Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 01:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe
-
Size
53KB
-
MD5
cd9c76370ebe37b8d2d902152a1ec5a0
-
SHA1
c288247da3b94aec5ba18f96880d23bb1bab3c6f
-
SHA256
2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868
-
SHA512
10a3f131e93b15f2a3038b0027fed277ee196291a85027c48aa3c0a603beb3f19db68b78d2a5df3dcc1de509dc6fa5b4b48efcd04279e9844be3e2ea983755c1
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlS:0cdpeeBSHHMHLf9RyIb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1648-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-26-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2316-24-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2800-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-41-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1748-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-80-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2840-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/696-136-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/696-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/288-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-250-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2976-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-314-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2636-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-330-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2920-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-429-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-484-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-491-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1608-498-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-574-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-593-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-600-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-626-0x00000000003D0000-0x00000000003F9000-memory.dmp family_blackmoon behavioral1/memory/2420-640-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2828-671-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-678-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-712-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2376-747-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-772-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2944-1078-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2508-1093-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/672-1262-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2956-1309-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2224-1354-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2616 rxlxfll.exe 2316 1xlfllx.exe 3048 1bntbh.exe 2660 jdpdv.exe 2800 jjvvd.exe 3060 ffrrffr.exe 2840 rrfxffl.exe 1748 nttthh.exe 2552 hhnbbb.exe 2716 vdjpd.exe 888 vpvvj.exe 1752 rrfrrxr.exe 2776 xffxlfr.exe 696 bbtbnn.exe 2020 9pjjp.exe 1632 rrfllrf.exe 2864 hhttbb.exe 2416 ntnthh.exe 2348 vpvdj.exe 672 9fllxxf.exe 288 bbtbnt.exe 1640 nnbbnn.exe 1924 vvpvv.exe 1940 rlrrlrx.exe 1744 hhntbb.exe 2976 dvjdp.exe 2372 rrlxxrr.exe 1900 bthnbb.exe 2272 hhhnnt.exe 584 jjppv.exe 1984 5xflrrf.exe 2508 xflfrrx.exe 1588 hbhbbh.exe 1436 vvppj.exe 3044 ddjpv.exe 2636 fflrlfr.exe 2920 xxlrxxl.exe 2816 bbnbhn.exe 2568 pjppv.exe 2692 1vvvd.exe 2840 rlrxflx.exe 2644 9rxllll.exe 2696 nnnhnt.exe 2544 5thbbb.exe 2996 pjppv.exe 1840 vdpvj.exe 2844 xfrxfrf.exe 1812 rlxfrrf.exe 1248 hnbntt.exe 1508 nhbbnt.exe 1300 pvjjv.exe 1764 3pvvd.exe 1980 5xffxfx.exe 1404 bhtbhn.exe 2880 pjvdj.exe 2028 7rlxfxl.exe 2124 fxlxflx.exe 2104 bbnntb.exe 1788 tnhnbh.exe 1032 bbtbtt.exe 2248 pvddj.exe 1356 pvpvj.exe 1608 rrlrxlx.exe 316 rrflrrf.