Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30-09-2024 21:32
Static task
static1
Behavioral task
behavioral1
Sample
4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe
Resource
win7-20240708-en
General
-
Target
4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe
-
Size
82KB
-
MD5
cad9e2ef30454c6c517c644bc66b4890
-
SHA1
3ab06317d32cf3b122548bc0c4cf5f1486c7417c
-
SHA256
4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432
-
SHA512
744b68fcd5ee17512e9f2fc6dacdc766c058dda6657b63f023dfdcd493b82eedd168943033166a9fcf8909b90bf4f35d134f9d7d95f4b4c85cb958c2cc3a1de3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QIj:ymb3NkkiQ3mdBjFIIp9L9QrrA8rj
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2272-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1168-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/996-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/620-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-5405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1604 lfrrllr.exe 1396 9btnnt.exe 2316 jvjdj.exe 2780 lfrxxfl.exe 2792 9thbhb.exe 2820 pdddj.exe 2804 xxllllr.exe 2624 lfflxxf.exe 2460 htbtbb.exe 1448 jvjpd.exe 1976 xrfrxfl.exe 376 frlxlrr.exe 592 hbnnnn.exe 320 hbthnt.exe 2044 vvjpd.exe 1592 7dpdp.exe 2840 rflffxf.exe 2248 tnbbhn.exe 2256 htbbhh.exe 2236 3jddp.exe 1168 dvddj.exe 840 1xxlxlf.exe 996 lrxflrx.exe 1652 hbhntn.exe 620 pdvjv.exe 2120 lfxffff.exe 880 frxxrxx.exe 1908 hbhhnn.exe 2076 ddjpd.exe 1116 5dddd.exe 1764 xlrrrrr.exe 2452 7bttth.exe 2660 nnhhbh.exe 2760 jddjj.exe 2748 vjvvv.exe 2776 rllrxxl.exe 2200 tnhhnh.exe 2728 htnnhh.exe 2852 3vpjj.exe 2604 vpddj.exe 2984 xlxxlfr.exe 2628 xllffxx.exe 496 hnhtbn.exe 1980 bhnhhb.exe 1744 pjddp.exe 2360 nbntbb.exe 1888 1thbbb.exe 1688 pjdpp.exe 2472 djjdp.exe 1952 xrlflrr.exe 2044 rflfxxl.exe 1520 htbhbh.exe 968 hthnnh.exe 2084 vjvvp.exe 2588 vpppp.exe 2504 rflllfr.exe 2532 lxrxllr.exe 1012 bbtnhn.exe 1176 5tnttt.exe 1192 vpppv.exe 1772 pdpvd.exe 572 fxrrrxl.exe 2424 5fflflr.exe 2032 9bbhtt.exe -
resource yara_rule behavioral1/memory/2272-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/376-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1168-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/996-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/620-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-5405-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfflrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2272 wrote to memory of 1604 2272 4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe 31 PID 2272 wrote to memory of 1604 2272 4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe 31 PID 2272 wrote to memory of 1604 2272 4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe 31 PID 2272 wrote to memory of 1604 2272 4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe 31 PID 1604 wrote to memory of 1396 1604 lfrrllr.exe 32 PID 1604 wrote to memory of 1396 1604 lfrrllr.exe 32 PID 1604 wrote to memory of 1396 1604 lfrrllr.exe 32 PID 1604 wrote to memory of 1396 1604 lfrrllr.exe 32 PID 1396 wrote to memory of 2316 1396 9btnnt.exe 33 PID 1396 wrote to memory of 2316 1396 9btnnt.exe 33 PID 1396 wrote to memory of 2316 1396 9btnnt.exe 33 PID 1396 wrote to memory of 2316 1396 9btnnt.exe 33 PID 2316 wrote to memory of 2780 2316 jvjdj.exe 