Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 08:20
Static task
static1
Behavioral task
behavioral1
Sample
d1b2b6c2486e6d52050e61033fc7f7855c102638e8cc552fd072b6a15ad8491aN.exe
Resource
win7-20240903-en
General
-
Target
d1b2b6c2486e6d52050e61033fc7f7855c102638e8cc552fd072b6a15ad8491aN.exe
-
Size
79KB
-
MD5
7d706681cb97d7140e5a9783fbf78bc0
-
SHA1
ca1979422f63e42c1e74229f5929e11e2a0ba475
-
SHA256
d1b2b6c2486e6d52050e61033fc7f7855c102638e8cc552fd072b6a15ad8491a
-
SHA512
7ddaf965cb5d0a264265e4b1eaf480178bf8772cfc377bf28509868c42a81553e2de2ce65364240f2b691d9d425398793e62af470f470f26ede383f1df9a4d24
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4ye6:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4t
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/880-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2748 vjdjp.exe 2936 dpjpv.exe 2068 5tbhhn.exe 2820 btnbhh.exe 2544 pjddv.exe 2668 9xxrxfr.exe 2264 9btthn.exe 1060 vvjvd.exe 992 fxllxxf.exe 2932 nhnbnt.exe 2160 7tthbn.exe 2892 3dddj.exe 2140 7rffllr.exe 2164 xrlrxfx.exe 2172 bbtnhb.exe 536 9hntnh.exe 2008 ddvdp.exe 1780 lfxrflf.exe 2968 5bttbn.exe 2040 hbhtbb.exe 2100 jvpdd.exe 2156 lfrxffr.exe 2516 9xfflrl.exe 2056 hbbtnt.exe 2400 5vdjp.exe 604 llffffr.exe 1944 nnnthh.exe 2632 btbtnn.exe 888 5djpd.exe 2276 rllfrrx.exe 2748 lxlrxfr.exe 2704 1bthhn.exe 1708 bbtthn.exe 2740 vpddp.exe 2108 jdjjp.exe 2664 fxlrxff.exe 2556 9rfrxfx.exe 3004 5bnhnn.exe 2612 7httth.exe 1508 vppvv.exe 1804 xrlllxl.exe 2828 ffxlflx.exe 2948 3lfxfff.exe 1788 9tnbhh.exe 2168 bnhnnt.exe 2160 vvvjp.exe 2888 9jjvd.exe 2856 xrxfllr.exe 1160 rrrrflr.exe 2644 btthht.exe 320 7bbhbh.exe 792 5jpvj.exe 652 9pppv.exe 1672 3ffrffl.exe 2964 xrlxxxf.exe 2960 nbnntb.exe 624 vpppv.exe 1344 ppddj.exe 2220 lfrlxxr.exe 916 thntnh.exe 1932 9vjjp.exe 1940 7jdvd.exe 2500 fffrrlf.exe 1500 rrlrrxf.exe -
resource yara_rule behavioral1/memory/880-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-265-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 880 wrote to memory of 2748 880 d1b2b6c2486e6d52050e61033fc7f7855c102638e8cc552fd072b6a15ad8491aN.exe 30 PID 880 wrote to memory of 2748 880 d1b2b6c2486e6d52050e61033fc7f7855c102638e8cc552fd072b6a15ad8491aN.exe 30 PID 880 wrote to memory of 2748 880 d1b2b6c2486e6d52050e61033fc7f7855c102638e8cc552fd072b6a15ad8491aN.exe 30 PID 880 wrote to memory of 2748 880 d1b2b6c2486e6d52050e61033fc7f7855c102638e8cc552fd072b6a15ad8491aN.exe 30 PID 2748 wrote to memory of 2936 2748 vjdjp.exe 31 PID 2748 wrote to memory of 2936 2748 vjdjp.exe 31 PID 2748 wrote to memory of 2936 2748 vjdjp.exe 31 PID 2748 wrote to memory of 2936 2748 vjdjp.exe 31 PID 2936 wrote to memory of 2068 2936 dpjpv.exe 32 PID 2936 wrote to memory of 2068 2936 dpjpv.exe 32 PID 2936 wrote to memory of 2068 2936 dpjpv.exe 32 PID 2936 wrote to memory of 2068 2936 dpjpv.exe 32 PID 2068 wrote to memory of 2820 2068 5tbhhn.exe 33 PID 2068 wrote to memory of 2820 2068 5tbhhn.exe 33 PID 2068 wrote to memory of 2820 2068 5tbhhn.exe 33 PID 2068 wrote to memory of 2820 2068 5tbhhn.exe 33 PID 2820 wrote to memory of 2544 2820 btnbhh.exe 34 PID 2820 wrote to memory of 2544 2820 btnbhh.exe 34 PID 2820 wrote to memory of 2544 2820 btnbhh.exe 34 PID 2820 wrote to memory of 2544 2820 btnbhh.exe 34 PID 2544 wrote