Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6809381156afeb450f60530851c697753136102ecc0d71915b9301dda8abe408N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
6809381156afeb450f60530851c697753136102ecc0d71915b9301dda8abe408N.exe
-
Size
62KB
-
MD5
b6c4de73e2e2079bcfb1966400628eb0
-
SHA1
bab17a1d46e6c61c8dbaf33b90ccf1393e00ff68
-
SHA256
6809381156afeb450f60530851c697753136102ecc0d71915b9301dda8abe408
-
SHA512
0bc4c7ce902510ac3c8220a2a35f7009ce32f6fdd4fea1e3657564a256e199e676de01c6f9305ccc4761b184b8c2a1c97ff578e145ec5e3cc4fd1d2be8131971
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIms9H:ymb3NkkiQ3mdBjFIsIFZ
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1588-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/372-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1188-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2360 btnnbh.exe 2452 hbbbnt.exe 372 bthtbb.exe 2832 pppvp.exe 3012 pdvvd.exe 2728 rlxfflr.exe 2816 bbhttn.exe 2612 vpdjj.exe 2732 vjvvv.exe 2168 lfrxflr.exe 1228 lrxlfrf.exe 2208 nthhbh.exe 2700 bbnhtn.exe 2872 fflrxrr.exe 3068 rlfxxff.exe 2864 5tbtth.exe 1244 1bbbnh.exe 2072 dvpvj.exe 1488 3lxflrx.exe 2148 fxrxllx.exe 376 1tnhtt.exe 892 pjdjp.exe 2484 pdpvd.exe 1188 lfrrffl.exe 960 nbhhnn.exe 1740 pjdvj.exe 1964 dvvjj.exe 2696 pjddd.exe 888 rllxllx.exe 2440 9hbbnn.exe 2704 5bbnbb.exe 2308 dvjjj.exe 2496 5xrrflr.exe 2768 lrfffxx.exe 2812 7tntth.exe 2808 hbhnbh.exe 2968 5tnntb.exe 1604 djddv.exe 2652 jdjjj.exe 1048 fxrxxfl.exe 2632 frffrrf.exe 2472 nhbtbt.exe 2904 hbhntt.exe 664 ddvdj.exe 2456 dpddd.exe 1984 jjjpv.exe 2300 llffrxf.exe 2868 fxrflrf.exe 2952 ttbntt.exe 1960 9bhnbb.exe 844 jdppv.exe 1764 dpppv.exe 2092 fxrrrlr.exe 352 fxffffl.exe 1728 nhnntt.exe 772 nntbbh.exe 3024 ppddj.exe 2480 ppdpv.exe 2252 lrfxxxf.exe 2432 xxrfffr.exe 928 hbhntt.exe 1340 tnhbnh.exe 2424 jdpvj.exe 2552 llflrrx.exe -
resource yara_rule behavioral1/memory/2452-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/372-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/376-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1188-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1588 wrote to memory of 2360 1588 6809381156afeb450f60530851c697753136102ecc0d71915b9301dda8abe408N.exe 30 PID 1588 wrote to memory of 2360 1588 6809381156afeb450f60530851c697753136102ecc0d71915b9301dda8abe408N.exe 30 PID 1588 wrote to memory of 2360 1588 6809381156afeb450f60530851c697753136102ecc0d71915b9301dda8abe408N.exe 30 PID 1588 wrote to memory of 2360 1588 6809381156afeb450f60530851c697753136102ecc0d71915b9301dda8abe408N.exe 30 PID 2360 wrote to memory of 2452 2360 btnnbh.exe 31 PID 2360 wrote to memory of 2452 2360 btnnbh.exe 31 PID 2360 wrote to memory of 2452 2360 btnnbh.exe 31 PID 2360 wrote to memory of 2452 2360 btnnbh.exe 31 PID 2452 wrote to memory of 372 2452 hbbbnt.exe 32 PID 2452 wrote to memory of 372 2452 hbbbnt.exe 32 PID 2452 wrote to memory of 372 2452 hbbbnt.exe 32 PID 2452 wrote to memory of 372 2452 hbbbnt.exe 32 PID 372 wrote to memory of 2832 372 bthtbb.exe 33 PID 372 wrote to memory of 2832 372 bthtbb.exe 33 PID 372 wrote to memory of 2832 372 bthtbb.exe 33 PID 372 wrote to memory of 2832 372 bthtbb.exe 33 PID 2832 wrote to memory of 3012 2832 pppvp.exe 34 PID 2832 wrote to memory of 3012 2832 pppvp.exe 