Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe
-
Size
70KB
-
MD5
126ad0a1e47f8bc52a88946a5ffd7ca1
-
SHA1
9123cbea23bdf4c65b4070769635169186df5b9d
-
SHA256
07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a
-
SHA512
01955836c539db039526217f2248b553c3bb249296b1d06eefdd6f6d8f50ebaf43b70f95ffe347e44d031878c26a6e88448159d3154c2744e4b078d762dcceb4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnfp:ymb3NkkiQ3mdBjFIgUEBp
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/568-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/868-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
Processes:
resource yara_rule behavioral1/memory/568-284-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2140-230-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2924-212-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2780-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1640-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1548-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2336-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1092-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2224-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2376-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/868-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2192-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2192-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2192-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2652-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2652-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3004-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1368-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1368-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
njpbvb.exehttrvnv.exefxnxxfj.exebxjxb.exepdbhx.exebvrfbrb.exefnhvfv.exejbbjx.exelfbdpxf.exebvjbb.exepffbfv.exefblbdj.exeftxtv.exejtrrxlh.exepvffr.exebfthrjp.exefvrrv.exedvhpff.exepdjrtn.exevrnhdn.exenrblt.exebbfhxjt.exelfjdxhr.exefxfbnl.exelbhnp.exebrdrtx.exejnndrjj.exeptxhn.exelflnxbp.exejvjlhn.exejrtxfd.exerjdhvhl.exelfxjb.exenjrbvb.exedpvxl.exejtddxxh.exelxdbd.exevvpbnp.exejptlh.exebjfdb.exextpdb.exerlnlft.exejblntj.exejttrrrd.exefxnpp.exexfppbd.exedxtlb.exejvvdbb.exexjrhrr.exedntbvf.exevvjbr.exejlpjdj.exetnrnxtf.exervnfbr.exexvxjj.exejfdfl.exellbfb.exeprbfpr.exepdnrnj.exelflfbt.exexjtvxx.exexxpfbhj.exehbtjrhf.exernrfx.exepid process 3004 njpbvb.exe 2488 httrvnv.exe 2628 fxnxxfj.exe 2652 bxjxb.exe 2908 pdbhx.exe 2712 bvrfbrb.exe 2192 fnhvfv.exe 2832 jbbjx.exe 868 lfbdpxf.exe 2376 bvjbb.exe 2224 pffbfv.exe 2572 fblbdj.exe 1092 ftxtv.exe 1756 