Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 04:07
Behavioral task
behavioral1
Sample
dd9fed63d002946d36344b00681be29e53cadfaa64f1fe47794c60705204b9b5.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
dd9fed63d002946d36344b00681be29e53cadfaa64f1fe47794c60705204b9b5.exe
-
Size
275KB
-
MD5
3da3150a505252aee5fecf958daaedaa
-
SHA1
8d51a5ba51740a99e699d6fa16e0b262785011d0
-
SHA256
dd9fed63d002946d36344b00681be29e53cadfaa64f1fe47794c60705204b9b5
-
SHA512
39e6ec6811de36127337a7781fb713cb87ef1687434cffa6a8505d8d660b4a4db46683d125888ebf8ddbb4303a98bde4abe44025af90022fe5b8e9da85998ffd
-
SSDEEP
6144:ncm4FmowdHoS6rW3NNTvBu6wo2J4JAgNXkArR/rtXOLtu4J6KvvLp3OKtUuuuTE/:14wFHoSeM/Tpu6w14JAOkIRhOBu4Jhvc
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1284-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-153-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2652-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-284-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1136-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-359-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2756-367-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-410-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1388-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-456-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-462-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1324-637-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-652-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2160-665-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-806-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/656-820-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1036-1041-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/1284-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1284-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x000b000000014b6d-8.dat UPX behavioral1/memory/3020-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x002e000000015364-16.dat UPX behavioral1/memory/2516-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x000800000001560a-23.dat UPX behavioral1/memory/2528-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0007000000015a2d-35.dat UPX behavioral1/memory/2528-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0007000000015a98-43.dat UPX behavioral1/memory/2576-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0009000000015c0d-52.dat UPX behavioral1/memory/2512-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2512-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0009000000015e5b-60.dat UPX behavioral1/files/0x000f0000000155d4-73.dat UPX behavioral1/memory/2592-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3040-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d41-83.dat UPX behavioral1/memory/1208-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d4a-91.dat UPX behavioral1/files/0x0006000000016d4f-101.dat UPX behavioral1/memory/1804-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1652-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d55-109.dat UPX behavioral1/memory/1608-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d84-117.dat UPX behavioral1/memory/2640-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d89-127.dat UPX behavioral1/memory/756-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016e56-136.dat UPX behavioral1/files/0x000600000001704f-144.dat UPX behavioral1/files/0x0006000000017090-154.dat UPX behavioral1/files/0x000500000001868c-162.dat UPX behavioral1/files/0x0005000000018698-171.dat UPX behavioral1/memory/2652-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x00050000000186a0-182.dat UPX behavioral1/files/0x0006000000018ae2-189.dat UPX behavioral1/memory/372-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000018ae8-200.dat UPX behavioral1/files/0x0006000000018b15-208.dat UPX behavioral1/memory/2148-216-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000018b33-217.dat