Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 15:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe
-
Size
230KB
-
MD5
98823d081f9d8f5b7ec5dbd17a9e0ad0
-
SHA1
9da4a69ecc34731a23cc1f8c0391535c609f7bb8
-
SHA256
5bb121b3a6d6dc16354110ad8849eec1e632567eef4b3b8f55d54d6eecd81fde
-
SHA512
8fc578d1ec11c309b42fdbe50560328009579cfa78776fd07424f23c521049627e78b55a98cff6b55ab3bb1c4941f23f529b887c6d22eee4a4a203934ccf3d61
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeG+d:n3C9BRo7MlrWKo+lxKu
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2676-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1764 xxrxlxl.exe 2676 tbthtb.exe 2724 7nbnhn.exe 1508 fxrrxxr.exe 1200 nhhnbb.exe 2564 rlxfrfl.exe 2132 3ntnnn.exe 264 thnntt.exe 2256 rflffxr.exe 2904 nhbbbn.exe 2632 vvjpv.exe 2872 xlrxflr.exe 2040 1lxrfll.exe 2996 btnnht.exe 484 jdjjp.exe 1556 fxflxxx.exe 1996 lflrlxl.exe 2244 bnhhnn.exe 2240 ddddd.exe 2192 9rlrrrr.exe 2232 nnnhbn.exe 1256 ppvdj.exe 908 jjvdp.exe 1208 nhtbnt.exe 2252 nnhtnn.exe 2292 dvdpd.exe 1672 xxrfrrf.exe 1528 tbbthb.exe 2032 1pddp.exe 2172 7frrxff.exe 2784 nhtbht.exe 1520 vpppv.exe 2800 jdpdv.exe 2508 1llrxrr.exe 2732 fxllxfx.exe 2708 1htbhn.exe 2832 pdppd.exe 2584 pdddd.exe 2180 rrfrffr.exe 2104 fxfxxrx.exe 2640 bttthh.exe 2148 5tntbb.exe 1348 pjdjp.exe 2892 dppdj.exe 2816 rxxxxlr.exe 1932 thhhtn.exe 2300 ppjdp.exe 2880 ddvdp.exe 2764 xrrxflx.exe 1928 xrrrxxx.exe 1848 bbtnhh.exe 2316 1pjjd.exe 1988 7pppd.exe 2204 1rrfffr.exe 2448 nhtbhh.exe 752 9thbbt.exe 2364 dpvdd.exe 940 lffxflx.exe 2568 1xxxffx.exe 2488 htthbh.exe 908 ddvjj.exe 776 jjdpp.exe 1396 rrflxfr.exe 352 xrxlxlr.exe -
resource yara_rule behavioral1/memory/1780-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-286-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttnbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 1764 1780 98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe 31 PID 1780 wrote to memory of 1764 1780 98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe 31 PID 1780 wrote to memory of 1764 1780 98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe 31 PID 1780 wrote to memory of 1764 1780 98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe 31 PID 1764 wrote to memory of 2676 1764 xxrxlxl.exe 32 PID 1764 wrote to memory of 2676 1764 xxrxlxl.exe 32 PID 1764 wrote to memory of 2676 1764 xxrxlxl.exe 32 PID 1764 wrote to memory of 2676 1764 xxrxlxl.exe 32 PID 2676 wrote to memory of 2724 2676 tbthtb.exe 33 PID 2676 wrote to memory of 2724 2676 tbthtb.exe 33 PID 2676 wrote to memory of 2724 2676 tbthtb.exe 33 PID 2676 wrote to memory of 2724 2676 tbthtb.exe 33 PID 2724 wrote to memory of 1508 2724 7nbnhn.exe 34 PID 2724 wrote to memory of 1508 2724 7nbnhn.exe 34 PID 2724 wrote to memory of 1508 2724 7nbnhn.exe 34 PID 2724 wrote to memory of 1508 2724 7nbnhn.exe 34 PID 1508 wrote to memory of 1200 1508 fxrrxxr.exe 35 PID 1508 wrote to memory of 1200 1508 fxrrxxr.exe 35 PID 1508 wrote to memory of 1200 1508 fxrrxxr.exe 35 PID 1508 wrote to memory of 1200 1508 fxrrxxr.exe 35 PID 1200 wrote to memory of 2564 1200 nhhnbb.exe 36 PID 1200 wrote to memory of 2564 1200 nhhnbb.exe 36 PID 