Analysis
-
max time kernel
111s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 05:22
Behavioral task
behavioral1
Sample
0018506d26a427363a0d2a2f61811fe6.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0018506d26a427363a0d2a2f61811fe6.exe
-
Size
350KB
-
MD5
0018506d26a427363a0d2a2f61811fe6
-
SHA1
8f0f61e1c82a311c370ba9a70e733509ea30644e
-
SHA256
cef36cbd67cdd02be8e1ecc9f39e87ee3435e6a9ce23697a6f9dd227178d94fc
-
SHA512
08abac8d3ca5b59d34b7841ba9459e93bdd8265ed2f1acef28f16f64739680aa370a4c7e458fc5b267016c9f2aff286a91078ca0ca1507edb64e5032f7acddf2
-
SSDEEP
6144:bcm4FmowdHoSgWrXD486jCpoAhlq1mEjBqLyOSlhNFF2e:h4wFHoSgWj168w1VjsyvhNFF2e
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/1996-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-392-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2252-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-533-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2304-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-557-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-563-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1260-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1016-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-95-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-79-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/2556-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/552-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-50-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2948-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/528-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 528 bfxnlnj.exe 2504 rnlhn.exe 1332 lvljp.exe 2948 dlpptlp.exe 2820 pbhrtt.exe 2936 dfjfjn.exe 552 lvbphb.exe 2600 xrfvvhd.exe 2556 fxvpnl.exe 2764 xfvrx.exe 2420 tjtprtj.exe 2120 hpljtdx.exe 2432 ttvrjht.exe 2832 hfxhbj.exe 2384 ffdtllr.exe 2044 hvrrlfv.exe 1636 tbvbblb.exe 2184 hxjlp.exe 2068 hfrxnv.exe 1600 vrvpdhd.exe 888 vhdjnf.exe 1548 phflbv.exe 1700 hpjlb.exe 1836 pptvjn.exe 1428 lrvvblh.exe 280 hhdrnj.exe 1708 tbbxj.exe 1140 txddbt.exe 1520 lrldv.exe 1016 pldllh.exe 1808 hfdxh.exe 1792 pnltdh.exe 936 tpddnpx.exe 1996 rvrtdf.exe 2152 nltpp.exe 2984 ndnnvr.exe 2112 jtlxxx.exe 1748 jnvbd.exe 2768 npbfj.exe 3020 bjdpvn.exe 1568 nljpb.exe 1576 jdndn.exe 988 vlxjbp.exe 1736 bhrrb.exe 2748 trthb.exe 2872 lfnxhrr.exe 2100 jrtbblf.exe 1056 jjvttp.exe 836 vpfnlpv.exe 2640 nbrvrrr.exe 2556 hxbtl.exe 2756 tldxpln.exe 2420 vnxxdx.exe 2680 fltvld.exe 2492 jfbnd.exe 2840 jrvxnj.exe 1108 dhpdpbn.exe 2252 thxvhl.exe 1692 tljljb.exe 1716 pvxtj.exe 2812 bvnrxvt.exe 928 btnljj.exe 624 ftltf.exe 1648 nrlvpn.exe -
resource yara_rule behavioral1/memory/1996-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1792-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b4a-258.dat upx behavioral1/memory/1568-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2100-344-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-392-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2252-404-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1692-410-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2252-398-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2088-441-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-453-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3024-459-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-465-