Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-09-2024 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5eba13d7401d55d653a22f71f988b3d0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
5eba13d7401d55d653a22f71f988b3d0N.exe
-
Size
67KB
-
MD5
5eba13d7401d55d653a22f71f988b3d0
-
SHA1
848e2559b1a8fbdfcadb91fbe038ccf4e4f482d9
-
SHA256
fb19a47d4f412ade50a2dc9a01aeee81204300e5304732627296de2860d77f04
-
SHA512
bc981e830c3fa45265bb77a7be1381224229202031b46ca5b8e3fe07343b7be076397e29be5d522a573dc3b29b8930b9d8b322a6aadc289a6c3e0f3a86f4e2b9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27BqfCe:ymb3NkkiQ3mdBjFI9cqfN
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/756-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/496-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2736 btnnbb.exe 2652 dvvpj.exe 2716 lllrfrl.exe 2660 llfrflx.exe 2544 tthnbh.exe 2944 nhthbn.exe 580 vvpvd.exe 756 5vvdd.exe 2804 fxrxlrx.exe 2564 3fxrrxf.exe 1244 nhhhhn.exe 496 bnhhnn.exe 1568 jjjpd.exe 1804 xxrlxfr.exe 1708 rrllxrl.exe 1644 tththt.exe 2092 btnhtn.exe 2152 vjdjp.exe 3000 jdjjp.exe 2332 lfllxfl.exe 2008 fxrxrrx.exe 1396 tnbnnb.exe 1112 3tnbhn.exe 1784 dvjpd.exe 824 9vpdv.exe 1408 ddddp.exe 556 lfrflxf.exe 884 btnbnt.exe 3008 5htnnn.exe 2752 pjvjp.exe 2672 vpvvp.exe 2880 frxfffl.exe 1164 3rrrrxf.exe 2812 fxrrlrf.exe 2540 htbbbt.exe 1092 bnbbnh.exe 332 jvvvd.exe 2848 dpdvv.exe 2284 rlrrfxf.exe 2712 rfllrrf.exe 2004 tnthth.exe 1792 tnnnnh.exe 1952 hbnbbn.exe 316 7vvdj.exe 1700 ppdvj.exe 2360 xlfllrx.exe 2852 rfrfrrf.exe 872 bbnnbh.exe 1080 tntbbh.exe 2700 pjpvd.exe 1760 3pvdj.exe 2184 9fffxrx.exe 2240 xxxlfrf.exe 2112 tnttbb.exe 1964 ttbnbh.exe 1276 9jdjj.exe 1084 dpvdp.exe 1544 dvpvp.exe 1784 7rfrxrf.exe 824 5rlxxfr.exe 2124 rlrfrxl.exe 1408 nhhhhh.exe 2496 bnttbb.exe 1732 bnntnn.exe -
resource yara_rule behavioral1/memory/2104-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/496-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/756-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-32-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2736 2104 5eba13d7401d55d653a22f71f988b3d0N.exe 96 PID 2104 wrote to memory of 2736 2104 5eba13d7401d55d653a22f71f988b3d0N.exe 96 PID 2104 wrote to memory of 2736 2104 5eba13d7401d55d653a22f71f988b3d0N.exe 96 PID 2104 wrote to memory of 2736 2104 5eba13d7401d55d653a22f71f988b3d0N.exe 96 PID 2736 wrote to memory of 2652 2736 btnnbb.exe 31 PID 2736 wrote to memory of 2652 2736 btnnbb.exe 31 PID 2736 wrote to memory of 2652 2736 btnnbb.exe 31 PID 2736 wrote to memory of 2652 2736 btnnbb.exe 31 PID 2652 wrote to memory of 2716 2652 dvvpj.exe 32 PID 2652 wrote to memory of 2716 2652 dvvpj.exe 32 PID 2652 wrote to memory of 2716 2652 dvvpj.exe 32 PID 2652 wrote to memory of 2716 2652 dvvpj.exe 32 PID 2716 wrote to memory of 2660 2716 lllrfrl.exe 33 PID 2716 wrote to memory of 2660 2716 lllrfrl.exe 33 PID 2716 wrote to memory of 2660 2716 lllrfrl.exe 33 PID 2716 wrote to memory of 2660 2716 lllrfrl.exe 33 PID 2660 wrote to memory of 2544 2660 llfrflx.exe 34 PID 2660 wrote to memory of 2544 2660 llfrflx.exe 34 PID 2660 wrote to memory of 2544 2660 llfrflx.exe 34 PID 2660 wrote to memory of 2544 2660 llfrflx.exe 34 