Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
15/10/2023, 18:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f151c3483b9ab21cd21a27ca7c253f0_exe32_JC.exe
Resource
win7-20230831-en
5 signatures
150 seconds
General
-
Target
1f151c3483b9ab21cd21a27ca7c253f0_exe32_JC.exe
-
Size
84KB
-
MD5
1f151c3483b9ab21cd21a27ca7c253f0
-
SHA1
38561f1d542216c0f15b1e944ff51969d82649c2
-
SHA256
153c12094b98ba14e4e11441f12e7b90d589fb3a2d731a48940164ba11805074
-
SHA512
18750a012eb0bdbc5aca75bee00105f9db33088a5cec5a0a80a4a0d8f7a0603f2f844d010456e55d29a2ea02932dfaa4995517fb203bebb1732d9eb1639c5b60
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7MJeS051zTtdfU6kw:ymb3NkkiQ3mdBjFo7oefX+w
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral1/memory/2352-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/528-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1376-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-381-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-467-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-489-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2784 lnvfdhh.exe 2584 fbfjj.exe 2860 tdfhvh.exe 2772 dlnjj.exe 2652 djdhfl.exe 2496 xrftbr.exe 2944 ffflxxl.exe 268 lrfpjd.exe 528 vfbjn.exe 944 vrxbxj.exe 2936 bfhnxb.exe 2300 brdjjdh.exe 1660 xbnrbfl.exe 2248 fhrllp.exe 1524 npxjj.exe 2568 xbpdtlj.exe 1444 vjbthv.exe 1396 nfnvj.exe 2092 hrhbfph.exe 2324 jvlrbl.exe 2088 blfvnpf.exe 2056 nxvxhx.exe 2264 lhhjbl.exe 1952 npnbdpf.exe 2084 jhlpxxn.exe 728 hnxffb.exe 1056 tpfrvx.exe 688 rdhfxf.exe 3000 jdpdlfn.exe 928 lnvjvpb.exe 872 pppvnt.exe 1376 rrxrtd.exe 1588 ldvrhx.exe 2680 lvbbr.exe 2572 dbhxddl.exe 2624 dhjfvd.exe 2800 fdvrptr.exe 2648 hhhdfn.exe 2484 njrjp.exe 2524 ftnxnr.exe 2500 jfrjp.exe 2944 hfnntl.exe 1000 lxldb.exe 1420 fvhnl.exe 2940 hrtrjj.exe 2980 txttx.exe 2576 dbrlrvx.exe 2044 vvrjhr.exe 1888 ntvxv.exe 1636 xblprht.exe 1240 rbxdlrp.exe 1508 xjbrdx.exe 1568 xvlfjbf.exe 1472 xbnxff.exe 1364 vhttt.exe 2336 dhbdbf.exe 2876 rflnrf.exe 3032 lpfndx.exe 1808 frbbllh.exe 940 lvnbxph.exe 2052 ldttt.exe 1964 tprfrv.exe 1076 jdflr.exe 1952 ppfvdbv.exe -
resource yara_rule behavioral1/memory/2352-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/528-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/728-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/688-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1376-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-372-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-403-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-411-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1420-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-451-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-466-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-467-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-489-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-497-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-505-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1364-513-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2784 2352 1f151c3483b9ab21cd21a27ca7c253f0_exe32_JC.exe 28 PID 2352 wrote to memory of 2784 2352 1f151c3483b9ab21cd21a27ca7c253f0_exe32_JC.exe 28 PID 2352 wrote to memory of 2784 2352 1f151c3483b9ab21cd21a27ca7c253f0_exe32_JC.exe 28 PID 2352 wrote to memory of 2784 2352 1f151c3483b9ab21cd21a27ca7c253f0_exe32_JC.exe 28 PID 2784 wrote to memory of 2584 2784 lnvfdhh.exe 29 PID 2784 wrote to memory of 