Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 05:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
General
-
Target
e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe
-
Size
387KB
-
MD5
a73992931be67358799b9052e51e1104
-
SHA1
7155b82ac6e852e2888ff978cff8b9fe63c95336
-
SHA256
e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b
-
SHA512
7102bd317f4c155d0a0d027317d9308eef36183aa8505f06887fe216272ee22eeeef5b8085cd91696bf680d3249ccef0129e0302dc2a9c6228ad053985b2f025
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwf0:SgdnJVU4TlnwJ6Goh
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2792-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1220-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 31 IoCs
resource yara_rule behavioral1/memory/2792-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2052-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2508-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2888-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2888-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1696-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1696-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1780-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3048-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1648-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1220-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1456-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2360-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2296-208-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1960-226-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2160-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2368-244-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2920-289-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2088-298-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2944-307-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2052 bbtjx.exe 3056 fxrxpv.exe 2736 ljjnnth.exe 2760 pbblhjl.exe 2632 rjpbvfd.exe 2508 ffbdtx.exe 2888 ndxjr.exe 1696 ttjnhv.exe 592 tldffj.exe 1780 njrbth.exe 2584 rlxbn.exe 3048 jftvlvn.exe 1648 hlhrbp.exe 2100 frhln.exe 1172 vntlb.exe 1220 hxnbtrv.exe 1456 lrtpld.exe 1872 dvbxlnh.exe 2360 nrhxxrj.exe 2296 xdbjtn.exe 1628 jbfntld.exe 1960 fhtvblr.exe 2160 jbllndp.exe 2368 rplbfv.exe 2116 ljrlp.exe 1552 brrrbpl.exe 1612 rndlj.exe 1772 ddtlj.exe 2920 htptn.exe 2088 njjrl.exe 2944 trpbfbf.exe 288 dfvdldj.exe 2044 vtdhfv.exe 3004 dfljxl.exe 2232 pxxbbpl.exe 2948 rxfhfh.exe 2956 fddldxl.exe 2728 dvhnhx.exe 2352 bjfbj.exe 2744 hjrxldp.exe 2216 blfxtxh.exe 2548 brbntf.exe 2632 tnnxj.exe 2892 ntvvj.exe 2220 rhrhxr.exe 2936 jlflbdd.exe 2184 lbvhhhv.exe 584 ljppvh.exe 272 lvhvl.exe 2480 ddxjxv.exe 1100 ldhvn.exe 1656 tvlftll.exe 1868 xxxrfxh.exe 1848 xpfhdhr.exe 1124 blxlnv.exe 1812 dtflxj.exe 1220 dlldff.exe 800 xjhrpx.exe 1732 pplxfnf.exe 1460 vbpljd.exe 2836 hvnfn.exe 2296 vxprn.exe 2384 dbhrnp.exe 2992 dhppvr.exe -