UPX behavioral1/memory/3036-227-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000018b37-226.dat UPX behavioral1/memory/2028-236-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000018b42-235.dat UPX behavioral1/files/0x0006000000018b4a-244.dat UPX behavioral1/files/0x0006000000018b6a-253.dat UPX behavioral1/files/0x0006000000018b73-261.dat UPX behavioral1/memory/1164-271-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000018b96-270.dat UPX behavioral1/files/0x0006000000018ba2-280.dat UPX behavioral1/files/0x0006000000018d06-289.dat UPX behavioral1/memory/1136-297-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2144-311-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2972-338-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2688-345-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2672-352-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-367-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2496-385-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-394-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3020 fvrjp.exe 2516 rrhxbn.exe 2528 blhjd.exe 2576 rjjnpn.exe 2752 ljlpr.exe 2512 rdlnv.exe 2592 xlnnl.exe 3040 dlldlxr.exe 1208 nbnpbf.exe 1652 hfvjfl.exe 1804 hlprd.exe 1608 bpprllj.exe 2640 fjfxxhj.exe 756 hxhnj.exe 1524 lfhnn.exe 840 ldfxdr.exe 1996 vdjrjn.exe 1724 rhpxnhr.exe 2652 lxbxvpr.exe 2212 rldxhpv.exe 372 phvlv.exe 780 pfljvvp.exe 2148 rjtbxhf.exe 3036 rptdpxr.exe 2028 ffrfv.exe 1156 rnvrjrb.exe 1376 bpvrr.exe 1476 vrppxnr.exe 2784 fhdhf.exe 1164 hjfjjvb.exe 2836 vxppn.exe 1136 xpjhnpx.exe 284 thhbh.exe 2144 rjrjnx.exe 2244 pfhrhhl.exe 2308 rndvnf.exe 2504 xtndl.exe 2972 tjnlx.exe 2688 fpvfbx.exe 2672 rvdxvl.exe 2728 btnnlrx.exe 2740 tjlnj.exe 2756 vlpnldv.exe 2692 ttjvhj.exe 2496 jjhrf.exe 2592 fjdbvt.exe 3040 btrjbxt.exe 1208 ptbxfhv.exe 1388 dbrpv.exe 904 lhpnt.exe 2712 hndld.exe 1276 pjdpxb.exe 292 rtljjn.exe 1920 rxdnl.exe 1240 ntnnr.exe 2120 hflbf.exe 1848 vxtjxlx.exe 2660 fjjbxn.exe 1724 pnbth.exe 1040 rrjlrn.exe 832 ltdnlhf.exe 2664 vbhrhhr.exe 2044 drvxlx.exe 2968 rddxd.exe -
resource yara_rule behavioral1/memory/1284-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000b000000014b6d-8.dat upx behavioral1/memory/3020-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x002e000000015364-16.dat upx behavioral1/memory/2516-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000800000001560a-23.dat upx behavioral1/memory/2528-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000015a2d-35.dat upx behavioral1/memory/2528-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000015a98-43.dat upx behavioral1/memory/2576-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0009000000015c0d-52.dat upx behavioral1/memory/2512-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0009000000015e5b-60.dat upx behavioral1/files/0x000f0000000155d4-73.dat upx behavioral1/memory/2592-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d41-83.dat upx behavioral1/memory/1208-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d4a-91.dat upx behavioral1/files/0x0006000000016d4f-101.dat upx behavioral1/memory/1804-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d55-109.dat upx behavioral1/memory/1608-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d84-117.dat upx behavioral1/memory/2640-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d89-127.dat upx behavioral1/memory/756-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016e56-136.dat upx behavioral1/files/0x000600000001704f-144.dat upx behavioral1/files/0x0006000000017090-154.dat upx behavioral1/files/0x000500000001868c-162.dat upx behavioral1/files/0x0005000000018698-171.dat upx behavioral1/memory/2652-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x00050000000186a0-182.dat upx behavioral1/files/0x0006000000018ae2-189.dat upx behavioral1/memory/372-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018ae8-200.dat upx