Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 19:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16dadcc0c40f3b038bbd4910a14256c1667d720250bcbcfb63a6f8a27c3bea6a.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
16dadcc0c40f3b038bbd4910a14256c1667d720250bcbcfb63a6f8a27c3bea6a.exe
-
Size
127KB
-
MD5
a3dc12ca33f00990a9ab30b51399e192
-
SHA1
e66ff4305aa281700a338b132ce724b78097596f
-
SHA256
16dadcc0c40f3b038bbd4910a14256c1667d720250bcbcfb63a6f8a27c3bea6a
-
SHA512
b5911bc1796533b2637f190e184297029bc9ce22903ce507a332c5d318c323bec468199f7b8664be4971ab83a9283286e0673247a4dffe81a04ab00b0f22cce3
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afodnmm9Ao98h3dktX4/J7:n3C9BRW0j/tmm9nwytIx
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/944-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/804-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/976-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1292-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral1/memory/944-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/804-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2292-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2292-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1580-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1580-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2304-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2724-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1952-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3048-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2032-286-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/976-268-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1624-242-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/564-215-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2132-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1292-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2840-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1940-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1580-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
hbbhnt.exejjpdd.exedvdpd.exe7rlrffr.exenntbnn.exevpjjv.exefxfxlxx.exerfrfllx.exenbbhnn.exepdpdd.exellfxlrf.exellrffff.exetthhnh.exepjddv.exeddjvv.exefrlxxxf.exerrflxfx.exettttbn.exe5hbhbn.exejvjpj.exe1vjpv.exexxlrflf.exerlflrxl.exehhbhtb.exebbtbhh.exepjdpd.exe1fxfllx.exe5xrflrf.exe1nhthb.exejjpjd.exexrxffxr.exe7fxfrrf.exebtthbn.exebbtbnn.exetnbhnt.exevvvdv.exexfxlflf.exexlffxfr.exefxfrlxl.exettnhht.exe3btbth.exetntbth.exejvpvj.exevjdvp.exelrflrll.exexrlxrxr.exe5xrfrxl.exe7bbhtb.exenhhthn.exevjdpj.exejddvd.exerlrrxrr.exelxlrrrf.exenhbntb.exehbnhnn.exettbnbb.exevvvvp.exefxrlrrr.exellfrflr.exeflrxrll.exettnthn.exetnbtnt.exevpjpd.exevppdv.exepid