Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15-10-2024 05:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe
-
Size
69KB
-
MD5
8ab920a4be80e78e61422fabfbf471e0
-
SHA1
598d2f8209797d3f2cf49e716d1dc82208227101
-
SHA256
ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dad
-
SHA512
600da159ed3c40b947be99dfedcbb7881105e5fdf4a49556a3ca351a11b4eeece371d8a3dc5397d8822f66b97a7612b7122b89b081d32f2295a2940a5c18414d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvdy:ymb3NkkiQ3mdBjF0yMliy
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2308-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/408-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1408-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-2520-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1648 lfxlxfl.exe 2168 nbtbht.exe 2948 lfxrrxx.exe 408 ttnntb.exe 2712 pjvvd.exe 2692 llfrflr.exe 2256 5ddjv.exe 1036 dvvdv.exe 580 rlrrlrx.exe 264 ntthbh.exe 3000 pjjvj.exe 1408 vdddd.exe 2956 xlxrllf.exe 856 1bthnn.exe 3028 bthhnh.exe 668 1jjjv.exe 1860 xrlrffr.exe 2404 xrlrfxf.exe 2224 btnnhn.exe 2020 btnthh.exe 2400 dvpdj.exe 1192 lxxxfll.exe 1684 5xxfllx.exe 1956 tthhht.exe 1988 vvdjv.exe 1920 xlxfxlr.exe 3052 rlxlxlx.exe 1508 vjppp.exe 884 3dvdp.exe 1340 7rrfxxl.exe 2644 hbntbh.exe 2976 pvvjj.exe 2212 xllffrr.exe 2896 xxrfxxx.exe 2808 3tthbn.exe 2724 nhntbb.exe 2856 5dpvd.exe 2860 jjdpj.exe 2944 lfxxfxf.exe 2692 1xrxffl.exe 1488 nbthhn.exe 1348 nnbnth.exe 2100 djdjp.exe 2432 vpjvp.exe 3016 djvvv.exe 1068 5fxfrxf.exe 1996 fffrrxf.exe 1408 nhthhn.exe 316 btthbt.exe 3012 tntnhb.exe 1472 pjvdj.exe 2052 dddvd.exe 2084 dvddd.exe 2096 xxrflxl.exe 2220 rlxrxxl.exe 2636 hbhbbn.exe 788 hbtnnn.exe 2132 hthnbb.exe 2484 5jvjj.exe 2072 7ppvp.exe 484 pjjpp.exe 1356 1frrflx.exe 1956 rrxlxfl.exe 2572 hbbnbb.exe -
resource yara_rule behavioral1/memory/1648-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/408-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/408-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/408-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1408-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-2520-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1648 2308 ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe 30 PID 2308 wrote to memory of 1648 2308 ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe 30 PID 2308 wrote to memory of 1648 2308 ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe 30 PID 2308 wrote to memory of 1648 2308 ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe 30 PID 1648 wrote to memory of 2168 1648 lfxlxfl.exe 31 PID 1648 wrote to memory of 2168 1648 lfxlxfl.exe 31 PID 1648 wrote to memory of 2168 1648 lfxlxfl.exe 31 PID 1648 wrote to memory of 2168 1648 lfxlxfl.exe 31 PID 2168 wrote to memory of 2948 2168 nbtbht.exe 32 PID 2168 wrote to memory of 2948 2168 nbtbht.exe 32 PID 2168 wrote to memory of 2948 2168 nbtbht.exe 32 PID 2168 wrote to memory of 2948 2168 nbtbht.exe 32 PID 2948 wrote to memory of 408 2948 lfxrrxx.exe 33 PID 2948 wrote to memory of 408 2948 lfxrrxx.exe 33 PID 2948 wrote to memory of 408 2948 lfxrrxx.exe 33 PID 2948 wrote to memory of 408 2948 lfxrrxx.exe 33 PID 408 wrote to memory of 2712 408 ttnntb.exe 34 PID 408 wrote to memory of 2712 408 ttnntb.exe 