Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 20:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
245f959ede23fdc8258b4962a55966c14afcdde003b1b04b44db86c4d91093c5.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
245f959ede23fdc8258b4962a55966c14afcdde003b1b04b44db86c4d91093c5.exe
-
Size
76KB
-
MD5
2a005dc436bc29e40151ce9b177a179c
-
SHA1
f1de51e491cdc79c22c5c7f76071fce821035025
-
SHA256
245f959ede23fdc8258b4962a55966c14afcdde003b1b04b44db86c4d91093c5
-
SHA512
3e4f5ac13a834a3fee5469c4b985d41e8864e06d35f3e1f3ea8ff5e7eeb45158e2c1b1a53c7b87a2baa827eca656ec20dfa79ae84fadd06a3fa66a88bdbfb3dc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8gu3Gno9yvrjKl2:ymb3NkkiQ3mdBjFo68t3Gno9IW2
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1568-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/804-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/936-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
Processes:
resource yara_rule behavioral1/memory/1568-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2692-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/796-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/804-291-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/936-273-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/380-264-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1904-255-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1912-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2008-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3004-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2172-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2148-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1048-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2852-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2852-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2852-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2408-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2880-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2216-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2216-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2540-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2688-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vvpvp.exefxllffr.exe5lxlrll.exehtbbbt.exenbhntn.exe1vdpp.exepdpjd.exelfllrrr.exerfrrlfx.exebtnnnn.exe7bbntt.exenbbtnh.exevpjjd.exedvdjd.exejppdv.exellrxrxf.exexlrrrlr.exetnbntt.exethhhbh.exejdvjv.exedvdjp.exexlrrxrr.exelrrrxfx.exe1rfffxx.exe7bthtt.exetntbnh.exe5pvpp.exepjvjj.exelfrrfll.exelfrxlrx.exebnttbn.exethtnbb.exehbhhnh.exejvjdj.exepdppv.exelxfxllr.exerlrxrxl.exe3xlfllf.exennhbnn.exebthntb.exepdpvv.exejjpvv.exedpddd.exexrffffr.exerxllxxf.exelxrxrrl.exe3bnthn.exehtnntt.exenhntbb.exe9dvvv.exedpvdp.exe1jvvd.exerrlxxfl.exelfflxfl.exexxffrfr.exethbntt.exethbbnt.exehbhnbb.exedvddp.exepjvjv.exexrfflrr.exebtbhtt.exe1bttbb.exe5nhhhn.exepid