Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 05:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe
-
Size
105KB
-
MD5
a4c210bbb97e01caf3f428a3d44172f2
-
SHA1
fc9e2a416cb8a26622e3c668c7c0f4af265498bc
-
SHA256
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd
-
SHA512
cf790335aa1841a2f216a00ab39d09b034d7bc005e235d324b4179f1ac743f75cea7353e7974c7d0e11614ba1a39d376b92b3b46f5920ef1c77daca9f8dff610
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHq82PC1:n3C9BRo7tvnJ99T/KZE891
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2264-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/600-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1408-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/880-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/944-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/400-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2416 rfxxffr.exe 2296 88228.exe 2852 btbbbh.exe 600 80288.exe 2400 lxlllxf.exe 2728 tntntb.exe 2760 1lxflfr.exe 2756 bnbbbt.exe 2140 tnnntt.exe 2072 028466.exe 1408 9dppp.exe 1588 46608.exe 2064 nhttnn.exe 1644 604604.exe 1620 1htnnn.exe 2000 8640224.exe 1700 q68848.exe 880 2600840.exe 2192 028626.exe 3036 000688.exe 448 42066.exe 1004 vjvdv.exe 944 20882.exe 1720 420022.exe 956 o422884.exe 824 u680622.exe 2572 dvjjv.exe 400 020622.exe 2632 nhtbbh.exe 2308 3vddj.exe 2340 260244.exe 2172 pjdvd.exe 2524 dpvdj.exe 2820 864488.exe 2840 q08406.exe 2984 bnbbht.exe 2980 8644222.exe 2420 1xlllfl.exe 2704 pdjvp.exe 2780 i862006.exe 892 080462.exe 1204 3hnnbt.exe 376 w64400.exe 1200 4268088.exe 2072 084444.exe 1248 hthtth.exe 2376 lfxfffx.exe 1460 a0408.exe 2032 s8228.exe 820 vddpp.exe 1560 a0284.exe 3028 4686606.exe 1260 nbhbhb.exe 1008 26846.exe 2216 s2462.exe 544 xrxxxrr.exe 2100 rxlrrrx.exe 1012 640644.exe 1576 rrrxxxx.exe 2512 7pdpp.exe 284 pdjjp.exe 2408 0406228.exe 2124 k20688.exe 1228 o862444.exe -
resource yara_rule behavioral1/memory/2416-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1408-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/944-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/400-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0488440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6482484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642060.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84086.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4604446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82480.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u026266.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2416 2264 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 31 PID 2264 wrote to memory of 2416 2264 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 31 PID 2264 wrote to memory of 2416 2264 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 31 PID 2264 wrote to memory of 2416 2264 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 31 PID 2416 wrote to memory of 2296 2416 rfxxffr.exe 32 PID 2416 wrote to memory of 2296 2416 rfxxffr.exe 32 PID 2416 wrote to memory of 2296 2416 rfxxffr.exe 32 PID 2416 wrote to memory of 2296 2416 rfxxffr.exe 32 PID 2296 wrote to memory of 2852 2296 88228.exe 33 PID 2296 wrote to memory of 2852 2296 88228.exe 33 PID 2296 wrote to memory of 2852 2296 88228.exe 33 PID 2296 