Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bcff5a231861628aee1cf2831855a81492fe55f3d60d07a968a55bd3813a3273.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
bcff5a231861628aee1cf2831855a81492fe55f3d60d07a968a55bd3813a3273.exe
-
Size
127KB
-
MD5
4cfc9aa515fdc1353fc2c7f6e29c1d16
-
SHA1
016c7853109cddf49fa4ecf027bbd35805546723
-
SHA256
bcff5a231861628aee1cf2831855a81492fe55f3d60d07a968a55bd3813a3273
-
SHA512
01a4b230a3818441b29fd7c38462f4a6a1373ae20be41ccdd3dfc6bd4d8a51ddd4507f290637dbbf898085aa921ce9e7ec1245c0dd62d27fc7fe0a967d08752a
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afodnmm9Ao98h3dktX4/Jl:n3C9BRW0j/tmm9nwytIL
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2108-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-59-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-78-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1064-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/444-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2108-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1724-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2928-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2336-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2740-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2148-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2548-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3040-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2848-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1668-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2396-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1064-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1940-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1688-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1636-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/444-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/576-233-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1000-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1824-251-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2332-286-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
rrxxflf.exebtbbhn.exepjjvj.exefffrxlf.exehbtbhn.exedvjjv.exe1lffrrf.exefxrrxfl.exe3bnnbb.exe7vddj.exe7lflxfr.exellxflrf.exenhbbnn.exenhtbnb.exepjdjp.exerxrxflx.exe5btbhh.exe3nhhtt.exe7djpv.exelfxfxrx.exe3hthhn.exebbnnhh.exejjdpd.exevpjjd.exellrxflr.exebttbnt.exetnhnbh.exevpppv.exe7llxffr.exe5hntbn.exethtthh.exe3vppv.exelxxfrrl.exefxlrlrx.exebnhnbh.exe3tntbb.exebtbbhh.exejdddv.exejvddj.exefxllflx.exehbnnnt.exe1nhbtt.exejdvpj.exedvjvd.exexrlfxrx.exefxllrrx.exe5nbhhh.exenhnntt.exedpddj.exepjddj.exefxllfxx.exe3flllxf.exe5nnntn.exethtttb.exe5pvvp.exelfxxxxx.exelfrxflr.exe7nnntb.exennhntt.exe9vvdd.exevpddj.exelxllxrr.exexrflrxl.exehhnbnb.exepid