Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 07:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe
-
Size
68KB
-
MD5
170e0d450d0b9b23a4ab9f5055cb4700
-
SHA1
c2ecaea7c6dad88c8c654c5abea63ffca8e5432a
-
SHA256
2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308
-
SHA512
cf21353c7b73f35139cf940335c827d849aa28d243e6671f0526749897a9a467ee712d78e0c2e651d2dcb2acb4b9ff283ac4a292e1330c003d5dc1449d000032
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcZ:ymb3NkkiQ3mdBjFIsIVcZ
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/3016-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/880-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2536 ffrlxxf.exe 1848 nntntt.exe 2344 hbbtnb.exe 2900 7xllllr.exe 2744 htnhtb.exe 2828 dpvpp.exe 2656 lrlfxrx.exe 1732 nbhntb.exe 1620 hhhnhn.exe 2364 jvdpv.exe 1048 lfxxfff.exe 2860 thbhbh.exe 2508 nhhtbb.exe 1324 3pppv.exe 2712 3vpjp.exe 1320 fxxflxr.exe 1432 3xlllrx.exe 2960 bthhbn.exe 844 pvvpp.exe 264 3jjpd.exe 1944 xrxxflx.exe 1124 nhnbhn.exe 1932 9nhnhn.exe 1852 7jppv.exe 700 9lfflrr.exe 2368 bbntbn.exe 2144 jpdvv.exe 2472 ddjpd.exe 880 llrllxr.exe 1920 hhttbb.exe 2532 3jvjj.exe 2296 jdddv.exe 2936 lfxxllx.exe 2756 hbtbhh.exe 1820 bhhttn.exe 2740 vpjpp.exe 2908 xlflxfx.exe 2952 rrfflrx.exe 2844 hhbhbh.exe 2624 vjdpd.exe 2688 jppdv.exe 2184 lxxlrff.exe 1880 xfflflr.exe 1052 tntnnt.exe 1476 hbtbbh.exe 2948 jjdpd.exe 1792 rlflrrf.exe 1780 lxrxffl.exe 2508 nbbnbb.exe 1976 ttbnbb.exe 1600 nhbbnt.exe 2852 vjjpj.exe 2524 9dpvd.exe 2212 9rllrfl.exe 2960 rlrxxff.exe 2240 hbnnbh.exe 316 bbthht.exe 952 vpjvv.exe 2120 jvvpp.exe 1124 9fflxlr.exe 936 nbnntt.exe 608 tbhbhh.exe 1644 jdvjp.exe 2988 7fxrxfr.exe -
resource yara_rule behavioral1/memory/3016-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-309-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2536 3016 2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe 30 PID 3016 wrote to memory of 2536 3016 2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe 30 PID 3016 wrote to memory of 2536 3016 2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe 30 PID 3016 wrote to memory of 2536 3016 2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe 30 PID 2536 wrote to memory of 1848 2536 ffrlxxf.exe 31 PID 2536 wrote to memory of 1848 2536 ffrlxxf.exe 31 PID 2536 wrote to memory of 1848 2536 ffrlxxf.exe 31 PID 2536 wrote to memory of 1848 2536 ffrlxxf.exe 31 PID 1848 wrote to memory of 2344 1848 nntntt.exe 32 PID 1848 wrote to memory of 2344 1848 nntntt.exe 32 PID 1848 wrote to memory of 2344 1848 nntntt.exe 32 PID 1848 wrote to memory of 2344 1848 nntntt.exe 32 PID 2344 wrote to memory of 2900 2344 hbbtnb.exe 33 PID 2344 wrote to memory of 2900 2344 hbbtnb.exe 33 PID 2344 wrote to memory of 2900 2344 hbbtnb.exe 33 PID 2344 wrote to memory of 2900 2344 hbbtnb.exe 33 PID 2900 wrote to memory of 2744 2900 7xllllr.exe 34 PID 2900 wrote to memory of 2744 2900 7xllllr.exe 34 PID 2900 wrote to memory of 2744 2900 7xllllr.exe 34 PID 2900 wrote to memory of 2744 2900 7xllllr.exe 34 PID 2744 wrote to memory of 2828 2744 htnhtb.exe 35 PID 2744 wrote to memory of 2828 2744 htnhtb.exe 35 PID 2744 wrote to memory of 2828 2744 htnhtb.exe 35 PID 