Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 00:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d5121c246dd1400ba13a14f750047dc9276a3767cbf98d43764a830ee9384a7.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
7d5121c246dd1400ba13a14f750047dc9276a3767cbf98d43764a830ee9384a7.exe
-
Size
119KB
-
MD5
58cc3f15b96eea6f808a114df71e86c9
-
SHA1
2afa08f8af9fd96602cc1130da8ad3211109dc5c
-
SHA256
7d5121c246dd1400ba13a14f750047dc9276a3767cbf98d43764a830ee9384a7
-
SHA512
f7738699168dc1facddd4db9a02ccc8fadf6bc8eb59ed9e84df108587b0a10e0764d00ba0bd6ed01aab658674a1ffe72ca65ba95cdea2fd9a7876a5ed06be28c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgcdu:n3C9BRomRph+0Gsgcdu
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2804-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/808-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/920-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
Processes:
resource yara_rule behavioral1/memory/2804-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2052-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2128-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2620-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2620-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2620-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2368-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2368-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2368-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2368-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2408-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1428-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1920-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2288-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/948-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1108-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2140-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/808-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2420-216-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1768-252-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/920-261-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
tbvlp.exeltbrfbd.exexndljjt.exexvpxfdx.exenbfrhd.exedptbx.exenxplpvp.exejbdff.exelxfph.exejnvxv.exevfhnj.exerdjbhr.exerxnptr.exentxbxrt.exehdxtld.exebrjvhlj.exehjdntjx.exendxtlr.exenljljn.exerjrbl.exebhnjxfr.exenljbf.exeptxhlhp.exebtnjprp.exettfhn.exerjxrf.exedrdfpfn.exebvnln.exerjjbhfh.exetdljrf.exenhblllj.exehdnlr.exexjvfvph.exedhfpvh.exejplpj.exebtxdlr.exelfjlb.exedvfdthf.exexdpjfr.exellfbr.exehfdvtjt.exevxljfj.exerpjvvhb.exedpvdpdx.exelhxdhd.exenxbxbl.exephrhl.exejddrdf.exefvdjj.exevthnfb.exebvfffd.exelbhbh.exeftjnjj.exexjvfh.exellfdj.exedxppfrv.exenflhnt.exefvdtdj.exehpdbrff.exerhtxftf.exebdxtvnj.exejjbbt.exefddbbnl.exepnthbr.exepid