process 1724 rrxxflf.exe 2928 btbbhn.exe 2336 pjjvj.exe 2740 fffrxlf.exe 2148 hbtbhn.exe 2688 dvjjv.exe 2548 1lffrrf.exe 2524 fxrrxfl.exe 3040 3bnnbb.exe 1616 7vddj.exe 2848 7lflxfr.exe 2876 llxflrf.exe 1668 nhbbnn.exe 2396 nhtbnb.exe 1064 pjdjp.exe 1940 rxrxflx.exe 2756 5btbhh.exe 816 3nhhtt.exe 1688 7djpv.exe 3032 lfxfxrx.exe 1636 3hthhn.exe 1628 bbnnhh.exe 444 jjdpd.exe 576 vpjjd.exe 1000 llrxflr.exe 1824 bttbnt.exe 1960 tnhnbh.exe 712 vpppv.exe 2472 7llxffr.exe 2332 5hntbn.exe 1504 thtthh.exe 2984 3vppv.exe 2108 lxxfrrl.exe 1604 fxlrlrx.exe 2092 bnhnbh.exe 2324 3tntbb.exe 2696 btbbhh.exe 2944 jdddv.exe 1224 jvddj.exe 2540 fxllflx.exe 2644 hbnnnt.exe 2560 1nhbtt.exe 2516 jdvpj.exe 3044 dvjvd.exe 2200 xrlfxrx.exe 3040 fxllrrx.exe 2392 5nbhhh.exe 2848 nhnntt.exe 352 dpddj.exe 2160 pjddj.exe 1192 fxllfxx.exe 1216 3flllxf.exe 1828 5nnntn.exe 2796 thtttb.exe 1760 5pvvp.exe 1692 lfxxxxx.exe 3048 lfrxflr.exe 2236 7nnntb.exe 1400 nnhntt.exe 1492 9vvdd.exe 332 vpddj.exe 1476 lxllxrr.exe 1468 xrflrxl.exe 576 hhnbnb.exe -
Processes:
resource yara_rule behavioral1/memory/2108-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/444-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-286-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bcff5a231861628aee1cf2831855a81492fe55f3d60d07a968a55bd3813a3273.exerrxxflf.exebtbbhn.exepjjvj.exefffrxlf.exehbtbhn.exedvjjv.exe1lffrrf.exefxrrxfl.exe3bnnbb.exe7vddj.exe7lflxfr.exellxflrf.exenhbbnn.exenhtbnb.exepjdjp.exedescription pid process target process PID 2108 wrote to memory of 1724 2108 bcff5a231861628aee1cf2831855a81492fe55f3d60d07a968a55bd3813a3273.exe rrxxflf.exe PID 2108 wrote to memory of 1724 2108 bcff5a231861628aee1cf2831855a81492fe55f3d60d07a968a55bd3813a3273.exe rrxxflf.exe PID 2108 wrote to memory of 1724 2108 bcff5a231861628aee1cf2831855a81492fe55f3d60d07a968a55bd3813a3273.exe rrxxflf.exe PID 2108 wrote to memory of 1724 2108 bcff5a231861628aee1cf2831855a81492fe55f3d60d07a968a55bd3813a3273.exe rrxxflf.exe PID 1724 wrote to memory of 2928 1724 rrxxflf.exe btbbhn.exe PID 1724 wrote to memory of 2928 1724 rrxxflf.exe btbbhn.exe PID 1724 wrote to memory of 2928 1724 rrxxflf.exe btbbhn.exe PID 1724 wrote to memory of 2928 1724 rrxxflf.exe btbbhn.exe PID 2928 wrote to memory of 2336 2928 btbbhn.exe pjjvj.exe PID 2928 wrote to memory of 2336 2928 btbbhn.exe pjjvj.exe PID 2928 wrote to memory of 2336 2928 btbbhn.exe pjjvj.exe PID 2928 wrote to memory of 2336 2928 btbbhn.exe pjjvj.exe PID 2336 wrote to memory of 2740 2336 