Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 23:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4382cc5cba3c53b8b7df40f46f3d8927.exe
Resource
win7-20231215-en
5 signatures
150 seconds
General
-
Target
4382cc5cba3c53b8b7df40f46f3d8927.exe
-
Size
130KB
-
MD5
4382cc5cba3c53b8b7df40f46f3d8927
-
SHA1
ceaea59ba473551752b83db0d74cea575a045805
-
SHA256
e021ea7ae5d899173073b97bbf0ffb60d0ac3e021571585ae4fd5534439f9396
-
SHA512
aeae07c480a6de6b19e3af53d669652e4a395087c5eec43fffc876c1e73eda8f243314a85249f14babf91b8599af0ff2b7fa7f5defb53e9d9a8bea3f60d401bc
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9ggGQGGqOOPcJC:n3C9BRo7tvnJ90Gq/0JC
Malware Config
Signatures
-
Detect Blackmoon payload 33 IoCs
resource yara_rule behavioral1/memory/2068-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-378-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-387-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-403-0x00000000001B0000-0x00000000001BC000-memory.dmp family_blackmoon behavioral1/memory/2628-402-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-421-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-460-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-479-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-486-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-539-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-548-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2864 rvpht.exe 1748 jlnxjfh.exe 1404 trnvpv.exe 1212 jljbnd.exe 840 xhrvrh.exe 2824 nxnjr.exe 2612 tbnnt.exe 2404 xxrlj.exe 2516 tdvfdjx.exe 2620 ldfbrp.exe 2496 vnvxft.exe 2944 lbpprj.exe 2436 nbjvrv.exe 1924 vxbvxf.exe 1968 phhdttx.exe 2000 npfjbxb.exe 2008 nbnvl.exe 1876 rvnbh.exe 468 ljtdf.exe 928 phtndbx.exe 2728 xnnbdr.exe 2768 dtxnhft.exe 1036 rrtpdbl.exe 2304 rnljvd.exe 1536 pvtdl.exe 1520 dxdxdx.exe 1740 rrrtphf.exe 1824 fxxvxl.exe 1980 pthdrx.exe 2212 dphprv.exe 3016 bjbjl.exe 2444 lptxlfp.exe 1720 vhjnpf.exe 2432 vhthh.exe 2060 xvpvhd.exe 1896 ltbntt.exe 2076 pvnvpl.exe 1404 nhbbxhf.exe 2972 xfdnr.exe 3040 bvtnr.exe 2628 hjlfnxl.exe 2724 dfdrdx.exe 2488 ptbtvr.exe 2828 lvdhr.exe 2516 nrpnrxr.exe 2544 nntnvxv.exe 2948 hrfhh.exe 2464 hxjnfjn.exe 2020 pfnjftj.exe 1052 flnlh.exe 2128 nxbbtln.exe 2004 fpjdtlh.exe 1864 rbjjtnp.exe 1696 jphvnhd.exe 2540 lbdpph.exe 2468 vhjxpr.exe 2816 hthtbhv.exe 2220 dtlrd.exe 1468 ptlnf.exe 2768 nprbfdn.exe 1064 fhxrxpr.exe 2304 tjrbxbl.exe 1820 htdpnv.exe 2108 bhjntj.exe -
resource yara_rule behavioral1/memory/2068-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-378-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-387-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-402-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-411-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-419-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-421-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-436-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-451-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-459-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-460-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-468-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-476-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-479-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-486-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-493-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-501-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-509-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-531-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-539-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-547-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-548-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2864 