Analysis
-
max time kernel
79s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 13:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe
-
Size
65KB
-
MD5
4653cf22acfbe2373964547c2320eca1
-
SHA1
96bb491966b58b02d8b16b104af0f09fb074ac74
-
SHA256
1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0
-
SHA512
226c4349d50d20882d2d3efbb503fed225631e3857a76d69a66c408ef413ec763d6e1b2654a98d1ad888d7f65f80ae20681d59b8a4dc277a098054690d5696ef
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AyXmhx:ymb3NkkiQ3mdBjFI46TQyXmhx
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral1/memory/2004-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-386-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-395-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-429-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-435-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-378-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/976-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-481-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-521-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-545-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-574-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 59 IoCs
resource yara_rule behavioral1/memory/2004-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2004-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2024-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2116-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2116-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2840-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2404-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2424-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2940-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2940-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1488-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1488-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/836-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/836-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1740-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/944-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1900-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1556-186-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1624-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2656-208-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2664-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/440-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/976-282-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1608-339-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-354-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2004-331-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2876-369-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2552-385-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2552-386-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2348-402-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-395-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2348-404-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-412-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2396-419-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/764-429-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1256-435-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2564-378-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/976-285-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1676-274-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1820-255-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2656-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/836-465-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1964-481-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1964-480-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2228-489-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1436-504-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2056-512-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3032-521-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2960-542-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2960-545-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1252-572-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1252-574-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1520-581-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2992-597-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2024 