Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ee111342e2fb553aaf13f4951e55100957189c12fd74528ba0d68426b9021dd.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
3ee111342e2fb553aaf13f4951e55100957189c12fd74528ba0d68426b9021dd.exe
-
Size
54KB
-
MD5
9b0f28af14e89f1fdfd7002c175f185c
-
SHA1
713dfbfc00953464f34337976e79c899a591092f
-
SHA256
3ee111342e2fb553aaf13f4951e55100957189c12fd74528ba0d68426b9021dd
-
SHA512
8295cae3911d7a702814421fd7ec12c089028ab212a5068a9ec4f0f842776559349d9e2ce6a1f738c4081829baf016d1650e3c18a9f98e6d044a81805445c117
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFPl:ymb3NkkiQ3mdBjFIFPl
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1224-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 31 IoCs
resource yara_rule behavioral1/memory/1224-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1224-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1900-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2372-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2372-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2820-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2088-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2088-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1452-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2360-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1760-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/944-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2272-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2348-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/840-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1704-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1084-225-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2232-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2992-243-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1772-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3060-289-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2736 tdxntdh.exe 2504 fnjptp.exe 2532 rfllnt.exe 1900 bvhftx.exe 2696 pftbfl.exe 2372 pplhbxr.exe 2820 bdfbvhn.exe 2088 lvdxbl.exe 2160 fhhlh.exe 1452 tppvnpx.exe 2360 vlnnfn.exe 1760 xnxhdp.exe 944 dbpjnrn.exe 1824 jhtbjp.exe 2348 lftxfpb.exe 2272 xhndr.exe 840 ftrtpb.exe 1704 nxbtrd.exe 2660 xlbpfpl.exe 1932 dfrtbnd.exe 596 htfnpn.exe 1084 nbtntx.exe 2232 drptxn.exe 2992 lxtfp.exe 1772 bphvl.exe 1688 jrhnvt.exe 1028 xdrhfh.exe 912 jbnbdvv.exe 3060 xpjbrl.exe 2120 vntbvn.exe 3028 nptpxtt.exe 2240 jdlplt.exe 2104 bvbdr.exe 2988 vrvrh.exe 2124 fbhjd.exe 2484 txxdvl.exe 1516 ntvtx.exe 2596 fhplrp.exe 2580 fljfp.exe 2692 dbrtnrf.exe 2572 drdxxvb.exe 2540 ltdxpfr.exe 2388 brldv.exe 2452 vbhdhhj.exe 1908 hjxbbb.exe 1324 llrnfpj.exe 1664 rxrvnl.exe 2320 xxrdjlt.exe 1400 tvdhdv.exe 856 rhjhvlp.exe 1648 jpljv.exe 2672 pphjtf.exe 2140 pbxddhl.exe 1872 bflvtxl.exe 1636 jbrfjf.exe 2348 rlflrhp.exe 1388 vbjtnln.exe 2476 bxpxxxh.exe 1996 hxlvj.exe 2624 tphjr.exe 2472 pfbbfj.exe 2236 vjtdrvb.exe 2772 fxblxj.exe 2732 dptfvv.exe -
