Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 07:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f8c30f149f670ce7a96ba5020161b70N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
5f8c30f149f670ce7a96ba5020161b70N.exe
-
Size
92KB
-
MD5
5f8c30f149f670ce7a96ba5020161b70
-
SHA1
042d866cb6d7283789a75663f351d3c1b6b9f7cb
-
SHA256
9b94ebbd375a6e2a42d2b16fb42ff34277eb7627f924aa35e73f54a3c7ff1776
-
SHA512
14ec7ec5c1e12cd6f1b1b80d06de2a0f06b19600b2a01dc80b87f75041708915bc3ff2a49fac3dce2e8d359dc946b4b902ff0fe8958e18814bbfa9132f29d709
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBz:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBV5
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2156-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/928-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2716 ppppj.exe 2712 vvpdd.exe 2168 9ttbbb.exe 2584 7vdjj.exe 2572 ttnhtt.exe 1908 1ttnht.exe 3036 3fxflrf.exe 1152 bhnnht.exe 2984 7vdpv.exe 856 5pdjp.exe 2224 1rlxlrf.exe 2896 hnnnbt.exe 2104 5vpvd.exe 2660 jppvd.exe 1108 xrlxrlf.exe 584 xxrrrxl.exe 2020 pppdv.exe 2164 9jjpj.exe 1684 rrfxlxf.exe 2436 lxxxllx.exe 948 nnhnbb.exe 2456 dvppv.exe 928 7rlrflf.exe 1788 hhthht.exe 1504 hbbthh.exe 896 3xrxxxl.exe 1072 hbhntb.exe 876 3dvjp.exe 1856 vdpjv.exe 2716 1frrrfl.exe 2792 bbbbtt.exe 2956 hbthtn.exe 2840 pjdjv.exe 2672 rllrxfl.exe 2592 9frflfl.exe 2560 1ttnth.exe 1672 bbhhnn.exe 828 dvpvd.exe 1064 rlxxfrx.exe 1464 llxfllx.exe 2004 tbttnb.exe 2976 hbntbb.exe 280 3pjvd.exe 2888 ppdpj.exe 2224 xrxxxlx.exe 2152 7nhhtt.exe 3064 bbbthh.exe 1924 jpddp.exe 552 3jdvd.exe 1108 rlrxxlr.exe 1760 3xfflrl.exe 2388 tbnhbb.exe 2428 pjddj.exe 2220 vvpdd.exe 2140 xrlrlrf.exe 1972 xflllff.exe 2216 3btbtb.exe 2092 bbtbnt.exe 912 7ddjj.exe 928 vpvvv.exe 1928 rlfrxxr.exe 2476 1xrfrrx.exe 3024 btnthh.exe 1000 nnnbnh.exe -
resource yara_rule behavioral1/memory/2156-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2716 2156 5f8c30f149f670ce7a96ba5020161b70N.exe 30 PID 2156 wrote to memory of 2716 2156 5f8c30f149f670ce7a96ba5020161b70N.exe 30 PID 2156 wrote to memory of 2716 2156 5f8c30f149f670ce7a96ba5020161b70N.exe 30 PID 2156 wrote to memory of 2716 2156 5f8c30f149f670ce7a96ba5020161b70N.exe 30 PID 2716 wrote to memory of 2712 2716 ppppj.exe 31 PID 2716 wrote to memory of 2712 2716 ppppj.exe 31 PID 2716 wrote to memory of 2712 2716 ppppj.exe 31 PID 2716 wrote to memory of 2712 2716 ppppj.exe 31 PID 2712 wrote to memory of 2168 2712 vvpdd.exe 32 PID 2712 wrote to memory of 2168 2712 vvpdd.exe 32 PID 2712 wrote to memory of 2168 2712 vvpdd.exe 32 PID 2712 wrote to memory of 2168 2712 vvpdd.exe 32 PID 2168 wrote to memory of 2584 2168 9ttbbb.exe 33 PID 2168 wrote to memory of 2584 2168 9ttbbb.exe 33 PID 2168 wrote to memory of 2584 2168 9ttbbb.exe 33 PID 2168 wrote to memory of 2584 2168 9ttbbb.exe 33 PID 2584 wrote to memory of 2572 2584 7vdjj.exe 34 PID 2584 wrote to memory of 2572 2584 7vdjj.exe 34 PID 2584 wrote to memory of 2572 2584 7vdjj.exe 34 PID 2584 wrote to memory of 2572 2584 7vdjj.exe 34 PID 2572 wrote to memory of 1908 2572 ttnhtt.exe 35 PID 2572 wrote to memory of 1908 2572 ttnhtt.exe 35 PID 2572 wrote to memory of 