pjjvj.exe fffrxlf.exe PID 2336 wrote to memory of 2740 2336 pjjvj.exe fffrxlf.exe PID 2336 wrote to memory of 2740 2336 pjjvj.exe fffrxlf.exe PID 2336 wrote to memory of 2740 2336 pjjvj.exe fffrxlf.exe PID 2740 wrote to memory of 2148 2740 fffrxlf.exe hbtbhn.exe PID 2740 wrote to memory of 2148 2740 fffrxlf.exe hbtbhn.exe PID 2740 wrote to memory of 2148 2740 fffrxlf.exe hbtbhn.exe PID 2740 wrote to memory of 2148 2740 fffrxlf.exe hbtbhn.exe PID 2148 wrote to memory of 2688 2148 hbtbhn.exe dvjjv.exe PID 2148 wrote to memory of 2688 2148 hbtbhn.exe dvjjv.exe PID 2148 wrote to memory of 2688 2148 hbtbhn.exe dvjjv.exe PID 2148 wrote to memory of 2688 2148 hbtbhn.exe dvjjv.exe PID 2688 wrote to memory of 2548 2688 dvjjv.exe 1lffrrf.exe PID 2688 wrote to memory of 2548 2688 dvjjv.exe 1lffrrf.exe PID 2688 wrote to memory of 2548 2688 dvjjv.exe 1lffrrf.exe PID 2688 wrote to memory of 2548 2688 dvjjv.exe 1lffrrf.exe PID 2548 wrote to memory of 2524 2548 1lffrrf.exe fxrrxfl.exe PID 2548 wrote to memory of 2524 2548 1lffrrf.exe fxrrxfl.exe PID 2548 wrote to memory of 2524 2548 1lffrrf.exe fxrrxfl.exe PID 2548 wrote to memory of 2524 2548 1lffrrf.exe fxrrxfl.exe PID 2524 wrote to memory of 3040 2524 fxrrxfl.exe 3bnnbb.exe PID 2524 wrote to memory of 3040 2524 fxrrxfl.exe 3bnnbb.exe PID 2524 wrote to memory of 3040 2524 fxrrxfl.exe 3bnnbb.exe PID 2524 wrote to memory of 3040 2524 fxrrxfl.exe 3bnnbb.exe PID 3040 wrote to memory of 1616 3040 3bnnbb.exe 7vddj.exe PID 3040 wrote to memory of 1616 3040 3bnnbb.exe 7vddj.exe PID 3040 wrote to memory of 1616 3040 3bnnbb.exe 7vddj.exe PID 3040 wrote to memory of 1616 3040 3bnnbb.exe 7vddj.exe PID 1616 wrote to memory of 2848 1616 7vddj.exe 7lflxfr.exe PID 1616 wrote to memory of 2848 1616 7vddj.exe 7lflxfr.exe PID 1616 wrote to memory of 2848 1616 7vddj.exe 7lflxfr.exe PID 1616 wrote to memory of 2848 1616 7vddj.exe 7lflxfr.exe PID 2848 wrote to memory of 2876 2848 7lflxfr.exe llxflrf.exe PID 2848 wrote to memory of 2876 2848 7lflxfr.exe llxflrf.exe PID 2848 wrote to memory of 2876 2848 7lflxfr.exe llxflrf.exe PID 2848 wrote to memory of 2876 2848 7lflxfr.exe llxflrf.exe PID 2876 wrote to memory of 1668 2876 llxflrf.exe nhbbnn.exe PID 2876 wrote to memory of 1668 2876 llxflrf.exe nhbbnn.exe PID 2876 wrote to memory of 1668 2876 llxflrf.exe nhbbnn.exe PID 2876 wrote to memory of 1668 2876 llxflrf.exe nhbbnn.exe PID 1668 wrote to memory of 2396 1668 nhbbnn.exe nhtbnb.exe PID 1668 wrote to memory of 2396 1668 nhbbnn.exe nhtbnb.exe PID 1668 wrote to memory of 2396 1668 nhbbnn.exe nhtbnb.exe PID 1668 wrote to memory of 2396 1668 nhbbnn.exe nhtbnb.exe PID 2396 wrote to memory of 1064 2396 