PID 2544 wrote to memory of 2944 2544 tthnbh.exe 35 PID 2544 wrote to memory of 2944 2544 tthnbh.exe 35 PID 2544 wrote to memory of 2944 2544 tthnbh.exe 35 PID 2544 wrote to memory of 2944 2544 tthnbh.exe 35 PID 2944 wrote to memory of 580 2944 nhthbn.exe 36 PID 2944 wrote to memory of 580 2944 nhthbn.exe 36 PID 2944 wrote to memory of 580 2944 nhthbn.exe 36 PID 2944 wrote to memory of 580 2944 nhthbn.exe 36 PID 580 wrote to memory of 756 580 vvpvd.exe 37 PID 580 wrote to memory of 756 580 vvpvd.exe 37 PID 580 wrote to memory of 756 580 vvpvd.exe 37 PID 580 wrote to memory of 756 580 vvpvd.exe 37 PID 756 wrote to memory of 2804 756 5vvdd.exe 38 PID 756 wrote to memory of 2804 756 5vvdd.exe 38 PID 756 wrote to memory of 2804 756 5vvdd.exe 38 PID 756 wrote to memory of 2804 756 5vvdd.exe 38 PID 2804 wrote to memory of 2564 2804 fxrxlrx.exe 39 PID 2804 wrote to memory of 2564 2804 fxrxlrx.exe 39 PID 2804 wrote to memory of 2564 2804 fxrxlrx.exe 39 PID 2804 wrote to memory of 2564 2804 fxrxlrx.exe 39 PID 2564 wrote to memory of 1244 2564 3fxrrxf.exe 40 PID 2564 wrote to memory of 1244 2564 3fxrrxf.exe 40 PID 2564 wrote to memory of 1244 2564 3fxrrxf.exe 40 PID 2564 wrote to memory of 1244 2564 3fxrrxf.exe 40 PID 1244 wrote to memory of 496 1244 nhhhhn.exe 41 PID 1244 wrote to memory of 496 1244 nhhhhn.exe 41 PID 1244 wrote to memory of 496 1244 nhhhhn.exe 41 PID 1244 wrote to memory of 496 1244 nhhhhn.exe 41 PID 496 wrote to memory of 1568 496 bnhhnn.exe 42 PID 496 wrote to memory of 1568 496 bnhhnn.exe 42 PID 496 wrote to memory of 1568 496 bnhhnn.exe 42 PID 496 wrote to memory of 1568 496 bnhhnn.exe 42 PID 1568 wrote to memory of 1804 1568 jjjpd.exe 43 PID 1568 wrote to memory of 1804 1568 jjjpd.exe 43 PID 1568 wrote to memory of 1804 1568 jjjpd.exe 43 PID 1568 wrote to memory of 1804 1568 jjjpd.exe 43 PID 1804 wrote to memory of 1708 1804 xxrlxfr.exe 44 PID 1804 wrote to memory of 1708 1804 xxrlxfr.exe 44 PID 1804 wrote to memory of 1708 1804 xxrlxfr.exe 44 PID 1804 wrote to memory of 1708 1804 xxrlxfr.exe 44 PID 1708 wrote to memory of 1644 1708 rrllxrl.exe 45 PID 1708 wrote to memory of 1644 1708 rrllxrl.exe 45 PID 1708 wrote to memory of 1644 1708 rrllxrl.exe 45 PID 1708 wrote to memory of 1644 1708 rrllxrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eba13d7401d55d653a22f71f988b3d0N.exe"C:\Users\Admin\AppData\Local\Temp\5eba13d7401d55d653a22f71f988b3d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\btnnbb.exec:\btnnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\dvvpj.exec:\dvvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\lllrfrl.exec:\lllrfrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\llfrflx.exec:\llfrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\tthnbh.exec:\tthnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\nhthbn.exec:\nhthbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\vvpvd.exec:\vvpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\5vvdd.exec:\5vvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\3fxrrxf.exec:\3fxrrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nhhhhn.exec:\nhhhhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\bnhhnn.exec:\bnhhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
