Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22/11/2024, 22:46
Static task
static1
Behavioral task
behavioral1
Sample
fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe
Resource
win7-20240729-en
General
-
Target
fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe
-
Size
72KB
-
MD5
9b505f1dcf02dab70d5bfbcd3ddba70e
-
SHA1
437694a0e4a803b48e19716b00713a22f097970c
-
SHA256
fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394
-
SHA512
72a81776859465374cc6c6ed1b2ccc7a375dac80beb03f17447b615c5e985fc14680860cf97dd116ba69367824b6c9c22cb7e16ae7e9b9f3cf87e54b6e72aa76
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUcicP/fG:ymb3NkkiQ3mdBjFI4V4ci2/fG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2540-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/704-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/272-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 704 jvjjj.exe 572 xxlrxfl.exe 2816 7nbhnh.exe 2612 ffrrrxl.exe 2800 7thntt.exe 2716 ddpvd.exe 2668 3rfffxx.exe 2656 fxrlrll.exe 2872 bhnttt.exe 2064 jpddj.exe 2060 rrflrfl.exe 2672 llllrrx.exe 2876 ttttbb.exe 792 5vdjj.exe 3004 3pvvv.exe 2256 xxfllxf.exe 1872 9bnhtb.exe 272 1tnbnb.exe 2976 ppvvj.exe 1804 ppjpv.exe 2296 3lxlrxf.exe 1764 1bnbbb.exe 1584 1nhbbb.exe 308 pjvdj.exe 2940 rxfxfll.exe 1512 xrrxlrr.exe 1736 7thbhb.exe 796 pvpvp.exe 984 rrxxxfl.exe 2936 ffrrxxx.exe 1604 hhtttb.exe 704 ttbbht.exe 572 9pjpv.exe 1572 rrrlxrx.exe 2760 lflrrrx.exe 2816 bbbnnh.exe 2832 tbhbbn.exe 2628 jdddj.exe 2660 9jddp.exe 2636 5lxxxxx.exe 1640 llllllr.exe 2212 nnhntn.exe 2840 pdddj.exe 1776 1pvjp.exe 2308 5xrflll.exe 2268 3lflxfx.exe 1992 nnbttb.exe 2704 tntttn.exe 988 dppjv.exe 844 jjdvd.exe 2928 rlxxxfl.exe 1612 rrxxflr.exe 1068 bbhhnt.exe 2000 nnthtn.exe 544 ppjdv.exe 2392 7jjjp.exe 2208 rlrrfll.exe 2396 nhhtht.exe 764 bbbbhh.exe 620 5httht.exe 2112 5pvdv.exe 1920 3vdvd.exe 488 3xflxxx.exe 2284 hbnthb.exe -
resource yara_rule behavioral1/memory/2540-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/272-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 704 2540 fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe 29 PID 2540 wrote to memory of 704 2540 fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe 29 PID 2540 wrote to memory of 704 2540 fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe 29 PID 2540 wrote to memory of 704 2540 fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe 29 PID 704 wrote to memory of 572 704 jvjjj.exe 30 PID 704 wrote to memory of 572 704 jvjjj.exe 30 PID 704 wrote to memory of 572 704 jvjjj.exe 30 PID 704 wrote to memory of 572 704 jvjjj.exe 30 PID 572 wrote to memory of 2816 572 xxlrxfl.exe 31 PID 572 wrote to memory of 2816 572 xxlrxfl.exe 31 PID 572 wrote to memory of 2816 572 xxlrxfl.exe 31 PID 572 wrote to memory of 2816 572 xxlrxfl.exe 31 PID 2816 wrote to memory of 2612 2816 7nbhnh.exe 32 PID 2816 wrote to memory of 2612 2816 7nbhnh.exe 32 PID 2816 wrote to memory of 2612 2816 7nbhnh.exe 32 PID 2816 wrote to memory of 2612 2816 7nbhnh.exe 32 PID 2612 wrote to memory of 2800 2612 ffrrrxl.exe 33 PID 2612 wrote to memory of 2800 2612 ffrrrxl.exe 33 PID 2612 wrote to memory of 2800 2612 ffrrrxl.exe 33 PID 2612 wrote to memory of 2800 2612 ffrrrxl.exe 33 