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2304-545-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2080-557-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1872-605-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1492-622-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-584-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2952-563-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2080-551-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2304-544-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/1260-467-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-376-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-365-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1576-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b42-251.dat upx behavioral1/memory/1016-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b37-243.dat upx behavioral1/files/0x0006000000018b33-236.dat upx behavioral1/files/0x0006000000018b15-229.dat upx behavioral1/files/0x0006000000018ae8-221.dat upx behavioral1/files/0x0006000000018ae2-213.dat upx behavioral1/memory/280-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1836-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186a0-205.dat upx behavioral1/memory/1836-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018698-197.dat upx behavioral1/files/0x000500000001868c-189.dat upx behavioral1/files/0x000600000001704f-174.dat upx behavioral1/files/0x0006000000017090-182.dat upx behavioral1/memory/1548-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1600-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016e56-166.dat upx behavioral1/files/0x0006000000016d89-159.dat upx behavioral1/files/0x0006000000016d84-152.dat upx behavioral1/memory/2184-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d55-144.dat upx behavioral1/files/0x0006000000016d4f-137.dat upx behavioral1/files/0x0006000000016d4a-130.dat upx behavioral1/memory/2832-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000014b6d-122.dat upx behavioral1/memory/2432-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d41-114.dat upx behavioral1/memory/2120-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d36-106.dat upx behavioral1/memory/2120-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d24-97.dat upx behavioral1/memory/2764-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d11-88.dat upx behavioral1/memory/2556-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d01-78.dat upx behavioral1/memory/2600-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cf0-70.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 528 3048 0018506d26a427363a0d2a2f61811fe6.exe 28 PID 3048 wrote to memory of 528 3048 0018506d26a427363a0d2a2f61811fe6.exe 28 PID 3048 wrote to memory of 528 3048 0018506d26a427363a0d2a2f61811fe6.exe 28 PID 3048 wrote to memory of 528 3048 0018506d26a427363a0d2a2f61811fe6.exe 28 PID 528 wrote to memory of 2504 528 bfxnlnj.exe 29 PID 528 wrote to memory of 2504 528 bfxnlnj.exe 29 PID 528 wrote to memory of 2504 528 bfxnlnj.exe 29 PID 528 wrote to memory of 2504 528 bfxnlnj.exe 29 PID 2504 wrote to memory of 1332 2504 rnlhn.exe 30 PID 2504 wrote to memory of 1332 2504 rnlhn.exe 30 PID 2504 wrote to memory of 1332 2504 rnlhn.exe 30 PID 2504 wrote to memory of 1332 2504 rnlhn.exe 30 PID 1332 wrote to memory of 2948 1332 lvljp.exe 31 PID 1332 wrote to memory of 2948 1332 lvljp.exe 31 