resource yara_rule behavioral1/memory/1224-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1224 wrote to memory of 2736 1224 3ee111342e2fb553aaf13f4951e55100957189c12fd74528ba0d68426b9021dd.exe 28 PID 1224 wrote to memory of 2736 1224 3ee111342e2fb553aaf13f4951e55100957189c12fd74528ba0d68426b9021dd.exe 28 PID 1224 wrote to memory of 2736 1224 3ee111342e2fb553aaf13f4951e55100957189c12fd74528ba0d68426b9021dd.exe 28 PID 1224 wrote to memory of 2736 1224 3ee111342e2fb553aaf13f4951e55100957189c12fd74528ba0d68426b9021dd.exe 28 PID 2736 wrote to memory of 2504 2736 tdxntdh.exe 29 PID 2736 wrote to memory of 2504 2736 tdxntdh.exe 29 PID 2736 wrote to memory of 2504 2736 tdxntdh.exe 29 PID 2736 wrote to memory of 2504 2736 tdxntdh.exe 29 PID 2504 wrote to memory of 2532 2504 fnjptp.exe 30 PID 2504 wrote to memory of 2532 2504 fnjptp.exe 30 PID 2504 wrote to memory of 2532 2504 fnjptp.exe 30 PID 2504 wrote to memory of 2532 2504 fnjptp.exe 30 PID 2532 wrote to memory of 1900 2532 rfllnt.exe 31 PID 2532 wrote to memory of 1900 2532 rfllnt.exe 31 PID 2532 wrote to memory of 1900 2532 rfllnt.exe 31 PID 2532 wrote to memory of 1900 2532 rfllnt.exe 31 PID 1900 wrote to memory of 2696 1900 bvhftx.exe 32 PID 1900 wrote to memory of 2696 1900 bvhftx.exe 32 PID 1900 wrote to memory of 2696 1900 bvhftx.exe 32 PID 1900 wrote to memory of 2696 1900 bvhftx.exe 32 PID 2696 wrote to memory of 2372 2696 pftbfl.exe 33 PID 2696 wrote to memory of 2372 2696 pftbfl.exe 33 PID 2696 wrote to memory of 2372 2696 pftbfl.exe 33 PID 2696 wrote to memory of 2372 2696 pftbfl.exe 33 PID 2372 wrote to memory of 2820 2372 pplhbxr.exe 34 PID 2372 wrote to memory of 2820 2372 pplhbxr.exe 34 PID 2372 wrote to memory of 2820 2372 pplhbxr.exe 34 PID 2372 wrote to memory of 2820 2372 pplhbxr.exe 34 PID 2820 wrote to memory of 2088 2820 bdfbvhn.exe 35 PID 2820 wrote to memory of 2088 2820 bdfbvhn.exe 35 PID 2820 wrote to memory of 2088 2820 bdfbvhn.exe 35 PID 2820 wrote to memory of 2088 2820 bdfbvhn.exe 35 PID 2088 wrote to memory of 2160 2088 lvdxbl.exe 36 PID 2088 wrote to memory of 2160 2088 lvdxbl.exe 36 PID 2088 wrote to memory of 2160 2088 lvdxbl.exe 36 PID 2088 wrote to memory of 2160 2088 lvdxbl.exe 36 PID 2160 wrote to memory of 1452 2160 fhhlh.exe 37 PID 2160 wrote to memory of 1452 2160 fhhlh.exe 37 PID 2160 wrote to memory of 1452 2160 fhhlh.exe 37 PID 2160 wrote to memory of 1452 2160 fhhlh.exe 37 PID 1452 wrote to memory of 2360 1452 tppvnpx.exe 38 PID 1452 wrote to memory of 2360 1452 tppvnpx.exe 38 PID 1452 wrote to memory of 2360 1452 tppvnpx.exe 38 PID 1452 wrote to memory of 2360 1452 tppvnpx.exe 38 PID 2360 wrote to memory of 1760 2360 vlnnfn.exe 39 PID 2360 wrote to memory of 1760 2360 vlnnfn.exe 39 PID 2360 wrote to memory of 1760 2360 vlnnfn.exe 39 PID 2360 wrote to memory of 1760 2360 vlnnfn.exe 39 PID 1760 wrote to memory of 944 1760 xnxhdp.exe 40 PID 1760 wrote to memory of 944 1760 xnxhdp.exe 40 PID 1760 wrote to memory of 944 1760 xnxhdp.exe 40 PID 1760 wrote to memory of 944 1760 xnxhdp.exe 40 PID 944 wrote to memory of 1824 944 dbpjnrn.exe 41 PID 944 wrote to memory of 1824 944 dbpjnrn.exe 41 PID 944 wrote to memory of 1824 944 dbpjnrn.exe 41 PID 944 wrote to memory of 1824 944 dbpjnrn.exe 41 PID 1824 wrote to memory of 2348 1824 jhtbjp.exe 42 PID 1824 wrote to memory of 2348 1824 jhtbjp.exe 42 PID 1824 wrote to memory of 2348 1824 jhtbjp.exe 42 PID 1824 wrote to memory of 2348 1824 jhtbjp.exe 42 PID 2348 wrote to memory of 2272 2348 lftxfpb.exe 43 PID 2348 wrote to memory of 2272 2348 lftxfpb.exe 43 PID 2348 wrote to memory of 2272 2348 lftxfpb.exe 43 PID 2348 wrote to memory of 2272 2348 