Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe
-
Size
247KB
-
MD5
61230f922120a18697f197e01635d880
-
SHA1
d7cd1ce566e2f175b728420db54a5bbefaa0de1a
-
SHA256
bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941
-
SHA512
683e4e95626b73a115850e5b50ce688e337ffe2b6cff83ce2806fe8703f4c1f621da2631909676d26ca4b00c1eff366bfb89e1a6562218bbf677e3b2603b2a5c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjR1q:n3C9BRo7MlrWKo+lxtvGt1q
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1908-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/824-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
Processes:
resource yara_rule behavioral1/memory/1908-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1696-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2620-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2508-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2460-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2816-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2816-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2816-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1092-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2368-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2004-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2788-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2752-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2144-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/824-276-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/816-267-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2296-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2012-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1060-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vnxxn.exehnjll.exehdvfr.exejrfxfj.exeffhbddv.exehvlrv.exendjbn.exepxhtf.exejhlvd.exentthr.exejrdlpl.exenrvlrrv.exexdnlh.exebbtpbr.exehdlptjv.exehjfvprn.exejtnhh.exebvxft.exehtllvt.exehxvhn.exejjnbr.exevvxjj.exejrphlj.exerfjxnxb.exeblnpdpt.exefdhrx.exepvrdpn.exebjpdjt.exedppftvf.exetbddbtt.exebrjjlph.exervhtl.exextddd.exetjvjn.exeltfbp.exedxxvjv.exedtxnvd.exehnnjrt.exeftfpt.exenbdhbh.exexxlpd.exelrbldf.exerbpvb.exelfblp.exerhnvx.exejxfvtp.exellrvlll.exeltxnr.exexdvtpnd.exerlfxx.exellpjhxx.exentrtvrd.exerfhttbd.exeflvfl.exexhrxr.exedvjjtl.exerjljt.exexpfxtpt.exentfxr.exelxjtnh.exepjvrt.exeppjnf.exehdlrr.exelljhlx.exepid process 1696 vnxxn.exe 2488 hnjll.exe 2620 hdvfr.exe 2732 jrfxfj.exe 2708 ffhbddv.exe 2508 hvlrv.exe 2460 ndjbn.exe 2816 pxhtf.exe 1092 jhlvd.exe 2368 ntthr.exe 1612 