Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 23:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ec208a956bd3c650cb4f69f9c8e03d1252207778e22d2809c579cbd5921fa79.exe
Resource
win7-20240704-en
6 signatures
150 seconds
General
-
Target
6ec208a956bd3c650cb4f69f9c8e03d1252207778e22d2809c579cbd5921fa79.exe
-
Size
453KB
-
MD5
16ef38b80fb75dd70900e05718b5c3c8
-
SHA1
7d754cc199ee3e4000db0a03ec77c483ea47f27d
-
SHA256
6ec208a956bd3c650cb4f69f9c8e03d1252207778e22d2809c579cbd5921fa79
-
SHA512
b3810893dedfe3ca1879a5b2810b1f84440d467cbbcf7dd41c67be2d4527af630f95821e4e8f9b846fb371c14054f09b8c4cd7907c50c0620f67620b6f253686
-
SSDEEP
12288:n3C9uDIPh2kkkkK4kXkkkkkkkkl888888888888888888nj:ShPh2kkkkK4kXkkkkkkkkF
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1940-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-292-0x0000000077100000-0x00000000771FA000-memory.dmp family_blackmoon behavioral1/memory/2164-291-0x0000000077200000-0x000000007731F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1952 hbthnn.exe 2552 jdvdj.exe 2876 xfrlffr.exe 2816 nhbbnh.exe 2720 xxlrllx.exe 2728 tttbbt.exe 2628 vddpp.exe 2860 5htbtt.exe 2732 3xxllxl.exe 1960 3nhthb.exe 1776 9lflxfr.exe 536 9rffffl.exe 2444 nnhhbh.exe 2136 pjjpd.exe 1228 llxxflx.exe 1996 hhbnth.exe 1272 3lxfllx.exe 3036 frxxfff.exe 2320 fxrxfrf.exe 576 tbhnnn.exe 2128 xxflxrl.exe 708 llxlffr.exe 2204 3bhntt.exe 1284 vvjpd.exe 944 7jpvj.exe 2992 lxfrfrl.exe 2384 dddpj.exe 1828 lfxlxfx.exe 2528 pjvdp.exe 2164 jvjpd.exe 2388 llrxrxr.exe 1588 9hbnhh.exe 2880 7dvvd.exe 2828 hhttbh.exe 2704 3hhnbh.exe 2328 ppjpd.exe 2496 fxxxlrf.exe 2632 rrrffrl.exe 2728 btttht.exe 2604 pvvvj.exe 2648 pjdpj.exe 2860 lllrlrr.exe 2056 ntbbhh.exe 860 nhnbnh.exe 592 ppjvj.exe 600 flflflf.exe 536 ttnhtb.exe 1196 bhbntb.exe 2136 vvppj.exe 1228 fxrflxl.exe 560 tnhnth.exe 1600 7bnnnt.exe 1356 jpjpj.exe 2708 7xllrrf.exe 2112 rrrfxfx.exe 1956 btnbnn.exe 2644 1vpvj.exe 844 xlllxrf.exe 708 xfxrrlr.exe 1628 nnthth.exe 236 pppvd.exe 1048 xxlxllf.exe 848 llllrxr.exe 1844 hnbhtb.exe -
resource yara_rule behavioral1/memory/1940-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 1952 1940 6ec208a956bd3c650cb4f69f9c8e03d1252207778e22d2809c579cbd5921fa79.exe 30 PID 1940 wrote to memory of 1952 1940 6ec208a956bd3c650cb4f69f9c8e03d1252207778e22d2809c579cbd5921fa79.exe 30 PID 1940 wrote to memory of 1952 1940 6ec208a956bd3c650cb4f69f9c8e03d1252207778e22d2809c579cbd5921fa79.exe 30 PID 1940 wrote to memory of 1952 1940 6ec208a956bd3c650cb4f69f9c8e03d1252207778e22d2809c579cbd5921fa79.exe 30 PID 1952 wrote to memory of 2552 1952 hbthnn.exe 31 PID 1952 wrote to memory of 2552 1952 hbthnn.exe 31 PID 1952 wrote to memory of 2552 1952 hbthnn.exe 31 PID 1952 wrote to memory of 2552 1952 hbthnn.exe 31 PID 2552 wrote to memory of 2876 2552 jdvdj.exe 32 PID 2552 wrote to memory of 2876 2552 jdvdj.exe 32 PID 2552 wrote to memory of 2876 2552 jdvdj.exe 32 PID 2552 wrote to memory of 2876 2552 jdvdj.exe 32 PID 2876 wrote to memory of 2816 2876 xfrlffr.exe 33 PID 2876 wrote to memory of 2816 2876 xfrlffr.exe 33 PID 2876 wrote to memory of 2816 2876 xfrlffr.exe 33 PID 2876 wrote to memory of 2816 2876 xfrlffr.exe 33 PID 2816 wrote to memory of 2720 2816 nhbbnh.exe 34 PID 2816 wrote to memory of 2720 2816 nhbbnh.exe 34 PID 2816 wrote to memory of 