to memory of 2668 2544 pjddv.exe 35 PID 2544 wrote to memory of 2668 2544 pjddv.exe 35 PID 2544 wrote to memory of 2668 2544 pjddv.exe 35 PID 2544 wrote to memory of 2668 2544 pjddv.exe 35 PID 2668 wrote to memory of 2264 2668 9xxrxfr.exe 36 PID 2668 wrote to memory of 2264 2668 9xxrxfr.exe 36 PID 2668 wrote to memory of 2264 2668 9xxrxfr.exe 36 PID 2668 wrote to memory of 2264 2668 9xxrxfr.exe 36 PID 2264 wrote to memory of 1060 2264 9btthn.exe 37 PID 2264 wrote to memory of 1060 2264 9btthn.exe 37 PID 2264 wrote to memory of 1060 2264 9btthn.exe 37 PID 2264 wrote to memory of 1060 2264 9btthn.exe 37 PID 1060 wrote to memory of 992 1060 vvjvd.exe 38 PID 1060 wrote to memory of 992 1060 vvjvd.exe 38 PID 1060 wrote to memory of 992 1060 vvjvd.exe 38 PID 1060 wrote to memory of 992 1060 vvjvd.exe 38 PID 992 wrote to memory of 2932 992 fxllxxf.exe 39 PID 992 wrote to memory of 2932 992 fxllxxf.exe 39 PID 992 wrote to memory of 2932 992 fxllxxf.exe 39 PID 992 wrote to memory of 2932 992 fxllxxf.exe 39 PID 2932 wrote to memory of 2160 2932 nhnbnt.exe 40 PID 2932 wrote to memory of 2160 2932 nhnbnt.exe 40 PID 2932 wrote to memory of 2160 2932 nhnbnt.exe 40 PID 2932 wrote to memory of 2160 2932 nhnbnt.exe 40 PID 2160 wrote to memory of 2892 2160 7tthbn.exe 41 PID 2160 wrote to memory of 2892 2160 7tthbn.exe 41 PID 2160 wrote to memory of 2892 2160 7tthbn.exe 41 PID 2160 wrote to memory of 2892 2160 7tthbn.exe 41 PID 2892 wrote to memory of 2140 2892 3dddj.exe 42 PID 2892 wrote to memory of 2140 2892 3dddj.exe 42 PID 2892 wrote to memory of 2140 2892 3dddj.exe 42 PID 2892 wrote to memory of 2140 2892 3dddj.exe 42 PID 2140 wrote to memory of 2164 2140 7rffllr.exe 43 PID 2140 wrote to memory of 2164 2140 7rffllr.exe 43 PID 2140 wrote to memory of 2164 2140 7rffllr.exe 43 PID 2140 wrote to memory of 2164 2140 7rffllr.exe 43 PID 2164 wrote to memory of 2172 2164 xrlrxfx.exe 44 PID 2164 wrote to memory of 2172 2164 xrlrxfx.exe 44 PID 2164 wrote to memory of 2172 2164 xrlrxfx.exe 44 PID 2164 wrote to memory of 2172 2164 xrlrxfx.exe 44 PID 2172 wrote to memory of 536 2172 bbtnhb.exe 45 PID 2172 wrote to memory of 536 2172 bbtnhb.exe 45 PID 2172 wrote to memory of 536 2172 bbtnhb.exe 45 PID 2172 wrote to memory of 536 2172 bbtnhb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1b2b6c2486e6d52050e61033fc7f7855c102638e8cc552fd072b6a15ad8491aN.exe"C:\Users\Admin\AppData\Local\Temp\d1b2b6c2486e6d52050e61033fc7f7855c102638e8cc552fd072b6a15ad8491aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\vjdjp.exec:\vjdjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\dpjpv.exec:\dpjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5tbhhn.exec:\5tbhhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\btnbhh.exec:\btnbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\pjddv.exec:\pjddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\9xxrxfr.exec:\9xxrxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\9btthn.exec:\9btthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\vvjvd.exec:\vvjvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\fxllxxf.exec:\fxllxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\nhnbnt.exec:\nhnbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\7tthbn.exec:\7tthbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\3dddj.exec:\3dddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\7rffllr.exec:\7rffllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\xrlrxfx.exec:\xrlrxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\bbtnhb.exec:\bbtnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\9hntnh.exec:\9hntnh.exe17⤵
