Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 05:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3e3e6b35a4eb905e321ea2e9f4f30d7c01299e40f6eb8acad4bda82346b164c1N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
3e3e6b35a4eb905e321ea2e9f4f30d7c01299e40f6eb8acad4bda82346b164c1N.exe
-
Size
72KB
-
MD5
09ad6d8df6ddf0d66318b3adb8ac6570
-
SHA1
4c0c7a35eea9cdc41875af4dd22ec42e71609ec8
-
SHA256
3e3e6b35a4eb905e321ea2e9f4f30d7c01299e40f6eb8acad4bda82346b164c1
-
SHA512
318f5da0b5d41d9ef944acd690fae60e1304aeb61f81800adfbee67c246df49ec9f6e503eaeb1e43afe7347d76d4b90301c1bcd14dfdb3c9cf5451eb70996337
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj9:ymb3NkkiQ3mdBjFI4VN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2556-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-53-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-76-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/828-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2360 dddpd.exe 792 ddvjv.exe 2944 rlffrrf.exe 2724 vdjdp.exe 2896 xfxflrx.exe 2316 ttnhtn.exe 2464 nhtbhn.exe 2620 1lxfrlf.exe 2020 9frfffl.exe 2632 3bhnbn.exe 2708 ppjpd.exe 1960 ppvpd.exe 1400 rlrxxfr.exe 844 nnnbtn.exe 1988 bhnbbn.exe 2844 pvpvv.exe 1620 rffxxrx.exe 2440 xxllxlr.exe 2716 9bnbbn.exe 840 vpjvv.exe 304 1rllxxl.exe 828 llffffx.exe 1864 1tbthn.exe 1952 hhbthn.exe 908 djvdv.exe 1828 lllxxfr.exe 2248 lfrxlfx.exe 2572 nhtbhn.exe 1248 dddpp.exe 2552 pjddp.exe 2592 7llxflx.exe 2380 hnnhtt.exe 1580 bnhhht.exe 604 vvvjv.exe 2124 llxfrfx.exe 3020 lllxrrr.exe 2800 tnhbnb.exe 2736 7hnthb.exe 2860 jdvpd.exe 2788 dvpvj.exe 2636 frlxfrx.exe 2696 nnhtbn.exe 2168 hbtbbt.exe 1856 dvdjp.exe 2840 5vpvj.exe 1976 rlxlxfr.exe 1656 fllxxlx.exe 2032 nhbntb.exe 1284 bbbhbh.exe 1192 jvdvd.exe 376 dvjvd.exe 2952 ffrxrff.exe 2228 ffffrrx.exe 2076 nntnbt.exe 2336 rrflxxl.exe 1084 lffrfrx.exe 1324 btbbhb.exe 304 hhbnnb.exe 1996 vvdpv.exe 572 pppvd.exe 2216 pvpdd.exe 628 ffrxlxr.exe 740 xrfrxfl.exe 2304 1nhnbn.exe -
resource yara_rule behavioral1/memory/2556-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-267-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2360 2556 3e3e6b35a4eb905e321ea2e9f4f30d7c01299e40f6eb8acad4bda82346b164c1N.exe 31 PID 2556 wrote to memory of 2360 2556 3e3e6b35a4eb905e321ea2e9f4f30d7c01299e40f6eb8acad4bda82346b164c1N.exe 31 PID 2556 wrote to memory of 2360 2556 3e3e6b35a4eb905e321ea2e9f4f30d7c01299e40f6eb8acad4bda82346b164c1N.exe 31 PID 2556 wrote to memory of 2360 2556 3e3e6b35a4eb905e321ea2e9f4f30d7c01299e40f6eb8acad4bda82346b164c1N.exe 31 PID 2360 wrote to memory of 792 2360 dddpd.exe 32 PID 2360 wrote to memory of 792 2360 dddpd.exe 32 PID 2360 wrote to memory of 792 2360 dddpd.exe 32 PID 2360 wrote to memory of 792 2360 dddpd.exe 32 PID 792 wrote to memory of 2944 792 ddvjv.exe 33 PID 792 wrote to memory of 2944 792 ddvjv.exe 33 PID 792 wrote to memory of 2944 792 ddvjv.exe 33 PID 792 wrote to memory of 2944 792 ddvjv.exe 33 PID 2944 wrote to memory of 2724 2944 rlffrrf.exe 34 PID 2944 wrote to memory of 2724 2944 rlffrrf.exe 34 PID 2944 wrote to memory of 2724 2944 rlffrrf.exe 34 PID 2944 wrote to memory of 2724 2944 rlffrrf.exe 34 PID 2724 wrote to memory of 2896 2724 vdjdp.exe 35 PID 2724 wrote to memory of 2896 2724 vdjdp.exe 35 PID 2724 wrote to memory of 2896 2724 