Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 22:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe
-
Size
90KB
-
MD5
b589a7b0e66283bdb85b2a5e6354856e
-
SHA1
660a2d5c0286f1ad669c60fa81197e689e431ec6
-
SHA256
45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5
-
SHA512
b1ee6dda13c672dde0a237f7a34a0b793c4ab796d19ec224b475b356c3be4d576caa3fade7c94a46e72d0bf743f082104f7930aae044b6e30d6610cc07a98deb
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBY:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBy5
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/1968-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1380-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral1/memory/1968-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2172-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2232-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2232-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2836-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2836-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1648-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1648-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1648-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2520-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2384-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2384-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2432-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2456-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1668-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1712-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1632-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1380-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2752-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2004-236-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/276-281-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1740-308-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2172 xlhdhhl.exe 2232 lptrrp.exe 2836 lxxjt.exe 1648 vnfxpvx.exe 2568 jdjjb.exe 2520 xdlxdd.exe 2644 hvpdbdh.exe 2384 lddjj.exe 2404 vbnjj.exe 2432 prdfpp.exe 2456 ptxbhv.exe 1668 nvtxp.exe 1764 hpbrpb.exe 1936 jddbdlf.exe 1712 nlhff.exe 1632 pjjrjpv.exe 1696 lfjlf.exe 1380 ntdnth.exe 476 vtrxlj.exe 2752 fhdfnd.exe 1976 jbbdn.exe 2468 rfpbft.exe 2004 ttthb.exe 1956 nnpldp.exe 1556 htdpd.exe 2256 drhbl.exe 1136 xbftlx.exe 276 pfblbn.exe 708 jtbnft.exe 2988 lfnrnd.exe 1740 jhbxn.exe 1756 tvxhlj.exe 2112 jbpjv.exe 1604 hpjbtp.exe 2228 ftlttv.exe 2216 jxrjfrl.exe 2812 nhvpxf.exe 2820 bxhtnhv.exe 2760 fhdxlft.exe 2288 fjhvnjl.exe 1896 hhdtbft.exe 1964 xjbpvfj.exe 2588 vdfjhx.exe 2536 tbbhhl.exe 2784 ndhbp.exe 2496 ndpnvhh.exe 1148 lflbhdr.exe 2544 rlbrd.exe 2392 jtnjf.exe 956 jtjjbpt.exe 640 xrdfn.exe 1944 jtrfhp.exe 1664 vjfdrh.exe 1592 lrbtptr.exe 1536 vvbxtbb.exe 1952 hvfhpdl.exe 632 dxhvf.exe 2448 xbpbvb.exe 580 jrdfh.exe 592 npvbnx.exe 2712 blvltj.exe 1128 tnpxvbv.exe 2572 hxrlnvp.exe 596 hddjrh.exe -