34 PID 408 wrote to memory of 2712 408 ttnntb.exe 34 PID 408 wrote to memory of 2712 408 ttnntb.exe 34 PID 2712 wrote to memory of 2692 2712 pjvvd.exe 35 PID 2712 wrote to memory of 2692 2712 pjvvd.exe 35 PID 2712 wrote to memory of 2692 2712 pjvvd.exe 35 PID 2712 wrote to memory of 2692 2712 pjvvd.exe 35 PID 2692 wrote to memory of 2256 2692 llfrflr.exe 36 PID 2692 wrote to memory of 2256 2692 llfrflr.exe 36 PID 2692 wrote to memory of 2256 2692 llfrflr.exe 36 PID 2692 wrote to memory of 2256 2692 llfrflr.exe 36 PID 2256 wrote to memory of 1036 2256 5ddjv.exe 37 PID 2256 wrote to memory of 1036 2256 5ddjv.exe 37 PID 2256 wrote to memory of 1036 2256 5ddjv.exe 37 PID 2256 wrote to memory of 1036 2256 5ddjv.exe 37 PID 1036 wrote to memory of 580 1036 dvvdv.exe 38 PID 1036 wrote to memory of 580 1036 dvvdv.exe 38 PID 1036 wrote to memory of 580 1036 dvvdv.exe 38 PID 1036 wrote to memory of 580 1036 dvvdv.exe 38 PID 580 wrote to memory of 264 580 rlrrlrx.exe 39 PID 580 wrote to memory of 264 580 rlrrlrx.exe 39 PID 580 wrote to memory of 264 580 rlrrlrx.exe 39 PID 580 wrote to memory of 264 580 rlrrlrx.exe 39 PID 264 wrote to memory of 3000 264 ntthbh.exe 40 PID 264 wrote to memory of 3000 264 ntthbh.exe 40 PID 264 wrote to memory of 3000 264 ntthbh.exe 40 PID 264 wrote to memory of 3000 264 ntthbh.exe 40 PID 3000 wrote to memory of 1408 3000 pjjvj.exe 41 PID 3000 wrote to memory of 1408 3000 pjjvj.exe 41 PID 3000 wrote to memory of 1408 3000 pjjvj.exe 41 PID 3000 wrote to memory of 1408 3000 pjjvj.exe 41 PID 1408 wrote to memory of 2956 1408 vdddd.exe 42 PID 1408 wrote to memory of 2956 1408 vdddd.exe 42 PID 1408 wrote to memory of 2956 1408 vdddd.exe 42 PID 1408 wrote to memory of 2956 1408 vdddd.exe 42 PID 2956 wrote to memory of 856 2956 xlxrllf.exe 43 PID 2956 wrote to memory of 856 2956 xlxrllf.exe 43 PID 2956 wrote to memory of 856 2956 xlxrllf.exe 43 PID 2956 wrote to memory of 856 2956 xlxrllf.exe 43 PID 856 wrote to memory of 3028 856 1bthnn.exe 44 PID 856 wrote to memory of 3028 856 1bthnn.exe 44 PID 856 wrote to memory of 3028 856 1bthnn.exe 44 PID 856 wrote to memory of 3028 856 1bthnn.exe 44 PID 3028 wrote to memory of 668 3028 bthhnh.exe 45 PID 3028 wrote to memory of 668 3028 bthhnh.exe 45 PID 3028 wrote to memory of 668 3028 bthhnh.exe 45 PID 3028 wrote to memory of 668 3028 bthhnh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe"C:\Users\Admin\AppData\Local\Temp\ba385aee933f984998ed4255853d87c46acb3d17c8223278b99adc9fe9bd3dadN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\lfxlxfl.exec:\lfxlxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\nbtbht.exec:\nbtbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\lfxrrxx.exec:\lfxrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ttnntb.exec:\ttnntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\pjvvd.exec:\pjvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\llfrflr.exec:\llfrflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\5ddjv.exec:\5ddjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\dvvdv.exec:\dvvdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\rlrrlrx.exec:\rlrrlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\ntthbh.exec:\ntthbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\pjjvj.exec:\pjjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\vdddd.exec:\vdddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\xlxrllf.exec:\xlxrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\1bthnn.exec:\1bthnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\bthhnh.exec:\bthhnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\1jjjv.exec:\1jjjv.exe17⤵