process 2688 vvpvp.exe 2540 fxllffr.exe 2216 5lxlrll.exe 2692 htbbbt.exe 2880 nbhntn.exe 2408 1vdpp.exe 2532 pdpjd.exe 2852 lfllrrr.exe 1048 rfrrlfx.exe 2712 btnnnn.exe 676 7bbntt.exe 2148 nbbtnh.exe 2280 vpjjd.exe 2172 dvdjd.exe 1084 jppdv.exe 3004 llrxrxf.exe 2028 xlrrrlr.exe 2008 tnbntt.exe 2212 thhhbh.exe 1912 jdvjv.exe 540 dvdjp.exe 796 xlrrxrr.exe 980 lrrrxfx.exe 1896 1rfffxx.exe 2924 7bthtt.exe 1904 tntbnh.exe 380 5pvpp.exe 936 pjvjj.exe 2268 lfrrfll.exe 804 lfrxlrx.exe 2264 bnttbn.exe 1440 thtnbb.exe 2236 hbhhnh.exe 1568 jvjdj.exe 2600 pdppv.exe 1544 lxfxllr.exe 2604 rlrxrxl.exe 2208 3xlfllf.exe 2548 nnhbnn.exe 2524 bthntb.exe 2428 pdpvv.exe 2832 jjpvv.exe 1524 dpddd.exe 2472 xrffffr.exe 2724 rxllxxf.exe 2808 lxrxrrl.exe 1780 3bnthn.exe 2316 htnntt.exe 308 nhntbb.exe 932 9dvvv.exe 1332 dpvdp.exe 1084 1jvvd.exe 1028 rrlxxfl.exe 2508 lfflxfl.exe 1932 xxffrfr.exe 2368 thbntt.exe 1624 thbbnt.exe 1912 hbhnbb.exe 1068 dvddp.exe 1576 pjvjv.exe 1196 xrfflrr.exe 2112 btbhtt.exe 448 1bttbb.exe 1732 5nhhhn.exe -
Processes:
resource yara_rule behavioral1/memory/1568-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/936-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-21-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
245f959ede23fdc8258b4962a55966c14afcdde003b1b04b44db86c4d91093c5.exevvpvp.exefxllffr.exe5lxlrll.exehtbbbt.exenbhntn.exe1vdpp.exepdpjd.exelfllrrr.exerfrrlfx.exebtnnnn.exe7bbntt.exenbbtnh.exevpjjd.exedvdjd.exejppdv.exedescription pid process target process PID 1568 wrote to memory of 2688 1568 245f959ede23fdc8258b4962a55966c14afcdde003b1b04b44db86c4d91093c5.exe vvpvp.exe PID 1568 wrote to memory of 2688 1568 245f959ede23fdc8258b4962a55966c14afcdde003b1b04b44db86c4d91093c5.exe vvpvp.exe PID 1568 wrote to memory of 2688 1568 245f959ede23fdc8258b4962a55966c14afcdde003b1b04b44db86c4d91093c5.exe vvpvp.exe PID 1568 wrote to memory of 2688 1568 245f959ede23fdc8258b4962a55966c14afcdde003b1b04b44db86c4d91093c5.exe vvpvp.exe PID 2688 wrote to memory of 2540 2688 vvpvp.exe fxllffr.exe PID 2688 wrote to memory of 2540 2688 vvpvp.exe fxllffr.exe PID 2688 wrote to memory of 2540 2688 vvpvp.exe fxllffr.exe PID 2688 wrote to memory of 2540 2688 vvpvp.exe fxllffr.exe PID 2540 wrote to memory of 2216 2540 fxllffr.exe vpvvv.exe PID 2540 wrote to memory of 2216 2540 fxllffr.exe vpvvv.exe PID 2540 wrote to memory of 2216 2540 fxllffr.exe vpvvv.exe PID 2540 wrote to