Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
290d8882682856e0ab53cb12040f43e1b9949f0d1b52ec8233b5879b983882a0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
290d8882682856e0ab53cb12040f43e1b9949f0d1b52ec8233b5879b983882a0N.exe
-
Size
72KB
-
MD5
2826e08041a32b748525d9550fea8040
-
SHA1
d9456ce36d5a1221df7cdcda0bc34dad1ca1aa7d
-
SHA256
290d8882682856e0ab53cb12040f43e1b9949f0d1b52ec8233b5879b983882a0
-
SHA512
652317746491eea82db296e86c6cbd97812ff3e2695c3b5a856341fee6c02384b5cfa55c9e852c81e712c6acff54c2a7a61d73bfecf9f457b43b6ba70a0893d6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj8:ymb3NkkiQ3mdBjFI4Vs
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2416-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1408-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1720 dpvpd.exe 2096 lflrlxl.exe 2216 1bhbnh.exe 2824 btnnbb.exe 2720 dpdjd.exe 2728 fxxllff.exe 2304 bnbhbt.exe 2608 pjppp.exe 3044 dvppj.exe 840 frflllr.exe 760 3nnnbb.exe 1876 thtnnt.exe 2152 ddvdj.exe 1204 fxrrffl.exe 892 lxllxfl.exe 1940 nbtbhb.exe 1408 7nhnnt.exe 2920 5vjjj.exe 2312 5dpvj.exe 2128 ffxflxf.exe 1608 rfrrxrx.exe 2996 bntthb.exe 1660 tnthtb.exe 2188 pvdpj.exe 2708 llrxffr.exe 2220 lxllffl.exe 2076 tthbbt.exe 2476 jdvvd.exe 2344 vjdjp.exe 2040 lfxxrfr.exe 2080 xllxrfx.exe 3016 tbhhhn.exe 2180 7dvpd.exe 2332 jpjvj.exe 2824 7rflrxr.exe 2828 3rrxxff.exe 2888 bnttbh.exe 2868 3nhbhn.exe 2792 9vjpp.exe 2652 vvjvj.exe 2612 fxxfrfl.exe 2304 xrfrxfr.exe 1552 hbhhtn.exe 2240 nbnthn.exe 1988 vpjdp.exe 828 jvjpp.exe 760 rxlxxrx.exe 1336 frflfxl.exe 1644 3bhhtt.exe 276 hbhhbt.exe 1028 ddvdd.exe 1964 pjjdp.exe 1576 lxfxrrr.exe 1840 frrflfr.exe 2952 nhnnbt.exe 2112 tnnntt.exe 2232 pjvvp.exe 2128 dpddd.exe 1608 xxlrflf.exe 960 9lffrxl.exe 1780 rlrxfll.exe 2552 nhtbhh.exe 2036 thntbb.exe 2480 jjdvd.exe -
resource yara_rule behavioral1/memory/2416-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1408-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 1720 2416 290d8882682856e0ab53cb12040f43e1b9949f0d1b52ec8233b5879b983882a0N.exe 30 PID 2416 wrote to memory of 1720 2416 290d8882682856e0ab53cb12040f43e1b9949f0d1b52ec8233b5879b983882a0N.exe 30 PID 2416 wrote to memory of 1720 2416 290d8882682856e0ab53cb12040f43e1b9949f0d1b52ec8233b5879b983882a0N.exe 30 PID 2416 wrote to memory of 1720 2416 290d8882682856e0ab53cb12040f43e1b9949f0d1b52ec8233b5879b983882a0N.exe 30 PID 1720 wrote to memory of 2096 1720 dpvpd.exe 31 PID 1720 wrote to memory of 2096 1720 dpvpd.exe 31 PID 1720 wrote to memory of 2096 1720 dpvpd.exe 31 PID 1720 wrote to memory of 2096 1720 dpvpd.exe 31 PID 2096 wrote to memory of 2216 2096 lflrlxl.exe 32 PID 2096 wrote to memory of 2216 2096 lflrlxl.exe 32 PID 2096 wrote to memory of 2216 2096 lflrlxl.exe 32 PID 2096 wrote to memory of 2216 2096 lflrlxl.exe 32 PID 2216 wrote to memory of 2824 2216 1bhbnh.exe 33 PID 2216 wrote to memory of 2824 2216 1bhbnh.exe 33 PID 2216 wrote to memory of 2824 2216 1bhbnh.exe 33 PID 2216 wrote to memory of 2824 2216 1bhbnh.exe 33 PID 2824 wrote to memory of 2720 2824 btnnbb.exe 34 PID 2824 wrote to memory of 2720 2824 btnnbb.exe 34 PID 2824 wrote to memory of 2720 2824 btnnbb.exe 34 PID 2824 wrote to memory of 2720 2824 btnnbb.exe 34 PID 2720 wrote to memory of 2728 