Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe
Resource
win7-20240903-en
General
-
Target
1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe
-
Size
82KB
-
MD5
ede0967ff87cc55acdde654977abf7c0
-
SHA1
c5bf62be175da58c387c4ede379e389ca782c85c
-
SHA256
1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6
-
SHA512
473566f480745b9d3b32605b290dafb128377793efd45153f67dee6d8690619ee6953ecf97a09f950cd09d267dace0c6cf59edcc7dac7a7338c2fc41544cc77f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qc:ymb3NkkiQ3mdBjFIIp9L9QrrA8d
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2348-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1364-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1412-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1364 jdvvd.exe 2516 3lxxffl.exe 1200 bnbntb.exe 2008 dvdpp.exe 2840 vjpvj.exe 2968 rrfflrf.exe 2316 thhbbt.exe 2924 jdvvd.exe 2656 xxxlfll.exe 2004 7tthtb.exe 668 thnnhh.exe 1412 tnbhtb.exe 2440 dpjdv.exe 2672 rfxxxfl.exe 1056 frxrrll.exe 1116 tnbntt.exe 1352 nbnhhb.exe 1952 5pdvv.exe 2172 jvjjj.exe 1708 3xrlrrx.exe 1616 lxlrrrx.exe 2176 bbtbbb.exe 2044 nbnttt.exe 1216 5vvpv.exe 2216 pjvpp.exe 344 vpddv.exe 1296 lfrlrrx.exe 3028 btntht.exe 3036 3hbthh.exe 1640 9jvdj.exe 2392 1xrrxxx.exe 1664 xrffllr.exe 2956 lfxlfxx.exe 2708 nhnbbh.exe 2744 5nbttb.exe 2900 pdpvd.exe 2024 vdppj.exe 2892 frflfxx.exe 2968 lxrxrll.exe 2712 7frfrxx.exe 2720 bhhbtn.exe 2116 nbnbtt.exe 2068 5djjv.exe 1404 dppvd.exe 2856 vjddd.exe 532 5rlrrrr.exe 388 1lxrrrl.exe 320 hhtttb.exe 2672 nhbhnn.exe 1300 vjvdd.exe 1900 dpddd.exe 1144 flxxrxx.exe 2196 lfrxffl.exe 2304 bnnttn.exe 2172 5nbttt.exe 1776 9vdvd.exe 1656 3pdjv.exe 448 7jpjd.exe 844 xlffllf.exe 2564 1xrxxxr.exe 1120 pjpvd.exe 1432 dvppv.exe 344 xlxrxfx.exe 992 rffrxff.exe -
resource yara_rule behavioral1/memory/2348-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1364-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1412-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1116-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1364 2348 1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe 30 PID 2348 wrote to memory of 1364 2348 1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe 30 PID 2348 wrote to memory of 1364 2348 1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe 30 PID 2348 wrote to memory of 1364 2348 1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe 30 PID 1364 wrote to memory of 2516 1364 jdvvd.exe 31 PID 1364 wrote to memory of 2516 1364 jdvvd.exe 31 PID 1364 wrote to memory of 2516 1364 jdvvd.exe 31 PID 1364 wrote to memory of 2516 1364 jdvvd.exe 31 PID 2516 wrote to memory of 1200 2516 3lxxffl.exe 32 PID 2516 wrote to memory of 1200 2516 3lxxffl.exe 32 PID 2516 wrote to memory of 1200 2516 3lxxffl.exe 32 PID 2516 wrote to memory of 1200 2516 3lxxffl.exe 32 PID 1200 wrote to memory of 2008 1200 bnbntb.exe 33 PID 1200 wrote to memory of 2008 1200 bnbntb.exe 33 PID 1200 wrote to memory of 2008 1200 bnbntb.exe 33 PID 1200 wrote to memory of 2008 1200 bnbntb.exe 33 PID 2008 wrote to memory of 2840 2008 dvdpp.exe 34 PID 2008 wrote to memory of 2840 2008 dvdpp.exe 34 PID 2008 wrote to memory of 2840 2008 dvdpp.exe 34 PID 2008 wrote to