resource yara_rule behavioral1/memory/2792-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-307-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2052 2792 e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe 28 PID 2792 wrote to memory of 2052 2792 e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe 28 PID 2792 wrote to memory of 2052 2792 e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe 28 PID 2792 wrote to memory of 2052 2792 e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe 28 PID 2052 wrote to memory of 3056 2052 bbtjx.exe 29 PID 2052 wrote to memory of 3056 2052 bbtjx.exe 29 PID 2052 wrote to memory of 3056 2052 bbtjx.exe 29 PID 2052 wrote to memory of 3056 2052 bbtjx.exe 29 PID 3056 wrote to memory of 2736 3056 fxrxpv.exe 30 PID 3056 wrote to memory of 2736 3056 fxrxpv.exe 30 PID 3056 wrote to memory of 2736 3056 fxrxpv.exe 30 PID 3056 wrote to memory of 2736 3056 fxrxpv.exe 30 PID 2736 wrote to memory of 2760 2736 ljjnnth.exe 31 PID 2736 wrote to memory of 2760 2736 ljjnnth.exe 31 PID 2736 wrote to memory of 2760 2736 ljjnnth.exe 31 PID 2736 wrote to memory of 2760 2736 ljjnnth.exe 31 PID 2760 wrote to memory of 2632 2760 pbblhjl.exe 32 PID 2760 wrote to memory of 2632 2760 pbblhjl.exe 32 PID 2760 wrote to memory of 2632 2760 pbblhjl.exe 32 PID 2760 wrote to memory of 2632 2760 pbblhjl.exe 32 PID 2632 wrote to memory of 2508 2632 rjpbvfd.exe 33 PID 2632 wrote to memory of 2508 2632 rjpbvfd.exe 33 PID 2632 wrote to memory of 2508 2632 rjpbvfd.exe 33 PID 2632 wrote to memory of 2508 2632 rjpbvfd.exe 33 PID 2508 wrote to memory of 2888 2508 ffbdtx.exe 34 PID 2508 wrote to memory of 2888 2508 ffbdtx.exe 34 PID 2508 wrote to memory of 2888 2508 ffbdtx.exe 34 PID 2508 wrote to memory of 2888 2508 ffbdtx.exe 34 PID 2888 wrote to memory of 1696 2888 ndxjr.exe 35 PID 2888 wrote to memory of 1696 2888 ndxjr.exe 35 PID 2888 wrote to memory of 1696 2888 ndxjr.exe 35 PID 2888 wrote to memory of 1696 2888 ndxjr.exe 35 PID 1696 wrote to memory of 592 1696 ttjnhv.exe 36 PID 1696 wrote to memory of 592 1696 ttjnhv.exe 36 PID 1696 wrote to memory of 592 1696 ttjnhv.exe 36 PID 1696 wrote to memory of 592 1696 ttjnhv.exe 36 PID 592 wrote to memory of 1780 592 tldffj.exe 37 PID 592 wrote to memory of 1780 592 tldffj.exe 37 PID 592 wrote to memory of 1780 592 tldffj.exe 37 PID 592 wrote to memory of 1780 592 tldffj.exe 37 PID 1780 wrote to memory of 2584 1780 njrbth.exe 38 PID 1780 wrote to memory of 2584 1780 njrbth.exe 38 PID 1780 wrote to memory of 2584 1780 njrbth.exe 38 PID 1780 wrote to memory of 2584 1780 njrbth.exe 38 PID 2584 wrote to memory of 3048 2584 rlxbn.exe 39 PID 2584 wrote to memory of 3048 2584 rlxbn.exe 39 PID 2584 wrote to memory of 3048 2584 rlxbn.exe 39 PID 2584 wrote to memory of 3048 2584 rlxbn.exe 39 PID 3048 wrote to memory of 1648 3048 jftvlvn.exe 40 PID 3048 wrote to memory of 1648 3048 jftvlvn.exe 40 PID 3048 wrote to memory of 1648 3048 jftvlvn.exe 40 PID 3048 wrote to memory of 1648 3048 jftvlvn.exe 40 PID 1648 wrote to memory of 2100 1648 hlhrbp.exe 41 PID 1648 wrote to memory of 2100 1648 hlhrbp.exe 41 PID 1648 wrote to memory of 2100 1648 hlhrbp.exe 41 PID 1648 wrote to memory of 2100 1648 hlhrbp.exe 41 PID 2100 wrote to memory of 1172 2100 frhln.exe 42 PID 2100 wrote to memory of 1172 2100 frhln.exe 42 PID 2100 wrote to memory of 1172 2100 frhln.exe 42 PID 2100 wrote to memory of 1172 2100 frhln.exe 42 PID 1172 wrote to memory of 1220 1172 vntlb.exe 43 PID 1172 wrote to memory of 1220 1172 vntlb.exe 43 PID 1172 wrote to memory of 1220 1172 vntlb.exe 43 PID 1172 wrote to memory of 1220 1172 