nhtbnb.exe pjdjp.exe PID 2396 wrote to memory of 1064 2396 nhtbnb.exe pjdjp.exe PID 2396 wrote to memory of 1064 2396 nhtbnb.exe pjdjp.exe PID 2396 wrote to memory of 1064 2396 nhtbnb.exe pjdjp.exe PID 1064 wrote to memory of 1940 1064 pjdjp.exe rxrxflx.exe PID 1064 wrote to memory of 1940 1064 pjdjp.exe rxrxflx.exe PID 1064 wrote to memory of 1940 1064 pjdjp.exe rxrxflx.exe PID 1064 wrote to memory of 1940 1064 pjdjp.exe rxrxflx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcff5a231861628aee1cf2831855a81492fe55f3d60d07a968a55bd3813a3273.exe"C:\Users\Admin\AppData\Local\Temp\bcff5a231861628aee1cf2831855a81492fe55f3d60d07a968a55bd3813a3273.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\rrxxflf.exec:\rrxxflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\btbbhn.exec:\btbbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\pjjvj.exec:\pjjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\fffrxlf.exec:\fffrxlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\hbtbhn.exec:\hbtbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\dvjjv.exec:\dvjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\1lffrrf.exec:\1lffrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\3bnnbb.exec:\3bnnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\7vddj.exec:\7vddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\7lflxfr.exec:\7lflxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\llxflrf.exec:\llxflrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\nhbbnn.exec:\nhbbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\nhtbnb.exec:\nhtbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\pjdjp.exec:\pjdjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\rxrxflx.exec:\rxrxflx.exe17⤵
- Executes dropped EXE
PID:1940 -
\??\c:\5btbhh.exec:\5btbhh.exe18⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3nhhtt.exec:\3nhhtt.exe19⤵
- Executes dropped EXE
PID:816 -
\??\c:\7djpv.exec:\7djpv.exe20⤵
- Executes dropped EXE
PID:1688 -
\??\c:\lfxfxrx.exec:\lfxfxrx.exe21⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3hthhn.exec:\3hthhn.exe22⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bbnnhh.exec:\bbnnhh.exe23⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jjdpd.exec:\jjdpd.exe24⤵
- Executes dropped EXE
PID:444 -
\??\c:\vpjjd.exec:\vpjjd.exe25⤵
- Executes dropped EXE
PID:576 -
\??\c:\llrxflr.exec:\llrxflr.exe26⤵
- Executes dropped EXE
PID:1000 -
\??\c:\bttbnt.exec:\bttbnt.exe27⤵
- Executes dropped EXE
PID:1824 -
\??\c:\tnhnbh.exec:\tnhnbh.exe28⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vpppv.exec:\vpppv.exe29⤵
- Executes dropped EXE
PID:712 -
