Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe
-
Size
68KB
-
MD5
0d9ca127eb6fe79f5223884a92fc9590
-
SHA1
49d96a768fea752f3bfa0368ea7e464b05875aa0
-
SHA256
321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc
-
SHA512
c142970881f38b646c5d8161d2658d0e1a1342432b5aea4d26dbb4373f42ccb45592d0fe168625a8996402bcc35606138ba91ee9a0efab91e81547d9e61e329e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbY/O:ymb3NkkiQ3mdBjF0yjcsMW
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/3000-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-85-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrflxfr.exepjjpd.exe5xlrxxl.exebbthnh.exebthntt.exevjvvj.exelxflrrx.exerlxlxff.exe9htthh.exejdpvd.exe9jvjv.exe3rlfllr.exexrllflr.exe3ttbhn.exedvjjj.exevpdvj.exexrrxrrf.exerllrfxf.exe1ttbhh.exe9vpvj.exepjddp.exefrflxlx.exe9hnthn.exebthntn.exe1jvvp.exejdvjd.exellfrxxx.exethbbhh.exe3vjjp.exe3pddj.exerlxxlrl.exenhhtbn.exehtntbh.exe5pjvj.exe1jvvj.exevpvvj.exerffxxxl.exexrlrxrf.exebtbbnn.exethtbnn.exevjpvd.exe5pvdj.exerlxfrrx.exerlxxrlr.exebthbhh.exe1nbnhh.exevppvd.exe1pjpp.exerlflrxl.exerfxrllr.exebnbbbh.exetnhbnt.exe3jjdp.exevvpdj.exerrflllx.exehhtbnn.exe1tttht.exejdvjp.exe1rlrfrx.exe5btbnn.exenhthnn.exepvdvd.exedpjpp.exerfrrxxf.exepid process 2292 xrflxfr.exe 3044 pjjpd.exe 2744 5xlrxxl.exe 2340 bbthnh.exe 2652 bthntt.exe 2516 vjvvj.exe 2536 lxflrrx.exe 2404 rlxlxff.exe 2352 9htthh.exe 1352 jdpvd.exe 2716 9jvjv.exe 1856 3rlfllr.exe 1868 xrllflr.exe 1216 3ttbhn.exe 2272 dvjjj.exe 2156 vpdvj.exe 1432 xrrxrrf.exe 1520 rllrfxf.exe 2012 1ttbhh.exe 2032 9vpvj.exe 320 pjddp.exe 912 frflxlx.exe 1720 9hnthn.exe 1172 bthntn.exe 2996 1jvvp.exe 812 jdvjd.exe 900 llfrxxx.exe 1032 thbbhh.exe 2936 3vjjp.exe 2840 3pddj.exe 1240 rlxxlrl.exe 2880 nhhtbn.exe 1500 htntbh.exe 2992 5pjvj.exe 2244 1jvvj.exe 2612 vpvvj.exe 2832 rffxxxl.exe 2468 xrlrxrf.exe 2772 btbbnn.exe 2484 thtbnn.exe 2488 vjpvd.exe 2492 5pvdj.exe 2912 rlxfrrx.exe 2920 rlxxrlr.exe 316 bthbhh.exe 1632 1nbnhh.exe 2448 vppvd.exe 1772 1pjpp.exe 328 rlflrxl.exe 2376 rfxrllr.exe 1564 bnbbbh.exe 1888 tnhbnt.exe 2104 3jjdp.exe 1424 vvpdj.exe 2116 rrflllx.exe 1672 hhtbnn.exe 2800 1tttht.exe 2224 jdvjp.exe 2240 1rlrfrx.exe 2032 5btbnn.exe 1560 nhthnn.exe 2440 pvdvd.exe 1408 dpjpp.exe 608 rfrrxxf.exe -
Processes:
resource yara_rule behavioral1/memory/3000-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-285-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exexrflxfr.exepjjpd.exe5xlrxxl.exebbthnh.exebthntt.exevjvvj.exelxflrrx.exerlxlxff.exe9htthh.exejdpvd.exe9jvjv.exe3rlfllr.exexrllflr.exe3ttbhn.exedvjjj.exedescription pid process target process PID 3000 wrote to memory of 2292 3000 321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe xrflxfr.exe PID 3000 wrote to memory of 2292 3000 321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe xrflxfr.exe PID 3000 wrote to memory of 2292 3000 321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe xrflxfr.exe PID 3000 wrote to memory of 2292 3000 321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe xrflxfr.exe PID 2292 wrote to memory of 3044 2292 xrflxfr.exe pjjpd.exe PID 2292 wrote to memory of 3044 2292 xrflxfr.exe pjjpd.exe PID 2292 wrote to memory of 3044 2292 xrflxfr.exe pjjpd.exe PID 2292 wrote to memory of 3044 2292 xrflxfr.exe pjjpd.exe PID 3044 wrote to memory of 2744 3044 pjjpd.exe 5xlrxxl.exe PID 3044 wrote to memory of 2744 3044 pjjpd.exe 5xlrxxl.exe PID 3044 wrote to memory of 2744 3044 pjjpd.exe 5xlrxxl.exe PID 3044 wrote to memory of 2744 3044 pjjpd.exe 5xlrxxl.exe PID 2744 wrote to memory of 2340 2744 5xlrxxl.exe bbthnh.exe PID 2744 wrote to memory of 2340 2744 5xlrxxl.exe bbthnh.exe PID 2744 wrote to memory of 2340 2744 5xlrxxl.exe bbthnh.exe PID 2744 wrote to memory of 2340 2744 5xlrxxl.exe bbthnh.exe PID 2340 wrote to memory of 2652 2340 bbthnh.exe bthntt.exe PID 2340 wrote to memory of 2652 2340 bbthnh.exe bthntt.exe PID 2340 wrote to memory of 2652 2340 bbthnh.exe bthntt.exe PID 2340 wrote to memory of 2652 2340 bbthnh.exe bthntt.exe PID 2652 wrote to memory of 2516 2652 bthntt.exe vjvvj.exe PID 2652 wrote to memory of 2516 2652 bthntt.exe vjvvj.exe PID 2652 wrote to memory of 2516 2652 bthntt.exe vjvvj.exe PID 2652 wrote to memory of 2516 2652 bthntt.exe vjvvj.exe PID 2516 wrote to memory of 2536 2516 vjvvj.exe lxflrrx.exe PID 2516 wrote to memory of 2536 2516 vjvvj.exe lxflrrx.exe PID 2516 wrote to memory of 2536 2516 vjvvj.exe lxflrrx.exe PID 2516 wrote to memory of 2536 2516 vjvvj.exe lxflrrx.exe PID 2536 wrote to memory of 2404 2536 lxflrrx.exe rlxlxff.exe PID 2536 wrote to memory of 2404 2536 lxflrrx.exe rlxlxff.exe PID 2536 wrote to memory of 2404 2536 lxflrrx.exe rlxlxff.exe PID 2536 wrote to memory of 2404 2536 lxflrrx.exe rlxlxff.exe PID 2404 wrote to memory of 2352 2404 rlxlxff.exe 9htthh.exe PID 2404 wrote to memory of 2352 2404 rlxlxff.exe 9htthh.exe PID 2404 wrote to memory of 2352 2404 rlxlxff.exe 9htthh.exe PID 2404 wrote to memory of 2352 2404 rlxlxff.exe 9htthh.exe PID 2352 wrote to memory of 1352 2352 9htthh.exe jdpvd.exe PID 2352 wrote to memory of 1352 2352 9htthh.exe jdpvd.exe PID 2352 wrote to memory of 1352 2352 9htthh.exe jdpvd.exe PID 2352 wrote to memory of 1352 2352 9htthh.exe jdpvd.exe PID 1352 wrote to memory of 2716 1352 jdpvd.exe 9jvjv.exe PID 1352 wrote to memory of 2716 1352 jdpvd.exe 9jvjv.exe PID 1352 wrote to memory of 2716 1352 jdpvd.exe 9jvjv.exe PID 1352 wrote to memory of 2716 1352 jdpvd.exe 9jvjv.exe PID 2716 wrote to memory of 1856 2716 9jvjv.exe 3rlfllr.exe PID 2716 wrote to memory of 1856 2716 9jvjv.exe 3rlfllr.exe PID 2716 wrote to memory of 1856 2716 9jvjv.exe 