behavioral1/files/0x0006000000018b15-208.dat upx behavioral1/memory/2148-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018b33-217.dat upx behavioral1/memory/3036-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018b37-226.dat upx behavioral1/memory/2028-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018b42-235.dat upx behavioral1/files/0x0006000000018b4a-244.dat upx behavioral1/files/0x0006000000018b6a-253.dat upx behavioral1/files/0x0006000000018b73-261.dat upx behavioral1/memory/1164-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000018b96-270.dat upx behavioral1/files/0x0006000000018ba2-280.dat upx behavioral1/files/0x0006000000018d06-289.dat upx behavioral1/memory/1136-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-394-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1284 wrote to memory of 3020 1284 dd9fed63d002946d36344b00681be29e53cadfaa64f1fe47794c60705204b9b5.exe 28 PID 1284 wrote to memory of 3020 1284 dd9fed63d002946d36344b00681be29e53cadfaa64f1fe47794c60705204b9b5.exe 28 PID 1284 wrote to memory of 3020 1284 dd9fed63d002946d36344b00681be29e53cadfaa64f1fe47794c60705204b9b5.exe 28 PID 1284 wrote to memory of 3020 1284 dd9fed63d002946d36344b00681be29e53cadfaa64f1fe47794c60705204b9b5.exe 28 PID 3020 wrote to memory of 2516 3020 fvrjp.exe 29 PID 3020 wrote to memory of 2516 3020 fvrjp.exe 29 PID 3020 wrote to memory of 2516 3020 fvrjp.exe 29 PID 3020 wrote to memory of 2516 3020 fvrjp.exe 29 PID 2516 wrote to memory of 2528 2516 rrhxbn.exe 30 PID 2516 wrote to memory of 2528 2516 rrhxbn.exe 30 PID 2516 wrote to memory of 2528 2516 rrhxbn.exe 30 PID 2516 wrote to memory of 2528 2516 rrhxbn.exe 30 PID 2528 wrote to memory of 2576 2528 blhjd.exe 31 PID 2528 wrote to memory of 2576 2528 blhjd.exe 31 PID 2528 wrote to memory of 2576 2528 blhjd.exe 31 PID 2528 wrote to memory of 2576 2528 blhjd.exe 31 PID 2576 wrote to memory of 2752 2576 rjjnpn.exe 32 PID 2576 wrote to memory of 2752 2576 rjjnpn.exe 32 PID 2576 wrote to memory of 2752 2576 rjjnpn.exe 32 PID 2576 wrote to memory of 2752 2576 rjjnpn.exe 32 PID 2752 wrote to memory of 2512 2752 ljlpr.exe 33 PID 2752 wrote to memory of 2512 2752 ljlpr.exe 33 PID 2752 wrote to memory of 2512 2752 ljlpr.exe 33 PID 2752 wrote to memory of 2512 2752 ljlpr.exe 33 PID 2512 wrote to memory of 2592 2512 rdlnv.exe 34 PID 2512 wrote to memory of 2592 2512 rdlnv.exe 34 PID 2512 wrote to memory of 2592 2512 rdlnv.exe 34 PID 2512 wrote to memory of 2592 2512 rdlnv.exe 34 PID 2592 wrote to memory of 3040 2592 xlnnl.exe 35 PID 2592 wrote to memory of 3040 2592 xlnnl.exe 35 PID 2592 wrote to memory of 3040 2592 xlnnl.exe 35 PID 2592 wrote to memory of 3040 2592 xlnnl.exe 35 PID 3040 wrote to memory of 1208 3040 dlldlxr.exe 36 PID 3040 wrote to memory of 1208 3040 dlldlxr.exe 36 PID 3040 wrote to memory of 1208 3040 dlldlxr.exe 36 PID 3040 wrote to memory of 1208 3040 dlldlxr.exe 36 PID 1208 wrote to memory of 1652 1208 nbnpbf.exe 37 PID 1208 wrote to memory of 1652 1208 nbnpbf.exe 37 PID 1208 wrote to memory of 1652 1208 nbnpbf.exe 37 PID 1208 wrote to memory of 1652 1208 nbnpbf.exe 37 PID 1652 wrote to memory of 1804 1652 hfvjfl.exe 38 PID 1652 wrote to memory of 1804 1652 hfvjfl.exe 38 PID 1652 wrote to memory of 1804 1652 hfvjfl.exe 38 PID 1652 wrote to memory of 1804 1652 hfvjfl.exe 38 PID 1804 wrote to memory of 1608 1804 hlprd.exe 39 PID 1804 wrote to memory of 1608 1804 hlprd.exe 39 PID 1804 wrote to memory of 1608 1804 hlprd.exe 39 PID 1804 wrote to memory of 1608 1804 hlprd.exe 39 PID 1608 wrote to memory of 2640 1608 bpprllj.exe 40 PID 1608 wrote to memory of 2640 1608 bpprllj.exe 40 PID 1608 wrote to memory of 2640 1608 bpprllj.exe 40 PID 1608 wrote to memory of 2640 1608 bpprllj.exe 40 PID 2640 wrote to memory of 756 2640 fjfxxhj.exe 41 PID 2640 wrote to memory of 756 2640 fjfxxhj.exe 41 PID 2640 wrote to memory of 756 2640 fjfxxhj.exe 41 PID 2640 wrote to memory of 756 2640 fjfxxhj.exe 41 PID 756 