memory of 2216 2540 fxllffr.exe vpvvv.exe PID 2216 wrote to memory of 2692 2216 5lxlrll.exe htbbbt.exe PID 2216 wrote to memory of 2692 2216 5lxlrll.exe htbbbt.exe PID 2216 wrote to memory of 2692 2216 5lxlrll.exe htbbbt.exe PID 2216 wrote to memory of 2692 2216 5lxlrll.exe htbbbt.exe PID 2692 wrote to memory of 2880 2692 htbbbt.exe nbhntn.exe PID 2692 wrote to memory of 2880 2692 htbbbt.exe nbhntn.exe PID 2692 wrote to memory of 2880 2692 htbbbt.exe nbhntn.exe PID 2692 wrote to memory of 2880 2692 htbbbt.exe nbhntn.exe PID 2880 wrote to memory of 2408 2880 nbhntn.exe 1vdpp.exe PID 2880 wrote to memory of 2408 2880 nbhntn.exe 1vdpp.exe PID 2880 wrote to memory of 2408 2880 nbhntn.exe 1vdpp.exe PID 2880 wrote to memory of 2408 2880 nbhntn.exe 1vdpp.exe PID 2408 wrote to memory of 2532 2408 1vdpp.exe pdpjd.exe PID 2408 wrote to memory of 2532 2408 1vdpp.exe pdpjd.exe PID 2408 wrote to memory of 2532 2408 1vdpp.exe pdpjd.exe PID 2408 wrote to memory of 2532 2408 1vdpp.exe pdpjd.exe PID 2532 wrote to memory of 2852 2532 pdpjd.exe lfllrrr.exe PID 2532 wrote to memory of 2852 2532 pdpjd.exe lfllrrr.exe PID 2532 wrote to memory of 2852 2532 pdpjd.exe lfllrrr.exe PID 2532 wrote to memory of 2852 2532 pdpjd.exe lfllrrr.exe PID 2852 wrote to memory of 1048 2852 lfllrrr.exe rfrrlfx.exe PID 2852 wrote to memory of 1048 2852 lfllrrr.exe rfrrlfx.exe PID 2852 wrote to memory of 1048 2852 lfllrrr.exe rfrrlfx.exe PID 2852 wrote to memory of 1048 2852 lfllrrr.exe rfrrlfx.exe PID 1048 wrote to memory of 2712 1048 rfrrlfx.exe btnnnn.exe PID 1048 wrote to memory of 2712 1048 rfrrlfx.exe btnnnn.exe PID 1048 wrote to memory of 2712 1048 rfrrlfx.exe btnnnn.exe PID 1048 wrote to memory of 2712 1048 rfrrlfx.exe btnnnn.exe PID 2712 wrote to memory of 676 2712 btnnnn.exe 7bbntt.exe PID 2712 wrote to memory of 676 2712 btnnnn.exe 7bbntt.exe PID 2712 wrote to memory of 676 2712 btnnnn.exe 7bbntt.exe PID 2712 wrote to memory of 676 2712 btnnnn.exe 7bbntt.exe PID 676 wrote to memory of 2148 676 7bbntt.exe nbbtnh.exe PID 676 wrote to memory of 2148 676 7bbntt.exe nbbtnh.exe PID 676 wrote to memory of 2148 676 7bbntt.exe nbbtnh.exe PID 676 wrote to memory of 2148 676 7bbntt.exe nbbtnh.exe PID 2148 wrote to memory of 2280 2148 nbbtnh.exe vpjjd.exe PID 2148 wrote to memory of 2280 2148 nbbtnh.exe vpjjd.exe PID 2148 wrote to memory of 2280 2148 nbbtnh.exe vpjjd.exe PID 2148 wrote to memory of 2280 2148 nbbtnh.exe vpjjd.exe PID 2280 wrote to memory of 2172 2280 vpjjd.exe dvdjd.exe PID 2280 wrote to memory of 2172 2280 vpjjd.exe dvdjd.exe PID 2280 wrote to memory of 2172 2280 vpjjd.exe dvdjd.exe PID 2280 wrote to memory of 2172 2280 vpjjd.exe dvdjd.exe