2720 2816 nhbbnh.exe 34 PID 2816 wrote to memory of 2720 2816 nhbbnh.exe 34 PID 2720 wrote to memory of 2728 2720 xxlrllx.exe 35 PID 2720 wrote to memory of 2728 2720 xxlrllx.exe 35 PID 2720 wrote to memory of 2728 2720 xxlrllx.exe 35 PID 2720 wrote to memory of 2728 2720 xxlrllx.exe 35 PID 2728 wrote to memory of 2628 2728 tttbbt.exe 36 PID 2728 wrote to memory of 2628 2728 tttbbt.exe 36 PID 2728 wrote to memory of 2628 2728 tttbbt.exe 36 PID 2728 wrote to memory of 2628 2728 tttbbt.exe 36 PID 2628 wrote to memory of 2860 2628 vddpp.exe 37 PID 2628 wrote to memory of 2860 2628 vddpp.exe 37 PID 2628 wrote to memory of 2860 2628 vddpp.exe 37 PID 2628 wrote to memory of 2860 2628 vddpp.exe 37 PID 2860 wrote to memory of 2732 2860 5htbtt.exe 38 PID 2860 wrote to memory of 2732 2860 5htbtt.exe 38 PID 2860 wrote to memory of 2732 2860 5htbtt.exe 38 PID 2860 wrote to memory of 2732 2860 5htbtt.exe 38 PID 2732 wrote to memory of 1960 2732 3xxllxl.exe 39 PID 2732 wrote to memory of 1960 2732 3xxllxl.exe 39 PID 2732 wrote to memory of 1960 2732 3xxllxl.exe 39 PID 2732 wrote to memory of 1960 2732 3xxllxl.exe 39 PID 1960 wrote to memory of 1776 1960 3nhthb.exe 40 PID 1960 wrote to memory of 1776 1960 3nhthb.exe 40 PID 1960 wrote to memory of 1776 1960 3nhthb.exe 40 PID 1960 wrote to memory of 1776 1960 3nhthb.exe 40 PID 1776 wrote to memory of 536 1776 9lflxfr.exe 41 PID 1776 wrote to memory of 536 1776 9lflxfr.exe 41 PID 1776 wrote to memory of 536 1776 9lflxfr.exe 41 PID 1776 wrote to memory of 536 1776 9lflxfr.exe 41 PID 536 wrote to memory of 2444 536 9rffffl.exe 42 PID 536 wrote to memory of 2444 536 9rffffl.exe 42 PID 536 wrote to memory of 2444 536 9rffffl.exe 42 PID 536 wrote to memory of 2444 536 9rffffl.exe 42 PID 2444 wrote to memory of 2136 2444 nnhhbh.exe 43 PID 2444 wrote to memory of 2136 2444 nnhhbh.exe 43 PID 2444 wrote to memory of 2136 2444 nnhhbh.exe 43 PID 2444 wrote to memory of 2136 2444 nnhhbh.exe 43 PID 2136 wrote to memory of 1228 2136 pjjpd.exe 44 PID 2136 wrote to memory of 1228 2136 pjjpd.exe 44 PID 2136 wrote to memory of 1228 2136 pjjpd.exe 44 PID 2136 wrote to memory of 1228 2136 pjjpd.exe 44 PID 1228 wrote to memory of 1996 1228 llxxflx.exe 45 PID 1228 wrote to memory of 1996 1228 llxxflx.exe 45 PID 1228 wrote to memory of 1996 1228 llxxflx.exe 45 PID 1228 wrote to memory of 1996 1228 llxxflx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec208a956bd3c650cb4f69f9c8e03d1252207778e22d2809c579cbd5921fa79.exe"C:\Users\Admin\AppData\Local\Temp\6ec208a956bd3c650cb4f69f9c8e03d1252207778e22d2809c579cbd5921fa79.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\hbthnn.exec:\hbthnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\jdvdj.exec:\jdvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\xfrlffr.exec:\xfrlffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\nhbbnh.exec:\nhbbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\xxlrllx.exec:\xxlrllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\tttbbt.exec:\tttbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vddpp.exec:\vddpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\5htbtt.exec:\5htbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\3xxllxl.exec:\3xxllxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\3nhthb.exec:\3nhthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\9lflxfr.exec:\9lflxfr.