34 PID 2832 wrote to memory of 3012 2832 pppvp.exe 34 PID 2832 wrote to memory of 3012 2832 pppvp.exe 34 PID 3012 wrote to memory of 2728 3012 pdvvd.exe 35 PID 3012 wrote to memory of 2728 3012 pdvvd.exe 35 PID 3012 wrote to memory of 2728 3012 pdvvd.exe 35 PID 3012 wrote to memory of 2728 3012 pdvvd.exe 35 PID 2728 wrote to memory of 2816 2728 rlxfflr.exe 36 PID 2728 wrote to memory of 2816 2728 rlxfflr.exe 36 PID 2728 wrote to memory of 2816 2728 rlxfflr.exe 36 PID 2728 wrote to memory of 2816 2728 rlxfflr.exe 36 PID 2816 wrote to memory of 2612 2816 bbhttn.exe 37 PID 2816 wrote to memory of 2612 2816 bbhttn.exe 37 PID 2816 wrote to memory of 2612 2816 bbhttn.exe 37 PID 2816 wrote to memory of 2612 2816 bbhttn.exe 37 PID 2612 wrote to memory of 2732 2612 vpdjj.exe 38 PID 2612 wrote to memory of 2732 2612 vpdjj.exe 38 PID 2612 wrote to memory of 2732 2612 vpdjj.exe 38 PID 2612 wrote to memory of 2732 2612 vpdjj.exe 38 PID 2732 wrote to memory of 2168 2732 vjvvv.exe 39 PID 2732 wrote to memory of 2168 2732 vjvvv.exe 39 PID 2732 wrote to memory of 2168 2732 vjvvv.exe 39 PID 2732 wrote to memory of 2168 2732 vjvvv.exe 39 PID 2168 wrote to memory of 1228 2168 lfrxflr.exe 40 PID 2168 wrote to memory of 1228 2168 lfrxflr.exe 40 PID 2168 wrote to memory of 1228 2168 lfrxflr.exe 40 PID 2168 wrote to memory of 1228 2168 lfrxflr.exe 40 PID 1228 wrote to memory of 2208 1228 lrxlfrf.exe 41 PID 1228 wrote to memory of 2208 1228 lrxlfrf.exe 41 PID 1228 wrote to memory of 2208 1228 lrxlfrf.exe 41 PID 1228 wrote to memory of 2208 1228 lrxlfrf.exe 41 PID 2208 wrote to memory of 2700 2208 nthhbh.exe 42 PID 2208 wrote to memory of 2700 2208 nthhbh.exe 42 PID 2208 wrote to memory of 2700 2208 nthhbh.exe 42 PID 2208 wrote to memory of 2700 2208 nthhbh.exe 42 PID 2700 wrote to memory of 2872 2700 bbnhtn.exe 43 PID 2700 wrote to memory of 2872 2700 bbnhtn.exe 43 PID 2700 wrote to memory of 2872 2700 bbnhtn.exe 43 PID 2700 wrote to memory of 2872 2700 bbnhtn.exe 43 PID 2872 wrote to memory of 3068 2872 fflrxrr.exe 44 PID 2872 wrote to memory of 3068 2872 fflrxrr.exe 44 PID 2872 wrote to memory of 3068 2872 fflrxrr.exe 44 PID 2872 wrote to memory of 3068 2872 fflrxrr.exe 44 PID 3068 wrote to memory of 2864 3068 rlfxxff.exe 45 PID 3068 wrote to memory of 2864 3068 rlfxxff.exe 45 PID 3068 wrote to memory of 2864 3068 rlfxxff.exe 45 PID 3068 wrote to memory of 2864 3068 rlfxxff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6809381156afeb450f60530851c697753136102ecc0d71915b9301dda8abe408N.exe"C:\Users\Admin\AppData\Local\Temp\6809381156afeb450f60530851c697753136102ecc0d71915b9301dda8abe408N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\btnnbh.exec:\btnnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\hbbbnt.exec:\hbbbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\bthtbb.exec:\bthtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\pppvp.exec:\pppvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\pdvvd.exec:\pdvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\rlxfflr.exec:\rlxfflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\bbhttn.exec:\bbhttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vpdjj.exec:\vpdjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vjvvv.exec:\vjvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lfrxflr.exec:\lfrxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\lrxlfrf.exec:\lrxlfrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\nthhbh.exec:\nthhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\bbnhtn.exec:\bbnhtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\fflrxrr.exec:\fflrxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rlfxxff.exec:\rlfxxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\5tbtth.exec:\5tbtth.exe17⤵