bbfrhb.exe 2116 rdlxbd.exe 2632 pdnbx.exe 2904 rdjlfh.exe 2508 lxtrt.exe 2840 flhbl.exe 2452 tjbvpj.exe 2404 tnrjf.exe 2424 txnhvtd.exe 2940 tfdbtr.exe 1488 tpdjn.exe 2104 lhdpfnx.exe 836 djblpl.exe 308 vvjjnfx.exe 1740 vrvlx.exe 944 vxtvvbp.exe 1900 fjjnfv.exe 1556 hxjtbr.exe 1624 plvxhp.exe 2656 vjdpbb.exe 2676 rjfttvf.exe 2664 lpbxnrn.exe 440 dnptx.exe 840 drdjfrr.exe 1820 tndfpnh.exe 1580 rlnfvhl.exe 1676 jhptnbp.exe 976 xjlxh.exe 2856 hphhb.exe 2812 tvjjffl.exe 1240 rhvfp.exe 1976 prhvhft.exe 2004 nxbdvvl.exe 1608 rrtnr.exe 1096 rjphd.exe 2444 fvtrphd.exe 2832 plbnpd.exe 2876 jpvtlpl.exe 2564 dlpdlv.exe 2552 hxtlx.exe 2536 nnhvblv.exe 2348 fnntxd.exe 2412 lrpnjt.exe 2396 vljhx.exe 764 xhpfjjr.exe 1256 pbbnt.exe 1764 djjlh.exe 1828 pbnffth.exe 1940 pthvd.exe 836 ddjrp.exe 308 rvdtnll.exe 1964 dvvxdh.exe 2228 dvrhdt.exe 1552 hrjhprh.exe 1436 dxhnbr.exe 2056 xnfjntt.exe 3032 bvtbbb.exe 2652 dnjvtbj.exe 380 bfjrfp.exe 2960 ppjhp.exe 844 jttnf.exe 2040 pjrhtrh.exe 840 vvxbrnd.exe 1252 rlvxpt.exe -
resource yara_rule behavioral1/memory/2004-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/440-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/976-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-339-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-402-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-395-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-419-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-429-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-435-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-378-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/976-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-465-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-481-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-480-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-489-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-504-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-512-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-521-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-542-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-545-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-572-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-574-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-581-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-597-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2024 2004 1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe 28 PID 2004 wrote to memory of 2024 2004 1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe 28 PID 2004 wrote to memory of 2024 2004 1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe 28 PID 2004 wrote to memory of 2024 2004 1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe 28 PID 2024 wrote to memory of 2116 2024 bbfrhb.exe 29 PID 2024 wrote to memory of 2116 2024 bbfrhb.exe 29 PID 2024 wrote to memory of 2116 2024 bbfrhb.exe 29 PID 2024 wrote to memory of 2116 2024 bbfrhb.exe 29 PID 2116 wrote to memory of 2632 2116 rdlxbd.exe 30 PID 2116 wrote to memory of 2632 2116 rdlxbd.exe 30 PID 2116 wrote to memory of 2632 2116 rdlxbd.exe 30 PID 2116 wrote to memory of 2632 2116 rdlxbd.exe 30 PID 2632 wrote to memory of 2904 2632 pdnbx.exe 31 PID 2632 wrote to memory of 2904 2632 pdnbx.exe 31 PID 2632 wrote to memory of 2904 2632 pdnbx.exe 31 PID 2632 wrote to memory of 2904 2632 pdnbx.exe 31 PID 2904 wrote to memory of 2508 2904 rdjlfh.exe 32 PID 2904 wrote to memory of 2508 2904 rdjlfh.exe 32 PID 2904 wrote to memory of 2508 2904 rdjlfh.exe 32 PID 2904 wrote to memory of 2508 2904 rdjlfh.exe 32 PID 2508 wrote to memory of 2840 2508 lxtrt.exe 33 PID 2508 wrote to memory of 2840 2508 lxtrt.exe 33 PID 2508 wrote to memory of 2840 2508 lxtrt.exe 33 PID 2508 wrote to memory of 2840 2508 lxtrt.exe 33 PID 2840 wrote to memory of 2452 2840 flhbl.exe 34 PID 2840 wrote to memory of 2452 2840 flhbl.exe 34 PID 2840 wrote to memory of 2452 2840 flhbl.exe 34 PID 2840 wrote to memory of 2452 2840 flhbl.exe 34 PID 2452 wrote to memory of 2404 2452 tjbvpj.exe 35 PID 2452 wrote to memory of 2404 2452 tjbvpj.exe 35 PID 2452 wrote to memory of 2404 2452 tjbvpj.exe 35 PID 2452 wrote to memory of 2404 2452 tjbvpj.exe 35 PID 2404 wrote to memory of 2424 2404 tnrjf.exe 36 PID 2404 wrote to memory of 2424 2404 tnrjf.exe 36 PID 2404 wrote to