Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 01:13
Static task
static1
Behavioral task
behavioral1
Sample
aa21efa4d70b7be845e7304d04a90ebc653a7e190c39228ae6de41f5413349a2.exe
Resource
win7-20240708-en
General
-
Target
aa21efa4d70b7be845e7304d04a90ebc653a7e190c39228ae6de41f5413349a2.exe
-
Size
88KB
-
MD5
1e20cd7afd9863871cc50ced520ffd9f
-
SHA1
515c79fdc11467a817e2274c80bd30219d2447e8
-
SHA256
aa21efa4d70b7be845e7304d04a90ebc653a7e190c39228ae6de41f5413349a2
-
SHA512
dfb5bb3dbbd3c421b1993b3917c953e1c09b51d325e5f63286429863b13baacc78445c009a8ff535131d7d490ff7387ad53d5531fe9cdef411cfe05b67513390
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgt7WxZKmNDnX77lY8/X5Qgrciy:ymb3NkkiQ3mdBjFIgte0mNb77BptfXW
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2408-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-89-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1612-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/396-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2184 tnbbtt.exe 2080 vdpdj.exe 2152 nhhhnt.exe 700 rlfrxrf.exe 2944 rllxlrx.exe 2812 nhtbhh.exe 2772 hhbbhn.exe 2636 3dpvv.exe 2780 9xxrffr.exe 2640 nhthth.exe 3020 3btnbh.exe 1908 ppdjv.exe 2140 3lrllfx.exe 1444 ttnbnn.exe 2428 nnhntt.exe 2144 7pdjj.exe 1872 9rllrrx.exe 1612 xrrxllr.exe 1104 tbhbth.exe 2448 jddjd.exe 568 3jddj.exe 1492 fllxrrx.exe 1624 hbnbht.exe 1792 vjvvd.exe 1732 jdvjj.exe 908 3httbh.exe 2468 hhtbtt.exe 556 1vdjp.exe 396 1vjpv.exe 772 lfrxlrr.exe 2980 tthbhh.exe 2556 bbbnbb.exe 2072 pjvjj.exe 1584 lllrxfx.exe 1592 xlxxffx.exe 3052 xrxffrx.exe 2716 tnhnhn.exe 2148 tntnnt.exe 2944 ppjvd.exe 2800 vpppp.exe 2952 xlrrrxf.exe 2840 3thhnt.exe 2856 1bhnbn.exe 2780 5hthhh.exe 2640 3jddd.exe 1320 vdjvv.exe 2552 rfrllrx.exe 2128 rlrxfll.exe 2084 hbhhbb.exe 2420 hbtbnn.exe 1904 vpppp.exe 1324 ppddv.exe 1704 xrxxrrf.exe 1560 rllfffl.exe 640 9btthb.exe 1772 5nhntn.exe 2460 jvvvv.exe 2836 pjjvp.exe 2908 fxlxxxx.exe 2708 fxlxxlx.exe 2676 ffrxflx.exe 1056 1tthnb.exe 960 bththb.exe 2388 dvpvj.exe -
resource yara_rule behavioral1/memory/2408-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1104-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/396-278-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2184 2408 aa21efa4d70b7be845e7304d04a90ebc653a7e190c39228ae6de41f5413349a2.exe 30 PID 2408 wrote to memory of 2184 2408 aa21efa4d70b7be845e7304d04a90ebc653a7e190c39228ae6de41f5413349a2.exe 30 PID 2408 wrote to memory of 2184 2408 aa21efa4d70b7be845e7304d04a90ebc653a7e190c39228ae6de41f5413349a2.exe 30 PID 2408 wrote to memory of 2184 2408 aa21efa4d70b7be845e7304d04a90ebc653a7e190c39228ae6de41f5413349a2.exe 30 PID 2184 wrote to memory of 2080 2184 tnbbtt.exe 31 PID 2184 wrote to memory of 2080 2184 tnbbtt.exe 31 PID 2184 wrote to memory of 2080 2184 tnbbtt.exe 31 PID 2184 wrote to memory of 2080 2184 tnbbtt.exe 31 PID 2080 wrote to memory of 2152 2080 vdpdj.exe 32 PID 2080 wrote to memory of 2152 2080 vdpdj.exe 32 PID 2080 wrote to memory of 2152 2080 vdpdj.exe 32 PID 2080 wrote to memory of 2152 2080 vdpdj.exe 32 PID 2152 wrote to memory of 700 2152 nhhhnt.exe 33 PID 2152 wrote to memory of 700 2152 nhhhnt.exe 33 PID 2152 wrote to memory of 700 2152 nhhhnt.exe 33 PID 2152 wrote to memory of 700 2152 nhhhnt.exe 33 PID 700 wrote to memory of 2944 700 rlfrxrf.exe 34 PID 700 wrote to memory of 2944 700 