\??\c:\7llxffr.exec:\7llxffr.exe30⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5hntbn.exec:\5hntbn.exe31⤵
- Executes dropped EXE
PID:2332 -
\??\c:\thtthh.exec:\thtthh.exe32⤵
- Executes dropped EXE
PID:1504 -
\??\c:\3vppv.exec:\3vppv.exe33⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lxxfrrl.exec:\lxxfrrl.exe34⤵
- Executes dropped EXE
PID:2108 -
\??\c:\fxlrlrx.exec:\fxlrlrx.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bnhnbh.exec:\bnhnbh.exe36⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3tntbb.exec:\3tntbb.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\btbbhh.exec:\btbbhh.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jdddv.exec:\jdddv.exe39⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jvddj.exec:\jvddj.exe40⤵
- Executes dropped EXE
PID:1224 -
\??\c:\fxllflx.exec:\fxllflx.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hbnnnt.exec:\hbnnnt.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1nhbtt.exec:\1nhbtt.exe43⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jdvpj.exec:\jdvpj.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\dvjvd.exec:\dvjvd.exe45⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xrlfxrx.exec:\xrlfxrx.exe46⤵
- Executes dropped EXE
PID:2200 -
\??\c:\fxllrrx.exec:\fxllrrx.exe47⤵
- Executes dropped EXE
PID:3040 -
\??\c:\5nbhhh.exec:\5nbhhh.exe48⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nhnntt.exec:\nhnntt.exe49⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dpddj.exec:\dpddj.exe50⤵
- Executes dropped EXE
PID:352 -
\??\c:\pjddj.exec:\pjddj.exe51⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fxllfxx.exec:\fxllfxx.exe52⤵
- Executes dropped EXE
PID:1192 -
\??\c:\3flllxf.exec:\3flllxf.exe53⤵
- Executes dropped EXE
PID:1216 -
\??\c:\5nnntn.exec:\5nnntn.exe54⤵
- Executes dropped EXE
PID:1828 -
\??\c:\thtttb.exec:\thtttb.exe55⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5pvvp.exec:\5pvvp.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lfxxxxx.exec:\lfxxxxx.exe57⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lfrxflr.exec:\lfrxflr.exe58⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7nnntb.exec:\7nnntb.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nnhntt.exec:\nnhntt.exe60⤵
- Executes dropped EXE
PID:1400 -
\??\c:\9vvdd.exec:\9vvdd.exe61⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vpddj.exec:\vpddj.exe62⤵
- Executes dropped EXE
PID:332 -
\??\c:\lxllxrr.exec:\lxllxrr.exe63⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xrflrxl.exec:\xrflrxl.exe64⤵
- Executes dropped EXE
PID:1468 -
\??\c:\hhnbnb.exec:\hhnbnb.exe65⤵
- Executes dropped EXE
PID:576 -
\??\c:\bnbhtb.exec:\bnbhtb.exe66⤵PID:1680
