Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11-09-2024 21:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bfaba925143fe5b888b4fcccbe66a800N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
bfaba925143fe5b888b4fcccbe66a800N.exe
-
Size
68KB
-
MD5
bfaba925143fe5b888b4fcccbe66a800
-
SHA1
05f82d1d603cf7adaabd62e7c5f8e39c0c42679e
-
SHA256
5dc23cf3f9e28d6923d50d11bb0dacb191a24d240a1a36a28781ca145b1ef958
-
SHA512
6955e220af497b33e7cbb3911ff2008871f8ac3f8874c4fd3ec28db70ef3506a6d92fd6b342ddf9030e097da432df9b015673805921913a59700d19c8d0c5b1c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcb:ymb3NkkiQ3mdBjFIsIVcb
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/2156-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4276 thbhtt.exe 3328 jddjd.exe 4964 vddjv.exe 1248 5xrrllf.exe 3680 hhnntt.exe 2420 3jddj.exe 3576 dvjdp.exe 4484 lfffxrl.exe 4596 tntnnn.exe 5008 ddpdv.exe 3176 ffffxxx.exe 2796 3bhbtn.exe 3084 vvdjv.exe 4164 7lrllll.exe 3916 fxxxxxx.exe 3972 7hhnhh.exe 1920 dddpj.exe 1948 lxxlfxf.exe 4864 rrfxrrx.exe 536 vvdvv.exe 3032 dppvd.exe 836 llfllxx.exe 4764 hbbhbn.exe 2548 vjddv.exe 4324 5djdp.exe 3588 llrlfxx.exe 2504 7bbtbt.exe 1660 3bhhhn.exe 1852 pdvvp.exe 4048 lxxrxrr.exe 1228 lffrfrr.exe 2576 nhhhhb.exe 4996 9jpvv.exe 1728 jvjjv.exe 5016 fxfxxxr.exe 2392 xfllfff.exe 5116 htntbh.exe 2004 hthbbb.exe 3240 vvddv.exe 2496 7ddvj.exe 4044 jdvjv.exe 1568 rxffxll.exe 1352 5xlfxxx.exe 3420 btttnn.exe 4796 bbnntb.exe 4080 dpvvp.exe 2896 vppjj.exe 1236 ffxrlll.exe 5028 xrxxrrr.exe 2464 ttnnnt.exe 3560 tntttt.exe 2288 vpddv.exe 1092 1vddd.exe 3976 rlrlrxf.exe 3900 rrllflf.exe 4596 ttntnn.exe 5036 tthnht.exe 4648 pjjpd.exe 3176 jpdvp.exe 1924 xlrlllf.exe 2796 7llllll.exe 220 thbbhn.exe 1484 5pvpd.exe 2544 dvvvv.exe -
resource yara_rule behavioral2/memory/2156-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 4276 2156 bfaba925143fe5b888b4fcccbe66a800N.exe 83 PID 2156 wrote to memory of 4276 2156 bfaba925143fe5b888b4fcccbe66a800N.exe 83 PID 2156 wrote to memory of 4276 2156 bfaba925143fe5b888b4fcccbe66a800N.exe 83 PID 4276 wrote to memory of 3328 4276 thbhtt.exe 84 PID 4276 wrote to memory of 3328 4276 thbhtt.exe 84 PID 4276 wrote to memory of 3328 4276 thbhtt.exe 84 PID 3328 wrote to memory of 4964 3328 jddjd.exe 85 PID 3328 wrote to memory of 4964 3328 jddjd.exe 85 PID 3328 wrote to memory of 4964 3328 jddjd.exe 85 PID 4964 wrote to memory of 1248 4964 vddjv.exe 86 PID 4964 wrote to memory of 1248 4964 vddjv.exe 86 PID 4964 wrote to memory of 1248 4964 vddjv.exe 86 PID 1248 wrote to memory of 3680 1248 5xrrllf.exe 87 PID 1248 wrote to memory of 3680 1248 5xrrllf.exe 87 PID 1248 wrote to memory of 3680 1248 5xrrllf.exe 87 PID 3680 wrote to memory of 2420 3680 hhnntt.exe 88 PID 3680 wrote to memory of 2420 3680 hhnntt.exe 88 PID 3680 wrote to memory of 2420 3680 hhnntt.exe 88 PID 2420 wrote to memory of 3576 2420 3jddj.exe 89 PID 2420 wrote to memory of 3576 2420 3jddj.exe 89 PID 2420 wrote to memory of 3576 2420 3jddj.exe 89 PID 3576 wrote to memory of 4484 3576 dvjdp.exe 90 PID 3576 wrote to memory of 4484 3576 dvjdp.exe 90 PID 3576 wrote to memory of 