memory of 2840 2008 dvdpp.exe 34 PID 2840 wrote to memory of 2968 2840 vjpvj.exe 35 PID 2840 wrote to memory of 2968 2840 vjpvj.exe 35 PID 2840 wrote to memory of 2968 2840 vjpvj.exe 35 PID 2840 wrote to memory of 2968 2840 vjpvj.exe 35 PID 2968 wrote to memory of 2316 2968 rrfflrf.exe 36 PID 2968 wrote to memory of 2316 2968 rrfflrf.exe 36 PID 2968 wrote to memory of 2316 2968 rrfflrf.exe 36 PID 2968 wrote to memory of 2316 2968 rrfflrf.exe 36 PID 2316 wrote to memory of 2924 2316 thhbbt.exe 37 PID 2316 wrote to memory of 2924 2316 thhbbt.exe 37 PID 2316 wrote to memory of 2924 2316 thhbbt.exe 37 PID 2316 wrote to memory of 2924 2316 thhbbt.exe 37 PID 2924 wrote to memory of 2656 2924 jdvvd.exe 38 PID 2924 wrote to memory of 2656 2924 jdvvd.exe 38 PID 2924 wrote to memory of 2656 2924 jdvvd.exe 38 PID 2924 wrote to memory of 2656 2924 jdvvd.exe 38 PID 2656 wrote to memory of 2004 2656 xxxlfll.exe 39 PID 2656 wrote to memory of 2004 2656 xxxlfll.exe 39 PID 2656 wrote to memory of 2004 2656 xxxlfll.exe 39 PID 2656 wrote to memory of 2004 2656 xxxlfll.exe 39 PID 2004 wrote to memory of 668 2004 7tthtb.exe 40 PID 2004 wrote to memory of 668 2004 7tthtb.exe 40 PID 2004 wrote to memory of 668 2004 7tthtb.exe 40 PID 2004 wrote to memory of 668 2004 7tthtb.exe 40 PID 668 wrote to memory of 1412 668 thnnhh.exe 41 PID 668 wrote to memory of 1412 668 thnnhh.exe 41 PID 668 wrote to memory of 1412 668 thnnhh.exe 41 PID 668 wrote to memory of 1412 668 thnnhh.exe 41 PID 1412 wrote to memory of 2440 1412 tnbhtb.exe 42 PID 1412 wrote to memory of 2440 1412 tnbhtb.exe 42 PID 1412 wrote to memory of 2440 1412 tnbhtb.exe 42 PID 1412 wrote to memory of 2440 1412 tnbhtb.exe 42 PID 2440 wrote to memory of 2672 2440 dpjdv.exe 43 PID 2440 wrote to memory of 2672 2440 dpjdv.exe 43 PID 2440 wrote to memory of 2672 2440 dpjdv.exe 43 PID 2440 wrote to memory of 2672 2440 dpjdv.exe 43 PID 2672 wrote to memory of 1056 2672 rfxxxfl.exe 44 PID 2672 wrote to memory of 1056 2672 rfxxxfl.exe 44 PID 2672 wrote to memory of 1056 2672 rfxxxfl.exe 44 PID 2672 wrote to memory of 1056 2672 rfxxxfl.exe 44 PID 1056 wrote to memory of 1116 1056 frxrrll.exe 45 PID 1056 wrote to memory of 1116 1056 frxrrll.exe 45 PID 1056 wrote to memory of 1116 1056 frxrrll.exe 45 PID 1056 wrote to memory of 1116 1056 frxrrll.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe"C:\Users\Admin\AppData\Local\Temp\1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\jdvvd.exec:\jdvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\3lxxffl.exec:\3lxxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\bnbntb.exec:\bnbntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\dvdpp.exec:\dvdpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\vjpvj.exec:\vjpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rrfflrf.exec:\rrfflrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\thhbbt.exec:\thhbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\jdvvd.exec:\jdvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\xxxlfll.exec:\xxxlfll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\7tthtb.exec:\7tthtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\thnnhh.exec:\thnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\tnbhtb.exec:\tnbhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\dpjdv.exec:\dpjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\rfxxxfl.exec:\rfxxxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\frxrrll.exec:\frxrrll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\tnbntt.exec:\tnbntt.exe17⤵
