Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 03:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b58fff930e892b84635f2a3054693a70N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
b58fff930e892b84635f2a3054693a70N.exe
-
Size
261KB
-
MD5
b58fff930e892b84635f2a3054693a70
-
SHA1
6531e70cd467de9461d1362cf2bf764d80ab4ec7
-
SHA256
1a773e6696b1afe09189e023a3e5be75f303df90692ae6cbbee8c543c228ade7
-
SHA512
a0f08f1fde5a8cdd0791f99c2fe8a4bf1e7995eca0beb1f0d0095097565b3f62c0092761fa0bb38098151101fe5e2fc06e1b4c5e2e86da8e9781045ab0672dce
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0qF:n3C9ytvn8whkb4i3e3GF/F
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/3048-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/308-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1400-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2508 hbhhnn.exe 308 nhttbh.exe 2680 5vjpj.exe 2716 bnttbn.exe 2796 ppdjd.exe 2748 7pddp.exe 2924 htbbhb.exe 1720 3pddj.exe 2664 fxrfxfl.exe 3028 nnbtbb.exe 1684 9vjjp.exe 1400 lfrlxfl.exe 1688 rlxflll.exe 2108 3nnhnh.exe 1932 dppjp.exe 772 bbtbhb.exe 1788 htbhtn.exe 600 llfxfll.exe 2244 5rrrllx.exe 2684 9dpjv.exe 1904 pjvdp.exe 2568 xxrrffl.exe 844 nhbhtt.exe 2148 pjvdj.exe 1288 lfrlfff.exe 2128 hhtthh.exe 1728 bbtbnn.exe 2348 xrffrrx.exe 1864 nhnhbb.exe 2156 3dddp.exe 2520 fxlrxxx.exe 2564 nhtntn.exe 2672 7nhbhh.exe 1604 jjppv.exe 2776 llrlrll.exe 2844 rlfxffl.exe 2732 3nttbb.exe 2704 dddjd.exe 2840 jpvdp.exe 2628 5xxfrfx.exe 2924 rfxflfl.exe 2700 ththbh.exe 2636 7jppd.exe 680 vvjvp.exe 1364 lfllffx.exe 1948 7xfxflf.exe 1952 tnbnbn.exe 2040 jdpvd.exe 1748 vpddp.exe 288 xxxfrxl.exe 1932 fxlrrxl.exe 772 1nnhht.exe 988 pjdjd.exe 2460 pjjdj.exe 2464 fxrrrrr.exe 576 bbtbbt.exe 2684 tnhthn.exe 1444 vvpjd.exe 992 pjvvd.exe 344 5lfrxlx.exe 1640 bntttb.exe 1304 hbtbnt.exe 2164 dvppj.exe 2024 5jvjj.exe -
resource yara_rule behavioral1/memory/3048-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/308-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1400-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2508 3048 b58fff930e892b84635f2a3054693a70N.exe 31 PID 3048 wrote to memory of 2508 3048 b58fff930e892b84635f2a3054693a70N.exe 31 PID 3048 wrote to memory of 2508 3048 b58fff930e892b84635f2a3054693a70N.exe 31 PID 3048 wrote to memory of 2508 3048 b58fff930e892b84635f2a3054693a70N.exe 31 PID 2508 wrote to memory of 308 2508 hbhhnn.exe 32 PID 2508 wrote to memory of 308 2508 hbhhnn.exe 32 PID 2508 wrote to memory of 308 2508 hbhhnn.exe 32 PID 2508 wrote to memory of 308 2508 hbhhnn.exe 32 PID 308 wrote to memory of 2680 308 nhttbh.exe 33 PID 308 wrote to memory of 2680 308 nhttbh.exe 33 PID 308 wrote to memory of 2680 308 nhttbh.exe 33 PID 308 wrote to memory of 2680 308 nhttbh.exe 33 PID 2680 wrote to memory of 2716 2680 5vjpj.exe 34 PID 2680 wrote to memory of 2716 2680 5vjpj.exe 34 PID 2680 wrote to memory of 2716 2680 5vjpj.exe 34 PID 2680 wrote to memory of 2716 2680 5vjpj.exe 34 PID 2716 wrote to memory of 2796 2716 bnttbn.exe 35 PID 2716 wrote to memory of 2796 2716 bnttbn.exe 35 PID 2716 wrote to memory of 2796 2716 bnttbn.exe 35 PID 2716 wrote to memory of 2796 2716 bnttbn.exe 35 PID 2796 wrote to memory of 2748 2796 ppdjd.exe 36 