Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe
-
Size
345KB
-
MD5
190831908333df1dbde6f87601ea90b6
-
SHA1
7ce05d6cc63a19b512521e1515417ff3e7c4d214
-
SHA256
dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82
-
SHA512
8d1887df78b9c083d13403fee900ae0f118f5067fc7902bd92c2a860917d0d261724a4e34b81cb225296cc80db6b6cd17d5fa3d51130c862c802ac78fcb04e0a
-
SSDEEP
6144:n3C9BRo/AIX2MUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhXjmnwJQyIl:n3C9uDnUXoSWlnwJv90aKToFqwfIBL
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2136-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/652-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1160-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
Processes:
resource yara_rule behavioral1/memory/2136-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2988-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3068-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3068-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3068-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2552-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2492-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2492-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2948-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2820-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2804-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1460-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/932-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2344-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1652-211-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/652-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2052-229-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1864-256-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1160-265-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2888-292-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vvjjp.exenhthbh.exerrfrxrx.exetbtbbt.exevdvdj.exellrlrrx.exetntnht.exejvdvv.exebnbhtt.exevppdp.exe7rxxffl.exebbnnhn.exe9pvpd.exexxllrxl.exe9nhnth.exe5ddvv.exerlxxflr.exe5nbbbb.exe9jdpv.exentthnb.exejvddd.exetbnbhh.exejvdjj.exefrflllr.exenbnttb.exedpvvv.exerlxflrf.exe3bhhhb.exejjdjv.exe1xfllrr.exebtbtnn.exejjdjp.exellfrfxr.exetbbbnb.exehbtbbt.exejvjdj.exe5xffffl.exe7bbhbn.exedvjjv.exejdpdd.exexxrflxr.exerrlfrxr.exenbhhtb.exepdppp.exe7dppp.exe9rllrrx.exebnbbnh.exe7bbbnb.exepjddj.exefxrxffr.exe9ffflfl.exenhnbhh.exehtthbt.exe7vpvp.exerrrxrlf.exe9rlrxxx.exetnhthn.exenbhbtb.exedvppd.exe1dvdd.exelxlfllf.exe9bbbbb.exebnbntt.exe1jvjp.exepid process 2988 vvjjp.exe 3068 