Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cbf3c8473c0750fa44fe095059509bb6fc1965dd5ecb5ec24b559869578dc955.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
cbf3c8473c0750fa44fe095059509bb6fc1965dd5ecb5ec24b559869578dc955.exe
-
Size
99KB
-
MD5
e50c2ae097fd2a808fbc3a0d559b2020
-
SHA1
d4a12df09db7465bf810e0954395e7b05142da16
-
SHA256
cbf3c8473c0750fa44fe095059509bb6fc1965dd5ecb5ec24b559869578dc955
-
SHA512
6bc0c6ed817a28d927c834dcaaaa327059d3830d312c475aa0d31ca44d2856bc6e2944a4485277352613f5f117c439ce3bfb88b9a7e4a1e0bdde37570ebcabbc
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHq/4wcD:n3C9BRo7tvnJ99T/KZE/8
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 30 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1048-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1048-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2372-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1048-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2636-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2636-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2636-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2588-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2496-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1716-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2992-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2020-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2332-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1756-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2936-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1396-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1288-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2304-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2212-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2884-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/556-222-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/836-239-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1960-248-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/916-266-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2080-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
pjppj.exe5thbhn.exedvjjv.exelxlrxxf.exehhbnbh.exe9bnnbb.exejpjvj.exe7rrxxxl.exerfxlffx.exenhhthh.exe1pdvd.exe5rlffrx.exelxffrlr.exe5nhhnn.exepjvpv.exefflrflx.exexlrrrrf.exehhntnb.exeppvdj.exevpvvd.exelrxxrlx.exenbbnhh.exejjjjd.exefxxxxrr.exerffllxf.exe7tbnbn.exejpdpv.exedvddj.exelllxxxr.exehtbbbt.exethntbh.exedpppj.exevpdvj.exe7rlrrrr.exelxxxrrf.exe3nbntb.exenhhbbb.exedpvdp.exepdjdd.exe7fxflll.exe3lxrrrf.exethhnhb.exe5hnbtn.exe1pvvd.exexlrxffl.exe5fxflff.exe9ntttt.exehbbbnn.exejdjpv.exejjjdd.exelfxfrxf.exexfxrfrx.exentthnn.exeppjvd.exejppdd.exerlxxlll.exenthhhh.exe9nhhhh.exevjpvp.exedvvdd.exe9rxlfff.exexrxxxff.exenhtbtn.exenbhhhh.exepid