Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 02:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd32a4089d9edb8d2d6fe8db76a87ed625e90bef68efe4d463b4a031f020228d.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
cd32a4089d9edb8d2d6fe8db76a87ed625e90bef68efe4d463b4a031f020228d.exe
-
Size
90KB
-
MD5
651fecb833695bb6bbed49c8bd0531bd
-
SHA1
ff0fc3df2dfa87d357d1c20d83a70c4639d59b93
-
SHA256
cd32a4089d9edb8d2d6fe8db76a87ed625e90bef68efe4d463b4a031f020228d
-
SHA512
9f2f893dd327c44704409d8370d5c31e5041601c69d35a7de54c16075c641dc797b9b0a7681da81185d43c1d1b3a6f19d26f65caf09b41b276576a000457e0af
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzac0Hobv0byLufTJfJ0:ymb3NkkiQ3mdBjFodt27HobvcyLufNfi
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2184-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral1/memory/1724-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2184-6-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1724-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1796-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2120-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2724-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2788-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2516-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3008-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1588-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3040-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2264-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1428-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1488-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2244-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2136-216-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1124-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/584-242-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/352-251-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1820-260-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/692-269-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1724 llxflrx.exe 1796 7tnntb.exe 2120 frffrxf.exe 2724 rfllxxx.exe 2788 9bbnbn.exe 2632 dpppd.exe 2680 llflrfr.exe 2516 fxllrrr.exe 3008 tnthht.exe 1588 jvjpp.exe 3040 rfrrfrf.exe 2264 fxrfrxf.exe 2972 hbtthb.exe 1428 vpvjd.exe 2500 lrxrlxf.exe 2856 nnbhtn.exe 2956 5bnntn.exe 1488 1pdjp.exe 1756 fflrfxr.exe 2244 hthttb.exe 1996 nhtbnt.exe 2136 9jvdd.exe 1124 rlflrxf.exe 1468 7lxrxfl.exe 584 nbntht.exe 352 vjvjp.exe 1820 lfflxfr.exe 692 tnnntt.exe 3068 9vpjv.exe 2932 9lxfffr.exe 2252 rlxlxxl.exe 2020 1tnbht.exe 760 1jvvj.exe 2204 vpvdd.exe 2208 9frlffx.exe 1724 fxfffff.exe 2644 ttnbnb.exe 2720 5bntbh.exe 832 vjvpp.exe 2648 vpjjv.exe 2772 xxrxlrf.exe 2652 1htttt.exe 1980 bbnthb.exe 2556 vvdpj.exe 2516 pjvvv.exe 3000 3fflrfx.exe 3024 9flrrrx.exe 1376 htbhhh.exe 1716 hbbhnt.exe 2108 pjpjp.exe 1180 vpjpd.exe 2488 9rfrrrx.exe 2828 9llxflx.exe 2976 hbnbnn.exe 2168 nhtntn.exe 2956 7vvpp.exe 1912 dvdjp.exe 2032 lfrfrrf.exe 2080 xxflrrf.exe 2496 hbtbnt.exe 1676 nbnhnn.exe 2132 jdjvd.exe 576 7rlrfff.exe 1252 rffrrxf.exe -