3rlfllr.exe PID 2716 wrote to memory of 1856 2716 9jvjv.exe 3rlfllr.exe PID 1856 wrote to memory of 1868 1856 3rlfllr.exe xrllflr.exe PID 1856 wrote to memory of 1868 1856 3rlfllr.exe xrllflr.exe PID 1856 wrote to memory of 1868 1856 3rlfllr.exe xrllflr.exe PID 1856 wrote to memory of 1868 1856 3rlfllr.exe xrllflr.exe PID 1868 wrote to memory of 1216 1868 xrllflr.exe 3ttbhn.exe PID 1868 wrote to memory of 1216 1868 xrllflr.exe 3ttbhn.exe PID 1868 wrote to memory of 1216 1868 xrllflr.exe 3ttbhn.exe PID 1868 wrote to memory of 1216 1868 xrllflr.exe 3ttbhn.exe PID 1216 wrote to memory of 2272 1216 3ttbhn.exe dvjjj.exe PID 1216 wrote to memory of 2272 1216 3ttbhn.exe dvjjj.exe PID 1216 wrote to memory of 2272 1216 3ttbhn.exe dvjjj.exe PID 1216 wrote to memory of 2272 1216 3ttbhn.exe dvjjj.exe PID 2272 wrote to memory of 2156 2272 dvjjj.exe vpdvj.exe PID 2272 wrote to memory of 2156 2272 dvjjj.exe vpdvj.exe PID 2272 wrote to memory of 2156 2272 dvjjj.exe vpdvj.exe PID 2272 wrote to memory of 2156 2272 dvjjj.exe vpdvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe"C:\Users\Admin\AppData\Local\Temp\321172a1fddcffaf2c8d4c2783567333ace6af0fbae84bb53a6e64eec033d3cc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xrflxfr.exec:\xrflxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pjjpd.exec:\pjjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\5xlrxxl.exec:\5xlrxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\bbthnh.exec:\bbthnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\bthntt.exec:\bthntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vjvvj.exec:\vjvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\lxflrrx.exec:\lxflrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rlxlxff.exec:\rlxlxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\9htthh.exec:\9htthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\jdpvd.exec:\jdpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\9jvjv.exec:\9jvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\3rlfllr.exec:\3rlfllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\xrllflr.exec:\xrllflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\3ttbhn.exec:\3ttbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\dvjjj.exec:\dvjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\vpdvj.exec:\vpdvj.exe17⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xrrxrrf.exec:\xrrxrrf.exe18⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rllrfxf.exec:\rllrfxf.exe19⤵
- Executes dropped EXE
PID:1520 -
\??\c:\1ttbhh.exec:\1ttbhh.exe20⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9vpvj.exec:\9vpvj.exe21⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pjddp.exec:\pjddp.exe22⤵
- Executes dropped EXE
PID:320 -
\??\c:\frflxlx.exec:\frflxlx.exe23⤵
- Executes dropped EXE
PID:912 -
