Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe
-
Size
53KB
-
MD5
f3622e4e42e6f564563caac3d1962a6f
-
SHA1
adc685342fc780f8a57438415418df24368d7112
-
SHA256
eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f
-
SHA512
77733aa15f07624fd471ce384486947e2a219cf80dec9a3ef5ff19fce0f5ee7c014b542d1f13185ea79b711f37c08579ac7d7befd3b8114e96a64d80cecfbed4
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlW:0cdpeeBSHHMHLf9RyIT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2012-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-71-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2648-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1192-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-324-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-351-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-371-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-378-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-434-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1388-454-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1388-453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-547-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-650-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2616-657-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/636-694-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-707-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2820-714-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1416-756-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2216-830-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/1596-855-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2716-870-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-903-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2928-916-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2636-929-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2636-948-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2080-1126-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2444-1145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-1376-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1736 tthtnt.exe 1980 3vvvj.exe 2436 jpjdp.exe 1984 jvjdp.exe 2860 1lfxlxl.exe 2756 nthtnt.exe 2928 pvppd.exe 2968 1pppp.exe 2908 9lfrxll.exe 2648 fllfxlf.exe 2656 thnhhb.exe 572 djjjv.exe 2672 pvjvp.exe 348 1bhtbn.exe 1476 tbtntt.exe 1192 1ddpp.exe 2128 xlxxflf.exe 628 hhbnbh.exe 2132 9tthnb.exe 2084 pvjpj.exe 2544 vppjd.exe 1524 llllxrr.exe 2792 nbntnt.exe 1076 vvvdp.exe 1572 vvpvp.exe 1652 rxlffrf.exe 2812 9nhtht.exe 3052 ppdvj.exe 3036 djdvd.exe 1912 xxrxlrf.exe 1676 7xflrrf.exe 1732 ntnnbn.exe 2556 vjjjd.exe 1924 dpjjv.exe 2300 lllxrxr.exe 2932 thnnht.exe 380 hnnthn.exe 2852 vvvdj.exe 2912 5xlxrrx.exe 2896 xfxrlxl.exe 2920 9httbb.exe 2632 hbnntt.exe 2776 ddpjj.exe 2648 vddpd.exe 2604 frxllff.exe 2140 7bhntb.exe 828 nntntn.exe 1252 djdjp.exe 1664 dvdpd.exe 2884 lfllrrx.exe 1624 fxlrrrx.exe 1800 tbbnth.exe 2820 7hbhhn.exe 1448 pvvvj.exe 1900 djvdj.exe 1388 lrlrfrf.exe 2948 rrlfrrx.exe 2940 bbbhnn.exe 2084 ttbtbt.exe 2108 3djjj.exe 2496 djdjp.exe 584 xfxfllx.exe 376 xrxrrrx.exe 356 hnnbtb.