process 804 hbbhnt.exe 2464 jjpdd.exe 2292 dvdpd.exe 2712 7rlrffr.exe 2768 nntbnn.exe 1580 vpjjv.exe 2752 fxfxlxx.exe 2560 rfrfllx.exe 2304 nbbhnn.exe 1244 pdpdd.exe 2940 llfxlrf.exe 2724 llrffff.exe 1940 tthhnh.exe 2840 pjddv.exe 2888 ddjvv.exe 1952 frlxxxf.exe 1292 rrflxfx.exe 3048 ttttbn.exe 2380 5hbhbn.exe 2132 jvjpj.exe 564 1vjpv.exe 1060 xxlrflf.exe 568 rlflrxl.exe 1624 hhbhtb.exe 452 bbtbhh.exe 404 pjdpd.exe 976 1fxfllx.exe 2992 5xrflrf.exe 2032 1nhthb.exe 896 jjpjd.exe 808 xrxffxr.exe 2348 7fxfrrf.exe 1604 btthbn.exe 956 bbtbnn.exe 2648 tnbhnt.exe 1736 vvvdv.exe 2744 xfxlflf.exe 2588 xlffxfr.exe 2700 fxfrlxl.exe 2488 ttnhht.exe 2752 3btbth.exe 2560 tntbth.exe 1636 jvpvj.exe 2964 vjdvp.exe 1512 lrflrll.exe 2792 xrlxrxr.exe 2908 5xrfrxl.exe 1364 7bbhtb.exe 2668 nhhthn.exe 2200 vjdpj.exe 2888 jddvd.exe 1372 rlrrxrr.exe 3036 lxlrrrf.exe 2056 nhbntb.exe 2684 hbnhnn.exe 2796 ttbnbb.exe 1096 vvvvp.exe 1296 fxrlrrr.exe 2084 llfrflr.exe 636 flrxrll.exe 412 ttnthn.exe 2336 tnbtnt.exe 1104 vpjpd.exe 1984 vppdv.exe -
Processes:
resource yara_rule behavioral1/memory/944-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/976-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-54-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
16dadcc0c40f3b038bbd4910a14256c1667d720250bcbcfb63a6f8a27c3bea6a.exehbbhnt.exejjpdd.exedvdpd.exe7rlrffr.exenntbnn.exevpjjv.exefxfxlxx.exerfrfllx.exenbbhnn.exepdpdd.exellfxlrf.exellrffff.exetthhnh.exepjddv.exeddjvv.exedescription pid process target process PID 944 wrote to memory of 804 944 16dadcc0c40f3b038bbd4910a14256c1667d720250bcbcfb63a6f8a27c3bea6a.exe hbbhnt.exe PID 944 wrote to memory of 804 944 16dadcc0c40f3b038bbd4910a14256c1667d720250bcbcfb63a6f8a27c3bea6a.exe hbbhnt.exe PID 944 wrote to memory of 804 944 16dadcc0c40f3b038bbd4910a14256c1667d720250bcbcfb63a6f8a27c3bea6a.exe hbbhnt.exe PID 944 wrote to memory of 804 944 16dadcc0c40f3b038bbd4910a14256c1667d720250bcbcfb63a6f8a27c3bea6a.exe hbbhnt.exe PID 804 wrote to memory of 2464 804 hbbhnt.exe jjpdd.exe PID 804 wrote to memory of 2464 804 hbbhnt.exe jjpdd.exe PID 804 wrote to memory of 2464 804 hbbhnt.exe jjpdd.exe PID 804 wrote to memory of 2464 804 hbbhnt.exe jjpdd.exe PID 2464 wrote to memory of 2292 2464 jjpdd.exe dvdpd.exe PID 2464 wrote to memory of 2292 2464 jjpdd.exe dvdpd.exe PID 2464 wrote to memory of 2292 2464 jjpdd.exe dvdpd.exe PID 2464 wrote to memory of 2292 2464 jjpdd.exe dvdpd.exe PID 2292 wrote to memory of 2712 2292 dvdpd.exe 7rlrffr.exe PID 2292 wrote to memory of 2712 2292 dvdpd.exe 7rlrffr.exe