Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 21:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe
-
Size
106KB
-
MD5
c670a3012341143aa2ceb3fd8aa54400
-
SHA1
fb5b81271c13e3e640af0fa7eddc8e0cd18f9efb
-
SHA256
59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964
-
SHA512
3861c6461b016e102039af447654635dc6c92a57973ef20b7ac80322766f4a1bcf5c1098b33a6d47c0b6bbeaa7f6e3beffce0f9dd32852c5797b1ee4447c18cf
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3CmW:n3C9BRo7MlrWKVT+buBGu3PHW
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1976-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/824-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1816 nnnbth.exe 2324 tbhthb.exe 2480 pvjdp.exe 2800 rrlxrfx.exe 2844 1bbbnt.exe 2564 vppvd.exe 2668 xxxffff.exe 2544 nhtthn.exe 2580 vvpvj.exe 1084 9jvjp.exe 2788 fxxflrl.exe 1860 lfrfrxx.exe 2068 ttnthn.exe 2764 jdpjv.exe 1060 jjjjv.exe 2908 rfxflrl.exe 2892 ffrfrfr.exe 2192 nhbntb.exe 2184 1dpvd.exe 1480 3pdjp.exe 1072 lfrxrff.exe 1764 rlfrlrf.exe 1632 5hthnn.exe 3032 vpjvp.exe 1512 jjvjp.exe 552 rlxlrxl.exe 344 9rffxlx.exe 1028 bbnntb.exe 1700 hnnbth.exe 1792 9jjpd.exe 824 vpjvj.exe 476 9fflrxl.exe 2380 frrlrxl.exe 2848 hbttbn.exe 2816 1vvvp.exe 2824 vjpjp.exe 2188 tttbnn.exe 2728 vdjdj.exe 2704 jvddj.exe 2700 1ppvp.exe 2588 fxlrrfr.exe 2148 9rrfrlx.exe 1528 ttnbth.exe 2784 7hnbnt.exe 1944 pvpdp.exe 2788 ddjpj.exe 1080 rrrrflx.exe 1264 rlrxfxl.exe 1336 hbnttt.exe 1848 9btbtb.exe 1060 7vdjd.exe 1768 1dpvp.exe 2924 xxffrfx.exe 2080 bbnnhn.exe 1712 nhtbhn.exe 844 nnthtb.exe 1480 pjvpj.exe 1124 lrfrlff.exe 736 lrfxlfl.exe 1960 tbtbnb.exe 568 7bnntt.exe 1732 5tthtb.exe 1984 3dvjj.exe 1508 vvpdj.exe -
resource yara_rule behavioral1/memory/1976-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/824-310-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1816 1976 59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe 31 PID 1976 wrote to memory of 1816 1976 59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe 31 PID 1976 wrote to memory of 1816 1976 59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe 31 PID 1976 wrote to memory of 1816 1976 59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe 31 PID 1816 wrote to memory of 2324 1816 nnnbth.exe 32 PID 1816 wrote to memory of 2324 1816 nnnbth.exe 32 PID 1816 wrote to memory of 2324 1816 nnnbth.exe 32 PID 1816 wrote to memory of 2324 1816 nnnbth.exe 32 PID 2324 wrote to memory of 2480 2324 tbhthb.exe 33 PID 2324 wrote to memory of 2480 2324 tbhthb.exe 33 PID 2324 wrote to memory of 2480 2324 tbhthb.exe 33 PID 2324 wrote to memory of 2480 2324 tbhthb.exe 33 PID 2480 wrote to memory of 2800 2480 pvjdp.exe 34 PID 2480 wrote to memory of 2800 2480 pvjdp.exe 34 PID 2480 wrote to memory of 2800 2480 pvjdp.exe 34 PID 2480 wrote to memory of 2800 2480 pvjdp.exe 34 PID 2800 wrote to memory of 2844 2800 rrlxrfx.exe 35 PID 2800 wrote to memory of 2844 2800 rrlxrfx.exe 35 PID 2800 wrote to memory of 2844 2800 rrlxrfx.exe 35 PID 2800 wrote to memory of 2844 2800 rrlxrfx.exe 35 PID 2844 wrote to memory of 2564 2844 1bbbnt.exe 36 PID 2844 wrote to memory of 2564 2844 1bbbnt.exe 36 PID 2844 wrote to memory of 2564 2844 