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rffxlx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1648 wrote to memory of 2616 1648 2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe 31 PID 1648 wrote to memory of 2616 1648 2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe 31 PID 1648 wrote to memory of 2616 1648 2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe 31 PID 1648 wrote to memory of 2616 1648 2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe 31 PID 2616 wrote to memory of 2316 2616 rxlxfll.exe 32 PID 2616 wrote to memory of 2316 2616 rxlxfll.exe 32 PID 2616 wrote to memory of 2316 2616 rxlxfll.exe 32 PID 2616 wrote to memory of 2316 2616 rxlxfll.exe 32 PID 2316 wrote to memory of 3048 2316 1xlfllx.exe 33 PID 2316 wrote to memory of 3048 2316 1xlfllx.exe 33 PID 2316 wrote to memory of 3048 2316 1xlfllx.exe 33 PID 2316 wrote to memory of 3048 2316 1xlfllx.exe 33 PID 3048 wrote to memory of 2660 3048 1bntbh.exe 34 PID 3048 wrote to memory of 2660 3048 1bntbh.exe 34 PID 3048 wrote to memory of 2660 3048 1bntbh.exe 34 PID 3048 wrote to memory of 2660 3048 1bntbh.exe 34 PID 2660 wrote to memory of 2800 2660 jdpdv.exe 35 PID 2660 wrote to memory of 2800 2660 jdpdv.exe 35 PID 2660 wrote to memory of 2800 2660 jdpdv.exe 35 PID 2660 wrote to memory of 2800 2660 jdpdv.exe 35 PID 2800 wrote to memory of 3060 2800 jjvvd.exe 36 PID 2800 wrote to memory of 3060 2800 jjvvd.exe 36 PID 2800 wrote to memory of 3060 2800 jjvvd.exe 36 PID 2800 wrote to memory of 3060 2800 jjvvd.exe 36 PID 3060 wrote to memory of 2840 3060 ffrrffr.exe 37 PID 3060 wrote to memory of 2840 3060 ffrrffr.exe 37 PID 3060 wrote to memory of 2840 3060 ffrrffr.exe 37 PID 3060 wrote to memory of 2840 3060 ffrrffr.exe 37 PID 2840 wrote to memory of 1748 2840 rrfxffl.exe 38 PID 2840 wrote to memory of 1748 2840 rrfxffl.exe 38 PID 2840 wrote to memory of 1748 2840 rrfxffl.exe 38 PID 2840 wrote to memory of 1748 2840 rrfxffl.exe 38 PID 1748 wrote to memory of 2552 1748 nttthh.exe 39 PID 1748 wrote to memory of 2552 1748 nttthh.exe 39 PID 1748 wrote to memory of 2552 1748 nttthh.exe 39 PID 1748 wrote to memory of 2552 1748 nttthh.exe 39 PID 2552 wrote to memory of 2716 2552 hhnbbb.exe 40 PID 2552 wrote to memory of 2716 2552 hhnbbb.exe 40 PID 2552 wrote to memory of 2716 2552 hhnbbb.exe 40 PID 2552 wrote to memory of 2716 2552 hhnbbb.exe 40 PID 2716 wrote to memory of 888 2716 vdjpd.exe 41 PID 2716 wrote to memory of 888 2716 vdjpd.exe 41 PID 2716 wrote to memory of 888 2716 vdjpd.exe 41 PID 2716 wrote to memory of 888 2716 vdjpd.exe 41 PID 888 wrote to memory of 1752 888 vpvvj.exe 42 PID 888 wrote to memory of 1752 888 vpvvj.exe 42 PID 888 wrote to memory of 1752 888 vpvvj.exe 42 PID 888 wrote to memory of 1752 888 vpvvj.exe 42 PID 1752 wrote to memory of 2776 1752 rrfrrxr.exe 43 PID 1752 wrote to memory of 2776 1752 rrfrrxr.exe 43 PID 1752 wrote to memory of 2776 1752 rrfrrxr.exe 43 PID 1752 wrote to memory of 2776 1752 rrfrrxr.exe 43 PID 2776 wrote to memory of 696 2776 xffxlfr.exe 44 PID 2776 wrote to memory of 696 2776 xffxlfr.exe 44 PID 2776 wrote to memory of 696 2776 xffxlfr.exe 44 PID 2776 wrote to memory of 696 2776 xffxlfr.exe 44 PID 696 wrote to memory of 2020 696 bbtbnn.exe 45 PID 696 wrote to memory of 2020 696 bbtbnn.exe 45 PID 696 wrote to memory of 2020 696 bbtbnn.exe 45 PID 696 wrote to memory of 2020 696 bbtbnn.exe 45 PID 2020 wrote to memory of 1632 2020 9pjjp.exe 46 PID 2020 wrote to memory of 1632 2020 9pjjp.exe 46 PID 2020 wrote to memory of 1632 2020 9pjjp.exe 46 PID 2020 wrote to memory of 1632 2020 