Analysis
-
max time kernel
115s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 00:04
Behavioral task
behavioral1
Sample
3316dd48ff6c6ccc6861b77098609330N.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
120 seconds
General
-
Target
3316dd48ff6c6ccc6861b77098609330N.exe
-
Size
96KB
-
MD5
3316dd48ff6c6ccc6861b77098609330
-
SHA1
6f57f6345f424002353b5cea4141dfd8d119b9d0
-
SHA256
4dd234385d5d30d352fd06d89d5efd9c62c413843a50cfa2f02b3465ccc31dee
-
SHA512
5d21754e9e59bd486886248d68999e01192d66cfc1bb35681a9f0039fd1d2dda1333f73f9f5e1899f98e1ad623ec6e3985d25547c8c74026fc7bd2394521ac4f
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzX:8cm4FmowdHoSgWrXUX
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2552-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/752-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1232-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-213-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1308-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/236-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1360-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-286-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2960-307-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2960-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-388-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/664-401-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/320-410-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2924-431-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1308-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-576-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-806-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-1161-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2172-6752-0x0000000077BA0000-0x0000000077C9A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2552 hbpdx.exe 2724 dvpnvl.exe 2784 vfdbtr.exe 2892 vpljrd.exe 2764 pbpftt.exe 2200 ldbtd.exe 2652 vxdbd.exe 2660 dhnrdd.exe 3048 fhtvxn.exe 2612 dprhpl.exe 3032 dpdppdb.exe 752 tdbnd.exe 2528 rvpprll.exe 1232 tdpdn.exe 1548 vbrxtdl.exe 756 nptlr.exe 2948 nhfjxb.exe 1244 hljfrrf.exe 1356 xxpldxd.exe 1504 prljx.exe 2984 jvvrrl.exe 2408 jjhldv.exe 2104 lptvffl.exe 2436 btfxpnd.exe 1732 jltbjf.exe 2184 tdhvpn.exe 1308 plxlntf.exe 236 ftfdfj.exe 1360 ltjjj.exe 1552 fnvphhf.exe 928 dxrhb.exe 2492 lpjdl.exe 1760 bfbtfhb.exe 948 hrjdf.exe 996 brdjl.exe 588 bvfbxv.exe 2500 drdhnf.exe 2568 pjtvdf.exe 3064 fhtljx.exe 2960 xxfdv.exe 2316 hprnb.exe 1608 vpbvdbb.exe 2888 ljdnv.exe 2760 bfxtj.exe 2892 lbvbbbt.exe 2764 tdhfrp.exe 2836 vbhjpfd.exe 2800 ttpxj.exe 2668 ftlvdrj.exe 2660 ljfbltp.exe 2116 jjrjb.exe 3060 pxhfdx.exe 2936 nntlt.exe 320 rndvhb.exe 2728 dftxjjp.exe 1648 vjrxrtx.exe 664 dvphvdb.exe 1996 trpdx.exe 972 dvxdfbd.exe 2156 ftlxvnd.exe 1988 jrhjpt.exe 2924 nhhbrx.exe 388 fdlnrdj.exe 2036 bxlpddr.exe -
