Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 00:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe
Resource
win7-20240705-en
6 signatures
150 seconds
General
-
Target
5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe
-
Size
71KB
-
MD5
5206e13281a5a2ec34dd159ed0643c94
-
SHA1
80c17d25e960c1eb58f0e5b245aaec297505ae65
-
SHA256
5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6
-
SHA512
961bab46a51921885139d7faaae396a2e387f8bbd775be16ffb9e38fafac626e343889462d30b72070be750216e08356472f55b2179dc84bc3ecbeaa91f08238
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hgVsz:ymb3NkkiQ3mdBjFIj+qNhgVsz
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2088-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1340-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2924 7lllxxx.exe 2408 nntthn.exe 2740 ttnhnn.exe 3036 7llrxfr.exe 2652 5tnthn.exe 2672 5bthnt.exe 2640 vpvdj.exe 2556 rlflrfx.exe 2476 5nhthn.exe 2708 bbbbnt.exe 2356 ddpdj.exe 1900 lxrrxxl.exe 2232 9nhtnb.exe 2352 9bnttn.exe 2176 jdppv.exe 1408 fxllrxf.exe 1192 hbntbb.exe 1252 9bnntt.exe 2184 vddvd.exe 2336 pjvjp.exe 2748 lfxrfrl.exe 1148 rlxxxfx.exe 1616 nhhnnn.exe 1864 vvvpd.exe 1340 9lfrrxx.exe 2812 3rrflrx.exe 1164 tnhttn.exe 916 bbtnth.exe 1484 pjjdj.exe 2964 xxxlxfl.exe 2872 ttnnhn.exe 2896 bthntb.exe 2632 dvppd.exe 1744 7dpvd.exe 1980 rrlxlxr.exe 2656 llrrxxf.exe 2648 5hhbhn.exe 2984 nhhhnn.exe 2744 vpdvj.exe 2568 dvjvv.exe 2500 7rlllfr.exe 2460 5lrrffl.exe 2192 9hhnbb.exe 2476 9bnbbt.exe 2920 dvjpj.exe 2356 pdppp.exe 2420 fflxrrf.exe 2404 7flrrrl.exe 1400 thbthh.exe 2380 9bbbhh.exe 1736 5jdjv.exe 1608 vvjjj.exe 1652 nnhhhn.exe 1688 dvvjd.exe 2032 jdvvd.exe 1920 xlrlrlr.exe 1988 lfrlrrf.exe 2620 1hbhtn.exe 316 nnhhtb.exe 1576 vpdjd.exe 1616 jvpdd.exe 1016 5frlxxx.exe 2096 htnttb.exe 2812 hbbbhh.exe -
resource yara_rule behavioral1/memory/2088-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2924 2088 5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe 30 PID 2088 wrote to memory of 2924 2088 5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe 30 PID 2088 wrote to memory of 2924 2088 5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe 30 PID 2088 wrote to memory of 2924 2088 5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe 30 PID 2924 wrote to memory of 2408 2924 7lllxxx.exe 31 PID 2924 wrote to memory of 2408 2924 7lllxxx.exe 31 PID 2924 wrote to memory of 2408 2924 7lllxxx.exe 31 PID 2924 wrote to memory of 2408 2924 7lllxxx.exe 31 PID 2408 wrote to memory of 2740 2408 nntthn.exe 32 PID 2408 wrote to memory of 2740 2408 nntthn.exe 32 PID 2408 wrote to memory of 2740 2408 nntthn.exe 32 PID 2408 wrote to memory of 2740 2408 nntthn.exe 32 PID 2740 wrote to memory of 3036 2740 ttnhnn.exe 33 PID 2740 wrote to memory of 3036 2740 ttnhnn.exe 33 PID 2740 wrote to memory of 3036 2740 ttnhnn.exe 33 PID 2740 wrote to memory of 3036 2740 ttnhnn.exe 33 PID 3036 wrote to memory of 2652 3036 7llrxfr.exe 34 PID 3036 wrote to memory of 2652 3036 7llrxfr.exe 34 PID 3036 wrote to memory of 2652 3036 7llrxfr.exe 34 PID 3036 wrote to memory of 2652 3036 7llrxfr.exe 34 PID 2652 wrote to memory of 2672 2652 5tnthn.exe 35 PID 2652 wrote to memory of 2672 2652 