wrote to memory of 2852 2296 88228.exe 33 PID 2852 wrote to memory of 600 2852 btbbbh.exe 34 PID 2852 wrote to memory of 600 2852 btbbbh.exe 34 PID 2852 wrote to memory of 600 2852 btbbbh.exe 34 PID 2852 wrote to memory of 600 2852 btbbbh.exe 34 PID 600 wrote to memory of 2400 600 80288.exe 35 PID 600 wrote to memory of 2400 600 80288.exe 35 PID 600 wrote to memory of 2400 600 80288.exe 35 PID 600 wrote to memory of 2400 600 80288.exe 35 PID 2400 wrote to memory of 2728 2400 lxlllxf.exe 36 PID 2400 wrote to memory of 2728 2400 lxlllxf.exe 36 PID 2400 wrote to memory of 2728 2400 lxlllxf.exe 36 PID 2400 wrote to memory of 2728 2400 lxlllxf.exe 36 PID 2728 wrote to memory of 2760 2728 tntntb.exe 37 PID 2728 wrote to memory of 2760 2728 tntntb.exe 37 PID 2728 wrote to memory of 2760 2728 tntntb.exe 37 PID 2728 wrote to memory of 2760 2728 tntntb.exe 37 PID 2760 wrote to memory of 2756 2760 1lxflfr.exe 38 PID 2760 wrote to memory of 2756 2760 1lxflfr.exe 38 PID 2760 wrote to memory of 2756 2760 1lxflfr.exe 38 PID 2760 wrote to memory of 2756 2760 1lxflfr.exe 38 PID 2756 wrote to memory of 2140 2756 bnbbbt.exe 39 PID 2756 wrote to memory of 2140 2756 bnbbbt.exe 39 PID 2756 wrote to memory of 2140 2756 bnbbbt.exe 39 PID 2756 wrote to memory of 2140 2756 bnbbbt.exe 39 PID 2140 wrote to memory of 2072 2140 tnnntt.exe 40 PID 2140 wrote to memory of 2072 2140 tnnntt.exe 40 PID 2140 wrote to memory of 2072 2140 tnnntt.exe 40 PID 2140 wrote to memory of 2072 2140 tnnntt.exe 40 PID 2072 wrote to memory of 1408 2072 028466.exe 41 PID 2072 wrote to memory of 1408 2072 028466.exe 41 PID 2072 wrote to memory of 1408 2072 028466.exe 41 PID 2072 wrote to memory of 1408 2072 028466.exe 41 PID 1408 wrote to memory of 1588 1408 9dppp.exe 42 PID 1408 wrote to memory of 1588 1408 9dppp.exe 42 PID 1408 wrote to memory of 1588 1408 9dppp.exe 42 PID 1408 wrote to memory of 1588 1408 9dppp.exe 42 PID 1588 wrote to memory of 2064 1588 46608.exe 43 PID 1588 wrote to memory of 2064 1588 46608.exe 43 PID 1588 wrote to memory of 2064 1588 46608.exe 43 PID 1588 wrote to memory of 2064 1588 46608.exe 43 PID 2064 wrote to memory of 1644 2064 nhttnn.exe 44 PID 2064 wrote to memory of 1644 2064 nhttnn.exe 44 PID 2064 wrote to memory of 1644 2064 nhttnn.exe 44 PID 2064 wrote to memory of 1644 2064 nhttnn.exe 44 PID 1644 wrote to memory of 1620 1644 604604.exe 45 PID 1644 wrote to memory of 1620 1644 604604.exe 45 PID 1644 wrote to memory of 1620 1644 604604.exe 45 PID 1644 wrote to memory of 1620 1644 604604.exe 45 PID 1620 wrote to memory of 2000 1620 1htnnn.exe 46 PID 1620 wrote to memory of 2000 1620 1htnnn.exe 46 PID 1620 wrote to memory of 2000 1620 1htnnn.exe 46 PID 1620 wrote to memory of 2000 1620 1htnnn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe"C:\Users\Admin\AppData\Local\Temp\eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\rfxxffr.exec:\rfxxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\88228.exec:\88228.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\btbbbh.exec:\btbbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\80288.exec:\80288.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\lxlllxf.exec:\lxlllxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\tntntb.exec:\tntntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\1lxflfr.exec:\1lxflfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\bnbbbt.exec:\bnbbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tnnntt.exec:\tnnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\028466.exec:\028466.