jtrrxlh.exe 2336 pvffr.exe 1100 bfthrjp.exe 1548 fvrrv.exe 1640 dvhpff.exe 1196 pdjrtn.exe 2780 vrnhdn.exe 2924 nrblt.exe 380 bbfhxjt.exe 2140 lfjdxhr.exe 1848 fxfbnl.exe 1804 lbhnp.exe 808 brdrtx.exe 320 jnndrjj.exe 1676 ptxhn.exe 568 lflnxbp.exe 2104 jvjlhn.exe 2784 jrtxfd.exe 1508 rjdhvhl.exe 2480 lfxjb.exe 2684 njrbvb.exe 1584 dpvxl.exe 2164 jtddxxh.exe 2944 lxdbd.exe 2488 vvpbnp.exe 2504 jptlh.exe 2588 bjfdb.exe 2564 xtpdb.exe 2756 rlnlft.exe 2508 jblntj.exe 2428 jttrrrd.exe 2904 fxnpp.exe 3032 xfppbd.exe 1476 dxtlb.exe 2316 jvvdbb.exe 844 xjrhrr.exe 2384 dntbvf.exe 1916 vvjbr.exe 1884 jlpjdj.exe 2700 tnrnxtf.exe 2000 rvnfbr.exe 1696 xvxjj.exe 2204 jfdfl.exe 1632 llbfb.exe 1308 prbfpr.exe 1640 pdnrnj.exe 2776 lflfbt.exe 756 xjtvxx.exe 596 xxpfbhj.exe 2768 hbtjrhf.exe 3068 rnrfx.exe -
Processes:
resource yara_rule behavioral1/memory/568-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-3-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exenjpbvb.exehttrvnv.exefxnxxfj.exebxjxb.exepdbhx.exebvrfbrb.exefnhvfv.exejbbjx.exelfbdpxf.exebvjbb.exepffbfv.exefblbdj.exeftxtv.exejtrrxlh.exepvffr.exedescription pid process target process PID 1368 wrote to memory of 3004 1368 07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe njpbvb.exe PID 1368 wrote to memory of 3004 1368 07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe njpbvb.exe PID 1368 wrote to memory of 3004 1368 07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe njpbvb.exe PID 1368 wrote to memory of 3004 1368 07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe njpbvb.exe PID 3004 wrote to memory of 2488 3004 njpbvb.exe httrvnv.exe PID 3004 wrote to memory of 2488 3004 njpbvb.exe httrvnv.exe PID 3004 wrote to memory of 2488 3004 njpbvb.exe httrvnv.exe PID 3004 wrote to memory of 2488 3004 njpbvb.exe httrvnv.exe PID 2488 wrote to memory of 2628 2488 httrvnv.exe fxnxxfj.exe PID 2488 wrote to memory of 2628 2488 httrvnv.exe fxnxxfj.exe PID 2488 wrote to memory of 2628 2488 httrvnv.exe fxnxxfj.exe PID 2488 wrote to memory of 2628 2488 httrvnv.exe fxnxxfj.exe PID 2628 wrote to memory of 2652 2628 fxnxxfj.exe bxjxb.exe PID 2628 wrote to memory of 2652 2628 fxnxxfj.exe bxjxb.exe PID 2628 wrote to memory of 2652 2628 fxnxxfj.exe bxjxb.exe PID 2628 wrote to memory of 2652 2628 fxnxxfj.exe bxjxb.exe PID 2652 wrote to memory of 2908 2652 bxjxb.exe pdbhx.exe PID 2652 wrote to memory of 2908 2652 bxjxb.exe pdbhx.exe PID 2652 wrote to memory of 2908 2652 bxjxb.exe pdbhx.exe PID 2652 wrote to memory of 2908 2652 bxjxb.exe pdbhx.exe PID 2908 wrote to memory of 2712 2908 pdbhx.exe bvrfbrb.exe PID 2908 wrote to