process 2052 tbvlp.exe 2628 ltbrfbd.exe 2128 xndljjt.exe 2524 xvpxfdx.exe 2620 nbfrhd.exe 2368 dptbx.exe 2444 nxplpvp.exe 2408 jbdff.exe 1856 lxfph.exe 1096 jnvxv.exe 1428 vfhnj.exe 1920 rdjbhr.exe 2288 rxnptr.exe 948 ntxbxrt.exe 2044 hdxtld.exe 1108 brjvhlj.exe 2140 hjdntjx.exe 1756 ndxtlr.exe 808 nljljn.exe 2960 rjrbl.exe 2420 bhnjxfr.exe 2120 nljbf.exe 2908 ptxhlhp.exe 1288 btnjprp.exe 1768 ttfhn.exe 920 rjxrf.exe 1968 drdfpfn.exe 368 bvnln.exe 3008 rjjbhfh.exe 2732 tdljrf.exe 584 nhblllj.exe 880 hdnlr.exe 2212 xjvfvph.exe 2036 dhfpvh.exe 2248 jplpj.exe 2080 btxdlr.exe 1588 lfjlb.exe 2436 dvfdthf.exe 2480 xdpjfr.exe 2524 llfbr.exe 2456 hfdvtjt.exe 2692 vxljfj.exe 2672 rpjvvhb.exe 2336 dpvdpdx.exe 2396 lhxdhd.exe 2408 nxbxbl.exe 2776 phrhl.exe 2780 jddrdf.exe 1412 fvdjj.exe 1124 vthnfb.exe 1932 bvfffd.exe 2176 lbhbh.exe 2168 ftjnjj.exe 1832 xjvfh.exe 1928 llfdj.exe 1680 dxppfrv.exe 1776 nflhnt.exe 764 fvdtdj.exe 2400 hpdbrff.exe 2428 rhtxftf.exe 2788 bdxtvnj.exe 2712 jjbbt.exe 2576 fddbbnl.exe 2904 pnthbr.exe -
Processes:
resource yara_rule behavioral1/memory/2804-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/808-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/920-261-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7d5121c246dd1400ba13a14f750047dc9276a3767cbf98d43764a830ee9384a7.exetbvlp.exeltbrfbd.exexndljjt.exexvpxfdx.exenbfrhd.exedptbx.exenxplpvp.exejbdff.exelxfph.exejnvxv.exevfhnj.exerdjbhr.exerxnptr.exentxbxrt.exehdxtld.exedescription pid process target process PID 2804 wrote to memory of 2052 2804 7d5121c246dd1400ba13a14f750047dc9276a3767cbf98d43764a830ee9384a7.exe tbvlp.exe PID 2804 wrote to memory of 2052 2804 7d5121c246dd1400ba13a14f750047dc9276a3767cbf98d43764a830ee9384a7.exe tbvlp.exe PID 2804 wrote to memory of 2052 2804 7d5121c246dd1400ba13a14f750047dc9276a3767cbf98d43764a830ee9384a7.exe tbvlp.exe PID 2804 wrote to memory of 2052 2804 7d5121c246dd1400ba13a14f750047dc9276a3767cbf98d43764a830ee9384a7.exe tbvlp.exe PID 2052 wrote to memory of 2628 2052 tbvlp.exe ltbrfbd.exe PID 2052 wrote to memory of 2628 2052 tbvlp.exe ltbrfbd.exe PID 2052 wrote to memory of 2628 2052 tbvlp.exe ltbrfbd.exe PID 2052 wrote to memory of 2628 2052 tbvlp.exe ltbrfbd.exe PID 2628 wrote to memory of 2128 2628 ltbrfbd.exe xndljjt.exe PID 2628 wrote to memory of 2128 2628 ltbrfbd.exe xndljjt.exe PID 2628 wrote to memory of 2128 2628 ltbrfbd.exe xndljjt.exe PID 2628 wrote to memory of 2128 2628 ltbrfbd.exe xndljjt.exe PID 2128 wrote to memory