Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 12:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe
-
Size
64KB
-
MD5
23babc5fb7485d6f4a539544582ac0a0
-
SHA1
47b4d56548cb50773d284411097776c544c27486
-
SHA256
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563
-
SHA512
2a680fd0be0ee2b0d766c684847c47fc28bb65d77e52f283c4b2db90ffd2654b351aaaf84f1bf32f849b889c0ba8e43d9abef0d275087adcd236c79aa6fd181b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B1R:ymb3NkkiQ3mdBjFI9cD
Malware Config
Signatures
-
Detect Blackmoon payload 17 IoCs
resource yara_rule behavioral1/memory/1624-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2300 ppjvp.exe 2348 3xfflfr.exe 2652 tntnnh.exe 2760 vpvdd.exe 2684 rrfxrfx.exe 2832 lxxxrrl.exe 2724 5tnnnn.exe 2576 1pjjj.exe 2608 1pddd.exe 1736 xlrrfxf.exe 2388 xlrrxfl.exe 1892 7frffff.exe 2384 hbnnbn.exe 1828 7nhnhb.exe 1508 ppddd.exe 1224 vjpjj.exe 2016 xrfxlrx.exe 468 fflrflr.exe 1664 3hnntn.exe 1972 hbnhnh.exe 1120 vjppp.exe 836 jjvdj.exe 1896 lfrrxrf.exe 1740 3lffllx.exe 2800 bnbbhh.exe 2416 hnbhnn.exe 2064 pdvdd.exe 2532 jvvpp.exe 1832 ffrxxrf.exe 2480 7lxxffl.exe 2452 nbnbnh.exe 2108 vjppd.exe 2700 5dpjp.exe 2784 1frfffl.exe 2716 fxflrll.exe 2844 lfllrxf.exe 2592 1hnhhh.exe 2696 thtnnn.exe 2812 7jpjp.exe 2624 dpdjv.exe 2396 9vjvv.exe 3048 9flllll.exe 1816 rlffllr.exe 2904 bhttnh.exe 2544 hnhbbb.exe 640 7httnn.exe 572 jpvdd.exe 1196 5pddd.exe 1436 7frrrrr.exe 1748 1rlrrxf.exe 1224 xlxrrrr.exe 2660 3ntbbt.exe 2244 5bnhhb.exe 2200 7jpjd.exe 1620 vpdpd.exe 1456 jvvvv.exe 972 lfxrlll.exe 1672 5xfxlff.exe 2988 nhbbhb.exe 920 1bhhnn.exe 2228 pjpdj.exe 1528 pdvpp.exe 1328 1llffff.exe 2360 xlxllll.exe -
resource yara_rule behavioral1/memory/2300-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-278-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1624 wrote to memory of 2300 1624 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 31 PID 1624 wrote to memory of 2300 1624 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 31 PID 1624 wrote to memory of 2300 1624 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 31 PID 1624 wrote to memory of 2300 1624 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 31 PID 2300 wrote to memory of 2348 2300 ppjvp.exe 32 PID 2300 wrote to memory of 2348 2300 ppjvp.exe 32 PID 2300 wrote to memory of 2348 2300 ppjvp.exe 32 PID 2300 wrote to memory of 2348 2300 ppjvp.exe 32 PID 2348 wrote to memory of 2652 2348 3xfflfr.exe 33 PID 2348 wrote to memory of 2652 2348 3xfflfr.exe 33 PID 2348 wrote to memory of 2652 2348 3xfflfr.exe 33 PID 2348 wrote to memory of 2652 2348 3xfflfr.exe 33 PID 2652 wrote to memory of 2760 2652 tntnnh.exe 34 PID 2652 wrote to memory of 2760 2652 tntnnh.exe 34 PID 2652 wrote to memory of 2760 2652 tntnnh.exe 34 PID 2652 wrote to memory of 2760 2652 tntnnh.exe 34 PID 2760 wrote to memory of 2684 2760 vpvdd.exe 35 PID 2760 wrote to memory of 2684 2760 vpvdd.exe 35 PID 2760 wrote to memory of 2684 2760 vpvdd.exe 35 PID 2760 wrote to memory of 2684 2760 vpvdd.exe 35 PID 2684 wrote to memory of 2832 2684 rrfxrfx.exe 36 PID 2684 wrote to memory of 2832 2684 rrfxrfx.exe 36 PID 2684 wrote to memory of 