Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
680a06ace9f201131ea2bef9926c27b1140c795b635a11ae4323fddfc61eff10.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
680a06ace9f201131ea2bef9926c27b1140c795b635a11ae4323fddfc61eff10.exe
-
Size
71KB
-
MD5
d41597c58fc3f2dd0ba1d6db23c596b6
-
SHA1
cde607e425abe274e1ba8e8c43bf33d21ed738fb
-
SHA256
680a06ace9f201131ea2bef9926c27b1140c795b635a11ae4323fddfc61eff10
-
SHA512
d9f9765b9cb68e8ad5ca87cad8147c8f38da1139d61d2113f6b0a31c85dfd520b23424838d61cf7f3631be03e0939459d65d968fbd8935e21cb42571bc5bd9b4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdLH+/:ymb3NkkiQ3mdBjF0yMliC/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/444-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2504 3ttbnt.exe 2116 pppvd.exe 2764 dvpdj.exe 2688 9rlrxfl.exe 2876 lfxrlfr.exe 2856 ttnnbn.exe 2604 ddvdp.exe 2588 ffxrffr.exe 2892 nbtbbn.exe 1932 jjjjp.exe 2800 vpddj.exe 1716 fxrfrrx.exe 1668 5bbtbh.exe 1660 tnnbnt.exe 2416 1pvdp.exe 1904 dvdjv.exe 2772 rfrxffr.exe 2224 rfrxffl.exe 2512 htnhnt.exe 1812 hbbnnt.exe 444 tnbbnb.exe 1104 vjdjp.exe 1604 fxrrffx.exe 2244 7frxflr.exe 2148 hhthnn.exe 1548 bthntt.exe 900 jdvpj.exe 1908 rrllxfr.exe 3036 frflrrr.exe 3056 1thhnn.exe 1696 hbhbnt.exe 2176 vjvpj.exe 3048 pjpvp.exe 2872 xlflrrf.exe 2728 rlxrrxf.exe 2824 hbnntn.exe 2612 hbbbtt.exe 2696 nnbhnt.exe 2600 pjpvd.exe 2604 dvpvd.exe 2580 7flrllf.exe 1944 fffxlrx.exe 1704 rllfxxl.exe 1560 bhbttt.exe 1924 7bthtt.exe 2420 dvjvd.exe 1020 pjvvj.exe 1668 lfllrrf.exe 952 xxrlrfr.exe 2004 lrllllr.exe 1808 nhtbbh.exe 2908 thnbhn.exe 2952 ddvpd.exe 2496 7pvjp.exe 672 9rrrrxf.exe 408 fxrflrf.exe 2396 frlrrrx.exe 1952 bththh.exe 588 bbtnth.exe 1512 bthtbb.exe 684 jdppp.exe 2024 3fxfllx.exe 1476 rfrxffl.exe 2124 frlrxrf.exe -
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/444-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2504 2104 680a06ace9f201131ea2bef9926c27b1140c795b635a11ae4323fddfc61eff10.exe 30 PID 2104 wrote to memory of 2504 2104 680a06ace9f201131ea2bef9926c27b1140c795b635a11ae4323fddfc61eff10.exe 30 PID 2104 wrote to memory of 2504 2104 680a06ace9f201131ea2bef9926c27b1140c795b635a11ae4323fddfc61eff10.exe 30 PID 2104 wrote to memory of 2504 2104 680a06ace9f201131ea2bef9926c27b1140c795b635a11ae4323fddfc61eff10.exe 30 PID 2504 wrote to memory of 2116 2504 3ttbnt.exe 31 PID 2504 wrote to memory of 2116 2504 3ttbnt.exe 31 PID 2504 wrote to memory of 2116 2504 3ttbnt.exe 31 PID 2504 wrote to memory of 2116 2504 3ttbnt.exe 31 PID 2116 wrote to memory of 2764 2116 pppvd.exe 32 PID 2116 wrote to memory of 2764 2116 pppvd.exe 32 PID 2116 wrote to memory of 2764 2116 pppvd.exe 32 PID 2116 wrote to memory of 2764 2116 pppvd.exe 32 PID 2764 wrote to memory of 2688 2764 dvpdj.exe 33 PID 2764 wrote to memory of 2688 2764 dvpdj.exe 33 PID 2764 wrote to memory of 2688 2764 dvpdj.exe 33 PID 2764 wrote to memory of 2688 2764 dvpdj.exe 33 PID 2688 wrote to memory of 2876 2688 9rlrxfl.exe 34 PID 2688 wrote to memory of 2876 2688 9rlrxfl.exe 34 PID 2688 wrote to memory of 2876 2688 9rlrxfl.exe 34 PID 2688 wrote to memory of 2876 2688 9rlrxfl.exe 34 PID 2876 wrote to memory of 2856 2876 lfxrlfr.exe 35 PID 2876 wrote to memory of 2856 2876 lfxrlfr.exe 35 PID 2876 wrote