Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 20:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe
-
Size
91KB
-
MD5
51cdd6629b5948817acc173d965d724d
-
SHA1
ee904d16b6d24023b0cf28da33510e33d5fce97b
-
SHA256
42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3
-
SHA512
7a0472beefb8c3a483f4866ee231ca64fea0dfe79b0fdc8d7177d08dfad12698e31187aaeb3dfa638c73293179baf7b345dde7a1aaca20513065ab957d617f15
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDvPGB1haZJ2:ymb3NkkiQ3mdBjFIk7+cz2
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2224-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1276-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1372-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral1/memory/2224-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2224-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-28-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2720-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2472-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2476-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2120-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1120-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2236-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2740-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1276-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2388-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2796-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2608-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2952-222-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1804-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1372-258-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1020-267-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2968-276-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
jbhlj.exefdpvf.exerbnfbft.exertdjbbd.exeftxdh.exexnvpj.exephtltf.exenrnndr.exetjpfpvf.exetfbnv.exexhhxvhh.exetppnd.exenjxtlll.exeptfxvf.exedjrnvjb.exeptjjx.exeddbxrd.exelbltp.exevnnlxx.exevtvvxv.exebrdbp.exernfxln.exebnxxbpd.exerrtpp.exehldrntj.exexfxppdd.exexrtbv.exejfnfv.exebhrjbf.exexlbljjn.exefvbpj.exebrjrf.exevdlrx.exebxbdbtb.exextnxv.exehffhpb.exevpblfl.exerpxrf.exejhddpn.exejvhtrth.exetdpjvpt.exeddfbfvp.exevfdftnt.exennbjh.exexvvbdx.exetnjtxn.exerxxjjt.exevlxrb.exejdhrhj.exejvrlb.exebxvhlrd.exehllfr.exepdhtt.exeppnvhd.exervbnpx.exedhvfb.exeldhvr.exevtxxpp.exejhnlrx.exenvffdd.exevjltbb.exebfhvtbp.exevjpld.exevhfrv.exepid process 2832 jbhlj.exe 2612 fdpvf.exe 2568 rbnfbft.exe 2720 rtdjbbd.exe 2632 ftxdh.exe 2736 