Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
3b6f1561650b909203a282bf3296f0cb52c7f1e36cf5882618c4b691cecb489a.exe
Resource
win7-20240903-en
General
-
Target
3b6f1561650b909203a282bf3296f0cb52c7f1e36cf5882618c4b691cecb489a.exe
-
Size
87KB
-
MD5
b0e850857ce61d7e28d703a28faff60b
-
SHA1
ebbd0ae36ca7022088af31157225b8fa4e9fdd1c
-
SHA256
3b6f1561650b909203a282bf3296f0cb52c7f1e36cf5882618c4b691cecb489a
-
SHA512
6749bf13c304aae8656086b089595915d159cc1a639f711833a107c17ed81932521dbeedf19b915f5bd1a0782f68f7f967727f75b4b991dafb526d22516aa98c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmoLZsOS:ymb3NkkiQ3mdBjF+3TU2iBRioSnZsb
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/3020-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1364-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/632-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1412-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 tnhthh.exe 1364 lfrxxlx.exe 840 bbthtt.exe 2732 vvvdd.exe 2580 pjpvv.exe 2608 jjvjj.exe 1416 3llrlfr.exe 2064 hhbhth.exe 2292 tthtth.exe 1580 dvjjp.exe 2856 jjvjv.exe 1040 lxlxflr.exe 2756 rlfxflx.exe 2960 nbntbh.exe 1096 htnbnn.exe 2372 jddjp.exe 2148 dddpp.exe 1876 5xlrfrx.exe 632 rxrxfrl.exe 2928 7htbhn.exe 1228 9nnhbt.exe 352 pjdjp.exe 2100 jpppv.exe 560 xrlrxlx.exe 1844 7rrfrxl.exe 2276 nhnthn.exe 1044 9hhhhn.exe 2436 ppjvd.exe 1636 jjddd.exe 1412 ffxrflx.exe 2496 3xllllr.exe 2696 nhtbtt.exe 2688 ttnnbh.exe 2584 vpdpj.exe 2792 ppppj.exe 2628 lxxxfrf.exe 2580 lrlflxx.exe 1716 nhthht.exe 2576 3thhth.exe 2104 1jdjj.exe 1824 frlfflx.exe 2660 nhntbh.exe 2828 jpjdv.exe 2916 3rxflxl.exe 2624 bhbnhb.exe 2908 dvdvj.exe 1632 fflrffr.exe 592 nnnnht.exe 588 nnthnb.exe 2204 pjvpd.exe 2132 fxlrllr.exe 1308 tbthth.exe 264 5hnhtb.exe 688 ddjpj.exe 632 9rlrrfr.exe 1488 tnhnhn.exe 1228 hhtnbh.exe 2300 vpjdp.exe 2712 xxrfrxl.exe 2420 3rxlfrl.exe 2520 rxlfrlf.exe 1752 hhtbtt.exe 2456 tnbtnb.exe 1072 1vpvv.exe -
resource yara_rule behavioral1/memory/3020-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1364-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1412-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-122-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b6f1561650b909203a282bf3296f0cb52c7f1e36cf5882618c4b691cecb489a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2768 3020 3b6f1561650b909203a282bf3296f0cb52c7f1e36cf5882618c4b691cecb489a.exe 30 PID 3020 wrote to memory of 2768 3020 3b6f1561650b909203a282bf3296f0cb52c7f1e36cf5882618c4b691cecb489a.exe 30 PID 3020 wrote to memory of 2768 3020 3b6f1561650b909203a282bf3296f0cb52c7f1e36cf5882618c4b691cecb489a.exe 30 PID 3020 wrote to memory of 2768 3020 3b6f1561650b909203a282bf3296f0cb52c7f1e36cf5882618c4b691cecb489a.exe 30 PID 2768 wrote to memory of 1364 2768 tnhthh.exe 31 PID 2768 wrote to memory of 1364 2768 tnhthh.exe 31 PID 2768 wrote to memory of 1364 2768 tnhthh.exe 31 PID 2768 wrote to memory of 1364 2768 tnhthh.exe 31 PID 1364 wrote to memory of 840 1364 lfrxxlx.exe 32 PID 1364 wrote to memory of 840 1364 lfrxxlx.exe 32 PID 1364 wrote to memory of 840 1364 lfrxxlx.exe 32 PID 1364 wrote to memory of 840 1364 lfrxxlx.exe 32 PID 840 wrote to memory of 2732 840 bbthtt.exe 33 PID 840 wrote to memory of 2732 840 bbthtt.exe 33 PID 840 wrote to memory of 2732 840 bbthtt.exe 33 PID 840 wrote to memory of 