to memory of 2856 2876 lfxrlfr.exe 35 PID 2876 wrote to memory of 2856 2876 lfxrlfr.exe 35 PID 2856 wrote to memory of 2604 2856 ttnnbn.exe 36 PID 2856 wrote to memory of 2604 2856 ttnnbn.exe 36 PID 2856 wrote to memory of 2604 2856 ttnnbn.exe 36 PID 2856 wrote to memory of 2604 2856 ttnnbn.exe 36 PID 2604 wrote to memory of 2588 2604 ddvdp.exe 37 PID 2604 wrote to memory of 2588 2604 ddvdp.exe 37 PID 2604 wrote to memory of 2588 2604 ddvdp.exe 37 PID 2604 wrote to memory of 2588 2604 ddvdp.exe 37 PID 2588 wrote to memory of 2892 2588 ffxrffr.exe 38 PID 2588 wrote to memory of 2892 2588 ffxrffr.exe 38 PID 2588 wrote to memory of 2892 2588 ffxrffr.exe 38 PID 2588 wrote to memory of 2892 2588 ffxrffr.exe 38 PID 2892 wrote to memory of 1932 2892 nbtbbn.exe 39 PID 2892 wrote to memory of 1932 2892 nbtbbn.exe 39 PID 2892 wrote to memory of 1932 2892 nbtbbn.exe 39 PID 2892 wrote to memory of 1932 2892 nbtbbn.exe 39 PID 1932 wrote to memory of 2800 1932 jjjjp.exe 40 PID 1932 wrote to memory of 2800 1932 jjjjp.exe 40 PID 1932 wrote to memory of 2800 1932 jjjjp.exe 40 PID 1932 wrote to memory of 2800 1932 jjjjp.exe 40 PID 2800 wrote to memory of 1716 2800 vpddj.exe 41 PID 2800 wrote to memory of 1716 2800 vpddj.exe 41 PID 2800 wrote to memory of 1716 2800 vpddj.exe 41 PID 2800 wrote to memory of 1716 2800 vpddj.exe 41 PID 1716 wrote to memory of 1668 1716 fxrfrrx.exe 42 PID 1716 wrote to memory of 1668 1716 fxrfrrx.exe 42 PID 1716 wrote to memory of 1668 1716 fxrfrrx.exe 42 PID 1716 wrote to memory of 1668 1716 fxrfrrx.exe 42 PID 1668 wrote to memory of 1660 1668 5bbtbh.exe 43 PID 1668 wrote to memory of 1660 1668 5bbtbh.exe 43 PID 1668 wrote to memory of 1660 1668 5bbtbh.exe 43 PID 1668 wrote to memory of 1660 1668 5bbtbh.exe 43 PID 1660 wrote to memory of 2416 1660 tnnbnt.exe 44 PID 1660 wrote to memory of 2416 1660 tnnbnt.exe 44 PID 1660 wrote to memory of 2416 1660 tnnbnt.exe 44 PID 1660 wrote to memory of 2416 1660 tnnbnt.exe 44 PID 2416 wrote to memory of 1904 2416 1pvdp.exe 45 PID 2416 wrote to memory of 1904 2416 1pvdp.exe 45 PID 2416 wrote to memory of 1904 2416 1pvdp.exe 45 PID 2416 wrote to memory of 1904 2416 1pvdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\680a06ace9f201131ea2bef9926c27b1140c795b635a11ae4323fddfc61eff10.exe"C:\Users\Admin\AppData\Local\Temp\680a06ace9f201131ea2bef9926c27b1140c795b635a11ae4323fddfc61eff10.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\3ttbnt.exec:\3ttbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\pppvd.exec:\pppvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\dvpdj.exec:\dvpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\9rlrxfl.exec:\9rlrxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\lfxrlfr.exec:\lfxrlfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ttnnbn.exec:\ttnnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\ddvdp.exec:\ddvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\ffxrffr.exec:\ffxrffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nbtbbn.exec:\nbtbbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\jjjjp.exec:\jjjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\vpddj.exec:\vpddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\fxrfrrx.exec:\fxrfrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\5bbtbh.exec:\5bbtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\tnnbnt.exec:\tnnbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\1pvdp.exec:\1pvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\dvdjv.exec:\dvdjv.exe17⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rfrxffr.exec:\rfrxffr.exe18⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rfrxffl.exec:\rfrxffl.exe19⤵
