Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 05:08
Static task
static1
Behavioral task
behavioral1
Sample
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe
Resource
win7-20240903-en
General
-
Target
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe
-
Size
82KB
-
MD5
e3a9a82f7c138c77e2b1716a5a6164b3
-
SHA1
c78a2245fb1d97d0cbfd5fdd415fe467e623a900
-
SHA256
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb
-
SHA512
0456800a2a89493e2db62f3d3c6f1f2e13a00af64190f2d12cf17e6cad0d7ff9daf44a507e3aea221cef0dab6fbac6e9d6b70beba9ce8407e6fd1d7a830a6fae
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmB5Gt9:ymb3NkkiQ3mdBjFo73thgQ/wEkc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2332-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/784-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3028 jpjjd.exe 2196 xrfxfxr.exe 2400 bthntt.exe 784 jvjjd.exe 2968 3rfxfff.exe 2676 hbbntb.exe 2584 dvjpd.exe 2732 dvjpv.exe 2680 rllrlxl.exe 3068 9rxfrxx.exe 1948 hhtnnh.exe 2620 dvpvj.exe 1692 dvddd.exe 1328 5rlfxff.exe 1056 xlxfrlx.exe 884 9thnbh.exe 1628 7nbtbt.exe 2660 9vddd.exe 600 7pjvp.exe 3036 lfrrffx.exe 448 lfrrffr.exe 1592 thttbh.exe 1856 bthnbh.exe 1968 vpjpd.exe 1080 vpddp.exe 2312 xrlrrrr.exe 2092 btntbb.exe 1504 thttbb.exe 2352 1jpdp.exe 1596 lfxxffl.exe 2284 lxlllrr.exe 3012 htbbhh.exe 2844 hbntbb.exe 2132 vvvvp.exe 2764 1jvvv.exe 784 frxxxff.exe 2956 lxlfflx.exe 2824 9nbhhh.exe 2676 bbnhbh.exe 2408 hhhhhn.exe 2604 vpddj.exe 3064 jvvpp.exe 2088 1rflffl.exe 856 7frfflr.exe 808 7hthnn.exe 1316 tttnbt.exe 1800 7hbhhh.exe 1812 9djdd.exe 1752 pdjdd.exe 2792 3flrflr.exe 2008 btthnn.exe 1700 thnnbb.exe 2932 5pvdv.exe 2144 djpjj.exe 2804 lxlxrxl.exe 2316 tnbbhh.exe 2412 hhnnth.exe 1908 djvjd.exe 2040 pdppp.exe 1236 rfxfxfl.exe 2224 hbhbhh.exe 2356 nthhhn.exe 1696 dppjp.exe 2096 7jvdd.exe -
resource yara_rule behavioral1/memory/2332-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2332 wrote to memory of 3028 2332 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 31 PID 2332 wrote to memory of 3028 2332 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 31 PID 2332 wrote to memory of 3028 2332 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 31 PID 2332 wrote to memory of 3028 2332 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 31 PID 3028 wrote to memory of 2196 3028 jpjjd.exe 32 PID 3028 wrote to memory of 2196 3028 jpjjd.exe 32 PID 3028 wrote to memory of 2196 3028 jpjjd.exe 32 PID 3028 wrote to memory of 2196 3028 jpjjd.exe 32 PID 2196 wrote to memory of 2400 2196 xrfxfxr.exe 33 PID 2196 wrote to memory of 2400 2196 xrfxfxr.exe 33 PID 2196 wrote to memory of 2400 2196 xrfxfxr.exe 33 PID 2196 wrote to memory of 2400 2196 xrfxfxr.exe 33 PID 2400 wrote to memory of 784 2400 bthntt.exe 34 PID 2400 wrote to memory of 784 2400 bthntt.exe 34 PID 2400 wrote to memory of 784 2400 bthntt.exe 34 PID 2400 wrote to memory of 784 2400 bthntt.exe 34 PID 784 wrote to memory of 2968 784 jvjjd.exe 35 PID 784 wrote to memory of 2968 784 jvjjd.exe 35 PID 784 wrote to memory of 2968 784 jvjjd.exe 35 PID 784 wrote to memory of 2968 784 jvjjd.exe 35 PID 2968 wrote to memory of 2676 2968 3rfxfff.exe 36 PID 2968 