xnvpj.exe 2472 phtltf.exe 2476 nrnndr.exe 2120 tjpfpvf.exe 1120 tfbnv.exe 2236 xhhxvhh.exe 2740 tppnd.exe 1904 njxtlll.exe 1276 ptfxvf.exe 1972 djrnvjb.exe 1524 ptjjx.exe 2008 ddbxrd.exe 2388 lbltp.exe 2064 vnnlxx.exe 2796 vtvvxv.exe 2608 brdbp.exe 2952 rnfxln.exe 1804 bnxxbpd.exe 1308 rrtpp.exe 952 hldrntj.exe 1372 xfxppdd.exe 1020 xrtbv.exe 2968 jfnfv.exe 2264 bhrjbf.exe 1000 xlbljjn.exe 872 fvbpj.exe 1692 brjrf.exe 2896 vdlrx.exe 1708 bxbdbtb.exe 3068 xtnxv.exe 2936 hffhpb.exe 2532 vpblfl.exe 2552 rpxrf.exe 2628 jhddpn.exe 2540 jvhtrth.exe 2632 tdpjvpt.exe 2596 ddfbfvp.exe 2468 vfdftnt.exe 2588 nnbjh.exe 2496 xvvbdx.exe 1480 tnjtxn.exe 1532 rxxjjt.exe 1512 vlxrb.exe 2600 jdhrhj.exe 1212 jvrlb.exe 2208 bxvhlrd.exe 1980 hllfr.exe 832 pdhtt.exe 1964 ppnvhd.exe 1524 rvbnpx.exe 2364 dhvfb.exe 1088 ldhvr.exe 464 vtxxpp.exe 552 jhnlrx.exe 2316 nvffdd.exe 432 vjltbb.exe 1724 bfhvtbp.exe 1892 vjpld.exe 1804 vhfrv.exe -
Processes:
resource yara_rule behavioral1/memory/2224-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-276-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exejbhlj.exefdpvf.exerbnfbft.exertdjbbd.exeftxdh.exexnvpj.exephtltf.exenrnndr.exetjpfpvf.exetfbnv.exexhhxvhh.exetppnd.exenjxtlll.exeptfxvf.exedjrnvjb.exedescription pid process target process PID 2224 wrote to memory of 2832 2224 42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe jbhlj.exe PID 2224 wrote to memory of 2832 2224 42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe jbhlj.exe PID 2224 wrote to memory of 2832 2224 42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe jbhlj.exe PID 2224 wrote to memory of 2832 2224 42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe jbhlj.exe PID 2832 wrote to memory of 2612 2832 jbhlj.exe fdpvf.exe PID 2832 wrote to memory of 2612 2832 jbhlj.exe fdpvf.exe PID 2832 wrote to memory of 2612 2832 jbhlj.exe fdpvf.exe PID 2832 wrote to memory of 2612 2832 jbhlj.exe fdpvf.exe PID 2612 wrote to memory of 2568 2612 fdpvf.exe rbnfbft.exe PID 2612 wrote to memory of 2568 2612 fdpvf.exe rbnfbft.exe PID 2612 wrote to memory of 2568 2612 fdpvf.exe rbnfbft.exe PID 2612 wrote to memory of 2568 2612 fdpvf.exe rbnfbft.exe PID 2568 wrote to memory of 2720 2568 rbnfbft.exe rtdjbbd.exe PID 2568 wrote to memory of 2720 2568 rbnfbft.exe rtdjbbd.exe PID 2568 wrote to memory of 2720 2568 rbnfbft.exe rtdjbbd.exe PID 2568 wrote to memory of 2720 2568 rbnfbft.exe rtdjbbd.exe PID 2720 wrote to memory of 2632 2720 rtdjbbd.exe ftxdh.exe PID 2720 wrote to memory of 2632 2720 rtdjbbd.exe ftxdh.exe PID 2720 wrote to memory of 2632 2720 rtdjbbd.exe