Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 18:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00e950cc37bcaa714564cdf9c008c7157e05f71f16de23cb447fce98d41f0c36.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
00e950cc37bcaa714564cdf9c008c7157e05f71f16de23cb447fce98d41f0c36.exe
-
Size
68KB
-
MD5
c6091f34cb6f278c1d9fa3b8a47c359c
-
SHA1
cedbef08200d3b701f2233bd446e783f7dbe8083
-
SHA256
00e950cc37bcaa714564cdf9c008c7157e05f71f16de23cb447fce98d41f0c36
-
SHA512
dc6abbbdecf761923d417845a6fde001e99a768172b8d5e8b8e643245b621758984caecbe3340385375d84f7b31e152a504dc629babb2581a6bcb9bdd6e5cf59
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89m:ymb3NkkiQ3mdBjFIvl358nLA89m
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2244-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
Processes:
resource yara_rule behavioral1/memory/2244-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1844-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2692-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2692-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2148-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2080-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2640-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2236-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1956-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/808-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1696-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2784-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1440-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2040-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1256-246-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1836-255-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1764-264-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/892-300-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vpjpj.exellxrxxl.exenhhnbh.exedvpdj.exe5fflxrx.exe1frxxxf.exe9ntnnh.exejdppv.exevjpdj.exelxflrll.exehbtbhb.exe9btthh.exe1djvd.exedjjdv.exe9frxxff.exettbbhn.exethbbtn.exejdjdp.exedpdjp.exe9rxxfll.exebtntbb.exehntnhh.exe5vdvd.exepdpdd.exexxfxxfx.exebnhnbh.exe9vjdd.exevjvjv.exellfxlxl.exe7rrrxxf.exehbbhbn.exedvdpj.exexrfrxrf.exe9fxxffl.exenhnttt.exe5nbhnn.exedvvjp.exe9xfffrx.exebbbbnh.exe7jvjp.exedpvvv.exeffxrrrf.exefxrfrfr.exenhtbhb.exebbtbnb.exejdppv.exerflllff.exexlrlxxf.exenhhnhh.exejvddp.exevpvpv.exerlrfllr.exefxlrrxf.exethhhtb.exe5djpv.exepdpjp.exelfrrfxl.exellrllfx.exethhbhb.exehttnnh.exejvppv.exevjvvd.exelrrlrll.exe1xfxxlf.exepid process 1844 vpjpj.exe 2380 llxrxxl.exe 2692 