wrote to memory of 1524 756 hxhnj.exe 42 PID 756 wrote to memory of 1524 756 hxhnj.exe 42 PID 756 wrote to memory of 1524 756 hxhnj.exe 42 PID 756 wrote to memory of 1524 756 hxhnj.exe 42 PID 1524 wrote to memory of 840 1524 lfhnn.exe 43 PID 1524 wrote to memory of 840 1524 lfhnn.exe 43 PID 1524 wrote to memory of 840 1524 lfhnn.exe 43 PID 1524 wrote to memory of 840 1524 lfhnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd9fed63d002946d36344b00681be29e53cadfaa64f1fe47794c60705204b9b5.exe"C:\Users\Admin\AppData\Local\Temp\dd9fed63d002946d36344b00681be29e53cadfaa64f1fe47794c60705204b9b5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\fvrjp.exec:\fvrjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\rrhxbn.exec:\rrhxbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\blhjd.exec:\blhjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\rjjnpn.exec:\rjjnpn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ljlpr.exec:\ljlpr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\rdlnv.exec:\rdlnv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xlnnl.exec:\xlnnl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\dlldlxr.exec:\dlldlxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\nbnpbf.exec:\nbnpbf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\hfvjfl.exec:\hfvjfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\hlprd.exec:\hlprd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\bpprllj.exec:\bpprllj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\fjfxxhj.exec:\fjfxxhj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hxhnj.exec:\hxhnj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\lfhnn.exec:\lfhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\ldfxdr.exec:\ldfxdr.exe17⤵
- Executes dropped EXE
PID:840 -
\??\c:\vdjrjn.exec:\vdjrjn.exe18⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rhpxnhr.exec:\rhpxnhr.exe19⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lxbxvpr.exec:\lxbxvpr.exe20⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rldxhpv.exec:\rldxhpv.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\phvlv.exec:\phvlv.exe22⤵
- Executes dropped EXE
PID:372 -
\??\c:\pfljvvp.exec:\pfljvvp.exe23⤵
- Executes dropped EXE
PID:780 -
\??\c:\rjtbxhf.exec:\rjtbxhf.exe24⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rptdpxr.exec:\rptdpxr.exe25⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ffrfv.exec:\ffrfv.exe26⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rnvrjrb.exec:\rnvrjrb.exe27⤵
- Executes dropped EXE
PID:1156 -
\??\c:\bpvrr.exec:\bpvrr.exe28⤵
- Executes dropped EXE
PID:1376 -
\??\c:\vrppxnr.exec:\vrppxnr.exe29⤵
- Executes dropped EXE
PID:1476 -
\??\c:\fhdhf.exec:\fhdhf.exe30⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hjfjjvb.exec:\hjfjjvb.exe31⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vxppn.exec:\vxppn.exe32⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xpjhnpx.exec:\xpjhnpx.exe33⤵
- Executes dropped EXE
PID:1136 -
\??\c:\thhbh.exec:\thhbh.exe34⤵
- Executes dropped EXE
PID:284 -
\??\c:\rjrjnx.exec:\rjrjnx.exe35⤵
- Executes dropped EXE
PID:2144 -
\??\c:\pfhrhhl.exec:\pfhrhhl.exe36⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rndvnf.exec:\rndvnf.exe37⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xtndl.exec:\xtndl.exe38⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tjnlx.exec:\tjnlx.exe39⤵
- Executes dropped EXE
PID:2972 -
\??\c:\fpvfbx.exec:\fpvfbx.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rvdxvl.exec:\rvdxvl.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\btnnlrx.exec:\btnnlrx.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\tjlnj.exec:\tjlnj.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vlpnldv.exec:\vlpnldv.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ttjvhj.exec:\ttjvhj.exe45⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jjhrf.exec:\jjhrf.exe46⤵
- Executes dropped EXE
PID:2496 -
