Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 13:48
Static task
static1
Behavioral task
behavioral1
Sample
4f887d89e0a1198f2bd82aa5b4d62d39ef65998bad876822fecbef6e59b6eb59.exe
Resource
win7-20240903-en
General
-
Target
4f887d89e0a1198f2bd82aa5b4d62d39ef65998bad876822fecbef6e59b6eb59.exe
-
Size
82KB
-
MD5
89ea02a71fbabafafff6639c845654a0
-
SHA1
9b7a5a817071a4873b596ee4f006b38df125e3e3
-
SHA256
4f887d89e0a1198f2bd82aa5b4d62d39ef65998bad876822fecbef6e59b6eb59
-
SHA512
cf872cf14e856916791be94a197af77b1ab71e1ada2ad7023cc4f029c493a3ad7a6bbde78752ff90a22815c10423e9c8a58d289f3f91d57ee602b178d9287cf8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qw:ymb3NkkiQ3mdBjFIIp9L9QrrA8T
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2652-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/288-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2744 btnntt.exe 2052 pjdjp.exe 2696 lfllffr.exe 2732 nnbhtb.exe 2632 djpvv.exe 3004 xxllxfl.exe 2028 fxrxfff.exe 2104 bbnntb.exe 1596 jdjvp.exe 288 3frxrrf.exe 2416 7xxflrf.exe 1700 btbbtt.exe 1936 hbtbhn.exe 324 dpvvd.exe 592 fxlfflr.exe 2144 fxlrflx.exe 3056 hhbbhh.exe 2984 pddjj.exe 420 3vppv.exe 2856 fxlflrr.exe 344 rxrrxrl.exe 792 bnthnn.exe 1712 nttbnb.exe 2912 3jvvj.exe 1792 rlflxfl.exe 2424 llfflll.exe 384 7lrrfff.exe 1948 9bhnnn.exe 3016 7vjjj.exe 2724 pjdjv.exe 1708 fxlxfrx.exe 2644 thnbhh.exe 2840 nbbbnt.exe 2916 vvdvv.exe 2680 7jvvd.exe 2520 xrllrrf.exe 2592 rlxflll.exe 2392 nhbnbb.exe 2328 ttbnnt.exe 2008 pjdvd.exe 2112 jjpvd.exe 764 fxflxxf.exe 2116 nbtttt.exe 2056 bbnntb.exe 1780 pvvvv.exe 1016 ddvpd.exe 2576 lxfflll.exe 576 9fxxffl.exe 760 ntbntt.exe 264 1ttbbh.exe 2380 vpvdj.exe 2176 pdppv.exe 2144 flxrxlr.exe 2960 9lxfllx.exe 2172 htnnnn.exe 820 1bhtnb.exe 1984 dvdjp.exe 688 vpjjj.exe 1076 frxffxf.exe 692 lxflrrx.exe 2476 tnhtbh.exe 2220 nhbtbb.exe 1560 dvdjj.exe 572 vpddj.exe -
resource yara_rule behavioral1/memory/2652-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrffr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2744 2652 4f887d89e0a1198f2bd82aa5b4d62d39ef65998bad876822fecbef6e59b6eb59.exe 30 PID 2652 wrote to memory of 2744 2652 4f887d89e0a1198f2bd82aa5b4d62d39ef65998bad876822fecbef6e59b6eb59.exe 30 PID 2652 wrote to memory of 2744 2652 4f887d89e0a1198f2bd82aa5b4d62d39ef65998bad876822fecbef6e59b6eb59.exe 30 PID 2652 wrote to memory of 2744 2652 4f887d89e0a1198f2bd82aa5b4d62d39ef65998bad876822fecbef6e59b6eb59.exe 30 PID 2744 wrote to memory of 2052 2744 btnntt.exe 31 PID 2744 wrote to memory of 2052 2744 btnntt.exe 31 PID 2744 wrote to memory of 2052 2744 btnntt.exe 31 PID 2744 wrote to memory of 2052 2744 btnntt.exe 31 PID 2052 wrote to memory of 2696 2052 pjdjp.exe 32 PID 2052 wrote to memory of 2696 2052 pjdjp.exe 32 PID 2052 wrote to memory of 2696 2052 pjdjp.exe 32 PID 2052 wrote to memory of 2696 2052 pjdjp.exe 32 PID 2696 wrote to memory of 2732 2696 lfllffr.exe 33 PID 2696 wrote to memory of 2732 2696 lfllffr.exe 33 PID 2696 wrote to memory of 2732 2696 lfllffr.exe 33 PID 2696 wrote to memory of 2732 2696 lfllffr.exe 33 PID 2732 wrote to memory of 2632 2732 nnbhtb.exe 34 PID 2732 wrote to memory of 2632 2732 nnbhtb.exe 34 PID 2732 wrote to memory of 2632 2732 nnbhtb.exe 34 PID 2732 wrote to memory of 2632 2732 nnbhtb.exe 