process 1048 pjppj.exe 2856 5thbhn.exe 2636 dvjjv.exe 2588 lxlrxxf.exe 2864 hhbnbh.exe 2464 9bnnbb.exe 2496 jpjvj.exe 2516 7rrxxxl.exe 1716 rfxlffx.exe 2992 nhhthh.exe 1976 1pdvd.exe 2020 5rlffrx.exe 2332 lxffrlr.exe 1756 5nhhnn.exe 2628 pjvpv.exe 2936 fflrflx.exe 1396 xlrrrrf.exe 1288 hhntnb.exe 2304 ppvdj.exe 2212 vpvvd.exe 2884 lrxxrlx.exe 556 nbbnhh.exe 644 jjjjd.exe 836 fxxxxrr.exe 1960 rffllxf.exe 380 7tbnbn.exe 916 jpdpv.exe 2008 dvddj.exe 792 lllxxxr.exe 2080 htbbbt.exe 1932 thntbh.exe 1008 dpppj.exe 1712 vpdvj.exe 1696 7rlrrrr.exe 1256 lxxxrrf.exe 1708 3nbntb.exe 2672 nhhbbb.exe 2880 dpvdp.exe 2684 pdjdd.exe 2848 7fxflll.exe 2792 3lxrrrf.exe 1948 thhnhb.exe 2968 5hnbtn.exe 1940 1pvvd.exe 2728 xlrxffl.exe 2952 5fxflff.exe 2248 9ntttt.exe 1996 hbbbnn.exe 1444 jdjpv.exe 2508 jjjdd.exe 2764 lfxfrxf.exe 2716 xfxrfrx.exe 2984 ntthnn.exe 1392 ppjvd.exe 1724 jppdd.exe 1736 rlxxlll.exe 2040 nthhhh.exe 2308 9nhhhh.exe 2212 vjpvp.exe 2884 dvvdd.exe 1028 9rxlfff.exe 1648 xrxxxff.exe 2252 nhtbtn.exe 964 nbhhhh.exe -
Processes:
resource yara_rule behavioral1/memory/2372-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-293-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cbf3c8473c0750fa44fe095059509bb6fc1965dd5ecb5ec24b559869578dc955.exepjppj.exe5thbhn.exedvjjv.exelxlrxxf.exehhbnbh.exe9bnnbb.exejpjvj.exe7rrxxxl.exerfxlffx.exenhhthh.exe1pdvd.exe5rlffrx.exelxffrlr.exe5nhhnn.exepjvpv.exedescription pid process target process PID 2372 wrote to memory of 1048 2372 cbf3c8473c0750fa44fe095059509bb6fc1965dd5ecb5ec24b559869578dc955.exe pjppj.exe PID 2372 wrote to memory of 1048 2372 cbf3c8473c0750fa44fe095059509bb6fc1965dd5ecb5ec24b559869578dc955.exe pjppj.exe PID 2372 wrote to memory of 1048 2372 cbf3c8473c0750fa44fe095059509bb6fc1965dd5ecb5ec24b559869578dc955.exe pjppj.exe PID 2372 wrote to memory of 1048 2372 cbf3c8473c0750fa44fe095059509bb6fc1965dd5ecb5ec24b559869578dc955.exe pjppj.exe PID 1048 wrote to memory of 2856 1048 pjppj.exe 5thbhn.exe PID 1048 wrote to memory of 2856 1048 pjppj.exe 5thbhn.exe PID 1048 wrote to memory of 2856 1048 pjppj.exe 5thbhn.exe PID 1048 wrote to memory of 2856 1048 pjppj.exe 5thbhn.exe PID 2856 wrote to memory of 2636 2856 5thbhn.exe dvjjv.exe PID 2856 wrote to memory of 2636 2856 5thbhn.exe dvjjv.exe PID 2856 wrote to memory of 2636 2856 5thbhn.exe dvjjv.exe PID 2856 wrote to memory of 2636 2856 5thbhn.exe dvjjv.exe PID 2636 wrote to memory of 2588 2636 dvjjv.exe lxlrxxf.exe