2720 dpdjd.exe 35 PID 2720 wrote to memory of 2728 2720 dpdjd.exe 35 PID 2720 wrote to memory of 2728 2720 dpdjd.exe 35 PID 2720 wrote to memory of 2728 2720 dpdjd.exe 35 PID 2728 wrote to memory of 2304 2728 fxxllff.exe 36 PID 2728 wrote to memory of 2304 2728 fxxllff.exe 36 PID 2728 wrote to memory of 2304 2728 fxxllff.exe 36 PID 2728 wrote to memory of 2304 2728 fxxllff.exe 36 PID 2304 wrote to memory of 2608 2304 bnbhbt.exe 37 PID 2304 wrote to memory of 2608 2304 bnbhbt.exe 37 PID 2304 wrote to memory of 2608 2304 bnbhbt.exe 37 PID 2304 wrote to memory of 2608 2304 bnbhbt.exe 37 PID 2608 wrote to memory of 3044 2608 pjppp.exe 38 PID 2608 wrote to memory of 3044 2608 pjppp.exe 38 PID 2608 wrote to memory of 3044 2608 pjppp.exe 38 PID 2608 wrote to memory of 3044 2608 pjppp.exe 38 PID 3044 wrote to memory of 840 3044 dvppj.exe 39 PID 3044 wrote to memory of 840 3044 dvppj.exe 39 PID 3044 wrote to memory of 840 3044 dvppj.exe 39 PID 3044 wrote to memory of 840 3044 dvppj.exe 39 PID 840 wrote to memory of 760 840 frflllr.exe 40 PID 840 wrote to memory of 760 840 frflllr.exe 40 PID 840 wrote to memory of 760 840 frflllr.exe 40 PID 840 wrote to memory of 760 840 frflllr.exe 40 PID 760 wrote to memory of 1876 760 3nnnbb.exe 41 PID 760 wrote to memory of 1876 760 3nnnbb.exe 41 PID 760 wrote to memory of 1876 760 3nnnbb.exe 41 PID 760 wrote to memory of 1876 760 3nnnbb.exe 41 PID 1876 wrote to memory of 2152 1876 thtnnt.exe 42 PID 1876 wrote to memory of 2152 1876 thtnnt.exe 42 PID 1876 wrote to memory of 2152 1876 thtnnt.exe 42 PID 1876 wrote to memory of 2152 1876 thtnnt.exe 42 PID 2152 wrote to memory of 1204 2152 ddvdj.exe 43 PID 2152 wrote to memory of 1204 2152 ddvdj.exe 43 PID 2152 wrote to memory of 1204 2152 ddvdj.exe 43 PID 2152 wrote to memory of 1204 2152 ddvdj.exe 43 PID 1204 wrote to memory of 892 1204 fxrrffl.exe 44 PID 1204 wrote to memory of 892 1204 fxrrffl.exe 44 PID 1204 wrote to memory of 892 1204 fxrrffl.exe 44 PID 1204 wrote to memory of 892 1204 fxrrffl.exe 44 PID 892 wrote to memory of 1940 892 lxllxfl.exe 45 PID 892 wrote to memory of 1940 892 lxllxfl.exe 45 PID 892 wrote to memory of 1940 892 lxllxfl.exe 45 PID 892 wrote to memory of 1940 892 lxllxfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\290d8882682856e0ab53cb12040f43e1b9949f0d1b52ec8233b5879b983882a0N.exe"C:\Users\Admin\AppData\Local\Temp\290d8882682856e0ab53cb12040f43e1b9949f0d1b52ec8233b5879b983882a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\dpvpd.exec:\dpvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\lflrlxl.exec:\lflrlxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\1bhbnh.exec:\1bhbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\btnnbb.exec:\btnnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\dpdjd.exec:\dpdjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\fxxllff.exec:\fxxllff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\bnbhbt.exec:\bnbhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\pjppp.exec:\pjppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\dvppj.exec:\dvppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\frflllr.exec:\frflllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\3nnnbb.exec:\3nnnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\thtnnt.exec:\thtnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\ddvdj.exec:\ddvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\fxrrffl.exec:\fxrrffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\lxllxfl.exec:\lxllxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\nbtbhb.exec:\nbtbhb.exe17⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7nhnnt.exec:\7nhnnt.exe18⤵
