Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 21:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c73713c04794c2ada14572eb827eb860271fd97072e2da26149adeb73f01d93.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
7c73713c04794c2ada14572eb827eb860271fd97072e2da26149adeb73f01d93.exe
-
Size
73KB
-
MD5
e4a5bd15c9cbb756785f9e65f591d4d8
-
SHA1
397859f6caaec0b042e7e090f47bbee9e2c35744
-
SHA256
7c73713c04794c2ada14572eb827eb860271fd97072e2da26149adeb73f01d93
-
SHA512
96b02efe4f239cdb198446b2bf2fb7f4c96e005d625964ec84cba507f6371b9cce67bec4b90366b0c91d75bcb1d2db614fab15f1967b941bd8f140da63f37c52
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIdiW65V:ymb3NkkiQ3mdBjFIFdJ8bViW6L
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2236-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/632-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1920 rlffllx.exe 3028 nbbbht.exe 2812 dvppd.exe 2760 lxfrrxl.exe 2860 5ntbbh.exe 2500 dddvv.exe 2400 7lrfrxf.exe 2620 nnbnbh.exe 2788 nbhttt.exe 2504 jvvvp.exe 632 xrxxfll.exe 1076 xflxlrl.exe 1680 tnhhtt.exe 1908 3djjp.exe 1344 rlrrxfr.exe 1696 3lflrlx.exe 2032 hbbbbh.exe 2952 5nttbn.exe 2200 3dvdj.exe 2216 flfflrf.exe 764 rlxrrlr.exe 1068 nhbhtt.exe 1536 vdppp.exe 1052 5dpdd.exe 548 xlxlrlr.exe 2584 7thttt.exe 580 dpdpd.exe 2020 fxrfrxl.exe 2284 bthnbb.exe 2532 nhtthh.exe 1576 jpjjv.exe 3024 llfxxfl.exe 2136 7lffxxl.exe 2156 thtbhb.exe 2748 ddvvp.exe 488 7rflrrx.exe 2496 7bnbhh.exe 2740 nbhhtt.exe 2896 pvddd.exe 2888 lflrffl.exe 3060 tnbttb.exe 2644 nhhnbb.exe 2840 pjdjd.exe 2412 ddpdv.exe 2152 lfrllll.exe 1556 hntbbb.exe 1924 tnthhh.exe 1932 dpvpv.exe 2512 pjvpv.exe 1908 rxffffx.exe 1688 tthnnt.exe 296 bnnbbt.exe 2808 vdpvp.exe 472 vvdjd.exe 2956 lrfrrlr.exe 2200 fxffxxf.exe 2996 nbhntb.exe 2264 hnnbth.exe 696 pdvpd.exe 1536 jpjpj.exe 2084 rfrfxfr.exe 688 rffflff.exe 2388 ththbt.exe 2764 pvjpj.exe -
resource yara_rule behavioral1/memory/2236-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-308-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1920 2236 7c73713c04794c2ada14572eb827eb860271fd97072e2da26149adeb73f01d93.exe 30 PID 2236 wrote to memory of 1920 2236 7c73713c04794c2ada14572eb827eb860271fd97072e2da26149adeb73f01d93.exe 30 PID 2236 wrote to memory of 1920 2236 7c73713c04794c2ada14572eb827eb860271fd97072e2da26149adeb73f01d93.exe 30 PID 2236 wrote to memory of 1920 2236 7c73713c04794c2ada14572eb827eb860271fd97072e2da26149adeb73f01d93.exe 30 PID 1920 wrote to memory of 3028 1920 rlffllx.exe 31 PID 1920 wrote to memory of 3028 1920 rlffllx.exe 31 PID 1920 wrote to memory of 3028 1920 rlffllx.exe 31 PID 1920 wrote to memory of 3028 1920 rlffllx.exe 31 PID 3028 wrote to memory of 2812 3028 nbbbht.exe 32 PID 3028 wrote to memory of 2812 3028 nbbbht.exe 32 PID 3028 wrote to memory of 2812 3028 nbbbht.exe 32 PID 3028 wrote to memory of 2812 3028 nbbbht.exe 32 PID 2812 wrote to memory of 2760 2812 dvppd.exe 33 PID 2812 wrote to memory of 2760 2812 dvppd.exe 33 PID 2812 wrote to memory of 2760 2812 dvppd.exe 33 PID 2812 wrote to memory of 2760 2812 dvppd.exe 33 PID 2760 wrote to memory of 2860 2760 lxfrrxl.exe 34 PID 2760 wrote to memory of 2860 2760 lxfrrxl.exe 34 PID 2760 wrote to memory of 2860 2760 lxfrrxl.exe 34 PID 2760 wrote to memory of 2860 2760 lxfrrxl.exe 