ftxdh.exe PID 2720 wrote to memory of 2632 2720 rtdjbbd.exe ftxdh.exe PID 2632 wrote to memory of 2736 2632 ftxdh.exe xnvpj.exe PID 2632 wrote to memory of 2736 2632 ftxdh.exe xnvpj.exe PID 2632 wrote to memory of 2736 2632 ftxdh.exe xnvpj.exe PID 2632 wrote to memory of 2736 2632 ftxdh.exe xnvpj.exe PID 2736 wrote to memory of 2472 2736 xnvpj.exe phtltf.exe PID 2736 wrote to memory of 2472 2736 xnvpj.exe phtltf.exe PID 2736 wrote to memory of 2472 2736 xnvpj.exe phtltf.exe PID 2736 wrote to memory of 2472 2736 xnvpj.exe phtltf.exe PID 2472 wrote to memory of 2476 2472 phtltf.exe nrnndr.exe PID 2472 wrote to memory of 2476 2472 phtltf.exe nrnndr.exe PID 2472 wrote to memory of 2476 2472 phtltf.exe nrnndr.exe PID 2472 wrote to memory of 2476 2472 phtltf.exe nrnndr.exe PID 2476 wrote to memory of 2120 2476 nrnndr.exe tjpfpvf.exe PID 2476 wrote to memory of 2120 2476 nrnndr.exe tjpfpvf.exe PID 2476 wrote to memory of 2120 2476 nrnndr.exe tjpfpvf.exe PID 2476 wrote to memory of 2120 2476 nrnndr.exe tjpfpvf.exe PID 2120 wrote to memory of 1120 2120 tjpfpvf.exe tfbnv.exe PID 2120 wrote to memory of 1120 2120 tjpfpvf.exe tfbnv.exe PID 2120 wrote to memory of 1120 2120 tjpfpvf.exe tfbnv.exe PID 2120 wrote to memory of 1120 2120 tjpfpvf.exe tfbnv.exe PID 1120 wrote to memory of 2236 1120 tfbnv.exe xhhxvhh.exe PID 1120 wrote to memory of 2236 1120 tfbnv.exe xhhxvhh.exe PID 1120 wrote to memory of 2236 1120 tfbnv.exe xhhxvhh.exe PID 1120 wrote to memory of 2236 1120 tfbnv.exe xhhxvhh.exe PID 2236 wrote to memory of 2740 2236 xhhxvhh.exe tppnd.exe PID 2236 wrote to memory of 2740 2236 xhhxvhh.exe tppnd.exe PID 2236 wrote to memory of 2740 2236 xhhxvhh.exe tppnd.exe PID 2236 wrote to memory of 2740 2236 xhhxvhh.exe tppnd.exe PID 2740 wrote to memory of 1904 2740 tppnd.exe njxtlll.exe PID 2740 wrote to memory of 1904 2740 tppnd.exe njxtlll.exe PID 2740 wrote to memory of 1904 2740 tppnd.exe njxtlll.exe PID 2740 wrote to memory of 1904 2740 tppnd.exe njxtlll.exe PID 1904 wrote to memory of 1276 1904 njxtlll.exe ptfxvf.exe PID 1904 wrote to memory of 1276 1904 njxtlll.exe ptfxvf.exe PID 1904 wrote to memory of 1276 1904 njxtlll.exe ptfxvf.exe PID 1904 wrote to memory of 1276 1904 njxtlll.exe ptfxvf.exe PID 1276 wrote to memory of 1972 1276 ptfxvf.exe djrnvjb.exe PID 1276 wrote to memory of 1972 1276 ptfxvf.exe djrnvjb.exe PID 1276 wrote to memory of 1972 1276 ptfxvf.exe djrnvjb.exe PID 1276 wrote to memory of 1972 1276 ptfxvf.exe djrnvjb.exe PID 1972 wrote to memory of 1524 1972 djrnvjb.exe ptjjx.exe PID 1972 wrote to memory of 1524 1972 djrnvjb.exe ptjjx.exe