Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 05:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f1a77ba407e831d4eddb3854afcd86dea9e65723dac132f4e47bfc5a515b7baf.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
f1a77ba407e831d4eddb3854afcd86dea9e65723dac132f4e47bfc5a515b7baf.exe
-
Size
67KB
-
MD5
6cf632e36500a938f95688f72c819adf
-
SHA1
be33ef4afb4c3c383fd9e5e0cd2b0926d168800f
-
SHA256
f1a77ba407e831d4eddb3854afcd86dea9e65723dac132f4e47bfc5a515b7baf
-
SHA512
4706a62ef52b8ccc0e378f97ddc5cdb8cefb66f9029568e74059cba8e464ff84698e564dce42bf166df34e1901c8e99d0b4cbd6f5c6cb3e0f842f664c8e0c59b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJ/RWPqBjfjBL:ymb3NkkiQ3mdBjFIqsj9L
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2732-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1372-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/784-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral1/memory/2732-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2852-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2772-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2792-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2716-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/320-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1888-282-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1028-264-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1372-256-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1512-246-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/784-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1516-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2328-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2196-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2184-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1964-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2972-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2416-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2868-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2852 9vpjp.exe 2772 xlxflll.exe 2568 nthbhh.exe 2792 ttnnbh.exe 2716 pvvdv.exe 2756 dvjdd.exe 2700 9rllrrx.exe 2520 7rrxlrf.exe 2868 thbbbh.exe 2416 thtttb.exe 2624 thnhnt.exe 2972 pjdjp.exe 320 1ddpd.exe 1964 3fxfrlr.exe 2184 rfrlrxf.exe 2196 tnhhtt.exe 2328 tbtnbt.exe 1516 3hthtn.exe 2280 pjdpj.exe 2244 pjdjp.exe 2532 3llflrr.exe 2812 rfrxllr.exe 784 tnbbhb.exe 892 thbtbb.exe 1868 ttntbb.exe 1512 1pdjv.exe 1372 fxlxffr.exe 1028 xlfxffr.exe 708 tthtbb.exe 1888 7bttbb.exe 1376 hbnttb.exe 896 7vdpd.exe 2068 vppdd.exe 2840 pjdjp.exe 1580 rlrfflf.exe 2152 lfrxrxl.exe 2664 nhnthb.exe 2688 hnhhtn.exe 2580 pjpvp.exe 2476 9rlffll.exe 2716 lffxxrx.exe 2464 fxlxlfl.exe 2508 tnbhhb.exe 2384 tnttbt.exe 2744 djpdd.exe 2676 pjjvd.exe 2860 pjvdj.exe 1588 5lxrfxf.exe 820 5xrrfll.exe 1668 nbnhhb.exe 1956 nbnhnn.exe 1552 nhthhn.exe 2680 9vvpp.exe 1628 7jdvd.exe 2328 tbntbt.exe 1516 tnnbbb.exe 1232 pjdjp.exe 2816 vvjdd.exe 536 ffxlfrl.exe 1984 bnhntn.exe 936 btnhnn.exe 1564 pjjdj.exe 3036 7pvpv.exe 2420 1fffrxl.exe -
