.exe 2756 xrlfrxl.exe 2696 btthnt.exe 1668 7vjjv.exe 2568 5llrlxl.exe 2584 nnhtbn.exe 3064 pjvvp.exe 2828 5vjjp.exe 2848 xfxflrf.exe 1940 bbbbhh.exe 1756 vvpvj.exe 1936 llflflr.exe 1624 rrxxlrx.exe 796 nnbhnn.exe 1520 jddpj.exe 2004 llrfxfr.exe 2620 httbnn.exe 1912 vpddj.exe 2964 xrxfrrx.exe 2952 flfrxfl.exe 772 nbttbh.exe 696 jpvpp.exe 2296 rlxlfll.exe 632 htnhth.exe 2860 vpjvd.exe 1044 fffxxlf.exe -
Processes:
resource yara_rule behavioral1/memory/3016-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/424-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-286-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0c4931873b7b1dc23086b1344d198136f38856b16ceb353699eb0733a87d0afd.exebtntbb.exevpdjv.exe9rlrfrf.exexrlrflx.exelxlrxff.exe7btbhh.exexrlrflr.exenhbtbn.exetbthhb.exelxrflrx.exe9vjjp.exe9nbhnb.exexlfflll.exedvpvd.exepjdjj.exedescription pid process target process PID 3016 wrote to memory of 3044 3016 0c4931873b7b1dc23086b1344d198136f38856b16ceb353699eb0733a87d0afd.exe btntbb.exe PID 3016 wrote to memory of 3044 3016 0c4931873b7b1dc23086b1344d198136f38856b16ceb353699eb0733a87d0afd.exe btntbb.exe PID 3016 wrote to memory of 3044 3016 0c4931873b7b1dc23086b1344d198136f38856b16ceb353699eb0733a87d0afd.exe btntbb.exe PID 3016 wrote to memory of 3044 3016 0c4931873b7b1dc23086b1344d198136f38856b16ceb353699eb0733a87d0afd.exe btntbb.exe PID 3044 wrote to memory of 1152 3044 btntbb.exe vpdjv.exe PID 3044 wrote to memory of 1152 3044 btntbb.exe vpdjv.exe PID 3044 wrote to memory of 1152 3044 btntbb.exe vpdjv.exe PID 3044 wrote to memory of 1152 3044 btntbb.exe vpdjv.exe PID 1152 wrote to memory of 2728 1152 vpdjv.exe 9rlrfrf.exe PID 1152 wrote to memory of 2728 1152 vpdjv.exe 9rlrfrf.exe PID 1152 wrote to memory of 2728 1152 vpdjv.exe 9rlrfrf.exe PID 1152 wrote to memory of 2728 1152 vpdjv.exe 9rlrfrf.exe PID 2728 wrote to memory of 2628 2728 9rlrfrf.exe xrlrflx.exe PID 2728 wrote to memory of 2628 2728 9rlrfrf.exe xrlrflx.exe PID 2728 wrote to memory of 2628 2728 9rlrfrf.exe xrlrflx.exe PID 2728 wrote to memory of 2628 2728 9rlrfrf.exe xrlrflx.exe PID 2628 wrote to memory of 2788 2628 xrlrflx.exe lxlrxff.exe PID 2628 wrote to memory of 2788 2628 xrlrflx.exe lxlrxff.exe PID 2628 wrote to memory of 2788 2628 xrlrflx.exe lxlrxff.exe PID 2628 wrote to memory of 2788 2628 xrlrflx.exe lxlrxff.exe PID 2788 wrote to memory of 2688 2788 lxlrxff.exe 7btbhh.exe PID 2788 wrote to memory of 2688 2788 lxlrxff.exe 7btbhh.exe PID 2788 wrote to memory of 2688 2788 lxlrxff.exe 7btbhh.exe PID 2788 wrote to memory of 2688 