PID 1972 wrote to memory of 1524 1972 djrnvjb.exe ptjjx.exe PID 1972 wrote to memory of 1524 1972 djrnvjb.exe ptjjx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe"C:\Users\Admin\AppData\Local\Temp\42359307cd6e7530f5bf5cbf982ef41b5f3663ba971c01579e0d6b4824efa0c3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\jbhlj.exec:\jbhlj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\fdpvf.exec:\fdpvf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\rbnfbft.exec:\rbnfbft.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\rtdjbbd.exec:\rtdjbbd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\ftxdh.exec:\ftxdh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xnvpj.exec:\xnvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\phtltf.exec:\phtltf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\nrnndr.exec:\nrnndr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\tjpfpvf.exec:\tjpfpvf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\tfbnv.exec:\tfbnv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\xhhxvhh.exec:\xhhxvhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\tppnd.exec:\tppnd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\njxtlll.exec:\njxtlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\ptfxvf.exec:\ptfxvf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\djrnvjb.exec:\djrnvjb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\ptjjx.exec:\ptjjx.exe17⤵
- Executes dropped EXE
PID:1524 -
\??\c:\ddbxrd.exec:\ddbxrd.exe18⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lbltp.exec:\lbltp.exe19⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vnnlxx.exec:\vnnlxx.exe20⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vtvvxv.exec:\vtvvxv.exe21⤵
- Executes dropped EXE
PID:2796 -
\??\c:\brdbp.exec:\brdbp.exe22⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rnfxln.exec:\rnfxln.exe23⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bnxxbpd.exec:\bnxxbpd.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rrtpp.exec:\rrtpp.exe25⤵
- Executes dropped EXE
PID:1308 -
\??\c:\hldrntj.exec:\hldrntj.exe26⤵
- Executes dropped EXE
PID:952 -
\??\c:\xfxppdd.exec:\xfxppdd.exe27⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xrtbv.exec:\xrtbv.exe28⤵
- Executes dropped EXE
PID:1020 -
\??\c:\jfnfv.exec:\jfnfv.exe29⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bhrjbf.exec:\bhrjbf.exe30⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xlbljjn.exec:\xlbljjn.exe31⤵
- Executes dropped EXE
PID:1000 -
