Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 10:45
Behavioral task
behavioral1
Sample
7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe
-
Size
169KB
-
MD5
d002865618db61a4b2c7216615c0ed80
-
SHA1
aa6442723c8aac153b9dcdf6b9d0315ab1e703f6
-
SHA256
7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501
-
SHA512
20b224a316fd1af22280c02de25ddb2656a7e511fc679669a53b1452dc6b636493d05516964469fdaa90b9c127d66be34c4c8c5f4030100d429cd8c87592ac8c
-
SSDEEP
1536:HvQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7FK4O8A1o4XEc3YtxD8/Ai2L:HhOmTsF93UYfwC6GIoutX8Ki3c3YT8VU
Score
10/10
Malware Config
Signatures
-
Detect Blackmoon payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2916-9-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2584-22-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2572-19-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2940-37-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/3024-39-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2708-56-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2680-59-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2700-69-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2508-78-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/3048-94-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2404-96-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2836-120-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2952-130-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/332-138-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1960-155-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1744-206-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/676-216-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1860-226-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1548-242-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/780-253-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/568-269-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/888-294-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2664-320-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2548-333-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2604-352-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2456-366-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1924-435-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1508-457-0x0000000000290000-0x00000000002D6000-memory.dmp family_blackmoon behavioral1/memory/2992-573-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2596-605-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/3040-618-0x00000000003B0000-0x00000000003F6000-memory.dmp family_blackmoon behavioral1/memory/2492-658-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/592-771-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbttbh.exepppjj.exexxrxxlx.exehbhhhn.exe5jdpv.exelfxfrrf.exetbhbtb.exebttbnt.exejddjv.exenhnttb.exe7hbbnt.exedvdjv.exe7fflrrl.exebnbhbn.exejdjjd.exe3rffllr.exe7nbnbb.exevvpvd.exe7fxlllf.exe1nbtbh.exejvppd.exevdpvd.exelffrflx.exe3bbthh.exedvdjp.exellxlfrx.exebhtbhb.exeddjjd.exejdvjj.exefxrxflr.exehbthtb.exevdjpv.exelxlrxrf.exe1tbnnt.exetnbhbh.exedvvvd.exexlllrxf.exenhtbbh.exethhbbb.exe7pdjv.exe3lflxlf.exelfrrflr.exebhnntn.exepjdjv.exeflxxxxx.exerrflrll.exe5hntbn.exedvjpj.exe7jvpv.exe1lfxxxl.exelxxllll.exe1hbbbb.exe3dvjj.exejpjdp.exelxfxrxf.exetttntt.exe7nhhtt.exejppjd.exerlflffl.exebbntbn.exenhnntt.exevpjjp.exe1pddp.exerlffrff.exepid