2788 lxlrxff.exe 7btbhh.exe PID 2688 wrote to memory of 2540 2688 7btbhh.exe xrlrflr.exe PID 2688 wrote to memory of 2540 2688 7btbhh.exe xrlrflr.exe PID 2688 wrote to memory of 2540 2688 7btbhh.exe xrlrflr.exe PID 2688 wrote to memory of 2540 2688 7btbhh.exe xrlrflr.exe PID 2540 wrote to memory of 1048 2540 xrlrflr.exe nhbtbn.exe PID 2540 wrote to memory of 1048 2540 xrlrflr.exe nhbtbn.exe PID 2540 wrote to memory of 1048 2540 xrlrflr.exe nhbtbn.exe PID 2540 wrote to memory of 1048 2540 xrlrflr.exe nhbtbn.exe PID 1048 wrote to memory of 1928 1048 nhbtbn.exe tbthhb.exe PID 1048 wrote to memory of 1928 1048 nhbtbn.exe tbthhb.exe PID 1048 wrote to memory of 1928 1048 nhbtbn.exe tbthhb.exe PID 1048 wrote to memory of 1928 1048 nhbtbn.exe tbthhb.exe PID 1928 wrote to memory of 2824 1928 tbthhb.exe lxrflrx.exe PID 1928 wrote to memory of 2824 1928 tbthhb.exe lxrflrx.exe PID 1928 wrote to memory of 2824 1928 tbthhb.exe lxrflrx.exe PID 1928 wrote to memory of 2824 1928 tbthhb.exe lxrflrx.exe PID 2824 wrote to memory of 1780 2824 lxrflrx.exe 9vjjp.exe PID 2824 wrote to memory of 1780 2824 lxrflrx.exe 9vjjp.exe PID 2824 wrote to memory of 1780 2824 lxrflrx.exe 9vjjp.exe PID 2824 wrote to memory of 1780 2824 lxrflrx.exe 9vjjp.exe PID 1780 wrote to memory of 348 1780 9vjjp.exe 9nbhnb.exe PID 1780 wrote to memory of 348 1780 9vjjp.exe 9nbhnb.exe PID 1780 wrote to memory of 348 1780 9vjjp.exe 9nbhnb.exe PID 1780 wrote to memory of 348 1780 9vjjp.exe 9nbhnb.exe PID 348 wrote to memory of 796 348 9nbhnb.exe xlfflll.exe PID 348 wrote to memory of 796 348 9nbhnb.exe xlfflll.exe PID 348 wrote to memory of 796 348 9nbhnb.exe xlfflll.exe PID 348 wrote to memory of 796 348 9nbhnb.exe xlfflll.exe PID 796 wrote to memory of 2508 796 xlfflll.exe dvpvd.exe PID 796 wrote to memory of 2508 796 xlfflll.exe dvpvd.exe PID 796 wrote to memory of 2508 796 xlfflll.exe dvpvd.exe PID 796 wrote to memory of 2508 796 xlfflll.exe dvpvd.exe PID 2508 wrote to memory of 1516 2508 dvpvd.exe pjdjj.exe PID 2508 wrote to memory of 1516 2508 dvpvd.exe pjdjj.exe PID 2508 wrote to memory of 1516 2508 dvpvd.exe pjdjj.exe PID 2508 wrote to memory of 1516 2508 dvpvd.exe pjdjj.exe PID 1516 wrote to memory of 1392 1516 pjdjj.exe rlflfxl.exe PID 1516 wrote to memory of 1392 1516 pjdjj.exe rlflfxl.exe PID 1516 wrote to memory of 1392 1516 pjdjj.exe rlflfxl.exe PID 1516 wrote to memory of 1392 1516 pjdjj.exe rlflfxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c4931873b7b1dc23086b1344d198136f38856b16ceb353699eb0733a87d0afd.exe"C:\Users\Admin\AppData\Local\Temp\0c4931873b7b1dc23086b1344d198136f38856b16ceb353699eb0733a87d0afd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\btntbb.exec:\btntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\vpdjv.exec:\vpdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\9rlrfrf.exec:\9rlrfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xrlrflx.exec:\xrlrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\lxlrxff.exec:\lxlrxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\7btbhh.exec:\7btbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xrlrflr.exec:\xrlrflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nhbtbn.exec:\nhbtbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\tbthhb.exec:\tbthhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\lxrflrx.exec:\lxrflrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9vjjp.exec:\9vjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\9nbhnb.exec:\9nbhnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\xlfflll.exec:\xlfflll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\dvpvd.exec:\dvpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\pjdjj.exec:\pjdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\rlflfxl.exec:\rlflfxl.exe17⤵
- Executes dropped EXE
PID:1392 -
\??\c:\3dpjv.exec:\3dpjv.exe18⤵
- Executes dropped EXE
PID:1428 -
\??\c:\bbthnb.exec:\bbthnb.exe19⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ffxlflf.exec:\ffxlflf.exe20⤵
- Executes dropped EXE
PID:308 -
\??\c:\bbttbh.exec:\bbttbh.exe21⤵
- Executes dropped EXE
PID:572 -
\??\c:\rrfffll.exec:\rrfffll.exe22⤵
- Executes dropped EXE
PID:1484 -
\??\c:\tnhtbb.exec:\tnhtbb.exe23⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1nbntb.exec:\1nbntb.exe24⤵
- Executes dropped EXE
PID:2412 -
\??\c:\1vpvj.exec:\1vpvj.exe25⤵
- Executes dropped EXE
PID:424 -
\??\c:\pjjvd.exec:\pjjvd.exe26⤵
- Executes dropped EXE
PID:1504 -
\??\c:\bhthnh.exec:\bhthnh.exe27⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rlxlxfr.exec:\rlxlxfr.exe28⤵
- Executes dropped EXE
PID:1084 -
\??\c:\7jddd.exec:\7jddd.exe29⤵
- Executes dropped EXE
PID:840 -
\??\c:\nhbntt.exec:\nhbntt.exe30⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dvpvd.exec:\dvpvd.exe31⤵
- Executes dropped EXE
PID:1496 -
\??\c:\ppvdd.exec:\ppvdd.exe32⤵
- Executes dropped EXE
PID:2980 -
\??\c:\llxfrxl.exec:\llxfrxl.exe33⤵
- Executes dropped EXE
PID:2448 -
\??\c:\3pjvd.exec:\3pjvd.exe34⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe35⤵PID:1720
-