\??\c:\fvbpj.exec:\fvbpj.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\brjrf.exec:\brjrf.exe33⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vdlrx.exec:\vdlrx.exe34⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bxbdbtb.exec:\bxbdbtb.exe35⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xtnxv.exec:\xtnxv.exe36⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hffhpb.exec:\hffhpb.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vpblfl.exec:\vpblfl.exe38⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rpxrf.exec:\rpxrf.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jhddpn.exec:\jhddpn.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jvhtrth.exec:\jvhtrth.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tdpjvpt.exec:\tdpjvpt.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ddfbfvp.exec:\ddfbfvp.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vfdftnt.exec:\vfdftnt.exe44⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nnbjh.exec:\nnbjh.exe45⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xvvbdx.exec:\xvvbdx.exe46⤵
- Executes dropped EXE
PID:2496 -
\??\c:\tnjtxn.exec:\tnjtxn.exe47⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rxxjjt.exec:\rxxjjt.exe48⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vlxrb.exec:\vlxrb.exe49⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jdhrhj.exec:\jdhrhj.exe50⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jvrlb.exec:\jvrlb.exe51⤵
- Executes dropped EXE
PID:1212 -
\??\c:\bxvhlrd.exec:\bxvhlrd.exe52⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hllfr.exec:\hllfr.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pdhtt.exec:\pdhtt.exe54⤵
- Executes dropped EXE
PID:832 -
\??\c:\ppnvhd.exec:\ppnvhd.exe55⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rvbnpx.exec:\rvbnpx.exe56⤵
- Executes dropped EXE
PID:1524 -
\??\c:\dhvfb.exec:\dhvfb.exe57⤵
- Executes dropped EXE
PID:2364 -
\??\c:\ldhvr.exec:\ldhvr.exe58⤵
- Executes dropped EXE
PID:1088 -
\??\c:\vtxxpp.exec:\vtxxpp.exe59⤵
- Executes dropped EXE
PID:464 -
\??\c:\jhnlrx.exec:\jhnlrx.exe60⤵
- Executes dropped EXE
PID:552 -
\??\c:\nvffdd.exec:\nvffdd.exe61⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vjltbb.exec:\vjltbb.exe62⤵
- Executes dropped EXE
PID:432 -
\??\c:\bfhvtbp.exec:\bfhvtbp.exe63⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vjpld.exec:\vjpld.exe64⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vhfrv.exec:\vhfrv.exe65⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xfjnt.exec:\xfjnt.exe66⤵PID:1400
-
\??\c:\xlrbp.exec:\xlrbp.exe67⤵PID:2984
-
\??\c:\vxnhfj.exec:\vxnhfj.exe68⤵PID:896
-