2584 2784 lnvfdhh.exe 29 PID 2784 wrote to memory of 2584 2784 lnvfdhh.exe 29 PID 2784 wrote to memory of 2584 2784 lnvfdhh.exe 29 PID 2584 wrote to memory of 2860 2584 fbfjj.exe 30 PID 2584 wrote to memory of 2860 2584 fbfjj.exe 30 PID 2584 wrote to memory of 2860 2584 fbfjj.exe 30 PID 2584 wrote to memory of 2860 2584 fbfjj.exe 30 PID 2860 wrote to memory of 2772 2860 tdfhvh.exe 31 PID 2860 wrote to memory of 2772 2860 tdfhvh.exe 31 PID 2860 wrote to memory of 2772 2860 tdfhvh.exe 31 PID 2860 wrote to memory of 2772 2860 tdfhvh.exe 31 PID 2772 wrote to memory of 2652 2772 dlnjj.exe 32 PID 2772 wrote to memory of 2652 2772 dlnjj.exe 32 PID 2772 wrote to memory of 2652 2772 dlnjj.exe 32 PID 2772 wrote to memory of 2652 2772 dlnjj.exe 32 PID 2652 wrote to memory of 2496 2652 djdhfl.exe 33 PID 2652 wrote to memory of 2496 2652 djdhfl.exe 33 PID 2652 wrote to memory of 2496 2652 djdhfl.exe 33 PID 2652 wrote to memory of 2496 2652 djdhfl.exe 33 PID 2496 wrote to memory of 2944 2496 xrftbr.exe 34 PID 2496 wrote to memory of 2944 2496 xrftbr.exe 34 PID 2496 wrote to memory of 2944 2496 xrftbr.exe 34 PID 2496 wrote to memory of 2944 2496 xrftbr.exe 34 PID 2944 wrote to memory of 268 2944 ffflxxl.exe 35 PID 2944 wrote to memory of 268 2944 ffflxxl.exe 35 PID 2944 wrote to memory of 268 2944 ffflxxl.exe 35 PID 2944 wrote to memory of 268 2944 ffflxxl.exe 35 PID 268 wrote to memory of 528 268 lrfpjd.exe 36 PID 268 wrote to memory of 528 268 lrfpjd.exe 36 PID 268 wrote to memory of 528 268 lrfpjd.exe 36 PID 268 wrote to memory of 528 268 lrfpjd.exe 36 PID 528 wrote to memory of 944 528 vfbjn.exe 37 PID 528 wrote to memory of 944 528 vfbjn.exe 37 PID 528 wrote to memory of 944 528 vfbjn.exe 37 PID 528 wrote to memory of 944 528 vfbjn.exe 37 PID 944 wrote to memory of 2936 944 vrxbxj.exe 38 PID 944 wrote to memory of 2936 944 vrxbxj.exe 38 PID 944 wrote to memory of 2936 944 vrxbxj.exe 38 PID 944 wrote to memory of 2936 944 vrxbxj.exe 38 PID 2936 wrote to memory of 2300 2936 bfhnxb.exe 39 PID 2936 wrote to memory of 2300 2936 bfhnxb.exe 39 PID 2936 wrote to memory of 2300 2936 bfhnxb.exe 39 PID 2936 wrote to memory of 2300 2936 bfhnxb.exe 39 PID 2300 wrote to memory of 1660 2300 brdjjdh.exe 40 PID 2300 wrote to memory of 1660 2300 brdjjdh.exe 40 PID 2300 wrote to memory of 1660 2300 brdjjdh.exe 40 PID 2300 wrote to memory of 1660 2300 brdjjdh.exe 40 PID 1660 wrote to memory of 2248 1660 xbnrbfl.exe 41 PID 1660 wrote to memory of 2248 1660 xbnrbfl.exe 41 PID 1660 wrote to memory of 2248 1660 xbnrbfl.exe 41 PID 1660 wrote to memory of 2248 1660 xbnrbfl.exe 41 PID 2248 wrote to memory of 1524 2248 fhrllp.exe 42 PID 2248 wrote to memory of 1524 2248 fhrllp.exe 42 PID 2248 wrote to memory of 1524 2248 fhrllp.exe 42 PID 2248 wrote to memory of 1524 2248 fhrllp.exe 42 PID 1524 wrote to memory of 2568 1524 npxjj.exe 43 PID 1524 wrote to memory of 2568 1524 npxjj.exe 43 PID 1524 wrote to memory of 2568 1524 npxjj.exe 43 PID 1524 wrote to memory of 2568 1524 npxjj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f151c3483b9ab21cd21a27ca7c253f0_exe32_JC.exe"C:\Users\Admin\AppData\Local\Temp\1f151c3483b9ab21cd21a27ca7c253f0_exe32_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\lnvfdhh.exec:\lnvfdhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\fbfjj.exec:\fbfjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\tdfhvh.exec:\tdfhvh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\dlnjj.exec:\dlnjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\djdhfl.exec:\djdhfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xrftbr.exec:\xrftbr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\ffflxxl.exec:\ffflxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\lrfpjd.exec:\lrfpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