nhhnbh.exe 2148 dvpdj.exe 2080 5fflxrx.exe 2640 1frxxxf.exe 2504 9ntnnh.exe 2236 jdppv.exe 1956 vjpdj.exe 2648 lxflrll.exe 808 hbtbhb.exe 1696 9btthh.exe 1668 1djvd.exe 2784 djjdv.exe 2820 9frxxff.exe 1440 ttbbhn.exe 2796 thbbtn.exe 2040 jdjdp.exe 2696 dpdjp.exe 536 9rxxfll.exe 1008 btntbb.exe 1660 hntnhh.exe 2964 5vdvd.exe 2096 pdpdd.exe 1256 xxfxxfx.exe 1836 bnhnbh.exe 1764 9vjdd.exe 1452 vjvjv.exe 1896 llfxlxl.exe 1280 7rrrxxf.exe 892 hbbhbn.exe 3004 dvdpj.exe 2392 xrfrxrf.exe 2280 9fxxffl.exe 2092 nhnttt.exe 2372 5nbhnn.exe 2600 dvvjp.exe 2720 9xfffrx.exe 2508 bbbbnh.exe 2404 7jvjp.exe 2432 dpvvv.exe 2528 ffxrrrf.exe 2492 fxrfrfr.exe 2212 nhtbhb.exe 2236 bbtbnb.exe 1956 jdppv.exe 1904 rflllff.exe 1928 xlrlxxf.exe 1968 nhhnhh.exe 2448 jvddp.exe 2708 vpvpv.exe 2656 rlrfllr.exe 1576 fxlrrxf.exe 2652 thhhtb.exe 2852 5djpv.exe 2912 pdpjp.exe 2072 lfrrfxl.exe 1220 llrllfx.exe 324 thhbhb.exe 480 httnnh.exe 1512 jvppv.exe 664 vjvvd.exe 1740 lrrlrll.exe 1056 1xfxxlf.exe -
Processes:
resource yara_rule behavioral1/memory/2244-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
00e950cc37bcaa714564cdf9c008c7157e05f71f16de23cb447fce98d41f0c36.exevpjpj.exellxrxxl.exenhhnbh.exedvpdj.exe5fflxrx.exe1frxxxf.exe9ntnnh.exejdppv.exevjpdj.exelxflrll.exehbtbhb.exe9btthh.exe1djvd.exedjjdv.exe9frxxff.exedescription pid process target process PID 2244 wrote to memory of 1844 2244 00e950cc37bcaa714564cdf9c008c7157e05f71f16de23cb447fce98d41f0c36.exe vpjpj.exe PID 2244 wrote to memory of 1844 2244 00e950cc37bcaa714564cdf9c008c7157e05f71f16de23cb447fce98d41f0c36.exe vpjpj.exe PID 2244 wrote to memory of 1844 2244 00e950cc37bcaa714564cdf9c008c7157e05f71f16de23cb447fce98d41f0c36.exe vpjpj.exe PID 2244 wrote to memory of 1844 2244 00e950cc37bcaa714564cdf9c008c7157e05f71f16de23cb447fce98d41f0c36.exe vpjpj.exe PID 1844 wrote to memory of 2380 1844 vpjpj.exe llxrxxl.exe PID 1844 wrote to memory of 2380 1844 vpjpj.exe llxrxxl.exe PID 1844 wrote to memory of 2380 1844 vpjpj.exe llxrxxl.exe PID 1844 wrote to memory of 2380 1844 vpjpj.exe llxrxxl.exe PID 2380 wrote to memory of 2692 2380 llxrxxl.exe nhhnbh.exe PID 2380 wrote to memory of 2692 2380 llxrxxl.exe nhhnbh.exe PID 2380 wrote to memory of 2692 2380 llxrxxl.exe nhhnbh.exe PID 2380 wrote to memory of 2692 2380 llxrxxl.exe nhhnbh.exe PID 2692 wrote to memory of 2148 2692 nhhnbh.exe dvpdj.exe PID 2692 wrote to memory of 2148 2692 nhhnbh.exe dvpdj.exe PID 2692 wrote to memory of 2148 2692 nhhnbh.exe dvpdj.exe PID 2692 wrote to memory of 2148 2692 nhhnbh.exe dvpdj.exe PID 2148 wrote to memory of 2080 2148 dvpdj.exe 5fflxrx.exe PID 2148 wrote