- Executes dropped EXE
PID:2864 -
\??\c:\1bbbnh.exec:\1bbbnh.exe18⤵
- Executes dropped EXE
PID:1244 -
\??\c:\dvpvj.exec:\dvpvj.exe19⤵
- Executes dropped EXE
PID:2072 -
\??\c:\3lxflrx.exec:\3lxflrx.exe20⤵
- Executes dropped EXE
PID:1488 -
\??\c:\fxrxllx.exec:\fxrxllx.exe21⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1tnhtt.exec:\1tnhtt.exe22⤵
- Executes dropped EXE
PID:376 -
\??\c:\pjdjp.exec:\pjdjp.exe23⤵
- Executes dropped EXE
PID:892 -
\??\c:\pdpvd.exec:\pdpvd.exe24⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lfrrffl.exec:\lfrrffl.exe25⤵
- Executes dropped EXE
PID:1188 -
\??\c:\nbhhnn.exec:\nbhhnn.exe26⤵
- Executes dropped EXE
PID:960 -
\??\c:\pjdvj.exec:\pjdvj.exe27⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dvvjj.exec:\dvvjj.exe28⤵
- Executes dropped EXE
PID:1964 -
\??\c:\pjddd.exec:\pjddd.exe29⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rllxllx.exec:\rllxllx.exe30⤵
- Executes dropped EXE
PID:888 -
\??\c:\9hbbnn.exec:\9hbbnn.exe31⤵
- Executes dropped EXE
PID:2440 -
\??\c:\5bbnbb.exec:\5bbnbb.exe32⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dvjjj.exec:\dvjjj.exe33⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5xrrflr.exec:\5xrrflr.exe34⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lrfffxx.exec:\lrfffxx.exe35⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7tntth.exec:\7tntth.exe36⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hbhnbh.exec:\hbhnbh.exe37⤵
- Executes dropped EXE
PID:2808 -
\??\c:\5tnntb.exec:\5tnntb.exe38⤵
- Executes dropped EXE
PID:2968 -
\??\c:\djddv.exec:\djddv.exe39⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jdjjj.exec:\jdjjj.exe40⤵
- Executes dropped EXE
PID:2652 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe41⤵
- Executes dropped EXE
PID:1048 -
\??\c:\frffrrf.exec:\frffrrf.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nhbtbt.exec:\nhbtbt.exe43⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hbhntt.exec:\hbhntt.exe44⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ddvdj.exec:\ddvdj.exe45⤵
- Executes dropped EXE
PID:664 -
\??\c:\dpddd.exec:\dpddd.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jjjpv.exec:\jjjpv.exe47⤵
- Executes dropped EXE
PID:1984 -
\??\c:\llffrxf.exec:\llffrxf.exe48⤵
- Executes dropped EXE
PID:2300 -
\??\c:\fxrflrf.exec:\fxrflrf.exe49⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ttbntt.exec:\ttbntt.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9bhnbb.exec:\9bhnbb.exe51⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jdppv.exec:\jdppv.exe52⤵
- Executes dropped EXE
PID:844 -
\??\c:\dpppv.exec:\dpppv.exe53⤵
- Executes dropped EXE
PID:1764 -
\??\c:\fxrrrlr.exec:\fxrrrlr.exe54⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fxffffl.exec:\fxffffl.exe55⤵
- Executes dropped EXE
PID:352 -
\??\c:\nhnntt.exec:\nhnntt.exe56⤵
