Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe
Resource
win7-20240705-en
General
-
Target
a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe
-
Size
94KB
-
MD5
716c0a035f55682028eeb717c3a0d32a
-
SHA1
fd3c7a8326ccc7fc2f5460748f1f865985ed84da
-
SHA256
a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08
-
SHA512
9cecb9e80a67230ab0df197a5b2652213b7b7a4c0002f239aed48cf4c3258b1f478ea3f3484c0ea642e09bf02a3585184d6ed2485531a75fad958e7534eaa29e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRB/:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBtt
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2764-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3528 jdvjd.exe 2640 xffxllf.exe 2580 tnnbtn.exe 3508 pddvd.exe 4224 flxxffl.exe 1412 fxlxfxx.exe 2360 hbhthb.exe 3292 pvdvj.exe 976 jjvvj.exe 2356 rlfflrx.exe 732 xlfxlfx.exe 2220 hhtbhn.exe 344 jdjvp.exe 3268 pppjp.exe 4692 rxfxlfx.exe 4616 9xfrfxl.exe 5036 1nnhtt.exe 3328 ddvdd.exe 4952 vpvjj.exe 4816 rrrlfxx.exe 384 nbtthb.exe 4800 1nhthb.exe 2428 jpjdp.exe 1248 xfrfrrl.exe 4448 hbtnbb.exe 532 hbbbnt.exe 1300 vvdvj.exe 4120 3vpdp.exe 2480 tbthtn.exe 4092 nththb.exe 1856 vpvjp.exe 5016 fxxrlfx.exe 852 bnthhb.exe 2280 hnhbnh.exe 4444 dppjd.exe 4552 frlxfxr.exe 1924 rfffxrl.exe 4560 xrrlfxr.exe 3580 bbtnbt.exe 4600 bnhbnn.exe 1628 5ppdv.exe 3524 dppjp.exe 4328 9xlxlfr.exe 4760 lllrxxl.exe 4376 nhhbhb.exe 3624 pvvpd.exe 2640 dppvj.exe 3560 frlfxrl.exe 3736 ttnbnh.exe 876 thbtbt.exe 3636 vpjdv.exe 4044 djjvp.exe 4908 rllxrlx.exe 3092 5fxrlxl.exe 1524 1hbnbt.exe 4580 3nbbnb.exe 2832 pvvpv.exe 4048 pdvjv.exe 2004 rrrlxlx.exe 344 lfxrffr.exe 3256 bhbnbb.exe 4692 tnbnbb.exe 1284 dddpj.exe 3852 jjdpj.exe -
resource yara_rule behavioral2/memory/2764-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2764 wrote to memory of 3528 2764 a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe 82 PID 2764 wrote to memory of 3528 2764 a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe 82 PID 2764 wrote to memory of 3528 2764 a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe 82 PID 3528 wrote to memory of 2640 3528 jdvjd.exe 83 PID 3528 wrote to memory of 2640 3528 jdvjd.exe 83 PID 3528 wrote to memory of 2640 3528 jdvjd.exe 83 PID 2640 wrote to memory of 2580 2640 xffxllf.exe 84 PID 2640 wrote to memory of 2580 2640 xffxllf.exe 84 PID 2640 wrote to memory of 2580 2640 xffxllf.exe 84 PID 2580 wrote to memory of 3508 2580 tnnbtn.exe 85 PID 2580 wrote to memory of 3508 2580 tnnbtn.exe 85 PID 2580 wrote to memory of 3508 2580 tnnbtn.exe 85 PID 3508 wrote to memory of 4224 3508 pddvd.exe 86 PID 3508 wrote to memory of 4224 3508 pddvd.exe 86 PID 3508 wrote to memory of 4224 3508 pddvd.exe 86 PID 4224 wrote to memory of 1412 4224 flxxffl.exe 87 PID 4224 wrote to memory of 1412 4224 flxxffl.exe 87 PID 4224 wrote to memory of 1412 4224 flxxffl.exe 87 PID 1412 wrote to memory of 2360 1412 fxlxfxx.exe 88 PID 1412 wrote to memory of 2360 1412 fxlxfxx.exe 88 PID 1412 wrote to memory of 2360 1412 fxlxfxx.exe 88 PID 2360 wrote to memory of 3292 2360 hbhthb.exe 89 PID 2360 wrote to memory of 3292 2360 hbhthb.exe 89 PID 2360 wrote