Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
528657f0c2cd44677465b2e9e62a4ab0N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
528657f0c2cd44677465b2e9e62a4ab0N.exe
-
Size
82KB
-
MD5
528657f0c2cd44677465b2e9e62a4ab0
-
SHA1
2e1bb0041695e6da6146a9baca5bbbb559af8ca5
-
SHA256
ed6134a2c083d3d1444f6894fd919a7ea3378ee535c33267ee54000c17751efd
-
SHA512
7637cddbfb01cc582d8fe94be043f5368a6546268bc7dfecb2908c57488b14c86452993f0d4210ede9e3dbf1fc6573703b04eb3e1a29211d717441e5ef8fcf26
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qk:ymb3NkkiQ3mdBjFIIp9L9QrrA8H
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4308-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-55-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1176 bnbtnn.exe 3444 jdvpd.exe 3688 flfxrll.exe 1560 ffxxrfx.exe 2704 bttnhh.exe 2036 5nnbtt.exe 2876 5jjdv.exe 1536 1llxrlx.exe 2488 lfrlffx.exe 2224 nbnbtn.exe 2180 vjpjd.exe 1756 rlllxxx.exe 3924 thttnt.exe 2000 5jjpp.exe 2772 5lrrlff.exe 2968 7flfxxr.exe 4644 bbhbtn.exe 672 7tthbb.exe 4900 djvjp.exe 1248 xrxrlxr.exe 4120 3nnhbb.exe 3880 ddpjp.exe 2660 xxrxffl.exe 2412 lflfxxf.exe 4624 bnthhn.exe 3284 vjvvv.exe 644 vjdjd.exe 1136 9ffxrlf.exe 2880 fxrlfrl.exe 1416 tnhbtt.exe 1012 dvjpp.exe 1196 xxrrlrx.exe 2444 1vpjj.exe 648 lfffxff.exe 2416 fxfxxxr.exe 3756 dvjdv.exe 412 xlrlxxl.exe 2472 xlrffxx.exe 4672 hnhbbb.exe 1928 7hnhbt.exe 4464 pjpjj.exe 3952 xxrrrrl.exe 4968 lfllrrx.exe 3220 hhhbbb.exe 2032 hbtnhn.exe 1560 7vpvp.exe 2704 3flfffr.exe 4668 btnhnt.exe 2620 jvvpp.exe 1636 flrrllf.exe 2604 5xffxff.exe 2108 ttnnnn.exe 4188 1hnnhn.exe 1460 vpddp.exe 3656 5vdvp.exe 1640 7pdvd.exe 2556 llrlrrr.exe 1456 frxxrrr.exe 2980 nnhbbb.exe 4488 1ttnhh.exe 4296 vpppj.exe 544 vpjjd.exe 376 xrxrfff.exe 4512 xrlfxfx.exe -
resource yara_rule behavioral2/memory/4308-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhnb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4308 wrote to memory of 1176 4308 528657f0c2cd44677465b2e9e62a4ab0N.exe 83 PID 4308 wrote to memory of 1176 4308 528657f0c2cd44677465b2e9e62a4ab0N.exe 83 PID 4308 wrote to memory of 1176 4308 528657f0c2cd44677465b2e9e62a4ab0N.exe 83 PID 1176 wrote to memory of 3444 1176 bnbtnn.exe 84 PID 1176 wrote to memory of 3444 1176 bnbtnn.exe 84 PID 1176 wrote to memory of 3444 1176 bnbtnn.exe 84 PID 3444 wrote to memory of 3688 3444 jdvpd.exe 85 PID 3444 wrote to memory of 3688 3444 jdvpd.exe 85 PID 3444 wrote to memory of 3688 3444 jdvpd.exe 85 PID 3688 wrote to memory of 1560 3688 flfxrll.exe 86 PID 3688 wrote to memory of 1560 3688 flfxrll.exe 86 PID 3688 wrote to memory of 1560 3688 flfxrll.exe 86 PID 1560 wrote to memory of 2704 1560 ffxxrfx.exe 87 PID 1560 wrote to memory of 2704 1560 ffxxrfx.exe 87 PID 1560 wrote to memory of 2704 1560 ffxxrfx.exe 87 PID 2704 wrote to memory of 2036 2704 bttnhh.exe 88 PID 2704 wrote to memory of 2036 2704 bttnhh.exe 88 PID 2704 wrote to memory of 2036 2704 bttnhh.exe 88 PID 2036 wrote to memory of 2876 2036 5nnbtt.exe 89 PID 2036 wrote to memory of 2876 2036 5nnbtt.exe 89 PID 2036 wrote to memory of 2876 2036 5nnbtt.exe 89 PID 2876 wrote to memory of 1536 2876 5jjdv.exe 90 PID 2876 wrote to memory of 1536 2876 