Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 08:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe
-
Size
52KB
-
MD5
7c714b0617dad817c42df4d2241f4ee8
-
SHA1
3c82ee424a84c05339e8cd205b341c44aa376117
-
SHA256
ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308
-
SHA512
cf4278e4168267a9d84ed128000c7dcc54d64017ebe47b1b3b5241f0ba547965139226fa4e790c7422de3967c1550e5de44d71c026ed6fff0ba7954d1c3fa137
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0ysbe:ymb3NkkiQ3mdBjF0yee
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2344-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1384-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/444-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1420-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1632 nbnthn.exe 2520 pjjvj.exe 2900 5frxffl.exe 2696 hbttbb.exe 2872 tntntt.exe 2592 1vvdd.exe 2892 3dvdp.exe 2640 5tthtt.exe 2660 5btbnh.exe 2652 pjvvd.exe 2008 lfrrrrx.exe 2924 thbhhh.exe 2016 htntbh.exe 1640 jjpvv.exe 1384 7vjdd.exe 1016 xrflrxl.exe 2984 nnbbtt.exe 2988 3bnttt.exe 988 7pdvp.exe 3064 vvjjp.exe 444 rlxfllr.exe 2972 1bhnbt.exe 1172 tnttbh.exe 1560 jdvvd.exe 1420 vjpjv.exe 3044 rfrrrrx.exe 924 3ffllfl.exe 1416 hbntnh.exe 2296 jvvdd.exe 2332 5dppp.exe 2532 lfllxlx.exe 2368 9nbtbn.exe 1392 pjvjj.exe 2716 dpppp.exe 2728 rllffxf.exe 2820 fxxfrxl.exe 2872 rfrrrlr.exe 2836 9bhttt.exe 2096 hthbbb.exe 2584 5vjvj.exe 1860 pjvpj.exe 2616 fxfflfl.exe 1964 xrfllrr.exe 2628 hhttnn.exe 1908 9nttbt.exe 1704 3pddv.exe 1648 3pvvj.exe 1552 rlxxrxf.exe 2856 1xrxxrf.exe 2356 nhnnbt.exe 1016 ththhn.exe 2180 lfrlrlx.exe 2416 7fxxffl.exe 2460 5bbhtt.exe 2156 thbbbb.exe 1132 1vvvd.exe 1848 pjddj.exe 1204 rrxfrrx.exe 788 rfrlrlr.exe 1936 btbnnt.exe 540 nthtth.exe 2264 7vjpj.exe 1324 5pdpp.exe 2352 1lxxxxf.exe -
resource yara_rule behavioral1/memory/2344-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1384-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/444-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1420-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 1632 2344 ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe 30 PID 2344 wrote to memory of 1632 2344 ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe 30 PID 2344 wrote to memory of 1632 2344 ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe 30 PID 2344 wrote to memory of 1632 2344 ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe 30 PID 1632 wrote to memory of 2520 1632 nbnthn.exe 31 PID 1632 wrote to memory of 2520 1632 nbnthn.exe 31 PID 1632 wrote to memory of 2520 1632 nbnthn.exe 31 PID 1632 wrote to memory of 2520 1632 nbnthn.exe 31 PID 2520 wrote to memory of 2900 2520 pjjvj.exe 32 PID 2520 wrote to memory of 2900 2520 pjjvj.exe 32 PID 2520 wrote to memory of 2900 2520 pjjvj.exe 32 PID 2520 wrote to memory of 2900 2520 pjjvj.exe 32 PID 2900 wrote to memory of 2696 2900 5frxffl.exe 33 PID 2900 wrote to memory of 2696 2900 5frxffl.exe 33 PID 2900 wrote to memory of 2696 2900 5frxffl.exe 33 PID 2900 wrote to memory of 2696 2900 5frxffl.exe 33 PID 2696 wrote to memory of 2872 2696 hbttbb.exe 34 PID 2696 wrote to memory of 2872 2696 hbttbb.exe 34 PID 2696 wrote to memory of 2872 