lftxfpb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ee111342e2fb553aaf13f4951e55100957189c12fd74528ba0d68426b9021dd.exe"C:\Users\Admin\AppData\Local\Temp\3ee111342e2fb553aaf13f4951e55100957189c12fd74528ba0d68426b9021dd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\tdxntdh.exec:\tdxntdh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\fnjptp.exec:\fnjptp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\rfllnt.exec:\rfllnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\bvhftx.exec:\bvhftx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\pftbfl.exec:\pftbfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pplhbxr.exec:\pplhbxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\bdfbvhn.exec:\bdfbvhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\lvdxbl.exec:\lvdxbl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\fhhlh.exec:\fhhlh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\tppvnpx.exec:\tppvnpx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\vlnnfn.exec:\vlnnfn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\xnxhdp.exec:\xnxhdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\dbpjnrn.exec:\dbpjnrn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\jhtbjp.exec:\jhtbjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\lftxfpb.exec:\lftxfpb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\xhndr.exec:\xhndr.exe17⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ftrtpb.exec:\ftrtpb.exe18⤵
- Executes dropped EXE
PID:840 -
\??\c:\nxbtrd.exec:\nxbtrd.exe19⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xlbpfpl.exec:\xlbpfpl.exe20⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dfrtbnd.exec:\dfrtbnd.exe21⤵
- Executes dropped EXE
PID:1932 -
\??\c:\htfnpn.exec:\htfnpn.exe22⤵
- Executes dropped EXE
PID:596 -
\??\c:\nbtntx.exec:\nbtntx.exe23⤵
- Executes dropped EXE
PID:1084 -
\??\c:\drptxn.exec:\drptxn.exe24⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lxtfp.exec:\lxtfp.exe25⤵
- Executes dropped EXE
PID:2992 -
\??\c:\bphvl.exec:\bphvl.exe26⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jrhnvt.exec:\jrhnvt.exe27⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xdrhfh.exec:\xdrhfh.exe28⤵
- Executes dropped EXE
PID:1028 -
\??\c:\jbnbdvv.exec:\jbnbdvv.exe29⤵
- Executes dropped EXE
PID:912 -
\??\c:\xpjbrl.exec:\xpjbrl.exe30⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vntbvn.exec:\vntbvn.exe31⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nptpxtt.exec:\nptpxtt.exe32⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jdlplt.exec:\jdlplt.exe33⤵
- Executes dropped EXE
PID:2240 -
\??\c:\bvbdr.exec:\bvbdr.exe34⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vrvrh.exec:\vrvrh.exe35⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fbhjd.exec:\fbhjd.exe36⤵
- Executes dropped EXE
PID:2124 -
\??\c:\txxdvl.exec:\txxdvl.exe37⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ntvtx.exec:\ntvtx.exe38⤵
- Executes dropped EXE
PID:1516 -
\??\c:\fhplrp.exec:\fhplrp.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\fljfp.exec:\fljfp.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dbrtnrf.exec:\dbrtnrf.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\drdxxvb.exec:\drdxxvb.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ltdxpfr.exec:\ltdxpfr.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\brldv.exec:\brldv.exe44⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vbhdhhj.exec:\vbhdhhj.exe45⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hjxbbb.exec:\hjxbbb.exe46⤵
- Executes dropped EXE
PID:1908 -
\??\c:\llrnfpj.exec:\llrnfpj.exe47⤵
- Executes dropped EXE
PID:1324 -
\??\c:\rxrvnl.exec:\rxrvnl.exe48⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xxrdjlt.exec:\xxrdjlt.exe49⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tvdhdv.exec:\tvdhdv.exe50⤵
- Executes dropped EXE
PID:1400 -
\??\c:\rhjhvlp.exec:\rhjhvlp.exe51⤵
- Executes dropped EXE
PID:856 -
\??\c:\jpljv.exec:\jpljv.exe52⤵
- Executes dropped EXE
PID:1648 -