resource yara_rule behavioral1/memory/2124-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000015635-5.dat upx behavioral1/memory/2552-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2124-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018f90-18.dat upx behavioral1/files/0x0007000000018f98-25.dat upx behavioral1/memory/2724-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018f9c-33.dat upx behavioral1/memory/2784-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018f9e-40.dat upx behavioral1/memory/2764-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2764-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018fa0-49.dat upx behavioral1/files/0x0009000000018fa2-58.dat upx behavioral1/memory/2200-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018fcb-67.dat upx behavioral1/memory/2660-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018fe4-73.dat upx behavioral1/memory/2660-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002b000000018f84-81.dat upx behavioral1/files/0x0005000000019078-88.dat upx behavioral1/memory/3032-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/752-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0004000000019206-96.dat upx behavioral1/memory/752-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00040000000192a8-106.dat upx behavioral1/memory/3048-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00040000000192ad-113.dat upx behavioral1/memory/1232-121-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1232-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1548-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0004000000019380-125.dat upx behavioral1/files/0x0004000000019438-133.dat upx behavioral1/files/0x0004000000019461-139.dat upx behavioral1/files/0x0004000000019485-147.dat upx behavioral1/memory/2948-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00040000000194ec-154.dat upx behavioral1/memory/1356-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019571-162.dat upx behavioral1/files/0x0005000000019575-169.dat upx behavioral1/memory/1504-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001962f-177.dat upx behavioral1/files/0x000500000001966c-183.dat upx behavioral1/files/0x00050000000196af-191.dat upx behavioral1/memory/2436-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f50-199.dat upx behavioral1/files/0x000500000001a056-206.dat upx behavioral1/memory/2184-213-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a1e8-214.dat upx behavioral1/memory/1308-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a1ee-222.dat upx behavioral1/memory/236-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a1f1-231.dat upx behavioral1/memory/1552-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1360-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a1fe-238.dat upx behavioral1/files/0x000500000001a201-247.dat upx behavioral1/memory/1552-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a237-255.dat upx behavioral1/memory/2492-262-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2492-264-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2492-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1760-270-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2552 2124 3316dd48ff6c6ccc6861b77098609330N.exe 29 PID 2124 wrote to memory of 2552 2124 3316dd48ff6c6ccc6861b77098609330N.exe 29 PID 2124 wrote to memory of 2552 2124 3316dd48ff6c6ccc6861b77098609330N.exe 29 PID 2124 wrote to memory of 2552 2124 3316dd48ff6c6ccc6861b77098609330N.exe 29 PID 2552 wrote to memory of 2724 2552 hbpdx.exe 30 PID 2552 wrote to memory of 2724 2552 hbpdx.exe 30 PID 2552 wrote to memory of 2724 2552 hbpdx.exe 30 PID 2552 wrote to memory of 2724 2552 hbpdx.exe 30 PID 2724 wrote to memory of 2784 2724 dvpnvl.exe 31 PID 2724 wrote to memory of 2784 2724 dvpnvl.exe 31 PID 2724 wrote to memory of 2784 2724 dvpnvl.exe 31 PID 2724 wrote to