Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 22:02
Static task
static1
Behavioral task
behavioral1
Sample
67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe
Resource
win7-20240708-en
General
-
Target
67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe
-
Size
76KB
-
MD5
347c97934e66190c88426f149b2f9250
-
SHA1
a44fd211f751951ec9f1596f00f8b59cf691e9ba
-
SHA256
67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893
-
SHA512
0a57a9077bd78f1f4069c49384442521efb6117f45e85ed2d3c18b0269a007cf3c69d35328b9c3406434fb89ea459bed5f6d8595b6e754df7e52d9f481ecd117
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmP76:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHT
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2032-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2412 1xlrrrr.exe 2344 btbbhb.exe 1864 vpppd.exe 2456 9rfflfl.exe 2876 bnttbb.exe 2900 vpjdd.exe 2624 pdjvv.exe 1668 llllflx.exe 2720 bbnhnn.exe 2220 1dppd.exe 1708 jvddj.exe 2428 xxrfxlf.exe 1600 bttttt.exe 2668 hhbhtt.exe 2828 nthttt.exe 2024 9djpj.exe 1648 lxxlxfl.exe 2952 nhhhnn.exe 2444 3thhtt.exe 2080 djvjj.exe 1268 lxffllx.exe 1772 rxlxxxf.exe 2008 hbhntb.exe 1252 5vjpv.exe 484 vdjdd.exe 2516 3flfxxr.exe 2092 3xrfrll.exe 1360 nbhbbt.exe 896 nbttbb.exe 2544 3dpvj.exe 3036 fxfffff.exe 2404 xlxrllr.exe 1964 5frrffl.exe 1852 nbhhhh.exe 2556 vjppp.exe 2704 vjvpp.exe 2796 xllffxf.exe 2608 xrrrrrx.exe 2912 5bhbtn.exe 2832 3ddvp.exe 2768 dvpvd.exe 2624 lxxllfl.exe 2240 3frrxxl.exe 2292 ttnbnt.exe 2504 nhtbhh.exe 1092 1jpvv.exe 2976 pdvjj.exe 1944 fxfflfl.exe 2784 xrrxflr.exe 2160 5hnnnh.exe 1528 9vppv.exe 2424 ddvdj.exe 1892 7dppj.exe 2972 ffllflx.exe 2988 xxllfrr.exe 2052 thtnnn.exe 1932 nbhnnh.exe 1676 jvjjj.exe 3012 5pdvv.exe 844 xrlrrrf.exe 1956 tttthb.exe 1216 hbntth.exe 1260 5vppv.exe 484 9dvjj.exe -
resource yara_rule behavioral1/memory/2032-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-308-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2412 2032 67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe 30 PID 2032 wrote to memory of 2412 2032 67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe 30 PID 2032 wrote to memory of 2412 2032 67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe 30 PID 2032 wrote to memory of 2412 2032 67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe 30 PID 2412 wrote to memory of 2344 2412 1xlrrrr.exe 31 PID 2412 wrote to memory of 2344 2412 1xlrrrr.exe 31 PID 2412 wrote to memory of 2344 2412 1xlrrrr.exe 31 PID 2412 wrote to memory of 2344 2412 1xlrrrr.exe 31 PID 2344 wrote to memory of 1864 2344 btbbhb.exe 32 PID 2344 wrote to memory of 1864 2344 btbbhb.exe 32 PID 2344 wrote to memory of 1864 2344 btbbhb.exe 32 PID 2344 wrote to memory of 1864 2344 btbbhb.exe 32 PID 1864 wrote to memory of 2456 1864 vpppd.exe 33 PID 1864 wrote to memory of 2456 1864 vpppd.exe 33 PID 1864 wrote to memory of 2456 1864 vpppd.exe 33 PID 1864 wrote to memory of 2456 1864 vpppd.exe 33 PID 2456 wrote to memory of 2876 2456 9rfflfl.exe 34 PID 2456 wrote to memory of 2876 2456 9rfflfl.exe 34 PID 2456 wrote to memory of 2876 2456 9rfflfl.exe 34 PID 2456 wrote to memory of 2876 2456 9rfflfl.exe 34 PID 2876 wrote to memory of 2900 2876 