Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
3dab17bc0bb02f5f9bc138c56d54f56031aa8a0c2b506fb4ba8c9488f20393aeN.exe
Resource
win7-20240903-en
General
-
Target
3dab17bc0bb02f5f9bc138c56d54f56031aa8a0c2b506fb4ba8c9488f20393aeN.exe
-
Size
83KB
-
MD5
b0ab1ee4cd818725627c95b1a0cab400
-
SHA1
a3d8462758368fa6999e1f3dd865b2501da52b7d
-
SHA256
3dab17bc0bb02f5f9bc138c56d54f56031aa8a0c2b506fb4ba8c9488f20393ae
-
SHA512
5163f2c9ba01f0d2db8576447e98c1f36a38c8c59040d4db468ac763835172ba083f88b2cd38f529a18e2f5fb5fb327c1a564cbd2ce3170b85e7a471e7b28137
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QZ:ymb3NkkiQ3mdBjFIIp9L9QrrA8o
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2016-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-96-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1140-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/584-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/340-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2692 9tnntb.exe 2820 1ddpv.exe 2800 pjdjd.exe 2576 lfxxffl.exe 2828 7dvjd.exe 2672 1frxllr.exe 2596 nnttnb.exe 2860 dpjpv.exe 2852 lfxxffr.exe 1056 tbbnnh.exe 1344 vpddd.exe 1404 xxxlxxr.exe 1140 lfxxllr.exe 2884 thtbtb.exe 584 3nhtnh.exe 1688 3ppdj.exe 1856 ffxfllx.exe 1996 5tnhnt.exe 1780 nhthnn.exe 1948 ddvdv.exe 2648 7pddp.exe 956 flxflrf.exe 340 1tnbhh.exe 1580 jvddp.exe 3020 vpvjd.exe 1844 rfxrrfl.exe 1280 hhhnhn.exe 996 ppvdj.exe 1180 1ddjd.exe 1888 lfxlxfr.exe 3016 xrlrxxr.exe 2264 tbbhtt.exe 2972 ppdvj.exe 2756 vpjpp.exe 2580 llffflr.exe 2576 rrxxffx.exe 2768 3htbnn.exe 2036 nhnnnt.exe 2604 ddvvj.exe 2296 jjdpj.exe 2652 rlxxflr.exe 2936 9rlrrll.exe 2908 tnbhtb.exe 2540 nhnnbb.exe 2592 jdpvd.exe 1248 vpjpp.exe 1884 xxxfrlf.exe 1896 rrflxxf.exe 1876 tntbnt.exe 2884 3bhtbh.exe 320 3jjpv.exe 112 vvdjp.exe 2532 1rfrxxl.exe 2144 nnbhnn.exe 2364 hbnntb.exe 2164 1dppp.exe 1732 5jdjp.exe 1016 xrfxllx.exe 1556 xxrlxfl.exe 900 tntthn.exe 1696 ttnttt.exe 580 3pjpv.exe 288 ddvjv.exe 2436 fxlfrxl.exe -
resource yara_rule behavioral1/memory/2016-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1140-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/340-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-249-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2692 2016 3dab17bc0bb02f5f9bc138c56d54f56031aa8a0c2b506fb4ba8c9488f20393aeN.exe 30 PID 2016 wrote to memory of 2692 2016 3dab17bc0bb02f5f9bc138c56d54f56031aa8a0c2b506fb4ba8c9488f20393aeN.exe 30 PID 2016 wrote to memory of 2692 2016 3dab17bc0bb02f5f9bc138c56d54f56031aa8a0c2b506fb4ba8c9488f20393aeN.exe 30 PID 2016 wrote to memory of 2692 2016 3dab17bc0bb02f5f9bc138c56d54f56031aa8a0c2b506fb4ba8c9488f20393aeN.exe 30 PID 2692 wrote to memory of 2820 2692 9tnntb.exe 31 PID 2692 wrote to memory of 2820 2692 9tnntb.exe 31 PID 2692 wrote to memory of 2820 2692 9tnntb.exe 31 PID 2692 wrote to memory of 2820 2692 9tnntb.exe 31 PID 2820 wrote to memory of 2800 2820 1ddpv.exe 32 PID 2820 wrote to memory of 2800 2820 1ddpv.exe 32 PID 2820 wrote to memory of 2800 2820 1ddpv.exe 32 PID 2820 wrote to memory of 2800 2820 1ddpv.exe 32 PID 2800 wrote to memory of 2576 2800 pjdjd.exe 33 PID 2800 wrote to memory of 2576 2800 pjdjd.exe 33 PID 2800 wrote to memory of 2576 2800 pjdjd.exe 33 PID 2800 wrote to memory of 2576 2800 pjdjd.exe 33 PID 2576 wrote to memory of 2828 2576 