memory of 2784 2724 dvpnvl.exe 31 PID 2784 wrote to memory of 2892 2784 vfdbtr.exe 32 PID 2784 wrote to memory of 2892 2784 vfdbtr.exe 32 PID 2784 wrote to memory of 2892 2784 vfdbtr.exe 32 PID 2784 wrote to memory of 2892 2784 vfdbtr.exe 32 PID 2892 wrote to memory of 2764 2892 vpljrd.exe 33 PID 2892 wrote to memory of 2764 2892 vpljrd.exe 33 PID 2892 wrote to memory of 2764 2892 vpljrd.exe 33 PID 2892 wrote to memory of 2764 2892 vpljrd.exe 33 PID 2764 wrote to memory of 2200 2764 pbpftt.exe 34 PID 2764 wrote to memory of 2200 2764 pbpftt.exe 34 PID 2764 wrote to memory of 2200 2764 pbpftt.exe 34 PID 2764 wrote to memory of 2200 2764 pbpftt.exe 34 PID 2200 wrote to memory of 2652 2200 ldbtd.exe 35 PID 2200 wrote to memory of 2652 2200 ldbtd.exe 35 PID 2200 wrote to memory of 2652 2200 ldbtd.exe 35 PID 2200 wrote to memory of 2652 2200 ldbtd.exe 35 PID 2652 wrote to memory of 2660 2652 vxdbd.exe 36 PID 2652 wrote to memory of 2660 2652 vxdbd.exe 36 PID 2652 wrote to memory of 2660 2652 vxdbd.exe 36 PID 2652 wrote to memory of 2660 2652 vxdbd.exe 36 PID 2660 wrote to memory of 3048 2660 dhnrdd.exe 37 PID 2660 wrote to memory of 3048 2660 dhnrdd.exe 37 PID 2660 wrote to memory of 3048 2660 dhnrdd.exe 37 PID 2660 wrote to memory of 3048 2660 dhnrdd.exe 37 PID 3048 wrote to memory of 2612 3048 fhtvxn.exe 38 PID 3048 wrote to memory of 2612 3048 fhtvxn.exe 38 PID 3048 wrote to memory of 2612 3048 fhtvxn.exe 38 PID 3048 wrote to memory of 2612 3048 fhtvxn.exe 38 PID 2612 wrote to memory of 3032 2612 dprhpl.exe 39 PID 2612 wrote to memory of 3032 2612 dprhpl.exe 39 PID 2612 wrote to memory of 3032 2612 dprhpl.exe 39 PID 2612 wrote to memory of 3032 2612 dprhpl.exe 39 PID 3032 wrote to memory of 752 3032 dpdppdb.exe 40 PID 3032 wrote to memory of 752 3032 dpdppdb.exe 40 PID 3032 wrote to memory of 752 3032 dpdppdb.exe 40 PID 3032 wrote to memory of 752 3032 dpdppdb.exe 40 PID 752 wrote to memory of 2528 752 tdbnd.exe 41 PID 752 wrote to memory of 2528 752 tdbnd.exe 41 PID 752 wrote to memory of 2528 752 tdbnd.exe 41 PID 752 wrote to memory of 2528 752 tdbnd.exe 41 PID 2528 wrote to memory of 1232 2528 rvpprll.exe 42 PID 2528 wrote to memory of 1232 2528 rvpprll.exe 42 PID 2528 wrote to memory of 1232 2528 rvpprll.exe 42 PID 2528 wrote to memory of 1232 2528 rvpprll.exe 42 PID 1232 wrote to memory of 1548 1232 tdpdn.exe 43 PID 1232 wrote to memory of 1548 1232 tdpdn.exe 43 PID 1232 wrote to memory of 1548 1232 tdpdn.exe 43 PID 1232 wrote to memory of 1548 1232 tdpdn.exe 43 PID 1548 wrote to memory of 756 1548 vbrxtdl.exe 44 PID 1548 wrote to memory of 756 1548 vbrxtdl.exe 44 PID 1548 wrote to memory of 756 1548 vbrxtdl.exe 44 PID 1548 wrote to memory of 756 1548 vbrxtdl.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\3316dd48ff6c6ccc6861b77098609330N.exe"C:\Users\Admin\AppData\Local\Temp\3316dd48ff6c6ccc6861b77098609330N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\hbpdx.exec:\hbpdx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\dvpnvl.exec:\dvpnvl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\vfdbtr.exec:\vfdbtr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vpljrd.exec:\vpljrd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\pbpftt.exec:\pbpftt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\ldbtd.exec:\ldbtd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\vxdbd.exec:\vxdbd