nhthbh.exe 2552 rrfrxrx.exe 2668 tbtbbt.exe 2592 vdvdj.exe 2792 llrlrrx.exe 2624 tntnht.exe 2492 jvdvv.exe 2948 bnbhtt.exe 2476 vppdp.exe 2820 7rxxffl.exe 928 bbnnhn.exe 2804 9pvpd.exe 1460 xxllrxl.exe 3060 9nhnth.exe 2184 5ddvv.exe 932 rlxxflr.exe 2344 5nbbbb.exe 2852 9jdpv.exe 844 ntthnb.exe 1652 jvddd.exe 652 tbnbhh.exe 2052 jvdjj.exe 2076 frflllr.exe 1540 nbnttb.exe 1864 dpvvv.exe 1160 rlxflrf.exe 1060 3bhhhb.exe 2208 jjdjv.exe 2888 1xfllrr.exe 1164 btbtnn.exe 1916 jjdjp.exe 2172 llfrfxr.exe 1604 tbbbnb.exe 2152 hbtbbt.exe 2416 jvjdj.exe 2856 5xffffl.exe 2656 7bbhbn.exe 2612 dvjjv.exe 2776 jdpdd.exe 2828 xxrflxr.exe 2500 rrlfrxr.exe 2480 nbhhtb.exe 2464 pdppp.exe 2524 7dppp.exe 2944 9rllrrx.exe 2728 bnbbnh.exe 2720 7bbbnb.exe 2724 pjddj.exe 2440 fxrxffr.exe 2812 9ffflfl.exe 2816 nhnbhh.exe 2636 htthbt.exe 2268 7vpvp.exe 1972 rrrxrlf.exe 1616 9rlrxxx.exe 2316 tnhthn.exe 1008 nbhbtb.exe 272 dvppd.exe 844 1dvdd.exe 788 lxlfllf.exe 1084 9bbbbb.exe 1476 bnbntt.exe 840 1jvjp.exe -
Processes:
resource yara_rule behavioral1/memory/2136-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/652-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1160-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exevvjjp.exenhthbh.exerrfrxrx.exetbtbbt.exevdvdj.exellrlrrx.exetntnht.exejvdvv.exebnbhtt.exevppdp.exe7rxxffl.exebbnnhn.exe9pvpd.exexxllrxl.exe9nhnth.exedescription pid process target process PID 2136 wrote to memory of 2988 2136 dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe vvjjp.exe PID 2136 wrote to memory of 2988 2136 dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe vvjjp.exe PID 2136 wrote to memory of 2988 2136 dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe vvjjp.exe PID 2136 wrote to memory of 2988 2136 dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe vvjjp.exe PID 2988 wrote to memory of 3068 2988 vvjjp.exe nhthbh.exe PID 2988 wrote to memory of 3068 2988 vvjjp.exe nhthbh.exe PID 2988 wrote to memory of 3068 2988 vvjjp.exe nhthbh.exe PID 2988 wrote to memory of 3068 2988 vvjjp.exe nhthbh.exe PID 3068 wrote to memory of 2552 3068 nhthbh.exe rrfrxrx.exe PID 3068 wrote to memory of 2552 3068 nhthbh.exe rrfrxrx.exe PID 3068 wrote to memory of 2552 3068 nhthbh.exe rrfrxrx.exe PID 3068 wrote to memory of 2552 3068 nhthbh.exe rrfrxrx.exe PID 2552 wrote to memory of 2668 2552 rrfrxrx.exe tbtbbt.exe PID 2552 wrote to memory of 2668 2552 rrfrxrx.exe tbtbbt.exe PID 2552 wrote to memory of 2668 2552 rrfrxrx.exe tbtbbt.exe PID 2552 wrote to memory of 2668 2552 rrfrxrx.exe tbtbbt.exe PID 2668 wrote to memory of 2592 2668 tbtbbt.exe vdvdj.exe PID 2668 