Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 10:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8369597aaeb4f20987229c901e124280N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
8369597aaeb4f20987229c901e124280N.exe
-
Size
75KB
-
MD5
8369597aaeb4f20987229c901e124280
-
SHA1
3d0df5b1a1ea8af70cbec9215080f3b4a80665ae
-
SHA256
b4dd576cb8f3d90fcb0232943c96f0905cff35804fd9cee5b88034cfd316e372
-
SHA512
8e0d640004bd171a4463b204e58e608eb2f0aae194b079846418908d10cf705e89f595aa7ac94f0836bcbc90232ee7c526377bd5f4aea9bba41d09037168dc3f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmP1:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHk
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2668-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1004-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2772 3fxfrxr.exe 2812 nhthbn.exe 2720 vpvdj.exe 2728 vvjpj.exe 2568 7frxxfr.exe 3008 tthntt.exe 1656 7vjpv.exe 1620 bthhbn.exe 2452 thnbhh.exe 2392 vpdjp.exe 2880 9rrlxfr.exe 1904 btnntb.exe 1152 hbbbbh.exe 1992 pjvjv.exe 2900 5jdjv.exe 1784 lllfflr.exe 2032 bttthn.exe 2956 ppdpd.exe 1004 jjvjv.exe 2520 9rlrlrf.exe 2276 xlrrxxl.exe 1772 nhhnhn.exe 840 dvpvp.exe 3056 pjjjv.exe 960 xxlfrfr.exe 1328 llflllx.exe 2376 7pjjj.exe 1096 3lffrrf.exe 1560 rlxfrrl.exe 1296 ppppv.exe 2712 dpdjd.exe 2692 xrrlrrl.exe 2184 rlflflx.exe 2580 7hbnbn.exe 2604 dvjpd.exe 2588 jdvpp.exe 1692 fxxxfxx.exe 3044 3xlxlrx.exe 532 7tttht.exe 800 jdpvd.exe 1028 vvpdv.exe 2252 xrffllr.exe 2164 xxfrxfr.exe 1856 btntbh.exe 2392 nhhhtt.exe 2016 djvpv.exe 2036 pvjdd.exe 1756 xrxlffr.exe 1408 rfxflrx.exe 2892 5htthh.exe 1132 thbnbh.exe 1632 jjddp.exe 2332 1vpvj.exe 1912 1frrrff.exe 2956 ffxxflx.exe 304 hbttbb.exe 1776 hhtbnn.exe 1664 vppvp.exe 1016 jjjpd.exe 1712 frfrrxf.exe 1052 ttbhtt.exe 2192 nhhthn.exe 608 7pvdv.exe 692 pdvvd.exe -
resource yara_rule behavioral1/memory/2668-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1004-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-282-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2772 2668 8369597aaeb4f20987229c901e124280N.exe 30 PID 2668 wrote to memory of 2772 2668 8369597aaeb4f20987229c901e124280N.exe 30 PID 2668 wrote to memory of 2772 2668 8369597aaeb4f20987229c901e124280N.exe 30 PID 2668 wrote to memory of 2772 2668 8369597aaeb4f20987229c901e124280N.exe 30 PID 2772 wrote to memory of 2812 2772 3fxfrxr.exe 31 PID 2772 wrote to memory of 2812 2772 3fxfrxr.exe 31 PID 2772 wrote to memory of 2812 2772 3fxfrxr.exe 31 PID 2772 wrote to memory of 2812 2772 3fxfrxr.exe 31 PID 2812 wrote to memory of 2720 2812 nhthbn.exe 32 PID 2812 wrote to memory of 2720 2812 nhthbn.exe 32 PID 2812 wrote to memory of 2720 2812 nhthbn.exe 32 PID 2812 wrote to memory of 2720 2812 nhthbn.exe 32 PID 2720 wrote to memory of 2728 2720 vpvdj.exe 33 PID 2720 wrote to memory of 2728 2720 vpvdj.exe 33 PID 2720 wrote to memory of 2728 2720 vpvdj.exe 33 PID 2720 wrote to memory of 2728 2720 vpvdj.exe 33 PID 2728 wrote to memory of 2568 2728 vvjpj.exe 34 PID 2728 wrote to memory of 2568 2728 vvjpj.exe 34 PID 2728 wrote to memory of 2568 2728 vvjpj.exe 34 PID 2728 wrote to memory of 2568 2728 vvjpj.exe 34 PID 2568 wrote to memory of 3008 2568 7frxxfr.exe 