Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe
-
Size
54KB
-
MD5
b811c51873a98c783ac102140f14a5db
-
SHA1
d2e5683d0e1771ce6b79a952bb3c410cd15e4651
-
SHA256
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f
-
SHA512
69c42f8c50f39d15ef79033152e6fa27d246859b2d1c56d1a680e7b4f1dfb92755b0d63bdb824622d345f3e28117fa078b77d506b7313419d351fce3d59b50b3
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJV2:0cdpeeBSHHMHLf9RyIET2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2092-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-36-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3028-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/672-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-126-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2116-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-163-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2196-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-261-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1760-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-328-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/1528-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-370-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2164-397-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2164-418-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2732-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-436-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-450-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-506-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-548-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-603-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-677-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2960-698-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/1988-801-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2772-866-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2940-887-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon behavioral1/memory/1172-938-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-976-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2612-1172-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/1552-1180-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1552-1178-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2848-1200-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2116-1270-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2688 pjpvj.exe 2880 dvdvv.exe 2552 vvjvv.exe 2296 1xflxfl.exe 2720 ttbbhb.exe 2560 nhtttn.exe 3012 dpdvp.exe 3028 1pdvj.exe 2900 ppddj.exe 2520 rrfxrll.exe 672 3tbtnn.exe 2972 hbttbt.exe 2088 tntbbb.exe 2872 lfllffx.exe 2116 rlrrfxf.exe 2616 llxfrrx.exe 532 tnbtbn.exe 572 dvdjv.exe 992 jdpvv.exe 2196 bthbbt.exe 2184 dvddv.exe 1976 xxrfxfl.exe 568 ffrfxfr.exe 988 3thhnh.exe 904 tthhbh.exe 1364 jjdjp.exe 2408 rrllrrf.exe 2300 fxlfffl.exe 1760 bttbnn.exe 1748 vvppp.exe 1884 5vjvp.exe 2092 xlflllr.exe 2800 7tnntt.exe 2876 nnthhh.exe 2652 tntttn.exe 3032 3ddvv.exe 1528 vjppv.exe 2244 fxxffff.exe 2604 rlxxffl.exe 2564 bbhnhb.exe 2708 tnhbtt.exe 3012 9vjdv.exe 3020 xxlfxxl.exe 1764 5tbbbt.exe 440 7tbhhn.exe 664 ppddp.exe 2164 ppvpv.exe 2964 xxlxxxl.exe 2372 1bnnhh.exe 2860 nthttb.exe 2732 5ppjd.exe 2616 1jvvv.exe 1704 fxxrflr.exe 564 rrlxffl.exe 2856 3hhhnn.exe 1672 7nnbnt.exe 596 ppjvd.exe 2180 5vjjd.exe 2212 fffflrx.exe 2936 llxxxrx.exe 2264 ttnnbh.exe 2424 tbnbhn.exe 676 3dvdd.exe 2500 pvddd.