2744 wrote to memory of 2828 2744 htnhtb.exe 35 PID 2828 wrote to memory of 2656 2828 dpvpp.exe 36 PID 2828 wrote to memory of 2656 2828 dpvpp.exe 36 PID 2828 wrote to memory of 2656 2828 dpvpp.exe 36 PID 2828 wrote to memory of 2656 2828 dpvpp.exe 36 PID 2656 wrote to memory of 1732 2656 lrlfxrx.exe 37 PID 2656 wrote to memory of 1732 2656 lrlfxrx.exe 37 PID 2656 wrote to memory of 1732 2656 lrlfxrx.exe 37 PID 2656 wrote to memory of 1732 2656 lrlfxrx.exe 37 PID 1732 wrote to memory of 1620 1732 nbhntb.exe 38 PID 1732 wrote to memory of 1620 1732 nbhntb.exe 38 PID 1732 wrote to memory of 1620 1732 nbhntb.exe 38 PID 1732 wrote to memory of 1620 1732 nbhntb.exe 38 PID 1620 wrote to memory of 2364 1620 hhhnhn.exe 39 PID 1620 wrote to memory of 2364 1620 hhhnhn.exe 39 PID 1620 wrote to memory of 2364 1620 hhhnhn.exe 39 PID 1620 wrote to memory of 2364 1620 hhhnhn.exe 39 PID 2364 wrote to memory of 1048 2364 jvdpv.exe 40 PID 2364 wrote to memory of 1048 2364 jvdpv.exe 40 PID 2364 wrote to memory of 1048 2364 jvdpv.exe 40 PID 2364 wrote to memory of 1048 2364 jvdpv.exe 40 PID 1048 wrote to memory of 2860 1048 lfxxfff.exe 41 PID 1048 wrote to memory of 2860 1048 lfxxfff.exe 41 PID 1048 wrote to memory of 2860 1048 lfxxfff.exe 41 PID 1048 wrote to memory of 2860 1048 lfxxfff.exe 41 PID 2860 wrote to memory of 2508 2860 thbhbh.exe 42 PID 2860 wrote to memory of 2508 2860 thbhbh.exe 42 PID 2860 wrote to memory of 2508 2860 thbhbh.exe 42 PID 2860 wrote to memory of 2508 2860 thbhbh.exe 42 PID 2508 wrote to memory of 1324 2508 nhhtbb.exe 43 PID 2508 wrote to memory of 1324 2508 nhhtbb.exe 43 PID 2508 wrote to memory of 1324 2508 nhhtbb.exe 43 PID 2508 wrote to memory of 1324 2508 nhhtbb.exe 43 PID 1324 wrote to memory of 2712 1324 3pppv.exe 44 PID 1324 wrote to memory of 2712 1324 3pppv.exe 44 PID 1324 wrote to memory of 2712 1324 3pppv.exe 44 PID 1324 wrote to memory of 2712 1324 3pppv.exe 44 PID 2712 wrote to memory of 1320 2712 3vpjp.exe 45 PID 2712 wrote to memory of 1320 2712 3vpjp.exe 45 PID 2712 wrote to memory of 1320 2712 3vpjp.exe 45 PID 2712 wrote to memory of 1320 2712 3vpjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe"C:\Users\Admin\AppData\Local\Temp\2b95f3f33e0ad83cb777a5b2f24c2ad666571e36ee2a366cd09a414f28785308N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\ffrlxxf.exec:\ffrlxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\nntntt.exec:\nntntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\hbbtnb.exec:\hbbtnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\7xllllr.exec:\7xllllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\htnhtb.exec:\htnhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\dpvpp.exec:\dpvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\lrlfxrx.exec:\lrlfxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\nbhntb.exec:\nbhntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\hhhnhn.exec:\hhhnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jvdpv.exec:\jvdpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\lfxxfff.exec:\lfxxfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\thbhbh.exec:\thbhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\nhhtbb.exec:\nhhtbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\3pppv.exec:\3pppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\3vpjp.exec:\3vpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\fxxflxr.exec:\fxxflxr.exe17⤵
