Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 00:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a9cb27350d85f3668617c9f51094a6e258f826dfda98449611a2eac007c0c8d.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
9a9cb27350d85f3668617c9f51094a6e258f826dfda98449611a2eac007c0c8d.exe
-
Size
61KB
-
MD5
4b3d8fdaf3a13182ac42e1b7d7ec8e27
-
SHA1
0c5671ac945adc99d3ae4c426598df489a5e94d0
-
SHA256
9a9cb27350d85f3668617c9f51094a6e258f826dfda98449611a2eac007c0c8d
-
SHA512
3c017d56f4fa063aed6604c272c4f016cab19c82d6d5ec9489331a42b1cf0c26de33e2c987be73a343785134d9a29b15764467c48463455db84a9d4e91277640
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27h:ymb3NkkiQ3mdBjFI9Q
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/1968-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/828-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral1/memory/1968-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2172-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2244-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2244-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2288-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2288-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2288-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2288-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2908-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2596-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2596-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2596-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2540-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2500-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2036-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1736-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/564-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/828-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2088-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2416-233-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1060-242-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1796-278-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2172 pxrbr.exe 2244 hxldj.exe 2832 btlnxnf.exe 2288 xvlthn.exe 2908 rthhx.exe 2596 tvtlxdh.exe 2628 dxpthnv.exe 2540 btdtlh.exe 2400 hjrdhb.exe 2380 dthbbdd.exe 2500 dlxvxt.exe 2864 pljndb.exe 2080 ljnvxdx.exe 2036 dfnrjfv.exe 1516 xxhvd.exe 1736 dbxtp.exe 1628 plbhr.exe 564 xnbpr.exe 828 ldbnjrr.exe 780 tbbjllp.exe 2840 blrxx.exe 2088 hjnll.exe 2416 jftjt.exe 1060 ljphr.exe 1960 tbhxtt.exe 980 rjxrttd.exe 1484 npndlpl.exe 1796 dltrh.exe 108 tjpjj.exe 688 rvbnb.exe 3024 llthxf.exe 1740 xlhjn.exe 2200 lrxdhd.exe 2112 vlhprb.exe 2212 nrhlftd.exe 2220 hjhdvh.exe 2316 ptjldd.exe 2980 hhptbt.exe 2880 dfbhrpb.exe 1896 thrjjtb.exe 1708 lhjjj.exe 2464 hbbjnnj.exe 2508 bvdhj.exe 2784 ptjhn.exe 2596 thtrvr.exe 2636 dhnvhln.exe 2692 dnrfl.exe 2544 hrdvd.exe 2400 djjtl.exe 2452 bxrfj.exe 1240 xhbljtj.exe 2356 lxdbrj.exe 2012 xxjtlxt.exe 1908 hpfpnrt.exe 1900 rpxpjv.exe 1716 llpbn.exe 1536 dhhdl.exe 2328 vjdbf.exe 1452 xprjxr.exe 564 jpxlhtt.exe 2684 rxdjph.exe 2752 lrdjrvt.exe 1976 pnfrppt.exe 2708 lrpnpdb.exe -