rlfrxrf.exe 34 PID 700 wrote to memory of 2944 700 rlfrxrf.exe 34 PID 700 wrote to memory of 2944 700 rlfrxrf.exe 34 PID 2944 wrote to memory of 2812 2944 rllxlrx.exe 35 PID 2944 wrote to memory of 2812 2944 rllxlrx.exe 35 PID 2944 wrote to memory of 2812 2944 rllxlrx.exe 35 PID 2944 wrote to memory of 2812 2944 rllxlrx.exe 35 PID 2812 wrote to memory of 2772 2812 nhtbhh.exe 36 PID 2812 wrote to memory of 2772 2812 nhtbhh.exe 36 PID 2812 wrote to memory of 2772 2812 nhtbhh.exe 36 PID 2812 wrote to memory of 2772 2812 nhtbhh.exe 36 PID 2772 wrote to memory of 2636 2772 hhbbhn.exe 37 PID 2772 wrote to memory of 2636 2772 hhbbhn.exe 37 PID 2772 wrote to memory of 2636 2772 hhbbhn.exe 37 PID 2772 wrote to memory of 2636 2772 hhbbhn.exe 37 PID 2636 wrote to memory of 2780 2636 3dpvv.exe 38 PID 2636 wrote to memory of 2780 2636 3dpvv.exe 38 PID 2636 wrote to memory of 2780 2636 3dpvv.exe 38 PID 2636 wrote to memory of 2780 2636 3dpvv.exe 38 PID 2780 wrote to memory of 2640 2780 9xxrffr.exe 39 PID 2780 wrote to memory of 2640 2780 9xxrffr.exe 39 PID 2780 wrote to memory of 2640 2780 9xxrffr.exe 39 PID 2780 wrote to memory of 2640 2780 9xxrffr.exe 39 PID 2640 wrote to memory of 3020 2640 nhthth.exe 40 PID 2640 wrote to memory of 3020 2640 nhthth.exe 40 PID 2640 wrote to memory of 3020 2640 nhthth.exe 40 PID 2640 wrote to memory of 3020 2640 nhthth.exe 40 PID 3020 wrote to memory of 1908 3020 3btnbh.exe 41 PID 3020 wrote to memory of 1908 3020 3btnbh.exe 41 PID 3020 wrote to memory of 1908 3020 3btnbh.exe 41 PID 3020 wrote to memory of 1908 3020 3btnbh.exe 41 PID 1908 wrote to memory of 2140 1908 ppdjv.exe 42 PID 1908 wrote to memory of 2140 1908 ppdjv.exe 42 PID 1908 wrote to memory of 2140 1908 ppdjv.exe 42 PID 1908 wrote to memory of 2140 1908 ppdjv.exe 42 PID 2140 wrote to memory of 1444 2140 3lrllfx.exe 43 PID 2140 wrote to memory of 1444 2140 3lrllfx.exe 43 PID 2140 wrote to memory of 1444 2140 3lrllfx.exe 43 PID 2140 wrote to memory of 1444 2140 3lrllfx.exe 43 PID 1444 wrote to memory of 2428 1444 ttnbnn.exe 44 PID 1444 wrote to memory of 2428 1444 ttnbnn.exe 44 PID 1444 wrote to memory of 2428 1444 ttnbnn.exe 44 PID 1444 wrote to memory of 2428 1444 ttnbnn.exe 44 PID 2428 wrote to memory of 2144 2428 nnhntt.exe 45 PID 2428 wrote to memory of 2144 2428 nnhntt.exe 45 PID 2428 wrote to memory of 2144 2428 nnhntt.exe 45 PID 2428 wrote to memory of 2144 2428 nnhntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa21efa4d70b7be845e7304d04a90ebc653a7e190c39228ae6de41f5413349a2.exe"C:\Users\Admin\AppData\Local\Temp\aa21efa4d70b7be845e7304d04a90ebc653a7e190c39228ae6de41f5413349a2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\tnbbtt.exec:\tnbbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\vdpdj.exec:\vdpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\nhhhnt.exec:\nhhhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\rlfrxrf.exec:\rlfrxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\rllxlrx.exec:\rllxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\nhtbhh.exec:\nhtbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\hhbbhn.exec:\hhbbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3dpvv.exec:\3dpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\9xxrffr.exec:\9xxrffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nhthth.exec:\nhthth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