Analysis
-
max time kernel
103s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 09:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2da5132e12616704799ce0f75738bd90N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
2da5132e12616704799ce0f75738bd90N.exe
-
Size
68KB
-
MD5
2da5132e12616704799ce0f75738bd90
-
SHA1
d8ca261a6fdc4679213c84e71991cd92d5fa98dc
-
SHA256
0b5cc57cf9510d0b50f33f146347242cbfe8ad47c27850ffca64590657e8e931
-
SHA512
e503e8a441dbfe1e4fcde746c6137ccd78b11be1612a4ab71194ada0476a76bf9c542fcea8c11d906364bdf801a5f646d960d91ef2fecb3912f07258578129dd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdI:ymb3NkkiQ3mdBjF0yMliI
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/1316-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3004 lxlxllx.exe 4052 bhnhtt.exe 936 pjvpj.exe 972 jdpdv.exe 2872 llfxxxr.exe 3824 frffflr.exe 3260 bbnhtn.exe 728 djvpj.exe 220 ppdvj.exe 3896 rllxlrl.exe 4128 hbtnbb.exe 4344 3ddvd.exe 1592 1ppdp.exe 1344 xlfxlxl.exe 620 btnhhb.exe 1564 tbbnhb.exe 4852 1jvpd.exe 4548 vppdv.exe 3044 7rlfxxl.exe 4704 ttbbbt.exe 2672 jdjdj.exe 2540 pvdvd.exe 1364 fxrfrrl.exe 2352 nhbnhb.exe 3904 pjvjv.exe 4552 xlfrlfr.exe 3628 1xrrlxr.exe 536 fllxrlf.exe 2824 thhnnn.exe 4500 pjdvp.exe 1644 jdvjv.exe 2172 7flllfl.exe 3440 5bnnnn.exe 4944 pvjvp.exe 1244 jjpdj.exe 3428 1xrrlfr.exe 2648 fxrlffx.exe 4160 hbbnhb.exe 3248 1jppj.exe 1572 dpjdj.exe 3912 rrxrxrr.exe 2164 nttttt.exe 3608 5hhhtt.exe 2932 9hhbhh.exe 224 jvpdp.exe 3492 xfrlfrf.exe 3348 3flxxrf.exe 2480 ntnnnn.exe 1200 nhnbhb.exe 4244 vdvpd.exe 3456 jpvpj.exe 4344 1rrfrll.exe 880 lxfxxrx.exe 4928 3lrfrrf.exe 1344 tttnbt.exe 1692 bntthb.exe 1544 pjjdd.exe 4196 pjvjj.exe 5016 xxflfxx.exe 4568 ttnhtt.exe 3392 ntbbtt.exe 1524 7bthbb.exe 4704 frrllll.exe 2088 rffxrrf.exe -
resource yara_rule behavioral2/memory/1316-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lllffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfffff.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1316 wrote to memory of 3004 1316 2da5132e12616704799ce0f75738bd90N.exe 84 PID 1316 wrote to memory of 3004 1316 2da5132e12616704799ce0f75738bd90N.exe 84 PID 1316 wrote to memory of 3004 1316 2da5132e12616704799ce0f75738bd90N.exe 84 PID 3004 wrote to memory of 4052 3004 lxlxllx.exe 85 PID 3004 wrote to memory of 4052 3004 lxlxllx.exe 85 PID 3004 wrote to memory of 4052 3004 lxlxllx.exe 85 PID 4052 wrote to memory of 936 4052 bhnhtt.exe 86 PID 4052 wrote to memory of 936 4052 bhnhtt.exe 86 PID 4052 wrote to memory of 936 4052 bhnhtt.exe 86 PID 936 wrote to memory of 972 936 pjvpj.exe 87 PID 936 wrote to memory of 972 936 pjvpj.exe 87 PID 936 wrote to memory of 972 936 pjvpj.exe 87 PID 972 wrote to memory of 2872 972 jdpdv.exe 88 PID 972 wrote to memory of 2872 972 jdpdv.exe 88 PID 972 wrote to memory of 2872 972 jdpdv.exe 88 PID 2872 wrote to memory of 3824 2872 llfxxxr.exe 89 PID 2872 wrote to memory of 3824 2872 llfxxxr.exe 89 PID 2872 wrote to memory of 3824 2872 llfxxxr.exe 89 PID 3824 wrote to memory of 3260 3824 frffflr.exe 90 PID 3824 wrote to memory of 3260 3824 frffflr.exe 90 PID 3824 wrote to memory of 3260 3824 frffflr.exe 90 PID 3260 wrote to memory of 