Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe
Resource
win7-20240903-en
General
-
Target
474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe
-
Size
75KB
-
MD5
a4c13ca5c7d71ec055b1aa0d829aea40
-
SHA1
fe6f8d20ea61877a0134b0456712aaf33906f66e
-
SHA256
474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3
-
SHA512
ea94987162f17a034436b98b05f2ceb3c88e24ebe4fdc62345996292d8ba88dbf1769bbc059d19839286e6bc8cbe805f99c07be78edeb73260e32cd457dfa8c5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmsp:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHT
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1788-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2360 xlflflf.exe 1784 tthhnb.exe 2428 pjdjp.exe 2832 jdppd.exe 2968 3xlrflf.exe 2896 tnhhbb.exe 1276 bbnhnb.exe 2596 pjppd.exe 1716 xffxxfl.exe 1832 httbbh.exe 956 1tnthn.exe 1696 dvvdv.exe 1984 fxlrrrx.exe 1808 ffxfrrf.exe 1980 bnbbnt.exe 1752 vpjpv.exe 2776 7pdvp.exe 2212 3frlrrr.exe 1840 nhtbnn.exe 560 3vjjp.exe 1500 vvjpp.exe 1848 rlllrxl.exe 1344 xxrflrl.exe 1192 hbnbht.exe 1664 tnnbtt.exe 3060 vppjj.exe 2268 9xxfllf.exe 1736 xxlrrll.exe 1740 hbhhnh.exe 2320 thbntb.exe 2380 vjvdd.exe 1588 7xxxlfl.exe 2184 ffxlrxl.exe 1804 bthntt.exe 2844 vjvvd.exe 2892 3vpvd.exe 2880 1fllrlx.exe 2964 xflflff.exe 2872 dpvjp.exe 2928 9vjjp.exe 2588 rrxrffr.exe 1704 ttnhtb.exe 2416 btbtth.exe 2008 nhbbnn.exe 2400 9vvjd.exe 2412 7rfxxxf.exe 284 7fxlxfr.exe 1280 5bhthn.exe 836 hhbhnt.exe 1148 vddvv.exe 1420 pdppd.exe 2796 lrflrxl.exe 2816 5ffxflf.exe 2424 btnntb.exe 2948 ppdjp.exe 2088 1vjdj.exe 408 vvpvv.exe 2996 xxxrflf.exe 840 xrfffrf.exe 892 tnbtnt.exe 1344 5hthhh.exe 1624 3vvpv.exe 796 3jjdj.exe 1268 ffrxrxf.exe -
resource yara_rule behavioral1/memory/1788-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1788 wrote to memory of 2360 1788 474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe 30 PID 1788 wrote to memory of 2360 1788 474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe 30 PID 1788 wrote to memory of 2360 1788 474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe 30 PID 1788 wrote to memory of 2360 1788 474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe 30 PID 2360 wrote to memory of 1784 2360 xlflflf.exe 31 PID 2360 wrote to memory of 1784 2360 xlflflf.exe 31 PID 2360 wrote to memory of 1784 2360 xlflflf.exe 31 PID 2360 wrote to memory of 1784 2360 xlflflf.exe 31 PID 1784 wrote to memory of 2428 1784 tthhnb.exe 32 PID 1784 wrote to memory of 2428 1784 tthhnb.exe 32 PID 1784 wrote to memory of 2428 1784 tthhnb.exe 32 PID 1784 wrote to memory of 2428 1784 tthhnb.exe 32 PID 2428 wrote to memory of 2832 2428 pjdjp.exe 33 PID 2428 wrote to memory of 2832 2428 pjdjp.exe 33 PID 2428 wrote to memory of 2832 2428 pjdjp.exe 33 PID 2428 wrote to memory of 2832 2428 pjdjp.exe 33 PID 2832 wrote to memory of 2968 2832 jdppd.exe 34 PID 2832 wrote to memory of 2968 2832 jdppd.exe 34 PID 2832 wrote to memory of 2968 2832 jdppd.exe 34 PID 2832 wrote to memory of 2968 2832 jdppd.exe 34 PID 2968 wrote to memory of 2896 2968 3xlrflf.exe 35 PID 2968 wrote to memory of 2896 2968 3xlrflf.exe 35 PID 2968 wrote to memory