Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 16:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe
-
Size
64KB
-
MD5
23babc5fb7485d6f4a539544582ac0a0
-
SHA1
47b4d56548cb50773d284411097776c544c27486
-
SHA256
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563
-
SHA512
2a680fd0be0ee2b0d766c684847c47fc28bb65d77e52f283c4b2db90ffd2654b351aaaf84f1bf32f849b889c0ba8e43d9abef0d275087adcd236c79aa6fd181b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B1R:ymb3NkkiQ3mdBjFI9cD
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2544-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1412-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2380 htthhb.exe 2240 vpdvd.exe 2772 5pvvv.exe 2884 nbhbbh.exe 2788 3nbtnn.exe 2648 vvvjd.exe 2624 lflxfff.exe 2796 nbthhh.exe 776 9djjj.exe 1412 rlxxrff.exe 1200 3frxfff.exe 2920 thhtbt.exe 1716 dpjdd.exe 1632 7vpdd.exe 2844 7frlllr.exe 2936 lfrrrrr.exe 2484 9bbnnh.exe 2940 7thntn.exe 2988 ppjpv.exe 2196 jdddd.exe 1580 rfxrrrx.exe 2336 fflfrrl.exe 1312 bhnnhh.exe 984 htntbh.exe 1628 pjpdd.exe 2232 dpddd.exe 2312 rffflfl.exe 2256 tnnttb.exe 532 1nbnnn.exe 2368 3dpjp.exe 2108 ddpjj.exe 1032 1flfrrf.exe 2768 xlrxlrr.exe 2876 7hbtbb.exe 2756 vjdvp.exe 2852 dpppv.exe 2944 djvvv.exe 2800 ffrlfxx.exe 2820 1fxffll.exe 2692 1djjj.exe 3056 7pvpj.exe 624 pdjdv.exe 1444 lfrrrrr.exe 1112 rfffffr.exe 2612 xrrfxrr.exe 356 htbbtt.exe 1104 bhnntt.exe 844 dvjjj.exe 2924 pddvv.exe 2728 rfxrxrl.exe 1148 frrrlff.exe 2384 7lxxrfl.exe 2948 nhtbhh.exe 1956 bthhnn.exe 2104 jvjjv.exe 2996 pdvpv.exe 2308 3frllll.exe 2356 ntnnhn.exe 1460 5hthbb.exe 1968 btnhtn.exe 1868 9pjdj.exe 1428 rfrfrrr.exe 2068 9rfrlfx.exe 3008 llfrrlx.exe -
resource yara_rule behavioral1/memory/2544-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1412-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-306-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxxxxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 2380 2544 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 30 PID 2544 wrote to memory of 2380 2544 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 30 PID 2544 wrote to memory of 2380 2544 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 30 PID 2544 wrote to memory of 2380 2544 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 30 PID 2380 wrote to memory of 2240 2380 htthhb.exe 31 PID 2380 wrote to memory of 2240 2380 htthhb.exe 31 PID 2380 wrote to memory of 2240 2380 htthhb.exe 31 PID 2380 wrote to memory of 2240 2380 htthhb.exe 31 PID 2240 wrote to memory of 2772 2240 vpdvd.exe 32 PID 2240 wrote to memory of 2772 2240 vpdvd.exe 32 PID 2240 wrote to memory of 2772 2240 vpdvd.exe 32 PID 2240 wrote to memory of 2772 2240 vpdvd.exe 32 PID 2772 wrote to memory of 2884 2772 5pvvv.exe 33 PID 2772 wrote to memory of 2884 2772 5pvvv.exe 33 PID 2772 wrote to memory of 2884 2772 5pvvv.exe 33 PID 2772 wrote to memory of 2884 2772 5pvvv.exe 33 PID 2884 wrote to memory of 2788 2884 nbhbbh.exe 34 PID 2884 wrote to memory of 2788 2884 nbhbbh.exe 34 PID 2884 wrote to memory of 2788 2884 nbhbbh.exe 34 PID 2884 wrote to memory of 2788 2884 nbhbbh.exe 34 PID 2788 wrote to memory of 2648 2788 3nbtnn.exe 35 PID 2788 wrote to memory of 2648 