- Executes dropped EXE
PID:2224 -
\??\c:\htnhnt.exec:\htnhnt.exe20⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hbbnnt.exec:\hbbnnt.exe21⤵
- Executes dropped EXE
PID:1812 -
\??\c:\tnbbnb.exec:\tnbbnb.exe22⤵
- Executes dropped EXE
PID:444 -
\??\c:\vjdjp.exec:\vjdjp.exe23⤵
- Executes dropped EXE
PID:1104 -
\??\c:\fxrrffx.exec:\fxrrffx.exe24⤵
- Executes dropped EXE
PID:1604 -
\??\c:\7frxflr.exec:\7frxflr.exe25⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hhthnn.exec:\hhthnn.exe26⤵
- Executes dropped EXE
PID:2148 -
\??\c:\bthntt.exec:\bthntt.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jdvpj.exec:\jdvpj.exe28⤵
- Executes dropped EXE
PID:900 -
\??\c:\rrllxfr.exec:\rrllxfr.exe29⤵
- Executes dropped EXE
PID:1908 -
\??\c:\frflrrr.exec:\frflrrr.exe30⤵
- Executes dropped EXE
PID:3036 -
\??\c:\1thhnn.exec:\1thhnn.exe31⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hbhbnt.exec:\hbhbnt.exe32⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vjvpj.exec:\vjvpj.exe33⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pjpvp.exec:\pjpvp.exe34⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xlflrrf.exec:\xlflrrf.exe35⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rlxrrxf.exec:\rlxrrxf.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hbnntn.exec:\hbnntn.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hbbbtt.exec:\hbbbtt.exe38⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nnbhnt.exec:\nnbhnt.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pjpvd.exec:\pjpvd.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\dvpvd.exec:\dvpvd.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7flrllf.exec:\7flrllf.exe42⤵
- Executes dropped EXE
PID:2580 -
\??\c:\fffxlrx.exec:\fffxlrx.exe43⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rllfxxl.exec:\rllfxxl.exe44⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bhbttt.exec:\bhbttt.exe45⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7bthtt.exec:\7bthtt.exe46⤵
- Executes dropped EXE
PID:1924 -
\??\c:\dvjvd.exec:\dvjvd.exe47⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pjvvj.exec:\pjvvj.exe48⤵
- Executes dropped EXE
PID:1020 -
\??\c:\lfllrrf.exec:\lfllrrf.exe49⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xxrlrfr.exec:\xxrlrfr.exe50⤵
- Executes dropped EXE
PID:952 -
\??\c:\lrllllr.exec:\lrllllr.exe51⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nhtbbh.exec:\nhtbbh.exe52⤵
- Executes dropped EXE
PID:1808 -
\??\c:\thnbhn.exec:\thnbhn.exe53⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ddvpd.exec:\ddvpd.exe54⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7pvjp.exec:\7pvjp.exe55⤵
- Executes dropped EXE
PID:2496 -
\??\c:\9rrrrxf.exec:\9rrrrxf.exe56⤵
- Executes dropped EXE
PID:672 -
\??\c:\fxrflrf.exec:\fxrflrf.exe57⤵
