Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 03:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e31d6025997bb78485544193c717463169b67fef14c9eb4d4a1757ae6392c610.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
e31d6025997bb78485544193c717463169b67fef14c9eb4d4a1757ae6392c610.exe
-
Size
69KB
-
MD5
0e5b4dd9bd0795cd41b88a1d343047fb
-
SHA1
f98a197ad2f366aa65d3c102d425189158b110cc
-
SHA256
e31d6025997bb78485544193c717463169b67fef14c9eb4d4a1757ae6392c610
-
SHA512
af7fa431ce6a7735fa7f3cb5b8dc53ef372aefede01fb282ac82f06373a5f44cd8fc0914ea96fefba53e1da33d03c46c5b1e09318d47a027a163b91b82754761
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbu0:ymb3NkkiQ3mdBjFIfvTfCD+HU
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2756-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/312-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/880-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 28 IoCs
resource yara_rule behavioral1/memory/1808-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1808-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1280-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1280-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1280-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1280-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2652-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2660-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2184-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2484-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2484-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2484-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2484-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2420-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2836-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1944-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/312-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1740-208-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1284-217-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1472-234-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2268-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/880-270-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/560-288-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2756 dvpdd.exe 1280 5frllfl.exe 2652 bntnnn.exe 2568 pdpvd.exe 2660 rlfrfxf.exe 2572 lxxfxll.exe 2184 tnhbbh.exe 2484 jpddj.exe 1744 lflfxlr.exe 2420 3hbbhn.exe 2836 bbtthh.exe 2960 ppjdj.exe 1944 ffrxlxl.exe 312 hhbntn.exe 2312 bbthtb.exe 1588 9vdjp.exe 1516 5fllflr.exe 2072 xlrrxfx.exe 320 ntnbtb.exe 1740 vvpvj.exe 1284 dvdjv.exe 1080 xrrxlfl.exe 1472 1bbbbh.exe 1852 jvppj.exe 2268 jpjjp.exe 2376 lfxrxff.exe 880 btntbn.exe 2808 djjpp.exe 560 jjvjp.exe 572 rrrxllf.exe 2204 lxxlxff.exe 2368 3bhbhh.exe 1560 ddvvv.exe 2988 jdjpv.exe 2528 fxxfllr.exe 1280 5rffflr.exe 2656 bnbhnn.exe 2540 tnttth.exe 2880 pjppv.exe 2668 vjpvv.exe 2480 frfllfl.exe 2448 llfrxxf.exe 2184 3nnbhh.exe 1660 vdjpp.exe 1620 pdpjp.exe 2716 lflxrrf.exe 2824 lxxfflx.exe 2216 bnthtt.exe 2344 5htbtn.exe 1952 vpvpv.exe 1652 9llrxfl.exe 1640 1xflrrr.exe 2316 thhhhn.exe 1508 btbhhn.exe 828 dpdjp.exe 2068 jvjpv.exe 2412 rllrflf.exe 2380 bttbht.exe 2112 nhnbhh.exe 484 jddpv.exe 324 vpjpd.exe 1644 rlxxflf.exe 2980 frfrrlr.exe 1768 ttntbb.exe -
