Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/11/2024, 04:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f387a1ef45a32c9ce8f728693013ad994880608c37892e31df7c0adf1baeb9f0.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
f387a1ef45a32c9ce8f728693013ad994880608c37892e31df7c0adf1baeb9f0.exe
-
Size
50KB
-
MD5
0af5ec3b33e368af1423d7710f906619
-
SHA1
6d93e61d8e562f4b8ed97027a978c869a03d7d38
-
SHA256
f387a1ef45a32c9ce8f728693013ad994880608c37892e31df7c0adf1baeb9f0
-
SHA512
d56053c70cfff01344d9de289389ac387171dcf382a63342c280ac72cb47ce13e1e0196fac8df4662fa58855a187383e2eeedaddbb908a65255b25e5998cf5b7
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlbD:0cdpeeBSHHMHLf9RyIc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2516-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-79-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2580-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/804-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-245-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2376-275-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2376-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-328-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2160-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1892-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-444-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-458-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2172-471-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1204-510-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1592-520-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2236-541-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-596-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2544-600-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1392-756-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-770-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-867-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon behavioral1/memory/2992-877-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2204-887-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2204-892-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1952-998-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1708-1258-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2172-1311-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2660 rlfrxxf.exe 3008 1bnnbb.exe 2984 rlllfxl.exe 2704 llxfrxf.exe 2856 tbnthh.exe 2840 ppjvd.exe 2188 jdvvd.exe 2832 5lflxff.exe 2580 1httbh.exe 2972 ntnntt.exe 2980 dpvvp.exe 2112 ffxxxxf.exe 1836 ffrxtnb.exe 1924 5bbnth.exe 2416 vvjpd.exe 1016 3vpvj.exe 1884 llfrffr.exe 804 ntnbtb.exe 1684 dvjvd.exe 1612 3ddpv.exe 484 rrxlrlx.exe 1036 lrxfrfx.exe 1696 hhhhtt.exe 2168 pppdp.exe 2804 jjdpj.exe 1208 rrffrxf.exe 1896 bbtbhn.exe 680 7dppv.exe 2524 vpdpj.exe 2776 3rflrxf.exe 2376 nttbnt.exe 352 5thntn.exe 2148 9vjjd.exe 2500 xrxlxfr.exe 2948 9hthnb.exe 2380 tttbhn.exe 2052 vjvjp.exe 2160 fxrrrrx.exe 3060 bbhhhn.exe 2772 hnhhtt.exe 2720 pvjpv.exe 2436 7fxlllx.exe 2760 lfrffrf.exe 2740 9hhntb.exe 2688 hhnbnb.exe 2640 jjvvj.exe 2828 lrxlflx.exe 2536 1rlrxxf.exe 1712 1bbhbh.exe 1152 7hntbb.exe 2112 jjddj.exe 2792 pvjjv.exe 1720 rrffllr.exe 1892 lfxfrrf.exe 1888 bhbhtt.exe 1560 nnthnt.exe 2876 ddjdd.exe 1248 9xxfffl.exe 2116 rrxxfrx.exe 2172 nhnbhn.exe 1612 1btbbh.exe 632 djdjv.exe 1732 llrrfxf.exe 1260 flrxffl.