\??\c:\5bttht.exec:\5bttht.exe36⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dvpvj.exec:\dvpvj.exe37⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lrlflxf.exec:\lrlflxf.exe38⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bthtnt.exec:\bthtnt.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1dpvj.exec:\1dpvj.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xrflxlf.exec:\xrflxlf.exe41⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xrlfrxl.exec:\xrlfrxl.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\btthnt.exec:\btthnt.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7vjjv.exec:\7vjjv.exe44⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5llrlxl.exec:\5llrlxl.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nnhtbn.exec:\nnhtbn.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pjvvp.exec:\pjvvp.exe47⤵
- Executes dropped EXE
PID:3064 -
\??\c:\5vjjp.exec:\5vjjp.exe48⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xfxflrf.exec:\xfxflrf.exe49⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bbbbhh.exec:\bbbbhh.exe50⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vvpvj.exec:\vvpvj.exe51⤵
- Executes dropped EXE
PID:1756 -
\??\c:\llflflr.exec:\llflflr.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rrxxlrx.exec:\rrxxlrx.exe53⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nnbhnn.exec:\nnbhnn.exe54⤵
- Executes dropped EXE
PID:796 -
\??\c:\jddpj.exec:\jddpj.exe55⤵
- Executes dropped EXE
PID:1520 -
\??\c:\llrfxfr.exec:\llrfxfr.exe56⤵
- Executes dropped EXE
PID:2004 -
\??\c:\httbnn.exec:\httbnn.exe57⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vpddj.exec:\vpddj.exe58⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xrxfrrx.exec:\xrxfrrx.exe59⤵
- Executes dropped EXE
PID:2964 -
\??\c:\flfrxfl.exec:\flfrxfl.exe60⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nbttbh.exec:\nbttbh.exe61⤵
- Executes dropped EXE
PID:772 -
\??\c:\jpvpp.exec:\jpvpp.exe62⤵
- Executes dropped EXE
PID:696 -
\??\c:\rlxlfll.exec:\rlxlfll.exe63⤵
- Executes dropped EXE
PID:2296 -
\??\c:\htnhth.exec:\htnhth.exe64⤵
- Executes dropped EXE
PID:632 -
\??\c:\vpjvd.exec:\vpjvd.exe65⤵
- Executes dropped EXE
PID:2860 -
\??\c:\fffxxlf.exec:\fffxxlf.exe66⤵
- Executes dropped EXE
PID:1044 -
\??\c:\5rlfrxl.exec:\5rlfrxl.exe67⤵PID:1696
-
\??\c:\nnhnbh.exec:\nnhnbh.exe68⤵PID:1536
-
\??\c:\jdvvj.exec:\jdvvj.exe69⤵PID:1348
-
\??\c:\xrflrxx.exec:\xrflrxx.exe70⤵PID:2948
-
\??\c:\tnhnbn.exec:\tnhnbn.exe71⤵PID:2280
-
\??\c:\vpppv.exec:\vpppv.exe72⤵PID:296
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe73⤵PID:1740