jrdlpl.exe 1060 nrvlrrv.exe 2652 xdnlh.exe 2324 bbtpbr.exe 2012 hdlptjv.exe 2340 hjfvprn.exe 2004 jtnhh.exe 2788 bvxft.exe 1636 htllvt.exe 2144 hxvhn.exe 2752 jjnbr.exe 2968 vvxjj.exe 2296 jrphlj.exe 424 rfjxnxb.exe 1080 blnpdpt.exe 728 fdhrx.exe 816 pvrdpn.exe 824 bjpdjt.exe 856 dppftvf.exe 2132 tbddbtt.exe 2252 brjjlph.exe 944 rvhtl.exe 376 xtddd.exe 752 tjvjn.exe 1052 ltfbp.exe 2240 dxxvjv.exe 1604 dtxnvd.exe 2992 hnnjrt.exe 2608 ftfpt.exe 2700 nbdhbh.exe 2620 xxlpd.exe 2420 lrbldf.exe 1748 rbpvb.exe 1992 lfblp.exe 2364 rhnvx.exe 2996 jxfvtp.exe 2444 llrvlll.exe 2816 ltxnr.exe 2036 xdvtpnd.exe 1852 rlfxx.exe 2000 llpjhxx.exe 1484 ntrtvrd.exe 2348 rfhttbd.exe 2148 flvfl.exe 2172 xhrxr.exe 1916 dvjjtl.exe 2340 rjljt.exe 2576 xpfxtpt.exe 1048 ntfxr.exe 2080 lxjtnh.exe 2120 pjvrt.exe 2144 ppjnf.exe 1752 hdlrr.exe 2292 lljhlx.exe -
Processes:
resource yara_rule behavioral1/memory/1908-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/824-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-132-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exevnxxn.exehnjll.exehdvfr.exejrfxfj.exeffhbddv.exehvlrv.exendjbn.exepxhtf.exejhlvd.exentthr.exejrdlpl.exenrvlrrv.exexdnlh.exebbtpbr.exehdlptjv.exedescription pid process target process PID 1908 wrote to memory of 1696 1908 bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe vnxxn.exe PID 1908 wrote to memory of 1696 1908 bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe vnxxn.exe PID 1908 wrote to memory of 1696 1908 bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe vnxxn.exe PID 1908 wrote to memory of 1696 1908 bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe vnxxn.exe PID 1696 wrote to memory of 2488 1696 vnxxn.exe hnjll.exe PID 1696 wrote to memory of 2488 1696 vnxxn.exe hnjll.exe PID 1696 wrote to memory of 2488 1696 vnxxn.exe hnjll.exe PID 1696 wrote to memory of 2488 1696 vnxxn.exe hnjll.exe PID 2488 wrote to memory of 2620 2488 hnjll.exe hdvfr.exe PID 2488 wrote to memory of 2620 2488 hnjll.exe hdvfr.exe PID 2488 wrote to memory of 2620 2488 hnjll.exe hdvfr.exe PID 2488 wrote to memory of 2620 2488 hnjll.exe hdvfr.exe PID 2620 wrote to memory of 2732 2620 hdvfr.exe jrfxfj.exe PID 2620 wrote to memory of 2732 2620 hdvfr.exe jrfxfj.exe PID 2620 wrote to memory of 2732 2620 hdvfr.exe jrfxfj.exe PID 2620 wrote to memory of 2732 2620 hdvfr.exe jrfxfj.exe PID 2732 wrote to memory of 2708 2732 jrfxfj.exe ffhbddv.exe PID 2732 wrote to memory of 2708 2732 jrfxfj.exe ffhbddv.exe PID 2732 wrote to memory of 2708 2732 jrfxfj.exe ffhbddv.exe PID 2732 wrote