34 PID 2316 wrote to memory of 2780 2316 jvjdj.exe 34 PID 2316 wrote to memory of 2780 2316 jvjdj.exe 34 PID 2316 wrote to memory of 2780 2316 jvjdj.exe 34 PID 2780 wrote to memory of 2792 2780 lfrxxfl.exe 35 PID 2780 wrote to memory of 2792 2780 lfrxxfl.exe 35 PID 2780 wrote to memory of 2792 2780 lfrxxfl.exe 35 PID 2780 wrote to memory of 2792 2780 lfrxxfl.exe 35 PID 2792 wrote to memory of 2820 2792 9thbhb.exe 36 PID 2792 wrote to memory of 2820 2792 9thbhb.exe 36 PID 2792 wrote to memory of 2820 2792 9thbhb.exe 36 PID 2792 wrote to memory of 2820 2792 9thbhb.exe 36 PID 2820 wrote to memory of 2804 2820 pdddj.exe 37 PID 2820 wrote to memory of 2804 2820 pdddj.exe 37 PID 2820 wrote to memory of 2804 2820 pdddj.exe 37 PID 2820 wrote to memory of 2804 2820 pdddj.exe 37 PID 2804 wrote to memory of 2624 2804 xxllllr.exe 38 PID 2804 wrote to memory of 2624 2804 xxllllr.exe 38 PID 2804 wrote to memory of 2624 2804 xxllllr.exe 38 PID 2804 wrote to memory of 2624 2804 xxllllr.exe 38 PID 2624 wrote to memory of 2460 2624 lfflxxf.exe 39 PID 2624 wrote to memory of 2460 2624 lfflxxf.exe 39 PID 2624 wrote to memory of 2460 2624 lfflxxf.exe 39 PID 2624 wrote to memory of 2460 2624 lfflxxf.exe 39 PID 2460 wrote to memory of 1448 2460 htbtbb.exe 40 PID 2460 wrote to memory of 1448 2460 htbtbb.exe 40 PID 2460 wrote to memory of 1448 2460 htbtbb.exe 40 PID 2460 wrote to memory of 1448 2460 htbtbb.exe 40 PID 1448 wrote to memory of 1976 1448 jvjpd.exe 41 PID 1448 wrote to memory of 1976 1448 jvjpd.exe 41 PID 1448 wrote to memory of 1976 1448 jvjpd.exe 41 PID 1448 wrote to memory of 1976 1448 jvjpd.exe 41 PID 1976 wrote to memory of 376 1976 xrfrxfl.exe 42 PID 1976 wrote to memory of 376 1976 xrfrxfl.exe 42 PID 1976 wrote to memory of 376 1976 xrfrxfl.exe 42 PID 1976 wrote to memory of 376 1976 xrfrxfl.exe 42 PID 376 wrote to memory of 592 376 frlxlrr.exe 43 PID 376 wrote to memory of 592 376 frlxlrr.exe 43 PID 376 wrote to memory of 592 376 frlxlrr.exe 43 PID 376 wrote to memory of 592 376 frlxlrr.exe 43 PID 592 wrote to memory of 320 592 hbnnnn.exe 44 PID 592 wrote to memory of 320 592 hbnnnn.exe 44 PID 592 wrote to memory of 320 592 hbnnnn.exe 44 PID 592 wrote to memory of 320 592 hbnnnn.exe 44 PID 320 wrote to memory of 2044 320 hbthnt.exe 45 PID 320 wrote to memory of 2044 320 hbthnt.exe 45 PID 320 wrote to memory of 2044 320 hbthnt.exe 45 PID 320 wrote to memory of 2044 320 hbthnt.exe 45 PID 2044 wrote to memory of 1592 2044 vvjpd.exe 46 PID 2044 wrote to memory of 1592 2044 vvjpd.exe 46 PID 2044 wrote to memory of 1592 2044 vvjpd.exe 46 PID 2044 wrote to memory of 1592 2044 vvjpd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe"C:\Users\Admin\AppData\Local\Temp\4e26f38bbbf091fe002f258be4d65e670929c15fc6dd485be7bbb5c5727d2432N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\lfrrllr.exec:\lfrrllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\9btnnt.exec:\9btnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\jvjdj.exec:\jvjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\lfrxxfl.exec:\lfrxxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\9thbhb.exec:\9thbhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pdddj.exec:\pdddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\xxllllr.exec:\xxllllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