2788 3nbtnn.exe 35 PID 2788 wrote to memory of 2648 2788 3nbtnn.exe 35 PID 2788 wrote to memory of 2648 2788 3nbtnn.exe 35 PID 2648 wrote to memory of 2624 2648 vvvjd.exe 36 PID 2648 wrote to memory of 2624 2648 vvvjd.exe 36 PID 2648 wrote to memory of 2624 2648 vvvjd.exe 36 PID 2648 wrote to memory of 2624 2648 vvvjd.exe 36 PID 2624 wrote to memory of 2796 2624 lflxfff.exe 37 PID 2624 wrote to memory of 2796 2624 lflxfff.exe 37 PID 2624 wrote to memory of 2796 2624 lflxfff.exe 37 PID 2624 wrote to memory of 2796 2624 lflxfff.exe 37 PID 2796 wrote to memory of 776 2796 nbthhh.exe 38 PID 2796 wrote to memory of 776 2796 nbthhh.exe 38 PID 2796 wrote to memory of 776 2796 nbthhh.exe 38 PID 2796 wrote to memory of 776 2796 nbthhh.exe 38 PID 776 wrote to memory of 1412 776 9djjj.exe 39 PID 776 wrote to memory of 1412 776 9djjj.exe 39 PID 776 wrote to memory of 1412 776 9djjj.exe 39 PID 776 wrote to memory of 1412 776 9djjj.exe 39 PID 1412 wrote to memory of 1200 1412 rlxxrff.exe 40 PID 1412 wrote to memory of 1200 1412 rlxxrff.exe 40 PID 1412 wrote to memory of 1200 1412 rlxxrff.exe 40 PID 1412 wrote to memory of 1200 1412 rlxxrff.exe 40 PID 1200 wrote to memory of 2920 1200 3frxfff.exe 41 PID 1200 wrote to memory of 2920 1200 3frxfff.exe 41 PID 1200 wrote to memory of 2920 1200 3frxfff.exe 41 PID 1200 wrote to memory of 2920 1200 3frxfff.exe 41 PID 2920 wrote to memory of 1716 2920 thhtbt.exe 42 PID 2920 wrote to memory of 1716 2920 thhtbt.exe 42 PID 2920 wrote to memory of 1716 2920 thhtbt.exe 42 PID 2920 wrote to memory of 1716 2920 thhtbt.exe 42 PID 1716 wrote to memory of 1632 1716 dpjdd.exe 43 PID 1716 wrote to memory of 1632 1716 dpjdd.exe 43 PID 1716 wrote to memory of 1632 1716 dpjdd.exe 43 PID 1716 wrote to memory of 1632 1716 dpjdd.exe 43 PID 1632 wrote to memory of 2844 1632 7vpdd.exe 44 PID 1632 wrote to memory of 2844 1632 7vpdd.exe 44 PID 1632 wrote to memory of 2844 1632 7vpdd.exe 44 PID 1632 wrote to memory of 2844 1632 7vpdd.exe 44 PID 2844 wrote to memory of 2936 2844 7frlllr.exe 45 PID 2844 wrote to memory of 2936 2844 7frlllr.exe 45 PID 2844 wrote to memory of 2936 2844 7frlllr.exe 45 PID 2844 wrote to memory of 2936 2844 7frlllr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe"C:\Users\Admin\AppData\Local\Temp\06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\htthhb.exec:\htthhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\vpdvd.exec:\vpdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\5pvvv.exec:\5pvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nbhbbh.exec:\nbhbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\3nbtnn.exec:\3nbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vvvjd.exec:\vvvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\lflxfff.exec:\lflxfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\nbthhh.exec:\nbthhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\9djjj.exec:\9djjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\rlxxrff.exec:\rlxxrff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\3frxfff.exec:\3frxfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\thhtbt.exec:\thhtbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\dpjdd.exec:\dpjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\7vpdd.exec:\7vpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\7frlllr.exec:\7frlllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe17⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9bbnnh.exec:\9bbnnh.exe18⤵
