Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2024, 23:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d1f16f60145d85271316263c68ce630N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
7d1f16f60145d85271316263c68ce630N.exe
-
Size
72KB
-
MD5
7d1f16f60145d85271316263c68ce630
-
SHA1
0b92db84fd2b7e5b87900b1405ae000198260d55
-
SHA256
9a08580bc06b2575115a86d0e56f2ac69f0eeaab28b132cbc98334c4b30a4b9c
-
SHA512
bd3190149304e900e6cb49972398b26912692a62d9854fff1fefb17222b11c7b6004f4ff8403d9ec2436fde6345f1c387370e3dd6f5e8d96f8935bd017279003
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZ5RxfVK5DIlm:ymb3NkkiQ3mdBjF0yUmrfVc5
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/64-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2256 rfrffxr.exe 4092 5bbhbh.exe 2336 9jppp.exe 4728 frxlfll.exe 3684 hhbhtb.exe 2864 nhbtht.exe 3696 pjddd.exe 2008 bbttnb.exe 1800 htbhhh.exe 1460 llrlrrl.exe 2652 llllllf.exe 3008 jdvdd.exe 2420 jvvpj.exe 2592 frfrlll.exe 2404 hbnnbn.exe 3276 pjjjj.exe 632 lffffll.exe 4536 9bttbn.exe 4380 nnbhht.exe 912 pjppd.exe 1716 xlxrxxr.exe 2244 xfxxfll.exe 4632 hhhhtb.exe 3784 jdjjd.exe 4784 lxrrxrr.exe 1484 fxffxrx.exe 1452 nbhbnh.exe 2296 jvjvv.exe 2012 rxfxllf.exe 544 rrfrllx.exe 624 nnbbnt.exe 2992 dvjjp.exe 2288 lrxfrxx.exe 1784 lllllll.exe 4424 lxfllxf.exe 3248 9ntnhn.exe 3012 hbhhbh.exe 2300 jpjpp.exe 216 rrflrxf.exe 2532 bnhbtn.exe 4304 ttbhhn.exe 3208 dddjp.exe 4948 3dpvj.exe 2256 xlllxfr.exe 4084 flxxrff.exe 4388 nbbtth.exe 2608 3thhbh.exe 2772 jpppv.exe 3204 xrfflxx.exe 2436 fflrllr.exe 3596 hntbbn.exe 2864 tbntth.exe 1188 ddvvd.exe 2008 pjpvv.exe 364 rlxxlrl.exe 1968 fxrlffx.exe 2164 tbnhth.exe 404 dddjp.exe 3432 vvdpd.exe 2476 xlrxxrx.exe 4476 hbbbtn.exe 4568 nnbhhn.exe 2392 djvdj.exe 1388 lrrrxrr.exe -
resource yara_rule behavioral2/memory/64-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-214-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 64 wrote to memory of 2256 64 7d1f16f60145d85271316263c68ce630N.exe 83 PID 64 wrote to memory of 2256 64 7d1f16f60145d85271316263c68ce630N.exe 83 PID 64 wrote to memory of 2256 64 7d1f16f60145d85271316263c68ce630N.exe 83 PID 2256 wrote to memory of 4092 2256 rfrffxr.exe 84 PID 2256 wrote to memory of 4092 2256 rfrffxr.exe 84 PID 2256 wrote to memory of 4092 2256 rfrffxr.exe 84 PID 4092 wrote to memory of 2336 4092 5bbhbh.exe 85 PID 4092 wrote to memory of 2336 4092 5bbhbh.exe 85 PID 4092 wrote to memory of 2336 4092 5bbhbh.exe 85 PID 2336 wrote to memory of 4728 2336 9jppp.exe 86 PID 2336 wrote to memory of 4728 2336 9jppp.exe 86 PID 2336 wrote to memory of 4728 2336 9jppp.exe 86 PID 4728 wrote to memory of 3684 4728 frxlfll.exe 87 PID 4728 wrote to memory of 3684 4728 frxlfll.exe 87 PID 4728 wrote to memory of 3684 4728 frxlfll.exe 87 PID 3684 wrote to memory of 2864 3684 hhbhtb.exe 88 PID 3684 wrote to memory of 2864 3684 hhbhtb.exe 88 PID 3684 wrote to memory of 2864 3684 hhbhtb.exe 88 PID 2864 wrote to memory of 3696 2864 nhbtht.exe 89 PID 2864 wrote to memory of 3696 2864 nhbtht.exe 89 PID 2864 wrote to memory of 3696 2864 nhbtht.exe 89 PID 3696 wrote to memory of 2008 3696 pjddd.exe 91 PID 3696 wrote to memory of 2008 3696 pjddd.exe 