2068 4382cc5cba3c53b8b7df40f46f3d8927.exe 28 PID 2068 wrote to memory of 2864 2068 4382cc5cba3c53b8b7df40f46f3d8927.exe 28 PID 2068 wrote to memory of 2864 2068 4382cc5cba3c53b8b7df40f46f3d8927.exe 28 PID 2068 wrote to memory of 2864 2068 4382cc5cba3c53b8b7df40f46f3d8927.exe 28 PID 2864 wrote to memory of 1748 2864 rvpht.exe 29 PID 2864 wrote to memory of 1748 2864 rvpht.exe 29 PID 2864 wrote to memory of 1748 2864 rvpht.exe 29 PID 2864 wrote to memory of 1748 2864 rvpht.exe 29 PID 1748 wrote to memory of 1404 1748 jlnxjfh.exe 30 PID 1748 wrote to memory of 1404 1748 jlnxjfh.exe 30 PID 1748 wrote to memory of 1404 1748 jlnxjfh.exe 30 PID 1748 wrote to memory of 1404 1748 jlnxjfh.exe 30 PID 1404 wrote to memory of 1212 1404 trnvpv.exe 31 PID 1404 wrote to memory of 1212 1404 trnvpv.exe 31 PID 1404 wrote to memory of 1212 1404 trnvpv.exe 31 PID 1404 wrote to memory of 1212 1404 trnvpv.exe 31 PID 1212 wrote to memory of 840 1212 jljbnd.exe 32 PID 1212 wrote to memory of 840 1212 jljbnd.exe 32 PID 1212 wrote to memory of 840 1212 jljbnd.exe 32 PID 1212 wrote to memory of 840 1212 jljbnd.exe 32 PID 840 wrote to memory of 2824 840 xhrvrh.exe 33 PID 840 wrote to memory of 2824 840 xhrvrh.exe 33 PID 840 wrote to memory of 2824 840 xhrvrh.exe 33 PID 840 wrote to memory of 2824 840 xhrvrh.exe 33 PID 2824 wrote to memory of 2612 2824 nxnjr.exe 34 PID 2824 wrote to memory of 2612 2824 nxnjr.exe 34 PID 2824 wrote to memory of 2612 2824 nxnjr.exe 34 PID 2824 wrote to memory of 2612 2824 nxnjr.exe 34 PID 2612 wrote to memory of 2404 2612 tbnnt.exe 35 PID 2612 wrote to memory of 2404 2612 tbnnt.exe 35 PID 2612 wrote to memory of 2404 2612 tbnnt.exe 35 PID 2612 wrote to memory of 2404 2612 tbnnt.exe 35 PID 2404 wrote to memory of 2516 2404 xxrlj.exe 36 PID 2404 wrote to memory of 2516 2404 xxrlj.exe 36 PID 2404 wrote to memory of 2516 2404 xxrlj.exe 36 PID 2404 wrote to memory of 2516 2404 xxrlj.exe 36 PID 2516 wrote to memory of 2620 2516 tdvfdjx.exe 37 PID 2516 wrote to memory of 2620 2516 tdvfdjx.exe 37 PID 2516 wrote to memory of 2620 2516 tdvfdjx.exe 37 PID 2516 wrote to memory of 2620 2516 tdvfdjx.exe 37 PID 2620 wrote to memory of 2496 2620 ldfbrp.exe 38 PID 2620 wrote to memory of 2496 2620 ldfbrp.exe 38 PID 2620 wrote to memory of 2496 2620 ldfbrp.exe 38 PID 2620 wrote to memory of 2496 2620 ldfbrp.exe 38 PID 2496 wrote to memory of 2944 2496 vnvxft.exe 39 PID 2496 wrote to memory of 2944 2496 vnvxft.exe 39 PID 2496 wrote to memory of 2944 2496 vnvxft.exe 39 PID 2496 wrote to memory of 2944 2496 vnvxft.exe 39 PID 2944 wrote to memory of 2436 2944 lbpprj.exe 40 PID 2944 wrote to memory of 2436 2944 lbpprj.exe 40 PID 2944 wrote to memory of 2436 2944 lbpprj.exe 40 PID 2944 wrote to memory of 2436 2944 lbpprj.exe 40 PID 2436 wrote to memory of 1924 2436 nbjvrv.exe 41 PID 2436 wrote to memory of 1924 2436 nbjvrv.exe 41 PID 2436 wrote to memory of 1924 2436 nbjvrv.exe 41 PID 2436 wrote to memory of 1924 2436 nbjvrv.exe 41 PID 1924 wrote to memory of 1968 1924 vxbvxf.exe 42 PID 1924 wrote to memory of 1968 1924 vxbvxf.exe 42 PID 1924 wrote to memory of 1968 1924 vxbvxf.exe 42 PID 1924 wrote to memory of 1968 1924 vxbvxf.exe 42 PID 1968 wrote to memory of 2000 1968 phhdttx.exe 43 PID 1968 wrote to memory of 2000 1968 phhdttx.exe 43 PID 1968 wrote to memory of 2000 1968 phhdttx.exe 43 PID 1968 wrote to memory of 2000 1968 phhdttx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4382cc5cba3c53b8b7df40f46f3d8927.exe"C:\Users\Admin\AppData\Local\Temp\4382cc5cba3c53b8b7df40f46f3d8927.