PID 2796 wrote to memory of 2748 2796 ppdjd.exe 36 PID 2796 wrote to memory of 2748 2796 ppdjd.exe 36 PID 2796 wrote to memory of 2748 2796 ppdjd.exe 36 PID 2748 wrote to memory of 2924 2748 7pddp.exe 37 PID 2748 wrote to memory of 2924 2748 7pddp.exe 37 PID 2748 wrote to memory of 2924 2748 7pddp.exe 37 PID 2748 wrote to memory of 2924 2748 7pddp.exe 37 PID 2924 wrote to memory of 1720 2924 htbbhb.exe 38 PID 2924 wrote to memory of 1720 2924 htbbhb.exe 38 PID 2924 wrote to memory of 1720 2924 htbbhb.exe 38 PID 2924 wrote to memory of 1720 2924 htbbhb.exe 38 PID 1720 wrote to memory of 2664 1720 3pddj.exe 39 PID 1720 wrote to memory of 2664 1720 3pddj.exe 39 PID 1720 wrote to memory of 2664 1720 3pddj.exe 39 PID 1720 wrote to memory of 2664 1720 3pddj.exe 39 PID 2664 wrote to memory of 3028 2664 fxrfxfl.exe 40 PID 2664 wrote to memory of 3028 2664 fxrfxfl.exe 40 PID 2664 wrote to memory of 3028 2664 fxrfxfl.exe 40 PID 2664 wrote to memory of 3028 2664 fxrfxfl.exe 40 PID 3028 wrote to memory of 1684 3028 nnbtbb.exe 41 PID 3028 wrote to memory of 1684 3028 nnbtbb.exe 41 PID 3028 wrote to memory of 1684 3028 nnbtbb.exe 41 PID 3028 wrote to memory of 1684 3028 nnbtbb.exe 41 PID 1684 wrote to memory of 1400 1684 9vjjp.exe 42 PID 1684 wrote to memory of 1400 1684 9vjjp.exe 42 PID 1684 wrote to memory of 1400 1684 9vjjp.exe 42 PID 1684 wrote to memory of 1400 1684 9vjjp.exe 42 PID 1400 wrote to memory of 1688 1400 lfrlxfl.exe 43 PID 1400 wrote to memory of 1688 1400 lfrlxfl.exe 43 PID 1400 wrote to memory of 1688 1400 lfrlxfl.exe 43 PID 1400 wrote to memory of 1688 1400 lfrlxfl.exe 43 PID 1688 wrote to memory of 2108 1688 rlxflll.exe 44 PID 1688 wrote to memory of 2108 1688 rlxflll.exe 44 PID 1688 wrote to memory of 2108 1688 rlxflll.exe 44 PID 1688 wrote to memory of 2108 1688 rlxflll.exe 44 PID 2108 wrote to memory of 1932 2108 3nnhnh.exe 45 PID 2108 wrote to memory of 1932 2108 3nnhnh.exe 45 PID 2108 wrote to memory of 1932 2108 3nnhnh.exe 45 PID 2108 wrote to memory of 1932 2108 3nnhnh.exe 45 PID 1932 wrote to memory of 772 1932 dppjp.exe 46 PID 1932 wrote to memory of 772 1932 dppjp.exe 46 PID 1932 wrote to memory of 772 1932 dppjp.exe 46 PID 1932 wrote to memory of 772 1932 dppjp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b58fff930e892b84635f2a3054693a70N.exe"C:\Users\Admin\AppData\Local\Temp\b58fff930e892b84635f2a3054693a70N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\hbhhnn.exec:\hbhhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\nhttbh.exec:\nhttbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\5vjpj.exec:\5vjpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bnttbn.exec:\bnttbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\ppdjd.exec:\ppdjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\7pddp.exec:\7pddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\htbbhb.exec:\htbbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\3pddj.exec:\3pddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\fxrfxfl.exec:\fxrfxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\nnbtbb.exec:\nnbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\9vjjp.exec:\9vjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\lfrlxfl.exec:\lfrlxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\rlxflll.exec:\rlxflll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\3nnhnh.exec:\3nnhnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\dppjp.exec:\dppjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\bbtbhb.exec:\bbtbhb.exe17⤵