PID 2636 wrote to memory of 2588 2636 dvjjv.exe lxlrxxf.exe PID 2636 wrote to memory of 2588 2636 dvjjv.exe lxlrxxf.exe PID 2636 wrote to memory of 2588 2636 dvjjv.exe lxlrxxf.exe PID 2588 wrote to memory of 2864 2588 lxlrxxf.exe hhbnbh.exe PID 2588 wrote to memory of 2864 2588 lxlrxxf.exe hhbnbh.exe PID 2588 wrote to memory of 2864 2588 lxlrxxf.exe hhbnbh.exe PID 2588 wrote to memory of 2864 2588 lxlrxxf.exe hhbnbh.exe PID 2864 wrote to memory of 2464 2864 hhbnbh.exe 9bnnbb.exe PID 2864 wrote to memory of 2464 2864 hhbnbh.exe 9bnnbb.exe PID 2864 wrote to memory of 2464 2864 hhbnbh.exe 9bnnbb.exe PID 2864 wrote to memory of 2464 2864 hhbnbh.exe 9bnnbb.exe PID 2464 wrote to memory of 2496 2464 9bnnbb.exe jpjvj.exe PID 2464 wrote to memory of 2496 2464 9bnnbb.exe jpjvj.exe PID 2464 wrote to memory of 2496 2464 9bnnbb.exe jpjvj.exe PID 2464 wrote to memory of 2496 2464 9bnnbb.exe jpjvj.exe PID 2496 wrote to memory of 2516 2496 jpjvj.exe 7rrxxxl.exe PID 2496 wrote to memory of 2516 2496 jpjvj.exe 7rrxxxl.exe PID 2496 wrote to memory of 2516 2496 jpjvj.exe 7rrxxxl.exe PID 2496 wrote to memory of 2516 2496 jpjvj.exe 7rrxxxl.exe PID 2516 wrote to memory of 1716 2516 7rrxxxl.exe rfxlffx.exe PID 2516 wrote to memory of 1716 2516 7rrxxxl.exe rfxlffx.exe PID 2516 wrote to memory of 1716 2516 7rrxxxl.exe rfxlffx.exe PID 2516 wrote to memory of 1716 2516 7rrxxxl.exe rfxlffx.exe PID 1716 wrote to memory of 2992 1716 rfxlffx.exe nhhthh.exe PID 1716 wrote to memory of 2992 1716 rfxlffx.exe nhhthh.exe PID 1716 wrote to memory of 2992 1716 rfxlffx.exe nhhthh.exe PID 1716 wrote to memory of 2992 1716 rfxlffx.exe nhhthh.exe PID 2992 wrote to memory of 1976 2992 nhhthh.exe 1pdvd.exe PID 2992 wrote to memory of 1976 2992 nhhthh.exe 1pdvd.exe PID 2992 wrote to memory of 1976 2992 nhhthh.exe 1pdvd.exe PID 2992 wrote to memory of 1976 2992 nhhthh.exe 1pdvd.exe PID 1976 wrote to memory of 2020 1976 1pdvd.exe 5rlffrx.exe PID 1976 wrote to memory of 2020 1976 1pdvd.exe 5rlffrx.exe PID 1976 wrote to memory of 2020 1976 1pdvd.exe 5rlffrx.exe PID 1976 wrote to memory of 2020 1976 1pdvd.exe 5rlffrx.exe PID 2020 wrote to memory of 2332 2020 5rlffrx.exe lxffrlr.exe PID 2020 wrote to memory of 2332 2020 5rlffrx.exe lxffrlr.exe PID 2020 wrote to memory of 2332 2020 5rlffrx.exe lxffrlr.exe PID 2020 wrote to memory of 2332 2020 5rlffrx.exe lxffrlr.exe PID 2332 wrote to memory of 1756 2332 lxffrlr.exe 5nhhnn.exe PID 2332 wrote to memory of 1756 2332 lxffrlr.exe 5nhhnn.exe PID 2332 wrote to memory of 1756 2332 lxffrlr.exe 5nhhnn.exe PID 2332 wrote to memory of 1756 2332 lxffrlr.exe 5nhhnn.exe PID 1756 wrote to memory of 2628 1756 5nhhnn.exe