PID 2292 wrote to memory of 2712 2292 dvdpd.exe 7rlrffr.exe PID 2292 wrote to memory of 2712 2292 dvdpd.exe 7rlrffr.exe PID 2712 wrote to memory of 2768 2712 7rlrffr.exe nntbnn.exe PID 2712 wrote to memory of 2768 2712 7rlrffr.exe nntbnn.exe PID 2712 wrote to memory of 2768 2712 7rlrffr.exe nntbnn.exe PID 2712 wrote to memory of 2768 2712 7rlrffr.exe nntbnn.exe PID 2768 wrote to memory of 1580 2768 nntbnn.exe vpjjv.exe PID 2768 wrote to memory of 1580 2768 nntbnn.exe vpjjv.exe PID 2768 wrote to memory of 1580 2768 nntbnn.exe vpjjv.exe PID 2768 wrote to memory of 1580 2768 nntbnn.exe vpjjv.exe PID 1580 wrote to memory of 2752 1580 vpjjv.exe fxfxlxx.exe PID 1580 wrote to memory of 2752 1580 vpjjv.exe fxfxlxx.exe PID 1580 wrote to memory of 2752 1580 vpjjv.exe fxfxlxx.exe PID 1580 wrote to memory of 2752 1580 vpjjv.exe fxfxlxx.exe PID 2752 wrote to memory of 2560 2752 fxfxlxx.exe rfrfllx.exe PID 2752 wrote to memory of 2560 2752 fxfxlxx.exe rfrfllx.exe PID 2752 wrote to memory of 2560 2752 fxfxlxx.exe rfrfllx.exe PID 2752 wrote to memory of 2560 2752 fxfxlxx.exe rfrfllx.exe PID 2560 wrote to memory of 2304 2560 rfrfllx.exe nbbhnn.exe PID 2560 wrote to memory of 2304 2560 rfrfllx.exe nbbhnn.exe PID 2560 wrote to memory of 2304 2560 rfrfllx.exe nbbhnn.exe PID 2560 wrote to memory of 2304 2560 rfrfllx.exe nbbhnn.exe PID 2304 wrote to memory of 1244 2304 nbbhnn.exe pdpdd.exe PID 2304 wrote to memory of 1244 2304 nbbhnn.exe pdpdd.exe PID 2304 wrote to memory of 1244 2304 nbbhnn.exe pdpdd.exe PID 2304 wrote to memory of 1244 2304 nbbhnn.exe pdpdd.exe PID 1244 wrote to memory of 2940 1244 pdpdd.exe llfxlrf.exe PID 1244 wrote to memory of 2940 1244 pdpdd.exe llfxlrf.exe PID 1244 wrote to memory of 2940 1244 pdpdd.exe llfxlrf.exe PID 1244 wrote to memory of 2940 1244 pdpdd.exe llfxlrf.exe PID 2940 wrote to memory of 2724 2940 llfxlrf.exe llrffff.exe PID 2940 wrote to memory of 2724 2940 llfxlrf.exe llrffff.exe PID 2940 wrote to memory of 2724 2940 llfxlrf.exe llrffff.exe PID 2940 wrote to memory of 2724 2940 llfxlrf.exe llrffff.exe PID 2724 wrote to memory of 1940 2724 llrffff.exe tthhnh.exe PID 2724 wrote to memory of 1940 2724 llrffff.exe tthhnh.exe PID 2724 wrote to memory of 1940 2724 llrffff.exe tthhnh.exe PID 2724 wrote to memory of 1940 2724 llrffff.exe tthhnh.exe PID 1940 wrote to memory of 2840 1940 tthhnh.exe pjddv.exe PID 1940 wrote to memory of 2840 1940 tthhnh.exe pjddv.exe PID 1940 wrote to memory of 2840 1940 tthhnh.exe pjddv.exe PID 1940 wrote to memory of 2840 1940 tthhnh.exe pjddv.exe PID 2840 wrote to memory of 2888 2840 pjddv.exe ddjvv.exe PID 2840 wrote to memory of 2888 2840 pjddv.exe ddjvv.exe PID 