PID 1332 wrote to memory of 2948 1332 lvljp.exe 31 PID 1332 wrote to memory of 2948 1332 lvljp.exe 31 PID 2948 wrote to memory of 2820 2948 dlpptlp.exe 32 PID 2948 wrote to memory of 2820 2948 dlpptlp.exe 32 PID 2948 wrote to memory of 2820 2948 dlpptlp.exe 32 PID 2948 wrote to memory of 2820 2948 dlpptlp.exe 32 PID 2820 wrote to memory of 2936 2820 pbhrtt.exe 33 PID 2820 wrote to memory of 2936 2820 pbhrtt.exe 33 PID 2820 wrote to memory of 2936 2820 pbhrtt.exe 33 PID 2820 wrote to memory of 2936 2820 pbhrtt.exe 33 PID 2936 wrote to memory of 552 2936 dfjfjn.exe 34 PID 2936 wrote to memory of 552 2936 dfjfjn.exe 34 PID 2936 wrote to memory of 552 2936 dfjfjn.exe 34 PID 2936 wrote to memory of 552 2936 dfjfjn.exe 34 PID 552 wrote to memory of 2600 552 lvbphb.exe 35 PID 552 wrote to memory of 2600 552 lvbphb.exe 35 PID 552 wrote to memory of 2600 552 lvbphb.exe 35 PID 552 wrote to memory of 2600 552 lvbphb.exe 35 PID 2600 wrote to memory of 2556 2600 xrfvvhd.exe 36 PID 2600 wrote to memory of 2556 2600 xrfvvhd.exe 36 PID 2600 wrote to memory of 2556 2600 xrfvvhd.exe 36 PID 2600 wrote to memory of 2556 2600 xrfvvhd.exe 36 PID 2556 wrote to memory of 2764 2556 fxvpnl.exe 37 PID 2556 wrote to memory of 2764 2556 fxvpnl.exe 37 PID 2556 wrote to memory of 2764 2556 fxvpnl.exe 37 PID 2556 wrote to memory of 2764 2556 fxvpnl.exe 37 PID 2764 wrote to memory of 2420 2764 xfvrx.exe 38 PID 2764 wrote to memory of 2420 2764 xfvrx.exe 38 PID 2764 wrote to memory of 2420 2764 xfvrx.exe 38 PID 2764 wrote to memory of 2420 2764 xfvrx.exe 38 PID 2420 wrote to memory of 2120 2420 tjtprtj.exe 39 PID 2420 wrote to memory of 2120 2420 tjtprtj.exe 39 PID 2420 wrote to memory of 2120 2420 tjtprtj.exe 39 PID 2420 wrote to memory of 2120 2420 tjtprtj.exe 39 PID 2120 wrote to memory of 2432 2120 hpljtdx.exe 40 PID 2120 wrote to memory of 2432 2120 hpljtdx.exe 40 PID 2120 wrote to memory of 2432 2120 hpljtdx.exe 40 PID 2120 wrote to memory of 2432 2120 hpljtdx.exe 40 PID 2432 wrote to memory of 2832 2432 ttvrjht.exe 41 PID 2432 wrote to memory of 2832 2432 ttvrjht.exe 41 PID 2432 wrote to memory of 2832 2432 ttvrjht.exe 41 PID 2432 wrote to memory of 2832 2432 ttvrjht.exe 41 PID 2832 wrote to memory of 2384 2832 hfxhbj.exe 42 PID 2832 wrote to memory of 2384 2832 hfxhbj.exe 42 PID 2832 wrote to memory of 2384 2832 hfxhbj.exe 42 PID 2832 wrote to memory of 2384 2832 hfxhbj.exe 42 PID 2384 wrote to memory of 2044 2384 ffdtllr.exe 236 PID 2384 wrote to memory of 2044 2384 ffdtllr.exe 236 PID 2384 wrote to memory of 2044 2384 ffdtllr.exe 236 PID 2384 wrote to memory of 2044 2384 ffdtllr.exe 236
Processes
-
C:\Users\Admin\AppData\Local\Temp\2826952929\zmstage.exeC:\Users\Admin\AppData\Local\Temp\2826952929\zmstage.exe1⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\0018506d26a427363a0d2a2f61811fe6.exe"C:\Users\Admin\AppData\Local\Temp\0018506d26a427363a0d2a2f61811fe6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\bfxnlnj.exec:\bfxnlnj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\rnlhn.exec:\rnlhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lvljp.exec:\lvljp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\dlpptlp.exec:\dlpptlp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\pbhrtt.exec:\pbhrtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dfjfjn.exec:\dfjfjn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lvbphb.exec:\lvbphb