PID 2172 wrote to memory of 1084 2172 dvdjd.exe jppdv.exe PID 2172 wrote to memory of 1084 2172 dvdjd.exe jppdv.exe PID 2172 wrote to memory of 1084 2172 dvdjd.exe jppdv.exe PID 2172 wrote to memory of 1084 2172 dvdjd.exe jppdv.exe PID 1084 wrote to memory of 3004 1084 jppdv.exe llrxrxf.exe PID 1084 wrote to memory of 3004 1084 jppdv.exe llrxrxf.exe PID 1084 wrote to memory of 3004 1084 jppdv.exe llrxrxf.exe PID 1084 wrote to memory of 3004 1084 jppdv.exe llrxrxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\245f959ede23fdc8258b4962a55966c14afcdde003b1b04b44db86c4d91093c5.exe"C:\Users\Admin\AppData\Local\Temp\245f959ede23fdc8258b4962a55966c14afcdde003b1b04b44db86c4d91093c5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\vvpvp.exec:\vvpvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fxllffr.exec:\fxllffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\5lxlrll.exec:\5lxlrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\htbbbt.exec:\htbbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nbhntn.exec:\nbhntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\1vdpp.exec:\1vdpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\pdpjd.exec:\pdpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\lfllrrr.exec:\lfllrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\rfrrlfx.exec:\rfrrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\btnnnn.exec:\btnnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\7bbntt.exec:\7bbntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\nbbtnh.exec:\nbbtnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\vpjjd.exec:\vpjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\dvdjd.exec:\dvdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\jppdv.exec:\jppdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\llrxrxf.exec:\llrxrxf.exe17⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xlrrrlr.exec:\xlrrrlr.exe18⤵
- Executes dropped EXE
PID:2028 -
\??\c:\tnbntt.exec:\tnbntt.exe19⤵
- Executes dropped EXE
PID:2008 -
\??\c:\thhhbh.exec:\thhhbh.exe20⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jdvjv.exec:\jdvjv.exe21⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dvdjp.exec:\dvdjp.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\xlrrxrr.exec:\xlrrxrr.exe23⤵
- Executes dropped EXE
PID:796 -
\??\c:\lrrrxfx.exec:\lrrrxfx.exe24⤵
- Executes dropped EXE
PID:980 -
\??\c:\1rfffxx.exec:\1rfffxx.exe25⤵
- Executes dropped EXE
PID:1896 -
\??\c:\7bthtt.exec:\7bthtt.exe26⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tntbnh.exec:\tntbnh.exe27⤵
- Executes dropped EXE
PID:1904 -
\??\c:\5pvpp.exec:\5pvpp.exe28⤵
- Executes dropped EXE
PID:380 -