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\rvpht.exec:\rvpht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\jlnxjfh.exec:\jlnxjfh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\trnvpv.exec:\trnvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\jljbnd.exec:\jljbnd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\xhrvrh.exec:\xhrvrh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\nxnjr.exec:\nxnjr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\tbnnt.exec:\tbnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\xxrlj.exec:\xxrlj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\tdvfdjx.exec:\tdvfdjx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\ldfbrp.exec:\ldfbrp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vnvxft.exec:\vnvxft.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\lbpprj.exec:\lbpprj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\nbjvrv.exec:\nbjvrv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\vxbvxf.exec:\vxbvxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\phhdttx.exec:\phhdttx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\npfjbxb.exec:\npfjbxb.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nbnvl.exec:\nbnvl.exe18⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rvnbh.exec:\rvnbh.exe19⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ljtdf.exec:\ljtdf.exe20⤵
- Executes dropped EXE
PID:468 -
\??\c:\phtndbx.exec:\phtndbx.exe21⤵
- Executes dropped EXE
PID:928 -
\??\c:\xnnbdr.exec:\xnnbdr.exe22⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dtxnhft.exec:\dtxnhft.exe23⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rrtpdbl.exec:\rrtpdbl.exe24⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rnljvd.exec:\rnljvd.exe25⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pvtdl.exec:\pvtdl.exe26⤵
- Executes dropped EXE
PID:1536 -
\??\c:\dxdxdx.exec:\dxdxdx.exe27⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rrrtphf.exec:\rrrtphf.exe28⤵
- Executes dropped EXE
PID:1740 -
\??\c:\fxxvxl.exec:\fxxvxl.exe29⤵
- Executes dropped EXE
PID:1824 -
\??\c:\pthdrx.exec:\pthdrx.exe30⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dphprv.exec:\dphprv.exe31⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bjbjl.exec:\bjbjl.exe32⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lptxlfp.exec:\lptxlfp.exe33⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vhjnpf.exec:\vhjnpf.exe34⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vhthh.exec:\vhthh.exe35⤵
- Executes dropped EXE
PID:2432 -
\??\c:\xvpvhd.exec:\xvpvhd.exe36⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ltbntt.exec:\ltbntt.exe37⤵
- Executes dropped EXE
PID:1896 -
\??\c:\pvnvpl.exec:\pvnvpl.exe38⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nhbbxhf.exec:\nhbbxhf.exe39⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xfdnr.exec:\xfdnr.exe40⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bvtnr.exec:\bvtnr.exe41⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hjlfnxl.exec:\hjlfnxl.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\dfdrdx.exec:\dfdrdx.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ptbtvr.exec:\ptbtvr.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lvdhr.exec:\lvdhr.exe45⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nrpnrxr.exec:\nrpnrxr.exe46⤵
- Executes dropped EXE
PID:2516 -
\??\c:\nntnvxv.exec:\nntnvxv.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hrfhh.exec:\hrfhh.exe48⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hxjnfjn.exec:\hxjnfjn.exe49⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pfnjftj.exec:\pfnjftj.exe50⤵
- Executes dropped EXE
PID:2020 -
