Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
15-10-2023 18:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe
Resource
win7-20230831-en
windows7-x64
5 signatures
150 seconds
General
-
Target
20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe
-
Size
229KB
-
MD5
20dfc6eb8377513ad0500f565bd49150
-
SHA1
537f512d80b7020f974598ab7dd65191c6dca50c
-
SHA256
f0d7d0a5a80e1013d69efca5c953d96b91811d701c9a704f2981d89c3f60782d
-
SHA512
1d0acc7ab94eb044940e576de080c5408184d710c5376e745492c5d90e043a37eeb2b66ad31ba5e52a93d0ae5024d254861ed69855fde4dd5bbb6ff1f552f6fd
-
SSDEEP
6144:n3C9BRo7tvnJ9oEz2Eu9XgcVyDOoZU0Wm4:n3C9ytvnV2NQAo20Wm4
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/2188-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/440-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/748-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-353-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-355-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-387-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-403-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-436-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-437-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-454-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-499-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1688 hdjdrj.exe 2604 pvbjh.exe 2772 trnhxxf.exe 2724 jvdfhd.exe 2260 nvnjrvb.exe 2552 tllxfhd.exe 2556 xjltp.exe 596 jlvllv.exe 440 thhdbrr.exe 748 xbdldrt.exe 2832 lrpblhd.exe 2696 ttdrvtt.exe 2856 jrdltll.exe 1672 vrxvtrf.exe 1396 bnrlttv.exe 1016 xhdlh.exe 1524 dlpvp.exe 1040 fdjxj.exe 2372 rrvnh.exe 2924 dlfftdt.exe 2324 dvvvhr.exe 1664 xlrbl.exe 2212 bpvvbp.exe 1992 rldtlh.exe 1272 fxflv.exe 3040 nxhxn.exe 1048 djrpt.exe 1532 dxthr.exe 3060 pthhrx.exe 292 hbffpbr.exe 2264 nprffvv.exe 1288 vnxvr.exe 2432 dvrdbn.exe 1588 pptdd.exe 2636 tjvxxvr.exe 2748 jlxnrp.exe 2744 fvjjr.exe 2584 dlvlhxl.exe 2568 bldpvlx.exe 2992 jjbjn.exe 2500 lvdtxdx.exe 2476 xbhrb.exe 1496 drbjftb.exe 768 lfpvf.exe 2800 htbtnpx.exe 2596 tvjtlhx.exe 2844 xhvxrhp.exe 2412 hfrbj.exe 2176 vfxdl.exe 2436 djxvxp.exe 1952 pbrxrx.exe 2452 xxhnx.exe 2484 nxtpvxh.exe 2320 xdjhpd.exe 1800 rhxft.exe 2940 hphrtb.exe 2284 tvbtpj.exe 1832 rtrfx.exe 908 jvbvd.exe 2100 blvpxb.exe 1380 ljxdh.exe 1756 fhldj.exe 1372 xrvttj.exe 1056 ntfpplj.exe -
resource yara_rule behavioral1/memory/2188-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/440-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-353-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-378-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-387-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-395-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-403-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-411-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-419-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-436-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-437-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-445-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-454-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-469-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-477-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-499-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 1688 2188 20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe 28 PID 2188 wrote to memory of 1688 2188 20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe 28 PID 2188 wrote to memory of 1688 2188 20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe 28 PID 2188 wrote to memory of 1688 2188 20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe 28 PID 1688 wrote to memory of 2604 1688 hdjdrj.exe 29 PID 1688 wrote to memory of 2604 1688 hdjdrj.exe 29 PID 1688 wrote to memory of 2604 1688 hdjdrj.exe 29 PID 1688 wrote to memory of 2604 1688 hdjdrj.exe 29 PID 2604 wrote to memory of 2772 2604 pvbjh.exe 30 PID 2604 wrote to memory of 2772 2604 pvbjh.exe 30 PID 2604 wrote to memory of 2772 2604 pvbjh.exe 30 PID 2604 wrote to memory of 2772 2604 pvbjh.exe 30 PID 2772 wrote to memory of 2724 2772 trnhxxf.exe 31 PID 2772 wrote to memory of 2724 2772 trnhxxf.exe 31 PID 2772 wrote to memory of 2724 2772 trnhxxf.exe 31 PID 2772 wrote to memory of 2724 2772 trnhxxf.exe 31 PID 2724 wrote to memory of 2260 2724 jvdfhd.exe 32 PID 2724 wrote to memory of 2260 2724 jvdfhd.exe 32 PID 2724 wrote to memory of 2260 2724 jvdfhd.exe 32 PID 2724 wrote to memory of 2260 2724 jvdfhd.exe 32 PID 2260 wrote to memory of 2552 2260 nvnjrvb.exe 33 PID 2260 wrote to memory of 2552 2260 nvnjrvb.exe 33 PID 2260 wrote to memory of 2552 2260 nvnjrvb.exe 33 PID 2260 wrote to memory of 2552 2260 nvnjrvb.exe 33 PID 2552 wrote to memory of 2556 2552 tllxfhd.exe 34 PID 2552 wrote to memory of 2556 2552 tllxfhd.exe 34 PID 2552 wrote to memory of 2556 2552 tllxfhd.exe 34 PID 2552 wrote to memory of 2556 2552 tllxfhd.exe 34 PID 2556 wrote to memory of 596 2556 xjltp.exe 35 PID 2556 wrote to memory of 596 2556 xjltp.exe 35 PID 2556 wrote to memory of 596 2556 xjltp.exe 35 PID 2556 wrote to memory of 596 2556 xjltp.exe 35 PID 596 wrote to memory of 440 596 jlvllv.exe 36 PID 596 wrote to memory of 440 596 jlvllv.exe 36 PID 596 wrote to memory of 440 596 jlvllv.exe 36 PID 596 wrote to memory of 440 596 jlvllv.exe 36 PID 440 wrote to memory of 748 440 thhdbrr.exe 37 PID 440 wrote to memory of 748 440 thhdbrr.exe 37 PID 440 wrote to memory of 748 440 thhdbrr.exe 37 PID 440 wrote to memory of 748 440 thhdbrr.exe 37 PID 748 wrote to memory of 2832 748 xbdldrt.exe 38 PID 748 wrote to memory of 2832 748 xbdldrt.exe 38 PID 748 wrote to memory of 2832 748 xbdldrt.exe 38 PID 748 wrote to memory of 2832 748 xbdldrt.exe 38 PID 2832 wrote to memory of 2696 2832 lrpblhd.exe 39 PID 2832 wrote to memory of 2696 2832 lrpblhd.exe 39 PID 2832 wrote to memory of 2696 2832 lrpblhd.exe 39 PID 2832 wrote to memory of 2696 2832 lrpblhd.exe 39 PID 2696 wrote to memory of 2856 2696 ttdrvtt.exe 40 PID 2696 wrote to memory of 2856 2696 ttdrvtt.exe 40 PID 2696 wrote to memory of 2856 2696 ttdrvtt.exe 40 PID 2696 wrote to memory of 2856 2696 ttdrvtt.exe 40 PID 2856 wrote to memory of 1672 2856 jrdltll.exe 41 PID 2856 wrote to memory of 1672 2856 jrdltll.exe 41 PID 2856 wrote to memory of 1672 2856 jrdltll.exe 41 PID 2856 wrote to memory of 1672 2856 jrdltll.exe 41 PID 1672 wrote to memory of 1396 1672 vrxvtrf.exe 42 PID 1672 wrote to memory of 1396 1672 vrxvtrf.exe 42 PID 1672 wrote to memory of 1396 1672 vrxvtrf.exe 42 PID 1672 wrote to memory of 1396 1672 vrxvtrf.exe 42 PID 1396 wrote to memory of 1016 1396 bnrlttv.exe 43 PID 1396 wrote to memory of 1016 1396 bnrlttv.exe 43 PID 1396 wrote to memory of 1016 1396 bnrlttv.exe 43 PID 1396 wrote to memory of 1016 1396 