4484 3576 dvjdp.exe 90 PID 4484 wrote to memory of 4596 4484 lfffxrl.exe 91 PID 4484 wrote to memory of 4596 4484 lfffxrl.exe 91 PID 4484 wrote to memory of 4596 4484 lfffxrl.exe 91 PID 4596 wrote to memory of 5008 4596 tntnnn.exe 92 PID 4596 wrote to memory of 5008 4596 tntnnn.exe 92 PID 4596 wrote to memory of 5008 4596 tntnnn.exe 92 PID 5008 wrote to memory of 3176 5008 ddpdv.exe 93 PID 5008 wrote to memory of 3176 5008 ddpdv.exe 93 PID 5008 wrote to memory of 3176 5008 ddpdv.exe 93 PID 3176 wrote to memory of 2796 3176 ffffxxx.exe 95 PID 3176 wrote to memory of 2796 3176 ffffxxx.exe 95 PID 3176 wrote to memory of 2796 3176 ffffxxx.exe 95 PID 2796 wrote to memory of 3084 2796 3bhbtn.exe 96 PID 2796 wrote to memory of 3084 2796 3bhbtn.exe 96 PID 2796 wrote to memory of 3084 2796 3bhbtn.exe 96 PID 3084 wrote to memory of 4164 3084 vvdjv.exe 97 PID 3084 wrote to memory of 4164 3084 vvdjv.exe 97 PID 3084 wrote to memory of 4164 3084 vvdjv.exe 97 PID 4164 wrote to memory of 3916 4164 7lrllll.exe 98 PID 4164 wrote to memory of 3916 4164 7lrllll.exe 98 PID 4164 wrote to memory of 3916 4164 7lrllll.exe 98 PID 3916 wrote to memory of 3972 3916 fxxxxxx.exe 99 PID 3916 wrote to memory of 3972 3916 fxxxxxx.exe 99 PID 3916 wrote to memory of 3972 3916 fxxxxxx.exe 99 PID 3972 wrote to memory of 1920 3972 7hhnhh.exe 101 PID 3972 wrote to memory of 1920 3972 7hhnhh.exe 101 PID 3972 wrote to memory of 1920 3972 7hhnhh.exe 101 PID 1920 wrote to memory of 1948 1920 dddpj.exe 102 PID 1920 wrote to memory of 1948 1920 dddpj.exe 102 PID 1920 wrote to memory of 1948 1920 dddpj.exe 102 PID 1948 wrote to memory of 4864 1948 lxxlfxf.exe 103 PID 1948 wrote to memory of 4864 1948 lxxlfxf.exe 103 PID 1948 wrote to memory of 4864 1948 lxxlfxf.exe 103 PID 4864 wrote to memory of 536 4864 rrfxrrx.exe 104 PID 4864 wrote to memory of 536 4864 rrfxrrx.exe 104 PID 4864 wrote to memory of 536 4864 rrfxrrx.exe 104 PID 536 wrote to memory of 3032 536 vvdvv.exe 105 PID 536 wrote to memory of 3032 536 vvdvv.exe 105 PID 536 wrote to memory of 3032 536 vvdvv.exe 105 PID 3032 wrote to memory of 836 3032 dppvd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfaba925143fe5b888b4fcccbe66a800N.exe"C:\Users\Admin\AppData\Local\Temp\bfaba925143fe5b888b4fcccbe66a800N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\thbhtt.exec:\thbhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\jddjd.exec:\jddjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\vddjv.exec:\vddjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\5xrrllf.exec:\5xrrllf.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\hhnntt.exec:\hhnntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\3jddj.exec:\3jddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\dvjdp.exec:\dvjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\lfffxrl.exec:\lfffxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\tntnnn.exec:\tntnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\ddpdv.exec:\ddpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\ffffxxx.exec:\ffffxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\3bhbtn.exec:\3bhbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\vvdjv.exec:\vvdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\7lrllll.exec:\7lrllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\7hhnhh.exec:\7hhnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\dddpj.exec:\dddpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\lxxlfxf.exec:\lxxlfxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\rrfxrrx.exec:\rrfxrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\vvdvv.exec:\vvdvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\dppvd.exec:\dppvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\llfllxx.exec:\llfllxx.exe23⤵
- Executes dropped EXE
PID:836 -
\??\c:\hbbhbn.exec:\hbbhbn.exe24⤵
- Executes dropped EXE
PID:4764 -
\??\c:\vjddv.exec:\vjddv.exe25⤵
- Executes dropped EXE
PID:2548 -
\??\c:\5djdp.exec:\5djdp.exe26⤵
- Executes dropped EXE
PID:4324 -
\??\c:\llrlfxx.exec:\llrlfxx.exe27⤵
- Executes dropped EXE
PID:3588 -
\??\c:\7bbtbt.exec:\7bbtbt.exe28⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3bhhhn.exec:\3bhhhn.exe29⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pdvvp.exec:\pdvvp.exe30⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lxxrxrr.exec:\lxxrxrr.exe31⤵
- Executes dropped EXE
PID:4048 -
\??\c:\lffrfrr.exec:\lffrfrr.exe32⤵
- Executes dropped EXE
PID:1228 -
\??\c:\nhhhhb.exec:\nhhhhb.exe33⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9jpvv.exec:\9jpvv.exe34⤵
- Executes dropped EXE
PID:4996 -
\??\c:\jvjjv.exec:\jvjjv.exe35⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe36⤵
- Executes dropped EXE
PID:5016 -
\??\c:\xfllfff.exec:\xfllfff.exe37⤵
- Executes dropped EXE
PID:2392 -
\??\c:\htntbh.exec:\htntbh.exe38⤵
- Executes dropped EXE
PID:5116 -
\??\c:\hthbbb.exec:\hthbbb.exe39⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vvddv.exec:\vvddv.exe40⤵
- Executes dropped EXE
PID:3240 -
\??\c:\7ddvj.exec:\7ddvj.exe41⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jdvjv.exec:\jdvjv.exe42⤵
- Executes dropped EXE
PID:4044 -
\??\c:\rxffxll.exec:\rxffxll.exe43⤵
- Executes dropped EXE
PID:1568 -
\??\c:\5xlfxxx.exec:\5xlfxxx.exe44⤵
- Executes dropped EXE
PID:1352 -
\??\c:\btttnn.exec:\btttnn.exe45⤵
- Executes dropped EXE
PID:3420 -
\??\c:\bbnntb.exec:\bbnntb.exe46⤵
- Executes dropped EXE
PID:4796 -
\??\c:\dpvvp.exec:\dpvvp.exe47⤵
- Executes dropped EXE
PID:4080 -
\??\c:\vppjj.exec:\vppjj.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\ffxrlll.exec:\ffxrlll.exe49⤵
- Executes dropped EXE
PID:1236 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe50⤵
- Executes dropped EXE
PID:5028 -
\??\c:\ttnnnt.exec:\ttnnnt.exe51⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tntttt.exec:\tntttt.exe52⤵
- Executes dropped EXE
PID:3560 -
\??\c:\vpddv.exec:\vpddv.exe53⤵
- Executes dropped EXE
PID:2288 -
\??\c:\1vddd.exec:\1vddd.exe54⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rlrlrxf.exec:\rlrlrxf.exe55⤵
- Executes dropped EXE
PID:3976 -
\??\c:\rrllflf.exec:\rrllflf.exe56⤵
- Executes dropped EXE
PID:3900 -
\??\c:\ttntnn.exec:\ttntnn.exe57⤵
- Executes dropped EXE
PID:4596 -
\??\c:\tthnht.exec:\tthnht.exe58⤵
