Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 01:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aaf786d94ac82c5999fd5ba39dfc5fe0a3e02bdd27fd11923fd1d28d604d9ff3.exe
Resource
win7-20240705-en
6 signatures
150 seconds
General
-
Target
aaf786d94ac82c5999fd5ba39dfc5fe0a3e02bdd27fd11923fd1d28d604d9ff3.exe
-
Size
64KB
-
MD5
8c328ee1dddcce2c7094af0eba20086d
-
SHA1
5bb74244e96434b8604937e5b416b0d42cc92d7a
-
SHA256
aaf786d94ac82c5999fd5ba39dfc5fe0a3e02bdd27fd11923fd1d28d604d9ff3
-
SHA512
359a6053d4b68f85b056cf4c73b1991d1cd45dc8116fcaa88ce1410441cdd203dad8ff776535e6d00516424498ed9dc62cd4cc85c45d136edc3645c331ef0e22
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qPte:ymb3NkkiQ3mdBjFIj+qA
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/5100-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-23-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-66-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/784-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5056 frflxfx.exe 3720 btbttt.exe 4740 ddpjd.exe 1892 lffxxxr.exe 1248 fxrlxxr.exe 880 hhtthn.exe 2916 3nnnnn.exe 4676 jvpdp.exe 784 rffxlrl.exe 3240 9fffxxx.exe 4540 hhhhbb.exe 2344 1bhbhh.exe 3916 9vvpd.exe 1860 xrrlxxr.exe 5064 ffffflf.exe 3696 3hnntt.exe 4532 nbtnhh.exe 756 pjppj.exe 4964 lffllrf.exe 3348 fxxxxxx.exe 4820 hnnhbh.exe 1668 vpppp.exe 3772 7xxxlff.exe 3856 llrrlll.exe 2600 bnhhbb.exe 1456 hnbtnn.exe 2684 jpvpj.exe 3188 rflllrr.exe 4536 nhnnnn.exe 2996 nntnnn.exe 772 hnnhhh.exe 3724 3vdvp.exe 1928 1rxrllf.exe 3436 5htbtt.exe 4400 7ttnbh.exe 2148 dddpj.exe 4960 pvvjd.exe 440 lffxllf.exe 4468 hnnnhh.exe 3760 3bbnhh.exe 2208 vvvpd.exe 4108 rxlxlfx.exe 2924 lxrlfxr.exe 4396 bbnnhh.exe 4636 tnttnb.exe 3692 vjjdv.exe 4904 jdvpj.exe 1540 xxrlffx.exe 1952 xrrrxxf.exe 1612 tnnhht.exe 4732 1vppj.exe 1044 pjdvp.exe 1820 7xrlllf.exe 1880 ddjdd.exe 2692 ddjpd.exe 4548 3lxlrrr.exe 3916 xlffxxr.exe 2640 5bhbtn.exe 4112 pdpdd.exe 4828 frxfxxr.exe 1160 hhhhbb.exe 1732 5htbnh.exe 2064 vddvd.exe 3336 xrlfxxr.exe -
resource yara_rule behavioral2/memory/5100-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/784-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5100 wrote to memory of 5056 5100 aaf786d94ac82c5999fd5ba39dfc5fe0a3e02bdd27fd11923fd1d28d604d9ff3.exe 84 PID 5100 wrote to memory of 5056 5100 aaf786d94ac82c5999fd5ba39dfc5fe0a3e02bdd27fd11923fd1d28d604d9ff3.exe 84 PID 5100 wrote to memory of 5056 5100 aaf786d94ac82c5999fd5ba39dfc5fe0a3e02bdd27fd11923fd1d28d604d9ff3.exe 84 PID 5056 wrote to memory of 3720 5056 frflxfx.exe 85 PID 5056 wrote to memory of 3720 5056 frflxfx.exe 85 PID 5056 wrote to memory of 3720 5056 frflxfx.exe 85 PID 3720 wrote to memory of 4740 3720 btbttt.exe 86 PID 3720 wrote to memory of 4740 3720 btbttt.exe 86 PID 3720 wrote to memory of 4740 3720 btbttt.exe 86 PID 4740 wrote to memory of 1892 4740 ddpjd.exe 87 PID 4740 wrote to memory of 1892 4740 ddpjd.exe 87 PID 4740 wrote to memory of 1892 4740 ddpjd.exe 87 PID 1892 wrote to memory of 1248 1892 lffxxxr.exe 88 PID 1892 wrote to memory of 1248 1892 lffxxxr.exe 88 PID 1892 wrote to memory of 1248 1892 lffxxxr.exe 88 PID 1248 wrote to memory of 880 1248 fxrlxxr.exe 89 PID 1248 wrote to memory of 880 1248 fxrlxxr.exe 89 