1908 2572 ttnhtt.exe 35 PID 2572 wrote to memory of 1908 2572 ttnhtt.exe 35 PID 1908 wrote to memory of 3036 1908 1ttnht.exe 36 PID 1908 wrote to memory of 3036 1908 1ttnht.exe 36 PID 1908 wrote to memory of 3036 1908 1ttnht.exe 36 PID 1908 wrote to memory of 3036 1908 1ttnht.exe 36 PID 3036 wrote to memory of 1152 3036 3fxflrf.exe 37 PID 3036 wrote to memory of 1152 3036 3fxflrf.exe 37 PID 3036 wrote to memory of 1152 3036 3fxflrf.exe 37 PID 3036 wrote to memory of 1152 3036 3fxflrf.exe 37 PID 1152 wrote to memory of 2984 1152 bhnnht.exe 38 PID 1152 wrote to memory of 2984 1152 bhnnht.exe 38 PID 1152 wrote to memory of 2984 1152 bhnnht.exe 38 PID 1152 wrote to memory of 2984 1152 bhnnht.exe 38 PID 2984 wrote to memory of 856 2984 7vdpv.exe 39 PID 2984 wrote to memory of 856 2984 7vdpv.exe 39 PID 2984 wrote to memory of 856 2984 7vdpv.exe 39 PID 2984 wrote to memory of 856 2984 7vdpv.exe 39 PID 856 wrote to memory of 2224 856 5pdjp.exe 40 PID 856 wrote to memory of 2224 856 5pdjp.exe 40 PID 856 wrote to memory of 2224 856 5pdjp.exe 40 PID 856 wrote to memory of 2224 856 5pdjp.exe 40 PID 2224 wrote to memory of 2896 2224 1rlxlrf.exe 41 PID 2224 wrote to memory of 2896 2224 1rlxlrf.exe 41 PID 2224 wrote to memory of 2896 2224 1rlxlrf.exe 41 PID 2224 wrote to memory of 2896 2224 1rlxlrf.exe 41 PID 2896 wrote to memory of 2104 2896 hnnnbt.exe 42 PID 2896 wrote to memory of 2104 2896 hnnnbt.exe 42 PID 2896 wrote to memory of 2104 2896 hnnnbt.exe 42 PID 2896 wrote to memory of 2104 2896 hnnnbt.exe 42 PID 2104 wrote to memory of 2660 2104 5vpvd.exe 43 PID 2104 wrote to memory of 2660 2104 5vpvd.exe 43 PID 2104 wrote to memory of 2660 2104 5vpvd.exe 43 PID 2104 wrote to memory of 2660 2104 5vpvd.exe 43 PID 2660 wrote to memory of 1108 2660 jppvd.exe 44 PID 2660 wrote to memory of 1108 2660 jppvd.exe 44 PID 2660 wrote to memory of 1108 2660 jppvd.exe 44 PID 2660 wrote to memory of 1108 2660 jppvd.exe 44 PID 1108 wrote to memory of 584 1108 xrlxrlf.exe 45 PID 1108 wrote to memory of 584 1108 xrlxrlf.exe 45 PID 1108 wrote to memory of 584 1108 xrlxrlf.exe 45 PID 1108 wrote to memory of 584 1108 xrlxrlf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f8c30f149f670ce7a96ba5020161b70N.exe"C:\Users\Admin\AppData\Local\Temp\5f8c30f149f670ce7a96ba5020161b70N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\ppppj.exec:\ppppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\vvpdd.exec:\vvpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\9ttbbb.exec:\9ttbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\7vdjj.exec:\7vdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\ttnhtt.exec:\ttnhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\1ttnht.exec:\1ttnht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\3fxflrf.exec:\3fxflrf.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\bhnnht.exec:\bhnnht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\7vdpv.exec:\7vdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\5pdjp.exec:\5pdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\1rlxlrf.exec:\1rlxlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\hnnnbt.exec:\hnnnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\5vpvd.exec:\5vpvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\jppvd.exec:\jppvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\xrlxrlf.exec:\xrlxrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\xxrrrxl.exec:\xxrrrxl.exe17⤵