35 PID 2568 wrote to memory of 3008 2568 7frxxfr.exe 35 PID 2568 wrote to memory of 3008 2568 7frxxfr.exe 35 PID 2568 wrote to memory of 3008 2568 7frxxfr.exe 35 PID 3008 wrote to memory of 1656 3008 tthntt.exe 36 PID 3008 wrote to memory of 1656 3008 tthntt.exe 36 PID 3008 wrote to memory of 1656 3008 tthntt.exe 36 PID 3008 wrote to memory of 1656 3008 tthntt.exe 36 PID 1656 wrote to memory of 1620 1656 7vjpv.exe 37 PID 1656 wrote to memory of 1620 1656 7vjpv.exe 37 PID 1656 wrote to memory of 1620 1656 7vjpv.exe 37 PID 1656 wrote to memory of 1620 1656 7vjpv.exe 37 PID 1620 wrote to memory of 2452 1620 bthhbn.exe 38 PID 1620 wrote to memory of 2452 1620 bthhbn.exe 38 PID 1620 wrote to memory of 2452 1620 bthhbn.exe 38 PID 1620 wrote to memory of 2452 1620 bthhbn.exe 38 PID 2452 wrote to memory of 2392 2452 thnbhh.exe 39 PID 2452 wrote to memory of 2392 2452 thnbhh.exe 39 PID 2452 wrote to memory of 2392 2452 thnbhh.exe 39 PID 2452 wrote to memory of 2392 2452 thnbhh.exe 39 PID 2392 wrote to memory of 2880 2392 vpdjp.exe 40 PID 2392 wrote to memory of 2880 2392 vpdjp.exe 40 PID 2392 wrote to memory of 2880 2392 vpdjp.exe 40 PID 2392 wrote to memory of 2880 2392 vpdjp.exe 40 PID 2880 wrote to memory of 1904 2880 9rrlxfr.exe 41 PID 2880 wrote to memory of 1904 2880 9rrlxfr.exe 41 PID 2880 wrote to memory of 1904 2880 9rrlxfr.exe 41 PID 2880 wrote to memory of 1904 2880 9rrlxfr.exe 41 PID 1904 wrote to memory of 1152 1904 btnntb.exe 42 PID 1904 wrote to memory of 1152 1904 btnntb.exe 42 PID 1904 wrote to memory of 1152 1904 btnntb.exe 42 PID 1904 wrote to memory of 1152 1904 btnntb.exe 42 PID 1152 wrote to memory of 1992 1152 hbbbbh.exe 43 PID 1152 wrote to memory of 1992 1152 hbbbbh.exe 43 PID 1152 wrote to memory of 1992 1152 hbbbbh.exe 43 PID 1152 wrote to memory of 1992 1152 hbbbbh.exe 43 PID 1992 wrote to memory of 2900 1992 pjvjv.exe 44 PID 1992 wrote to memory of 2900 1992 pjvjv.exe 44 PID 1992 wrote to memory of 2900 1992 pjvjv.exe 44 PID 1992 wrote to memory of 2900 1992 pjvjv.exe 44 PID 2900 wrote to memory of 1784 2900 5jdjv.exe 45 PID 2900 wrote to memory of 1784 2900 5jdjv.exe 45 PID 2900 wrote to memory of 1784 2900 5jdjv.exe 45 PID 2900 wrote to memory of 1784 2900 5jdjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8369597aaeb4f20987229c901e124280N.exe"C:\Users\Admin\AppData\Local\Temp\8369597aaeb4f20987229c901e124280N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\3fxfrxr.exec:\3fxfrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nhthbn.exec:\nhthbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vpvdj.exec:\vpvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\vvjpj.exec:\vvjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\7frxxfr.exec:\7frxxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\tthntt.exec:\tthntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\7vjpv.exec:\7vjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\bthhbn.exec:\bthhbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\thnbhh.exec:\thnbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\vpdjp.exec:\vpdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\9rrlxfr.exec:\9rrlxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\btnntb.exec:\btnntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\hbbbbh.exec:\hbbbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\pjvjv.exec:\pjvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\5jdjv.exec:\5jdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\lllfflr.exec:\lllfflr.exe17⤵