resource yara_rule behavioral1/memory/2732-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-76-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2852 2732 f1a77ba407e831d4eddb3854afcd86dea9e65723dac132f4e47bfc5a515b7baf.exe 28 PID 2732 wrote to memory of 2852 2732 f1a77ba407e831d4eddb3854afcd86dea9e65723dac132f4e47bfc5a515b7baf.exe 28 PID 2732 wrote to memory of 2852 2732 f1a77ba407e831d4eddb3854afcd86dea9e65723dac132f4e47bfc5a515b7baf.exe 28 PID 2732 wrote to memory of 2852 2732 f1a77ba407e831d4eddb3854afcd86dea9e65723dac132f4e47bfc5a515b7baf.exe 28 PID 2852 wrote to memory of 2772 2852 9vpjp.exe 29 PID 2852 wrote to memory of 2772 2852 9vpjp.exe 29 PID 2852 wrote to memory of 2772 2852 9vpjp.exe 29 PID 2852 wrote to memory of 2772 2852 9vpjp.exe 29 PID 2772 wrote to memory of 2568 2772 xlxflll.exe 30 PID 2772 wrote to memory of 2568 2772 xlxflll.exe 30 PID 2772 wrote to memory of 2568 2772 xlxflll.exe 30 PID 2772 wrote to memory of 2568 2772 xlxflll.exe 30 PID 2568 wrote to memory of 2792 2568 nthbhh.exe 31 PID 2568 wrote to memory of 2792 2568 nthbhh.exe 31 PID 2568 wrote to memory of 2792 2568 nthbhh.exe 31 PID 2568 wrote to memory of 2792 2568 nthbhh.exe 31 PID 2792 wrote to memory of 2716 2792 ttnnbh.exe 68 PID 2792 wrote to memory of 2716 2792 ttnnbh.exe 68 PID 2792 wrote to memory of 2716 2792 ttnnbh.exe 68 PID 2792 wrote to memory of 2716 2792 ttnnbh.exe 68 PID 2716 wrote to memory of 2756 2716 pvvdv.exe 33 PID 2716 wrote to memory of 2756 2716 pvvdv.exe 33 PID 2716 wrote to memory of 2756 2716 pvvdv.exe 33 PID 2716 wrote to memory of 2756 2716 pvvdv.exe 33 PID 2756 wrote to memory of 2700 2756 dvjdd.exe 34 PID 2756 wrote to memory of 2700 2756 dvjdd.exe 34 PID 2756 wrote to memory of 2700 2756 dvjdd.exe 34 PID 2756 wrote to memory of 2700 2756 dvjdd.exe 34 PID 2700 wrote to memory of 2520 2700 9rllrrx.exe 35 PID 2700 wrote to memory of 2520 2700 9rllrrx.exe 35 PID 2700 wrote to memory of 2520 2700 9rllrrx.exe 35 PID 2700 wrote to memory of 2520 2700 9rllrrx.exe 35 PID 2520 wrote to memory of 2868 2520 7rrxlrf.exe 36 PID 2520 wrote to memory of 2868 2520 7rrxlrf.exe 36 PID 2520 wrote to memory of 2868 2520 7rrxlrf.exe 36 PID 2520 wrote to memory of 2868 2520 7rrxlrf.exe 36 PID 2868 wrote to memory of 2416 2868 thbbbh.exe 37 PID 2868 wrote to memory of 2416 2868 thbbbh.exe 37 PID 2868 wrote to memory of 2416 2868 thbbbh.exe 37 PID 2868 wrote to memory of 2416 2868 thbbbh.exe 37 PID 2416 wrote to memory of 2624 2416 thtttb.exe 38 PID 2416 wrote to memory of 2624 2416 thtttb.exe 38 PID 2416 wrote to memory of 2624 2416 thtttb.exe 38 PID 2416 wrote to memory of 2624 2416 thtttb.exe 38 PID 2624 wrote to memory of 2972 2624 thnhnt.exe 39 PID 2624 wrote to memory of 2972 2624 thnhnt.exe 39 PID 2624 wrote to memory of 2972 2624 thnhnt.exe 39 PID 2624 wrote to memory of 2972 2624 thnhnt.exe 39 PID 2972 wrote to memory of 320 2972 pjdjp.exe 40 PID 2972 wrote to memory of 320 2972 pjdjp.exe 40 PID 2972 wrote to memory of 320 2972 pjdjp.exe 40 PID 2972 wrote to memory of 320 2972 pjdjp.exe 40 PID 320 wrote to memory of 1964 320 1ddpd.exe 41 PID 320 wrote to memory of 1964 320 1ddpd.exe 41 PID 320 wrote to memory of 1964 320 1ddpd.exe 41 PID 320 wrote to memory of 1964 320 1ddpd.exe 41 PID 1964 wrote to memory of 2184 1964 3fxfrlr.exe 42 PID 1964 wrote to memory of 2184 1964 3fxfrlr.exe 42 PID 1964 wrote to memory of 2184 1964 3fxfrlr.exe 42 PID 1964 wrote to memory of 2184 1964 3fxfrlr.exe 42 PID 2184 wrote to memory of 2196 2184 rfrlrxf.exe 43 PID 2184 wrote to memory of 2196 2184 rfrlrxf.exe 43 PID 2184 wrote to memory of 2196 2184 rfrlrxf.exe 43 PID 2184 wrote to memory of 2196 2184 rfrlrxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1a77ba407e831d4eddb3854afcd86dea9e65723dac132f4e47bfc5a515b7baf.exe"C:\Users\Admin\AppData\Local\Temp\f1a77ba407e831d4eddb3854afcd86dea9e65723dac132f4e47bfc5a515b7baf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\9vpjp.exec:\9vpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\xlxflll.exec:\xlxflll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nthbhh.exec:\nthbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\ttnnbh.exec:\ttnnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pvvdv.exec:\pvvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\dvjdd.exec:\dvjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\9rllrrx.exec:\9rllrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\7rrxlrf.exec:\7rrxlrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\thbbbh.exec:\thbbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\thtttb.exec:\thtttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\thnhnt.exec:\thnhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pjdjp.exec:\pjdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\1ddpd.exec:\1ddpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\3fxfrlr.exec:\3fxfrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\rfrlrxf.exec:\rfrlrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\tnhhtt.exec:\tnhhtt.exe17⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tbtnbt.exec:\tbtnbt.exe18⤵
- Executes dropped EXE
PID:2328 -
\??\c:\3hthtn.exec:\3hthtn.exe19⤵
- Executes dropped EXE
PID:1516 -
\??\c:\pjdpj.exec:\pjdpj.exe20⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pjdjp.exec:\pjdjp.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3llflrr.exec:\3llflrr.exe22⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rfrxllr.exec:\rfrxllr.exe23⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tnbbhb.exec:\tnbbhb.exe24⤵
- Executes dropped EXE
PID:784 -
\??\c:\thbtbb.exec:\thbtbb.exe25⤵
- Executes dropped EXE
PID:892 -
\??\c:\ttntbb.exec:\ttntbb.exe26⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1pdjv.exec:\1pdjv.exe27⤵
- Executes dropped EXE
PID:1512 -
\??\c:\fxlxffr.exec:\fxlxffr.exe28⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xlfxffr.exec:\xlfxffr.exe29⤵
- Executes dropped EXE
PID:1028 -
\??\c:\tthtbb.exec:\tthtbb.exe30⤵
- Executes dropped EXE
PID:708 -
\??\c:\7bttbb.exec:\7bttbb.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hbnttb.exec:\hbnttb.exe32⤵
- Executes dropped EXE
PID:1376 -
\??\c:\7vdpd.exec:\7vdpd.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\vppdd.exec:\vppdd.exe34⤵
- Executes dropped EXE
PID:2068 -
\??\c:\pjdjp.exec:\pjdjp.exe35⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rlrfflf.exec:\rlrfflf.exe36⤵
- Executes dropped EXE
PID:1580 -
\??\c:\lfrxrxl.exec:\lfrxrxl.exe37⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nhnthb.exec:\nhnthb.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hnhhtn.exec:\hnhhtn.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjpvp.exec:\pjpvp.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9rlffll.exec:\9rlffll.exe41⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lffxxrx.exec:\lffxxrx.exe42⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fxlxlfl.exec:\fxlxlfl.exe43⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tnbhhb.exec:\tnbhhb.exe44⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tnttbt.exec:\tnttbt.exe45⤵
- Executes dropped EXE
PID:2384 -
\??\c:\djpdd.exec:\djpdd.exe46⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pjjvd.exec:\pjjvd.exe47⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pjvdj.exec:\pjvdj.exe48⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5lxrfxf.exec:\5lxrfxf.exe49⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5xrrfll.exec:\5xrrfll.exe50⤵
- Executes dropped EXE
PID:820 -
