Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-10-2024 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe
-
Size
72KB
-
MD5
b29035d91da4f594db99b20c5d7ae300
-
SHA1
3189860d6452d208233e0e31e9f3c31f22c18c3a
-
SHA256
f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f
-
SHA512
647edeaeb0e9d61238cb4dc28b503caab806d9d7348b25ad4c9b854a65bb7d7d5198a1f889ad8c194663c2a1a40449e2f80d81037ed242056ee30560413e4da1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjW3:ymb3NkkiQ3mdBjFI4Vi
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2696-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2520 btthtt.exe 2104 jjvjp.exe 2260 vvpjp.exe 2924 tnhnbb.exe 2804 pjvvv.exe 2828 xlflrxf.exe 2668 fxrrlrx.exe 2676 7nhnbb.exe 2448 9hbbht.exe 556 jpddj.exe 1256 lrxxxfl.exe 2840 9htbbh.exe 1260 bnbbhn.exe 1720 1vpdv.exe 1952 rllfllr.exe 2420 9hhntt.exe 2852 9bbnbb.exe 2116 jjddp.exe 568 pjvvj.exe 3008 xxrlrxf.exe 1764 nhnnnt.exe 1116 1thbbh.exe 2108 dvjpp.exe 968 pdppd.exe 1056 ffxxrrf.exe 2292 nhntnt.exe 2304 thtbnn.exe 2440 pdppp.exe 1736 dvjpd.exe 1920 9fxlxxr.exe 2404 btnnnn.exe 1856 bthtbn.exe 2104 vvppj.exe 2348 xrffflr.exe 2904 1llxllx.exe 2260 lxllrxx.exe 2984 htbbbt.exe 2772 9bntbb.exe 2640 5vjjp.exe 1684 pjvdd.exe 2628 frxxffr.exe 2244 rfrrxxx.exe 3068 bththh.exe 1248 nnhthn.exe 1160 7djpj.exe 1608 rlxfflr.exe 2872 nhtbnb.exe 2132 5jvvd.exe 2512 9ppdp.exe 692 dvjpd.exe 764 9rxllrl.exe 2016 7lfrlfl.exe 1144 bththh.exe 376 tntbnh.exe 592 jdjjd.exe 3012 5jddd.exe 1680 rlfrxfr.exe 1940 rrrxflx.exe 2996 lxlfllr.exe 952 nnnbtb.exe 2800 bnbbtb.exe 2124 jvdpj.exe 788 vpddj.exe 1032 xrfrffx.exe -
resource yara_rule behavioral1/memory/2696-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1260-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1116-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxffff.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2520 2696 f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe 30 PID 2696 wrote to memory of 2520 2696 f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe 30 PID 2696 wrote to memory of 2520 2696 f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe 30 PID 2696 wrote to memory of 2520 2696 f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe 30 PID 2520 wrote to memory of 2104 2520 btthtt.exe 31 PID 2520 wrote to memory of 2104 2520 btthtt.exe 31 PID 2520 wrote to memory of 2104 2520 btthtt.exe 31 PID 2520 wrote to memory of 2104 2520 btthtt.exe 31 PID 2104 wrote to memory of 2260 2104 jjvjp.exe 32 PID 2104 wrote to memory of 2260 2104 jjvjp.exe 32 PID 2104 wrote to memory of 2260 2104 jjvjp.exe 32 PID 2104 wrote to memory of 2260 2104 jjvjp.exe 32 PID 2260 wrote to memory of 2924 2260 vvpjp.exe 33 PID 2260 wrote to memory of 2924 2260 vvpjp.exe 33 PID 2260 wrote to memory of 2924 2260 vvpjp.exe 33 PID 2260 wrote to memory of 2924 2260 vvpjp.exe 33 PID 2924 wrote to memory of 2804 2924 tnhnbb.exe 34 PID 2924 wrote to memory of 2804 2924 tnhnbb.exe 34 PID 2924 wrote to memory of 2804 2924 tnhnbb.exe 34 PID 2924 wrote to memory of 2804 2924 tnhnbb.exe 34 PID 2804 wrote to memory of 2828 2804 pjvvv.exe 35 PID 2804 wrote to memory of 2828 2804 pjvvv.exe 35 PID 