wrote to memory of 2592 2668 tbtbbt.exe vdvdj.exe PID 2668 wrote to memory of 2592 2668 tbtbbt.exe vdvdj.exe PID 2668 wrote to memory of 2592 2668 tbtbbt.exe vdvdj.exe PID 2592 wrote to memory of 2792 2592 vdvdj.exe llrlrrx.exe PID 2592 wrote to memory of 2792 2592 vdvdj.exe llrlrrx.exe PID 2592 wrote to memory of 2792 2592 vdvdj.exe llrlrrx.exe PID 2592 wrote to memory of 2792 2592 vdvdj.exe llrlrrx.exe PID 2792 wrote to memory of 2624 2792 llrlrrx.exe tntnht.exe PID 2792 wrote to memory of 2624 2792 llrlrrx.exe tntnht.exe PID 2792 wrote to memory of 2624 2792 llrlrrx.exe tntnht.exe PID 2792 wrote to memory of 2624 2792 llrlrrx.exe tntnht.exe PID 2624 wrote to memory of 2492 2624 tntnht.exe jvdvv.exe PID 2624 wrote to memory of 2492 2624 tntnht.exe jvdvv.exe PID 2624 wrote to memory of 2492 2624 tntnht.exe jvdvv.exe PID 2624 wrote to memory of 2492 2624 tntnht.exe jvdvv.exe PID 2492 wrote to memory of 2948 2492 jvdvv.exe bnbhtt.exe PID 2492 wrote to memory of 2948 2492 jvdvv.exe bnbhtt.exe PID 2492 wrote to memory of 2948 2492 jvdvv.exe bnbhtt.exe PID 2492 wrote to memory of 2948 2492 jvdvv.exe bnbhtt.exe PID 2948 wrote to memory of 2476 2948 bnbhtt.exe vppdp.exe PID 2948 wrote to memory of 2476 2948 bnbhtt.exe vppdp.exe PID 2948 wrote to memory of 2476 2948 bnbhtt.exe vppdp.exe PID 2948 wrote to memory of 2476 2948 bnbhtt.exe vppdp.exe PID 2476 wrote to memory of 2820 2476 vppdp.exe 7rxxffl.exe PID 2476 wrote to memory of 2820 2476 vppdp.exe 7rxxffl.exe PID 2476 wrote to memory of 2820 2476 vppdp.exe 7rxxffl.exe PID 2476 wrote to memory of 2820 2476 vppdp.exe 7rxxffl.exe PID 2820 wrote to memory of 928 2820 7rxxffl.exe bbnnhn.exe PID 2820 wrote to memory of 928 2820 7rxxffl.exe bbnnhn.exe PID 2820 wrote to memory of 928 2820 7rxxffl.exe bbnnhn.exe PID 2820 wrote to memory of 928 2820 7rxxffl.exe bbnnhn.exe PID 928 wrote to memory of 2804 928 bbnnhn.exe 9pvpd.exe PID 928 wrote to memory of 2804 928 bbnnhn.exe 9pvpd.exe PID 928 wrote to memory of 2804 928 bbnnhn.exe 9pvpd.exe PID 928 wrote to memory of 2804 928 bbnnhn.exe 9pvpd.exe PID 2804 wrote to memory of 1460 2804 9pvpd.exe xxllrxl.exe PID 2804 wrote to memory of 1460 2804 9pvpd.exe xxllrxl.exe PID 2804 wrote to memory of 1460 2804 9pvpd.exe xxllrxl.exe PID 2804 wrote to memory of 1460 2804 9pvpd.exe xxllrxl.exe PID 1460 wrote to memory of 3060 1460 xxllrxl.exe 9nhnth.exe PID 1460 wrote to memory of 3060 1460 xxllrxl.exe 9nhnth.exe PID 1460 wrote to memory of 3060 1460 xxllrxl.exe 9nhnth.exe PID 1460 wrote to memory of 3060 1460 xxllrxl.exe 9nhnth.exe PID 3060 wrote to memory of 2184 3060 9nhnth.exe 5ddvv.exe PID 3060 wrote to memory of 2184 3060 9nhnth.exe 5ddvv.exe PID 3060 wrote to memory of 2184 3060 9nhnth.exe 5ddvv.exe PID 3060 wrote to memory of 2184 3060 9nhnth.exe 5ddvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe"C:\Users\Admin\AppData\Local\Temp\dbf04b99da3490327b583b18dc7f295cf027b6876cd2c2305b00a484e8359a82.