Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 05:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c254b0af9e560474174484dc4b994fb9b8ff9f1f96cab130826a88b2ee4978cf.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
c254b0af9e560474174484dc4b994fb9b8ff9f1f96cab130826a88b2ee4978cf.exe
-
Size
80KB
-
MD5
5c5fde1216ab23c239931ce764ce2f26
-
SHA1
1caaad56944bdb6d603c6664b02a0fbdde78b2ee
-
SHA256
c254b0af9e560474174484dc4b994fb9b8ff9f1f96cab130826a88b2ee4978cf
-
SHA512
162062dfb7d3f11942f8aec171c3be9088c9002841a8366dca2ebe93c2e153f79bbe5935949877ec25d0557bf21613a93ba47790962a6ed3ac2b5396f2ed16e5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlSVeAD:ymb3NkkiQ3mdBjFoLucjDNVD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2348-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-38-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/316-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/688-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2528 7ttnhh.exe 2524 jvvvp.exe 2920 vdppj.exe 2040 rfrlrff.exe 2832 frxxrll.exe 2420 pvddd.exe 2904 pvjdv.exe 2924 frxrrrl.exe 2680 thttnb.exe 2328 vpdvd.exe 316 9dpvd.exe 2692 lxlxrlr.exe 2500 flrrrll.exe 1448 nbbtbb.exe 772 5thhnn.exe 1100 7vjdd.exe 1744 1xrfxrr.exe 3056 rlxfrlr.exe 3040 5rfrlfx.exe 2076 hthhnt.exe 2364 bnbntn.exe 608 7vvvj.exe 2940 vjpjj.exe 1284 rxfxfxx.exe 1428 rfxxxrr.exe 688 9tthht.exe 1676 bnnhht.exe 2360 9pdpp.exe 1960 9vppj.exe 2348 xrlllfl.exe 2088 3lffxrx.exe 2028 hnnnhb.exe 848 jjvvv.exe 1200 dppjp.exe 2228 pvvvv.exe 2040 lrfxxrr.exe 2896 5lrlxrx.exe 2024 frxxfrx.exe 2728 htnntn.exe 2908 bhtnnh.exe 2660 bthhnt.exe 2624 3jjjd.exe 3064 3djpp.exe 2068 frrlllf.exe 820 rflfxxx.exe 2000 1lxxrlx.exe 2948 nbbbhh.exe 1668 bnthnh.exe 1992 jvdjj.exe 1560 pdpjj.exe 1116 9fllffl.exe 2944 xrxrrll.exe 1144 htbbhh.exe 1744 htbtbh.exe 3048 pdppv.exe 2108 dpppp.exe 1616 lrxllff.exe 2588 lfxfllx.exe 2256 3xrxfxr.exe 2992 htbhhh.exe 1988 pjvdv.exe 2216 frfxlff.exe 564 xllxxlf.exe 2280 thbhnn.exe -
resource yara_rule behavioral1/memory/2348-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/688-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2528 2348 c254b0af9e560474174484dc4b994fb9b8ff9f1f96cab130826a88b2ee4978cf.exe 30 PID 2348 wrote to memory of 2528 2348 c254b0af9e560474174484dc4b994fb9b8ff9f1f96cab130826a88b2ee4978cf.exe 30 PID 2348 wrote to memory of 2528 2348 c254b0af9e560474174484dc4b994fb9b8ff9f1f96cab130826a88b2ee4978cf.exe 30 PID 2348 wrote to memory of 2528 2348 c254b0af9e560474174484dc4b994fb9b8ff9f1f96cab130826a88b2ee4978cf.exe 30 PID 2528 wrote to memory of 2524 2528 7ttnhh.exe 31 PID 2528 wrote to memory of 2524 2528 7ttnhh.exe 31 PID 2528 wrote to memory of 2524 2528 7ttnhh.exe 31 PID 2528 wrote to memory of 2524 2528 7ttnhh.exe 31 PID 2524 wrote to memory of 2920 2524 jvvvp.exe 32 PID 2524 wrote to memory of 2920 2524 jvvvp.exe 32 PID 2524 wrote to memory of 2920 2524 jvvvp.exe 32 PID 2524 wrote to memory of 2920 2524 jvvvp.exe 32 PID 2920 wrote to memory of 2040 2920 vdppj.exe 33 PID 2920 wrote to memory of 2040 2920 vdppj.exe 33 PID 2920 wrote to memory of 2040 2920 vdppj.exe 33 PID 2920 wrote to memory of 2040 2920 vdppj.exe 33 PID 2040 wrote to memory of 2832 2040 rfrlrff.exe 34 PID 2040 wrote to memory of 2832 2040 rfrlrff.exe 34 PID 