- Executes dropped EXE
PID:5036 -
\??\c:\pjjpd.exec:\pjjpd.exe59⤵
- Executes dropped EXE
PID:4648 -
\??\c:\jpdvp.exec:\jpdvp.exe60⤵
- Executes dropped EXE
PID:3176 -
\??\c:\xlrlllf.exec:\xlrlllf.exe61⤵
- Executes dropped EXE
PID:1924 -
\??\c:\7llllll.exec:\7llllll.exe62⤵
- Executes dropped EXE
PID:2796 -
\??\c:\thbbhn.exec:\thbbhn.exe63⤵
- Executes dropped EXE
PID:220 -
\??\c:\5pvpd.exec:\5pvpd.exe64⤵
- Executes dropped EXE
PID:1484 -
\??\c:\dvvvv.exec:\dvvvv.exe65⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lxxlfff.exec:\lxxlfff.exe66⤵PID:2620
-
\??\c:\xlrllfx.exec:\xlrllfx.exe67⤵PID:4128
-
\??\c:\bhthtb.exec:\bhthtb.exe68⤵PID:1920
-
\??\c:\hbnhnn.exec:\hbnhnn.exe69⤵PID:4632
-
\??\c:\vpdjv.exec:\vpdjv.exe70⤵PID:5032
-
\??\c:\vjvvv.exec:\vjvvv.exe71⤵PID:808
-
\??\c:\rxfxllx.exec:\rxfxllx.exe72⤵PID:976
-
\??\c:\nhnhnh.exec:\nhnhnh.exe73⤵PID:4572
-
\??\c:\ttnnnt.exec:\ttnnnt.exe74⤵PID:3092
-
\??\c:\9dppp.exec:\9dppp.exe75⤵PID:3264
-
\??\c:\fxffxxx.exec:\fxffxxx.exe76⤵PID:1296
-
\??\c:\bbnhtt.exec:\bbnhtt.exe77⤵PID:2324
-
\??\c:\3nbbnt.exec:\3nbbnt.exe78⤵PID:1020
-
\??\c:\pvdjd.exec:\pvdjd.exe79⤵PID:4376
-
\??\c:\vpddd.exec:\vpddd.exe80⤵PID:4324
-
\??\c:\9lllflf.exec:\9lllflf.exe81⤵PID:4956
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe82⤵PID:4856
-
\??\c:\bnntbb.exec:\bnntbb.exe83⤵PID:4748
-
\??\c:\bbbtnt.exec:\bbbtnt.exe84⤵PID:2732
-
\??\c:\ddvvp.exec:\ddvvp.exe85⤵PID:3764
-
\??\c:\llrrfrx.exec:\llrrfrx.exe86⤵PID:2572
-
\??\c:\7nntnn.exec:\7nntnn.exe87⤵PID:832
-
\??\c:\9vvpj.exec:\9vvpj.exe88⤵PID:4732
-
\??\c:\jdjjj.exec:\jdjjj.exe89⤵PID:2240
-
\??\c:\7xrrlll.exec:\7xrrlll.exe90⤵PID:2500
-
\??\c:\7lrxxxx.exec:\7lrxxxx.exe91⤵PID:2204
-
\??\c:\nhttnn.exec:\nhttnn.exe92⤵PID:5016
-
\??\c:\nhnnnn.exec:\nhnnnn.exe93⤵PID:4432
-
\??\c:\dpddj.exec:\dpddj.exe94⤵PID:2256
-
\??\c:\xrlffff.exec:\xrlffff.exe95⤵PID:3748
-
\??\c:\rrxllrl.exec:\rrxllrl.exe96⤵PID:1192
-
\??\c:\nnhhht.exec:\nnhhht.exe97⤵PID:2236
-
\??\c:\hhbhht.exec:\hhbhht.exe98⤵PID:4736
-
\??\c:\dpjvv.exec:\dpjvv.exe99⤵PID:3436
-
\??\c:\jvjdv.exec:\jvjdv.exe100⤵PID:3296
-
\??\c:\llrrxfl.exec:\llrrxfl.exe101⤵PID:3276
-
\??\c:\ffffffx.exec:\ffffffx.exe102⤵PID:3760
-
\??\c:\xrxrrrf.exec:\xrxrrrf.exe103⤵PID:2380
-
\??\c:\hnbnnn.exec:\hnbnnn.exe104⤵PID:2696
-
\??\c:\jpvpj.exec:\jpvpj.exe105⤵PID:3680
-
\??\c:\rflfrlf.exec:\rflfrlf.exe106⤵PID:2780
-
\??\c:\llrlfxr.exec:\llrlfxr.exe107⤵PID:2420
-
\??\c:\htbtnn.exec:\htbtnn.exe108⤵PID:2224
-
\??\c:\bttnbb.exec:\bttnbb.exe109⤵PID:5112
-
\??\c:\dvjdp.exec:\dvjdp.exe110⤵PID:376
-
\??\c:\9dvpj.exec:\9dvpj.exe111⤵PID:3976
-
\??\c:\1pjjd.exec:\1pjjd.exe112⤵PID:3932
-
\??\c:\frlfxrl.exec:\frlfxrl.exe113⤵PID:3152
-
\??\c:\lflxrxr.exec:\lflxrxr.exe114⤵PID:3496
-
\??\c:\nbbbbh.exec:\nbbbbh.exe115⤵PID:4980
-
\??\c:\tnhhbh.exec:\tnhhbh.exe116⤵PID:1724
-
\??\c:\vdpvj.exec:\vdpvj.exe117⤵PID:2736
-
\??\c:\jdjjv.exec:\jdjjv.exe118⤵PID:4464
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe119⤵PID:2388
-
\??\c:\5rfxrrl.exec:\5rfxrrl.exe120⤵PID:2936
-
\??\c:\9htnnn.exec:\9htnnn.exe121⤵PID:2376
-
\??\c:\hbhbtt.exec:\hbhbtt.exe122⤵PID:3292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-