resource yara_rule behavioral1/memory/1968-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1380-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-308-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2172 1968 45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe 28 PID 1968 wrote to memory of 2172 1968 45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe 28 PID 1968 wrote to memory of 2172 1968 45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe 28 PID 1968 wrote to memory of 2172 1968 45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe 28 PID 2172 wrote to memory of 2232 2172 xlhdhhl.exe 29 PID 2172 wrote to memory of 2232 2172 xlhdhhl.exe 29 PID 2172 wrote to memory of 2232 2172 xlhdhhl.exe 29 PID 2172 wrote to memory of 2232 2172 xlhdhhl.exe 29 PID 2232 wrote to memory of 2836 2232 lptrrp.exe 30 PID 2232 wrote to memory of 2836 2232 lptrrp.exe 30 PID 2232 wrote to memory of 2836 2232 lptrrp.exe 30 PID 2232 wrote to memory of 2836 2232 lptrrp.exe 30 PID 2836 wrote to memory of 1648 2836 lxxjt.exe 31 PID 2836 wrote to memory of 1648 2836 lxxjt.exe 31 PID 2836 wrote to memory of 1648 2836 lxxjt.exe 31 PID 2836 wrote to memory of 1648 2836 lxxjt.exe 31 PID 1648 wrote to memory of 2568 1648 vnfxpvx.exe 32 PID 1648 wrote to memory of 2568 1648 vnfxpvx.exe 32 PID 1648 wrote to memory of 2568 1648 vnfxpvx.exe 32 PID 1648 wrote to memory of 2568 1648 vnfxpvx.exe 32 PID 2568 wrote to memory of 2520 2568 jdjjb.exe 33 PID 2568 wrote to memory of 2520 2568 jdjjb.exe 33 PID 2568 wrote to memory of 2520 2568 jdjjb.exe 33 PID 2568 wrote to memory of 2520 2568 jdjjb.exe 33 PID 2520 wrote to memory of 2644 2520 xdlxdd.exe 34 PID 2520 wrote to memory of 2644 2520 xdlxdd.exe 34 PID 2520 wrote to memory of 2644 2520 xdlxdd.exe 34 PID 2520 wrote to memory of 2644 2520 xdlxdd.exe 34 PID 2644 wrote to memory of 2384 2644 hvpdbdh.exe 35 PID 2644 wrote to memory of 2384 2644 hvpdbdh.exe 35 PID 2644 wrote to memory of 2384 2644 hvpdbdh.exe 35 PID 2644 wrote to memory of 2384 2644 hvpdbdh.exe 35 PID 2384 wrote to memory of 2404 2384 lddjj.exe 36 PID 2384 wrote to memory of 2404 2384 lddjj.exe 36 PID 2384 wrote to memory of 2404 2384 lddjj.exe 36 PID 2384 wrote to memory of 2404 2384 lddjj.exe 36 PID 2404 wrote to memory of 2432 2404 vbnjj.exe 37 PID 2404 wrote to memory of 2432 2404 vbnjj.exe 37 PID 2404 wrote to memory of 2432 2404 vbnjj.exe 37 PID 2404 wrote to memory of 2432 2404 vbnjj.exe 37 PID 2432 wrote to memory of 2456 2432 prdfpp.exe 38 PID 2432 wrote to memory of 2456 2432 prdfpp.exe 38 PID 2432 wrote to memory of 2456 2432 prdfpp.exe 38 PID 2432 wrote to memory of 2456 2432 prdfpp.exe 38 PID 2456 wrote to memory of 1668 2456 ptxbhv.exe 39 PID 2456 wrote to memory of 1668 2456 ptxbhv.exe 39 PID 2456 wrote to memory of 1668 2456 ptxbhv.exe 39 PID 2456 wrote to memory of 1668 2456 ptxbhv.exe 39 PID 1668 wrote to memory of 1764 1668 nvtxp.exe 40 PID 1668 wrote to memory of 1764 1668 nvtxp.exe 40 PID 1668 wrote to memory of 1764 1668 nvtxp.exe 40 PID 1668 wrote to memory of 1764 1668 nvtxp.exe 40 PID 1764 wrote to memory of 1936 1764 hpbrpb.exe 41 PID 1764 wrote to memory of 1936 1764 hpbrpb.exe 41 PID 1764 wrote to memory of 1936 1764 hpbrpb.exe 41 PID 1764 wrote to memory of 1936 1764 hpbrpb.exe 41 PID 1936 wrote to memory of 1712 1936 jddbdlf.exe 42 PID 1936 wrote to memory of 1712 1936 jddbdlf.exe 42 PID 1936 wrote to memory of 1712 1936 jddbdlf.exe 42 PID 1936 wrote to memory of 1712 1936 jddbdlf.exe 42 PID 1712 wrote to memory of 1632 1712 nlhff.exe 43 PID 1712 wrote to memory of 1632 1712 nlhff.exe 43 PID 1712 wrote to memory of 1632 1712 nlhff.exe 43 PID 1712 wrote to memory of 1632 1712 nlhff.