process 2572 hbttbh.exe 2584 pppjj.exe 2940 xxrxxlx.exe 3024 hbhhhn.exe 2708 5jdpv.exe 2680 lfxfrrf.exe 2700 tbhbtb.exe 2508 bttbnt.exe 3048 jddjv.exe 2404 nhnttb.exe 2432 7hbbnt.exe 2836 dvdjv.exe 2952 7fflrrl.exe 332 bnbhbn.exe 1652 jdjjd.exe 1960 3rffllr.exe 1684 7nbnbb.exe 1536 vvpvd.exe 2264 7fxlllf.exe 1156 1nbtbh.exe 2632 jvppd.exe 1744 vdpvd.exe 676 lffrflx.exe 1096 3bbthh.exe 1860 dvdjp.exe 1548 llxlfrx.exe 780 bhtbhb.exe 700 ddjjd.exe 568 jdvjj.exe 2808 fxrxflr.exe 2320 hbthtb.exe 888 vdjpv.exe 2272 lxlrxrf.exe 1608 1tbnnt.exe 2656 tnbhbh.exe 2664 dvvvd.exe 2924 xlllrxf.exe 2548 nhtbbh.exe 2956 thhbbb.exe 3020 7pdjv.exe 2604 3lflxlf.exe 2196 lfrrflr.exe 2456 bhnntn.exe 2844 pjdjv.exe 2848 flxxxxx.exe 2892 rrflrll.exe 1584 5hntbn.exe 2724 dvjpj.exe 2840 7jvpv.exe 1740 1lfxxxl.exe 1704 lxxllll.exe 2004 1hbbbb.exe 548 3dvjj.exe 1924 jpjdp.exe 1652 lxfxrxf.exe 2332 tttntt.exe 1532 7nhhtt.exe 1508 jppjd.exe 2060 rlflffl.exe 1268 bbntbn.exe 2796 nhnntt.exe 1948 vpjjp.exe 2028 1pddp.exe 1044 rlffrff.exe -
Processes:
resource yara_rule behavioral1/memory/1772-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2916-1-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\hbttbh.exe upx behavioral1/memory/2916-9-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2572-10-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\pppjj.exe upx behavioral1/memory/2584-22-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2572-19-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\xxrxxlx.exe upx C:\hbhhhn.exe upx behavioral1/memory/2940-37-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/3024-39-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\5jdpv.exe upx behavioral1/memory/2708-47-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2708-56-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\lfxfrrf.exe upx behavioral1/memory/2680-59-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\tbhbtb.exe upx behavioral1/memory/2700-69-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\bttbnt.exe upx behavioral1/memory/2508-78-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\jddjv.exe upx behavioral1/memory/3048-85-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\nhnttb.exe upx behavioral1/memory/3048-94-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2404-96-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\7hbbnt.exe upx C:\dvdjv.exe upx C:\7fflrrl.exe upx behavioral1/memory/2836-120-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2952-128-0x0000000000390000-0x00000000003D6000-memory.dmp upx C:\bnbhbn.exe upx behavioral1/memory/2952-130-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\jdjjd.exe upx behavioral1/memory/332-138-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\3rffllr.exe