- Executes dropped EXE
PID:668 -
\??\c:\xrlrffr.exec:\xrlrffr.exe18⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xrlrfxf.exec:\xrlrfxf.exe19⤵
- Executes dropped EXE
PID:2404 -
\??\c:\btnnhn.exec:\btnnhn.exe20⤵
- Executes dropped EXE
PID:2224 -
\??\c:\btnthh.exec:\btnthh.exe21⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dvpdj.exec:\dvpdj.exe22⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lxxxfll.exec:\lxxxfll.exe23⤵
- Executes dropped EXE
PID:1192 -
\??\c:\5xxfllx.exec:\5xxfllx.exe24⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tthhht.exec:\tthhht.exe25⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vvdjv.exec:\vvdjv.exe26⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xlxfxlr.exec:\xlxfxlr.exe27⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rlxlxlx.exec:\rlxlxlx.exe28⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vjppp.exec:\vjppp.exe29⤵
- Executes dropped EXE
PID:1508 -
\??\c:\3dvdp.exec:\3dvdp.exe30⤵
- Executes dropped EXE
PID:884 -
\??\c:\7rrfxxl.exec:\7rrfxxl.exe31⤵
- Executes dropped EXE
PID:1340 -
\??\c:\hbntbh.exec:\hbntbh.exe32⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pvvjj.exec:\pvvjj.exe33⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xllffrr.exec:\xllffrr.exe34⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xxrfxxx.exec:\xxrfxxx.exe35⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3tthbn.exec:\3tthbn.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nhntbb.exec:\nhntbb.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5dpvd.exec:\5dpvd.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jjdpj.exec:\jjdpj.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lfxxfxf.exec:\lfxxfxf.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1xrxffl.exec:\1xrxffl.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nbthhn.exec:\nbthhn.exe42⤵
- Executes dropped EXE
PID:1488 -
\??\c:\nnbnth.exec:\nnbnth.exe43⤵
- Executes dropped EXE
PID:1348 -
\??\c:\djdjp.exec:\djdjp.exe44⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vpjvp.exec:\vpjvp.exe45⤵
- Executes dropped EXE
PID:2432 -
\??\c:\djvvv.exec:\djvvv.exe46⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5fxfrxf.exec:\5fxfrxf.exe47⤵
- Executes dropped EXE
PID:1068 -
\??\c:\fffrrxf.exec:\fffrrxf.exe48⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nhthhn.exec:\nhthhn.exe49⤵
- Executes dropped EXE
PID:1408 -
\??\c:\btthbt.exec:\btthbt.exe50⤵
- Executes dropped EXE
PID:316 -
\??\c:\tntnhb.exec:\tntnhb.exe51⤵
- Executes dropped EXE
PID:3012 -
\??\c:\pjvdj.exec:\pjvdj.exe52⤵
- Executes dropped EXE
PID:1472 -
\??\c:\dddvd.exec:\dddvd.exe53⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dvddd.exec:\dvddd.exe54⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xxrflxl.exec:\xxrflxl.exe55⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe56⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hbhbbn.exec:\hbhbbn.exe57⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hbtnnn.exec:\hbtnnn.exe58⤵