to memory of 2708 2732 jrfxfj.exe ffhbddv.exe PID 2708 wrote to memory of 2508 2708 ffhbddv.exe hvlrv.exe PID 2708 wrote to memory of 2508 2708 ffhbddv.exe hvlrv.exe PID 2708 wrote to memory of 2508 2708 ffhbddv.exe hvlrv.exe PID 2708 wrote to memory of 2508 2708 ffhbddv.exe hvlrv.exe PID 2508 wrote to memory of 2460 2508 hvlrv.exe ndjbn.exe PID 2508 wrote to memory of 2460 2508 hvlrv.exe ndjbn.exe PID 2508 wrote to memory of 2460 2508 hvlrv.exe ndjbn.exe PID 2508 wrote to memory of 2460 2508 hvlrv.exe ndjbn.exe PID 2460 wrote to memory of 2816 2460 ndjbn.exe ltxnr.exe PID 2460 wrote to memory of 2816 2460 ndjbn.exe ltxnr.exe PID 2460 wrote to memory of 2816 2460 ndjbn.exe ltxnr.exe PID 2460 wrote to memory of 2816 2460 ndjbn.exe ltxnr.exe PID 2816 wrote to memory of 1092 2816 pxhtf.exe jhlvd.exe PID 2816 wrote to memory of 1092 2816 pxhtf.exe jhlvd.exe PID 2816 wrote to memory of 1092 2816 pxhtf.exe jhlvd.exe PID 2816 wrote to memory of 1092 2816 pxhtf.exe jhlvd.exe PID 1092 wrote to memory of 2368 1092 jhlvd.exe ntthr.exe PID 1092 wrote to memory of 2368 1092 jhlvd.exe ntthr.exe PID 1092 wrote to memory of 2368 1092 jhlvd.exe ntthr.exe PID 1092 wrote to memory of 2368 1092 jhlvd.exe ntthr.exe PID 2368 wrote to memory of 1612 2368 ntthr.exe jrdlpl.exe PID 2368 wrote to memory of 1612 2368 ntthr.exe jrdlpl.exe PID 2368 wrote to memory of 1612 2368 ntthr.exe jrdlpl.exe PID 2368 wrote to memory of 1612 2368 ntthr.exe jrdlpl.exe PID 1612 wrote to memory of 1060 1612 jrdlpl.exe nrvlrrv.exe PID 1612 wrote to memory of 1060 1612 jrdlpl.exe nrvlrrv.exe PID 1612 wrote to memory of 1060 1612 jrdlpl.exe nrvlrrv.exe PID 1612 wrote to memory of 1060 1612 jrdlpl.exe nrvlrrv.exe PID 1060 wrote to memory of 2652 1060 nrvlrrv.exe xdnlh.exe PID 1060 wrote to memory of 2652 1060 nrvlrrv.exe xdnlh.exe PID 1060 wrote to memory of 2652 1060 nrvlrrv.exe xdnlh.exe PID 1060 wrote to memory of 2652 1060 nrvlrrv.exe xdnlh.exe PID 2652 wrote to memory of 2324 2652 xdnlh.exe bbtpbr.exe PID 2652 wrote to memory of 2324 2652 xdnlh.exe bbtpbr.exe PID 2652 wrote to memory of 2324 2652 xdnlh.exe bbtpbr.exe PID 2652 wrote to memory of 2324 2652 xdnlh.exe bbtpbr.exe PID 2324 wrote to memory of 2012 2324 bbtpbr.exe hdlptjv.exe PID 2324 wrote to memory of 2012 2324 bbtpbr.exe hdlptjv.exe PID 2324 wrote to memory of 2012 2324 bbtpbr.exe hdlptjv.exe PID 2324 wrote to memory of 2012 2324 bbtpbr.exe hdlptjv.exe PID 2012 wrote to memory of 2340 2012 hdlptjv.exe hjfvprn.exe PID 2012 wrote to memory of 2340 2012 hdlptjv.exe hjfvprn.exe PID 2012 wrote to memory