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\vvjjp.exec:\vvjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\nhthbh.exec:\nhthbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\rrfrxrx.exec:\rrfrxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\tbtbbt.exec:\tbtbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\vdvdj.exec:\vdvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\llrlrrx.exec:\llrlrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\tntnht.exec:\tntnht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\jvdvv.exec:\jvdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\bnbhtt.exec:\bnbhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\vppdp.exec:\vppdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\7rxxffl.exec:\7rxxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\bbnnhn.exec:\bbnnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\9pvpd.exec:\9pvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\xxllrxl.exec:\xxllrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\9nhnth.exec:\9nhnth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\5ddvv.exec:\5ddvv.exe17⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rlxxflr.exec:\rlxxflr.exe18⤵
- Executes dropped EXE
PID:932 -
\??\c:\5nbbbb.exec:\5nbbbb.exe19⤵
- Executes dropped EXE
PID:2344 -
\??\c:\9jdpv.exec:\9jdpv.exe20⤵
- Executes dropped EXE
PID:2852 -
\??\c:\ntthnb.exec:\ntthnb.exe21⤵
- Executes dropped EXE
PID:844 -
\??\c:\jvddd.exec:\jvddd.exe22⤵
- Executes dropped EXE
PID:1652 -
\??\c:\tbnbhh.exec:\tbnbhh.exe23⤵
- Executes dropped EXE
PID:652 -
\??\c:\jvdjj.exec:\jvdjj.exe24⤵
- Executes dropped EXE
PID:2052 -
\??\c:\frflllr.exec:\frflllr.exe25⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nbnttb.exec:\nbnttb.exe26⤵
- Executes dropped EXE
PID:1540 -
\??\c:\dpvvv.exec:\dpvvv.exe27⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rlxflrf.exec:\rlxflrf.exe28⤵
- Executes dropped EXE
PID:1160 -
\??\c:\3bhhhb.exec:\3bhhhb.exe29⤵
- Executes dropped EXE
PID:1060 -
\??\c:\jjdjv.exec:\jjdjv.exe30⤵
- Executes dropped EXE
PID:2208 -
\??\c:\1xfllrr.exec:\1xfllrr.exe31⤵
- Executes dropped EXE
PID:2888 -
\??\c:\btbtnn.exec:\btbtnn.exe32⤵
- Executes dropped EXE
PID:1164 -
\??\c:\jjdjp.exec:\jjdjp.exe33⤵
- Executes dropped EXE