pjvpv.exe PID 1756 wrote to memory of 2628 1756 5nhhnn.exe pjvpv.exe PID 1756 wrote to memory of 2628 1756 5nhhnn.exe pjvpv.exe PID 1756 wrote to memory of 2628 1756 5nhhnn.exe pjvpv.exe PID 2628 wrote to memory of 2936 2628 pjvpv.exe fflrflx.exe PID 2628 wrote to memory of 2936 2628 pjvpv.exe fflrflx.exe PID 2628 wrote to memory of 2936 2628 pjvpv.exe fflrflx.exe PID 2628 wrote to memory of 2936 2628 pjvpv.exe fflrflx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbf3c8473c0750fa44fe095059509bb6fc1965dd5ecb5ec24b559869578dc955.exe"C:\Users\Admin\AppData\Local\Temp\cbf3c8473c0750fa44fe095059509bb6fc1965dd5ecb5ec24b559869578dc955.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\pjppj.exec:\pjppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\5thbhn.exec:\5thbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\dvjjv.exec:\dvjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hhbnbh.exec:\hhbnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\9bnnbb.exec:\9bnnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\jpjvj.exec:\jpjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\7rrxxxl.exec:\7rrxxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\rfxlffx.exec:\rfxlffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\nhhthh.exec:\nhhthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\1pdvd.exec:\1pdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\5rlffrx.exec:\5rlffrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\lxffrlr.exec:\lxffrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\5nhhnn.exec:\5nhhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\pjvpv.exec:\pjvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\fflrflx.exec:\fflrflx.exe17⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xlrrrrf.exec:\xlrrrrf.exe18⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hhntnb.exec:\hhntnb.exe19⤵
- Executes dropped EXE
PID:1288 -
\??\c:\ppvdj.exec:\ppvdj.exe20⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vpvvd.exec:\vpvvd.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lrxxrlx.exec:\lrxxrlx.exe22⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nbbnhh.exec:\nbbnhh.exe23⤵
- Executes dropped EXE
PID:556 -
\??\c:\jjjjd.exec:\jjjjd.exe24⤵
- Executes dropped EXE
PID:644 -
\??\c:\fxxxxrr.exec:\fxxxxrr.exe25⤵
- Executes dropped EXE
PID:836 -
\??\c:\rffllxf.exec:\rffllxf.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\7tbnbn.exec:\7tbnbn.exe27⤵
- Executes dropped EXE
PID:380 -
\??\c:\jpdpv.exec:\jpdpv.exe28⤵
- Executes dropped EXE
PID:916 -
\??\c:\dvddj.exec:\dvddj.exe29⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lllxxxr.exec:\lllxxxr.exe30⤵