vdjdp.exe 35 PID 2724 wrote to memory of 2896 2724 vdjdp.exe 35 PID 2896 wrote to memory of 2316 2896 xfxflrx.exe 36 PID 2896 wrote to memory of 2316 2896 xfxflrx.exe 36 PID 2896 wrote to memory of 2316 2896 xfxflrx.exe 36 PID 2896 wrote to memory of 2316 2896 xfxflrx.exe 36 PID 2316 wrote to memory of 2464 2316 ttnhtn.exe 37 PID 2316 wrote to memory of 2464 2316 ttnhtn.exe 37 PID 2316 wrote to memory of 2464 2316 ttnhtn.exe 37 PID 2316 wrote to memory of 2464 2316 ttnhtn.exe 37 PID 2464 wrote to memory of 2620 2464 nhtbhn.exe 38 PID 2464 wrote to memory of 2620 2464 nhtbhn.exe 38 PID 2464 wrote to memory of 2620 2464 nhtbhn.exe 38 PID 2464 wrote to memory of 2620 2464 nhtbhn.exe 38 PID 2620 wrote to memory of 2020 2620 1lxfrlf.exe 39 PID 2620 wrote to memory of 2020 2620 1lxfrlf.exe 39 PID 2620 wrote to memory of 2020 2620 1lxfrlf.exe 39 PID 2620 wrote to memory of 2020 2620 1lxfrlf.exe 39 PID 2020 wrote to memory of 2632 2020 9frfffl.exe 40 PID 2020 wrote to memory of 2632 2020 9frfffl.exe 40 PID 2020 wrote to memory of 2632 2020 9frfffl.exe 40 PID 2020 wrote to memory of 2632 2020 9frfffl.exe 40 PID 2632 wrote to memory of 2708 2632 3bhnbn.exe 41 PID 2632 wrote to memory of 2708 2632 3bhnbn.exe 41 PID 2632 wrote to memory of 2708 2632 3bhnbn.exe 41 PID 2632 wrote to memory of 2708 2632 3bhnbn.exe 41 PID 2708 wrote to memory of 1960 2708 ppjpd.exe 42 PID 2708 wrote to memory of 1960 2708 ppjpd.exe 42 PID 2708 wrote to memory of 1960 2708 ppjpd.exe 42 PID 2708 wrote to memory of 1960 2708 ppjpd.exe 42 PID 1960 wrote to memory of 1400 1960 ppvpd.exe 43 PID 1960 wrote to memory of 1400 1960 ppvpd.exe 43 PID 1960 wrote to memory of 1400 1960 ppvpd.exe 43 PID 1960 wrote to memory of 1400 1960 ppvpd.exe 43 PID 1400 wrote to memory of 844 1400 rlrxxfr.exe 44 PID 1400 wrote to memory of 844 1400 rlrxxfr.exe 44 PID 1400 wrote to memory of 844 1400 rlrxxfr.exe 44 PID 1400 wrote to memory of 844 1400 rlrxxfr.exe 44 PID 844 wrote to memory of 1988 844 nnnbtn.exe 45 PID 844 wrote to memory of 1988 844 nnnbtn.exe 45 PID 844 wrote to memory of 1988 844 nnnbtn.exe 45 PID 844 wrote to memory of 1988 844 nnnbtn.exe 45 PID 1988 wrote to memory of 2844 1988 bhnbbn.exe 46 PID 1988 wrote to memory of 2844 1988 bhnbbn.exe 46 PID 1988 wrote to memory of 2844 1988 bhnbbn.exe 46 PID 1988 wrote to memory of 2844 1988 bhnbbn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e3e6b35a4eb905e321ea2e9f4f30d7c01299e40f6eb8acad4bda82346b164c1N.exe"C:\Users\Admin\AppData\Local\Temp\3e3e6b35a4eb905e321ea2e9f4f30d7c01299e40f6eb8acad4bda82346b164c1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\dddpd.exec:\dddpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\ddvjv.exec:\ddvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\rlffrrf.exec:\rlffrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\vdjdp.exec:\vdjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xfxflrx.exec:\xfxflrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\ttnhtn.exec:\ttnhtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\nhtbhn.exec:\nhtbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\1lxfrlf.exec:\1lxfrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\9frfffl.exec:\9frfffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\3bhnbn.exec:\3bhnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