Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01-08-2024 21:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
218c8ebbbc8234b792ec258eee5b906d99009afe7a68976fb8ec0bf5b0236584.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
218c8ebbbc8234b792ec258eee5b906d99009afe7a68976fb8ec0bf5b0236584.exe
-
Size
79KB
-
MD5
9563f065ecced5a7df8053686788e26b
-
SHA1
7aba468d37390a2501d1453034be9da49b892a6e
-
SHA256
218c8ebbbc8234b792ec258eee5b906d99009afe7a68976fb8ec0bf5b0236584
-
SHA512
be5c88e29385a2b8faa6241fc86eb512019b980fc99c813d77859e1e1c0691981367e8d9ce4deea690950fdff1670cd0e02011b084adbaaea034924262ad3d5b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLU1gxmcK8n/8:ymb3NkkiQ3mdBjFoLkmW8nE
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2852-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/928-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-281-0x00000000776E0000-0x00000000777FF000-memory.dmp family_blackmoon behavioral1/memory/1936-2475-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2732 3xflrfl.exe 2644 5dddv.exe 2776 xrllrlr.exe 2640 rrlrxfr.exe 1936 hbntbt.exe 264 bttbbh.exe 928 jvjjv.exe 1816 jdvvj.exe 2208 5frrrrx.exe 2536 nbhnbh.exe 2808 dpvvv.exe 1520 jdppp.exe 1388 9lrlrrx.exe 1940 rfrxrxf.exe 2984 bthntn.exe 1652 ddpjp.exe 1772 pjvdj.exe 3032 lxrrrxf.exe 2196 tttthn.exe 2228 thtthb.exe 1676 pjddp.exe 376 jdjdd.exe 2064 xrflrrr.exe 1976 nbntbt.exe 1952 hbnhth.exe 1296 vpvdj.exe 816 1vpjj.exe 1192 flffffl.exe 2736 tnbbht.exe 1716 vjdjp.exe 2832 lfxxxrx.exe 2336 dvdvv.exe 2656 dvdvj.exe 2672 lffxrrr.exe 2340 5rflxfx.exe 2660 nhtntt.exe 552 nhntbh.exe 2516 jjddj.exe 820 dvdvj.exe 1804 5jdpd.exe 2120 lxllrlr.exe 2704 rfrlffl.exe 1080 bnttbb.exe 2888 nbhbhb.exe 1508 dvjpd.exe 2028 jddvv.exe 1868 pdvvd.exe 2936 rxlxrff.exe 1540 xlxfllr.exe 1632 hthhhn.exe 2076 3hnhhb.exe 1772 9pvdp.exe 3040 pdvvd.exe 1972 9fxxxxx.exe 1228 xrxxrrr.exe 2228 tntttb.exe 1144 5tbtbh.exe 1428 nhbhbh.exe 1356 5dvdv.exe 2988 jdvdj.exe 1976 5rlllfr.exe 2240 rfrxlll.exe 336 1tnnnn.exe 2024 thhbbt.exe -
resource yara_rule behavioral1/memory/2852-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/376-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-281-0x00000000776E0000-0x00000000777FF000-memory.dmp upx behavioral1/memory/1936-2475-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2732 2852 218c8ebbbc8234b792ec258eee5b906d99009afe7a68976fb8ec0bf5b0236584.exe 30 PID 2852 wrote to memory of 2732 2852 218c8ebbbc8234b792ec258eee5b906d99009afe7a68976fb8ec0bf5b0236584.exe 30 PID 2852 wrote to memory of 2732 2852 218c8ebbbc8234b792ec258eee5b906d99009afe7a68976fb8ec0bf5b0236584.exe 30 PID 2852 wrote to memory of 2732 2852 218c8ebbbc8234b792ec258eee5b906d99009afe7a68976fb8ec0bf5b0236584.exe 30 PID 2732 wrote to memory of 2644 2732 3xflrfl.exe 31 PID 2732 wrote to memory of 2644 2732 3xflrfl.exe 31 PID 2732 wrote to memory of 2644 2732 3xflrfl.exe 31 PID 2732 wrote to memory of 2644 2732 3xflrfl.exe 31 PID 2644 wrote to memory of 2776 2644 5dddv.exe 32 PID 2644 wrote to memory of 2776 2644 5dddv.exe 32 PID 2644 wrote to memory of 2776 2644 5dddv.exe 32 PID 2644 wrote to memory of 2776 2644 5dddv.exe 32 PID 2776 wrote to memory of 2640 2776 xrllrlr.exe 33 PID 2776 wrote to memory of 2640 2776 xrllrlr.exe 33 PID 2776 wrote to memory of 2640 2776 xrllrlr.exe 33 PID 2776 