Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 23:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d1f16f60145d85271316263c68ce630N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
7d1f16f60145d85271316263c68ce630N.exe
-
Size
72KB
-
MD5
7d1f16f60145d85271316263c68ce630
-
SHA1
0b92db84fd2b7e5b87900b1405ae000198260d55
-
SHA256
9a08580bc06b2575115a86d0e56f2ac69f0eeaab28b132cbc98334c4b30a4b9c
-
SHA512
bd3190149304e900e6cb49972398b26912692a62d9854fff1fefb17222b11c7b6004f4ff8403d9ec2436fde6345f1c387370e3dd6f5e8d96f8935bd017279003
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZ5RxfVK5DIlm:ymb3NkkiQ3mdBjF0yUmrfVc5
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2116-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/648-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2088 jvdvd.exe 2736 dpvvv.exe 1752 bntntt.exe 2816 jjddp.exe 1644 7rlxrrf.exe 2572 3nbhnt.exe 2548 jdvdj.exe 2980 lfxxffl.exe 276 7frrrrx.exe 2004 thnbtt.exe 1620 5vjjj.exe 2364 3djpp.exe 648 rflflff.exe 1032 9ffxffr.exe 1924 7hthbt.exe 2536 hbnbhh.exe 1520 jdpjp.exe 2416 rfxrfxf.exe 3000 xrffllr.exe 1716 btbtbh.exe 2856 htbttt.exe 1820 jvdjj.exe 2396 lfrrxrx.exe 236 lfxxfxl.exe 1812 1hhnth.exe 3044 htnttn.exe 1972 vjvvv.exe 2152 lxlflll.exe 2312 lffrflr.exe 2088 5nhthn.exe 2328 thnntt.exe 2228 vpdvd.exe 2680 9vjdj.exe 1752 1xlfflf.exe 2684 lfrxffl.exe 2908 tnhhtt.exe 2868 7hbtbb.exe 2804 vpppp.exe 2564 jdddj.exe 2552 7lxfrrl.exe 2996 5xrfxfr.exe 1708 hbntnn.exe 1988 bnnthh.exe 1744 tntbbt.exe 2360 jdpvd.exe 792 9vpvp.exe 320 xlxfffx.exe 1436 xlrxlll.exe 1548 hthbtt.exe 816 bthnhb.exe 2620 9vjdj.exe 2248 pdjvd.exe 688 1xxfllx.exe 2416 ntbhhb.exe 456 vpjjp.exe 2532 1vpvv.exe 1996 xrllfxr.exe 1940 lllffxf.exe 2212 ntnhbt.exe 1252 5tbnbn.exe 2464 jdppd.exe 2388 dpvdj.exe 708 lxlxxff.exe 1860 xrxflrx.exe -
resource yara_rule behavioral1/memory/2116-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/648-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2088 2116 7d1f16f60145d85271316263c68ce630N.exe 31 PID 2116 wrote to memory of 2088 2116 7d1f16f60145d85271316263c68ce630N.exe 31 PID 2116 wrote to memory of 2088 2116 7d1f16f60145d85271316263c68ce630N.exe 31 PID 2116 wrote to memory of 2088 2116 7d1f16f60145d85271316263c68ce630N.exe 31 PID 2088 wrote to memory of 2736 2088 jvdvd.exe 32 PID 2088 wrote to memory of 2736 2088 jvdvd.exe 32 PID 2088 wrote to memory of 2736 2088 jvdvd.exe 32 PID 2088 wrote to memory of 2736 2088 jvdvd.exe 32 PID 2736 wrote to memory of 1752 2736 dpvvv.exe 33 PID 2736 wrote to memory of 1752 2736 dpvvv.exe 33 PID 2736 wrote to memory of 1752 2736 dpvvv.exe 33 PID 2736 wrote to memory of 1752 2736 dpvvv.exe 33 PID 1752 wrote to memory of 2816 1752 bntntt.exe 34 PID 1752 wrote to memory of 2816 1752 bntntt.exe 34 PID 1752 wrote to memory of 2816 1752 bntntt.exe 34 PID 1752 wrote to memory of 2816 1752 bntntt.exe 34 PID 2816 wrote to memory of 1644 2816 jjddp.exe 35 PID 2816 wrote to memory of 1644 2816 jjddp.exe 35 PID 2816 wrote to memory of 1644 2816 jjddp.exe 35 PID 2816 wrote to memory of 1644 2816 jjddp.exe 35 PID 1644 wrote to memory of 2572 1644 7rlxrrf.exe 36 PID 1644 wrote to memory of 2572 1644 7rlxrrf.exe 36 PID 1644 