vntlb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe"C:\Users\Admin\AppData\Local\Temp\e143762ee203cc6182de40c0f2b565dfec2723c5381dfd2297c95ccbbfe75d5b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\bbtjx.exec:\bbtjx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\fxrxpv.exec:\fxrxpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\ljjnnth.exec:\ljjnnth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\pbblhjl.exec:\pbblhjl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\rjpbvfd.exec:\rjpbvfd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ffbdtx.exec:\ffbdtx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\ndxjr.exec:\ndxjr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\ttjnhv.exec:\ttjnhv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\tldffj.exec:\tldffj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\njrbth.exec:\njrbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\rlxbn.exec:\rlxbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\jftvlvn.exec:\jftvlvn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\hlhrbp.exec:\hlhrbp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\frhln.exec:\frhln.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\vntlb.exec:\vntlb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\hxnbtrv.exec:\hxnbtrv.exe17⤵
- Executes dropped EXE
PID:1220 -
\??\c:\lrtpld.exec:\lrtpld.exe18⤵
- Executes dropped EXE
PID:1456 -
\??\c:\dvbxlnh.exec:\dvbxlnh.exe19⤵
- Executes dropped EXE
PID:1872 -
\??\c:\nrhxxrj.exec:\nrhxxrj.exe20⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xdbjtn.exec:\xdbjtn.exe21⤵
- Executes dropped EXE
PID:2296 -
\??\c:\jbfntld.exec:\jbfntld.exe22⤵
- Executes dropped EXE
PID:1628 -
\??\c:\fhtvblr.exec:\fhtvblr.exe23⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jbllndp.exec:\jbllndp.exe24⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rplbfv.exec:\rplbfv.exe25⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ljrlp.exec:\ljrlp.exe26⤵
- Executes dropped EXE
PID:2116 -
\??\c:\brrrbpl.exec:\brrrbpl.exe27⤵
- Executes dropped EXE
PID:1552 -
\??\c:\rndlj.exec:\rndlj.exe28⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ddtlj.exec:\ddtlj.exe29⤵
- Executes dropped EXE
PID:1772 -
\??\c:\htptn.exec:\htptn.exe30⤵
- Executes dropped EXE
PID:2920 -
\??\c:\njjrl.exec:\njjrl.exe31⤵
- Executes dropped EXE
PID:2088 -
\??\c:\trpbfbf.exec:\trpbfbf.exe32⤵
- Executes dropped EXE
PID:2944 -
\??\c:\dfvdldj.exec:\dfvdldj.exe33⤵
- Executes dropped EXE
PID:288 -
\??\c:\vtdhfv.exec:\vtdhfv.exe34⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dfljxl.exec:\dfljxl.exe35⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pxxbbpl.exec:\pxxbbpl.exe36⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rxfhfh.exec:\rxfhfh.exe37⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fddldxl.exec:\fddldxl.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\dvhnhx.exec:\dvhnhx.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bjfbj.exec:\bjfbj.exe40⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hjrxldp.exec:\hjrxldp.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\blfxtxh.exec:\blfxtxh.exe42⤵
- Executes dropped EXE
PID:2216 -
\??\c:\brbntf.exec:\brbntf.exe43⤵
- Executes dropped EXE
PID:2548 -
\??\c:\tnnxj.exec:\tnnxj.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ntvvj.exec:\ntvvj.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rhrhxr.exec:\rhrhxr.exe46⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jlflbdd.exec:\jlflbdd.exe47⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lbvhhhv.exec:\lbvhhhv.exe48⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ljppvh.exec:\ljppvh.exe49⤵
- Executes dropped EXE
PID:584 -
\??\c:\lvhvl.exec:\lvhvl.exe50⤵
- Executes dropped EXE
PID:272 -
\??\c:\ddxjxv.exec:\ddxjxv.exe51⤵
- Executes dropped EXE
PID:2480 -
\??\c:\ldhvn.exec:\ldhvn.exe52⤵
- Executes dropped EXE
PID:1100 -
