Analysis
-
max time kernel
100s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
15-10-2023 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
81b2f02b654b9a429a052e3566432420_exe32.exe
Resource
win7-20230831-en
windows7-x64
5 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
81b2f02b654b9a429a052e3566432420_exe32.exe
-
Size
109KB
-
MD5
81b2f02b654b9a429a052e3566432420
-
SHA1
68db8751f9b50a208ff2e4f9b76e63a5fba3fedf
-
SHA256
4e18614f43d1223d852f914b847a3b826801f07e3c6fc3cb77ac816d9ba023f2
-
SHA512
04126f47df78fae81c7fa40cc3a6d46a5b7d6014eb968d9d419303e1e37b97b51afdbda1c94a32f9e8c0e36429795bec57d141a3df19a38511d0ffec82cfe3dd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJUeDZos5ZNOEX64C:ymb3NkkiQ3mdBjFI6ix5ZNOENC
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral1/memory/2104-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/800-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1332-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-381-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-406-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-449-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-463-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-527-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2856 hlbljx.exe 2716 ltjjnv.exe 2868 thvvjjj.exe 2752 nntxpl.exe 2748 hhpfvl.exe 2504 thjljbx.exe 2936 hbjnl.exe 584 pfdrprl.exe 564 vtvrlnb.exe 568 npfjlj.exe 1964 xvflfrh.exe 2824 ttxffr.exe 1500 djxjxn.exe 1940 ntbpdxn.exe 2432 hvhphr.exe 2264 ttvdhv.exe 2412 hrtjn.exe 800 bdnhjnv.exe 2380 nvrbxd.exe 1328 pbdjnlp.exe 1920 nbljhfb.exe 1808 jjlxrpd.exe 436 jbpjtr.exe 1352 jvfbntb.exe 776 lrvrf.exe 1332 tbxfbdd.exe 1980 hxtvt.exe 1784 dxxfnvn.exe 2316 vnfrtlr.exe 2416 vvbrftv.exe 876 bbdttd.exe 2984 vfjnrld.exe 2628 pddtxl.exe 2920 xbdtbb.exe 2880 ffbdd.exe 3032 fbtxddd.exe 1756 hlllfd.exe 2536 fnffxl.exe 2548 lhvjh.exe 2520 lvfrv.exe 2496 bdlnvh.exe 2480 vrdtl.exe 268 xvlvlp.exe 580 lhhvb.exe 632 plvhdd.exe 1056 vbdrffp.exe 2552 jttrvb.exe 756 xdrrnv.exe 2688 bdxtdlf.exe 1876 fxfnlt.exe 1460 ppbtlb.exe 1852 tbtpplf.exe 1040 jxnrbd.exe 308 pnvvrlx.exe 2540 frvnj.exe 1796 xvtvbht.exe 1752 lvrldf.exe 2304 vbdnfr.exe 2892 tfnxv.exe 1328 bfjtbbp.exe 1600 rlltlv.exe 2312 djfrvfh.exe 2144 phpvpf.exe 2008 xfjjb.exe -
resource yara_rule behavioral1/memory/2104-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/436-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1332-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1332-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-372-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-389-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-406-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-449-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-463-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-479-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-494-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-502-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-510-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-518-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-527-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-526-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2856 