- Executes dropped EXE
PID:536 -
\??\c:\ddvdp.exec:\ddvdp.exe18⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lfxrflf.exec:\lfxrflf.exe19⤵
- Executes dropped EXE
PID:1780 -
\??\c:\5bttbn.exec:\5bttbn.exe20⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hbhtbb.exec:\hbhtbb.exe21⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jvpdd.exec:\jvpdd.exe22⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lfrxffr.exec:\lfrxffr.exe23⤵
- Executes dropped EXE
PID:2156 -
\??\c:\9xfflrl.exec:\9xfflrl.exe24⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hbbtnt.exec:\hbbtnt.exe25⤵
- Executes dropped EXE
PID:2056 -
\??\c:\5vdjp.exec:\5vdjp.exe26⤵
- Executes dropped EXE
PID:2400 -
\??\c:\llffffr.exec:\llffffr.exe27⤵
- Executes dropped EXE
PID:604 -
\??\c:\nnnthh.exec:\nnnthh.exe28⤵
- Executes dropped EXE
PID:1944 -
\??\c:\btbtnn.exec:\btbtnn.exe29⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5djpd.exec:\5djpd.exe30⤵
- Executes dropped EXE
PID:888 -
\??\c:\rllfrrx.exec:\rllfrrx.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lxlrxfr.exec:\lxlrxfr.exe32⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1bthhn.exec:\1bthhn.exe33⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbtthn.exec:\bbtthn.exe34⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vpddp.exec:\vpddp.exe35⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jdjjp.exec:\jdjjp.exe36⤵
- Executes dropped EXE
PID:2108 -
\??\c:\fxlrxff.exec:\fxlrxff.exe37⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9rfrxfx.exec:\9rfrxfx.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\5bnhnn.exec:\5bnhnn.exe39⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7httth.exec:\7httth.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vppvv.exec:\vppvv.exe41⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xrlllxl.exec:\xrlllxl.exe42⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ffxlflx.exec:\ffxlflx.exe43⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3lfxfff.exec:\3lfxfff.exe44⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9tnbhh.exec:\9tnbhh.exe45⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bnhnnt.exec:\bnhnnt.exe46⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vvvjp.exec:\vvvjp.exe47⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9jjvd.exec:\9jjvd.exe48⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xrxfllr.exec:\xrxfllr.exe49⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rrrrflr.exec:\rrrrflr.exe50⤵
- Executes dropped EXE
PID:1160 -
\??\c:\btthht.exec:\btthht.exe51⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7bbhbh.exec:\7bbhbh.exe52⤵
- Executes dropped EXE
PID:320 -
\??\c:\5jpvj.exec:\5jpvj.exe53⤵
- Executes dropped EXE
PID:792 -
\??\c:\9pppv.exec:\9pppv.exe54⤵
- Executes dropped EXE
PID:652 -