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\9dppp.exec:\9dppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\46608.exec:\46608.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\nhttnn.exec:\nhttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\604604.exec:\604604.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\1htnnn.exec:\1htnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\8640224.exec:\8640224.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\q68848.exec:\q68848.exe18⤵
- Executes dropped EXE
PID:1700 -
\??\c:\2600840.exec:\2600840.exe19⤵
- Executes dropped EXE
PID:880 -
\??\c:\028626.exec:\028626.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\000688.exec:\000688.exe21⤵
- Executes dropped EXE
PID:3036 -
\??\c:\42066.exec:\42066.exe22⤵
- Executes dropped EXE
PID:448 -
\??\c:\vjvdv.exec:\vjvdv.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1004 -
\??\c:\20882.exec:\20882.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:944 -
\??\c:\420022.exec:\420022.exe25⤵
- Executes dropped EXE
PID:1720 -
\??\c:\o422884.exec:\o422884.exe26⤵
- Executes dropped EXE
PID:956 -
\??\c:\u680622.exec:\u680622.exe27⤵
- Executes dropped EXE
PID:824 -
\??\c:\dvjjv.exec:\dvjjv.exe28⤵
- Executes dropped EXE
PID:2572 -
\??\c:\020622.exec:\020622.exe29⤵
- Executes dropped EXE
PID:400 -
\??\c:\nhtbbh.exec:\nhtbbh.exe30⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3vddj.exec:\3vddj.exe31⤵
- Executes dropped EXE
PID:2308 -
\??\c:\260244.exec:\260244.exe32⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pjdvd.exec:\pjdvd.exe33⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dpvdj.exec:\dpvdj.exe34⤵
- Executes dropped EXE
PID:2524 -
\??\c:\864488.exec:\864488.exe35⤵
- Executes dropped EXE
PID:2820 -
\??\c:\q08406.exec:\q08406.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bnbbht.exec:\bnbbht.exe37⤵
- Executes dropped EXE
PID:2984 -
\??\c:\8644222.exec:\8644222.exe38⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1xlllfl.exec:\1xlllfl.exe39⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pdjvp.exec:\pdjvp.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\i862006.exec:\i862006.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\080462.exec:\080462.exe42⤵
- Executes dropped EXE
PID:892 -
\??\c:\3hnnbt.exec:\3hnnbt.exe43⤵
- Executes dropped EXE
PID:1204 -
\??\c:\w64400.exec:\w64400.exe44⤵
- Executes dropped EXE
PID:376 -
\??\c:\4268088.exec:\4268088.exe45⤵
- Executes dropped EXE
PID:1200 -
\??\c:\084444.exec:\084444.exe46⤵
- Executes dropped EXE
PID:2072 -
\??\c:\hthtth.exec:\hthtth.exe47⤵
- Executes dropped EXE
PID:1248 -
\??\c:\lfxfffx.exec:\lfxfffx.exe48⤵
- Executes dropped EXE
PID:2376 -
\??\c:\a0408.exec:\a0408.exe49⤵
- Executes dropped EXE
PID:1460 -
\??\c:\s8228.exec:\s8228.exe50⤵
- Executes dropped EXE
PID:2032 -
\??\c:\vddpp.exec:\vddpp.exe51⤵
- Executes dropped EXE
PID:820 -
\??\c:\a0284.exec:\a0284.exe52⤵
- Executes dropped EXE
PID:1560 -
\??\c:\4686606.exec:\4686606.exe53⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nbhbhb.exec:\nbhbhb.exe54⤵
- Executes dropped EXE
PID:1260 -
\??\c:\26846.exec:\26846.exe55⤵