lfxxffl.exe 34 PID 2576 wrote to memory of 2828 2576 lfxxffl.exe 34 PID 2576 wrote to memory of 2828 2576 lfxxffl.exe 34 PID 2576 wrote to memory of 2828 2576 lfxxffl.exe 34 PID 2828 wrote to memory of 2672 2828 7dvjd.exe 35 PID 2828 wrote to memory of 2672 2828 7dvjd.exe 35 PID 2828 wrote to memory of 2672 2828 7dvjd.exe 35 PID 2828 wrote to memory of 2672 2828 7dvjd.exe 35 PID 2672 wrote to memory of 2596 2672 1frxllr.exe 36 PID 2672 wrote to memory of 2596 2672 1frxllr.exe 36 PID 2672 wrote to memory of 2596 2672 1frxllr.exe 36 PID 2672 wrote to memory of 2596 2672 1frxllr.exe 36 PID 2596 wrote to memory of 2860 2596 nnttnb.exe 37 PID 2596 wrote to memory of 2860 2596 nnttnb.exe 37 PID 2596 wrote to memory of 2860 2596 nnttnb.exe 37 PID 2596 wrote to memory of 2860 2596 nnttnb.exe 37 PID 2860 wrote to memory of 2852 2860 dpjpv.exe 38 PID 2860 wrote to memory of 2852 2860 dpjpv.exe 38 PID 2860 wrote to memory of 2852 2860 dpjpv.exe 38 PID 2860 wrote to memory of 2852 2860 dpjpv.exe 38 PID 2852 wrote to memory of 1056 2852 lfxxffr.exe 39 PID 2852 wrote to memory of 1056 2852 lfxxffr.exe 39 PID 2852 wrote to memory of 1056 2852 lfxxffr.exe 39 PID 2852 wrote to memory of 1056 2852 lfxxffr.exe 39 PID 1056 wrote to memory of 1344 1056 tbbnnh.exe 40 PID 1056 wrote to memory of 1344 1056 tbbnnh.exe 40 PID 1056 wrote to memory of 1344 1056 tbbnnh.exe 40 PID 1056 wrote to memory of 1344 1056 tbbnnh.exe 40 PID 1344 wrote to memory of 1404 1344 vpddd.exe 41 PID 1344 wrote to memory of 1404 1344 vpddd.exe 41 PID 1344 wrote to memory of 1404 1344 vpddd.exe 41 PID 1344 wrote to memory of 1404 1344 vpddd.exe 41 PID 1404 wrote to memory of 1140 1404 xxxlxxr.exe 42 PID 1404 wrote to memory of 1140 1404 xxxlxxr.exe 42 PID 1404 wrote to memory of 1140 1404 xxxlxxr.exe 42 PID 1404 wrote to memory of 1140 1404 xxxlxxr.exe 42 PID 1140 wrote to memory of 2884 1140 lfxxllr.exe 43 PID 1140 wrote to memory of 2884 1140 lfxxllr.exe 43 PID 1140 wrote to memory of 2884 1140 lfxxllr.exe 43 PID 1140 wrote to memory of 2884 1140 lfxxllr.exe 43 PID 2884 wrote to memory of 584 2884 thtbtb.exe 44 PID 2884 wrote to memory of 584 2884 thtbtb.exe 44 PID 2884 wrote to memory of 584 2884 thtbtb.exe 44 PID 2884 wrote to memory of 584 2884 thtbtb.exe 44 PID 584 wrote to memory of 1688 584 3nhtnh.exe 45 PID 584 wrote to memory of 1688 584 3nhtnh.exe 45 PID 584 wrote to memory of 1688 584 3nhtnh.exe 45 PID 584 wrote to memory of 1688 584 3nhtnh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dab17bc0bb02f5f9bc138c56d54f56031aa8a0c2b506fb4ba8c9488f20393aeN.exe"C:\Users\Admin\AppData\Local\Temp\3dab17bc0bb02f5f9bc138c56d54f56031aa8a0c2b506fb4ba8c9488f20393aeN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\9tnntb.exec:\9tnntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\1ddpv.exec:\1ddpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\pjdjd.exec:\pjdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\lfxxffl.exec:\lfxxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\7dvjd.exec:\7dvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1frxllr.exec:\1frxllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nnttnb.exec:\nnttnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\dpjpv.exec:\dpjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\lfxxffr.exec:\lfxxffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\tbbnnh.exec:\tbbnnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\vpddd.exec:\vpddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\xxxlxxr.exec:\xxxlxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\lfxxllr.exec:\lfxxllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\thtbtb.exec:\thtbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\3nhtnh.exec:\3nhtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\3ppdj.exec:\3ppdj.exe17⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ffxfllx.exec:\ffxfllx.exe18⤵
- Executes dropped EXE
PID:1856 -
\??\c:\5tnhnt.exec:\5tnhnt.exe19⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nhthnn.exec:\nhthnn.exe20⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ddvdv.exec:\ddvdv.exe21⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7pddp.exec:\7pddp.exe22⤵
- Executes dropped EXE
PID:2648 -
\??\c:\flxflrf.exec:\flxflrf.exe23⤵
- Executes dropped EXE
PID:956 -
\??\c:\1tnbhh.exec:\1tnbhh.exe24⤵
- Executes dropped EXE
PID:340 -
\??\c:\jvddp.exec:\jvddp.exe25⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vpvjd.exec:\vpvjd.exe26⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rfxrrfl.exec:\rfxrrfl.exe27⤵
- Executes dropped EXE
PID:1844 -
\??\c:\hhhnhn.exec:\hhhnhn.exe28⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ppvdj.exec:\ppvdj.exe29⤵
- Executes dropped EXE
PID:996 -
\??\c:\1ddjd.exec:\1ddjd.exe30⤵
- Executes dropped EXE
PID:1180 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xrlrxxr.exec:\xrlrxxr.exe32⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tbbhtt.exec:\tbbhtt.exe33⤵
- Executes dropped EXE
PID:2264 -
\??\c:\ppdvj.exec:\ppdvj.exe34⤵
- Executes dropped EXE
PID:2972 -
\??\c:\vpjpp.exec:\vpjpp.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\llffflr.exec:\llffflr.exe36⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rrxxffx.exec:\rrxxffx.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3htbnn.exec:\3htbnn.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhnnnt.exec:\nhnnnt.exe39⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ddvvj.exec:\ddvvj.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jjdpj.exec:\jjdpj.exe41⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rlxxflr.exec:\rlxxflr.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\9rlrrll.exec:\9rlrrll.exe43⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tnbhtb.exec:\tnbhtb.exe44⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nhnnbb.exec:\nhnnbb.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jdpvd.exec:\jdpvd.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vpjpp.exec:\vpjpp.exe47⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xxxfrlf.exec:\xxxfrlf.exe48⤵
- Executes dropped EXE
PID:1884 -
\??\c:\rrflxxf.exec:\rrflxxf.exe49⤵
- Executes dropped EXE
PID:1896 -
\??\c:\tntbnt.exec:\tntbnt.exe50⤵
- Executes dropped EXE
PID:1876 -
\??\c:\3bhtbh.exec:\3bhtbh.exe51⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3jjpv.exec:\3jjpv.exe52⤵
- Executes dropped EXE
PID:320 -
\??\c:\vvdjp.exec:\vvdjp.exe53⤵
- Executes dropped EXE
PID:112 -
\??\c:\1rfrxxl.exec:\1rfrxxl.exe54⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nnbhnn.exec:\nnbhnn.exe55⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hbnntb.exec:\hbnntb.exe56⤵