- Executes dropped EXE
PID:772 -
\??\c:\htbhtn.exec:\htbhtn.exe18⤵
- Executes dropped EXE
PID:1788 -
\??\c:\llfxfll.exec:\llfxfll.exe19⤵
- Executes dropped EXE
PID:600 -
\??\c:\5rrrllx.exec:\5rrrllx.exe20⤵
- Executes dropped EXE
PID:2244 -
\??\c:\9dpjv.exec:\9dpjv.exe21⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pjvdp.exec:\pjvdp.exe22⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xxrrffl.exec:\xxrrffl.exe23⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nhbhtt.exec:\nhbhtt.exe24⤵
- Executes dropped EXE
PID:844 -
\??\c:\pjvdj.exec:\pjvdj.exe25⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lfrlfff.exec:\lfrlfff.exe26⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hhtthh.exec:\hhtthh.exe27⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bbtbnn.exec:\bbtbnn.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xrffrrx.exec:\xrffrrx.exe29⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nhnhbb.exec:\nhnhbb.exe30⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3dddp.exec:\3dddp.exe31⤵
- Executes dropped EXE
PID:2156 -
\??\c:\fxlrxxx.exec:\fxlrxxx.exe32⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nhtntn.exec:\nhtntn.exe33⤵
- Executes dropped EXE
PID:2564 -
\??\c:\7nhbhh.exec:\7nhbhh.exe34⤵
- Executes dropped EXE
PID:2672 -
\??\c:\jjppv.exec:\jjppv.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\llrlrll.exec:\llrlrll.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rlfxffl.exec:\rlfxffl.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3nttbb.exec:\3nttbb.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\dddjd.exec:\dddjd.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jpvdp.exec:\jpvdp.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5xxfrfx.exec:\5xxfrfx.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rfxflfl.exec:\rfxflfl.exe42⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ththbh.exec:\ththbh.exe43⤵
- Executes dropped EXE
PID:2700 -
\??\c:\7jppd.exec:\7jppd.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vvjvp.exec:\vvjvp.exe45⤵
- Executes dropped EXE
PID:680 -
\??\c:\lfllffx.exec:\lfllffx.exe46⤵
- Executes dropped EXE
PID:1364 -
\??\c:\7xfxflf.exec:\7xfxflf.exe47⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tnbnbn.exec:\tnbnbn.exe48⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jdpvd.exec:\jdpvd.exe49⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vpddp.exec:\vpddp.exe50⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe51⤵
- Executes dropped EXE
PID:288 -
\??\c:\fxlrrxl.exec:\fxlrrxl.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1nnhht.exec:\1nnhht.exe53⤵
- Executes dropped EXE
PID:772 -
\??\c:\pjdjd.exec:\pjdjd.exe54⤵
- Executes dropped EXE
PID:988 -
\??\c:\pjjdj.exec:\pjjdj.exe55⤵
- Executes dropped EXE
PID:2460 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe56⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bbtbbt.exec:\bbtbbt.exe57⤵
- Executes dropped EXE