5tnthn.exe 35 PID 2652 wrote to memory of 2672 2652 5tnthn.exe 35 PID 2652 wrote to memory of 2672 2652 5tnthn.exe 35 PID 2672 wrote to memory of 2640 2672 5bthnt.exe 36 PID 2672 wrote to memory of 2640 2672 5bthnt.exe 36 PID 2672 wrote to memory of 2640 2672 5bthnt.exe 36 PID 2672 wrote to memory of 2640 2672 5bthnt.exe 36 PID 2640 wrote to memory of 2556 2640 vpvdj.exe 37 PID 2640 wrote to memory of 2556 2640 vpvdj.exe 37 PID 2640 wrote to memory of 2556 2640 vpvdj.exe 37 PID 2640 wrote to memory of 2556 2640 vpvdj.exe 37 PID 2556 wrote to memory of 2476 2556 rlflrfx.exe 38 PID 2556 wrote to memory of 2476 2556 rlflrfx.exe 38 PID 2556 wrote to memory of 2476 2556 rlflrfx.exe 38 PID 2556 wrote to memory of 2476 2556 rlflrfx.exe 38 PID 2476 wrote to memory of 2708 2476 5nhthn.exe 39 PID 2476 wrote to memory of 2708 2476 5nhthn.exe 39 PID 2476 wrote to memory of 2708 2476 5nhthn.exe 39 PID 2476 wrote to memory of 2708 2476 5nhthn.exe 39 PID 2708 wrote to memory of 2356 2708 bbbbnt.exe 40 PID 2708 wrote to memory of 2356 2708 bbbbnt.exe 40 PID 2708 wrote to memory of 2356 2708 bbbbnt.exe 40 PID 2708 wrote to memory of 2356 2708 bbbbnt.exe 40 PID 2356 wrote to memory of 1900 2356 ddpdj.exe 41 PID 2356 wrote to memory of 1900 2356 ddpdj.exe 41 PID 2356 wrote to memory of 1900 2356 ddpdj.exe 41 PID 2356 wrote to memory of 1900 2356 ddpdj.exe 41 PID 1900 wrote to memory of 2232 1900 lxrrxxl.exe 42 PID 1900 wrote to memory of 2232 1900 lxrrxxl.exe 42 PID 1900 wrote to memory of 2232 1900 lxrrxxl.exe 42 PID 1900 wrote to memory of 2232 1900 lxrrxxl.exe 42 PID 2232 wrote to memory of 2352 2232 9nhtnb.exe 43 PID 2232 wrote to memory of 2352 2232 9nhtnb.exe 43 PID 2232 wrote to memory of 2352 2232 9nhtnb.exe 43 PID 2232 wrote to memory of 2352 2232 9nhtnb.exe 43 PID 2352 wrote to memory of 2176 2352 9bnttn.exe 44 PID 2352 wrote to memory of 2176 2352 9bnttn.exe 44 PID 2352 wrote to memory of 2176 2352 9bnttn.exe 44 PID 2352 wrote to memory of 2176 2352 9bnttn.exe 44 PID 2176 wrote to memory of 1408 2176 jdppv.exe 45 PID 2176 wrote to memory of 1408 2176 jdppv.exe 45 PID 2176 wrote to memory of 1408 2176 jdppv.exe 45 PID 2176 wrote to memory of 1408 2176 jdppv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe"C:\Users\Admin\AppData\Local\Temp\5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\7lllxxx.exec:\7lllxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\nntthn.exec:\nntthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\ttnhnn.exec:\ttnhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\7llrxfr.exec:\7llrxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\5tnthn.exec:\5tnthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5bthnt.exec:\5bthnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\vpvdj.exec:\vpvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rlflrfx.exec:\rlflrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5nhthn.exec:\5nhthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\bbbbnt.exec:\bbbbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ddpdj.exec:\ddpdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\lxrrxxl.exec:\lxrrxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\9nhtnb.exec:\9nhtnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\9bnttn.exec:\9bnttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\jdppv.exec:\jdppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\fxllrxf.exec:\fxllrxf.exe17⤵
