Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 07:58
Behavioral task
behavioral1
Sample
24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe
-
Size
82KB
-
MD5
25d6411f8b6fc578d193e6ff1a239d80
-
SHA1
a6f92b357a21fabb781ef1cf80d6005fdb4cce8d
-
SHA256
24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb
-
SHA512
1e66c73c41cf59e128da09bceb60f0089c99e00bc93c8a6267443bf60c84a8e796795f4156207589d5f59f0595163f191088b75389229abd374331ad4dcff343
-
SSDEEP
1536:CvQBeOGtrYS3srx93UBWfwC6Ggnouy8AelS7/7VIQH2i:ChOmTsF93UYfwC6GIoutAe07zVIq7
Malware Config
Signatures
-
Detect Blackmoon payload 56 IoCs
Processes:
resource yara_rule behavioral1/memory/2180-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-60-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2360-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1012-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-120-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2932-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-190-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2248-189-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2248-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-248-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1092-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-256-0x0000000000250000-0x0000000000279000-memory.dmp family_blackmoon behavioral1/memory/1680-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-284-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2056-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-294-0x0000000000250000-0x0000000000279000-memory.dmp family_blackmoon behavioral1/memory/892-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-323-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2916-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-352-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2512-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-364-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/1124-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-425-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-444-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-476-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1568-543-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2204-542-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1548-550-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/460-558-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1384-603-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2664-667-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2664-693-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1636-721-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2584-735-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2296-781-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/524-798-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/524-835-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/1556-890-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2360-974-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lvhjr.exelhnrjp.exejxvrd.exejxxrfj.exebrvpdf.exetrthbb.exephlplj.exelxxfpp.exevtbfvbj.exebljffj.exelphvvlb.exepxvjf.exehvdjnnt.exepxtld.exevhxpnh.exenxlxpd.exehjdnt.exejxhjlr.exelrnxlrv.exexxnhbfj.exedlpjlf.exebtjdv.exexjpll.exexbvfnlb.exehnfjntx.exedbrbt.exephbjn.exelvlnn.exetjpbbx.exepbhlbtn.exefnvnbl.exetlndn.exelhvjvn.exejdbdf.exebnvvpt.exejbjxtb.exetjfppxt.exetnfbl.exepftvvhn.exebrvvpjp.exeblvhlt.exejlvrpjb.exetnlrl.exedrpxlh.exehbhxbhx.exedhpvrtf.exehvhdv.exevtdbvjt.exejlnhdjh.exerxvxrxf.exexpndjx.exetlnbh.exehpnxpdh.exeftlfv.exehtjtljp.exehxfxf.exedxbtt.exejbdxhlp.exellbhdbx.exeddxjd.exertpnhlt.exexppnt.exebprhxf.exevxtljdp.exepid process 2180 lvhjr.exe 2620 lhnrjp.exe 2480 jxvrd.exe 2524 jxxrfj.exe 2464 brvpdf.exe 2360 trthbb.exe 2500 phlplj.exe 