2104 81b2f02b654b9a429a052e3566432420_exe32.exe 28 PID 2104 wrote to memory of 2856 2104 81b2f02b654b9a429a052e3566432420_exe32.exe 28 PID 2104 wrote to memory of 2856 2104 81b2f02b654b9a429a052e3566432420_exe32.exe 28 PID 2104 wrote to memory of 2856 2104 81b2f02b654b9a429a052e3566432420_exe32.exe 28 PID 2856 wrote to memory of 2716 2856 hlbljx.exe 29 PID 2856 wrote to memory of 2716 2856 hlbljx.exe 29 PID 2856 wrote to memory of 2716 2856 hlbljx.exe 29 PID 2856 wrote to memory of 2716 2856 hlbljx.exe 29 PID 2716 wrote to memory of 2868 2716 ltjjnv.exe 30 PID 2716 wrote to memory of 2868 2716 ltjjnv.exe 30 PID 2716 wrote to memory of 2868 2716 ltjjnv.exe 30 PID 2716 wrote to memory of 2868 2716 ltjjnv.exe 30 PID 2868 wrote to memory of 2752 2868 thvvjjj.exe 31 PID 2868 wrote to memory of 2752 2868 thvvjjj.exe 31 PID 2868 wrote to memory of 2752 2868 thvvjjj.exe 31 PID 2868 wrote to memory of 2752 2868 thvvjjj.exe 31 PID 2752 wrote to memory of 2748 2752 nntxpl.exe 32 PID 2752 wrote to memory of 2748 2752 nntxpl.exe 32 PID 2752 wrote to memory of 2748 2752 nntxpl.exe 32 PID 2752 wrote to memory of 2748 2752 nntxpl.exe 32 PID 2748 wrote to memory of 2504 2748 hhpfvl.exe 33 PID 2748 wrote to memory of 2504 2748 hhpfvl.exe 33 PID 2748 wrote to memory of 2504 2748 hhpfvl.exe 33 PID 2748 wrote to memory of 2504 2748 hhpfvl.exe 33 PID 2504 wrote to memory of 2936 2504 thjljbx.exe 34 PID 2504 wrote to memory of 2936 2504 thjljbx.exe 34 PID 2504 wrote to memory of 2936 2504 thjljbx.exe 34 PID 2504 wrote to memory of 2936 2504 thjljbx.exe 34 PID 2936 wrote to memory of 584 2936 hbjnl.exe 35 PID 2936 wrote to memory of 584 2936 hbjnl.exe 35 PID 2936 wrote to memory of 584 2936 hbjnl.exe 35 PID 2936 wrote to memory of 584 2936 hbjnl.exe 35 PID 584 wrote to memory of 564 584 pfdrprl.exe 38 PID 584 wrote to memory of 564 584 pfdrprl.exe 38 PID 584 wrote to memory of 564 584 pfdrprl.exe 38 PID 584 wrote to memory of 564 584 pfdrprl.exe 38 PID 564 wrote to memory of 568 564 vtvrlnb.exe 36 PID 564 wrote to memory of 568 564 vtvrlnb.exe 36 PID 564 wrote to memory of 568 564 vtvrlnb.exe 36 PID 564 wrote to memory of 568 564 vtvrlnb.exe 36 PID 568 wrote to memory of 1964 568 npfjlj.exe 37 PID 568 wrote to memory of 1964 568 npfjlj.exe 37 PID 568 wrote to memory of 1964 568 npfjlj.exe 37 PID 568 wrote to memory of 1964 568 npfjlj.exe 37 PID 1964 wrote to memory of 2824 1964 xvflfrh.exe 43 PID 1964 wrote to memory of 2824 1964 xvflfrh.exe 43 PID 1964 wrote to memory of 2824 1964 xvflfrh.exe 43 PID 1964 wrote to memory of 2824 1964 xvflfrh.exe 43 PID 2824 wrote to memory of 1500 2824 ttxffr.exe 41 PID 2824 wrote to memory