1bbbnt.exe 36 PID 2844 wrote to memory of 2564 2844 1bbbnt.exe 36 PID 2564 wrote to memory of 2668 2564 vppvd.exe 37 PID 2564 wrote to memory of 2668 2564 vppvd.exe 37 PID 2564 wrote to memory of 2668 2564 vppvd.exe 37 PID 2564 wrote to memory of 2668 2564 vppvd.exe 37 PID 2668 wrote to memory of 2544 2668 xxxffff.exe 38 PID 2668 wrote to memory of 2544 2668 xxxffff.exe 38 PID 2668 wrote to memory of 2544 2668 xxxffff.exe 38 PID 2668 wrote to memory of 2544 2668 xxxffff.exe 38 PID 2544 wrote to memory of 2580 2544 nhtthn.exe 39 PID 2544 wrote to memory of 2580 2544 nhtthn.exe 39 PID 2544 wrote to memory of 2580 2544 nhtthn.exe 39 PID 2544 wrote to memory of 2580 2544 nhtthn.exe 39 PID 2580 wrote to memory of 1084 2580 vvpvj.exe 40 PID 2580 wrote to memory of 1084 2580 vvpvj.exe 40 PID 2580 wrote to memory of 1084 2580 vvpvj.exe 40 PID 2580 wrote to memory of 1084 2580 vvpvj.exe 40 PID 1084 wrote to memory of 2788 1084 9jvjp.exe 41 PID 1084 wrote to memory of 2788 1084 9jvjp.exe 41 PID 1084 wrote to memory of 2788 1084 9jvjp.exe 41 PID 1084 wrote to memory of 2788 1084 9jvjp.exe 41 PID 2788 wrote to memory of 1860 2788 fxxflrl.exe 42 PID 2788 wrote to memory of 1860 2788 fxxflrl.exe 42 PID 2788 wrote to memory of 1860 2788 fxxflrl.exe 42 PID 2788 wrote to memory of 1860 2788 fxxflrl.exe 42 PID 1860 wrote to memory of 2068 1860 lfrfrxx.exe 43 PID 1860 wrote to memory of 2068 1860 lfrfrxx.exe 43 PID 1860 wrote to memory of 2068 1860 lfrfrxx.exe 43 PID 1860 wrote to memory of 2068 1860 lfrfrxx.exe 43 PID 2068 wrote to memory of 2764 2068 ttnthn.exe 44 PID 2068 wrote to memory of 2764 2068 ttnthn.exe 44 PID 2068 wrote to memory of 2764 2068 ttnthn.exe 44 PID 2068 wrote to memory of 2764 2068 ttnthn.exe 44 PID 2764 wrote to memory of 1060 2764 jdpjv.exe 45 PID 2764 wrote to memory of 1060 2764 jdpjv.exe 45 PID 2764 wrote to memory of 1060 2764 jdpjv.exe 45 PID 2764 wrote to memory of 1060 2764 jdpjv.exe 45 PID 1060 wrote to memory of 2908 1060 jjjjv.exe 46 PID 1060 wrote to memory of 2908 1060 jjjjv.exe 46 PID 1060 wrote to memory of 2908 1060 jjjjv.exe 46 PID 1060 wrote to memory of 2908 1060 jjjjv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe"C:\Users\Admin\AppData\Local\Temp\59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\nnnbth.exec:\nnnbth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\tbhthb.exec:\tbhthb.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\pvjdp.exec:\pvjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\rrlxrfx.exec:\rrlxrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1bbbnt.exec:\1bbbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\vppvd.exec:\vppvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\xxxffff.exec:\xxxffff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nhtthn.exec:\nhtthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\vvpvj.exec:\vvpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\9jvjp.exec:\9jvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\fxxflrl.exec:\fxxflrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lfrfrxx.exec:\lfrfrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\ttnthn.exec:\ttnthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