memory of 2712 2908 pdbhx.exe bvrfbrb.exe PID 2908 wrote to memory of 2712 2908 pdbhx.exe bvrfbrb.exe PID 2908 wrote to memory of 2712 2908 pdbhx.exe bvrfbrb.exe PID 2712 wrote to memory of 2192 2712 bvrfbrb.exe fnhvfv.exe PID 2712 wrote to memory of 2192 2712 bvrfbrb.exe fnhvfv.exe PID 2712 wrote to memory of 2192 2712 bvrfbrb.exe fnhvfv.exe PID 2712 wrote to memory of 2192 2712 bvrfbrb.exe fnhvfv.exe PID 2192 wrote to memory of 2832 2192 fnhvfv.exe jbbjx.exe PID 2192 wrote to memory of 2832 2192 fnhvfv.exe jbbjx.exe PID 2192 wrote to memory of 2832 2192 fnhvfv.exe jbbjx.exe PID 2192 wrote to memory of 2832 2192 fnhvfv.exe jbbjx.exe PID 2832 wrote to memory of 868 2832 jbbjx.exe lfbdpxf.exe PID 2832 wrote to memory of 868 2832 jbbjx.exe lfbdpxf.exe PID 2832 wrote to memory of 868 2832 jbbjx.exe lfbdpxf.exe PID 2832 wrote to memory of 868 2832 jbbjx.exe lfbdpxf.exe PID 868 wrote to memory of 2376 868 lfbdpxf.exe bvjbb.exe PID 868 wrote to memory of 2376 868 lfbdpxf.exe bvjbb.exe PID 868 wrote to memory of 2376 868 lfbdpxf.exe bvjbb.exe PID 868 wrote to memory of 2376 868 lfbdpxf.exe bvjbb.exe PID 2376 wrote to memory of 2224 2376 bvjbb.exe pffbfv.exe PID 2376 wrote to memory of 2224 2376 bvjbb.exe pffbfv.exe PID 2376 wrote to memory of 2224 2376 bvjbb.exe pffbfv.exe PID 2376 wrote to memory of 2224 2376 bvjbb.exe pffbfv.exe PID 2224 wrote to memory of 2572 2224 pffbfv.exe fblbdj.exe PID 2224 wrote to memory of 2572 2224 pffbfv.exe fblbdj.exe PID 2224 wrote to memory of 2572 2224 pffbfv.exe fblbdj.exe PID 2224 wrote to memory of 2572 2224 pffbfv.exe fblbdj.exe PID 2572 wrote to memory of 1092 2572 fblbdj.exe ftxtv.exe PID 2572 wrote to memory of 1092 2572 fblbdj.exe ftxtv.exe PID 2572 wrote to memory of 1092 2572 fblbdj.exe ftxtv.exe PID 2572 wrote to memory of 1092 2572 fblbdj.exe ftxtv.exe PID 1092 wrote to memory of 1756 1092 ftxtv.exe jtrrxlh.exe PID 1092 wrote to memory of 1756 1092 ftxtv.exe jtrrxlh.exe PID 1092 wrote to memory of 1756 1092 ftxtv.exe jtrrxlh.exe PID 1092 wrote to memory of 1756 1092 ftxtv.exe jtrrxlh.exe PID 1756 wrote to memory of 2336 1756 jtrrxlh.exe pvffr.exe PID 1756 wrote to memory of 2336 1756 jtrrxlh.exe pvffr.exe PID 1756 wrote to memory of 2336 1756 jtrrxlh.exe pvffr.exe PID 1756 wrote to memory of 2336 1756 jtrrxlh.exe pvffr.exe PID 2336 wrote to memory of 1100 2336 pvffr.exe bfthrjp.exe PID 2336 wrote to memory of 1100 2336 pvffr.exe bfthrjp.exe PID 2336 wrote to memory of 1100 2336 pvffr.exe bfthrjp.exe PID 2336 wrote to memory of 1100 2336 pvffr.exe bfthrjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe"C:\Users\Admin\AppData\Local\Temp\07326330fdf597fce65272dee18af4763d5c9fce75b888b072dc592fb799df8a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\njpbvb.exec:\njpbvb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\httrvnv.exec:\httrvnv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxnxxfj.exec:\fxnxxfj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bxjxb.exec:\bxjxb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdbhx.exec:\pdbhx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bvrfbrb.exec:\bvrfbrb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fnhvfv.exec:\fnhvfv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jbbjx.exec:\jbbjx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfbdpxf.exec:\lfbdpxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bvjbb.exec:\bvjbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pffbfv.exec:\pffbfv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fblbdj.exec:\fblbdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ftxtv.exec:\ftxtv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jtrrxlh.exec:\jtrrxlh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvffr.exec:\pvffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bfthrjp.exec:\bfthrjp.exe17⤵
- Executes dropped EXE
-
\??\c:\fvrrv.exec:\fvrrv.exe18⤵
- Executes dropped EXE
-
\??\c:\dvhpff.exec:\dvhpff.exe19⤵
- Executes dropped EXE
-
\??\c:\pdjrtn.exec:\pdjrtn.exe20⤵
- Executes dropped EXE
-
\??\c:\vrnhdn.exec:\vrnhdn.exe21⤵
- Executes dropped EXE
-
\??\c:\nrblt.exec:\nrblt.exe22⤵
- Executes dropped EXE
-
\??\c:\bbfhxjt.exec:\bbfhxjt.exe23⤵
- Executes dropped EXE
-
\??\c:\lfjdxhr.exec:\lfjdxhr.exe24⤵
- Executes dropped EXE
-
\??\c:\fxfbnl.exec:\fxfbnl.exe25⤵
- Executes dropped EXE
-
\??\c:\lbhnp.exec:\lbhnp.exe26⤵
- Executes dropped EXE
-
\??\c:\brdrtx.exec:\brdrtx.exe27⤵
- Executes dropped EXE
-
\??\c:\jnndrjj.exec:\jnndrjj.exe28⤵
- Executes dropped EXE
-
\??\c:\ptxhn.exec:\ptxhn.exe29⤵
- Executes dropped EXE
-
\??\c:\lflnxbp.exec:\lflnxbp.exe30⤵
- Executes dropped EXE
-
\??\c:\jvjlhn.exec:\jvjlhn.exe31⤵
- Executes dropped EXE
-
\??\c:\jrtxfd.exec:\jrtxfd.exe32⤵
- Executes dropped EXE
-
\??\c:\rjdhvhl.exec:\rjdhvhl.exe33⤵
- Executes dropped EXE
-
\??\c:\lfxjb.exec:\lfxjb.exe34⤵
- Executes dropped EXE
-
\??\c:\njrbvb.exec:\njrbvb.exe35⤵
- Executes dropped EXE
-
\??\c:\dpvxl.exec:\dpvxl.exe36⤵
- Executes dropped EXE
-
\??\c:\jtddxxh.exec:\jtddxxh.exe37⤵
- Executes dropped EXE
-
\??\c:\lxdbd.exec:\lxdbd.exe38⤵
- Executes dropped EXE
-
\??\c:\vvpbnp.exec:\vvpbnp.exe39⤵
- Executes dropped EXE
-
\??\c:\jptlh.exec:\jptlh.exe40⤵
- Executes dropped EXE
-
\??\c:\bjfdb.exec:\bjfdb.exe41⤵