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2688 2092 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 30 PID 2092 wrote to memory of 2688 2092 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 30 PID 2092 wrote to memory of 2688 2092 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 30 PID 2092 wrote to memory of 2688 2092 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 30 PID 2688 wrote to memory of 2880 2688 pjpvj.exe 31 PID 2688 wrote to memory of 2880 2688 pjpvj.exe 31 PID 2688 wrote to memory of 2880 2688 pjpvj.exe 31 PID 2688 wrote to memory of 2880 2688 pjpvj.exe 31 PID 2880 wrote to memory of 2552 2880 dvdvv.exe 32 PID 2880 wrote to memory of 2552 2880 dvdvv.exe 32 PID 2880 wrote to memory of 2552 2880 dvdvv.exe 32 PID 2880 wrote to memory of 2552 2880 dvdvv.exe 32 PID 2552 wrote to memory of 2296 2552 vvjvv.exe 33 PID 2552 wrote to memory of 2296 2552 vvjvv.exe 33 PID 2552 wrote to memory of 2296 2552 vvjvv.exe 33 PID 2552 wrote to memory of 2296 2552 vvjvv.exe 33 PID 2296 wrote to memory of 2720 2296 1xflxfl.exe 34 PID 2296 wrote to memory of 2720 2296 1xflxfl.exe 34 PID 2296 wrote to memory of 2720 2296 1xflxfl.exe 34 PID 2296 wrote to memory of 2720 2296 1xflxfl.exe 34 PID 2720 wrote to memory of 2560 2720 ttbbhb.exe 35 PID 2720 wrote to memory of 2560 2720 ttbbhb.exe 35 PID 2720 wrote to memory of 2560 2720 ttbbhb.exe 35 PID 2720 wrote to memory of 2560 2720 ttbbhb.exe 35 PID 2560 wrote to memory of 3012 2560 nhtttn.exe 36 PID 2560 wrote to memory of 3012 2560 nhtttn.exe 36 PID 2560 wrote to memory of 3012 2560 nhtttn.exe 36 PID 2560 wrote to memory of 3012 2560 nhtttn.exe 36 PID 3012 wrote to memory of 3028 3012 dpdvp.exe 37 PID 3012 wrote to memory of 3028 3012 dpdvp.exe 37 PID 3012 wrote to memory of 3028 3012 dpdvp.exe 37 PID 3012 wrote to memory of 3028 3012 dpdvp.exe 37 PID 3028 wrote to memory of 2900 3028 1pdvj.exe 38 PID 3028 wrote to memory of 2900 3028 1pdvj.exe 38 PID 3028 wrote to memory of 2900 3028 1pdvj.exe 38 PID 3028 wrote to memory of 2900 3028 1pdvj.exe 38 PID 2900 wrote to memory of 2520 2900 ppddj.exe 39 PID 2900 wrote to memory of 2520 2900 ppddj.exe 39 PID 2900 wrote to memory of 2520 2900 ppddj.exe 39 PID 2900 wrote to memory of 2520 2900 ppddj.exe 39 PID 2520 wrote to memory of 672 2520 rrfxrll.exe 40 PID 2520 wrote to memory of 672 2520 rrfxrll.exe 40 PID 2520 wrote to memory of 672 2520 rrfxrll.exe 40 PID 2520 wrote to memory of 672 2520 rrfxrll.exe 40 PID 672 wrote to memory of 2972 672 3tbtnn.exe 41 PID 672 wrote to memory of 2972 672 3tbtnn.exe 41 PID 672 wrote to memory of 2972 672 3tbtnn.exe 41 PID 672 wrote to memory of 2972 672 3tbtnn.exe 41 PID 2972 wrote to memory of 2088 2972 hbttbt.exe 42 PID 2972 wrote to memory of 2088 2972 hbttbt.exe 42 PID 2972 wrote to memory of 2088 2972 hbttbt.exe 42 PID 2972 wrote to memory of 2088 2972 hbttbt.exe 42 PID 2088 wrote to memory of 2872 2088 tntbbb.exe 43 PID 2088 wrote to memory of 2872 2088 tntbbb.exe 43 PID 2088 wrote to memory of 2872 2088 tntbbb.exe 43 PID 2088 wrote to memory of 2872 2088 tntbbb.exe 43 PID 2872 wrote to memory of 2116 2872 lfllffx.exe 44 PID 2872 wrote to memory of 2116 2872 lfllffx.exe 44 PID 2872 wrote to memory of 2116 2872 lfllffx.exe 44 PID 2872 wrote to memory of 2116 2872 lfllffx.exe 44 PID 2116 wrote to memory of 2616 2116 rlrrfxf.exe 45 PID 2116 wrote to memory of 2616 2116 rlrrfxf.exe 45 PID 2116 wrote to memory of 2616 2116 rlrrfxf.exe 45 PID 2116 wrote to memory of 2616 2116 rlrrfxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe"C:\Users\Admin\AppData\Local\Temp\bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\pjpvj.exec:\pjpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\dvdvv.exec:\dvdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\vvjvv.exec:\vvjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\1xflxfl.exec:\1xflxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\ttbbhb.exec:\ttbbhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nhtttn.exec:\nhtttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\dpdvp.exec:\dpdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\1pdvj.exec:\1pdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\ppddj.exec:\ppddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\rrfxrll.exec:\rrfxrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\3tbtnn.exec:\3tbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\hbttbt.exec:\hbttbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\tntbbb.exec:\tntbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\lfllffx.exec:\lfllffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rlrrfxf.exec:\rlrrfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\llxfrrx.exec:\llxfrrx.exe17⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tnbtbn.exec:\tnbtbn.exe18⤵
- Executes dropped EXE
PID:532 -
\??\c:\dvdjv.exec:\dvdjv.exe19⤵
- Executes dropped EXE
PID:572 -
\??\c:\jdpvv.exec:\jdpvv.exe20⤵
- Executes dropped EXE
PID:992 -
\??\c:\bthbbt.exec:\bthbbt.exe21⤵
- Executes dropped EXE
PID:2196 -
\??\c:\dvddv.exec:\dvddv.exe22⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xxrfxfl.exec:\xxrfxfl.exe23⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ffrfxfr.exec:\ffrfxfr.exe24⤵
- Executes dropped EXE
PID:568 -
\??\c:\3thhnh.exec:\3thhnh.exe25⤵
- Executes dropped EXE
PID:988 -
\??\c:\tthhbh.exec:\tthhbh.exe26⤵
- Executes dropped EXE
PID:904 -
\??\c:\jjdjp.exec:\jjdjp.exe27⤵
- Executes dropped EXE
PID:1364 -
\??\c:\rrllrrf.exec:\rrllrrf.exe28⤵
- Executes dropped EXE
PID:2408 -
\??\c:\fxlfffl.exec:\fxlfffl.exe29⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bttbnn.exec:\bttbnn.exe30⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vvppp.exec:\vvppp.exe31⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5vjvp.exec:\5vjvp.exe32⤵
- Executes dropped EXE
PID:1884 -
\??\c:\xlflllr.exec:\xlflllr.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\7tnntt.exec:\7tnntt.exe34⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nnthhh.exec:\nnthhh.exe35⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tntttn.exec:\tntttn.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\3ddvv.exec:\3ddvv.exe37⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vjppv.exec:\vjppv.exe38⤵
- Executes dropped EXE
PID:1528 -
\??\c:\fxxffff.exec:\fxxffff.exe39⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rlxxffl.exec:\rlxxffl.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\bbhnhb.exec:\bbhnhb.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\tnhbtt.exec:\tnhbtt.exe42⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9vjdv.exec:\9vjdv.exe43⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xxlfxxl.exec:\xxlfxxl.exe44⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5tbbbt.exec:\5tbbbt.exe45⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7tbhhn.exec:\7tbhhn.exe46⤵
- Executes dropped EXE
PID:440 -
\??\c:\ppddp.exec:\ppddp.exe47⤵
- Executes dropped EXE
PID:664 -
\??\c:\ppvpv.exec:\ppvpv.exe48⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xxlxxxl.exec:\xxlxxxl.exe49⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1bnnhh.exec:\1bnnhh.exe50⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nthttb.exec:\nthttb.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5ppjd.exec:\5ppjd.exe52⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1jvvv.exec:\1jvvv.exe53⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fxxrflr.exec:\fxxrflr.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rrlxffl.exec:\rrlxffl.exe55⤵