- Executes dropped EXE
PID:792 -
\??\c:\htbbbt.exec:\htbbbt.exe31⤵
- Executes dropped EXE
PID:2080 -
\??\c:\thntbh.exec:\thntbh.exe32⤵
- Executes dropped EXE
PID:1932 -
\??\c:\dpppj.exec:\dpppj.exe33⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vpdvj.exec:\vpdvj.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7rlrrrr.exec:\7rlrrrr.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lxxxrrf.exec:\lxxxrrf.exe36⤵
- Executes dropped EXE
PID:1256 -
\??\c:\3nbntb.exec:\3nbntb.exe37⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nhhbbb.exec:\nhhbbb.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dpvdp.exec:\dpvdp.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pdjdd.exec:\pdjdd.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\7fxflll.exec:\7fxflll.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3lxrrrf.exec:\3lxrrrf.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\thhnhb.exec:\thhnhb.exe43⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5hnbtn.exec:\5hnbtn.exe44⤵
- Executes dropped EXE
PID:2968 -
\??\c:\1pvvd.exec:\1pvvd.exe45⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xlrxffl.exec:\xlrxffl.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5fxflff.exec:\5fxflff.exe47⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9ntttt.exec:\9ntttt.exe48⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hbbbnn.exec:\hbbbnn.exe49⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jdjpv.exec:\jdjpv.exe50⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jjjdd.exec:\jjjdd.exe51⤵
- Executes dropped EXE
PID:2508 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe52⤵
- Executes dropped EXE
PID:2764 -
\??\c:\xfxrfrx.exec:\xfxrfrx.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ntthnn.exec:\ntthnn.exe54⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ppjvd.exec:\ppjvd.exe55⤵
- Executes dropped EXE
PID:1392 -
\??\c:\jppdd.exec:\jppdd.exe56⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rlxxlll.exec:\rlxxlll.exe57⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nthhhh.exec:\nthhhh.exe58⤵
- Executes dropped EXE
PID:2040 -
\??\c:\9nhhhh.exec:\9nhhhh.exe59⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vjpvp.exec:\vjpvp.exe60⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dvvdd.exec:\dvvdd.exe61⤵
- Executes dropped EXE
PID:2884 -
\??\c:\9rxlfff.exec:\9rxlfff.exe62⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xrxxxff.exec:\xrxxxff.exe63⤵
- Executes dropped EXE
PID:1648 -
\??\c:\nhtbtn.exec:\nhtbtn.exe64⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nbhhhh.exec:\nbhhhh.exe65⤵
- Executes dropped EXE