of 2896 2968 3xlrflf.exe 35 PID 2968 wrote to memory of 2896 2968 3xlrflf.exe 35 PID 2896 wrote to memory of 1276 2896 tnhhbb.exe 36 PID 2896 wrote to memory of 1276 2896 tnhhbb.exe 36 PID 2896 wrote to memory of 1276 2896 tnhhbb.exe 36 PID 2896 wrote to memory of 1276 2896 tnhhbb.exe 36 PID 1276 wrote to memory of 2596 1276 bbnhnb.exe 37 PID 1276 wrote to memory of 2596 1276 bbnhnb.exe 37 PID 1276 wrote to memory of 2596 1276 bbnhnb.exe 37 PID 1276 wrote to memory of 2596 1276 bbnhnb.exe 37 PID 2596 wrote to memory of 1716 2596 pjppd.exe 38 PID 2596 wrote to memory of 1716 2596 pjppd.exe 38 PID 2596 wrote to memory of 1716 2596 pjppd.exe 38 PID 2596 wrote to memory of 1716 2596 pjppd.exe 38 PID 1716 wrote to memory of 1832 1716 xffxxfl.exe 39 PID 1716 wrote to memory of 1832 1716 xffxxfl.exe 39 PID 1716 wrote to memory of 1832 1716 xffxxfl.exe 39 PID 1716 wrote to memory of 1832 1716 xffxxfl.exe 39 PID 1832 wrote to memory of 956 1832 httbbh.exe 40 PID 1832 wrote to memory of 956 1832 httbbh.exe 40 PID 1832 wrote to memory of 956 1832 httbbh.exe 40 PID 1832 wrote to memory of 956 1832 httbbh.exe 40 PID 956 wrote to memory of 1696 956 1tnthn.exe 41 PID 956 wrote to memory of 1696 956 1tnthn.exe 41 PID 956 wrote to memory of 1696 956 1tnthn.exe 41 PID 956 wrote to memory of 1696 956 1tnthn.exe 41 PID 1696 wrote to memory of 1984 1696 dvvdv.exe 42 PID 1696 wrote to memory of 1984 1696 dvvdv.exe 42 PID 1696 wrote to memory of 1984 1696 dvvdv.exe 42 PID 1696 wrote to memory of 1984 1696 dvvdv.exe 42 PID 1984 wrote to memory of 1808 1984 fxlrrrx.exe 43 PID 1984 wrote to memory of 1808 1984 fxlrrrx.exe 43 PID 1984 wrote to memory of 1808 1984 fxlrrrx.exe 43 PID 1984 wrote to memory of 1808 1984 fxlrrrx.exe 43 PID 1808 wrote to memory of 1980 1808 ffxfrrf.exe 44 PID 1808 wrote to memory of 1980 1808 ffxfrrf.exe 44 PID 1808 wrote to memory of 1980 1808 ffxfrrf.exe 44 PID 1808 wrote to memory of 1980 1808 ffxfrrf.exe 44 PID 1980 wrote to memory of 1752 1980 bnbbnt.exe 45 PID 1980 wrote to memory of 1752 1980 bnbbnt.exe 45 PID 1980 wrote to memory of 1752 1980 bnbbnt.exe 45 PID 1980 wrote to memory of 1752 1980 bnbbnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe"C:\Users\Admin\AppData\Local\Temp\474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\xlflflf.exec:\xlflflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\tthhnb.exec:\tthhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\pjdjp.exec:\pjdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\jdppd.exec:\jdppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\3xlrflf.exec:\3xlrflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\tnhhbb.exec:\tnhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\bbnhnb.exec:\bbnhnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\pjppd.exec:\pjppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\xffxxfl.exec:\xffxxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\httbbh.exec:\httbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\1tnthn.exec:\1tnthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\dvvdv.exec:\dvvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\bnbbnt.exec:\bnbbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\vpjpv.exec:\vpjpv.exe17⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7pdvp.exec:\7pdvp.exe18⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3frlrrr.exec:\3frlrrr.exe19⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nhtbnn.exec:\nhtbnn.exe20⤵