wrote to memory of 2572 1644 7rlxrrf.exe 36 PID 1644 wrote to memory of 2572 1644 7rlxrrf.exe 36 PID 2572 wrote to memory of 2548 2572 3nbhnt.exe 37 PID 2572 wrote to memory of 2548 2572 3nbhnt.exe 37 PID 2572 wrote to memory of 2548 2572 3nbhnt.exe 37 PID 2572 wrote to memory of 2548 2572 3nbhnt.exe 37 PID 2548 wrote to memory of 2980 2548 jdvdj.exe 38 PID 2548 wrote to memory of 2980 2548 jdvdj.exe 38 PID 2548 wrote to memory of 2980 2548 jdvdj.exe 38 PID 2548 wrote to memory of 2980 2548 jdvdj.exe 38 PID 2980 wrote to memory of 276 2980 lfxxffl.exe 39 PID 2980 wrote to memory of 276 2980 lfxxffl.exe 39 PID 2980 wrote to memory of 276 2980 lfxxffl.exe 39 PID 2980 wrote to memory of 276 2980 lfxxffl.exe 39 PID 276 wrote to memory of 2004 276 7frrrrx.exe 40 PID 276 wrote to memory of 2004 276 7frrrrx.exe 40 PID 276 wrote to memory of 2004 276 7frrrrx.exe 40 PID 276 wrote to memory of 2004 276 7frrrrx.exe 40 PID 2004 wrote to memory of 1620 2004 thnbtt.exe 41 PID 2004 wrote to memory of 1620 2004 thnbtt.exe 41 PID 2004 wrote to memory of 1620 2004 thnbtt.exe 41 PID 2004 wrote to memory of 1620 2004 thnbtt.exe 41 PID 1620 wrote to memory of 2364 1620 5vjjj.exe 42 PID 1620 wrote to memory of 2364 1620 5vjjj.exe 42 PID 1620 wrote to memory of 2364 1620 5vjjj.exe 42 PID 1620 wrote to memory of 2364 1620 5vjjj.exe 42 PID 2364 wrote to memory of 648 2364 3djpp.exe 43 PID 2364 wrote to memory of 648 2364 3djpp.exe 43 PID 2364 wrote to memory of 648 2364 3djpp.exe 43 PID 2364 wrote to memory of 648 2364 3djpp.exe 43 PID 648 wrote to memory of 1032 648 rflflff.exe 44 PID 648 wrote to memory of 1032 648 rflflff.exe 44 PID 648 wrote to memory of 1032 648 rflflff.exe 44 PID 648 wrote to memory of 1032 648 rflflff.exe 44 PID 1032 wrote to memory of 1924 1032 9ffxffr.exe 45 PID 1032 wrote to memory of 1924 1032 9ffxffr.exe 45 PID 1032 wrote to memory of 1924 1032 9ffxffr.exe 45 PID 1032 wrote to memory of 1924 1032 9ffxffr.exe 45 PID 1924 wrote to memory of 2536 1924 7hthbt.exe 46 PID 1924 wrote to memory of 2536 1924 7hthbt.exe 46 PID 1924 wrote to memory of 2536 1924 7hthbt.exe 46 PID 1924 wrote to memory of 2536 1924 7hthbt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d1f16f60145d85271316263c68ce630N.exe"C:\Users\Admin\AppData\Local\Temp\7d1f16f60145d85271316263c68ce630N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\jvdvd.exec:\jvdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\dpvvv.exec:\dpvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\bntntt.exec:\bntntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\jjddp.exec:\jjddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\7rlxrrf.exec:\7rlxrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\3nbhnt.exec:\3nbhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\jdvdj.exec:\jdvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\lfxxffl.exec:\lfxxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\7frrrrx.exec:\7frrrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\thnbtt.exec:\thnbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\5vjjj.exec:\5vjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\3djpp.exec:\3djpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