\lfflxxf.exec:\lfflxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\htbtbb.exec:\htbtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\jvjpd.exec:\jvjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\frlxlrr.exec:\frlxlrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\hbnnnn.exec:\hbnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\hbthnt.exec:\hbthnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\vvjpd.exec:\vvjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\7dpdp.exec:\7dpdp.exe17⤵
- Executes dropped EXE
PID:1592 -
\??\c:\rflffxf.exec:\rflffxf.exe18⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tnbbhn.exec:\tnbbhn.exe19⤵
- Executes dropped EXE
PID:2248 -
\??\c:\htbbhh.exec:\htbbhh.exe20⤵
- Executes dropped EXE
PID:2256 -
\??\c:\3jddp.exec:\3jddp.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\dvddj.exec:\dvddj.exe22⤵
- Executes dropped EXE
PID:1168 -
\??\c:\1xxlxlf.exec:\1xxlxlf.exe23⤵
- Executes dropped EXE
PID:840 -
\??\c:\lrxflrx.exec:\lrxflrx.exe24⤵
- Executes dropped EXE
PID:996 -
\??\c:\hbhntn.exec:\hbhntn.exe25⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pdvjv.exec:\pdvjv.exe26⤵
- Executes dropped EXE
PID:620 -
\??\c:\lfxffff.exec:\lfxffff.exe27⤵
- Executes dropped EXE
PID:2120 -
\??\c:\frxxrxx.exec:\frxxrxx.exe28⤵
- Executes dropped EXE
PID:880 -
\??\c:\hbhhnn.exec:\hbhhnn.exe29⤵
- Executes dropped EXE
PID:1908 -
\??\c:\ddjpd.exec:\ddjpd.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5dddd.exec:\5dddd.exe31⤵
- Executes dropped EXE
PID:1116 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe32⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7bttth.exec:\7bttth.exe33⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nnhhbh.exec:\nnhhbh.exe34⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jddjj.exec:\jddjj.exe35⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vjvvv.exec:\vjvvv.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rllrxxl.exec:\rllrxxl.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tnhhnh.exec:\tnhhnh.exe38⤵
- Executes dropped EXE
PID:2200 -
\??\c:\htnnhh.exec:\htnnhh.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3vpjj.exec:\3vpjj.exe40⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vpddj.exec:\vpddj.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xlxxlfr.exec:\xlxxlfr.exe42⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xllffxx.exec:\xllffxx.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hnhtbn.exec:\hnhtbn.exe44⤵
- Executes dropped EXE
PID:496 -
\??\c:\bhnhhb.exec:\bhnhhb.exe45⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pjddp.exec:\pjddp.exe46⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nbntbb.exec:\nbntbb.exe47⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1thbbb.exec:\1thbbb.exe48⤵
- Executes dropped EXE
PID:1888 -
\??\c:\pjdpp.exec:\pjdpp.exe49⤵
- Executes dropped EXE
PID:1688 -
\??\c:\djjdp.exec:\djjdp.exe50⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xrlflrr.exec:\xrlflrr.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rflfxxl.exec:\rflfxxl.exe52⤵
- Executes dropped EXE
PID:2044 -
\??\c:\htbhbh.exec:\htbhbh.exe53⤵
- Executes dropped EXE
PID:1520 -
\??\c:\hthnnh.exec:\hthnnh.exe54⤵
- Executes dropped EXE
PID:968 -