\??\c:\fbjjbtj.exec:\fbjjbtj.exe69⤵PID:1568
-
\??\c:\lvdjpbp.exec:\lvdjpbp.exe70⤵PID:2308
-
\??\c:\fxfnxj.exec:\fxfnxj.exe71⤵PID:1488
-
\??\c:\fjhfld.exec:\fjhfld.exe72⤵PID:2248
-
\??\c:\jfntr.exec:\jfntr.exe73⤵PID:1000
-
\??\c:\lbdtj.exec:\lbdtj.exe74⤵PID:3008
-
\??\c:\rtrxn.exec:\rtrxn.exe75⤵PID:1752
-
\??\c:\bhpfvnt.exec:\bhpfvnt.exe76⤵PID:2224
-
\??\c:\hvrdn.exec:\hvrdn.exe77⤵PID:1772
-
\??\c:\rfxhl.exec:\rfxhl.exe78⤵PID:2320
-
\??\c:\ljjnlb.exec:\ljjnlb.exe79⤵PID:2516
-
\??\c:\nphjbxn.exec:\nphjbxn.exe80⤵PID:2644
-
\??\c:\tdrfd.exec:\tdrfd.exe81⤵PID:2572
-
\??\c:\phlhjfh.exec:\phlhjfh.exe82⤵PID:2552
-
\??\c:\phvpv.exec:\phvpv.exe83⤵PID:2660
-
\??\c:\hfnbhdx.exec:\hfnbhdx.exe84⤵PID:2540
-
\??\c:\trlrrv.exec:\trlrrv.exe85⤵PID:2448
-
\??\c:\nprdhrr.exec:\nprdhrr.exe86⤵PID:2592
-
\??\c:\jjlplnp.exec:\jjlplnp.exe87⤵PID:2676
-
\??\c:\rldbl.exec:\rldbl.exe88⤵PID:1888
-
\??\c:\nphfdp.exec:\nphfdp.exe89⤵PID:2476
-
\??\c:\fldvjhp.exec:\fldvjhp.exe90⤵PID:1480
-
\??\c:\hnvlphv.exec:\hnvlphv.exe91⤵PID:840
-
\??\c:\dhptvpv.exec:\dhptvpv.exe92⤵PID:1512
-
\??\c:\hplfxhp.exec:\hplfxhp.exe93⤵PID:2600
-
\??\c:\jndvbh.exec:\jndvbh.exe94⤵PID:1212
-
\??\c:\xpjxff.exec:\xpjxff.exe95⤵PID:2208
-
\??\c:\hpnxf.exec:\hpnxf.exe96⤵PID:1980
-
\??\c:\npxfh.exec:\npxfh.exe97⤵PID:832
-
\??\c:\vjplh.exec:\vjplh.exe98⤵PID:1964
-
\??\c:\xpblpbx.exec:\xpblpbx.exe99⤵PID:1524
-
\??\c:\xvppn.exec:\xvppn.exe100⤵PID:588
-
\??\c:\bhxhprl.exec:\bhxhprl.exe101⤵PID:1088
-
\??\c:\bdbvn.exec:\bdbvn.exe102⤵PID:776
-
\??\c:\xffft.exec:\xffft.exe103⤵PID:552
-
\??\c:\fhdxfxt.exec:\fhdxfxt.exe104⤵PID:2316
-
\??\c:\jntnjd.exec:\jntnjd.exe105⤵PID:1064
-
\??\c:\ldxhdr.exec:\ldxhdr.exe106⤵PID:1724
-
\??\c:\xhjvf.exec:\xhjvf.exe107⤵PID:1892
-
\??\c:\fhhjp.exec:\fhhjp.exe108⤵PID:1376
-
\??\c:\dhrnt.exec:\dhrnt.exe109⤵PID:2788
-
\??\c:\xxtlpth.exec:\xxtlpth.exe110⤵PID:1400
-
\??\c:\xlhbhxv.exec:\xlhbhxv.exe111⤵PID:2392
-
\??\c:\bfxhddt.exec:\bfxhddt.exe112⤵PID:896
-
\??\c:\lhrlhr.exec:\lhrlhr.exe113⤵PID:1568
-
\??\c:\ldxdp.exec:\ldxdp.exe114⤵PID:2300
-
\??\c:\xxjhfdd.exec:\xxjhfdd.exe115⤵PID:2068
-
\??\c:\nxtfvpp.exec:\nxtfvpp.exe116⤵PID:1988
-
\??\c:\rxtrxvd.exec:\rxtrxvd.exe117⤵PID:1000
-
\??\c:\rhvhx.exec:\rhvhx.exe118⤵PID:1080
-
\??\c:\jhrjr.exec:\jhrjr.exe119⤵PID:1584
-
\??\c:\fpjhjbp.exec:\fpjhjbp.exe120⤵PID:2840
-
\??\c:\rxrdflh.exec:\rxrdflh.exe121⤵PID:2612
-
\??\c:\tvthbnd.exec:\tvthbnd.exe122⤵PID:3048
-
\??\c:\bjntphx.exec:\bjntphx.exe123⤵PID:2640
-
\??\c:\htxvlhn.exec:\htxvlhn.exe124⤵PID:2716
-
\??\c:\ftfrffh.exec:\ftfrffh.exe125⤵PID:2668
-
\??\c:\bptxj.exec:\bptxj.exe126⤵PID:2756
-