- Executes dropped EXE
PID:2484 -
\??\c:\7thntn.exec:\7thntn.exe19⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ppjpv.exec:\ppjpv.exe20⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jdddd.exec:\jdddd.exe21⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rfxrrrx.exec:\rfxrrrx.exe22⤵
- Executes dropped EXE
PID:1580 -
\??\c:\fflfrrl.exec:\fflfrrl.exe23⤵
- Executes dropped EXE
PID:2336 -
\??\c:\bhnnhh.exec:\bhnnhh.exe24⤵
- Executes dropped EXE
PID:1312 -
\??\c:\htntbh.exec:\htntbh.exe25⤵
- Executes dropped EXE
PID:984 -
\??\c:\pjpdd.exec:\pjpdd.exe26⤵
- Executes dropped EXE
PID:1628 -
\??\c:\dpddd.exec:\dpddd.exe27⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rffflfl.exec:\rffflfl.exe28⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tnnttb.exec:\tnnttb.exe29⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1nbnnn.exec:\1nbnnn.exe30⤵
- Executes dropped EXE
PID:532 -
\??\c:\3dpjp.exec:\3dpjp.exe31⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ddpjj.exec:\ddpjj.exe32⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1flfrrf.exec:\1flfrrf.exe33⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xlrxlrr.exec:\xlrxlrr.exe34⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7hbtbb.exec:\7hbtbb.exe35⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vjdvp.exec:\vjdvp.exe36⤵
- Executes dropped EXE
PID:2756 -
\??\c:\dpppv.exec:\dpppv.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\djvvv.exec:\djvvv.exe38⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ffrlfxx.exec:\ffrlfxx.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\1fxffll.exec:\1fxffll.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1djjj.exec:\1djjj.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7pvpj.exec:\7pvpj.exe42⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pdjdv.exec:\pdjdv.exe43⤵
- Executes dropped EXE
PID:624 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe44⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rfffffr.exec:\rfffffr.exe45⤵
- Executes dropped EXE
PID:1112 -
\??\c:\xrrfxrr.exec:\xrrfxrr.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\htbbtt.exec:\htbbtt.exe47⤵
- Executes dropped EXE
PID:356 -
\??\c:\bhnntt.exec:\bhnntt.exe48⤵
- Executes dropped EXE
PID:1104 -
\??\c:\dvjjj.exec:\dvjjj.exe49⤵
- Executes dropped EXE
PID:844 -
\??\c:\pddvv.exec:\pddvv.exe50⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rfxrxrl.exec:\rfxrxrl.exe51⤵
- Executes dropped EXE
PID:2728 -
\??\c:\frrrlff.exec:\frrrlff.exe52⤵
- Executes dropped EXE
PID:1148 -
\??\c:\7lxxrfl.exec:\7lxxrfl.exe53⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nhtbhh.exec:\nhtbhh.exe54⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bthhnn.exec:\bthhnn.exe55⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jvjjv.exec:\jvjjv.exe56⤵
- Executes dropped EXE
PID:2104 -
