Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe
-
Size
67KB
-
MD5
8f5fb2f2a612d6da00c99116d1233d20
-
SHA1
1466354ad79d4c1920cc770b5c36b5353e512b27
-
SHA256
2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720
-
SHA512
98793ebe279c89cc1ad9630fe896dcf457f8b21eb625b5e57be8362d4581030e20523f00041278ac89c48b433e46517e4080c8f2697cc77bc5694ee0f14f903d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfs:ymb3NkkiQ3mdBjFI9cqfs
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2660-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/696-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2748 llxfrxr.exe 2976 tthhtt.exe 2972 bthbhn.exe 2580 vpvdp.exe 2608 rlllxxl.exe 2628 xrffrlx.exe 2060 9bbnbb.exe 2032 jjjpj.exe 2172 nnhhnb.exe 1696 pjvdp.exe 676 dvjpp.exe 2540 9lrflrx.exe 2328 3xxlllx.exe 1200 hbnhth.exe 2372 jvjvp.exe 696 vpddp.exe 592 frffffl.exe 2080 1ttnhn.exe 2204 1nthnn.exe 2004 jdppd.exe 3036 5vpvv.exe 692 llflxlx.exe 1656 frllllr.exe 2912 thbnht.exe 556 3bbnbh.exe 564 ddjpp.exe 2216 7ddjj.exe 1496 rlrlrfr.exe 1788 xffflxr.exe 1072 hhtthb.exe 2828 3btbhn.exe 2696 jjdjv.exe 2832 fxrrfrx.exe 2716 lxlxlrf.exe 2776 btnbtb.exe 1620 tthbbn.exe 2720 1dpjv.exe 3068 1dvvv.exe 1420 pdppv.exe 1592 xxlrflr.exe 1904 xlxlrff.exe 2764 tnhhtt.exe 2984 hbnbbh.exe 2652 jdpvp.exe 584 3vpdp.exe 1492 7rrrlrx.exe 2540 fxlrflr.exe 1960 xxlrxfx.exe 1172 hhbnbh.exe 2132 hbthnt.exe 2516 vpdpv.exe 264 vjddj.exe 1888 frllxfr.exe 2260 llrlllx.exe 2196 3hhhhb.exe 2204 7ttnnn.exe 2348 dpddd.exe 2968 dvjpv.exe 780 jdjjp.exe 2508 llflfxf.exe 348 lfxffrf.exe 1436 tnbtbb.exe 3016 9nhnnn.exe 1284 jvjpv.exe -
resource yara_rule behavioral1/memory/2660-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/696-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-293-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2748 2660 2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe 30 PID 2660 wrote to memory of 2748 2660 2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe 30 PID 2660 wrote to memory of 2748 2660 2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe 30 PID 2660 wrote to memory of 2748 2660 2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe 30 PID 2748 wrote to memory of 2976 2748 llxfrxr.exe 31 PID 2748 wrote to memory of 2976 2748 llxfrxr.exe 31 PID 2748 wrote to memory of 2976 2748 llxfrxr.exe 31 PID 2748 wrote to memory of 2976 2748 llxfrxr.exe 31 PID 2976 wrote to memory of 2972 2976 tthhtt.exe 32 PID 2976 wrote to memory of 2972 2976 tthhtt.exe 32 PID 2976 wrote to memory of 2972 2976 tthhtt.exe 32 PID 2976 wrote to memory of 2972 2976 tthhtt.exe 32 PID 2972 wrote to memory of 2580 2972 bthbhn.exe 33 PID 2972 wrote to memory of 2580 2972 bthbhn.exe 33 PID 2972 wrote to memory of 2580 2972 bthbhn.exe 33 PID 2972 wrote to memory of 2580 2972 bthbhn.exe 33 PID 2580 wrote to memory of 2608 2580 vpvdp.exe 34 PID 2580 wrote to memory of 2608 2580 vpvdp.exe 34 PID 2580 wrote to memory of 2608 2580 vpvdp.exe 34 PID 2580 wrote to memory of 2608 2580 vpvdp.exe 34 PID 2608 wrote to memory of 2628 2608 rlllxxl.exe 35 PID 2608 wrote to memory of 2628 2608 rlllxxl.exe 35 PID 2608 wrote to memory of 2628 2608 rlllxxl.exe 35 