- Executes dropped EXE
PID:564 -
\??\c:\3hhhnn.exec:\3hhhnn.exe56⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7nnbnt.exec:\7nnbnt.exe57⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ppjvd.exec:\ppjvd.exe58⤵
- Executes dropped EXE
PID:596 -
\??\c:\5vjjd.exec:\5vjjd.exe59⤵
- Executes dropped EXE
PID:2180 -
\??\c:\fffflrx.exec:\fffflrx.exe60⤵
- Executes dropped EXE
PID:2212 -
\??\c:\llxxxrx.exec:\llxxxrx.exe61⤵
- Executes dropped EXE
PID:2936 -
\??\c:\ttnnbh.exec:\ttnnbh.exe62⤵
- Executes dropped EXE
PID:2264 -
\??\c:\tbnbhn.exec:\tbnbhn.exe63⤵
- Executes dropped EXE
PID:2424 -
\??\c:\3dvdd.exec:\3dvdd.exe64⤵
- Executes dropped EXE
PID:676 -
\??\c:\pvddd.exec:\pvddd.exe65⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5vpvd.exec:\5vpvd.exe66⤵PID:776
-
\??\c:\llxfffx.exec:\llxfffx.exe67⤵PID:876
-
\??\c:\9thntn.exec:\9thntn.exe68⤵PID:1868
-
\??\c:\ttbtbh.exec:\ttbtbh.exe69⤵PID:1188
-
\??\c:\jpvvd.exec:\jpvvd.exe70⤵PID:1036
-
\??\c:\pjjjp.exec:\pjjjp.exe71⤵PID:1540
-
\??\c:\fffflrx.exec:\fffflrx.exe72⤵PID:3056
-
\??\c:\btbhnn.exec:\btbhnn.exe73⤵PID:1816
-
\??\c:\bbnbhn.exec:\bbnbhn.exe74⤵PID:2992
-
\??\c:\1thttb.exec:\1thttb.exe75⤵PID:1948
-
\??\c:\jdddj.exec:\jdddj.exe76⤵PID:2700
-
\??\c:\dvpvv.exec:\dvpvv.exe77⤵PID:2956
-
\??\c:\fxrrxrf.exec:\fxrrxrf.exe78⤵PID:2332
-
\??\c:\9frrrxf.exec:\9frrrxf.exe79⤵PID:2652
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe80⤵PID:2768
-
\??\c:\hbhntt.exec:\hbhntt.exe81⤵PID:2716
-
\??\c:\1htnnn.exec:\1htnnn.exe82⤵PID:2588
-
\??\c:\7jdjj.exec:\7jdjj.exe83⤵PID:2884
-
\??\c:\3pjjp.exec:\3pjjp.exe84⤵PID:2580
-
\??\c:\1rrrrrf.exec:\1rrrrrf.exe85⤵PID:2068
-
\??\c:\rrfrxxf.exec:\rrfrxxf.exe86⤵PID:1012
-
\??\c:\btnttb.exec:\btnttb.exe87⤵PID:348
-
\??\c:\bhnbbh.exec:\bhnbbh.exe88⤵PID:3020
-
\??\c:\1dppp.exec:\1dppp.exe89⤵PID:1632
-
\??\c:\dvvpv.exec:\dvvpv.exe90⤵PID:1664
-
\??\c:\1fxxxlr.exec:\1fxxxlr.exe91⤵PID:2348
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe92⤵PID:2960
-
\??\c:\bbntbt.exec:\bbntbt.exe93⤵PID:2120
-
\??\c:\bbtntt.exec:\bbtntt.exe94⤵PID:2372
-
\??\c:\vpvdd.exec:\vpvdd.exe95⤵PID:2324
-
\??\c:\1vvvv.exec:\1vvvv.exe96⤵PID:2872
-
\??\c:\lfrrffl.exec:\lfrrffl.exe97⤵PID:1656
-
\??\c:\9xlffff.exec:\9xlffff.exe98⤵PID:1676
-
\??\c:\7bnhht.exec:\7bnhht.exe99⤵PID:564
-
\??\c:\bbhhnn.exec:\bbhhnn.exe100⤵PID:1572
-
\??\c:\vppvd.exec:\vppvd.exe101⤵PID:572
-
\??\c:\1jvvv.exec:\1jvvv.exe102⤵PID:2200
-
\??\c:\fxfflll.exec:\fxfflll.exe103⤵PID:992
-
\??\c:\ffxxflx.exec:\ffxxflx.exe104⤵PID:2980
-
\??\c:\5ntttn.exec:\5ntttn.exe105⤵PID:112
-
\??\c:\hhntth.exec:\hhntth.exe106⤵PID:1924
-
\??\c:\tttttt.exec:\tttttt.exe107⤵PID:2424
-
\??\c:\dvdjp.exec:\dvdjp.exe108⤵PID:832
-
\??\c:\jdjdd.exec:\jdjdd.exe109⤵PID:1472
-
\??\c:\rrxxlrf.exec:\rrxxlrf.exe110⤵PID:1984
-
\??\c:\xxffllr.exec:\xxffllr.exe111⤵PID:2208
-
\??\c:\tntttt.exec:\tntttt.exe112⤵PID:1988
-
\??\c:\bbhntt.exec:\bbhntt.exe113⤵PID:3044
-
\??\c:\3ntnnt.exec:\3ntnnt.exe114⤵PID:2304
-
\??\c:\9dppv.exec:\9dppv.exe115⤵PID:1004
-
\??\c:\pvjvv.exec:\pvjvv.exe116⤵PID:896
-
\??\c:\7rllxfl.exec:\7rllxfl.exe117⤵PID:1420
-
\??\c:\xrfllrx.exec:\xrfllrx.exe118⤵PID:3068
-
\??\c:\htnbhh.exec:\htnbhh.exe119⤵PID:2676
-
\??\c:\ttttbb.exec:\ttttbb.exe120⤵PID:2988
-
\??\c:\vvdvv.exec:\vvdvv.exe121⤵PID:2816
-
\??\c:\jjjdj.exec:\jjjdj.exe122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-