to memory of 2080 2148 dvpdj.exe 5fflxrx.exe PID 2148 wrote to memory of 2080 2148 dvpdj.exe 5fflxrx.exe PID 2148 wrote to memory of 2080 2148 dvpdj.exe 5fflxrx.exe PID 2080 wrote to memory of 2640 2080 5fflxrx.exe 1frxxxf.exe PID 2080 wrote to memory of 2640 2080 5fflxrx.exe 1frxxxf.exe PID 2080 wrote to memory of 2640 2080 5fflxrx.exe 1frxxxf.exe PID 2080 wrote to memory of 2640 2080 5fflxrx.exe 1frxxxf.exe PID 2640 wrote to memory of 2504 2640 1frxxxf.exe 9ntnnh.exe PID 2640 wrote to memory of 2504 2640 1frxxxf.exe 9ntnnh.exe PID 2640 wrote to memory of 2504 2640 1frxxxf.exe 9ntnnh.exe PID 2640 wrote to memory of 2504 2640 1frxxxf.exe 9ntnnh.exe PID 2504 wrote to memory of 2236 2504 9ntnnh.exe jdppv.exe PID 2504 wrote to memory of 2236 2504 9ntnnh.exe jdppv.exe PID 2504 wrote to memory of 2236 2504 9ntnnh.exe jdppv.exe PID 2504 wrote to memory of 2236 2504 9ntnnh.exe jdppv.exe PID 2236 wrote to memory of 1956 2236 jdppv.exe vjpdj.exe PID 2236 wrote to memory of 1956 2236 jdppv.exe vjpdj.exe PID 2236 wrote to memory of 1956 2236 jdppv.exe vjpdj.exe PID 2236 wrote to memory of 1956 2236 jdppv.exe vjpdj.exe PID 1956 wrote to memory of 2648 1956 vjpdj.exe lxflrll.exe PID 1956 wrote to memory of 2648 1956 vjpdj.exe lxflrll.exe PID 1956 wrote to memory of 2648 1956 vjpdj.exe lxflrll.exe PID 1956 wrote to memory of 2648 1956 vjpdj.exe lxflrll.exe PID 2648 wrote to memory of 808 2648 lxflrll.exe hbtbhb.exe PID 2648 wrote to memory of 808 2648 lxflrll.exe hbtbhb.exe PID 2648 wrote to memory of 808 2648 lxflrll.exe hbtbhb.exe PID 2648 wrote to memory of 808 2648 lxflrll.exe hbtbhb.exe PID 808 wrote to memory of 1696 808 hbtbhb.exe 9btthh.exe PID 808 wrote to memory of 1696 808 hbtbhb.exe 9btthh.exe PID 808 wrote to memory of 1696 808 hbtbhb.exe 9btthh.exe PID 808 wrote to memory of 1696 808 hbtbhb.exe 9btthh.exe PID 1696 wrote to memory of 1668 1696 9btthh.exe 1djvd.exe PID 1696 wrote to memory of 1668 1696 9btthh.exe 1djvd.exe PID 1696 wrote to memory of 1668 1696 9btthh.exe 1djvd.exe PID 1696 wrote to memory of 1668 1696 9btthh.exe 1djvd.exe PID 1668 wrote to memory of 2784 1668 1djvd.exe djjdv.exe PID 1668 wrote to memory of 2784 1668 1djvd.exe djjdv.exe PID 1668 wrote to memory of 2784 1668 1djvd.exe djjdv.exe PID 1668 wrote to memory of 2784 1668 1djvd.exe djjdv.exe PID 2784 wrote to memory of 2820 2784 djjdv.exe 9frxxff.exe PID 2784 wrote to memory of 2820 2784 djjdv.exe 9frxxff.exe PID 2784 wrote to memory of 2820 2784 djjdv.exe 9frxxff.exe PID 2784 wrote to memory of 2820 2784 djjdv.exe 9frxxff.exe PID 2820 wrote to memory of 1440 2820 9frxxff.exe ttbbhn.exe