2040 wrote to memory of 2832 2040 rfrlrff.exe 34 PID 2040 wrote to memory of 2832 2040 rfrlrff.exe 34 PID 2832 wrote to memory of 2420 2832 frxxrll.exe 35 PID 2832 wrote to memory of 2420 2832 frxxrll.exe 35 PID 2832 wrote to memory of 2420 2832 frxxrll.exe 35 PID 2832 wrote to memory of 2420 2832 frxxrll.exe 35 PID 2420 wrote to memory of 2904 2420 pvddd.exe 36 PID 2420 wrote to memory of 2904 2420 pvddd.exe 36 PID 2420 wrote to memory of 2904 2420 pvddd.exe 36 PID 2420 wrote to memory of 2904 2420 pvddd.exe 36 PID 2904 wrote to memory of 2924 2904 pvjdv.exe 37 PID 2904 wrote to memory of 2924 2904 pvjdv.exe 37 PID 2904 wrote to memory of 2924 2904 pvjdv.exe 37 PID 2904 wrote to memory of 2924 2904 pvjdv.exe 37 PID 2924 wrote to memory of 2680 2924 frxrrrl.exe 38 PID 2924 wrote to memory of 2680 2924 frxrrrl.exe 38 PID 2924 wrote to memory of 2680 2924 frxrrrl.exe 38 PID 2924 wrote to memory of 2680 2924 frxrrrl.exe 38 PID 2680 wrote to memory of 2328 2680 thttnb.exe 39 PID 2680 wrote to memory of 2328 2680 thttnb.exe 39 PID 2680 wrote to memory of 2328 2680 thttnb.exe 39 PID 2680 wrote to memory of 2328 2680 thttnb.exe 39 PID 2328 wrote to memory of 316 2328 vpdvd.exe 40 PID 2328 wrote to memory of 316 2328 vpdvd.exe 40 PID 2328 wrote to memory of 316 2328 vpdvd.exe 40 PID 2328 wrote to memory of 316 2328 vpdvd.exe 40 PID 316 wrote to memory of 2692 316 9dpvd.exe 41 PID 316 wrote to memory of 2692 316 9dpvd.exe 41 PID 316 wrote to memory of 2692 316 9dpvd.exe 41 PID 316 wrote to memory of 2692 316 9dpvd.exe 41 PID 2692 wrote to memory of 2500 2692 lxlxrlr.exe 42 PID 2692 wrote to memory of 2500 2692 lxlxrlr.exe 42 PID 2692 wrote to memory of 2500 2692 lxlxrlr.exe 42 PID 2692 wrote to memory of 2500 2692 lxlxrlr.exe 42 PID 2500 wrote to memory of 1448 2500 flrrrll.exe 43 PID 2500 wrote to memory of 1448 2500 flrrrll.exe 43 PID 2500 wrote to memory of 1448 2500 flrrrll.exe 43 PID 2500 wrote to memory of 1448 2500 flrrrll.exe 43 PID 1448 wrote to memory of 772 1448 nbbtbb.exe 44 PID 1448 wrote to memory of 772 1448 nbbtbb.exe 44 PID 1448 wrote to memory of 772 1448 nbbtbb.exe 44 PID 1448 wrote to memory of 772 1448 nbbtbb.exe 44 PID 772 wrote to memory of 1100 772 5thhnn.exe 45 PID 772 wrote to memory of 1100 772 5thhnn.exe 45 PID 772 wrote to memory of 1100 772 5thhnn.exe 45 PID 772 wrote to memory of 1100 772 5thhnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c254b0af9e560474174484dc4b994fb9b8ff9f1f96cab130826a88b2ee4978cf.exe"C:\Users\Admin\AppData\Local\Temp\c254b0af9e560474174484dc4b994fb9b8ff9f1f96cab130826a88b2ee4978cf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\7ttnhh.exec:\7ttnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\jvvvp.exec:\jvvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\vdppj.exec:\vdppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rfrlrff.exec:\rfrlrff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\frxxrll.exec:\frxxrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\pvddd.exec:\pvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\pvjdv.exec:\pvjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\frxrrrl.exec:\frxrrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\thttnb.exec:\thttnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\vpdvd.exec:\vpdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\9dpvd.exec:\9dpvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\lxlxrlr.exec:\lxlxrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\flrrrll.exec:\flrrrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\nbbtbb.exec:\nbbtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\5thhnn.exec:\5thhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\7vjdd.exec:\7vjdd.exe17⤵