\??\c:\pjvjj.exec:\pjvjj.exe29⤵
- Executes dropped EXE
PID:936 -
\??\c:\lfrrfll.exec:\lfrrfll.exe30⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lfrxlrx.exec:\lfrxlrx.exe31⤵
- Executes dropped EXE
PID:804 -
\??\c:\bnttbn.exec:\bnttbn.exe32⤵
- Executes dropped EXE
PID:2264 -
\??\c:\thtnbb.exec:\thtnbb.exe33⤵
- Executes dropped EXE
PID:1440 -
\??\c:\hbhhnh.exec:\hbhhnh.exe34⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jvjdj.exec:\jvjdj.exe35⤵
- Executes dropped EXE
PID:1568 -
\??\c:\pdppv.exec:\pdppv.exe36⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lxfxllr.exec:\lxfxllr.exe37⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rlrxrxl.exec:\rlrxrxl.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\3xlfllf.exec:\3xlfllf.exe39⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nnhbnn.exec:\nnhbnn.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bthntb.exec:\bthntb.exe41⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pdpvv.exec:\pdpvv.exe42⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jjpvv.exec:\jjpvv.exe43⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dpddd.exec:\dpddd.exe44⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xrffffr.exec:\xrffffr.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rxllxxf.exec:\rxllxxf.exe46⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lxrxrrl.exec:\lxrxrrl.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3bnthn.exec:\3bnthn.exe48⤵
- Executes dropped EXE
PID:1780 -
\??\c:\htnntt.exec:\htnntt.exe49⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nhntbb.exec:\nhntbb.exe50⤵
- Executes dropped EXE
PID:308 -
\??\c:\9dvvv.exec:\9dvvv.exe51⤵
- Executes dropped EXE
PID:932 -
\??\c:\dpvdp.exec:\dpvdp.exe52⤵
- Executes dropped EXE
PID:1332 -
\??\c:\1jvvd.exec:\1jvvd.exe53⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rrlxxfl.exec:\rrlxxfl.exe54⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lfflxfl.exec:\lfflxfl.exe55⤵
- Executes dropped EXE
PID:2508 -
\??\c:\xxffrfr.exec:\xxffrfr.exe56⤵
- Executes dropped EXE
PID:1932 -
\??\c:\thbntt.exec:\thbntt.exe57⤵
- Executes dropped EXE
PID:2368 -
\??\c:\thbbnt.exec:\thbbnt.exe58⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hbhnbb.exec:\hbhnbb.exe59⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dvddp.exec:\dvddp.exe60⤵
- Executes dropped EXE
PID:1068 -
\??\c:\pjvjv.exec:\pjvjv.exe61⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xrfflrr.exec:\xrfflrr.exe62⤵
- Executes dropped EXE
PID:1196 -
\??\c:\btbhtt.exec:\btbhtt.exe63⤵
- Executes dropped EXE
PID:2112 -
\??\c:\1bttbb.exec:\1bttbb.exe64⤵
- Executes dropped EXE
PID:448 -