- Executes dropped EXE
PID:1784 -
\??\c:\bttthn.exec:\bttthn.exe18⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ppdpd.exec:\ppdpd.exe19⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jjvjv.exec:\jjvjv.exe20⤵
- Executes dropped EXE
PID:1004 -
\??\c:\9rlrlrf.exec:\9rlrlrf.exe21⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xlrrxxl.exec:\xlrrxxl.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nhhnhn.exec:\nhhnhn.exe23⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dvpvp.exec:\dvpvp.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\pjjjv.exec:\pjjjv.exe25⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xxlfrfr.exec:\xxlfrfr.exe26⤵
- Executes dropped EXE
PID:960 -
\??\c:\llflllx.exec:\llflllx.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\7pjjj.exec:\7pjjj.exe28⤵
- Executes dropped EXE
PID:2376 -
\??\c:\3lffrrf.exec:\3lffrrf.exe29⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe30⤵
- Executes dropped EXE
PID:1560 -
\??\c:\ppppv.exec:\ppppv.exe31⤵
- Executes dropped EXE
PID:1296 -
\??\c:\dpdjd.exec:\dpdjd.exe32⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xrrlrrl.exec:\xrrlrrl.exe33⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rlflflx.exec:\rlflflx.exe34⤵
- Executes dropped EXE
PID:2184 -
\??\c:\7hbnbn.exec:\7hbnbn.exe35⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dvjpd.exec:\dvjpd.exe36⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jdvpp.exec:\jdvpp.exe37⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fxxxfxx.exec:\fxxxfxx.exe38⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3xlxlrx.exec:\3xlxlrx.exe39⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7tttht.exec:\7tttht.exe40⤵
- Executes dropped EXE
PID:532 -
\??\c:\jdpvd.exec:\jdpvd.exe41⤵
- Executes dropped EXE
PID:800 -
\??\c:\vvpdv.exec:\vvpdv.exe42⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xrffllr.exec:\xrffllr.exe43⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xxfrxfr.exec:\xxfrxfr.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\btntbh.exec:\btntbh.exe45⤵
- Executes dropped EXE
PID:1856 -
\??\c:\nhhhtt.exec:\nhhhtt.exe46⤵
- Executes dropped EXE
PID:2392 -
\??\c:\djvpv.exec:\djvpv.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pvjdd.exec:\pvjdd.exe48⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xrxlffr.exec:\xrxlffr.exe49⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rfxflrx.exec:\rfxflrx.exe50⤵
- Executes dropped EXE
PID:1408 -
\??\c:\5htthh.exec:\5htthh.exe51⤵
- Executes dropped EXE
PID:2892 -
\??\c:\thbnbh.exec:\thbnbh.exe52⤵
- Executes dropped EXE
PID:1132 -
\??\c:\jjddp.exec:\jjddp.exe53⤵
- Executes dropped EXE
PID:1632 -
\??\c:\1vpvj.exec:\1vpvj.exe54⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1frrrff.exec:\1frrrff.exe55⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ffxxflx.exec:\ffxxflx.exe56⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hbttbb.exec:\hbttbb.exe57⤵