PID 2800 wrote to memory of 2716 2800 7thntt.exe 34 PID 2800 wrote to memory of 2716 2800 7thntt.exe 34 PID 2800 wrote to memory of 2716 2800 7thntt.exe 34 PID 2800 wrote to memory of 2716 2800 7thntt.exe 34 PID 2716 wrote to memory of 2668 2716 ddpvd.exe 35 PID 2716 wrote to memory of 2668 2716 ddpvd.exe 35 PID 2716 wrote to memory of 2668 2716 ddpvd.exe 35 PID 2716 wrote to memory of 2668 2716 ddpvd.exe 35 PID 2668 wrote to memory of 2656 2668 3rfffxx.exe 36 PID 2668 wrote to memory of 2656 2668 3rfffxx.exe 36 PID 2668 wrote to memory of 2656 2668 3rfffxx.exe 36 PID 2668 wrote to memory of 2656 2668 3rfffxx.exe 36 PID 2656 wrote to memory of 2872 2656 fxrlrll.exe 37 PID 2656 wrote to memory of 2872 2656 fxrlrll.exe 37 PID 2656 wrote to memory of 2872 2656 fxrlrll.exe 37 PID 2656 wrote to memory of 2872 2656 fxrlrll.exe 37 PID 2872 wrote to memory of 2064 2872 bhnttt.exe 38 PID 2872 wrote to memory of 2064 2872 bhnttt.exe 38 PID 2872 wrote to memory of 2064 2872 bhnttt.exe 38 PID 2872 wrote to memory of 2064 2872 bhnttt.exe 38 PID 2064 wrote to memory of 2060 2064 jpddj.exe 39 PID 2064 wrote to memory of 2060 2064 jpddj.exe 39 PID 2064 wrote to memory of 2060 2064 jpddj.exe 39 PID 2064 wrote to memory of 2060 2064 jpddj.exe 39 PID 2060 wrote to memory of 2672 2060 rrflrfl.exe 40 PID 2060 wrote to memory of 2672 2060 rrflrfl.exe 40 PID 2060 wrote to memory of 2672 2060 rrflrfl.exe 40 PID 2060 wrote to memory of 2672 2060 rrflrfl.exe 40 PID 2672 wrote to memory of 2876 2672 llllrrx.exe 41 PID 2672 wrote to memory of 2876 2672 llllrrx.exe 41 PID 2672 wrote to memory of 2876 2672 llllrrx.exe 41 PID 2672 wrote to memory of 2876 2672 llllrrx.exe 41 PID 2876 wrote to memory of 792 2876 ttttbb.exe 42 PID 2876 wrote to memory of 792 2876 ttttbb.exe 42 PID 2876 wrote to memory of 792 2876 ttttbb.exe 42 PID 2876 wrote to memory of 792 2876 ttttbb.exe 42 PID 792 wrote to memory of 3004 792 5vdjj.exe 43 PID 792 wrote to memory of 3004 792 5vdjj.exe 43 PID 792 wrote to memory of 3004 792 5vdjj.exe 43 PID 792 wrote to memory of 3004 792 5vdjj.exe 43 PID 3004 wrote to memory of 2256 3004 3pvvv.exe 44 PID 3004 wrote to memory of 2256 3004 3pvvv.exe 44 PID 3004 wrote to memory of 2256 3004 3pvvv.exe 44 PID 3004 wrote to memory of 2256 3004 3pvvv.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe"C:\Users\Admin\AppData\Local\Temp\fa3093a22c61d8d47fc4edcfe379a354444ddb840cb1d4101dc20333ce66f394.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\jvjjj.exec:\jvjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\xxlrxfl.exec:\xxlrxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\7nbhnh.exec:\7nbhnh.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ffrrrxl.exec:\ffrrrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\7thntt.exec:\7thntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ddpvd.exec:\ddpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\3rfffxx.exec:\3rfffxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\fxrlrll.exec:\fxrlrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\bhnttt.exec:\bhnttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\jpddj.exec:\jpddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\rrflrfl.exec:\rrflrfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\llllrrx.exec:\llllrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\ttttbb.exec:\ttttbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\5vdjj.exec:\5vdjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\3pvvv.exec:\3pvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\xxfllxf.exec:\xxfllxf.exe17⤵