5jjdv.exe 90 PID 2876 wrote to memory of 1536 2876 5jjdv.exe 90 PID 1536 wrote to memory of 2488 1536 1llxrlx.exe 91 PID 1536 wrote to memory of 2488 1536 1llxrlx.exe 91 PID 1536 wrote to memory of 2488 1536 1llxrlx.exe 91 PID 2488 wrote to memory of 2224 2488 lfrlffx.exe 92 PID 2488 wrote to memory of 2224 2488 lfrlffx.exe 92 PID 2488 wrote to memory of 2224 2488 lfrlffx.exe 92 PID 2224 wrote to memory of 2180 2224 nbnbtn.exe 93 PID 2224 wrote to memory of 2180 2224 nbnbtn.exe 93 PID 2224 wrote to memory of 2180 2224 nbnbtn.exe 93 PID 2180 wrote to memory of 1756 2180 vjpjd.exe 94 PID 2180 wrote to memory of 1756 2180 vjpjd.exe 94 PID 2180 wrote to memory of 1756 2180 vjpjd.exe 94 PID 1756 wrote to memory of 3924 1756 rlllxxx.exe 95 PID 1756 wrote to memory of 3924 1756 rlllxxx.exe 95 PID 1756 wrote to memory of 3924 1756 rlllxxx.exe 95 PID 3924 wrote to memory of 2000 3924 thttnt.exe 96 PID 3924 wrote to memory of 2000 3924 thttnt.exe 96 PID 3924 wrote to memory of 2000 3924 thttnt.exe 96 PID 2000 wrote to memory of 2772 2000 5jjpp.exe 97 PID 2000 wrote to memory of 2772 2000 5jjpp.exe 97 PID 2000 wrote to memory of 2772 2000 5jjpp.exe 97 PID 2772 wrote to memory of 2968 2772 5lrrlff.exe 98 PID 2772 wrote to memory of 2968 2772 5lrrlff.exe 98 PID 2772 wrote to memory of 2968 2772 5lrrlff.exe 98 PID 2968 wrote to memory of 4644 2968 7flfxxr.exe 100 PID 2968 wrote to memory of 4644 2968 7flfxxr.exe 100 PID 2968 wrote to memory of 4644 2968 7flfxxr.exe 100 PID 4644 wrote to memory of 672 4644 bbhbtn.exe 101 PID 4644 wrote to memory of 672 4644 bbhbtn.exe 101 PID 4644 wrote to memory of 672 4644 bbhbtn.exe 101 PID 672 wrote to memory of 4900 672 7tthbb.exe 102 PID 672 wrote to memory of 4900 672 7tthbb.exe 102 PID 672 wrote to memory of 4900 672 7tthbb.exe 102 PID 4900 wrote to memory of 1248 4900 djvjp.exe 103 PID 4900 wrote to memory of 1248 4900 djvjp.exe 103 PID 4900 wrote to memory of 1248 4900 djvjp.exe 103 PID 1248 wrote to memory of 4120 1248 xrxrlxr.exe 104 PID 1248 wrote to memory of 4120 1248 xrxrlxr.exe 104 PID 1248 wrote to memory of 4120 1248 xrxrlxr.exe 104 PID 4120 wrote to memory of 3880 4120 3nnhbb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\528657f0c2cd44677465b2e9e62a4ab0N.exe"C:\Users\Admin\AppData\Local\Temp\528657f0c2cd44677465b2e9e62a4ab0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\bnbtnn.exec:\bnbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\jdvpd.exec:\jdvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\flfxrll.exec:\flfxrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\ffxxrfx.exec:\ffxxrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\bttnhh.exec:\bttnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5nnbtt.exec:\5nnbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\5jjdv.exec:\5jjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\1llxrlx.exec:\1llxrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\lfrlffx.exec:\lfrlffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\nbnbtn.exec:\nbnbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vjpjd.exec:\vjpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\rlllxxx.exec:\rlllxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\thttnt.exec:\thttnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\5jjpp.exec:\5jjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\5lrrlff.exec:\5lrrlff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\7flfxxr.exec:\7flfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\bbhbtn.exec:\bbhbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\7tthbb.exec:\7tthbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\djvjp.exec:\djvjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\xrxrlxr.exec:\xrxrlxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\3nnhbb.exec:\3nnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\ddpjp.exec:\ddpjp.exe23⤵
- Executes dropped EXE
PID:3880 -
\??\c:\xxrxffl.exec:\xxrxffl.exe24⤵
- Executes dropped EXE
PID:2660 -
\??\c:\lflfxxf.exec:\lflfxxf.exe25⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bnthhn.exec:\bnthhn.exe26⤵
- Executes dropped EXE
PID:4624 -
\??\c:\vjvvv.exec:\vjvvv.exe27⤵
- Executes dropped EXE
PID:3284 -
\??\c:\vjdjd.exec:\vjdjd.exe28⤵
- Executes dropped EXE
PID:644 -
\??\c:\9ffxrlf.exec:\9ffxrlf.exe29⤵
- Executes dropped EXE
PID:1136 -
\??\c:\fxrlfrl.exec:\fxrlfrl.exe30⤵
- Executes dropped EXE
PID:2880 -
\??\c:\tnhbtt.exec:\tnhbtt.exe31⤵
- Executes dropped EXE
PID:1416 -
\??\c:\dvjpp.exec:\dvjpp.exe32⤵
- Executes dropped EXE
PID:1012 -
\??\c:\xxrrlrx.exec:\xxrrlrx.exe33⤵
- Executes dropped EXE
PID:1196 -
\??\c:\1vpjj.exec:\1vpjj.exe34⤵
- Executes dropped EXE
PID:2444 -
\??\c:\lfffxff.exec:\lfffxff.exe35⤵
- Executes dropped EXE
PID:648 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe36⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dvjdv.exec:\dvjdv.exe37⤵
- Executes dropped EXE
PID:3756 -
\??\c:\xlrlxxl.exec:\xlrlxxl.exe38⤵
- Executes dropped EXE
PID:412 -
\??\c:\xlrffxx.exec:\xlrffxx.exe39⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hnhbbb.exec:\hnhbbb.exe40⤵
- Executes dropped EXE
PID:4672 -
\??\c:\7hnhbt.exec:\7hnhbt.exe41⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pjpjj.exec:\pjpjj.exe42⤵
- Executes dropped EXE
PID:4464 -
\??\c:\xxrrrrl.exec:\xxrrrrl.exe43⤵
- Executes dropped EXE
PID:3952 -
\??\c:\lfllrrx.exec:\lfllrrx.exe44⤵
- Executes dropped EXE
PID:4968 -
\??\c:\hhhbbb.exec:\hhhbbb.exe45⤵
- Executes dropped EXE
PID:3220 -
\??\c:\hbtnhn.exec:\hbtnhn.exe46⤵
- Executes dropped EXE
PID:2032 -
\??\c:\7vpvp.exec:\7vpvp.exe47⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3flfffr.exec:\3flfffr.exe48⤵
- Executes dropped EXE
PID:2704 -
\??\c:\btnhnt.exec:\btnhnt.exe49⤵
- Executes dropped EXE
PID:4668 -
\??\c:\jvvpp.exec:\jvvpp.exe50⤵
- Executes dropped EXE
PID:2620 -
\??\c:\flrrllf.exec:\flrrllf.exe51⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5xffxff.exec:\5xffxff.exe52⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ttnnnn.exec:\ttnnnn.exe53⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1hnnhn.exec:\1hnnhn.exe54⤵
- Executes dropped EXE
PID:4188 -
\??\c:\vpddp.exec:\vpddp.exe55⤵
- Executes dropped EXE
PID:1460 -
\??\c:\5vdvp.exec:\5vdvp.exe56⤵
- Executes dropped EXE
PID:3656 -
\??\c:\7pdvd.exec:\7pdvd.exe57⤵
- Executes dropped EXE
PID:1640 -