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe"C:\Users\Admin\AppData\Local\Temp\45bbd0fcf11d155fffaecda111fb0686cbc254480c7f46ce73ad09b9992fbeb5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\xlhdhhl.exec:\xlhdhhl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\lptrrp.exec:\lptrrp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\lxxjt.exec:\lxxjt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\vnfxpvx.exec:\vnfxpvx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\jdjjb.exec:\jdjjb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\xdlxdd.exec:\xdlxdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\hvpdbdh.exec:\hvpdbdh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\lddjj.exec:\lddjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vbnjj.exec:\vbnjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\prdfpp.exec:\prdfpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\ptxbhv.exec:\ptxbhv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\nvtxp.exec:\nvtxp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\hpbrpb.exec:\hpbrpb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\jddbdlf.exec:\jddbdlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\nlhff.exec:\nlhff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\pjjrjpv.exec:\pjjrjpv.exe17⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lfjlf.exec:\lfjlf.exe18⤵
- Executes dropped EXE
PID:1696 -
\??\c:\ntdnth.exec:\ntdnth.exe19⤵
- Executes dropped EXE
PID:1380 -
\??\c:\vtrxlj.exec:\vtrxlj.exe20⤵
- Executes dropped EXE
PID:476 -
\??\c:\fhdfnd.exec:\fhdfnd.exe21⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jbbdn.exec:\jbbdn.exe22⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rfpbft.exec:\rfpbft.exe23⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ttthb.exec:\ttthb.exe24⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nnpldp.exec:\nnpldp.exe25⤵
- Executes dropped EXE
PID:1956 -
\??\c:\htdpd.exec:\htdpd.exe26⤵
- Executes dropped EXE
PID:1556 -
\??\c:\drhbl.exec:\drhbl.exe27⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xbftlx.exec:\xbftlx.exe28⤵
- Executes dropped EXE
PID:1136 -
\??\c:\pfblbn.exec:\pfblbn.exe29⤵
- Executes dropped EXE
PID:276 -
\??\c:\jtbnft.exec:\jtbnft.exe30⤵
- Executes dropped EXE
PID:708 -
\??\c:\lfnrnd.exec:\lfnrnd.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jhbxn.exec:\jhbxn.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\tvxhlj.exec:\tvxhlj.exe33⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jbpjv.exec:\jbpjv.exe34⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hpjbtp.exec:\hpjbtp.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ftlttv.exec:\ftlttv.exe36⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jxrjfrl.exec:\jxrjfrl.exe37⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nhvpxf.exec:\nhvpxf.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bxhtnhv.exec:\bxhtnhv.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fhdxlft.exec:\fhdxlft.exe40⤵
- Executes dropped EXE
PID:2760 -
\??\c:\fjhvnjl.exec:\fjhvnjl.exe41⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hhdtbft.exec:\hhdtbft.exe42⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xjbpvfj.exec:\xjbpvfj.exe43⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vdfjhx.exec:\vdfjhx.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\tbbhhl.exec:\tbbhhl.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ndhbp.exec:\ndhbp.exe46⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ndpnvhh.exec:\ndpnvhh.exe47⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lflbhdr.exec:\lflbhdr.exe48⤵
- Executes dropped EXE
PID:1148 -
\??\c:\rlbrd.exec:\rlbrd.exe49⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jtnjf.exec:\jtnjf.exe50⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jtjjbpt.exec:\jtjjbpt.exe51⤵
- Executes dropped EXE
PID:956 -
\??\c:\xrdfn.exec:\xrdfn.exe52⤵
- Executes dropped EXE