2840 wrote to memory of 2888 2840 pjddv.exe ddjvv.exe PID 2840 wrote to memory of 2888 2840 pjddv.exe ddjvv.exe PID 2888 wrote to memory of 1952 2888 ddjvv.exe frlxxxf.exe PID 2888 wrote to memory of 1952 2888 ddjvv.exe frlxxxf.exe PID 2888 wrote to memory of 1952 2888 ddjvv.exe frlxxxf.exe PID 2888 wrote to memory of 1952 2888 ddjvv.exe frlxxxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16dadcc0c40f3b038bbd4910a14256c1667d720250bcbcfb63a6f8a27c3bea6a.exe"C:\Users\Admin\AppData\Local\Temp\16dadcc0c40f3b038bbd4910a14256c1667d720250bcbcfb63a6f8a27c3bea6a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\hbbhnt.exec:\hbbhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\jjpdd.exec:\jjpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\dvdpd.exec:\dvdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\7rlrffr.exec:\7rlrffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nntbnn.exec:\nntbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\vpjjv.exec:\vpjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\fxfxlxx.exec:\fxfxlxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\rfrfllx.exec:\rfrfllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\nbbhnn.exec:\nbbhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\pdpdd.exec:\pdpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\llfxlrf.exec:\llfxlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\llrffff.exec:\llrffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\tthhnh.exec:\tthhnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\pjddv.exec:\pjddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\ddjvv.exec:\ddjvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\frlxxxf.exec:\frlxxxf.exe17⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rrflxfx.exec:\rrflxfx.exe18⤵
- Executes dropped EXE
PID:1292 -
\??\c:\ttttbn.exec:\ttttbn.exe19⤵
- Executes dropped EXE
PID:3048 -
\??\c:\5hbhbn.exec:\5hbhbn.exe20⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jvjpj.exec:\jvjpj.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\1vjpv.exec:\1vjpv.exe22⤵
- Executes dropped EXE
PID:564 -
\??\c:\xxlrflf.exec:\xxlrflf.exe23⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rlflrxl.exec:\rlflrxl.exe24⤵
- Executes dropped EXE
PID:568 -
\??\c:\hhbhtb.exec:\hhbhtb.exe25⤵
- Executes dropped EXE
PID:1624 -
\??\c:\bbtbhh.exec:\bbtbhh.exe26⤵
- Executes dropped EXE
PID:452 -
\??\c:\pjdpd.exec:\pjdpd.exe27⤵
- Executes dropped EXE
PID:404 -
\??\c:\1fxfllx.exec:\1fxfllx.exe28⤵
- Executes dropped EXE
PID:976 -