of 2340 2012 hdlptjv.exe hjfvprn.exe PID 2012 wrote to memory of 2340 2012 hdlptjv.exe hjfvprn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe"C:\Users\Admin\AppData\Local\Temp\bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\vnxxn.exec:\vnxxn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\hnjll.exec:\hnjll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\hdvfr.exec:\hdvfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jrfxfj.exec:\jrfxfj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ffhbddv.exec:\ffhbddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hvlrv.exec:\hvlrv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\ndjbn.exec:\ndjbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\pxhtf.exec:\pxhtf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\jhlvd.exec:\jhlvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\ntthr.exec:\ntthr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jrdlpl.exec:\jrdlpl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\nrvlrrv.exec:\nrvlrrv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\xdnlh.exec:\xdnlh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\bbtpbr.exec:\bbtpbr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\hdlptjv.exec:\hdlptjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\hjfvprn.exec:\hjfvprn.exe17⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jtnhh.exec:\jtnhh.exe18⤵
- Executes dropped EXE
PID:2004 -
\??\c:\bvxft.exec:\bvxft.exe19⤵
- Executes dropped EXE
PID:2788 -
\??\c:\htllvt.exec:\htllvt.exe20⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hxvhn.exec:\hxvhn.exe21⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jjnbr.exec:\jjnbr.exe22⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vvxjj.exec:\vvxjj.exe23⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jrphlj.exec:\jrphlj.exe24⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rfjxnxb.exec:\rfjxnxb.exe25⤵
- Executes dropped EXE
PID:424 -
\??\c:\blnpdpt.exec:\blnpdpt.exe26⤵
- Executes dropped EXE
PID:1080 -
\??\c:\fdhrx.exec:\fdhrx.exe27⤵
- Executes dropped EXE
PID:728 -
\??\c:\pvrdpn.exec:\pvrdpn.exe28⤵
- Executes dropped EXE
PID:816 -
\??\c:\bjpdjt.exec:\bjpdjt.exe29⤵
- Executes dropped EXE
PID:824 -
\??\c:\dppftvf.exec:\dppftvf.exe30⤵
- Executes dropped EXE
PID:856 -
\??\c:\tbddbtt.exec:\tbddbtt.exe31⤵
- Executes dropped EXE
PID:2132 -
\??\c:\brjjlph.exec:\brjjlph.exe32⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rvhtl.exec:\rvhtl.exe33⤵
- Executes dropped EXE
PID:944 -
\??\c:\xtddd.exec:\xtddd.exe34⤵