of 2524 2128 xndljjt.exe xvpxfdx.exe PID 2128 wrote to memory of 2524 2128 xndljjt.exe xvpxfdx.exe PID 2128 wrote to memory of 2524 2128 xndljjt.exe xvpxfdx.exe PID 2128 wrote to memory of 2524 2128 xndljjt.exe xvpxfdx.exe PID 2524 wrote to memory of 2620 2524 xvpxfdx.exe nbfrhd.exe PID 2524 wrote to memory of 2620 2524 xvpxfdx.exe nbfrhd.exe PID 2524 wrote to memory of 2620 2524 xvpxfdx.exe nbfrhd.exe PID 2524 wrote to memory of 2620 2524 xvpxfdx.exe nbfrhd.exe PID 2620 wrote to memory of 2368 2620 nbfrhd.exe dptbx.exe PID 2620 wrote to memory of 2368 2620 nbfrhd.exe dptbx.exe PID 2620 wrote to memory of 2368 2620 nbfrhd.exe dptbx.exe PID 2620 wrote to memory of 2368 2620 nbfrhd.exe dptbx.exe PID 2368 wrote to memory of 2444 2368 dptbx.exe nxplpvp.exe PID 2368 wrote to memory of 2444 2368 dptbx.exe nxplpvp.exe PID 2368 wrote to memory of 2444 2368 dptbx.exe nxplpvp.exe PID 2368 wrote to memory of 2444 2368 dptbx.exe nxplpvp.exe PID 2444 wrote to memory of 2408 2444 nxplpvp.exe jbdff.exe PID 2444 wrote to memory of 2408 2444 nxplpvp.exe jbdff.exe PID 2444 wrote to memory of 2408 2444 nxplpvp.exe jbdff.exe PID 2444 wrote to memory of 2408 2444 nxplpvp.exe jbdff.exe PID 2408 wrote to memory of 1856 2408 jbdff.exe lxfph.exe PID 2408 wrote to memory of 1856 2408 jbdff.exe lxfph.exe PID 2408 wrote to memory of 1856 2408 jbdff.exe lxfph.exe PID 2408 wrote to memory of 1856 2408 jbdff.exe lxfph.exe PID 1856 wrote to memory of 1096 1856 lxfph.exe jnvxv.exe PID 1856 wrote to memory of 1096 1856 lxfph.exe jnvxv.exe PID 1856 wrote to memory of 1096 1856 lxfph.exe jnvxv.exe PID 1856 wrote to memory of 1096 1856 lxfph.exe jnvxv.exe PID 1096 wrote to memory of 1428 1096 jnvxv.exe vfhnj.exe PID 1096 wrote to memory of 1428 1096 jnvxv.exe vfhnj.exe PID 1096 wrote to memory of 1428 1096 jnvxv.exe vfhnj.exe PID 1096 wrote to memory of 1428 1096 jnvxv.exe vfhnj.exe PID 1428 wrote to memory of 1920 1428 vfhnj.exe rdjbhr.exe PID 1428 wrote to memory of 1920 1428 vfhnj.exe rdjbhr.exe PID 1428 wrote to memory of 1920 1428 vfhnj.exe rdjbhr.exe PID 1428 wrote to memory of 1920 1428 vfhnj.exe rdjbhr.exe PID 1920 wrote to memory of 2288 1920 rdjbhr.exe rxnptr.exe PID 1920 wrote to memory of 2288 1920 rdjbhr.exe rxnptr.exe PID 1920 wrote to memory of 2288 1920 rdjbhr.exe rxnptr.exe PID 1920 wrote to memory of 2288 1920 rdjbhr.exe rxnptr.exe PID 2288 wrote to memory of 948 2288 rxnptr.exe ntxbxrt.exe PID 2288 wrote to memory of 948 2288 rxnptr.exe ntxbxrt.exe PID 2288 wrote to memory of 948 2288 rxnptr.exe ntxbxrt.exe PID 2288 wrote to memory of 948 2288 rxnptr.exe ntxbxrt.exe PID 948 wrote to memory of 2044 948 ntxbxrt.exe hdxtld.exe PID 948 wrote