\??\c:\vjvvp.exec:\vjvvp.exe55⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vpppp.exec:\vpppp.exe56⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rflllfr.exec:\rflllfr.exe57⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lxrxllr.exec:\lxrxllr.exe58⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bbtnhn.exec:\bbtnhn.exe59⤵
- Executes dropped EXE
PID:1012 -
\??\c:\5tnttt.exec:\5tnttt.exe60⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vpppv.exec:\vpppv.exe61⤵
- Executes dropped EXE
PID:1192 -
\??\c:\pdpvd.exec:\pdpvd.exe62⤵
- Executes dropped EXE
PID:1772 -
\??\c:\fxrrrxl.exec:\fxrrrxl.exe63⤵
- Executes dropped EXE
PID:572 -
\??\c:\5fflflr.exec:\5fflflr.exe64⤵
- Executes dropped EXE
PID:2424 -
\??\c:\9bbhtt.exec:\9bbhtt.exe65⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5nhnhb.exec:\5nhnhb.exe66⤵PID:2516
-
\??\c:\jvjdj.exec:\jvjdj.exe67⤵PID:3012
-
\??\c:\9vvpd.exec:\9vvpd.exe68⤵PID:1872
-
\??\c:\frrfllr.exec:\frrfllr.exe69⤵PID:2272
-
\??\c:\hbnbth.exec:\hbnbth.exe70⤵PID:2192
-
\??\c:\tnbhnn.exec:\tnbhnn.exe71⤵PID:1536
-
\??\c:\vvdjd.exec:\vvdjd.exe72⤵PID:2172
-
\??\c:\djvpj.exec:\djvpj.exe73⤵PID:2656
-
\??\c:\frfflrx.exec:\frfflrx.exe74⤵PID:2784
-
\??\c:\btnhnh.exec:\btnhnh.exe75⤵PID:2676
-
\??\c:\hbtnbb.exec:\hbtnbb.exe76⤵PID:2732
-
\??\c:\9jvpj.exec:\9jvpj.exe77⤵PID:2572
-
\??\c:\dpdvd.exec:\dpdvd.exe78⤵PID:2724
-
\??\c:\9rlrxlr.exec:\9rlrxlr.exe79⤵PID:2544
-
\??\c:\llxrrlr.exec:\llxrrlr.exe80⤵PID:2804
-
\??\c:\tnnnnt.exec:\tnnnnt.exe81⤵PID:2808
-
\??\c:\9hbbtb.exec:\9hbbtb.exe82⤵PID:1540
-
\??\c:\vddjp.exec:\vddjp.exe83⤵PID:1268
-
\??\c:\dvjjd.exec:\dvjjd.exe84⤵PID:1600
-
\??\c:\7lfffll.exec:\7lfffll.exe85⤵PID:1612
-
\??\c:\xxfxrlr.exec:\xxfxrlr.exe86⤵PID:2520
-
\??\c:\lxflxfr.exec:\lxflxfr.exe87⤵PID:648
-
\??\c:\1btnbt.exec:\1btnbt.exe88⤵PID:592
-
\??\c:\nhttbb.exec:\nhttbb.exe89⤵PID:2036
-
\??\c:\jvdpp.exec:\jvdpp.exe90⤵PID:1712
-
\??\c:\pdvvv.exec:\pdvvv.exe91⤵PID:2620
-
\??\c:\9pjjj.exec:\9pjjj.exe92⤵PID:2612
-
\??\c:\lxxfrxr.exec:\lxxfrxr.exe93⤵PID:1704
-
\??\c:\xxlrrxl.exec:\xxlrrxl.exe94⤵PID:2196
-
\??\c:\nbthhh.exec:\nbthhh.exe95⤵PID:2964
-
\??\c:\tnbbbt.exec:\tnbbbt.exe96⤵PID:2528
-
\??\c:\vpvdd.exec:\vpvdd.exe97⤵PID:2640
-
\??\c:\vjvvd.exec:\vjvvd.exe98⤵PID:1932
-
\??\c:\3llffxf.exec:\3llffxf.exe99⤵PID:2396
-
\??\c:\rxlrxxx.exec:\rxlrxxx.exe100⤵PID:1000
-
\??\c:\3bbbbb.exec:\3bbbbb.exe101⤵PID:2464
-
\??\c:\tnbbbh.exec:\tnbbbh.exe102⤵PID:1468
-
\??\c:\pdjvj.exec:\pdjvj.exe103⤵PID:1504
-
\??\c:\7dddd.exec:\7dddd.exe104⤵PID:2120
-
\??\c:\lxlrxrf.exec:\lxlrxrf.exe105⤵PID:2976
-
\??\c:\xfrxfrl.exec:\xfrxfrl.exe106⤵PID:1584
-
\??\c:\nbhhbh.exec:\nbhhbh.exe107⤵PID:2116
-
\??\c:\5tnhhn.exec:\5tnhhn.exe108⤵PID:1036
-
\??\c:\nhthhn.exec:\nhthhn.exe109⤵PID:1676
-
\??\c:\pvjjj.exec:\pvjjj.exe110⤵PID:2332
-
\??\c:\1dvpp.exec:\1dvpp.exe111⤵PID:3060
-
\??\c:\xlxrxlf.exec:\xlxrxlf.exe112⤵PID:2108
-
\??\c:\xlrxlff.exec:\xlrxlff.exe113⤵PID:2760
-
\??\c:\3btbnt.exec:\3btbnt.exe114⤵PID:2748
-
\??\c:\bhthnt.exec:\bhthnt.exe115⤵PID:2428
-
\??\c:\pjddj.exec:\pjddj.exe116⤵PID:2668
-
\??\c:\jpvpp.exec:\jpvpp.exe117⤵PID:3032
-
\??\c:\xrfllll.exec:\xrfllll.exe118⤵PID:2468
-
\??\c:\7rlrlxf.exec:\7rlrlxf.exe119⤵PID:2600
-
\??\c:\hbbhhh.exec:\hbbhhh.exe120⤵PID:1664
-
\??\c:\1hbbbb.exec:\1hbbbb.exe121⤵PID:264
-
\??\c:\jdjpd.exec:\jdjpd.exe122⤵PID:1512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-