728 3260 bbnhtn.exe 91 PID 3260 wrote to memory of 728 3260 bbnhtn.exe 91 PID 3260 wrote to memory of 728 3260 bbnhtn.exe 91 PID 728 wrote to memory of 220 728 djvpj.exe 92 PID 728 wrote to memory of 220 728 djvpj.exe 92 PID 728 wrote to memory of 220 728 djvpj.exe 92 PID 220 wrote to memory of 3896 220 ppdvj.exe 93 PID 220 wrote to memory of 3896 220 ppdvj.exe 93 PID 220 wrote to memory of 3896 220 ppdvj.exe 93 PID 3896 wrote to memory of 4128 3896 rllxlrl.exe 94 PID 3896 wrote to memory of 4128 3896 rllxlrl.exe 94 PID 3896 wrote to memory of 4128 3896 rllxlrl.exe 94 PID 4128 wrote to memory of 4344 4128 hbtnbb.exe 95 PID 4128 wrote to memory of 4344 4128 hbtnbb.exe 95 PID 4128 wrote to memory of 4344 4128 hbtnbb.exe 95 PID 4344 wrote to memory of 1592 4344 3ddvd.exe 96 PID 4344 wrote to memory of 1592 4344 3ddvd.exe 96 PID 4344 wrote to memory of 1592 4344 3ddvd.exe 96 PID 1592 wrote to memory of 1344 1592 1ppdp.exe 97 PID 1592 wrote to memory of 1344 1592 1ppdp.exe 97 PID 1592 wrote to memory of 1344 1592 1ppdp.exe 97 PID 1344 wrote to memory of 620 1344 xlfxlxl.exe 98 PID 1344 wrote to memory of 620 1344 xlfxlxl.exe 98 PID 1344 wrote to memory of 620 1344 xlfxlxl.exe 98 PID 620 wrote to memory of 1564 620 btnhhb.exe 99 PID 620 wrote to memory of 1564 620 btnhhb.exe 99 PID 620 wrote to memory of 1564 620 btnhhb.exe 99 PID 1564 wrote to memory of 4852 1564 tbbnhb.exe 100 PID 1564 wrote to memory of 4852 1564 tbbnhb.exe 100 PID 1564 wrote to memory of 4852 1564 tbbnhb.exe 100 PID 4852 wrote to memory of 4548 4852 1jvpd.exe 101 PID 4852 wrote to memory of 4548 4852 1jvpd.exe 101 PID 4852 wrote to memory of 4548 4852 1jvpd.exe 101 PID 4548 wrote to memory of 3044 4548 vppdv.exe 102 PID 4548 wrote to memory of 3044 4548 vppdv.exe 102 PID 4548 wrote to memory of 3044 4548 vppdv.exe 102 PID 3044 wrote to memory of 4704 3044 7rlfxxl.exe 103 PID 3044 wrote to memory of 4704 3044 7rlfxxl.exe 103 PID 3044 wrote to memory of 4704 3044 7rlfxxl.exe 103 PID 4704 wrote to memory of 2672 4704 ttbbbt.exe 104 PID 4704 wrote to memory of 2672 4704 ttbbbt.exe 104 PID 4704 wrote to memory of 2672 4704 ttbbbt.exe 104 PID 2672 wrote to memory of 2540 2672 jdjdj.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2da5132e12616704799ce0f75738bd90N.exe"C:\Users\Admin\AppData\Local\Temp\2da5132e12616704799ce0f75738bd90N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\lxlxllx.exec:\lxlxllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bhnhtt.exec:\bhnhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\pjvpj.exec:\pjvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\jdpdv.exec:\jdpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\llfxxxr.exec:\llfxxxr.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\frffflr.exec:\frffflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\bbnhtn.exec:\bbnhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\djvpj.exec:\djvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\ppdvj.exec:\ppdvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\rllxlrl.exec:\rllxlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\hbtnbb.exec:\hbtnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\3ddvd.exec:\3ddvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\1ppdp.exec:\1ppdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\xlfxlxl.exec:\xlfxlxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\btnhhb.exec:\btnhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\tbbnhb.exec:\tbbnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\1jvpd.exec:\1jvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\vppdv.exec:\vppdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\7rlfxxl.exec:\7rlfxxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\ttbbbt.exec:\ttbbbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\jdjdj.exec:\jdjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\pvdvd.exec:\pvdvd.exe23⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fxrfrrl.exec:\fxrfrrl.exe24⤵
- Executes dropped EXE
PID:1364 -
\??\c:\nhbnhb.exec:\nhbnhb.exe25⤵
- Executes dropped EXE
PID:2352 -
\??\c:\pjvjv.exec:\pjvjv.exe26⤵
- Executes dropped EXE
PID:3904 -
\??\c:\xlfrlfr.exec:\xlfrlfr.exe27⤵
- Executes dropped EXE
PID:4552 -
\??\c:\1xrrlxr.exec:\1xrrlxr.exe28⤵
- Executes dropped EXE
PID:3628 -
\??\c:\fllxrlf.exec:\fllxrlf.exe29⤵
- Executes dropped EXE
PID:536 -
\??\c:\thhnnn.exec:\thhnnn.exe30⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pjdvp.exec:\pjdvp.exe31⤵
- Executes dropped EXE
PID:4500 -
\??\c:\jdvjv.exec:\jdvjv.exe32⤵
- Executes dropped EXE
PID:1644 -
\??\c:\7flllfl.exec:\7flllfl.exe33⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5bnnnn.exec:\5bnnnn.exe34⤵
- Executes dropped EXE
PID:3440 -
\??\c:\pvjvp.exec:\pvjvp.exe35⤵
- Executes dropped EXE
PID:4944 -
\??\c:\jjpdj.exec:\jjpdj.exe36⤵
- Executes dropped EXE
PID:1244 -
\??\c:\1xrrlfr.exec:\1xrrlfr.exe37⤵
- Executes dropped EXE
PID:3428 -
\??\c:\fxrlffx.exec:\fxrlffx.exe38⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hbbnhb.exec:\hbbnhb.exe39⤵
- Executes dropped EXE
PID:4160 -
\??\c:\1jppj.exec:\1jppj.exe40⤵
- Executes dropped EXE
PID:3248 -
\??\c:\dpjdj.exec:\dpjdj.exe41⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rrxrxrr.exec:\rrxrxrr.exe42⤵
- Executes dropped EXE
PID:3912 -
\??\c:\nttttt.exec:\nttttt.exe43⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5hhhtt.exec:\5hhhtt.exe44⤵
- Executes dropped EXE
PID:3608 -
\??\c:\9hhbhh.exec:\9hhbhh.exe45⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jvpdp.exec:\jvpdp.exe46⤵
- Executes dropped EXE
PID:224 -
\??\c:\xfrlfrf.exec:\xfrlfrf.exe47⤵
- Executes dropped EXE
PID:3492 -
\??\c:\3flxxrf.exec:\3flxxrf.exe48⤵
- Executes dropped EXE
PID:3348 -
\??\c:\ntnnnn.exec:\ntnnnn.exe49⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nhnbhb.exec:\nhnbhb.exe50⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vdvpd.exec:\vdvpd.exe51⤵
- Executes dropped EXE
PID:4244 -
\??\c:\jpvpj.exec:\jpvpj.exe52⤵
- Executes dropped EXE
PID:3456 -
\??\c:\1rrfrll.exec:\1rrfrll.exe53⤵
- Executes dropped EXE
PID:4344 -
\??\c:\lxfxxrx.exec:\lxfxxrx.exe54⤵
- Executes dropped EXE
PID:880 -
\??\c:\3lrfrrf.exec:\3lrfrrf.exe55⤵
- Executes dropped EXE
PID:4928 -
\??\c:\tttnbt.exec:\tttnbt.exe56⤵
- Executes dropped EXE
PID:1344 -