\??\c:\5xrflrf.exec:\5xrflrf.exe29⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1nhthb.exec:\1nhthb.exe30⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jjpjd.exec:\jjpjd.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\xrxffxr.exec:\xrxffxr.exe32⤵
- Executes dropped EXE
PID:808 -
\??\c:\7fxfrrf.exec:\7fxfrrf.exe33⤵
- Executes dropped EXE
PID:2348 -
\??\c:\btthbn.exec:\btthbn.exe34⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bbtbnn.exec:\bbtbnn.exe35⤵
- Executes dropped EXE
PID:956 -
\??\c:\tnbhnt.exec:\tnbhnt.exe36⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vvvdv.exec:\vvvdv.exe37⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xfxlflf.exec:\xfxlflf.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xlffxfr.exec:\xlffxfr.exe39⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fxfrlxl.exec:\fxfrlxl.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ttnhht.exec:\ttnhht.exe41⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3btbth.exec:\3btbth.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\tntbth.exec:\tntbth.exe43⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jvpvj.exec:\jvpvj.exe44⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vjdvp.exec:\vjdvp.exe45⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lrflrll.exec:\lrflrll.exe46⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xrlxrxr.exec:\xrlxrxr.exe47⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5xrfrxl.exec:\5xrfrxl.exe48⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7bbhtb.exec:\7bbhtb.exe49⤵
- Executes dropped EXE
PID:1364 -
\??\c:\nhhthn.exec:\nhhthn.exe50⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vjdpj.exec:\vjdpj.exe51⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jddvd.exec:\jddvd.exe52⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rlrrxrr.exec:\rlrrxrr.exe53⤵
- Executes dropped EXE
PID:1372 -
\??\c:\lxlrrrf.exec:\lxlrrrf.exe54⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nhbntb.exec:\nhbntb.exe55⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hbnhnn.exec:\hbnhnn.exe56⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ttbnbb.exec:\ttbnbb.exe57⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vvvvp.exec:\vvvvp.exe58⤵
- Executes dropped EXE
PID:1096 -
\??\c:\fxrlrrr.exec:\fxrlrrr.exe59⤵
- Executes dropped EXE
PID:1296 -
\??\c:\llfrflr.exec:\llfrflr.exe60⤵
- Executes dropped EXE
PID:2084 -
\??\c:\flrxrll.exec:\flrxrll.exe61⤵
- Executes dropped EXE
PID:636 -
\??\c:\ttnthn.exec:\ttnthn.exe62⤵
- Executes dropped EXE
PID:412 -
\??\c:\tnbtnt.exec:\tnbtnt.exe63⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vpjpd.exec:\vpjpd.exe64⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vppdv.exec:\vppdv.exe65⤵
- Executes dropped EXE
PID:1984 -