- Executes dropped EXE
PID:408 -
\??\c:\frlrrrx.exec:\frlrrrx.exe58⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bththh.exec:\bththh.exe59⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bbtnth.exec:\bbtnth.exe60⤵
- Executes dropped EXE
PID:588 -
\??\c:\bthtbb.exec:\bthtbb.exe61⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jdppp.exec:\jdppp.exe62⤵
- Executes dropped EXE
PID:684 -
\??\c:\3fxfllx.exec:\3fxfllx.exe63⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rfrxffl.exec:\rfrxffl.exe64⤵
- Executes dropped EXE
PID:1476 -
\??\c:\frlrxrf.exec:\frlrxrf.exe65⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hththn.exec:\hththn.exe66⤵PID:1724
-
\??\c:\3htbnn.exec:\3htbnn.exe67⤵PID:1200
-
\??\c:\jdpvj.exec:\jdpvj.exe68⤵PID:2460
-
\??\c:\pjjpd.exec:\pjjpd.exe69⤵PID:1892
-
\??\c:\dvjvd.exec:\dvjvd.exe70⤵PID:3040
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe71⤵PID:1696
-
\??\c:\fxrxrrl.exec:\fxrxrrl.exe72⤵PID:2176
-
\??\c:\7tnbnt.exec:\7tnbnt.exe73⤵PID:2684
-
\??\c:\nnntbh.exec:\nnntbh.exe74⤵PID:1796
-
\??\c:\5dvjj.exec:\5dvjj.exe75⤵PID:2868
-
\??\c:\xllrrxl.exec:\xllrrxl.exe76⤵PID:2996
-
\??\c:\fxxlllr.exec:\fxxlllr.exe77⤵PID:2888
-
\??\c:\3bbtnt.exec:\3bbtnt.exe78⤵PID:2744
-
\??\c:\9thntt.exec:\9thntt.exe79⤵PID:2940
-
\??\c:\pjppd.exec:\pjppd.exe80⤵PID:2748
-
\??\c:\1jvdp.exec:\1jvdp.exe81⤵PID:2576
-
\??\c:\fxxxflr.exec:\fxxxflr.exe82⤵PID:1872
-
\??\c:\rlflxxl.exec:\rlflxxl.exe83⤵PID:1936
-
\??\c:\1bhttb.exec:\1bhttb.exe84⤵PID:2784
-
\??\c:\jpvvj.exec:\jpvvj.exe85⤵PID:2788
-
\??\c:\vppvj.exec:\vppvj.exe86⤵PID:108
-
\??\c:\ppdjd.exec:\ppdjd.exe87⤵PID:2420
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe88⤵PID:1496
-
\??\c:\rfxllrf.exec:\rfxllrf.exe89⤵PID:1960
-
\??\c:\nhnnhn.exec:\nhnnhn.exe90⤵PID:2028
-
\??\c:\nbbnbb.exec:\nbbnbb.exe91⤵PID:2664
-
\??\c:\dpjpv.exec:\dpjpv.exe92⤵PID:2220
-
\??\c:\9vvvd.exec:\9vvvd.exe93⤵PID:2936
-
\??\c:\9lrxflr.exec:\9lrxflr.exe94⤵PID:2264
-
\??\c:\llxlxff.exec:\llxlxff.exe95⤵PID:1492
-
\??\c:\hbbntb.exec:\hbbntb.exe96⤵PID:3024
-
\??\c:\nnbhtb.exec:\nnbhtb.exe97⤵PID:916
-
\??\c:\5nnnhh.exec:\5nnnhh.exe98⤵PID:3020
-
\??\c:\dvpdv.exec:\dvpdv.exe99⤵PID:1104
-
\??\c:\jdvjp.exec:\jdvjp.exe100⤵PID:2128
-
\??\c:\rlllxxf.exec:\rlllxxf.exe101⤵PID:1504
-
\??\c:\fxfxfff.exec:\fxfxfff.exe102⤵PID:1788
-
\??\c:\bbthnn.exec:\bbthnn.exe103⤵PID:988
-
\??\c:\btbbnt.exec:\btbbnt.exe104⤵PID:2236
-
\??\c:\dpdjv.exec:\dpdjv.exe105⤵PID:1324
-
\??\c:\ppjvj.exec:\ppjvj.exe106⤵PID:764
-
\??\c:\lffrrrf.exec:\lffrrrf.exe107⤵PID:3036
-
\??\c:\frrlrrf.exec:\frrlrrf.exe108⤵PID:2288
-
\??\c:\7bhnbt.exec:\7bhnbt.exe109⤵PID:2468
-
\??\c:\7hbhtb.exec:\7hbhtb.exe110⤵PID:2096
-
\??\c:\jppvd.exec:\jppvd.exe111⤵PID:2724
-
\??\c:\5ppjp.exec:\5ppjp.exe112⤵PID:3048
-
\??\c:\vvvdv.exec:\vvvdv.exe113⤵PID:2916
-
\??\c:\frlxlxf.exec:\frlxlxf.exe114⤵PID:2880
-
\??\c:\xxlfrlf.exec:\xxlfrlf.exe115⤵PID:2976
-
\??\c:\9bbbnn.exec:\9bbbnn.exe116⤵PID:2408
-
\??\c:\tnhhnb.exec:\tnhhnb.exe117⤵PID:2844
-
\??\c:\3pdvd.exec:\3pdvd.exe118⤵PID:2600
-
\??\c:\3vppd.exec:\3vppd.exe119⤵PID:2640
-
\??\c:\pjjvp.exec:\pjjvp.exe120⤵PID:2216
-
\??\c:\rlflxfl.exec:\rlflxfl.exe121⤵PID:1864
-
\??\c:\fffllrf.exec:\fffllrf.exe122⤵PID:908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-