Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe
Resource
win7-20240708-en
General
-
Target
2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe
-
Size
73KB
-
MD5
1bfabca692d1249f8d78d83756c40ae0
-
SHA1
c96e937d4bcb2123238e10fbd4a0255563b334d6
-
SHA256
2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0
-
SHA512
816e3d97199cd9a60484d6d22cb6735555da24211ceb603e91e0052eabf3e3ed79fe738bbc35ef4eb12d7ab10045ad5a643f25478c36878030eefa687583b413
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUcicP/f69q:ymb3NkkiQ3mdBjFI4V4ci2/fOq
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2480-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/544-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3028 rfrrxxx.exe 2668 3rxxxff.exe 2812 bnttbh.exe 2792 9jddp.exe 2568 lrrfxfl.exe 2816 hthbnn.exe 2616 nhnhtt.exe 2032 vpjjp.exe 2908 3xrflrx.exe 1716 3rfrrxf.exe 836 nhnnbh.exe 544 9pjjv.exe 2988 pjvpd.exe 2888 7dpjp.exe 2524 fxflxfr.exe 1916 bthhtt.exe 2732 5ntbtt.exe 1668 jpdjv.exe 2056 ddvdd.exe 448 5frxffr.exe 1232 5nhhnn.exe 976 tnbbnt.exe 1892 dvdjp.exe 684 rfrxrxf.exe 1508 rxllfff.exe 2312 hbbhtb.exe 1276 ntbtth.exe 2452 pvpjp.exe 624 3flflll.exe 2444 3xlxffl.exe 3028 htbhnh.exe 2224 jvjpv.exe 2740 9djpj.exe 2548 rxxrrlr.exe 2700 frxfffl.exe 2332 frxffxf.exe 2588 nbbttt.exe 2556 3djjd.exe 3008 jdjpd.exe 2328 rxxxxxr.exe 680 rllxxrx.exe 1152 1lxffxr.exe 300 htnbtn.exe 1716 5thnnn.exe 1060 jvpjv.exe 828 pvddj.exe 1624 9lrxrlr.exe 3012 7lfffff.exe 2516 1ntntn.exe 1924 bntntt.exe 2208 tnthnt.exe 2960 5jjjj.exe 2204 1jddp.exe 2084 fxlxlrx.exe 2120 xfrfxlf.exe 1664 9hnbtn.exe 1528 1nhbhb.exe 668 dvjvd.exe 976 3xffxrx.exe 820 flrxrfr.exe 1520 xrlflll.exe 2852 3vjvd.exe 664 1jvpp.exe 2636 xlxfrrx.exe -
resource yara_rule behavioral1/memory/2480-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/544-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2480 wrote to memory of 3028 2480 2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe 30 PID 2480 wrote to memory of 3028 2480 2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe 30 PID 2480 wrote to memory of 3028 2480 2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe 30 PID 2480 wrote to memory of 3028 2480 2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe 30 PID 3028 wrote to memory of 2668 3028 rfrrxxx.exe 31 PID 3028 wrote to memory of 2668 3028 rfrrxxx.exe 31 PID 3028 wrote to memory of 2668 3028 rfrrxxx.exe 31 PID 3028 wrote to memory of 2668 3028 rfrrxxx.exe 31 PID 2668 wrote to memory of 2812 2668 3rxxxff.exe 32 PID 2668 wrote to memory of 2812 2668 3rxxxff.exe 32 PID 2668 wrote to memory of 2812 2668 3rxxxff.exe 32 PID 2668 wrote to memory of 2812 2668 3rxxxff.exe 32 PID 2812 wrote to memory of 2792 2812 bnttbh.exe 33 PID 2812 wrote to memory of 2792 2812 bnttbh.exe 33 PID 2812 wrote to memory of 2792 2812 bnttbh.exe 33 PID 2812 wrote to memory of 2792 2812 bnttbh.exe 33 PID 2792 wrote to memory of 2568 2792 9jddp.exe 34 PID 2792 wrote to memory of 2568 2792 9jddp.exe 34 PID 2792 wrote to memory of 2568 2792 9jddp.exe 34 PID 2792 wrote to memory of 2568 2792 9jddp.exe 34 PID 2568 wrote to memory of 2816 2568 lrrfxfl.exe 35 PID 2568 wrote to