PID:964 -
\??\c:\vdjjd.exec:\vdjjd.exe66⤵PID:2344
-
\??\c:\3frrxlr.exec:\3frrxlr.exe67⤵PID:1324
-
\??\c:\rfflrxf.exec:\rfflrxf.exe68⤵PID:776
-
\??\c:\5httbb.exec:\5httbb.exe69⤵PID:2860
-
\??\c:\btbbtb.exec:\btbbtb.exe70⤵PID:2044
-
\??\c:\jdvdj.exec:\jdvdj.exe71⤵PID:888
-
\??\c:\dvddd.exec:\dvddd.exe72⤵PID:1848
-
\??\c:\frxfxxx.exec:\frxfxxx.exe73⤵PID:1932
-
\??\c:\9fflffx.exec:\9fflffx.exe74⤵PID:1596
-
\??\c:\1btttt.exec:\1btttt.exe75⤵PID:1604
-
\??\c:\tnhnnn.exec:\tnhnnn.exe76⤵PID:2296
-
\??\c:\pdpvj.exec:\pdpvj.exe77⤵PID:1696
-
\??\c:\jvpdj.exec:\jvpdj.exe78⤵PID:1092
-
\??\c:\jdvpp.exec:\jdvpp.exe79⤵PID:1708
-
\??\c:\rlxrxxr.exec:\rlxrxxr.exe80⤵PID:2548
-
\??\c:\nhhhnh.exec:\nhhhnh.exe81⤵PID:2880
-
\??\c:\tnttnh.exec:\tnttnh.exe82⤵PID:2680
-
\??\c:\pvpjp.exec:\pvpjp.exe83⤵PID:3048
-
\??\c:\fxllxfr.exec:\fxllxfr.exe84⤵PID:852
-
\??\c:\rlrfffl.exec:\rlrfffl.exe85⤵PID:1948
-
\??\c:\1xlrlrf.exec:\1xlrlrf.exe86⤵PID:2976
-
\??\c:\ttbhbh.exec:\ttbhbh.exe87⤵PID:2964
-
\??\c:\dvjpv.exec:\dvjpv.exe88⤵PID:2136
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe89⤵PID:2952
-
\??\c:\fxflllx.exec:\fxflllx.exe90⤵PID:2248
-
\??\c:\thnhtt.exec:\thnhtt.exe91⤵PID:1996
-
\??\c:\hbtbth.exec:\hbtbth.exe92⤵PID:1444
-
\??\c:\dppdd.exec:\dppdd.exe93⤵PID:2804
-
\??\c:\pjvvp.exec:\pjvvp.exe94⤵PID:2744
-
\??\c:\xrflrrf.exec:\xrflrrf.exe95⤵PID:2616
-
\??\c:\rlffrxf.exec:\rlffrxf.exe96⤵PID:2984
-
\??\c:\5tnthh.exec:\5tnthh.exe97⤵PID:1392
-
\??\c:\7nbhnt.exec:\7nbhnt.exe98⤵PID:2300
-
\??\c:\pjvdj.exec:\pjvdj.exe99⤵PID:1736
-
\??\c:\jdjvd.exec:\jdjvd.exe100⤵PID:2876
-
\??\c:\lfxxffl.exec:\lfxxffl.exe101⤵PID:1928
-
\??\c:\flfxfxf.exec:\flfxfxf.exe102⤵PID:2212
-
\??\c:\nhnbhn.exec:\nhnbhn.exe103⤵PID:2884
-
\??\c:\5vjdj.exec:\5vjdj.exe104⤵PID:644
-
\??\c:\vpddd.exec:\vpddd.exe105⤵PID:1648
-
\??\c:\7rrlffl.exec:\7rrlffl.exe106⤵PID:2252
-
\??\c:\lxlffff.exec:\lxlffff.exe107⤵PID:1328
-
\??\c:\nnhhtt.exec:\nnhhtt.exe108⤵PID:576
-
\??\c:\thhhbh.exec:\thhhbh.exe109⤵PID:2748
-
\??\c:\7bnnnn.exec:\7bnnnn.exe110⤵PID:2176
-
\??\c:\5dppd.exec:\5dppd.exe111⤵PID:2860
-
\??\c:\vvjvj.exec:\vvjvj.exe112⤵PID:2044
-
\??\c:\1lffflr.exec:\1lffflr.exe113⤵PID:1508
-
\??\c:\flrrfxr.exec:\flrrfxr.exe114⤵PID:1528
-
\??\c:\9tnnbh.exec:\9tnnbh.exe115⤵PID:804
-
\??\c:\bthhtn.exec:\bthhtn.exe116⤵PID:1596
-
\??\c:\ddvvj.exec:\ddvvj.exe117⤵PID:1604
-
\??\c:\pvvvj.exec:\pvvvj.exe118⤵PID:2000
-
\??\c:\1frrlff.exec:\1frrlff.exe119⤵PID:1696
-
\??\c:\1lxxfff.exec:\1lxxfff.exe120⤵PID:2688
-
\??\c:\nnthtt.exec:\nnthtt.exe121⤵PID:1708
-
\??\c:\bbtnbt.exec:\bbtnbt.exe122⤵PID:2548
-
\??\c:\vpjdj.exec:\vpjdj.exe123⤵PID:2468
-
\??\c:\jvvpd.exec:\jvvpd.exe124⤵PID:2576
-