- Executes dropped EXE
PID:1116 -
\??\c:\nbnhhb.exec:\nbnhhb.exe18⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5pdvv.exec:\5pdvv.exe19⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jvjjj.exec:\jvjjj.exe20⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3xrlrrx.exec:\3xrlrrx.exe21⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe22⤵
- Executes dropped EXE
PID:1616 -
\??\c:\bbtbbb.exec:\bbtbbb.exe23⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nbnttt.exec:\nbnttt.exe24⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5vvpv.exec:\5vvpv.exe25⤵
- Executes dropped EXE
PID:1216 -
\??\c:\pjvpp.exec:\pjvpp.exe26⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vpddv.exec:\vpddv.exe27⤵
- Executes dropped EXE
PID:344 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe28⤵
- Executes dropped EXE
PID:1296 -
\??\c:\btntht.exec:\btntht.exe29⤵
- Executes dropped EXE
PID:3028 -
\??\c:\3hbthh.exec:\3hbthh.exe30⤵
- Executes dropped EXE
PID:3036 -
\??\c:\9jvdj.exec:\9jvdj.exe31⤵
- Executes dropped EXE
PID:1640 -
\??\c:\1xrrxxx.exec:\1xrrxxx.exe32⤵
- Executes dropped EXE
PID:2392 -
\??\c:\xrffllr.exec:\xrffllr.exe33⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lfxlfxx.exec:\lfxlfxx.exe34⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nhnbbh.exec:\nhnbbh.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5nbttb.exec:\5nbttb.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pdpvd.exec:\pdpvd.exe37⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vdppj.exec:\vdppj.exe38⤵
- Executes dropped EXE
PID:2024 -
\??\c:\frflfxx.exec:\frflfxx.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lxrxrll.exec:\lxrxrll.exe40⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7frfrxx.exec:\7frfrxx.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bhhbtn.exec:\bhhbtn.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nbnbtt.exec:\nbnbtt.exe43⤵
- Executes dropped EXE
PID:2116 -
\??\c:\5djjv.exec:\5djjv.exe44⤵
- Executes dropped EXE
PID:2068 -
\??\c:\dppvd.exec:\dppvd.exe45⤵
- Executes dropped EXE
PID:1404 -
\??\c:\vjddd.exec:\vjddd.exe46⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5rlrrrr.exec:\5rlrrrr.exe47⤵
- Executes dropped EXE
PID:532 -
\??\c:\1lxrrrl.exec:\1lxrrrl.exe48⤵
- Executes dropped EXE
PID:388 -
\??\c:\hhtttb.exec:\hhtttb.exe49⤵
- Executes dropped EXE
PID:320 -
\??\c:\nhbhnn.exec:\nhbhnn.exe50⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vjvdd.exec:\vjvdd.exe51⤵
- Executes dropped EXE
PID:1300 -
\??\c:\dpddd.exec:\dpddd.exe52⤵
- Executes dropped EXE
PID:1900 -
\??\c:\flxxrxx.exec:\flxxrxx.exe53⤵
- Executes dropped EXE
PID:1144 -
\??\c:\lfrxffl.exec:\lfrxffl.exe54⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bnnttn.exec:\bnnttn.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\5nbttt.exec:\5nbttt.exe56⤵
- Executes dropped EXE
PID:2172 -