\??\c:\pdvpv.exec:\pdvpv.exe57⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3frllll.exec:\3frllll.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ntnnhn.exec:\ntnnhn.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\5hthbb.exec:\5hthbb.exe60⤵
- Executes dropped EXE
PID:1460 -
\??\c:\btnhtn.exec:\btnhtn.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9pjdj.exec:\9pjdj.exe62⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rfrfrrr.exec:\rfrfrrr.exe63⤵
- Executes dropped EXE
PID:1428 -
\??\c:\9rfrlfx.exec:\9rfrlfx.exe64⤵
- Executes dropped EXE
PID:2068 -
\??\c:\llfrrlx.exec:\llfrrlx.exe65⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nhtttt.exec:\nhtttt.exe66⤵PID:2020
-
\??\c:\jdjpd.exec:\jdjpd.exe67⤵PID:892
-
\??\c:\vjjjd.exec:\vjjjd.exe68⤵PID:3024
-
\??\c:\ppvdd.exec:\ppvdd.exe69⤵PID:3032
-
\??\c:\lrfffxr.exec:\lrfffxr.exe70⤵PID:2380
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe71⤵PID:2124
-
\??\c:\hbhbhb.exec:\hbhbhb.exe72⤵PID:1644
-
\??\c:\9hnttt.exec:\9hnttt.exe73⤵PID:2784
-
\??\c:\pdjpj.exec:\pdjpj.exe74⤵PID:2860
-
\??\c:\vjvvj.exec:\vjvvj.exe75⤵PID:2884
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe76⤵PID:2632
-
\??\c:\flxxxxf.exec:\flxxxxf.exe77⤵PID:2764
-
\??\c:\hbnbnn.exec:\hbnbnn.exe78⤵PID:2892
-
\??\c:\hbnntt.exec:\hbnntt.exe79⤵PID:2672
-
\??\c:\5hbhnn.exec:\5hbhnn.exe80⤵PID:2600
-
\??\c:\jdvdv.exec:\jdvdv.exe81⤵PID:2260
-
\??\c:\7rfffxf.exec:\7rfffxf.exe82⤵PID:1572
-
\??\c:\1xrrxxf.exec:\1xrrxxf.exe83⤵PID:2052
-
\??\c:\hbhbbb.exec:\hbhbbb.exe84⤵PID:1932
-
\??\c:\bthnbh.exec:\bthnbh.exe85⤵PID:2688
-
\??\c:\pvdpp.exec:\pvdpp.exe86⤵PID:1744
-
\??\c:\3jdvv.exec:\3jdvv.exe87⤵PID:1916
-
\??\c:\llfxfff.exec:\llfxfff.exe88⤵PID:1716
-
\??\c:\lfxllxf.exec:\lfxllxf.exe89⤵PID:2372
-
\??\c:\3bhnnt.exec:\3bhnnt.exe90⤵PID:1984
-
\??\c:\tnbbhh.exec:\tnbbhh.exe91⤵PID:1988
-
\??\c:\5hhhnn.exec:\5hhhnn.exe92⤵PID:1148
-
\??\c:\ppdjd.exec:\ppdjd.exe93⤵PID:2484
-
\??\c:\jjpjp.exec:\jjpjp.exe94⤵PID:2608
-
\??\c:\1fxflxl.exec:\1fxflxl.exe95⤵PID:2200
-
\??\c:\xrfrrrx.exec:\xrfrrrx.exe96⤵PID:2804
-
\??\c:\bbbbtt.exec:\bbbbtt.exe97⤵PID:2324
-
\??\c:\htthhh.exec:\htthhh.exe98⤵PID:836
-
\??\c:\vpjpd.exec:\vpjpd.exe99⤵PID:2036
-
\??\c:\lxffxrx.exec:\lxffxrx.exe100⤵PID:848
-
\??\c:\lflrflf.exec:\lflrflf.exe101⤵PID:1216
-
\??\c:\bnnntt.exec:\bnnntt.exe102⤵PID:1628
-
\??\c:\btbttn.exec:\btbttn.exe103⤵PID:1688
-
\??\c:\pdppp.exec:\pdppp.exe104⤵PID:2232
-
\??\c:\djjvp.exec:\djjvp.exe105⤵PID:3012
-
\??\c:\pjvvv.exec:\pjvvv.exe106⤵PID:888
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe107⤵PID:2544
-
\??\c:\lxfffff.exec:\lxfffff.exe108⤵PID:3024
-
\??\c:\1bnntt.exec:\1bnntt.exe109⤵PID:2268
-
\??\c:\thhhhb.exec:\thhhhb.exe110⤵PID:316
-
\??\c:\jvddj.exec:\jvddj.exe111⤵PID:1528
-
\??\c:\9dppv.exec:\9dppv.exe112⤵PID:2864
-
\??\c:\xrflxll.exec:\xrflxll.exe113⤵PID:2468
-
\??\c:\lxfxxrx.exec:\lxfxxrx.exe114⤵PID:2904
-
\??\c:\tnbhhb.exec:\tnbhhb.exe115⤵PID:2928
-
\??\c:\nhbhhh.exec:\nhbhhh.exe116⤵PID:1448
-
\??\c:\pjjpv.exec:\pjjpv.exe117⤵PID:2792
-
\??\c:\5jjpp.exec:\5jjpp.exe118⤵PID:2644
-
\??\c:\frflxxf.exec:\frflxxf.exe119⤵PID:3052
-
\??\c:\1frlllr.exec:\1frlllr.exe120⤵PID:1592
-
\??\c:\9nhbbb.exec:\9nhbbb.exe121⤵PID:3060
-
\??\c:\1nbbtb.exec:\1nbbtb.exe122⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-