\??\c:\fxlxxxr.exec:\fxlxxxr.exe66⤵PID:1508
-
\??\c:\xlflrrl.exec:\xlflrrl.exe67⤵PID:2404
-
\??\c:\tthnhn.exec:\tthnhn.exe68⤵PID:576
-
\??\c:\dddjd.exec:\dddjd.exe69⤵PID:2032
-
\??\c:\1rxlxfx.exec:\1rxlxfx.exe70⤵PID:896
-
\??\c:\xfflfrl.exec:\xfflfrl.exe71⤵PID:1680
-
\??\c:\bhtnbt.exec:\bhtnbt.exe72⤵PID:2976
-
\??\c:\ttbhnb.exec:\ttbhnb.exe73⤵PID:2884
-
\??\c:\jjvpv.exec:\jjvpv.exe74⤵PID:2036
-
\??\c:\1rxrxfx.exec:\1rxrxfx.exe75⤵PID:2756
-
\??\c:\7vdvj.exec:\7vdvj.exe76⤵PID:2644
-
\??\c:\lfxllff.exec:\lfxllff.exe77⤵PID:2624
-
\??\c:\bnbbnt.exec:\bnbbnt.exe78⤵PID:2924
-
\??\c:\vvvdp.exec:\vvvdp.exe79⤵PID:2744
-
\??\c:\ppjvj.exec:\ppjvj.exe80⤵PID:2588
-
\??\c:\lxflrrr.exec:\lxflrrr.exe81⤵PID:2700
-
\??\c:\bthnbb.exec:\bthnbb.exe82⤵PID:1544
-
\??\c:\jpjpj.exec:\jpjpj.exe83⤵PID:2160
-
\??\c:\llxxxfx.exec:\llxxxfx.exe84⤵PID:1080
-
\??\c:\hbtthh.exec:\hbtthh.exe85⤵PID:2652
-
\??\c:\7pddj.exec:\7pddj.exe86⤵PID:1300
-
\??\c:\vvdpv.exec:\vvdpv.exe87⤵PID:2512
-
\??\c:\rlrxffr.exec:\rlrxffr.exe88⤵PID:2776
-
\??\c:\btnnnh.exec:\btnnnh.exe89⤵PID:1584
-
\??\c:\7hbnhb.exec:\7hbnhb.exe90⤵PID:2388
-
\??\c:\jdjpj.exec:\jdjpj.exe91⤵PID:2896
-
\??\c:\ppdjp.exec:\ppdjp.exe92⤵PID:1316
-
\??\c:\7rlrxfl.exec:\7rlrxfl.exe93⤵PID:864
-
\??\c:\xxlxflr.exec:\xxlxflr.exe94⤵PID:2888
-
\??\c:\tthhnt.exec:\tthhnt.exe95⤵PID:2164
-
\??\c:\htbbnn.exec:\htbbnn.exe96⤵PID:3036
-
\??\c:\9vvjv.exec:\9vvjv.exe97⤵PID:2312
-
\??\c:\jppvj.exec:\jppvj.exe98⤵PID:2684
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe99⤵PID:2920
-
\??\c:\tbtbnh.exec:\tbtbnh.exe100⤵PID:620
-
\??\c:\nhtbbb.exec:\nhtbbb.exe101⤵PID:1560
-
\??\c:\pjpvv.exec:\pjpvv.exe102⤵PID:568
-
\??\c:\fxrrlrx.exec:\fxrrlrx.exe103⤵PID:1624
-
\??\c:\rlfrlxl.exec:\rlfrlxl.exe104⤵PID:2416
-
\??\c:\ntbhtt.exec:\ntbhtt.exe105⤵PID:1684
-
\??\c:\pdpvj.exec:\pdpvj.exe106⤵PID:3024
-
\??\c:\1dvjj.exec:\1dvjj.exe107⤵PID:2412
-
\??\c:\fxfllfr.exec:\fxfllfr.exe108⤵PID:2992
-
\??\c:\9nnnhn.exec:\9nnnhn.exe109⤵PID:2184
-
\??\c:\tntthn.exec:\tntthn.exe110⤵PID:1108
-
\??\c:\dvppd.exec:\dvppd.exe111⤵PID:944
-
\??\c:\rrrfrfl.exec:\rrrfrfl.exe112⤵PID:808
-
\??\c:\tntnhn.exec:\tntnhn.exe113⤵PID:2384
-
\??\c:\nhtnnb.exec:\nhtnnb.exe114⤵PID:1600
-
\??\c:\jdpvj.exec:\jdpvj.exe115⤵PID:2088
-
\??\c:\rrrflrx.exec:\rrrflrx.exe116⤵PID:2760
-
\??\c:\bbtbnn.exec:\bbtbnn.exe117⤵PID:2772
-
\??\c:\ttnhbh.exec:\ttnhbh.exe118⤵PID:2748
-
\??\c:\3pvvj.exec:\3pvvj.exe119⤵PID:2096
-
\??\c:\5dvjv.exec:\5dvjv.exe120⤵PID:2520
-
\??\c:\flxrfff.exec:\flxrfff.exe121⤵PID:2672
-
\??\c:\rrlxrlx.exec:\rrlxrlx.exe122⤵PID:1596
-
\??\c:\3hbhhb.exec:\3hbhhb.exe123⤵PID:3060
-
\??\c:\jdddd.exec:\jdddd.exe124⤵PID:3068
-