upx C:\7nbnbb.exe upx behavioral1/memory/1960-155-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\vvpvd.exe upx behavioral1/memory/1536-165-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\7fxlllf.exe upx C:\1nbtbh.exe upx C:\jvppd.exe upx C:\vdpvd.exe upx behavioral1/memory/1744-198-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1744-206-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\lffrflx.exe upx C:\3bbthh.exe upx behavioral1/memory/676-216-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\dvdjp.exe upx behavioral1/memory/1860-226-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1548-234-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\llxlfrx.exe upx behavioral1/memory/1548-242-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\bhtbhb.exe upx C:\ddjjd.exe upx behavioral1/memory/780-253-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\jdvjj.exe upx behavioral1/memory/568-269-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\fxrxflr.exe upx C:\hbthtb.exe upx C:\vdjpv.exe upx behavioral1/memory/2272-295-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/888-294-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe" 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe -
Drops file in System32 directory 2 IoCs
Processes:
7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exedescription ioc process File created C:\Windows\SysWOW64\Serverx.exe 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe File opened for modification C:\Windows\SysWOW64\Serverx.exe 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exehbttbh.exepppjj.exexxrxxlx.exehbhhhn.exe5jdpv.exelfxfrrf.exetbhbtb.exebttbnt.exejddjv.exenhnttb.exe7hbbnt.exedvdjv.exe7fflrrl.exebnbhbn.exedescription pid process target process PID 1772 wrote to memory of 2916 1772 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe PID 1772 wrote to memory of 2916 1772 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe PID 1772 wrote to memory of 2916 1772 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe PID 1772 wrote to memory of 2916 1772 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe PID 2916 wrote to memory of 2572 2916 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe hbttbh.exe PID 2916 wrote to memory of 2572 2916 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe hbttbh.exe PID 2916 wrote to memory of 2572 2916 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe hbttbh.exe PID 2916 wrote to memory of 2572 2916 7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe hbttbh.exe PID 2572 wrote to memory of 2584 2572 hbttbh.exe pppjj.exe PID 2572 wrote to memory of 2584 2572 hbttbh.exe pppjj.exe PID 2572 wrote to memory of 2584 2572 hbttbh.exe pppjj.exe PID 2572 wrote to memory of 2584 2572 hbttbh.exe pppjj.exe PID 2584 wrote to memory of 2940 2584 pppjj.exe xxrxxlx.exe PID 2584 wrote to memory of 2940 2584 pppjj.exe xxrxxlx.exe PID 2584 wrote to memory of 2940 2584 pppjj.exe xxrxxlx.exe PID 2584 wrote to memory of 2940 2584 pppjj.exe xxrxxlx.exe PID 2940 wrote to memory of 3024 2940 xxrxxlx.exe