memory of 2424 2404 tnrjf.exe 36 PID 2404 wrote to memory of 2424 2404 tnrjf.exe 36 PID 2424 wrote to memory of 2940 2424 txnhvtd.exe 37 PID 2424 wrote to memory of 2940 2424 txnhvtd.exe 37 PID 2424 wrote to memory of 2940 2424 txnhvtd.exe 37 PID 2424 wrote to memory of 2940 2424 txnhvtd.exe 37 PID 2940 wrote to memory of 1488 2940 tfdbtr.exe 38 PID 2940 wrote to memory of 1488 2940 tfdbtr.exe 38 PID 2940 wrote to memory of 1488 2940 tfdbtr.exe 38 PID 2940 wrote to memory of 1488 2940 tfdbtr.exe 38 PID 1488 wrote to memory of 2104 1488 tpdjn.exe 39 PID 1488 wrote to memory of 2104 1488 tpdjn.exe 39 PID 1488 wrote to memory of 2104 1488 tpdjn.exe 39 PID 1488 wrote to memory of 2104 1488 tpdjn.exe 39 PID 2104 wrote to memory of 836 2104 lhdpfnx.exe 40 PID 2104 wrote to memory of 836 2104 lhdpfnx.exe 40 PID 2104 wrote to memory of 836 2104 lhdpfnx.exe 40 PID 2104 wrote to memory of 836 2104 lhdpfnx.exe 40 PID 836 wrote to memory of 308 836 djblpl.exe 41 PID 836 wrote to memory of 308 836 djblpl.exe 41 PID 836 wrote to memory of 308 836 djblpl.exe 41 PID 836 wrote to memory of 308 836 djblpl.exe 41 PID 308 wrote to memory of 1740 308 vvjjnfx.exe 42 PID 308 wrote to memory of 1740 308 vvjjnfx.exe 42 PID 308 wrote to memory of 1740 308 vvjjnfx.exe 42 PID 308 wrote to memory of 1740 308 vvjjnfx.exe 42 PID 1740 wrote to memory of 944 1740 vrvlx.exe 43 PID 1740 wrote to memory of 944 1740 vrvlx.exe 43 PID 1740 wrote to memory of 944 1740 vrvlx.exe 43 PID 1740 wrote to memory of 944 1740 vrvlx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe"C:\Users\Admin\AppData\Local\Temp\1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\bbfrhb.exec:\bbfrhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\rdlxbd.exec:\rdlxbd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\pdnbx.exec:\pdnbx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\rdjlfh.exec:\rdjlfh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\lxtrt.exec:\lxtrt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\flhbl.exec:\flhbl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\tjbvpj.exec:\tjbvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\tnrjf.exec:\tnrjf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\txnhvtd.exec:\txnhvtd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\tfdbtr.exec:\tfdbtr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\tpdjn.exec:\tpdjn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\lhdpfnx.exec:\lhdpfnx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\djblpl.exec:\djblpl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\vvjjnfx.exec:\vvjjnfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\vrvlx.exec:\vrvlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\vxtvvbp.exec:\vxtvvbp.exe17⤵
- Executes dropped EXE
PID:944 -
\??\c:\fjjnfv.exec:\fjjnfv.exe18⤵
- Executes dropped EXE
PID:1900 -
\??\c:\hxjtbr.exec:\hxjtbr.exe19⤵
- Executes dropped EXE
PID:1556 -
\??\c:\plvxhp.exec:\plvxhp.exe20⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vjdpbb.exec:\vjdpbb.exe21⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rjfttvf.exec:\rjfttvf.exe22⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lpbxnrn.exec:\lpbxnrn.exe23⤵
- Executes dropped EXE
PID:2664 -
\??\c:\dnptx.exec:\dnptx.exe24⤵
- Executes dropped EXE
PID:440 -
\??\c:\drdjfrr.exec:\drdjfrr.exe25⤵
- Executes dropped EXE
PID:840 -
\??\c:\tndfpnh.exec:\tndfpnh.exe26⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rlnfvhl.exec:\rlnfvhl.exe27⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jhptnbp.exec:\jhptnbp.exe28⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xjlxh.exec:\xjlxh.exe29⤵
- Executes dropped EXE
PID:976 -
\??\c:\hphhb.exec:\hphhb.exe30⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tvjjffl.exec:\tvjjffl.exe31⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rhvfp.exec:\rhvfp.exe32⤵
- Executes dropped EXE
PID:1240 -
\??\c:\prhvhft.exec:\prhvhft.exe33⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nxbdvvl.exec:\nxbdvvl.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rrtnr.exec:\rrtnr.exe35⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rjphd.exec:\rjphd.exe36⤵
- Executes dropped EXE
PID:1096 -
\??\c:\fvtrphd.exec:\fvtrphd.exe37⤵
- Executes dropped EXE
PID:2444 -