\??\c:\pphjtf.exec:\pphjtf.exe53⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pbxddhl.exec:\pbxddhl.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\bflvtxl.exec:\bflvtxl.exe55⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jbrfjf.exec:\jbrfjf.exe56⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rlflrhp.exec:\rlflrhp.exe57⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vbjtnln.exec:\vbjtnln.exe58⤵
- Executes dropped EXE
PID:1388 -
\??\c:\bxpxxxh.exec:\bxpxxxh.exe59⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hxlvj.exec:\hxlvj.exe60⤵
- Executes dropped EXE
PID:1996 -
\??\c:\tphjr.exec:\tphjr.exe61⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pfbbfj.exec:\pfbbfj.exe62⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vjtdrvb.exec:\vjtdrvb.exe63⤵
- Executes dropped EXE
PID:2236 -
\??\c:\fxblxj.exec:\fxblxj.exe64⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dptfvv.exec:\dptfvv.exe65⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vxvtthj.exec:\vxvtthj.exe66⤵PID:1968
-
\??\c:\tjndfl.exec:\tjndfl.exe67⤵PID:848
-
\??\c:\vprhfr.exec:\vprhfr.exe68⤵PID:1460
-
\??\c:\lrvlxr.exec:\lrvlxr.exe69⤵PID:2768
-
\??\c:\xljvvhd.exec:\xljvvhd.exe70⤵PID:528
-
\??\c:\lrhtfh.exec:\lrhtfh.exe71⤵PID:1032
-
\??\c:\rjpjpvp.exec:\rjpjpvp.exe72⤵PID:1976
-
\??\c:\bxxbj.exec:\bxxbj.exe73⤵PID:2108
-
\??\c:\pvlfr.exec:\pvlfr.exe74⤵PID:1864
-
\??\c:\txpfjd.exec:\txpfjd.exe75⤵PID:2996
-
\??\c:\rftvpvd.exec:\rftvpvd.exe76⤵PID:3000
-
\??\c:\fdxfljf.exec:\fdxfljf.exe77⤵PID:2012
-
\??\c:\rvhpdh.exec:\rvhpdh.exe78⤵PID:1692
-
\??\c:\xnhfhnx.exec:\xnhfhnx.exe79⤵PID:2468
-
\??\c:\bxbdbj.exec:\bxbdbj.exe80⤵PID:2984
-
\??\c:\pdrhh.exec:\pdrhh.exe81⤵PID:2628
-
\??\c:\vpfrdnx.exec:\vpfrdnx.exe82⤵PID:1596
-
\??\c:\prplj.exec:\prplj.exe83⤵PID:2764
-
\??\c:\vvljvpj.exec:\vvljvpj.exe84⤵PID:2536
-
\??\c:\dbbhpf.exec:\dbbhpf.exe85⤵PID:2408
-
\??\c:\jbddbxf.exec:\jbddbxf.exe86⤵PID:2712
-
\??\c:\pdpflp.exec:\pdpflp.exe87⤵PID:2384
-
\??\c:\pdhhndj.exec:\pdhhndj.exe88⤵PID:2376
-
\??\c:\xhbtr.exec:\xhbtr.exe89⤵PID:2100
-
\??\c:\nrpvf.exec:\nrpvf.exe90⤵PID:1572
-
\??\c:\dlplb.exec:\dlplb.exe91⤵PID:2172
-
\??\c:\jtfvrh.exec:\jtfvrh.exe92⤵PID:764
-
\??\c:\dxjhrfp.exec:\dxjhrfp.exe93⤵PID:1436
-
\??\c:\tdlxd.exec:\tdlxd.exe94⤵PID:2656
-
\??\c:\bpxpff.exec:\bpxpff.exe95⤵PID:948
-
\??\c:\jjltlh.exec:\jjltlh.exe96⤵PID:2184
-
\??\c:\vvbtnv.exec:\vvbtnv.exe97⤵PID:2672
-
\??\c:\rrtllj.exec:\rrtllj.exe98⤵PID:2300
-
\??\c:\nrnvv.exec:\nrnvv.exe99⤵PID:1752
-
\??\c:\vvpxnhr.exec:\vvpxnhr.exe100⤵PID:1592
-
\??\c:\fffpxvf.exec:\fffpxvf.exe101⤵PID:2164
-
\??\c:\nxtfxpl.exec:\nxtfxpl.exe102⤵PID:1288
-
\??\c:\vlprxnh.exec:\vlprxnh.exe103⤵PID:2980
-
\??\c:\bntlv.exec:\bntlv.exe104⤵PID:2716
-
\??\c:\dhtjvtp.exec:\dhtjvtp.exe105⤵PID:2676
-
\??\c:\thhrld.exec:\thhrld.exe106⤵PID:696
-
\??\c:\djpbv.exec:\djpbv.exe107⤵PID:1440
-
\??\c:\fdjvlj.exec:\fdjvlj.exe108⤵PID:1924
-
\??\c:\nbttptf.exec:\nbttptf.exe109⤵PID:2084
-
\??\c:\htpfpb.exec:\htpfpb.exe110⤵PID:1904
-
\??\c:\ftrplfl.exec:\ftrplfl.exe111⤵PID:1444
-
\??\c:\xdlbnrp.exec:\xdlbnrp.exe112⤵PID:2304
-
\??\c:\nfjvdd.exec:\nfjvdd.exe113⤵PID:1532
-
\??\c:\llprdr.exec:\llprdr.exe114⤵PID:1944
-
\??\c:\dlrdf.exec:\dlrdf.exe115⤵PID:960
-
\??\c:\ptplxlv.exec:\ptplxlv.exe116⤵PID:488
-
\??\c:\jfplt.exec:\jfplt.exe117⤵PID:2224
-
\??\c:\fxftr.exec:\fxftr.exe118⤵PID:2072
-
\??\c:\lvftr.exec:\lvftr.exe119⤵PID:2020
-
\??\c:\xhldtt.exec:\xhldtt.exe120⤵PID:2744
-
\??\c:\lthhd.exec:\lthhd.exe121⤵PID:1556
-
\??\c:\xpldtf.exec:\xpldtf.exe122⤵PID:2064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-