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\9rffffl.exec:\9rffffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\nnhhbh.exec:\nnhhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\pjjpd.exec:\pjjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\llxxflx.exec:\llxxflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\hhbnth.exec:\hhbnth.exe17⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3lxfllx.exec:\3lxfllx.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1272 -
\??\c:\frxxfff.exec:\frxxfff.exe19⤵
- Executes dropped EXE
PID:3036 -
\??\c:\fxrxfrf.exec:\fxrxfrf.exe20⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tbhnnn.exec:\tbhnnn.exe21⤵
- Executes dropped EXE
PID:576 -
\??\c:\xxflxrl.exec:\xxflxrl.exe22⤵
- Executes dropped EXE
PID:2128 -
\??\c:\llxlffr.exec:\llxlffr.exe23⤵
- Executes dropped EXE
PID:708 -
\??\c:\3bhntt.exec:\3bhntt.exe24⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vvjpd.exec:\vvjpd.exe25⤵
- Executes dropped EXE
PID:1284 -
\??\c:\7jpvj.exec:\7jpvj.exe26⤵
- Executes dropped EXE
PID:944 -
\??\c:\lxfrfrl.exec:\lxfrfrl.exe27⤵
- Executes dropped EXE
PID:2992 -
\??\c:\dddpj.exec:\dddpj.exe28⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe29⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pjvdp.exec:\pjvdp.exe30⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jvjpd.exec:\jvjpd.exe31⤵
- Executes dropped EXE
PID:2164 -
\??\c:\1btbnb.exec:\1btbnb.exe32⤵PID:2408
-
\??\c:\llrxrxr.exec:\llrxrxr.exe33⤵
- Executes dropped EXE
PID:2388 -
\??\c:\9hbnhh.exec:\9hbnhh.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7dvvd.exec:\7dvvd.exe35⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hhttbh.exec:\hhttbh.exe36⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3hhnbh.exec:\3hhnbh.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\ppjpd.exec:\ppjpd.exe38⤵
- Executes dropped EXE
PID:2328 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe39⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rrrffrl.exec:\rrrffrl.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\btttht.exec:\btttht.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\pvvvj.exec:\pvvvj.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pjdpj.exec:\pjdpj.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lllrlrr.exec:\lllrlrr.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ntbbhh.exec:\ntbbhh.exe45⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nhnbnh.exec:\nhnbnh.exe46⤵
- Executes dropped EXE
PID:860 -
\??\c:\ppjvj.exec:\ppjvj.exe47⤵
- Executes dropped EXE
PID:592 -
\??\c:\flflflf.exec:\flflflf.exe48⤵
- Executes dropped EXE
PID:600 -
\??\c:\ttnhtb.exec:\ttnhtb.exe49⤵
- Executes dropped EXE
PID:536 -
\??\c:\bhbntb.exec:\bhbntb.exe50⤵
- Executes dropped EXE
PID:1196 -
\??\c:\vvppj.exec:\vvppj.exe51⤵
- Executes dropped EXE
PID:2136 -
\??\c:\fxrflxl.exec:\fxrflxl.exe52⤵
- Executes dropped EXE
PID:1228 -
\??\c:\tnhnth.exec:\tnhnth.exe53⤵
- Executes dropped EXE
PID:560 -
\??\c:\7bnnnt.exec:\7bnnnt.exe54⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jpjpj.exec:\jpjpj.exe55⤵
- Executes dropped EXE
PID:1356 -
\??\c:\7xllrrf.exec:\7xllrrf.exe56⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rrrfxfx.exec:\rrrfxfx.exe57⤵