- Executes dropped EXE
-
\??\c:\xtpdb.exec:\xtpdb.exe42⤵
- Executes dropped EXE
-
\??\c:\rlnlft.exec:\rlnlft.exe43⤵
- Executes dropped EXE
-
\??\c:\jblntj.exec:\jblntj.exe44⤵
- Executes dropped EXE
-
\??\c:\jttrrrd.exec:\jttrrrd.exe45⤵
- Executes dropped EXE
-
\??\c:\fxnpp.exec:\fxnpp.exe46⤵
- Executes dropped EXE
-
\??\c:\xfppbd.exec:\xfppbd.exe47⤵
- Executes dropped EXE
-
\??\c:\dxtlb.exec:\dxtlb.exe48⤵
- Executes dropped EXE
-
\??\c:\jvvdbb.exec:\jvvdbb.exe49⤵
- Executes dropped EXE
-
\??\c:\xjrhrr.exec:\xjrhrr.exe50⤵
- Executes dropped EXE
-
\??\c:\dntbvf.exec:\dntbvf.exe51⤵
- Executes dropped EXE
-
\??\c:\vvjbr.exec:\vvjbr.exe52⤵
- Executes dropped EXE
-
\??\c:\jlpjdj.exec:\jlpjdj.exe53⤵
- Executes dropped EXE
-
\??\c:\tnrnxtf.exec:\tnrnxtf.exe54⤵
- Executes dropped EXE
-
\??\c:\rvnfbr.exec:\rvnfbr.exe55⤵
- Executes dropped EXE
-
\??\c:\xvxjj.exec:\xvxjj.exe56⤵
- Executes dropped EXE
-
\??\c:\jfdfl.exec:\jfdfl.exe57⤵
- Executes dropped EXE
-
\??\c:\llbfb.exec:\llbfb.exe58⤵
- Executes dropped EXE
-
\??\c:\prbfpr.exec:\prbfpr.exe59⤵
- Executes dropped EXE
-
\??\c:\pdnrnj.exec:\pdnrnj.exe60⤵
- Executes dropped EXE
-
\??\c:\lflfbt.exec:\lflfbt.exe61⤵
- Executes dropped EXE
-
\??\c:\xjtvxx.exec:\xjtvxx.exe62⤵
- Executes dropped EXE
-
\??\c:\xxpfbhj.exec:\xxpfbhj.exe63⤵
- Executes dropped EXE
-
\??\c:\hbtjrhf.exec:\hbtjrhf.exe64⤵
- Executes dropped EXE
-
\??\c:\rnrfx.exec:\rnrfx.exe65⤵
- Executes dropped EXE
-
\??\c:\vhdrr.exec:\vhdrr.exe66⤵
-
\??\c:\xjrdppj.exec:\xjrdppj.exe67⤵
-
\??\c:\thhxl.exec:\thhxl.exe68⤵
-
\??\c:\xljnn.exec:\xljnn.exe69⤵
-
\??\c:\jjtlfv.exec:\jjtlfv.exe70⤵
-
\??\c:\djxltxj.exec:\djxltxj.exe71⤵
-
\??\c:\ptfptn.exec:\ptfptn.exe72⤵
-
\??\c:\drffnd.exec:\drffnd.exe73⤵
-
\??\c:\dnfllrn.exec:\dnfllrn.exe74⤵
-
\??\c:\hhtbjn.exec:\hhtbjn.exe75⤵
-
\??\c:\hdxtt.exec:\hdxtt.exe76⤵
-
\??\c:\vdbvhft.exec:\vdbvhft.exe77⤵
-
\??\c:\xrfvj.exec:\xrfvj.exe78⤵
-
\??\c:\brppbv.exec:\brppbv.exe79⤵
-
\??\c:\xnnrn.exec:\xnnrn.exe80⤵
-
\??\c:\hbldjxb.exec:\hbldjxb.exe81⤵
-
\??\c:\flhnp.exec:\flhnp.exe82⤵
-
\??\c:\pbpxl.exec:\pbpxl.exe83⤵
-
\??\c:\xbhdjr.exec:\xbhdjr.exe84⤵
-
\??\c:\nfxtxr.exec:\nfxtxr.exe85⤵
-
\??\c:\jnblr.exec:\jnblr.exe86⤵
-
\??\c:\brtvnb.exec:\brtvnb.exe87⤵
-
\??\c:\pxfrlb.exec:\pxfrlb.exe88⤵
-
\??\c:\vpdljfp.exec:\vpdljfp.exe89⤵
-
\??\c:\vhdfj.exec:\vhdfj.exe90⤵
-
\??\c:\jvdtft.exec:\jvdtft.exe91⤵
-
\??\c:\dnpvnf.exec:\dnpvnf.exe92⤵
-
\??\c:\fvftx.exec:\fvftx.exe93⤵
-
\??\c:\bjvth.exec:\bjvth.exe94⤵
-
\??\c:\btjnlf.exec:\btjnlf.exe95⤵
-
\??\c:\jxppnd.exec:\jxppnd.exe96⤵
-
\??\c:\ntbldv.exec:\ntbldv.exe97⤵
-
\??\c:\xjldvd.exec:\xjldvd.exe98⤵
-