34 PID 2860 wrote to memory of 2500 2860 5ntbbh.exe 35 PID 2860 wrote to memory of 2500 2860 5ntbbh.exe 35 PID 2860 wrote to memory of 2500 2860 5ntbbh.exe 35 PID 2860 wrote to memory of 2500 2860 5ntbbh.exe 35 PID 2500 wrote to memory of 2400 2500 dddvv.exe 36 PID 2500 wrote to memory of 2400 2500 dddvv.exe 36 PID 2500 wrote to memory of 2400 2500 dddvv.exe 36 PID 2500 wrote to memory of 2400 2500 dddvv.exe 36 PID 2400 wrote to memory of 2620 2400 7lrfrxf.exe 37 PID 2400 wrote to memory of 2620 2400 7lrfrxf.exe 37 PID 2400 wrote to memory of 2620 2400 7lrfrxf.exe 37 PID 2400 wrote to memory of 2620 2400 7lrfrxf.exe 37 PID 2620 wrote to memory of 2788 2620 nnbnbh.exe 38 PID 2620 wrote to memory of 2788 2620 nnbnbh.exe 38 PID 2620 wrote to memory of 2788 2620 nnbnbh.exe 38 PID 2620 wrote to memory of 2788 2620 nnbnbh.exe 38 PID 2788 wrote to memory of 2504 2788 nbhttt.exe 39 PID 2788 wrote to memory of 2504 2788 nbhttt.exe 39 PID 2788 wrote to memory of 2504 2788 nbhttt.exe 39 PID 2788 wrote to memory of 2504 2788 nbhttt.exe 39 PID 2504 wrote to memory of 632 2504 jvvvp.exe 40 PID 2504 wrote to memory of 632 2504 jvvvp.exe 40 PID 2504 wrote to memory of 632 2504 jvvvp.exe 40 PID 2504 wrote to memory of 632 2504 jvvvp.exe 40 PID 632 wrote to memory of 1076 632 xrxxfll.exe 41 PID 632 wrote to memory of 1076 632 xrxxfll.exe 41 PID 632 wrote to memory of 1076 632 xrxxfll.exe 41 PID 632 wrote to memory of 1076 632 xrxxfll.exe 41 PID 1076 wrote to memory of 1680 1076 xflxlrl.exe 42 PID 1076 wrote to memory of 1680 1076 xflxlrl.exe 42 PID 1076 wrote to memory of 1680 1076 xflxlrl.exe 42 PID 1076 wrote to memory of 1680 1076 xflxlrl.exe 42 PID 1680 wrote to memory of 1908 1680 tnhhtt.exe 43 PID 1680 wrote to memory of 1908 1680 tnhhtt.exe 43 PID 1680 wrote to memory of 1908 1680 tnhhtt.exe 43 PID 1680 wrote to memory of 1908 1680 tnhhtt.exe 43 PID 1908 wrote to memory of 1344 1908 3djjp.exe 44 PID 1908 wrote to memory of 1344 1908 3djjp.exe 44 PID 1908 wrote to memory of 1344 1908 3djjp.exe 44 PID 1908 wrote to memory of 1344 1908 3djjp.exe 44 PID 1344 wrote to memory of 1696 1344 rlrrxfr.exe 45 PID 1344 wrote to memory of 1696 1344 rlrrxfr.exe 45 PID 1344 wrote to memory of 1696 1344 rlrrxfr.exe 45 PID 1344 wrote to memory of 1696 1344 rlrrxfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c73713c04794c2ada14572eb827eb860271fd97072e2da26149adeb73f01d93.exe"C:\Users\Admin\AppData\Local\Temp\7c73713c04794c2ada14572eb827eb860271fd97072e2da26149adeb73f01d93.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\rlffllx.exec:\rlffllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\nbbbht.exec:\nbbbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\dvppd.exec:\dvppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lxfrrxl.exec:\lxfrrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\5ntbbh.exec:\5ntbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\dddvv.exec:\dddvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\7lrfrxf.exec:\7lrfrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\nnbnbh.exec:\nnbnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\nbhttt.exec:\nbhttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jvvvp.exec:\jvvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xrxxfll.exec:\xrxxfll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\xflxlrl.exec:\xflxlrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\tnhhtt.exec:\tnhhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\3djjp.exec:\3djjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\rlrrxfr.exec:\rlrrxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\3lflrlx.exec:\3lflrlx.exe17⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hbbbbh.exec:\hbbbbh.exe18⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5nttbn.exec:\5nttbn.exe19⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3dvdj.exec:\3dvdj.exe20⤵
- Executes dropped EXE
PID:2200 -
\??\c:\flfflrf.exec:\flfflrf.exe21⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rlxrrlr.exec:\rlxrrlr.exe22⤵
- Executes dropped EXE
PID:764 -
\??\c:\nhbhtt.exec:\nhbhtt.exe23⤵
- Executes dropped EXE
PID:1068 -
\??\c:\vdppp.exec:\vdppp.exe24⤵
- Executes dropped EXE
PID:1536 -
\??\c:\5dpdd.exec:\5dpdd.exe25⤵
- Executes dropped EXE
PID:1052 -
\??\c:\xlxlrlr.exec:\xlxlrlr.exe26⤵
- Executes dropped EXE
PID:548 -
\??\c:\7thttt.exec:\7thttt.exe27⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dpdpd.exec:\dpdpd.exe28⤵
- Executes dropped EXE
PID:580 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe29⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bthnbb.exec:\bthnbb.exe30⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nhtthh.exec:\nhtthh.exe31⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jpjjv.exec:\jpjjv.exe32⤵
- Executes dropped EXE
PID:1576 -
\??\c:\llfxxfl.exec:\llfxxfl.exe33⤵
- Executes dropped EXE
PID:3024 -
\??\c:\7lffxxl.exec:\7lffxxl.exe34⤵
- Executes dropped EXE
PID:2136 -
\??\c:\thtbhb.exec:\thtbhb.exe35⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ddvvp.exec:\ddvvp.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7rflrrx.exec:\7rflrrx.exe37⤵
- Executes dropped EXE
PID:488 -
\??\c:\7bnbhh.exec:\7bnbhh.exe38⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nbhhtt.exec:\nbhhtt.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pvddd.exec:\pvddd.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lflrffl.exec:\lflrffl.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tnbttb.exec:\tnbttb.exe42⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nhhnbb.exec:\nhhnbb.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pjdjd.exec:\pjdjd.exe44⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ddpdv.exec:\ddpdv.exe45⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lfrllll.exec:\lfrllll.exe46⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hntbbb.exec:\hntbbb.exe47⤵
- Executes dropped EXE
PID:1556 -
\??\c:\tnthhh.exec:\tnthhh.exe48⤵
- Executes dropped EXE
PID:1924 -
\??\c:\dpvpv.exec:\dpvpv.exe49⤵
- Executes dropped EXE
PID:1932 -
\??\c:\pjvpv.exec:\pjvpv.exe50⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rxffffx.exec:\rxffffx.exe51⤵
- Executes dropped EXE
PID:1908 -
\??\c:\tthnnt.exec:\tthnnt.exe52⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bnnbbt.exec:\bnnbbt.exe53⤵
- Executes dropped EXE
PID:296 -
\??\c:\vdpvp.exec:\vdpvp.exe54⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vvdjd.exec:\vvdjd.exe55⤵
- Executes dropped EXE
PID:472 -