2856 lxxfpp.exe 1012 vtbfvbj.exe 2316 bljffj.exe 840 lphvvlb.exe 2788 pxvjf.exe 2932 hvdjnnt.exe 1988 pxtld.exe 2148 vhxpnh.exe 1920 nxlxpd.exe 2632 hjdnt.exe 1784 jxhjlr.exe 764 lrnxlrv.exe 2248 xxnhbfj.exe 780 dlpjlf.exe 2988 btjdv.exe 3008 xjpll.exe 3020 xbvfnlb.exe 2204 hnfjntx.exe 1092 dbrbt.exe 1680 phbjn.exe 2100 lvlnn.exe 608 tjpbbx.exe 1616 pbhlbtn.exe 2056 fnvnbl.exe 2164 tlndn.exe 892 lhvjvn.exe 2076 jdbdf.exe 2412 bnvvpt.exe 1584 jbjxtb.exe 2784 tjfppxt.exe 2916 tnfbl.exe 2480 pftvvhn.exe 2436 brvvpjp.exe 2512 blvhlt.exe 2712 jlvrpjb.exe 2648 tnlrl.exe 2604 drpxlh.exe 1884 hbhxbhx.exe 1172 dhpvrtf.exe 1124 hvhdv.exe 1732 vtdbvjt.exe 2652 jlnhdjh.exe 2812 rxvxrxf.exe 2300 xpndjx.exe 2220 tlnbh.exe 1116 hpnxpdh.exe 1644 ftlfv.exe 1924 htjtljp.exe 2592 hxfxf.exe 2508 dxbtt.exe 1196 jbdxhlp.exe 2280 llbhdbx.exe 2236 ddxjd.exe 2268 rtpnhlt.exe 576 xppnt.exe 1568 bprhxf.exe 2140 vxtljdp.exe -
Processes:
resource yara_rule behavioral1/memory/1692-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-13-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2180-11-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\lhnrjp.exe upx \??\c:\lvhjr.exe upx behavioral1/memory/1692-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-26-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\jxvrd.exe upx C:\jxxrfj.exe upx behavioral1/memory/2524-44-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\brvpdf.exe upx behavioral1/memory/2464-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-58-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\phlplj.exe upx behavioral1/memory/2500-66-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\trthbb.exe upx \??\c:\lxxfpp.exe upx behavioral1/memory/2856-77-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\vtbfvbj.exe upx behavioral1/memory/1012-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1012-91-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\bljffj.exe upx behavioral1/memory/2316-102-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\lphvvlb.exe upx \??\c:\pxvjf.exe upx behavioral1/memory/840-111-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\hvdjnnt.exe upx behavioral1/memory/2932-122-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\pxtld.exe upx behavioral1/memory/2932-131-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\vhxpnh.exe upx C:\nxlxpd.exe upx behavioral1/memory/2148-147-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\hjdnt.exe upx behavioral1/memory/1920-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-165-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\jxhjlr.exe upx C:\lrnxlrv.exe upx behavioral1/memory/1784-174-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\xxnhbfj.exe upx behavioral1/memory/764-183-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\dlpjlf.exe upx behavioral1/memory/780-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-194-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\btjdv.exe upx C:\xjpll.exe upx behavioral1/memory/3008-213-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\xbvfnlb.exe upx C:\hnfjntx.exe upx behavioral1/memory/2204-237-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\dbrbt.exe upx behavioral1/memory/1092-247-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\phbjn.exe upx C:\lvlnn.exe upx \??