resource yara_rule behavioral1/memory/1724-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-269-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 1724 2184 cd32a4089d9edb8d2d6fe8db76a87ed625e90bef68efe4d463b4a031f020228d.exe 28 PID 2184 wrote to memory of 1724 2184 cd32a4089d9edb8d2d6fe8db76a87ed625e90bef68efe4d463b4a031f020228d.exe 28 PID 2184 wrote to memory of 1724 2184 cd32a4089d9edb8d2d6fe8db76a87ed625e90bef68efe4d463b4a031f020228d.exe 28 PID 2184 wrote to memory of 1724 2184 cd32a4089d9edb8d2d6fe8db76a87ed625e90bef68efe4d463b4a031f020228d.exe 28 PID 1724 wrote to memory of 1796 1724 llxflrx.exe 29 PID 1724 wrote to memory of 1796 1724 llxflrx.exe 29 PID 1724 wrote to memory of 1796 1724 llxflrx.exe 29 PID 1724 wrote to memory of 1796 1724 llxflrx.exe 29 PID 1796 wrote to memory of 2120 1796 7tnntb.exe 30 PID 1796 wrote to memory of 2120 1796 7tnntb.exe 30 PID 1796 wrote to memory of 2120 1796 7tnntb.exe 30 PID 1796 wrote to memory of 2120 1796 7tnntb.exe 30 PID 2120 wrote to memory of 2724 2120 frffrxf.exe 31 PID 2120 wrote to memory of 2724 2120 frffrxf.exe 31 PID 2120 wrote to memory of 2724 2120 frffrxf.exe 31 PID 2120 wrote to memory of 2724 2120 frffrxf.exe 31 PID 2724 wrote to memory of 2788 2724 rfllxxx.exe 32 PID 2724 wrote to memory of 2788 2724 rfllxxx.exe 32 PID 2724 wrote to memory of 2788 2724 rfllxxx.exe 32 PID 2724 wrote to memory of 2788 2724 rfllxxx.exe 32 PID 2788 wrote to memory of 2632 2788 9bbnbn.exe 33 PID 2788 wrote to memory of 2632 2788 9bbnbn.exe 33 PID 2788 wrote to memory of 2632 2788 9bbnbn.exe 33 PID 2788 wrote to memory of 2632 2788 9bbnbn.exe 33 PID 2632 wrote to memory of 2680 2632 dpppd.exe 34 PID 2632 wrote to memory of 2680 2632 dpppd.exe 34 PID 2632 wrote to memory of 2680 2632 dpppd.exe 34 PID 2632 wrote to memory of 2680 2632 dpppd.exe 34 PID 2680 wrote to memory of 2516 2680 llflrfr.exe 35 PID 2680 wrote to memory of 2516 2680 llflrfr.exe 35 PID 2680 wrote to memory of 2516 2680 llflrfr.exe 35 PID 2680 wrote to memory of 2516 2680 llflrfr.exe 35 PID 2516 wrote to memory of 3008 2516 fxllrrr.exe 36 PID 2516 wrote to memory of 3008 2516 fxllrrr.exe 36 PID 2516 wrote to memory of 3008 2516 fxllrrr.exe 36 PID 2516 wrote to memory of 3008 2516 fxllrrr.exe 36 PID 3008 wrote to memory of 1588 3008 tnthht.exe 37 PID 3008 wrote to memory of 1588 3008 tnthht.exe 37 PID 3008 wrote to memory of 1588 3008 tnthht.exe 37 PID 3008 wrote to memory of 1588 3008 tnthht.exe 37 PID 1588 wrote to memory of 3040 1588 jvjpp.exe 38 PID 1588 wrote to memory of 3040 1588 jvjpp.exe 38 PID 1588 wrote to memory of 3040 1588 jvjpp.exe 38 PID 1588 wrote to memory of 3040 1588 jvjpp.exe 38 PID 3040 wrote to memory of 2264 3040 rfrrfrf.exe 39 PID 3040 wrote to memory of 2264 3040 rfrrfrf.exe 39 PID 3040 wrote to memory of 2264 3040 rfrrfrf.exe 39 PID 3040 wrote to memory of 2264 3040 rfrrfrf.exe 39 PID 2264 wrote to memory of 2972 2264 fxrfrxf.exe 40 PID 2264 wrote to memory of 2972 2264 fxrfrxf.exe 40 PID 2264 wrote to memory of 2972 2264 fxrfrxf.exe 40 PID 2264 wrote to memory of 2972 2264 fxrfrxf.exe 40 PID 2972 wrote to memory of 1428 2972 hbtthb.exe 41 PID 2972 wrote to memory of 1428 2972 hbtthb.exe 41 PID 2972 wrote to memory of 1428 2972 hbtthb.exe 41 PID 2972 wrote to memory of 1428 2972 hbtthb.exe 41 PID 1428 wrote to memory of 2500 1428 vpvjd.exe 42 PID 1428 wrote to memory of 2500 1428 vpvjd.exe 42 PID 1428 wrote to memory of 2500 1428 vpvjd.exe 42 PID 1428 wrote to memory of 2500 1428 vpvjd.exe 42 PID 2500 wrote to memory of 2856 2500 lrxrlxf.exe 43 PID 2500 wrote to memory of 2856 2500 lrxrlxf.exe 43 PID 2500 wrote to memory of 2856 2500 lrxrlxf.exe 43 PID 2500 wrote to memory of 2856 2500 lrxrlxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd32a4089d9edb8d2d6fe8db76a87ed625e90bef68efe4d463b4a031f020228d.exe"C:\Users\Admin\AppData\Local\Temp\cd32a4089d9edb8d2d6fe8db76a87ed625e90bef68efe4d463b4a031f020228d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\llxflrx.exec:\llxflrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\7tnntb.exec:\7tnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\frffrxf.exec:\frffrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rfllxxx.exec:\rfllxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\9bbnbn.exec:\9bbnbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dpppd.exec:\dpppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\llflrfr.exec:\llflrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\fxllrrr.exec:\fxllrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\tnthht.exec:\tnthht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\jvjpp.exec:\jvjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\rfrrfrf.exec:\rfrrfrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\fxrfrxf.exec:\fxrfrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hbtthb.exec:\hbtthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vpvjd.exec:\vpvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\lrxrlxf.exec:\lrxrlxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\nnbhtn.exec:\nnbhtn.exe17⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5bnntn.exec:\5bnntn.exe18⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1pdjp.exec:\1pdjp.exe19⤵
- Executes dropped EXE
PID:1488 -
\??\c:\fflrfxr.exec:\fflrfxr.exe20⤵
- Executes dropped EXE
PID:1756 -
\??\c:\hthttb.exec:\hthttb.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\nhtbnt.exec:\nhtbnt.exe22⤵
- Executes dropped EXE
PID:1996 -
\??\c:\9jvdd.exec:\9jvdd.exe23⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rlflrxf.exec:\rlflrxf.exe24⤵
- Executes dropped EXE
PID:1124 -
\??\c:\7lxrxfl.exec:\7lxrxfl.exe25⤵
- Executes dropped EXE
PID:1468 -
\??\c:\nbntht.exec:\nbntht.exe26⤵
- Executes dropped EXE
PID:584 -
\??\c:\vjvjp.exec:\vjvjp.exe27⤵
- Executes dropped EXE
PID:352 -
\??\c:\lfflxfr.exec:\lfflxfr.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\tnnntt.exec:\tnnntt.exe29⤵
- Executes dropped EXE
PID:692 -
\??\c:\9vpjv.exec:\9vpjv.exe30⤵
- Executes dropped EXE
PID:3068 -
\??\c:\9lxfffr.exec:\9lxfffr.exe31⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe32⤵
- Executes dropped EXE
PID:2252 -
\??\c:\1tnbht.exec:\1tnbht.exe33⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1jvvj.exec:\1jvvj.exe34⤵
- Executes dropped EXE
PID:760 -
\??\c:\vpvdd.exec:\vpvdd.exe35⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9frlffx.exec:\9frlffx.exe36⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fxfffff.exec:\fxfffff.exe37⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ttnbnb.exec:\ttnbnb.exe38⤵
- Executes dropped EXE
PID:2644 -
\??\c:\5bntbh.exec:\5bntbh.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vjvpp.exec:\vjvpp.exe40⤵
- Executes dropped EXE
PID:832 -
\??\c:\vpjjv.exec:\vpjjv.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\1htttt.exec:\1htttt.exe43⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bbnthb.exec:\bbnthb.exe44⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vvdpj.exec:\vvdpj.exe45⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pjvvv.exec:\pjvvv.exe46⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3fflrfx.exec:\3fflrfx.exe47⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9flrrrx.exec:\9flrrrx.exe48⤵
- Executes dropped EXE
PID:3024 -
\??\c:\htbhhh.exec:\htbhhh.exe49⤵
- Executes dropped EXE
PID:1376 -
\??\c:\hbbhnt.exec:\hbbhnt.exe50⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pjpjp.exec:\pjpjp.exe51⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vpjpd.exec:\vpjpd.exe52⤵
- Executes dropped EXE
PID:1180 -
\??\c:\9rfrrrx.exec:\9rfrrrx.exe53⤵
