Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 04:00
Behavioral task
behavioral1
Sample
e0f260ba012108457aa2073162a9668892566278a6a372106a7b65e8bb43acae.exe
Resource
win7-20240221-en
7 signatures
150 seconds
General
-
Target
e0f260ba012108457aa2073162a9668892566278a6a372106a7b65e8bb43acae.exe
-
Size
487KB
-
MD5
325db849d9f5547e4927337a86f62506
-
SHA1
e854728f9877fd97f6c37721f8621bd2f7375305
-
SHA256
e0f260ba012108457aa2073162a9668892566278a6a372106a7b65e8bb43acae
-
SHA512
7376c5ee2d89c3a486cc1d9d9a35066c9dcefdbbc300d3fe83d3cc7ee1b31d15a67554e8495bf65d9492e72acfc28de33542b122f46664f382d297f7a60f212b
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkUo7tvnJ9oH0IiVByq9CPobNVB:n3C9ytvngQjgtvngSV3CPobNVB
Malware Config
Signatures
-
Detect Blackmoon payload 32 IoCs
resource yara_rule behavioral1/memory/2228-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/464-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-378-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/464-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-424-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-442-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-483-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 50 IoCs
resource yara_rule behavioral1/memory/2228-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1820-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2368-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1252-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1960-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2328-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/872-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/464-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1628-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1772-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/840-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1348-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2836-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1808-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2972-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2964-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2468-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2468-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1640-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1524-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/980-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2160-252-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2160-254-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2844-273-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2140-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2232-302-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2336-323-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2340-331-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2336-321-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2032-360-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2032-361-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2044-376-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2044-378-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/464-392-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/464-393-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1168-401-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-423-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-424-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/940-433-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2544-441-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2544-442-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1792-465-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2848-473-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2940-483-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2948-490-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/984-519-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2816-534-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2160-563-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/280-579-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2052-594-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1820 brfjrnp.exe 2368 rpxjpjj.exe 1252 xttrdbd.exe 1960 jxlhx.exe 2328 