2732 840 bbthtt.exe 33 PID 2732 wrote to memory of 2580 2732 vvvdd.exe 34 PID 2732 wrote to memory of 2580 2732 vvvdd.exe 34 PID 2732 wrote to memory of 2580 2732 vvvdd.exe 34 PID 2732 wrote to memory of 2580 2732 vvvdd.exe 34 PID 2580 wrote to memory of 2608 2580 pjpvv.exe 35 PID 2580 wrote to memory of 2608 2580 pjpvv.exe 35 PID 2580 wrote to memory of 2608 2580 pjpvv.exe 35 PID 2580 wrote to memory of 2608 2580 pjpvv.exe 35 PID 2608 wrote to memory of 1416 2608 jjvjj.exe 36 PID 2608 wrote to memory of 1416 2608 jjvjj.exe 36 PID 2608 wrote to memory of 1416 2608 jjvjj.exe 36 PID 2608 wrote to memory of 1416 2608 jjvjj.exe 36 PID 1416 wrote to memory of 2064 1416 3llrlfr.exe 37 PID 1416 wrote to memory of 2064 1416 3llrlfr.exe 37 PID 1416 wrote to memory of 2064 1416 3llrlfr.exe 37 PID 1416 wrote to memory of 2064 1416 3llrlfr.exe 37 PID 2064 wrote to memory of 2292 2064 hhbhth.exe 38 PID 2064 wrote to memory of 2292 2064 hhbhth.exe 38 PID 2064 wrote to memory of 2292 2064 hhbhth.exe 38 PID 2064 wrote to memory of 2292 2064 hhbhth.exe 38 PID 2292 wrote to memory of 1580 2292 tthtth.exe 39 PID 2292 wrote to memory of 1580 2292 tthtth.exe 39 PID 2292 wrote to memory of 1580 2292 tthtth.exe 39 PID 2292 wrote to memory of 1580 2292 tthtth.exe 39 PID 1580 wrote to memory of 2856 1580 dvjjp.exe 40 PID 1580 wrote to memory of 2856 1580 dvjjp.exe 40 PID 1580 wrote to memory of 2856 1580 dvjjp.exe 40 PID 1580 wrote to memory of 2856 1580 dvjjp.exe 40 PID 2856 wrote to memory of 1040 2856 jjvjv.exe 41 PID 2856 wrote to memory of 1040 2856 jjvjv.exe 41 PID 2856 wrote to memory of 1040 2856 jjvjv.exe 41 PID 2856 wrote to memory of 1040 2856 jjvjv.exe 41 PID 1040 wrote to memory of 2756 1040 lxlxflr.exe 42 PID 1040 wrote to memory of 2756 1040 lxlxflr.exe 42 PID 1040 wrote to memory of 2756 1040 lxlxflr.exe 42 PID 1040 wrote to memory of 2756 1040 lxlxflr.exe 42 PID 2756 wrote to memory of 2960 2756 rlfxflx.exe 43 PID 2756 wrote to memory of 2960 2756 rlfxflx.exe 43 PID 2756 wrote to memory of 2960 2756 rlfxflx.exe 43 PID 2756 wrote to memory of 2960 2756 rlfxflx.exe 43 PID 2960 wrote to memory of 1096 2960 nbntbh.exe 44 PID 2960 wrote to memory of 1096 2960 nbntbh.exe 44 PID 2960 wrote to memory of 1096 2960 nbntbh.exe 44 PID 2960 wrote to memory of 1096 2960 nbntbh.exe 44 PID 1096 wrote to memory of 2372 1096 htnbnn.exe 45 PID 1096 wrote to memory of 2372 1096 htnbnn.exe 45 PID 1096 wrote to memory of 2372 1096 htnbnn.exe 45 PID 1096 wrote to memory of 2372 1096 htnbnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b6f1561650b909203a282bf3296f0cb52c7f1e36cf5882618c4b691cecb489a.exe"C:\Users\Admin\AppData\Local\Temp\3b6f1561650b909203a282bf3296f0cb52c7f1e36cf5882618c4b691cecb489a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\tnhthh.exec:\tnhthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\lfrxxlx.exec:\lfrxxlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\bbthtt.exec:\bbthtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\vvvdd.exec:\vvvdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\pjpvv.exec:\pjpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\jjvjj.exec:\jjvjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\3llrlfr.exec:\3llrlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\hhbhth.exec:\hhbhth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