2804 wrote to memory of 2828 2804 pjvvv.exe 35 PID 2804 wrote to memory of 2828 2804 pjvvv.exe 35 PID 2828 wrote to memory of 2668 2828 xlflrxf.exe 36 PID 2828 wrote to memory of 2668 2828 xlflrxf.exe 36 PID 2828 wrote to memory of 2668 2828 xlflrxf.exe 36 PID 2828 wrote to memory of 2668 2828 xlflrxf.exe 36 PID 2668 wrote to memory of 2676 2668 fxrrlrx.exe 37 PID 2668 wrote to memory of 2676 2668 fxrrlrx.exe 37 PID 2668 wrote to memory of 2676 2668 fxrrlrx.exe 37 PID 2668 wrote to memory of 2676 2668 fxrrlrx.exe 37 PID 2676 wrote to memory of 2448 2676 7nhnbb.exe 38 PID 2676 wrote to memory of 2448 2676 7nhnbb.exe 38 PID 2676 wrote to memory of 2448 2676 7nhnbb.exe 38 PID 2676 wrote to memory of 2448 2676 7nhnbb.exe 38 PID 2448 wrote to memory of 556 2448 9hbbht.exe 39 PID 2448 wrote to memory of 556 2448 9hbbht.exe 39 PID 2448 wrote to memory of 556 2448 9hbbht.exe 39 PID 2448 wrote to memory of 556 2448 9hbbht.exe 39 PID 556 wrote to memory of 1256 556 jpddj.exe 40 PID 556 wrote to memory of 1256 556 jpddj.exe 40 PID 556 wrote to memory of 1256 556 jpddj.exe 40 PID 556 wrote to memory of 1256 556 jpddj.exe 40 PID 1256 wrote to memory of 2840 1256 lrxxxfl.exe 41 PID 1256 wrote to memory of 2840 1256 lrxxxfl.exe 41 PID 1256 wrote to memory of 2840 1256 lrxxxfl.exe 41 PID 1256 wrote to memory of 2840 1256 lrxxxfl.exe 41 PID 2840 wrote to memory of 1260 2840 9htbbh.exe 42 PID 2840 wrote to memory of 1260 2840 9htbbh.exe 42 PID 2840 wrote to memory of 1260 2840 9htbbh.exe 42 PID 2840 wrote to memory of 1260 2840 9htbbh.exe 42 PID 1260 wrote to memory of 1720 1260 bnbbhn.exe 43 PID 1260 wrote to memory of 1720 1260 bnbbhn.exe 43 PID 1260 wrote to memory of 1720 1260 bnbbhn.exe 43 PID 1260 wrote to memory of 1720 1260 bnbbhn.exe 43 PID 1720 wrote to memory of 1952 1720 1vpdv.exe 44 PID 1720 wrote to memory of 1952 1720 1vpdv.exe 44 PID 1720 wrote to memory of 1952 1720 1vpdv.exe 44 PID 1720 wrote to memory of 1952 1720 1vpdv.exe 44 PID 1952 wrote to memory of 2420 1952 rllfllr.exe 45 PID 1952 wrote to memory of 2420 1952 rllfllr.exe 45 PID 1952 wrote to memory of 2420 1952 rllfllr.exe 45 PID 1952 wrote to memory of 2420 1952 rllfllr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe"C:\Users\Admin\AppData\Local\Temp\f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\btthtt.exec:\btthtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\jjvjp.exec:\jjvjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\vvpjp.exec:\vvpjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\tnhnbb.exec:\tnhnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pjvvv.exec:\pjvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\xlflrxf.exec:\xlflrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\fxrrlrx.exec:\fxrrlrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\7nhnbb.exec:\7nhnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\9hbbht.exec:\9hbbht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\jpddj.exec:\jpddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\lrxxxfl.exec:\lrxxxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\9htbbh.exec:\9htbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\bnbbhn.exec:\bnbbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\1vpdv.exec:\1vpdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\rllfllr.exec:\rllfllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\9hhntt.exec:\9hhntt.exe17⤵