\??\c:\7xllrrx.exec:\7xllrrx.exe125⤵PID:3048
-
\??\c:\xrxfffl.exec:\xrxfffl.exe126⤵PID:2460
-
\??\c:\9tbbhh.exec:\9tbbhh.exe127⤵PID:1948
-
\??\c:\jdddj.exec:\jdddj.exe128⤵PID:3024
-
\??\c:\pvvdj.exec:\pvvdj.exe129⤵PID:2964
-
\??\c:\rflllxf.exec:\rflllxf.exe130⤵PID:2816
-
\??\c:\frxfllr.exec:\frxfllr.exe131⤵PID:2952
-
\??\c:\tnthtb.exec:\tnthtb.exe132⤵PID:2528
-
\??\c:\5ttnnh.exec:\5ttnnh.exe133⤵PID:1996
-
\??\c:\nbhbhh.exec:\nbhbhh.exe134⤵PID:2624
-
\??\c:\dvpvp.exec:\dvpvp.exe135⤵PID:2804
-
\??\c:\jjpvd.exec:\jjpvd.exe136⤵PID:2944
-
\??\c:\fxxxfxf.exec:\fxxxfxf.exe137⤵PID:2616
-
\??\c:\5lrrrlf.exec:\5lrrrlf.exe138⤵PID:2312
-
\??\c:\bnhnbb.exec:\bnhnbb.exe139⤵PID:1392
-
\??\c:\5htnnt.exec:\5htnnt.exe140⤵PID:1740
-
\??\c:\pdjpp.exec:\pdjpp.exe141⤵PID:1736
-
\??\c:\ddpvj.exec:\ddpvj.exe142⤵PID:2876
-
\??\c:\rfxflfl.exec:\rfxflfl.exe143⤵PID:1928
-
\??\c:\xlxxfff.exec:\xlxxfff.exe144⤵PID:556
-
\??\c:\5bbhtn.exec:\5bbhtn.exe145⤵PID:2884
-
\??\c:\5btthh.exec:\5btthh.exe146⤵PID:588
-
\??\c:\1bhbhh.exec:\1bhbhh.exe147⤵PID:1648
-
\??\c:\9dpdd.exec:\9dpdd.exe148⤵PID:2252
-
\??\c:\dvvjd.exec:\dvvjd.exe149⤵PID:1328
-
\??\c:\lxffrrf.exec:\lxffrrf.exe150⤵PID:696
-
\??\c:\9lllxrr.exec:\9lllxrr.exe151⤵PID:2748
-
\??\c:\bthbhb.exec:\bthbhb.exe152⤵PID:2236
-
\??\c:\dpvdj.exec:\dpvdj.exe153⤵PID:2860
-
\??\c:\rllfrxf.exec:\rllfrxf.exe154⤵PID:2044
-
\??\c:\rlxfllr.exec:\rlxfllr.exe155⤵PID:888
-
\??\c:\1bbhhn.exec:\1bbhhn.exe156⤵PID:1528
-
\??\c:\hhnnhh.exec:\hhnnhh.exe157⤵PID:804
-
\??\c:\dvjpd.exec:\dvjpd.exe158⤵PID:2024
-
\??\c:\dpvvp.exec:\dpvvp.exe159⤵PID:1604
-
\??\c:\xrflxfl.exec:\xrflxfl.exe160⤵PID:2668
-
\??\c:\ffxrrxf.exec:\ffxrrxf.exe161⤵PID:1696
-
\??\c:\3nhnbb.exec:\3nhnbb.exe162⤵PID:2600
-
\??\c:\nbtnnb.exec:\nbtnnb.exe163⤵PID:2588
-
\??\c:\jjddj.exec:\jjddj.exe164⤵PID:2548
-
\??\c:\7dpjp.exec:\7dpjp.exe165⤵PID:2468
-
\??\c:\lxllfff.exec:\lxllfff.exe166⤵PID:2472
-
\??\c:\rrxfrxf.exec:\rrxfrxf.exe167⤵PID:3048
-
\??\c:\tttbht.exec:\tttbht.exe168⤵PID:2484
-
\??\c:\tttbnh.exec:\tttbnh.exe169⤵PID:1948
-
\??\c:\1dvjp.exec:\1dvjp.exe170⤵PID:3024
-
\??\c:\vpppv.exec:\vpppv.exe171⤵PID:2964
-
\??\c:\xlrrrlx.exec:\xlrrrlx.exe172⤵PID:2816
-
\??\c:\fxflrxr.exec:\fxflrxr.exe173⤵PID:3008
-
\??\c:\1htbnh.exec:\1htbnh.exe174⤵PID:2528
-
\??\c:\hbnnbb.exec:\hbnnbb.exe175⤵PID:2812
-
\??\c:\vjvvv.exec:\vjvvv.exe176⤵PID:2956
-
\??\c:\vjpjj.exec:\vjpjj.exe177⤵PID:2804
-
\??\c:\1pjpv.exec:\1pjpv.exe178⤵PID:1308
-
\??\c:\fxfxlff.exec:\fxfxlff.exe179⤵PID:2616
-
\??\c:\nntnnt.exec:\nntnnt.exe180⤵PID:1288
-
\??\c:\btbbnh.exec:\btbbnh.exe181⤵PID:1392
-
\??\c:\5jvvp.exec:\5jvvp.exe182⤵PID:1864
-
\??\c:\dpvvj.exec:\dpvvj.exe183⤵PID:1736
-