PID:1916 -
\??\c:\llfrfxr.exec:\llfrfxr.exe34⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tbbbnb.exec:\tbbbnb.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hbtbbt.exec:\hbtbbt.exe36⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jvjdj.exec:\jvjdj.exe37⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5xffffl.exec:\5xffffl.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7bbhbn.exec:\7bbhbn.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dvjjv.exec:\dvjjv.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jdpdd.exec:\jdpdd.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xxrflxr.exec:\xxrflxr.exe42⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rrlfrxr.exec:\rrlfrxr.exe43⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nbhhtb.exec:\nbhhtb.exe44⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pdppp.exec:\pdppp.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\7dppp.exec:\7dppp.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9rllrrx.exec:\9rllrrx.exe47⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bnbbnh.exec:\bnbbnh.exe48⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7bbbnb.exec:\7bbbnb.exe49⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pjddj.exec:\pjddj.exe50⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxrxffr.exec:\fxrxffr.exe51⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9ffflfl.exec:\9ffflfl.exe52⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nhnbhh.exec:\nhnbhh.exe53⤵
- Executes dropped EXE
PID:2816 -
\??\c:\htthbt.exec:\htthbt.exe54⤵
- Executes dropped EXE
PID:2636 -
\??\c:\7vpvp.exec:\7vpvp.exe55⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rrrxrlf.exec:\rrrxrlf.exe56⤵
- Executes dropped EXE
PID:1972 -
\??\c:\9rlrxxx.exec:\9rlrxxx.exe57⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tnhthn.exec:\tnhthn.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nbhbtb.exec:\nbhbtb.exe59⤵
- Executes dropped EXE
PID:1008 -
\??\c:\dvppd.exec:\dvppd.exe60⤵
- Executes dropped EXE
PID:272 -
\??\c:\1dvdd.exec:\1dvdd.exe61⤵
- Executes dropped EXE
PID:844 -
\??\c:\lxlfllf.exec:\lxlfllf.exe62⤵
- Executes dropped EXE
PID:788 -
\??\c:\9bbbbb.exec:\9bbbbb.exe63⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bnbntt.exec:\bnbntt.exe64⤵
- Executes dropped EXE
PID:1476 -
\??\c:\1jvjp.exec:\1jvjp.exe65⤵
- Executes dropped EXE
PID:840 -
\??\c:\5frxfll.exec:\5frxfll.exe66⤵PID:1968
-
\??\c:\xlfflfr.exec:\xlfflfr.exe67⤵PID:1988
-
\??\c:\nhbhnb.exec:\nhbhnb.exe68⤵PID:2264
-
\??\c:\vvvdd.exec:\vvvdd.exe69⤵PID:1624
-
\??\c:\pvvpp.exec:\pvvpp.exe70⤵PID:1840
-