\??\c:\5nhhhn.exec:\5nhhhn.exe65⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dvpjj.exec:\dvpjj.exe66⤵PID:2272
-
\??\c:\9dvdp.exec:\9dvdp.exe67⤵PID:968
-
\??\c:\5dvjj.exec:\5dvjj.exe68⤵PID:1420
-
\??\c:\7jpvj.exec:\7jpvj.exe69⤵PID:700
-
\??\c:\fxfflfl.exec:\fxfflfl.exe70⤵PID:2332
-
\??\c:\1xxxrrf.exec:\1xxxrrf.exe71⤵PID:1992
-
\??\c:\tnthtt.exec:\tnthtt.exe72⤵PID:1648
-
\??\c:\5tbhnt.exec:\5tbhnt.exe73⤵PID:1140
-
\??\c:\nnhtbb.exec:\nnhtbb.exe74⤵PID:1756
-
\??\c:\jdpdj.exec:\jdpdj.exe75⤵PID:2740
-
\??\c:\pjpvv.exec:\pjpvv.exe76⤵PID:1228
-
\??\c:\7vddp.exec:\7vddp.exe77⤵PID:2600
-
\??\c:\1rflxxl.exec:\1rflxxl.exe78⤵PID:2752
-
\??\c:\lxxflxf.exec:\lxxflxf.exe79⤵PID:2604
-
\??\c:\rllrflx.exec:\rllrflx.exe80⤵PID:2680
-
\??\c:\llflxxf.exec:\llflxxf.exe81⤵PID:2632
-
\??\c:\hbnbnt.exec:\hbnbnt.exe82⤵PID:788
-
\??\c:\hbbbnn.exec:\hbbbnn.exe83⤵PID:2412
-
\??\c:\nnhbbh.exec:\nnhbbh.exe84⤵PID:1584
-
\??\c:\3djpv.exec:\3djpv.exe85⤵PID:2832
-
\??\c:\pjdpd.exec:\pjdpd.exe86⤵PID:2640
-
\??\c:\1jvdp.exec:\1jvdp.exe87⤵PID:2572
-
\??\c:\vjjjp.exec:\vjjjp.exe88⤵PID:1724
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe89⤵PID:1788
-
\??\c:\fxflxxf.exec:\fxflxxf.exe90⤵PID:2512
-
\??\c:\1xxrxlx.exec:\1xxrxlx.exe91⤵PID:1628
-
\??\c:\7lrxrrl.exec:\7lrxrrl.exe92⤵PID:1592
-
\??\c:\nbhnbh.exec:\nbhnbh.exe93⤵PID:1432
-
\??\c:\nhbnhn.exec:\nhbnhn.exe94⤵PID:860
-
\??\c:\bttthb.exec:\bttthb.exe95⤵PID:1280
-
\??\c:\pjvvv.exec:\pjvvv.exe96⤵PID:2124
-
\??\c:\dvvjv.exec:\dvvjv.exe97⤵PID:1716
-
\??\c:\vpjpp.exec:\vpjpp.exe98⤵PID:2392
-
\??\c:\dvjdj.exec:\dvjdj.exe99⤵PID:2204
-
\??\c:\rlfrrxf.exec:\rlfrrxf.exe100⤵PID:1080
-
\??\c:\lxlxfll.exec:\lxlxfll.exe101⤵PID:716
-
\??\c:\rlxxrxl.exec:\rlxxrxl.exe102⤵PID:1428
-
\??\c:\3xrrflr.exec:\3xrrflr.exe103⤵PID:1416
-
\??\c:\bbnthh.exec:\bbnthh.exe104⤵PID:1908
-
\??\c:\3bbhnb.exec:\3bbhnb.exe105⤵PID:1312
-
\??\c:\hnhhnt.exec:\hnhhnt.exe106⤵PID:1012
-
\??\c:\pjvpp.exec:\pjvpp.exe107⤵PID:1496
-
\??\c:\7vddp.exec:\7vddp.exe108⤵PID:1556
-
\??\c:\3dvdp.exec:\3dvdp.exe109⤵PID:772
-
\??\c:\dvvdv.exec:\dvvdv.exe110⤵PID:952
-
\??\c:\xxrfxxl.exec:\xxrfxxl.exe111⤵PID:1620
-
\??\c:\lflrffl.exec:\lflrffl.exe112⤵PID:336
-
\??\c:\llrfrfr.exec:\llrfrfr.exe113⤵PID:2108
-
\??\c:\xlrxllr.exec:\xlrxllr.exe114⤵PID:1916
-
\??\c:\nhtbtt.exec:\nhtbtt.exe115⤵PID:1444
-
\??\c:\hbthbb.exec:\hbthbb.exe116⤵PID:2344
-
\??\c:\nhbbnn.exec:\nhbbnn.exe117⤵PID:2220
-
\??\c:\dvdjv.exec:\dvdjv.exe118⤵PID:1700
-
\??\c:\pjpvj.exec:\pjpvj.exe119⤵PID:560
-
\??\c:\pjppv.exec:\pjppv.exe120⤵PID:2932
-
\??\c:\vpvvv.exec:\vpvvv.exe121⤵PID:2216
-
\??\c:\lxflxxf.exec:\lxflxxf.exe122⤵PID:1664
-
\??\c:\lfrxxll.exec:\lfrxxll.exe123⤵PID:2548
-
\??\c:\7xrflll.exec:\7xrflll.exe124⤵PID:2880