- Executes dropped EXE
PID:1408 -
\??\c:\hbntbb.exec:\hbntbb.exe18⤵
- Executes dropped EXE
PID:1192 -
\??\c:\9bnntt.exec:\9bnntt.exe19⤵
- Executes dropped EXE
PID:1252 -
\??\c:\vddvd.exec:\vddvd.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\pjvjp.exec:\pjvjp.exe21⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lfxrfrl.exec:\lfxrfrl.exe22⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rlxxxfx.exec:\rlxxxfx.exe23⤵
- Executes dropped EXE
PID:1148 -
\??\c:\nhhnnn.exec:\nhhnnn.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vvvpd.exec:\vvvpd.exe25⤵
- Executes dropped EXE
PID:1864 -
\??\c:\9lfrrxx.exec:\9lfrrxx.exe26⤵
- Executes dropped EXE
PID:1340 -
\??\c:\3rrflrx.exec:\3rrflrx.exe27⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tnhttn.exec:\tnhttn.exe28⤵
- Executes dropped EXE
PID:1164 -
\??\c:\bbtnth.exec:\bbtnth.exe29⤵
- Executes dropped EXE
PID:916 -
\??\c:\pjjdj.exec:\pjjdj.exe30⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xxxlxfl.exec:\xxxlxfl.exe31⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ttnnhn.exec:\ttnnhn.exe32⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bthntb.exec:\bthntb.exe33⤵
- Executes dropped EXE
PID:2896 -
\??\c:\dvppd.exec:\dvppd.exe34⤵
- Executes dropped EXE
PID:2632 -
\??\c:\7dpvd.exec:\7dpvd.exe35⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rrlxlxr.exec:\rrlxlxr.exe36⤵
- Executes dropped EXE
PID:1980 -
\??\c:\llrrxxf.exec:\llrrxxf.exe37⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5hhbhn.exec:\5hhbhn.exe38⤵
- Executes dropped EXE
PID:2648 -
\??\c:\nhhhnn.exec:\nhhhnn.exe39⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vpdvj.exec:\vpdvj.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\dvjvv.exec:\dvjvv.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7rlllfr.exec:\7rlllfr.exe42⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5lrrffl.exec:\5lrrffl.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\9hhnbb.exec:\9hhnbb.exe44⤵
- Executes dropped EXE
PID:2192 -
\??\c:\9bnbbt.exec:\9bnbbt.exe45⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dvjpj.exec:\dvjpj.exe46⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pdppp.exec:\pdppp.exe47⤵
- Executes dropped EXE
PID:2356 -
\??\c:\fflxrrf.exec:\fflxrrf.exe48⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7flrrrl.exec:\7flrrrl.exe49⤵
- Executes dropped EXE
PID:2404 -
\??\c:\thbthh.exec:\thbthh.exe50⤵
- Executes dropped EXE
PID:1400 -
\??\c:\9bbbhh.exec:\9bbbhh.exe51⤵
- Executes dropped EXE
PID:2380 -
\??\c:\5jdjv.exec:\5jdjv.exe52⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vvjjj.exec:\vvjjj.exe53⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nnhhhn.exec:\nnhhhn.exe54⤵
- Executes dropped EXE
PID:1652 -
\??\c:\dvvjd.exec:\dvvjd.exe55⤵
- Executes dropped EXE
PID:1688 -
\??\c:\jdvvd.exec:\jdvvd.exe56⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xlrlrlr.exec:\xlrlrlr.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe58⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1hbhtn.exec:\1hbhtn.exe59⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nnhhtb.exec:\nnhhtb.exe60⤵