memory of 2816 2568 lrrfxfl.exe 35 PID 2568 wrote to memory of 2816 2568 lrrfxfl.exe 35 PID 2568 wrote to memory of 2816 2568 lrrfxfl.exe 35 PID 2816 wrote to memory of 2616 2816 hthbnn.exe 36 PID 2816 wrote to memory of 2616 2816 hthbnn.exe 36 PID 2816 wrote to memory of 2616 2816 hthbnn.exe 36 PID 2816 wrote to memory of 2616 2816 hthbnn.exe 36 PID 2616 wrote to memory of 2032 2616 nhnhtt.exe 37 PID 2616 wrote to memory of 2032 2616 nhnhtt.exe 37 PID 2616 wrote to memory of 2032 2616 nhnhtt.exe 37 PID 2616 wrote to memory of 2032 2616 nhnhtt.exe 37 PID 2032 wrote to memory of 2908 2032 vpjjp.exe 38 PID 2032 wrote to memory of 2908 2032 vpjjp.exe 38 PID 2032 wrote to memory of 2908 2032 vpjjp.exe 38 PID 2032 wrote to memory of 2908 2032 vpjjp.exe 38 PID 2908 wrote to memory of 1716 2908 3xrflrx.exe 39 PID 2908 wrote to memory of 1716 2908 3xrflrx.exe 39 PID 2908 wrote to memory of 1716 2908 3xrflrx.exe 39 PID 2908 wrote to memory of 1716 2908 3xrflrx.exe 39 PID 1716 wrote to memory of 836 1716 3rfrrxf.exe 40 PID 1716 wrote to memory of 836 1716 3rfrrxf.exe 40 PID 1716 wrote to memory of 836 1716 3rfrrxf.exe 40 PID 1716 wrote to memory of 836 1716 3rfrrxf.exe 40 PID 836 wrote to memory of 544 836 nhnnbh.exe 41 PID 836 wrote to memory of 544 836 nhnnbh.exe 41 PID 836 wrote to memory of 544 836 nhnnbh.exe 41 PID 836 wrote to memory of 544 836 nhnnbh.exe 41 PID 544 wrote to memory of 2988 544 9pjjv.exe 42 PID 544 wrote to memory of 2988 544 9pjjv.exe 42 PID 544 wrote to memory of 2988 544 9pjjv.exe 42 PID 544 wrote to memory of 2988 544 9pjjv.exe 42 PID 2988 wrote to memory of 2888 2988 pjvpd.exe 43 PID 2988 wrote to memory of 2888 2988 pjvpd.exe 43 PID 2988 wrote to memory of 2888 2988 pjvpd.exe 43 PID 2988 wrote to memory of 2888 2988 pjvpd.exe 43 PID 2888 wrote to memory of 2524 2888 7dpjp.exe 44 PID 2888 wrote to memory of 2524 2888 7dpjp.exe 44 PID 2888 wrote to memory of 2524 2888 7dpjp.exe 44 PID 2888 wrote to memory of 2524 2888 7dpjp.exe 44 PID 2524 wrote to memory of 1916 2524 fxflxfr.exe 45 PID 2524 wrote to memory of 1916 2524 fxflxfr.exe 45 PID 2524 wrote to memory of 1916 2524 fxflxfr.exe 45 PID 2524 wrote to memory of 1916 2524 fxflxfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe"C:\Users\Admin\AppData\Local\Temp\2a310d239f53c4bfab3229394f388c144c219cde22800008b126af676c3d02f0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\rfrrxxx.exec:\rfrrxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\3rxxxff.exec:\3rxxxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bnttbh.exec:\bnttbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\9jddp.exec:\9jddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lrrfxfl.exec:\lrrfxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hthbnn.exec:\hthbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\nhnhtt.exec:\nhnhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vpjjp.exec:\vpjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\3xrflrx.exec:\3xrflrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\3rfrrxf.exec:\3rfrrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\nhnnbh.exec:\nhnnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\9pjjv.exec:\9pjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\pjvpd.exec:\pjvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\7dpjp.exec:\7dpjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fxflxfr.exec:\fxflxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\bthhtt.exec:\bthhtt.exe17⤵