- Executes dropped EXE
PID:1100 -
\??\c:\1xrfxrr.exec:\1xrfxrr.exe18⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rlxfrlr.exec:\rlxfrlr.exe19⤵
- Executes dropped EXE
PID:3056 -
\??\c:\5rfrlfx.exec:\5rfrlfx.exe20⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hthhnt.exec:\hthhnt.exe21⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bnbntn.exec:\bnbntn.exe22⤵
- Executes dropped EXE
PID:2364 -
\??\c:\7vvvj.exec:\7vvvj.exe23⤵
- Executes dropped EXE
PID:608 -
\??\c:\vjpjj.exec:\vjpjj.exe24⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rxfxfxx.exec:\rxfxfxx.exe25⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rfxxxrr.exec:\rfxxxrr.exe26⤵
- Executes dropped EXE
PID:1428 -
\??\c:\9tthht.exec:\9tthht.exe27⤵
- Executes dropped EXE
PID:688 -
\??\c:\bnnhht.exec:\bnnhht.exe28⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9pdpp.exec:\9pdpp.exe29⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9vppj.exec:\9vppj.exe30⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xrlllfl.exec:\xrlllfl.exe31⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3lffxrx.exec:\3lffxrx.exe32⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hnnnhb.exec:\hnnnhb.exe33⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jjvvv.exec:\jjvvv.exe34⤵
- Executes dropped EXE
PID:848 -
\??\c:\dppjp.exec:\dppjp.exe35⤵
- Executes dropped EXE
PID:1200 -
\??\c:\pvvvv.exec:\pvvvv.exe36⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lrfxxrr.exec:\lrfxxrr.exe37⤵
- Executes dropped EXE
PID:2040 -
\??\c:\5lrlxrx.exec:\5lrlxrx.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\frxxfrx.exec:\frxxfrx.exe39⤵
- Executes dropped EXE
PID:2024 -
\??\c:\htnntn.exec:\htnntn.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bhtnnh.exec:\bhtnnh.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bthhnt.exec:\bthhnt.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3jjjd.exec:\3jjjd.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3djpp.exec:\3djpp.exe44⤵
- Executes dropped EXE
PID:3064 -
\??\c:\frrlllf.exec:\frrlllf.exe45⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rflfxxx.exec:\rflfxxx.exe46⤵
- Executes dropped EXE
PID:820 -
\??\c:\1lxxrlx.exec:\1lxxrlx.exe47⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nbbbhh.exec:\nbbbhh.exe48⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bnthnh.exec:\bnthnh.exe49⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jvdjj.exec:\jvdjj.exe50⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pdpjj.exec:\pdpjj.exe51⤵
- Executes dropped EXE
PID:1560 -
\??\c:\9fllffl.exec:\9fllffl.exe52⤵
- Executes dropped EXE
PID:1116 -
\??\c:\xrxrrll.exec:\xrxrrll.exe53⤵
- Executes dropped EXE
PID:2944 -
\??\c:\htbbhh.exec:\htbbhh.exe54⤵
- Executes dropped EXE
PID:1144 -
\??\c:\htbtbh.exec:\htbtbh.exe55⤵
- Executes dropped EXE
PID:1744 -
\??\c:\pdppv.exec:\pdppv.exe56⤵