of 1500 2824 ttxffr.exe 41 PID 2824 wrote to memory of 1500 2824 ttxffr.exe 41 PID 2824 wrote to memory of 1500 2824 ttxffr.exe 41 PID 1500 wrote to memory of 1940 1500 djxjxn.exe 39 PID 1500 wrote to memory of 1940 1500 djxjxn.exe 39 PID 1500 wrote to memory of 1940 1500 djxjxn.exe 39 PID 1500 wrote to memory of 1940 1500 djxjxn.exe 39 PID 1940 wrote to memory of 2432 1940 ntbpdxn.exe 40 PID 1940 wrote to memory of 2432 1940 ntbpdxn.exe 40 PID 1940 wrote to memory of 2432 1940 ntbpdxn.exe 40 PID 1940 wrote to memory of 2432 1940 ntbpdxn.exe 40 PID 2432 wrote to memory of 2264 2432 hvhphr.exe 42 PID 2432 wrote to memory of 2264 2432 hvhphr.exe 42 PID 2432 wrote to memory of 2264 2432 hvhphr.exe 42 PID 2432 wrote to memory of 2264 2432 hvhphr.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\81b2f02b654b9a429a052e3566432420_exe32.exe"C:\Users\Admin\AppData\Local\Temp\81b2f02b654b9a429a052e3566432420_exe32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\hlbljx.exec:\hlbljx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\ltjjnv.exec:\ltjjnv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\thvvjjj.exec:\thvvjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\nntxpl.exec:\nntxpl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hhpfvl.exec:\hhpfvl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\thjljbx.exec:\thjljbx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\hbjnl.exec:\hbjnl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\pfdrprl.exec:\pfdrprl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\vtvrlnb.exec:\vtvrlnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564
-
-
-
-
-
-
-
-
-
-
\??\c:\npfjlj.exec:\npfjlj.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\xvflfrh.exec:\xvflfrh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\ttxffr.exec:\ttxffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824
-
-
-
\??\c:\ntbpdxn.exec:\ntbpdxn.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\hvhphr.exec:\hvhphr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\ttvdhv.exec:\ttvdhv.exe3⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hrtjn.exec:\hrtjn.exe4⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bdnhjnv.exec:\bdnhjnv.exe5⤵
- Executes dropped EXE
PID:800 -
\??\c:\nvrbxd.exec:\nvrbxd.exe6⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pbdjnlp.exec:\pbdjnlp.exe7⤵
- Executes dropped EXE
PID:1328 -
\??\c:\nbljhfb.exec:\nbljhfb.exe8⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jjlxrpd.exec:\jjlxrpd.exe9⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jbpjtr.exec:\jbpjtr.exe10⤵
- Executes dropped EXE
PID:436 -
\??\c:\jvfbntb.exec:\jvfbntb.exe11⤵
- Executes dropped EXE
PID:1352 -
\??\c:\lrvrf.exec:\lrvrf.exe12⤵
- Executes dropped EXE
PID:776 -
\??\c:\tbxfbdd.exec:\tbxfbdd.exe13⤵
- Executes dropped EXE
PID:1332 -