PID 1248 wrote to memory of 880 1248 fxrlxxr.exe 89 PID 880 wrote to memory of 2916 880 hhtthn.exe 90 PID 880 wrote to memory of 2916 880 hhtthn.exe 90 PID 880 wrote to memory of 2916 880 hhtthn.exe 90 PID 2916 wrote to memory of 4676 2916 3nnnnn.exe 91 PID 2916 wrote to memory of 4676 2916 3nnnnn.exe 91 PID 2916 wrote to memory of 4676 2916 3nnnnn.exe 91 PID 4676 wrote to memory of 784 4676 jvpdp.exe 92 PID 4676 wrote to memory of 784 4676 jvpdp.exe 92 PID 4676 wrote to memory of 784 4676 jvpdp.exe 92 PID 784 wrote to memory of 3240 784 rffxlrl.exe 93 PID 784 wrote to memory of 3240 784 rffxlrl.exe 93 PID 784 wrote to memory of 3240 784 rffxlrl.exe 93 PID 3240 wrote to memory of 4540 3240 9fffxxx.exe 94 PID 3240 wrote to memory of 4540 3240 9fffxxx.exe 94 PID 3240 wrote to memory of 4540 3240 9fffxxx.exe 94 PID 4540 wrote to memory of 2344 4540 hhhhbb.exe 95 PID 4540 wrote to memory of 2344 4540 hhhhbb.exe 95 PID 4540 wrote to memory of 2344 4540 hhhhbb.exe 95 PID 2344 wrote to memory of 3916 2344 1bhbhh.exe 96 PID 2344 wrote to memory of 3916 2344 1bhbhh.exe 96 PID 2344 wrote to memory of 3916 2344 1bhbhh.exe 96 PID 3916 wrote to memory of 1860 3916 9vvpd.exe 98 PID 3916 wrote to memory of 1860 3916 9vvpd.exe 98 PID 3916 wrote to memory of 1860 3916 9vvpd.exe 98 PID 1860 wrote to memory of 5064 1860 xrrlxxr.exe 99 PID 1860 wrote to memory of 5064 1860 xrrlxxr.exe 99 PID 1860 wrote to memory of 5064 1860 xrrlxxr.exe 99 PID 5064 wrote to memory of 3696 5064 ffffflf.exe 100 PID 5064 wrote to memory of 3696 5064 ffffflf.exe 100 PID 5064 wrote to memory of 3696 5064 ffffflf.exe 100 PID 3696 wrote to memory of 4532 3696 3hnntt.exe 101 PID 3696 wrote to memory of 4532 3696 3hnntt.exe 101 PID 3696 wrote to memory of 4532 3696 3hnntt.exe 101 PID 4532 wrote to memory of 756 4532 nbtnhh.exe 102 PID 4532 wrote to memory of 756 4532 nbtnhh.exe 102 PID 4532 wrote to memory of 756 4532 nbtnhh.exe 102 PID 756 wrote to memory of 4964 756 pjppj.exe 103 PID 756 wrote to memory of 4964 756 pjppj.exe 103 PID 756 wrote to memory of 4964 756 pjppj.exe 103 PID 4964 wrote to memory of 3348 4964 lffllrf.exe 104 PID 4964 wrote to memory of 3348 4964 lffllrf.exe 104 PID 4964 wrote to memory of 3348 4964 lffllrf.exe 104 PID 3348 wrote to memory of 4820 3348 fxxxxxx.exe 105 PID 3348 wrote to memory of 4820 3348 fxxxxxx.exe 105 PID 3348 wrote to memory of 4820 3348 fxxxxxx.exe 105 PID 4820 wrote to memory of 1668 4820 hnnhbh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaf786d94ac82c5999fd5ba39dfc5fe0a3e02bdd27fd11923fd1d28d604d9ff3.exe"C:\Users\Admin\AppData\Local\Temp\aaf786d94ac82c5999fd5ba39dfc5fe0a3e02bdd27fd11923fd1d28d604d9ff3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\frflxfx.exec:\frflxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\btbttt.exec:\btbttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\ddpjd.exec:\ddpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\lffxxxr.exec:\lffxxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\hhtthn.exec:\hhtthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\3nnnnn.exec:\3nnnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\jvpdp.exec:\jvpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\rffxlrl.exec:\rffxlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\9fffxxx.exec:\9fffxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\hhhhbb.exec:\hhhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\1bhbhh.exec:\1bhbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\9vvpd.exec:\9vvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\ffffflf.exec:\ffffflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\3hnntt.exec:\3hnntt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\nbtnhh.exec:\nbtnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\pjppj.exec:\pjppj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\lffllrf.exec:\lffllrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\hnnhbh.exec:\hnnhbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\vpppp.exec:\vpppp.exe23⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7xxxlff.exec:\7xxxlff.exe24⤵
- Executes dropped EXE
PID:3772 -
\??\c:\llrrlll.exec:\llrrlll.exe25⤵
- Executes dropped EXE
PID:3856 -
\??\c:\bnhhbb.exec:\bnhhbb.exe26⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hnbtnn.exec:\hnbtnn.exe27⤵
- Executes dropped EXE
PID:1456 -
\??\c:\jpvpj.exec:\jpvpj.exe28⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rflllrr.exec:\rflllrr.exe29⤵
- Executes dropped EXE
PID:3188 -
\??\c:\nhnnnn.exec:\nhnnnn.exe30⤵
- Executes dropped EXE
PID:4536 -
\??\c:\nntnnn.exec:\nntnnn.exe31⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hnnhhh.exec:\hnnhhh.exe32⤵
- Executes dropped EXE
PID:772 -
\??\c:\3vdvp.exec:\3vdvp.exe33⤵
- Executes dropped EXE
PID:3724 -
\??\c:\1rxrllf.exec:\1rxrllf.exe34⤵
- Executes dropped EXE
PID:1928 -
\??\c:\5htbtt.exec:\5htbtt.exe35⤵
- Executes dropped EXE
PID:3436 -
\??\c:\7ttnbh.exec:\7ttnbh.exe36⤵
- Executes dropped EXE
PID:4400 -
\??\c:\dddpj.exec:\dddpj.exe37⤵
- Executes dropped EXE
PID:2148 -
\??\c:\pvvjd.exec:\pvvjd.exe38⤵
- Executes dropped EXE
PID:4960 -
\??\c:\lffxllf.exec:\lffxllf.exe39⤵
- Executes dropped EXE
PID:440 -
\??\c:\hnnnhh.exec:\hnnnhh.exe40⤵
- Executes dropped EXE
PID:4468 -
\??\c:\3bbnhh.exec:\3bbnhh.exe41⤵
- Executes dropped EXE
PID:3760 -
\??\c:\vvvpd.exec:\vvvpd.exe42⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rxlxlfx.exec:\rxlxlfx.exe43⤵
- Executes dropped EXE
PID:4108 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe44⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bbnnhh.exec:\bbnnhh.exe45⤵
- Executes dropped EXE
PID:4396 -
\??\c:\tnttnb.exec:\tnttnb.exe46⤵
- Executes dropped EXE
PID:4636 -
\??\c:\vjjdv.exec:\vjjdv.exe47⤵
- Executes dropped EXE
PID:3692 -
\??\c:\jdvpj.exec:\jdvpj.exe48⤵
- Executes dropped EXE
PID:4904 -
\??\c:\xxrlffx.exec:\xxrlffx.exe49⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xrrrxxf.exec:\xrrrxxf.exe50⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tnnhht.exec:\tnnhht.exe51⤵
- Executes dropped EXE
PID:1612 -
\??\c:\1vppj.exec:\1vppj.exe52⤵
- Executes dropped EXE
PID:4732 -
\??\c:\pjdvp.exec:\pjdvp.exe53⤵
- Executes dropped EXE
PID:1044 -
\??\c:\7xrlllf.exec:\7xrlllf.exe54⤵
- Executes dropped EXE
PID:1820 -
\??\c:\ddjdd.exec:\ddjdd.exe55⤵
- Executes dropped EXE
PID:1880 -
\??\c:\ddjpd.exec:\ddjpd.exe56⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3lxlrrr.exec:\3lxlrrr.exe57⤵