- Executes dropped EXE
PID:1916 -
\??\c:\5ntbtt.exec:\5ntbtt.exe18⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jpdjv.exec:\jpdjv.exe19⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ddvdd.exec:\ddvdd.exe20⤵
- Executes dropped EXE
PID:2056 -
\??\c:\5frxffr.exec:\5frxffr.exe21⤵
- Executes dropped EXE
PID:448 -
\??\c:\5nhhnn.exec:\5nhhnn.exe22⤵
- Executes dropped EXE
PID:1232 -
\??\c:\tnbbnt.exec:\tnbbnt.exe23⤵
- Executes dropped EXE
PID:976 -
\??\c:\dvdjp.exec:\dvdjp.exe24⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rfrxrxf.exec:\rfrxrxf.exe25⤵
- Executes dropped EXE
PID:684 -
\??\c:\rxllfff.exec:\rxllfff.exe26⤵
- Executes dropped EXE
PID:1508 -
\??\c:\hbbhtb.exec:\hbbhtb.exe27⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ntbtth.exec:\ntbtth.exe28⤵
- Executes dropped EXE
PID:1276 -
\??\c:\pvpjp.exec:\pvpjp.exe29⤵
- Executes dropped EXE
PID:2452 -
\??\c:\3flflll.exec:\3flflll.exe30⤵
- Executes dropped EXE
PID:624 -
\??\c:\3xlxffl.exec:\3xlxffl.exe31⤵
- Executes dropped EXE
PID:2444 -
\??\c:\htbhnh.exec:\htbhnh.exe32⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jvjpv.exec:\jvjpv.exe33⤵
- Executes dropped EXE
PID:2224 -
\??\c:\9djpj.exec:\9djpj.exe34⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rxxrrlr.exec:\rxxrrlr.exe35⤵
- Executes dropped EXE
PID:2548 -
\??\c:\frxfffl.exec:\frxfffl.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\frxffxf.exec:\frxffxf.exe37⤵
- Executes dropped EXE
PID:2332 -
\??\c:\nbbttt.exec:\nbbttt.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3djjd.exec:\3djjd.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jdjpd.exec:\jdjpd.exe40⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rxxxxxr.exec:\rxxxxxr.exe41⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rllxxrx.exec:\rllxxrx.exe42⤵
- Executes dropped EXE
PID:680 -
\??\c:\1lxffxr.exec:\1lxffxr.exe43⤵
- Executes dropped EXE
PID:1152 -
\??\c:\htnbtn.exec:\htnbtn.exe44⤵
- Executes dropped EXE
PID:300 -
\??\c:\5thnnn.exec:\5thnnn.exe45⤵
- Executes dropped EXE
PID:1716 -
\??\c:\jvpjv.exec:\jvpjv.exe46⤵
- Executes dropped EXE
PID:1060 -
\??\c:\pvddj.exec:\pvddj.exe47⤵
- Executes dropped EXE
PID:828 -
\??\c:\9lrxrlr.exec:\9lrxrlr.exe48⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7lfffff.exec:\7lfffff.exe49⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1ntntn.exec:\1ntntn.exe50⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bntntt.exec:\bntntt.exe51⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tnthnt.exec:\tnthnt.exe52⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5jjjj.exec:\5jjjj.exe53⤵
- Executes dropped EXE
PID:2960 -
\??\c:\1jddp.exec:\1jddp.exe54⤵
- Executes dropped EXE
PID:2204 -
\??\c:\fxlxlrx.exec:\fxlxlrx.exe55⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xfrfxlf.exec:\xfrfxlf.exe56⤵
- Executes dropped EXE
PID:2120 -