-
\??\c:\fxflrxf.exec:\fxflrxf.exe74⤵PID:2160
-
\??\c:\bbhnnb.exec:\bbhnnb.exe75⤵PID:992
-
\??\c:\dvjpj.exec:\dvjpj.exe76⤵PID:1872
-
\??\c:\5rxxxfl.exec:\5rxxxfl.exe77⤵PID:1564
-
\??\c:\hbhntt.exec:\hbhntt.exe78⤵PID:3040
-
\??\c:\pjvjp.exec:\pjvjp.exe79⤵PID:1748
-
\??\c:\ddvdp.exec:\ddvdp.exe80⤵PID:2928
-
\??\c:\7rlrfll.exec:\7rlrfll.exe81⤵PID:2248
-
\??\c:\hhbhtt.exec:\hhbhtt.exe82⤵PID:2748
-
\??\c:\jjjpd.exec:\jjjpd.exe83⤵PID:2944
-
\??\c:\1lflrrx.exec:\1lflrrx.exe84⤵PID:2684
-
\??\c:\hbtbht.exec:\hbtbht.exe85⤵PID:2656
-
\??\c:\vvppd.exec:\vvppd.exe86⤵PID:2544
-
\??\c:\xrlrrxx.exec:\xrlrrxx.exe87⤵PID:2532
-
\??\c:\tnhtnn.exec:\tnhtnn.exe88⤵PID:2644
-
\??\c:\5vvdj.exec:\5vvdj.exe89⤵PID:2216
-
\??\c:\rlflrxf.exec:\rlflrxf.exe90⤵PID:2584
-
\??\c:\nhbbtb.exec:\nhbbtb.exe91⤵PID:2840
-
\??\c:\dpdvv.exec:\dpdvv.exe92⤵PID:2624
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe93⤵PID:2328
-
\??\c:\nntbhh.exec:\nntbhh.exe94⤵PID:1780
-
\??\c:\3pjpv.exec:\3pjpv.exe95⤵PID:1568
-
\??\c:\xlxxxff.exec:\xlxxxff.exe96⤵PID:316
-
\??\c:\hbbbhn.exec:\hbbbhn.exe97⤵PID:624
-
\??\c:\jpvvd.exec:\jpvvd.exe98⤵PID:796
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe99⤵PID:1768
-
\??\c:\htbnhh.exec:\htbnhh.exe100⤵PID:1200
-
\??\c:\tnhbbb.exec:\tnhbbb.exe101⤵PID:1852
-
\??\c:\vpjjp.exec:\vpjjp.exe102⤵PID:2876
-
\??\c:\1lxflxf.exec:\1lxflxf.exe103⤵PID:380
-
\??\c:\9tntnt.exec:\9tntnt.exe104⤵PID:308
-
\??\c:\pjddp.exec:\pjddp.exe105⤵PID:572
-
\??\c:\llllxlr.exec:\llllxlr.exe106⤵PID:836
-
\??\c:\tnbthn.exec:\tnbthn.exe107⤵PID:1680
-
\??\c:\hbhntb.exec:\hbhntb.exe108⤵PID:2364
-
\??\c:\jddjv.exec:\jddjv.exe109⤵PID:2292
-
\??\c:\ffxrfrx.exec:\ffxrfrx.exe110⤵PID:1360
-
\??\c:\hbtbnt.exec:\hbtbnt.exe111⤵PID:1604
-
\??\c:\9jvdd.exec:\9jvdd.exe112⤵PID:1072
-
\??\c:\5rxflxf.exec:\5rxflxf.exe113⤵PID:1060
-
\??\c:\frfrlff.exec:\frfrlff.exe114⤵PID:2388
-
\??\c:\hhhtbb.exec:\hhhtbb.exe115⤵PID:1292
-
\??\c:\jdppj.exec:\jdppj.exe116⤵PID:1960
-
\??\c:\lrrrrrf.exec:\lrrrrrf.exe117⤵PID:1800
-
\??\c:\bbbhbt.exec:\bbbhbt.exe118⤵PID:1232
-
\??\c:\jpvpp.exec:\jpvpp.exe119⤵PID:2116
-
\??\c:\rrflrxr.exec:\rrflrxr.exe120⤵PID:2988
-
\??\c:\3nthbt.exec:\3nthbt.exe121⤵PID:2992
-
\??\c:\hhbntb.exec:\hhbntb.exe122⤵PID:2812
-
\??\c:\jddpv.exec:\jddpv.exe123⤵PID:3044
-
\??\c:\frlrxlx.exec:\frlrxlx.exe124⤵PID:2760
-
\??\c:\7thhnt.exec:\7thhnt.exe125⤵PID:2648
-
\??\c:\djdjp.exec:\djdjp.exe126⤵PID:2300
-
\??\c:\lfrflrf.exec:\lfrflrf.exe127⤵PID:2752
-
\??\c:\9rlfrfl.exec:\9rlfrfl.exe128⤵PID:3068
-
\??\c:\nhnhtb.exec:\nhnhtb.exe129⤵PID:2520
-