2832 2684 rrfxrfx.exe 36 PID 2684 wrote to memory of 2832 2684 rrfxrfx.exe 36 PID 2832 wrote to memory of 2724 2832 lxxxrrl.exe 37 PID 2832 wrote to memory of 2724 2832 lxxxrrl.exe 37 PID 2832 wrote to memory of 2724 2832 lxxxrrl.exe 37 PID 2832 wrote to memory of 2724 2832 lxxxrrl.exe 37 PID 2724 wrote to memory of 2576 2724 5tnnnn.exe 38 PID 2724 wrote to memory of 2576 2724 5tnnnn.exe 38 PID 2724 wrote to memory of 2576 2724 5tnnnn.exe 38 PID 2724 wrote to memory of 2576 2724 5tnnnn.exe 38 PID 2576 wrote to memory of 2608 2576 1pjjj.exe 39 PID 2576 wrote to memory of 2608 2576 1pjjj.exe 39 PID 2576 wrote to memory of 2608 2576 1pjjj.exe 39 PID 2576 wrote to memory of 2608 2576 1pjjj.exe 39 PID 2608 wrote to memory of 1736 2608 1pddd.exe 40 PID 2608 wrote to memory of 1736 2608 1pddd.exe 40 PID 2608 wrote to memory of 1736 2608 1pddd.exe 40 PID 2608 wrote to memory of 1736 2608 1pddd.exe 40 PID 1736 wrote to memory of 2388 1736 xlrrfxf.exe 41 PID 1736 wrote to memory of 2388 1736 xlrrfxf.exe 41 PID 1736 wrote to memory of 2388 1736 xlrrfxf.exe 41 PID 1736 wrote to memory of 2388 1736 xlrrfxf.exe 41 PID 2388 wrote to memory of 1892 2388 xlrrxfl.exe 42 PID 2388 wrote to memory of 1892 2388 xlrrxfl.exe 42 PID 2388 wrote to memory of 1892 2388 xlrrxfl.exe 42 PID 2388 wrote to memory of 1892 2388 xlrrxfl.exe 42 PID 1892 wrote to memory of 2384 1892 7frffff.exe 43 PID 1892 wrote to memory of 2384 1892 7frffff.exe 43 PID 1892 wrote to memory of 2384 1892 7frffff.exe 43 PID 1892 wrote to memory of 2384 1892 7frffff.exe 43 PID 2384 wrote to memory of 1828 2384 hbnnbn.exe 44 PID 2384 wrote to memory of 1828 2384 hbnnbn.exe 44 PID 2384 wrote to memory of 1828 2384 hbnnbn.exe 44 PID 2384 wrote to memory of 1828 2384 hbnnbn.exe 44 PID 1828 wrote to memory of 1508 1828 7nhnhb.exe 45 PID 1828 wrote to memory of 1508 1828 7nhnhb.exe 45 PID 1828 wrote to memory of 1508 1828 7nhnhb.exe 45 PID 1828 wrote to memory of 1508 1828 7nhnhb.exe 45 PID 1508 wrote to memory of 1224 1508 ppddd.exe 46 PID 1508 wrote to memory of 1224 1508 ppddd.exe 46 PID 1508 wrote to memory of 1224 1508 ppddd.exe 46 PID 1508 wrote to memory of 1224 1508 ppddd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe"C:\Users\Admin\AppData\Local\Temp\06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\ppjvp.exec:\ppjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\3xfflfr.exec:\3xfflfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\tntnnh.exec:\tntnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vpvdd.exec:\vpvdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\rrfxrfx.exec:\rrfxrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\5tnnnn.exec:\5tnnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1pjjj.exec:\1pjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\1pddd.exec:\1pddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xlrrfxf.exec:\xlrrfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\xlrrxfl.exec:\xlrrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\7frffff.exec:\7frffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\hbnnbn.exec:\hbnnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\7nhnhb.exec:\7nhnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\ppddd.exec:\ppddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\vjpjj.exec:\vjpjj.exe17⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xrfxlrx.exec:\xrfxlrx.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\fflrflr.exec:\fflrflr.exe19⤵