- Executes dropped EXE
PID:1008 -
\??\c:\s2462.exec:\s2462.exe56⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xrxxxrr.exec:\xrxxxrr.exe57⤵
- Executes dropped EXE
PID:544 -
\??\c:\rxlrrrx.exec:\rxlrrrx.exe58⤵
- Executes dropped EXE
PID:2100 -
\??\c:\640644.exec:\640644.exe59⤵
- Executes dropped EXE
PID:1012 -
\??\c:\rrrxxxx.exec:\rrrxxxx.exe60⤵
- Executes dropped EXE
PID:1576 -
\??\c:\7pdpp.exec:\7pdpp.exe61⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pdjjp.exec:\pdjjp.exe62⤵
- Executes dropped EXE
PID:284 -
\??\c:\0406228.exec:\0406228.exe63⤵
- Executes dropped EXE
PID:2408 -
\??\c:\k20688.exec:\k20688.exe64⤵
- Executes dropped EXE
PID:2124 -
\??\c:\o862444.exec:\o862444.exe65⤵
- Executes dropped EXE
PID:1228 -
\??\c:\xfrlffl.exec:\xfrlffl.exe66⤵PID:2580
-
\??\c:\86228.exec:\86228.exe67⤵PID:1944
-
\??\c:\k88848.exec:\k88848.exe68⤵PID:1964
-
\??\c:\w44444.exec:\w44444.exe69⤵PID:2676
-
\??\c:\048684.exec:\048684.exe70⤵PID:1648
-
\??\c:\480662.exec:\480662.exe71⤵PID:3000
-
\??\c:\q42444.exec:\q42444.exe72⤵PID:2464
-
\??\c:\dpvpv.exec:\dpvpv.exe73⤵PID:2172
-
\??\c:\a2402.exec:\a2402.exe74⤵PID:2372
-
\??\c:\64668.exec:\64668.exe75⤵PID:2920
-
\??\c:\vpdpp.exec:\vpdpp.exe76⤵PID:2836
-
\??\c:\s8060.exec:\s8060.exe77⤵PID:2220
-
\??\c:\hthntt.exec:\hthntt.exe78⤵PID:2980
-
\??\c:\0862446.exec:\0862446.exe79⤵PID:2848
-
\??\c:\k42848.exec:\k42848.exe80⤵PID:2824
-
\??\c:\w08404.exec:\w08404.exe81⤵PID:2784
-
\??\c:\bbttbt.exec:\bbttbt.exe82⤵PID:2700
-
\??\c:\jddjv.exec:\jddjv.exe83⤵PID:1280
-
\??\c:\rfxfxrr.exec:\rfxfxrr.exe84⤵PID:920
-
\??\c:\20802.exec:\20802.exe85⤵PID:268
-
\??\c:\7dddj.exec:\7dddj.exe86⤵PID:860
-
\??\c:\200466.exec:\200466.exe87⤵PID:1824
-
\??\c:\64020.exec:\64020.exe88⤵PID:2376
-
\??\c:\424404.exec:\424404.exe89⤵PID:1628
-
\??\c:\q04628.exec:\q04628.exe90⤵PID:2032
-
\??\c:\c200222.exec:\c200222.exe91⤵PID:820
-
\??\c:\tnbhtn.exec:\tnbhtn.exe92⤵PID:1560
-
\??\c:\u060606.exec:\u060606.exe93⤵PID:2948
-
\??\c:\nbhnbb.exec:\nbhnbb.exe94⤵PID:2776
-
\??\c:\o080882.exec:\o080882.exe95⤵PID:2564
-
\??\c:\426688.exec:\426688.exe96⤵PID:2216
-
\??\c:\q24060.exec:\q24060.exe97⤵PID:2168
-
\??\c:\08046.exec:\08046.exe98⤵PID:448
-
\??\c:\flxxrlr.exec:\flxxrlr.exe99⤵PID:696
-
\??\c:\6606448.exec:\6606448.exe100⤵PID:2544
-
\??\c:\rflrfxx.exec:\rflrfxx.exe101⤵PID:1736
-
\??\c:\1nthtn.exec:\1nthtn.exe102⤵PID:848
-
\??\c:\rflrxxf.exec:\rflrxxf.exe103⤵PID:336
-
\??\c:\fxllrlr.exec:\fxllrlr.exe104⤵PID:2328
-
\??\c:\vdppj.exec:\vdppj.exe105⤵PID:2560
-
\??\c:\20884.exec:\20884.exe106⤵PID:2580
-
\??\c:\4266224.exec:\4266224.exe107⤵PID:780
-
\??\c:\208000.exec:\208000.exe108⤵PID:400
-
\??\c:\nhtbbt.exec:\nhtbbt.exe109⤵PID:2188
-
\??\c:\020000.exec:\020000.exe110⤵PID:1648
-
\??\c:\thttbt.exec:\thttbt.exe111⤵PID:2336
-
\??\c:\o240006.exec:\o240006.exe112⤵PID:2916
-
\??\c:\4288828.exec:\4288828.exe113⤵PID:2524
-
\??\c:\202844.exec:\202844.exe114⤵PID:2932
-
\??\c:\1nbbbb.exec:\1nbbbb.exe115⤵PID:2820
-
\??\c:\426400.exec:\426400.exe116⤵PID:2840
-
\??\c:\42888.exec:\42888.exe117⤵PID:2880
-
\??\c:\7tnthh.exec:\7tnthh.exe118⤵PID:2812
-
\??\c:\0862622.exec:\0862622.exe119⤵PID:2420
-
\??\c:\hthbhb.exec:\hthbhb.exe120⤵PID:2760
-
\??\c:\6028440.exec:\6028440.exe121⤵PID:2780
-
\??\c:\bnbbhh.exec:\bnbbhh.exe122⤵PID:892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-