- Executes dropped EXE
PID:2112 -
\??\c:\btnbnn.exec:\btnbnn.exe58⤵
- Executes dropped EXE
PID:1956 -
\??\c:\1vpvj.exec:\1vpvj.exe59⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xlllxrf.exec:\xlllxrf.exe60⤵
- Executes dropped EXE
PID:844 -
\??\c:\xfxrrlr.exec:\xfxrrlr.exe61⤵
- Executes dropped EXE
PID:708 -
\??\c:\nnthth.exec:\nnthth.exe62⤵
- Executes dropped EXE
PID:1628 -
\??\c:\pppvd.exec:\pppvd.exe63⤵
- Executes dropped EXE
PID:236 -
\??\c:\xxlxllf.exec:\xxlxllf.exe64⤵
- Executes dropped EXE
PID:1048 -
\??\c:\llllrxr.exec:\llllrxr.exe65⤵
- Executes dropped EXE
PID:848 -
\??\c:\hnbhtb.exec:\hnbhtb.exe66⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jjvdp.exec:\jjvdp.exe67⤵PID:2236
-
\??\c:\jjddj.exec:\jjddj.exe68⤵PID:1760
-
\??\c:\9ffllff.exec:\9ffllff.exe69⤵PID:2340
-
\??\c:\hthttt.exec:\hthttt.exe70⤵PID:2184
-
\??\c:\vpdjp.exec:\vpdjp.exe71⤵PID:2392
-
\??\c:\rlrfxxx.exec:\rlrfxxx.exe72⤵PID:1584
-
\??\c:\xxlrrxf.exec:\xxlrrxf.exe73⤵PID:2076
-
\??\c:\tnhhtn.exec:\tnhhtn.exe74⤵PID:2552
-
\??\c:\7ddjv.exec:\7ddjv.exe75⤵PID:1860
-
\??\c:\5flxlrf.exec:\5flxlrf.exe76⤵PID:2832
-
\??\c:\rrlxrxr.exec:\rrlxrxr.exe77⤵PID:2800
-
\??\c:\nhbhtb.exec:\nhbhtb.exe78⤵PID:2744
-
\??\c:\pjvdv.exec:\pjvdv.exe79⤵PID:2240
-
\??\c:\pjdjv.exec:\pjdjv.exe80⤵PID:2896
-
\??\c:\xlrllff.exec:\xlrllff.exe81⤵PID:2712
-
\??\c:\bnnbtb.exec:\bnnbtb.exe82⤵PID:2652
-
\??\c:\vvvjp.exec:\vvvjp.exe83⤵PID:2660
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe84⤵PID:2072
-
\??\c:\9frrflr.exec:\9frrflr.exe85⤵PID:1296
-
\??\c:\7tnnbh.exec:\7tnnbh.exe86⤵PID:1644
-
\??\c:\3jpjp.exec:\3jpjp.exe87⤵PID:864
-
\??\c:\fxfrrll.exec:\fxfrrll.exe88⤵PID:2672
-
\??\c:\ffxlffr.exec:\ffxlffr.exe89⤵PID:1868
-
\??\c:\nnhntb.exec:\nnhntb.exe90⤵PID:1704
-
\??\c:\9pdjp.exec:\9pdjp.exe91⤵PID:1136
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe92⤵PID:1660
-
\??\c:\5xxfxfr.exec:\5xxfxfr.exe93⤵PID:1996
-
\??\c:\hhhnht.exec:\hhhnht.exe94⤵PID:1512
-
\??\c:\pddjv.exec:\pddjv.exe95⤵PID:2908
-
\??\c:\1dpvv.exec:\1dpvv.exe96⤵PID:2220
-
\??\c:\9xxxrxl.exec:\9xxxrxl.exe97⤵PID:2264
-
\??\c:\tttbth.exec:\tttbth.exe98⤵PID:1796
-
\??\c:\7htntt.exec:\7htntt.exe99⤵PID:444
-
\??\c:\dvvjp.exec:\dvvjp.exe100⤵PID:108
-
\??\c:\fllxflf.exec:\fllxflf.exe101⤵PID:1964
-
\??\c:\1nthtn.exec:\1nthtn.exe102⤵PID:1388
-
\??\c:\nntnbn.exec:\nntnbn.exe103⤵PID:912
-
\??\c:\jjdjv.exec:\jjdjv.exe104⤵PID:2920
-
\??\c:\xrrrffr.exec:\xrrrffr.exe105⤵PID:2980
-
\??\c:\xfxlxxl.exec:\xfxlxxl.exe106⤵PID:1044
-
\??\c:\3thnbn.exec:\3thnbn.exe107⤵PID:2300
-
\??\c:\jpjvd.exec:\jpjvd.exe108⤵PID:2116
-
\??\c:\vvvvj.exec:\vvvvj.exe109⤵PID:2424
-
\??\c:\5frflrx.exec:\5frflrx.exe110⤵PID:2068
-
\??\c:\hbntbh.exec:\hbntbh.exe111⤵PID:2412
-
\??\c:\vjddd.exec:\vjddd.exe112⤵PID:2388
-
\??\c:\pvjjv.exec:\pvjjv.exe113⤵PID:2520
-
\??\c:\flffrxf.exec:\flffrxf.exe114⤵PID:2576
-
\??\c:\nnnbnt.exec:\nnnbnt.exe115⤵PID:2812
-
\??\c:\ttnbhb.exec:\ttnbhb.exe116⤵PID:2156
-
\??\c:\jjdjv.exec:\jjdjv.exe117⤵PID:2736
-
\??\c:\fxlfxlr.exec:\fxlfxlr.exe118⤵PID:852
-
\??\c:\1fllrxf.exec:\1fllrxf.exe119⤵PID:2748
-
\??\c:\bnthth.exec:\bnthth.exe120⤵PID:2724
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe121⤵PID:2820
-
\??\c:\btnbnn.exec:\btnbnn.exe122⤵PID:3068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-