PID:640 -
\??\c:\jtrfhp.exec:\jtrfhp.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vjfdrh.exec:\vjfdrh.exe54⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lrbtptr.exec:\lrbtptr.exe55⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vvbxtbb.exec:\vvbxtbb.exe56⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hvfhpdl.exec:\hvfhpdl.exe57⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dxhvf.exec:\dxhvf.exe58⤵
- Executes dropped EXE
PID:632 -
\??\c:\xbpbvb.exec:\xbpbvb.exe59⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jrdfh.exec:\jrdfh.exe60⤵
- Executes dropped EXE
PID:580 -
\??\c:\npvbnx.exec:\npvbnx.exe61⤵
- Executes dropped EXE
PID:592 -
\??\c:\blvltj.exec:\blvltj.exe62⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tnpxvbv.exec:\tnpxvbv.exe63⤵
- Executes dropped EXE
PID:1128 -
\??\c:\hxrlnvp.exec:\hxrlnvp.exe64⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hddjrh.exec:\hddjrh.exe65⤵
- Executes dropped EXE
PID:596 -
\??\c:\plhjv.exec:\plhjv.exe66⤵PID:1224
-
\??\c:\ptfpvr.exec:\ptfpvr.exe67⤵PID:2344
-
\??\c:\dndhx.exec:\dndhx.exe68⤵PID:1564
-
\??\c:\bxhdn.exec:\bxhdn.exe69⤵PID:2744
-
\??\c:\jpbbn.exec:\jpbbn.exe70⤵PID:1484
-
\??\c:\ldtdfrj.exec:\ldtdfrj.exe71⤵PID:1468
-
\??\c:\hvhjl.exec:\hvhjl.exe72⤵PID:2992
-
\??\c:\trxvvl.exec:\trxvvl.exe73⤵PID:2968
-
\??\c:\ffhfh.exec:\ffhfh.exe74⤵PID:552
-
\??\c:\fnvjfh.exec:\fnvjfh.exe75⤵PID:2144
-
\??\c:\rrttfr.exec:\rrttfr.exe76⤵PID:2928
-
\??\c:\htdln.exec:\htdln.exe77⤵PID:2116
-
\??\c:\dvxdxv.exec:\dvxdxv.exe78⤵PID:2188
-
\??\c:\llhppnn.exec:\llhppnn.exe79⤵PID:2224
-
\??\c:\nfttx.exec:\nfttx.exe80⤵PID:2308
-
\??\c:\rftjhjh.exec:\rftjhjh.exe81⤵PID:940
-
\??\c:\lpjjjp.exec:\lpjjjp.exe82⤵PID:2832
-
\??\c:\nrnldxh.exec:\nrnldxh.exe83⤵PID:1844
-
\??\c:\btdbfv.exec:\btdbfv.exe84⤵PID:2464
-
\??\c:\dpdnp.exec:\dpdnp.exe85⤵PID:2728
-
\??\c:\nphll.exec:\nphll.exe86⤵PID:2908
-
\??\c:\jhpnbx.exec:\jhpnbx.exe87⤵PID:2608
-
\??\c:\drptffb.exec:\drptffb.exe88⤵PID:2520
-
\??\c:\prjbn.exec:\prjbn.exe89⤵PID:2636
-
\??\c:\rbfrl.exec:\rbfrl.exe90⤵PID:2652
-
\??\c:\xxtxnnn.exec:\xxtxnnn.exe91⤵PID:2564
-
\??\c:\bdvhj.exec:\bdvhj.exe92⤵PID:1732
-
\??\c:\tlbjhrf.exec:\tlbjhrf.exe93⤵PID:2388
-
\??\c:\pxfnbt.exec:\pxfnbt.exe94⤵PID:2600
-
\??\c:\fffxlr.exec:\fffxlr.exe95⤵PID:2392
-
\??\c:\ndbdd.exec:\ndbdd.exe96⤵PID:2356
-
\??\c:\dvjrt.exec:\dvjrt.exe97⤵PID:2176
-
\??\c:\txfblt.exec:\txfblt.exe98⤵PID:1764
-
\??\c:\nplhd.exec:\nplhd.exe99⤵PID:1516
-
\??\c:\njvjjl.exec:\njvjjl.exe100⤵PID:1532
-
\??\c:\xnnpff.exec:\xnnpff.exe101⤵PID:1832
-
\??\c:\rjrph.exec:\rjrph.exe102⤵PID:1488
-
\??\c:\jbfplpb.exec:\jbfplpb.exe103⤵PID:1696
-
\??\c:\tfndth.exec:\tfndth.exe104⤵PID:564
-
\??\c:\tnhptb.exec:\tnhptb.exe105⤵PID:848
-
\??\c:\lnpdb.exec:\lnpdb.exe106⤵PID:612
-
\??\c:\tblhp.exec:\tblhp.exe107⤵PID:2712
-
\??\c:\nhxtb.exec:\nhxtb.exe108⤵PID:2944
-
\??\c:\plfdhhf.exec:\plfdhhf.exe109⤵PID:2572
-
\??\c:\lnjbt.exec:\lnjbt.exe110⤵PID:2416
-
\??\c:\fjntbrr.exec:\fjntbrr.exe111⤵PID:1496
-
\??\c:\bhttdh.exec:\bhttdh.exe112⤵PID:1624
-
\??\c:\trvvf.exec:\trvvf.exe113⤵PID:1020
-
\??\c:\bnnbflp.exec:\bnnbflp.exe114⤵PID:1144
-
\??\c:\ljxxhlf.exec:\ljxxhlf.exe115⤵PID:1796
-
\??\c:\lxhrjfx.exec:\lxhrjfx.exe116⤵PID:2152
-
\??\c:\nhhnhr.exec:\nhhnhr.exe117⤵PID:2148
-
\??\c:\tfnfb.exec:\tfnfb.exe118⤵PID:2084
-
\??\c:\lrlrpnp.exec:\lrlrpnp.exe119⤵PID:2268
-
\??\c:\bfjph.exec:\bfjph.exe120⤵PID:2020
-
\??\c:\hfddtxn.exec:\hfddtxn.exe121⤵PID:1740
-
\??\c:\hlbhb.exec:\hlbhb.exe122⤵PID:2100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-