91 PID 3696 wrote to memory of 2008 3696 pjddd.exe 91 PID 2008 wrote to memory of 1800 2008 bbttnb.exe 92 PID 2008 wrote to memory of 1800 2008 bbttnb.exe 92 PID 2008 wrote to memory of 1800 2008 bbttnb.exe 92 PID 1800 wrote to memory of 1460 1800 htbhhh.exe 93 PID 1800 wrote to memory of 1460 1800 htbhhh.exe 93 PID 1800 wrote to memory of 1460 1800 htbhhh.exe 93 PID 1460 wrote to memory of 2652 1460 llrlrrl.exe 95 PID 1460 wrote to memory of 2652 1460 llrlrrl.exe 95 PID 1460 wrote to memory of 2652 1460 llrlrrl.exe 95 PID 2652 wrote to memory of 3008 2652 llllllf.exe 96 PID 2652 wrote to memory of 3008 2652 llllllf.exe 96 PID 2652 wrote to memory of 3008 2652 llllllf.exe 96 PID 3008 wrote to memory of 2420 3008 jdvdd.exe 97 PID 3008 wrote to memory of 2420 3008 jdvdd.exe 97 PID 3008 wrote to memory of 2420 3008 jdvdd.exe 97 PID 2420 wrote to memory of 2592 2420 jvvpj.exe 98 PID 2420 wrote to memory of 2592 2420 jvvpj.exe 98 PID 2420 wrote to memory of 2592 2420 jvvpj.exe 98 PID 2592 wrote to memory of 2404 2592 frfrlll.exe 99 PID 2592 wrote to memory of 2404 2592 frfrlll.exe 99 PID 2592 wrote to memory of 2404 2592 frfrlll.exe 99 PID 2404 wrote to memory of 3276 2404 hbnnbn.exe 100 PID 2404 wrote to memory of 3276 2404 hbnnbn.exe 100 PID 2404 wrote to memory of 3276 2404 hbnnbn.exe 100 PID 3276 wrote to memory of 632 3276 pjjjj.exe 101 PID 3276 wrote to memory of 632 3276 pjjjj.exe 101 PID 3276 wrote to memory of 632 3276 pjjjj.exe 101 PID 632 wrote to memory of 4536 632 lffffll.exe 102 PID 632 wrote to memory of 4536 632 lffffll.exe 102 PID 632 wrote to memory of 4536 632 lffffll.exe 102 PID 4536 wrote to memory of 4380 4536 9bttbn.exe 103 PID 4536 wrote to memory of 4380 4536 9bttbn.exe 103 PID 4536 wrote to memory of 4380 4536 9bttbn.exe 103 PID 4380 wrote to memory of 912 4380 nnbhht.exe 104 PID 4380 wrote to memory of 912 4380 nnbhht.exe 104 PID 4380 wrote to memory of 912 4380 nnbhht.exe 104 PID 912 wrote to memory of 1716 912 pjppd.exe 105 PID 912 wrote to memory of 1716 912 pjppd.exe 105 PID 912 wrote to memory of 1716 912 pjppd.exe 105 PID 1716 wrote to memory of 2244 1716 xlxrxxr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d1f16f60145d85271316263c68ce630N.exe"C:\Users\Admin\AppData\Local\Temp\7d1f16f60145d85271316263c68ce630N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\rfrffxr.exec:\rfrffxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\5bbhbh.exec:\5bbhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\9jppp.exec:\9jppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\frxlfll.exec:\frxlfll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\hhbhtb.exec:\hhbhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\nhbtht.exec:\nhbtht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\pjddd.exec:\pjddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\bbttnb.exec:\bbttnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\htbhhh.exec:\htbhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\llrlrrl.exec:\llrlrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\llllllf.exec:\llllllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jdvdd.exec:\jdvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