1200 wrote to memory of 2564 1200 nhhnbb.exe 36 PID 1200 wrote to memory of 2564 1200 nhhnbb.exe 36 PID 2564 wrote to memory of 2132 2564 rlxfrfl.exe 37 PID 2564 wrote to memory of 2132 2564 rlxfrfl.exe 37 PID 2564 wrote to memory of 2132 2564 rlxfrfl.exe 37 PID 2564 wrote to memory of 2132 2564 rlxfrfl.exe 37 PID 2132 wrote to memory of 264 2132 3ntnnn.exe 38 PID 2132 wrote to memory of 264 2132 3ntnnn.exe 38 PID 2132 wrote to memory of 264 2132 3ntnnn.exe 38 PID 2132 wrote to memory of 264 2132 3ntnnn.exe 38 PID 264 wrote to memory of 2256 264 thnntt.exe 39 PID 264 wrote to memory of 2256 264 thnntt.exe 39 PID 264 wrote to memory of 2256 264 thnntt.exe 39 PID 264 wrote to memory of 2256 264 thnntt.exe 39 PID 2256 wrote to memory of 2904 2256 rflffxr.exe 40 PID 2256 wrote to memory of 2904 2256 rflffxr.exe 40 PID 2256 wrote to memory of 2904 2256 rflffxr.exe 40 PID 2256 wrote to memory of 2904 2256 rflffxr.exe 40 PID 2904 wrote to memory of 2632 2904 nhbbbn.exe 41 PID 2904 wrote to memory of 2632 2904 nhbbbn.exe 41 PID 2904 wrote to memory of 2632 2904 nhbbbn.exe 41 PID 2904 wrote to memory of 2632 2904 nhbbbn.exe 41 PID 2632 wrote to memory of 2872 2632 vvjpv.exe 42 PID 2632 wrote to memory of 2872 2632 vvjpv.exe 42 PID 2632 wrote to memory of 2872 2632 vvjpv.exe 42 PID 2632 wrote to memory of 2872 2632 vvjpv.exe 42 PID 2872 wrote to memory of 2040 2872 xlrxflr.exe 43 PID 2872 wrote to memory of 2040 2872 xlrxflr.exe 43 PID 2872 wrote to memory of 2040 2872 xlrxflr.exe 43 PID 2872 wrote to memory of 2040 2872 xlrxflr.exe 43 PID 2040 wrote to memory of 2996 2040 1lxrfll.exe 44 PID 2040 wrote to memory of 2996 2040 1lxrfll.exe 44 PID 2040 wrote to memory of 2996 2040 1lxrfll.exe 44 PID 2040 wrote to memory of 2996 2040 1lxrfll.exe 44 PID 2996 wrote to memory of 484 2996 btnnht.exe 45 PID 2996 wrote to memory of 484 2996 btnnht.exe 45 PID 2996 wrote to memory of 484 2996 btnnht.exe 45 PID 2996 wrote to memory of 484 2996 btnnht.exe 45 PID 484 wrote to memory of 1556 484 jdjjp.exe 46 PID 484 wrote to memory of 1556 484 jdjjp.exe 46 PID 484 wrote to memory of 1556 484 jdjjp.exe 46 PID 484 wrote to memory of 1556 484 jdjjp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe"C:\Users\Admin\AppData\Local\Temp\98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\xxrxlxl.exec:\xxrxlxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\tbthtb.exec:\tbthtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\7nbnhn.exec:\7nbnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\fxrrxxr.exec:\fxrrxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\nhhnbb.exec:\nhhnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\rlxfrfl.exec:\rlxfrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\3ntnnn.exec:\3ntnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\thnntt.exec:\thnntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\rflffxr.exec:\rflffxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\nhbbbn.exec:\nhbbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vvjpv.exec:\vvjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xlrxflr.exec:\xlrxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\1lxrfll.exec:\1lxrfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\btnnht.exec:\btnnht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\jdjjp.exec:\jdjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\fxflxxx.exec:\fxflxxx.exe17⤵