bnttbb.exe 35 PID 2876 wrote to memory of 2900 2876 bnttbb.exe 35 PID 2876 wrote to memory of 2900 2876 bnttbb.exe 35 PID 2876 wrote to memory of 2900 2876 bnttbb.exe 35 PID 2900 wrote to memory of 2624 2900 vpjdd.exe 36 PID 2900 wrote to memory of 2624 2900 vpjdd.exe 36 PID 2900 wrote to memory of 2624 2900 vpjdd.exe 36 PID 2900 wrote to memory of 2624 2900 vpjdd.exe 36 PID 2624 wrote to memory of 1668 2624 pdjvv.exe 37 PID 2624 wrote to memory of 1668 2624 pdjvv.exe 37 PID 2624 wrote to memory of 1668 2624 pdjvv.exe 37 PID 2624 wrote to memory of 1668 2624 pdjvv.exe 37 PID 1668 wrote to memory of 2720 1668 llllflx.exe 38 PID 1668 wrote to memory of 2720 1668 llllflx.exe 38 PID 1668 wrote to memory of 2720 1668 llllflx.exe 38 PID 1668 wrote to memory of 2720 1668 llllflx.exe 38 PID 2720 wrote to memory of 2220 2720 bbnhnn.exe 39 PID 2720 wrote to memory of 2220 2720 bbnhnn.exe 39 PID 2720 wrote to memory of 2220 2720 bbnhnn.exe 39 PID 2720 wrote to memory of 2220 2720 bbnhnn.exe 39 PID 2220 wrote to memory of 1708 2220 1dppd.exe 40 PID 2220 wrote to memory of 1708 2220 1dppd.exe 40 PID 2220 wrote to memory of 1708 2220 1dppd.exe 40 PID 2220 wrote to memory of 1708 2220 1dppd.exe 40 PID 1708 wrote to memory of 2428 1708 jvddj.exe 41 PID 1708 wrote to memory of 2428 1708 jvddj.exe 41 PID 1708 wrote to memory of 2428 1708 jvddj.exe 41 PID 1708 wrote to memory of 2428 1708 jvddj.exe 41 PID 2428 wrote to memory of 1600 2428 xxrfxlf.exe 42 PID 2428 wrote to memory of 1600 2428 xxrfxlf.exe 42 PID 2428 wrote to memory of 1600 2428 xxrfxlf.exe 42 PID 2428 wrote to memory of 1600 2428 xxrfxlf.exe 42 PID 1600 wrote to memory of 2668 1600 bttttt.exe 43 PID 1600 wrote to memory of 2668 1600 bttttt.exe 43 PID 1600 wrote to memory of 2668 1600 bttttt.exe 43 PID 1600 wrote to memory of 2668 1600 bttttt.exe 43 PID 2668 wrote to memory of 2828 2668 hhbhtt.exe 44 PID 2668 wrote to memory of 2828 2668 hhbhtt.exe 44 PID 2668 wrote to memory of 2828 2668 hhbhtt.exe 44 PID 2668 wrote to memory of 2828 2668 hhbhtt.exe 44 PID 2828 wrote to memory of 2024 2828 nthttt.exe 45 PID 2828 wrote to memory of 2024 2828 nthttt.exe 45 PID 2828 wrote to memory of 2024 2828 nthttt.exe 45 PID 2828 wrote to memory of 2024 2828 nthttt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe"C:\Users\Admin\AppData\Local\Temp\67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\1xlrrrr.exec:\1xlrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\btbbhb.exec:\btbbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\vpppd.exec:\vpppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\9rfflfl.exec:\9rfflfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\bnttbb.exec:\bnttbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\vpjdd.exec:\vpjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\pdjvv.exec:\pdjvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\llllflx.exec:\llllflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bbnhnn.exec:\bbnhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\1dppd.exec:\1dppd.