wrote to memory of 2640 2776 xrllrlr.exe 33 PID 2640 wrote to memory of 1936 2640 rrlrxfr.exe 34 PID 2640 wrote to memory of 1936 2640 rrlrxfr.exe 34 PID 2640 wrote to memory of 1936 2640 rrlrxfr.exe 34 PID 2640 wrote to memory of 1936 2640 rrlrxfr.exe 34 PID 1936 wrote to memory of 264 1936 hbntbt.exe 35 PID 1936 wrote to memory of 264 1936 hbntbt.exe 35 PID 1936 wrote to memory of 264 1936 hbntbt.exe 35 PID 1936 wrote to memory of 264 1936 hbntbt.exe 35 PID 264 wrote to memory of 928 264 bttbbh.exe 36 PID 264 wrote to memory of 928 264 bttbbh.exe 36 PID 264 wrote to memory of 928 264 bttbbh.exe 36 PID 264 wrote to memory of 928 264 bttbbh.exe 36 PID 928 wrote to memory of 1816 928 jvjjv.exe 37 PID 928 wrote to memory of 1816 928 jvjjv.exe 37 PID 928 wrote to memory of 1816 928 jvjjv.exe 37 PID 928 wrote to memory of 1816 928 jvjjv.exe 37 PID 1816 wrote to memory of 2208 1816 jdvvj.exe 38 PID 1816 wrote to memory of 2208 1816 jdvvj.exe 38 PID 1816 wrote to memory of 2208 1816 jdvvj.exe 38 PID 1816 wrote to memory of 2208 1816 jdvvj.exe 38 PID 2208 wrote to memory of 2536 2208 5frrrrx.exe 39 PID 2208 wrote to memory of 2536 2208 5frrrrx.exe 39 PID 2208 wrote to memory of 2536 2208 5frrrrx.exe 39 PID 2208 wrote to memory of 2536 2208 5frrrrx.exe 39 PID 2536 wrote to memory of 2808 2536 nbhnbh.exe 40 PID 2536 wrote to memory of 2808 2536 nbhnbh.exe 40 PID 2536 wrote to memory of 2808 2536 nbhnbh.exe 40 PID 2536 wrote to memory of 2808 2536 nbhnbh.exe 40 PID 2808 wrote to memory of 1520 2808 dpvvv.exe 41 PID 2808 wrote to memory of 1520 2808 dpvvv.exe 41 PID 2808 wrote to memory of 1520 2808 dpvvv.exe 41 PID 2808 wrote to memory of 1520 2808 dpvvv.exe 41 PID 1520 wrote to memory of 1388 1520 jdppp.exe 42 PID 1520 wrote to memory of 1388 1520 jdppp.exe 42 PID 1520 wrote to memory of 1388 1520 jdppp.exe 42 PID 1520 wrote to memory of 1388 1520 jdppp.exe 42 PID 1388 wrote to memory of 1940 1388 9lrlrrx.exe 43 PID 1388 wrote to memory of 1940 1388 9lrlrrx.exe 43 PID 1388 wrote to memory of 1940 1388 9lrlrrx.exe 43 PID 1388 wrote to memory of 1940 1388 9lrlrrx.exe 43 PID 1940 wrote to memory of 2984 1940 rfrxrxf.exe 44 PID 1940 wrote to memory of 2984 1940 rfrxrxf.exe 44 PID 1940 wrote to memory of 2984 1940 rfrxrxf.exe 44 PID 1940 wrote to memory of 2984 1940 rfrxrxf.exe 44 PID 2984 wrote to memory of 1652 2984 bthntn.exe 45 PID 2984 wrote to memory of 1652 2984 bthntn.exe 45 PID 2984 wrote to memory of 1652 2984 bthntn.exe 45 PID 2984 wrote to memory of 1652 2984 bthntn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\218c8ebbbc8234b792ec258eee5b906d99009afe7a68976fb8ec0bf5b0236584.exe"C:\Users\Admin\AppData\Local\Temp\218c8ebbbc8234b792ec258eee5b906d99009afe7a68976fb8ec0bf5b0236584.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\3xflrfl.exec:\3xflrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\5dddv.exec:\5dddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\xrllrlr.exec:\xrllrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rrlrxfr.exec:\rrlrxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hbntbt.exec:\hbntbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\bttbbh.exec:\bttbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\jvjjv.exec:\jvjjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\jdvvj.exec:\jdvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