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\dhnrdd.exec:\dhnrdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\fhtvxn.exec:\fhtvxn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\dprhpl.exec:\dprhpl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\dpdppdb.exec:\dpdppdb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\tdbnd.exec:\tdbnd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\rvpprll.exec:\rvpprll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\tdpdn.exec:\tdpdn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\vbrxtdl.exec:\vbrxtdl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\nptlr.exec:\nptlr.exe17⤵
- Executes dropped EXE
PID:756 -
\??\c:\nhfjxb.exec:\nhfjxb.exe18⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hljfrrf.exec:\hljfrrf.exe19⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xxpldxd.exec:\xxpldxd.exe20⤵
- Executes dropped EXE
PID:1356 -
\??\c:\prljx.exec:\prljx.exe21⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jvvrrl.exec:\jvvrrl.exe22⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jjhldv.exec:\jjhldv.exe23⤵
- Executes dropped EXE
PID:2408 -
\??\c:\lptvffl.exec:\lptvffl.exe24⤵
- Executes dropped EXE
PID:2104 -
\??\c:\btfxpnd.exec:\btfxpnd.exe25⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jltbjf.exec:\jltbjf.exe26⤵
- Executes dropped EXE
PID:1732 -
\??\c:\tdhvpn.exec:\tdhvpn.exe27⤵
- Executes dropped EXE
PID:2184 -
\??\c:\plxlntf.exec:\plxlntf.exe28⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ftfdfj.exec:\ftfdfj.exe29⤵
- Executes dropped EXE
PID:236 -
\??\c:\ltjjj.exec:\ltjjj.exe30⤵
- Executes dropped EXE
PID:1360 -
\??\c:\fnvphhf.exec:\fnvphhf.exe31⤵
- Executes dropped EXE
PID:1552 -
\??\c:\dxrhb.exec:\dxrhb.exe32⤵
- Executes dropped EXE
PID:928 -
\??\c:\lpjdl.exec:\lpjdl.exe33⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bfbtfhb.exec:\bfbtfhb.exe34⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hrjdf.exec:\hrjdf.exe35⤵
- Executes dropped EXE
PID:948 -
\??\c:\brdjl.exec:\brdjl.exe36⤵
- Executes dropped EXE
PID:996 -
\??\c:\bvfbxv.exec:\bvfbxv.exe37⤵
- Executes dropped EXE
PID:588 -
\??\c:\drdhnf.exec:\drdhnf.exe38⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pjtvdf.exec:\pjtvdf.exe39⤵
- Executes dropped EXE
PID:2568 -
\??\c:\fhtljx.exec:\fhtljx.exe40⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xxfdv.exec:\xxfdv.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hprnb.exec:\hprnb.exe42⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vpbvdbb.exec:\vpbvdbb.exe43⤵
- Executes dropped EXE
PID:1608 -
\??\c:\ljdnv.exec:\ljdnv.exe44⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bfxtj.exec:\bfxtj.exe45⤵
- Executes dropped EXE
PID:2760 -
\??\c:\lbvbbbt.exec:\lbvbbbt.exe46⤵
- Executes dropped EXE
PID:2892 -
\??\c:\tdhfrp.exec:\tdhfrp.exe47⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vbhjpfd.exec:\vbhjpfd.exe48⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ttpxj.exec:\ttpxj.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ftlvdrj.exec:\ftlvdrj.exe50⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ljfbltp.exec:\ljfbltp.exe51⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jjrjb.exec:\jjrjb.exe52⤵
- Executes dropped EXE
PID:2116 -