PID 2820 wrote to memory of 1440 2820 9frxxff.exe ttbbhn.exe PID 2820 wrote to memory of 1440 2820 9frxxff.exe ttbbhn.exe PID 2820 wrote to memory of 1440 2820 9frxxff.exe ttbbhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00e950cc37bcaa714564cdf9c008c7157e05f71f16de23cb447fce98d41f0c36.exe"C:\Users\Admin\AppData\Local\Temp\00e950cc37bcaa714564cdf9c008c7157e05f71f16de23cb447fce98d41f0c36.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\vpjpj.exec:\vpjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\llxrxxl.exec:\llxrxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\nhhnbh.exec:\nhhnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\dvpdj.exec:\dvpdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\5fflxrx.exec:\5fflxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\1frxxxf.exec:\1frxxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\9ntnnh.exec:\9ntnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jdppv.exec:\jdppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\vjpdj.exec:\vjpdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\lxflrll.exec:\lxflrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hbtbhb.exec:\hbtbhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\9btthh.exec:\9btthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\1djvd.exec:\1djvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\djjdv.exec:\djjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\9frxxff.exec:\9frxxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\ttbbhn.exec:\ttbbhn.exe17⤵
- Executes dropped EXE
PID:1440 -
\??\c:\thbbtn.exec:\thbbtn.exe18⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jdjdp.exec:\jdjdp.exe19⤵
- Executes dropped EXE
PID:2040 -
\??\c:\dpdjp.exec:\dpdjp.exe20⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9rxxfll.exec:\9rxxfll.exe21⤵
- Executes dropped EXE
PID:536 -
\??\c:\btntbb.exec:\btntbb.exe22⤵
- Executes dropped EXE
PID:1008 -
\??\c:\hntnhh.exec:\hntnhh.exe23⤵
- Executes dropped EXE
PID:1660 -
\??\c:\5vdvd.exec:\5vdvd.exe24⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pdpdd.exec:\pdpdd.exe25⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xxfxxfx.exec:\xxfxxfx.exe26⤵
- Executes dropped EXE
PID:1256 -
\??\c:\bnhnbh.exec:\bnhnbh.exe27⤵
- Executes dropped EXE
PID:1836 -
\??\c:\9vjdd.exec:\9vjdd.exe28⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vjvjv.exec:\vjvjv.exe29⤵
- Executes dropped EXE
PID:1452 -
\??\c:\llfxlxl.exec:\llfxlxl.exe30⤵
- Executes dropped EXE
PID:1896 -
\??\c:\7rrrxxf.exec:\7rrrxxf.exe31⤵
- Executes dropped EXE
PID:1280 -
\??\c:\hbbhbn.exec:\hbbhbn.exe32⤵