\??\c:\llrlrrr.exec:\llrlrrr.exe58⤵
- Executes dropped EXE
PID:2556 -
\??\c:\frxxrrr.exec:\frxxrrr.exe59⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nnhbbb.exec:\nnhbbb.exe60⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1ttnhh.exec:\1ttnhh.exe61⤵
- Executes dropped EXE
PID:4488 -
\??\c:\vpppj.exec:\vpppj.exe62⤵
- Executes dropped EXE
PID:4296 -
\??\c:\vpjjd.exec:\vpjjd.exe63⤵
- Executes dropped EXE
PID:544 -
\??\c:\xrxrfff.exec:\xrxrfff.exe64⤵
- Executes dropped EXE
PID:376 -
\??\c:\xrlfxfx.exec:\xrlfxfx.exe65⤵
- Executes dropped EXE
PID:4512 -
\??\c:\3nnhbb.exec:\3nnhbb.exe66⤵PID:1244
-
\??\c:\nhhttb.exec:\nhhttb.exe67⤵PID:4956
-
\??\c:\dvvvv.exec:\dvvvv.exe68⤵PID:1520
-
\??\c:\pjjdv.exec:\pjjdv.exe69⤵PID:876
-
\??\c:\ppvvd.exec:\ppvvd.exe70⤵PID:2352
-
\??\c:\5rffrxr.exec:\5rffrxr.exe71⤵PID:4632
-
\??\c:\tbbbtt.exec:\tbbbtt.exe72⤵PID:1752
-
\??\c:\hbtnhh.exec:\hbtnhh.exe73⤵PID:2856
-
\??\c:\5dvpv.exec:\5dvpv.exe74⤵PID:4544
-
\??\c:\vppjv.exec:\vppjv.exe75⤵PID:3916
-
\??\c:\jdppp.exec:\jdppp.exe76⤵PID:1772
-
\??\c:\xfrlfff.exec:\xfrlfff.exe77⤵PID:1668
-
\??\c:\tbhttt.exec:\tbhttt.exe78⤵PID:1960
-
\??\c:\btntnt.exec:\btntnt.exe79⤵PID:4872
-
\??\c:\3hnnhb.exec:\3hnnhb.exe80⤵PID:536
-
\??\c:\pjvjp.exec:\pjvjp.exe81⤵PID:2024
-
\??\c:\frrflfx.exec:\frrflfx.exe82⤵PID:1012
-
\??\c:\9nbbtt.exec:\9nbbtt.exe83⤵PID:5052
-
\??\c:\bbhhnn.exec:\bbhhnn.exe84⤵PID:2540
-
\??\c:\jvdvp.exec:\jvdvp.exe85⤵PID:3864
-
\??\c:\dvvvd.exec:\dvvvd.exe86⤵PID:2416
-
\??\c:\rrxxrrx.exec:\rrxxrrx.exe87⤵PID:3756
-
\??\c:\fxxxxff.exec:\fxxxxff.exe88⤵PID:412
-
\??\c:\nnbtnn.exec:\nnbtnn.exe89⤵PID:456
-
\??\c:\jvvpp.exec:\jvvpp.exe90⤵PID:3600
-
\??\c:\3rrlfff.exec:\3rrlfff.exe91⤵PID:4592
-
\??\c:\xrrrlll.exec:\xrrrlll.exe92⤵PID:716
-
\??\c:\hbbtnn.exec:\hbbtnn.exe93⤵PID:2892
-
\??\c:\5bhhbn.exec:\5bhhbn.exe94⤵PID:2596
-
\??\c:\7dddv.exec:\7dddv.exe95⤵PID:2748
-
\??\c:\rrrrfff.exec:\rrrrfff.exe96⤵PID:1956
-
\??\c:\tnhhhh.exec:\tnhhhh.exe97⤵PID:2032
-
\??\c:\3ntnbh.exec:\3ntnbh.exe98⤵PID:3472
-
\??\c:\pdvpj.exec:\pdvpj.exe99⤵PID:1780
-
\??\c:\vvvpp.exec:\vvvpp.exe100⤵PID:2512
-
\??\c:\rrrlffx.exec:\rrrlffx.exe101⤵PID:4596
-
\??\c:\5xlfxfx.exec:\5xlfxfx.exe102⤵PID:1420
-
\??\c:\nnbtnn.exec:\nnbtnn.exe103⤵PID:4168
-
\??\c:\3ttnbb.exec:\3ttnbb.exe104⤵PID:3348
-
\??\c:\pvdjv.exec:\pvdjv.exe105⤵PID:4388
-
\??\c:\lflfrrx.exec:\lflfrrx.exe106⤵PID:3656
-
\??\c:\rllffrx.exec:\rllffrx.exe107⤵PID:2452
-
\??\c:\thhtnn.exec:\thhtnn.exe108⤵PID:4124
-
\??\c:\nnnhbh.exec:\nnnhbh.exe109⤵PID:2912
-
\??\c:\ddpdv.exec:\ddpdv.exe110⤵PID:2980
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe111⤵PID:4144
-
\??\c:\thhbbt.exec:\thhbbt.exe112⤵PID:4296
-
\??\c:\btnnbb.exec:\btnnbb.exe113⤵PID:3524
-
\??\c:\1dvjd.exec:\1dvjd.exe114⤵PID:1852
-
\??\c:\dpdvv.exec:\dpdvv.exe115⤵PID:4200
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe116⤵PID:4004
-
\??\c:\1llfxxr.exec:\1llfxxr.exe117⤵PID:4548
-
\??\c:\llxxrrr.exec:\llxxrrr.exe118⤵PID:2132
-
\??\c:\1nbbbn.exec:\1nbbbn.exe119⤵PID:876
-
\??\c:\dvvpj.exec:\dvvpj.exe120⤵PID:2352
-
\??\c:\vpjdd.exec:\vpjdd.exe121⤵PID:892
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe122⤵PID:4424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-