- Executes dropped EXE
PID:1840 -
\??\c:\3vjjp.exec:\3vjjp.exe21⤵
- Executes dropped EXE
PID:560 -
\??\c:\vvjpp.exec:\vvjpp.exe22⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rlllrxl.exec:\rlllrxl.exe23⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xxrflrl.exec:\xxrflrl.exe24⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hbnbht.exec:\hbnbht.exe25⤵
- Executes dropped EXE
PID:1192 -
\??\c:\tnnbtt.exec:\tnnbtt.exe26⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vppjj.exec:\vppjj.exe27⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9xxfllf.exec:\9xxfllf.exe28⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xxlrrll.exec:\xxlrrll.exe29⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hbhhnh.exec:\hbhhnh.exe30⤵
- Executes dropped EXE
PID:1740 -
\??\c:\thbntb.exec:\thbntb.exe31⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vjvdd.exec:\vjvdd.exe32⤵
- Executes dropped EXE
PID:2380 -
\??\c:\7xxxlfl.exec:\7xxxlfl.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe34⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bthntt.exec:\bthntt.exe35⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vjvvd.exec:\vjvvd.exe36⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3vpvd.exec:\3vpvd.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\1fllrlx.exec:\1fllrlx.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xflflff.exec:\xflflff.exe39⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dpvjp.exec:\dpvjp.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9vjjp.exec:\9vjjp.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rrxrffr.exec:\rrxrffr.exe42⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ttnhtb.exec:\ttnhtb.exe43⤵
- Executes dropped EXE
PID:1704 -
\??\c:\btbtth.exec:\btbtth.exe44⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nhbbnn.exec:\nhbbnn.exe45⤵
- Executes dropped EXE
PID:2008 -
\??\c:\9vvjd.exec:\9vvjd.exe46⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7rfxxxf.exec:\7rfxxxf.exe47⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7fxlxfr.exec:\7fxlxfr.exe48⤵
- Executes dropped EXE
PID:284 -
\??\c:\5bhthn.exec:\5bhthn.exe49⤵
- Executes dropped EXE
PID:1280 -
\??\c:\hhbhnt.exec:\hhbhnt.exe50⤵
- Executes dropped EXE
PID:836 -
\??\c:\vddvv.exec:\vddvv.exe51⤵
- Executes dropped EXE
PID:1148 -
\??\c:\pdppd.exec:\pdppd.exe52⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lrflrxl.exec:\lrflrxl.exe53⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5ffxflf.exec:\5ffxflf.exe54⤵
- Executes dropped EXE
PID:2816 -
\??\c:\btnntb.exec:\btnntb.exe55⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ppdjp.exec:\ppdjp.exe56⤵
- Executes dropped EXE
PID:2948 -
\??\c:\1vjdj.exec:\1vjdj.exe57⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vvpvv.exec:\vvpvv.exe58⤵