\??\c:\vfbjn.exec:\vfbjn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\vrxbxj.exec:\vrxbxj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\bfhnxb.exec:\bfhnxb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\brdjjdh.exec:\brdjjdh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\xbnrbfl.exec:\xbnrbfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\fhrllp.exec:\fhrllp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\npxjj.exec:\npxjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\xbpdtlj.exec:\xbpdtlj.exe17⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vjbthv.exec:\vjbthv.exe18⤵
- Executes dropped EXE
PID:1444 -
\??\c:\nfnvj.exec:\nfnvj.exe19⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hrhbfph.exec:\hrhbfph.exe20⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jvlrbl.exec:\jvlrbl.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\blfvnpf.exec:\blfvnpf.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nxvxhx.exec:\nxvxhx.exe23⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lhhjbl.exec:\lhhjbl.exe24⤵
- Executes dropped EXE
PID:2264 -
\??\c:\npnbdpf.exec:\npnbdpf.exe25⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jhlpxxn.exec:\jhlpxxn.exe26⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hnxffb.exec:\hnxffb.exe27⤵
- Executes dropped EXE
PID:728 -
\??\c:\tpfrvx.exec:\tpfrvx.exe28⤵
- Executes dropped EXE
PID:1056 -
\??\c:\rdhfxf.exec:\rdhfxf.exe29⤵
- Executes dropped EXE
PID:688 -
\??\c:\jdpdlfn.exec:\jdpdlfn.exe30⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lnvjvpb.exec:\lnvjvpb.exe31⤵
- Executes dropped EXE
PID:928 -
\??\c:\pppvnt.exec:\pppvnt.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\rrxrtd.exec:\rrxrtd.exe33⤵
- Executes dropped EXE
PID:1376 -
\??\c:\ldvrhx.exec:\ldvrhx.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lvbbr.exec:\lvbbr.exe35⤵
- Executes dropped EXE
PID:2680 -
\??\c:\dbhxddl.exec:\dbhxddl.exe36⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dhjfvd.exec:\dhjfvd.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fdvrptr.exec:\fdvrptr.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hhhdfn.exec:\hhhdfn.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\njrjp.exec:\njrjp.exe40⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ftnxnr.exec:\ftnxnr.exe41⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jfrjp.exec:\jfrjp.exe42⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hfnntl.exec:\hfnntl.exe43⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lxldb.exec:\lxldb.exe44⤵
- Executes dropped EXE
PID:1000 -
\??\c:\fvhnl.exec:\fvhnl.exe45⤵
- Executes dropped EXE
PID:1420 -
\??\c:\hrtrjj.exec:\hrtrjj.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\txttx.exec:\txttx.exe47⤵
- Executes dropped EXE
PID:2980 -
\??\c:\dbrlrvx.exec:\dbrlrvx.exe48⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vvrjhr.exec:\vvrjhr.exe49⤵
- Executes dropped EXE
PID:2044 -
\??\c:\ntvxv.exec:\ntvxv.exe50⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xblprht.exec:\xblprht.exe51⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rbxdlrp.exec:\rbxdlrp.exe52⤵
- Executes dropped EXE
PID:1240 -