-
\??\c:\jvjpd.exec:\jvjpd.exe67⤵PID:1620
-
\??\c:\7dvdp.exec:\7dvdp.exe68⤵PID:912
-
\??\c:\5xrlrfr.exec:\5xrlrfr.exe69⤵PID:2980
-
\??\c:\fxllrxf.exec:\fxllrxf.exe70⤵PID:2288
-
\??\c:\5nntbh.exec:\5nntbh.exe71⤵PID:2376
-
\??\c:\nbbhhn.exec:\nbbhhn.exe72⤵PID:1936
-
\??\c:\vpjpd.exec:\vpjpd.exe73⤵PID:2164
-
\??\c:\vvpvd.exec:\vvpvd.exe74⤵PID:880
-
\??\c:\xrflrxx.exec:\xrflrxx.exe75⤵PID:2340
-
\??\c:\9fffllx.exec:\9fffllx.exe76⤵PID:2108
-
\??\c:\hbntbh.exec:\hbntbh.exe77⤵PID:1604
-
\??\c:\3tnthh.exec:\3tnthh.exe78⤵PID:3016
-
\??\c:\ppvvd.exec:\ppvvd.exe79⤵PID:2140
-
\??\c:\dpppj.exec:\dpppj.exe80⤵PID:2696
-
\??\c:\fxllxfr.exec:\fxllxfr.exe81⤵PID:2740
-
\??\c:\fxrflrx.exec:\fxrflrx.exe82⤵PID:2776
-
\??\c:\nntnnn.exec:\nntnnn.exe83⤵PID:2748
-
\??\c:\nnhttb.exec:\nnhttb.exe84⤵PID:2644
-
\??\c:\vjvdp.exec:\vjvdp.exe85⤵PID:1908
-
\??\c:\pdpvd.exec:\pdpvd.exe86⤵PID:2552
-
\??\c:\dpdvv.exec:\dpdvv.exe87⤵PID:3036
-
\??\c:\xrllffl.exec:\xrllffl.exe88⤵PID:3060
-
\??\c:\bbhhhn.exec:\bbhhhn.exe89⤵PID:2832
-
\??\c:\5hbhhn.exec:\5hbhhn.exe90⤵PID:2908
-
\??\c:\1dvdp.exec:\1dvdp.exe91⤵PID:2860
-
\??\c:\jdddp.exec:\jdddp.exe92⤵PID:352
-
\??\c:\fxrlrxf.exec:\fxrlrxf.exe93⤵PID:760
-
\??\c:\1lrrxrf.exec:\1lrrxrf.exe94⤵PID:1192
-
\??\c:\tnbbnt.exec:\tnbbnt.exe95⤵PID:1064
-
\??\c:\nnbbhn.exec:\nnbbhn.exe96⤵PID:2824
-
\??\c:\pjpdv.exec:\pjpdv.exe97⤵PID:752
-
\??\c:\vjvpp.exec:\vjvpp.exe98⤵PID:1760
-
\??\c:\xlllrrf.exec:\xlllrrf.exe99⤵PID:1652
-
\??\c:\xrlxfff.exec:\xrlxfff.exe100⤵PID:3048
-
\??\c:\httbhn.exec:\httbhn.exe101⤵PID:2960
-
\??\c:\3nthtn.exec:\3nthtn.exe102⤵PID:2068
-
\??\c:\dvvdd.exec:\dvvdd.exe103⤵PID:600
-
\??\c:\9vppd.exec:\9vppd.exe104⤵PID:332
-
\??\c:\llrrxfl.exec:\llrrxfl.exe105⤵PID:1484
-
\??\c:\thbbnt.exec:\thbbnt.exe106⤵PID:1468
-
\??\c:\bhbnnh.exec:\bhbnnh.exe107⤵PID:3028
-
\??\c:\dpdjv.exec:\dpdjv.exe108⤵PID:1680
-
\??\c:\jdpvd.exec:\jdpvd.exe109⤵PID:2864
-
\??\c:\xrrxflr.exec:\xrrxflr.exe110⤵PID:912
-
\??\c:\lxfrxlr.exec:\lxfrxlr.exe111⤵PID:648
-
\??\c:\tnttbb.exec:\tnttbb.exe112⤵PID:2288
-
\??\c:\3jvpp.exec:\3jvpp.exe113⤵PID:1740
-
\??\c:\jjvvj.exec:\jjvvj.exe114⤵PID:1936
-
\??\c:\3xxlxlx.exec:\3xxlxlx.exe115⤵PID:2408
-
\??\c:\fxxflrx.exec:\fxxflrx.exe116⤵PID:880
-
\??\c:\btnhtt.exec:\btnhtt.exe117⤵PID:2984
-
\??\c:\dpvvd.exec:\dpvvd.exe118⤵PID:2480
-
\??\c:\5pjjj.exec:\5pjjj.exe119⤵PID:2248
-
\??\c:\lfrrffr.exec:\lfrrffr.exe120⤵PID:2732
-
\??\c:\rrlrffr.exec:\rrlrffr.exe121⤵PID:2664
-
\??\c:\nnbnbh.exec:\nnbnbh.exe122⤵PID:2696
-
\??\c:\5pjvd.exec:\5pjvd.exe123⤵PID:2532
-
\??\c:\dvddp.exec:\dvddp.exe124⤵PID:2776
-
\??\c:\3rrrrrf.exec:\3rrrrrf.exe125⤵PID:2504
-
\??\c:\lrxxlrf.exec:\lrxxlrf.exe126⤵PID:2676
-