to memory of 2044 948 ntxbxrt.exe hdxtld.exe PID 948 wrote to memory of 2044 948 ntxbxrt.exe hdxtld.exe PID 948 wrote to memory of 2044 948 ntxbxrt.exe hdxtld.exe PID 2044 wrote to memory of 1108 2044 hdxtld.exe brjvhlj.exe PID 2044 wrote to memory of 1108 2044 hdxtld.exe brjvhlj.exe PID 2044 wrote to memory of 1108 2044 hdxtld.exe brjvhlj.exe PID 2044 wrote to memory of 1108 2044 hdxtld.exe brjvhlj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d5121c246dd1400ba13a14f750047dc9276a3767cbf98d43764a830ee9384a7.exe"C:\Users\Admin\AppData\Local\Temp\7d5121c246dd1400ba13a14f750047dc9276a3767cbf98d43764a830ee9384a7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\tbvlp.exec:\tbvlp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\ltbrfbd.exec:\ltbrfbd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\xndljjt.exec:\xndljjt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\xvpxfdx.exec:\xvpxfdx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\nbfrhd.exec:\nbfrhd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\dptbx.exec:\dptbx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\nxplpvp.exec:\nxplpvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\jbdff.exec:\jbdff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\lxfph.exec:\lxfph.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\jnvxv.exec:\jnvxv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\vfhnj.exec:\vfhnj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\rdjbhr.exec:\rdjbhr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\rxnptr.exec:\rxnptr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\ntxbxrt.exec:\ntxbxrt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\hdxtld.exec:\hdxtld.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\brjvhlj.exec:\brjvhlj.exe17⤵
- Executes dropped EXE
PID:1108 -
\??\c:\hjdntjx.exec:\hjdntjx.exe18⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ndxtlr.exec:\ndxtlr.exe19⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nljljn.exec:\nljljn.exe20⤵
- Executes dropped EXE
PID:808 -
\??\c:\rjrbl.exec:\rjrbl.exe21⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bhnjxfr.exec:\bhnjxfr.exe22⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nljbf.exec:\nljbf.exe23⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ptxhlhp.exec:\ptxhlhp.exe24⤵
- Executes dropped EXE
PID:2908 -
\??\c:\btnjprp.exec:\btnjprp.exe25⤵
- Executes dropped EXE
PID:1288 -
\??\c:\ttfhn.exec:\ttfhn.exe26⤵
- Executes dropped EXE
PID:1768 -
\??\c:\rjxrf.exec:\rjxrf.exe27⤵
- Executes dropped EXE
PID:920 -
\??\c:\drdfpfn.exec:\drdfpfn.exe28⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bvnln.exec:\bvnln.exe29⤵