- Executes dropped EXE
PID:1320 -
\??\c:\3xlllrx.exec:\3xlllrx.exe18⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bthhbn.exec:\bthhbn.exe19⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pvvpp.exec:\pvvpp.exe20⤵
- Executes dropped EXE
PID:844 -
\??\c:\3jjpd.exec:\3jjpd.exe21⤵
- Executes dropped EXE
PID:264 -
\??\c:\xrxxflx.exec:\xrxxflx.exe22⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nhnbhn.exec:\nhnbhn.exe23⤵
- Executes dropped EXE
PID:1124 -
\??\c:\9nhnhn.exec:\9nhnhn.exe24⤵
- Executes dropped EXE
PID:1932 -
\??\c:\7jppv.exec:\7jppv.exe25⤵
- Executes dropped EXE
PID:1852 -
\??\c:\9lfflrr.exec:\9lfflrr.exe26⤵
- Executes dropped EXE
PID:700 -
\??\c:\bbntbn.exec:\bbntbn.exe27⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jpdvv.exec:\jpdvv.exe28⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ddjpd.exec:\ddjpd.exe29⤵
- Executes dropped EXE
PID:2472 -
\??\c:\llrllxr.exec:\llrllxr.exe30⤵
- Executes dropped EXE
PID:880 -
\??\c:\hhttbb.exec:\hhttbb.exe31⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3jvjj.exec:\3jvjj.exe32⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jdddv.exec:\jdddv.exe33⤵
- Executes dropped EXE
PID:2296 -
\??\c:\lfxxllx.exec:\lfxxllx.exe34⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hbtbhh.exec:\hbtbhh.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bhhttn.exec:\bhhttn.exe36⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vpjpp.exec:\vpjpp.exe37⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xlflxfx.exec:\xlflxfx.exe38⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rrfflrx.exec:\rrfflrx.exe39⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hhbhbh.exec:\hhbhbh.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vjdpd.exec:\vjdpd.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jppdv.exec:\jppdv.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lxxlrff.exec:\lxxlrff.exe43⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xfflflr.exec:\xfflflr.exe44⤵
- Executes dropped EXE
PID:1880 -
\??\c:\tntnnt.exec:\tntnnt.exe45⤵
- Executes dropped EXE
PID:1052 -
\??\c:\hbtbbh.exec:\hbtbbh.exe46⤵
- Executes dropped EXE
PID:1476 -
\??\c:\jjdpd.exec:\jjdpd.exe47⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rlflrrf.exec:\rlflrrf.exe48⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lxrxffl.exec:\lxrxffl.exe49⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nbbnbb.exec:\nbbnbb.exe50⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ttbnbb.exec:\ttbnbb.exe51⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nhbbnt.exec:\nhbbnt.exe52⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vjjpj.exec:\vjjpj.exe53⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9dpvd.exec:\9dpvd.exe54⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9rllrfl.exec:\9rllrfl.exe55⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rlrxxff.exec:\rlrxxff.exe56⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hbnnbh.exec:\hbnnbh.exe57⤵