\??\c:\fxllllr.exec:\fxllllr.exe71⤵PID:2256
-
\??\c:\5lflrrf.exec:\5lflrrf.exe72⤵PID:2368
-
\??\c:\hbntbh.exec:\hbntbh.exe73⤵PID:1512
-
\??\c:\thtbhb.exec:\thtbhb.exe74⤵PID:1164
-
\??\c:\vjdvp.exec:\vjdvp.exe75⤵PID:2376
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe76⤵PID:1580
-
\??\c:\llflfll.exec:\llflfll.exe77⤵PID:1524
-
\??\c:\5nbhnh.exec:\5nbhnh.exe78⤵PID:3048
-
\??\c:\5pvvd.exec:\5pvvd.exe79⤵PID:3068
-
\??\c:\dpdjp.exec:\dpdjp.exe80⤵PID:2564
-
\??\c:\rxrfxlf.exec:\rxrfxlf.exe81⤵PID:2744
-
\??\c:\1tnbnt.exec:\1tnbnt.exe82⤵PID:2732
-
\??\c:\btbhnn.exec:\btbhnn.exe83⤵PID:2592
-
\??\c:\jjvpp.exec:\jjvpp.exe84⤵PID:2780
-
\??\c:\5vjjp.exec:\5vjjp.exe85⤵PID:2488
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe86⤵PID:2572
-
\??\c:\1htbnb.exec:\1htbnb.exe87⤵PID:2940
-
\??\c:\5bnhnn.exec:\5bnhnn.exe88⤵PID:2504
-
\??\c:\pdpjp.exec:\pdpjp.exe89⤵PID:2528
-
\??\c:\3xlfffl.exec:\3xlfffl.exe90⤵PID:936
-
\??\c:\rfxrffr.exec:\rfxrffr.exe91⤵PID:2820
-
\??\c:\htbhhh.exec:\htbhhh.exe92⤵PID:2644
-
\??\c:\thnhhh.exec:\thnhhh.exe93⤵PID:800
-
\??\c:\pdvdv.exec:\pdvdv.exe94⤵PID:940
-
\??\c:\xrlflrx.exec:\xrlflrx.exe95⤵PID:1460
-
\??\c:\rrfffxf.exec:\rrfffxf.exe96⤵PID:1628
-
\??\c:\hbnbbb.exec:\hbnbbb.exe97⤵PID:1688
-
\??\c:\tntnnt.exec:\tntnnt.exe98⤵PID:1780
-
\??\c:\dpddj.exec:\dpddj.exe99⤵PID:1092
-
\??\c:\xlrlxrx.exec:\xlrlxrx.exe100⤵PID:536
-
\??\c:\rlrxlfl.exec:\rlrxlfl.exe101⤵PID:324
-
\??\c:\btbttt.exec:\btbttt.exe102⤵PID:588
-
\??\c:\ntbbhh.exec:\ntbbhh.exe103⤵PID:1996
-
\??\c:\dvdvv.exec:\dvdvv.exe104⤵PID:1888
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe105⤵PID:1036
-
\??\c:\xrfffxl.exec:\xrfffxl.exe106⤵PID:2304
-
\??\c:\htttbb.exec:\htttbb.exe107⤵PID:1664
-
\??\c:\dpvvp.exec:\dpvvp.exe108⤵PID:1884
-
\??\c:\3jjpj.exec:\3jjpj.exe109⤵PID:1680
-
\??\c:\1xrffrf.exec:\1xrffrf.exe110⤵PID:968
-
\??\c:\btnntt.exec:\btnntt.exe111⤵PID:3040
-
\??\c:\bttnnt.exec:\bttnnt.exe112⤵PID:1064
-
\??\c:\jdpvv.exec:\jdpvv.exe113⤵PID:2208
-
\??\c:\jvjpv.exec:\jvjpv.exe114⤵PID:2364
-
\??\c:\fffxflx.exec:\fffxflx.exe115⤵PID:1768
-
\??\c:\rrxxflf.exec:\rrxxflf.exe116⤵PID:2384
-
\??\c:\bthhtb.exec:\bthhtb.exe117⤵PID:2200
-
\??\c:\jjdpj.exec:\jjdpj.exe118⤵PID:1612
-
\??\c:\vdppv.exec:\vdppv.exe119⤵PID:1720
-
\??\c:\rlfllrf.exec:\rlfllrf.exe120⤵PID:2152
-
\??\c:\fxllrrl.exec:\fxllrrl.exe121⤵PID:3012
-
\??\c:\pvjpd.exec:\pvjpd.exe122⤵PID:2736
-
\??\c:\xfxllfx.exec:\xfxllfx.exe123⤵PID:2664
-
\??\c:\rrlxffl.exec:\rrlxffl.exe124⤵PID:2604
-
\??\c:\bttbbh.exec:\bttbbh.exe125⤵PID:2640
-
\??\c:\jjjjj.exec:\jjjjj.exe126⤵PID:2792
-
\??\c:\lllrxfr.exec:\lllrxfr.exe127⤵PID:2772
-