\??\c:\htbhhh.exec:\htbhhh.exe127⤵PID:2560
-
\??\c:\hhthnn.exec:\hhthnn.exe128⤵PID:2804
-
\??\c:\pdjpd.exec:\pdjpd.exe129⤵PID:3044
-
\??\c:\lflfllx.exec:\lflfllx.exe130⤵PID:2200
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe131⤵PID:3040
-
\??\c:\tthhnn.exec:\tthhnn.exe132⤵PID:2916
-
\??\c:\nbhhhn.exec:\nbhhhn.exe133⤵PID:2848
-
\??\c:\pdjjv.exec:\pdjjv.exe134⤵PID:352
-
\??\c:\7fxxxrx.exec:\7fxxxrx.exe135⤵PID:1440
-
\??\c:\llxxrrf.exec:\llxxrrf.exe136⤵PID:1192
-
\??\c:\nhnbhh.exec:\nhnbhh.exe137⤵PID:3000
-
\??\c:\7jddp.exec:\7jddp.exe138⤵PID:2824
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe139⤵PID:1044
-
\??\c:\1lxrrxf.exec:\1lxrrxf.exe140⤵PID:2544
-
\??\c:\nbnhhb.exec:\nbnhhb.exe141⤵PID:1720
-
\??\c:\1pvvd.exec:\1pvvd.exe142⤵PID:3048
-
\??\c:\7pjpp.exec:\7pjpp.exe143⤵PID:2880
-
\??\c:\xrllxrf.exec:\xrllxrf.exe144⤵PID:2068
-
\??\c:\xrlxfxf.exec:\xrlxfxf.exe145⤵PID:600
-
\??\c:\nhbhbb.exec:\nhbhbb.exe146⤵PID:1028
-
\??\c:\5pjjv.exec:\5pjjv.exe147⤵PID:1864
-
\??\c:\5jddv.exec:\5jddv.exe148⤵PID:1976
-
\??\c:\dvpvd.exec:\dvpvd.exe149⤵PID:576
-
\??\c:\ffxxllr.exec:\ffxxllr.exe150⤵PID:1680
-
\??\c:\bththh.exec:\bththh.exe151⤵PID:2864
-
\??\c:\hbhnbh.exec:\hbhnbh.exe152⤵PID:324
-
\??\c:\jddvd.exec:\jddvd.exe153⤵PID:648
-
\??\c:\pjddp.exec:\pjddp.exe154⤵PID:1924
-
\??\c:\xxxlfxr.exec:\xxxlfxr.exe155⤵PID:2376
-
\??\c:\bnbhnt.exec:\bnbhnt.exe156⤵PID:2792
-
\??\c:\btbbnn.exec:\btbbnn.exe157⤵PID:2408
-
\??\c:\nhtbtt.exec:\nhtbtt.exe158⤵PID:1600
-
\??\c:\jddpd.exec:\jddpd.exe159⤵PID:2984
-
\??\c:\lxffrrl.exec:\lxffrrl.exe160⤵PID:2480
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe161⤵PID:2248
-
\??\c:\tnbbbh.exec:\tnbbbh.exe162⤵PID:2140
-
\??\c:\3nbbbb.exec:\3nbbbb.exe163⤵PID:2664
-
\??\c:\5nhhnh.exec:\5nhhnh.exe164⤵PID:2148
-
\??\c:\jdvdj.exec:\jdvdj.exe165⤵PID:2532
-
\??\c:\vvddj.exec:\vvddj.exe166⤵PID:2748
-
\??\c:\xrllrrf.exec:\xrllrrf.exe167⤵PID:2504
-
\??\c:\nnhbnt.exec:\nnhbnt.exe168⤵PID:2284
-
\??\c:\bnhbhb.exec:\bnhbhb.exe169⤵PID:2560
-
\??\c:\jvppv.exec:\jvppv.exe170⤵PID:2804
-
\??\c:\7ddpd.exec:\7ddpd.exe171⤵PID:3044
-
\??\c:\llfflrx.exec:\llfflrx.exe172⤵PID:3060
-
\??\c:\7xxxlfl.exec:\7xxxlfl.exe173⤵PID:3040
-
\??\c:\btbbnn.exec:\btbbnn.exe174⤵PID:2244
-
\??\c:\tthhnt.exec:\tthhnt.exe175⤵PID:1876
-
\??\c:\vpddp.exec:\vpddp.exe176⤵PID:1972
-
\??\c:\dvppp.exec:\dvppp.exe177⤵PID:1440
-
\??\c:\9llrrxr.exec:\9llrrxr.exe178⤵PID:316
-
\??\c:\tnhhtb.exec:\tnhhtb.exe179⤵PID:3000
-
\??\c:\tthtbb.exec:\tthtbb.exe180⤵PID:816
-
\??\c:\ppdpv.exec:\ppdpv.exe181⤵PID:1044
-
\??\c:\pjvpd.exec:\pjvpd.exe182⤵PID:2544
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe183⤵PID:1720
-
\??\c:\fxrrllf.exec:\fxrrllf.exe184⤵PID:264