\??\c:\9hnbtn.exec:\9hnbtn.exe57⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1nhbhb.exec:\1nhbhb.exe58⤵
- Executes dropped EXE
PID:1528 -
\??\c:\dvjvd.exec:\dvjvd.exe59⤵
- Executes dropped EXE
PID:668 -
\??\c:\3xffxrx.exec:\3xffxrx.exe60⤵
- Executes dropped EXE
PID:976 -
\??\c:\flrxrfr.exec:\flrxrfr.exe61⤵
- Executes dropped EXE
PID:820 -
\??\c:\xrlflll.exec:\xrlflll.exe62⤵
- Executes dropped EXE
PID:1520 -
\??\c:\3vjvd.exec:\3vjvd.exe63⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1jvpp.exec:\1jvpp.exe64⤵
- Executes dropped EXE
PID:664 -
\??\c:\xlxfrrx.exec:\xlxfrrx.exe65⤵
- Executes dropped EXE
PID:2636 -
\??\c:\3xffrrx.exec:\3xffrrx.exe66⤵PID:872
-
\??\c:\3htbhn.exec:\3htbhn.exe67⤵PID:1988
-
\??\c:\9ntbhb.exec:\9ntbhb.exe68⤵PID:1792
-
\??\c:\pjvjv.exec:\pjvjv.exe69⤵PID:2172
-
\??\c:\dvdjp.exec:\dvdjp.exe70⤵PID:2668
-
\??\c:\frfflfl.exec:\frfflfl.exe71⤵PID:2744
-
\??\c:\rfxxrff.exec:\rfxxrff.exe72⤵PID:2272
-
\??\c:\thntbh.exec:\thntbh.exe73⤵PID:2672
-
\??\c:\htnntn.exec:\htnntn.exe74⤵PID:2944
-
\??\c:\tnthnt.exec:\tnthnt.exe75⤵PID:2720
-
\??\c:\dpddj.exec:\dpddj.exe76⤵PID:2652
-
\??\c:\1vvdd.exec:\1vvdd.exe77⤵PID:2552
-
\??\c:\lrxxxrf.exec:\lrxxxrf.exe78⤵PID:2660
-
\??\c:\9fxxllx.exec:\9fxxllx.exe79⤵PID:2612
-
\??\c:\thnnnn.exec:\thnnnn.exe80⤵PID:2616
-
\??\c:\bnbhnn.exec:\bnbhnn.exe81⤵PID:1472
-
\??\c:\jvjpp.exec:\jvjpp.exe82⤵PID:1676
-
\??\c:\vpjjj.exec:\vpjjj.exe83⤵PID:1312
-
\??\c:\lxllllf.exec:\lxllllf.exe84⤵PID:2288
-
\??\c:\frxxllr.exec:\frxxllr.exe85⤵PID:792
-
\??\c:\httbbh.exec:\httbbh.exe86⤵PID:1636
-
\??\c:\9ntbbh.exec:\9ntbbh.exe87⤵PID:2064
-
\??\c:\vvddv.exec:\vvddv.exe88⤵PID:1044
-
\??\c:\dpjjv.exec:\dpjjv.exe89⤵PID:1904
-
\??\c:\3frrrrx.exec:\3frrrrx.exe90⤵PID:752
-
\??\c:\flfxlfx.exec:\flfxlfx.exe91⤵PID:2940
-
\??\c:\nhhntt.exec:\nhhntt.exe92⤵PID:2408
-
\??\c:\ntbbtn.exec:\ntbbtn.exe93⤵PID:2268
-
\??\c:\jvvdd.exec:\jvvdd.exe94⤵PID:2396
-
\??\c:\ddpjd.exec:\ddpjd.exe95⤵PID:2716
-
\??\c:\3rllxxx.exec:\3rllxxx.exe96⤵PID:2528
-
\??\c:\fxflxrx.exec:\fxflxrx.exe97⤵PID:1600
-
\??\c:\lxfflll.exec:\lxfflll.exe98⤵PID:2304
-
\??\c:\tbtbhn.exec:\tbtbhn.exe99⤵PID:2080
-
\??\c:\jdppp.exec:\jdppp.exe100⤵PID:1892
-
\??\c:\7pppv.exec:\7pppv.exe101⤵PID:1344
-
\??\c:\pvjdd.exec:\pvjdd.exe102⤵PID:1508
-
\??\c:\flrxrrx.exec:\flrxrrx.exe103⤵PID:3048
-
\??\c:\frfxrrr.exec:\frfxrrr.exe104⤵PID:1040
-
\??\c:\nbbhtt.exec:\nbbhtt.exe105⤵PID:2020
-
\??\c:\bnnhhb.exec:\bnnhhb.exe106⤵PID:304
-
\??\c:\thbhnn.exec:\thbhnn.exe107⤵PID:1332
-
\??\c:\jdjvd.exec:\jdjvd.exe108⤵PID:2284
-
\??\c:\jpppj.exec:\jpppj.exe109⤵PID:1576
-
\??\c:\dpjjp.exec:\dpjjp.exe110⤵PID:2760
-
\??\c:\rffflfx.exec:\rffflfx.exe111⤵PID:2688
-
\??\c:\frxfllx.exec:\frxfllx.exe112⤵PID:2740
-
\??\c:\7btbhn.exec:\7btbhn.exe113⤵PID:2792
-
\??\c:\9bntbh.exec:\9bntbh.exe114⤵PID:2784
-
\??\c:\nbhbhh.exec:\nbhbhh.exe115⤵PID:2540
-
\??\c:\vdjjd.exec:\vdjjd.exe116⤵PID:2604
-
\??\c:\pjppd.exec:\pjppd.exe117⤵PID:3056
-
\??\c:\vjvdj.exec:\vjvdj.exe118⤵PID:3008
-
\??\c:\5rrxxrf.exec:\5rrxxrf.exe119⤵PID:2032
-
\??\c:\rfrxxrx.exec:\rfrxxrx.exe120⤵PID:1096
-
\??\c:\9bnnnt.exec:\9bnnnt.exe121⤵PID:748
-
\??\c:\nnnhnn.exec:\nnnhnn.exe122⤵PID:2348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-