- Executes dropped EXE
PID:2420 -
\??\c:\9bbnbb.exec:\9bbnbb.exe18⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jjddp.exec:\jjddp.exe19⤵
- Executes dropped EXE
PID:2116 -
\??\c:\pjvvj.exec:\pjvvj.exe20⤵
- Executes dropped EXE
PID:568 -
\??\c:\xxrlrxf.exec:\xxrlrxf.exe21⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nhnnnt.exec:\nhnnnt.exe22⤵
- Executes dropped EXE
PID:1764 -
\??\c:\1thbbh.exec:\1thbbh.exe23⤵
- Executes dropped EXE
PID:1116 -
\??\c:\dvjpp.exec:\dvjpp.exe24⤵
- Executes dropped EXE
PID:2108 -
\??\c:\pdppd.exec:\pdppd.exe25⤵
- Executes dropped EXE
PID:968 -
\??\c:\ffxxrrf.exec:\ffxxrrf.exe26⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nhntnt.exec:\nhntnt.exe27⤵
- Executes dropped EXE
PID:2292 -
\??\c:\thtbnn.exec:\thtbnn.exe28⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pdppp.exec:\pdppp.exe29⤵
- Executes dropped EXE
PID:2440 -
\??\c:\dvjpd.exec:\dvjpd.exe30⤵
- Executes dropped EXE
PID:1736 -
\??\c:\9fxlxxr.exec:\9fxlxxr.exe31⤵
- Executes dropped EXE
PID:1920 -
\??\c:\btnnnn.exec:\btnnnn.exe32⤵
- Executes dropped EXE
PID:2404 -
\??\c:\bthtbn.exec:\bthtbn.exe33⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vvppj.exec:\vvppj.exe34⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xrffflr.exec:\xrffflr.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1llxllx.exec:\1llxllx.exe36⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lxllrxx.exec:\lxllrxx.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\htbbbt.exec:\htbbbt.exe38⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9bntbb.exec:\9bntbb.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5vjjp.exec:\5vjjp.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pjvdd.exec:\pjvdd.exe41⤵
- Executes dropped EXE
PID:1684 -
\??\c:\frxxffr.exec:\frxxffr.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rfrrxxx.exec:\rfrrxxx.exe43⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bththh.exec:\bththh.exe44⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nnhthn.exec:\nnhthn.exe45⤵
- Executes dropped EXE
PID:1248 -
\??\c:\7djpj.exec:\7djpj.exe46⤵
- Executes dropped EXE
PID:1160 -
\??\c:\rlxfflr.exec:\rlxfflr.exe47⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nhtbnb.exec:\nhtbnb.exe48⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5jvvd.exec:\5jvvd.exe49⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9ppdp.exec:\9ppdp.exe50⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dvjpd.exec:\dvjpd.exe51⤵
- Executes dropped EXE
PID:692 -
\??\c:\9rxllrl.exec:\9rxllrl.exe52⤵
- Executes dropped EXE
PID:764 -
\??\c:\7lfrlfl.exec:\7lfrlfl.exe53⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bththh.exec:\bththh.exe54⤵
- Executes dropped EXE
PID:1144 -
\??\c:\tntbnh.exec:\tntbnh.exe55⤵
- Executes dropped EXE
PID:376 -
\??\c:\jdjjd.exec:\jdjjd.exe56⤵
- Executes dropped EXE
PID:592 -