- Executes dropped EXE
PID:368 -
\??\c:\rjjbhfh.exec:\rjjbhfh.exe30⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tdljrf.exec:\tdljrf.exe31⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhblllj.exec:\nhblllj.exe32⤵
- Executes dropped EXE
PID:584 -
\??\c:\hdnlr.exec:\hdnlr.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\xjvfvph.exec:\xjvfvph.exe34⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dhfpvh.exec:\dhfpvh.exe35⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jplpj.exec:\jplpj.exe36⤵
- Executes dropped EXE
PID:2248 -
\??\c:\btxdlr.exec:\btxdlr.exe37⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lfjlb.exec:\lfjlb.exe38⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dvfdthf.exec:\dvfdthf.exe39⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xdpjfr.exec:\xdpjfr.exe40⤵
- Executes dropped EXE
PID:2480 -
\??\c:\llfbr.exec:\llfbr.exe41⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hfdvtjt.exec:\hfdvtjt.exe42⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vxljfj.exec:\vxljfj.exe43⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rpjvvhb.exec:\rpjvvhb.exe44⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dpvdpdx.exec:\dpvdpdx.exe45⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lhxdhd.exec:\lhxdhd.exe46⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nxbxbl.exec:\nxbxbl.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\phrhl.exec:\phrhl.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jddrdf.exec:\jddrdf.exe49⤵
- Executes dropped EXE
PID:2780 -
\??\c:\fvdjj.exec:\fvdjj.exe50⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vthnfb.exec:\vthnfb.exe51⤵
- Executes dropped EXE
PID:1124 -
\??\c:\bvfffd.exec:\bvfffd.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lbhbh.exec:\lbhbh.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ftjnjj.exec:\ftjnjj.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xjvfh.exec:\xjvfh.exe55⤵
- Executes dropped EXE
PID:1832 -
\??\c:\llfdj.exec:\llfdj.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dxppfrv.exec:\dxppfrv.exe57⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nflhnt.exec:\nflhnt.exe58⤵
- Executes dropped EXE
PID:1776 -
\??\c:\fvdtdj.exec:\fvdtdj.exe59⤵
- Executes dropped EXE
PID:764 -
\??\c:\hpdbrff.exec:\hpdbrff.exe60⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rhtxftf.exec:\rhtxftf.exe61⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bdxtvnj.exec:\bdxtvnj.exe62⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jjbbt.exec:\jjbbt.exe63⤵
- Executes dropped EXE
PID:2712 -
\??\c:\fddbbnl.exec:\fddbbnl.exe64⤵
- Executes dropped EXE
PID:2576 -