34 PID 2632 wrote to memory of 3004 2632 djpvv.exe 35 PID 2632 wrote to memory of 3004 2632 djpvv.exe 35 PID 2632 wrote to memory of 3004 2632 djpvv.exe 35 PID 2632 wrote to memory of 3004 2632 djpvv.exe 35 PID 3004 wrote to memory of 2028 3004 xxllxfl.exe 36 PID 3004 wrote to memory of 2028 3004 xxllxfl.exe 36 PID 3004 wrote to memory of 2028 3004 xxllxfl.exe 36 PID 3004 wrote to memory of 2028 3004 xxllxfl.exe 36 PID 2028 wrote to memory of 2104 2028 fxrxfff.exe 37 PID 2028 wrote to memory of 2104 2028 fxrxfff.exe 37 PID 2028 wrote to memory of 2104 2028 fxrxfff.exe 37 PID 2028 wrote to memory of 2104 2028 fxrxfff.exe 37 PID 2104 wrote to memory of 1596 2104 bbnntb.exe 38 PID 2104 wrote to memory of 1596 2104 bbnntb.exe 38 PID 2104 wrote to memory of 1596 2104 bbnntb.exe 38 PID 2104 wrote to memory of 1596 2104 bbnntb.exe 38 PID 1596 wrote to memory of 288 1596 jdjvp.exe 39 PID 1596 wrote to memory of 288 1596 jdjvp.exe 39 PID 1596 wrote to memory of 288 1596 jdjvp.exe 39 PID 1596 wrote to memory of 288 1596 jdjvp.exe 39 PID 288 wrote to memory of 2416 288 3frxrrf.exe 40 PID 288 wrote to memory of 2416 288 3frxrrf.exe 40 PID 288 wrote to memory of 2416 288 3frxrrf.exe 40 PID 288 wrote to memory of 2416 288 3frxrrf.exe 40 PID 2416 wrote to memory of 1700 2416 7xxflrf.exe 41 PID 2416 wrote to memory of 1700 2416 7xxflrf.exe 41 PID 2416 wrote to memory of 1700 2416 7xxflrf.exe 41 PID 2416 wrote to memory of 1700 2416 7xxflrf.exe 41 PID 1700 wrote to memory of 1936 1700 btbbtt.exe 42 PID 1700 wrote to memory of 1936 1700 btbbtt.exe 42 PID 1700 wrote to memory of 1936 1700 btbbtt.exe 42 PID 1700 wrote to memory of 1936 1700 btbbtt.exe 42 PID 1936 wrote to memory of 324 1936 hbtbhn.exe 43 PID 1936 wrote to memory of 324 1936 hbtbhn.exe 43 PID 1936 wrote to memory of 324 1936 hbtbhn.exe 43 PID 1936 wrote to memory of 324 1936 hbtbhn.exe 43 PID 324 wrote to memory of 592 324 dpvvd.exe 44 PID 324 wrote to memory of 592 324 dpvvd.exe 44 PID 324 wrote to memory of 592 324 dpvvd.exe 44 PID 324 wrote to memory of 592 324 dpvvd.exe 44 PID 592 wrote to memory of 2144 592 fxlfflr.exe 45 PID 592 wrote to memory of 2144 592 fxlfflr.exe 45 PID 592 wrote to memory of 2144 592 fxlfflr.exe 45 PID 592 wrote to memory of 2144 592 fxlfflr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f887d89e0a1198f2bd82aa5b4d62d39ef65998bad876822fecbef6e59b6eb59.exe"C:\Users\Admin\AppData\Local\Temp\4f887d89e0a1198f2bd82aa5b4d62d39ef65998bad876822fecbef6e59b6eb59.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\btnntt.exec:\btnntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\pjdjp.exec:\pjdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\lfllffr.exec:\lfllffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nnbhtb.exec:\nnbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\djpvv.exec:\djpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xxllxfl.exec:\xxllxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\fxrxfff.exec:\fxrxfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\bbnntb.exec:\bbnntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\jdjvp.exec:\jdjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\3frxrrf.exec:\3frxrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\7xxflrf.exec:\7xxflrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\btbbtt.exec:\btbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\hbtbhn.exec:\hbtbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\dpvvd.exec:\dpvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\fxlfflr.exec:\fxlfflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\fxlrflx.exec:\fxlrflx.exe17⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hhbbhh.exec:\hhbbhh.exe18⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pddjj.exec:\pddjj.exe19⤵
- Executes dropped EXE
PID:2984 -
\??\c:\3vppv.exec:\3vppv.exe20⤵
- Executes dropped EXE
PID:420 -
\??\c:\fxlflrr.exec:\fxlflrr.exe21⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rxrrxrl.exec:\rxrrxrl.exe22⤵
- Executes dropped EXE
PID:344 -
\??\c:\bnthnn.exec:\bnthnn.exe23⤵
- Executes dropped EXE
PID:792 -
\??\c:\nttbnb.exec:\nttbnb.exe24⤵
- Executes dropped EXE
PID:1712 -
\??\c:\3jvvj.exec:\3jvvj.exe25⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rlflxfl.exec:\rlflxfl.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\llfflll.exec:\llfflll.exe27⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7lrrfff.exec:\7lrrfff.exe28⤵
- Executes dropped EXE
PID:384 -
\??\c:\9bhnnn.exec:\9bhnnn.exe29⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7vjjj.exec:\7vjjj.exe30⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pjdjv.exec:\pjdjv.exe31⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxlxfrx.exec:\fxlxfrx.exe32⤵
- Executes dropped EXE
PID:1708 -
\??\c:\thnbhh.exec:\thnbhh.exe33⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nbbbnt.exec:\nbbbnt.exe34⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vvdvv.exec:\vvdvv.exe35⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7jvvd.exec:\7jvvd.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xrllrrf.exec:\xrllrrf.exe37⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rlxflll.exec:\rlxflll.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nhbnbb.exec:\nhbnbb.exe39⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ttbnnt.exec:\ttbnnt.exe40⤵
- Executes dropped EXE
PID:2328 -
\??\c:\pjdvd.exec:\pjdvd.exe41⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jjpvd.exec:\jjpvd.exe42⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fxflxxf.exec:\fxflxxf.exe43⤵
- Executes dropped EXE
PID:764 -
\??\c:\nbtttt.exec:\nbtttt.exe44⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bbnntb.exec:\bbnntb.exe45⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pvvvv.exec:\pvvvv.exe46⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ddvpd.exec:\ddvpd.exe47⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lxfflll.exec:\lxfflll.exe48⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9fxxffl.exec:\9fxxffl.exe49⤵
- Executes dropped EXE
PID:576 -
\??\c:\ntbntt.exec:\ntbntt.exe50⤵
- Executes dropped EXE
PID:760 -
\??\c:\1ttbbh.exec:\1ttbbh.exe51⤵
- Executes dropped EXE
PID:264 -
\??\c:\vpvdj.exec:\vpvdj.exe52⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pdppv.exec:\pdppv.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\flxrxlr.exec:\flxrxlr.exe54⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9lxfllx.exec:\9lxfllx.exe55⤵
- Executes dropped EXE
PID:2960 -