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1httbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2660 2516 f387a1ef45a32c9ce8f728693013ad994880608c37892e31df7c0adf1baeb9f0.exe 30 PID 2516 wrote to memory of 2660 2516 f387a1ef45a32c9ce8f728693013ad994880608c37892e31df7c0adf1baeb9f0.exe 30 PID 2516 wrote to memory of 2660 2516 f387a1ef45a32c9ce8f728693013ad994880608c37892e31df7c0adf1baeb9f0.exe 30 PID 2516 wrote to memory of 2660 2516 f387a1ef45a32c9ce8f728693013ad994880608c37892e31df7c0adf1baeb9f0.exe 30 PID 2660 wrote to memory of 3008 2660 rlfrxxf.exe 31 PID 2660 wrote to memory of 3008 2660 rlfrxxf.exe 31 PID 2660 wrote to memory of 3008 2660 rlfrxxf.exe 31 PID 2660 wrote to memory of 3008 2660 rlfrxxf.exe 31 PID 3008 wrote to memory of 2984 3008 1bnnbb.exe 32 PID 3008 wrote to memory of 2984 3008 1bnnbb.exe 32 PID 3008 wrote to memory of 2984 3008 1bnnbb.exe 32 PID 3008 wrote to memory of 2984 3008 1bnnbb.exe 32 PID 2984 wrote to memory of 2704 2984 rlllfxl.exe 33 PID 2984 wrote to memory of 2704 2984 rlllfxl.exe 33 PID 2984 wrote to memory of 2704 2984 rlllfxl.exe 33 PID 2984 wrote to memory of 2704 2984 rlllfxl.exe 33 PID 2704 wrote to memory of 2856 2704 llxfrxf.exe 34 PID 2704 wrote to memory of 2856 2704 llxfrxf.exe 34 PID 2704 wrote to memory of 2856 2704 llxfrxf.exe 34 PID 2704 wrote to memory of 2856 2704 llxfrxf.exe 34 PID 2856 wrote to memory of 2840 2856 tbnthh.exe 35 PID 2856 wrote to memory of 2840 2856 tbnthh.exe 35 PID 2856 wrote to memory of 2840 2856 tbnthh.exe 35 PID 2856 wrote to memory of 2840 2856 tbnthh.exe 35 PID 2840 wrote to memory of 2188 2840 ppjvd.exe 36 PID 2840 wrote to memory of 2188 2840 ppjvd.exe 36 PID 2840 wrote to memory of 2188 2840 ppjvd.exe 36 PID 2840 wrote to memory of 2188 2840 ppjvd.exe 36 PID 2188 wrote to memory of 2832 2188 jdvvd.exe 37 PID 2188 wrote to memory of 2832 2188 jdvvd.exe 37 PID 2188 wrote to memory of 2832 2188 jdvvd.exe 37 PID 2188 wrote to memory of 2832 2188 jdvvd.exe 37 PID 2832 wrote to memory of 2580 2832 5lflxff.exe 38 PID 2832 wrote to memory of 2580 2832 5lflxff.exe 38 PID 2832 wrote to memory of 2580 2832 5lflxff.exe 38 PID 2832 wrote to memory of 2580 2832 5lflxff.exe 38 PID 2580 wrote to memory of 2972 2580 1httbh.exe 39 PID 2580 wrote to memory of 2972 2580 1httbh.exe 39 PID 2580 wrote to memory of 2972 2580 1httbh.exe 39 PID 2580 wrote to memory of 2972 2580 1httbh.exe 39 PID 2972 wrote to memory of 2980 2972 ntnntt.exe 40 PID 2972 wrote to memory of 2980 2972 ntnntt.exe 40 PID 2972 wrote to memory of 2980 2972 ntnntt.exe 40 PID 2972 wrote to memory of 2980 2972 ntnntt.exe 40 PID 2980 wrote to memory of 2112 2980 dpvvp.exe 41 PID 2980 wrote to memory of 2112 2980 dpvvp.exe 41 PID 2980 wrote to memory of 2112 2980 dpvvp.exe 41 PID 2980 wrote to memory of 2112 2980 dpvvp.exe 41 PID 2112 wrote to memory of 1836 2112 ffxxxxf.exe 42 PID 2112 wrote to memory of 1836 2112 ffxxxxf.exe 42 PID 2112 wrote to memory of 1836 2112 ffxxxxf.exe 42 PID 2112 wrote to memory of 1836 2112 ffxxxxf.exe 42 PID 1836 wrote to memory of 1924 1836 ffrxtnb.exe 43 PID 1836 wrote to memory of 1924 1836 ffrxtnb.exe 43 PID 1836 wrote to memory of 1924 1836 ffrxtnb.exe 43 PID 1836 wrote to memory of 1924 1836 ffrxtnb.exe 43 PID 1924 wrote to memory of 2416 1924 5bbnth.exe 44 PID 1924 wrote to memory of 2416 1924 5bbnth.exe 44 PID 1924 wrote to memory of 2416 1924 5bbnth.exe 44 PID 1924 wrote to memory of 2416 1924 5bbnth.exe 44 PID 2416 wrote to memory of 1016 2416 vvjpd.exe 45 PID 2416 wrote to memory of 1016 2416 vvjpd.exe 45 PID 2416 wrote to memory of 1016 2416 vvjpd.exe 45 PID 2416 wrote to memory of 1016 2416 vvjpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f387a1ef45a32c9ce8f728693013ad994880608c37892e31df7c0adf1baeb9f0.exe"C:\Users\Admin\AppData\Local\Temp\f387a1ef45a32c9ce8f728693013ad994880608c37892e31df7c0adf1baeb9f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\rlfrxxf.exec:\rlfrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\1bnnbb.exec:\1bnnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rlllfxl.exec:\rlllfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\llxfrxf.exec:\llxfrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\tbnthh.exec:\tbnthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\ppjvd.exec:\ppjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\jdvvd.exec:\jdvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\5lflxff.exec:\5lflxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\1httbh.exec:\1httbh.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ntnntt.exec:\ntnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\dpvvp.exec:\dpvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\ffxxxxf.exec:\ffxxxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\ffrxtnb.exec:\ffrxtnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\5bbnth.exec:\5bbnth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\vvjpd.exec:\vvjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\3vpvj.exec:\3vpvj.exe17⤵
- Executes dropped EXE
PID:1016 -
\??\c:\llfrffr.exec:\llfrffr.exe18⤵
- Executes dropped EXE
PID:1884 -
\??\c:\ntnbtb.exec:\ntnbtb.exe19⤵
- Executes dropped EXE
PID:804 -
\??\c:\dvjvd.exec:\dvjvd.exe20⤵
- Executes dropped EXE
PID:1684 -
\??\c:\3ddpv.exec:\3ddpv.exe21⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rrxlrlx.exec:\rrxlrlx.exe22⤵
- Executes dropped EXE
PID:484 -
\??\c:\lrxfrfx.exec:\lrxfrfx.exe23⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hhhhtt.exec:\hhhhtt.exe24⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pppdp.exec:\pppdp.exe25⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jjdpj.exec:\jjdpj.exe26⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rrffrxf.exec:\rrffrxf.exe27⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bbtbhn.exec:\bbtbhn.exe28⤵
- Executes dropped EXE
PID:1896 -
\??\c:\7dppv.exec:\7dppv.exe29⤵
- Executes dropped EXE
PID:680 -
\??\c:\vpdpj.exec:\vpdpj.exe30⤵
- Executes dropped EXE
PID:2524 -
\??\c:\3rflrxf.exec:\3rflrxf.exe31⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nttbnt.exec:\nttbnt.exe32⤵
- Executes dropped EXE
PID:2376 -
\??\c:\5thntn.exec:\5thntn.exe33⤵
- Executes dropped EXE
PID:352 -
\??\c:\9vjjd.exec:\9vjjd.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xrxlxfr.exec:\xrxlxfr.exe35⤵
- Executes dropped EXE
PID:2500 -
\??\c:\9hthnb.exec:\9hthnb.exe36⤵
- Executes dropped EXE
PID:2948 -
\??\c:\tttbhn.exec:\tttbhn.exe37⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vjvjp.exec:\vjvjp.exe38⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe39⤵
- Executes dropped EXE
PID:2160 -
\??\c:\bbhhhn.exec:\bbhhhn.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hnhhtt.exec:\hnhhtt.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\pvjpv.exec:\pvjpv.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7fxlllx.exec:\7fxlllx.exe43⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lfrffrf.exec:\lfrffrf.exe44⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9hhntb.exec:\9hhntb.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\hhnbnb.exec:\hhnbnb.exe46⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jjvvj.exec:\jjvvj.exe47⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lrxlflx.exec:\lrxlflx.exe48⤵
- Executes dropped EXE
PID:2828 -
\??\c:\1rlrxxf.exec:\1rlrxxf.exe49⤵
- Executes dropped EXE
PID:2536 -