\??\c:\5rlrxlr.exec:\5rlrxlr.exe128⤵PID:2480
-
\??\c:\btbhbn.exec:\btbhbn.exe129⤵PID:1568
-
\??\c:\nbbnbt.exec:\nbbnbt.exe130⤵PID:2308
-
\??\c:\jvppp.exec:\jvppp.exe131⤵PID:2476
-
\??\c:\1rffllr.exec:\1rffllr.exe132⤵PID:2964
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe133⤵PID:1308
-
\??\c:\nnhhnn.exec:\nnhhnn.exe134⤵PID:2724
-
\??\c:\vjjpp.exec:\vjjpp.exe135⤵PID:2440
-
\??\c:\vvvvp.exec:\vvvvp.exe136⤵PID:2812
-
\??\c:\9rfrfff.exec:\9rfrfff.exe137⤵PID:3060
-
\??\c:\rlrxrfl.exec:\rlrxrfl.exe138⤵PID:2972
-
\??\c:\ththtb.exec:\ththtb.exe139⤵PID:2980
-
\??\c:\3pvjv.exec:\3pvjv.exe140⤵PID:2184
-
\??\c:\vjdpv.exec:\vjdpv.exe141⤵PID:320
-
\??\c:\rrlxrxf.exec:\rrlxrxf.exe142⤵PID:1748
-
\??\c:\tthntb.exec:\tthntb.exe143⤵PID:2432
-
\??\c:\hnhnbh.exec:\hnhnbh.exe144⤵PID:272
-
\??\c:\jjvdj.exec:\jjvdj.exe145⤵PID:1504
-
\??\c:\xrlxflx.exec:\xrlxflx.exe146⤵PID:1224
-
\??\c:\thttht.exec:\thttht.exe147⤵PID:384
-
\??\c:\jdppd.exec:\jdppd.exe148⤵PID:2140
-
\??\c:\7pdvv.exec:\7pdvv.exe149⤵PID:840
-
\??\c:\xrxrfxf.exec:\xrxrfxf.exe150⤵PID:1816
-
\??\c:\1htbhh.exec:\1htbhh.exe151⤵PID:1988
-
\??\c:\nbhnbb.exec:\nbhnbb.exe152⤵PID:2264
-
\??\c:\9jjpj.exec:\9jjpj.exe153⤵PID:1624
-
\??\c:\dpvdj.exec:\dpvdj.exe154⤵PID:2872
-
\??\c:\rfrlrlr.exec:\rfrlrlr.exe155⤵PID:2256
-
\??\c:\hbhhnn.exec:\hbhhnn.exe156⤵PID:1700
-
\??\c:\thbbbb.exec:\thbbbb.exe157⤵PID:2924
-
\??\c:\vpdvv.exec:\vpdvv.exe158⤵PID:1164
-
\??\c:\xxlllfl.exec:\xxlllfl.exe159⤵PID:1608
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe160⤵PID:1580
-
\??\c:\hbtntt.exec:\hbtntt.exe161⤵PID:2824
-
\??\c:\5ddpd.exec:\5ddpd.exe162⤵PID:3032
-
\??\c:\vdppp.exec:\vdppp.exe163⤵PID:3068
-
\??\c:\rlxfllr.exec:\rlxfllr.exe164⤵PID:2564
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe165⤵PID:2744
-
\??\c:\nhbbnb.exec:\nhbbnb.exe166⤵PID:2496
-
\??\c:\9bthnb.exec:\9bthnb.exe167⤵PID:2592
-
\??\c:\1dpvd.exec:\1dpvd.exe168⤵PID:2760
-
\??\c:\vvdjp.exec:\vvdjp.exe169⤵PID:1908
-
\??\c:\xrlrfrx.exec:\xrlrfrx.exe170⤵PID:2500
-
\??\c:\tththt.exec:\tththt.exe171⤵PID:2940
-
\??\c:\btnnbn.exec:\btnnbn.exe172⤵PID:2956
-
\??\c:\ppvvv.exec:\ppvvv.exe173⤵PID:2528
-
\??\c:\5fxlrxf.exec:\5fxlrxf.exe174⤵PID:936
-
\??\c:\lxrxflr.exec:\lxrxflr.exe175⤵PID:2820
-
\??\c:\hthtbt.exec:\hthtbt.exe176⤵PID:2644
-
\??\c:\7jjjp.exec:\7jjjp.exe177⤵PID:1752
-
\??\c:\pjpvv.exec:\pjpvv.exe178⤵PID:2920
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe179⤵PID:1460
-
\??\c:\5xfxlrx.exec:\5xfxlrx.exe180⤵PID:1584
-
\??\c:\nhbnhh.exec:\nhbnhh.exe181⤵PID:1688
-
\??\c:\5ppvj.exec:\5ppvj.exe182⤵PID:932
-
\??\c:\jjvvd.exec:\jjvvd.exe183⤵PID:1404
-
\??\c:\fllfxfr.exec:\fllfxfr.exe184⤵PID:1208