wrote to memory of 2676 2968 3rfxfff.exe 36 PID 2968 wrote to memory of 2676 2968 3rfxfff.exe 36 PID 2968 wrote to memory of 2676 2968 3rfxfff.exe 36 PID 2676 wrote to memory of 2584 2676 hbbntb.exe 37 PID 2676 wrote to memory of 2584 2676 hbbntb.exe 37 PID 2676 wrote to memory of 2584 2676 hbbntb.exe 37 PID 2676 wrote to memory of 2584 2676 hbbntb.exe 37 PID 2584 wrote to memory of 2732 2584 dvjpd.exe 38 PID 2584 wrote to memory of 2732 2584 dvjpd.exe 38 PID 2584 wrote to memory of 2732 2584 dvjpd.exe 38 PID 2584 wrote to memory of 2732 2584 dvjpd.exe 38 PID 2732 wrote to memory of 2680 2732 dvjpv.exe 39 PID 2732 wrote to memory of 2680 2732 dvjpv.exe 39 PID 2732 wrote to memory of 2680 2732 dvjpv.exe 39 PID 2732 wrote to memory of 2680 2732 dvjpv.exe 39 PID 2680 wrote to memory of 3068 2680 rllrlxl.exe 40 PID 2680 wrote to memory of 3068 2680 rllrlxl.exe 40 PID 2680 wrote to memory of 3068 2680 rllrlxl.exe 40 PID 2680 wrote to memory of 3068 2680 rllrlxl.exe 40 PID 3068 wrote to memory of 1948 3068 9rxfrxx.exe 41 PID 3068 wrote to memory of 1948 3068 9rxfrxx.exe 41 PID 3068 wrote to memory of 1948 3068 9rxfrxx.exe 41 PID 3068 wrote to memory of 1948 3068 9rxfrxx.exe 41 PID 1948 wrote to memory of 2620 1948 hhtnnh.exe 42 PID 1948 wrote to memory of 2620 1948 hhtnnh.exe 42 PID 1948 wrote to memory of 2620 1948 hhtnnh.exe 42 PID 1948 wrote to memory of 2620 1948 hhtnnh.exe 42 PID 2620 wrote to memory of 1692 2620 dvpvj.exe 43 PID 2620 wrote to memory of 1692 2620 dvpvj.exe 43 PID 2620 wrote to memory of 1692 2620 dvpvj.exe 43 PID 2620 wrote to memory of 1692 2620 dvpvj.exe 43 PID 1692 wrote to memory of 1328 1692 dvddd.exe 44 PID 1692 wrote to memory of 1328 1692 dvddd.exe 44 PID 1692 wrote to memory of 1328 1692 dvddd.exe 44 PID 1692 wrote to memory of 1328 1692 dvddd.exe 44 PID 1328 wrote to memory of 1056 1328 5rlfxff.exe 45 PID 1328 wrote to memory of 1056 1328 5rlfxff.exe 45 PID 1328 wrote to memory of 1056 1328 5rlfxff.exe 45 PID 1328 wrote to memory of 1056 1328 5rlfxff.exe 45 PID 1056 wrote to memory of 884 1056 xlxfrlx.exe 46 PID 1056 wrote to memory of 884 1056 xlxfrlx.exe 46 PID 1056 wrote to memory of 884 1056 xlxfrlx.exe 46 PID 1056 wrote to memory of 884 1056 xlxfrlx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe"C:\Users\Admin\AppData\Local\Temp\e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\jpjjd.exec:\jpjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\xrfxfxr.exec:\xrfxfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\bthntt.exec:\bthntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jvjjd.exec:\jvjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\3rfxfff.exec:\3rfxfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\hbbntb.exec:\hbbntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\dvjpd.exec:\dvjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\dvjpv.exec:\dvjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\rllrlxl.exec:\rllrlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\9rxfrxx.exec:\9rxfrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\hhtnnh.exec:\hhtnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\dvpvj.exec:\dvpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\dvddd.exec:\dvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\5rlfxff.exec:\5rlfxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\xlxfrlx.exec:\xlxfrlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\9thnbh.exec:\9thnbh.exe17⤵