ppjpd.exec:\ppjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ppvpd.exec:\ppvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\rlrxxfr.exec:\rlrxxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\nnnbtn.exec:\nnnbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\bhnbbn.exec:\bhnbbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\pvpvv.exec:\pvpvv.exe17⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rffxxrx.exec:\rffxxrx.exe18⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xxllxlr.exec:\xxllxlr.exe19⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9bnbbn.exec:\9bnbbn.exe20⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vpjvv.exec:\vpjvv.exe21⤵
- Executes dropped EXE
PID:840 -
\??\c:\1rllxxl.exec:\1rllxxl.exe22⤵
- Executes dropped EXE
PID:304 -
\??\c:\llffffx.exec:\llffffx.exe23⤵
- Executes dropped EXE
PID:828 -
\??\c:\1tbthn.exec:\1tbthn.exe24⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hhbthn.exec:\hhbthn.exe25⤵
- Executes dropped EXE
PID:1952 -
\??\c:\djvdv.exec:\djvdv.exe26⤵
- Executes dropped EXE
PID:908 -
\??\c:\lllxxfr.exec:\lllxxfr.exe27⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lfrxlfx.exec:\lfrxlfx.exe28⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nhtbhn.exec:\nhtbhn.exe29⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dddpp.exec:\dddpp.exe30⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pjddp.exec:\pjddp.exe31⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7llxflx.exec:\7llxflx.exe32⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hnnhtt.exec:\hnnhtt.exe33⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bnhhht.exec:\bnhhht.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vvvjv.exec:\vvvjv.exe35⤵
- Executes dropped EXE
PID:604 -
\??\c:\llxfrfx.exec:\llxfrfx.exe36⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lllxrrr.exec:\lllxrrr.exe37⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tnhbnb.exec:\tnhbnb.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7hnthb.exec:\7hnthb.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jdvpd.exec:\jdvpd.exe40⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dvpvj.exec:\dvpvj.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\frlxfrx.exec:\frlxfrx.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nnhtbn.exec:\nnhtbn.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hbtbbt.exec:\hbtbbt.exe44⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dvdjp.exec:\dvdjp.exe45⤵
- Executes dropped EXE
PID:1856 -
\??\c:\5vpvj.exec:\5vpvj.exe46⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rlxlxfr.exec:\rlxlxfr.exe47⤵
- Executes dropped EXE
PID:1976 -
\??\c:\fllxxlx.exec:\fllxxlx.exe48⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nhbntb.exec:\nhbntb.exe49⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bbbhbh.exec:\bbbhbh.exe50⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jvdvd.exec:\jvdvd.exe51⤵
- Executes dropped EXE
PID:1192 -
\??\c:\dvjvd.exec:\dvjvd.exe52⤵
- Executes dropped EXE
PID:376 -
\??\c:\ffrxrff.exec:\ffrxrff.exe53⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ffffrrx.exec:\ffffrrx.exe54⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nntnbt.exec:\nntnbt.exe55⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rrflxxl.exec:\rrflxxl.exe56⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lffrfrx.exec:\lffrfrx.exe57⤵