- Executes dropped EXE
PID:892 -
\??\c:\dvdpj.exec:\dvdpj.exe33⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xrfrxrf.exec:\xrfrxrf.exe34⤵
- Executes dropped EXE
PID:2392 -
\??\c:\9fxxffl.exec:\9fxxffl.exe35⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nhnttt.exec:\nhnttt.exe36⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5nbhnn.exec:\5nbhnn.exe37⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dvvjp.exec:\dvvjp.exe38⤵
- Executes dropped EXE
PID:2600 -
\??\c:\9xfffrx.exec:\9xfffrx.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bbbbnh.exec:\bbbbnh.exe40⤵
- Executes dropped EXE
PID:2508 -
\??\c:\7jvjp.exec:\7jvjp.exe41⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dpvvv.exec:\dpvvv.exe42⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ffxrrrf.exec:\ffxrrrf.exe43⤵
- Executes dropped EXE
PID:2528 -
\??\c:\fxrfrfr.exec:\fxrfrfr.exe44⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nhtbhb.exec:\nhtbhb.exe45⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bbtbnb.exec:\bbtbnb.exe46⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jdppv.exec:\jdppv.exe47⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rflllff.exec:\rflllff.exe48⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xlrlxxf.exec:\xlrlxxf.exe49⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nhhnhh.exec:\nhhnhh.exe50⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jvddp.exec:\jvddp.exe51⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vpvpv.exec:\vpvpv.exe52⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rlrfllr.exec:\rlrfllr.exe53⤵
- Executes dropped EXE
PID:2656 -
\??\c:\fxlrrxf.exec:\fxlrrxf.exe54⤵
- Executes dropped EXE
PID:1576 -
\??\c:\thhhtb.exec:\thhhtb.exe55⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5djpv.exec:\5djpv.exe56⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pdpjp.exec:\pdpjp.exe57⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lfrrfxl.exec:\lfrrfxl.exe58⤵
- Executes dropped EXE
PID:2072 -
\??\c:\llrllfx.exec:\llrllfx.exe59⤵
- Executes dropped EXE
PID:1220 -
\??\c:\thhbhb.exec:\thhbhb.exe60⤵
- Executes dropped EXE
PID:324 -
\??\c:\httnnh.exec:\httnnh.exe61⤵
- Executes dropped EXE
PID:480 -
\??\c:\jvppv.exec:\jvppv.exe62⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vjvvd.exec:\vjvvd.exe63⤵
- Executes dropped EXE
PID:664 -
\??\c:\lrrlrll.exec:\lrrlrll.exe64⤵
- Executes dropped EXE
PID:1740 -
\??\c:\1xfxxlf.exec:\1xfxxlf.exe65⤵
- Executes dropped EXE
PID:1056 -
\??\c:\tbnntn.exec:\tbnntn.exe66⤵PID:3068
-
\??\c:\thnnbb.exec:\thnnbb.exe67⤵PID:1680
-