\??\c:\9vdvd.exec:\9vdvd.exe57⤵
- Executes dropped EXE
PID:1776 -
\??\c:\3pdjv.exec:\3pdjv.exe58⤵
- Executes dropped EXE
PID:1656 -
\??\c:\7jpjd.exec:\7jpjd.exe59⤵
- Executes dropped EXE
PID:448 -
\??\c:\xlffllf.exec:\xlffllf.exe60⤵
- Executes dropped EXE
PID:844 -
\??\c:\1xrxxxr.exec:\1xrxxxr.exe61⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pjpvd.exec:\pjpvd.exe62⤵
- Executes dropped EXE
PID:1120 -
\??\c:\dvppv.exec:\dvppv.exe63⤵
- Executes dropped EXE
PID:1432 -
\??\c:\xlxrxfx.exec:\xlxrxfx.exe64⤵
- Executes dropped EXE
PID:344 -
\??\c:\rffrxff.exec:\rffrxff.exe65⤵
- Executes dropped EXE
PID:992 -
\??\c:\nbnnhh.exec:\nbnnhh.exe66⤵PID:900
-
\??\c:\5bntbh.exec:\5bntbh.exe67⤵PID:2132
-
\??\c:\dvpdj.exec:\dvpdj.exe68⤵PID:2320
-
\??\c:\9jpdp.exec:\9jpdp.exe69⤵PID:2096
-
\??\c:\3lfflfl.exec:\3lfflfl.exe70⤵PID:1532
-
\??\c:\xxlrlrf.exec:\xxlrlrf.exe71⤵PID:2572
-
\??\c:\hbnttb.exec:\hbnttb.exe72⤵PID:2496
-
\??\c:\1bttbb.exec:\1bttbb.exe73⤵PID:2412
-
\??\c:\jddjp.exec:\jddjp.exe74⤵PID:2708
-
\??\c:\pjdjp.exec:\pjdjp.exe75⤵PID:2876
-
\??\c:\1lxxxff.exec:\1lxxxff.exe76⤵PID:2900
-
\??\c:\fxfflxx.exec:\fxfflxx.exe77⤵PID:2024
-
\??\c:\7nhhht.exec:\7nhhht.exe78⤵PID:2716
-
\??\c:\thbbhh.exec:\thbbhh.exe79⤵PID:2604
-
\??\c:\dpvvv.exec:\dpvvv.exe80⤵PID:2924
-
\??\c:\dvvdp.exec:\dvvdp.exe81⤵PID:3064
-
\??\c:\rfxflrf.exec:\rfxflrf.exe82⤵PID:2352
-
\??\c:\xrffllr.exec:\xrffllr.exe83⤵PID:2356
-
\??\c:\7thhnb.exec:\7thhnb.exe84⤵PID:316
-
\??\c:\tnbthh.exec:\tnbthh.exe85⤵PID:296
-
\??\c:\tnhttb.exec:\tnhttb.exe86⤵PID:2836
-
\??\c:\pjvvj.exec:\pjvvj.exe87⤵PID:692
-
\??\c:\xlrxxfl.exec:\xlrxxfl.exe88⤵PID:592
-
\??\c:\xrlrllx.exec:\xrlrllx.exe89⤵PID:1100
-
\??\c:\frlrxff.exec:\frlrxff.exe90⤵PID:1744
-
\??\c:\tthnbh.exec:\tthnbh.exe91⤵PID:2936
-
\??\c:\hthnnt.exec:\hthnnt.exe92⤵PID:3044
-
\??\c:\pjvdd.exec:\pjvdd.exe93⤵PID:2244
-
\??\c:\lfxxxff.exec:\lfxxxff.exe94⤵PID:640
-
\??\c:\frrlffx.exec:\frrlffx.exe95⤵PID:2076
-
\??\c:\3ttttt.exec:\3ttttt.exe96⤵PID:1864
-
\??\c:\hthhhn.exec:\hthhhn.exe97⤵PID:1180
-
\??\c:\ppjvd.exec:\ppjvd.exe98⤵PID:2256
-
\??\c:\ddvdp.exec:\ddvdp.exe99⤵PID:1216
-
\??\c:\fffrrll.exec:\fffrrll.exe100⤵PID:1988
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe101⤵PID:1676
-
\??\c:\1hbhtb.exec:\1hbhtb.exe102⤵PID:2184
-
\??\c:\pjjpv.exec:\pjjpv.exe103⤵PID:1868
-
\??\c:\5vpjd.exec:\5vpjd.exe104⤵PID:1944
-
\??\c:\llflrxx.exec:\llflrxx.exe105⤵PID:800
-
\??\c:\lffxrrl.exec:\lffxrrl.exe106⤵PID:3036
-
\??\c:\tnbbhb.exec:\tnbbhb.exe107⤵PID:1500
-
\??\c:\thtnbt.exec:\thtnbt.exe108⤵PID:2104
-
\??\c:\pdjjd.exec:\pdjjd.exe109⤵PID:2516
-
\??\c:\dppjd.exec:\dppjd.exe110⤵PID:2868
-
\??\c:\fxrrflx.exec:\fxrrflx.exe111⤵PID:2972
-
\??\c:\frffffl.exec:\frffffl.exe112⤵PID:2956
-
\??\c:\9tntbb.exec:\9tntbb.exe113⤵PID:2756
-
\??\c:\3bthbh.exec:\3bthbh.exe114⤵PID:2752
-
\??\c:\nbhnbb.exec:\nbhnbb.exe115⤵PID:2904
-
\??\c:\dpvdd.exec:\dpvdd.exe116⤵PID:2908
-
\??\c:\jdpvv.exec:\jdpvv.exe117⤵PID:2792
-
\??\c:\xfrrrlr.exec:\xfrrrlr.exe118⤵PID:1712
-
\??\c:\ffflflx.exec:\ffflflx.exe119⤵PID:2720
-
\??\c:\5thhtt.exec:\5thhtt.exe120⤵PID:2888
-
\??\c:\nnntbh.exec:\nnntbh.exe121⤵PID:1400
-
\??\c:\nhthtb.exec:\nhthtb.exe122⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-