- Executes dropped EXE
PID:304 -
\??\c:\hhtbnn.exec:\hhtbnn.exe58⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vppvp.exec:\vppvp.exe59⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jjjpd.exec:\jjjpd.exe60⤵
- Executes dropped EXE
PID:1016 -
\??\c:\frfrrxf.exec:\frfrrxf.exe61⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ttbhtt.exec:\ttbhtt.exe62⤵
- Executes dropped EXE
PID:1052 -
\??\c:\nhhthn.exec:\nhhthn.exe63⤵
- Executes dropped EXE
PID:2192 -
\??\c:\7pvdv.exec:\7pvdv.exe64⤵
- Executes dropped EXE
PID:608 -
\??\c:\pdvvd.exec:\pdvvd.exe65⤵
- Executes dropped EXE
PID:692 -
\??\c:\3lflrrf.exec:\3lflrrf.exe66⤵PID:1320
-
\??\c:\5lfxlfr.exec:\5lfxlfr.exe67⤵PID:1624
-
\??\c:\hthbbn.exec:\hthbbn.exe68⤵PID:2920
-
\??\c:\nhbhhn.exec:\nhbhhn.exe69⤵PID:896
-
\??\c:\jjdpd.exec:\jjdpd.exe70⤵PID:2080
-
\??\c:\jdppd.exec:\jdppd.exe71⤵PID:2748
-
\??\c:\lxlxflf.exec:\lxlxflf.exe72⤵PID:2564
-
\??\c:\xrfrxrx.exec:\xrfrxrx.exe73⤵PID:2756
-
\??\c:\1tnbhh.exec:\1tnbhh.exe74⤵PID:1936
-
\??\c:\9tnntb.exec:\9tnntb.exe75⤵PID:2592
-
\??\c:\7vjvj.exec:\7vjvj.exe76⤵PID:2724
-
\??\c:\pjdjp.exec:\pjdjp.exe77⤵PID:2604
-
\??\c:\fffrxrf.exec:\fffrxrf.exe78⤵PID:1396
-
\??\c:\1bnbnt.exec:\1bnbnt.exe79⤵PID:1692
-
\??\c:\5bthtt.exec:\5bthtt.exe80⤵PID:2632
-
\??\c:\vpvjv.exec:\vpvjv.exe81⤵PID:532
-
\??\c:\vpdvp.exec:\vpdvp.exe82⤵PID:1248
-
\??\c:\1lfflrx.exec:\1lfflrx.exe83⤵PID:1028
-
\??\c:\3rlxlrf.exec:\3rlxlrf.exe84⤵PID:2188
-
\??\c:\bnnbnt.exec:\bnnbnt.exe85⤵PID:2164
-
\??\c:\nnhhbb.exec:\nnhhbb.exe86⤵PID:1856
-
\??\c:\dvjpd.exec:\dvjpd.exe87⤵PID:2392
-
\??\c:\1pjjj.exec:\1pjjj.exe88⤵PID:2860
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe89⤵PID:2036
-
\??\c:\lflxflx.exec:\lflxflx.exe90⤵PID:2868
-
\??\c:\3tnnbh.exec:\3tnnbh.exe91⤵PID:1408
-
\??\c:\dpdjv.exec:\dpdjv.exe92⤵PID:2900
-
\??\c:\1pppv.exec:\1pppv.exe93⤵PID:1132
-
\??\c:\rfxfxfl.exec:\rfxfxfl.exe94⤵PID:1932
-
\??\c:\frlfrxx.exec:\frlfrxx.exe95⤵PID:2332
-
\??\c:\7bbhbb.exec:\7bbhbb.exe96⤵PID:1640
-
\??\c:\thtbnt.exec:\thtbnt.exe97⤵PID:2956
-
\??\c:\vpddj.exec:\vpddj.exe98⤵PID:1960
-
\??\c:\vpjjj.exec:\vpjjj.exe99⤵PID:1776
-
\??\c:\rfrxflr.exec:\rfrxflr.exe100⤵PID:276
-
\??\c:\rfflxfl.exec:\rfflxfl.exe101⤵PID:404
-
\??\c:\nnhhhh.exec:\nnhhhh.exe102⤵PID:1964
-
\??\c:\hhtttt.exec:\hhtttt.exe103⤵PID:1052
-
\??\c:\3dpdp.exec:\3dpdp.exe104⤵PID:1288
-
\??\c:\pjvjv.exec:\pjvjv.exe105⤵PID:608
-
\??\c:\9djpd.exec:\9djpd.exe106⤵PID:2380
-
\??\c:\rfrrxrf.exec:\rfrrxrf.exe107⤵PID:1320
-
\??\c:\fxrrflf.exec:\fxrrflf.exe108⤵PID:2428
-
\??\c:\nnbhnt.exec:\nnbhnt.exe109⤵PID:2920
-
\??\c:\nnhhbt.exec:\nnhhbt.exe110⤵PID:2788
-
\??\c:\1djdp.exec:\1djdp.exe111⤵PID:2080
-
\??\c:\pjvdj.exec:\pjvdj.exe112⤵PID:2712
-
\??\c:\xxflxxr.exec:\xxflxxr.exe113⤵PID:2564
-
\??\c:\7lxflrf.exec:\7lxflrf.exe114⤵PID:2812
-
\??\c:\ppjjv.exec:\ppjjv.exe115⤵PID:2676
-
\??\c:\1ddpd.exec:\1ddpd.exe116⤵PID:2728
-
\??\c:\frffrrx.exec:\frffrrx.exe117⤵PID:1556
-
\??\c:\rrlrflr.exec:\rrlrflr.exe118⤵PID:2680
-
\??\c:\xxxrlxf.exec:\xxxrlxf.exe119⤵PID:1044
-
\??\c:\btnthh.exec:\btnthh.exe120⤵PID:588
-
\??\c:\1pjvv.exec:\1pjvv.exe121⤵PID:1924
-
\??\c:\vjjjp.exec:\vjjjp.exe122⤵PID:1656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-