resource yara_rule behavioral1/memory/1808-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1280-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/312-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 2756 1808 e31d6025997bb78485544193c717463169b67fef14c9eb4d4a1757ae6392c610.exe 28 PID 1808 wrote to memory of 2756 1808 e31d6025997bb78485544193c717463169b67fef14c9eb4d4a1757ae6392c610.exe 28 PID 1808 wrote to memory of 2756 1808 e31d6025997bb78485544193c717463169b67fef14c9eb4d4a1757ae6392c610.exe 28 PID 1808 wrote to memory of 2756 1808 e31d6025997bb78485544193c717463169b67fef14c9eb4d4a1757ae6392c610.exe 28 PID 2756 wrote to memory of 1280 2756 dvpdd.exe 29 PID 2756 wrote to memory of 1280 2756 dvpdd.exe 29 PID 2756 wrote to memory of 1280 2756 dvpdd.exe 29 PID 2756 wrote to memory of 1280 2756 dvpdd.exe 29 PID 1280 wrote to memory of 2652 1280 5frllfl.exe 30 PID 1280 wrote to memory of 2652 1280 5frllfl.exe 30 PID 1280 wrote to memory of 2652 1280 5frllfl.exe 30 PID 1280 wrote to memory of 2652 1280 5frllfl.exe 30 PID 2652 wrote to memory of 2568 2652 bntnnn.exe 31 PID 2652 wrote to memory of 2568 2652 bntnnn.exe 31 PID 2652 wrote to memory of 2568 2652 bntnnn.exe 31 PID 2652 wrote to memory of 2568 2652 bntnnn.exe 31 PID 2568 wrote to memory of 2660 2568 pdpvd.exe 32 PID 2568 wrote to memory of 2660 2568 pdpvd.exe 32 PID 2568 wrote to memory of 2660 2568 pdpvd.exe 32 PID 2568 wrote to memory of 2660 2568 pdpvd.exe 32 PID 2660 wrote to memory of 2572 2660 rlfrfxf.exe 33 PID 2660 wrote to memory of 2572 2660 rlfrfxf.exe 33 PID 2660 wrote to memory of 2572 2660 rlfrfxf.exe 33 PID 2660 wrote to memory of 2572 2660 rlfrfxf.exe 33 PID 2572 wrote to memory of 2184 2572 lxxfxll.exe 34 PID 2572 wrote to memory of 2184 2572 lxxfxll.exe 34 PID 2572 wrote to memory of 2184 2572 lxxfxll.exe 34 PID 2572 wrote to memory of 2184 2572 lxxfxll.exe 34 PID 2184 wrote to memory of 2484 2184 tnhbbh.exe 35 PID 2184 wrote to memory of 2484 2184 tnhbbh.exe 35 PID 2184 wrote to memory of 2484 2184 tnhbbh.exe 35 PID 2184 wrote to memory of 2484 2184 tnhbbh.exe 35 PID 2484 wrote to memory of 1744 2484 jpddj.exe 36 PID 2484 wrote to memory of 1744 2484 jpddj.exe 36 PID 2484 wrote to memory of 1744 2484 jpddj.exe 36 PID 2484 wrote to memory of 1744 2484 jpddj.exe 36 PID 1744 wrote to memory of 2420 1744 lflfxlr.exe 37 PID 1744 wrote to memory of 2420 1744 lflfxlr.exe 37 PID 1744 wrote to memory of 2420 1744 lflfxlr.exe 37 PID 1744 wrote to memory of 2420 1744 lflfxlr.exe 37 PID 2420 wrote to memory of 2836 2420 3hbbhn.exe 38 PID 2420 wrote to memory of 2836 2420 3hbbhn.exe 38 PID 2420 wrote to memory of 2836 2420 3hbbhn.exe 38 PID 2420 wrote to memory of 2836 2420 3hbbhn.exe 38 PID 2836 wrote to memory of 2960 2836 bbtthh.exe 39 PID 2836 wrote to memory of 2960 2836 bbtthh.exe 39 PID 2836 wrote to memory of 2960 2836 bbtthh.exe 39 PID 2836 wrote to memory of 2960 2836 bbtthh.exe 39 PID 2960 wrote to memory of 1944 2960 ppjdj.exe 40 PID 2960 wrote to memory of 1944 2960 ppjdj.exe 40 PID 2960 wrote to memory of 1944 2960 ppjdj.exe 40 PID 2960 wrote to memory of 1944 2960 ppjdj.exe 40 PID 1944 wrote to memory of 312 1944 ffrxlxl.exe 41 PID 1944 wrote to memory of 312 1944 ffrxlxl.exe 41 PID 1944 wrote to memory of 312 1944 ffrxlxl.exe 41 PID 1944 wrote to memory of 312 1944 ffrxlxl.exe 41 PID 312 wrote to memory of 2312 312 hhbntn.exe 42 PID 312 wrote to memory of 2312 312 hhbntn.exe 42 PID 312 wrote to memory of 2312 312 hhbntn.exe 42 PID 312 wrote to memory of 2312 312 hhbntn.exe 42 PID 2312 wrote to memory of 1588 2312 bbthtb.exe 43 PID 2312 wrote to memory of 1588 2312 bbthtb.exe 43 PID 2312 wrote to memory of 1588 2312 bbthtb.exe 43 PID 2312 wrote to memory of 1588 2312 bbthtb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e31d6025997bb78485544193c717463169b67fef14c9eb4d4a1757ae6392c610.exe"C:\Users\Admin\AppData\Local\Temp\e31d6025997bb78485544193c717463169b67fef14c9eb4d4a1757ae6392c610.