\c:\tjpbbx.exe upx behavioral1/memory/1680-257-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\pbhlbtn.exe upx C:\fnvnbl.exe upx C:\tlndn.exe upx behavioral1/memory/2056-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-322-0x0000000000230000-0x0000000000259000-memory.dmp upx behavioral1/memory/2916-343-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exelvhjr.exelhnrjp.exejxvrd.exejxxrfj.exebrvpdf.exetrthbb.exephlplj.exelxxfpp.exevtbfvbj.exebljffj.exelphvvlb.exepxvjf.exehvdjnnt.exepxtld.exevhxpnh.exedescription pid process target process PID 1692 wrote to memory of 2180 1692 24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe lvhjr.exe PID 1692 wrote to memory of 2180 1692 24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe lvhjr.exe PID 1692 wrote to memory of 2180 1692 24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe lvhjr.exe PID 1692 wrote to memory of 2180 1692 24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe lvhjr.exe PID 2180 wrote to memory of 2620 2180 lvhjr.exe lhnrjp.exe PID 2180 wrote to memory of 2620 2180 lvhjr.exe lhnrjp.exe PID 2180 wrote to memory of 2620 2180 lvhjr.exe lhnrjp.exe PID 2180 wrote to memory of 2620 2180 lvhjr.exe lhnrjp.exe PID 2620 wrote to memory of 2480 2620 lhnrjp.exe jxvrd.exe PID 2620 wrote to memory of 2480 2620 lhnrjp.exe jxvrd.exe PID 2620 wrote to memory of 2480 2620 lhnrjp.exe jxvrd.exe PID 2620 wrote to memory of 2480 2620 lhnrjp.exe jxvrd.exe PID 2480 wrote to memory of 2524 2480 jxvrd.exe jxxrfj.exe PID 2480 wrote to memory of 2524 2480 jxvrd.exe jxxrfj.exe PID 2480 wrote to memory of 2524 2480 jxvrd.exe jxxrfj.exe PID 2480 wrote to memory of 2524 2480 jxvrd.exe jxxrfj.exe PID 2524 wrote to memory of 2464 2524 jxxrfj.exe brvpdf.exe PID 2524 wrote to memory of 2464 2524 jxxrfj.exe brvpdf.exe PID 2524 wrote to memory of 2464 2524 jxxrfj.exe brvpdf.exe PID 2524 wrote to memory of 2464 2524 jxxrfj.exe brvpdf.exe PID 2464 wrote to memory of 2360 2464 brvpdf.exe trthbb.exe PID 2464 wrote to memory of 2360 2464 brvpdf.exe trthbb.exe PID 2464 wrote to memory of 2360 2464 brvpdf.exe trthbb.exe PID 2464 wrote to memory of 2360 2464 brvpdf.exe trthbb.exe PID 2360 wrote to memory of 2500 2360 trthbb.exe phlplj.exe PID 2360 wrote to memory of 2500 2360 trthbb.exe phlplj.exe PID 2360 wrote to memory of 2500 2360 trthbb.exe phlplj.exe PID 2360 wrote to memory of 2500 2360 trthbb.exe phlplj.exe PID 2500 wrote to memory of 2856 2500 phlplj.exe lxxfpp.exe PID 2500 wrote to memory of 2856 2500 phlplj.exe lxxfpp.exe PID 2500 wrote to memory of 2856 2500 phlplj.exe lxxfpp.exe PID 2500 wrote to memory of 2856 2500 phlplj.exe lxxfpp.exe PID 2856 wrote to memory of 1012 2856 lxxfpp.exe vtbfvbj.exe PID 2856 wrote to memory of 1012 2856 lxxfpp.exe vtbfvbj.exe PID 2856 wrote to memory of 1012 2856 lxxfpp.exe vtbfvbj.exe PID 2856 wrote to memory of 1012 2856 lxxfpp.exe vtbfvbj.exe PID 1012 wrote to memory of 2316 1012 vtbfvbj.exe bljffj.exe PID 1012 wrote to memory of 2316 1012 vtbfvbj.exe bljffj.exe PID 1012 wrote to memory of 2316 1012 vtbfvbj.exe bljffj.exe PID 1012 wrote to memory of 2316 1012 vtbfvbj.exe bljffj.exe PID 2316 wrote to memory of 840 2316 bljffj.exe lphvvlb.exe PID 2316 wrote to memory of 840 2316 bljffj.exe lphvvlb.exe PID 2316 wrote to memory of 840 2316 bljffj.exe lphvvlb.exe PID 2316 wrote to memory of 840 2316 bljffj.exe lphvvlb.exe PID 840 wrote to memory of 2788 840 lphvvlb.exe pxvjf.exe PID 840 wrote to memory of 2788 840 lphvvlb.exe pxvjf.exe PID 840 wrote to memory of 2788 840 lphvvlb.exe pxvjf.exe PID 840 wrote to memory of 2788 840 lphvvlb.exe pxvjf.exe PID 2788 wrote to memory of 2932 2788 pxvjf.exe hvdjnnt.exe PID 2788 wrote to memory of 2932 2788 pxvjf.exe hvdjnnt.exe PID 2788 wrote to memory of 2932 2788 pxvjf.exe hvdjnnt.exe PID 2788 wrote to memory of 2932 2788 pxvjf.exe hvdjnnt.exe PID 2932 wrote to memory of 1988 2932 hvdjnnt.exe pxtld.exe PID 2932 wrote to memory of 1988 2932 hvdjnnt.exe pxtld.exe PID 2932 wrote to memory of 1988 2932 hvdjnnt.exe pxtld.exe PID 2932 wrote to memory of 1988 2932 hvdjnnt.exe pxtld.exe PID 1988 wrote to memory of 2148 1988 pxtld.exe vhxpnh.exe PID 1988 wrote to memory of 2148 1988 pxtld.exe vhxpnh.exe PID 1988 wrote to memory of 2148 1988 pxtld.exe vhxpnh.exe PID 1988 wrote to memory of 2148 1988 pxtld.exe vhxpnh.exe PID 2148 wrote to memory of 1920 2148 vhxpnh.exe nxlxpd.exe