- Executes dropped EXE
PID:2256 -
\??\c:\9bnhtb.exec:\9bnhtb.exe18⤵
- Executes dropped EXE
PID:1872 -
\??\c:\1tnbnb.exec:\1tnbnb.exe19⤵
- Executes dropped EXE
PID:272 -
\??\c:\ppvvj.exec:\ppvvj.exe20⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ppjpv.exec:\ppjpv.exe21⤵
- Executes dropped EXE
PID:1804 -
\??\c:\3lxlrxf.exec:\3lxlrxf.exe22⤵
- Executes dropped EXE
PID:2296 -
\??\c:\1bnbbb.exec:\1bnbbb.exe23⤵
- Executes dropped EXE
PID:1764 -
\??\c:\1nhbbb.exec:\1nhbbb.exe24⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pjvdj.exec:\pjvdj.exe25⤵
- Executes dropped EXE
PID:308 -
\??\c:\rxfxfll.exec:\rxfxfll.exe26⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xrrxlrr.exec:\xrrxlrr.exe27⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7thbhb.exec:\7thbhb.exe28⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pvpvp.exec:\pvpvp.exe29⤵
- Executes dropped EXE
PID:796 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe30⤵
- Executes dropped EXE
PID:984 -
\??\c:\ffrrxxx.exec:\ffrrxxx.exe31⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hhtttb.exec:\hhtttb.exe32⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ttbbht.exec:\ttbbht.exe33⤵
- Executes dropped EXE
PID:704 -
\??\c:\9pjpv.exec:\9pjpv.exe34⤵
- Executes dropped EXE
PID:572 -
\??\c:\rrrlxrx.exec:\rrrlxrx.exe35⤵
- Executes dropped EXE
PID:1572 -
\??\c:\lflrrrx.exec:\lflrrrx.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bbbnnh.exec:\bbbnnh.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tbhbbn.exec:\tbhbbn.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\jdddj.exec:\jdddj.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9jddp.exec:\9jddp.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5lxxxxx.exec:\5lxxxxx.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\llllllr.exec:\llllllr.exe42⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nnhntn.exec:\nnhntn.exe43⤵
- Executes dropped EXE
PID:2212 -
\??\c:\pdddj.exec:\pdddj.exe44⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1pvjp.exec:\1pvjp.exe45⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5xrflll.exec:\5xrflll.exe46⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3lflxfx.exec:\3lflxfx.exe47⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nnbttb.exec:\nnbttb.exe48⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tntttn.exec:\tntttn.exe49⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dppjv.exec:\dppjv.exe50⤵
- Executes dropped EXE
PID:988 -
\??\c:\jjdvd.exec:\jjdvd.exe51⤵
- Executes dropped EXE
PID:844 -
\??\c:\rlxxxfl.exec:\rlxxxfl.exe52⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rrxxflr.exec:\rrxxflr.exe53⤵
- Executes dropped EXE
PID:1612 -
\??\c:\bbhhnt.exec:\bbhhnt.exe54⤵
- Executes dropped EXE
PID:1068 -
\??\c:\nnthtn.exec:\nnthtn.exe55⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ppjdv.exec:\ppjdv.exe56⤵
- Executes dropped EXE
PID:544 -