- Executes dropped EXE
PID:1084 -
\??\c:\btbbhb.exec:\btbbhb.exe58⤵
- Executes dropped EXE
PID:1324 -
\??\c:\hhbnnb.exec:\hhbnnb.exe59⤵
- Executes dropped EXE
PID:304 -
\??\c:\vvdpv.exec:\vvdpv.exe60⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pppvd.exec:\pppvd.exe61⤵
- Executes dropped EXE
PID:572 -
\??\c:\pvpdd.exec:\pvpdd.exe62⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ffrxlxr.exec:\ffrxlxr.exe63⤵
- Executes dropped EXE
PID:628 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe64⤵
- Executes dropped EXE
PID:740 -
\??\c:\1nhnbn.exec:\1nhnbn.exe65⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hhnthb.exec:\hhnthb.exe66⤵PID:1536
-
\??\c:\pjddv.exec:\pjddv.exe67⤵PID:1784
-
\??\c:\jjvdp.exec:\jjvdp.exe68⤵PID:1436
-
\??\c:\ffllxlf.exec:\ffllxlf.exe69⤵PID:1248
-
\??\c:\1xxlxxl.exec:\1xxlxxl.exe70⤵PID:1628
-
\??\c:\hhnnhb.exec:\hhnnhb.exe71⤵PID:2060
-
\??\c:\nhhtht.exec:\nhhtht.exe72⤵PID:2016
-
\??\c:\1ddpj.exec:\1ddpj.exe73⤵PID:1688
-
\??\c:\1xrxflr.exec:\1xrxflr.exe74⤵PID:2728
-
\??\c:\ffrlrfr.exec:\ffrlrfr.exe75⤵PID:2908
-
\??\c:\bbtnhn.exec:\bbtnhn.exe76⤵PID:2932
-
\??\c:\bbbtbt.exec:\bbbtbt.exe77⤵PID:2752
-
\??\c:\pvpjj.exec:\pvpjj.exe78⤵PID:2472
-
\??\c:\vpppd.exec:\vpppd.exe79⤵PID:2652
-
\??\c:\9lxflrr.exec:\9lxflrr.exe80⤵PID:2860
-
\??\c:\fllflrf.exec:\fllflrf.exe81⤵PID:2612
-
\??\c:\1bbhtt.exec:\1bbhtt.exe82⤵PID:2456
-
\??\c:\pjvdd.exec:\pjvdd.exe83⤵PID:756
-
\??\c:\1vddd.exec:\1vddd.exe84⤵PID:2688
-
\??\c:\rxxfffr.exec:\rxxfffr.exe85⤵PID:2836
-
\??\c:\fxlrfxl.exec:\fxlrfxl.exe86⤵PID:2432
-
\??\c:\hhhtbh.exec:\hhhtbh.exe87⤵PID:1720
-
\??\c:\vvjvd.exec:\vvjvd.exe88⤵PID:1064
-
\??\c:\dvddd.exec:\dvddd.exe89⤵PID:2008
-
\??\c:\1xlfflx.exec:\1xlfflx.exe90⤵PID:1272
-
\??\c:\rrxffrl.exec:\rrxffrl.exe91⤵PID:2972
-
\??\c:\btnnbh.exec:\btnnbh.exe92⤵PID:1588
-
\??\c:\hbtbnb.exec:\hbtbnb.exe93⤵PID:2984
-
\??\c:\dvvdj.exec:\dvvdj.exe94⤵PID:2284
-
\??\c:\ddjpd.exec:\ddjpd.exe95⤵PID:2444
-
\??\c:\lllxfrf.exec:\lllxfrf.exe96⤵PID:1556
-
\??\c:\lxlrxrx.exec:\lxlrxrx.exe97⤵PID:688
-
\??\c:\tttnnb.exec:\tttnnb.exe98⤵PID:960
-
\??\c:\hhbnbh.exec:\hhbnbh.exe99⤵PID:568
-
\??\c:\jjjvd.exec:\jjjvd.exe100⤵PID:1528
-
\??\c:\dpjpd.exec:\dpjpd.exe101⤵PID:1952
-
\??\c:\lrfrlrf.exec:\lrfrlrf.exe102⤵PID:1924
-
\??\c:\fffrxlx.exec:\fffrxlx.exe103⤵PID:1828
-
\??\c:\5bthnt.exec:\5bthnt.exe104⤵PID:1052
-
\??\c:\3bnntt.exec:\3bnntt.exe105⤵PID:2248
-
\??\c:\vvjvp.exec:\vvjvp.exe106⤵PID:1344
-
\??\c:\dvjpv.exec:\dvjpv.exe107⤵PID:2096
-
\??\c:\fxrffxl.exec:\fxrffxl.exe108⤵PID:332
-
\??\c:\llfrxlr.exec:\llfrxlr.exe109⤵PID:2148
-
\??\c:\btnthh.exec:\btnthh.exe110⤵PID:2592
-
\??\c:\nnhttb.exec:\nnhttb.exe111⤵PID:2948
-
\??\c:\ddvdj.exec:\ddvdj.exe112⤵PID:1584
-
\??\c:\7ppvd.exec:\7ppvd.exe113⤵PID:604
-
\??\c:\rrfflrx.exec:\rrfflrx.exe114⤵PID:2124
-
\??\c:\9xfrxxx.exec:\9xfrxxx.exe115⤵PID:3020
-
\??\c:\ttnttt.exec:\ttnttt.exe116⤵PID:2896
-
\??\c:\9ntbbh.exec:\9ntbbh.exe117⤵PID:2736
-
\??\c:\7pvvj.exec:\7pvvj.exe118⤵PID:2664
-
\??\c:\dpjdd.exec:\dpjdd.exe119⤵PID:2788
-
\??\c:\fxlxrxr.exec:\fxlxrxr.exe120⤵PID:484
-
\??\c:\llfxlxr.exec:\llfxlxr.exe121⤵PID:2312
-
\??\c:\9tntht.exec:\9tntht.exe122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-