to memory of 3292 2360 hbhthb.exe 89 PID 3292 wrote to memory of 976 3292 pvdvj.exe 90 PID 3292 wrote to memory of 976 3292 pvdvj.exe 90 PID 3292 wrote to memory of 976 3292 pvdvj.exe 90 PID 976 wrote to memory of 2356 976 jjvvj.exe 91 PID 976 wrote to memory of 2356 976 jjvvj.exe 91 PID 976 wrote to memory of 2356 976 jjvvj.exe 91 PID 2356 wrote to memory of 732 2356 rlfflrx.exe 92 PID 2356 wrote to memory of 732 2356 rlfflrx.exe 92 PID 2356 wrote to memory of 732 2356 rlfflrx.exe 92 PID 732 wrote to memory of 2220 732 xlfxlfx.exe 93 PID 732 wrote to memory of 2220 732 xlfxlfx.exe 93 PID 732 wrote to memory of 2220 732 xlfxlfx.exe 93 PID 2220 wrote to memory of 344 2220 hhtbhn.exe 94 PID 2220 wrote to memory of 344 2220 hhtbhn.exe 94 PID 2220 wrote to memory of 344 2220 hhtbhn.exe 94 PID 344 wrote to memory of 3268 344 jdjvp.exe 95 PID 344 wrote to memory of 3268 344 jdjvp.exe 95 PID 344 wrote to memory of 3268 344 jdjvp.exe 95 PID 3268 wrote to memory of 4692 3268 pppjp.exe 96 PID 3268 wrote to memory of 4692 3268 pppjp.exe 96 PID 3268 wrote to memory of 4692 3268 pppjp.exe 96 PID 4692 wrote to memory of 4616 4692 rxfxlfx.exe 97 PID 4692 wrote to memory of 4616 4692 rxfxlfx.exe 97 PID 4692 wrote to memory of 4616 4692 rxfxlfx.exe 97 PID 4616 wrote to memory of 5036 4616 9xfrfxl.exe 98 PID 4616 wrote to memory of 5036 4616 9xfrfxl.exe 98 PID 4616 wrote to memory of 5036 4616 9xfrfxl.exe 98 PID 5036 wrote to memory of 3328 5036 1nnhtt.exe 99 PID 5036 wrote to memory of 3328 5036 1nnhtt.exe 99 PID 5036 wrote to memory of 3328 5036 1nnhtt.exe 99 PID 3328 wrote to memory of 4952 3328 ddvdd.exe 100 PID 3328 wrote to memory of 4952 3328 ddvdd.exe 100 PID 3328 wrote to memory of 4952 3328 ddvdd.exe 100 PID 4952 wrote to memory of 4816 4952 vpvjj.exe 102 PID 4952 wrote to memory of 4816 4952 vpvjj.exe 102 PID 4952 wrote to memory of 4816 4952 vpvjj.exe 102 PID 4816 wrote to memory of 384 4816 rrrlfxx.exe 103 PID 4816 wrote to memory of 384 4816 rrrlfxx.exe 103 PID 4816 wrote to memory of 384 4816 rrrlfxx.exe 103 PID 384 wrote to memory of 4800 384 nbtthb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe"C:\Users\Admin\AppData\Local\Temp\a06d01e2bc0280f949e5e204bb6e9c0cc48b4757cb17873003fcfd7913595b08.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jdvjd.exec:\jdvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\xffxllf.exec:\xffxllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\tnnbtn.exec:\tnnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\pddvd.exec:\pddvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\flxxffl.exec:\flxxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\fxlxfxx.exec:\fxlxfxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\hbhthb.exec:\hbhthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\pvdvj.exec:\pvdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\jjvvj.exec:\jjvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\rlfflrx.exec:\rlfflrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\xlfxlfx.exec:\xlfxlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\hhtbhn.exec:\hhtbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