PID 2608 wrote to memory of 2628 2608 rlllxxl.exe 35 PID 2628 wrote to memory of 2060 2628 xrffrlx.exe 36 PID 2628 wrote to memory of 2060 2628 xrffrlx.exe 36 PID 2628 wrote to memory of 2060 2628 xrffrlx.exe 36 PID 2628 wrote to memory of 2060 2628 xrffrlx.exe 36 PID 2060 wrote to memory of 2032 2060 9bbnbb.exe 37 PID 2060 wrote to memory of 2032 2060 9bbnbb.exe 37 PID 2060 wrote to memory of 2032 2060 9bbnbb.exe 37 PID 2060 wrote to memory of 2032 2060 9bbnbb.exe 37 PID 2032 wrote to memory of 2172 2032 jjjpj.exe 38 PID 2032 wrote to memory of 2172 2032 jjjpj.exe 38 PID 2032 wrote to memory of 2172 2032 jjjpj.exe 38 PID 2032 wrote to memory of 2172 2032 jjjpj.exe 38 PID 2172 wrote to memory of 1696 2172 nnhhnb.exe 39 PID 2172 wrote to memory of 1696 2172 nnhhnb.exe 39 PID 2172 wrote to memory of 1696 2172 nnhhnb.exe 39 PID 2172 wrote to memory of 1696 2172 nnhhnb.exe 39 PID 1696 wrote to memory of 676 1696 pjvdp.exe 40 PID 1696 wrote to memory of 676 1696 pjvdp.exe 40 PID 1696 wrote to memory of 676 1696 pjvdp.exe 40 PID 1696 wrote to memory of 676 1696 pjvdp.exe 40 PID 676 wrote to memory of 2540 676 dvjpp.exe 41 PID 676 wrote to memory of 2540 676 dvjpp.exe 41 PID 676 wrote to memory of 2540 676 dvjpp.exe 41 PID 676 wrote to memory of 2540 676 dvjpp.exe 41 PID 2540 wrote to memory of 2328 2540 9lrflrx.exe 42 PID 2540 wrote to memory of 2328 2540 9lrflrx.exe 42 PID 2540 wrote to memory of 2328 2540 9lrflrx.exe 42 PID 2540 wrote to memory of 2328 2540 9lrflrx.exe 42 PID 2328 wrote to memory of 1200 2328 3xxlllx.exe 43 PID 2328 wrote to memory of 1200 2328 3xxlllx.exe 43 PID 2328 wrote to memory of 1200 2328 3xxlllx.exe 43 PID 2328 wrote to memory of 1200 2328 3xxlllx.exe 43 PID 1200 wrote to memory of 2372 1200 hbnhth.exe 44 PID 1200 wrote to memory of 2372 1200 hbnhth.exe 44 PID 1200 wrote to memory of 2372 1200 hbnhth.exe 44 PID 1200 wrote to memory of 2372 1200 hbnhth.exe 44 PID 2372 wrote to memory of 696 2372 jvjvp.exe 45 PID 2372 wrote to memory of 696 2372 jvjvp.exe 45 PID 2372 wrote to memory of 696 2372 jvjvp.exe 45 PID 2372 wrote to memory of 696 2372 jvjvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe"C:\Users\Admin\AppData\Local\Temp\2cfa313a9ea62d51c562de2100bdfa7f30fda5c9c3adb8048b6ef1a01b8a1720N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\llxfrxr.exec:\llxfrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\tthhtt.exec:\tthhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\bthbhn.exec:\bthbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vpvdp.exec:\vpvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\rlllxxl.exec:\rlllxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xrffrlx.exec:\xrffrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\9bbnbb.exec:\9bbnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\jjjpj.exec:\jjjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\nnhhnb.exec:\nnhhnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\pjvdp.exec:\pjvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\dvjpp.exec:\dvjpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\9lrflrx.exec:\9lrflrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\3xxlllx.exec:\3xxlllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\hbnhth.exec:\hbnhth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\jvjvp.exec:\jvjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\vpddp.exec:\vpddp.exe17⤵