- Executes dropped EXE
PID:316 -
\??\c:\vpdjd.exec:\vpdjd.exe61⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jvpdd.exec:\jvpdd.exe62⤵
- Executes dropped EXE
PID:1616 -
\??\c:\5frlxxx.exec:\5frlxxx.exe63⤵
- Executes dropped EXE
PID:1016 -
\??\c:\htnttb.exec:\htnttb.exe64⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hbbbhh.exec:\hbbbhh.exe65⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jdvpd.exec:\jdvpd.exe66⤵PID:1476
-
\??\c:\dpjjj.exec:\dpjjj.exe67⤵PID:1704
-
\??\c:\xrflfrx.exec:\xrflfrx.exe68⤵PID:1752
-
\??\c:\fffxxxr.exec:\fffxxxr.exe69⤵PID:1484
-
\??\c:\bbthtn.exec:\bbthtn.exe70⤵PID:1568
-
\??\c:\3btnnt.exec:\3btnnt.exe71⤵PID:2072
-
\??\c:\vpddd.exec:\vpddd.exe72⤵PID:2196
-
\??\c:\1fxxxxf.exec:\1fxxxxf.exe73⤵PID:2260
-
\??\c:\3llxrxl.exec:\3llxrxl.exe74⤵PID:2632
-
\??\c:\rlffrlx.exec:\rlffrlx.exe75⤵PID:2996
-
\??\c:\hbnttt.exec:\hbnttt.exe76⤵PID:2164
-
\??\c:\jdvdv.exec:\jdvdv.exe77⤵PID:2584
-
\??\c:\jvjpv.exec:\jvjpv.exe78⤵PID:2560
-
\??\c:\rfrxrrx.exec:\rfrxrrx.exe79⤵PID:2668
-
\??\c:\rlxlrxr.exec:\rlxlrxr.exe80⤵PID:2696
-
\??\c:\tnnbtb.exec:\tnnbtb.exe81⤵PID:912
-
\??\c:\jdpdp.exec:\jdpdp.exe82⤵PID:2456
-
\??\c:\jvjjp.exec:\jvjjp.exe83⤵PID:2488
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe84⤵PID:2912
-
\??\c:\rlxllll.exec:\rlxllll.exe85⤵PID:1808
-
\??\c:\tnbbbb.exec:\tnbbbb.exe86⤵PID:1420
-
\??\c:\7nnthn.exec:\7nnthn.exe87⤵PID:2224
-
\??\c:\pjvpp.exec:\pjvpp.exe88⤵PID:2212
-
\??\c:\dpdjd.exec:\dpdjd.exe89⤵PID:1892
-
\??\c:\fxrxxfr.exec:\fxrxxfr.exe90⤵PID:2012
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe91⤵PID:1940
-
\??\c:\7btbbb.exec:\7btbbb.exe92⤵PID:1736
-
\??\c:\thtttt.exec:\thtttt.exe93⤵PID:2332
-
\??\c:\djvjp.exec:\djvjp.exe94⤵PID:1696
-
\??\c:\dvpvd.exec:\dvpvd.exe95⤵PID:1960
-
\??\c:\frfxllr.exec:\frfxllr.exe96⤵PID:1252
-
\??\c:\rfrllff.exec:\rfrllff.exe97⤵PID:2804
-
\??\c:\hhthhn.exec:\hhthhn.exe98⤵PID:2336
-
\??\c:\7hbhtb.exec:\7hbhtb.exe99⤵PID:2860
-
\??\c:\vpddp.exec:\vpddp.exe100⤵PID:1868
-
\??\c:\vjpjp.exec:\vjpjp.exe101⤵PID:1008
-
\??\c:\rlxlxff.exec:\rlxlxff.exe102⤵PID:976
-
\??\c:\5xxlxxf.exec:\5xxlxxf.exe103⤵PID:924
-
\??\c:\hbnhnb.exec:\hbnhnb.exe104⤵PID:3056
-
\??\c:\nbhhhn.exec:\nbhhhn.exe105⤵PID:700
-
\??\c:\dvppj.exec:\dvppj.exe106⤵PID:1336
-
\??\c:\9dpvd.exec:\9dpvd.exe107⤵PID:2824
-
\??\c:\rrfrllr.exec:\rrfrllr.exe108⤵PID:916
-
\??\c:\9xrxlrf.exec:\9xrxlrf.exe109⤵PID:1708
-
\??\c:\btnnnt.exec:\btnnnt.exe110⤵PID:1592
-
\??\c:\1ttbbb.exec:\1ttbbb.exe111⤵PID:2080
-
\??\c:\3bthnn.exec:\3bthnn.exe112⤵PID:2716
-
\??\c:\5vppp.exec:\5vppp.exe113⤵PID:3032
-
\??\c:\pdpvj.exec:\pdpvj.exe114⤵PID:1744
-
\??\c:\xlrrlfl.exec:\xlrrlfl.exe115⤵PID:2704
-
\??\c:\ffrrllr.exec:\ffrrllr.exe116⤵PID:1980
-
\??\c:\9xffllx.exec:\9xffllx.exe117⤵PID:2648
-
\??\c:\htbhhb.exec:\htbhhb.exe118⤵PID:2984
-
\??\c:\tnbthb.exec:\tnbthb.exe119⤵PID:2480
-
\??\c:\jvddv.exec:\jvddv.exe120⤵PID:2744
-
\??\c:\jjvdp.exec:\jjvdp.exe121⤵PID:2500
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe122⤵PID:2444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-