- Executes dropped EXE
PID:376 -
\??\c:\tjvjn.exec:\tjvjn.exe35⤵
- Executes dropped EXE
PID:752 -
\??\c:\ltfbp.exec:\ltfbp.exe36⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dxxvjv.exec:\dxxvjv.exe37⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dtxnvd.exec:\dtxnvd.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hnnjrt.exec:\hnnjrt.exe39⤵
- Executes dropped EXE
PID:2992 -
\??\c:\ftfpt.exec:\ftfpt.exe40⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nbdhbh.exec:\nbdhbh.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\xxlpd.exec:\xxlpd.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lrbldf.exec:\lrbldf.exe43⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rbpvb.exec:\rbpvb.exe44⤵
- Executes dropped EXE
PID:1748 -
\??\c:\lfblp.exec:\lfblp.exe45⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rhnvx.exec:\rhnvx.exe46⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jxfvtp.exec:\jxfvtp.exe47⤵
- Executes dropped EXE
PID:2996 -
\??\c:\llrvlll.exec:\llrvlll.exe48⤵
- Executes dropped EXE
PID:2444 -
\??\c:\ltxnr.exec:\ltxnr.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xdvtpnd.exec:\xdvtpnd.exe50⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rlfxx.exec:\rlfxx.exe51⤵
- Executes dropped EXE
PID:1852 -
\??\c:\llpjhxx.exec:\llpjhxx.exe52⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ntrtvrd.exec:\ntrtvrd.exe53⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rfhttbd.exec:\rfhttbd.exe54⤵
- Executes dropped EXE
PID:2348 -
\??\c:\flvfl.exec:\flvfl.exe55⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xhrxr.exec:\xhrxr.exe56⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dvjjtl.exec:\dvjjtl.exe57⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rjljt.exec:\rjljt.exe58⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xpfxtpt.exec:\xpfxtpt.exe59⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ntfxr.exec:\ntfxr.exe60⤵
- Executes dropped EXE
PID:1048 -
\??\c:\lxjtnh.exec:\lxjtnh.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pjvrt.exec:\pjvrt.exe62⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ppjnf.exec:\ppjnf.exe63⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hdlrr.exec:\hdlrr.exe64⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lljhlx.exec:\lljhlx.exe65⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nnbldlx.exec:\nnbldlx.exe66⤵PID:3032
-
\??\c:\nhhddvx.exec:\nhhddvx.exe67⤵PID:2068
-
\??\c:\xpxvd.exec:\xpxvd.exe68⤵PID:1588
-
\??\c:\bbjhr.exec:\bbjhr.exe69⤵PID:1356
-
\??\c:\vphbrj.exec:\vphbrj.exe70⤵PID:1460