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1736 2012 eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe 30 PID 2012 wrote to memory of 1736 2012 eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe 30 PID 2012 wrote to memory of 1736 2012 eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe 30 PID 2012 wrote to memory of 1736 2012 eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe 30 PID 1736 wrote to memory of 1980 1736 tthtnt.exe 31 PID 1736 wrote to memory of 1980 1736 tthtnt.exe 31 PID 1736 wrote to memory of 1980 1736 tthtnt.exe 31 PID 1736 wrote to memory of 1980 1736 tthtnt.exe 31 PID 1980 wrote to memory of 2436 1980 3vvvj.exe 32 PID 1980 wrote to memory of 2436 1980 3vvvj.exe 32 PID 1980 wrote to memory of 2436 1980 3vvvj.exe 32 PID 1980 wrote to memory of 2436 1980 3vvvj.exe 32 PID 2436 wrote to memory of 1984 2436 jpjdp.exe 33 PID 2436 wrote to memory of 1984 2436 jpjdp.exe 33 PID 2436 wrote to memory of 1984 2436 jpjdp.exe 33 PID 2436 wrote to memory of 1984 2436 jpjdp.exe 33 PID 1984 wrote to memory of 2860 1984 jvjdp.exe 34 PID 1984 wrote to memory of 2860 1984 jvjdp.exe 34 PID 1984 wrote to memory of 2860 1984 jvjdp.exe 34 PID 1984 wrote to memory of 2860 1984 jvjdp.exe 34 PID 2860 wrote to memory of 2756 2860 1lfxlxl.exe 35 PID 2860 wrote to memory of 2756 2860 1lfxlxl.exe 35 PID 2860 wrote to memory of 2756 2860 1lfxlxl.exe 35 PID 2860 wrote to memory of 2756 2860 1lfxlxl.exe 35 PID 2756 wrote to memory of 2928 2756 nthtnt.exe 36 PID 2756 wrote to memory of 2928 2756 nthtnt.exe 36 PID 2756 wrote to memory of 2928 2756 nthtnt.exe 36 PID 2756 wrote to memory of 2928 2756 nthtnt.exe 36 PID 2928 wrote to memory of 2968 2928 pvppd.exe 37 PID 2928 wrote to memory of 2968 2928 pvppd.exe 37 PID 2928 wrote to memory of 2968 2928 pvppd.exe 37 PID 2928 wrote to memory of 2968 2928 pvppd.exe 37 PID 2968 wrote to memory of 2908 2968 1pppp.exe 38 PID 2968 wrote to memory of 2908 2968 1pppp.exe 38 PID 2968 wrote to memory of 2908 2968 1pppp.exe 38 PID 2968 wrote to memory of 2908 2968 1pppp.exe 38 PID 2908 wrote to memory of 2648 2908 9lfrxll.exe 39 PID 2908 wrote to memory of 2648 2908 9lfrxll.exe 39 PID 2908 wrote to memory of 2648 2908 9lfrxll.exe 39 PID 2908 wrote to memory of 2648 2908 9lfrxll.exe 39 PID 2648 wrote to memory of 2656 2648 fllfxlf.exe 40 PID 2648 wrote to memory of 2656 2648 fllfxlf.exe 40 PID 2648 wrote to memory of 2656 2648 fllfxlf.exe 40 PID 2648 wrote to memory of 2656 2648 fllfxlf.exe 40 PID 2656 wrote to memory of 572 2656 thnhhb.exe 41 PID 2656 wrote to memory of 572 2656 thnhhb.exe 41 PID 2656 wrote to memory of 572 2656 thnhhb.exe 41 PID 2656 wrote to memory of 572 2656 thnhhb.exe 41 PID 572 wrote to memory of 2672 572 djjjv.exe 42 PID 572 wrote to memory of 2672 572 djjjv.exe 42 PID 572 wrote to memory of 2672 572 djjjv.exe 42 PID 572 wrote to memory of 2672 572 djjjv.exe 42 PID 2672 wrote to memory of 348 2672 pvjvp.exe 43 PID 2672 wrote to memory of 348 2672 pvjvp.exe 43 PID 2672 wrote to memory of 348 2672 pvjvp.exe 43 PID 2672 wrote to memory of 348 2672 pvjvp.exe 43 PID 348 wrote to memory of 1476 348 1bhtbn.exe 44 PID 348 wrote to memory of 1476 348 1bhtbn.exe 44 PID 348 wrote to memory of 1476 348 1bhtbn.exe 44 PID 348 wrote to memory of 1476 348 1bhtbn.exe 44 PID 1476 wrote to memory of 1192 1476 tbtntt.exe 45 PID 1476 wrote to memory of 1192 1476 tbtntt.exe 45 PID 1476 wrote to memory of 1192 1476 tbtntt.exe 45 PID 1476 wrote to memory of 1192 1476 tbtntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe"C:\Users\Admin\AppData\Local\Temp\eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\tthtnt.exec:\tthtnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\3vvvj.exec:\3vvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\jpjdp.exec:\jpjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jvjdp.exec:\jvjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\1lfxlxl.exec:\1lfxlxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\nthtnt.exec:\nthtnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\pvppd.exec:\pvppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\1pppp.exec:\1pppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\9lfrxll.exec:\9lfrxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\fllfxlf.exec:\fllfxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\thnhhb.exec:\thnhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\djjjv.exec:\djjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\pvjvp.exec:\pvjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\1bhtbn.exec:\1bhtbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\tbtntt.exec:\tbtntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\1ddpp.exec:\1ddpp.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1192 -
\??\c:\xlxxflf.exec:\xlxxflf.exe18⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hhbnbh.exec:\hhbnbh.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:628 -
\??\c:\9tthnb.exec:\9tthnb.exe20⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pvjpj.exec:\pvjpj.exe21⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vppjd.exec:\vppjd.exe22⤵
- Executes dropped EXE
PID:2544 -
\??\c:\llllxrr.exec:\llllxrr.exe23⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nbntnt.exec:\nbntnt.exe24⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vvvdp.exec:\vvvdp.exe25⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vvpvp.exec:\vvpvp.exe26⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rxlffrf.exec:\rxlffrf.exe27⤵
- Executes dropped EXE
PID:1652 -
\??\c:\9nhtht.exec:\9nhtht.exe28⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ppdvj.exec:\ppdvj.exe29⤵
- Executes dropped EXE
PID:3052 -
\??\c:\djdvd.exec:\djdvd.exe30⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe31⤵
- Executes dropped EXE
PID:1912 -
\??\c:\7xflrrf.exec:\7xflrrf.exe32⤵
- Executes dropped EXE
PID:1676 -
\??\c:\ntnnbn.exec:\ntnnbn.exe33⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vjjjd.exec:\vjjjd.exe34⤵
- Executes dropped EXE
PID:2556 -
\??\c:\dpjjv.exec:\dpjjv.exe35⤵
- Executes dropped EXE
PID:1924 -
\??\c:\lllxrxr.exec:\lllxrxr.exe36⤵
- Executes dropped EXE
PID:2300 -
\??\c:\thnnht.exec:\thnnht.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hnnthn.exec:\hnnthn.exe38⤵
- Executes dropped EXE
PID:380 -
\??\c:\vvvdj.exec:\vvvdj.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\5xlxrrx.exec:\5xlxrrx.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xfxrlxl.exec:\xfxrlxl.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9httbb.exec:\9httbb.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hbnntt.exec:\hbnntt.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ddpjj.exec:\ddpjj.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vddpd.exec:\vddpd.exe45⤵
- Executes dropped EXE
PID:2648 -
\??\c:\frxllff.exec:\frxllff.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7bhntb.exec:\7bhntb.exe47⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nntntn.exec:\nntntn.exe48⤵
- Executes dropped EXE
PID:828 -
\??\c:\djdjp.exec:\djdjp.exe49⤵
- Executes dropped EXE
PID:1252 -
\??\c:\dvdpd.exec:\dvdpd.exe50⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lfllrrx.exec:\lfllrrx.exe51⤵
- Executes dropped EXE
PID:2884 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe52⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tbbnth.exec:\tbbnth.exe53⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7hbhhn.exec:\7hbhhn.exe54⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pvvvj.exec:\pvvvj.exe55⤵