\??\c:\vpjjd.exec:\vpjjd.exe130⤵PID:2572
-
\??\c:\rlffrrx.exec:\rlffrrx.exe131⤵PID:2608
-
\??\c:\lfffrxl.exec:\lfffrxl.exe132⤵PID:2540
-
\??\c:\hhbnbh.exec:\hhbnbh.exe133⤵PID:2200
-
\??\c:\ffxflrx.exec:\ffxflrx.exe134⤵PID:2792
-
\??\c:\5bttbh.exec:\5bttbh.exe135⤵PID:2844
-
\??\c:\tbntnb.exec:\tbntnb.exe136⤵PID:2856
-
\??\c:\pdjvv.exec:\pdjvv.exe137⤵PID:1744
-
\??\c:\xrlxffl.exec:\xrlxffl.exe138⤵PID:1952
-
\??\c:\ttnnhn.exec:\ttnnhn.exe139⤵PID:1552
-
\??\c:\jjpdv.exec:\jjpdv.exe140⤵PID:1944
-
\??\c:\fllxlxf.exec:\fllxlxf.exe141⤵PID:2508
-
\??\c:\tnntbb.exec:\tnntbb.exe142⤵PID:852
-
\??\c:\btbhnn.exec:\btbhnn.exe143⤵PID:2060
-
\??\c:\pjvvd.exec:\pjvvd.exe144⤵PID:2076
-
\??\c:\xlxfflx.exec:\xlxfflx.exe145⤵PID:1912
-
\??\c:\tnbnbn.exec:\tnbnbn.exe146⤵PID:2500
-
\??\c:\pjvpv.exec:\pjvpv.exe147⤵PID:2044
-
\??\c:\lfxxxff.exec:\lfxxxff.exe148⤵PID:1308
-
\??\c:\hbnnbn.exec:\hbnnbn.exe149⤵PID:696
-
\??\c:\htnthb.exec:\htnthb.exe150⤵PID:2296
-
\??\c:\jdjjp.exec:\jdjjp.exe151⤵PID:632
-
\??\c:\fxxflrx.exec:\fxxflrx.exe152⤵PID:2284
-
\??\c:\3hbthn.exec:\3hbthn.exe153⤵PID:448
-
\??\c:\3pddd.exec:\3pddd.exe154⤵PID:948
-
\??\c:\jvjjj.exec:\jvjjj.exe155⤵PID:1140
-
\??\c:\rlfxffl.exec:\rlfxffl.exe156⤵PID:1832
-
\??\c:\1ttttt.exec:\1ttttt.exe157⤵PID:1636
-
\??\c:\jdpdj.exec:\jdpdj.exe158⤵PID:1084
-
\??\c:\fxlxffl.exec:\fxlxffl.exe159⤵PID:296
-
\??\c:\nhtbhh.exec:\nhtbhh.exe160⤵PID:1740
-
\??\c:\jpjdp.exec:\jpjdp.exe161⤵PID:1688
-
\??\c:\ddvjv.exec:\ddvjv.exe162⤵PID:1692
-
\??\c:\xrflxfl.exec:\xrflxfl.exe163⤵PID:2448
-
\??\c:\hhbnbh.exec:\hhbnbh.exe164⤵PID:1180
-
\??\c:\pjvdj.exec:\pjvdj.exe165⤵PID:2092
-
\??\c:\rllrxff.exec:\rllrxff.exe166⤵PID:1748
-
\??\c:\bnhntt.exec:\bnhntt.exe167⤵PID:2928
-
\??\c:\ddjvp.exec:\ddjvp.exe168⤵PID:2776
-
\??\c:\vvpdp.exec:\vvpdp.exe169⤵PID:2528
-
\??\c:\1llrxfl.exec:\1llrxfl.exe170⤵PID:2772
-
\??\c:\bhbhth.exec:\bhbhth.exe171⤵PID:2804
-
\??\c:\vpppv.exec:\vpppv.exe172⤵PID:2656
-
\??\c:\rrfrlxr.exec:\rrfrlxr.exe173⤵PID:2544
-
\??\c:\bthbnh.exec:\bthbnh.exe174⤵PID:2276
-
\??\c:\vpvpd.exec:\vpvpd.exe175⤵PID:3032
-
\??\c:\ddvpd.exec:\ddvpd.exe176⤵PID:2208
-
\??\c:\xrllllx.exec:\xrllllx.exe177⤵PID:344
-
\??\c:\9hbhhh.exec:\9hbhhh.exe178⤵PID:1928
-
\??\c:\dvddp.exec:\dvddp.exe179⤵PID:2840
-
\??\c:\1xllllr.exec:\1xllllr.exe180⤵PID:2820
-
\??\c:\5tnhht.exec:\5tnhht.exe181⤵PID:2328
-
\??\c:\nhbbnn.exec:\nhbbnn.exe182⤵PID:1672
-
\??\c:\djvdd.exec:\djvdd.exe183⤵PID:1568
-
\??\c:\5fxlrfx.exec:\5fxlrfx.exe184⤵PID:1188
-
\??\c:\btthtb.exec:\btthtb.exe185⤵PID:624
-
\??\c:\9dvvj.exec:\9dvvj.exe186⤵PID:796
-
