Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb28ecf427da115085b7cad20763b5e0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
eb28ecf427da115085b7cad20763b5e0N.exe
-
Size
721KB
-
MD5
eb28ecf427da115085b7cad20763b5e0
-
SHA1
5384ff16eb1103b83352583807c5e909b31c2c40
-
SHA256
32c9b385f3ab08273229135f14fe5c7f153ea8c6e03e97b4a8c8874605708f18
-
SHA512
ac7845b121f481f67589b71e5e201bccfccbbe421d574adbe827d5020c48a44f6e750b68090e464cec38a40d378d67fc3ac01b1dacc25c4e35f1b4f880131e7a
-
SSDEEP
12288:n3C9yMCxqYL5oeEF5rna9sUxg7udOxPJVSjYg8lcmJ1MZxEkTsxPJp6aasUdlH7t:Sg5qYLS7w4O
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2376-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/468-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1996 nhhhnb.exe 2308 9nthbn.exe 2296 lxfxflr.exe 2924 ppjpd.exe 2836 ffrrxxf.exe 2944 7jdvd.exe 2796 xrlllxf.exe 2020 vpvdj.exe 2260 3xxrxfl.exe 468 5rxffrr.exe 2892 tthntb.exe 2348 ffflrxx.exe 2996 tbtntb.exe 3036 rfxxllr.exe 2904 fxlrxxx.exe 2600 vpjpd.exe 2156 tnhtbn.exe 1452 fxrfxfx.exe 2164 5nhhbh.exe 692 vdjjp.exe 1924 lxlfxrl.exe 572 5xrrxff.exe 1980 1bbnnh.exe 2284 5bhnhn.exe 900 bnbhnh.exe 2464 dvdjv.exe 300 ffflrrf.exe 2448 5jddp.exe 1344 lfxfrxx.exe 1860 pjpdd.exe 1628 ffflrxl.exe 2200 5tntbn.exe 2384 rrfflrx.exe 1644 bhnnnh.exe 2400 1djvd.exe 2784 ppvdj.exe 2928 3rlrrrr.exe 2736 5hbbbb.exe 2404 1jddv.exe 2804 llxrrxx.exe 2868 ttntht.exe 2632 ppdpj.exe 2692 llflxfr.exe 332 nbnnnb.exe 1216 jdpjp.exe 1804 frllxxr.exe 1164 5rllrrf.exe 2992 bbntbh.exe 3020 vpvdj.exe 3008 rrxxfrx.exe 2616 tnhtbh.exe 1712 vddjv.exe 2076 fxffrll.exe 2004 bnhhht.exe 2552 bnbnnt.exe 1752 pjppd.exe 2208 llxrxlr.exe 2164 9hhhnt.exe 3068 5dpvj.exe 1896 rrlrrlx.exe 1920 7fxxxff.exe 1852 btbhbh.exe 1980 jjddj.exe 1720 lxrfllr.exe -
resource yara_rule behavioral1/memory/2376-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/468-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 1996 2376 eb28ecf427da115085b7cad20763b5e0N.exe 30 PID 2376 wrote to memory of 1996 2376 eb28ecf427da115085b7cad20763b5e0N.exe 30 PID 2376 wrote to memory of 1996 2376 eb28ecf427da115085b7cad20763b5e0N.exe 30 PID 2376 wrote to memory of 1996 2376 eb28ecf427da115085b7cad20763b5e0N.exe 30 PID 1996 wrote to memory of 2308 1996 nhhhnb.exe 31 PID 1996 wrote to memory of 2308 1996 nhhhnb.exe 31 PID 1996 wrote to memory of 2308 1996 nhhhnb.exe 31 PID 1996 wrote to memory of 2308 1996 nhhhnb.exe 31 PID 2308 wrote to memory of 2296 2308 9nthbn.exe 32 PID 2308 wrote to memory of 2296 2308 9nthbn.exe 32 PID 2308 wrote to memory of 2296 2308 9nthbn.exe 32 PID 2308 wrote to memory of 2296 2308 9nthbn.exe 32 PID 2296 wrote to memory of 2924 2296 lxfxflr.exe 33 PID 2296 wrote to memory of 2924 2296 lxfxflr.exe 33 PID 2296 wrote to memory of 2924 2296 lxfxflr.exe 33 PID 2296 wrote to memory of 2924 2296 lxfxflr.exe 33 PID 2924 wrote to memory of 2836 2924 ppjpd.exe 34 PID 2924 wrote to memory of 2836 2924 ppjpd.exe 34 PID 2924 wrote to memory of 2836 2924 ppjpd.exe 34 PID 2924 wrote to memory of 2836 2924 ppjpd.exe 34 PID 2836 wrote to memory of 2944 2836 ffrrxxf.exe 35 PID 2836 wrote to memory of 2944 2836 ffrrxxf.exe 35 PID 2836 wrote to memory of 2944 2836 ffrrxxf.exe 35 PID 2836 wrote to memory of 2944 2836 ffrrxxf.exe 35 PID 2944 wrote to memory of 2796 2944 7jdvd.exe 36 PID 2944 wrote to memory of 2796 2944 7jdvd.exe 36 PID 2944 wrote to memory of 2796 2944 7jdvd.exe 36 PID 2944 wrote to memory of 2796 2944 7jdvd.exe 36 PID 2796 wrote to memory of 2020 2796 xrlllxf.exe 37 PID 2796 wrote to memory of 2020 2796 xrlllxf.exe 37 PID 2796 wrote to memory of 2020 2796 xrlllxf.exe 37 PID 2796 wrote to memory of 2020 2796 xrlllxf.exe 37 PID 2020 wrote to memory of 2260 2020 vpvdj.exe 38 PID 2020 wrote to memory of 2260 2020 vpvdj.exe 38 PID 2020 wrote to memory of 2260 2020 vpvdj.exe 38 PID 2020 wrote to memory of 2260 2020 vpvdj.exe 38 PID 2260 wrote to memory of 468 2260 3xxrxfl.exe 39 PID 2260 wrote to memory of 