- Executes dropped EXE
PID:696 -
\??\c:\frffffl.exec:\frffffl.exe18⤵
- Executes dropped EXE
PID:592 -
\??\c:\1ttnhn.exec:\1ttnhn.exe19⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1nthnn.exec:\1nthnn.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\jdppd.exec:\jdppd.exe21⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5vpvv.exec:\5vpvv.exe22⤵
- Executes dropped EXE
PID:3036 -
\??\c:\llflxlx.exec:\llflxlx.exe23⤵
- Executes dropped EXE
PID:692 -
\??\c:\frllllr.exec:\frllllr.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\thbnht.exec:\thbnht.exe25⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3bbnbh.exec:\3bbnbh.exe26⤵
- Executes dropped EXE
PID:556 -
\??\c:\ddjpp.exec:\ddjpp.exe27⤵
- Executes dropped EXE
PID:564 -
\??\c:\7ddjj.exec:\7ddjj.exe28⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rlrlrfr.exec:\rlrlrfr.exe29⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xffflxr.exec:\xffflxr.exe30⤵
- Executes dropped EXE
PID:1788 -
\??\c:\hhtthb.exec:\hhtthb.exe31⤵
- Executes dropped EXE
PID:1072 -
\??\c:\3btbhn.exec:\3btbhn.exe32⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jjdjv.exec:\jjdjv.exe33⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fxrrfrx.exec:\fxrrfrx.exe34⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lxlxlrf.exec:\lxlxlrf.exe35⤵
- Executes dropped EXE
PID:2716 -
\??\c:\btnbtb.exec:\btnbtb.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tthbbn.exec:\tthbbn.exe37⤵
- Executes dropped EXE
PID:1620 -
\??\c:\1dpjv.exec:\1dpjv.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\1dvvv.exec:\1dvvv.exe39⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pdppv.exec:\pdppv.exe40⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xxlrflr.exec:\xxlrflr.exe41⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xlxlrff.exec:\xlxlrff.exe42⤵
- Executes dropped EXE
PID:1904 -
\??\c:\tnhhtt.exec:\tnhhtt.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hbnbbh.exec:\hbnbbh.exe44⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jdpvp.exec:\jdpvp.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\3vpdp.exec:\3vpdp.exe46⤵
- Executes dropped EXE
PID:584 -
\??\c:\7rrrlrx.exec:\7rrrlrx.exe47⤵
- Executes dropped EXE
PID:1492 -
\??\c:\fxlrflr.exec:\fxlrflr.exe48⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xxlrxfx.exec:\xxlrxfx.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hhbnbh.exec:\hhbnbh.exe50⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hbthnt.exec:\hbthnt.exe51⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vpdpv.exec:\vpdpv.exe52⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vjddj.exec:\vjddj.exe53⤵
- Executes dropped EXE
PID:264 -
\??\c:\frllxfr.exec:\frllxfr.exe54⤵
- Executes dropped EXE
PID:1888 -
\??\c:\llrlllx.exec:\llrlllx.exe55⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3hhhhb.exec:\3hhhhb.exe56⤵
- Executes dropped EXE
PID:2196 -