\??\c:\jjjpd.exec:\jjjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\xxrlxfr.exec:\xxrlxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\rrllxrl.exec:\rrllxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\tththt.exec:\tththt.exe17⤵
- Executes dropped EXE
PID:1644 -
\??\c:\btnhtn.exec:\btnhtn.exe18⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vjdjp.exec:\vjdjp.exe19⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jdjjp.exec:\jdjjp.exe20⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lfllxfl.exec:\lfllxfl.exe21⤵
- Executes dropped EXE
PID:2332 -
\??\c:\fxrxrrx.exec:\fxrxrrx.exe22⤵
- Executes dropped EXE
PID:2008 -
\??\c:\tnbnnb.exec:\tnbnnb.exe23⤵
- Executes dropped EXE
PID:1396 -
\??\c:\3tnbhn.exec:\3tnbhn.exe24⤵
- Executes dropped EXE
PID:1112 -
\??\c:\dvjpd.exec:\dvjpd.exe25⤵
- Executes dropped EXE
PID:1784 -
\??\c:\9vpdv.exec:\9vpdv.exe26⤵
- Executes dropped EXE
PID:824 -
\??\c:\ddddp.exec:\ddddp.exe27⤵
- Executes dropped EXE
PID:1408 -
\??\c:\lfrflxf.exec:\lfrflxf.exe28⤵
- Executes dropped EXE
PID:556 -
\??\c:\btnbnt.exec:\btnbnt.exe29⤵
- Executes dropped EXE
PID:884 -
\??\c:\5htnnn.exec:\5htnnn.exe30⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pjvjp.exec:\pjvjp.exe31⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vpvvp.exec:\vpvvp.exe32⤵
- Executes dropped EXE
PID:2672 -
\??\c:\frxfffl.exec:\frxfffl.exe33⤵
- Executes dropped EXE
PID:2880 -
\??\c:\3rrrrxf.exec:\3rrrrxf.exe34⤵
- Executes dropped EXE
PID:1164 -
\??\c:\fxrrlrf.exec:\fxrrlrf.exe35⤵
- Executes dropped EXE
PID:2812 -
\??\c:\htbbbt.exec:\htbbbt.exe36⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bnbbnh.exec:\bnbbnh.exe37⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jvvvd.exec:\jvvvd.exe38⤵
- Executes dropped EXE
PID:332 -
\??\c:\dpdvv.exec:\dpdvv.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rlrrfxf.exec:\rlrrfxf.exe40⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rfllrrf.exec:\rfllrrf.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tnthth.exec:\tnthth.exe42⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tnnnnh.exec:\tnnnnh.exe43⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hbnbbn.exec:\hbnbbn.exe44⤵
- Executes dropped EXE
PID:1952 -
\??\c:\7vvdj.exec:\7vvdj.exe45⤵
- Executes dropped EXE
PID:316 -
\??\c:\ppdvj.exec:\ppdvj.exe46⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xlfllrx.exec:\xlfllrx.exe47⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rfrfrrf.exec:\rfrfrrf.exe48⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bbnnbh.exec:\bbnnbh.exe49⤵
- Executes dropped EXE
PID:872 -
\??\c:\tntbbh.exec:\tntbbh.exe50⤵
- Executes dropped EXE
PID:1080 -
\??\c:\pjpvd.exec:\pjpvd.exe51⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3pvdj.exec:\3pvdj.exe52⤵
- Executes dropped EXE
PID:1760 -
\??\c:\9fffxrx.exec:\9fffxrx.exe53⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xxxlfrf.exec:\xxxlfrf.exe54⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tnttbb.exec:\tnttbb.exe55⤵
- Executes dropped EXE
PID:2112 -
\??\c:\ttbnbh.exec:\ttbnbh.exe56⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9jdjj.exec:\9jdjj.exe57⤵
- Executes dropped EXE