\??\c:\1bbhbh.exec:\1bbhbh.exe50⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7hntbb.exec:\7hntbb.exe51⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jjddj.exec:\jjddj.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\pvjjv.exec:\pvjjv.exe53⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rrffllr.exec:\rrffllr.exe54⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe55⤵
- Executes dropped EXE
PID:1892 -
\??\c:\bhbhtt.exec:\bhbhtt.exe56⤵
- Executes dropped EXE
PID:1888 -
\??\c:\nnthnt.exec:\nnthnt.exe57⤵
- Executes dropped EXE
PID:1560 -
\??\c:\ddjdd.exec:\ddjdd.exe58⤵
- Executes dropped EXE
PID:2876 -
\??\c:\9xxfffl.exec:\9xxfffl.exe59⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rrxxfrx.exec:\rrxxfrx.exe60⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nhnbhn.exec:\nhnbhn.exe61⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1btbbh.exec:\1btbbh.exe62⤵
- Executes dropped EXE
PID:1612 -
\??\c:\djdjv.exec:\djdjv.exe63⤵
- Executes dropped EXE
PID:632 -
\??\c:\llrrfxf.exec:\llrrfxf.exe64⤵
- Executes dropped EXE
PID:1732 -
\??\c:\flrxffl.exec:\flrxffl.exe65⤵
- Executes dropped EXE
PID:1260 -
\??\c:\bhbhnh.exec:\bhbhnh.exe66⤵PID:1012
-
\??\c:\bbnnnt.exec:\bbnnnt.exe67⤵PID:2168
-
\??\c:\jjvvj.exec:\jjvvj.exe68⤵PID:1204
-
\??\c:\5vdjv.exec:\5vdjv.exe69⤵PID:1592
-
\??\c:\ffxxrrf.exec:\ffxxrrf.exe70⤵PID:1680
-
\??\c:\xxxxlll.exec:\xxxxlll.exe71⤵PID:1400
-
\??\c:\tbhnbh.exec:\tbhnbh.exe72⤵PID:2236
-
\??\c:\hntbhh.exec:\hntbhh.exe73⤵PID:2088
-
\??\c:\ppjpv.exec:\ppjpv.exe74⤵PID:2800
-
\??\c:\1lxllrf.exec:\1lxllrf.exe75⤵PID:2348
-
\??\c:\1fxxxxx.exec:\1fxxxxx.exe76⤵PID:112
-
\??\c:\3lxfffl.exec:\3lxfffl.exe77⤵PID:2144
-
\??\c:\bhbbnb.exec:\bhbbnb.exe78⤵PID:3048
-
\??\c:\ttnthn.exec:\ttnthn.exe79⤵PID:1988
-
\??\c:\jppvj.exec:\jppvj.exe80⤵PID:1628
-
\??\c:\ffxflff.exec:\ffxflff.exe81⤵PID:2660
-
\??\c:\rrlrfxl.exec:\rrlrfxl.exe82⤵PID:2544
-
\??\c:\rxlfxxl.exec:\rxlfxxl.exe83⤵PID:2684
-
\??\c:\3bbhth.exec:\3bbhth.exe84⤵PID:2784
-
\??\c:\ddppv.exec:\ddppv.exe85⤵PID:2728
-
\??\c:\jpdpp.exec:\jpdpp.exe86⤵PID:2856
-
\??\c:\xfllxrx.exec:\xfllxrx.exe87⤵PID:2860
-
\??\c:\llffrrl.exec:\llffrrl.exe88⤵PID:2600
-
\??\c:\7ttbhn.exec:\7ttbhn.exe89⤵PID:2744
-
\??\c:\7hnthh.exec:\7hnthh.exe90⤵PID:2824
-
\??\c:\jvdjp.exec:\jvdjp.exe91⤵PID:2652
-
\??\c:\vvpdj.exec:\vvpdj.exe92⤵PID:2696
-
\??\c:\1xxlxfx.exec:\1xxlxfx.exe93⤵PID:3012
-
\??\c:\hhtbnt.exec:\hhtbnt.exe94⤵PID:1764
-
\??\c:\ttbbbb.exec:\ttbbbb.exe95⤵PID:1868
-
\??\c:\djdpv.exec:\djdpv.exe96⤵PID:1348
-
\??\c:\1dpdj.exec:\1dpdj.exe97⤵PID:1708
-
\??\c:\rrrxrff.exec:\rrrxrff.exe98⤵PID:372
-
\??\c:\1frlfrx.exec:\1frlfrx.exe99⤵PID:844
-
\??\c:\bbnbhh.exec:\bbnbhh.exe100⤵PID:2120
-
\??\c:\djdvd.exec:\djdvd.exe101⤵PID:1916
-
\??\c:\pvvdv.exec:\pvvdv.exe102⤵PID:1884
-
\??\c:\rrfrlfl.exec:\rrfrlfl.exe103⤵PID:1420
-
\??\c:\tthtth.exec:\tthtth.exe104⤵PID:1176
-
\??\c:\hhttbb.exec:\hhttbb.exe105⤵PID:812
-
\??\c:\1jjvj.exec:\1jjvj.exe106⤵PID:1392
-
\??\c:\vdvpv.exec:\vdvpv.exe107⤵PID:2456
-
\??\c:\xxlllxr.exec:\xxlllxr.exe108⤵PID:1768
-
\??\c:\hnbnbb.exec:\hnbnbb.exe109⤵PID:2920
-
\??\c:\9jvvp.exec:\9jvvp.exe110⤵PID:3052
-
\??\c:\5ppjv.exec:\5ppjv.exe111⤵PID:1524
-
\??\c:\3rllrlr.exec:\3rllrlr.exe112⤵PID:1460
-
\??\c:\frxfffl.exec:\frxfffl.exe113⤵PID:1596
-
\??\c:\tbbbnn.exec:\tbbbnn.exe114⤵PID:592
-
\??\c:\7vpvj.exec:\7vpvj.exe115⤵PID:2424
-
\??\c:\vjjvv.exec:\vjjvv.exe116⤵PID:1400
-
\??\c:\lrlxlxl.exec:\lrlxlxl.exe117⤵PID:1976
-
\??\c:\bbnhtb.exec:\bbnhtb.exe118⤵PID:1676
-
\??\c:\ppddd.exec:\ppddd.exe119⤵PID:760
-
\??\c:\ddvdp.exec:\ddvdp.exe120⤵PID:112
-
\??\c:\3rlflll.exec:\3rlflll.exe121⤵PID:2340
-
\??\c:\thnhbt.exec:\thnhbt.exe122⤵PID:2288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-