\??\c:\llftd.exec:\llftd.exe99⤵
-
\??\c:\hhbhvf.exec:\hhbhvf.exe100⤵
-
\??\c:\xbnjvb.exec:\xbnjvb.exe101⤵
-
\??\c:\ttbtnd.exec:\ttbtnd.exe102⤵
-
\??\c:\lrbjdr.exec:\lrbjdr.exe103⤵
-
\??\c:\vbhdpf.exec:\vbhdpf.exe104⤵
-
\??\c:\dbxbj.exec:\dbxbj.exe105⤵
-
\??\c:\nbvhf.exec:\nbvhf.exe106⤵
-
\??\c:\ltrvj.exec:\ltrvj.exe107⤵
-
\??\c:\vjtfhb.exec:\vjtfhb.exe108⤵
-
\??\c:\rvxrjrl.exec:\rvxrjrl.exe109⤵
-
\??\c:\tdtxjxt.exec:\tdtxjxt.exe110⤵
-
\??\c:\pbbvfpt.exec:\pbbvfpt.exe111⤵
-
\??\c:\pdtfx.exec:\pdtfx.exe112⤵
-
\??\c:\jhpjfv.exec:\jhpjfv.exe113⤵
-
\??\c:\tfrvdph.exec:\tfrvdph.exe114⤵
-
\??\c:\ltnxrj.exec:\ltnxrj.exe115⤵
-
\??\c:\rrhtjt.exec:\rrhtjt.exe116⤵
-
\??\c:\fbdnb.exec:\fbdnb.exe117⤵
-
\??\c:\tffphlf.exec:\tffphlf.exe118⤵
-
\??\c:\rdxxtrv.exec:\rdxxtrv.exe119⤵
-
\??\c:\vllvvfv.exec:\vllvvfv.exe120⤵
-
\??\c:\fphph.exec:\fphph.exe121⤵
-
\??\c:\dtvrrr.exec:\dtvrrr.exe122⤵
-
\??\c:\rtbbj.exec:\rtbbj.exe123⤵
-
\??\c:\nnvdtb.exec:\nnvdtb.exe124⤵
-
\??\c:\vhbrbjn.exec:\vhbrbjn.exe125⤵
-
\??\c:\rndjxb.exec:\rndjxb.exe126⤵
-
\??\c:\lbdxphr.exec:\lbdxphr.exe127⤵
-
\??\c:\jjdrtdr.exec:\jjdrtdr.exe128⤵
-
\??\c:\blphj.exec:\blphj.exe129⤵
-
\??\c:\tvxbn.exec:\tvxbn.exe130⤵
-
\??\c:\pttdlrn.exec:\pttdlrn.exe131⤵
-
\??\c:\hhxxpx.exec:\hhxxpx.exe132⤵
-
\??\c:\rbhhdjv.exec:\rbhhdjv.exe133⤵
-
\??\c:\pltfrbr.exec:\pltfrbr.exe134⤵
-
\??\c:\tbnbp.exec:\tbnbp.exe135⤵
-
\??\c:\vxlrth.exec:\vxlrth.exe136⤵
-
\??\c:\nxrlfh.exec:\nxrlfh.exe137⤵
-
\??\c:\pjxvdr.exec:\pjxvdr.exe138⤵
-
\??\c:\rndhxhx.exec:\rndhxhx.exe139⤵
-
\??\c:\hrhbpb.exec:\hrhbpb.exe140⤵
-
\??\c:\pjrpjp.exec:\pjrpjp.exe141⤵
-
\??\c:\xjvphrn.exec:\xjvphrn.exe142⤵
-
\??\c:\lfdrh.exec:\lfdrh.exe143⤵
-
\??\c:\ddfbpdl.exec:\ddfbpdl.exe144⤵
-
\??\c:\phfnjv.exec:\phfnjv.exe145⤵
-
\??\c:\nfdfx.exec:\nfdfx.exe146⤵
-
\??\c:\hjvthf.exec:\hjvthf.exe147⤵
-
\??\c:\xvffhrx.exec:\xvffhrx.exe148⤵
-
\??\c:\frlpp.exec:\frlpp.exe149⤵
-
\??\c:\rppbbh.exec:\rppbbh.exe150⤵
-
\??\c:\vntnlv.exec:\vntnlv.exe151⤵
-
\??\c:\tdfvv.exec:\tdfvv.exe152⤵
-
\??\c:\bvbtntr.exec:\bvbtntr.exe153⤵
-
\??\c:\dtvdtrn.exec:\dtvdtrn.exe154⤵
-
\??\c:\jrvjb.exec:\jrvjb.exe155⤵
-
\??\c:\hllvjp.exec:\hllvjp.exe156⤵
-
\??\c:\vbnrp.exec:\vbnrp.exe157⤵
-
\??\c:\hptvhh.exec:\hptvhh.exe158⤵
-
\??\c:\lbjjd.exec:\lbjjd.exe159⤵
-
\??\c:\rndnxrn.exec:\rndnxrn.exe160⤵
-
\??\c:\jtrxp.exec:\jtrxp.exe161⤵
-
\??\c:\tlxxv.exec:\tlxxv.exe162⤵
-
\??\c:\vtlbd.exec:\vtlbd.exe163⤵
-
\??\c:\dvppjjt.exec:\dvppjjt.exe164⤵
-
\??\c:\lbjtf.exec:\lbjtf.exe165⤵
-
\??\c:\bbxpr.exec:\bbxpr.exe166⤵
-
\??\c:\fdhph.exec:\fdhph.exe167⤵
-
\??\c:\brttfn.exec:\brttfn.exe168⤵
-
\??\c:\jjbvxv.exec:\jjbvxv.exe169⤵
-