\??\c:\flnlh.exec:\flnlh.exe51⤵
- Executes dropped EXE
PID:1052 -
\??\c:\nxbbtln.exec:\nxbbtln.exe52⤵
- Executes dropped EXE
PID:2128 -
\??\c:\fpjdtlh.exec:\fpjdtlh.exe53⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rbjjtnp.exec:\rbjjtnp.exe54⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jphvnhd.exec:\jphvnhd.exe55⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lbdpph.exec:\lbdpph.exe56⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vhjxpr.exec:\vhjxpr.exe57⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hthtbhv.exec:\hthtbhv.exe58⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dtlrd.exec:\dtlrd.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ptlnf.exec:\ptlnf.exe60⤵
- Executes dropped EXE
PID:1468 -
\??\c:\nprbfdn.exec:\nprbfdn.exe61⤵
- Executes dropped EXE
PID:2768 -
\??\c:\fhxrxpr.exec:\fhxrxpr.exe62⤵
- Executes dropped EXE
PID:1064 -
\??\c:\tjrbxbl.exec:\tjrbxbl.exe63⤵
- Executes dropped EXE
PID:2304 -
\??\c:\htdpnv.exec:\htdpnv.exe64⤵
- Executes dropped EXE
PID:1820 -
\??\c:\bhjntj.exec:\bhjntj.exe65⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jxrrxr.exec:\jxrrxr.exe66⤵PID:2424
-
\??\c:\ppnvvlv.exec:\ppnvvlv.exe67⤵PID:1060
-
\??\c:\bnhdjx.exec:\bnhdjx.exe68⤵PID:1016
-
\??\c:\tpflbd.exec:\tpflbd.exe69⤵PID:664
-
\??\c:\lbtrb.exec:\lbtrb.exe70⤵PID:628
-
\??\c:\pdtdf.exec:\pdtdf.exe71⤵PID:872
-
\??\c:\djlbd.exec:\djlbd.exe72⤵PID:880
-
\??\c:\nlflx.exec:\nlflx.exe73⤵PID:2444
-
\??\c:\hlbpxp.exec:\hlbpxp.exe74⤵PID:1104
-
\??\c:\lppdp.exec:\lppdp.exe75⤵PID:2432
-
\??\c:\bnhnp.exec:\bnhnp.exe76⤵PID:1460
-
\??\c:\pftxrpl.exec:\pftxrpl.exe77⤵PID:2904
-
\??\c:\dfblvxx.exec:\dfblvxx.exe78⤵PID:2924
-
\??\c:\htdnr.exec:\htdnr.exe79⤵PID:2564
-
\??\c:\xvvdh.exec:\xvvdh.exe80⤵PID:1764
-
\??\c:\hvxtl.exec:\hvxtl.exe81⤵PID:2668
-
\??\c:\pnhxnx.exec:\pnhxnx.exe82⤵PID:2588
-
\??\c:\ppxxtff.exec:\ppxxtff.exe83⤵PID:2708
-
\??\c:\jxrfxr.exec:\jxrfxr.exe84⤵PID:2612
-
\??\c:\rtlhd.exec:\rtlhd.exe85⤵PID:3012
-
\??\c:\xlrjv.exec:\xlrjv.exe86⤵PID:2736
-
\??\c:\lpjtvx.exec:\lpjtvx.exe87⤵PID:2476
-
\??\c:\hjrpr.exec:\hjrpr.exe88⤵PID:2556
-
\??\c:\rbrtbp.exec:\rbrtbp.exe89⤵PID:2524
-
\??\c:\dlrprrd.exec:\dlrprrd.exe90⤵PID:1972
-
\??\c:\ljrfnlf.exec:\ljrfnlf.exe91⤵PID:1716
-
\??\c:\fhvlpxv.exec:\fhvlpxv.exe92⤵PID:836
-
\??\c:\fjjdd.exec:\fjjdd.exe93⤵PID:2024
-
\??\c:\dxbrp.exec:\dxbrp.exe94⤵PID:1988
-
\??\c:\rnxnddh.exec:\rnxnddh.exe95⤵PID:2004
-
\??\c:\drhlfrh.exec:\drhlfrh.exe96⤵PID:1864
-
\??\c:\rdlff.exec:\rdlff.exe97⤵PID:1560
-
\??\c:\fvbphhp.exec:\fvbphhp.exe98⤵PID:2800
-
\??\c:\rhjlrd.exec:\rhjlrd.exe99⤵PID:2772
-
\??\c:\prdpvjf.exec:\prdpvjf.exe100⤵PID:2916
-
\??\c:\hhpfhjh.exec:\hhpfhjh.exe101⤵PID:2520
-
\??\c:\nbnxr.exec:\nbnxr.exe102⤵PID:1468
-
\??\c:\nvlvpn.exec:\nvlvpn.exe103⤵PID:2768
-
\??\c:\nxbxh.exec:\nxbxh.exe104⤵PID:1064
-
\??\c:\vrbvxf.exec:\vrbvxf.exe105⤵PID:2304
-
\??\c:\hthbjtj.exec:\hthbjtj.exe106⤵PID:1668
-
\??\c:\rrbpb.exec:\rrbpb.exe107⤵PID:1372
-
\??\c:\pdnljln.exec:\pdnljln.exe108⤵PID:1456
-
\??\c:\pvlhbnn.exec:\pvlhbnn.exe109⤵PID:984
-
\??\c:\nnbhvpn.exec:\nnbhvpn.exe110⤵PID:1016
-
\??\c:\hdvjdrf.exec:\hdvjdrf.exe111⤵PID:2380
-
\??\c:\npdxphh.exec:\npdxphh.exe112⤵PID:628
-
\??\c:\vplrt.exec:\vplrt.exe113⤵PID:872
-
\??\c:\lxfhd.exec:\lxfhd.exe114⤵PID:1592
-
\??\c:\pxjxnx.exec:\pxjxnx.exe115⤵PID:1508
-
\??\c:\vnrhjr.exec:\vnrhjr.exe116⤵PID:1892
-
\??\c:\dxtlrlj.exec:\dxtlrlj.exe117⤵PID:2388
-
\??\c:\dtjlnvl.exec:\dtjlnvl.exe118⤵PID:1368
-
\??\c:\htdrn.exec:\htdrn.exe119⤵PID:2968
-
\??\c:\xxbhfn.exec:\xxbhfn.exe120⤵PID:2760
-
\??\c:\ljhxxj.exec:\ljhxxj.exe121⤵PID:292
-
\??\c:\ndtfl.exec:\ndtfl.exe122⤵PID:840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-