-
\??\c:\hhthnh.exec:\hhthnh.exe185⤵PID:1464
-
\??\c:\hnnbhb.exec:\hnnbhb.exe186⤵PID:588
-
\??\c:\5vppd.exec:\5vppd.exe187⤵PID:788
-
\??\c:\rfrrxfr.exec:\rfrrxfr.exe188⤵PID:1924
-
\??\c:\flrrrxx.exec:\flrrrxx.exe189⤵PID:1636
-
\??\c:\nhttnn.exec:\nhttnn.exe190⤵PID:1800
-
\??\c:\vpjpp.exec:\vpjpp.exe191⤵PID:1104
-
\??\c:\dpjpj.exec:\dpjpj.exe192⤵PID:1892
-
\??\c:\lrfxlrx.exec:\lrfxlrx.exe193⤵PID:1884
-
\??\c:\tbbttb.exec:\tbbttb.exe194⤵PID:900
-
\??\c:\dpddv.exec:\dpddv.exe195⤵PID:1160
-
\??\c:\7lllxfr.exec:\7lllxfr.exe196⤵PID:1416
-
\??\c:\frxfrrx.exec:\frxfrrx.exe197⤵PID:1176
-
\??\c:\thhtth.exec:\thhtth.exe198⤵PID:892
-
\??\c:\nhbbnt.exec:\nhbbnt.exe199⤵PID:1512
-
\??\c:\vpdjv.exec:\vpdjv.exe200⤵PID:848
-
\??\c:\lxfrlrl.exec:\lxfrlrl.exe201⤵PID:2916
-
\??\c:\5tntbt.exec:\5tntbt.exe202⤵PID:2988
-
\??\c:\bthhtt.exec:\bthhtt.exe203⤵PID:2788
-
\??\c:\pvpvd.exec:\pvpvd.exe204⤵PID:3048
-
\??\c:\7xlxfxr.exec:\7xlxfxr.exe205⤵PID:2244
-
\??\c:\fxrflll.exec:\fxrflll.exe206⤵PID:2740
-
\??\c:\htbhhb.exec:\htbhhb.exe207⤵PID:2868
-
\??\c:\htnnnt.exec:\htnnnt.exe208⤵PID:2612
-
\??\c:\ddpvv.exec:\ddpvv.exe209⤵PID:2484
-
\??\c:\xrrrfff.exec:\xrrrfff.exe210⤵PID:2640
-
\??\c:\ntnbhh.exec:\ntnbhh.exe211⤵PID:2752
-
\??\c:\nnnhth.exec:\nnnhth.exe212⤵PID:1836
-
\??\c:\jdpvd.exec:\jdpvd.exe213⤵PID:2952
-
\??\c:\xrfxfrr.exec:\xrfxfrr.exe214⤵PID:2836
-
\??\c:\1lflxfl.exec:\1lflxfl.exe215⤵PID:2520
-
\??\c:\5ttbtb.exec:\5ttbtb.exe216⤵PID:2548
-
\??\c:\jvjjj.exec:\jvjjj.exe217⤵PID:1312
-
\??\c:\7llflfr.exec:\7llflfr.exe218⤵PID:2008
-
\??\c:\rxrxlfr.exec:\rxrxlfr.exe219⤵PID:2976
-
\??\c:\bnnnnn.exec:\bnnnnn.exe220⤵PID:940
-
\??\c:\7tthtn.exec:\7tthtn.exe221⤵PID:1708
-
\??\c:\ppdpj.exec:\ppdpj.exe222⤵PID:1692
-
\??\c:\rrflfrl.exec:\rrflfrl.exe223⤵PID:1684
-
\??\c:\bnthhb.exec:\bnthhb.exe224⤵PID:628
-
\??\c:\nhnnnt.exec:\nhnnnt.exe225⤵PID:1092
-
\??\c:\ddvdv.exec:\ddvdv.exe226⤵PID:692
-
\??\c:\rlfrlrx.exec:\rlfrlrx.exe227⤵PID:1748
-
\??\c:\fllflrf.exec:\fllflrf.exe228⤵PID:2252
-
\??\c:\ttntnn.exec:\ttntnn.exe229⤵PID:1996
-
\??\c:\pdpjp.exec:\pdpjp.exe230⤵PID:1268
-
\??\c:\3jjpj.exec:\3jjpj.exe231⤵PID:1036
-
\??\c:\rxfxxlf.exec:\rxfxxlf.exe232⤵PID:2304
-
\??\c:\nbnttn.exec:\nbnttn.exe233⤵PID:2224
-
\??\c:\9thnnn.exec:\9thnnn.exe234⤵PID:1936
-
\??\c:\3pjjp.exec:\3pjjp.exe235⤵PID:1056
-
\??\c:\fxlfrxf.exec:\fxlfrxf.exe236⤵PID:2272
-
\??\c:\fxllxfl.exec:\fxllxfl.exe237⤵PID:2880
-
\??\c:\tnhhhn.exec:\tnhhhn.exe238⤵PID:3008
-
\??\c:\7pdjj.exec:\7pdjj.exe239⤵PID:2112
-
\??\c:\djvdd.exec:\djvdd.exe240⤵PID:1620
-
\??\c:\frrfllr.exec:\frrfllr.exe241⤵PID:2888
-
\??\c:\ttnhtt.exec:\ttnhtt.exe242⤵PID:1768