\3btnbh.exec:\3btnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\ppdjv.exec:\ppdjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\3lrllfx.exec:\3lrllfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\ttnbnn.exec:\ttnbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\nnhntt.exec:\nnhntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\7pdjj.exec:\7pdjj.exe17⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9rllrrx.exec:\9rllrrx.exe18⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xrrxllr.exec:\xrrxllr.exe19⤵
- Executes dropped EXE
PID:1612 -
\??\c:\tbhbth.exec:\tbhbth.exe20⤵
- Executes dropped EXE
PID:1104 -
\??\c:\jddjd.exec:\jddjd.exe21⤵
- Executes dropped EXE
PID:2448 -
\??\c:\3jddj.exec:\3jddj.exe22⤵
- Executes dropped EXE
PID:568 -
\??\c:\fllxrrx.exec:\fllxrrx.exe23⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hbnbht.exec:\hbnbht.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vjvvd.exec:\vjvvd.exe25⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jdvjj.exec:\jdvjj.exe26⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3httbh.exec:\3httbh.exe27⤵
- Executes dropped EXE
PID:908 -
\??\c:\hhtbtt.exec:\hhtbtt.exe28⤵
- Executes dropped EXE
PID:2468 -
\??\c:\1vdjp.exec:\1vdjp.exe29⤵
- Executes dropped EXE
PID:556 -
\??\c:\1vjpv.exec:\1vjpv.exe30⤵
- Executes dropped EXE
PID:396 -
\??\c:\lfrxlrr.exec:\lfrxlrr.exe31⤵
- Executes dropped EXE
PID:772 -
\??\c:\tthbhh.exec:\tthbhh.exe32⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bbbnbb.exec:\bbbnbb.exe33⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pjvjj.exec:\pjvjj.exe34⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lllrxfx.exec:\lllrxfx.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xlxxffx.exec:\xlxxffx.exe36⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xrxffrx.exec:\xrxffrx.exe37⤵
- Executes dropped EXE
PID:3052 -
\??\c:\tnhnhn.exec:\tnhnhn.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tntnnt.exec:\tntnnt.exe39⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ppjvd.exec:\ppjvd.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vpppp.exec:\vpppp.exe41⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xlrrrxf.exec:\xlrrrxf.exe42⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3thhnt.exec:\3thhnt.exe43⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1bhnbn.exec:\1bhnbn.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5hthhh.exec:\5hthhh.exe45⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3jddd.exec:\3jddd.exe46⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vdjvv.exec:\vdjvv.exe47⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rfrllrx.exec:\rfrllrx.exe48⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rlrxfll.exec:\rlrxfll.exe49⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hbhhbb.exec:\hbhhbb.exe50⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hbtbnn.exec:\hbtbnn.exe51⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vpppp.exec:\vpppp.exe52⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ppddv.exec:\ppddv.exe53⤵
- Executes dropped EXE
PID:1324 -
\??\c:\xrxxrrf.exec:\xrxxrrf.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rllfffl.exec:\rllfffl.exe55⤵
- Executes dropped EXE
PID:1560 -
\??\c:\9btthb.exec:\9btthb.exe56⤵
- Executes dropped EXE
PID:640 -