\jvvpj.exec:\jvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\frfrlll.exec:\frfrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hbnnbn.exec:\hbnnbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\pjjjj.exec:\pjjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\lffffll.exec:\lffffll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\9bttbn.exec:\9bttbn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\nnbhht.exec:\nnbhht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\pjppd.exec:\pjppd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\xlxrxxr.exec:\xlxrxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\xfxxfll.exec:\xfxxfll.exe23⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hhhhtb.exec:\hhhhtb.exe24⤵
- Executes dropped EXE
PID:4632 -
\??\c:\jdjjd.exec:\jdjjd.exe25⤵
- Executes dropped EXE
PID:3784 -
\??\c:\lxrrxrr.exec:\lxrrxrr.exe26⤵
- Executes dropped EXE
PID:4784 -
\??\c:\fxffxrx.exec:\fxffxrx.exe27⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nbhbnh.exec:\nbhbnh.exe28⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jvjvv.exec:\jvjvv.exe29⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rxfxllf.exec:\rxfxllf.exe30⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rrfrllx.exec:\rrfrllx.exe31⤵
- Executes dropped EXE
PID:544 -
\??\c:\nnbbnt.exec:\nnbbnt.exe32⤵
- Executes dropped EXE
PID:624 -
\??\c:\dvjjp.exec:\dvjjp.exe33⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lrxfrxx.exec:\lrxfrxx.exe34⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lllllll.exec:\lllllll.exe35⤵
- Executes dropped EXE
PID:1784 -
\??\c:\lxfllxf.exec:\lxfllxf.exe36⤵
- Executes dropped EXE
PID:4424 -
\??\c:\9ntnhn.exec:\9ntnhn.exe37⤵
- Executes dropped EXE
PID:3248 -
\??\c:\hbhhbh.exec:\hbhhbh.exe38⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jpjpp.exec:\jpjpp.exe39⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rrflrxf.exec:\rrflrxf.exe40⤵
- Executes dropped EXE
PID:216 -
\??\c:\bnhbtn.exec:\bnhbtn.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ttbhhn.exec:\ttbhhn.exe42⤵
- Executes dropped EXE
PID:4304 -
\??\c:\dddjp.exec:\dddjp.exe43⤵
- Executes dropped EXE
PID:3208 -
\??\c:\3dpvj.exec:\3dpvj.exe44⤵
- Executes dropped EXE
PID:4948 -
\??\c:\xlllxfr.exec:\xlllxfr.exe45⤵
- Executes dropped EXE
PID:2256 -
\??\c:\flxxrff.exec:\flxxrff.exe46⤵
- Executes dropped EXE
PID:4084 -
\??\c:\nbbtth.exec:\nbbtth.exe47⤵
- Executes dropped EXE
PID:4388 -
\??\c:\3thhbh.exec:\3thhbh.exe48⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jpppv.exec:\jpppv.exe49⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xrfflxx.exec:\xrfflxx.exe50⤵
- Executes dropped EXE
PID:3204 -
\??\c:\fflrllr.exec:\fflrllr.exe51⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hntbbn.exec:\hntbbn.exe52⤵
- Executes dropped EXE
PID:3596 -
\??\c:\tbntth.exec:\tbntth.exe53⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ddvvd.exec:\ddvvd.exe54⤵
- Executes dropped EXE
PID:1188 -
\??\c:\pjpvv.exec:\pjpvv.exe55⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rlxxlrl.exec:\rlxxlrl.exe56⤵
- Executes dropped EXE
PID:364 -