resource yara_rule behavioral1/memory/1968-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-278-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2172 1968 9a9cb27350d85f3668617c9f51094a6e258f826dfda98449611a2eac007c0c8d.exe 28 PID 1968 wrote to memory of 2172 1968 9a9cb27350d85f3668617c9f51094a6e258f826dfda98449611a2eac007c0c8d.exe 28 PID 1968 wrote to memory of 2172 1968 9a9cb27350d85f3668617c9f51094a6e258f826dfda98449611a2eac007c0c8d.exe 28 PID 1968 wrote to memory of 2172 1968 9a9cb27350d85f3668617c9f51094a6e258f826dfda98449611a2eac007c0c8d.exe 28 PID 2172 wrote to memory of 2244 2172 pxrbr.exe 29 PID 2172 wrote to memory of 2244 2172 pxrbr.exe 29 PID 2172 wrote to memory of 2244 2172 pxrbr.exe 29 PID 2172 wrote to memory of 2244 2172 pxrbr.exe 29 PID 2244 wrote to memory of 2832 2244 hxldj.exe 30 PID 2244 wrote to memory of 2832 2244 hxldj.exe 30 PID 2244 wrote to memory of 2832 2244 hxldj.exe 30 PID 2244 wrote to memory of 2832 2244 hxldj.exe 30 PID 2832 wrote to memory of 2288 2832 btlnxnf.exe 31 PID 2832 wrote to memory of 2288 2832 btlnxnf.exe 31 PID 2832 wrote to memory of 2288 2832 btlnxnf.exe 31 PID 2832 wrote to memory of 2288 2832 btlnxnf.exe 31 PID 2288 wrote to memory of 2908 2288 xvlthn.exe 32 PID 2288 wrote to memory of 2908 2288 xvlthn.exe 32 PID 2288 wrote to memory of 2908 2288 xvlthn.exe 32 PID 2288 wrote to memory of 2908 2288 xvlthn.exe 32 PID 2908 wrote to memory of 2596 2908 rthhx.exe 33 PID 2908 wrote to memory of 2596 2908 rthhx.exe 33 PID 2908 wrote to memory of 2596 2908 rthhx.exe 33 PID 2908 wrote to memory of 2596 2908 rthhx.exe 33 PID 2596 wrote to memory of 2628 2596 tvtlxdh.exe 34 PID 2596 wrote to memory of 2628 2596 tvtlxdh.exe 34 PID 2596 wrote to memory of 2628 2596 tvtlxdh.exe 34 PID 2596 wrote to memory of 2628 2596 tvtlxdh.exe 34 PID 2628 wrote to memory of 2540 2628 dxpthnv.exe 35 PID 2628 wrote to memory of 2540 2628 dxpthnv.exe 35 PID 2628 wrote to memory of 2540 2628 dxpthnv.exe 35 PID 2628 wrote to memory of 2540 2628 dxpthnv.exe 35 PID 2540 wrote to memory of 2400 2540 btdtlh.exe 36 PID 2540 wrote to memory of 2400 2540 btdtlh.exe 36 PID 2540 wrote to memory of 2400 2540 btdtlh.exe 36 PID 2540 wrote to memory of 2400 2540 btdtlh.exe 36 PID 2400 wrote to memory of 2380 2400 hjrdhb.exe 37 PID 2400 wrote to memory of 2380 2400 hjrdhb.exe 37 PID 2400 wrote to memory of 2380 2400 hjrdhb.exe 37 PID 2400 wrote to memory of 2380 2400 hjrdhb.exe 37 PID 2380 wrote to memory of 2500 2380 dthbbdd.exe 38 PID 2380 wrote to memory of 2500 2380 dthbbdd.exe 38 PID 2380 wrote to memory of 2500 2380 dthbbdd.exe 38 PID 2380 wrote to memory of 2500 2380 dthbbdd.exe 38 PID 2500 wrote to memory of 2864 2500 dlxvxt.exe 39 PID 2500 wrote to memory of 2864 2500 dlxvxt.exe 39 PID 2500 wrote to memory of 2864 2500 dlxvxt.exe 39 PID 2500 wrote to memory of 2864 2500 dlxvxt.exe 39 PID 2864 wrote to memory of 2080 2864 pljndb.exe 40 PID 2864 wrote to memory of 2080 2864 pljndb.exe 40 PID 2864 wrote to memory of 2080 2864 pljndb.exe 40 PID 2864 wrote to memory of 2080 2864 pljndb.exe 40 PID 2080 wrote to memory of 2036 2080 ljnvxdx.exe 41 PID 2080 wrote to memory of 2036 2080 ljnvxdx.exe 41 PID 2080 wrote to memory of 2036 2080 ljnvxdx.exe 41 PID 2080 wrote to memory of 2036 2080 ljnvxdx.exe 41 PID 2036 wrote to memory of 1516 2036 dfnrjfv.exe 42 PID 2036 wrote to memory of 1516 2036 dfnrjfv.exe 42 PID 2036 wrote to memory of 1516 2036 dfnrjfv.exe 42 PID 2036 wrote to memory of 1516 2036 dfnrjfv.exe 42 PID 1516 wrote to memory of 1736 1516 xxhvd.exe 43 PID 1516 wrote to memory of 1736 1516 xxhvd.exe 43 PID 1516 wrote to memory of 1736 1516 xxhvd.exe 43 PID 1516 wrote to memory of 1736 1516 