- Executes dropped EXE
PID:468 -
\??\c:\3hnntn.exec:\3hnntn.exe20⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hbnhnh.exec:\hbnhnh.exe21⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vjppp.exec:\vjppp.exe22⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jjvdj.exec:\jjvdj.exe23⤵
- Executes dropped EXE
PID:836 -
\??\c:\lfrrxrf.exec:\lfrrxrf.exe24⤵
- Executes dropped EXE
PID:1896 -
\??\c:\3lffllx.exec:\3lffllx.exe25⤵
- Executes dropped EXE
PID:1740 -
\??\c:\bnbbhh.exec:\bnbbhh.exe26⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hnbhnn.exec:\hnbhnn.exe27⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pdvdd.exec:\pdvdd.exe28⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jvvpp.exec:\jvvpp.exe29⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ffrxxrf.exec:\ffrxxrf.exe30⤵
- Executes dropped EXE
PID:1832 -
\??\c:\7lxxffl.exec:\7lxxffl.exe31⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nbnbnh.exec:\nbnbnh.exe32⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vjppd.exec:\vjppd.exe33⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5dpjp.exec:\5dpjp.exe34⤵
- Executes dropped EXE
PID:2700 -
\??\c:\1frfffl.exec:\1frfffl.exe35⤵
- Executes dropped EXE
PID:2784 -
\??\c:\fxflrll.exec:\fxflrll.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lfllrxf.exec:\lfllrxf.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1hnhhh.exec:\1hnhhh.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\thtnnn.exec:\thtnnn.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7jpjp.exec:\7jpjp.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\dpdjv.exec:\dpdjv.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9vjvv.exec:\9vjvv.exe42⤵
- Executes dropped EXE
PID:2396 -
\??\c:\9flllll.exec:\9flllll.exe43⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rlffllr.exec:\rlffllr.exe44⤵
- Executes dropped EXE
PID:1816 -
\??\c:\bhttnh.exec:\bhttnh.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hnhbbb.exec:\hnhbbb.exe46⤵
- Executes dropped EXE
PID:2544 -
\??\c:\7httnn.exec:\7httnn.exe47⤵
- Executes dropped EXE
PID:640 -
\??\c:\jpvdd.exec:\jpvdd.exe48⤵
- Executes dropped EXE
PID:572 -
\??\c:\5pddd.exec:\5pddd.exe49⤵
- Executes dropped EXE
PID:1196 -
\??\c:\7frrrrr.exec:\7frrrrr.exe50⤵
- Executes dropped EXE
PID:1436 -
\??\c:\1rlrrxf.exec:\1rlrrxf.exe51⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe52⤵
- Executes dropped EXE
PID:1224 -
\??\c:\3ntbbt.exec:\3ntbbt.exe53⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5bnhhb.exec:\5bnhhb.exe54⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7jpjd.exec:\7jpjd.exe55⤵
- Executes dropped EXE
PID:2200 -
\??\c:\vpdpd.exec:\vpdpd.exe56⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jvvvv.exec:\jvvvv.exe57⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lfxrlll.exec:\lfxrlll.exe58⤵