nnbdfvp.exe 872 rbjxrrj.exe 464 rbnnr.exe 1628 hldpjlb.exe 840 xtxbj.exe 1772 hbtfxlv.exe 2468 fjdnt.exe 1348 jppxdbx.exe 2528 hjpvrxt.exe 2836 fdjlnn.exe 2652 vdbft.exe 1352 xpdbp.exe 1808 rbjlh.exe 2972 pdlxb.exe 2964 bnhbp.exe 1640 rlrfr.exe 1524 bpdfv.exe 980 xrdbtb.exe 2764 prrppxv.exe 796 hvrpjj.exe 2160 rlftb.exe 2084 prrdpd.exe 2844 njbtpb.exe 2512 dfhvt.exe 2140 hnjth.exe 2232 dtfhph.exe 2284 rprxd.exe 2336 bvfbp.exe 2340 tvddx.exe 2364 bvfjhrd.exe 1568 jxljx.exe 1276 vjjlbv.exe 2032 npddlrb.exe 1984 jnlhtr.exe 2044 nfdbv.exe 548 hnrfr.exe 464 hnfdld.exe 1168 tbpbb.exe 920 rhlnjxt.exe 960 lxpjpvr.exe 2464 xftjtn.exe 940 vhndfjd.exe 2544 jllxt.exe 2536 rplftvb.exe 2708 jthlfjn.exe 1792 lxpfxt.exe 2848 blnhdb.exe 2940 vpnfpp.exe 2948 pldvn.exe 3024 bpnlbt.exe 3000 rddphj.exe 2100 ffttnd.exe 984 rvtjp.exe 864 dllxxh.exe 2816 fdjvp.exe 1724 fxbhpn.exe 632 lvtpbt.exe 1432 dfrhdn.exe 2160 hddrx.exe 2064 fdtpd.exe -
resource yara_rule behavioral1/memory/2228-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/464-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-378-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/464-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/464-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1168-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-423-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-424-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-442-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-465-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-473-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-483-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-490-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-519-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-563-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-579-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-594-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 1820 2228 e0f260ba012108457aa2073162a9668892566278a6a372106a7b65e8bb43acae.exe 30 PID 2228 wrote to memory of 1820 2228 e0f260ba012108457aa2073162a9668892566278a6a372106a7b65e8bb43acae.exe 30 PID 2228 wrote to memory of 1820 2228 e0f260ba012108457aa2073162a9668892566278a6a372106a7b65e8bb43acae.exe 30 PID 2228 wrote to memory of 1820 2228 e0f260ba012108457aa2073162a9668892566278a6a372106a7b65e8bb43acae.exe 30 PID 1820 wrote to memory of 2368 1820 brfjrnp.exe 31 PID 1820 wrote to memory of 2368 1820 brfjrnp.exe 31 PID 1820 wrote to memory of 2368 1820 brfjrnp.exe 31 PID 1820 wrote to memory of 2368 1820 brfjrnp.exe 31 PID 2368 wrote to memory of 1252 2368 rpxjpjj.exe 32 PID 2368 wrote to memory of 1252 2368 rpxjpjj.exe 32 PID 2368 wrote to memory of 1252 2368 rpxjpjj.exe 32 PID 2368 wrote to memory of 1252 2368 rpxjpjj.exe 32 PID 1252 wrote to memory of 1960 1252 xttrdbd.exe 33 PID 1252 wrote to memory of 1960 1252 xttrdbd.exe 33 PID 1252 wrote to memory of 1960 1252 xttrdbd.exe 33 PID 1252 wrote to memory of 1960 1252 xttrdbd.exe 33 PID 1960 wrote to memory of 2328 1960 jxlhx.exe 34 PID 1960 wrote to memory of 2328 1960 jxlhx.exe 34 PID 1960 wrote to memory of 2328 1960 jxlhx.exe 34 PID 1960 wrote to memory of 2328 1960 jxlhx.exe 34 PID 2328 wrote to memory of 872 2328 nnbdfvp.exe 35 PID 2328 wrote to memory of 872 2328 nnbdfvp.exe 35 PID 2328 wrote to memory of 872 2328 nnbdfvp.exe 35 PID 2328 wrote to memory of 872 2328 nnbdfvp.exe 35 PID 872 wrote to memory of 464 872 rbjxrrj.exe 36 PID 872 wrote to memory of 464 872 rbjxrrj.exe 36 PID 872 wrote to memory of 464 872 rbjxrrj.exe 36 PID 872 wrote to memory of 464 872 rbjxrrj.exe 36 PID 464 wrote to memory of 1628 464 rbnnr.exe 37 PID 464 wrote to memory of 1628 464 rbnnr.exe 37 PID 464 wrote to memory of 1628 464 rbnnr.exe 37 PID 464 wrote to memory of 1628 464 rbnnr.exe 37 PID 1628 wrote to memory of 840 1628 hldpjlb.exe 38 PID 1628 wrote to memory of 840 1628 hldpjlb.exe 38 PID 1628 wrote to memory of 840 1628 hldpjlb.exe 38 PID 1628 wrote to memory of 840 1628 hldpjlb.exe 38 PID 840 wrote to memory of 1772 840 xtxbj.exe 39 PID 840 wrote to memory of 1772 840 xtxbj.exe 39 PID 840 wrote to memory of 1772 840 xtxbj.exe 39 PID 840 wrote to memory of 1772 840 xtxbj.exe 39 PID 1772 wrote to memory of 2468 1772 hbtfxlv.exe 40 PID 1772 wrote to memory of 2468 1772 hbtfxlv.exe 40 PID 1772 wrote to memory