\??\c:\9hnthn.exec:\9hnthn.exe24⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bthntn.exec:\bthntn.exe25⤵
- Executes dropped EXE
PID:1172 -
\??\c:\1jvvp.exec:\1jvvp.exe26⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jdvjd.exec:\jdvjd.exe27⤵
- Executes dropped EXE
PID:812 -
\??\c:\llfrxxx.exec:\llfrxxx.exe28⤵
- Executes dropped EXE
PID:900 -
\??\c:\thbbhh.exec:\thbbhh.exe29⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3vjjp.exec:\3vjjp.exe30⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3pddj.exec:\3pddj.exe31⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rlxxlrl.exec:\rlxxlrl.exe32⤵
- Executes dropped EXE
PID:1240 -
\??\c:\nhhtbn.exec:\nhhtbn.exe33⤵
- Executes dropped EXE
PID:2880 -
\??\c:\htntbh.exec:\htntbh.exe34⤵
- Executes dropped EXE
PID:1500 -
\??\c:\5pjvj.exec:\5pjvj.exe35⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1jvvj.exec:\1jvvj.exe36⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vpvvj.exec:\vpvvj.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rffxxxl.exec:\rffxxxl.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xrlrxrf.exec:\xrlrxrf.exe39⤵
- Executes dropped EXE
PID:2468 -
\??\c:\btbbnn.exec:\btbbnn.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\thtbnn.exec:\thtbnn.exe41⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vjpvd.exec:\vjpvd.exe42⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5pvdj.exec:\5pvdj.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rlxxrlr.exec:\rlxxrlr.exe45⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bthbhh.exec:\bthbhh.exe46⤵
- Executes dropped EXE
PID:316 -
\??\c:\1nbnhh.exec:\1nbnhh.exe47⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vppvd.exec:\vppvd.exe48⤵
- Executes dropped EXE
PID:2448 -
\??\c:\1pjpp.exec:\1pjpp.exe49⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rlflrxl.exec:\rlflrxl.exe50⤵
- Executes dropped EXE
PID:328 -
\??\c:\rfxrllr.exec:\rfxrllr.exe51⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bnbbbh.exec:\bnbbbh.exe52⤵
- Executes dropped EXE
PID:1564 -
\??\c:\tnhbnt.exec:\tnhbnt.exe53⤵
- Executes dropped EXE
PID:1888 -
\??\c:\3jjdp.exec:\3jjdp.exe54⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vvpdj.exec:\vvpdj.exe55⤵
- Executes dropped EXE
PID:1424 -
\??\c:\rrflllx.exec:\rrflllx.exe56⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hhtbnn.exec:\hhtbnn.exe57⤵
- Executes dropped EXE
PID:1672 -
\??\c:\1tttht.exec:\1tttht.exe58⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jdvjp.exec:\jdvjp.exe59⤵
- Executes dropped EXE
PID:2224 -
\??\c:\1rlrfrx.exec:\1rlrfrx.exe60⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5btbnn.exec:\5btbnn.exe61⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nhthnn.exec:\nhthnn.exe62⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pvdvd.exec:\pvdvd.exe63⤵