\??\c:\fjdbvt.exec:\fjdbvt.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\btrjbxt.exec:\btrjbxt.exe48⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ptbxfhv.exec:\ptbxfhv.exe49⤵
- Executes dropped EXE
PID:1208 -
\??\c:\dbrpv.exec:\dbrpv.exe50⤵
- Executes dropped EXE
PID:1388 -
\??\c:\lhpnt.exec:\lhpnt.exe51⤵
- Executes dropped EXE
PID:904 -
\??\c:\hndld.exec:\hndld.exe52⤵
- Executes dropped EXE
PID:2712 -
\??\c:\pjdpxb.exec:\pjdpxb.exe53⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rtljjn.exec:\rtljjn.exe54⤵
- Executes dropped EXE
PID:292 -
\??\c:\rxdnl.exec:\rxdnl.exe55⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ntnnr.exec:\ntnnr.exe56⤵
- Executes dropped EXE
PID:1240 -
\??\c:\hflbf.exec:\hflbf.exe57⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vxtjxlx.exec:\vxtjxlx.exe58⤵
- Executes dropped EXE
PID:1848 -
\??\c:\fjjbxn.exec:\fjjbxn.exe59⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pnbth.exec:\pnbth.exe60⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rrjlrn.exec:\rrjlrn.exe61⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ltdnlhf.exec:\ltdnlhf.exe62⤵
- Executes dropped EXE
PID:832 -
\??\c:\vbhrhhr.exec:\vbhrhhr.exe63⤵
- Executes dropped EXE
PID:2664 -
\??\c:\drvxlx.exec:\drvxlx.exe64⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rddxd.exec:\rddxd.exe65⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vxphpt.exec:\vxphpt.exe66⤵PID:1712
-
\??\c:\hpjvnn.exec:\hpjvnn.exe67⤵PID:400
-
\??\c:\vnbjvxr.exec:\vnbjvxr.exe68⤵PID:2072
-
\??\c:\lnprpbx.exec:\lnprpbx.exe69⤵PID:1844
-
\??\c:\thrjpxt.exec:\thrjpxt.exe70⤵PID:772
-
\??\c:\vnxpnb.exec:\vnxpnb.exe71⤵PID:1256
-
\??\c:\txxdtxr.exec:\txxdtxr.exe72⤵PID:1660
-
\??\c:\jvfhhrh.exec:\jvfhhrh.exe73⤵PID:1612
-
\??\c:\ddfjvp.exec:\ddfjvp.exe74⤵PID:964
-
\??\c:\dvxhjxj.exec:\dvxhjxj.exe75⤵PID:2840
-
\??\c:\hnvld.exec:\hnvld.exe76⤵PID:2176
-
\??\c:\xrptvd.exec:\xrptvd.exe77⤵PID:2872
-
\??\c:\pnrjx.exec:\pnrjx.exe78⤵PID:2248
-
\??\c:\jlhpj.exec:\jlhpj.exe79⤵PID:1912
-
\??\c:\nrbtrrj.exec:\nrbtrrj.exe80⤵PID:876
-
\??\c:\tjtlx.exec:\tjtlx.exe81⤵PID:2760
-
\??\c:\pnpjxxb.exec:\pnpjxxb.exe82⤵PID:1576
-
\??\c:\lbtxpj.exec:\lbtxpj.exe83⤵PID:2032
-
\??\c:\vjxfn.exec:\vjxfn.exe84⤵PID:1324
-
\??\c:\lbftbx.exec:\lbftbx.exe85⤵PID:2532
-
\??\c:\ppjhp.exec:\ppjhp.exe86⤵PID:2696
-
\??\c:\bvnjhd.exec:\bvnjhd.exe87⤵PID:2548
-
\??\c:\lhhprh.exec:\lhhprh.exe88⤵PID:2160
-
\??\c:\ftvxn.exec:\ftvxn.exe89⤵PID:2616
-
\??\c:\fpxvrhp.exec:\fpxvrhp.exe90⤵PID:2224
-
\??\c:\nxxjh.exec:\nxxjh.exe91⤵PID:2512
-
\??\c:\ffvrrxp.exec:\ffvrrxp.exe92⤵PID:2500
-
\??\c:\nnvrj.exec:\nnvrj.exe93⤵PID:860
-
\??\c:\nhbjl.exec:\nhbjl.exe94⤵PID:1080
-
\??\c:\dpftxb.exec:\dpftxb.exe95⤵PID:1552
-
\??\c:\jnfbjj.exec:\jnfbjj.exe96⤵PID:1732
-
\??\c:\djlfvrb.exec:\djlfvrb.exe97⤵PID:1860
-
\??\c:\hhfrl.exec:\hhfrl.exe98⤵PID:2656
-
\??\c:\lrnpnlf.exec:\lrnpnlf.exe99⤵PID:2712
-
\??\c:\jrjrfvb.exec:\jrjrfvb.exe100⤵PID:1036
-
\??\c:\nldxjd.exec:\nldxjd.exe101⤵PID:2636
-
\??\c:\nrjnfjl.exec:\nrjnfjl.exe102⤵PID:644
-
\??\c:\nvjhj.exec:\nvjhj.exe103⤵PID:1524
-
\??\c:\jjrnp.exec:\jjrnp.exe104⤵PID:2132
-
\??\c:\hnbnj.exec:\hnbnj.exe105⤵PID:1104
-
\??\c:\fhhxljh.exec:\fhhxljh.exe106⤵PID:2064
-
\??\c:\npvrfrf.exec:\npvrfrf.exe107⤵PID:2652
-
\??\c:\dvdjp.exec:\dvdjp.exe108⤵PID:1456
-
\??\c:\bbvnjxx.exec:\bbvnjxx.exe109⤵PID:2288
-
\??\c:\htdhpjx.exec:\htdhpjx.exe110⤵PID:2612
-
\??\c:\phdtbff.exec:\phdtbff.exe111⤵PID:3032
-
\??\c:\vlvnv.exec:\vlvnv.exe112⤵PID:656
-
\??\c:\dhbjvp.exec:\dhbjvp.exe113⤵PID:936
-
\??\c:\nrrnhxd.exec:\nrrnhxd.exe114⤵PID:2024
-
\??\c:\xffth.exec:\xffth.exe115⤵PID:2072
-
\??\c:\bvrnnf.exec:\bvrnnf.exe116⤵PID:1364
-
\??\c:\jhdxd.exec:\jhdxd.exe117⤵PID:1500
-
\??\c:\lhvvbtv.exec:\lhvvbtv.exe118⤵PID:1916
-
\??\c:\lrrdt.exec:\lrrdt.exe119⤵PID:1476
-
\??\c:\lvhtfv.exec:\lvhtfv.exe120⤵PID:712
-
\??\c:\hljnt.exec:\hljnt.exe121⤵PID:616
-
\??\c:\ptntbfv.exec:\ptntbfv.exe122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-