hbhhhn.exe PID 2940 wrote to memory of 3024 2940 xxrxxlx.exe hbhhhn.exe PID 2940 wrote to memory of 3024 2940 xxrxxlx.exe hbhhhn.exe PID 2940 wrote to memory of 3024 2940 xxrxxlx.exe hbhhhn.exe PID 3024 wrote to memory of 2708 3024 hbhhhn.exe 5jdpv.exe PID 3024 wrote to memory of 2708 3024 hbhhhn.exe 5jdpv.exe PID 3024 wrote to memory of 2708 3024 hbhhhn.exe 5jdpv.exe PID 3024 wrote to memory of 2708 3024 hbhhhn.exe 5jdpv.exe PID 2708 wrote to memory of 2680 2708 5jdpv.exe lfxfrrf.exe PID 2708 wrote to memory of 2680 2708 5jdpv.exe lfxfrrf.exe PID 2708 wrote to memory of 2680 2708 5jdpv.exe lfxfrrf.exe PID 2708 wrote to memory of 2680 2708 5jdpv.exe lfxfrrf.exe PID 2680 wrote to memory of 2700 2680 lfxfrrf.exe tbhbtb.exe PID 2680 wrote to memory of 2700 2680 lfxfrrf.exe tbhbtb.exe PID 2680 wrote to memory of 2700 2680 lfxfrrf.exe tbhbtb.exe PID 2680 wrote to memory of 2700 2680 lfxfrrf.exe tbhbtb.exe PID 2700 wrote to memory of 2508 2700 tbhbtb.exe bttbnt.exe PID 2700 wrote to memory of 2508 2700 tbhbtb.exe bttbnt.exe PID 2700 wrote to memory of 2508 2700 tbhbtb.exe bttbnt.exe PID 2700 wrote to memory of 2508 2700 tbhbtb.exe bttbnt.exe PID 2508 wrote to memory of 3048 2508 bttbnt.exe jddjv.exe PID 2508 wrote to memory of 3048 2508 bttbnt.exe jddjv.exe PID 2508 wrote to memory of 3048 2508 bttbnt.exe jddjv.exe PID 2508 wrote to memory of 3048 2508 bttbnt.exe jddjv.exe PID 3048 wrote to memory of 2404 3048 jddjv.exe nhnttb.exe PID 3048 wrote to memory of 2404 3048 jddjv.exe nhnttb.exe PID 3048 wrote to memory of 2404 3048 jddjv.exe nhnttb.exe PID 3048 wrote to memory of 2404 3048 jddjv.exe nhnttb.exe PID 2404 wrote to memory of 2432 2404 nhnttb.exe 7hbbnt.exe PID 2404 wrote to memory of 2432 2404 nhnttb.exe 7hbbnt.exe PID 2404 wrote to memory of 2432 2404 nhnttb.exe 7hbbnt.exe PID 2404 wrote to memory of 2432 2404 nhnttb.exe 7hbbnt.exe PID 2432 wrote to memory of 2836 2432 7hbbnt.exe dvdjv.exe PID 2432 wrote to memory of 2836 2432 7hbbnt.exe dvdjv.exe PID 2432 wrote to memory of 2836 2432 7hbbnt.exe dvdjv.exe PID 2432 wrote to memory of 2836 2432 7hbbnt.exe dvdjv.exe PID 2836 wrote to memory of 2952 2836 dvdjv.exe 7fflrrl.exe PID 2836 wrote to memory of 2952 2836 dvdjv.exe 7fflrrl.exe PID 2836 wrote to memory of 2952 2836 dvdjv.exe 7fflrrl.exe PID 2836 wrote to memory of 2952 2836 dvdjv.exe 7fflrrl.exe PID 2952 wrote to memory of 332 2952 7fflrrl.exe bnbhbn.exe PID 2952 wrote to memory of 332 2952 7fflrrl.exe bnbhbn.exe PID 2952 wrote to memory of 332 2952 7fflrrl.exe bnbhbn.exe PID 2952 wrote to memory of 332 2952 7fflrrl.exe bnbhbn.exe PID 332 wrote to memory of 1652 332 bnbhbn.exe jdjjd.exe PID 332 wrote to memory of 1652 332 bnbhbn.exe jdjjd.exe PID 332 wrote to memory of 1652 332 bnbhbn.exe jdjjd.exe PID 332 wrote to memory of 1652 332 bnbhbn.exe jdjjd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe"C:\Users\Admin\AppData\Local\Temp\7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe"C:\Users\Admin\AppData\Local\Temp\7e819bbfcd868a05aa4ba90b1c1ed904739c7360865eb27c1414e80ea808b501.