bnrlttv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe"C:\Users\Admin\AppData\Local\Temp\20dfc6eb8377513ad0500f565bd49150_exe32_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\hdjdrj.exec:\hdjdrj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\pvbjh.exec:\pvbjh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\trnhxxf.exec:\trnhxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\jvdfhd.exec:\jvdfhd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nvnjrvb.exec:\nvnjrvb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\tllxfhd.exec:\tllxfhd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\xjltp.exec:\xjltp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jlvllv.exec:\jlvllv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\thhdbrr.exec:\thhdbrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\xbdldrt.exec:\xbdldrt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\lrpblhd.exec:\lrpblhd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\ttdrvtt.exec:\ttdrvtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jrdltll.exec:\jrdltll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vrxvtrf.exec:\vrxvtrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\bnrlttv.exec:\bnrlttv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\xhdlh.exec:\xhdlh.exe17⤵
- Executes dropped EXE
PID:1016 -
\??\c:\dlpvp.exec:\dlpvp.exe18⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fdjxj.exec:\fdjxj.exe19⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rrvnh.exec:\rrvnh.exe20⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dlfftdt.exec:\dlfftdt.exe21⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dvvvhr.exec:\dvvvhr.exe22⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xlrbl.exec:\xlrbl.exe23⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bpvvbp.exec:\bpvvbp.exe24⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rldtlh.exec:\rldtlh.exe25⤵
- Executes dropped EXE
PID:1992 -
\??\c:\fxflv.exec:\fxflv.exe26⤵
- Executes dropped EXE
PID:1272 -
\??\c:\nxhxn.exec:\nxhxn.exe27⤵
- Executes dropped EXE
PID:3040 -
\??\c:\djrpt.exec:\djrpt.exe28⤵
- Executes dropped EXE
PID:1048 -
\??\c:\dxthr.exec:\dxthr.exe29⤵
- Executes dropped EXE
PID:1532 -
\??\c:\pthhrx.exec:\pthhrx.exe30⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hbffpbr.exec:\hbffpbr.exe31⤵
- Executes dropped EXE
PID:292 -
\??\c:\nprffvv.exec:\nprffvv.exe32⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vnxvr.exec:\vnxvr.exe33⤵
- Executes dropped EXE
PID:1288 -
\??\c:\dvrdbn.exec:\dvrdbn.exe34⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pptdd.exec:\pptdd.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tjvxxvr.exec:\tjvxxvr.exe36⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jlxnrp.exec:\jlxnrp.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\fvjjr.exec:\fvjjr.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\dlvlhxl.exec:\dlvlhxl.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bldpvlx.exec:\bldpvlx.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\jjbjn.exec:\jjbjn.exe41⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lvdtxdx.exec:\lvdtxdx.exe42⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xbhrb.exec:\xbhrb.exe43⤵
- Executes dropped EXE
PID:2476 -
\??\c:\drbjftb.exec:\drbjftb.exe44⤵
- Executes dropped EXE
PID:1496 -
\??\c:\lfpvf.exec:\lfpvf.exe45⤵
- Executes dropped EXE
PID:768 -
\??\c:\htbtnpx.exec:\htbtnpx.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\tvjtlhx.exec:\tvjtlhx.exe47⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xhvxrhp.exec:\xhvxrhp.exe48⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hfrbj.exec:\hfrbj.exe49⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vfxdl.exec:\vfxdl.exe50⤵
- Executes dropped EXE
PID:2176 -
\??\c:\djxvxp.exec:\djxvxp.exe51⤵
- Executes dropped EXE
PID:2436 -