\??\c:\hxtvt.exec:\hxtvt.exe14⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dxxfnvn.exec:\dxxfnvn.exe15⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vnfrtlr.exec:\vnfrtlr.exe16⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vvbrftv.exec:\vvbrftv.exe17⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bbdttd.exec:\bbdttd.exe18⤵
- Executes dropped EXE
PID:876 -
\??\c:\vfjnrld.exec:\vfjnrld.exe19⤵
- Executes dropped EXE
PID:2984 -
\??\c:\pddtxl.exec:\pddtxl.exe20⤵
- Executes dropped EXE
PID:2628 -
\??\c:\xbdtbb.exec:\xbdtbb.exe21⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ffbdd.exec:\ffbdd.exe22⤵
- Executes dropped EXE
PID:2880 -
\??\c:\fbtxddd.exec:\fbtxddd.exe23⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hlllfd.exec:\hlllfd.exe24⤵
- Executes dropped EXE
PID:1756 -
\??\c:\fnffxl.exec:\fnffxl.exe25⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lhvjh.exec:\lhvjh.exe26⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lvfrv.exec:\lvfrv.exe27⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bdlnvh.exec:\bdlnvh.exe28⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vrdtl.exec:\vrdtl.exe29⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xvlvlp.exec:\xvlvlp.exe30⤵
- Executes dropped EXE
PID:268 -
\??\c:\lhhvb.exec:\lhhvb.exe31⤵
- Executes dropped EXE
PID:580 -
\??\c:\plvhdd.exec:\plvhdd.exe32⤵
- Executes dropped EXE
PID:632 -
\??\c:\vbdrffp.exec:\vbdrffp.exe33⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jttrvb.exec:\jttrvb.exe34⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xdrrnv.exec:\xdrrnv.exe35⤵
- Executes dropped EXE
PID:756 -
\??\c:\bdxtdlf.exec:\bdxtdlf.exe36⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxfnlt.exec:\fxfnlt.exe37⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ppbtlb.exec:\ppbtlb.exe38⤵
- Executes dropped EXE
PID:1460 -
\??\c:\tbtpplf.exec:\tbtpplf.exe39⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jxnrbd.exec:\jxnrbd.exe40⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pnvvrlx.exec:\pnvvrlx.exe41⤵
- Executes dropped EXE
PID:308 -
\??\c:\frvnj.exec:\frvnj.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xvtvbht.exec:\xvtvbht.exe43⤵
- Executes dropped EXE
PID:1796 -
\??\c:\lvrldf.exec:\lvrldf.exe44⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vbdnfr.exec:\vbdnfr.exe45⤵
- Executes dropped EXE
PID:2304 -
\??\c:\tfnxv.exec:\tfnxv.exe46⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bfjtbbp.exec:\bfjtbbp.exe47⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rlltlv.exec:\rlltlv.exe48⤵
- Executes dropped EXE
PID:1600 -
\??\c:\djfrvfh.exec:\djfrvfh.exe49⤵
- Executes dropped EXE
PID:2312 -
\??\c:\phpvpf.exec:\phpvpf.exe50⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xfjjb.exec:\xfjjb.exe51⤵
- Executes dropped EXE
PID:2008 -
\??\c:\vdfrbr.exec:\vdfrbr.exe52⤵PID:1720
-
\??\c:\ltbblxj.exec:\ltbblxj.exe53⤵PID:2356
-
\??\c:\bxvpv.exec:\bxvpv.exe54⤵PID:2352
-
\??\c:\dhjtfjl.exec:\dhjtfjl.exe55⤵PID:2212
-
\??\c:\tljtdl.exec:\tljtdl.exe56⤵PID:2408
-
\??\c:\tpdbdl.exec:\tpdbdl.exe57⤵PID:2284