\??\c:\lfhnd.exec:\lfhnd.exe127⤵PID:2536
-
\??\c:\dphnxxh.exec:\dphnxxh.exe128⤵PID:2428
-
\??\c:\vtfxj.exec:\vtfxj.exe129⤵PID:2480
-
\??\c:\ltrrf.exec:\ltrrf.exe130⤵PID:2488
-
\??\c:\vhvbxrr.exec:\vhvbxrr.exe131⤵PID:1660
-
\??\c:\plpnb.exec:\plpnb.exe132⤵PID:2876
-
\??\c:\ndtlft.exec:\ndtlft.exe133⤵PID:1928
-
\??\c:\vjjtn.exec:\vjjtn.exe134⤵PID:2524
-
\??\c:\lxlnh.exec:\lxlnh.exe135⤵PID:2836
-
\??\c:\bxdhdjr.exec:\bxdhdjr.exe136⤵PID:2212
-
\??\c:\hxdrf.exec:\hxdrf.exe137⤵PID:1552
-
\??\c:\lphrb.exec:\lphrb.exe138⤵PID:1648
-
\??\c:\dtjff.exec:\dtjff.exe139⤵PID:1968
-
\??\c:\pvhbnfh.exec:\pvhbnfh.exe140⤵PID:1940
-
\??\c:\npdfjld.exec:\npdfjld.exe141⤵PID:1996
-
\??\c:\hpfbp.exec:\hpfbp.exe142⤵PID:3032
-
\??\c:\npxbf.exec:\npxbf.exe143⤵PID:388
-
\??\c:\fpfdl.exec:\fpfdl.exe144⤵PID:580
-
\??\c:\vvjfb.exec:\vvjfb.exe145⤵PID:2796
-
\??\c:\nlntltl.exec:\nlntltl.exe146⤵PID:3044
-
\??\c:\rlntjrr.exec:\rlntjrr.exe147⤵PID:2948
-
\??\c:\hxtbx.exec:\hxtbx.exe148⤵PID:1544
-
\??\c:\rtbxxlv.exec:\rtbxxlv.exe149⤵PID:1452
-
\??\c:\bfxbp.exec:\bfxbp.exe150⤵PID:604
-
\??\c:\fnpfv.exec:\fnpfv.exe151⤵PID:2400
-
\??\c:\xfffp.exec:\xfffp.exe152⤵PID:1428
-
\??\c:\tfjptdt.exec:\tfjptdt.exe153⤵PID:624
-
\??\c:\hfpdbn.exec:\hfpdbn.exe154⤵PID:904
-
\??\c:\bxjhd.exec:\bxjhd.exe155⤵PID:2184
-
\??\c:\xhjlnf.exec:\xhjlnf.exe156⤵PID:2188
-
\??\c:\jpdfn.exec:\jpdfn.exe157⤵PID:2180
-
\??\c:\lrnjhr.exec:\lrnjhr.exe158⤵PID:880
-
\??\c:\nxdnd.exec:\nxdnd.exe159⤵PID:2056
-
\??\c:\xdlhpbf.exec:\xdlhpbf.exe160⤵PID:2824
-
\??\c:\hfjrldh.exec:\hfjrldh.exe161⤵PID:2828
-
\??\c:\bvhvvfj.exec:\bvhvvfj.exe162⤵PID:2768
-
\??\c:\fjrbvp.exec:\fjrbvp.exe163⤵PID:2688
-
\??\c:\nfpjnp.exec:\nfpjnp.exe164⤵PID:2320
-
\??\c:\hrlpb.exec:\hrlpb.exe165⤵PID:2936
-
\??\c:\hlpptpn.exec:\hlpptpn.exe166⤵PID:2664
-
\??\c:\jnlvr.exec:\jnlvr.exe167⤵PID:2720
-
\??\c:\jlptp.exec:\jlptp.exe168⤵PID:2548
-
\??\c:\npbjph.exec:\npbjph.exe169⤵PID:2620
-
\??\c:\ljjjvr.exec:\ljjjvr.exe170⤵PID:2436
-
\??\c:\fptfn.exec:\fptfn.exe171⤵PID:2448
-
\??\c:\ffpbl.exec:\ffpbl.exe172⤵PID:2560
-
\??\c:\tpdjj.exec:\tpdjj.exe173⤵PID:2864
-
\??\c:\hlndnb.exec:\hlndnb.exe174⤵PID:1888
-
\??\c:\tdhdxh.exec:\tdhdxh.exe175⤵PID:2476
-
\??\c:\ffjtdd.exec:\ffjtdd.exe176⤵PID:2696
-
\??\c:\vlxtv.exec:\vlxtv.exe177⤵PID:840
-
\??\c:\ptlxfth.exec:\ptlxfth.exe178⤵PID:1512
-
\??\c:\hjvfxxh.exec:\hjvfxxh.exe179⤵PID:2328
-
\??\c:\nvbpdxv.exec:\nvbpdxv.exe180⤵PID:1276
-
\??\c:\dndrlr.exec:\dndrlr.exe181⤵PID:1588
-
\??\c:\nfrjr.exec:\nfrjr.exe182⤵PID:2012
-
\??\c:\lfbhddl.exec:\lfbhddl.exe183⤵PID:2360
-
\??\c:\vpjjnh.exec:\vpjjnh.exe184⤵PID:1716
-
\??\c:\nxvjtnd.exec:\nxvjtnd.exe185⤵PID:940