- Executes dropped EXE
PID:2240 -
\??\c:\bbthht.exec:\bbthht.exe58⤵
- Executes dropped EXE
PID:316 -
\??\c:\vpjvv.exec:\vpjvv.exe59⤵
- Executes dropped EXE
PID:952 -
\??\c:\jvvpp.exec:\jvvpp.exe60⤵
- Executes dropped EXE
PID:2120 -
\??\c:\9fflxlr.exec:\9fflxlr.exe61⤵
- Executes dropped EXE
PID:1124 -
\??\c:\nbnntt.exec:\nbnntt.exe62⤵
- Executes dropped EXE
PID:936 -
\??\c:\tbhbhh.exec:\tbhbhh.exe63⤵
- Executes dropped EXE
PID:608 -
\??\c:\jdvjp.exec:\jdvjp.exe64⤵
- Executes dropped EXE
PID:1644 -
\??\c:\7fxrxfr.exec:\7fxrxfr.exe65⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xrxfxrx.exec:\xrxfxrx.exe66⤵PID:2368
-
\??\c:\9xrlrxf.exec:\9xrlrxf.exe67⤵PID:1736
-
\??\c:\5hbthn.exec:\5hbthn.exe68⤵PID:2020
-
\??\c:\thbhnn.exec:\thbhnn.exe69⤵PID:1916
-
\??\c:\9vjjj.exec:\9vjjj.exe70⤵PID:2388
-
\??\c:\1dpdd.exec:\1dpdd.exe71⤵PID:2520
-
\??\c:\9flfllr.exec:\9flfllr.exe72⤵PID:2400
-
\??\c:\hnttnb.exec:\hnttnb.exe73⤵PID:2348
-
\??\c:\nhtntb.exec:\nhtntb.exe74⤵PID:1836
-
\??\c:\jdpjp.exec:\jdpjp.exe75⤵PID:2884
-
\??\c:\pdpvj.exec:\pdpvj.exe76⤵PID:2764
-
\??\c:\rllrrrx.exec:\rllrrrx.exe77⤵PID:2980
-
\??\c:\frrxllr.exec:\frrxllr.exe78⤵PID:2928
-
\??\c:\1tbhnn.exec:\1tbhnn.exe79⤵PID:2744
-
\??\c:\btnthh.exec:\btnthh.exe80⤵PID:2668
-
\??\c:\ddvdv.exec:\ddvdv.exe81⤵PID:2644
-
\??\c:\rrffrxx.exec:\rrffrxx.exe82⤵PID:2724
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe83⤵PID:1784
-
\??\c:\tnhntb.exec:\tnhntb.exe84⤵PID:2448
-
\??\c:\hbnntb.exec:\hbnntb.exe85⤵PID:1112
-
\??\c:\dpdjp.exec:\dpdjp.exe86⤵PID:1572
-
\??\c:\lrxxrfx.exec:\lrxxrfx.exe87⤵PID:1980
-
\??\c:\rfxfrrf.exec:\rfxfrrf.exe88⤵PID:2132
-
\??\c:\bthnnn.exec:\bthnnn.exe89⤵PID:1988
-
\??\c:\vppvj.exec:\vppvj.exe90⤵PID:2680
-
\??\c:\dpddj.exec:\dpddj.exe91⤵PID:2004
-
\??\c:\lxfffff.exec:\lxfffff.exe92⤵PID:1996
-
\??\c:\ffrfrrr.exec:\ffrfrrr.exe93⤵PID:1144
-
\??\c:\tnbbhn.exec:\tnbbhn.exe94⤵PID:2708
-
\??\c:\nnhnbb.exec:\nnhnbb.exe95⤵PID:576
-
\??\c:\pjdpj.exec:\pjdpj.exe96⤵PID:3000
-
\??\c:\vdjdv.exec:\vdjdv.exe97⤵PID:1676
-
\??\c:\rlxfrlx.exec:\rlxfrlx.exe98⤵PID:1680
-
\??\c:\flxrxrr.exec:\flxrxrr.exe99⤵PID:2352
-
\??\c:\1tthhh.exec:\1tthhh.exe100⤵PID:2332
-
\??\c:\3hbnnn.exec:\3hbnnn.exe101⤵PID:268
-
\??\c:\1dvvj.exec:\1dvvj.exe102⤵PID:1932
-
\??\c:\1pdvj.exec:\1pdvj.exe103⤵PID:1924
-
\??\c:\fxllllx.exec:\fxllllx.exe104⤵PID:2444
-
\??\c:\ffllllr.exec:\ffllllr.exe105⤵PID:1340
-
\??\c:\btthtb.exec:\btthtb.exe106⤵PID:1776
-
\??\c:\pddjj.exec:\pddjj.exe107⤵PID:1488
-
\??\c:\jvvpp.exec:\jvvpp.exe108⤵PID:2472
-
\??\c:\dvjjd.exec:\dvjjd.exe109⤵PID:3016
-
\??\c:\rlrllfl.exec:\rlrllfl.exe110⤵PID:2404
-
\??\c:\bntbbn.exec:\bntbbn.exe111⤵PID:1856
-
\??\c:\nbhbbn.exec:\nbhbbn.exe112⤵PID:1576
-
\??\c:\3hnhhh.exec:\3hnhhh.exe113⤵PID:2704
-
\??\c:\pdjpd.exec:\pdjpd.exe114⤵PID:2936
-
\??\c:\5vppp.exec:\5vppp.exe115⤵PID:2992
-
\??\c:\5ffrxlx.exec:\5ffrxlx.exe116⤵PID:1820
-
\??\c:\lrxrxlr.exec:\lrxrxlr.exe117⤵PID:2772
-
\??\c:\hbhhnt.exec:\hbhhnt.exe118⤵PID:2908
-
\??\c:\btbbhn.exec:\btbbhn.exe119⤵PID:2952
-
\??\c:\djpjp.exec:\djpjp.exe120⤵PID:2828
-
\??\c:\pdjjv.exec:\pdjjv.exe121⤵PID:1684
-
\??\c:\ppvjv.exec:\ppvjv.exe122⤵PID:1732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-