\??\c:\pbrxrx.exec:\pbrxrx.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xxhnx.exec:\xxhnx.exe53⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nxtpvxh.exec:\nxtpvxh.exe54⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xdjhpd.exec:\xdjhpd.exe55⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rhxft.exec:\rhxft.exe56⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hphrtb.exec:\hphrtb.exe57⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tvbtpj.exec:\tvbtpj.exe58⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rtrfx.exec:\rtrfx.exe59⤵
- Executes dropped EXE
PID:1832 -
\??\c:\jvbvd.exec:\jvbvd.exe60⤵
- Executes dropped EXE
PID:908 -
\??\c:\blvpxb.exec:\blvpxb.exe61⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ljxdh.exec:\ljxdh.exe62⤵
- Executes dropped EXE
PID:1380 -
\??\c:\fhldj.exec:\fhldj.exe63⤵
- Executes dropped EXE
PID:1756 -
\??\c:\xrvttj.exec:\xrvttj.exe64⤵
- Executes dropped EXE
PID:1372 -
\??\c:\ntfpplj.exec:\ntfpplj.exe65⤵
- Executes dropped EXE
PID:1056 -
\??\c:\fnjnbdr.exec:\fnjnbdr.exe66⤵PID:608
-
\??\c:\xphrlx.exec:\xphrlx.exe67⤵PID:2948
-
\??\c:\rfvjxp.exec:\rfvjxp.exe68⤵PID:2316
-
\??\c:\ddbxnrd.exec:\ddbxnrd.exe69⤵PID:1284
-
\??\c:\ljxtt.exec:\ljxtt.exe70⤵PID:1532
-
\??\c:\jrftlf.exec:\jrftlf.exe71⤵PID:2228
-
\??\c:\flhhd.exec:\flhhd.exe72⤵PID:1748
-
\??\c:\bntpb.exec:\bntpb.exe73⤵PID:2220
-
\??\c:\dhhttd.exec:\dhhttd.exe74⤵PID:2256
-
\??\c:\pjjpvr.exec:\pjjpvr.exe75⤵PID:3052
-
\??\c:\xlrvbf.exec:\xlrvbf.exe76⤵PID:1592
-
\??\c:\rbbph.exec:\rbbph.exe77⤵PID:2652
-
\??\c:\jxnfvb.exec:\jxnfvb.exe78⤵PID:2504
-
\??\c:\jdrphb.exec:\jdrphb.exe79⤵PID:2884
-
\??\c:\htbln.exec:\htbln.exe80⤵PID:2744
-
\??\c:\jjpbtdx.exec:\jjpbtdx.exe81⤵PID:2520
-
\??\c:\vtlvdt.exec:\vtlvdt.exe82⤵PID:2552
-
\??\c:\lrvtfh.exec:\lrvtfh.exe83⤵PID:528
-
\??\c:\npldndh.exec:\npldndh.exe84⤵PID:476
-
\??\c:\tndbnhd.exec:\tndbnhd.exe85⤵PID:672
-
\??\c:\xjrndrb.exec:\xjrndrb.exe86⤵PID:2684
-
\??\c:\txnpr.exec:\txnpr.exe87⤵PID:2788
-
\??\c:\hbrlvtx.exec:\hbrlvtx.exe88⤵PID:2672
-
\??\c:\rvfdfrf.exec:\rvfdfrf.exe89⤵PID:1808
-
\??\c:\fdbhjr.exec:\fdbhjr.exe90⤵PID:2596
-
\??\c:\nxdjrxj.exec:\nxdjrxj.exe91⤵PID:1740
-
\??\c:\hxlpn.exec:\hxlpn.exe92⤵PID:1988
-
\??\c:\ntnnftt.exec:\ntnnftt.exe93⤵PID:948
-
\??\c:\fnjdrj.exec:\fnjdrj.exe94⤵PID:980
-
\??\c:\rthrr.exec:\rthrr.exe95⤵PID:1348
-
\??\c:\xtxjd.exec:\xtxjd.exe96⤵PID:1524
-
\??\c:\vbxnflv.exec:\vbxnflv.exe97⤵PID:2388
-
\??\c:\hjfvfv.exec:\hjfvfv.exe98⤵PID:2012
-
\??\c:\ffhrhrx.exec:\ffhrhrx.exe99⤵PID:2380
-
\??\c:\xtrnpv.exec:\xtrnpv.exe100⤵PID:1196
-
\??\c:\vtxfph.exec:\vtxfph.exe101⤵PID:3044
-
\??\c:\ppxtn.exec:\ppxtn.exe102⤵PID:2280
-
\??\c:\bffrpft.exec:\bffrpft.exe103⤵PID:1332
-
\??\c:\pxvllj.exec:\pxvllj.exe104⤵PID:1232
-
\??\c:\vrltff.exec:\vrltff.exe105⤵PID:976
-
\??\c:\rlhfrt.exec:\rlhfrt.exe106⤵PID:1088
-
\??\c:\pjxrfr.exec:\pjxrfr.exe107⤵PID:320
-
\??\c:\jrtdvr.exec:\jrtdvr.exe108⤵PID:1124
-
\??\c:\njjljh.exec:\njjljh.exe109⤵PID:2972
-
\??\c:\rdxpp.exec:\rdxpp.exe110⤵PID:2900
-
\??\c:\rhpth.exec:\rhpth.exe111⤵PID:1480
-
\??\c:\ndxbljl.exec:\ndxbljl.exe112⤵PID:1572
-
\??\c:\phfbtnj.exec:\phfbtnj.exe113⤵PID:836
-
\??\c:\ftrrh.exec:\ftrrh.exe114⤵PID:1304
-
\??\c:\jvrpp.exec:\jvrpp.exe115⤵PID:1748
-
\??\c:\pvfbtxj.exec:\pvfbtxj.exe116⤵PID:2180
-
\??\c:\jxtjd.exec:\jxtjd.exe117⤵PID:1616
-
\??\c:\hlrxxp.exec:\hlrxxp.exe118⤵PID:1568
-
\??\c:\llprnj.exec:\llprnj.exe119⤵PID:2636
-
\??\c:\lvptpt.exec:\lvptpt.exe120⤵PID:3068
-
\??\c:\hphxhdp.exec:\hphxhdp.exe121⤵PID:2876
-
\??\c:\dnltxf.exec:\dnltxf.exe122⤵PID:2516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-