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\dvpdd.exec:\dvpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\5frllfl.exec:\5frllfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\bntnnn.exec:\bntnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pdpvd.exec:\pdpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\rlfrfxf.exec:\rlfrfxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\lxxfxll.exec:\lxxfxll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\tnhbbh.exec:\tnhbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jpddj.exec:\jpddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\lflfxlr.exec:\lflfxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\3hbbhn.exec:\3hbbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\bbtthh.exec:\bbtthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ppjdj.exec:\ppjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\ffrxlxl.exec:\ffrxlxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\hhbntn.exec:\hhbntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\bbthtb.exec:\bbthtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\9vdjp.exec:\9vdjp.exe17⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5fllflr.exec:\5fllflr.exe18⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xlrrxfx.exec:\xlrrxfx.exe19⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ntnbtb.exec:\ntnbtb.exe20⤵
- Executes dropped EXE
PID:320 -
\??\c:\vvpvj.exec:\vvpvj.exe21⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dvdjv.exec:\dvdjv.exe22⤵
- Executes dropped EXE
PID:1284 -
\??\c:\xrrxlfl.exec:\xrrxlfl.exe23⤵
- Executes dropped EXE
PID:1080 -
\??\c:\1bbbbh.exec:\1bbbbh.exe24⤵
- Executes dropped EXE
PID:1472 -
\??\c:\jvppj.exec:\jvppj.exe25⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jpjjp.exec:\jpjjp.exe26⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lfxrxff.exec:\lfxrxff.exe27⤵
- Executes dropped EXE
PID:2376 -
\??\c:\btntbn.exec:\btntbn.exe28⤵
- Executes dropped EXE
PID:880 -
\??\c:\djjpp.exec:\djjpp.exe29⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jjvjp.exec:\jjvjp.exe30⤵
- Executes dropped EXE
PID:560 -
\??\c:\rrrxllf.exec:\rrrxllf.exe31⤵
- Executes dropped EXE
PID:572 -
\??\c:\lxxlxff.exec:\lxxlxff.exe32⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3bhbhh.exec:\3bhbhh.exe33⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ddvvv.exec:\ddvvv.exe34⤵
- Executes dropped EXE
PID:1560 -
\??\c:\jdjpv.exec:\jdjpv.exe35⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fxxfllr.exec:\fxxfllr.exe36⤵
- Executes dropped EXE
PID:2528 -
\??\c:\5rffflr.exec:\5rffflr.exe37⤵
- Executes dropped EXE
PID:1280 -
\??\c:\bnbhnn.exec:\bnbhnn.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tnttth.exec:\tnttth.exe39⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pjppv.exec:\pjppv.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vjpvv.exec:\vjpvv.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\frfllfl.exec:\frfllfl.exe42⤵
- Executes dropped EXE
PID:2480 -
\??\c:\llfrxxf.exec:\llfrxxf.exe43⤵
- Executes dropped EXE
PID:2448 -
\??\c:\3nnbhh.exec:\3nnbhh.exe44⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vdjpp.exec:\vdjpp.exe45⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pdpjp.exec:\pdpjp.exe46⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lflxrrf.exec:\lflxrrf.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lxxfflx.exec:\lxxfflx.exe48⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bnthtt.exec:\bnthtt.exe49⤵
- Executes dropped EXE
PID:2216 -