\??\c:\lrfrrlr.exec:\lrfrrlr.exe56⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fxffxxf.exec:\fxffxxf.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nbhntb.exec:\nbhntb.exe58⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hnnbth.exec:\hnnbth.exe59⤵
- Executes dropped EXE
PID:2264 -
\??\c:\pdvpd.exec:\pdvpd.exe60⤵
- Executes dropped EXE
PID:696 -
\??\c:\jpjpj.exec:\jpjpj.exe61⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rfrfxfr.exec:\rfrfxfr.exe62⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rffflff.exec:\rffflff.exe63⤵
- Executes dropped EXE
PID:688 -
\??\c:\ththbt.exec:\ththbt.exe64⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pvjpj.exec:\pvjpj.exe65⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dpppp.exec:\dpppp.exe66⤵PID:580
-
\??\c:\1lrlfxf.exec:\1lrlfxf.exe67⤵PID:1632
-
\??\c:\rflrrxx.exec:\rflrrxx.exe68⤵PID:1904
-
\??\c:\3ttntt.exec:\3ttntt.exe69⤵PID:1664
-
\??\c:\5tnttt.exec:\5tnttt.exe70⤵PID:2532
-
\??\c:\vpdpv.exec:\vpdpv.exe71⤵PID:2148
-
\??\c:\dvdjv.exec:\dvdjv.exe72⤵PID:2068
-
\??\c:\rrrfxlx.exec:\rrrfxlx.exe73⤵PID:2112
-
\??\c:\nhbhtt.exec:\nhbhtt.exe74⤵PID:2436
-
\??\c:\3bbtbh.exec:\3bbtbh.exe75⤵PID:2824
-
\??\c:\jvvjd.exec:\jvvjd.exe76⤵PID:2992
-
\??\c:\7flrxxf.exec:\7flrxxf.exe77⤵PID:2848
-
\??\c:\xrfxflr.exec:\xrfxflr.exe78⤵PID:2640
-
\??\c:\btthtt.exec:\btthtt.exe79⤵PID:2932
-
\??\c:\jvjjp.exec:\jvjjp.exe80⤵PID:2752
-
\??\c:\vdpjv.exec:\vdpjv.exe81⤵PID:2668
-
\??\c:\rrlxfxf.exec:\rrlxfxf.exe82⤵PID:2852
-
\??\c:\5lxfffr.exec:\5lxfffr.exe83⤵PID:2688
-
\??\c:\3tnnbb.exec:\3tnnbb.exe84⤵PID:1756
-
\??\c:\hhtbtb.exec:\hhtbtb.exe85⤵PID:1108
-
\??\c:\ddjjj.exec:\ddjjj.exe86⤵PID:632
-
\??\c:\pjvvp.exec:\pjvvp.exe87⤵PID:1712
-
\??\c:\rxflxxf.exec:\rxflxxf.exe88⤵PID:2448
-
\??\c:\rlrrffl.exec:\rlrrffl.exe89⤵PID:1636
-
\??\c:\hthhnt.exec:\hthhnt.exe90⤵PID:836
-
\??\c:\vvdvd.exec:\vvdvd.exe91⤵PID:1588
-
\??\c:\vvdpv.exec:\vvdpv.exe92⤵PID:1604
-
\??\c:\lrxlfll.exec:\lrxlfll.exe93⤵PID:2880
-
\??\c:\1xlrrlr.exec:\1xlrrlr.exe94⤵PID:2924
-
\??\c:\nbnnth.exec:\nbnnth.exe95⤵PID:2140
-
\??\c:\nbbhbt.exec:\nbbhbt.exe96⤵PID:1804
-
\??\c:\dpdjv.exec:\dpdjv.exe97⤵PID:776
-
\??\c:\9fxflxf.exec:\9fxflxf.exe98⤵PID:2944
-
\??\c:\xrfrfxl.exec:\xrfrfxl.exe99⤵PID:2524
-
\??\c:\3hbtth.exec:\3hbtth.exe100⤵PID:988
-
\??\c:\5nbhnn.exec:\5nbhnn.exe101⤵PID:2224
-
\??\c:\dppjp.exec:\dppjp.exe102⤵PID:2520
-
\??\c:\xfrrxrf.exec:\xfrrxrf.exe103⤵PID:1840
-
\??\c:\rfrxxxx.exec:\rfrxxxx.exe104⤵PID:1432
-
\??\c:\5hnthb.exec:\5hnthb.exe105⤵PID:1992
-
\??\c:\3hthhh.exec:\3hthhh.exe106⤵PID:2364
-
\??\c:\pddjp.exec:\pddjp.exe107⤵PID:2548
-
\??\c:\3rxrrfr.exec:\3rxrrfr.exe108⤵PID:1552
-
\??\c:\rlxxffr.exec:\rlxxffr.exe109⤵PID:2540
-
\??\c:\lflfllx.exec:\lflfllx.exe110⤵PID:1576
-
\??\c:\tbbnhb.exec:\tbbnhb.exe111⤵PID:3028
-
\??\c:\5xxflrx.exec:\5xxflrx.exe112⤵PID:1156
-
\??\c:\9rlxffr.exec:\9rlxffr.exe113⤵PID:2768
-
\??\c:\nhbhhh.exec:\nhbhhh.exe114⤵PID:2760
-
\??\c:\djjpj.exec:\djjpj.exe115⤵PID:2828
-
\??\c:\jdvdj.exec:\jdvdj.exe116⤵PID:2716
-
\??\c:\xxxrlxl.exec:\xxxrlxl.exe117⤵PID:2500
-
\??\c:\thtbhb.exec:\thtbhb.exe118⤵PID:2876
-
\??\c:\7hhbtb.exec:\7hhbtb.exe119⤵PID:2636
-
\??\c:\5jdjv.exec:\5jdjv.exe120⤵PID:3068
-
\??\c:\dvjjp.exec:\dvjjp.exe121⤵PID:1436
-
\??\c:\xxxllll.exec:\xxxllll.exe122⤵PID:1916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-