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\hbttbh.exec:\hbttbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pppjj.exec:\pppjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\xxrxxlx.exec:\xxrxxlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\hbhhhn.exec:\hbhhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\5jdpv.exec:\5jdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\tbhbtb.exec:\tbhbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\bttbnt.exec:\bttbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\jddjv.exec:\jddjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\nhnttb.exec:\nhnttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\7hbbnt.exec:\7hbbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\dvdjv.exec:\dvdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\7fflrrl.exec:\7fflrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\bnbhbn.exec:\bnbhbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\jdjjd.exec:\jdjjd.exe18⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3rffllr.exec:\3rffllr.exe19⤵
- Executes dropped EXE
PID:1960 -
\??\c:\7nbnbb.exec:\7nbnbb.exe20⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vvpvd.exec:\vvpvd.exe21⤵
- Executes dropped EXE
PID:1536 -
\??\c:\7fxlllf.exec:\7fxlllf.exe22⤵
- Executes dropped EXE
PID:2264 -
\??\c:\1nbtbh.exec:\1nbtbh.exe23⤵
- Executes dropped EXE
PID:1156 -
\??\c:\jvppd.exec:\jvppd.exe24⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vdpvd.exec:\vdpvd.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lffrflx.exec:\lffrflx.exe26⤵
- Executes dropped EXE
PID:676 -
\??\c:\3bbthh.exec:\3bbthh.exe27⤵
- Executes dropped EXE
PID:1096 -
\??\c:\dvdjp.exec:\dvdjp.exe28⤵
- Executes dropped EXE
PID:1860 -
\??\c:\llxlfrx.exec:\llxlfrx.exe29⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bhtbhb.exec:\bhtbhb.exe30⤵
- Executes dropped EXE
PID:780 -
\??\c:\ddjjd.exec:\ddjjd.exe31⤵
- Executes dropped EXE
PID:700 -
\??\c:\jdvjj.exec:\jdvjj.exe32⤵
- Executes dropped EXE
PID:568 -
\??\c:\fxrxflr.exec:\fxrxflr.exe33⤵
- Executes dropped EXE
PID:2808 -
\??\c:\hbthtb.exec:\hbthtb.exe34⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vdjpv.exec:\vdjpv.exe35⤵
- Executes dropped EXE
PID:888 -
\??\c:\lxlrxrf.exec:\lxlrxrf.exe36⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1tbnnt.exec:\1tbnnt.exe37⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tnbhbh.exec:\tnbhbh.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dvvvd.exec:\dvvvd.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xlllrxf.exec:\xlllrxf.exe40⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nhtbbh.exec:\nhtbbh.exe41⤵
- Executes dropped EXE
PID:2548 -
\??\c:\thhbbb.exec:\thhbbb.exe42⤵
- Executes dropped EXE
PID:2956 -
\??\c:\7pdjv.exec:\7pdjv.exe43⤵
- Executes dropped EXE
PID:3020 -
\??\c:\3lflxlf.exec:\3lflxlf.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lfrrflr.exec:\lfrrflr.exe45⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bhnntn.exec:\bhnntn.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pjdjv.exec:\pjdjv.exe47⤵
- Executes dropped EXE
PID:2844 -