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\xrfvvhd.exec:\xrfvvhd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\fxvpnl.exec:\fxvpnl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\xfvrx.exec:\xfvrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\tjtprtj.exec:\tjtprtj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\hpljtdx.exec:\hpljtdx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\ttvrjht.exec:\ttvrjht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\hfxhbj.exec:\hfxhbj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\ffdtllr.exec:\ffdtllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\hvrrlfv.exec:\hvrrlfv.exe17⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tbvbblb.exec:\tbvbblb.exe18⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hxjlp.exec:\hxjlp.exe19⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hfrxnv.exec:\hfrxnv.exe20⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vrvpdhd.exec:\vrvpdhd.exe21⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vhdjnf.exec:\vhdjnf.exe22⤵
- Executes dropped EXE
PID:888 -
\??\c:\phflbv.exec:\phflbv.exe23⤵
- Executes dropped EXE
PID:1548 -
\??\c:\hpjlb.exec:\hpjlb.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pptvjn.exec:\pptvjn.exe25⤵
- Executes dropped EXE
PID:1836 -
\??\c:\lrvvblh.exec:\lrvvblh.exe26⤵
- Executes dropped EXE
PID:1428 -
\??\c:\hhdrnj.exec:\hhdrnj.exe27⤵
- Executes dropped EXE
PID:280 -
\??\c:\tbbxj.exec:\tbbxj.exe28⤵
- Executes dropped EXE
PID:1708 -
\??\c:\txddbt.exec:\txddbt.exe29⤵
- Executes dropped EXE
PID:1140 -
\??\c:\lrldv.exec:\lrldv.exe30⤵
- Executes dropped EXE
PID:1520 -
\??\c:\pldllh.exec:\pldllh.exe31⤵
- Executes dropped EXE
PID:1016 -
\??\c:\hfdxh.exec:\hfdxh.exe32⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pnltdh.exec:\pnltdh.exe33⤵
- Executes dropped EXE
PID:1792 -
\??\c:\tpddnpx.exec:\tpddnpx.exe34⤵
- Executes dropped EXE
PID:936 -
\??\c:\rvrtdf.exec:\rvrtdf.exe35⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nltpp.exec:\nltpp.exe36⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ndnnvr.exec:\ndnnvr.exe37⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jtlxxx.exec:\jtlxxx.exe38⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jnvbd.exec:\jnvbd.exe39⤵
- Executes dropped EXE
PID:1748 -
\??\c:\npbfj.exec:\npbfj.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bjdpvn.exec:\bjdpvn.exe41⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nljpb.exec:\nljpb.exe42⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jdndn.exec:\jdndn.exe43⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vlxjbp.exec:\vlxjbp.exe44⤵
- Executes dropped EXE
PID:988 -
\??\c:\bhrrb.exec:\bhrrb.exe45⤵
- Executes dropped EXE
PID:1736 -
\??\c:\trthb.exec:\trthb.exe46⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lfnxhrr.exec:\lfnxhrr.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jrtbblf.exec:\jrtbblf.exe48⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jjvttp.exec:\jjvttp.exe49⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vpfnlpv.exec:\vpfnlpv.exe50⤵
- Executes dropped EXE
PID:836 -
\??\c:\nbrvrrr.exec:\nbrvrrr.exe51⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hxbtl.exec:\hxbtl.exe52⤵
- Executes dropped EXE
PID:2556 -
\??\c:\tldxpln.exec:\tldxpln.exe53⤵
- Executes dropped EXE
PID:2756 -
\??\c:\vnxxdx.exec:\vnxxdx.exe54⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fltvld.exec:\fltvld.exe55⤵