\jdpjv.exec:\jdpjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jjjjv.exec:\jjjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\rfxflrl.exec:\rfxflrl.exe17⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe18⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nhbntb.exec:\nhbntb.exe19⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1dpvd.exec:\1dpvd.exe20⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3pdjp.exec:\3pdjp.exe21⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lfrxrff.exec:\lfrxrff.exe22⤵
- Executes dropped EXE
PID:1072 -
\??\c:\rlfrlrf.exec:\rlfrlrf.exe23⤵
- Executes dropped EXE
PID:1764 -
\??\c:\5hthnn.exec:\5hthnn.exe24⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vpjvp.exec:\vpjvp.exe25⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jjvjp.exec:\jjvjp.exe26⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rlxlrxl.exec:\rlxlrxl.exe27⤵
- Executes dropped EXE
PID:552 -
\??\c:\9rffxlx.exec:\9rffxlx.exe28⤵
- Executes dropped EXE
PID:344 -
\??\c:\bbnntb.exec:\bbnntb.exe29⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hnnbth.exec:\hnnbth.exe30⤵
- Executes dropped EXE
PID:1700 -
\??\c:\9jjpd.exec:\9jjpd.exe31⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vpjvj.exec:\vpjvj.exe32⤵
- Executes dropped EXE
PID:824 -
\??\c:\9fflrxl.exec:\9fflrxl.exe33⤵
- Executes dropped EXE
PID:476 -
\??\c:\frrlrxl.exec:\frrlrxl.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hbttbn.exec:\hbttbn.exe35⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1vvvp.exec:\1vvvp.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vjpjp.exec:\vjpjp.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tttbnn.exec:\tttbnn.exe38⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vdjdj.exec:\vdjdj.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jvddj.exec:\jvddj.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1ppvp.exec:\1ppvp.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\fxlrrfr.exec:\fxlrrfr.exe42⤵
- Executes dropped EXE
PID:2588 -
\??\c:\9rrfrlx.exec:\9rrfrlx.exe43⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ttnbth.exec:\ttnbth.exe44⤵
- Executes dropped EXE
PID:1528 -
\??\c:\7hnbnt.exec:\7hnbnt.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pvpdp.exec:\pvpdp.exe46⤵
- Executes dropped EXE
PID:1944 -
\??\c:\ddjpj.exec:\ddjpj.exe47⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rrrrflx.exec:\rrrrflx.exe48⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rlrxfxl.exec:\rlrxfxl.exe49⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hbnttt.exec:\hbnttt.exe50⤵
- Executes dropped EXE
PID:1336 -
\??\c:\9btbtb.exec:\9btbtb.exe51⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7vdjd.exec:\7vdjd.exe52⤵
- Executes dropped EXE
PID:1060 -
\??\c:\1dpvp.exec:\1dpvp.exe53⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xxffrfx.exec:\xxffrfx.exe54⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bbnnhn.exec:\bbnnhn.exe55⤵
- Executes dropped EXE
PID:2080 -
\??\c:\nhtbhn.exec:\nhtbhn.exe56⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nnthtb.exec:\nnthtb.exe57⤵
- Executes dropped EXE
PID:844 -