\tthtth.exec:\tthtth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\dvjjp.exec:\dvjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\jjvjv.exec:\jjvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\lxlxflr.exec:\lxlxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\rlfxflx.exec:\rlfxflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\nbntbh.exec:\nbntbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\htnbnn.exec:\htnbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\jddjp.exec:\jddjp.exe17⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dddpp.exec:\dddpp.exe18⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5xlrfrx.exec:\5xlrfrx.exe19⤵
- Executes dropped EXE
PID:1876 -
\??\c:\rxrxfrl.exec:\rxrxfrl.exe20⤵
- Executes dropped EXE
PID:632 -
\??\c:\7htbhn.exec:\7htbhn.exe21⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9nnhbt.exec:\9nnhbt.exe22⤵
- Executes dropped EXE
PID:1228 -
\??\c:\pjdjp.exec:\pjdjp.exe23⤵
- Executes dropped EXE
PID:352 -
\??\c:\jpppv.exec:\jpppv.exe24⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe25⤵
- Executes dropped EXE
PID:560 -
\??\c:\7rrfrxl.exec:\7rrfrxl.exe26⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nhnthn.exec:\nhnthn.exe27⤵
- Executes dropped EXE
PID:2276 -
\??\c:\9hhhhn.exec:\9hhhhn.exe28⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ppjvd.exec:\ppjvd.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jjddd.exec:\jjddd.exe30⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ffxrflx.exec:\ffxrflx.exe31⤵
- Executes dropped EXE
PID:1412 -
\??\c:\3xllllr.exec:\3xllllr.exe32⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nhtbtt.exec:\nhtbtt.exe33⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ttnnbh.exec:\ttnnbh.exe34⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vpdpj.exec:\vpdpj.exe35⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ppppj.exec:\ppppj.exe36⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lxxxfrf.exec:\lxxxfrf.exe37⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lrlflxx.exec:\lrlflxx.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nhthht.exec:\nhthht.exe39⤵
- Executes dropped EXE
PID:1716 -
\??\c:\3thhth.exec:\3thhth.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1jdjj.exec:\1jdjj.exe41⤵
- Executes dropped EXE
PID:2104 -
\??\c:\frlfflx.exec:\frlfflx.exe42⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nhntbh.exec:\nhntbh.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jpjdv.exec:\jpjdv.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3rxflxl.exec:\3rxflxl.exe45⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bhbnhb.exec:\bhbnhb.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\dvdvj.exec:\dvdvj.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\fflrffr.exec:\fflrffr.exe48⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nnnnht.exec:\nnnnht.exe49⤵
- Executes dropped EXE
PID:592 -
\??\c:\nnthnb.exec:\nnthnb.exe50⤵
- Executes dropped EXE
PID:588 -
\??\c:\pjvpd.exec:\pjvpd.exe51⤵
- Executes dropped EXE
PID:2204 -
\??\c:\fxlrllr.exec:\fxlrllr.exe52⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tbthth.exec:\tbthth.exe53⤵
- Executes dropped EXE
PID:1308 -
\??\c:\5hnhtb.exec:\5hnhtb.exe54⤵
- Executes dropped EXE
PID:264 -
\??\c:\ddjpj.exec:\ddjpj.exe55⤵