PID:576 -
\??\c:\tnhthn.exec:\tnhthn.exe58⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vvpjd.exec:\vvpjd.exe59⤵
- Executes dropped EXE
PID:1444 -
\??\c:\pjvvd.exec:\pjvvd.exe60⤵
- Executes dropped EXE
PID:992 -
\??\c:\5lfrxlx.exec:\5lfrxlx.exe61⤵
- Executes dropped EXE
PID:344 -
\??\c:\bntttb.exec:\bntttb.exe62⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hbtbnt.exec:\hbtbnt.exe63⤵
- Executes dropped EXE
PID:1304 -
\??\c:\dvppj.exec:\dvppj.exe64⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5jvjj.exec:\5jvjj.exe65⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3lrflff.exec:\3lrflff.exe66⤵PID:2364
-
\??\c:\ttbthh.exec:\ttbthh.exe67⤵PID:2124
-
\??\c:\1nttbb.exec:\1nttbb.exe68⤵PID:1612
-
\??\c:\5jpvv.exec:\5jpvv.exe69⤵PID:2476
-
\??\c:\9jddj.exec:\9jddj.exe70⤵PID:884
-
\??\c:\xrxxffl.exec:\xrxxffl.exe71⤵PID:2668
-
\??\c:\tnnhbh.exec:\tnnhbh.exe72⤵PID:2868
-
\??\c:\nnbhnt.exec:\nnbhnt.exe73⤵PID:2284
-
\??\c:\dpjjp.exec:\dpjjp.exe74⤵PID:1704
-
\??\c:\3vpjj.exec:\3vpjj.exe75⤵PID:1608
-
\??\c:\rfrlrll.exec:\rfrlrll.exe76⤵PID:3036
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe77⤵PID:2812
-
\??\c:\9thhbt.exec:\9thhbt.exe78⤵PID:2144
-
\??\c:\1vpjp.exec:\1vpjp.exe79⤵PID:2748
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe80⤵PID:2784
-
\??\c:\lllrfrf.exec:\lllrfrf.exe81⤵PID:2768
-
\??\c:\1hntnt.exec:\1hntnt.exe82⤵PID:1744
-
\??\c:\bnbbtt.exec:\bnbbtt.exe83⤵PID:2700
-
\??\c:\ppjpv.exec:\ppjpv.exe84⤵PID:1676
-
\??\c:\llxflrr.exec:\llxflrr.exe85⤵PID:680
-
\??\c:\5fxxxxx.exec:\5fxxxxx.exe86⤵PID:1780
-
\??\c:\hbhntb.exec:\hbhntb.exe87⤵PID:2320
-
\??\c:\hbhbhb.exec:\hbhbhb.exe88⤵PID:2116
-
\??\c:\5dpvd.exec:\5dpvd.exe89⤵PID:1672
-
\??\c:\fxllxlr.exec:\fxllxlr.exe90⤵PID:2064
-
\??\c:\rllxlrx.exec:\rllxlrx.exe91⤵PID:288
-
\??\c:\9hnnbt.exec:\9hnnbt.exe92⤵PID:2872
-
\??\c:\hbhtbt.exec:\hbhtbt.exe93⤵PID:2912
-
\??\c:\9djjj.exec:\9djjj.exe94⤵PID:528
-
\??\c:\fxxfrxr.exec:\fxxfrxr.exe95⤵PID:2252
-
\??\c:\7nhnth.exec:\7nhnth.exe96⤵PID:2464
-
\??\c:\nhbnhn.exec:\nhbnhn.exe97⤵PID:576
-
\??\c:\3jddj.exec:\3jddj.exe98⤵PID:1480
-
\??\c:\xrlrflf.exec:\xrlrflf.exe99⤵PID:968
-
\??\c:\rrrrffx.exec:\rrrrffx.exe100⤵PID:1980
-
\??\c:\tnbbht.exec:\tnbbht.exe101⤵PID:1080
-
\??\c:\btnthh.exec:\btnthh.exe102⤵PID:2540
-
\??\c:\ddvvv.exec:\ddvvv.exe103⤵PID:1280
-
\??\c:\vpjpd.exec:\vpjpd.exe104⤵PID:2164
-
\??\c:\rrllxfr.exec:\rrllxfr.exe105⤵PID:2024
-
\??\c:\tbthtb.exec:\tbthtb.exe106⤵PID:1532
-
\??\c:\tnhhnt.exec:\tnhhnt.exe107⤵PID:2372
-
\??\c:\pdpvv.exec:\pdpvv.exe108⤵PID:1800
-
\??\c:\dppvj.exec:\dppvj.exe109⤵PID:2156
-
\??\c:\rllxlxf.exec:\rllxlxf.exe110⤵PID:2496
-
\??\c:\frflrfl.exec:\frflrfl.exe111⤵PID:2344
-
\??\c:\nhnbhn.exec:\nhnbhn.exe112⤵PID:2876
-
\??\c:\ppddp.exec:\ppddp.exe113⤵PID:1708
-
\??\c:\7jvvd.exec:\7jvvd.exe114⤵PID:2304
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe115⤵PID:1608
-
\??\c:\bthntt.exec:\bthntt.exe116⤵PID:2776
-
\??\c:\hhttbb.exec:\hhttbb.exe117⤵PID:2812
-
\??\c:\ddppv.exec:\ddppv.exe118⤵PID:2704
-
\??\c:\3lflrrx.exec:\3lflrrx.exe119⤵PID:2748
-
\??\c:\hhbhtt.exec:\hhbhtt.exe120⤵PID:2840
-
\??\c:\ttbnth.exec:\ttbnth.exe121⤵PID:2768
-
\??\c:\vjvvd.exec:\vjvvd.exe122⤵PID:3016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-