\??\c:\djppp.exec:\djppp.exe68⤵PID:1748
-
\??\c:\3xrrxff.exec:\3xrrxff.exe69⤵PID:1080
-
\??\c:\frrrxrr.exec:\frrrxrr.exe70⤵PID:2316
-
\??\c:\lfrxfxl.exec:\lfrxfxl.exe71⤵PID:2552
-
\??\c:\htttbt.exec:\htttbt.exe72⤵PID:2332
-
\??\c:\bnntnh.exec:\bnntnh.exe73⤵PID:1280
-
\??\c:\pdppj.exec:\pdppj.exe74⤵PID:2428
-
\??\c:\3jvpv.exec:\3jvpv.exe75⤵PID:2352
-
\??\c:\fflfxrl.exec:\fflfxrl.exe76⤵PID:1844
-
\??\c:\tnhhtn.exec:\tnhhtn.exe77⤵PID:1584
-
\??\c:\ttbtbn.exec:\ttbtbn.exe78⤵PID:2576
-
\??\c:\jvvpd.exec:\jvvpd.exe79⤵PID:2732
-
\??\c:\pdjvj.exec:\pdjvj.exe80⤵PID:2620
-
\??\c:\lrxfxxf.exec:\lrxfxxf.exe81⤵PID:2892
-
\??\c:\lfxllfl.exec:\lfxllfl.exe82⤵PID:2572
-
\??\c:\3bnbhb.exec:\3bnbhb.exe83⤵PID:2728
-
\??\c:\tbnbht.exec:\tbnbht.exe84⤵PID:2636
-
\??\c:\vpvpv.exec:\vpvpv.exe85⤵PID:2544
-
\??\c:\5vvdp.exec:\5vvdp.exe86⤵PID:2504
-
\??\c:\5rxrrlx.exec:\5rxrrlx.exe87⤵PID:1924
-
\??\c:\rfxxfll.exec:\rfxxfll.exe88⤵PID:2824
-
\??\c:\thntnn.exec:\thntnn.exe89⤵PID:2832
-
\??\c:\hbttth.exec:\hbttth.exe90⤵PID:1980
-
\??\c:\3vddj.exec:\3vddj.exe91⤵PID:1692
-
\??\c:\jjdvd.exec:\jjdvd.exe92⤵PID:1640
-
\??\c:\vdppp.exec:\vdppp.exe93⤵PID:2840
-
\??\c:\7lrxxfl.exec:\7lrxxfl.exe94⤵PID:1648
-
\??\c:\lffffff.exec:\lffffff.exe95⤵PID:1408
-
\??\c:\tnbbhn.exec:\tnbbhn.exe96⤵PID:2844
-
\??\c:\nhnnnt.exec:\nhnnnt.exe97⤵PID:2992
-
\??\c:\pjddp.exec:\pjddp.exe98⤵PID:1884
-
\??\c:\pddvp.exec:\pddvp.exe99⤵PID:2804
-
\??\c:\1fxxxrr.exec:\1fxxxrr.exe100⤵PID:2456
-
\??\c:\9lxlfll.exec:\9lxlfll.exe101⤵PID:600
-
\??\c:\5ntnnh.exec:\5ntnnh.exe102⤵PID:536
-
\??\c:\nbbttt.exec:\nbbttt.exe103⤵PID:1244
-
\??\c:\tntnhn.exec:\tntnhn.exe104⤵PID:1520
-
\??\c:\dpvpv.exec:\dpvpv.exe105⤵PID:860
-
\??\c:\jvvpv.exec:\jvvpv.exe106⤵PID:412
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe107⤵PID:2112
-
\??\c:\lxxxfxf.exec:\lxxxfxf.exe108⤵PID:112
-
\??\c:\nbhnbh.exec:\nbhnbh.exe109⤵PID:1800
-
\??\c:\tnbbbb.exec:\tnbbbb.exe110⤵PID:2292
-
\??\c:\jvdjd.exec:\jvdjd.exe111⤵PID:3016
-
\??\c:\pjpvj.exec:\pjpvj.exe112⤵PID:1452
-
\??\c:\lxxrlll.exec:\lxxrlll.exe113⤵PID:1788
-
\??\c:\3flllrl.exec:\3flllrl.exe114⤵PID:904
-
\??\c:\5ntbhh.exec:\5ntbhh.exe115⤵PID:2032
-
\??\c:\bntthb.exec:\bntthb.exe116⤵PID:2036
-
\??\c:\pjppv.exec:\pjppv.exe117⤵PID:2044
-
\??\c:\jvddd.exec:\jvddd.exe118⤵PID:1156
-
\??\c:\3xrlllr.exec:\3xrlllr.exe119⤵PID:2000
-
\??\c:\llfrfrf.exec:\llfrfrf.exe120⤵PID:2092
-
\??\c:\7fxffxx.exec:\7fxffxx.exe121⤵PID:2688
-
\??\c:\nhhnbh.exec:\nhhnbh.exe122⤵PID:2624
-
\??\c:\7hbtnt.exec:\7hbtnt.exe123⤵PID:2744
-
\??\c:\jvvpp.exec:\jvvpp.exe124⤵PID:2508
-
\??\c:\pvpjj.exec:\pvpjj.exe125⤵PID:2608
-
\??\c:\rlxrfff.exec:\rlxrfff.exe126⤵PID:2472