- Executes dropped EXE
PID:584 -
\??\c:\pppdv.exec:\pppdv.exe18⤵
- Executes dropped EXE
PID:2020 -
\??\c:\9jjpj.exec:\9jjpj.exe19⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rrfxlxf.exec:\rrfxlxf.exe20⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lxxxllx.exec:\lxxxllx.exe21⤵
- Executes dropped EXE
PID:2436 -
\??\c:\nnhnbb.exec:\nnhnbb.exe22⤵
- Executes dropped EXE
PID:948 -
\??\c:\dvppv.exec:\dvppv.exe23⤵
- Executes dropped EXE
PID:2456 -
\??\c:\7rlrflf.exec:\7rlrflf.exe24⤵
- Executes dropped EXE
PID:928 -
\??\c:\hhthht.exec:\hhthht.exe25⤵
- Executes dropped EXE
PID:1788 -
\??\c:\hbbthh.exec:\hbbthh.exe26⤵
- Executes dropped EXE
PID:1504 -
\??\c:\3xrxxxl.exec:\3xrxxxl.exe27⤵
- Executes dropped EXE
PID:896 -
\??\c:\hbhntb.exec:\hbhntb.exe28⤵
- Executes dropped EXE
PID:1072 -
\??\c:\3dvjp.exec:\3dvjp.exe29⤵
- Executes dropped EXE
PID:876 -
\??\c:\vdpjv.exec:\vdpjv.exe30⤵
- Executes dropped EXE
PID:1856 -
\??\c:\1frrrfl.exec:\1frrrfl.exe31⤵
- Executes dropped EXE
PID:2716 -
\??\c:\bbbbtt.exec:\bbbbtt.exe32⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hbthtn.exec:\hbthtn.exe33⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pjdjv.exec:\pjdjv.exe34⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rllrxfl.exec:\rllrxfl.exe35⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9frflfl.exec:\9frflfl.exe36⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1ttnth.exec:\1ttnth.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bbhhnn.exec:\bbhhnn.exe38⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dvpvd.exec:\dvpvd.exe39⤵
- Executes dropped EXE
PID:828 -
\??\c:\rlxxfrx.exec:\rlxxfrx.exe40⤵
- Executes dropped EXE
PID:1064 -
\??\c:\llxfllx.exec:\llxfllx.exe41⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tbttnb.exec:\tbttnb.exe42⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hbntbb.exec:\hbntbb.exe43⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3pjvd.exec:\3pjvd.exe44⤵
- Executes dropped EXE
PID:280 -
\??\c:\ppdpj.exec:\ppdpj.exe45⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xrxxxlx.exec:\xrxxxlx.exe46⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7nhhtt.exec:\7nhhtt.exe47⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bbbthh.exec:\bbbthh.exe48⤵
- Executes dropped EXE
PID:3064 -
\??\c:\jpddp.exec:\jpddp.exe49⤵
- Executes dropped EXE
PID:1924 -
\??\c:\3jdvd.exec:\3jdvd.exe50⤵
- Executes dropped EXE
PID:552 -
\??\c:\rlrxxlr.exec:\rlrxxlr.exe51⤵
- Executes dropped EXE
PID:1108 -
\??\c:\3xfflrl.exec:\3xfflrl.exe52⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tbnhbb.exec:\tbnhbb.exe53⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pjddj.exec:\pjddj.exe54⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vvpdd.exec:\vvpdd.exe55⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xrlrlrf.exec:\xrlrlrf.exe56⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xflllff.exec:\xflllff.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3btbtb.exec:\3btbtb.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bbtbnt.exec:\bbtbnt.exe59⤵