\??\c:\flxxxxx.exec:\flxxxxx.exe48⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rrflrll.exec:\rrflrll.exe49⤵
- Executes dropped EXE
PID:2892 -
\??\c:\5hntbn.exec:\5hntbn.exe50⤵
- Executes dropped EXE
PID:1584 -
\??\c:\dvjpj.exec:\dvjpj.exe51⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7jvpv.exec:\7jvpv.exe52⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1lfxxxl.exec:\1lfxxxl.exe53⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lxxllll.exec:\lxxllll.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1hbbbb.exec:\1hbbbb.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3dvjj.exec:\3dvjj.exe56⤵
- Executes dropped EXE
PID:548 -
\??\c:\jpjdp.exec:\jpjdp.exe57⤵
- Executes dropped EXE
PID:1924 -
\??\c:\lxfxrxf.exec:\lxfxrxf.exe58⤵
- Executes dropped EXE
PID:1652 -
\??\c:\tttntt.exec:\tttntt.exe59⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7nhhtt.exec:\7nhhtt.exe60⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jppjd.exec:\jppjd.exe61⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rlflffl.exec:\rlflffl.exe62⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bbntbn.exec:\bbntbn.exe63⤵
- Executes dropped EXE
PID:1268 -
\??\c:\nhnntt.exec:\nhnntt.exe64⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vpjjp.exec:\vpjjp.exe65⤵
- Executes dropped EXE
PID:1948 -
\??\c:\1pddp.exec:\1pddp.exe66⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rlffrff.exec:\rlffrff.exe67⤵
- Executes dropped EXE
PID:1044 -
\??\c:\fxllrrf.exec:\fxllrrf.exe68⤵PID:656
-
\??\c:\nbntbb.exec:\nbntbb.exe69⤵PID:1856
-
\??\c:\vjjjd.exec:\vjjjd.exe70⤵PID:828
-
\??\c:\3vvpp.exec:\3vvpp.exe71⤵PID:2316
-
\??\c:\xrxflrl.exec:\xrxflrl.exe72⤵PID:1092
-
\??\c:\1nntbb.exec:\1nntbb.exe73⤵PID:1632
-
\??\c:\bnhnbh.exec:\bnhnbh.exe74⤵PID:856
-
\??\c:\pvdvv.exec:\pvdvv.exe75⤵PID:2232
-
\??\c:\frffrrx.exec:\frffrrx.exe76⤵PID:1620
-
\??\c:\btbhnn.exec:\btbhnn.exe77⤵PID:2812
-
\??\c:\thbbhh.exec:\thbbhh.exe78⤵PID:2872
-
\??\c:\9dvjp.exec:\9dvjp.exe79⤵PID:2992
-
\??\c:\frrlxrx.exec:\frrlxrx.exe80⤵PID:668
-
\??\c:\nhthhn.exec:\nhthhn.exe81⤵PID:1152
-
\??\c:\tnhtnh.exec:\tnhtnh.exe82⤵PID:2236
-
\??\c:\vvvdd.exec:\vvvdd.exe83⤵PID:2600
-
\??\c:\jvvdj.exec:\jvvdj.exe84⤵PID:2596
-
\??\c:\fxflrll.exec:\fxflrll.exe85⤵PID:3016
-
\??\c:\xrffxxf.exec:\xrffxxf.exe86⤵PID:3040
-
\??\c:\thntbh.exec:\thntbh.exe87⤵PID:2696
-
\??\c:\1vppd.exec:\1vppd.exe88⤵PID:2732
-
\??\c:\vdjjv.exec:\vdjjv.exe89⤵PID:2480
-
\??\c:\fxlrflx.exec:\fxlrflx.exe90⤵PID:2440
-
\??\c:\1htbbh.exec:\1htbbh.exe91⤵PID:2500
-
\??\c:\nhnhbb.exec:\nhnhbb.exe92⤵PID:2492
-
\??\c:\ddpvd.exec:\ddpvd.exe93⤵PID:2496
-
\??\c:\lrllllr.exec:\lrllllr.exe94⤵PID:1588
-
\??\c:\lxllflr.exec:\lxllflr.exe95⤵PID:2628
-
\??\c:\hthnnb.exec:\hthnnb.exe96⤵PID:1912
-
\??\c:\ddppd.exec:\ddppd.exe97⤵PID:1980
-
\??\c:\jjdjv.exec:\jjdjv.exe98⤵PID:1740
-
\??\c:\lfrfxfx.exec:\lfrfxfx.exe99⤵PID:1864
-
\??\c:\rfrrfll.exec:\rfrrfll.exe100⤵PID:2004
-
\??\c:\hbhnbh.exec:\hbhnbh.exe101⤵PID:1968
-
\??\c:\dvddv.exec:\dvddv.exe102⤵PID:1924
-
\??\c:\pjvvp.exec:\pjvvp.exe103⤵PID:1816
-
\??\c:\3frrflr.exec:\3frrflr.exe104⤵PID:2392
-
\??\c:\5nhnbh.exec:\5nhnbh.exe105⤵PID:1764