\5frrrrx.exec:\5frrrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\nbhnbh.exec:\nbhnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\dpvvv.exec:\dpvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\jdppp.exec:\jdppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\9lrlrrx.exec:\9lrlrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\rfrxrxf.exec:\rfrxrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\bthntn.exec:\bthntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\ddpjp.exec:\ddpjp.exe17⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pjvdj.exec:\pjvdj.exe18⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lxrrrxf.exec:\lxrrrxf.exe19⤵
- Executes dropped EXE
PID:3032 -
\??\c:\tttthn.exec:\tttthn.exe20⤵
- Executes dropped EXE
PID:2196 -
\??\c:\thtthb.exec:\thtthb.exe21⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pjddp.exec:\pjddp.exe22⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jdjdd.exec:\jdjdd.exe23⤵
- Executes dropped EXE
PID:376 -
\??\c:\xrflrrr.exec:\xrflrrr.exe24⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nbntbt.exec:\nbntbt.exe25⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hbnhth.exec:\hbnhth.exe26⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vpvdj.exec:\vpvdj.exe27⤵
- Executes dropped EXE
PID:1296 -
\??\c:\1vpjj.exec:\1vpjj.exe28⤵
- Executes dropped EXE
PID:816 -
\??\c:\flffffl.exec:\flffffl.exe29⤵
- Executes dropped EXE
PID:1192 -
\??\c:\tnbbht.exec:\tnbbht.exe30⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vjdjp.exec:\vjdjp.exe31⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vpdjj.exec:\vpdjj.exe32⤵PID:2716
-
\??\c:\lfxxxrx.exec:\lfxxxrx.exe33⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dvdvv.exec:\dvdvv.exe34⤵
- Executes dropped EXE
PID:2336 -
\??\c:\dvdvj.exec:\dvdvj.exe35⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lffxrrr.exec:\lffxrrr.exe36⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5rflxfx.exec:\5rflxfx.exe37⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhtntt.exec:\nhtntt.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nhntbh.exec:\nhntbh.exe39⤵
- Executes dropped EXE
PID:552 -
\??\c:\jjddj.exec:\jjddj.exe40⤵
- Executes dropped EXE
PID:2516 -
\??\c:\dvdvj.exec:\dvdvj.exe41⤵
- Executes dropped EXE
PID:820 -
\??\c:\5jdpd.exec:\5jdpd.exe42⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lxllrlr.exec:\lxllrlr.exe43⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rfrlffl.exec:\rfrlffl.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bnttbb.exec:\bnttbb.exe45⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nbhbhb.exec:\nbhbhb.exe46⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dvjpd.exec:\dvjpd.exe47⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jddvv.exec:\jddvv.exe48⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pdvvd.exec:\pdvvd.exe49⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rxlxrff.exec:\rxlxrff.exe50⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xlxfllr.exec:\xlxfllr.exe51⤵
- Executes dropped EXE
PID:1540 -
\??\c:\hthhhn.exec:\hthhhn.exe52⤵
- Executes dropped EXE
PID:1632 -
\??\c:\3hnhhb.exec:\3hnhhb.exe53⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9pvdp.exec:\9pvdp.exe54⤵
- Executes dropped EXE
PID:1772 -