\??\c:\5jddd.exec:\5jddd.exe57⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rlfrxfr.exec:\rlfrxfr.exe58⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rrrxflx.exec:\rrrxflx.exe59⤵
- Executes dropped EXE
PID:1940 -
\??\c:\lxlfllr.exec:\lxlfllr.exe60⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nnnbtb.exec:\nnnbtb.exe61⤵
- Executes dropped EXE
PID:952 -
\??\c:\bnbbtb.exec:\bnbbtb.exe62⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jvdpj.exec:\jvdpj.exe63⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vpddj.exec:\vpddj.exe64⤵
- Executes dropped EXE
PID:788 -
\??\c:\xrfrffx.exec:\xrfrffx.exe65⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xfrxfff.exec:\xfrxfff.exe66⤵PID:2084
-
\??\c:\hbbhnb.exec:\hbbhnb.exe67⤵PID:1340
-
\??\c:\5pdjj.exec:\5pdjj.exe68⤵PID:1616
-
\??\c:\jvjdd.exec:\jvjdd.exe69⤵PID:2088
-
\??\c:\pjdjp.exec:\pjdjp.exe70⤵PID:2360
-
\??\c:\rllrllx.exec:\rllrllx.exe71⤵PID:2388
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe72⤵PID:2940
-
\??\c:\ttnhtb.exec:\ttnhtb.exe73⤵PID:2936
-
\??\c:\bbnntt.exec:\bbnntt.exe74⤵PID:1856
-
\??\c:\dvjpd.exec:\dvjpd.exe75⤵PID:2752
-
\??\c:\vpdjv.exec:\vpdjv.exe76⤵PID:2892
-
\??\c:\xrrxxfr.exec:\xrrxxfr.exe77⤵PID:2740
-
\??\c:\rlrrfxl.exec:\rlrrfxl.exe78⤵PID:2176
-
\??\c:\ttnbtb.exec:\ttnbtb.exe79⤵PID:2952
-
\??\c:\nhttnh.exec:\nhttnh.exe80⤵PID:1956
-
\??\c:\dpvdj.exec:\dpvdj.exe81⤵PID:2608
-
\??\c:\jdjjp.exec:\jdjjp.exe82⤵PID:2644
-
\??\c:\fxllxxr.exec:\fxllxxr.exe83⤵PID:3052
-
\??\c:\3rrfrrf.exec:\3rrfrrf.exe84⤵PID:2660
-
\??\c:\5tntbh.exec:\5tntbh.exe85⤵PID:2028
-
\??\c:\tntbnn.exec:\tntbnn.exe86⤵PID:564
-
\??\c:\vpjpv.exec:\vpjpv.exe87⤵PID:1256
-
\??\c:\vpjdj.exec:\vpjdj.exe88⤵PID:1608
-
\??\c:\xrflflr.exec:\xrflflr.exe89⤵PID:2876
-
\??\c:\rlxflrx.exec:\rlxflrx.exe90⤵PID:1260
-
\??\c:\nnhntt.exec:\nnhntt.exe91⤵PID:2512
-
\??\c:\5nnntt.exec:\5nnntt.exe92⤵PID:2000
-
\??\c:\pjppp.exec:\pjppp.exe93⤵PID:1984
-
\??\c:\5dpjv.exec:\5dpjv.exe94⤵PID:1752
-
\??\c:\3jddv.exec:\3jddv.exe95⤵PID:2960
-
\??\c:\fxrfllr.exec:\fxrfllr.exe96⤵PID:2500
-
\??\c:\hbhnth.exec:\hbhnth.exe97⤵PID:592
-
\??\c:\9nnnnh.exec:\9nnnnh.exe98⤵PID:2232
-
\??\c:\9btnnt.exec:\9btnnt.exe99⤵PID:2492
-
\??\c:\jdvpv.exec:\jdvpv.exe100⤵PID:1276
-
\??\c:\ppjpd.exec:\ppjpd.exe101⤵PID:1632
-
\??\c:\5frrffx.exec:\5frrffx.exe102⤵PID:1852
-
\??\c:\fxfrfxx.exec:\fxfrfxx.exe103⤵PID:268
-
\??\c:\tnhbnb.exec:\tnhbnb.exe104⤵PID:1628
-
\??\c:\tnttbt.exec:\tnttbt.exe105⤵PID:2416
-
\??\c:\nnhhtb.exec:\nnhhtb.exe106⤵PID:992
-
\??\c:\pjdpv.exec:\pjdpv.exe107⤵PID:1728
-
\??\c:\ddppj.exec:\ddppj.exe108⤵PID:1488
-
\??\c:\rllxxfr.exec:\rllxxfr.exe109⤵PID:3044
-
\??\c:\rlflxrf.exec:\rlflxrf.exe110⤵PID:2528
-
\??\c:\btnbnb.exec:\btnbnb.exe111⤵PID:2360
-
\??\c:\thtntb.exec:\thtntb.exe112⤵PID:2404
-
\??\c:\vpdpv.exec:\vpdpv.exe113⤵PID:1556
-
\??\c:\dvppj.exec:\dvppj.exe114⤵PID:1580
-
\??\c:\pjvdp.exec:\pjvdp.exe115⤵PID:2248
-
\??\c:\9llfffr.exec:\9llfffr.exe116⤵PID:2912
-
\??\c:\rlffflr.exec:\rlffflr.exe117⤵PID:2924
-
\??\c:\7nnttb.exec:\7nnttb.exe118⤵PID:2648
-
\??\c:\bthtbh.exec:\bthtbh.exe119⤵PID:2804
-
\??\c:\vpddd.exec:\vpddd.exe120⤵PID:2808
-
\??\c:\vpddj.exec:\vpddj.exe121⤵PID:2624
-
\??\c:\7jjpd.exec:\7jjpd.exe122⤵PID:2676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-