-
\??\c:\tthntb.exec:\tthntb.exe106⤵PID:1676
-
\??\c:\jdvdj.exec:\jdvdj.exe107⤵PID:2252
-
\??\c:\dvvjd.exec:\dvvjd.exe108⤵PID:2792
-
\??\c:\1flxffr.exec:\1flxffr.exe109⤵PID:2036
-
\??\c:\lfxflrf.exec:\lfxflrf.exe110⤵PID:592
-
\??\c:\bttbnb.exec:\bttbnb.exe111⤵PID:536
-
\??\c:\7nhhnt.exec:\7nhhnt.exe112⤵PID:1492
-
\??\c:\vvvpp.exec:\vvvpp.exe113⤵PID:336
-
\??\c:\lflrlrx.exec:\lflrlrx.exe114⤵PID:1856
-
\??\c:\xrxllrl.exec:\xrxllrl.exe115⤵PID:1992
-
\??\c:\thnbth.exec:\thnbth.exe116⤵PID:1680
-
\??\c:\dvvvp.exec:\dvvvp.exe117⤵PID:780
-
\??\c:\rlfllrf.exec:\rlfllrf.exe118⤵PID:1028
-
\??\c:\1flrfxf.exec:\1flrfxf.exe119⤵PID:2824
-
\??\c:\3tbhnt.exec:\3tbhnt.exe120⤵PID:2344
-
\??\c:\jpdpj.exec:\jpdpj.exe121⤵PID:2996
-
\??\c:\jdvdp.exec:\jdvdp.exe122⤵PID:1988
-
\??\c:\5fxfrxf.exec:\5fxfrxf.exe123⤵PID:884
-
\??\c:\hhbtnn.exec:\hhbtnn.exe124⤵PID:1736
-
\??\c:\hhtbhn.exec:\hhtbhn.exe125⤵PID:2588
-
\??\c:\jdpvd.exec:\jdpvd.exe126⤵PID:2272
-
\??\c:\7vdjv.exec:\7vdjv.exe127⤵PID:2236
-
\??\c:\xxrrflx.exec:\xxrrflx.exe128⤵PID:2640
-
\??\c:\nhtbtb.exec:\nhtbtb.exe129⤵PID:2596
-
\??\c:\1thnth.exec:\1thnth.exe130⤵PID:2548
-
\??\c:\dvpdv.exec:\dvpdv.exe131⤵PID:2908
-
\??\c:\jvjpd.exec:\jvjpd.exe132⤵PID:2716
-
\??\c:\xfllffr.exec:\xfllffr.exe133⤵PID:2680
-
\??\c:\5nhthn.exec:\5nhthn.exe134⤵PID:2196
-
\??\c:\ntbbnt.exec:\ntbbnt.exe135⤵PID:2204
-
\??\c:\5vpvd.exec:\5vpvd.exe136⤵PID:2464
-
\??\c:\9vjpd.exec:\9vjpd.exe137⤵PID:356
-
\??\c:\frfflrx.exec:\frfflrx.exe138⤵PID:2848
-
\??\c:\xrxrllx.exec:\xrxrllx.exe139⤵PID:2172
-
\??\c:\tnbtnb.exec:\tnbtnb.exe140⤵PID:2744
-
\??\c:\nhhbbn.exec:\nhhbbn.exe141⤵PID:2628
-
\??\c:\3dvvv.exec:\3dvvv.exe142⤵PID:2864
-
\??\c:\vjjpp.exec:\vjjpp.exe143⤵PID:1256
-
\??\c:\frrxflr.exec:\frrxflr.exe144⤵PID:1740
-
\??\c:\3frxflx.exec:\3frxflx.exe145⤵PID:1864
-
\??\c:\hbnttt.exec:\hbnttt.exe146⤵PID:548
-
\??\c:\hthhhh.exec:\hthhhh.exe147⤵PID:1968
-
\??\c:\dpjjp.exec:\dpjjp.exe148⤵PID:1924
-
\??\c:\rlxxlfl.exec:\rlxxlfl.exe149⤵PID:1816
-
\??\c:\1rlflfr.exec:\1rlflfr.exe150⤵PID:2392
-
\??\c:\hbnnth.exec:\hbnnth.exe151⤵PID:1764
-
\??\c:\1tnbhn.exec:\1tnbhn.exe152⤵PID:1508
-
\??\c:\jdjjv.exec:\jdjjv.exe153⤵PID:2084
-
\??\c:\xrlxlfr.exec:\xrlxlfr.exe154⤵PID:2796
-
\??\c:\9xxxfxf.exec:\9xxxfxf.exe155⤵PID:1744
-
\??\c:\htntbb.exec:\htntbb.exe156⤵PID:2028
-
\??\c:\tnttnb.exec:\tnttnb.exe157⤵PID:2976
-
\??\c:\vvvdv.exec:\vvvdv.exe158⤵PID:692
-
\??\c:\jvddp.exec:\jvddp.exe159⤵PID:816
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe160⤵PID:1976
-
\??\c:\tnbbhh.exec:\tnbbhh.exe161⤵PID:2772
-
\??\c:\tnbbhn.exec:\tnbbhn.exe162⤵PID:1592
-
\??\c:\vjvvd.exec:\vjvvd.exe163⤵PID:1868
-
\??\c:\rllxfrf.exec:\rllxfrf.exe164⤵PID:856
-
\??\c:\ffrlfrx.exec:\ffrlfrx.exe165⤵PID:3044
-
\??\c:\tnhnbb.exec:\tnhnbb.exe166⤵PID:2804
-
\??\c:\nhnntb.exec:\nhnntb.exe167⤵PID:2132
-
\??\c:\pjdjv.exec:\pjdjv.exe168⤵PID:1516
-
\??\c:\jdjpd.exec:\jdjpd.exe169⤵PID:2304
-
\??\c:\rlflxxr.exec:\rlflxxr.exe170⤵PID:884
-
\??\c:\nbhnht.exec:\nbhnht.exe171⤵PID:1736
-
\??\c:\tthhbh.exec:\tthhbh.exe172⤵PID:2672
-
\??\c:\jdpvd.exec:\jdpvd.exe173⤵PID:2272
-