\jdjvp.exec:\jdjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\pppjp.exec:\pppjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\rxfxlfx.exec:\rxfxlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\9xfrfxl.exec:\9xfrfxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\1nnhtt.exec:\1nnhtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\ddvdd.exec:\ddvdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\vpvjj.exec:\vpvjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\rrrlfxx.exec:\rrrlfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\nbtthb.exec:\nbtthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\1nhthb.exec:\1nhthb.exe23⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jpjdp.exec:\jpjdp.exe24⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xfrfrrl.exec:\xfrfrrl.exe25⤵
- Executes dropped EXE
PID:1248 -
\??\c:\hbtnbb.exec:\hbtnbb.exe26⤵
- Executes dropped EXE
PID:4448 -
\??\c:\hbbbnt.exec:\hbbbnt.exe27⤵
- Executes dropped EXE
PID:532 -
\??\c:\vvdvj.exec:\vvdvj.exe28⤵
- Executes dropped EXE
PID:1300 -
\??\c:\3vpdp.exec:\3vpdp.exe29⤵
- Executes dropped EXE
PID:4120 -
\??\c:\tbthtn.exec:\tbthtn.exe30⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nththb.exec:\nththb.exe31⤵
- Executes dropped EXE
PID:4092 -
\??\c:\vpvjp.exec:\vpvjp.exe32⤵
- Executes dropped EXE
PID:1856 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe33⤵
- Executes dropped EXE
PID:5016 -
\??\c:\bnthhb.exec:\bnthhb.exe34⤵
- Executes dropped EXE
PID:852 -
\??\c:\hnhbnh.exec:\hnhbnh.exe35⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dppjd.exec:\dppjd.exe36⤵
- Executes dropped EXE
PID:4444 -
\??\c:\frlxfxr.exec:\frlxfxr.exe37⤵
- Executes dropped EXE
PID:4552 -
\??\c:\rfffxrl.exec:\rfffxrl.exe38⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe39⤵
- Executes dropped EXE
PID:4560 -
\??\c:\bbtnbt.exec:\bbtnbt.exe40⤵
- Executes dropped EXE
PID:3580 -
\??\c:\bnhbnn.exec:\bnhbnn.exe41⤵
- Executes dropped EXE
PID:4600 -
\??\c:\5ppdv.exec:\5ppdv.exe42⤵
- Executes dropped EXE
PID:1628 -
\??\c:\dppjp.exec:\dppjp.exe43⤵
- Executes dropped EXE
PID:3524 -
\??\c:\9xlxlfr.exec:\9xlxlfr.exe44⤵
- Executes dropped EXE
PID:4328 -
\??\c:\lllrxxl.exec:\lllrxxl.exe45⤵
- Executes dropped EXE
PID:4760 -
\??\c:\nhhbhb.exec:\nhhbhb.exe46⤵
- Executes dropped EXE
PID:4376 -
\??\c:\pvvpd.exec:\pvvpd.exe47⤵
- Executes dropped EXE
PID:3624 -
\??\c:\dppvj.exec:\dppvj.exe48⤵
- Executes dropped EXE
PID:2640 -
\??\c:\frlfxrl.exec:\frlfxrl.exe49⤵
- Executes dropped EXE
PID:3560 -
\??\c:\ttnbnh.exec:\ttnbnh.exe50⤵
- Executes dropped EXE
PID:3736 -
\??\c:\thbtbt.exec:\thbtbt.exe51⤵
- Executes dropped EXE
PID:876 -
\??\c:\vpjdv.exec:\vpjdv.exe52⤵
- Executes dropped EXE
PID:3636 -
\??\c:\djjvp.exec:\djjvp.exe53⤵
- Executes dropped EXE
PID:4044 -
\??\c:\rllxrlx.exec:\rllxrlx.exe54⤵
- Executes dropped EXE
PID:4908 -
\??\c:\5fxrlxl.exec:\5fxrlxl.exe55⤵
- Executes dropped EXE
PID:3092 -
\??\c:\1hbnbt.exec:\1hbnbt.exe56⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3nbbnb.exec:\3nbbnb.exe57⤵
- Executes dropped EXE
PID:4580 -