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\jvddj.exec:\jvddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\xxrfxlf.exec:\xxrfxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\bttttt.exec:\bttttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\hhbhtt.exec:\hhbhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nthttt.exec:\nthttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\9djpj.exec:\9djpj.exe17⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lxxlxfl.exec:\lxxlxfl.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\nhhhnn.exec:\nhhhnn.exe19⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3thhtt.exec:\3thhtt.exe20⤵
- Executes dropped EXE
PID:2444 -
\??\c:\djvjj.exec:\djvjj.exe21⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lxffllx.exec:\lxffllx.exe22⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rxlxxxf.exec:\rxlxxxf.exe23⤵
- Executes dropped EXE
PID:1772 -
\??\c:\hbhntb.exec:\hbhntb.exe24⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5vjpv.exec:\5vjpv.exe25⤵
- Executes dropped EXE
PID:1252 -
\??\c:\vdjdd.exec:\vdjdd.exe26⤵
- Executes dropped EXE
PID:484 -
\??\c:\3flfxxr.exec:\3flfxxr.exe27⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3xrfrll.exec:\3xrfrll.exe28⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nbhbbt.exec:\nbhbbt.exe29⤵
- Executes dropped EXE
PID:1360 -
\??\c:\nbttbb.exec:\nbttbb.exe30⤵
- Executes dropped EXE
PID:896 -
\??\c:\3dpvj.exec:\3dpvj.exe31⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fxfffff.exec:\fxfffff.exe32⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xlxrllr.exec:\xlxrllr.exe33⤵
- Executes dropped EXE
PID:2404 -
\??\c:\5frrffl.exec:\5frrffl.exe34⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nbhhhh.exec:\nbhhhh.exe35⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vjppp.exec:\vjppp.exe36⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vjvpp.exec:\vjvpp.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xllffxf.exec:\xllffxf.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xrrrrrx.exec:\xrrrrrx.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5bhbtn.exec:\5bhbtn.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3ddvp.exec:\3ddvp.exe41⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dvpvd.exec:\dvpvd.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lxxllfl.exec:\lxxllfl.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3frrxxl.exec:\3frrxxl.exe44⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ttnbnt.exec:\ttnbnt.exe45⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nhtbhh.exec:\nhtbhh.exe46⤵
- Executes dropped EXE
PID:2504 -
\??\c:\1jpvv.exec:\1jpvv.exe47⤵
- Executes dropped EXE
PID:1092 -
\??\c:\pdvjj.exec:\pdvjj.exe48⤵
- Executes dropped EXE
PID:2976 -
\??\c:\fxfflfl.exec:\fxfflfl.exe49⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xrrxflr.exec:\xrrxflr.exe50⤵
- Executes dropped EXE
PID:2784 -
\??\c:\5hnnnh.exec:\5hnnnh.exe51⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9vppv.exec:\9vppv.exe52⤵
- Executes dropped EXE
PID:1528 -
\??\c:\ddvdj.exec:\ddvdj.exe53⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7dppj.exec:\7dppj.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ffllflx.exec:\ffllflx.exe55⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xxllfrr.exec:\xxllfrr.exe56⤵
- Executes dropped EXE
PID:2988 -