\??\c:\tvlftll.exec:\tvlftll.exe53⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xxxrfxh.exec:\xxxrfxh.exe54⤵
- Executes dropped EXE
PID:1868 -
\??\c:\xpfhdhr.exec:\xpfhdhr.exe55⤵
- Executes dropped EXE
PID:1848 -
\??\c:\blxlnv.exec:\blxlnv.exe56⤵
- Executes dropped EXE
PID:1124 -
\??\c:\dtflxj.exec:\dtflxj.exe57⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dlldff.exec:\dlldff.exe58⤵
- Executes dropped EXE
PID:1220 -
\??\c:\xjhrpx.exec:\xjhrpx.exe59⤵
- Executes dropped EXE
PID:800 -
\??\c:\pplxfnf.exec:\pplxfnf.exe60⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vbpljd.exec:\vbpljd.exe61⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hvnfn.exec:\hvnfn.exe62⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vxprn.exec:\vxprn.exe63⤵
- Executes dropped EXE
PID:2296 -
\??\c:\dbhrnp.exec:\dbhrnp.exe64⤵
- Executes dropped EXE
PID:2384 -
\??\c:\dhppvr.exec:\dhppvr.exe65⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jltpff.exec:\jltpff.exe66⤵PID:1496
-
\??\c:\rfbbrb.exec:\rfbbrb.exe67⤵PID:2364
-
\??\c:\fnltrb.exec:\fnltrb.exe68⤵PID:2408
-
\??\c:\npjxll.exec:\npjxll.exe69⤵PID:1536
-
\??\c:\xthvhdx.exec:\xthvhdx.exe70⤵PID:1204
-
\??\c:\hdjtb.exec:\hdjtb.exe71⤵PID:1044
-
\??\c:\fxxfnf.exec:\fxxfnf.exe72⤵PID:1048
-
\??\c:\rpttfjf.exec:\rpttfjf.exe73⤵PID:1652
-
\??\c:\ttlvfjx.exec:\ttlvfjx.exe74⤵PID:2032
-
\??\c:\vrpxv.exec:\vrpxv.exe75⤵PID:2092
-
\??\c:\jnlvrrb.exec:\jnlvrrb.exe76⤵PID:1544
-
\??\c:\vpvbxvj.exec:\vpvbxvj.exe77⤵PID:564
-
\??\c:\rfpdx.exec:\rfpdx.exe78⤵PID:2040
-
\??\c:\tvxlf.exec:\tvxlf.exe79⤵PID:2024
-
\??\c:\vdxjvvb.exec:\vdxjvvb.exe80⤵PID:1604
-
\??\c:\hfdvp.exec:\hfdvp.exe81⤵PID:2908
-
\??\c:\vbxnfl.exec:\vbxnfl.exe82⤵PID:2028
-
\??\c:\tfbxvpd.exec:\tfbxvpd.exe83⤵PID:2724
-
\??\c:\vxfvxvp.exec:\vxfvxvp.exe84⤵PID:2720
-
\??\c:\lfxdtd.exec:\lfxdtd.exe85⤵PID:2620
-
\??\c:\prpvjj.exec:\prpvjj.exe86⤵PID:2876
-
\??\c:\dfnxfnv.exec:\dfnxfnv.exe87⤵PID:2804
-
\??\c:\pdjht.exec:\pdjht.exe88⤵PID:2748
-
\??\c:\xntdhf.exec:\xntdhf.exe89⤵PID:2488
-
\??\c:\bvvfh.exec:\bvvfh.exe90⤵PID:2508
-
\??\c:\npnjddl.exec:\npnjddl.exe91⤵PID:1680
-
\??\c:\ffbdp.exec:\ffbdp.exe92⤵PID:672
-
\??\c:\pjtltnl.exec:\pjtltnl.exe93⤵PID:1012
-
\??\c:\jjftd.exec:\jjftd.exe94⤵PID:592
-
\??\c:\rnljfx.exec:\rnljfx.exe95⤵PID:1636
-
\??\c:\ddnxjn.exec:\ddnxjn.exe96⤵PID:1156
-
\??\c:\pfttrr.exec:\pfttrr.exe97⤵PID:1624
-
\??\c:\tljtpv.exec:\tljtpv.exe98⤵PID:2424
-
\??\c:\vvvbl.exec:\vvvbl.exe99⤵PID:1188
-
\??\c:\jbnlxn.exec:\jbnlxn.exe100⤵PID:2100
-
\??\c:\jtpbt.exec:\jtpbt.exe101⤵PID:1828
-
\??\c:\fnnjh.exec:\fnnjh.exe102⤵PID:1364
-
\??\c:\lrrvfbj.exec:\lrrvfbj.exe103⤵PID:1816
-
\??\c:\hjnbptb.exec:\hjnbptb.exe104⤵PID:924
-
\??\c:\rpdtxv.exec:\rpdtxv.exe105⤵PID:2328
-
\??\c:\fbxjt.exec:\fbxjt.exe106⤵PID:2200
-
\??\c:\ljbljnb.exec:\ljbljnb.exe107⤵PID:1980
-
\??\c:\fblvrtl.exec:\fblvrtl.exe108⤵PID:2164
-
\??\c:\txfnjn.exec:\txfnjn.exe109⤵PID:1628
-
\??\c:\nlltt.exec:\nlltt.exe110⤵PID:1064
-
\??\c:\jpdfx.exec:\jpdfx.exe111⤵PID:2380
-
\??\c:\vxhlfb.exec:\vxhlfb.exe112⤵PID:2368
-
\??\c:\lhhtfbb.exec:\lhhtfbb.exe113⤵PID:1904
-
\??\c:\vrjlj.exec:\vrjlj.exe114⤵PID:1592
-
\??\c:\lhbtrx.exec:\lhbtrx.exe115⤵PID:2460
-
\??\c:\nfdtfdv.exec:\nfdtfdv.exe116⤵PID:1748
-
\??\c:\ffpnfl.exec:\ffpnfl.exe117⤵PID:660
-
\??\c:\flppfl.exec:\flppfl.exe118⤵PID:1224
-
\??\c:\xnlvnh.exec:\xnlvnh.exe119⤵PID:1972
-
\??\c:\dhxnb.exec:\dhxnb.exe120⤵PID:2268
-
\??\c:\fbvppfb.exec:\fbvppfb.exe121⤵PID:928
-
\??\c:\fjndjld.exec:\fjndjld.exe122⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-