\??\c:\5dvjv.exec:\5dvjv.exe174⤵PID:2236
-
\??\c:\lfrllrx.exec:\lfrllrx.exe175⤵PID:2640
-
\??\c:\nntthn.exec:\nntthn.exe176⤵PID:2596
-
\??\c:\httbbb.exec:\httbbb.exe177⤵PID:2548
-
\??\c:\jdpvj.exec:\jdpvj.exe178⤵PID:2908
-
\??\c:\vjppj.exec:\vjppj.exe179⤵PID:2716
-
\??\c:\7lxfrxl.exec:\7lxfrxl.exe180⤵PID:2480
-
\??\c:\fxfxrxf.exec:\fxfxrxf.exe181⤵PID:2196
-
\??\c:\5bbbnt.exec:\5bbbnt.exe182⤵PID:2488
-
\??\c:\pjvpj.exec:\pjvpj.exe183⤵PID:2464
-
\??\c:\3vjvv.exec:\3vjvv.exe184⤵PID:2496
-
\??\c:\xlxxllf.exec:\xlxxllf.exe185⤵PID:2848
-
\??\c:\xxfrlrf.exec:\xxfrlrf.exe186⤵PID:1460
-
\??\c:\thttnn.exec:\thttnn.exe187⤵PID:2744
-
\??\c:\1tnbnb.exec:\1tnbnb.exe188⤵PID:2628
-
\??\c:\dvjvj.exec:\dvjvj.exe189⤵PID:2864
-
\??\c:\3jjvj.exec:\3jjvj.exe190⤵PID:1712
-
\??\c:\1fxlxfx.exec:\1fxlxfx.exe191⤵PID:1740
-
\??\c:\btnhtt.exec:\btnhtt.exe192⤵PID:352
-
\??\c:\hbbnnn.exec:\hbbnnn.exe193⤵PID:548
-
\??\c:\3pjvd.exec:\3pjvd.exe194⤵PID:2368
-
\??\c:\pddjp.exec:\pddjp.exe195⤵PID:1924
-
\??\c:\xlrxffx.exec:\xlrxffx.exe196⤵PID:1408
-
\??\c:\nhbhht.exec:\nhbhht.exe197⤵PID:2392
-
\??\c:\9httbb.exec:\9httbb.exe198⤵PID:1764
-
\??\c:\dvdjv.exec:\dvdjv.exe199⤵PID:1508
-
\??\c:\1vdjv.exec:\1vdjv.exe200⤵PID:1400
-
\??\c:\9xxfrxr.exec:\9xxfrxr.exe201⤵PID:2796
-
\??\c:\rxxfrrr.exec:\rxxfrrr.exe202⤵PID:3008
-
\??\c:\hhnntn.exec:\hhnntn.exe203⤵PID:584
-
\??\c:\dpdpj.exec:\dpdpj.exe204⤵PID:1492
-
\??\c:\jjpvv.exec:\jjpvv.exe205⤵PID:1788
-
\??\c:\7frrfxf.exec:\7frrfxf.exe206⤵PID:1856
-
\??\c:\5xrrlrl.exec:\5xrrlrl.exe207⤵PID:1828
-
\??\c:\nbhhbh.exec:\nbhhbh.exe208⤵PID:2624
-
\??\c:\tbhnhh.exec:\tbhnhh.exe209⤵PID:2128
-
\??\c:\jdpvd.exec:\jdpvd.exe210⤵PID:2032
-
\??\c:\pjddv.exec:\pjddv.exe211⤵PID:1868
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe212⤵PID:856
-
\??\c:\nhnnbb.exec:\nhnnbb.exe213⤵PID:3044
-
\??\c:\hbtnhh.exec:\hbtnhh.exe214⤵PID:2804
-
\??\c:\dvdpv.exec:\dvdpv.exe215⤵PID:2244
-
\??\c:\5jdjv.exec:\5jdjv.exe216⤵PID:1516
-
\??\c:\xxrffrf.exec:\xxrffrf.exe217⤵PID:2916
-
\??\c:\9xxlxfr.exec:\9xxlxfr.exe218⤵PID:884
-
\??\c:\5hhhtb.exec:\5hhhtb.exe219⤵PID:2668
-
\??\c:\tnhtbb.exec:\tnhtbb.exe220⤵PID:2672
-
\??\c:\vpjvj.exec:\vpjvj.exe221⤵PID:2584
-
\??\c:\3xxfxlr.exec:\3xxfxlr.exe222⤵PID:2236
-
\??\c:\lffxxfl.exec:\lffxxfl.exe223⤵PID:2712
-
\??\c:\rfrfrrx.exec:\rfrfrrx.exe224⤵PID:2596
-
\??\c:\bnbhbb.exec:\bnbhbb.exe225⤵PID:2676
-
\??\c:\3tntbb.exec:\3tntbb.exe226⤵PID:2908
-
\??\c:\dvjvj.exec:\dvjvj.exe227⤵PID:2680
-
\??\c:\dvvdj.exec:\dvvdj.exe228⤵PID:2480
-
\??\c:\9llrffr.exec:\9llrffr.exe229⤵PID:2196
-
\??\c:\llxfxfl.exec:\llxfxfl.exe230⤵PID:2856
-
\??\c:\ttnnhh.exec:\ttnnhh.exe231⤵PID:1276
-
\??\c:\1bhnnt.exec:\1bhnnt.exe232⤵PID:2496
-
\??\c:\dvdpj.exec:\dvdpj.exe233⤵PID:2736
-
\??\c:\fxffflr.exec:\fxffflr.exe234⤵PID:1460
-
\??\c:\rffflrf.exec:\rffflrf.exe235⤵PID:1964
-
\??\c:\nhtthn.exec:\nhtthn.exe236⤵PID:2628
-
\??\c:\thnhhb.exec:\thnhhb.exe237⤵PID:1756
-
\??\c:\ddjvj.exec:\ddjvj.exe238⤵PID:1712
-
\??\c:\xflfrrl.exec:\xflfrrl.exe239⤵PID:1740
-
\??\c:\rlxxffl.exec:\rlxxffl.exe240⤵PID:1864
-
\??\c:\1thbnn.exec:\1thbnn.exe241⤵PID:1528
-
\??\c:\1tntbh.exec:\1tntbh.exe242⤵PID:2368