\??\c:\fxxrfxf.exec:\fxxrfxf.exe125⤵PID:2856
-
\??\c:\tnnnbb.exec:\tnnnbb.exe126⤵PID:2848
-
\??\c:\pddjv.exec:\pddjv.exe127⤵PID:2780
-
\??\c:\fxrxrrf.exec:\fxrxrrf.exe128⤵PID:2808
-
\??\c:\9nhttt.exec:\9nhttt.exe129⤵PID:2792
-
\??\c:\btnbnt.exec:\btnbnt.exe130⤵PID:2832
-
\??\c:\jdvvj.exec:\jdvvj.exe131⤵PID:2932
-
\??\c:\lxxrffx.exec:\lxxrffx.exe132⤵PID:2876
-
\??\c:\7hnhbb.exec:\7hnhbb.exe133⤵PID:2200
-
\??\c:\vpvdp.exec:\vpvdp.exe134⤵PID:1768
-
\??\c:\llxxffr.exec:\llxxffr.exe135⤵PID:1292
-
\??\c:\bnhhhh.exec:\bnhhhh.exe136⤵PID:1132
-
\??\c:\1pjvp.exec:\1pjvp.exe137⤵PID:2368
-
\??\c:\7xlrffr.exec:\7xlrffr.exe138⤵PID:2980
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe139⤵PID:1236
-
\??\c:\nhnttt.exec:\nhnttt.exe140⤵PID:1176
-
\??\c:\bnnthh.exec:\bnnthh.exe141⤵PID:2392
-
\??\c:\btnhbn.exec:\btnhbn.exe142⤵PID:1992
-
\??\c:\dpjpv.exec:\dpjpv.exe143⤵PID:1780
-
\??\c:\1djpd.exec:\1djpd.exe144⤵PID:2188
-
\??\c:\1xxlrfr.exec:\1xxlrfr.exe145⤵PID:832
-
\??\c:\nbhnbb.exec:\nbhnbb.exe146⤵PID:404
-
\??\c:\hhhnbh.exec:\hhhnbh.exe147⤵PID:2004
-
\??\c:\dvjvd.exec:\dvjvd.exe148⤵PID:600
-
\??\c:\3pjpd.exec:\3pjpd.exe149⤵PID:708
-
\??\c:\3lxrlff.exec:\3lxrlff.exe150⤵PID:868
-
\??\c:\nhbhbt.exec:\nhbhbt.exe151⤵PID:2420
-
\??\c:\bbnbbn.exec:\bbnbbn.exe152⤵PID:2092
-
\??\c:\dvppv.exec:\dvppv.exe153⤵PID:804
-
\??\c:\lxrrxrr.exec:\lxrrxrr.exe154⤵PID:2976
-
\??\c:\ffflfrl.exec:\ffflfrl.exe155⤵PID:2640
-
\??\c:\tttnbt.exec:\tttnbt.exe156⤵PID:2704
-
\??\c:\3nhhhn.exec:\3nhhhn.exe157⤵PID:2468
-
\??\c:\jpjvj.exec:\jpjvj.exe158⤵PID:2220
-
\??\c:\jjjpj.exec:\jjjpj.exe159⤵PID:1736
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe160⤵PID:2708
-
\??\c:\hbbtnt.exec:\hbbtnt.exe161⤵PID:2916
-
\??\c:\nbhntt.exec:\nbhntt.exe162⤵PID:2520
-
\??\c:\jvjdp.exec:\jvjdp.exe163⤵PID:2944
-
\??\c:\vjppv.exec:\vjppv.exe164⤵PID:1544
-
\??\c:\xxxfrrr.exec:\xxxfrrr.exe165⤵PID:2664
-
\??\c:\hthnbb.exec:\hthnbb.exe166⤵PID:2304
-
\??\c:\lllrxfr.exec:\lllrxfr.exe167⤵PID:2764
-
\??\c:\ntttth.exec:\ntttth.exe168⤵PID:1300
-
\??\c:\bbtbht.exec:\bbtbht.exe169⤵PID:2660
-
\??\c:\dddjd.exec:\dddjd.exe170⤵PID:1352
-
\??\c:\lrxllxf.exec:\lrxllxf.exe171⤵PID:1480
-
\??\c:\fllrlxl.exec:\fllrlxl.exe172⤵PID:2840
-
\??\c:\5hnbhh.exec:\5hnbhh.exe173⤵PID:1980
-
\??\c:\vvjjv.exec:\vvjjv.exe174⤵PID:1316
-
\??\c:\5fxlfrl.exec:\5fxlfrl.exe175⤵PID:948
-
\??\c:\lrxxrxl.exec:\lrxxrxl.exe176⤵PID:2844
-
\??\c:\nbtnbh.exec:\nbtnbh.exe177⤵PID:1952
-
\??\c:\nntthn.exec:\nntthn.exe178⤵PID:3036
-
\??\c:\jpvdv.exec:\jpvdv.exe179⤵PID:2204
-
\??\c:\rrffrrf.exec:\rrffrrf.exe180⤵PID:1644
-
\??\c:\3rlrlrl.exec:\3rlrlrl.exe181⤵PID:1504
-
\??\c:\hthbbh.exec:\hthbbh.exe182⤵PID:1956
-
\??\c:\hhtntn.exec:\hhtntn.exe183⤵PID:1100