-
\??\c:\nhbbbh.exec:\nhbbbh.exe185⤵PID:2880
-
\??\c:\bbnthn.exec:\bbnthn.exe186⤵PID:1084
-
\??\c:\dvjjv.exec:\dvjjv.exe187⤵PID:600
-
\??\c:\ddvvj.exec:\ddvvj.exe188⤵PID:628
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe189⤵PID:1208
-
\??\c:\7rrrxxf.exec:\7rrrxxf.exe190⤵PID:1928
-
\??\c:\hbhhnt.exec:\hbhhnt.exe191⤵PID:3028
-
\??\c:\thtbbh.exec:\thtbbh.exe192⤵PID:2436
-
\??\c:\jjpvd.exec:\jjpvd.exe193⤵PID:2188
-
\??\c:\rrflrlx.exec:\rrflrlx.exe194⤵PID:1776
-
\??\c:\frffllx.exec:\frffllx.exe195⤵PID:648
-
\??\c:\tnnbnn.exec:\tnnbnn.exe196⤵PID:3064
-
\??\c:\9pppd.exec:\9pppd.exe197⤵PID:1740
-
\??\c:\ppjpj.exec:\ppjpj.exe198⤵PID:1608
-
\??\c:\rfrlflx.exec:\rfrlflx.exe199⤵PID:1572
-
\??\c:\lxllxfl.exec:\lxllxfl.exe200⤵PID:2616
-
\??\c:\1nnbtb.exec:\1nnbtb.exe201⤵PID:2704
-
\??\c:\tnhntb.exec:\tnhntb.exe202⤵PID:2728
-
\??\c:\dvjvd.exec:\dvjvd.exe203⤵PID:2248
-
\??\c:\vpjjp.exec:\vpjjp.exe204⤵PID:2080
-
\??\c:\7xllrxr.exec:\7xllrxr.exe205⤵PID:3012
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe206⤵PID:2872
-
\??\c:\tnbhnn.exec:\tnbhnn.exe207⤵PID:2556
-
\??\c:\hbbhnb.exec:\hbbhnb.exe208⤵PID:2644
-
\??\c:\jjjjd.exec:\jjjjd.exe209⤵PID:1404
-
\??\c:\vjpvp.exec:\vjpvp.exe210⤵PID:2552
-
\??\c:\frfxlrf.exec:\frfxlrf.exe211⤵PID:2684
-
\??\c:\rlxxffr.exec:\rlxxffr.exe212⤵PID:2812
-
\??\c:\tnhhtt.exec:\tnhhtt.exe213⤵PID:3020
-
\??\c:\hhttbh.exec:\hhttbh.exe214⤵PID:3060
-
\??\c:\1pjdp.exec:\1pjdp.exe215⤵PID:1340
-
\??\c:\vdjvv.exec:\vdjvv.exe216⤵PID:2168
-
\??\c:\ffrxffx.exec:\ffrxffx.exe217⤵PID:1996
-
\??\c:\rlxxfrf.exec:\rlxxfrf.exe218⤵PID:1912
-
\??\c:\hbhbnb.exec:\hbhbnb.exe219⤵PID:876
-
\??\c:\7bhhnb.exec:\7bhhnb.exe220⤵PID:2756
-
\??\c:\dvjjp.exec:\dvjjp.exe221⤵PID:2856
-
\??\c:\pppdd.exec:\pppdd.exe222⤵PID:2076
-
\??\c:\7lrrfll.exec:\7lrrfll.exe223⤵PID:1728
-
\??\c:\9fxxfrf.exec:\9fxxfrf.exe224⤵PID:2968
-
\??\c:\ttnthb.exec:\ttnthb.exe225⤵PID:536
-
\??\c:\bthnbb.exec:\bthnbb.exe226⤵PID:1160
-
\??\c:\9vdpd.exec:\9vdpd.exe227⤵PID:1860
-
\??\c:\vpddj.exec:\vpddj.exe228⤵PID:1700
-
\??\c:\rlxxfff.exec:\rlxxfff.exe229⤵PID:1800
-
\??\c:\1lxfllr.exec:\1lxfllr.exe230⤵PID:1864
-
\??\c:\nnhthh.exec:\nnhthh.exe231⤵PID:896
-
\??\c:\hhbbtt.exec:\hhbbtt.exe232⤵PID:1836
-
\??\c:\jdvdj.exec:\jdvdj.exe233⤵PID:1512
-
\??\c:\dvjdj.exec:\dvjdj.exe234⤵PID:2360
-
\??\c:\3lxflrf.exec:\3lxflrf.exe235⤵PID:1352
-
\??\c:\rlflrlx.exec:\rlflrlx.exe236⤵PID:2384
-
\??\c:\tnhnhn.exec:\tnhnhn.exe237⤵PID:2176
-
\??\c:\thbhth.exec:\thbhth.exe238⤵PID:1576
-
\??\c:\dvpjp.exec:\dvpjp.exe239⤵PID:2788
-
\??\c:\jjdvj.exec:\jjdvj.exe240⤵PID:2152
-
\??\c:\rrffffr.exec:\rrffffr.exe241⤵PID:1804
-
\??\c:\fxllrxf.exec:\fxllrxf.exe242⤵PID:2928