- Executes dropped EXE
PID:1556 -
\??\c:\lflrlxl.exec:\lflrlxl.exe18⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bnhhnn.exec:\bnhhnn.exe19⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ddddd.exec:\ddddd.exe20⤵
- Executes dropped EXE
PID:2240 -
\??\c:\9rlrrrr.exec:\9rlrrrr.exe21⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nnnhbn.exec:\nnnhbn.exe22⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ppvdj.exec:\ppvdj.exe23⤵
- Executes dropped EXE
PID:1256 -
\??\c:\jjvdp.exec:\jjvdp.exe24⤵
- Executes dropped EXE
PID:908 -
\??\c:\nhtbnt.exec:\nhtbnt.exe25⤵
- Executes dropped EXE
PID:1208 -
\??\c:\nnhtnn.exec:\nnhtnn.exe26⤵
- Executes dropped EXE
PID:2252 -
\??\c:\dvdpd.exec:\dvdpd.exe27⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xxrfrrf.exec:\xxrfrrf.exe28⤵
- Executes dropped EXE
PID:1672 -
\??\c:\tbbthb.exec:\tbbthb.exe29⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1pddp.exec:\1pddp.exe30⤵
- Executes dropped EXE
PID:2032 -
\??\c:\7frrxff.exec:\7frrxff.exe31⤵
- Executes dropped EXE
PID:2172 -
\??\c:\nhtbht.exec:\nhtbht.exe32⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vpppv.exec:\vpppv.exe33⤵
- Executes dropped EXE
PID:1520 -
\??\c:\jdpdv.exec:\jdpdv.exe34⤵
- Executes dropped EXE
PID:2800 -
\??\c:\1llrxrr.exec:\1llrxrr.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\fxllxfx.exec:\fxllxfx.exe36⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1htbhn.exec:\1htbhn.exe37⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pdppd.exec:\pdppd.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pdddd.exec:\pdddd.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rrfrffr.exec:\rrfrffr.exe40⤵
- Executes dropped EXE
PID:2180 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe41⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bttthh.exec:\bttthh.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5tntbb.exec:\5tntbb.exe43⤵
- Executes dropped EXE
PID:2148 -
\??\c:\pjdjp.exec:\pjdjp.exe44⤵
- Executes dropped EXE
PID:1348 -
\??\c:\dppdj.exec:\dppdj.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rxxxxlr.exec:\rxxxxlr.exe46⤵
- Executes dropped EXE
PID:2816 -
\??\c:\thhhtn.exec:\thhhtn.exe47⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ppjdp.exec:\ppjdp.exe48⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ddvdp.exec:\ddvdp.exe49⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xrrxflx.exec:\xrrxflx.exe50⤵
- Executes dropped EXE
PID:2764 -
\??\c:\xrrrxxx.exec:\xrrrxxx.exe51⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bbtnhh.exec:\bbtnhh.exe52⤵
- Executes dropped EXE
PID:1848 -
\??\c:\1pjjd.exec:\1pjjd.exe53⤵
- Executes dropped EXE
PID:2316 -
\??\c:\7pppd.exec:\7pppd.exe54⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1rrfffr.exec:\1rrfffr.exe55⤵
- Executes dropped EXE
PID:2204 -
\??\c:\nhtbhh.exec:\nhtbhh.exe56⤵
- Executes dropped EXE
PID:2448 -
\??\c:\9thbbt.exec:\9thbbt.exe57⤵