-
\??\c:\jdtnr.exec:\jdtnr.exe71⤵PID:3044
-
\??\c:\rvdbr.exec:\rvdbr.exe72⤵PID:1252
-
\??\c:\xdhbd.exec:\xdhbd.exe73⤵PID:1208
-
\??\c:\lfthpt.exec:\lfthpt.exe74⤵PID:1152
-
\??\c:\lrxpj.exec:\lrxpj.exe75⤵PID:2132
-
\??\c:\jjjfvlf.exec:\jjjfvlf.exe76⤵PID:1144
-
\??\c:\hjrbv.exec:\hjrbv.exe77⤵PID:804
-
\??\c:\xnltfjd.exec:\xnltfjd.exe78⤵PID:888
-
\??\c:\fhnhx.exec:\fhnhx.exe79⤵PID:2284
-
\??\c:\lhltfr.exec:\lhltfr.exe80⤵PID:1908
-
\??\c:\rfnvpff.exec:\rfnvpff.exe81⤵PID:1052
-
\??\c:\tvhthb.exec:\tvhthb.exe82⤵PID:2240
-
\??\c:\njfhff.exec:\njfhff.exe83⤵PID:1604
-
\??\c:\thplnxr.exec:\thplnxr.exe84⤵PID:2636
-
\??\c:\rlfjn.exec:\rlfjn.exe85⤵PID:1756
-
\??\c:\hbndl.exec:\hbndl.exe86⤵PID:2556
-
\??\c:\vljfdvx.exec:\vljfdvx.exe87⤵PID:2732
-
\??\c:\pvlpftl.exec:\pvlpftl.exe88⤵PID:2448
-
\??\c:\vtxpjt.exec:\vtxpjt.exe89⤵PID:2396
-
\??\c:\xdbpd.exec:\xdbpd.exe90⤵PID:1724
-
\??\c:\vrphv.exec:\vrphv.exe91⤵PID:2472
-
\??\c:\hjrhb.exec:\hjrhb.exe92⤵PID:548
-
\??\c:\brjxn.exec:\brjxn.exe93⤵PID:1944
-
\??\c:\nrdvdh.exec:\nrdvdh.exe94⤵PID:2372
-
\??\c:\jxjntl.exec:\jxjntl.exe95⤵PID:956
-
\??\c:\vplrll.exec:\vplrll.exe96⤵PID:1800
-
\??\c:\lrlhd.exec:\lrlhd.exe97⤵PID:1968
-
\??\c:\hvvjpf.exec:\hvvjpf.exe98⤵PID:1612
-
\??\c:\nrdjvbr.exec:\nrdjvbr.exe99⤵PID:1860
-
\??\c:\bfrxh.exec:\bfrxh.exe100⤵PID:2376
-
\??\c:\xnrdlj.exec:\xnrdlj.exe101⤵PID:1816
-
\??\c:\bjdlxfh.exec:\bjdlxfh.exe102⤵PID:2664
-
\??\c:\xflnf.exec:\xflnf.exe103⤵PID:1916
-
\??\c:\pdrltbv.exec:\pdrltbv.exe104⤵PID:1336
-
\??\c:\pplltfx.exec:\pplltfx.exe105⤵PID:2576
-
\??\c:\rnvrvhf.exec:\rnvrvhf.exe106⤵PID:1028
-
\??\c:\tdfdjbp.exec:\tdfdjbp.exe107⤵PID:2080
-
\??\c:\hddlrd.exec:\hddlrd.exe108⤵PID:2432
-
\??\c:\tbrlhr.exec:\tbrlhr.exe109⤵PID:2336
-
\??\c:\jdhrrl.exec:\jdhrrl.exe110⤵PID:1480
-
\??\c:\lnprjb.exec:\lnprjb.exe111⤵PID:1276
-
\??\c:\rpppt.exec:\rpppt.exe112⤵PID:2136
-
\??\c:\dttvtn.exec:\dttvtn.exe113⤵PID:1780
-
\??\c:\nlxhjbp.exec:\nlxhjbp.exe114⤵PID:432
-
\??\c:\fxnrflt.exec:\fxnrflt.exe115⤵PID:1128
-
\??\c:\flbpnj.exec:\flbpnj.exe116⤵PID:1460
-
\??\c:\phnhtb.exec:\phnhtb.exe117⤵PID:3044
-
\??\c:\rvjljhn.exec:\rvjljhn.exe118⤵PID:900
-
\??\c:\tdtthf.exec:\tdtthf.exe119⤵PID:1208
-
\??\c:\jvvjl.exec:\jvvjl.exe120⤵PID:1688
-
\??\c:\hvvxt.exec:\hvvxt.exe121⤵PID:2952
-
\??\c:\xtbvp.exec:\xtbvp.exe122⤵PID:2160
-
\??\c:\ldvxjl.exec:\ldvxjl.exe123⤵PID:1564
-
\??\c:\hxfblb.exec:\hxfblb.exe124⤵PID:2736
-
\??\c:\rbpdjf.exec:\rbpdjf.exe125⤵PID:2856
-
\??\c:\vnrbddv.exec:\vnrbddv.exe126⤵PID:1716
-
\??\c:\txfphvf.exec:\txfphvf.exe127⤵PID:1576
-
\??\c:\rvnrd.exec:\rvnrd.exe128⤵PID:2936