- Executes dropped EXE
PID:972 -
\??\c:\5xfxlff.exec:\5xfxlff.exe59⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nhbbhb.exec:\nhbbhb.exe60⤵
- Executes dropped EXE
PID:2988 -
\??\c:\1bhhnn.exec:\1bhhnn.exe61⤵
- Executes dropped EXE
PID:920 -
\??\c:\pjpdj.exec:\pjpdj.exe62⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pdvpp.exec:\pdvpp.exe63⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1llffff.exec:\1llffff.exe64⤵
- Executes dropped EXE
PID:1328 -
\??\c:\xlxllll.exec:\xlxllll.exe65⤵
- Executes dropped EXE
PID:2360 -
\??\c:\lrxxrlr.exec:\lrxxrlr.exe66⤵PID:2060
-
\??\c:\thhntb.exec:\thhntb.exe67⤵PID:1576
-
\??\c:\nbnhhb.exec:\nbnhhb.exe68⤵PID:2072
-
\??\c:\5dpjd.exec:\5dpjd.exe69⤵PID:2300
-
\??\c:\1dvpp.exec:\1dvpp.exe70⤵PID:2840
-
\??\c:\9frrrxr.exec:\9frrrxr.exe71⤵PID:2280
-
\??\c:\lfllllr.exec:\lfllllr.exe72⤵PID:2140
-
\??\c:\ntttnn.exec:\ntttnn.exe73⤵PID:2976
-
\??\c:\vvddd.exec:\vvddd.exe74⤵PID:2780
-
\??\c:\vpdpv.exec:\vpdpv.exe75⤵PID:2964
-
\??\c:\xlrlfrx.exec:\xlrlfrx.exe76⤵PID:2860
-
\??\c:\frxrrll.exec:\frxrrll.exe77⤵PID:2604
-
\??\c:\thntnn.exec:\thntnn.exe78⤵PID:2572
-
\??\c:\nhtbhb.exec:\nhtbhb.exe79⤵PID:344
-
\??\c:\tntnnn.exec:\tntnnn.exe80⤵PID:1028
-
\??\c:\pjjvp.exec:\pjjvp.exe81⤵PID:2448
-
\??\c:\vpddv.exec:\vpddv.exe82⤵PID:1736
-
\??\c:\llxxllf.exec:\llxxllf.exe83⤵PID:2296
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe84⤵PID:2804
-
\??\c:\bnhnbh.exec:\bnhnbh.exe85⤵PID:1996
-
\??\c:\nbtbhh.exec:\nbtbhh.exe86⤵PID:2916
-
\??\c:\vvjvv.exec:\vvjvv.exe87⤵PID:556
-
\??\c:\dpppj.exec:\dpppj.exe88⤵PID:848
-
\??\c:\3rlxlll.exec:\3rlxlll.exe89⤵PID:2132
-
\??\c:\1xxxlfl.exec:\1xxxlfl.exe90⤵PID:2928
-
\??\c:\7hnnnh.exec:\7hnnnh.exe91⤵PID:2364
-
\??\c:\nttttb.exec:\nttttb.exe92⤵PID:2152
-
\??\c:\3jjpp.exec:\3jjpp.exe93⤵PID:112
-
\??\c:\jdjjp.exec:\jdjjp.exe94⤵PID:1876
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe95⤵PID:2892
-
\??\c:\rfrrffr.exec:\rfrrffr.exe96⤵PID:1244
-
\??\c:\bttnnn.exec:\bttnnn.exe97⤵PID:1744
-
\??\c:\5htbhn.exec:\5htbhn.exe98⤵PID:912
-
\??\c:\pdvvp.exec:\pdvvp.exe99⤵PID:2516
-
\??\c:\pdddv.exec:\pdddv.exe100⤵PID:3032
-
\??\c:\lxffxxx.exec:\lxffxxx.exe101⤵PID:1008
-
\??\c:\rlrrfff.exec:\rlrrfff.exe102⤵PID:1656
-
\??\c:\lxlflll.exec:\lxlflll.exe103⤵PID:884
-
\??\c:\9bhbbn.exec:\9bhbbn.exe104⤵PID:1624
-
\??\c:\3pdvv.exec:\3pdvv.exe105⤵PID:1352
-
\??\c:\jvvvp.exec:\jvvvp.exe106⤵PID:1676
-
\??\c:\flrfllf.exec:\flrfllf.exe107⤵PID:2640
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe108⤵PID:2080
-
\??\c:\bhnbnb.exec:\bhnbnb.exe109⤵PID:2264
-
\??\c:\9tbbtb.exec:\9tbbtb.exe110⤵PID:2700
-
\??\c:\btbbnh.exec:\btbbnh.exe111⤵PID:2712
-
\??\c:\9vjjp.exec:\9vjjp.exe112⤵PID:2564
-
\??\c:\pdvvv.exec:\pdvvv.exe113⤵PID:2252
-
\??\c:\5xxrxxx.exec:\5xxrxxx.exe114⤵PID:2748
-
\??\c:\rflxxxl.exec:\rflxxxl.exe115⤵PID:2552
-
\??\c:\9bhntt.exec:\9bhntt.exe116⤵PID:2632
-
\??\c:\5tbbbb.exec:\5tbbbb.exe117⤵PID:2576
-
\??\c:\thnnnn.exec:\thnnnn.exe118⤵PID:1492
-
\??\c:\dvppj.exec:\dvppj.exe119⤵PID:2932
-
\??\c:\9djjd.exec:\9djjd.exe120⤵PID:2884
-
\??\c:\7djjd.exec:\7djjd.exe121⤵PID:2796
-
\??\c:\9xllxrf.exec:\9xllxrf.exe122⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-