xxhvd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a9cb27350d85f3668617c9f51094a6e258f826dfda98449611a2eac007c0c8d.exe"C:\Users\Admin\AppData\Local\Temp\9a9cb27350d85f3668617c9f51094a6e258f826dfda98449611a2eac007c0c8d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\pxrbr.exec:\pxrbr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\hxldj.exec:\hxldj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\btlnxnf.exec:\btlnxnf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xvlthn.exec:\xvlthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\rthhx.exec:\rthhx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\tvtlxdh.exec:\tvtlxdh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\dxpthnv.exec:\dxpthnv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\btdtlh.exec:\btdtlh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hjrdhb.exec:\hjrdhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\dthbbdd.exec:\dthbbdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\dlxvxt.exec:\dlxvxt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\pljndb.exec:\pljndb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\ljnvxdx.exec:\ljnvxdx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\dfnrjfv.exec:\dfnrjfv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\xxhvd.exec:\xxhvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\dbxtp.exec:\dbxtp.exe17⤵
- Executes dropped EXE
PID:1736 -
\??\c:\plbhr.exec:\plbhr.exe18⤵
- Executes dropped EXE
PID:1628 -
\??\c:\xnbpr.exec:\xnbpr.exe19⤵
- Executes dropped EXE
PID:564 -
\??\c:\ldbnjrr.exec:\ldbnjrr.exe20⤵
- Executes dropped EXE
PID:828 -
\??\c:\tbbjllp.exec:\tbbjllp.exe21⤵
- Executes dropped EXE
PID:780 -
\??\c:\blrxx.exec:\blrxx.exe22⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hjnll.exec:\hjnll.exe23⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jftjt.exec:\jftjt.exe24⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ljphr.exec:\ljphr.exe25⤵
- Executes dropped EXE
PID:1060 -
\??\c:\tbhxtt.exec:\tbhxtt.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rjxrttd.exec:\rjxrttd.exe27⤵
- Executes dropped EXE
PID:980 -
\??\c:\npndlpl.exec:\npndlpl.exe28⤵
- Executes dropped EXE
PID:1484 -
\??\c:\dltrh.exec:\dltrh.exe29⤵
- Executes dropped EXE
PID:1796 -
\??\c:\tjpjj.exec:\tjpjj.exe30⤵
- Executes dropped EXE
PID:108 -
\??\c:\rvbnb.exec:\rvbnb.exe31⤵
- Executes dropped EXE
PID:688 -
\??\c:\llthxf.exec:\llthxf.exe32⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xlhjn.exec:\xlhjn.exe33⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lrxdhd.exec:\lrxdhd.exe34⤵
- Executes dropped EXE
PID:2200 -
\??\c:\vlhprb.exec:\vlhprb.exe35⤵
- Executes dropped EXE
PID:2112 -
\??\c:\nrhlftd.exec:\nrhlftd.exe36⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hjhdvh.exec:\hjhdvh.exe37⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ptjldd.exec:\ptjldd.exe38⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hhptbt.exec:\hhptbt.exe39⤵
- Executes dropped EXE
PID:2980 -
\??\c:\dfbhrpb.exec:\dfbhrpb.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\thrjjtb.exec:\thrjjtb.exe41⤵
- Executes dropped EXE
PID:1896 -
\??\c:\lhjjj.exec:\lhjjj.exe42⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hbbjnnj.exec:\hbbjnnj.exe43⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bvdhj.exec:\bvdhj.exe44⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ptjhn.exec:\ptjhn.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\thtrvr.exec:\thtrvr.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dhnvhln.exec:\dhnvhln.exe47⤵
- Executes dropped EXE
PID:2636 -
\??\c:\dnrfl.exec:\dnrfl.exe48⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hrdvd.exec:\hrdvd.exe49⤵
- Executes dropped EXE
PID:2544 -
\??\c:\djjtl.exec:\djjtl.exe50⤵
- Executes dropped EXE
PID:2400 -
\??\c:\bxrfj.exec:\bxrfj.exe51⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xhbljtj.exec:\xhbljtj.exe52⤵