-
\??\c:\hjttrp.exec:\hjttrp.exe58⤵PID:2680
-
\??\c:\jjtrbn.exec:\jjtrbn.exe59⤵PID:2416
-
\??\c:\tbhxb.exec:\tbhxb.exe60⤵PID:3020
-
\??\c:\tdjrx.exec:\tdjrx.exe61⤵PID:2108
-
\??\c:\bfnprb.exec:\bfnprb.exe62⤵PID:2116
-
\??\c:\htbfjvn.exec:\htbfjvn.exe63⤵PID:2640
-
\??\c:\nvnvrpn.exec:\nvnvrpn.exe64⤵PID:2644
-
\??\c:\bnxhxjn.exec:\bnxhxjn.exe65⤵PID:2528
-
\??\c:\lfnxf.exec:\lfnxf.exe66⤵PID:2864
-
\??\c:\njfxn.exec:\njfxn.exe67⤵PID:2636
-
\??\c:\nlnlb.exec:\nlnlb.exe68⤵PID:2536
-
\??\c:\pvvlftd.exec:\pvvlftd.exe69⤵PID:2576
-
\??\c:\tvbplp.exec:\tvbplp.exe70⤵PID:2252
-
\??\c:\xntntdh.exec:\xntntdh.exe71⤵PID:784
-
\??\c:\hnrbrl.exec:\hnrbrl.exe72⤵PID:476
-
\??\c:\pxlld.exec:\pxlld.exe73⤵PID:1660
-
\??\c:\jnljf.exec:\jnljf.exe74⤵PID:2488
-
\??\c:\vbddjft.exec:\vbddjft.exe75⤵PID:1492
-
\??\c:\jffptbd.exec:\jffptbd.exe76⤵PID:2568
-
\??\c:\tljbnpv.exec:\tljbnpv.exe77⤵PID:1236
-
\??\c:\ttnpv.exec:\ttnpv.exe78⤵PID:2520
-
\??\c:\dldnn.exec:\dldnn.exe79⤵PID:2688
-
\??\c:\rvvrlt.exec:\rvvrlt.exe80⤵PID:1500
-
\??\c:\fvjvnjt.exec:\fvjvnjt.exe81⤵PID:1648
-
\??\c:\dpvbfr.exec:\dpvbfr.exe82⤵PID:1788
-
\??\c:\xndnxld.exec:\xndnxld.exe83⤵PID:936
-
\??\c:\pvbbhj.exec:\pvbbhj.exe84⤵PID:308
-
\??\c:\jxpfnr.exec:\jxpfnr.exe85⤵PID:1656
-
\??\c:\bbjvx.exec:\bbjvx.exe86⤵PID:1796
-
\??\c:\fflbrjr.exec:\fflbrjr.exe87⤵PID:2064
-
\??\c:\hjllj.exec:\hjllj.exe88⤵PID:3056
-
\??\c:\llnvp.exec:\llnvp.exe89⤵PID:2892
-
\??\c:\bvhffnb.exec:\bvhffnb.exe90⤵PID:2060
-
\??\c:\jfjnnf.exec:\jfjnnf.exe91⤵PID:2376
-
\??\c:\jjbljvj.exec:\jjbljvj.exe92⤵PID:3068
-
\??\c:\xflnbd.exec:\xflnbd.exe93⤵PID:1364
-
\??\c:\jrxjlv.exec:\jrxjlv.exe94⤵PID:2008
-
\??\c:\dntbbx.exec:\dntbbx.exe95⤵PID:776
-
\??\c:\xxtbbrr.exec:\xxtbbrr.exe96⤵PID:1972
-
\??\c:\dlfdtv.exec:\dlfdtv.exe97⤵PID:1980
-
\??\c:\rfpvbr.exec:\rfpvbr.exe98⤵PID:2112
-
\??\c:\hnvnjfl.exec:\hnvnjfl.exe99⤵PID:2408
-
\??\c:\pjnrjb.exec:\pjnrjb.exe100⤵PID:1508
-
\??\c:\jlbrhrj.exec:\jlbrhrj.exe101⤵PID:2068
-
\??\c:\xrfdf.exec:\xrfdf.exe102⤵PID:876
-
\??\c:\jjhdpvr.exec:\jjhdpvr.exe103⤵PID:1608
-
\??\c:\ljhptv.exec:\ljhptv.exe104⤵PID:2856
-
\??\c:\jvprhfn.exec:\jvprhfn.exe105⤵PID:2604
-
\??\c:\dvbtdpn.exec:\dvbtdpn.exe106⤵PID:2640
-
\??\c:\nrbvnxx.exec:\nrbvnxx.exe107⤵PID:2760
-
\??\c:\drrvf.exec:\drrvf.exe108⤵PID:2672
-
\??\c:\vvtnlvb.exec:\vvtnlvb.exe109⤵PID:2512
-
\??\c:\nlfbt.exec:\nlfbt.exe110⤵PID:2516
-
\??\c:\drhrrj.exec:\drhrrj.exe111⤵PID:3028
-
\??\c:\frjpr.exec:\frjpr.exe112⤵PID:2956
-
\??\c:\pdxxjtl.exec:\pdxxjtl.exe113⤵PID:2480
-
\??\c:\plldnv.exec:\plldnv.exe114⤵PID:784
-
\??\c:\pplrt.exec:\pplrt.exe115⤵PID:1816
-
\??\c:\fdlvffr.exec:\fdlvffr.exe116⤵PID:2800
-
\??\c:\trvfvp.exec:\trvfvp.exe117⤵PID:864
-
\??\c:\fjnlrp.exec:\fjnlrp.exe118⤵PID:1860
-
\??\c:\flljjv.exec:\flljjv.exe119⤵PID:2200
-
\??\c:\flvxrt.exec:\flvxrt.exe120⤵PID:2188
-
\??\c:\drrxfn.exec:\drrxfn.exe121⤵PID:1196
-
\??\c:\rhvhnhj.exec:\rhvhnhj.exe122⤵PID:1820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-