-
\??\c:\dnhrrh.exec:\dnhrrh.exe129⤵PID:2872
-
\??\c:\bvxpbp.exec:\bvxpbp.exe130⤵PID:2992
-
\??\c:\tbdntr.exec:\tbdntr.exe131⤵PID:3068
-
\??\c:\dnllvbv.exec:\dnllvbv.exe132⤵PID:2416
-
\??\c:\pxdff.exec:\pxdff.exe133⤵PID:2512
-
\??\c:\pthtxj.exec:\pthtxj.exe134⤵PID:2528
-
\??\c:\xtjtfr.exec:\xtjtfr.exe135⤵PID:2440
-
\??\c:\jvfpjx.exec:\jvfpjx.exe136⤵PID:2364
-
\??\c:\nprhvrb.exec:\nprhvrb.exe137⤵PID:2996
-
\??\c:\nrfjbn.exec:\nrfjbn.exe138⤵PID:2208
-
\??\c:\ldhlfjd.exec:\ldhlfjd.exe139⤵PID:576
-
\??\c:\dtlfjrh.exec:\dtlfjrh.exe140⤵PID:1020
-
\??\c:\xvhftvl.exec:\xvhftvl.exe141⤵PID:880
-
\??\c:\nnjdph.exec:\nnjdph.exe142⤵PID:2640
-
\??\c:\lhhjvrl.exec:\lhhjvrl.exe143⤵PID:1412
-
\??\c:\hdbprbb.exec:\hdbprbb.exe144⤵PID:2000
-
\??\c:\bdhrjh.exec:\bdhrjh.exe145⤵PID:1484
-
\??\c:\tphtldl.exec:\tphtldl.exe146⤵PID:2348
-
\??\c:\frvtlx.exec:\frvtlx.exe147⤵PID:2148
-
\??\c:\rvllx.exec:\rvllx.exe148⤵PID:2172
-
\??\c:\pvhhnlb.exec:\pvhhnlb.exe149⤵PID:1916
-
\??\c:\xdvxb.exec:\xdvxb.exe150⤵PID:2340
-
\??\c:\tjfhphp.exec:\tjfhphp.exe151⤵PID:2964
-
\??\c:\dvlprnt.exec:\dvlprnt.exe152⤵PID:1048
-
\??\c:\lltddl.exec:\lltddl.exe153⤵PID:2084
-
\??\c:\ldltv.exec:\ldltv.exe154⤵PID:2432
-
\??\c:\prrdlnx.exec:\prrdlnx.exe155⤵PID:3064
-
\??\c:\vlxvlb.exec:\vlxvlb.exe156⤵PID:2816
-
\??\c:\vjnbl.exec:\vjnbl.exe157⤵PID:2124
-
\??\c:\hlbnjlj.exec:\hlbnjlj.exe158⤵PID:1492
-
\??\c:\xbjjj.exec:\xbjjj.exe159⤵PID:1676
-
\??\c:\rhffdh.exec:\rhffdh.exe160⤵PID:972
-
\??\c:\npfhrb.exec:\npfhrb.exe161⤵PID:2760
-
\??\c:\nltbnxn.exec:\nltbnxn.exe162⤵PID:596
-
\??\c:\ntjbpbt.exec:\ntjbpbt.exe163⤵PID:3044
-
\??\c:\vhtvrl.exec:\vhtvrl.exe164⤵PID:1252
-
\??\c:\fxfrvhn.exec:\fxfrvhn.exe165⤵PID:1208
-
\??\c:\bvxpj.exec:\bvxpj.exe166⤵PID:2908
-
\??\c:\tlnfr.exec:\tlnfr.exe167⤵PID:1144
-
\??\c:\pdlxp.exec:\pdlxp.exe168⤵PID:804
-
\??\c:\ptxnlbj.exec:\ptxnlbj.exe169⤵PID:888
-
\??\c:\bhjnrb.exec:\bhjnrb.exe170⤵PID:1740
-
\??\c:\bpdjhtr.exec:\bpdjhtr.exe171⤵PID:2476
-
\??\c:\tnfdbdj.exec:\tnfdbdj.exe172⤵PID:2980
-
\??\c:\jdvbl.exec:\jdvbl.exe173⤵PID:2800
-
\??\c:\rvdbld.exec:\rvdbld.exe174⤵PID:788
-
\??\c:\vxndt.exec:\vxndt.exe175⤵PID:2552
-
\??\c:\dlrdt.exec:\dlrdt.exe176⤵PID:2680
-
\??\c:\nnjjjlb.exec:\nnjjjlb.exe177⤵PID:1584
-
\??\c:\hvpxd.exec:\hvpxd.exe178⤵PID:2532
-
\??\c:\jldxld.exec:\jldxld.exe179⤵PID:2708
-
\??\c:\xjxpl.exec:\xjxpl.exe180⤵PID:2508
-
\??\c:\htrnrrx.exec:\htrnrrx.exe181⤵PID:2404
-
\??\c:\hhjtrtp.exec:\hhjtrtp.exe182⤵PID:840
-
\??\c:\fbpjjnf.exec:\fbpjjnf.exe183⤵PID:1960
-
\??\c:\fdrfpd.exec:\fdrfpd.exe184⤵PID:628
-
\??\c:\bppfdtd.exec:\bppfdtd.exe185⤵PID:1944