PID 2148 wrote to memory of 1920 2148 vhxpnh.exe nxlxpd.exe PID 2148 wrote to memory of 1920 2148 vhxpnh.exe nxlxpd.exe PID 2148 wrote to memory of 1920 2148 vhxpnh.exe nxlxpd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe"C:\Users\Admin\AppData\Local\Temp\24a47fd3806fbe678b579cf9b8d5fc9b19958db170ad648c6bc7f36bef1326fb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\lvhjr.exec:\lvhjr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\lhnrjp.exec:\lhnrjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jxvrd.exec:\jxvrd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\jxxrfj.exec:\jxxrfj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\brvpdf.exec:\brvpdf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\trthbb.exec:\trthbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\phlplj.exec:\phlplj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\lxxfpp.exec:\lxxfpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vtbfvbj.exec:\vtbfvbj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\bljffj.exec:\bljffj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\lphvvlb.exec:\lphvvlb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\pxvjf.exec:\pxvjf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hvdjnnt.exec:\hvdjnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\pxtld.exec:\pxtld.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\vhxpnh.exec:\vhxpnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\nxlxpd.exec:\nxlxpd.exe17⤵
- Executes dropped EXE
PID:1920 -
\??\c:\hjdnt.exec:\hjdnt.exe18⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jxhjlr.exec:\jxhjlr.exe19⤵
- Executes dropped EXE
PID:1784 -
\??\c:\lrnxlrv.exec:\lrnxlrv.exe20⤵
- Executes dropped EXE
PID:764 -
\??\c:\xxnhbfj.exec:\xxnhbfj.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dlpjlf.exec:\dlpjlf.exe22⤵
- Executes dropped EXE
PID:780 -
\??\c:\btjdv.exec:\btjdv.exe23⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xjpll.exec:\xjpll.exe24⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xbvfnlb.exec:\xbvfnlb.exe25⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hnfjntx.exec:\hnfjntx.exe26⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dbrbt.exec:\dbrbt.exe27⤵
- Executes dropped EXE
PID:1092 -
\??\c:\phbjn.exec:\phbjn.exe28⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lvlnn.exec:\lvlnn.exe29⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tjpbbx.exec:\tjpbbx.exe30⤵
- Executes dropped EXE
PID:608 -
\??\c:\pbhlbtn.exec:\pbhlbtn.exe31⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fnvnbl.exec:\fnvnbl.exe32⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tlndn.exec:\tlndn.exe33⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lhvjvn.exec:\lhvjvn.exe34⤵
- Executes dropped EXE
PID:892 -
\??\c:\jdbdf.exec:\jdbdf.exe35⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bnvvpt.exec:\bnvvpt.exe36⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jbjxtb.exec:\jbjxtb.exe37⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tjfppxt.exec:\tjfppxt.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\tnfbl.exec:\tnfbl.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pftvvhn.exec:\pftvvhn.exe40⤵
- Executes dropped EXE
PID:2480 -
\??\c:\brvvpjp.exec:\brvvpjp.exe41⤵
- Executes dropped EXE
PID:2436 -
\??\c:\blvhlt.exec:\blvhlt.exe42⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jlvrpjb.exec:\jlvrpjb.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tnlrl.exec:\tnlrl.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\drpxlh.exec:\drpxlh.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\hbhxbhx.exec:\hbhxbhx.exe46⤵
- Executes dropped EXE
PID:1884 -