\??\c:\7ttnnn.exec:\7ttnnn.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dpddd.exec:\dpddd.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\dvjpv.exec:\dvjpv.exe59⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jdjjp.exec:\jdjjp.exe60⤵
- Executes dropped EXE
PID:780 -
\??\c:\llflfxf.exec:\llflfxf.exe61⤵
- Executes dropped EXE
PID:2508 -
\??\c:\lfxffrf.exec:\lfxffrf.exe62⤵
- Executes dropped EXE
PID:348 -
\??\c:\tnbtbb.exec:\tnbtbb.exe63⤵
- Executes dropped EXE
PID:1436 -
\??\c:\9nhnnn.exec:\9nhnnn.exe64⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jvjpv.exec:\jvjpv.exe65⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jdjpp.exec:\jdjpp.exe66⤵PID:2468
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe67⤵PID:1676
-
\??\c:\rlxrfrf.exec:\rlxrfrf.exe68⤵PID:1516
-
\??\c:\5nhnnn.exec:\5nhnnn.exe69⤵PID:892
-
\??\c:\bthnbb.exec:\bthnbb.exe70⤵PID:2660
-
\??\c:\vpvdp.exec:\vpvdp.exe71⤵PID:2704
-
\??\c:\1pvvd.exec:\1pvvd.exe72⤵PID:2828
-
\??\c:\3vjjd.exec:\3vjjd.exe73⤵PID:2588
-
\??\c:\9lxlxlr.exec:\9lxlxlr.exe74⤵PID:2832
-
\??\c:\xlllrrr.exec:\xlllrrr.exe75⤵PID:2716
-
\??\c:\9dppd.exec:\9dppd.exe76⤵PID:2552
-
\??\c:\pjjdj.exec:\pjjdj.exe77⤵PID:1620
-
\??\c:\xrflxff.exec:\xrflxff.exe78⤵PID:2928
-
\??\c:\rrxflfl.exec:\rrxflfl.exe79⤵PID:1204
-
\??\c:\htbhnt.exec:\htbhnt.exe80⤵PID:1552
-
\??\c:\tbhtht.exec:\tbhtht.exe81⤵PID:1100
-
\??\c:\dpjjj.exec:\dpjjj.exe82⤵PID:3004
-
\??\c:\pjpdp.exec:\pjpdp.exe83⤵PID:3000
-
\??\c:\rrllrrf.exec:\rrllrrf.exe84⤵PID:2648
-
\??\c:\xxrrxfr.exec:\xxrrxfr.exe85⤵PID:1964
-
\??\c:\nhtbhn.exec:\nhtbhn.exe86⤵PID:676
-
\??\c:\nhhttn.exec:\nhhttn.exe87⤵PID:2148
-
\??\c:\pjpjv.exec:\pjpjv.exe88⤵PID:404
-
\??\c:\3dvvj.exec:\3dvvj.exe89⤵PID:2128
-
\??\c:\9vdjp.exec:\9vdjp.exe90⤵PID:1164
-
\??\c:\xrfflfl.exec:\xrfflfl.exe91⤵PID:1680
-
\??\c:\lfrfrxf.exec:\lfrfrxf.exe92⤵PID:2072
-
\??\c:\tntthb.exec:\tntthb.exe93⤵PID:1872
-
\??\c:\5hhhth.exec:\5hhhth.exe94⤵PID:2164
-
\??\c:\7djjd.exec:\7djjd.exe95⤵PID:2364
-
\??\c:\9pjdp.exec:\9pjdp.exe96⤵PID:1948
-
\??\c:\pdpvv.exec:\pdpvv.exe97⤵PID:952
-
\??\c:\xrrrxlx.exec:\xrrrxlx.exe98⤵PID:1632
-
\??\c:\5lrrxrx.exec:\5lrrxrx.exe99⤵PID:1828
-
\??\c:\ttnbnt.exec:\ttnbnt.exe100⤵PID:948
-
\??\c:\hbbbhh.exec:\hbbbhh.exe101⤵PID:1772
-
\??\c:\ppppj.exec:\ppppj.exe102⤵PID:1688
-
\??\c:\jjvdv.exec:\jjvdv.exe103⤵PID:1916
-
\??\c:\rffflfx.exec:\rffflfx.exe104⤵PID:2400
-
\??\c:\7fxxffl.exec:\7fxxffl.exe105⤵PID:1760
-
\??\c:\tnhthh.exec:\tnhthh.exe106⤵PID:292
-
\??\c:\nnbbhb.exec:\nnbbhb.exe107⤵PID:1096
-
\??\c:\7nbhbn.exec:\7nbhbn.exe108⤵PID:1088
-
\??\c:\pjvdj.exec:\pjvdj.exe109⤵PID:1064
-
\??\c:\9dpvv.exec:\9dpvv.exe110⤵PID:1072
-
\??\c:\9rxxllx.exec:\9rxxllx.exe111⤵PID:2784
-
\??\c:\rlxlflr.exec:\rlxlflr.exe112⤵PID:2724
-
\??\c:\bbhbhn.exec:\bbhbhn.exe113⤵PID:1508
-
\??\c:\bbnnnn.exec:\bbnnnn.exe114⤵PID:2548
-
\??\c:\3jjjp.exec:\3jjjp.exe115⤵PID:2556
-
\??\c:\vpdvj.exec:\vpdvj.exe116⤵PID:2152
-
\??\c:\xrfrrrx.exec:\xrfrrrx.exe117⤵PID:2664
-
\??\c:\rrfrrrf.exec:\rrfrrrf.exe118⤵PID:2672
-
\??\c:\rfrfffr.exec:\rfrfffr.exe119⤵PID:2452
-
\??\c:\bbtnbh.exec:\bbtnbh.exe120⤵PID:2924
-
\??\c:\tnhbhh.exec:\tnhbhh.exe121⤵PID:1592
-
\??\c:\djdjp.exec:\djdjp.exe122⤵PID:1752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-