- Executes dropped EXE
PID:4548 -
\??\c:\xlffxxr.exec:\xlffxxr.exe58⤵
- Executes dropped EXE
PID:3916 -
\??\c:\5bhbtn.exec:\5bhbtn.exe59⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pdpdd.exec:\pdpdd.exe60⤵
- Executes dropped EXE
PID:4112 -
\??\c:\frxfxxr.exec:\frxfxxr.exe61⤵
- Executes dropped EXE
PID:4828 -
\??\c:\hhhhbb.exec:\hhhhbb.exe62⤵
- Executes dropped EXE
PID:1160 -
\??\c:\5htbnh.exec:\5htbnh.exe63⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vddvd.exec:\vddvd.exe64⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe65⤵
- Executes dropped EXE
PID:3336 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe66⤵PID:3044
-
\??\c:\nnhbtn.exec:\nnhbtn.exe67⤵PID:4612
-
\??\c:\tttntn.exec:\tttntn.exe68⤵PID:3316
-
\??\c:\djvvd.exec:\djvvd.exe69⤵PID:1940
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe70⤵PID:4980
-
\??\c:\5flfxrl.exec:\5flfxrl.exe71⤵PID:2000
-
\??\c:\5ttthh.exec:\5ttthh.exe72⤵PID:3752
-
\??\c:\hhbtnh.exec:\hhbtnh.exe73⤵PID:2580
-
\??\c:\1dpdv.exec:\1dpdv.exe74⤵PID:2176
-
\??\c:\3xfxfxr.exec:\3xfxfxr.exe75⤵PID:5096
-
\??\c:\fffxrrl.exec:\fffxrrl.exe76⤵PID:4816
-
\??\c:\bnnnhh.exec:\bnnnhh.exe77⤵PID:2232
-
\??\c:\7ddpd.exec:\7ddpd.exe78⤵PID:1384
-
\??\c:\5jpjj.exec:\5jpjj.exe79⤵PID:1480
-
\??\c:\rrrrfxr.exec:\rrrrfxr.exe80⤵PID:264
-
\??\c:\tnhbnn.exec:\tnhbnn.exe81⤵PID:2880
-
\??\c:\nbbtnh.exec:\nbbtnh.exe82⤵PID:4868
-
\??\c:\5pjdp.exec:\5pjdp.exe83⤵PID:1620
-
\??\c:\9jjdd.exec:\9jjdd.exe84⤵PID:3684
-
\??\c:\9lxlxfx.exec:\9lxlxfx.exe85⤵PID:64
-
\??\c:\nntbhb.exec:\nntbhb.exe86⤵PID:1652
-
\??\c:\thhnht.exec:\thhnht.exe87⤵PID:952
-
\??\c:\jdpdp.exec:\jdpdp.exe88⤵PID:1864
-
\??\c:\1vvpd.exec:\1vvpd.exe89⤵PID:620
-
\??\c:\5xxrfxr.exec:\5xxrfxr.exe90⤵PID:4492
-
\??\c:\3nnbtt.exec:\3nnbtt.exe91⤵PID:4844
-
\??\c:\9hbtnn.exec:\9hbtnn.exe92⤵PID:3244
-
\??\c:\jjdpd.exec:\jjdpd.exe93⤵PID:4864
-
\??\c:\1fxrfxr.exec:\1fxrfxr.exe94⤵PID:4912
-
\??\c:\xffxrrf.exec:\xffxrrf.exe95⤵PID:4396
-
\??\c:\btbtbt.exec:\btbtbt.exe96⤵PID:4636
-
\??\c:\btthtn.exec:\btthtn.exe97⤵PID:4196
-
\??\c:\jpvjv.exec:\jpvjv.exe98⤵PID:4812
-
\??\c:\lffxlfr.exec:\lffxlfr.exe99⤵PID:1540
-
\??\c:\nbtbnn.exec:\nbtbnn.exe100⤵PID:2916
-
\??\c:\nnnbht.exec:\nnnbht.exe101⤵PID:1884
-
\??\c:\pjdvj.exec:\pjdvj.exe102⤵PID:1640
-
\??\c:\ppdjv.exec:\ppdjv.exe103⤵PID:3500
-
\??\c:\xrxllff.exec:\xrxllff.exe104⤵PID:1472
-
\??\c:\htntnb.exec:\htntnb.exe105⤵PID:2828
-
\??\c:\tthbbb.exec:\tthbbb.exe106⤵PID:3292
-
\??\c:\pdjvd.exec:\pdjvd.exe107⤵PID:368
-
\??\c:\lfxlffx.exec:\lfxlffx.exe108⤵PID:2784
-
\??\c:\lrxlxrf.exec:\lrxlxrf.exe109⤵PID:2012
-
\??\c:\nhtbtb.exec:\nhtbtb.exe110⤵PID:4452
-
\??\c:\tbhnnb.exec:\tbhnnb.exe111⤵PID:2132
-
\??\c:\vddvv.exec:\vddvv.exe112⤵PID:2616
-
\??\c:\lfxxfrx.exec:\lfxxfrx.exe113⤵PID:1636
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe114⤵PID:4436
-
\??\c:\9bbbtt.exec:\9bbbtt.exe115⤵PID:3348
-
\??\c:\jdddv.exec:\jdddv.exe116⤵PID:2956
-
\??\c:\5djvj.exec:\5djvj.exe117⤵PID:2904
-
\??\c:\9xlfxlf.exec:\9xlfxlf.exe118⤵PID:2288
-
\??\c:\ffrlllx.exec:\ffrlllx.exe119⤵PID:3784
-
\??\c:\btnhbb.exec:\btnhbb.exe120⤵PID:1992
-
\??\c:\tbbthh.exec:\tbbthh.exe121⤵PID:2600
-
\??\c:\vvdjd.exec:\vvdjd.exe122⤵PID:1528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-