2696 hbttbb.exe 34 PID 2696 wrote to memory of 2872 2696 hbttbb.exe 34 PID 2872 wrote to memory of 2592 2872 tntntt.exe 35 PID 2872 wrote to memory of 2592 2872 tntntt.exe 35 PID 2872 wrote to memory of 2592 2872 tntntt.exe 35 PID 2872 wrote to memory of 2592 2872 tntntt.exe 35 PID 2592 wrote to memory of 2892 2592 1vvdd.exe 36 PID 2592 wrote to memory of 2892 2592 1vvdd.exe 36 PID 2592 wrote to memory of 2892 2592 1vvdd.exe 36 PID 2592 wrote to memory of 2892 2592 1vvdd.exe 36 PID 2892 wrote to memory of 2640 2892 3dvdp.exe 37 PID 2892 wrote to memory of 2640 2892 3dvdp.exe 37 PID 2892 wrote to memory of 2640 2892 3dvdp.exe 37 PID 2892 wrote to memory of 2640 2892 3dvdp.exe 37 PID 2640 wrote to memory of 2660 2640 5tthtt.exe 38 PID 2640 wrote to memory of 2660 2640 5tthtt.exe 38 PID 2640 wrote to memory of 2660 2640 5tthtt.exe 38 PID 2640 wrote to memory of 2660 2640 5tthtt.exe 38 PID 2660 wrote to memory of 2652 2660 5btbnh.exe 39 PID 2660 wrote to memory of 2652 2660 5btbnh.exe 39 PID 2660 wrote to memory of 2652 2660 5btbnh.exe 39 PID 2660 wrote to memory of 2652 2660 5btbnh.exe 39 PID 2652 wrote to memory of 2008 2652 pjvvd.exe 40 PID 2652 wrote to memory of 2008 2652 pjvvd.exe 40 PID 2652 wrote to memory of 2008 2652 pjvvd.exe 40 PID 2652 wrote to memory of 2008 2652 pjvvd.exe 40 PID 2008 wrote to memory of 2924 2008 lfrrrrx.exe 41 PID 2008 wrote to memory of 2924 2008 lfrrrrx.exe 41 PID 2008 wrote to memory of 2924 2008 lfrrrrx.exe 41 PID 2008 wrote to memory of 2924 2008 lfrrrrx.exe 41 PID 2924 wrote to memory of 2016 2924 thbhhh.exe 43 PID 2924 wrote to memory of 2016 2924 thbhhh.exe 43 PID 2924 wrote to memory of 2016 2924 thbhhh.exe 43 PID 2924 wrote to memory of 2016 2924 thbhhh.exe 43 PID 2016 wrote to memory of 1640 2016 htntbh.exe 44 PID 2016 wrote to memory of 1640 2016 htntbh.exe 44 PID 2016 wrote to memory of 1640 2016 htntbh.exe 44 PID 2016 wrote to memory of 1640 2016 htntbh.exe 44 PID 1640 wrote to memory of 1384 1640 jjpvv.exe 45 PID 1640 wrote to memory of 1384 1640 jjpvv.exe 45 PID 1640 wrote to memory of 1384 1640 jjpvv.exe 45 PID 1640 wrote to memory of 1384 1640 jjpvv.exe 45 PID 1384 wrote to memory of 1016 1384 7vjdd.exe 46 PID 1384 wrote to memory of 1016 1384 7vjdd.exe 46 PID 1384 wrote to memory of 1016 1384 7vjdd.exe 46 PID 1384 wrote to memory of 1016 1384 7vjdd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe"C:\Users\Admin\AppData\Local\Temp\ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\nbnthn.exec:\nbnthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\pjjvj.exec:\pjjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\5frxffl.exec:\5frxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\hbttbb.exec:\hbttbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\tntntt.exec:\tntntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\1vvdd.exec:\1vvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\3dvdp.exec:\3dvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\5tthtt.exec:\5tthtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\5btbnh.exec:\5btbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\pjvvd.exec:\pjvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\thbhhh.exec:\thbhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\htntbh.exec:\htntbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\jjpvv.exec:\jjpvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\7vjdd.exec:\7vjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\xrflrxl.exec:\xrflrxl.exe17⤵