- Executes dropped EXE
PID:2364 -
\??\c:\1dppp.exec:\1dppp.exe57⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5jdjp.exec:\5jdjp.exe58⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xrfxllx.exec:\xrfxllx.exe59⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xxrlxfl.exec:\xxrlxfl.exe60⤵
- Executes dropped EXE
PID:1556 -
\??\c:\tntthn.exec:\tntthn.exe61⤵
- Executes dropped EXE
PID:900 -
\??\c:\ttnttt.exec:\ttnttt.exe62⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3pjpv.exec:\3pjpv.exe63⤵
- Executes dropped EXE
PID:580 -
\??\c:\ddvjv.exec:\ddvjv.exe64⤵
- Executes dropped EXE
PID:288 -
\??\c:\fxlfrxl.exec:\fxlfrxl.exe65⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xrrlxxf.exec:\xrrlxxf.exe66⤵PID:2980
-
\??\c:\7hbhhn.exec:\7hbhhn.exe67⤵PID:2132
-
\??\c:\5btbnb.exec:\5btbnb.exe68⤵PID:1412
-
\??\c:\djdvp.exec:\djdvp.exe69⤵PID:2316
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe70⤵PID:1928
-
\??\c:\3rrfllr.exec:\3rrfllr.exe71⤵PID:2704
-
\??\c:\1hbhtt.exec:\1hbhtt.exe72⤵PID:2760
-
\??\c:\ttnbhh.exec:\ttnbhh.exe73⤵PID:2204
-
\??\c:\ddvvd.exec:\ddvvd.exe74⤵PID:2560
-
\??\c:\9jdjv.exec:\9jdjv.exe75⤵PID:1516
-
\??\c:\lflrlrf.exec:\lflrlrf.exe76⤵PID:2804
-
\??\c:\llfxflr.exec:\llfxflr.exe77⤵PID:2548
-
\??\c:\1nnbnt.exec:\1nnbnt.exe78⤵PID:2664
-
\??\c:\btnthh.exec:\btnthh.exe79⤵PID:2828
-
\??\c:\hhbnbh.exec:\hhbnbh.exe80⤵PID:3064
-
\??\c:\dpddv.exec:\dpddv.exe81⤵PID:1796
-
\??\c:\7ppjp.exec:\7ppjp.exe82⤵PID:2924
-
\??\c:\lfrrflr.exec:\lfrrflr.exe83⤵PID:2740
-
\??\c:\fxlrffl.exec:\fxlrffl.exe84⤵PID:2796
-
\??\c:\1nhtnn.exec:\1nhtnn.exe85⤵PID:2128
-
\??\c:\bthnth.exec:\bthnth.exe86⤵PID:928
-
\??\c:\vvpvj.exec:\vvpvj.exe87⤵PID:1408
-
\??\c:\5jddj.exec:\5jddj.exe88⤵PID:1920
-
\??\c:\5xxxffl.exec:\5xxxffl.exe89⤵PID:2824
-
\??\c:\1xffrrf.exec:\1xffrrf.exe90⤵PID:2848
-
\??\c:\5hbnbh.exec:\5hbnbh.exe91⤵PID:536
-
\??\c:\hhthhh.exec:\hhthhh.exe92⤵PID:1228
-
\??\c:\9pjdj.exec:\9pjdj.exe93⤵PID:3000
-
\??\c:\dvjjp.exec:\dvjjp.exe94⤵PID:2200
-
\??\c:\llffxfr.exec:\llffxfr.exe95⤵PID:2168
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe96⤵PID:1912
-
\??\c:\rrfrxlr.exec:\rrfrxlr.exe97⤵PID:1848
-
\??\c:\bbtbtt.exec:\bbtbtt.exe98⤵PID:2968
-
\??\c:\5vdvd.exec:\5vdvd.exe99⤵PID:2184
-
\??\c:\vdjdd.exec:\vdjdd.exe100⤵PID:1268
-
\??\c:\fffrfrl.exec:\fffrfrl.exe101⤵PID:1660
-
\??\c:\lflfllf.exec:\lflfllf.exe102⤵PID:984
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe103⤵PID:1708
-
\??\c:\nnhthh.exec:\nnhthh.exe104⤵PID:1540
-
\??\c:\nbhhnh.exec:\nbhhnh.exe105⤵PID:3028
-
\??\c:\jvvjd.exec:\jvvjd.exe106⤵PID:752
-
\??\c:\vpppv.exec:\vpppv.exe107⤵PID:1956
-
\??\c:\lllxfrx.exec:\lllxfrx.exe108⤵PID:880
-
\??\c:\9lxlfxx.exec:\9lxlfxx.exe109⤵PID:2660
-
\??\c:\3thntb.exec:\3thntb.exe110⤵PID:2696
-
\??\c:\5pjpv.exec:\5pjpv.exe111⤵PID:2700
-
\??\c:\vddvv.exec:\vddvv.exe112⤵PID:2812
-
\??\c:\xrxrrxf.exec:\xrxrrxf.exe113⤵PID:2760
-
\??\c:\5rllxxl.exec:\5rllxxl.exe114⤵PID:2416
-
\??\c:\tbnhht.exec:\tbnhht.exe115⤵PID:2756
-
\??\c:\7hbhnt.exec:\7hbhnt.exe116⤵PID:2112
-
\??\c:\jjpjp.exec:\jjpjp.exe117⤵PID:2576
-
\??\c:\jjvvd.exec:\jjvvd.exe118⤵PID:2668
-
\??\c:\7rlrrrf.exec:\7rlrrrf.exe119⤵PID:2036
-
\??\c:\llrxlfr.exec:\llrxlfr.exe120⤵PID:2584
-
\??\c:\bttbht.exec:\bttbht.exe121⤵PID:2296
-
\??\c:\nbnntt.exec:\nbnntt.exe122⤵PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-