-
\??\c:\fxlrflr.exec:\fxlrflr.exe125⤵PID:2408
-
\??\c:\htbbhh.exec:\htbbhh.exe126⤵PID:2428
-
\??\c:\hhnnbb.exec:\hhnnbb.exe127⤵PID:2260
-
\??\c:\nhttbt.exec:\nhttbt.exe128⤵PID:1524
-
\??\c:\pjvpp.exec:\pjvpp.exe129⤵PID:2472
-
\??\c:\7jjpj.exec:\7jjpj.exe130⤵PID:1528
-
\??\c:\vjdvv.exec:\vjdvv.exe131⤵PID:1532
-
\??\c:\1fxfxfl.exec:\1fxfxfl.exe132⤵PID:2148
-
\??\c:\3xrxrrf.exec:\3xrxrrf.exe133⤵PID:2820
-
\??\c:\xlrxflr.exec:\xlrxflr.exe134⤵PID:2448
-
\??\c:\xrfrfxf.exec:\xrfrfxf.exe135⤵PID:2320
-
\??\c:\bnttnt.exec:\bnttnt.exe136⤵PID:488
-
\??\c:\hthhnt.exec:\hthhnt.exe137⤵PID:2032
-
\??\c:\hbthhn.exec:\hbthhn.exe138⤵PID:1936
-
\??\c:\vpdjv.exec:\vpdjv.exe139⤵PID:2028
-
\??\c:\vpvdj.exec:\vpvdj.exe140⤵PID:2528
-
\??\c:\pdjdd.exec:\pdjdd.exe141⤵PID:1932
-
\??\c:\5rlflxf.exec:\5rlflxf.exe142⤵PID:2088
-
\??\c:\lfrxxlx.exec:\lfrxxlx.exe143⤵PID:2780
-
\??\c:\1rlrxfl.exec:\1rlrxfl.exe144⤵PID:608
-
\??\c:\nhnhhh.exec:\nhnhhh.exe145⤵PID:1616
-
\??\c:\nhtbnt.exec:\nhtbnt.exe146⤵PID:2136
-
\??\c:\bbhntb.exec:\bbhntb.exe147⤵PID:980
-
\??\c:\jdvjj.exec:\jdvjj.exe148⤵PID:3044
-
\??\c:\vpddj.exec:\vpddj.exe149⤵PID:1200
-
\??\c:\dvddj.exec:\dvddj.exe150⤵PID:1824
-
\??\c:\fffrrxf.exec:\fffrrxf.exe151⤵PID:2056
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe152⤵PID:2704
-
\??\c:\xrfrflx.exec:\xrfrflx.exe153⤵PID:936
-
\??\c:\frxlrrf.exec:\frxlrrf.exe154⤵PID:1192
-
\??\c:\thtnbb.exec:\thtnbb.exe155⤵PID:1256
-
\??\c:\hbbbhh.exec:\hbbbhh.exe156⤵PID:2264
-
\??\c:\hbhntn.exec:\hbhntn.exe157⤵PID:872
-
\??\c:\jvdjv.exec:\jvdjv.exe158⤵PID:2908
-
\??\c:\vjpvv.exec:\vjpvv.exe159⤵PID:2688
-
\??\c:\9pdvp.exec:\9pdvp.exe160⤵PID:1660
-
\??\c:\lfxxffl.exec:\lfxxffl.exe161⤵PID:2620
-
\??\c:\fxxlxfl.exec:\fxxlxfl.exe162⤵PID:2516
-
\??\c:\rrrxffr.exec:\rrrxffr.exe163⤵PID:2904
-
\??\c:\hthhnn.exec:\hthhnn.exe164⤵PID:2932
-
\??\c:\btttnt.exec:\btttnt.exe165⤵PID:2432
-
\??\c:\nnhhhh.exec:\nnhhhh.exe166⤵PID:2420
-
\??\c:\nbtttb.exec:\nbtttb.exe167⤵PID:2356
-
\??\c:\7pjvd.exec:\7pjvd.exe168⤵PID:2828
-
\??\c:\jdvvv.exec:\jdvvv.exe169⤵PID:1572
-
\??\c:\jjvvj.exec:\jjvvj.exe170⤵PID:1212
-
\??\c:\rfrxlxr.exec:\rfrxlxr.exe171⤵PID:2716
-
\??\c:\xrxfrrl.exec:\xrxfrrl.exe172⤵PID:288
-
\??\c:\xxlxflx.exec:\xxlxflx.exe173⤵PID:1768
-
\??\c:\nnhntn.exec:\nnhntn.exe174⤵PID:2808
-
\??\c:\nbntbn.exec:\nbntbn.exe175⤵PID:2844
-
\??\c:\nbttbt.exec:\nbttbt.exe176⤵PID:344
-
\??\c:\dddvv.exec:\dddvv.exe177⤵PID:2164
-
\??\c:\jdvjd.exec:\jdvjd.exe178⤵PID:2916
-
\??\c:\5pjjv.exec:\5pjjv.exe179⤵PID:1332
-
\??\c:\dvdpv.exec:\dvdpv.exe180⤵PID:1704
-
\??\c:\5frxfrx.exec:\5frxfrx.exe181⤵PID:2024
-
\??\c:\9ffrflr.exec:\9ffrflr.exe182⤵PID:2380
-