\??\c:\bntthb.exec:\bntthb.exe57⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pjjdd.exec:\pjjdd.exe58⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pjvjj.exec:\pjvjj.exe59⤵
- Executes dropped EXE
PID:4196 -
\??\c:\xxflfxx.exec:\xxflfxx.exe60⤵
- Executes dropped EXE
PID:5016 -
\??\c:\ttnhtt.exec:\ttnhtt.exe61⤵
- Executes dropped EXE
PID:4568 -
\??\c:\ntbbtt.exec:\ntbbtt.exe62⤵
- Executes dropped EXE
PID:3392 -
\??\c:\7bthbb.exec:\7bthbb.exe63⤵
- Executes dropped EXE
PID:1524 -
\??\c:\frrllll.exec:\frrllll.exe64⤵
- Executes dropped EXE
PID:4704 -
\??\c:\rffxrrf.exec:\rffxrrf.exe65⤵
- Executes dropped EXE
PID:2088 -
\??\c:\thtnhh.exec:\thtnhh.exe66⤵PID:3388
-
\??\c:\thttnh.exec:\thttnh.exe67⤵PID:3468
-
\??\c:\pjjdv.exec:\pjjdv.exe68⤵PID:908
-
\??\c:\vppdp.exec:\vppdp.exe69⤵PID:1996
-
\??\c:\5djvv.exec:\5djvv.exe70⤵PID:2220
-
\??\c:\7lxxllf.exec:\7lxxllf.exe71⤵PID:3336
-
\??\c:\5hhbtn.exec:\5hhbtn.exe72⤵PID:3384
-
\??\c:\hbtnhh.exec:\hbtnhh.exe73⤵PID:3628
-
\??\c:\vvvpv.exec:\vvvpv.exe74⤵PID:2020
-
\??\c:\vpvvp.exec:\vpvvp.exe75⤵PID:1116
-
\??\c:\rffxllx.exec:\rffxllx.exe76⤵PID:1892
-
\??\c:\flrrlfx.exec:\flrrlfx.exe77⤵PID:4988
-
\??\c:\btnhnh.exec:\btnhnh.exe78⤵PID:5032
-
\??\c:\nhbthb.exec:\nhbthb.exe79⤵PID:3320
-
\??\c:\bhhbtt.exec:\bhhbtt.exe80⤵PID:960
-
\??\c:\djjdp.exec:\djjdp.exe81⤵PID:1628
-
\??\c:\rrlxrlf.exec:\rrlxrlf.exe82⤵PID:4124
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe83⤵PID:3292
-
\??\c:\3bbthn.exec:\3bbthn.exe84⤵PID:4424
-
\??\c:\hntnth.exec:\hntnth.exe85⤵PID:5064
-
\??\c:\pjvpd.exec:\pjvpd.exe86⤵PID:684
-
\??\c:\jjjvj.exec:\jjjvj.exe87⤵PID:3280
-
\??\c:\7pdvj.exec:\7pdvj.exe88⤵PID:4492
-
\??\c:\lxxrllf.exec:\lxxrllf.exe89⤵PID:1572
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe90⤵PID:3416
-
\??\c:\hbtnhh.exec:\hbtnhh.exe91⤵PID:1368
-
\??\c:\nbhbhb.exec:\nbhbhb.exe92⤵PID:3608
-
\??\c:\pjpjd.exec:\pjpjd.exe93⤵PID:3260
-
\??\c:\vjddp.exec:\vjddp.exe94⤵PID:5112
-
\??\c:\rfxrlff.exec:\rfxrlff.exe95⤵PID:4956
-
\??\c:\9rllfxr.exec:\9rllfxr.exe96⤵PID:4264
-
\??\c:\bttbbn.exec:\bttbbn.exe97⤵PID:396
-
\??\c:\9bthbn.exec:\9bthbn.exe98⤵PID:2156
-
\??\c:\jddvp.exec:\jddvp.exe99⤵PID:948
-
\??\c:\jpjpv.exec:\jpjpv.exe100⤵PID:3080
-
\??\c:\9lrflfr.exec:\9lrflfr.exe101⤵PID:4696
-
\??\c:\rllfrrl.exec:\rllfrrl.exe102⤵PID:1820
-
\??\c:\5thhbt.exec:\5thhbt.exe103⤵PID:2964
-
\??\c:\jddpp.exec:\jddpp.exe104⤵PID:4676
-
\??\c:\3ppjd.exec:\3ppjd.exe105⤵PID:2456
-
\??\c:\xrxxlxr.exec:\xrxxlxr.exe106⤵PID:3112
-
\??\c:\rlfxfxx.exec:\rlfxfxx.exe107⤵PID:380
-
\??\c:\xxrlfff.exec:\xxrlfff.exe108⤵PID:1412
-
\??\c:\htbthh.exec:\htbthh.exe109⤵PID:4668
-
\??\c:\9jddp.exec:\9jddp.exe110⤵PID:4912
-
\??\c:\lfrlxrl.exec:\lfrlxrl.exe111⤵PID:4776
-
\??\c:\3rlfffx.exec:\3rlfffx.exe112⤵PID:2576
-
\??\c:\7tbhhh.exec:\7tbhhh.exe113⤵PID:4704
-
\??\c:\jvdvp.exec:\jvdvp.exe114⤵PID:3996
-
\??\c:\pvpvp.exec:\pvpvp.exe115⤵PID:3388
-
\??\c:\xrfxfrl.exec:\xrfxfrl.exe116⤵PID:3468
-
\??\c:\lffxrrf.exec:\lffxrrf.exe117⤵PID:756
-
\??\c:\nhnhhh.exec:\nhnhhh.exe118⤵PID:1960
-
\??\c:\tttbht.exec:\tttbht.exe119⤵PID:1776
-
\??\c:\3vdvp.exec:\3vdvp.exe120⤵PID:4648
-
\??\c:\pjjjd.exec:\pjjjd.exe121⤵PID:2100
-
\??\c:\5rfllrr.exec:\5rfllrr.exe122⤵PID:3612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-