\??\c:\3ffrffl.exec:\3ffrffl.exe55⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xrlxxxf.exec:\xrlxxxf.exe56⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nbnntb.exec:\nbnntb.exe57⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vpppv.exec:\vpppv.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\ppddj.exec:\ppddj.exe59⤵
- Executes dropped EXE
PID:1344 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe60⤵
- Executes dropped EXE
PID:2220 -
\??\c:\thntnh.exec:\thntnh.exe61⤵
- Executes dropped EXE
PID:916 -
\??\c:\9vjjp.exec:\9vjjp.exe62⤵
- Executes dropped EXE
PID:1932 -
\??\c:\7jdvd.exec:\7jdvd.exe63⤵
- Executes dropped EXE
PID:1940 -
\??\c:\fffrrlf.exec:\fffrrlf.exe64⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rrlrrxf.exec:\rrlrrxf.exe65⤵
- Executes dropped EXE
PID:1500 -
\??\c:\ttnthh.exec:\ttnthh.exe66⤵PID:2104
-
\??\c:\tthhnt.exec:\tthhnt.exe67⤵PID:344
-
\??\c:\jdjpv.exec:\jdjpv.exe68⤵PID:2632
-
\??\c:\pvvpd.exec:\pvvpd.exe69⤵PID:2464
-
\??\c:\rlffrrf.exec:\rlffrrf.exe70⤵PID:2372
-
\??\c:\xfrfllr.exec:\xfrfllr.exe71⤵PID:2796
-
\??\c:\bnbtbn.exec:\bnbtbn.exe72⤵PID:2720
-
\??\c:\3dpjp.exec:\3dpjp.exe73⤵PID:2752
-
\??\c:\vpvdd.exec:\vpvdd.exe74⤵PID:2692
-
\??\c:\rfllllx.exec:\rfllllx.exe75⤵PID:2092
-
\??\c:\ffflflx.exec:\ffflflx.exe76⤵PID:2712
-
\??\c:\hbhnbb.exec:\hbhnbb.exe77⤵PID:2820
-
\??\c:\hbnntt.exec:\hbnntt.exe78⤵PID:2992
-
\??\c:\jdvdd.exec:\jdvdd.exe79⤵PID:2620
-
\??\c:\vvpvp.exec:\vvpvp.exe80⤵PID:2496
-
\??\c:\rlllrxl.exec:\rlllrxl.exe81⤵PID:808
-
\??\c:\nnnnnn.exec:\nnnnnn.exe82⤵PID:2904
-
\??\c:\hhtbbb.exec:\hhtbbb.exe83⤵PID:2524
-
\??\c:\nnnbnb.exec:\nnnbnb.exe84⤵PID:2732
-
\??\c:\jjdvp.exec:\jjdvp.exe85⤵PID:1924
-
\??\c:\lfrxxlx.exec:\lfrxxlx.exe86⤵PID:2308
-
\??\c:\lfrlrrr.exec:\lfrlrrr.exe87⤵PID:2608
-
\??\c:\nhbhnb.exec:\nhbhnb.exe88⤵PID:2648
-
\??\c:\nhttbt.exec:\nhttbt.exe89⤵PID:1616
-
\??\c:\jdppp.exec:\jdppp.exe90⤵PID:1420
-
\??\c:\dvvvd.exec:\dvvvd.exe91⤵PID:760
-
\??\c:\9frxflr.exec:\9frxflr.exe92⤵PID:2028
-
\??\c:\rflxffx.exec:\rflxffx.exe93⤵PID:2332
-
\??\c:\hbthbh.exec:\hbthbh.exe94⤵PID:1324
-
\??\c:\btntbt.exec:\btntbt.exe95⤵PID:1780
-
\??\c:\hbtbbn.exec:\hbtbbn.exe96⤵PID:3032
-
\??\c:\pjppp.exec:\pjppp.exe97⤵PID:1300
-
\??\c:\7djjv.exec:\7djjv.exe98⤵PID:1648
-
\??\c:\frffrrl.exec:\frffrrl.exe99⤵PID:1608
-
\??\c:\xxffrrf.exec:\xxffrrf.exe100⤵PID:956
-
\??\c:\3nbbbn.exec:\3nbbbn.exe101⤵PID:700
-
\??\c:\nnhnbh.exec:\nnhnbh.exe102⤵PID:2128
-
\??\c:\1dvvd.exec:\1dvvd.exe103⤵PID:2628
-
\??\c:\pjdjp.exec:\pjdjp.exe104⤵PID:996
-
\??\c:\rrfrffl.exec:\rrfrffl.exe105⤵PID:604
-
\??\c:\lfrxflr.exec:\lfrxflr.exe106⤵PID:1208
-
\??\c:\hthbbb.exec:\hthbbb.exe107⤵PID:2096
-
\??\c:\3bbtbb.exec:\3bbtbb.exe108⤵PID:768
-
\??\c:\hbbhtb.exec:\hbbhtb.exe109⤵PID:2924
-
\??\c:\ppjvd.exec:\ppjvd.exe110⤵PID:2276
-
\??\c:\pjvpv.exec:\pjvpv.exe111⤵PID:2760
-
\??\c:\5xrfxxr.exec:\5xrfxxr.exe112⤵PID:2236
-
\??\c:\3rfrxfl.exec:\3rfrxfl.exe113⤵PID:1588
-
\??\c:\btthtt.exec:\btthtt.exe114⤵PID:2672
-
\??\c:\nhttbh.exec:\nhttbh.exe115⤵PID:2068
-
\??\c:\pjppv.exec:\pjppv.exe116⤵PID:2876
-
\??\c:\rfrlxrx.exec:\rfrlxrx.exe117⤵PID:2560
-
\??\c:\9rxlrxr.exec:\9rxlrxr.exe118⤵PID:2548
-
\??\c:\1ffrxxl.exec:\1ffrxxl.exe119⤵PID:2612
-
\??\c:\hbtbhn.exec:\hbtbhn.exe120⤵PID:2604
-
\??\c:\nhbbhh.exec:\nhbbhh.exe121⤵PID:2388
-
\??\c:\vpdjv.exec:\vpdjv.exe122⤵PID:2904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-