-
\??\c:\xrrrxlr.exec:\xrrrxlr.exe127⤵PID:2516
-
\??\c:\hthhhb.exec:\hthhhb.exe128⤵PID:2180
-
\??\c:\nhtbbh.exec:\nhtbbh.exe129⤵PID:2520
-
\??\c:\jjjjv.exec:\jjjjv.exe130⤵PID:1768
-
\??\c:\1jjjp.exec:\1jjjp.exe131⤵PID:1956
-
\??\c:\vpdjv.exec:\vpdjv.exe132⤵PID:1104
-
\??\c:\rlrfxfl.exec:\rlrfxfl.exe133⤵PID:1652
-
\??\c:\rfrfrrr.exec:\rfrfrrr.exe134⤵PID:776
-
\??\c:\bntbnh.exec:\bntbnh.exe135⤵PID:2448
-
\??\c:\9nbtbb.exec:\9nbtbb.exe136⤵PID:2816
-
\??\c:\vdppv.exec:\vdppv.exe137⤵PID:2004
-
\??\c:\vpvdp.exec:\vpvdp.exe138⤵PID:2876
-
\??\c:\pjvjp.exec:\pjvjp.exe139⤵PID:2952
-
\??\c:\rlrrlfl.exec:\rlrrlfl.exe140⤵PID:2288
-
\??\c:\xlllxxx.exec:\xlllxxx.exe141⤵PID:2568
-
\??\c:\bhtthh.exec:\bhtthh.exe142⤵PID:684
-
\??\c:\nhtttt.exec:\nhtttt.exe143⤵PID:1020
-
\??\c:\1djjd.exec:\1djjd.exe144⤵PID:676
-
\??\c:\3jvjp.exec:\3jvjp.exe145⤵PID:784
-
\??\c:\jvjdp.exec:\jvjdp.exe146⤵PID:1992
-
\??\c:\lxrrrlr.exec:\lxrrrlr.exe147⤵PID:2028
-
\??\c:\xxlfrxf.exec:\xxlfrxf.exe148⤵PID:1596
-
\??\c:\5bbttt.exec:\5bbttt.exe149⤵PID:1060
-
\??\c:\nhtbnh.exec:\nhtbnh.exe150⤵PID:1088
-
\??\c:\vjvpv.exec:\vjvpv.exe151⤵PID:376
-
\??\c:\djppd.exec:\djppd.exe152⤵PID:1180
-
\??\c:\3xllrxf.exec:\3xllrxf.exe153⤵PID:1764
-
\??\c:\3flfflf.exec:\3flfflf.exe154⤵PID:1344
-
\??\c:\lfrxfxf.exec:\lfrxfxf.exe155⤵PID:3008
-
\??\c:\9nbhnn.exec:\9nbhnn.exe156⤵PID:2332
-
\??\c:\bntntn.exec:\bntntn.exe157⤵PID:1280
-
\??\c:\dpddj.exec:\dpddj.exe158⤵PID:892
-
\??\c:\jdddd.exec:\jdddd.exe159⤵PID:2352
-
\??\c:\lllxrff.exec:\lllxrff.exe160⤵PID:1616
-
\??\c:\rfxrlll.exec:\rfxrlll.exe161⤵PID:1620
-
\??\c:\btbntb.exec:\btbntb.exe162⤵PID:2252
-
\??\c:\btttbh.exec:\btttbh.exe163⤵PID:2480
-
\??\c:\dvpvj.exec:\dvpvj.exe164⤵PID:2760
-
\??\c:\jdjdd.exec:\jdjdd.exe165⤵PID:2632
-
\??\c:\pdppp.exec:\pdppp.exe166⤵PID:2080
-
\??\c:\5flflfl.exec:\5flflfl.exe167⤵PID:2468
-
\??\c:\3flxxrx.exec:\3flxxrx.exe168⤵PID:2644
-
\??\c:\nthtbh.exec:\nthtbh.exe169⤵PID:2880
-
\??\c:\thhbtn.exec:\thhbtn.exe170⤵PID:2504
-
\??\c:\nbnhhb.exec:\nbnhhb.exe171⤵PID:2356
-
\??\c:\pdjdd.exec:\pdjdd.exe172⤵PID:1944
-
\??\c:\5pvpp.exec:\5pvpp.exe173⤵PID:856
-
\??\c:\xrxxfrr.exec:\xrxxfrr.exe174⤵PID:1980
-
\??\c:\lxffxxf.exec:\lxffxxf.exe175⤵PID:2540
-
\??\c:\9bntnn.exec:\9bntnn.exe176⤵PID:1668
-
\??\c:\nbntbt.exec:\nbntbt.exe177⤵PID:2792
-
\??\c:\9vjpd.exec:\9vjpd.exe178⤵PID:1648
-
\??\c:\jjdvp.exec:\jjdvp.exe179⤵PID:2988
-
\??\c:\jvvvd.exec:\jvvvd.exe180⤵PID:1440
-
\??\c:\frllrrx.exec:\frllrrx.exe181⤵PID:1392
-
\??\c:\9xffxrx.exec:\9xffxrx.exe182⤵PID:1224
-
\??\c:\5thttt.exec:\5thttt.exe183⤵PID:2276
-
\??\c:\bnhbbb.exec:\bnhbbb.exe184⤵PID:2116