- Executes dropped EXE
PID:408 -
\??\c:\xxxrflf.exec:\xxxrflf.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xrfffrf.exec:\xrfffrf.exe60⤵
- Executes dropped EXE
PID:840 -
\??\c:\tnbtnt.exec:\tnbtnt.exe61⤵
- Executes dropped EXE
PID:892 -
\??\c:\5hthhh.exec:\5hthhh.exe62⤵
- Executes dropped EXE
PID:1344 -
\??\c:\3vvpv.exec:\3vvpv.exe63⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3jjdj.exec:\3jjdj.exe64⤵
- Executes dropped EXE
PID:796 -
\??\c:\ffrxrxf.exec:\ffrxrxf.exe65⤵
- Executes dropped EXE
PID:1268 -
\??\c:\bnnnbb.exec:\bnnnbb.exe66⤵PID:3060
-
\??\c:\nnbnbh.exec:\nnbnbh.exe67⤵PID:2268
-
\??\c:\bbbhhn.exec:\bbbhhn.exe68⤵PID:1736
-
\??\c:\ddjpv.exec:\ddjpv.exe69⤵PID:2960
-
\??\c:\3lffrrr.exec:\3lffrrr.exe70⤵PID:2052
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe71⤵PID:1552
-
\??\c:\xxrffrf.exec:\xxrffrf.exe72⤵PID:2484
-
\??\c:\3htbhb.exec:\3htbhb.exe73⤵PID:2148
-
\??\c:\jddvv.exec:\jddvv.exe74⤵PID:2352
-
\??\c:\dvppj.exec:\dvppj.exe75⤵PID:2428
-
\??\c:\fxrxffr.exec:\fxrxffr.exe76⤵PID:2708
-
\??\c:\lfrrfrl.exec:\lfrrfrl.exe77⤵PID:2976
-
\??\c:\hbnntt.exec:\hbnntt.exe78⤵PID:2784
-
\??\c:\tntbnh.exec:\tntbnh.exe79⤵PID:2392
-
\??\c:\pjvjp.exec:\pjvjp.exe80⤵PID:2612
-
\??\c:\vpdpd.exec:\vpdpd.exe81⤵PID:1276
-
\??\c:\fffllrf.exec:\fffllrf.exe82⤵PID:2704
-
\??\c:\1ffflrx.exec:\1ffflrx.exe83⤵PID:3040
-
\??\c:\tbtnnb.exec:\tbtnnb.exe84⤵PID:776
-
\??\c:\bthntt.exec:\bthntt.exe85⤵PID:1284
-
\??\c:\pdppv.exec:\pdppv.exe86⤵PID:764
-
\??\c:\3frllrf.exec:\3frllrf.exe87⤵PID:1524
-
\??\c:\lflxflx.exec:\lflxflx.exe88⤵PID:1636
-
\??\c:\bnbbbh.exec:\bnbbbh.exe89⤵PID:1428
-
\??\c:\vvpvj.exec:\vvpvj.exe90⤵PID:1808
-
\??\c:\vpvpv.exec:\vpvpv.exe91⤵PID:1980
-
\??\c:\1xlflfr.exec:\1xlflfr.exe92⤵PID:1224
-
\??\c:\rlrxxfr.exec:\rlrxxfr.exe93⤵PID:2684
-
\??\c:\thhthb.exec:\thhthb.exe94⤵PID:916
-
\??\c:\9vjvd.exec:\9vjvd.exe95⤵PID:1792
-
\??\c:\jjvpp.exec:\jjvpp.exe96⤵PID:344
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe97⤵PID:560
-
\??\c:\1frrrxf.exec:\1frrrxf.exe98⤵PID:2988
-
\??\c:\tbhhnb.exec:\tbhhnb.exe99⤵PID:2468
-
\??\c:\5hbhbh.exec:\5hbhbh.exe100⤵PID:676
-
\??\c:\jdvjj.exec:\jdvjj.exe101⤵PID:1600
-
\??\c:\xrxlrrf.exec:\xrxlrrf.exe102⤵PID:2012
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe103⤵PID:1192
-
\??\c:\nbtbht.exec:\nbtbht.exe104⤵PID:592
-
\??\c:\vvpdp.exec:\vvpdp.exe105⤵PID:2404
-
\??\c:\ppdjd.exec:\ppdjd.exe106⤵PID:2280
-
\??\c:\9frrrrx.exec:\9frrrrx.exe107⤵PID:812
-
\??\c:\lrflxfl.exec:\lrflxfl.exe108⤵PID:2188
-
\??\c:\hbbtnh.exec:\hbbtnh.exe109⤵PID:2492
-
\??\c:\nnnhtb.exec:\nnnhtb.exe110⤵PID:1584
-
\??\c:\jdpjv.exec:\jdpjv.exe111⤵PID:1592
-
\??\c:\5ppvd.exec:\5ppvd.exe112⤵PID:2768
-
\??\c:\rflrfrl.exec:\rflrfrl.exe113⤵PID:2148
-
\??\c:\ffrxxfl.exec:\ffrxxfl.exe114⤵PID:2832
-
\??\c:\hbhnhb.exec:\hbhnhb.exe115⤵PID:2688
-
\??\c:\nntbbn.exec:\nntbbn.exe116⤵PID:2676
-
\??\c:\1dvvv.exec:\1dvvv.exe117⤵PID:2900
-
\??\c:\jdvdd.exec:\jdvdd.exe118⤵PID:2712
-
\??\c:\lflxffx.exec:\lflxffx.exe119⤵PID:2392
-
\??\c:\llffxfx.exec:\llffxfx.exe120⤵PID:2272
-
\??\c:\nhntth.exec:\nhntth.exe121⤵PID:3036
-
\??\c:\hbhhnb.exec:\hbhhnb.exe122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-