- Executes dropped EXE
PID:752 -
\??\c:\dpvdd.exec:\dpvdd.exe58⤵
- Executes dropped EXE
PID:2364 -
\??\c:\lffxflx.exec:\lffxflx.exe59⤵
- Executes dropped EXE
PID:940 -
\??\c:\1xxxffx.exec:\1xxxffx.exe60⤵
- Executes dropped EXE
PID:2568 -
\??\c:\htthbh.exec:\htthbh.exe61⤵
- Executes dropped EXE
PID:2488 -
\??\c:\ddvjj.exec:\ddvjj.exe62⤵
- Executes dropped EXE
PID:908 -
\??\c:\jjdpp.exec:\jjdpp.exe63⤵
- Executes dropped EXE
PID:776 -
\??\c:\rrflxfr.exec:\rrflxfr.exe64⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xrxlxlr.exec:\xrxlxlr.exe65⤵
- Executes dropped EXE
PID:352 -
\??\c:\nhbhtt.exec:\nhbhtt.exe66⤵PID:560
-
\??\c:\btnntb.exec:\btnntb.exe67⤵PID:1844
-
\??\c:\vvpvp.exec:\vvpvp.exe68⤵PID:2156
-
\??\c:\dvppd.exec:\dvppd.exe69⤵PID:2664
-
\??\c:\lllrllx.exec:\lllrllx.exe70⤵PID:2408
-
\??\c:\7ffflxf.exec:\7ffflxf.exe71⤵PID:1492
-
\??\c:\bbnbnn.exec:\bbnbnn.exe72⤵PID:2680
-
\??\c:\bbthtt.exec:\bbthtt.exe73⤵PID:1520
-
\??\c:\7dpvd.exec:\7dpvd.exe74⤵PID:3008
-
\??\c:\jdvvv.exec:\jdvvv.exe75⤵PID:1508
-
\??\c:\rfflxrf.exec:\rfflxrf.exe76⤵PID:2612
-
\??\c:\9htbbb.exec:\9htbbb.exe77⤵PID:2388
-
\??\c:\5bbbhb.exec:\5bbbhb.exe78⤵PID:2832
-
\??\c:\pjjpd.exec:\pjjpd.exe79⤵PID:2648
-
\??\c:\5jpjd.exec:\5jpjd.exe80⤵PID:1692
-
\??\c:\ffxfxfx.exec:\ffxfxfx.exe81⤵PID:2260
-
\??\c:\rlxlxrf.exec:\rlxlxrf.exe82⤵PID:764
-
\??\c:\hbtntn.exec:\hbtntn.exe83⤵PID:2268
-
\??\c:\1htnbn.exec:\1htnbn.exe84⤵PID:1348
-
\??\c:\jjpvd.exec:\jjpvd.exe85⤵PID:2892
-
\??\c:\jdjpj.exec:\jdjpj.exe86⤵PID:2816
-
\??\c:\ffxflrx.exec:\ffxflrx.exe87⤵PID:1932
-
\??\c:\rxlfllr.exec:\rxlfllr.exe88⤵PID:348
-
\??\c:\3bbntt.exec:\3bbntt.exe89⤵PID:2880
-
\??\c:\nhnthn.exec:\nhnthn.exe90⤵PID:2764
-
\??\c:\dvjjv.exec:\dvjjv.exe91⤵PID:1928
-
\??\c:\pjjpd.exec:\pjjpd.exe92⤵PID:1848
-
\??\c:\rrrfflx.exec:\rrrfflx.exe93⤵PID:3040
-
\??\c:\xrxxxfr.exec:\xrxxxfr.exe94⤵PID:1988
-
\??\c:\ttnhnb.exec:\ttnhnb.exe95⤵PID:1708
-
\??\c:\7btttb.exec:\7btttb.exe96⤵PID:2932
-
\??\c:\jdvdj.exec:\jdvdj.exe97⤵PID:860
-
\??\c:\dvppd.exec:\dvppd.exe98⤵PID:2364
-
\??\c:\5xxlxrf.exec:\5xxlxrf.exe99⤵PID:940
-
\??\c:\tntbht.exec:\tntbht.exe100⤵PID:2568
-
\??\c:\9thnbn.exec:\9thnbn.exe101⤵PID:604
-
\??\c:\dvjpd.exec:\dvjpd.exe102⤵PID:908
-
\??\c:\1vjvv.exec:\1vjvv.exe103⤵PID:1720
-
\??\c:\lrrlrrx.exec:\lrrlrrx.exe104⤵PID:1000
-
\??\c:\ffxflxl.exec:\ffxflxl.exe105⤵PID:988
-
\??\c:\nbntbh.exec:\nbntbh.exe106⤵PID:560
-
\??\c:\3thtbb.exec:\3thtbb.exe107⤵PID:1844
-
\??\c:\hththn.exec:\hththn.exe108⤵PID:2156
-
\??\c:\pjvjp.exec:\pjvjp.exe109⤵PID:2804
-
\??\c:\7lxxfll.exec:\7lxxfll.exe110⤵PID:2408
-
\??\c:\7rflrrx.exec:\7rflrrx.exe111⤵PID:1492
-
\??\c:\hbbhbb.exec:\hbbhbb.exe112⤵PID:2676
-
\??\c:\nntnbb.exec:\nntnbb.exe113⤵PID:1520
-
\??\c:\3vjpv.exec:\3vjpv.exe114⤵PID:3008
-
\??\c:\ddvvd.exec:\ddvvd.exe115⤵PID:1508
-
\??\c:\rlflxxl.exec:\rlflxxl.exe116⤵PID:2612
-
\??\c:\7xrrrxf.exec:\7xrrrxf.exe117⤵PID:2388
-
\??\c:\hbntnb.exec:\hbntnb.exe118⤵PID:2692
-
\??\c:\hbnthn.exec:\hbnthn.exe119⤵PID:2648
-
\??\c:\ppdjp.exec:\ppdjp.exe120⤵PID:1692
-
\??\c:\jpjjd.exec:\jpjjd.exe121⤵PID:2260
-
\??\c:\7xrxfrx.exec:\7xrxfrx.exe122⤵PID:764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-