- Executes dropped EXE
PID:2440 -
\??\c:\dpjpp.exec:\dpjpp.exe64⤵
- Executes dropped EXE
PID:1408 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe65⤵
- Executes dropped EXE
PID:608 -
\??\c:\7fxfllr.exec:\7fxfllr.exe66⤵PID:2424
-
\??\c:\9thbtt.exec:\9thbtt.exe67⤵PID:1232
-
\??\c:\9ttthh.exec:\9ttthh.exe68⤵PID:1004
-
\??\c:\jvdjp.exec:\jvdjp.exe69⤵PID:2856
-
\??\c:\jdvvj.exec:\jdvvj.exe70⤵PID:2860
-
\??\c:\dvjjp.exec:\dvjjp.exe71⤵PID:2040
-
\??\c:\xxlrxlx.exec:\xxlrxlx.exe72⤵PID:2936
-
\??\c:\1fxrxxf.exec:\1fxrxxf.exe73⤵PID:2932
-
\??\c:\nhtbhn.exec:\nhtbhn.exe74⤵PID:2892
-
\??\c:\hhbnth.exec:\hhbnth.exe75⤵PID:3000
-
\??\c:\7jjpv.exec:\7jjpv.exe76⤵PID:1588
-
\??\c:\vvjpj.exec:\vvjpj.exe77⤵PID:2080
-
\??\c:\rrflffr.exec:\rrflffr.exe78⤵PID:2336
-
\??\c:\ffxrllf.exec:\ffxrllf.exe79⤵PID:2664
-
\??\c:\bnnnnt.exec:\bnnnnt.exe80⤵PID:2828
-
\??\c:\7nbntt.exec:\7nbntt.exe81⤵PID:2824
-
\??\c:\pjjpv.exec:\pjjpv.exe82⤵PID:2496
-
\??\c:\jdvdj.exec:\jdvdj.exe83⤵PID:1716
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe84⤵PID:2456
-
\??\c:\hthbnh.exec:\hthbnh.exe85⤵PID:2524
-
\??\c:\hbnttb.exec:\hbnttb.exe86⤵PID:2068
-
\??\c:\nbbhnn.exec:\nbbhnn.exe87⤵PID:2356
-
\??\c:\pjdjv.exec:\pjdjv.exe88⤵PID:2404
-
\??\c:\5xrlllr.exec:\5xrlllr.exe89⤵PID:2436
-
\??\c:\xrflllf.exec:\xrflllf.exe90⤵PID:2700
-
\??\c:\hthnbb.exec:\hthnbb.exe91⤵PID:2532
-
\??\c:\hbntnt.exec:\hbntnt.exe92⤵PID:1896
-
\??\c:\dvpvv.exec:\dvpvv.exe93⤵PID:1544
-
\??\c:\1dvvd.exec:\1dvvd.exe94⤵PID:1552
-
\??\c:\rfrxflr.exec:\rfrxflr.exe95⤵PID:1664
-
\??\c:\xxrflll.exec:\xxrflll.exe96⤵PID:1220
-
\??\c:\7nbhnt.exec:\7nbhnt.exe97⤵PID:1460
-
\??\c:\7tntbt.exec:\7tntbt.exe98⤵PID:1344
-
\??\c:\jjjjv.exec:\jjjjv.exe99⤵PID:2552
-
\??\c:\dpddd.exec:\dpddd.exe100⤵PID:1520
-
\??\c:\fxlrfxl.exec:\fxlrfxl.exe101⤵PID:2196
-
\??\c:\llxfrlr.exec:\llxfrlr.exe102⤵PID:2236
-
\??\c:\nbnntt.exec:\nbnntt.exe103⤵PID:476
-
\??\c:\bthnhh.exec:\bthnhh.exe104⤵PID:580
-
\??\c:\vppvv.exec:\vppvv.exe105⤵PID:652
-
\??\c:\5pddj.exec:\5pddj.exe106⤵PID:1532
-
\??\c:\rrlxfrx.exec:\rrlxfrx.exe107⤵PID:2136
-
\??\c:\llrlrxf.exec:\llrlrxf.exe108⤵PID:444
-
\??\c:\hnhnbt.exec:\hnhnbt.exe109⤵PID:1292
-
\??\c:\hbtnbb.exec:\hbtnbb.exe110⤵PID:1576
-
\??\c:\vvpvp.exec:\vvpvp.exe111⤵PID:848
-
\??\c:\xxxlxfl.exec:\xxxlxfl.exe112⤵PID:2072
-
\??\c:\lxlxllx.exec:\lxlxllx.exe113⤵PID:2304
-
\??\c:\9fxlfxr.exec:\9fxlfxr.exe114⤵PID:2796
-
\??\c:\btbhhn.exec:\btbhhn.exe115⤵PID:2840
-
\??\c:\btntbb.exec:\btntbb.exe116⤵PID:2392
-
\??\c:\jdvdj.exec:\jdvdj.exe117⤵PID:2888
-
\??\c:\fxllffl.exec:\fxllffl.exe118⤵PID:2128
-
\??\c:\5rxrlff.exec:\5rxrlff.exe119⤵PID:1584
-
\??\c:\1hbhnn.exec:\1hbhnn.exe120⤵PID:2568
-
\??\c:\nttbbn.exec:\nttbbn.exe121⤵PID:2676
-
\??\c:\dvjpd.exec:\dvjpd.exe122⤵PID:2596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-