- Executes dropped EXE
PID:1448 -
\??\c:\djvdj.exec:\djvdj.exe56⤵
- Executes dropped EXE
PID:1900 -
\??\c:\lrlrfrf.exec:\lrlrfrf.exe57⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rrlfrrx.exec:\rrlfrrx.exe58⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bbbhnn.exec:\bbbhnn.exe59⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ttbtbt.exec:\ttbtbt.exe60⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3djjj.exec:\3djjj.exe61⤵
- Executes dropped EXE
PID:2108 -
\??\c:\djdjp.exec:\djdjp.exe62⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xfxfllx.exec:\xfxfllx.exe63⤵
- Executes dropped EXE
PID:584 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe64⤵
- Executes dropped EXE
PID:376 -
\??\c:\hnnbtb.exec:\hnnbtb.exe65⤵
- Executes dropped EXE
PID:356 -
\??\c:\bbbhnn.exec:\bbbhnn.exe66⤵PID:1764
-
\??\c:\ddpvd.exec:\ddpvd.exe67⤵PID:1492
-
\??\c:\pvdjv.exec:\pvdjv.exe68⤵PID:560
-
\??\c:\fllxrxl.exec:\fllxrxl.exe69⤵PID:2240
-
\??\c:\lrflxfr.exec:\lrflxfr.exe70⤵PID:2168
-
\??\c:\1htbnt.exec:\1htbnt.exe71⤵PID:3052
-
\??\c:\5bnbhh.exec:\5bnbhh.exe72⤵PID:2488
-
\??\c:\jppjp.exec:\jppjp.exe73⤵PID:2292
-
\??\c:\9ddvd.exec:\9ddvd.exe74⤵PID:2528
-
\??\c:\xxfrxxr.exec:\xxfrxxr.exe75⤵PID:2012
-
\??\c:\rrrrxxx.exec:\rrrrxxx.exe76⤵PID:2392
-
\??\c:\bhbthh.exec:\bhbthh.exe77⤵PID:1596
-
\??\c:\hnbbtn.exec:\hnbbtn.exe78⤵PID:1852
-
\??\c:\7dpvv.exec:\7dpvv.exe79⤵PID:2332
-
\??\c:\vdjjd.exec:\vdjjd.exe80⤵PID:2300
-
\??\c:\xflxrxl.exec:\xflxrxl.exe81⤵PID:2736
-
\??\c:\3xfllxx.exec:\3xfllxx.exe82⤵PID:1584
-
\??\c:\hbhbhh.exec:\hbhbhh.exe83⤵PID:2852
-
\??\c:\9hhhnn.exec:\9hhhnn.exe84⤵PID:2740
-
\??\c:\pvppd.exec:\pvppd.exe85⤵PID:2900
-
\??\c:\vpjpd.exec:\vpjpd.exe86⤵PID:2892
-
\??\c:\lrrflrx.exec:\lrrflrx.exe87⤵PID:2928
-
\??\c:\fxlrlxf.exec:\fxlrlxf.exe88⤵PID:2968
-
\??\c:\hhhntb.exec:\hhhntb.exe89⤵PID:2680
-
\??\c:\7thnnn.exec:\7thnnn.exe90⤵PID:2616
-
\??\c:\pvvvd.exec:\pvvvd.exe91⤵PID:2624
-
\??\c:\ddjjj.exec:\ddjjj.exe92⤵PID:2656
-
\??\c:\5fxlrfr.exec:\5fxlrfr.exe93⤵PID:2840
-
\??\c:\3frfrfl.exec:\3frfrfl.exe94⤵PID:1108
-
\??\c:\9hbnth.exec:\9hbnth.exe95⤵PID:1932
-
\??\c:\bbtbnb.exec:\bbtbnb.exe96⤵PID:636
-
\??\c:\jpjjv.exec:\jpjjv.exe97⤵PID:1636
-
\??\c:\pdpvj.exec:\pdpvj.exe98⤵PID:1812
-
\??\c:\xxxlxfl.exec:\xxxlxfl.exe99⤵PID:2820
-
\??\c:\7xxfxfx.exec:\7xxfxfx.exe100⤵PID:2128
-
\??\c:\1nttbh.exec:\1nttbh.exe101⤵PID:2644
-
\??\c:\vvjjv.exec:\vvjjv.exe102⤵PID:3048
-
\??\c:\djdjj.exec:\djdjj.exe103⤵PID:2948
-
\??\c:\rrxxxfr.exec:\rrxxxfr.exe104⤵PID:1960
-
\??\c:\llfllxr.exec:\llfllxr.exe105⤵PID:1844
-
\??\c:\xrrllrf.exec:\xrrllrf.exe106⤵PID:1416
-
\??\c:\thhnbn.exec:\thhnbn.exe107⤵PID:3008
-
\??\c:\ntthbt.exec:\ntthbt.exe108⤵PID:1152
-
\??\c:\vvvdj.exec:\vvvdj.exe109⤵PID:1996
-
\??\c:\9lxxflf.exec:\9lxxflf.exe110⤵PID:1080
-
\??\c:\flflrxl.exec:\flflrxl.exe111⤵PID:1536
-
\??\c:\bbtbhh.exec:\bbtbhh.exe112⤵PID:2232
-
\??\c:\thhntb.exec:\thhntb.exe113⤵PID:1364
-
\??\c:\pjvdv.exec:\pjvdv.exe114⤵PID:2216
-
\??\c:\ddppp.exec:\ddppp.exe115⤵PID:1964
-
\??\c:\flxfrrl.exec:\flxfrrl.exe116⤵PID:2340
-
\??\c:\7lflfrx.exec:\7lflfrx.exe117⤵PID:2488
-
\??\c:\tbttbn.exec:\tbttbn.exe118⤵PID:2292
-
\??\c:\hnnhbn.exec:\hnnhbn.exe119⤵PID:872
-
\??\c:\jjvjj.exec:\jjvjj.exe120⤵PID:1496
-
\??\c:\jpdjj.exec:\jpdjj.exe121⤵PID:2392
-
\??\c:\9fflrxx.exec:\9fflrxx.exe122⤵PID:1596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-