\??\c:\flrrlrf.exec:\flrrlrf.exe183⤵PID:2372
-
\??\c:\bththn.exec:\bththn.exe184⤵PID:1876
-
\??\c:\hnbbhb.exec:\hnbbhb.exe185⤵PID:1604
-
\??\c:\nhnnbh.exec:\nhnnbh.exe186⤵PID:268
-
\??\c:\pjjpd.exec:\pjjpd.exe187⤵PID:1412
-
\??\c:\jjvjp.exec:\jjvjp.exe188⤵PID:1428
-
\??\c:\ddppj.exec:\ddppj.exe189⤵PID:1416
-
\??\c:\lfllllx.exec:\lfllllx.exe190⤵PID:1908
-
\??\c:\3rfrrxf.exec:\3rfrrxf.exe191⤵PID:984
-
\??\c:\7rlrfrx.exec:\7rlrfrx.exe192⤵PID:1316
-
\??\c:\tnhtbh.exec:\tnhtbh.exe193⤵PID:2132
-
\??\c:\nbbhth.exec:\nbbhth.exe194⤵PID:1556
-
\??\c:\nbtbhn.exec:\nbtbhn.exe195⤵PID:772
-
\??\c:\bbnnhh.exec:\bbnnhh.exe196⤵PID:1420
-
\??\c:\3djpv.exec:\3djpv.exe197⤵PID:1640
-
\??\c:\vpjvd.exec:\vpjvd.exe198⤵PID:336
-
\??\c:\rlfxlll.exec:\rlfxlll.exe199⤵PID:2108
-
\??\c:\xxlrlxf.exec:\xxlrlxf.exe200⤵PID:1648
-
\??\c:\rllxlrx.exec:\rllxlrx.exe201⤵PID:1140
-
\??\c:\thbhnn.exec:\thbhnn.exe202⤵PID:2344
-
\??\c:\5nttnh.exec:\5nttnh.exe203⤵PID:2740
-
\??\c:\tbtnbb.exec:\tbtnbb.exe204⤵PID:1228
-
\??\c:\tbntbt.exec:\tbntbt.exe205⤵PID:2600
-
\??\c:\jjpjp.exec:\jjpjp.exe206⤵PID:2560
-
\??\c:\rrlxfrf.exec:\rrlxfrf.exe207⤵PID:2604
-
\??\c:\tnhtbh.exec:\tnhtbh.exe208⤵PID:2680
-
\??\c:\7btthn.exec:\7btthn.exe209⤵PID:2632
-
\??\c:\bnbttb.exec:\bnbttb.exe210⤵PID:2652
-
\??\c:\pjvpv.exec:\pjvpv.exe211⤵PID:2356
-
\??\c:\jvjjp.exec:\jvjjp.exe212⤵PID:1584
-
\??\c:\pdjdp.exec:\pdjdp.exe213⤵PID:1572
-
\??\c:\fxxfrlr.exec:\fxxfrlr.exe214⤵PID:1208
-
\??\c:\ffrfrxr.exec:\ffrfrxr.exe215⤵PID:2728
-
\??\c:\rlflrlx.exec:\rlflrlx.exe216⤵PID:1776
-
\??\c:\hbnbnn.exec:\hbnbnn.exe217⤵PID:240
-
\??\c:\tnhhbh.exec:\tnhhbh.exe218⤵PID:1780
-
\??\c:\nhttbb.exec:\nhttbb.exe219⤵PID:2280
-
\??\c:\jdvdp.exec:\jdvdp.exe220⤵PID:308
-
\??\c:\vvdpj.exec:\vvdpj.exe221⤵PID:2040
-
\??\c:\jdvdj.exec:\jdvdj.exe222⤵PID:1364
-
\??\c:\5xfflrf.exec:\5xfflrf.exe223⤵PID:860
-
\??\c:\rfxfllr.exec:\rfxfllr.exe224⤵PID:1280
-
\??\c:\3lxlfll.exec:\3lxlfll.exe225⤵PID:1880
-
\??\c:\tnnnbb.exec:\tnnnbb.exe226⤵PID:1920
-
\??\c:\7nbttb.exec:\7nbttb.exe227⤵PID:2372
-
\??\c:\btbnnt.exec:\btbnnt.exe228⤵PID:1964
-
\??\c:\hbbhbh.exec:\hbbhbh.exe229⤵PID:800
-
\??\c:\jvjjj.exec:\jvjjj.exe230⤵PID:716
-
\??\c:\jvdjv.exec:\jvdjv.exe231⤵PID:624
-
\??\c:\jdpvj.exec:\jdpvj.exe232⤵PID:2824
-
\??\c:\7vpvj.exec:\7vpvj.exe233⤵PID:2312
-
\??\c:\1fxfxfl.exec:\1fxfxfl.exe234⤵PID:1888
-
\??\c:\lxfrxrx.exec:\lxfrxrx.exe235⤵PID:1300
-
\??\c:\rfffrfx.exec:\rfffrfx.exe236⤵PID:448
-
\??\c:\hbnnnn.exec:\hbnnnn.exe237⤵PID:380
-
\??\c:\bttbbn.exec:\bttbbn.exe238⤵PID:1952
-
\??\c:\nhtnbh.exec:\nhtnbh.exe239⤵PID:572
-
\??\c:\1nbntb.exec:\1nbntb.exe240⤵PID:700
-
\??\c:\7jddj.exec:\7jddj.exe241⤵PID:1956
-
\??\c:\3pdjv.exec:\3pdjv.exe242⤵PID:2000