-
\??\c:\rhpntt.exec:\rhpntt.exe186⤵PID:1036
-
\??\c:\jlxbhlx.exec:\jlxbhlx.exe187⤵PID:2452
-
\??\c:\xnrpt.exec:\xnrpt.exe188⤵PID:584
-
\??\c:\xfldb.exec:\xfldb.exe189⤵PID:1308
-
\??\c:\hbbnd.exec:\hbbnd.exe190⤵PID:2028
-
\??\c:\xptxftp.exec:\xptxftp.exe191⤵PID:2212
-
\??\c:\hlrnn.exec:\hlrnn.exe192⤵PID:2152
-
\??\c:\rllhbtx.exec:\rllhbtx.exe193⤵PID:2304
-
\??\c:\xxxjfr.exec:\xxxjfr.exe194⤵PID:2328
-
\??\c:\xjbhd.exec:\xjbhd.exe195⤵PID:2788
-
\??\c:\hxdhtfn.exec:\hxdhtfn.exe196⤵PID:2576
-
\??\c:\ddxbv.exec:\ddxbv.exe197⤵PID:1656
-
\??\c:\xdfbr.exec:\xdfbr.exe198⤵PID:2140
-
\??\c:\xdrlrr.exec:\xdrlrr.exe199⤵PID:2120
-
\??\c:\vnfbt.exec:\vnfbt.exe200⤵PID:2336
-
\??\c:\lhbhxj.exec:\lhbhxj.exe201⤵PID:2292
-
\??\c:\jdnll.exec:\jdnll.exe202⤵PID:836
-
\??\c:\bdjxb.exec:\bdjxb.exe203⤵PID:1296
-
\??\c:\hpplvh.exec:\hpplvh.exe204⤵PID:1804
-
\??\c:\fvbnp.exec:\fvbnp.exe205⤵PID:1620
-
\??\c:\jnvdhb.exec:\jnvdhb.exe206⤵PID:1504
-
\??\c:\jnvjll.exec:\jnvjll.exe207⤵PID:908
-
\??\c:\fphnj.exec:\fphnj.exe208⤵PID:2088
-
\??\c:\rlfdndb.exec:\rlfdndb.exe209⤵PID:580
-
\??\c:\tvnjxtp.exec:\tvnjxtp.exe210⤵PID:948
-
\??\c:\nfjht.exec:\nfjht.exe211⤵PID:884
-
\??\c:\vbxhvdf.exec:\vbxhvdf.exe212⤵PID:756
-
\??\c:\nvnbbjr.exec:\nvnbbjr.exe213⤵PID:2736
-
\??\c:\brldxvp.exec:\brldxvp.exe214⤵PID:1644
-
\??\c:\pdprvl.exec:\pdprvl.exe215⤵PID:2588
-
\??\c:\dffjn.exec:\dffjn.exe216⤵PID:860
-
\??\c:\vrlfhdd.exec:\vrlfhdd.exe217⤵PID:2716
-
\??\c:\xhnxrb.exec:\xhnxrb.exe218⤵PID:2696
-
\??\c:\tjxhvl.exec:\tjxhvl.exe219⤵PID:2548
-
\??\c:\xrfdr.exec:\xrfdr.exe220⤵PID:2484
-
\??\c:\hjfrpd.exec:\hjfrpd.exe221⤵PID:2684
-
\??\c:\rdtjrll.exec:\rdtjrll.exe222⤵PID:2416
-
\??\c:\ljrvdb.exec:\ljrvdb.exe223⤵PID:2512
-
\??\c:\npndvpl.exec:\npndvpl.exe224⤵PID:2528
-
\??\c:\nlxvd.exec:\nlxvd.exe225⤵PID:1164
-
\??\c:\bhjjp.exec:\bhjjp.exe226⤵PID:2988
-
\??\c:\vblpbtt.exec:\vblpbtt.exe227⤵PID:2248
-
\??\c:\rtvlp.exec:\rtvlp.exe228⤵PID:2320
-
\??\c:\fvtdn.exec:\fvtdn.exe229⤵PID:2316
-
\??\c:\pxjdv.exec:\pxjdv.exe230⤵PID:1640
-
\??\c:\fffxnbh.exec:\fffxnbh.exe231⤵PID:956
-
\??\c:\dhhfd.exec:\dhhfd.exe232⤵PID:2640
-
\??\c:\vnjjhhx.exec:\vnjjhhx.exe233⤵PID:1812
-
\??\c:\rjnxl.exec:\rjnxl.exe234⤵PID:1820
-
\??\c:\vvhxdt.exec:\vvhxdt.exe235⤵PID:2012
-
\??\c:\jvjjf.exec:\jvjjf.exe236⤵PID:2184
-
\??\c:\nnbnnb.exec:\nnbnnb.exe237⤵PID:2168
-
\??\c:\ltvjjn.exec:\ltvjjn.exe238⤵PID:1984
-
\??\c:\frfdrv.exec:\frfdrv.exe239⤵PID:1916
-
\??\c:\rrxtd.exec:\rrxtd.exe240⤵PID:1808
-
\??\c:\hvdjbft.exec:\hvdjbft.exe241⤵PID:2192
-
\??\c:\rhhnjph.exec:\rhhnjph.exe242⤵PID:268