- Executes dropped EXE
PID:788 -
\??\c:\hthnbb.exec:\hthnbb.exe59⤵
- Executes dropped EXE
PID:2132 -
\??\c:\5jvjj.exec:\5jvjj.exe60⤵
- Executes dropped EXE
PID:2484 -
\??\c:\7ppvp.exec:\7ppvp.exe61⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pjjpp.exec:\pjjpp.exe62⤵
- Executes dropped EXE
PID:484 -
\??\c:\1frrflx.exec:\1frrflx.exe63⤵
- Executes dropped EXE
PID:1356 -
\??\c:\rrxlxfl.exec:\rrxlxfl.exe64⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hbbnbb.exec:\hbbnbb.exe65⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hhbntt.exec:\hhbntt.exe66⤵PID:2624
-
\??\c:\tthhtt.exec:\tthhtt.exe67⤵PID:2244
-
\??\c:\7pdpv.exec:\7pdpv.exe68⤵PID:1056
-
\??\c:\jjddp.exec:\jjddp.exe69⤵PID:2608
-
\??\c:\xrrxffx.exec:\xrrxffx.exe70⤵PID:1600
-
\??\c:\rrfrlrf.exec:\rrfrlrf.exe71⤵PID:1340
-
\??\c:\frlfflr.exec:\frlfflr.exe72⤵PID:2252
-
\??\c:\nbnbhn.exec:\nbnbhn.exe73⤵PID:2464
-
\??\c:\hhbnbn.exec:\hhbnbn.exe74⤵PID:2876
-
\??\c:\nnbhhh.exec:\nnbhhh.exe75⤵PID:2948
-
\??\c:\7djdp.exec:\7djdp.exe76⤵PID:3020
-
\??\c:\vdjdp.exec:\vdjdp.exe77⤵PID:3060
-
\??\c:\xrlrfxl.exec:\xrlrfxl.exe78⤵PID:2736
-
\??\c:\rlrrxlf.exec:\rlrrxlf.exe79⤵PID:2704
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe80⤵PID:1736
-
\??\c:\hbhnbh.exec:\hbhnbh.exe81⤵PID:2256
-
\??\c:\nhtnnn.exec:\nhtnnn.exe82⤵PID:2056
-
\??\c:\bbbnht.exec:\bbbnht.exe83⤵PID:2728
-
\??\c:\jjvpp.exec:\jjvpp.exe84⤵PID:320
-
\??\c:\lfrxlxf.exec:\lfrxlxf.exe85⤵PID:2012
-
\??\c:\fxxlflf.exec:\fxxlflf.exe86⤵PID:1620
-
\??\c:\hbntbb.exec:\hbntbb.exe87⤵PID:2032
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe88⤵PID:2960
-
\??\c:\llfflrf.exec:\llfflrf.exe89⤵PID:1088
-
\??\c:\jdjvp.exec:\jdjvp.exe90⤵PID:1724
-
\??\c:\ppdpv.exec:\ppdpv.exe91⤵PID:856
-
\??\c:\xxrxlxr.exec:\xxrxlxr.exe92⤵PID:1576
-
\??\c:\ntnbbb.exec:\ntnbbb.exe93⤵PID:888
-
\??\c:\tttbth.exec:\tttbth.exe94⤵PID:2088
-
\??\c:\pjddp.exec:\pjddp.exe95⤵PID:2672
-
\??\c:\xxxlfrf.exec:\xxxlfrf.exe96⤵PID:2156
-
\??\c:\jjdpp.exec:\jjdpp.exe97⤵PID:2180
-
\??\c:\jdvjv.exec:\jdvjv.exe98⤵PID:2196
-
\??\c:\fffrflr.exec:\fffrflr.exe99⤵PID:920
-
\??\c:\btnhtt.exec:\btnhtt.exe100⤵PID:916
-
\??\c:\hhnthn.exec:\hhnthn.exe101⤵PID:2512
-
\??\c:\jjjdj.exec:\jjjdj.exe102⤵PID:2352
-
\??\c:\rlrxrxl.exec:\rlrxrxl.exe103⤵PID:2172
-
\??\c:\frfrfrx.exec:\frfrfrx.exe104⤵PID:1692
-
\??\c:\lfflxlf.exec:\lfflxlf.exe105⤵PID:1516
-
\??\c:\ddjdp.exec:\ddjdp.exe106⤵PID:2152
-
\??\c:\rlxfflf.exec:\rlxfflf.exe107⤵PID:3052
-
\??\c:\xlrllfl.exec:\xlrllfl.exe108⤵PID:900
-
\??\c:\hhnhnh.exec:\hhnhnh.exe109⤵PID:884
-
\??\c:\vvpvp.exec:\vvpvp.exe110⤵PID:2608
-
\??\c:\jdpvp.exec:\jdpvp.exe111⤵PID:1704
-
\??\c:\1xrfrlf.exec:\1xrfrlf.exe112⤵PID:2044
-
\??\c:\btbhbb.exec:\btbhbb.exe113⤵PID:612
-
\??\c:\hhthbn.exec:\hhthbn.exe114⤵PID:2880
-
\??\c:\jpdvd.exec:\jpdvd.exe115⤵PID:2928
-
\??\c:\vvdjd.exec:\vvdjd.exe116⤵PID:2920
-
\??\c:\5xflxfl.exec:\5xflxfl.exe117⤵PID:2828
-
\??\c:\llfxxlf.exec:\llfxxlf.exe118⤵PID:2688
-
\??\c:\ttnbtt.exec:\ttnbtt.exe119⤵PID:2764
-
\??\c:\nnnhht.exec:\nnnhht.exe120⤵PID:2744
-
\??\c:\9vpjv.exec:\9vpjv.exe121⤵PID:1276
-
\??\c:\jpvdp.exec:\jpvdp.exe122⤵PID:1456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-