\??\c:\pnthbr.exec:\pnthbr.exe65⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bdhtthb.exec:\bdhtthb.exe66⤵PID:1844
-
\??\c:\vttjfdb.exec:\vttjfdb.exe67⤵PID:1984
-
\??\c:\hrljxl.exec:\hrljxl.exe68⤵PID:2596
-
\??\c:\ltdnp.exec:\ltdnp.exe69⤵PID:328
-
\??\c:\rtprj.exec:\rtprj.exe70⤵PID:3024
-
\??\c:\tftvdnl.exec:\tftvdnl.exe71⤵PID:1968
-
\??\c:\bjtfjrd.exec:\bjtfjrd.exe72⤵PID:1072
-
\??\c:\bltfrrl.exec:\bltfrrl.exe73⤵PID:864
-
\??\c:\jljtr.exec:\jljtr.exe74⤵PID:2088
-
\??\c:\bdxffr.exec:\bdxffr.exe75⤵PID:292
-
\??\c:\vdltvx.exec:\vdltvx.exe76⤵PID:584
-
\??\c:\dnthx.exec:\dnthx.exe77⤵PID:2892
-
\??\c:\vdhhjd.exec:\vdhhjd.exe78⤵PID:1324
-
\??\c:\xrpftft.exec:\xrpftft.exe79⤵PID:2148
-
\??\c:\trdlt.exec:\trdlt.exe80⤵PID:3016
-
\??\c:\blltflr.exec:\blltflr.exe81⤵PID:2080
-
\??\c:\nxbxxvf.exec:\nxbxxvf.exe82⤵PID:3064
-
\??\c:\ttlvx.exec:\ttlvx.exe83⤵PID:2128
-
\??\c:\nvbtvvv.exec:\nvbtvvv.exe84⤵PID:2564
-
\??\c:\rffbhd.exec:\rffbhd.exe85⤵PID:2524
-
\??\c:\fhpffpd.exec:\fhpffpd.exe86⤵PID:2640
-
\??\c:\pjdpdht.exec:\pjdpdht.exe87⤵PID:2548
-
\??\c:\rbfnfn.exec:\rbfnfn.exe88⤵PID:2504
-
\??\c:\rjlbb.exec:\rjlbb.exe89⤵PID:2328
-
\??\c:\drjvlnp.exec:\drjvlnp.exe90⤵PID:2188
-
\??\c:\ptjvlrp.exec:\ptjvlrp.exe91⤵PID:2408
-
\??\c:\fpnvrpn.exec:\fpnvrpn.exe92⤵PID:2388
-
\??\c:\plxxdln.exec:\plxxdln.exe93⤵PID:2780
-
\??\c:\bbthttd.exec:\bbthttd.exe94⤵PID:828
-
\??\c:\pnfjndr.exec:\pnfjndr.exe95⤵PID:1124
-
\??\c:\nrjttr.exec:\nrjttr.exe96⤵PID:536
-
\??\c:\dljjd.exec:\dljjd.exe97⤵PID:2176
-
\??\c:\lllvt.exec:\lllvt.exe98⤵PID:1704
-
\??\c:\ffbhp.exec:\ffbhp.exe99⤵PID:948
-
\??\c:\pxlnn.exec:\pxlnn.exe100⤵PID:1632
-
\??\c:\tffnhbp.exec:\tffnhbp.exe101⤵PID:952
-
\??\c:\vtfhh.exec:\vtfhh.exe102⤵PID:2276
-
\??\c:\jbdtnnl.exec:\jbdtnnl.exe103⤵PID:2140
-
\??\c:\llbth.exec:\llbth.exe104⤵PID:1808
-
\??\c:\xxrlxdv.exec:\xxrlxdv.exe105⤵PID:2580
-
\??\c:\dhlbrhn.exec:\dhlbrhn.exe106⤵PID:2428
-
\??\c:\ptdbnb.exec:\ptdbnb.exe107⤵PID:2792
-
\??\c:\vnhxv.exec:\vnhxv.exe108⤵PID:1084
-
\??\c:\vbxfd.exec:\vbxfd.exe109⤵PID:2576
-
\??\c:\tbtpp.exec:\tbtpp.exe110⤵PID:2908
-
\??\c:\xnbnp.exec:\xnbnp.exe111⤵PID:1844
-
\??\c:\ldrpxbl.exec:\ldrpxbl.exe112⤵PID:1984
-
\??\c:\hdjbhf.exec:\hdjbhf.exe113⤵PID:1700
-
\??\c:\hxxlbpv.exec:\hxxlbpv.exe114⤵PID:1976
-
\??\c:\frhtvhv.exec:\frhtvhv.exe115⤵PID:3024
-
\??\c:\lnnrj.exec:\lnnrj.exe116⤵PID:1740
-
\??\c:\tlrlfrf.exec:\tlrlfrf.exe117⤵PID:2992
-
\??\c:\bjvvxrj.exec:\bjvvxrj.exe118⤵PID:2296
-
\??\c:\vfnhdrt.exec:\vfnhdrt.exe119⤵PID:2088
-
\??\c:\drfbxd.exec:\drfbxd.exe120⤵PID:1696
-
\??\c:\drxnlrd.exec:\drxnlrd.exe121⤵PID:584
-
\??\c:\bnvjb.exec:\bnvjb.exe122⤵PID:2212
-
\??\c:\bhjxhf.exec:\bhjxhf.exe123⤵PID:2092
-