- Executes dropped EXE
PID:1016 -
\??\c:\nnbbtt.exec:\nnbbtt.exe18⤵
- Executes dropped EXE
PID:2984 -
\??\c:\3bnttt.exec:\3bnttt.exe19⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7pdvp.exec:\7pdvp.exe20⤵
- Executes dropped EXE
PID:988 -
\??\c:\vvjjp.exec:\vvjjp.exe21⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rlxfllr.exec:\rlxfllr.exe22⤵
- Executes dropped EXE
PID:444 -
\??\c:\1bhnbt.exec:\1bhnbt.exe23⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tnttbh.exec:\tnttbh.exe24⤵
- Executes dropped EXE
PID:1172 -
\??\c:\jdvvd.exec:\jdvvd.exe25⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vjpjv.exec:\vjpjv.exe26⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe27⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3ffllfl.exec:\3ffllfl.exe28⤵
- Executes dropped EXE
PID:924 -
\??\c:\hbntnh.exec:\hbntnh.exe29⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jvvdd.exec:\jvvdd.exe30⤵
- Executes dropped EXE
PID:2296 -
\??\c:\5dppp.exec:\5dppp.exe31⤵
- Executes dropped EXE
PID:2332 -
\??\c:\lfllxlx.exec:\lfllxlx.exe32⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9nbtbn.exec:\9nbtbn.exe33⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pjvjj.exec:\pjvjj.exe34⤵
- Executes dropped EXE
PID:1392 -
\??\c:\dpppp.exec:\dpppp.exe35⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rllffxf.exec:\rllffxf.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rfrrrlr.exec:\rfrrrlr.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9bhttt.exec:\9bhttt.exe39⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hthbbb.exec:\hthbbb.exe40⤵
- Executes dropped EXE
PID:2096 -
\??\c:\5vjvj.exec:\5vjvj.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pjvpj.exec:\pjvpj.exe42⤵
- Executes dropped EXE
PID:1860 -
\??\c:\fxfflfl.exec:\fxfflfl.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xrfllrr.exec:\xrfllrr.exe44⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hhttnn.exec:\hhttnn.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9nttbt.exec:\9nttbt.exe46⤵
- Executes dropped EXE
PID:1908 -
\??\c:\3pddv.exec:\3pddv.exe47⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3pvvj.exec:\3pvvj.exe48⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rlxxrxf.exec:\rlxxrxf.exe49⤵
- Executes dropped EXE
PID:1552 -
\??\c:\1xrxxrf.exec:\1xrxxrf.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nhnnbt.exec:\nhnnbt.exe51⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ththhn.exec:\ththhn.exe52⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lfrlrlx.exec:\lfrlrlx.exe53⤵
- Executes dropped EXE
PID:2180 -
\??\c:\7fxxffl.exec:\7fxxffl.exe54⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5bbhtt.exec:\5bbhtt.exe55⤵
- Executes dropped EXE
PID:2460 -
\??\c:\thbbbb.exec:\thbbbb.exe56⤵
- Executes dropped EXE
PID:2156 -
\??\c:\1vvvd.exec:\1vvvd.exe57⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pjddj.exec:\pjddj.exe58⤵