- Executes dropped EXE
PID:688 -
\??\c:\9rlrrfr.exec:\9rlrrfr.exe56⤵
- Executes dropped EXE
PID:632 -
\??\c:\tnhnhn.exec:\tnhnhn.exe57⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hhtnbh.exec:\hhtnbh.exe58⤵
- Executes dropped EXE
PID:1228 -
\??\c:\vpjdp.exec:\vpjdp.exe59⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe60⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3rxlfrl.exec:\3rxlfrl.exe61⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rxlfrlf.exec:\rxlfrlf.exe62⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hhtbtt.exec:\hhtbtt.exe63⤵
- Executes dropped EXE
PID:1752 -
\??\c:\tnbtnb.exec:\tnbtnb.exe64⤵
- Executes dropped EXE
PID:2456 -
\??\c:\1vpvv.exec:\1vpvv.exe65⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ddjvp.exec:\ddjvp.exe66⤵PID:1064
-
\??\c:\lfrrxfx.exec:\lfrrxfx.exe67⤵PID:2528
-
\??\c:\llxrfrf.exec:\llxrfrf.exe68⤵PID:2700
-
\??\c:\nnhnnt.exec:\nnhnnt.exe69⤵PID:748
-
\??\c:\ttthht.exec:\ttthht.exe70⤵PID:2812
-
\??\c:\ppjvd.exec:\ppjvd.exe71⤵PID:2768
-
\??\c:\9jddv.exec:\9jddv.exe72⤵PID:2696
-
\??\c:\7flfxxx.exec:\7flfxxx.exe73⤵PID:576
-
\??\c:\ffllrxl.exec:\ffllrxl.exe74⤵PID:2584
-
\??\c:\7nbtnb.exec:\7nbtnb.exe75⤵PID:2572
-
\??\c:\5ppdv.exec:\5ppdv.exe76⤵PID:2068
-
\??\c:\dddpj.exec:\dddpj.exe77⤵PID:2160
-
\??\c:\pjdjj.exec:\pjdjj.exe78⤵PID:2556
-
\??\c:\rlllrxl.exec:\rlllrxl.exe79⤵PID:1416
-
\??\c:\7thnbh.exec:\7thnbh.exe80⤵PID:2576
-
\??\c:\9nhbtn.exec:\9nhbtn.exe81⤵PID:2104
-
\??\c:\5ppdj.exec:\5ppdj.exe82⤵PID:2064
-
\??\c:\vpppp.exec:\vpppp.exe83⤵PID:2292
-
\??\c:\9lxxlxr.exec:\9lxxlxr.exe84⤵PID:1820
-
\??\c:\flrlfrl.exec:\flrlfrl.exe85⤵PID:1808
-
\??\c:\xfxxrfl.exec:\xfxxrfl.exe86⤵PID:2904
-
\??\c:\hbhnhn.exec:\hbhnhn.exe87⤵PID:2088
-
\??\c:\bnnbbh.exec:\bnnbbh.exe88⤵PID:2252
-
\??\c:\vvpjj.exec:\vvpjj.exe89⤵PID:2248
-
\??\c:\vpddv.exec:\vpddv.exe90⤵PID:588
-
\??\c:\ffffxlf.exec:\ffffxlf.exe91⤵PID:2224
-
\??\c:\9lfrlxf.exec:\9lfrlxf.exe92⤵PID:1640
-
\??\c:\hntntt.exec:\hntntt.exe93⤵PID:1764
-
\??\c:\tbntbh.exec:\tbntbh.exe94⤵PID:2976
-
\??\c:\ppvpp.exec:\ppvpp.exe95⤵PID:2488
-
\??\c:\1jddj.exec:\1jddj.exe96⤵PID:1644
-
\??\c:\xxrfffl.exec:\xxrfffl.exe97⤵PID:2948
-
\??\c:\xlxflrr.exec:\xlxflrr.exe98⤵PID:824
-
\??\c:\bbnnhn.exec:\bbnnhn.exe99⤵PID:2300
-
\??\c:\tnbnnn.exec:\tnbnnn.exe100⤵PID:2712
-
\??\c:\ppvpp.exec:\ppvpp.exe101⤵PID:560
-
\??\c:\vvpvj.exec:\vvpvj.exe102⤵PID:1648
-
\??\c:\ffxllxl.exec:\ffxllxl.exe103⤵PID:1752
-
\??\c:\llrfflr.exec:\llrfflr.exe104⤵PID:1760
-
\??\c:\1hbhtb.exec:\1hbhtb.exe105⤵PID:1072
-
\??\c:\nnhthh.exec:\nnhthh.exe106⤵PID:1776
-
\??\c:\ddvpj.exec:\ddvpj.exe107⤵PID:2528
-
\??\c:\vjppj.exec:\vjppj.exe108⤵PID:984
-
\??\c:\fxxlrfr.exec:\fxxlrfr.exe109⤵PID:748
-
\??\c:\xlxfrxf.exec:\xlxfrxf.exe110⤵PID:1584
-
\??\c:\ttthnh.exec:\ttthnh.exe111⤵PID:2768
-
\??\c:\nhbnbh.exec:\nhbnbh.exe112⤵PID:2872
-
\??\c:\dvjjp.exec:\dvjjp.exe113⤵PID:576
-
\??\c:\vpppp.exec:\vpppp.exe114⤵PID:1704
-
\??\c:\rxxllxx.exec:\rxxllxx.exe115⤵PID:2572
-
\??\c:\9ffllrx.exec:\9ffllrx.exe116⤵PID:2636
-
\??\c:\hbnhth.exec:\hbnhth.exe117⤵PID:2160
-
\??\c:\bththb.exec:\bththb.exe118⤵PID:2560
-
\??\c:\dvvpj.exec:\dvvpj.exe119⤵PID:1664
-
\??\c:\vpddv.exec:\vpddv.exe120⤵PID:1680
-
\??\c:\9rlrfff.exec:\9rlrfff.exe121⤵PID:1904
-
\??\c:\ffxxflx.exec:\ffxxflx.exe122⤵PID:1824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-