9pjjp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe"C:\Users\Admin\AppData\Local\Temp\2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\rxlxfll.exec:\rxlxfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\1xlfllx.exec:\1xlfllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\1bntbh.exec:\1bntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jdpdv.exec:\jdpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\jjvvd.exec:\jjvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ffrrffr.exec:\ffrrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\rrfxffl.exec:\rrfxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\nttthh.exec:\nttthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\hhnbbb.exec:\hhnbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\vdjpd.exec:\vdjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\vpvvj.exec:\vpvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\rrfrrxr.exec:\rrfrrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\xffxlfr.exec:\xffxlfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\bbtbnn.exec:\bbtbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\9pjjp.exec:\9pjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\rrfllrf.exec:\rrfllrf.exe17⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hhttbb.exec:\hhttbb.exe18⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ntnthh.exec:\ntnthh.exe19⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vpvdj.exec:\vpvdj.exe20⤵
- Executes dropped EXE
PID:2348 -
\??\c:\9fllxxf.exec:\9fllxxf.exe21⤵
- Executes dropped EXE
PID:672 -
\??\c:\bbtbnt.exec:\bbtbnt.exe22⤵
- Executes dropped EXE
PID:288 -
\??\c:\nnbbnn.exec:\nnbbnn.exe23⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vvpvv.exec:\vvpvv.exe24⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rlrrlrx.exec:\rlrrlrx.exe25⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hhntbb.exec:\hhntbb.exe26⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dvjdp.exec:\dvjdp.exe27⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rrlxxrr.exec:\rrlxxrr.exe28⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bthnbb.exec:\bthnbb.exe29⤵
- Executes dropped EXE
PID:1900 -
\??\c:\hhhnnt.exec:\hhhnnt.exe30⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jjppv.exec:\jjppv.exe31⤵
- Executes dropped EXE
PID:584 -
\??\c:\5xflrrf.exec:\5xflrrf.exe32⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xflfrrx.exec:\xflfrrx.exe33⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hbhbbh.exec:\hbhbbh.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vvppj.exec:\vvppj.exe35⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ddjpv.exec:\ddjpv.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\fflrlfr.exec:\fflrlfr.exe37⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xxlrxxl.exec:\xxlrxxl.exe38⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bbnbhn.exec:\bbnbhn.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pjppv.exec:\pjppv.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\1vvvd.exec:\1vvvd.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rlrxflx.exec:\rlrxflx.exe42⤵
- Executes dropped EXE
PID:2840 -
\??\c:\9rxllll.exec:\9rxllll.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nnnhnt.exec:\nnnhnt.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\5thbbb.exec:\5thbbb.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\pjppv.exec:\pjppv.exe46⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vdpvj.exec:\vdpvj.exe47⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xfrxfrf.exec:\xfrxfrf.exe48⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe49⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hnbntt.exec:\hnbntt.exe50⤵
- Executes dropped EXE
PID:1248 -