- Executes dropped EXE
PID:1848 -
\??\c:\rrxfrrx.exec:\rrxfrrx.exe59⤵
- Executes dropped EXE
PID:1204 -
\??\c:\rfrlrlr.exec:\rfrlrlr.exe60⤵
- Executes dropped EXE
PID:788 -
\??\c:\btbnnt.exec:\btbnnt.exe61⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nthtth.exec:\nthtth.exe62⤵
- Executes dropped EXE
PID:540 -
\??\c:\7vjpj.exec:\7vjpj.exe63⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5pdpp.exec:\5pdpp.exe64⤵
- Executes dropped EXE
PID:1324 -
\??\c:\1lxxxxf.exec:\1lxxxxf.exe65⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5rflrrr.exec:\5rflrrr.exe66⤵PID:2992
-
\??\c:\9hhnbb.exec:\9hhnbb.exe67⤵PID:1112
-
\??\c:\btbbbh.exec:\btbbbh.exe68⤵PID:1508
-
\??\c:\9dvpd.exec:\9dvpd.exe69⤵PID:2124
-
\??\c:\vjpjv.exec:\vjpjv.exe70⤵PID:1928
-
\??\c:\rlfffll.exec:\rlfffll.exe71⤵PID:2320
-
\??\c:\9xxxllr.exec:\9xxxllr.exe72⤵PID:1492
-
\??\c:\hbbhhn.exec:\hbbhhn.exe73⤵PID:2808
-
\??\c:\bnhhtb.exec:\bnhhtb.exe74⤵PID:2716
-
\??\c:\jdvjv.exec:\jdvjv.exe75⤵PID:2696
-
\??\c:\djppv.exec:\djppv.exe76⤵PID:2796
-
\??\c:\5xlllfl.exec:\5xlllfl.exe77⤵PID:2704
-
\??\c:\rfllxrf.exec:\rfllxrf.exe78⤵PID:2724
-
\??\c:\9bbnbb.exec:\9bbnbb.exe79⤵PID:2892
-
\??\c:\hthbhh.exec:\hthbhh.exe80⤵PID:2224
-
\??\c:\1nnhhn.exec:\1nnhhn.exe81⤵PID:1692
-
\??\c:\dpjjd.exec:\dpjjd.exe82⤵PID:2616
-
\??\c:\jdvdd.exec:\jdvdd.exe83⤵PID:2816
-
\??\c:\rlrlfxf.exec:\rlrlfxf.exe84⤵PID:2848
-
\??\c:\ffrxllr.exec:\ffrxllr.exe85⤵PID:2932
-
\??\c:\hbbhtb.exec:\hbbhtb.exe86⤵PID:1876
-
\??\c:\bthhnt.exec:\bthhnt.exe87⤵PID:1640
-
\??\c:\1jvdv.exec:\1jvdv.exe88⤵PID:1384
-
\??\c:\7djpp.exec:\7djpp.exe89⤵PID:1556
-
\??\c:\jvjdv.exec:\jvjdv.exe90⤵PID:2688
-
\??\c:\rlflrxf.exec:\rlflrxf.exe91⤵PID:2684
-
\??\c:\frxllfl.exec:\frxllfl.exe92⤵PID:2152
-
\??\c:\thnbtt.exec:\thnbtt.exe93⤵PID:2552
-
\??\c:\bttnbt.exec:\bttnbt.exe94⤵PID:2460
-
\??\c:\vjpjd.exec:\vjpjd.exe95⤵PID:2976
-
\??\c:\5jvdj.exec:\5jvdj.exe96⤵PID:3024
-
\??\c:\3vpdj.exec:\3vpdj.exe97⤵PID:2972
-
\??\c:\xrrxlrx.exec:\xrrxlrx.exe98⤵PID:1620
-
\??\c:\hbntbt.exec:\hbntbt.exe99⤵PID:1896
-
\??\c:\3hbtbt.exec:\3hbtbt.exe100⤵PID:1420
-
\??\c:\5pvvd.exec:\5pvvd.exe101⤵PID:2952
-
\??\c:\dvdvd.exec:\dvdvd.exe102⤵PID:2264
-
\??\c:\xlxxxfl.exec:\xlxxxfl.exe103⤵PID:700
-
\??\c:\5rxxffr.exec:\5rxxffr.exe104⤵PID:2088
-
\??\c:\hhtbtt.exec:\hhtbtt.exe105⤵PID:876
-
\??\c:\nhnhnt.exec:\nhnhnt.exe106⤵PID:2348
-
\??\c:\7htbbt.exec:\7htbbt.exe107⤵PID:1996
-
\??\c:\9vpvv.exec:\9vpvv.exe108⤵PID:2124
-
\??\c:\vjpjj.exec:\vjpjj.exe109⤵PID:2172
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe110⤵PID:2732
-
\??\c:\7xxrxrx.exec:\7xxrxrx.exe111⤵PID:1716
-
\??\c:\btnthh.exec:\btnthh.exe112⤵PID:2740
-
\??\c:\ntbbbt.exec:\ntbbbt.exe113⤵PID:2712
-
\??\c:\vpdjp.exec:\vpdjp.exe114⤵PID:2692
-
\??\c:\5vdpv.exec:\5vdpv.exe115⤵PID:2420
-
\??\c:\9pvdd.exec:\9pvdd.exe116⤵PID:2752
-
\??\c:\rlrrfxx.exec:\rlrrfxx.exe117⤵PID:2648
-
\??\c:\9lxxffl.exec:\9lxxffl.exe118⤵PID:2756
-
\??\c:\bnbtnh.exec:\bnbtnh.exe119⤵PID:2660
-
\??\c:\nbnttb.exec:\nbnttb.exe120⤵PID:1924
-
\??\c:\1bhhbh.exec:\1bhhbh.exe121⤵PID:2008
-
\??\c:\9pddd.exec:\9pddd.exe122⤵PID:2020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-