- Executes dropped EXE
PID:1240 -
\??\c:\lxdbrj.exec:\lxdbrj.exe53⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xxjtlxt.exec:\xxjtlxt.exe54⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hpfpnrt.exec:\hpfpnrt.exe55⤵
- Executes dropped EXE
PID:1908 -
\??\c:\rpxpjv.exec:\rpxpjv.exe56⤵
- Executes dropped EXE
PID:1900 -
\??\c:\llpbn.exec:\llpbn.exe57⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dhhdl.exec:\dhhdl.exe58⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vjdbf.exec:\vjdbf.exe59⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xprjxr.exec:\xprjxr.exe60⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jpxlhtt.exec:\jpxlhtt.exe61⤵
- Executes dropped EXE
PID:564 -
\??\c:\rxdjph.exec:\rxdjph.exe62⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lrdjrvt.exec:\lrdjrvt.exe63⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pnfrppt.exec:\pnfrppt.exe64⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lrpnpdb.exec:\lrpnpdb.exe65⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xjbrbvt.exec:\xjbrbvt.exe66⤵PID:2616
-
\??\c:\pxdnjxb.exec:\pxdnjxb.exe67⤵PID:2416
-
\??\c:\xnxxprj.exec:\xnxxprj.exe68⤵PID:1224
-
\??\c:\plpxt.exec:\plpxt.exe69⤵PID:952
-
\??\c:\vbfbj.exec:\vbfbj.exe70⤵PID:1624
-
\??\c:\rbvxhn.exec:\rbvxhn.exe71⤵PID:1012
-
\??\c:\htjvtfd.exec:\htjvtfd.exe72⤵PID:1144
-
\??\c:\jxpndvv.exec:\jxpndvv.exe73⤵PID:1252
-
\??\c:\dvfrf.exec:\dvfrf.exe74⤵PID:108
-
\??\c:\btrxrt.exec:\btrxrt.exe75⤵PID:2148
-
\??\c:\dpdjp.exec:\dpdjp.exe76⤵PID:2268
-
\??\c:\vlfdlx.exec:\vlfdlx.exe77⤵PID:2144
-
\??\c:\hxxvrl.exec:\hxxvrl.exe78⤵PID:2828
-
\??\c:\bbllf.exec:\bbllf.exe79⤵PID:2200
-
\??\c:\lndjb.exec:\lndjb.exe80⤵PID:2112
-
\??\c:\pbjnr.exec:\pbjnr.exe81⤵PID:2072
-
\??\c:\ddxrxt.exec:\ddxrxt.exe82⤵PID:2172
-
\??\c:\tdxfth.exec:\tdxfth.exe83⤵PID:2316
-
\??\c:\vnnjp.exec:\vnnjp.exe84⤵PID:1676
-
\??\c:\hbrlbxv.exec:\hbrlbxv.exe85⤵PID:2832
-
\??\c:\vlrjbbr.exec:\vlrjbbr.exe86⤵PID:2728
-
\??\c:\brrhftr.exec:\brrhftr.exe87⤵PID:3040
-
\??\c:\nrlfb.exec:\nrlfb.exe88⤵PID:2592
-
\??\c:\bpbdxdb.exec:\bpbdxdb.exe89⤵PID:2772
-
\??\c:\pjvvjhj.exec:\pjvvjhj.exe90⤵PID:2336
-
\??\c:\jhldxp.exec:\jhldxp.exe91⤵PID:2784
-
\??\c:\flfdl.exec:\flfdl.exe92⤵PID:2596
-
\??\c:\tlvtxl.exec:\tlvtxl.exe93⤵PID:2636
-
\??\c:\drrpr.exec:\drrpr.exe94⤵PID:2692
-
\??\c:\vptdv.exec:\vptdv.exe95⤵PID:2544
-
\??\c:\xvtlxpp.exec:\xvtlxpp.exe96⤵PID:2400
-
\??\c:\dfvvdn.exec:\dfvvdn.exe97⤵PID:2452
-
\??\c:\nbnbvnx.exec:\nbnbvnx.exe98⤵PID:1904
-
\??\c:\htjfj.exec:\htjfj.exe99⤵PID:760
-
\??\c:\jxbjf.exec:\jxbjf.exe100⤵PID:1940
-
\??\c:\drlddbl.exec:\drlddbl.exe101⤵PID:2080
-
\??\c:\tllnr.exec:\tllnr.exe102⤵PID:2168
-
\??\c:\dftblvr.exec:\dftblvr.exe103⤵PID:520
-
\??\c:\tfblnp.exec:\tfblnp.exe104⤵PID:1632
-
\??\c:\tdtlldd.exec:\tdtlldd.exe105⤵PID:2328
-
\??\c:\xbdfx.exec:\xbdfx.exe106⤵PID:848
-
\??\c:\nxpxj.exec:\nxpxj.exe107⤵PID:564
-
\??\c:\ttpjrpn.exec:\ttpjrpn.exe108⤵PID:852
-
\??\c:\rlhpnf.exec:\rlhpnf.exe109⤵PID:2752
-
\??\c:\rnhhvl.exec:\rnhhvl.exe110⤵PID:1976
-
\??\c:\bnrfblh.exec:\bnrfblh.exe111⤵PID:2708
-
\??\c:\nbbjbbt.exec:\nbbjbbt.exe112⤵PID:2132
-
\??\c:\dtlff.exec:\dtlff.exe113⤵PID:2416
-
\??\c:\xvdxvp.exec:\xvdxvp.exe114⤵PID:1224
-
\??\c:\bbvpl.exec:\bbvpl.exe115⤵PID:952
-
\??\c:\dfnvbvl.exec:\dfnvbvl.exe116⤵PID:3012
-
\??\c:\dljtjj.exec:\dljtjj.exe117⤵PID:1468
-
\??\c:\frbnv.exec:\frbnv.exe118⤵PID:904
-
\??\c:\vpdtn.exec:\vpdtn.exe119⤵PID:2968
-
\??\c:\djrtvhf.exec:\djrtvhf.exe120⤵PID:552
-
\??\c:\nlvdtd.exec:\nlvdtd.exe121⤵PID:1416
-
\??\c:\dfphdj.exec:\dfphdj.exe122⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-