\??\c:\bfpbhr.exec:\bfpbhr.exe124⤵PID:2248
-
\??\c:\jrpfhbn.exec:\jrpfhbn.exe125⤵PID:3016
-
\??\c:\bhjbbbl.exec:\bhjbbbl.exe126⤵PID:2080
-
\??\c:\txllr.exec:\txllr.exe127⤵PID:3064
-
\??\c:\vhlvn.exec:\vhlvn.exe128⤵PID:2696
-
\??\c:\vhpvt.exec:\vhpvt.exe129⤵PID:2476
-
\??\c:\nhdjnfb.exec:\nhdjnfb.exe130⤵PID:2456
-
\??\c:\nrlnvv.exec:\nrlnvv.exe131⤵PID:2640
-
\??\c:\xftxnrj.exec:\xftxnrj.exe132⤵PID:2672
-
\??\c:\bhhnhvh.exec:\bhhnhvh.exe133⤵PID:2444
-
\??\c:\vlnbx.exec:\vlnbx.exe134⤵PID:2452
-
\??\c:\fbdhxbx.exec:\fbdhxbx.exe135⤵PID:2188
-
\??\c:\tpfnprn.exec:\tpfnprn.exe136⤵PID:1348
-
\??\c:\rldhdxh.exec:\rldhdxh.exe137⤵PID:1096
-
\??\c:\lxtdld.exec:\lxtdld.exe138⤵PID:2144
-
\??\c:\rvrvh.exec:\rvrvh.exe139⤵PID:828
-
\??\c:\jpnpplv.exec:\jpnpplv.exe140⤵PID:1936
-
\??\c:\nvrdnl.exec:\nvrdnl.exe141⤵PID:1664
-
\??\c:\hxdpd.exec:\hxdpd.exe142⤵PID:1960
-
\??\c:\xtrpxb.exec:\xtrpxb.exe143⤵PID:1796
-
\??\c:\fnpddfh.exec:\fnpddfh.exe144⤵PID:956
-
\??\c:\hbhnv.exec:\hbhnv.exe145⤵PID:936
-
\??\c:\nhptlv.exec:\nhptlv.exe146⤵PID:2588
-
\??\c:\xlvtrr.exec:\xlvtrr.exe147⤵PID:2584
-
\??\c:\dpphr.exec:\dpphr.exe148⤵PID:1184
-
\??\c:\xrlnpfd.exec:\xrlnpfd.exe149⤵PID:808
-
\??\c:\nhxfrbt.exec:\nhxfrbt.exe150⤵PID:2156
-
\??\c:\llhff.exec:\llhff.exe151⤵PID:2720
-
\??\c:\vrnllb.exec:\vrnllb.exe152⤵PID:2712
-
\??\c:\hdfhx.exec:\hdfhx.exe153⤵PID:1128
-
\??\c:\pfftfv.exec:\pfftfv.exe154⤵PID:1924
-
\??\c:\dvjhd.exec:\dvjhd.exe155⤵PID:2112
-
\??\c:\rflvhjb.exec:\rflvhjb.exe156⤵PID:2512
-
\??\c:\hhhrvh.exec:\hhhrvh.exe157⤵PID:1984
-
\??\c:\bjjph.exec:\bjjph.exe158⤵PID:1992
-
\??\c:\vjdrhp.exec:\vjdrhp.exe159⤵PID:840
-
\??\c:\lrdrh.exec:\lrdrh.exe160⤵PID:3024
-
\??\c:\jfrlntj.exec:\jfrlntj.exe161⤵PID:864
-
\??\c:\nxnlpf.exec:\nxnlpf.exe162⤵PID:240
-
\??\c:\vrtxn.exec:\vrtxn.exe163⤵PID:1332
-
\??\c:\lflpp.exec:\lflpp.exe164⤵PID:2216
-
\??\c:\xtlpph.exec:\xtlpph.exe165⤵PID:1056
-
\??\c:\ndfhdnr.exec:\ndfhdnr.exe166⤵PID:2076
-
\??\c:\ljbvnnx.exec:\ljbvnnx.exe167⤵PID:2844
-
\??\c:\vnbpr.exec:\vnbpr.exe168⤵PID:2684
-
\??\c:\bddvvr.exec:\bddvvr.exe169⤵PID:1716
-
\??\c:\tvjllbd.exec:\tvjllbd.exe170⤵PID:2896
-
\??\c:\fhvrj.exec:\fhvrj.exe171⤵PID:2480
-
\??\c:\nhlpdbh.exec:\nhlpdbh.exe172⤵PID:2340
-
\??\c:\fbpjd.exec:\fbpjd.exe173⤵PID:2696
-
\??\c:\fpjpxnb.exec:\fpjpxnb.exe174⤵PID:2620
-
\??\c:\vjlpnrf.exec:\vjlpnrf.exe175⤵PID:2456
-
\??\c:\rxjthdt.exec:\rxjthdt.exe176⤵PID:2352
-
\??\c:\pbvdr.exec:\pbvdr.exe177⤵PID:2152
-
\??\c:\bnvhbfn.exec:\bnvhbfn.exe178⤵PID:528
-
\??\c:\tlrxbf.exec:\tlrxbf.exe179⤵PID:324
-
\??\c:\dftlbf.exec:\dftlbf.exe180⤵PID:1432
-
\??\c:\dhphpf.exec:\dhphpf.exe181⤵PID:2700
-
\??\c:\brnhv.exec:\brnhv.exe182⤵PID:1912
-