- Executes dropped EXE
PID:1408 -
\??\c:\5vjjj.exec:\5vjjj.exe19⤵
- Executes dropped EXE
PID:2920 -
\??\c:\5dpvj.exec:\5dpvj.exe20⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ffxflxf.exec:\ffxflxf.exe21⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rfrrxrx.exec:\rfrrxrx.exe22⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bntthb.exec:\bntthb.exe23⤵
- Executes dropped EXE
PID:2996 -
\??\c:\tnthtb.exec:\tnthtb.exe24⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pvdpj.exec:\pvdpj.exe25⤵
- Executes dropped EXE
PID:2188 -
\??\c:\llrxffr.exec:\llrxffr.exe26⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lxllffl.exec:\lxllffl.exe27⤵
- Executes dropped EXE
PID:2220 -
\??\c:\tthbbt.exec:\tthbbt.exe28⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jdvvd.exec:\jdvvd.exe29⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vjdjp.exec:\vjdjp.exe30⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lfxxrfr.exec:\lfxxrfr.exe31⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xllxrfx.exec:\xllxrfx.exe32⤵
- Executes dropped EXE
PID:2080 -
\??\c:\tbhhhn.exec:\tbhhhn.exe33⤵
- Executes dropped EXE
PID:3016 -
\??\c:\7dvpd.exec:\7dvpd.exe34⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jpjvj.exec:\jpjvj.exe35⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7rflrxr.exec:\7rflrxr.exe36⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3rrxxff.exec:\3rrxxff.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bnttbh.exec:\bnttbh.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\3nhbhn.exec:\3nhbhn.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9vjpp.exec:\9vjpp.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vvjvj.exec:\vvjvj.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\fxxfrfl.exec:\fxxfrfl.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xrfrxfr.exec:\xrfrxfr.exe43⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hbhhtn.exec:\hbhhtn.exe44⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nbnthn.exec:\nbnthn.exe45⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vpjdp.exec:\vpjdp.exe46⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jvjpp.exec:\jvjpp.exe47⤵
- Executes dropped EXE
PID:828 -
\??\c:\rxlxxrx.exec:\rxlxxrx.exe48⤵
- Executes dropped EXE
PID:760 -
\??\c:\frflfxl.exec:\frflfxl.exe49⤵
- Executes dropped EXE
PID:1336 -
\??\c:\3bhhtt.exec:\3bhhtt.exe50⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hbhhbt.exec:\hbhhbt.exe51⤵
- Executes dropped EXE
PID:276 -
\??\c:\ddvdd.exec:\ddvdd.exe52⤵
- Executes dropped EXE
PID:1028 -
\??\c:\pjjdp.exec:\pjjdp.exe53⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe54⤵
- Executes dropped EXE
PID:1576 -
\??\c:\frrflfr.exec:\frrflfr.exe55⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nhnnbt.exec:\nhnnbt.exe56⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tnnntt.exec:\tnnntt.exe57⤵