rflflff.exec:\rflflff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\9ffxffr.exec:\9ffxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\7hthbt.exec:\7hthbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\hbnbhh.exec:\hbnbhh.exe17⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jdpjp.exec:\jdpjp.exe18⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rfxrfxf.exec:\rfxrfxf.exe19⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xrffllr.exec:\xrffllr.exe20⤵
- Executes dropped EXE
PID:3000 -
\??\c:\btbtbh.exec:\btbtbh.exe21⤵
- Executes dropped EXE
PID:1716 -
\??\c:\htbttt.exec:\htbttt.exe22⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jvdjj.exec:\jvdjj.exe23⤵
- Executes dropped EXE
PID:1820 -
\??\c:\lfrrxrx.exec:\lfrrxrx.exe24⤵
- Executes dropped EXE
PID:2396 -
\??\c:\lfxxfxl.exec:\lfxxfxl.exe25⤵
- Executes dropped EXE
PID:236 -
\??\c:\1hhnth.exec:\1hhnth.exe26⤵
- Executes dropped EXE
PID:1812 -
\??\c:\htnttn.exec:\htnttn.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3044 -
\??\c:\vjvvv.exec:\vjvvv.exe28⤵
- Executes dropped EXE
PID:1972 -
\??\c:\lxlflll.exec:\lxlflll.exe29⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lffrflr.exec:\lffrflr.exe30⤵
- Executes dropped EXE
PID:2312 -
\??\c:\5nhthn.exec:\5nhthn.exe31⤵
- Executes dropped EXE
PID:2088 -
\??\c:\thnntt.exec:\thnntt.exe32⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vpdvd.exec:\vpdvd.exe33⤵
- Executes dropped EXE
PID:2228 -
\??\c:\9vjdj.exec:\9vjdj.exe34⤵
- Executes dropped EXE
PID:2680 -
\??\c:\1xlfflf.exec:\1xlfflf.exe35⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lfrxffl.exec:\lfrxffl.exe36⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tnhhtt.exec:\tnhhtt.exe37⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7hbtbb.exec:\7hbtbb.exe38⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vpppp.exec:\vpppp.exe39⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jdddj.exec:\jdddj.exe40⤵
- Executes dropped EXE
PID:2564 -
\??\c:\7lxfrrl.exec:\7lxfrrl.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\5xrfxfr.exec:\5xrfxfr.exe42⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hbntnn.exec:\hbntnn.exe43⤵
- Executes dropped EXE
PID:1708 -
\??\c:\bnnthh.exec:\bnnthh.exe44⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tntbbt.exec:\tntbbt.exe45⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jdpvd.exec:\jdpvd.exe46⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9vpvp.exec:\9vpvp.exe47⤵
- Executes dropped EXE
PID:792 -
\??\c:\xlxfffx.exec:\xlxfffx.exe48⤵
- Executes dropped EXE
PID:320 -
\??\c:\xlrxlll.exec:\xlrxlll.exe49⤵
- Executes dropped EXE
PID:1436 -
\??\c:\hthbtt.exec:\hthbtt.exe50⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bthnhb.exec:\bthnhb.exe51⤵
- Executes dropped EXE
PID:816 -
\??\c:\9vjdj.exec:\9vjdj.exe52⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pdjvd.exec:\pdjvd.exe53⤵
- Executes dropped EXE
PID:2248 -
\??\c:\1xxfllx.exec:\1xxfllx.exe54⤵
- Executes dropped EXE
PID:688 -
\??\c:\ntbhhb.exec:\ntbhhb.exe55⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vpjjp.exec:\vpjjp.exe56⤵
- Executes dropped EXE
PID:456 -