\??\c:\pxhfdx.exec:\pxhfdx.exe53⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nntlt.exec:\nntlt.exe54⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rndvhb.exec:\rndvhb.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\dftxjjp.exec:\dftxjjp.exe56⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vjrxrtx.exec:\vjrxrtx.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dvphvdb.exec:\dvphvdb.exe58⤵
- Executes dropped EXE
PID:664 -
\??\c:\trpdx.exec:\trpdx.exe59⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dvxdfbd.exec:\dvxdfbd.exe60⤵
- Executes dropped EXE
PID:972 -
\??\c:\ftlxvnd.exec:\ftlxvnd.exe61⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jrhjpt.exec:\jrhjpt.exe62⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nhhbrx.exec:\nhhbrx.exe63⤵
- Executes dropped EXE
PID:2924 -
\??\c:\fdlnrdj.exec:\fdlnrdj.exe64⤵
- Executes dropped EXE
PID:388 -
\??\c:\bxlpddr.exec:\bxlpddr.exe65⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rjfxt.exec:\rjfxt.exe66⤵PID:1356
-
\??\c:\xlnrn.exec:\xlnrn.exe67⤵PID:2996
-
\??\c:\dlfxf.exec:\dlfxf.exe68⤵PID:2400
-
\??\c:\vfrlddx.exec:\vfrlddx.exe69⤵PID:2428
-
\??\c:\pbbldlj.exec:\pbbldlj.exe70⤵PID:572
-
\??\c:\lxfjf.exec:\lxfjf.exe71⤵PID:2260
-
\??\c:\vntff.exec:\vntff.exe72⤵PID:2312
-
\??\c:\hfvnt.exec:\hfvnt.exe73⤵PID:2252
-
\??\c:\rvtplvr.exec:\rvtplvr.exe74⤵PID:1100
-
\??\c:\dvtdxdj.exec:\dvtdxdj.exe75⤵PID:1120
-
\??\c:\xbfvd.exec:\xbfvd.exe76⤵PID:1308
-
\??\c:\jtfvfd.exec:\jtfvfd.exe77⤵PID:960
-
\??\c:\nvffpf.exec:\nvffpf.exe78⤵PID:1436
-
\??\c:\jhhdhhd.exec:\jhhdhhd.exe79⤵PID:1360
-
\??\c:\nfhnbn.exec:\nfhnbn.exe80⤵PID:876
-
\??\c:\vdvfrb.exec:\vdvfrb.exe81⤵PID:1472
-
\??\c:\lfdfj.exec:\lfdfj.exe82⤵PID:1264
-
\??\c:\tfdnlj.exec:\tfdnlj.exe83⤵PID:2476
-
\??\c:\vhbnrvx.exec:\vhbnrvx.exe84⤵PID:1932
-
\??\c:\bvjldhj.exec:\bvjldhj.exe85⤵PID:3028
-
\??\c:\dfnhd.exec:\dfnhd.exe86⤵PID:2716
-
\??\c:\jrdph.exec:\jrdph.exe87⤵PID:368
-
\??\c:\prnfn.exec:\prnfn.exe88⤵PID:2020
-
\??\c:\txxnx.exec:\txxnx.exe89⤵PID:2500
-
\??\c:\njnrrft.exec:\njnrrft.exe90⤵PID:888
-
\??\c:\jptxv.exec:\jptxv.exe91⤵PID:2904
-
\??\c:\dlxhnft.exec:\dlxhnft.exe92⤵PID:2212
-
\??\c:\rxrndjh.exec:\rxrndjh.exe93⤵PID:2316
-
\??\c:\lrnxht.exec:\lrnxht.exe94⤵PID:1604
-
\??\c:\hnjtb.exec:\hnjtb.exe95⤵PID:2788
-
\??\c:\pdntdj.exec:\pdntdj.exe96⤵PID:2740
-
\??\c:\txbxh.exec:\txbxh.exe97⤵PID:2848
-
\??\c:\xljvndh.exec:\xljvndh.exe98⤵PID:2932
-
\??\c:\hrrpjrj.exec:\hrrpjrj.exe99⤵PID:2840
-
\??\c:\pblhfxr.exec:\pblhfxr.exe100⤵PID:2772
-
\??\c:\lfldb.exec:\lfldb.exe101⤵PID:2820
-
\??\c:\nrvltln.exec:\nrvltln.exe102⤵PID:2652
-
\??\c:\brldd.exec:\brldd.exe103⤵PID:1720
-
\??\c:\vxddd.exec:\vxddd.exe104⤵PID:672
-
\??\c:\bxvhtdv.exec:\bxvhtdv.exe105⤵PID:3060
-
\??\c:\ldvrjbt.exec:\ldvrjbt.exe106⤵PID:2516
-
\??\c:\jltnpl.exec:\jltnpl.exe107⤵PID:2388
-
\??\c:\jrfvlnb.exec:\jrfvlnb.exe108⤵PID:1280
-
\??\c:\vbbpx.exec:\vbbpx.exe109⤵PID:1916
-
\??\c:\dffdtf.exec:\dffdtf.exe110⤵PID:2524
-
\??\c:\dhtvltj.exec:\dhtvltj.exe111⤵PID:2700
-
\??\c:\nvltvjh.exec:\nvltvjh.exe112⤵PID:2128
-
\??\c:\bnpnf.exec:\bnpnf.exe113⤵PID:1744
-
\??\c:\nlhjh.exec:\nlhjh.exe114⤵PID:2720
-
\??\c:\dlxrpp.exec:\dlxrpp.exe115⤵PID:812
-
\??\c:\jrxpdbj.exec:\jrxpdbj.exe116⤵PID:1244
-
\??\c:\vdvnlx.exec:\vdvnlx.exe117⤵PID:1868
-
\??\c:\drrbxxx.exec:\drrbxxx.exe118⤵PID:2272
-
\??\c:\pnppdhr.exec:\pnppdhr.exe119⤵PID:1504
-
\??\c:\bnxbh.exec:\bnxbh.exe120⤵PID:2984
-
\??\c:\tdjhtt.exec:\tdjhtt.exe121⤵PID:2108
-
\??\c:\tdbrxrb.exec:\tdbrxrb.exe122⤵PID:2148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-