\??\c:\5nhntn.exec:\5nhntn.exe57⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jvvvv.exec:\jvvvv.exe58⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pjjvp.exec:\pjjvp.exe59⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fxlxxxx.exec:\fxlxxxx.exe60⤵
- Executes dropped EXE
PID:2908 -
\??\c:\fxlxxlx.exec:\fxlxxlx.exe61⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ffrxflx.exec:\ffrxflx.exe62⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1tthnb.exec:\1tthnb.exe63⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bththb.exec:\bththb.exe64⤵
- Executes dropped EXE
PID:960 -
\??\c:\dvpvj.exec:\dvpvj.exe65⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vpdvd.exec:\vpdvd.exe66⤵PID:2120
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe67⤵PID:2452
-
\??\c:\1ffllrl.exec:\1ffllrl.exe68⤵PID:2564
-
\??\c:\dvpdp.exec:\dvpdp.exe69⤵PID:2112
-
\??\c:\3vvjp.exec:\3vvjp.exe70⤵PID:2240
-
\??\c:\llfrffr.exec:\llfrffr.exe71⤵PID:2180
-
\??\c:\frxlrxr.exec:\frxlrxr.exe72⤵PID:1924
-
\??\c:\nhbhnt.exec:\nhbhnt.exe73⤵PID:1916
-
\??\c:\bthhhn.exec:\bthhhn.exe74⤵PID:1556
-
\??\c:\jdjvd.exec:\jdjvd.exe75⤵PID:1588
-
\??\c:\3flrxff.exec:\3flrxff.exe76⤵PID:3040
-
\??\c:\rrfllxx.exec:\rrfllxx.exe77⤵PID:2316
-
\??\c:\5rlrxxf.exec:\5rlrxxf.exe78⤵PID:2160
-
\??\c:\ntbnnt.exec:\ntbnnt.exe79⤵PID:2824
-
\??\c:\7vjvd.exec:\7vjvd.exe80⤵PID:2940
-
\??\c:\5dvdj.exec:\5dvdj.exe81⤵PID:2848
-
\??\c:\xrxllxl.exec:\xrxllxl.exe82⤵PID:2772
-
\??\c:\xlffllf.exec:\xlffllf.exe83⤵PID:2636
-
\??\c:\tbtnnh.exec:\tbtnnh.exe84⤵PID:2628
-
\??\c:\nnnttt.exec:\nnnttt.exe85⤵PID:2608
-
\??\c:\pjvjp.exec:\pjvjp.exe86⤵PID:3028
-
\??\c:\dpvvv.exec:\dpvvv.exe87⤵PID:2652
-
\??\c:\fxrrflr.exec:\fxrrflr.exe88⤵PID:3024
-
\??\c:\rlfrfrx.exec:\rlfrfrx.exe89⤵PID:1512
-
\??\c:\btthnn.exec:\btthnn.exe90⤵PID:1948
-
\??\c:\thhhht.exec:\thhhht.exe91⤵PID:1700
-
\??\c:\vpdjv.exec:\vpdjv.exe92⤵PID:1724
-
\??\c:\9vjvj.exec:\9vjvj.exe93⤵PID:2144
-
\??\c:\rlrlxrx.exec:\rlrlxrx.exe94⤵PID:876
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe95⤵PID:1612
-
\??\c:\1ttbtb.exec:\1ttbtb.exe96⤵PID:1508
-
\??\c:\vvjvd.exec:\vvjvd.exe97⤵PID:592
-
\??\c:\jdpjd.exec:\jdpjd.exe98⤵PID:2480
-
\??\c:\xxrlxxf.exec:\xxrlxxf.exe99⤵PID:2476
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe100⤵PID:2104
-
\??\c:\nbnthn.exec:\nbnthn.exe101⤵PID:1608
-
\??\c:\btbtbh.exec:\btbtbh.exe102⤵PID:1792
-
\??\c:\vvjjv.exec:\vvjjv.exe103⤵PID:1676
-
\??\c:\dvpvj.exec:\dvpvj.exe104⤵PID:1064
-
\??\c:\xrfrflr.exec:\xrfrflr.exe105⤵PID:784
-
\??\c:\5frrrll.exec:\5frrrll.exe106⤵PID:2440
-
\??\c:\bbbntb.exec:\bbbntb.exe107⤵PID:2308
-
\??\c:\1hbntb.exec:\1hbntb.exe108⤵PID:2432
-
\??\c:\vdpjv.exec:\vdpjv.exe109⤵PID:552
-
\??\c:\jjvpd.exec:\jjvpd.exe110⤵PID:1760
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe111⤵PID:2184
-
\??\c:\xxlrfxx.exec:\xxlrfxx.exe112⤵PID:1384
-
\??\c:\hbtbnt.exec:\hbtbnt.exe113⤵PID:3036
-
\??\c:\ntnbbh.exec:\ntnbbh.exe114⤵PID:2072
-
\??\c:\3dddj.exec:\3dddj.exe115⤵PID:1584
-
\??\c:\jdvvp.exec:\jdvvp.exe116⤵PID:2156
-
\??\c:\fxfffrl.exec:\fxfffrl.exe117⤵PID:700
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe118⤵PID:2792
-
\??\c:\nbtbhh.exec:\nbtbhh.exe119⤵PID:2928
-
\??\c:\3btbhn.exec:\3btbhn.exe120⤵PID:2832
-
\??\c:\dpdpd.exec:\dpdpd.exe121⤵PID:2844
-
\??\c:\9jddv.exec:\9jddv.exe122⤵PID:2736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-