\??\c:\nhbbnt.exec:\nhbbnt.exe51⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pvjjv.exec:\pvjjv.exe52⤵
- Executes dropped EXE
PID:1300 -
\??\c:\3pvvd.exec:\3pvvd.exe53⤵
- Executes dropped EXE
PID:1764 -
\??\c:\5xffxfx.exec:\5xffxfx.exe54⤵
- Executes dropped EXE
PID:1980 -
\??\c:\bhtbhn.exec:\bhtbhn.exe55⤵
- Executes dropped EXE
PID:1404 -
\??\c:\pjvdj.exec:\pjvdj.exe56⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7rlxfxl.exec:\7rlxfxl.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fxlxflx.exec:\fxlxflx.exe58⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bbnntb.exec:\bbnntb.exe59⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tnhnbh.exec:\tnhnbh.exe60⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bbtbtt.exec:\bbtbtt.exe61⤵
- Executes dropped EXE
PID:1032 -
\??\c:\pvddj.exec:\pvddj.exe62⤵
- Executes dropped EXE
PID:2248 -
\??\c:\pvpvj.exec:\pvpvj.exe63⤵
- Executes dropped EXE
PID:1356 -
\??\c:\rrlrxlx.exec:\rrlrxlx.exe64⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rrflrrf.exec:\rrflrrf.exe65⤵
- Executes dropped EXE
PID:316 -
\??\c:\hnbhtb.exec:\hnbhtb.exe66⤵PID:1744
-
\??\c:\bhthhn.exec:\bhthhn.exe67⤵PID:544
-
\??\c:\pvjpv.exec:\pvjpv.exe68⤵PID:2976
-
\??\c:\3xrflxf.exec:\3xrflxf.exe69⤵PID:3068
-
\??\c:\9ffrllx.exec:\9ffrllx.exe70⤵PID:2052
-
\??\c:\tthnbb.exec:\tthnbb.exe71⤵PID:1908
-
\??\c:\1nnthh.exec:\1nnthh.exe72⤵PID:2904
-
\??\c:\7hbhnt.exec:\7hbhnt.exe73⤵PID:2300
-
\??\c:\pdjvj.exec:\pdjvj.exe74⤵PID:280
-
\??\c:\7dppv.exec:\7dppv.exe75⤵PID:2040
-
\??\c:\ffxlllf.exec:\ffxlllf.exe76⤵PID:1736
-
\??\c:\ffxxlxl.exec:\ffxxlxl.exe77⤵PID:2624
-
\??\c:\ttnntn.exec:\ttnntn.exe78⤵PID:2168
-
\??\c:\hhnhbb.exec:\hhnhbb.exe79⤵PID:2672
-
\??\c:\ddvjp.exec:\ddvjp.exe80⤵PID:2756
-
\??\c:\3jdpp.exec:\3jdpp.exe81⤵PID:2648
-
\??\c:\ffflrxf.exec:\ffflrxf.exe82⤵PID:2852
-
\??\c:\bbnnhn.exec:\bbnnhn.exe83⤵PID:2704
-
\??\c:\1nhntt.exec:\1nhntt.exe84⤵PID:2652
-
\??\c:\hnbhth.exec:\hnbhth.exe85⤵PID:2532
-
\??\c:\djdpj.exec:\djdpj.exe86⤵PID:2420
-
\??\c:\xxfxllx.exec:\xxfxllx.exe87⤵PID:1392
-
\??\c:\1llxffl.exec:\1llxffl.exe88⤵PID:1720
-
\??\c:\nhnntn.exec:\nhnntn.exe89⤵PID:2632
-
\??\c:\bhbhhh.exec:\bhbhhh.exe90⤵PID:2064
-
\??\c:\9vpdp.exec:\9vpdp.exe91⤵PID:996
-
\??\c:\ddjdd.exec:\ddjdd.exe92⤵PID:2828
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe93⤵PID:704
-
\??\c:\lffrxxl.exec:\lffrxxl.exe94⤵PID:1320
-
\??\c:\1hhtbn.exec:\1hhtbn.exe95⤵PID:2768
-
\??\c:\bhhnth.exec:\bhhnth.exe96⤵PID:1632
-
\??\c:\9dpvv.exec:\9dpvv.exe97⤵PID:2092
-
\??\c:\1dvvj.exec:\1dvvj.exe98⤵PID:2572
-
\??\c:\llxxfxr.exec:\llxxfxr.exe99⤵PID:2356
-
\??\c:\nnbtbn.exec:\nnbtbn.exe100⤵PID:1484
-
\??\c:\hhhhhh.exec:\hhhhhh.exe101⤵PID:2192
-
\??\c:\ntnnnt.exec:\ntnnnt.exe102⤵PID:1664
-
\??\c:\3jdjj.exec:\3jdjj.exe103⤵PID:2376
-
\??\c:\vvjjv.exec:\vvjjv.exe104⤵PID:1276
-
\??\c:\llxflrf.exec:\llxflrf.exe105⤵PID:1924
-
\??\c:\xxflrrf.exec:\xxflrrf.exe106⤵PID:1608
-
\??\c:\tbbtbn.exec:\tbbtbn.exe107⤵PID:2148
-
\??\c:\bhtthn.exec:\bhtthn.exe108⤵PID:920
-
\??\c:\vvddj.exec:\vvddj.exe109⤵PID:1576
-
\??\c:\dvpjv.exec:\dvpjv.exe110⤵PID:992
-
\??\c:\lrxfflr.exec:\lrxfflr.exe111⤵PID:2372
-
\??\c:\xxfxllx.exec:\xxfxllx.exe112⤵PID:2204
-
\??\c:\tthhbb.exec:\tthhbb.exe113⤵PID:2944
-
\??\c:\httbnh.exec:\httbnh.exe114⤵PID:1756
-
\??\c:\9djvv.exec:\9djvv.exe115⤵PID:2832
-
\??\c:\vvjpd.exec:\vvjpd.exe116⤵PID:548
-
\??\c:\rrxxrrf.exec:\rrxxrrf.exe117⤵PID:2004
-
\??\c:\ffxflxf.exec:\ffxflxf.exe118⤵PID:2040
-
\??\c:\hhbbnh.exec:\hhbbnh.exe119⤵PID:1736
-
\??\c:\vvppv.exec:\vvppv.exe120⤵PID:2624
-
\??\c:\ppvjd.exec:\ppvjd.exe121⤵PID:2168
-
\??\c:\xxxxllx.exec:\xxxxllx.exe122⤵PID:2672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-