\??\c:\htnnnn.exec:\htnnnn.exe56⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1bhtnb.exec:\1bhtnb.exe57⤵
- Executes dropped EXE
PID:820 -
\??\c:\dvdjp.exec:\dvdjp.exe58⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vpjjj.exec:\vpjjj.exe59⤵
- Executes dropped EXE
PID:688 -
\??\c:\frxffxf.exec:\frxffxf.exe60⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lxflrrx.exec:\lxflrrx.exe61⤵
- Executes dropped EXE
PID:692 -
\??\c:\tnhtbh.exec:\tnhtbh.exe62⤵
- Executes dropped EXE
PID:2476 -
\??\c:\nhbtbb.exec:\nhbtbb.exe63⤵
- Executes dropped EXE
PID:2220 -
\??\c:\dvdjj.exec:\dvdjj.exe64⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vpddj.exec:\vpddj.exe65⤵
- Executes dropped EXE
PID:572 -
\??\c:\7xfxllr.exec:\7xfxllr.exe66⤵PID:1532
-
\??\c:\rlxflll.exec:\rlxflll.exe67⤵PID:696
-
\??\c:\bttttb.exec:\bttttb.exe68⤵PID:1996
-
\??\c:\hhnhtn.exec:\hhnhtn.exe69⤵PID:2460
-
\??\c:\3jdjj.exec:\3jdjj.exe70⤵PID:2720
-
\??\c:\jdvpp.exec:\jdvpp.exe71⤵PID:1544
-
\??\c:\3fxrrxl.exec:\3fxrrxl.exe72⤵PID:2920
-
\??\c:\9frflfr.exec:\9frflfr.exe73⤵PID:2836
-
\??\c:\tthhnn.exec:\tthhnn.exe74⤵PID:2896
-
\??\c:\7thhnt.exec:\7thhnt.exe75⤵PID:2840
-
\??\c:\dvvvd.exec:\dvvvd.exe76⤵PID:2572
-
\??\c:\dpppv.exec:\dpppv.exe77⤵PID:2680
-
\??\c:\xllrxlx.exec:\xllrxlx.exe78⤵PID:2732
-
\??\c:\lxlfllx.exec:\lxlfllx.exe79⤵PID:2992
-
\??\c:\ttbbhh.exec:\ttbbhh.exe80⤵PID:2792
-
\??\c:\nbnttt.exec:\nbnttt.exe81⤵PID:1728
-
\??\c:\jdvjj.exec:\jdvjj.exe82⤵PID:2136
-
\??\c:\3pvvv.exec:\3pvvv.exe83⤵PID:1480
-
\??\c:\7vjjj.exec:\7vjjj.exe84⤵PID:788
-
\??\c:\9fffrrx.exec:\9fffrrx.exe85⤵PID:1596
-
\??\c:\xxrlxxf.exec:\xxrlxxf.exe86⤵PID:1612
-
\??\c:\hbbnbb.exec:\hbbnbb.exe87⤵PID:1236
-
\??\c:\nntntb.exec:\nntntb.exe88⤵PID:1092
-
\??\c:\7pvjd.exec:\7pvjd.exe89⤵PID:2784
-
\??\c:\jdppp.exec:\jdppp.exe90⤵PID:1600
-
\??\c:\lfrxllr.exec:\lfrxllr.exe91⤵PID:1496
-
\??\c:\xxrxffl.exec:\xxrxffl.exe92⤵PID:264
-
\??\c:\9nhnbh.exec:\9nhnbh.exe93⤵PID:1292
-
\??\c:\nnhtbh.exec:\nnhtbh.exe94⤵PID:2192
-
\??\c:\jdddd.exec:\jdddd.exe95⤵PID:2972
-
\??\c:\jdvjj.exec:\jdvjj.exe96⤵PID:3024
-
\??\c:\llrlxxl.exec:\llrlxxl.exe97⤵PID:2808
-
\??\c:\lfrfllx.exec:\lfrfllx.exe98⤵PID:1356
-
\??\c:\5ntnth.exec:\5ntnth.exe99⤵PID:2412
-
\??\c:\nhttbh.exec:\nhttbh.exe100⤵PID:1196
-
\??\c:\hthhbn.exec:\hthhbn.exe101⤵PID:2228
-
\??\c:\3vpvp.exec:\3vpvp.exe102⤵PID:1712
-
\??\c:\9vvvp.exec:\9vvvp.exe103⤵PID:1664
-
\??\c:\9fffrxx.exec:\9fffrxx.exe104⤵PID:1792
-
\??\c:\3lxxxfl.exec:\3lxxxfl.exe105⤵PID:2932
-
\??\c:\nhbhbh.exec:\nhbhbh.exe106⤵PID:1704
-
\??\c:\1bttbh.exec:\1bttbh.exe107⤵PID:1428
-
\??\c:\ddpdp.exec:\ddpdp.exe108⤵PID:2608
-
\??\c:\1jjdj.exec:\1jjdj.exe109⤵PID:3016
-
\??\c:\jjvjv.exec:\jjvjv.exe110⤵PID:1960
-
\??\c:\rfrxllx.exec:\rfrxllx.exe111⤵PID:2720
-
\??\c:\lffxflx.exec:\lffxflx.exe112⤵PID:2628
-
\??\c:\hbttbh.exec:\hbttbh.exe113⤵PID:2832
-
\??\c:\bbtbnb.exec:\bbtbnb.exe114⤵PID:2352
-
\??\c:\tnbnnt.exec:\tnbnnt.exe115⤵PID:2624
-
\??\c:\djpvp.exec:\djpvp.exe116⤵PID:2676
-
\??\c:\dpjjj.exec:\dpjjj.exe117⤵PID:2588
-
\??\c:\lfllrxl.exec:\lfllrxl.exe118⤵PID:2592
-
\??\c:\lfrffff.exec:\lfrffff.exe119⤵PID:2632
-
\??\c:\btntbh.exec:\btntbh.exe120⤵PID:2376
-
\??\c:\tntthh.exec:\tntthh.exe121⤵PID:2340
-
\??\c:\nhbnth.exec:\nhbnth.exe122⤵PID:2316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-