PID:1276 -
\??\c:\dpvdp.exec:\dpvdp.exe58⤵
- Executes dropped EXE
PID:1084 -
\??\c:\dvpvp.exec:\dvpvp.exe59⤵
- Executes dropped EXE
PID:1544 -
\??\c:\7rfrxrf.exec:\7rfrxrf.exe60⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5rlxxfr.exec:\5rlxxfr.exe61⤵
- Executes dropped EXE
PID:824 -
\??\c:\rlrfrxl.exec:\rlrfrxl.exe62⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nhhhhh.exec:\nhhhhh.exe63⤵
- Executes dropped EXE
PID:1408 -
\??\c:\bnttbb.exec:\bnttbb.exe64⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bnntnn.exec:\bnntnn.exe65⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vdvpp.exec:\vdvpp.exe66⤵PID:2748
-
\??\c:\pdppp.exec:\pdppp.exe67⤵PID:1564
-
\??\c:\rrlrffl.exec:\rrlrffl.exe68⤵PID:2736
-
\??\c:\xrflxfl.exec:\xrflxfl.exe69⤵PID:2120
-
\??\c:\7xxlxfx.exec:\7xxlxfx.exe70⤵PID:1560
-
\??\c:\nhtthh.exec:\nhtthh.exe71⤵PID:2560
-
\??\c:\5tbbhn.exec:\5tbbhn.exe72⤵PID:2568
-
\??\c:\fxxflff.exec:\fxxflff.exe73⤵PID:2576
-
\??\c:\rllrxfr.exec:\rllrxfr.exe74⤵PID:2628
-
\??\c:\htntbh.exec:\htntbh.exe75⤵PID:2556
-
\??\c:\9htbbh.exec:\9htbbh.exe76⤵PID:2844
-
\??\c:\bntbnt.exec:\bntbnt.exe77⤵PID:2984
-
\??\c:\1jddd.exec:\1jddd.exe78⤵PID:2848
-
\??\c:\vpjdj.exec:\vpjdj.exe79⤵PID:2924
-
\??\c:\dvjjp.exec:\dvjjp.exe80⤵PID:2384
-
\??\c:\rfrxffx.exec:\rfrxffx.exe81⤵PID:2720
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe82⤵PID:2548
-
\??\c:\hbbhnn.exec:\hbbhnn.exe83⤵PID:1684
-
\??\c:\tnbhtt.exec:\tnbhtt.exe84⤵PID:984
-
\??\c:\tntntn.exec:\tntntn.exe85⤵PID:2728
-
\??\c:\pjjdj.exec:\pjjdj.exe86⤵PID:1796
-
\??\c:\7dpdp.exec:\7dpdp.exe87⤵PID:2824
-
\??\c:\1dpdp.exec:\1dpdp.exe88⤵PID:1816
-
\??\c:\9lffrxf.exec:\9lffrxf.exe89⤵PID:1520
-
\??\c:\lxffffl.exec:\lxffffl.exe90⤵PID:2756
-
\??\c:\nhnntb.exec:\nhnntb.exe91⤵PID:2700
-
\??\c:\ttthtt.exec:\ttthtt.exe92⤵PID:2092
-
\??\c:\ppvjp.exec:\ppvjp.exe93⤵PID:3012
-
\??\c:\5pppd.exec:\5pppd.exe94⤵PID:3068
-
\??\c:\flxrrrr.exec:\flxrrrr.exe95⤵PID:2472
-
\??\c:\7hbhnt.exec:\7hbhnt.exe96⤵PID:1064
-
\??\c:\vjvvv.exec:\vjvvv.exe97⤵PID:3052
-
\??\c:\vjpvj.exec:\vjpvj.exe98⤵PID:1112
-
\??\c:\7lfrrrf.exec:\7lfrrrf.exe99⤵PID:1832
-
\??\c:\3rlxflx.exec:\3rlxflx.exe100⤵PID:1780
-
\??\c:\bbhhnn.exec:\bbhhnn.exe101⤵PID:2248
-
\??\c:\vjdvj.exec:\vjdvj.exe102⤵PID:548
-
\??\c:\1dddp.exec:\1dddp.exe103⤵PID:1340
-
\??\c:\5flfflr.exec:\5flfflr.exe104⤵PID:2212
-
\??\c:\5hhtnt.exec:\5hhtnt.exe105⤵PID:2408
-
\??\c:\hhtbtb.exec:\hhtbtb.exe106⤵PID:1712
-
\??\c:\vjvdj.exec:\vjvdj.exe107⤵PID:2724
-
\??\c:\rlfxrfl.exec:\rlfxrfl.exe108⤵PID:1592
-
\??\c:\tnhnbh.exec:\tnhnbh.exe109⤵PID:2388
-
\??\c:\ddpdv.exec:\ddpdv.exe110⤵PID:1908
-
\??\c:\ppjjv.exec:\ppjjv.exe111⤵PID:2244
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe112⤵PID:2716
-
\??\c:\htbtnh.exec:\htbtnh.exe113⤵PID:668
-
\??\c:\hbbhbh.exec:\hbbhbh.exe114⤵PID:1736
-
\??\c:\ppdjj.exec:\ppdjj.exe115⤵PID:2944
-
\??\c:\7dppp.exec:\7dppp.exe116⤵PID:1496
-
\??\c:\xrxxllr.exec:\xrxxllr.exe117⤵PID:2828
-
\??\c:\5fffxff.exec:\5fffxff.exe118⤵PID:2284
-
\??\c:\7nhntb.exec:\7nhntb.exe119⤵PID:2980
-
\??\c:\vpdvj.exec:\vpdvj.exe120⤵PID:2012
-
\??\c:\jdpvd.exec:\jdpvd.exe121⤵PID:2536
-
\??\c:\rlflxfr.exec:\rlflxfr.exe122⤵PID:1688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-