- Executes dropped EXE
PID:884 -
\??\c:\7nbtbt.exec:\7nbtbt.exe18⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9vddd.exec:\9vddd.exe19⤵
- Executes dropped EXE
PID:2660 -
\??\c:\7pjvp.exec:\7pjvp.exe20⤵
- Executes dropped EXE
PID:600 -
\??\c:\lfrrffx.exec:\lfrrffx.exe21⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lfrrffr.exec:\lfrrffr.exe22⤵
- Executes dropped EXE
PID:448 -
\??\c:\thttbh.exec:\thttbh.exe23⤵
- Executes dropped EXE
PID:1592 -
\??\c:\bthnbh.exec:\bthnbh.exe24⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vpjpd.exec:\vpjpd.exe25⤵
- Executes dropped EXE
PID:1968 -
\??\c:\vpddp.exec:\vpddp.exe26⤵
- Executes dropped EXE
PID:1080 -
\??\c:\xrlrrrr.exec:\xrlrrrr.exe27⤵
- Executes dropped EXE
PID:2312 -
\??\c:\btntbb.exec:\btntbb.exe28⤵
- Executes dropped EXE
PID:2092 -
\??\c:\thttbb.exec:\thttbb.exe29⤵
- Executes dropped EXE
PID:1504 -
\??\c:\1jpdp.exec:\1jpdp.exe30⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lfxxffl.exec:\lfxxffl.exe31⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lxlllrr.exec:\lxlllrr.exe32⤵
- Executes dropped EXE
PID:2284 -
\??\c:\htbbhh.exec:\htbbhh.exe33⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hbntbb.exec:\hbntbb.exe34⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vvvvp.exec:\vvvvp.exe35⤵
- Executes dropped EXE
PID:2132 -
\??\c:\1jvvv.exec:\1jvvv.exe36⤵
- Executes dropped EXE
PID:2764 -
\??\c:\frxxxff.exec:\frxxxff.exe37⤵
- Executes dropped EXE
PID:784 -
\??\c:\lxlfflx.exec:\lxlfflx.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\9nbhhh.exec:\9nbhhh.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bbnhbh.exec:\bbnhbh.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hhhhhn.exec:\hhhhhn.exe41⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vpddj.exec:\vpddj.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jvvpp.exec:\jvvpp.exe43⤵
- Executes dropped EXE
PID:3064 -
\??\c:\1rflffl.exec:\1rflffl.exe44⤵
- Executes dropped EXE
PID:2088 -
\??\c:\7frfflr.exec:\7frfflr.exe45⤵
- Executes dropped EXE
PID:856 -
\??\c:\7hthnn.exec:\7hthnn.exe46⤵
- Executes dropped EXE
PID:808 -
\??\c:\tttnbt.exec:\tttnbt.exe47⤵
- Executes dropped EXE
PID:1316 -
\??\c:\7hbhhh.exec:\7hbhhh.exe48⤵
- Executes dropped EXE
PID:1800 -
\??\c:\9djdd.exec:\9djdd.exe49⤵
- Executes dropped EXE
PID:1812 -
\??\c:\pdjdd.exec:\pdjdd.exe50⤵
- Executes dropped EXE
PID:1752 -
\??\c:\3flrflr.exec:\3flrflr.exe51⤵
- Executes dropped EXE
PID:2792 -
\??\c:\btthnn.exec:\btthnn.exe52⤵
- Executes dropped EXE
PID:2008 -
\??\c:\thnnbb.exec:\thnnbb.exe53⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5pvdv.exec:\5pvdv.exe54⤵
- Executes dropped EXE
PID:2932 -
\??\c:\djpjj.exec:\djpjj.exe55⤵
- Executes dropped EXE
PID:2144 -
\??\c:\lxlxrxl.exec:\lxlxrxl.exe56⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tnbbhh.exec:\tnbbhh.exe57⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hhnnth.exec:\hhnnth.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\djvjd.exec:\djvjd.exe59⤵