of 2468 1772 hbtfxlv.exe 40 PID 1772 wrote to memory of 2468 1772 hbtfxlv.exe 40 PID 2468 wrote to memory of 1348 2468 fjdnt.exe 41 PID 2468 wrote to memory of 1348 2468 fjdnt.exe 41 PID 2468 wrote to memory of 1348 2468 fjdnt.exe 41 PID 2468 wrote to memory of 1348 2468 fjdnt.exe 41 PID 1348 wrote to memory of 2528 1348 jppxdbx.exe 42 PID 1348 wrote to memory of 2528 1348 jppxdbx.exe 42 PID 1348 wrote to memory of 2528 1348 jppxdbx.exe 42 PID 1348 wrote to memory of 2528 1348 jppxdbx.exe 42 PID 2528 wrote to memory of 2836 2528 hjpvrxt.exe 43 PID 2528 wrote to memory of 2836 2528 hjpvrxt.exe 43 PID 2528 wrote to memory of 2836 2528 hjpvrxt.exe 43 PID 2528 wrote to memory of 2836 2528 hjpvrxt.exe 43 PID 2836 wrote to memory of 2652 2836 fdjlnn.exe 44 PID 2836 wrote to memory of 2652 2836 fdjlnn.exe 44 PID 2836 wrote to memory of 2652 2836 fdjlnn.exe 44 PID 2836 wrote to memory of 2652 2836 fdjlnn.exe 44 PID 2652 wrote to memory of 1352 2652 vdbft.exe 45 PID 2652 wrote to memory of 1352 2652 vdbft.exe 45 PID 2652 wrote to memory of 1352 2652 vdbft.exe 45 PID 2652 wrote to memory of 1352 2652 vdbft.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0f260ba012108457aa2073162a9668892566278a6a372106a7b65e8bb43acae.exe"C:\Users\Admin\AppData\Local\Temp\e0f260ba012108457aa2073162a9668892566278a6a372106a7b65e8bb43acae.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\brfjrnp.exec:\brfjrnp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\rpxjpjj.exec:\rpxjpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\xttrdbd.exec:\xttrdbd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\jxlhx.exec:\jxlhx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\nnbdfvp.exec:\nnbdfvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\rbjxrrj.exec:\rbjxrrj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\rbnnr.exec:\rbnnr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\hldpjlb.exec:\hldpjlb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\xtxbj.exec:\xtxbj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\hbtfxlv.exec:\hbtfxlv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\fjdnt.exec:\fjdnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\jppxdbx.exec:\jppxdbx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\hjpvrxt.exec:\hjpvrxt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\fdjlnn.exec:\fdjlnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\vdbft.exec:\vdbft.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xpdbp.exec:\xpdbp.exe17⤵
- Executes dropped EXE
PID:1352 -
\??\c:\rbjlh.exec:\rbjlh.exe18⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pdlxb.exec:\pdlxb.exe19⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bnhbp.exec:\bnhbp.exe20⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rlrfr.exec:\rlrfr.exe21⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bpdfv.exec:\bpdfv.exe22⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xrdbtb.exec:\xrdbtb.exe23⤵
- Executes dropped EXE
PID:980 -
\??\c:\prrppxv.exec:\prrppxv.exe24⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hvrpjj.exec:\hvrpjj.exe25⤵
- Executes dropped EXE
PID:796 -
\??\c:\rlftb.exec:\rlftb.exe26⤵
- Executes dropped EXE
PID:2160 -
\??\c:\prrdpd.exec:\prrdpd.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\njbtpb.exec:\njbtpb.exe28⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dfhvt.exec:\dfhvt.exe29⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hnjth.exec:\hnjth.exe30⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dtfhph.exec:\dtfhph.exe31⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rprxd.exec:\rprxd.exe32⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bvfbp.exec:\bvfbp.exe33⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tvddx.exec:\tvddx.exe34⤵
- Executes dropped EXE
PID:2340 -
\??\c:\bvfjhrd.exec:\bvfjhrd.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jxljx.exec:\jxljx.exe36⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vjjlbv.exec:\vjjlbv.exe37⤵
- Executes dropped EXE
PID:1276 -
\??\c:\npddlrb.exec:\npddlrb.exe38⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jnlhtr.exec:\jnlhtr.exe39⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nfdbv.exec:\nfdbv.exe40⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hnrfr.exec:\hnrfr.exe41⤵
- Executes dropped EXE
PID:548 -