\??\c:\7jjjp.exec:\7jjjp.exe57⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rlrrfll.exec:\rlrrfll.exe58⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nhhtht.exec:\nhhtht.exe59⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bbbbhh.exec:\bbbbhh.exe60⤵
- Executes dropped EXE
PID:764 -
\??\c:\5httht.exec:\5httht.exe61⤵
- Executes dropped EXE
PID:620 -
\??\c:\5pvdv.exec:\5pvdv.exe62⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3vdvd.exec:\3vdvd.exe63⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3xflxxx.exec:\3xflxxx.exe64⤵
- Executes dropped EXE
PID:488 -
\??\c:\hbnthb.exec:\hbnthb.exe65⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hhbnbb.exec:\hhbnbb.exe66⤵PID:1288
-
\??\c:\vjdjv.exec:\vjdjv.exe67⤵PID:3064
-
\??\c:\dvjpj.exec:\dvjpj.exe68⤵PID:1240
-
\??\c:\5xrxlrl.exec:\5xrxlrl.exe69⤵PID:796
-
\??\c:\ffllrrr.exec:\ffllrrr.exe70⤵PID:2352
-
\??\c:\nntbbn.exec:\nntbbn.exe71⤵PID:1644
-
\??\c:\3tnntt.exec:\3tnntt.exe72⤵PID:2336
-
\??\c:\1vjjd.exec:\1vjjd.exe73⤵PID:1604
-
\??\c:\vvjdd.exec:\vvjdd.exe74⤵PID:2200
-
\??\c:\rrffrrl.exec:\rrffrrl.exe75⤵PID:1596
-
\??\c:\3lxxxrf.exec:\3lxxxrf.exe76⤵PID:2848
-
\??\c:\nnnntt.exec:\nnnntt.exe77⤵PID:2824
-
\??\c:\nnhbhh.exec:\nnhbhh.exe78⤵PID:2640
-
\??\c:\9jjpv.exec:\9jjpv.exe79⤵PID:2612
-
\??\c:\jjjjj.exec:\jjjjj.exe80⤵PID:2740
-
\??\c:\rrxxfll.exec:\rrxxfll.exe81⤵PID:2624
-
\??\c:\hhnnbb.exec:\hhnnbb.exe82⤵PID:2772
-
\??\c:\hbbntb.exec:\hbbntb.exe83⤵PID:3044
-
\??\c:\ppppd.exec:\ppppd.exe84⤵PID:1444
-
\??\c:\vpvvd.exec:\vpvvd.exe85⤵PID:2272
-
\??\c:\9xrfrxx.exec:\9xrfrxx.exe86⤵PID:2872
-
\??\c:\lflxllx.exec:\lflxllx.exe87⤵PID:2064
-
\??\c:\1nbbhh.exec:\1nbbhh.exe88⤵PID:2416
-
\??\c:\tthhtn.exec:\tthhtn.exe89⤵PID:2692
-
\??\c:\5jvjj.exec:\5jvjj.exe90⤵PID:2920
-
\??\c:\3vppd.exec:\3vppd.exe91⤵PID:1020
-
\??\c:\fffxxxx.exec:\fffxxxx.exe92⤵PID:1100
-
\??\c:\llrlxrx.exec:\llrlxrx.exe93⤵PID:1352
-
\??\c:\7bntbb.exec:\7bntbb.exe94⤵PID:2968
-
\??\c:\bbhntn.exec:\bbhntn.exe95⤵PID:1160
-
\??\c:\pjppd.exec:\pjppd.exe96⤵PID:2172
-
\??\c:\1pvvd.exec:\1pvvd.exe97⤵PID:2556
-
\??\c:\lffxxll.exec:\lffxxll.exe98⤵PID:2976
-
\??\c:\xlrxflr.exec:\xlrxflr.exe99⤵PID:1932
-
\??\c:\7htttb.exec:\7htttb.exe100⤵PID:936
-
\??\c:\7htthn.exec:\7htthn.exe101⤵PID:780
-
\??\c:\tnnnnh.exec:\tnnnnh.exe102⤵PID:2564
-
\??\c:\jvddj.exec:\jvddj.exe103⤵PID:2568
-
\??\c:\5jvpp.exec:\5jvpp.exe104⤵PID:308
-
\??\c:\7fllrrr.exec:\7fllrrr.exe105⤵PID:2424
-
\??\c:\3lrxffl.exec:\3lrxffl.exe106⤵PID:1656
-
\??\c:\bhbnbn.exec:\bhbnbn.exe107⤵PID:3056
-
\??\c:\3nbntt.exec:\3nbntt.exe108⤵PID:2320
-
\??\c:\7djvv.exec:\7djvv.exe109⤵PID:1256
-
\??\c:\3jjjp.exec:\3jjjp.exe110⤵PID:892
-
\??\c:\llrxlfl.exec:\llrxlfl.exe111⤵PID:2580
-
\??\c:\xflrxff.exec:\xflrxff.exe112⤵PID:2540
-
\??\c:\9tthtb.exec:\9tthtb.exe113⤵PID:2336
-
\??\c:\9nhbbb.exec:\9nhbbb.exe114⤵PID:2696
-
\??\c:\ddjdd.exec:\ddjdd.exe115⤵PID:1600
-
\??\c:\1djjp.exec:\1djjp.exe116⤵PID:2808
-
\??\c:\xxfrffx.exec:\xxfrffx.exe117⤵PID:2728
-
\??\c:\nnttbh.exec:\nnttbh.exe118⤵PID:2444
-
\??\c:\nntttb.exec:\nntttb.exe119⤵PID:2196
-
\??\c:\9dvdj.exec:\9dvdj.exe120⤵PID:2800
-
\??\c:\9vvvv.exec:\9vvvv.exe121⤵PID:2616
-
\??\c:\lrfxflr.exec:\lrfxflr.exe122⤵PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-