\??\c:\dhpvrtf.exec:\dhpvrtf.exe47⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hvhdv.exec:\hvhdv.exe48⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vtdbvjt.exec:\vtdbvjt.exe49⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jlnhdjh.exec:\jlnhdjh.exe50⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rxvxrxf.exec:\rxvxrxf.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xpndjx.exec:\xpndjx.exe52⤵
- Executes dropped EXE
PID:2300 -
\??\c:\tlnbh.exec:\tlnbh.exe53⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hpnxpdh.exec:\hpnxpdh.exe54⤵
- Executes dropped EXE
PID:1116 -
\??\c:\ftlfv.exec:\ftlfv.exe55⤵
- Executes dropped EXE
PID:1644 -
\??\c:\htjtljp.exec:\htjtljp.exe56⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hxfxf.exec:\hxfxf.exe57⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dxbtt.exec:\dxbtt.exe58⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jbdxhlp.exec:\jbdxhlp.exe59⤵
- Executes dropped EXE
PID:1196 -
\??\c:\llbhdbx.exec:\llbhdbx.exe60⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ddxjd.exec:\ddxjd.exe61⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rtpnhlt.exec:\rtpnhlt.exe62⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xppnt.exec:\xppnt.exe63⤵
- Executes dropped EXE
PID:576 -
\??\c:\bprhxf.exec:\bprhxf.exe64⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vxtljdp.exec:\vxtljdp.exe65⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ldnfnh.exec:\ldnfnh.exe66⤵PID:1080
-
\??\c:\jdrtbd.exec:\jdrtbd.exe67⤵PID:3004
-
\??\c:\ptfdhb.exec:\ptfdhb.exe68⤵PID:2192
-
\??\c:\tdnvrxj.exec:\tdnvrxj.exe69⤵PID:2204
-
\??\c:\hrrvntp.exec:\hrrvntp.exe70⤵PID:1548
-
\??\c:\tlrfpl.exec:\tlrfpl.exe71⤵PID:460
-
\??\c:\xhjjfdp.exec:\xhjjfdp.exe72⤵PID:980
-
\??\c:\rbnfxff.exec:\rbnfxff.exe73⤵PID:1508
-
\??\c:\xtnphlh.exec:\xtnphlh.exe74⤵PID:2880
-
\??\c:\dxjbb.exec:\dxjbb.exe75⤵PID:1752
-
\??\c:\fphbdnr.exec:\fphbdnr.exe76⤵PID:1464
-
\??\c:\phtlx.exec:\phtlx.exe77⤵PID:1524
-
\??\c:\dvfbdtd.exec:\dvfbdtd.exe78⤵PID:1384
-
\??\c:\jrllv.exec:\jrllv.exe79⤵PID:1400
-
\??\c:\jpvbd.exec:\jpvbd.exe80⤵PID:2416
-
\??\c:\vdfnlpj.exec:\vdfnlpj.exe81⤵PID:1708
-
\??\c:\xtdvb.exec:\xtdvb.exe82⤵PID:1584
-
\??\c:\hdnjh.exec:\hdnjh.exe83⤵PID:1936
-
\??\c:\dvnxb.exec:\dvnxb.exe84⤵PID:2916
-
\??\c:\dnvljtr.exec:\dnvljtr.exe85⤵PID:2488
-
\??\c:\jntdd.exec:\jntdd.exe86⤵PID:2924
-
\??\c:\tvfljp.exec:\tvfljp.exe87⤵PID:2640
-
\??\c:\nxfnrn.exec:\nxfnrn.exe88⤵PID:2664
-
\??\c:\dtldtxn.exec:\dtldtxn.exe89⤵PID:2444
-
\??\c:\hhprh.exec:\hhprh.exe90⤵PID:2200
-
\??\c:\dvrtbx.exec:\dvrtbx.exe91⤵PID:556
-
\??\c:\fbhtdf.exec:\fbhtdf.exe92⤵PID:1236
-
\??\c:\rbdbdx.exec:\rbdbdx.exe93⤵PID:1372
-
\??\c:\vnfxvv.exec:\vnfxvv.exe94⤵PID:652
-
\??\c:\rbjhh.exec:\rbjhh.exe95⤵PID:840
-
\??\c:\frbjpp.exec:\frbjpp.exe96⤵PID:1636
-
\??\c:\nftrt.exec:\nftrt.exe97⤵PID:2008
-
\??\c:\jttvj.exec:\jttvj.exe98⤵PID:2584
-
\??\c:\dnvlx.exec:\dnvlx.exe99⤵PID:1988
-
\??\c:\ptprbtn.exec:\ptprbtn.exe100⤵PID:1912
-
\??\c:\pdbdhff.exec:\pdbdhff.exe101⤵PID:2156
-
\??\c:\xxdbjx.exec:\xxdbjx.exe102⤵PID:1540
-
\??\c:\rddpp.exec:\rddpp.exe103⤵PID:1460
-
\??\c:\jvhlvpl.exec:\jvhlvpl.exe104⤵PID:2252
-
\??\c:\lfrxtr.exec:\lfrxtr.exe105⤵PID:1188
-
\??\c:\lxtxdd.exec:\lxtxdd.exe106⤵PID:2296
-
\??\c:\brjpld.exec:\brjpld.exe107⤵PID:2248
-
\??\c:\jjtttbr.exec:\jjtttbr.exe108⤵PID:524
-
\??\c:\prrffrd.exec:\prrffrd.exe109⤵PID:1728
-
\??\c:\bjbhh.exec:\bjbhh.exe110⤵PID:1748
-
\??\c:\bjrdbff.exec:\bjrdbff.exe111⤵PID:2052
-
\??\c:\tbbrj.exec:\tbbrj.exe112⤵PID:2952
-
\??\c:\njvtblp.exec:\njvtblp.exe113⤵PID:1080
-
\??\c:\ltbxxxn.exec:\ltbxxxn.exe114⤵PID:3056
-
\??\c:\txdphll.exec:\txdphll.exe115⤵PID:2192
-
\??\c:\bffbllr.exec:\bffbllr.exe116⤵PID:1656
-
\??\c:\lnblnxj.exec:\lnblnxj.exe117⤵PID:1180
-
\??\c:\ppprxp.exec:\ppprxp.exe118⤵PID:1680
-
\??\c:\ptdhvbh.exec:\ptdhvbh.exe119⤵PID:2748
-
\??\c:\nrfrb.exec:\nrfrb.exe120⤵PID:608
-
\??\c:\dnpbrj.exec:\dnpbrj.exe121⤵PID:1616
-
\??\c:\phjrlth.exec:\phjrlth.exe122⤵PID:1716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-