-
\??\c:\jdvdd.exec:\jdvdd.exe185⤵PID:580
-
\??\c:\pvdvv.exec:\pvdvv.exe186⤵PID:536
-
\??\c:\jvddj.exec:\jvddj.exe187⤵PID:1008
-
\??\c:\fxrllff.exec:\fxrllff.exe188⤵PID:1520
-
\??\c:\lxfrxrx.exec:\lxfrxrx.exe189⤵PID:1168
-
\??\c:\xxlllrr.exec:\xxlllrr.exe190⤵PID:412
-
\??\c:\3tnhbb.exec:\3tnhbb.exe191⤵PID:1256
-
\??\c:\nbbhtn.exec:\nbbhtn.exe192⤵PID:112
-
\??\c:\9thhhn.exec:\9thhhn.exe193⤵PID:2120
-
\??\c:\vvjpd.exec:\vvjpd.exe194⤵PID:2424
-
\??\c:\vvjvp.exec:\vvjvp.exe195⤵PID:1232
-
\??\c:\lrrllff.exec:\lrrllff.exe196⤵PID:1332
-
\??\c:\rffflfr.exec:\rffflfr.exe197⤵PID:1896
-
\??\c:\hthnnn.exec:\hthnnn.exe198⤵PID:904
-
\??\c:\9nhhnh.exec:\9nhhnh.exe199⤵PID:1996
-
\??\c:\1jvvv.exec:\1jvvv.exe200⤵PID:2408
-
\??\c:\vvvjv.exec:\vvvjv.exe201⤵PID:2396
-
\??\c:\rlxffll.exec:\rlxffll.exe202⤵PID:2616
-
\??\c:\ffrrxxx.exec:\ffrrxxx.exe203⤵PID:2868
-
\??\c:\ntnntn.exec:\ntnntn.exe204⤵PID:2380
-
\??\c:\btbnbn.exec:\btbnbn.exe205⤵PID:2688
-
\??\c:\5nbhnt.exec:\5nbhnt.exe206⤵PID:2772
-
\??\c:\vjvdd.exec:\vjvdd.exe207⤵PID:2692
-
\??\c:\9djdj.exec:\9djdj.exe208⤵PID:2764
-
\??\c:\3vvvv.exec:\3vvvv.exe209⤵PID:2404
-
\??\c:\1fxffll.exec:\1fxffll.exe210⤵PID:3056
-
\??\c:\lxrllff.exec:\lxrllff.exe211⤵PID:2528
-
\??\c:\thnnnn.exec:\thnnnn.exe212⤵PID:952
-
\??\c:\tnbbbt.exec:\tnbbbt.exe213⤵PID:2212
-
\??\c:\frrxrll.exec:\frrxrll.exe214⤵PID:1924
-
\??\c:\ffxfxxf.exec:\ffxfxxf.exe215⤵PID:2712
-
\??\c:\thnthh.exec:\thnthh.exe216⤵PID:1104
-
\??\c:\9bthbt.exec:\9bthbt.exe217⤵PID:1928
-
\??\c:\3pvvd.exec:\3pvvd.exe218⤵PID:1640
-
\??\c:\dpjpj.exec:\dpjpj.exe219⤵PID:2784
-
\??\c:\flfxxxl.exec:\flfxxxl.exe220⤵PID:2816
-
\??\c:\lflxxlf.exec:\lflxxlf.exe221⤵PID:2004
-
\??\c:\xlrxffl.exec:\xlrxffl.exe222⤵PID:2016
-
\??\c:\nbnhhn.exec:\nbnhhn.exe223⤵PID:2852
-
\??\c:\btbbbh.exec:\btbbbh.exe224⤵PID:2912
-
\??\c:\jvjpv.exec:\jvjpv.exe225⤵PID:2568
-
\??\c:\pdjdv.exec:\pdjdv.exe226⤵PID:684
-
\??\c:\xlffffl.exec:\xlffffl.exe227⤵PID:1020
-
\??\c:\xllfffl.exec:\xllfffl.exe228⤵PID:1164
-
\??\c:\bnbhtt.exec:\bnbhtt.exe229⤵PID:784
-
\??\c:\hhnnnn.exec:\hhnnnn.exe230⤵PID:560
-
\??\c:\jvddv.exec:\jvddv.exe231⤵PID:2028
-
\??\c:\dpdvd.exec:\dpdvd.exe232⤵PID:1740
-
\??\c:\9flffxx.exec:\9flffxx.exe233⤵PID:1056
-
\??\c:\xrxlfxl.exec:\xrxlfxl.exe234⤵PID:1112
-
\??\c:\tnbbbb.exec:\tnbbbb.exe235⤵PID:376
-
\??\c:\1hhbbb.exec:\1hhbbb.exe236⤵PID:1180
-
\??\c:\bthntt.exec:\bthntt.exe237⤵PID:1764
-
\??\c:\jvjjp.exec:\jvjjp.exe238⤵PID:1344
-
\??\c:\dvvpd.exec:\dvvpd.exe239⤵PID:3008
-
\??\c:\xrflllr.exec:\xrflllr.exe240⤵PID:1132
-
\??\c:\xrxxfxf.exec:\xrxxfxf.exe241⤵PID:1280
-
\??\c:\bthnnn.exec:\bthnnn.exe242⤵PID:2580