\??\c:\ttfbxbf.exec:\ttfbxbf.exe170⤵
-
\??\c:\xfhnxb.exec:\xfhnxb.exe171⤵
-
\??\c:\hnphbt.exec:\hnphbt.exe172⤵
-
\??\c:\nxhdxx.exec:\nxhdxx.exe173⤵
-
\??\c:\nthxhdj.exec:\nthxhdj.exe174⤵
-
\??\c:\dlhjjjj.exec:\dlhjjjj.exe175⤵
-
\??\c:\dxtjbf.exec:\dxtjbf.exe176⤵
-
\??\c:\jvrnv.exec:\jvrnv.exe177⤵
-
\??\c:\jhrhdv.exec:\jhrhdv.exe178⤵
-
\??\c:\fpbbpv.exec:\fpbbpv.exe179⤵
-
\??\c:\nnhtjb.exec:\nnhtjb.exe180⤵
-
\??\c:\bjfxj.exec:\bjfxj.exe181⤵
-
\??\c:\fdnnvv.exec:\fdnnvv.exe182⤵
-
\??\c:\txlpn.exec:\txlpn.exe183⤵
-
\??\c:\hxppjjf.exec:\hxppjjf.exe184⤵
-
\??\c:\tppvdn.exec:\tppvdn.exe185⤵
-
\??\c:\bppjbr.exec:\bppjbr.exe186⤵
-
\??\c:\xhvtnf.exec:\xhvtnf.exe187⤵
-
\??\c:\nvvbx.exec:\nvvbx.exe188⤵
-
\??\c:\xlljr.exec:\xlljr.exe189⤵
-
\??\c:\nrhjfd.exec:\nrhjfd.exe190⤵
-
\??\c:\flrbfr.exec:\flrbfr.exe191⤵
-
\??\c:\tltbfl.exec:\tltbfl.exe192⤵
-
\??\c:\rhnrjr.exec:\rhnrjr.exe193⤵
-
\??\c:\lprxpl.exec:\lprxpl.exe194⤵
-
\??\c:\htdxdt.exec:\htdxdt.exe195⤵
-
\??\c:\xphlhhf.exec:\xphlhhf.exe196⤵
-
\??\c:\rrvnbdb.exec:\rrvnbdb.exe197⤵
-
\??\c:\dtttb.exec:\dtttb.exe198⤵
-
\??\c:\bjpjtlv.exec:\bjpjtlv.exe199⤵
-
\??\c:\xtxxv.exec:\xtxxv.exe200⤵
-
\??\c:\thxjpv.exec:\thxjpv.exe201⤵
-
\??\c:\ffbfl.exec:\ffbfl.exe202⤵
-
\??\c:\nfhjt.exec:\nfhjt.exe203⤵
-
\??\c:\bvpprj.exec:\bvpprj.exe204⤵
-
\??\c:\jhtpf.exec:\jhtpf.exe205⤵
-
\??\c:\dxnrxv.exec:\dxnrxv.exe206⤵
-
\??\c:\dlrxrx.exec:\dlrxrx.exe207⤵
-
\??\c:\dxbrj.exec:\dxbrj.exe208⤵
-
\??\c:\blpxr.exec:\blpxr.exe209⤵
-
\??\c:\vhpdjdt.exec:\vhpdjdt.exe210⤵
-
\??\c:\xnbtv.exec:\xnbtv.exe211⤵
-
\??\c:\lldtt.exec:\lldtt.exe212⤵
-
\??\c:\rfpnrn.exec:\rfpnrn.exe213⤵
-
\??\c:\hrttj.exec:\hrttj.exe214⤵
-
\??\c:\rljbd.exec:\rljbd.exe215⤵
-
\??\c:\nfhdrjj.exec:\nfhdrjj.exe216⤵
-
\??\c:\bbprx.exec:\bbprx.exe217⤵
-
\??\c:\btrnfrj.exec:\btrnfrj.exe218⤵
-
\??\c:\vnjhnh.exec:\vnjhnh.exe219⤵
-
\??\c:\rthrhd.exec:\rthrhd.exe220⤵
-
\??\c:\drdlx.exec:\drdlx.exe221⤵
-
\??\c:\jtbbrhh.exec:\jtbbrhh.exe222⤵
-
\??\c:\hfrtjbx.exec:\hfrtjbx.exe223⤵
-
\??\c:\ptbpfx.exec:\ptbpfx.exe224⤵
-
\??\c:\fvrrj.exec:\fvrrj.exe225⤵
-
\??\c:\dfdxdf.exec:\dfdxdf.exe226⤵
-
\??\c:\dtbln.exec:\dtbln.exe227⤵
-
\??\c:\jbrrjl.exec:\jbrrjl.exe228⤵
-
\??\c:\lnrvt.exec:\lnrvt.exe229⤵
-
\??\c:\jbldjt.exec:\jbldjt.exe230⤵
-
\??\c:\bxtrj.exec:\bxtrj.exe231⤵
-
\??\c:\hlhhr.exec:\hlhhr.exe232⤵
-
\??\c:\xlrphpp.exec:\xlrphpp.exe233⤵
-
\??\c:\hhrnh.exec:\hhrnh.exe234⤵
-
\??\c:\ntrbtt.exec:\ntrbtt.exe235⤵
-
\??\c:\nbbbd.exec:\nbbbd.exe236⤵
-
\??\c:\pfxrrp.exec:\pfxrrp.exe237⤵
-
\??\c:\hrbrhd.exec:\hrbrhd.exe238⤵
-
\??\c:\dvljr.exec:\dvljr.exe239⤵
-
\??\c:\prxjbj.exec:\prxjbj.exe240⤵
-
\??\c:\vblrtj.exec:\vblrtj.exe241⤵