\??\c:\plbnpd.exec:\plbnpd.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\jpvtlpl.exec:\jpvtlpl.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\dlpdlv.exec:\dlpdlv.exe40⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hxtlx.exec:\hxtlx.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nnhvblv.exec:\nnhvblv.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fnntxd.exec:\fnntxd.exe43⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lrpnjt.exec:\lrpnjt.exe44⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vljhx.exec:\vljhx.exe45⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xhpfjjr.exec:\xhpfjjr.exe46⤵
- Executes dropped EXE
PID:764 -
\??\c:\pbbnt.exec:\pbbnt.exe47⤵
- Executes dropped EXE
PID:1256 -
\??\c:\djjlh.exec:\djjlh.exe48⤵
- Executes dropped EXE
PID:1764 -
\??\c:\pbnffth.exec:\pbnffth.exe49⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pthvd.exec:\pthvd.exe50⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ddjrp.exec:\ddjrp.exe51⤵
- Executes dropped EXE
PID:836 -
\??\c:\rvdtnll.exec:\rvdtnll.exe52⤵
- Executes dropped EXE
PID:308 -
\??\c:\dvvxdh.exec:\dvvxdh.exe53⤵
- Executes dropped EXE
PID:1964 -
\??\c:\dvrhdt.exec:\dvrhdt.exe54⤵
- Executes dropped EXE
PID:2228 -
\??\c:\hrjhprh.exec:\hrjhprh.exe55⤵
- Executes dropped EXE
PID:1552 -
\??\c:\dxhnbr.exec:\dxhnbr.exe56⤵
- Executes dropped EXE
PID:1436 -
\??\c:\xnfjntt.exec:\xnfjntt.exe57⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bvtbbb.exec:\bvtbbb.exe58⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dnjvtbj.exec:\dnjvtbj.exe59⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bfjrfp.exec:\bfjrfp.exe60⤵
- Executes dropped EXE
PID:380 -
\??\c:\ppjhp.exec:\ppjhp.exe61⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jttnf.exec:\jttnf.exe62⤵
- Executes dropped EXE
PID:844 -
\??\c:\pjrhtrh.exec:\pjrhtrh.exe63⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vvxbrnd.exec:\vvxbrnd.exe64⤵
- Executes dropped EXE
PID:840 -
\??\c:\rlvxpt.exec:\rlvxpt.exe65⤵
- Executes dropped EXE
PID:1252 -
\??\c:\xvlxjnx.exec:\xvlxjnx.exe66⤵PID:1520
-
\??\c:\jbpdv.exec:\jbpdv.exe67⤵PID:1180
-
\??\c:\txbdb.exec:\txbdb.exe68⤵PID:2992
-
\??\c:\xjvpfvl.exec:\xjvpfvl.exe69⤵PID:2744
-
\??\c:\jrrvll.exec:\jrrvll.exe70⤵PID:3008
-
\??\c:\jxvxttl.exec:\jxvxttl.exe71⤵PID:2812
-
\??\c:\hxhlpfd.exec:\hxhlpfd.exe72⤵PID:1240
-
\??\c:\vfjldn.exec:\vfjldn.exe73⤵PID:2976
-
\??\c:\fpdblj.exec:\fpdblj.exe74⤵PID:852
-
\??\c:\tfvjjbf.exec:\tfvjjbf.exe75⤵PID:2248
-
\??\c:\bnbld.exec:\bnbld.exe76⤵PID:1960
-
\??\c:\tdvjvf.exec:\tdvjvf.exe77⤵PID:2540
-
\??\c:\ldfnb.exec:\ldfnb.exe78⤵PID:1536
-
\??\c:\fvtvh.exec:\fvtvh.exe79⤵PID:2456
-
\??\c:\prvbv.exec:\prvbv.exe80⤵PID:2548
-
\??\c:\ffhnffr.exec:\ffhnffr.exe81⤵PID:1708
-
\??\c:\nbbffj.exec:\nbbffj.exe82⤵PID:2604
-
\??\c:\jhvxnhh.exec:\jhvxnhh.exe83⤵PID:2536
-
\??\c:\ndvxtld.exec:\ndvxtld.exe84⤵PID:2472
-
\??\c:\vlxfpl.exec:\vlxfpl.exe85⤵PID:2464
-
\??\c:\flllhxb.exec:\flllhxb.exe86⤵PID:2412
-
\??\c:\bfrfl.exec:\bfrfl.exe87⤵PID:584
-
\??\c:\tflltpn.exec:\tflltpn.exe88⤵PID:2404
-
\??\c:\vvrbd.exec:\vvrbd.exe89⤵PID:572
-
\??\c:\lbfvhr.exec:\lbfvhr.exe90⤵PID:1984
-
\??\c:\pjhrrnv.exec:\pjhrrnv.exe91⤵PID:2220
-
\??\c:\dffrrt.exec:\dffrrt.exe92⤵PID:2204
-
\??\c:\ldvdbnn.exec:\ldvdbnn.exe93⤵PID:1832
-
\??\c:\nnjlb.exec:\nnjlb.exe94⤵PID:2208
-
\??\c:\tdhnpnv.exec:\tdhnpnv.exe95⤵PID:1840
-
\??\c:\dnnjrf.exec:\dnnjrf.exe96⤵PID:1908
-
\??\c:\ttbvfdd.exec:\ttbvfdd.exe97⤵PID:944
-
\??\c:\rlxrb.exec:\rlxrb.exe98⤵PID:1592
-
\??\c:\xfhjt.exec:\xfhjt.exe99⤵PID:1576
-
\??\c:\rldvd.exec:\rldvd.exe100⤵PID:1436
-
\??\c:\fjbrnd.exec:\fjbrnd.exe101⤵PID:2388
-
\??\c:\bdbnpnf.exec:\bdbnpnf.exe102⤵PID:2640
-
\??\c:\vtfnptr.exec:\vtfnptr.exe103⤵PID:912
-
\??\c:\txfldd.exec:\txfldd.exe104⤵PID:2676
-
\??\c:\rplhnp.exec:\rplhnp.exe105⤵PID:1800
-
\??\c:\txjphp.exec:\txjphp.exe106⤵PID:1904
-
\??\c:\prlvfdv.exec:\prlvfdv.exe107⤵PID:676
-
\??\c:\tvvtptn.exec:\tvvtptn.exe108⤵PID:980
-
\??\c:\nfdlj.exec:\nfdlj.exe109⤵PID:1932
-
\??\c:\vdtphnd.exec:\vdtphnd.exe110⤵PID:2064
-
\??\c:\fltnjdv.exec:\fltnjdv.exe111⤵PID:2184
-
\??\c:\jttjn.exec:\jttjn.exe112⤵PID:2972
-
\??\c:\xvvpj.exec:\xvvpj.exe113⤵PID:1044
-
\??\c:\nthjl.exec:\nthjl.exe114⤵PID:2836
-
\??\c:\trlvd.exec:\trlvd.exe115⤵PID:1540
-
\??\c:\dvrpntx.exec:\dvrpntx.exe116⤵PID:1508
-
\??\c:\lxxrdxn.exec:\lxxrdxn.exe117⤵PID:2820
-
\??\c:\bvlrl.exec:\bvlrl.exe118⤵PID:1736
-
\??\c:\bbxfrl.exec:\bbxfrl.exe119⤵PID:2072
-
\??\c:\hdhbhhh.exec:\hdhbhhh.exe120⤵PID:2248
-
\??\c:\vbdlfhn.exec:\vbdlfhn.exe121⤵PID:1632
-
\??\c:\bbbnv.exec:\bbbnv.exe122⤵PID:2436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-