- Executes dropped EXE
PID:2488 -
\??\c:\9llxflx.exec:\9llxflx.exe54⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hbnbnn.exec:\hbnbnn.exe55⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nhtntn.exec:\nhtntn.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7vvpp.exec:\7vvpp.exe57⤵
- Executes dropped EXE
PID:2956 -
\??\c:\dvdjp.exec:\dvdjp.exe58⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lfrfrrf.exec:\lfrfrrf.exe59⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xxflrrf.exec:\xxflrrf.exe60⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hbtbnt.exec:\hbtbnt.exe61⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nbnhnn.exec:\nbnhnn.exe62⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jdjvd.exec:\jdjvd.exe63⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7rlrfff.exec:\7rlrfff.exe64⤵
- Executes dropped EXE
PID:576 -
\??\c:\rffrrxf.exec:\rffrrxf.exe65⤵
- Executes dropped EXE
PID:1252 -
\??\c:\btnnbb.exec:\btnnbb.exe66⤵PID:1512
-
\??\c:\jjpdd.exec:\jjpdd.exe67⤵PID:1988
-
\??\c:\dvjpv.exec:\dvjpv.exe68⤵PID:944
-
\??\c:\frxxxrf.exec:\frxxxrf.exe69⤵PID:896
-
\??\c:\frxffxf.exec:\frxffxf.exe70⤵PID:2372
-
\??\c:\btbnnt.exec:\btbnnt.exe71⤵PID:2884
-
\??\c:\btnbhn.exec:\btnbhn.exe72⤵PID:2224
-
\??\c:\jjpvv.exec:\jjpvv.exe73⤵PID:2960
-
\??\c:\1dpvj.exec:\1dpvj.exe74⤵PID:2040
-
\??\c:\ffxxfll.exec:\ffxxfll.exe75⤵PID:2944
-
\??\c:\9fxlrxf.exec:\9fxlrxf.exe76⤵PID:1600
-
\??\c:\7bnbtt.exec:\7bnbtt.exe77⤵PID:796
-
\??\c:\dpvvd.exec:\dpvvd.exe78⤵PID:3044
-
\??\c:\jdddj.exec:\jdddj.exe79⤵PID:2608
-
\??\c:\rrrflxx.exec:\rrrflxx.exe80⤵PID:1724
-
\??\c:\5frxxlr.exec:\5frxxlr.exe81⤵PID:2624
-
\??\c:\ttnhtb.exec:\ttnhtb.exe82⤵PID:2640
-
\??\c:\7jddv.exec:\7jddv.exe83⤵PID:2520
-
\??\c:\dvvpv.exec:\dvvpv.exe84⤵PID:1216
-
\??\c:\7rflxfr.exec:\7rflxfr.exe85⤵PID:2628
-
\??\c:\ffxlrlx.exec:\ffxlrlx.exe86⤵PID:2680
-
\??\c:\rrxflff.exec:\rrxflff.exe87⤵PID:2592
-
\??\c:\bhhthn.exec:\bhhthn.exe88⤵PID:2332
-
\??\c:\ppjvp.exec:\ppjvp.exe89⤵PID:2564
-
\??\c:\3jjpj.exec:\3jjpj.exe90⤵PID:1532
-
\??\c:\rrflxfl.exec:\rrflxfl.exe91⤵PID:2304
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe92⤵PID:2760
-
\??\c:\tbbbtt.exec:\tbbbtt.exe93⤵PID:1924
-
\??\c:\nbhnnt.exec:\nbhnnt.exe94⤵PID:2748
-
\??\c:\vpddj.exec:\vpddj.exe95⤵PID:2972
-
\??\c:\dvjvv.exec:\dvjvv.exe96⤵PID:2500
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe97⤵PID:2996
-
\??\c:\3nbhtt.exec:\3nbhtt.exe98⤵PID:2064
-
\??\c:\hhbbhh.exec:\hhbbhh.exe99⤵PID:1516
-
\??\c:\vvdjp.exec:\vvdjp.exe100⤵PID:1248
-
\??\c:\jjvjp.exec:\jjvjp.exe101⤵PID:1696
-
\??\c:\xrlfllx.exec:\xrlfllx.exe102⤵PID:1952
-
\??\c:\llrlxfx.exec:\llrlxfx.exe103⤵PID:1256
-
\??\c:\tthtbb.exec:\tthtbb.exe104⤵PID:2496
-
\??\c:\vvjdd.exec:\vvjdd.exe105⤵PID:300
-
\??\c:\vpvpv.exec:\vpvpv.exe106⤵PID:1848
-
\??\c:\3vpvv.exec:\3vpvv.exe107⤵PID:1068
-
\??\c:\9llrfrf.exec:\9llrfrf.exe108⤵PID:1252
-
\??\c:\nnbhnh.exec:\nnbhnh.exe109⤵PID:984
-
\??\c:\bbthth.exec:\bbthth.exe110⤵PID:296
-
\??\c:\pppdp.exec:\pppdp.exe111⤵PID:940
-
\??\c:\jvvjj.exec:\jvvjj.exe112⤵PID:1040
-
\??\c:\fxflfxx.exec:\fxflfxx.exe113⤵PID:1732
-
\??\c:\xxxrlxr.exec:\xxxrlxr.exe114⤵PID:1280
-
\??\c:\rlflrxf.exec:\rlflrxf.exe115⤵PID:1748
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe116⤵PID:2904
-
\??\c:\9bnntt.exec:\9bnntt.exe117⤵PID:2476
-
\??\c:\hhbhbn.exec:\hhbhbn.exe118⤵PID:344
-
\??\c:\vpdpp.exec:\vpdpp.exe119⤵PID:1908
-
\??\c:\1jdjd.exec:\1jdjd.exe120⤵PID:492
-
\??\c:\fxflrxf.exec:\fxflrxf.exe121⤵PID:2804
-
\??\c:\xrxlrrx.exec:\xrxlrrx.exe122⤵PID:2716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-