\??\c:\lxfxrlr.exec:\lxfxrlr.exe184⤵PID:532
-
\??\c:\xrflrrx.exec:\xrflrrx.exe185⤵PID:1928
-
\??\c:\bhntnb.exec:\bhntnb.exe186⤵PID:2404
-
\??\c:\thtbbb.exec:\thtbbb.exe187⤵PID:2100
-
\??\c:\vpppv.exec:\vpppv.exe188⤵PID:588
-
\??\c:\jjjvd.exec:\jjjvd.exe189⤵PID:1648
-
\??\c:\1rffllx.exec:\1rffllx.exe190⤵PID:2260
-
\??\c:\3xffxxx.exec:\3xffxxx.exe191⤵PID:1328
-
\??\c:\hbhttt.exec:\hbhttt.exe192⤵PID:696
-
\??\c:\bnhntb.exec:\bnhntb.exe193⤵PID:792
-
\??\c:\3pdjj.exec:\3pdjj.exe194⤵PID:1968
-
\??\c:\7jjpv.exec:\7jjpv.exe195⤵PID:2860
-
\??\c:\7frxlrl.exec:\7frxlrl.exe196⤵PID:884
-
\??\c:\ntbhhb.exec:\ntbhhb.exe197⤵PID:1508
-
\??\c:\vpvdj.exec:\vpvdj.exe198⤵PID:1528
-
\??\c:\3vjjj.exec:\3vjjj.exe199⤵PID:804
-
\??\c:\fxllxxf.exec:\fxllxxf.exe200⤵PID:2652
-
\??\c:\btbhnn.exec:\btbhnn.exe201⤵PID:1604
-
\??\c:\tnhhbb.exec:\tnhhbb.exe202⤵PID:2544
-
\??\c:\5jdvv.exec:\5jdvv.exe203⤵PID:1696
-
\??\c:\pjvvv.exec:\pjvvv.exe204⤵PID:2756
-
\??\c:\5flrfll.exec:\5flrfll.exe205⤵PID:1060
-
\??\c:\rfllxxl.exec:\rfllxxl.exe206⤵PID:2464
-
\??\c:\nhtbnt.exec:\nhtbnt.exe207⤵PID:3052
-
\??\c:\btnhtn.exec:\btnhtn.exe208⤵PID:2512
-
\??\c:\1dvpv.exec:\1dvpv.exe209⤵PID:2972
-
\??\c:\jpppp.exec:\jpppp.exe210⤵PID:3000
-
\??\c:\lxxfxxl.exec:\lxxfxxl.exe211⤵PID:2276
-
\??\c:\1lfxxxl.exec:\1lfxxxl.exe212⤵PID:2740
-
\??\c:\thnhhb.exec:\thnhhb.exe213⤵PID:2112
-
\??\c:\hbnnbt.exec:\hbnnbt.exe214⤵PID:2816
-
\??\c:\jdvdj.exec:\jdvdj.exe215⤵PID:2632
-
\??\c:\pjddv.exec:\pjddv.exe216⤵PID:2528
-
\??\c:\frlrrrf.exec:\frlrrrf.exe217⤵PID:2840
-
\??\c:\hbntnn.exec:\hbntnn.exe218⤵PID:1380
-
\??\c:\hnbnbn.exec:\hnbnbn.exe219⤵PID:848
-
\??\c:\jdvjd.exec:\jdvjd.exe220⤵PID:1244
-
\??\c:\dppdd.exec:\dppdd.exe221⤵PID:3060
-
\??\c:\xlfflxf.exec:\xlfflxf.exe222⤵PID:2336
-
\??\c:\frxxxrx.exec:\frxxxrx.exe223⤵PID:1784
-
\??\c:\btbbhh.exec:\btbbhh.exe224⤵PID:2244
-
\??\c:\9jdvp.exec:\9jdvp.exe225⤵PID:604
-
\??\c:\ddppv.exec:\ddppv.exe226⤵PID:1480
-
\??\c:\dvddv.exec:\dvddv.exe227⤵PID:1104
-
\??\c:\rlxxrrf.exec:\rlxxrrf.exe228⤵PID:976
-
\??\c:\ffrxxrr.exec:\ffrxxrr.exe229⤵PID:1664
-
\??\c:\5ttthn.exec:\5ttthn.exe230⤵PID:960
-
\??\c:\9tbnhn.exec:\9tbnhn.exe231⤵PID:1648
-
\??\c:\3vjjj.exec:\3vjjj.exe232⤵PID:2360
-
\??\c:\dpddd.exec:\dpddd.exe233⤵PID:1760
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe234⤵PID:1704
-
\??\c:\xrllrlr.exec:\xrllrlr.exe235⤵PID:1512
-
\??\c:\9tbhbh.exec:\9tbhbh.exe236⤵PID:1968
-
\??\c:\tnbttt.exec:\tnbttt.exe237⤵PID:1932
-
\??\c:\9djjv.exec:\9djjv.exe238⤵PID:884
-
\??\c:\vpjjp.exec:\vpjjp.exe239⤵PID:1508
-
\??\c:\rrfxfrx.exec:\rrfxfrx.exe240⤵PID:2416
-
\??\c:\3lxxffl.exec:\3lxxffl.exe241⤵PID:1988
-
\??\c:\hhtbnt.exec:\hhtbnt.exe242⤵PID:2596