\??\c:\5rflrxl.exec:\5rflrxl.exe187⤵PID:2072
-
\??\c:\7nnntt.exec:\7nnntt.exe188⤵PID:2056
-
\??\c:\vjdvv.exec:\vjdvv.exe189⤵PID:1812
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe190⤵PID:1784
-
\??\c:\hhtbhh.exec:\hhtbhh.exe191⤵PID:1100
-
\??\c:\5nhttt.exec:\5nhttt.exe192⤵PID:964
-
\??\c:\dvvdd.exec:\dvvdd.exe193⤵PID:572
-
\??\c:\rllrffx.exec:\rllrffx.exe194⤵PID:340
-
\??\c:\tnhntb.exec:\tnhntb.exe195⤵PID:1676
-
\??\c:\7vjpd.exec:\7vjpd.exe196⤵PID:1980
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe197⤵PID:1696
-
\??\c:\llllxfl.exec:\llllxfl.exe198⤵PID:1532
-
\??\c:\tntttt.exec:\tntttt.exe199⤵PID:1504
-
\??\c:\pvpjd.exec:\pvpjd.exe200⤵PID:944
-
\??\c:\5rllxlx.exec:\5rllxlx.exe201⤵PID:1060
-
\??\c:\bthbbb.exec:\bthbbb.exe202⤵PID:2936
-
\??\c:\pdjjp.exec:\pdjjp.exe203⤵PID:1172
-
\??\c:\dvpjj.exec:\dvpjj.exe204⤵PID:2444
-
\??\c:\fxlrfxr.exec:\fxlrfxr.exe205⤵PID:1800
-
\??\c:\1bnntt.exec:\1bnntt.exe206⤵PID:2424
-
\??\c:\jjjdp.exec:\jjjdp.exe207⤵PID:2116
-
\??\c:\lfflrxr.exec:\lfflrxr.exe208⤵PID:3008
-
\??\c:\bthnbb.exec:\bthnbb.exe209⤵PID:3016
-
\??\c:\tnhhtb.exec:\tnhhtb.exe210⤵PID:2664
-
\??\c:\vvvvv.exec:\vvvvv.exe211⤵PID:2716
-
\??\c:\5lffflr.exec:\5lffflr.exe212⤵PID:2760
-
\??\c:\tthntt.exec:\tthntt.exe213⤵PID:2640
-
\??\c:\ddpvd.exec:\ddpvd.exe214⤵PID:2672
-
\??\c:\ffxrxfr.exec:\ffxrxfr.exe215⤵PID:2752
-
\??\c:\bbbbhn.exec:\bbbbhn.exe216⤵PID:2524
-
\??\c:\9tnhtt.exec:\9tnhtt.exe217⤵PID:1668
-
\??\c:\dvvdv.exec:\dvvdv.exe218⤵PID:2600
-
\??\c:\xrlxrfl.exec:\xrlxrfl.exe219⤵PID:2692
-
\??\c:\hhbnbh.exec:\hhbnbh.exe220⤵PID:2688
-
\??\c:\pppjv.exec:\pppjv.exe221⤵PID:2852
-
\??\c:\7rlllll.exec:\7rlllll.exe222⤵PID:2796
-
\??\c:\btnnth.exec:\btnnth.exe223⤵PID:2624
-
\??\c:\tnhntb.exec:\tnhntb.exe224⤵PID:2856
-
\??\c:\3djvj.exec:\3djvj.exe225⤵PID:1628
-
\??\c:\5rxllrx.exec:\5rxllrx.exe226⤵PID:1240
-
\??\c:\bthhtb.exec:\bthhtb.exe227⤵PID:3036
-
\??\c:\dvvvd.exec:\dvvvd.exe228⤵PID:1236
-
\??\c:\3fxfflr.exec:\3fxfflr.exe229⤵PID:864
-
\??\c:\lfrxrxf.exec:\lfrxrxf.exe230⤵PID:852
-
\??\c:\bnhnbb.exec:\bnhnbb.exe231⤵PID:1300
-
\??\c:\jjjpv.exec:\jjjpv.exe232⤵PID:2008
-
\??\c:\xrlllrx.exec:\xrlllrx.exe233⤵PID:2876
-
\??\c:\nhtbnn.exec:\nhtbnn.exe234⤵PID:988
-
\??\c:\hbbhnt.exec:\hbbhnt.exe235⤵PID:588
-
\??\c:\pjvpd.exec:\pjvpd.exe236⤵PID:1040
-
\??\c:\xxxflrf.exec:\xxxflrf.exe237⤵PID:912
-
\??\c:\nhhtbb.exec:\nhhtbb.exe238⤵PID:2296
-
\??\c:\pppjv.exec:\pppjv.exe239⤵PID:632
-
\??\c:\rxrxrfl.exec:\rxrxrfl.exe240⤵PID:2284
-
\??\c:\tnhbhh.exec:\tnhbhh.exe241⤵PID:1360
-
\??\c:\1bbbhn.exec:\1bbbhn.exe242⤵PID:1076