- Executes dropped EXE
PID:2680 -
\??\c:\jfbnd.exec:\jfbnd.exe56⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jrvxnj.exec:\jrvxnj.exe57⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dhpdpbn.exec:\dhpdpbn.exe58⤵
- Executes dropped EXE
PID:1108 -
\??\c:\thxvhl.exec:\thxvhl.exe59⤵
- Executes dropped EXE
PID:2252 -
\??\c:\tljljb.exec:\tljljb.exe60⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pvxtj.exec:\pvxtj.exe61⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bvnrxvt.exec:\bvnrxvt.exe62⤵
- Executes dropped EXE
PID:2812 -
\??\c:\btnljj.exec:\btnljj.exe63⤵
- Executes dropped EXE
PID:928 -
\??\c:\ftltf.exec:\ftltf.exe64⤵
- Executes dropped EXE
PID:624 -
\??\c:\nrlvpn.exec:\nrlvpn.exe65⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ptthxv.exec:\ptthxv.exe66⤵PID:2356
-
\??\c:\fnjtl.exec:\fnjtl.exe67⤵PID:2088
-
\??\c:\jxlrhbr.exec:\jxlrhbr.exe68⤵PID:2824
-
\??\c:\ddnhj.exec:\ddnhj.exe69⤵PID:3024
-
\??\c:\lhbdpr.exec:\lhbdpr.exe70⤵PID:2488
-
\??\c:\lbpbbbd.exec:\lbpbbbd.exe71⤵PID:1260
-
\??\c:\hpdvnx.exec:\hpdvnx.exe72⤵PID:1352
-
\??\c:\tbtvh.exec:\tbtvh.exe73⤵PID:2520
-
\??\c:\dfdpfn.exec:\dfdpfn.exe74⤵PID:1804
-
\??\c:\vvbvx.exec:\vvbvx.exe75⤵PID:1672
-
\??\c:\rpfxdl.exec:\rpfxdl.exe76⤵PID:2360
-
\??\c:\jlvddpd.exec:\jlvddpd.exe77⤵PID:2020
-
\??\c:\pvvnj.exec:\pvvnj.exe78⤵PID:2536
-
\??\c:\nfxfbp.exec:\nfxfbp.exe79⤵PID:1516
-
\??\c:\rjtdx.exec:\rjtdx.exe80⤵PID:968
-
\??\c:\jltvbhr.exec:\jltvbhr.exe81⤵PID:2348
-
\??\c:\nlbxhbx.exec:\nlbxhbx.exe82⤵PID:1016
-
\??\c:\tdhxv.exec:\tdhxv.exe83⤵PID:320
-
\??\c:\rtbvfn.exec:\rtbvfn.exe84⤵PID:2712
-
\??\c:\rftxlf.exec:\rftxlf.exe85⤵PID:2304
-
\??\c:\hjxhvv.exec:\hjxhvv.exe86⤵PID:1768
-
\??\c:\tffhddl.exec:\tffhddl.exe87⤵PID:2080
-
\??\c:\lfpxpv.exec:\lfpxpv.exe88⤵PID:2952
-
\??\c:\rdtvlx.exec:\rdtvlx.exe89⤵PID:1288
-
\??\c:\lnfhrl.exec:\lnfhrl.exe90⤵PID:668
-
\??\c:\tbdjl.exec:\tbdjl.exe91⤵PID:324
-
\??\c:\xrdfd.exec:\xrdfd.exe92⤵PID:832
-
\??\c:\bdrphh.exec:\bdrphh.exe93⤵PID:2504
-
\??\c:\tpnfv.exec:\tpnfv.exe94⤵PID:2860
-
\??\c:\tdnnnxt.exec:\tdnnnxt.exe95⤵PID:2804
-
\??\c:\vtltllb.exec:\vtltllb.exe96⤵PID:868
-
\??\c:\xjjhtd.exec:\xjjhtd.exe97⤵PID:1872
-
\??\c:\hjlxp.exec:\hjlxp.exe98⤵PID:552
-
\??\c:\xvnht.exec:\xvnht.exe99⤵PID:2632
-
\??\c:\jbbjld.exec:\jbbjld.exe100⤵PID:1492
-
\??\c:\lhlht.exec:\lhlht.exe101⤵PID:2904
-
\??\c:\jrtpf.exec:\jrtpf.exe102⤵PID:2848
-
\??\c:\nbbvx.exec:\nbbvx.exe103⤵PID:2280
-
\??\c:\nnnptdj.exec:\nnnptdj.exe104⤵PID:1988
-
\??\c:\fxvrp.exec:\fxvrp.exe105⤵PID:2832
-
\??\c:\drfrxx.exec:\drfrxx.exe106⤵PID:2208
-
\??\c:\rpdbvxh.exec:\rpdbvxh.exe107⤵PID:2192
-
\??\c:\tppvdf.exec:\tppvdf.exe108⤵PID:2196
-
\??\c:\xjdlnnr.exec:\xjdlnnr.exe109⤵PID:2316
-
\??\c:\ldjrfp.exec:\ldjrfp.exe110⤵PID:2336
-
\??\c:\fhbhntt.exec:\fhbhntt.exe111⤵PID:1976
-
\??\c:\vhlpbxp.exec:\vhlpbxp.exe112⤵PID:2896
-
\??\c:\fvlppv.exec:\fvlppv.exe113⤵PID:2796
-
\??\c:\trdvvjp.exec:\trdvvjp.exe114⤵PID:2148
-
\??\c:\xtvbtvj.exec:\xtvbtvj.exe115⤵PID:1464
-
\??\c:\jhfnxh.exec:\jhfnxh.exe116⤵PID:1628
-
\??\c:\dllpxnl.exec:\dllpxnl.exe117⤵PID:1488
-
\??\c:\ddjhrln.exec:\ddjhrln.exe118⤵PID:2940
-
\??\c:\vrrhrd.exec:\vrrhrd.exe119⤵PID:2908
-
\??\c:\vbdtpfv.exec:\vbdtpfv.exe120⤵PID:2992
-
\??\c:\brtpplv.exec:\brtpplv.exe121⤵PID:2644
-
\??\c:\pdfdbdl.exec:\pdfdbdl.exe122⤵PID:2016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-