- Executes dropped EXE
PID:2092 -
\??\c:\7ddjj.exec:\7ddjj.exe60⤵
- Executes dropped EXE
PID:912 -
\??\c:\vpvvv.exec:\vpvvv.exe61⤵
- Executes dropped EXE
PID:928 -
\??\c:\rlfrxxr.exec:\rlfrxxr.exe62⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1xrfrrx.exec:\1xrfrrx.exe63⤵
- Executes dropped EXE
PID:2476 -
\??\c:\btnthh.exec:\btnthh.exe64⤵
- Executes dropped EXE
PID:3024 -
\??\c:\nnnbnh.exec:\nnnbnh.exe65⤵
- Executes dropped EXE
PID:1000 -
\??\c:\pjpdj.exec:\pjpdj.exe66⤵PID:2304
-
\??\c:\fxxxrlx.exec:\fxxxrlx.exe67⤵PID:296
-
\??\c:\3xxllxr.exec:\3xxllxr.exe68⤵PID:2156
-
\??\c:\hhtbhn.exec:\hhtbhn.exe69⤵PID:1584
-
\??\c:\hnnnbt.exec:\hnnnbt.exe70⤵PID:2796
-
\??\c:\7djjd.exec:\7djjd.exe71⤵PID:2852
-
\??\c:\vvvdp.exec:\vvvdp.exe72⤵PID:2956
-
\??\c:\fxlxfrl.exec:\fxlxfrl.exe73⤵PID:2648
-
\??\c:\ffrxxxr.exec:\ffrxxxr.exe74⤵PID:2904
-
\??\c:\5thbtt.exec:\5thbtt.exe75⤵PID:2612
-
\??\c:\nbtbht.exec:\nbtbht.exe76⤵PID:2812
-
\??\c:\vpddp.exec:\vpddp.exe77⤵PID:1672
-
\??\c:\pjvdp.exec:\pjvdp.exe78⤵PID:1780
-
\??\c:\3lxxrxl.exec:\3lxxrxl.exe79⤵PID:1064
-
\??\c:\bhtbnn.exec:\bhtbnn.exe80⤵PID:1620
-
\??\c:\hbnntn.exec:\hbnntn.exe81⤵PID:1152
-
\??\c:\pvdvp.exec:\pvdvp.exe82⤵PID:2540
-
\??\c:\vpdjp.exec:\vpdjp.exe83⤵PID:2236
-
\??\c:\lfxxffr.exec:\lfxxffr.exe84⤵PID:2736
-
\??\c:\fxrlxrx.exec:\fxrlxrx.exe85⤵PID:2924
-
\??\c:\nhbntt.exec:\nhbntt.exe86⤵PID:2200
-
\??\c:\thhntb.exec:\thhntb.exe87⤵PID:2364
-
\??\c:\5vdpv.exec:\5vdpv.exe88⤵PID:320
-
\??\c:\pdppj.exec:\pdppj.exe89⤵PID:552
-
\??\c:\5fxfxxl.exec:\5fxfxxl.exe90⤵PID:1308
-
\??\c:\rrxlfxx.exec:\rrxlfxx.exe91⤵PID:1760
-
\??\c:\nhbhtt.exec:\nhbhtt.exe92⤵PID:2380
-
\??\c:\nhbhhh.exec:\nhbhhh.exe93⤵PID:2064
-
\??\c:\5dppv.exec:\5dppv.exe94⤵PID:2220
-
\??\c:\9dddd.exec:\9dddd.exe95⤵PID:2116
-
\??\c:\lfxxflr.exec:\lfxxflr.exe96⤵PID:1972
-
\??\c:\tnbttt.exec:\tnbttt.exe97⤵PID:2216
-
\??\c:\nhtbnn.exec:\nhtbnn.exe98⤵PID:568
-
\??\c:\dvppp.exec:\dvppp.exe99⤵PID:1536
-
\??\c:\7jppj.exec:\7jppj.exe100⤵PID:1744
-
\??\c:\9lxxflr.exec:\9lxxflr.exe101⤵PID:1928
-
\??\c:\lfllrlx.exec:\lfllrlx.exe102⤵PID:2476
-
\??\c:\htnbhn.exec:\htnbhn.exe103⤵PID:3024
-
\??\c:\tnhbbh.exec:\tnhbbh.exe104⤵PID:1000
-
\??\c:\pjjpd.exec:\pjjpd.exe105⤵PID:2128
-
\??\c:\7jvdd.exec:\7jvdd.exe106⤵PID:296
-
\??\c:\rllflll.exec:\rllflll.exe107⤵PID:1692
-
\??\c:\3lxxflr.exec:\3lxxflr.exe108⤵PID:1584
-
\??\c:\tnbtbb.exec:\tnbtbb.exe109⤵PID:2796
-
\??\c:\bhnhnh.exec:\bhnhnh.exe110⤵PID:2852
-
\??\c:\7vpvd.exec:\7vpvd.exe111⤵PID:2580
-
\??\c:\fxxrlrx.exec:\fxxrlrx.exe112⤵PID:2624
-
\??\c:\fxfxllr.exec:\fxfxllr.exe113⤵PID:2608
-
\??\c:\1nnbnt.exec:\1nnbnt.exe114⤵PID:2612
-
\??\c:\1btbhn.exec:\1btbhn.exe115⤵PID:2812
-
\??\c:\dpddj.exec:\dpddj.exe116⤵PID:1076
-
\??\c:\pddvv.exec:\pddvv.exe117⤵PID:1944
-
\??\c:\xlrlrxf.exec:\xlrlrxf.exe118⤵PID:1064
-
\??\c:\xlflllr.exec:\xlflllr.exe119⤵PID:2988
-
\??\c:\nhbbnh.exec:\nhbbnh.exe120⤵PID:1152
-
\??\c:\1btnhh.exec:\1btnhh.exe121⤵PID:2540
-
\??\c:\7jvpd.exec:\7jvpd.exe122⤵PID:2236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-