-
\??\c:\hvffp.exec:\hvffp.exe186⤵PID:588
-
\??\c:\xjbxvv.exec:\xjbxvv.exe187⤵PID:584
-
\??\c:\rjvpfrn.exec:\rjvpfrn.exe188⤵PID:2924
-
\??\c:\pjlhphj.exec:\pjlhphj.exe189⤵PID:2956
-
\??\c:\dhjxnd.exec:\dhjxnd.exe190⤵PID:2044
-
\??\c:\ltbhjtf.exec:\ltbhjtf.exe191⤵PID:3024
-
\??\c:\xxvbrt.exec:\xxvbrt.exe192⤵PID:836
-
\??\c:\jnxtrd.exec:\jnxtrd.exe193⤵PID:2708
-
\??\c:\dtprjxx.exec:\dtprjxx.exe194⤵PID:1560
-
\??\c:\pjftvp.exec:\pjftvp.exe195⤵PID:2788
-
\??\c:\ffptr.exec:\ffptr.exe196⤵PID:1400
-
\??\c:\bnlphhx.exec:\bnlphhx.exe197⤵PID:108
-
\??\c:\nddvthl.exec:\nddvthl.exe198⤵PID:2272
-
\??\c:\njplf.exec:\njplf.exe199⤵PID:2308
-
\??\c:\bxpttn.exec:\bxpttn.exe200⤵PID:2180
-
\??\c:\djrxtvr.exec:\djrxtvr.exe201⤵PID:1760
-
\??\c:\nphvntb.exec:\nphvntb.exe202⤵PID:1988
-
\??\c:\xxdrh.exec:\xxdrh.exe203⤵PID:1752
-
\??\c:\fbbdrr.exec:\fbbdrr.exe204⤵PID:1616
-
\??\c:\pvnft.exec:\pvnft.exe205⤵PID:2084
-
\??\c:\ntrlpvb.exec:\ntrlpvb.exe206⤵PID:2564
-
\??\c:\dtvvjd.exec:\dtvvjd.exe207⤵PID:2372
-
\??\c:\npxnbh.exec:\npxnbh.exe208⤵PID:2656
-
\??\c:\tthllr.exec:\tthllr.exe209⤵PID:2792
-
\??\c:\ppxlvnp.exec:\ppxlvnp.exe210⤵PID:3020
-
\??\c:\hhldllt.exec:\hhldllt.exe211⤵PID:2720
-
\??\c:\lfjtf.exec:\lfjtf.exe212⤵PID:2548
-
\??\c:\prbbt.exec:\prbbt.exe213⤵PID:1176
-
\??\c:\vxnxvt.exec:\vxnxvt.exe214⤵PID:2436
-
\??\c:\xhxvbh.exec:\xhxvbh.exe215⤵PID:2412
-
\??\c:\dddhpfx.exec:\dddhpfx.exe216⤵PID:3060
-
\??\c:\jtnhvdb.exec:\jtnhvdb.exe217⤵PID:2588
-
\??\c:\trdtltr.exec:\trdtltr.exe218⤵PID:1120
-
\??\c:\lprnhb.exec:\lprnhb.exe219⤵PID:1928
-
\??\c:\xnbtfxn.exec:\xnbtfxn.exe220⤵PID:2704
-
\??\c:\pprrbt.exec:\pprrbt.exe221⤵PID:2740
-
\??\c:\nrvppv.exec:\nrvppv.exe222⤵PID:2848
-
\??\c:\hrdhvbx.exec:\hrdhvbx.exe223⤵PID:1140
-
\??\c:\xtpdrxp.exec:\xtpdrxp.exe224⤵PID:1652
-
\??\c:\bntxbvn.exec:\bntxbvn.exe225⤵PID:2336
-
\??\c:\nvpxl.exec:\nvpxl.exe226⤵PID:2012
-
\??\c:\bnrplp.exec:\bnrplp.exe227⤵PID:1964
-
\??\c:\tbffbht.exec:\tbffbht.exe228⤵PID:1096
-
\??\c:\njdjxx.exec:\njdjxx.exe229⤵PID:2808
-
\??\c:\tdbxxh.exec:\tdbxxh.exe230⤵PID:2800
-
\??\c:\xbhplx.exec:\xbhplx.exe231⤵PID:776
-
\??\c:\ptxplnp.exec:\ptxplnp.exe232⤵PID:1036
-
\??\c:\xpnth.exec:\xpnth.exe233⤵PID:2480
-
\??\c:\ftrflx.exec:\ftrflx.exe234⤵PID:1808
-
\??\c:\tfdxpf.exec:\tfdxpf.exe235⤵PID:972
-
\??\c:\bnfdjtp.exec:\bnfdjtp.exe236⤵PID:1228
-
\??\c:\vxbrd.exec:\vxbrd.exe237⤵PID:1636
-
\??\c:\fbdxv.exec:\fbdxv.exe238⤵PID:1308
-
\??\c:\jfrfh.exec:\jfrfh.exe239⤵PID:1092
-
\??\c:\dbpltl.exec:\dbpltl.exe240⤵PID:2168
-
\??\c:\jtnldt.exec:\jtnldt.exe241⤵PID:2280
-
\??\c:\xbtnd.exec:\xbtnd.exe242⤵PID:2060