\??\c:\tlfbht.exec:\tlfbht.exe183⤵PID:2300
-
\??\c:\nvrnr.exec:\nvrnr.exe184⤵PID:2304
-
\??\c:\pxlvjbb.exec:\pxlvjbb.exe185⤵PID:860
-
\??\c:\rjlljlp.exec:\rjlljlp.exe186⤵PID:2012
-
\??\c:\nfhhtn.exec:\nfhhtn.exe187⤵PID:2284
-
\??\c:\drvdnr.exec:\drvdnr.exe188⤵PID:1680
-
\??\c:\bfnjh.exec:\bfnjh.exe189⤵PID:1188
-
\??\c:\xjljr.exec:\xjljr.exe190⤵PID:1944
-
\??\c:\fhnxdlb.exec:\fhnxdlb.exe191⤵PID:1956
-
\??\c:\ptbpfvt.exec:\ptbpfvt.exe192⤵PID:2656
-
\??\c:\pflfp.exec:\pflfp.exe193⤵PID:2644
-
\??\c:\tnvpp.exec:\tnvpp.exe194⤵PID:2256
-
\??\c:\htndbr.exec:\htndbr.exe195⤵PID:2508
-
\??\c:\ljrdx.exec:\ljrdx.exe196⤵PID:436
-
\??\c:\ptxhb.exec:\ptxhb.exe197⤵PID:1572
-
\??\c:\xbhjp.exec:\xbhjp.exe198⤵PID:2576
-
\??\c:\fffjjpd.exec:\fffjjpd.exe199⤵PID:2112
-
\??\c:\lhjlr.exec:\lhjlr.exe200⤵PID:1768
-
\??\c:\tthpjdx.exec:\tthpjdx.exe201⤵PID:2512
-
\??\c:\nrxrrrv.exec:\nrxrrrv.exe202⤵PID:2984
-
\??\c:\lrxrb.exec:\lrxrb.exe203⤵PID:3036
-
\??\c:\pxjbh.exec:\pxjbh.exe204⤵PID:1668
-
\??\c:\vtdnxnn.exec:\vtdnxnn.exe205⤵PID:2756
-
\??\c:\xbpdhf.exec:\xbpdhf.exe206⤵PID:2732
-
\??\c:\fbnhjr.exec:\fbnhjr.exe207⤵PID:1336
-
\??\c:\frhfvpj.exec:\frhfvpj.exe208⤵PID:1764
-
\??\c:\jdfdv.exec:\jdfdv.exe209⤵PID:1760
-
\??\c:\xlbrrn.exec:\xlbrrn.exe210⤵PID:2820
-
\??\c:\npvvb.exec:\npvvb.exe211⤵PID:1392
-
\??\c:\fhvvrr.exec:\fhvvrr.exe212⤵PID:2092
-
\??\c:\jltfrx.exec:\jltfrx.exe213⤵PID:3056
-
\??\c:\rjjtnvj.exec:\rjjtnvj.exe214⤵PID:3016
-
\??\c:\hvhptxn.exec:\hvhptxn.exe215⤵PID:2840
-
\??\c:\jhtln.exec:\jhtln.exe216⤵PID:1556
-
\??\c:\fxbbf.exec:\fxbbf.exe217⤵PID:2448
-
\??\c:\drlvddr.exec:\drlvddr.exe218⤵PID:2604
-
\??\c:\nbnnlt.exec:\nbnnlt.exe219⤵PID:2356
-
\??\c:\tlrlff.exec:\tlrlff.exe220⤵PID:2344
-
\??\c:\flrhrbh.exec:\flrhrbh.exe221⤵PID:2348
-
\??\c:\hxpfdtt.exec:\hxpfdtt.exe222⤵PID:2764
-
\??\c:\fpjxx.exec:\fpjxx.exe223⤵PID:564
-
\??\c:\ftlhdln.exec:\ftlhdln.exe224⤵PID:1008
-
\??\c:\hbfhd.exec:\hbfhd.exe225⤵PID:904
-
\??\c:\nbfdtrh.exec:\nbfdtrh.exe226⤵PID:572
-
\??\c:\pvtjl.exec:\pvtjl.exe227⤵PID:1428
-
\??\c:\ljbph.exec:\ljbph.exe228⤵PID:828
-
\??\c:\tvtlhlp.exec:\tvtlhlp.exe229⤵PID:1156
-
\??\c:\rjrjjxp.exec:\rjrjjxp.exe230⤵PID:860
-
\??\c:\lxlvt.exec:\lxlvt.exe231⤵PID:2280
-
\??\c:\xhrfd.exec:\xhrfd.exe232⤵PID:2164
-
\??\c:\rlrjff.exec:\rlrjff.exe233⤵PID:944
-
\??\c:\tlhjxrh.exec:\tlhjxrh.exe234⤵PID:936
-
\??\c:\hxvvt.exec:\hxvvt.exe235⤵PID:1592
-
\??\c:\hplfvvf.exec:\hplfvvf.exe236⤵PID:2652
-
\??\c:\jdjntv.exec:\jdjntv.exe237⤵PID:2320
-
\??\c:\vbxvpr.exec:\vbxvpr.exe238⤵PID:2708
-
\??\c:\nxhjh.exec:\nxhjh.exe239⤵PID:2256
-
\??\c:\ntflnrn.exec:\ntflnrn.exe240⤵PID:2720
-
\??\c:\jrphbxx.exec:\jrphbxx.exe241⤵PID:436
-
\??\c:\dttvbrh.exec:\dttvbrh.exe242⤵PID:2904