- Executes dropped EXE
PID:1728 -
\??\c:\nntbbh.exec:\nntbbh.exe57⤵
- Executes dropped EXE
PID:772 -
\??\c:\ppddj.exec:\ppddj.exe58⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ppdpv.exec:\ppdpv.exe59⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lrfxxxf.exec:\lrfxxxf.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xxrfffr.exec:\xxrfffr.exe61⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hbhntt.exec:\hbhntt.exe62⤵
- Executes dropped EXE
PID:928 -
\??\c:\tnhbnh.exec:\tnhbnh.exe63⤵
- Executes dropped EXE
PID:1340 -
\??\c:\jdpvj.exec:\jdpvj.exe64⤵
- Executes dropped EXE
PID:2424 -
\??\c:\llflrrx.exec:\llflrrx.exe65⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rfrrfff.exec:\rfrrfff.exe66⤵PID:1964
-
\??\c:\rxffxll.exec:\rxffxll.exe67⤵PID:1500
-
\??\c:\nbhhhh.exec:\nbhhhh.exe68⤵PID:2372
-
\??\c:\3jvvv.exec:\3jvvv.exe69⤵PID:2920
-
\??\c:\pdvvp.exec:\pdvvp.exe70⤵PID:2504
-
\??\c:\rllflrf.exec:\rllflrf.exe71⤵PID:2704
-
\??\c:\btbhnn.exec:\btbhnn.exe72⤵PID:372
-
\??\c:\pdjjp.exec:\pdjjp.exe73⤵PID:2448
-
\??\c:\lfxffll.exec:\lfxffll.exe74⤵PID:656
-
\??\c:\lllllff.exec:\lllllff.exe75⤵PID:2736
-
\??\c:\1rrrrrf.exec:\1rrrrrf.exe76⤵PID:1668
-
\??\c:\5hbhbh.exec:\5hbhbh.exe77⤵PID:1720
-
\??\c:\tbntbt.exec:\tbntbt.exe78⤵PID:2636
-
\??\c:\vvjpp.exec:\vvjpp.exe79⤵PID:2668
-
\??\c:\3dvdp.exec:\3dvdp.exe80⤵PID:2628
-
\??\c:\3jvdj.exec:\3jvdj.exe81⤵PID:2296
-
\??\c:\lfxffrf.exec:\lfxffrf.exe82⤵PID:2732
-
\??\c:\xrxffxr.exec:\xrxffxr.exe83⤵PID:2788
-
\??\c:\nhbthb.exec:\nhbthb.exe84⤵PID:2600
-
\??\c:\nnbhbb.exec:\nnbhbb.exe85⤵PID:1008
-
\??\c:\nbnhhh.exec:\nbnhhh.exe86⤵PID:2340
-
\??\c:\3vjjd.exec:\3vjjd.exe87⤵PID:2940
-
\??\c:\5vpdj.exec:\5vpdj.exe88⤵PID:2568
-
\??\c:\xlfxrll.exec:\xlfxrll.exe89⤵PID:1956
-
\??\c:\rlllfff.exec:\rlllfff.exe90⤵PID:1892
-
\??\c:\1bbbbb.exec:\1bbbbb.exe91⤵PID:1408
-
\??\c:\nbhnnn.exec:\nbhnnn.exe92⤵PID:1244
-
\??\c:\1jjdd.exec:\1jjdd.exe93⤵PID:1480
-
\??\c:\1vppp.exec:\1vppp.exe94⤵PID:2596
-
\??\c:\pdppv.exec:\pdppv.exe95⤵PID:444
-
\??\c:\1xffxxf.exec:\1xffxxf.exe96⤵PID:1628
-
\??\c:\rflrrlr.exec:\rflrrlr.exe97⤵PID:768
-
\??\c:\nbbhbh.exec:\nbbhbh.exe98⤵PID:1140
-
\??\c:\jjppp.exec:\jjppp.exe99⤵PID:1088
-
\??\c:\pjdjp.exec:\pjdjp.exe100⤵PID:636
-
\??\c:\jvvjj.exec:\jvvjj.exe101⤵PID:1476
-
\??\c:\rfxlrxx.exec:\rfxlrxx.exe102⤵PID:1740
-
\??\c:\1xllfxr.exec:\1xllfxr.exe103⤵PID:2120
-
\??\c:\htntbb.exec:\htntbb.exe104⤵PID:2536
-
\??\c:\jvppp.exec:\jvppp.exe105⤵PID:796
-
\??\c:\dpddj.exec:\dpddj.exe106⤵PID:1292
-
\??\c:\dpdjj.exec:\dpdjj.exe107⤵PID:1884
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe108⤵PID:2492
-
\??\c:\9lrlllr.exec:\9lrlllr.exe109⤵PID:1284
-
\??\c:\btnntt.exec:\btnntt.exe110⤵PID:2476
-
\??\c:\thhtbb.exec:\thhtbb.exe111⤵PID:2760
-
\??\c:\vpvdp.exec:\vpvdp.exe112⤵PID:2832
-
\??\c:\jvjvp.exec:\jvjvp.exe113⤵PID:2812
-
\??\c:\lfxfllr.exec:\lfxfllr.exe114⤵PID:2500
-
\??\c:\hbnnhb.exec:\hbnnhb.exe115⤵PID:2968
-
\??\c:\nhnntt.exec:\nhnntt.exe116⤵PID:2956
-
\??\c:\bbbnnh.exec:\bbbnnh.exe117⤵PID:2748
-
\??\c:\dvjdp.exec:\dvjdp.exe118⤵PID:2608
-
\??\c:\7fxxlll.exec:\7fxxlll.exe119⤵PID:2688
-
\??\c:\xrflrrx.exec:\xrflrrx.exe120⤵PID:2196
-
\??\c:\nhhhtt.exec:\nhhhtt.exe121⤵PID:1648
-
\??\c:\nhnhhn.exec:\nhnhhn.exe122⤵PID:664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-