\??\c:\thtnnn.exec:\thtnnn.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nbhnnh.exec:\nbhnnh.exe58⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jvjjj.exec:\jvjjj.exe59⤵
- Executes dropped EXE
PID:1676 -
\??\c:\5pdvv.exec:\5pdvv.exe60⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xrlrrrf.exec:\xrlrrrf.exe61⤵
- Executes dropped EXE
PID:844 -
\??\c:\tttthb.exec:\tttthb.exe62⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hbntth.exec:\hbntth.exe63⤵
- Executes dropped EXE
PID:1216 -
\??\c:\5vppv.exec:\5vppv.exe64⤵
- Executes dropped EXE
PID:1260 -
\??\c:\9dvjj.exec:\9dvjj.exe65⤵
- Executes dropped EXE
PID:484 -
\??\c:\9jdpv.exec:\9jdpv.exe66⤵PID:2284
-
\??\c:\lffxlrx.exec:\lffxlrx.exe67⤵PID:1872
-
\??\c:\rlrflxl.exec:\rlrflxl.exe68⤵PID:2280
-
\??\c:\nnhnbb.exec:\nnhnbb.exe69⤵PID:2084
-
\??\c:\7tbtbt.exec:\7tbtbt.exe70⤵PID:896
-
\??\c:\pjpvd.exec:\pjpvd.exe71⤵PID:2544
-
\??\c:\fxllrxl.exec:\fxllrxl.exe72⤵PID:1588
-
\??\c:\rlfllfr.exec:\rlfllfr.exe73⤵PID:2448
-
\??\c:\hhbtht.exec:\hhbtht.exe74⤵PID:2360
-
\??\c:\5nhhbb.exec:\5nhhbb.exe75⤵PID:1964
-
\??\c:\3vpdp.exec:\3vpdp.exe76⤵PID:2188
-
\??\c:\pdjpp.exec:\pdjpp.exe77⤵PID:3040
-
\??\c:\1jjdd.exec:\1jjdd.exe78⤵PID:2708
-
\??\c:\fxrxlxx.exec:\fxrxlxx.exe79⤵PID:2888
-
\??\c:\nnthbh.exec:\nnthbh.exe80⤵PID:2900
-
\??\c:\bhbhth.exec:\bhbhth.exe81⤵PID:2884
-
\??\c:\dvddj.exec:\dvddj.exe82⤵PID:2904
-
\??\c:\dvddv.exec:\dvddv.exe83⤵PID:2600
-
\??\c:\rlxflrr.exec:\rlxflrr.exe84⤵PID:2664
-
\??\c:\5frlrrf.exec:\5frlrrf.exe85⤵PID:688
-
\??\c:\hhbntt.exec:\hhbntt.exe86⤵PID:2380
-
\??\c:\tntttt.exec:\tntttt.exe87⤵PID:2948
-
\??\c:\pjvvv.exec:\pjvvv.exe88⤵PID:1516
-
\??\c:\vvpvj.exec:\vvpvj.exe89⤵PID:1520
-
\??\c:\flrlfff.exec:\flrlfff.exe90⤵PID:1740
-
\??\c:\llrxlrf.exec:\llrxlrf.exe91⤵PID:2668
-
\??\c:\bthbnb.exec:\bthbnb.exe92⤵PID:908
-
\??\c:\thhtth.exec:\thhtth.exe93⤵PID:1868
-
\??\c:\pjpjp.exec:\pjpjp.exe94⤵PID:2996
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe95⤵PID:2940
-
\??\c:\fxllrxl.exec:\fxllrxl.exe96⤵PID:2164
-
\??\c:\hbnnbb.exec:\hbnnbb.exe97⤵PID:2476
-
\??\c:\hbttbh.exec:\hbttbh.exe98⤵PID:2528
-
\??\c:\3tnbtn.exec:\3tnbtn.exe99⤵PID:448
-
\??\c:\3jddv.exec:\3jddv.exe100⤵PID:2572
-
\??\c:\1djjj.exec:\1djjj.exe101⤵PID:1772
-
\??\c:\5rfrxfl.exec:\5rfrxfl.exe102⤵PID:1800
-
\??\c:\9frfxfr.exec:\9frfxfr.exe103⤵PID:1688
-
\??\c:\5thntn.exec:\5thntn.exe104⤵PID:3024
-
\??\c:\bnthbb.exec:\bnthbb.exe105⤵PID:2020
-
\??\c:\nhntnh.exec:\nhntnh.exe106⤵PID:1744
-
\??\c:\5jvjj.exec:\5jvjj.exe107⤵PID:1736
-
\??\c:\1vjjp.exec:\1vjjp.exe108⤵PID:1056
-
\??\c:\xrffllf.exec:\xrffllf.exe109⤵PID:2372
-
\??\c:\7xlxffl.exec:\7xlxffl.exe110⤵PID:2032
-
\??\c:\7xxflxf.exec:\7xxflxf.exe111⤵PID:1584
-
\??\c:\7nnbnt.exec:\7nnbnt.exe112⤵PID:2520
-
\??\c:\tnbnnn.exec:\tnbnnn.exe113⤵PID:2108
-
\??\c:\vpjdd.exec:\vpjdd.exe114⤵PID:2780
-
\??\c:\pjjpv.exec:\pjjpv.exe115⤵PID:1032
-
\??\c:\fxrxxxl.exec:\fxrxxxl.exe116⤵PID:1284
-
\??\c:\frffllr.exec:\frffllr.exe117⤵PID:2804
-
\??\c:\bthnbh.exec:\bthnbh.exe118⤵PID:2732
-
\??\c:\5bbbhh.exec:\5bbbhh.exe119⤵PID:2760
-
\??\c:\jdpvj.exec:\jdpvj.exe120⤵PID:2960
-
\??\c:\7djjv.exec:\7djjv.exe121⤵PID:2648
-
\??\c:\xrllrxf.exec:\xrllrxf.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-