- Executes dropped EXE
PID:1908 -
\??\c:\pdppp.exec:\pdppp.exe60⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rfxfxfl.exec:\rfxfxfl.exe61⤵
- Executes dropped EXE
PID:1236 -
\??\c:\hbhbhh.exec:\hbhbhh.exe62⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nthhhn.exec:\nthhhn.exe63⤵
- Executes dropped EXE
PID:2356 -
\??\c:\dppjp.exec:\dppjp.exe64⤵
- Executes dropped EXE
PID:1696 -
\??\c:\7jvdd.exec:\7jvdd.exe65⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xlxxflr.exec:\xlxxflr.exe66⤵PID:2484
-
\??\c:\1frxflf.exec:\1frxflf.exe67⤵PID:2360
-
\??\c:\nbhhnn.exec:\nbhhnn.exe68⤵PID:2004
-
\??\c:\thttbh.exec:\thttbh.exe69⤵PID:3004
-
\??\c:\9pjpp.exec:\9pjpp.exe70⤵PID:1772
-
\??\c:\vjpjj.exec:\vjpjj.exe71⤵PID:1152
-
\??\c:\rflfxrx.exec:\rflfxrx.exe72⤵PID:1264
-
\??\c:\xrxxfff.exec:\xrxxfff.exe73⤵PID:2204
-
\??\c:\9nhhnn.exec:\9nhhnn.exe74⤵PID:2768
-
\??\c:\9vjdp.exec:\9vjdp.exe75⤵PID:860
-
\??\c:\7jpjp.exec:\7jpjp.exe76⤵PID:2756
-
\??\c:\vvdvv.exec:\vvdvv.exe77⤵PID:2772
-
\??\c:\3fllfxf.exec:\3fllfxf.exe78⤵PID:2432
-
\??\c:\rlfrrfr.exec:\rlfrrfr.exe79⤵PID:2848
-
\??\c:\3thnnb.exec:\3thnnb.exe80⤵PID:2676
-
\??\c:\bnnnhb.exec:\bnnnhb.exe81⤵PID:2732
-
\??\c:\vjvdd.exec:\vjvdd.exe82⤵PID:2592
-
\??\c:\pjjjj.exec:\pjjjj.exe83⤵PID:1992
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe84⤵PID:2448
-
\??\c:\ffxxxrl.exec:\ffxxxrl.exe85⤵PID:2736
-
\??\c:\htbhhn.exec:\htbhhn.exe86⤵PID:1912
-
\??\c:\7tntnn.exec:\7tntnn.exe87⤵PID:1316
-
\??\c:\pjvpv.exec:\pjvpv.exe88⤵PID:2800
-
\??\c:\vpdvv.exec:\vpdvv.exe89⤵PID:1976
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe90⤵PID:1056
-
\??\c:\lffxllr.exec:\lffxllr.exe91⤵PID:2924
-
\??\c:\bthbnn.exec:\bthbnn.exe92⤵PID:2900
-
\??\c:\tnbnnn.exec:\tnbnnn.exe93⤵PID:2228
-
\??\c:\jvdjj.exec:\jvdjj.exe94⤵PID:2112
-
\??\c:\ffxxffl.exec:\ffxxffl.exe95⤵PID:2440
-
\??\c:\lfflffl.exec:\lfflffl.exe96⤵PID:484
-
\??\c:\bttttb.exec:\bttttb.exe97⤵PID:552
-
\??\c:\bthtbh.exec:\bthtbh.exe98⤵PID:1940
-
\??\c:\pjjjv.exec:\pjjjv.exe99⤵PID:1852
-
\??\c:\dvpjp.exec:\dvpjp.exe100⤵PID:772
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe101⤵PID:2512
-
\??\c:\9fxflxl.exec:\9fxflxl.exe102⤵PID:1632
-
\??\c:\btthhn.exec:\btthhn.exe103⤵PID:2988
-
\??\c:\7ttbnh.exec:\7ttbnh.exe104⤵PID:332
-
\??\c:\ppdpd.exec:\ppdpd.exe105⤵PID:2028
-
\??\c:\djjjj.exec:\djjjj.exe106⤵PID:1504
-
\??\c:\5flllll.exec:\5flllll.exe107⤵PID:2352
-
\??\c:\httttn.exec:\httttn.exe108⤵PID:3028
-
\??\c:\btbhhh.exec:\btbhhh.exe109⤵PID:3008
-
\??\c:\jdpjp.exec:\jdpjp.exe110⤵PID:268
-
\??\c:\9dvdj.exec:\9dvdj.exe111⤵PID:3012
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe112⤵PID:2844
-
\??\c:\tnttbt.exec:\tnttbt.exe113⤵PID:1644
-
\??\c:\tthttt.exec:\tthttt.exe114⤵PID:2712
-
\??\c:\vjppv.exec:\vjppv.exe115⤵PID:2528
-
\??\c:\djpvp.exec:\djpvp.exe116⤵PID:2968
-
\??\c:\lxxrxfl.exec:\lxxrxfl.exe117⤵PID:2720
-
\??\c:\rllfxxf.exec:\rllfxxf.exe118⤵PID:2752
-
\??\c:\thbhhn.exec:\thbhhn.exe119⤵PID:2584
-
\??\c:\tnhnhh.exec:\tnhnhh.exe120⤵PID:3056
-
\??\c:\btttbh.exec:\btttbh.exe121⤵PID:2612
-
\??\c:\jppdv.exec:\jppdv.exe122⤵PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-