\??\c:\pjvpj.exec:\pjvpj.exe58⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lrfrlff.exec:\lrfrlff.exe59⤵
- Executes dropped EXE
PID:1124 -
\??\c:\lrfxlfl.exec:\lrfxlfl.exe60⤵
- Executes dropped EXE
PID:736 -
\??\c:\tbtbnb.exec:\tbtbnb.exe61⤵
- Executes dropped EXE
PID:1960 -
\??\c:\7bnntt.exec:\7bnntt.exe62⤵
- Executes dropped EXE
PID:568 -
\??\c:\5tthtb.exec:\5tthtb.exe63⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3dvjj.exec:\3dvjj.exe64⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vvpdj.exec:\vvpdj.exe65⤵
- Executes dropped EXE
PID:1508 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe66⤵PID:2364
-
\??\c:\fxlrflr.exec:\fxlrflr.exe67⤵PID:1560
-
\??\c:\hnbhbt.exec:\hnbhbt.exe68⤵PID:1920
-
\??\c:\nhhhnn.exec:\nhhhnn.exe69⤵PID:1608
-
\??\c:\5jjjv.exec:\5jjjv.exe70⤵PID:2296
-
\??\c:\ppppj.exec:\ppppj.exe71⤵PID:2720
-
\??\c:\llfrxfr.exec:\llfrxfr.exe72⤵PID:2172
-
\??\c:\llflflr.exec:\llflflr.exe73⤵PID:2676
-
\??\c:\bbhtnb.exec:\bbhtnb.exe74⤵PID:2808
-
\??\c:\bbtthn.exec:\bbtthn.exe75⤵PID:2684
-
\??\c:\ppdvp.exec:\ppdvp.exe76⤵PID:2816
-
\??\c:\1dvdd.exec:\1dvdd.exe77⤵PID:2916
-
\??\c:\pjddv.exec:\pjddv.exe78⤵PID:1032
-
\??\c:\fxxxrfr.exec:\fxxxrfr.exe79⤵PID:2856
-
\??\c:\fflfxxx.exec:\fflfxxx.exe80⤵PID:2704
-
\??\c:\btbnnb.exec:\btbnnb.exe81⤵PID:2604
-
\??\c:\9ntbtb.exec:\9ntbtb.exe82⤵PID:2152
-
\??\c:\pjdvp.exec:\pjdvp.exe83⤵PID:2776
-
\??\c:\vvpvp.exec:\vvpvp.exe84⤵PID:2772
-
\??\c:\dvpdj.exec:\dvpdj.exe85⤵PID:1620
-
\??\c:\fflflfl.exec:\fflflfl.exe86⤵PID:2600
-
\??\c:\xxlrlrl.exec:\xxlrlrl.exe87⤵PID:1392
-
\??\c:\1btnbn.exec:\1btnbn.exe88⤵PID:960
-
\??\c:\3bbnht.exec:\3bbnht.exe89⤵PID:2768
-
\??\c:\djjvj.exec:\djjvj.exe90⤵PID:1128
-
\??\c:\vvjjj.exec:\vvjjj.exe91⤵PID:2712
-
\??\c:\dvjpd.exec:\dvjpd.exe92⤵PID:2972
-
\??\c:\rlllrxf.exec:\rlllrxf.exe93⤵PID:2620
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe94⤵PID:2956
-
\??\c:\tbthbh.exec:\tbthbh.exe95⤵PID:1428
-
\??\c:\hbtbbh.exec:\hbtbbh.exe96⤵PID:1660
-
\??\c:\vpdvp.exec:\vpdvp.exe97⤵PID:2512
-
\??\c:\3vppj.exec:\3vppj.exe98⤵PID:1696
-
\??\c:\rlllxlf.exec:\rlllxlf.exe99⤵PID:2016
-
\??\c:\rxflrll.exec:\rxflrll.exe100⤵PID:1728
-
\??\c:\bbbbnn.exec:\bbbbnn.exe101⤵PID:2144
-
\??\c:\hthnbn.exec:\hthnbn.exe102⤵PID:748
-
\??\c:\vpvvp.exec:\vpvvp.exe103⤵PID:292
-
\??\c:\vpjpj.exec:\vpjpj.exe104⤵PID:1544
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe105⤵PID:1508
-
\??\c:\llxlrxr.exec:\llxlrxr.exe106⤵PID:868
-
\??\c:\nhthth.exec:\nhthth.exe107⤵PID:2288
-
\??\c:\dvdvj.exec:\dvdvj.exe108⤵PID:1056
-
\??\c:\ppvdv.exec:\ppvdv.exe109⤵PID:2140
-
\??\c:\rrxxfrl.exec:\rrxxfrl.exe110⤵PID:2352
-
\??\c:\lrlxrff.exec:\lrlxrff.exe111⤵PID:2180
-
\??\c:\nhbhnh.exec:\nhbhnh.exe112⤵PID:1304
-
\??\c:\nnbnbt.exec:\nnbnbt.exe113⤵PID:2796
-
\??\c:\ddjpp.exec:\ddjpp.exe114⤵PID:2828
-
\??\c:\jjjvp.exec:\jjjvp.exe115⤵PID:2688
-
\??\c:\hbtbnn.exec:\hbtbnn.exe116⤵PID:2816
-
\??\c:\hhnntb.exec:\hhnntb.exe117⤵PID:2584
-
\??\c:\ddvdd.exec:\ddvdd.exe118⤵PID:2644
-
\??\c:\dvjpj.exec:\dvjpj.exe119⤵PID:2608
-
\??\c:\lfxlxfr.exec:\lfxlxfr.exe120⤵PID:2224
-
\??\c:\ttnthn.exec:\ttnthn.exe121⤵PID:2548
-
\??\c:\hbhtht.exec:\hbhtht.exe122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-