- Executes dropped EXE
PID:3048 -
\??\c:\dpppp.exec:\dpppp.exe57⤵
- Executes dropped EXE
PID:2108 -
\??\c:\lrxllff.exec:\lrxllff.exe58⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lfxfllx.exec:\lfxfllx.exe59⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3xrxfxr.exec:\3xrxfxr.exe60⤵
- Executes dropped EXE
PID:2256 -
\??\c:\htbhhh.exec:\htbhhh.exe61⤵
- Executes dropped EXE
PID:2992 -
\??\c:\pjvdv.exec:\pjvdv.exe62⤵
- Executes dropped EXE
PID:1988 -
\??\c:\frfxlff.exec:\frfxlff.exe63⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xllxxlf.exec:\xllxxlf.exe64⤵
- Executes dropped EXE
PID:564 -
\??\c:\thbhnn.exec:\thbhnn.exe65⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bhhhbn.exec:\bhhhbn.exe66⤵PID:688
-
\??\c:\pjpdd.exec:\pjpdd.exe67⤵PID:1296
-
\??\c:\1pvvd.exec:\1pvvd.exe68⤵PID:900
-
\??\c:\rffxxfl.exec:\rffxxfl.exe69⤵PID:1724
-
\??\c:\fllflll.exec:\fllflll.exe70⤵PID:1640
-
\??\c:\1xrxlfr.exec:\1xrxlfr.exe71⤵PID:2960
-
\??\c:\bhthbt.exec:\bhthbt.exe72⤵PID:1184
-
\??\c:\nbnbnb.exec:\nbnbnb.exe73⤵PID:1644
-
\??\c:\dpjdd.exec:\dpjdd.exe74⤵PID:2192
-
\??\c:\jdppv.exec:\jdppv.exe75⤵PID:3036
-
\??\c:\3rxrxxx.exec:\3rxrxxx.exe76⤵PID:2740
-
\??\c:\xlrxflr.exec:\xlrxflr.exe77⤵PID:2880
-
\??\c:\nbnttt.exec:\nbnttt.exe78⤵PID:2752
-
\??\c:\1thnnb.exec:\1thnnb.exe79⤵PID:2760
-
\??\c:\1dddv.exec:\1dddv.exe80⤵PID:2736
-
\??\c:\jvdpp.exec:\jvdpp.exe81⤵PID:2712
-
\??\c:\lxfffff.exec:\lxfffff.exe82⤵PID:2904
-
\??\c:\rlrrxfr.exec:\rlrrxfr.exe83⤵PID:1548
-
\??\c:\rlrxxxf.exec:\rlrxxxf.exe84⤵PID:2124
-
\??\c:\nttntn.exec:\nttntn.exe85⤵PID:2680
-
\??\c:\bttbhh.exec:\bttbhh.exe86⤵PID:268
-
\??\c:\vjddv.exec:\vjddv.exe87⤵PID:1716
-
\??\c:\5pddv.exec:\5pddv.exe88⤵PID:1636
-
\??\c:\rxffxrr.exec:\rxffxrr.exe89⤵PID:2592
-
\??\c:\frxrxxx.exec:\frxrxxx.exe90⤵PID:692
-
\??\c:\bhhhbt.exec:\bhhhbt.exe91⤵PID:2844
-
\??\c:\bntnnb.exec:\bntnnb.exe92⤵PID:772
-
\??\c:\vjpjv.exec:\vjpjv.exe93⤵PID:1312
-
\??\c:\3pddd.exec:\3pddd.exe94⤵PID:1036
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe95⤵PID:1680
-
\??\c:\lrrrrlr.exec:\lrrrrlr.exe96⤵PID:2244
-
\??\c:\bnnhhb.exec:\bnnhhb.exe97⤵PID:2252
-
\??\c:\nbnnbt.exec:\nbnnbt.exe98⤵PID:2164
-
\??\c:\thhbhh.exec:\thhbhh.exe99⤵PID:924
-
\??\c:\9pdvj.exec:\9pdvj.exe100⤵PID:1180
-
\??\c:\5jpjd.exec:\5jpjd.exe101⤵PID:1232
-
\??\c:\3lrfxlr.exec:\3lrfxlr.exe102⤵PID:2940
-
\??\c:\xlffxxx.exec:\xlffxxx.exe103⤵PID:1892
-
\??\c:\lxfllll.exec:\lxfllll.exe104⤵PID:1832
-
\??\c:\9hbbhb.exec:\9hbbhb.exe105⤵PID:3008
-
\??\c:\pdvvv.exec:\pdvvv.exe106⤵PID:324
-
\??\c:\3jvvd.exec:\3jvvd.exe107⤵PID:1780
-
\??\c:\dpvvv.exec:\dpvvv.exe108⤵PID:1924
-
\??\c:\lfllllf.exec:\lfllllf.exe109⤵PID:3028
-
\??\c:\rxffxxx.exec:\rxffxxx.exe110⤵PID:2340
-
\??\c:\nbtnnh.exec:\nbtnnh.exe111⤵PID:2528
-
\??\c:\9bnttt.exec:\9bnttt.exe112⤵PID:2572
-
\??\c:\nbbnhb.exec:\nbbnhb.exe113⤵PID:2412
-
\??\c:\9vvvp.exec:\9vvvp.exe114⤵PID:1532
-
\??\c:\jvdvv.exec:\jvdvv.exe115⤵PID:2072
-
\??\c:\7lfllfl.exec:\7lfllfl.exe116⤵PID:2748
-
\??\c:\1rxrrlf.exec:\1rxrrlf.exe117⤵PID:2980
-
\??\c:\9rxxfrx.exec:\9rxxfrx.exe118⤵PID:2716
-
\??\c:\btbbtt.exec:\btbbtt.exe119⤵PID:2792
-
\??\c:\3tbbbn.exec:\3tbbbn.exe120⤵PID:2764
-
\??\c:\7hhttt.exec:\7hhttt.exe121⤵PID:2604
-
\??\c:\vjpjj.exec:\vjpjj.exe122⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-