\??\c:\xjbrdx.exec:\xjbrdx.exe53⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xvlfjbf.exec:\xvlfjbf.exe54⤵
- Executes dropped EXE
PID:1568 -
\??\c:\xbnxff.exec:\xbnxff.exe55⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vhttt.exec:\vhttt.exe56⤵
- Executes dropped EXE
PID:1364 -
\??\c:\dhbdbf.exec:\dhbdbf.exe57⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rflnrf.exec:\rflnrf.exe58⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lpfndx.exec:\lpfndx.exe59⤵
- Executes dropped EXE
PID:3032 -
\??\c:\frbbllh.exec:\frbbllh.exe60⤵
- Executes dropped EXE
PID:1808 -
\??\c:\lvnbxph.exec:\lvnbxph.exe61⤵
- Executes dropped EXE
PID:940 -
\??\c:\ldttt.exec:\ldttt.exe62⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tprfrv.exec:\tprfrv.exe63⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jdflr.exec:\jdflr.exe64⤵
- Executes dropped EXE
PID:1076 -
\??\c:\ppfvdbv.exec:\ppfvdbv.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hjxlx.exec:\hjxlx.exe66⤵PID:2992
-
\??\c:\tnvdf.exec:\tnvdf.exe67⤵PID:364
-
\??\c:\xbhxd.exec:\xbhxd.exe68⤵PID:1576
-
\??\c:\tjpnjp.exec:\tjpnjp.exe69⤵PID:1720
-
\??\c:\nvlrj.exec:\nvlrj.exe70⤵PID:2064
-
\??\c:\ptrnd.exec:\ptrnd.exe71⤵PID:2840
-
\??\c:\dxhjhnt.exec:\dxhjhnt.exe72⤵PID:1880
-
\??\c:\bdhnj.exec:\bdhnj.exe73⤵PID:872
-
\??\c:\dxfdn.exec:\dxfdn.exe74⤵PID:1712
-
\??\c:\brnvjv.exec:\brnvjv.exe75⤵PID:3040
-
\??\c:\vbjbtbt.exec:\vbjbtbt.exe76⤵PID:2692
-
\??\c:\fvfxtdl.exec:\fvfxtdl.exe77⤵PID:2748
-
\??\c:\npbbnv.exec:\npbbnv.exe78⤵PID:2572
-
\??\c:\bljbtfb.exec:\bljbtfb.exe79⤵PID:2624
-
\??\c:\lbbtrld.exec:\lbbtrld.exe80⤵PID:2792
-
\??\c:\phthfnj.exec:\phthfnj.exe81⤵PID:2320
-
\??\c:\npdplv.exec:\npdplv.exe82⤵PID:2952
-
\??\c:\bjfbhr.exec:\bjfbhr.exe83⤵PID:2512
-
\??\c:\xxxnr.exec:\xxxnr.exe84⤵PID:2496
-
\??\c:\vthfvp.exec:\vthfvp.exe85⤵PID:268
-
\??\c:\jvntbjf.exec:\jvntbjf.exe86⤵PID:896
-
\??\c:\jdvhdh.exec:\jdvhdh.exe87⤵PID:1640
-
\??\c:\tjbrv.exec:\tjbrv.exe88⤵PID:2196
-
\??\c:\hfrpx.exec:\hfrpx.exe89⤵PID:1632
-
\??\c:\dnbjx.exec:\dnbjx.exe90⤵PID:2576
-
\??\c:\vdxbv.exec:\vdxbv.exe91⤵PID:2424
-
\??\c:\fvvjl.exec:\fvvjl.exe92⤵PID:1888
-
\??\c:\dlxrdv.exec:\dlxrdv.exe93⤵PID:1692
-
\??\c:\nvnhpj.exec:\nvnhpj.exe94⤵PID:2788
-
\??\c:\jnrhjrh.exec:\jnrhjrh.exe95⤵PID:1212
-
\??\c:\dhffj.exec:\dhffj.exe96⤵PID:2580
-
\??\c:\rvvpvvp.exec:\rvvpvvp.exe97⤵PID:1280
-
\??\c:\vxvvfd.exec:\vxvvfd.exe98⤵PID:788
-
\??\c:\fpnbt.exec:\fpnbt.exe99⤵PID:2252
-
\??\c:\blvrtnb.exec:\blvrtnb.exe100⤵PID:2864
-
\??\c:\jxtdbt.exec:\jxtdbt.exe101⤵PID:2000
-
\??\c:\bxhftbx.exec:\bxhftbx.exe102⤵PID:1868
-
\??\c:\nxlhr.exec:\nxlhr.exe103⤵PID:1084
-
\??\c:\xvjbtv.exec:\xvjbtv.exe104⤵PID:2812
-
\??\c:\xfpdj.exec:\xfpdj.exe105⤵PID:1288
-
\??\c:\dbdxvnb.exec:\dbdxvnb.exe106⤵PID:1076
-
\??\c:\bbbdjv.exec:\bbbdjv.exe107⤵PID:728
-
\??\c:\ffjjvhl.exec:\ffjjvhl.exe108⤵PID:2908
-
\??\c:\njpllv.exec:\njpllv.exe109⤵PID:2988
-
\??\c:\hpdxjhx.exec:\hpdxjhx.exe110⤵PID:1696
-
\??\c:\xdfnlb.exec:\xdfnlb.exe111⤵PID:856
-
\??\c:\hxhdbjf.exec:\hxhdbjf.exe112⤵PID:2200
-
\??\c:\jbfjlp.exec:\jbfjlp.exe113⤵PID:2244
-
\??\c:\vhxjxd.exec:\vhxjxd.exe114⤵PID:2128
-
\??\c:\rjrrhnr.exec:\rjrrhnr.exe115⤵PID:2608
-
\??\c:\bjfth.exec:\bjfth.exe116⤵PID:1908
-
\??\c:\drdtb.exec:\drdtb.exe117⤵PID:2724
-
\??\c:\vpjjnbj.exec:\vpjjnbj.exe118⤵PID:2604
-
\??\c:\ntnhhjp.exec:\ntnhhjp.exe119⤵PID:2508
-
\??\c:\dvhxbp.exec:\dvhxbp.exe120⤵PID:2572
-
\??\c:\tpfhnl.exec:\tpfhnl.exe121⤵PID:2592
-
\??\c:\pfbnhp.exec:\pfbnhp.exe122⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-