-
\??\c:\ddvpv.exec:\ddvpv.exe184⤵PID:940
-
\??\c:\lrffxrx.exec:\lrffxrx.exe185⤵PID:412
-
\??\c:\rrxrlrf.exec:\rrxrlrf.exe186⤵PID:2408
-
\??\c:\hthhtt.exec:\hthhtt.exe187⤵PID:2988
-
\??\c:\vjdpp.exec:\vjdpp.exe188⤵PID:776
-
\??\c:\ppjpp.exec:\ppjpp.exe189⤵PID:1020
-
\??\c:\3rflxrx.exec:\3rflxrx.exe190⤵PID:1760
-
\??\c:\flfrflx.exec:\flfrflx.exe191⤵PID:2276
-
\??\c:\bbthbh.exec:\bbthbh.exe192⤵PID:880
-
\??\c:\djdpd.exec:\djdpd.exe193⤵PID:1572
-
\??\c:\9ppjd.exec:\9ppjd.exe194⤵PID:2348
-
\??\c:\lfflrxx.exec:\lfflrxx.exe195⤵PID:1932
-
\??\c:\nnntnb.exec:\nnntnb.exe196⤵PID:2600
-
\??\c:\tntntb.exec:\tntntb.exe197⤵PID:2088
-
\??\c:\djdvv.exec:\djdvv.exe198⤵PID:3004
-
\??\c:\xrrxrxl.exec:\xrrxrxl.exe199⤵PID:2180
-
\??\c:\rflrfff.exec:\rflrfff.exe200⤵PID:1712
-
\??\c:\1hnntb.exec:\1hnntb.exe201⤵PID:2540
-
\??\c:\3pddv.exec:\3pddv.exe202⤵PID:2492
-
\??\c:\pdvdp.exec:\pdvdp.exe203⤵PID:2588
-
\??\c:\fxlflrx.exec:\fxlflrx.exe204⤵PID:2572
-
\??\c:\nnhnnb.exec:\nnhnnb.exe205⤵PID:1724
-
\??\c:\nntnbb.exec:\nntnbb.exe206⤵PID:2804
-
\??\c:\pdjvj.exec:\pdjvj.exe207⤵PID:1528
-
\??\c:\xxxfxfx.exec:\xxxfxfx.exe208⤵PID:2964
-
\??\c:\5lxfrfx.exec:\5lxfrfx.exe209⤵PID:2940
-
\??\c:\9nthtn.exec:\9nthtn.exe210⤵PID:2244
-
\??\c:\ddpdv.exec:\ddpdv.exe211⤵PID:2808
-
\??\c:\jpppv.exec:\jpppv.exe212⤵PID:2792
-
\??\c:\5xllrxl.exec:\5xllrxl.exe213⤵PID:1428
-
\??\c:\tnhtnt.exec:\tnhtnt.exe214⤵PID:2932
-
\??\c:\nthbht.exec:\nthbht.exe215⤵PID:1412
-
\??\c:\9jdjd.exec:\9jdjd.exe216⤵PID:2904
-
\??\c:\7lflrrf.exec:\7lflrrf.exe217⤵PID:1720
-
\??\c:\9fffxll.exec:\9fffxll.exe218⤵PID:3044
-
\??\c:\bntthh.exec:\bntthh.exe219⤵PID:2164
-
\??\c:\jjvdp.exec:\jjvdp.exe220⤵PID:2008
-
\??\c:\vvppd.exec:\vvppd.exe221⤵PID:2312
-
\??\c:\xrlxrxf.exec:\xrlxrxf.exe222⤵PID:764
-
\??\c:\1bnnnt.exec:\1bnnnt.exe223⤵PID:1296
-
\??\c:\jdjpp.exec:\jdjpp.exe224⤵PID:2912
-
\??\c:\jdjdj.exec:\jdjdj.exe225⤵PID:696
-
\??\c:\5rlllrr.exec:\5rlllrr.exe226⤵PID:1536
-
\??\c:\tnbnnt.exec:\tnbnnt.exe227⤵PID:452
-
\??\c:\tnbbnh.exec:\tnbbnh.exe228⤵PID:1752
-
\??\c:\dvdpj.exec:\dvdpj.exe229⤵PID:904
-
\??\c:\lrfxffr.exec:\lrfxffr.exe230⤵PID:2004
-
\??\c:\frxfxrl.exec:\frxfxrl.exe231⤵PID:600
-
\??\c:\nbtnnh.exec:\nbtnnh.exe232⤵PID:2352
-
\??\c:\vpjjp.exec:\vpjjp.exe233⤵PID:2184
-
\??\c:\dvpvj.exec:\dvpvj.exe234⤵PID:2316
-
\??\c:\frflxrr.exec:\frflxrr.exe235⤵PID:1152
-
\??\c:\xlrlxxl.exec:\xlrlxxl.exe236⤵PID:2068
-
\??\c:\tnnhbt.exec:\tnnhbt.exe237⤵PID:1804
-
\??\c:\pvpvd.exec:\pvpvd.exe238⤵PID:2640
-
\??\c:\jdddp.exec:\jdddp.exe239⤵PID:2704
-
\??\c:\fxlrllx.exec:\fxlrllx.exe240⤵PID:2972
-
\??\c:\rllrrxr.exec:\rllrrxr.exe241⤵PID:2960
-
\??\c:\7hnbth.exec:\7hnbth.exe242⤵PID:1736