\??\c:\pdvvd.exec:\pdvvd.exe55⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9fxxxxx.exec:\9fxxxxx.exe56⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe57⤵
- Executes dropped EXE
PID:1228 -
\??\c:\tntttb.exec:\tntttb.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\5tbtbh.exec:\5tbtbh.exe59⤵
- Executes dropped EXE
PID:1144 -
\??\c:\nhbhbh.exec:\nhbhbh.exe60⤵
- Executes dropped EXE
PID:1428 -
\??\c:\5dvdv.exec:\5dvdv.exe61⤵
- Executes dropped EXE
PID:1356 -
\??\c:\jdvdj.exec:\jdvdj.exe62⤵
- Executes dropped EXE
PID:2988 -
\??\c:\5rlllfr.exec:\5rlllfr.exe63⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rfrxlll.exec:\rfrxlll.exe64⤵
- Executes dropped EXE
PID:2240 -
\??\c:\1tnnnn.exec:\1tnnnn.exe65⤵
- Executes dropped EXE
PID:336 -
\??\c:\thhbbt.exec:\thhbbt.exe66⤵
- Executes dropped EXE
PID:2024 -
\??\c:\dvjjj.exec:\dvjjj.exe67⤵PID:1072
-
\??\c:\jvddd.exec:\jvddd.exe68⤵PID:2392
-
\??\c:\rfxxflr.exec:\rfxxflr.exe69⤵PID:1584
-
\??\c:\frfxxxr.exec:\frfxxxr.exe70⤵PID:2836
-
\??\c:\bnhhbh.exec:\bnhhbh.exe71⤵PID:2296
-
\??\c:\hbhnbh.exec:\hbhnbh.exe72⤵PID:1932
-
\??\c:\dvvpv.exec:\dvvpv.exe73⤵PID:2612
-
\??\c:\jdpvd.exec:\jdpvd.exe74⤵PID:2776
-
\??\c:\3lxxflr.exec:\3lxxflr.exe75⤵PID:2624
-
\??\c:\7lfrrrf.exec:\7lfrrrf.exe76⤵PID:2140
-
\??\c:\btbbnh.exec:\btbbnh.exe77⤵PID:748
-
\??\c:\bthnhn.exec:\bthnhn.exe78⤵PID:264
-
\??\c:\5pjdd.exec:\5pjdd.exe79⤵PID:1552
-
\??\c:\vjvjp.exec:\vjvjp.exe80⤵PID:928
-
\??\c:\5xrxfxl.exec:\5xrxfxl.exe81⤵PID:2304
-
\??\c:\rlxlfxf.exec:\rlxlfxf.exe82⤵PID:2396
-
\??\c:\thhhtt.exec:\thhhtt.exe83⤵PID:2208
-
\??\c:\7hbntb.exec:\7hbntb.exe84⤵PID:2012
-
\??\c:\dvvpp.exec:\dvvpp.exe85⤵PID:2812
-
\??\c:\vjjvv.exec:\vjjvv.exe86⤵PID:1520
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe87⤵PID:1388
-
\??\c:\3frlxxl.exec:\3frlxxl.exe88⤵PID:1920
-
\??\c:\bnttbt.exec:\bnttbt.exe89⤵PID:3044
-
\??\c:\hthbbt.exec:\hthbbt.exe90⤵PID:1832
-
\??\c:\tntnbt.exec:\tntnbt.exe91⤵PID:1652
-
\??\c:\pjvvv.exec:\pjvvv.exe92⤵PID:2132
-
\??\c:\pjvdp.exec:\pjvdp.exe93⤵PID:2572
-
\??\c:\lrxxffr.exec:\lrxxffr.exe94⤵PID:2232
-
\??\c:\fxlxrxf.exec:\fxlxrxf.exe95⤵PID:1924
-
\??\c:\thntbh.exec:\thntbh.exe96⤵PID:2440
-
\??\c:\thtbbh.exec:\thtbbh.exe97⤵PID:848
-
\??\c:\dvddj.exec:\dvddj.exe98⤵PID:376
-
\??\c:\9pvvv.exec:\9pvvv.exe99⤵PID:1300
-
\??\c:\fxrlrrf.exec:\fxrlrrf.exe100⤵PID:1136
-
\??\c:\fxfxllr.exec:\fxfxllr.exe101⤵PID:976
-
\??\c:\tnbbnb.exec:\tnbbnb.exe102⤵PID:2244
-
\??\c:\hthbhh.exec:\hthbhh.exe103⤵PID:1704
-
\??\c:\pjpvv.exec:\pjpvv.exe104⤵PID:1752
-
\??\c:\pjvvd.exec:\pjvvd.exe105⤵PID:1004
-
\??\c:\fxlfrrr.exec:\fxlfrrr.exe106⤵PID:1192
-
\??\c:\lxllrrf.exec:\lxllrrf.exe107⤵PID:2852
-
\??\c:\tnnntt.exec:\tnnntt.exe108⤵PID:3020
-
\??\c:\tnhhbb.exec:\tnhhbb.exe109⤵PID:2976
-
\??\c:\vjppj.exec:\vjppj.exe110⤵PID:2832
-
\??\c:\vpvdj.exec:\vpvdj.exe111⤵PID:2872
-
\??\c:\lfxfxxx.exec:\lfxfxxx.exe112⤵PID:2636
-
\??\c:\xrfrxlr.exec:\xrfrxlr.exe113⤵PID:2220
-
\??\c:\btbbhb.exec:\btbbhb.exe114⤵PID:2640
-
\??\c:\9httnn.exec:\9httnn.exe115⤵PID:480
-
\??\c:\dpjjd.exec:\dpjjd.exe116⤵PID:784
-
\??\c:\jvvvv.exec:\jvvvv.exe117⤵PID:600
-
\??\c:\fxlfffr.exec:\fxlfffr.exe118⤵PID:1404
-
\??\c:\7fxfllr.exec:\7fxfllr.exe119⤵PID:2200
-
\??\c:\thnntt.exec:\thnntt.exe120⤵PID:2100
-
\??\c:\nbhhnt.exec:\nbhhnt.exe121⤵PID:2144
-
\??\c:\1pvdp.exec:\1pvdp.exe122⤵PID:1956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-