\??\c:\pvvpv.exec:\pvvpv.exe58⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pdvjv.exec:\pdvjv.exe59⤵
- Executes dropped EXE
PID:4048 -
\??\c:\rrrlxlx.exec:\rrrlxlx.exe60⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lfxrffr.exec:\lfxrffr.exe61⤵
- Executes dropped EXE
PID:344 -
\??\c:\bhbnbb.exec:\bhbnbb.exe62⤵
- Executes dropped EXE
PID:3256 -
\??\c:\tnbnbb.exec:\tnbnbb.exe63⤵
- Executes dropped EXE
PID:4692 -
\??\c:\dddpj.exec:\dddpj.exe64⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jjdpj.exec:\jjdpj.exe65⤵
- Executes dropped EXE
PID:3852 -
\??\c:\xxxrlfr.exec:\xxxrlfr.exe66⤵PID:5104
-
\??\c:\hbtnnh.exec:\hbtnnh.exe67⤵PID:4940
-
\??\c:\pdddv.exec:\pdddv.exe68⤵PID:4952
-
\??\c:\lffflrf.exec:\lffflrf.exe69⤵PID:1092
-
\??\c:\hbbttn.exec:\hbbttn.exe70⤵PID:2876
-
\??\c:\1ppdj.exec:\1ppdj.exe71⤵PID:4576
-
\??\c:\rxllffx.exec:\rxllffx.exe72⤵PID:2476
-
\??\c:\rrxxxff.exec:\rrxxxff.exe73⤵PID:2148
-
\??\c:\nnbbtt.exec:\nnbbtt.exe74⤵PID:4068
-
\??\c:\pjjdj.exec:\pjjdj.exe75⤵PID:3432
-
\??\c:\pvvjv.exec:\pvvjv.exe76⤵PID:3516
-
\??\c:\frrfxrx.exec:\frrfxrx.exe77⤵PID:2532
-
\??\c:\xxxxlll.exec:\xxxxlll.exe78⤵PID:1056
-
\??\c:\btnbhb.exec:\btnbhb.exe79⤵PID:4700
-
\??\c:\hbthth.exec:\hbthth.exe80⤵PID:4296
-
\??\c:\pddjv.exec:\pddjv.exe81⤵PID:3764
-
\??\c:\vvpdd.exec:\vvpdd.exe82⤵PID:4848
-
\??\c:\lllfffl.exec:\lllfffl.exe83⤵PID:1480
-
\??\c:\rffxlxl.exec:\rffxlxl.exe84⤵PID:4716
-
\??\c:\9tbthb.exec:\9tbthb.exe85⤵PID:2228
-
\??\c:\nnttth.exec:\nnttth.exe86⤵PID:3468
-
\??\c:\rlrlllf.exec:\rlrlllf.exe87⤵PID:432
-
\??\c:\htbbbb.exec:\htbbbb.exe88⤵PID:3744
-
\??\c:\hhhthn.exec:\hhhthn.exe89⤵PID:3164
-
\??\c:\pppdj.exec:\pppdj.exe90⤵PID:364
-
\??\c:\pjjvj.exec:\pjjvj.exe91⤵PID:1256
-
\??\c:\lfxlxrf.exec:\lfxlxrf.exe92⤵PID:920
-
\??\c:\rxfxxrr.exec:\rxfxxrr.exe93⤵PID:2828
-
\??\c:\hhhhtn.exec:\hhhhtn.exe94⤵PID:620
-
\??\c:\jpvpd.exec:\jpvpd.exe95⤵PID:4324
-
\??\c:\5vpdv.exec:\5vpdv.exe96⤵PID:760
-
\??\c:\pjvpd.exec:\pjvpd.exe97⤵PID:2200
-
\??\c:\frlfrlf.exec:\frlfrlf.exe98⤵PID:4588
-
\??\c:\7btthb.exec:\7btthb.exe99⤵PID:4248
-
\??\c:\bnhbnh.exec:\bnhbnh.exe100⤵PID:3724
-
\??\c:\pdjvj.exec:\pdjvj.exe101⤵PID:2580
-
\??\c:\1jjdp.exec:\1jjdp.exe102⤵PID:3124
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe103⤵PID:4208
-
\??\c:\rfxrffx.exec:\rfxrffx.exe104⤵PID:4420
-
\??\c:\bbtnbt.exec:\bbtnbt.exe105⤵PID:3292
-
\??\c:\htnbnh.exec:\htnbnh.exe106⤵PID:932
-
\??\c:\jvjvp.exec:\jvjvp.exe107⤵PID:976
-
\??\c:\lffffll.exec:\lffffll.exe108⤵PID:4852
-
\??\c:\xrrrfff.exec:\xrrrfff.exe109⤵PID:1064
-
\??\c:\1nttnn.exec:\1nttnn.exe110⤵PID:2724
-
\??\c:\tnhhtn.exec:\tnhhtn.exe111⤵PID:4548
-
\??\c:\dpjdj.exec:\dpjdj.exe112⤵PID:1060
-
\??\c:\3dppv.exec:\3dppv.exe113⤵PID:5116
-
\??\c:\llfxrlf.exec:\llfxrlf.exe114⤵PID:3692
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe115⤵PID:4488
-
\??\c:\bnhtnh.exec:\bnhtnh.exe116⤵PID:2972
-
\??\c:\ttthnh.exec:\ttthnh.exe117⤵PID:5036
-
\??\c:\dvjjd.exec:\dvjjd.exe118⤵PID:4596
-
\??\c:\ppjpj.exec:\ppjpj.exe119⤵PID:4556
-
\??\c:\xxxlxrl.exec:\xxxlxrl.exe120⤵PID:1068
-
\??\c:\httnnn.exec:\httnnn.exe121⤵PID:3024
-
\??\c:\btthbt.exec:\btthbt.exe122⤵PID:4352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-