- Executes dropped EXE
PID:2112 -
\??\c:\pjvvp.exec:\pjvvp.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\dpddd.exec:\dpddd.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xxlrflf.exec:\xxlrflf.exe60⤵
- Executes dropped EXE
PID:1608 -
\??\c:\9lffrxl.exec:\9lffrxl.exe61⤵
- Executes dropped EXE
PID:960 -
\??\c:\rlrxfll.exec:\rlrxfll.exe62⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nhtbhh.exec:\nhtbhh.exe63⤵
- Executes dropped EXE
PID:2552 -
\??\c:\thntbb.exec:\thntbb.exe64⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jjdvd.exec:\jjdvd.exe65⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pjvjv.exec:\pjvjv.exe66⤵PID:2940
-
\??\c:\jjpjj.exec:\jjpjj.exe67⤵PID:2460
-
\??\c:\9fxxxfl.exec:\9fxxxfl.exe68⤵PID:1776
-
\??\c:\rlrfxrr.exec:\rlrfxrr.exe69⤵PID:880
-
\??\c:\bbthnb.exec:\bbthnb.exe70⤵PID:2344
-
\??\c:\1nhttb.exec:\1nhttb.exe71⤵PID:2068
-
\??\c:\nthnhn.exec:\nthnhn.exe72⤵PID:576
-
\??\c:\jppjd.exec:\jppjd.exe73⤵PID:2136
-
\??\c:\jjpdp.exec:\jjpdp.exe74⤵PID:2140
-
\??\c:\3ffxlrr.exec:\3ffxlrr.exe75⤵PID:2740
-
\??\c:\lflrlrf.exec:\lflrlrf.exe76⤵PID:1632
-
\??\c:\bbhthh.exec:\bbhthh.exe77⤵PID:2876
-
\??\c:\nnbntt.exec:\nnbntt.exe78⤵PID:2760
-
\??\c:\5vvdd.exec:\5vvdd.exe79⤵PID:2908
-
\??\c:\pjvdp.exec:\pjvdp.exe80⤵PID:2700
-
\??\c:\frflxfl.exec:\frflxfl.exe81⤵PID:2728
-
\??\c:\fxrrfxf.exec:\fxrrfxf.exe82⤵PID:2616
-
\??\c:\3lxfrxx.exec:\3lxfrxx.exe83⤵PID:2684
-
\??\c:\nbhnbh.exec:\nbhnbh.exe84⤵PID:2248
-
\??\c:\nhbtbh.exec:\nhbtbh.exe85⤵PID:3052
-
\??\c:\5ddjj.exec:\5ddjj.exe86⤵PID:1916
-
\??\c:\3dvdp.exec:\3dvdp.exe87⤵PID:632
-
\??\c:\fxflrxl.exec:\fxflrxl.exe88⤵PID:1652
-
\??\c:\flxrrff.exec:\flxrrff.exe89⤵PID:1176
-
\??\c:\tnhnhn.exec:\tnhnhn.exe90⤵PID:2012
-
\??\c:\5hbthh.exec:\5hbthh.exe91⤵PID:1016
-
\??\c:\nnbnhh.exec:\nnbnhh.exe92⤵PID:2672
-
\??\c:\vvpjp.exec:\vvpjp.exe93⤵PID:1604
-
\??\c:\1flxxlf.exec:\1flxxlf.exe94⤵PID:2932
-
\??\c:\1frxfff.exec:\1frxfff.exe95⤵PID:2848
-
\??\c:\1thhnn.exec:\1thhnn.exe96⤵PID:2084
-
\??\c:\tntbbh.exec:\tntbbh.exe97⤵PID:2284
-
\??\c:\pjjdp.exec:\pjjdp.exe98⤵PID:2596
-
\??\c:\dvdjp.exec:\dvdjp.exe99⤵PID:2988
-
\??\c:\1flrxxf.exec:\1flrxxf.exe100⤵PID:444
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe101⤵PID:1528
-
\??\c:\7thtbb.exec:\7thtbb.exe102⤵PID:1416
-
\??\c:\nnhtnn.exec:\nnhtnn.exe103⤵PID:2020
-
\??\c:\dvppd.exec:\dvppd.exe104⤵PID:2432
-
\??\c:\xrffllr.exec:\xrffllr.exe105⤵PID:1996
-
\??\c:\xxxfxfr.exec:\xxxfxfr.exe106⤵PID:2212
-
\??\c:\1rxfllr.exec:\1rxfllr.exe107⤵PID:1760
-
\??\c:\5hhnbb.exec:\5hhnbb.exe108⤵PID:1976
-
\??\c:\1hhnht.exec:\1hhnht.exe109⤵PID:3004
-
\??\c:\jdvpv.exec:\jdvpv.exe110⤵PID:1872
-
\??\c:\vppdd.exec:\vppdd.exe111⤵PID:2356
-
\??\c:\7llxffl.exec:\7llxffl.exe112⤵PID:2408
-
\??\c:\fflrlrf.exec:\fflrlrf.exe113⤵PID:2052
-
\??\c:\7hhnhn.exec:\7hhnhn.exe114⤵PID:2180
-
\??\c:\tntnnn.exec:\tntnnn.exe115⤵PID:2332
-
\??\c:\vpjvv.exec:\vpjvv.exe116⤵PID:2824
-
\??\c:\vpddj.exec:\vpddj.exe117⤵PID:2860
-
\??\c:\1xlrxxr.exec:\1xlrxxr.exe118⤵PID:2620
-
\??\c:\ffxrxlr.exec:\ffxrxlr.exe119⤵PID:2720
-
\??\c:\1hnnnh.exec:\1hnnnh.exe120⤵PID:3036
-
\??\c:\hbbhtb.exec:\hbbhtb.exe121⤵PID:2832
-
\??\c:\vpvvd.exec:\vpvvd.exe122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-