\??\c:\nbnhhb.exec:\nbnhhb.exe51⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nbnhnn.exec:\nbnhnn.exe52⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nhthhn.exec:\nhthhn.exe53⤵
- Executes dropped EXE
PID:1552 -
\??\c:\9vvpp.exec:\9vvpp.exe54⤵
- Executes dropped EXE
PID:2680 -
\??\c:\7jdvd.exec:\7jdvd.exe55⤵
- Executes dropped EXE
PID:1628 -
\??\c:\tbntbt.exec:\tbntbt.exe56⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tnnbbb.exec:\tnnbbb.exe57⤵
- Executes dropped EXE
PID:1516 -
\??\c:\pjdjp.exec:\pjdjp.exe58⤵
- Executes dropped EXE
PID:1232 -
\??\c:\vvjdd.exec:\vvjdd.exe59⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ffxlfrl.exec:\ffxlfrl.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\bnhntn.exec:\bnhntn.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\btnhnn.exec:\btnhnn.exe62⤵
- Executes dropped EXE
PID:936 -
\??\c:\pjjdj.exec:\pjjdj.exe63⤵
- Executes dropped EXE
PID:1564 -
\??\c:\7pvpv.exec:\7pvpv.exe64⤵
- Executes dropped EXE
PID:3036 -
\??\c:\1fffrxl.exec:\1fffrxl.exe65⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xxlrlxx.exec:\xxlrlxx.exe66⤵PID:2796
-
\??\c:\bnbbhb.exec:\bnbbhb.exe67⤵PID:2036
-
\??\c:\bnbttn.exec:\bnbttn.exe68⤵PID:1296
-
\??\c:\dpjvd.exec:\dpjvd.exe69⤵PID:2780
-
\??\c:\jdjpv.exec:\jdjpv.exe70⤵PID:792
-
\??\c:\9fxlrrx.exec:\9fxlrrx.exe71⤵PID:1888
-
\??\c:\fxfffll.exec:\fxfffll.exe72⤵PID:1708
-
\??\c:\thtttt.exec:\thtttt.exe73⤵PID:2896
-
\??\c:\hbhbbh.exec:\hbhbbh.exe74⤵PID:1648
-
\??\c:\1vjdd.exec:\1vjdd.exe75⤵PID:2848
-
\??\c:\xrrxxfl.exec:\xrrxxfl.exe76⤵PID:1616
-
\??\c:\3fxlrlx.exec:\3fxlrlx.exe77⤵PID:2344
-
\??\c:\lfrxxrf.exec:\lfrxxrf.exe78⤵PID:868
-
\??\c:\nbhhnn.exec:\nbhhnn.exe79⤵PID:2016
-
\??\c:\tttnbh.exec:\tttnbh.exe80⤵PID:2596
-
\??\c:\9vpvp.exec:\9vpvp.exe81⤵PID:2600
-
\??\c:\jdpjd.exec:\jdpjd.exe82⤵PID:2448
-
\??\c:\lxfffff.exec:\lxfffff.exe83⤵PID:2556
-
\??\c:\tnbtbt.exec:\tnbtbt.exe84⤵PID:2444
-
\??\c:\9tntnn.exec:\9tntnn.exe85⤵PID:2708
-
\??\c:\pvvjj.exec:\pvvjj.exe86⤵PID:3032
-
\??\c:\1dvdd.exec:\1dvdd.exe87⤵PID:2360
-
\??\c:\lflrfff.exec:\lflrfff.exe88⤵PID:1748
-
\??\c:\fxrfxxl.exec:\fxrfxxl.exe89⤵PID:2628
-
\??\c:\hntnht.exec:\hntnht.exe90⤵PID:2492
-
\??\c:\jpdjj.exec:\jpdjj.exe91⤵PID:380
-
\??\c:\jvdvd.exec:\jvdvd.exe92⤵PID:272
-
\??\c:\lrrlrlr.exec:\lrrlrlr.exe93⤵PID:2180
-
\??\c:\rfllllf.exec:\rfllllf.exe94⤵PID:2080
-
\??\c:\9nnntb.exec:\9nnntb.exe95⤵PID:1760
-
\??\c:\tnthhb.exec:\tnthhb.exe96⤵PID:2196
-
\??\c:\7tnthh.exec:\7tnthh.exe97⤵PID:1524
-
\??\c:\dvvpv.exec:\dvvpv.exe98⤵PID:2252
-
\??\c:\dpjvv.exec:\dpjvv.exe99⤵PID:2064
-
\??\c:\xlrlllr.exec:\xlrlllr.exe100⤵PID:2112
-
\??\c:\3frrrll.exec:\3frrrll.exe101⤵PID:2752
-
\??\c:\bthhnt.exec:\bthhnt.exe102⤵PID:304
-
\??\c:\jvjjj.exec:\jvjjj.exe103⤵PID:1480
-
\??\c:\ddpdj.exec:\ddpdj.exe104⤵PID:1104
-
\??\c:\5xrrxlx.exec:\5xrrxlx.exe105⤵PID:892
-
\??\c:\flrrrll.exec:\flrrrll.exe106⤵PID:2056
-
\??\c:\htbbhn.exec:\htbbhn.exe107⤵PID:1360
-
\??\c:\pjdvd.exec:\pjdvd.exe108⤵PID:1828
-
\??\c:\dvdjp.exec:\dvdjp.exe109⤵PID:1892
-
\??\c:\rfllrlr.exec:\rfllrlr.exe110⤵PID:2916
-
\??\c:\7frflfr.exec:\7frflfr.exe111⤵PID:564
-
\??\c:\nhtttb.exec:\nhtttb.exe112⤵PID:2060
-
\??\c:\9jddj.exec:\9jddj.exe113⤵PID:2072
-
\??\c:\9vdjj.exec:\9vdjj.exe114⤵PID:2336
-
\??\c:\frlffll.exec:\frlffll.exe115⤵PID:1324
-
\??\c:\ffrxxfx.exec:\ffrxxfx.exe116⤵PID:2068
-
\??\c:\ttnthb.exec:\ttnthb.exe117⤵PID:1604
-
\??\c:\nhtbtb.exec:\nhtbtb.exe118⤵PID:1716
-
\??\c:\nbhttt.exec:\nbhttt.exe119⤵PID:2820
-
\??\c:\pdpvj.exec:\pdpvj.exe120⤵PID:2660
-
\??\c:\ddpjj.exec:\ddpjj.exe121⤵PID:1304
-
\??\c:\fxrxllx.exec:\fxrxllx.exe122⤵PID:1504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-