\??\c:\5htbtn.exec:\5htbtn.exe50⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vpvpv.exec:\vpvpv.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\9llrxfl.exec:\9llrxfl.exe52⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1xflrrr.exec:\1xflrrr.exe53⤵
- Executes dropped EXE
PID:1640 -
\??\c:\thhhhn.exec:\thhhhn.exe54⤵
- Executes dropped EXE
PID:2316 -
\??\c:\btbhhn.exec:\btbhhn.exe55⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dpdjp.exec:\dpdjp.exe56⤵
- Executes dropped EXE
PID:828 -
\??\c:\jvjpv.exec:\jvjpv.exe57⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rllrflf.exec:\rllrflf.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bttbht.exec:\bttbht.exe59⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nhnbhh.exec:\nhnbhh.exe60⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jddpv.exec:\jddpv.exe61⤵
- Executes dropped EXE
PID:484 -
\??\c:\vpjpd.exec:\vpjpd.exe62⤵
- Executes dropped EXE
PID:324 -
\??\c:\rlxxflf.exec:\rlxxflf.exe63⤵
- Executes dropped EXE
PID:1644 -
\??\c:\frfrrlr.exec:\frfrrlr.exe64⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ttntbb.exec:\ttntbb.exe65⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nhbbnt.exec:\nhbbnt.exe66⤵PID:1668
-
\??\c:\vjvdd.exec:\vjvdd.exe67⤵PID:1784
-
\??\c:\9dvpv.exec:\9dvpv.exe68⤵PID:3012
-
\??\c:\xrrxfxf.exec:\xrrxfxf.exe69⤵PID:880
-
\??\c:\bthnnn.exec:\bthnnn.exe70⤵PID:2972
-
\??\c:\hbthtb.exec:\hbthtb.exe71⤵PID:1908
-
\??\c:\5vpdd.exec:\5vpdd.exe72⤵PID:2828
-
\??\c:\jjjvp.exec:\jjjvp.exe73⤵PID:1100
-
\??\c:\xlxxfxl.exec:\xlxxfxl.exe74⤵PID:1928
-
\??\c:\fxrffxx.exec:\fxrffxx.exe75⤵PID:2212
-
\??\c:\bnnhhh.exec:\bnnhhh.exe76⤵PID:1112
-
\??\c:\dvjpv.exec:\dvjpv.exe77⤵PID:2924
-
\??\c:\7pdpv.exec:\7pdpv.exe78⤵PID:2640
-
\??\c:\fxlfffr.exec:\fxlfffr.exe79⤵PID:2560
-
\??\c:\3flfrrf.exec:\3flfrrf.exe80⤵PID:2156
-
\??\c:\9hntnb.exec:\9hntnb.exe81⤵PID:2536
-
\??\c:\5nbhbh.exec:\5nbhbh.exe82⤵PID:2548
-
\??\c:\pdjpv.exec:\pdjpv.exe83⤵PID:2476
-
\??\c:\3rffrrr.exec:\3rffrrr.exe84⤵PID:2512
-
\??\c:\rlllflr.exec:\rlllflr.exe85⤵PID:2608
-
\??\c:\nnhbbb.exec:\nnhbbb.exe86⤵PID:2848
-
\??\c:\7bntnn.exec:\7bntnn.exe87⤵PID:1632
-
\??\c:\vjpvp.exec:\vjpvp.exe88⤵PID:1744
-
\??\c:\rfxxfxf.exec:\rfxxfxf.exe89⤵PID:1540
-
\??\c:\rffxxrx.exec:\rffxxrx.exe90⤵PID:1956
-
\??\c:\tnbnbh.exec:\tnbnbh.exe91⤵PID:308
-
\??\c:\9htbbt.exec:\9htbbt.exe92⤵PID:2960
-
\??\c:\djpvj.exec:\djpvj.exe93⤵PID:1944
-
\??\c:\lfxxxfr.exec:\lfxxxfr.exe94⤵PID:1840
-
\??\c:\7lxlrrx.exec:\7lxlrrx.exe95⤵PID:1676
-
\??\c:\tnhnhh.exec:\tnhnhh.exe96⤵PID:1488
-
\??\c:\bnbttt.exec:\bnbttt.exe97⤵PID:1524
-
\??\c:\dpppp.exec:\dpppp.exe98⤵PID:3056
-
\??\c:\jvddj.exec:\jvddj.exe99⤵PID:2064
-
\??\c:\ffffflx.exec:\ffffflx.exe100⤵PID:1924
-
\??\c:\frxffll.exec:\frxffll.exe101⤵PID:2088
-
\??\c:\nbnnhh.exec:\nbnnhh.exe102⤵PID:672
-
\??\c:\5tntbh.exec:\5tntbh.exe103⤵PID:540
-
\??\c:\jjjdj.exec:\jjjdj.exe104⤵PID:1008
-
\??\c:\fxlxflr.exec:\fxlxflr.exe105⤵PID:1124
-
\??\c:\xxfflff.exec:\xxfflff.exe106⤵PID:908
-
\??\c:\hbbntt.exec:\hbbntt.exe107⤵PID:1804
-
\??\c:\nbntbt.exec:\nbntbt.exe108⤵PID:1972
-
\??\c:\jpdjv.exec:\jpdjv.exe109⤵PID:592
-
\??\c:\vddpp.exec:\vddpp.exe110⤵PID:2896
-
\??\c:\xxffrrf.exec:\xxffrrf.exe111⤵PID:1752
-
\??\c:\ffrlrxf.exec:\ffrlrxf.exe112⤵PID:2820
-
\??\c:\bnttnt.exec:\bnttnt.exe113⤵PID:2816
-
\??\c:\jdppv.exec:\jdppv.exe114⤵PID:1500
-
\??\c:\rxrxflr.exec:\rxrxflr.exe115⤵PID:2296
-
\??\c:\hhtbnh.exec:\hhtbnh.exe116⤵PID:2232
-
\??\c:\nnbttt.exec:\nnbttt.exe117⤵PID:1600
-
\??\c:\ppjpv.exec:\ppjpv.exe118⤵PID:1308
-
\??\c:\3ddpv.exec:\3ddpv.exe119⤵PID:2644
-
\??\c:\lfrrflx.exec:\lfrrflx.exe120⤵PID:2588
-
\??\c:\7lxlflr.exec:\7lxlflr.exe121⤵PID:2684
-
\??\c:\thnntb.exec:\thnntb.exe122⤵PID:2440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-