\??\c:\hnfdld.exec:\hnfdld.exe42⤵
- Executes dropped EXE
PID:464 -
\??\c:\tbpbb.exec:\tbpbb.exe43⤵
- Executes dropped EXE
PID:1168 -
\??\c:\rhlnjxt.exec:\rhlnjxt.exe44⤵
- Executes dropped EXE
PID:920 -
\??\c:\lxpjpvr.exec:\lxpjpvr.exe45⤵
- Executes dropped EXE
PID:960 -
\??\c:\xftjtn.exec:\xftjtn.exe46⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vhndfjd.exec:\vhndfjd.exe47⤵
- Executes dropped EXE
PID:940 -
\??\c:\jllxt.exec:\jllxt.exe48⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rplftvb.exec:\rplftvb.exe49⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jthlfjn.exec:\jthlfjn.exe50⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lxpfxt.exec:\lxpfxt.exe51⤵
- Executes dropped EXE
PID:1792 -
\??\c:\blnhdb.exec:\blnhdb.exe52⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vpnfpp.exec:\vpnfpp.exe53⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pldvn.exec:\pldvn.exe54⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bpnlbt.exec:\bpnlbt.exe55⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rddphj.exec:\rddphj.exe56⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ffttnd.exec:\ffttnd.exe57⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rvtjp.exec:\rvtjp.exe58⤵
- Executes dropped EXE
PID:984 -
\??\c:\dllxxh.exec:\dllxxh.exe59⤵
- Executes dropped EXE
PID:864 -
\??\c:\fdjvp.exec:\fdjvp.exe60⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fxbhpn.exec:\fxbhpn.exe61⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lvtpbt.exec:\lvtpbt.exe62⤵
- Executes dropped EXE
PID:632 -
\??\c:\dfrhdn.exec:\dfrhdn.exe63⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hddrx.exec:\hddrx.exe64⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fdtpd.exec:\fdtpd.exe65⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ndrjjjn.exec:\ndrjjjn.exe66⤵PID:280
-
\??\c:\ltnnr.exec:\ltnnr.exe67⤵PID:1784
-
\??\c:\djbtjnb.exec:\djbtjnb.exe68⤵PID:2052
-
\??\c:\blnflvj.exec:\blnflvj.exe69⤵PID:2140
-
\??\c:\jlvndr.exec:\jlvndr.exe70⤵PID:2280
-
\??\c:\rndnvv.exec:\rndnvv.exe71⤵PID:1676
-
\??\c:\dhhdf.exec:\dhhdf.exe72⤵PID:2392
-
\??\c:\bvdttbt.exec:\bvdttbt.exe73⤵PID:1552
-
\??\c:\ffrxj.exec:\ffrxj.exe74⤵PID:1592
-
\??\c:\xvfldtf.exec:\xvfldtf.exe75⤵PID:1684
-
\??\c:\fbffrjr.exec:\fbffrjr.exe76⤵PID:1968
-
\??\c:\vnjbhbr.exec:\vnjbhbr.exe77⤵PID:1964
-
\??\c:\jhfjdxd.exec:\jhfjdxd.exe78⤵PID:2000
-
\??\c:\ftnbnr.exec:\ftnbnr.exe79⤵PID:576
-
\??\c:\ldbvrf.exec:\ldbvrf.exe80⤵PID:1016
-
\??\c:\rjljb.exec:\rjljb.exe81⤵PID:2012
-
\??\c:\bljhnv.exec:\bljhnv.exe82⤵PID:2404
-
\??\c:\fdltll.exec:\fdltll.exe83⤵PID:364
-
\??\c:\hrbnd.exec:\hrbnd.exe84⤵PID:516
-
\??\c:\ttnvlpn.exec:\ttnvlpn.exe85⤵PID:2420
-
\??\c:\tnbjl.exec:\tnbjl.exe86⤵PID:2868
-
\??\c:\rjhbnnb.exec:\rjhbnnb.exe87⤵PID:2464
-
\??\c:\pxpnd.exec:\pxpnd.exe88⤵PID:940
-
\??\c:\rhnfxh.exec:\rhnfxh.exe89⤵PID:2624
-
\??\c:\rlhpb.exec:\rlhpb.exe90⤵PID:2836
-
\??\c:\prftd.exec:\prftd.exe91⤵PID:2708
-
\??\c:\hbdhnb.exec:\hbdhnb.exe92⤵PID:1824
-
\??\c:\jnjxb.exec:\jnjxb.exe93⤵PID:1804
-
\??\c:\jhbrpp.exec:\jhbrpp.exe94⤵PID:1832
-
\??\c:\pndnh.exec:\pndnh.exe95⤵PID:2972
-
\??\c:\ndnlrx.exec:\ndnlrx.exe96⤵PID:3060
-
\??\c:\xbdhvd.exec:\xbdhvd.exe97⤵PID:1512
-
\??\c:\lvthfn.exec:\lvthfn.exe98⤵PID:1892
-
\??\c:\jrnxdl.exec:\jrnxdl.exe99⤵PID:984
-
\??\c:\fxbrhfr.exec:\fxbrhfr.exe100⤵PID:1456
-
\??\c:\xtlvv.exec:\xtlvv.exe101⤵PID:2816
-
\??\c:\rvjrp.exec:\rvjrp.exe102⤵PID:1724
-
\??\c:\vfbbv.exec:\vfbbv.exe103⤵PID:2428
-
\??\c:\xvldl.exec:\xvldl.exe104⤵PID:2448
-
\??\c:\tnvrbx.exec:\tnvrbx.exe105⤵PID:1728
-
\??\c:\fxtfl.exec:\fxtfl.exe106⤵PID:2064
-
\??\c:\vvphhtj.exec:\vvphhtj.exe107⤵PID:1764
-
\??\c:\bnjnd.exec:\bnjnd.exe108⤵PID:900
-
\??\c:\flnbt.exec:\flnbt.exe109⤵PID:2076
-
\??\c:\xfnnh.exec:\xfnnh.exe110⤵PID:2080
-
\??\c:\rlpjtlh.exec:\rlpjtlh.exe111⤵PID:1560
-
\??\c:\lxdfv.exec:\lxdfv.exe112⤵PID:1208
-
\??\c:\vddvxd.exec:\vddvxd.exe113⤵PID:1040
-
\??\c:\pxxfxh.exec:\pxxfxh.exe114⤵PID:1552
-
\??\c:\bjrhnt.exec:\bjrhnt.exe115⤵PID:1692
-
\??\c:\xbdppxh.exec:\xbdppxh.exe116⤵PID:1124
-
\??\c:\fdrjphl.exec:\fdrjphl.exe117⤵PID:1968
-
\??\c:\dblhvfr.exec:\dblhvfr.exe118⤵PID:1668
-
\??\c:\dlrnjb.exec:\dlrnjb.exe119⤵PID:2000
-
\??\c:\ptdjdf.exec:\ptdjdf.exe120⤵PID:1164
-
\??\c:\fvtdbn.exec:\fvtdbn.exe121⤵PID:704
-
\??\c:\rhvnl.exec:\rhvnl.exe122⤵PID:1540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-