\??\c:\fxrlffx.exec:\fxrlffx.exe57⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tbnhth.exec:\tbnhth.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dddjp.exec:\dddjp.exe59⤵
- Executes dropped EXE
PID:404 -
\??\c:\vvdpd.exec:\vvdpd.exe60⤵
- Executes dropped EXE
PID:3432 -
\??\c:\xlrxxrx.exec:\xlrxxrx.exe61⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hbbbtn.exec:\hbbbtn.exe62⤵
- Executes dropped EXE
PID:4476 -
\??\c:\nnbhhn.exec:\nnbhhn.exe63⤵
- Executes dropped EXE
PID:4568 -
\??\c:\djvdj.exec:\djvdj.exe64⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lrrrxrr.exec:\lrrrxrr.exe65⤵
- Executes dropped EXE
PID:1388 -
\??\c:\frrrrrx.exec:\frrrrrx.exe66⤵PID:452
-
\??\c:\nnttnn.exec:\nnttnn.exe67⤵PID:4808
-
\??\c:\vvjpp.exec:\vvjpp.exe68⤵PID:3600
-
\??\c:\fxffxfl.exec:\fxffxfl.exe69⤵PID:2028
-
\??\c:\7lxxxff.exec:\7lxxxff.exe70⤵PID:976
-
\??\c:\bbhbbh.exec:\bbhbbh.exe71⤵PID:2220
-
\??\c:\ttbbbh.exec:\ttbbbh.exe72⤵PID:3948
-
\??\c:\djvdj.exec:\djvdj.exe73⤵PID:2056
-
\??\c:\jpjpp.exec:\jpjpp.exe74⤵PID:1972
-
\??\c:\fxxxflr.exec:\fxxxflr.exe75⤵PID:4232
-
\??\c:\tttbbh.exec:\tttbbh.exe76⤵PID:2144
-
\??\c:\7vjjv.exec:\7vjjv.exe77⤵PID:3520
-
\??\c:\jvpjj.exec:\jvpjj.exe78⤵PID:1660
-
\??\c:\xrfflll.exec:\xrfflll.exe79⤵PID:804
-
\??\c:\tnbbtn.exec:\tnbbtn.exe80⤵PID:4836
-
\??\c:\9hhhbt.exec:\9hhhbt.exe81⤵PID:1452
-
\??\c:\jvvdd.exec:\jvvdd.exe82⤵PID:3244
-
\??\c:\pdddv.exec:\pdddv.exe83⤵PID:2888
-
\??\c:\bbbtbh.exec:\bbbtbh.exe84⤵PID:3456
-
\??\c:\jjvpv.exec:\jjvpv.exe85⤵PID:4176
-
\??\c:\vpvjp.exec:\vpvjp.exe86⤵PID:3572
-
\??\c:\xrrrllr.exec:\xrrrllr.exe87⤵PID:3536
-
\??\c:\lfxrlll.exec:\lfxrlll.exe88⤵PID:464
-
\??\c:\bbtnbt.exec:\bbtnbt.exe89⤵PID:1316
-
\??\c:\pppjj.exec:\pppjj.exe90⤵PID:880
-
\??\c:\jdddp.exec:\jdddp.exe91⤵PID:4996
-
\??\c:\lllrlll.exec:\lllrlll.exe92⤵PID:3264
-
\??\c:\9flllrr.exec:\9flllrr.exe93⤵PID:4076
-
\??\c:\ttbbth.exec:\ttbbth.exe94⤵PID:3068
-
\??\c:\9dddv.exec:\9dddv.exe95⤵PID:2976
-
\??\c:\ppjvv.exec:\ppjvv.exe96⤵PID:4304
-
\??\c:\9llfxxr.exec:\9llfxxr.exe97⤵PID:2340
-
\??\c:\xxflllf.exec:\xxflllf.exe98⤵PID:2564
-
\??\c:\tthbbh.exec:\tthbbh.exe99⤵PID:3628
-
\??\c:\bbbthh.exec:\bbbthh.exe100⤵PID:3656
-
\??\c:\jpdjv.exec:\jpdjv.exe101⤵PID:3136
-
\??\c:\rflxfxx.exec:\rflxfxx.exe102⤵PID:3476
-
\??\c:\xfxlfxr.exec:\xfxlfxr.exe103⤵PID:3412
-
\??\c:\tbthtn.exec:\tbthtn.exe104⤵PID:1400
-
\??\c:\3pvdv.exec:\3pvdv.exe105⤵PID:636
-
\??\c:\fxlfrxr.exec:\fxlfrxr.exe106⤵PID:4800
-
\??\c:\lffxxrl.exec:\lffxxrl.exe107⤵PID:1872
-
\??\c:\bhhhht.exec:\bhhhht.exe108⤵PID:1152
-
\??\c:\7pvpj.exec:\7pvpj.exe109⤵PID:528
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe110⤵PID:2264
-
\??\c:\9hnhbb.exec:\9hnhbb.exe111⤵PID:4976
-
\??\c:\dpppj.exec:\dpppj.exe112⤵PID:4964
-
\??\c:\rrrrxrl.exec:\rrrrxrl.exe113⤵PID:4156
-
\??\c:\rrlllll.exec:\rrlllll.exe114⤵PID:3008
-
\??\c:\nbhhnn.exec:\nbhhnn.exe115⤵PID:2420
-
\??\c:\dvvvp.exec:\dvvvp.exe116⤵PID:4856
-
\??\c:\xxxrfxr.exec:\xxxrfxr.exe117⤵PID:4056
-
\??\c:\jvjjj.exec:\jvjjj.exe118⤵PID:1904
-
\??\c:\jpjdv.exec:\jpjdv.exe119⤵PID:1380
-
\??\c:\frxrllf.exec:\frxrllf.exe120⤵PID:3956
-
\??\c:\xxrrlrr.exec:\xxrrlrr.exe121⤵PID:4840
-
\??\c:\bnttnb.exec:\bnttnb.exe122⤵PID:1560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-