\??\c:\1vpvv.exec:\1vpvv.exe57⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xrllfxr.exec:\xrllfxr.exe58⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lllffxf.exec:\lllffxf.exe59⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ntnhbt.exec:\ntnhbt.exe60⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5tbnbn.exec:\5tbnbn.exe61⤵
- Executes dropped EXE
PID:1252 -
\??\c:\jdppd.exec:\jdppd.exe62⤵
- Executes dropped EXE
PID:2464 -
\??\c:\dpvdj.exec:\dpvdj.exe63⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lxlxxff.exec:\lxlxxff.exe64⤵
- Executes dropped EXE
PID:708 -
\??\c:\xrxflrx.exec:\xrxflrx.exe65⤵
- Executes dropped EXE
PID:1860 -
\??\c:\3bthnh.exec:\3bthnh.exe66⤵PID:1972
-
\??\c:\thnhhb.exec:\thnhhb.exe67⤵PID:2076
-
\??\c:\jdjjj.exec:\jdjjj.exe68⤵PID:1696
-
\??\c:\3xxrxxx.exec:\3xxrxxx.exe69⤵PID:2324
-
\??\c:\xfrflrr.exec:\xfrflrr.exe70⤵PID:2172
-
\??\c:\nbbttt.exec:\nbbttt.exe71⤵PID:2328
-
\??\c:\hbnbhb.exec:\hbnbhb.exe72⤵PID:2744
-
\??\c:\pdjdd.exec:\pdjdd.exe73⤵PID:2760
-
\??\c:\dpdpp.exec:\dpdpp.exe74⤵PID:2772
-
\??\c:\xlrrrxr.exec:\xlrrrxr.exe75⤵PID:2712
-
\??\c:\xlrfllf.exec:\xlrfllf.exe76⤵PID:2584
-
\??\c:\hbnbnt.exec:\hbnbnt.exe77⤵PID:2664
-
\??\c:\9hbbhh.exec:\9hbbhh.exe78⤵PID:2560
-
\??\c:\dppdj.exec:\dppdj.exe79⤵PID:3036
-
\??\c:\3vdvd.exec:\3vdvd.exe80⤵PID:2992
-
\??\c:\1pjdd.exec:\1pjdd.exe81⤵PID:884
-
\??\c:\1lxlllr.exec:\1lxlllr.exe82⤵PID:276
-
\??\c:\xrflxrr.exec:\xrflxrr.exe83⤵PID:1760
-
\??\c:\httbhh.exec:\httbhh.exe84⤵PID:1984
-
\??\c:\hbbttt.exec:\hbbttt.exe85⤵PID:592
-
\??\c:\vpjjd.exec:\vpjjd.exe86⤵PID:784
-
\??\c:\dpdvd.exec:\dpdvd.exe87⤵PID:1088
-
\??\c:\9frlxrx.exec:\9frlxrx.exe88⤵PID:1480
-
\??\c:\rrfxlrf.exec:\rrfxlrf.exe89⤵PID:1592
-
\??\c:\bnttth.exec:\bnttth.exe90⤵PID:2844
-
\??\c:\5tnnnn.exec:\5tnnnn.exe91⤵PID:2240
-
\??\c:\pdjpd.exec:\pdjpd.exe92⤵PID:1704
-
\??\c:\pppjp.exec:\pppjp.exe93⤵PID:1296
-
\??\c:\rlfrffl.exec:\rlfrffl.exe94⤵PID:2104
-
\??\c:\flrllff.exec:\flrllff.exe95⤵PID:2528
-
\??\c:\nhnhhn.exec:\nhnhhn.exe96⤵PID:972
-
\??\c:\hhnhnh.exec:\hhnhnh.exe97⤵PID:2188
-
\??\c:\vdpjj.exec:\vdpjj.exe98⤵PID:1820
-
\??\c:\pvvjd.exec:\pvvjd.exe99⤵PID:1772
-
\??\c:\rlllffr.exec:\rlllffr.exe100⤵PID:940
-
\??\c:\llxlxxf.exec:\llxlxxf.exe101⤵PID:1632
-
\??\c:\nhtbtb.exec:\nhtbtb.exe102⤵PID:1896
-
\??\c:\hhnnhn.exec:\hhnnhn.exe103⤵PID:3044
-
\??\c:\ppvpv.exec:\ppvpv.exe104⤵PID:2032
-
\??\c:\5dvdj.exec:\5dvdj.exe105⤵PID:2008
-
\??\c:\rlxrffl.exec:\rlxrffl.exe106⤵PID:1116
-
\??\c:\xxfflxr.exec:\xxfflxr.exe107⤵PID:2332
-
\??\c:\btntbb.exec:\btntbb.exe108⤵PID:1552
-
\??\c:\hbtntt.exec:\hbtntt.exe109⤵PID:1396
-
\??\c:\ddpdv.exec:\ddpdv.exe110⤵PID:2700
-
\??\c:\vpvvj.exec:\vpvvj.exe111⤵PID:2108
-
\??\c:\lfxfffr.exec:\lfxfffr.exe112⤵PID:2224
-
\??\c:\9xlxrxf.exec:\9xlxrxf.exe113⤵PID:2816
-
\??\c:\xlffflr.exec:\xlffflr.exe114⤵PID:1644
-
\??\c:\ttnnnt.exec:\ttnnnt.exe115⤵PID:2720
-
\??\c:\3nhbnh.exec:\3nhbnh.exe116⤵PID:2568
-
\??\c:\jdpvj.exec:\jdpvj.exe117⤵PID:2468
-
\??\c:\dvjdp.exec:\dvjdp.exe118⤵PID:1964
-
\??\c:\fxxfrxf.exec:\fxxfrxf.exe119⤵PID:1112
-
\??\c:\1rfxlrx.exec:\1rfxlrx.exe120⤵PID:1540
-
\??\c:\thbthh.exec:\thbthh.exe121⤵PID:580
-
\??\c:\btbthn.exec:\btbthn.exe122⤵PID:1816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-