468 2260 3xxrxfl.exe 39 PID 2260 wrote to memory of 468 2260 3xxrxfl.exe 39 PID 2260 wrote to memory of 468 2260 3xxrxfl.exe 39 PID 468 wrote to memory of 2892 468 5rxffrr.exe 40 PID 468 wrote to memory of 2892 468 5rxffrr.exe 40 PID 468 wrote to memory of 2892 468 5rxffrr.exe 40 PID 468 wrote to memory of 2892 468 5rxffrr.exe 40 PID 2892 wrote to memory of 2348 2892 tthntb.exe 41 PID 2892 wrote to memory of 2348 2892 tthntb.exe 41 PID 2892 wrote to memory of 2348 2892 tthntb.exe 41 PID 2892 wrote to memory of 2348 2892 tthntb.exe 41 PID 2348 wrote to memory of 2996 2348 ffflrxx.exe 42 PID 2348 wrote to memory of 2996 2348 ffflrxx.exe 42 PID 2348 wrote to memory of 2996 2348 ffflrxx.exe 42 PID 2348 wrote to memory of 2996 2348 ffflrxx.exe 42 PID 2996 wrote to memory of 3036 2996 tbtntb.exe 43 PID 2996 wrote to memory of 3036 2996 tbtntb.exe 43 PID 2996 wrote to memory of 3036 2996 tbtntb.exe 43 PID 2996 wrote to memory of 3036 2996 tbtntb.exe 43 PID 3036 wrote to memory of 2904 3036 rfxxllr.exe 44 PID 3036 wrote to memory of 2904 3036 rfxxllr.exe 44 PID 3036 wrote to memory of 2904 3036 rfxxllr.exe 44 PID 3036 wrote to memory of 2904 3036 rfxxllr.exe 44 PID 2904 wrote to memory of 2600 2904 fxlrxxx.exe 45 PID 2904 wrote to memory of 2600 2904 fxlrxxx.exe 45 PID 2904 wrote to memory of 2600 2904 fxlrxxx.exe 45 PID 2904 wrote to memory of 2600 2904 fxlrxxx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb28ecf427da115085b7cad20763b5e0N.exe"C:\Users\Admin\AppData\Local\Temp\eb28ecf427da115085b7cad20763b5e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\nhhhnb.exec:\nhhhnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\9nthbn.exec:\9nthbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\lxfxflr.exec:\lxfxflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\ppjpd.exec:\ppjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\7jdvd.exec:\7jdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\xrlllxf.exec:\xrlllxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\vpvdj.exec:\vpvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\3xxrxfl.exec:\3xxrxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\5rxffrr.exec:\5rxffrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\tthntb.exec:\tthntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\ffflrxx.exec:\ffflrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\tbtntb.exec:\tbtntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\rfxxllr.exec:\rfxxllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\fxlrxxx.exec:\fxlrxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vpjpd.exec:\vpjpd.exe17⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tnhtbn.exec:\tnhtbn.exe18⤵
- Executes dropped EXE
PID:2156 -
\??\c:\fxrfxfx.exec:\fxrfxfx.exe19⤵
- Executes dropped EXE
PID:1452 -
\??\c:\5nhhbh.exec:\5nhhbh.exe20⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vdjjp.exec:\vdjjp.exe21⤵
- Executes dropped EXE
PID:692 -
\??\c:\lxlfxrl.exec:\lxlfxrl.exe22⤵
- Executes dropped EXE
PID:1924 -
\??\c:\5xrrxff.exec:\5xrrxff.exe23⤵
- Executes dropped EXE
PID:572 -
\??\c:\1bbnnh.exec:\1bbnnh.exe24⤵
- Executes dropped EXE
PID:1980 -
\??\c:\5bhnhn.exec:\5bhnhn.exe25⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bnbhnh.exec:\bnbhnh.exe26⤵
- Executes dropped EXE
PID:900 -
\??\c:\dvdjv.exec:\dvdjv.exe27⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ffflrrf.exec:\ffflrrf.exe28⤵
- Executes dropped EXE
PID:300 -
\??\c:\5jddp.exec:\5jddp.exe29⤵
- Executes dropped EXE
PID:2448 -
\??\c:\lfxfrxx.exec:\lfxfrxx.exe30⤵
- Executes dropped EXE
PID:1344 -
\??\c:\pjpdd.exec:\pjpdd.exe31⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ffflrxl.exec:\ffflrxl.exe32⤵
- Executes dropped EXE
PID:1628 -
\??\c:\5tntbn.exec:\5tntbn.exe33⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rrfflrx.exec:\rrfflrx.exe34⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bhnnnh.exec:\bhnnnh.exe35⤵
- Executes dropped EXE
PID:1644 -
\??\c:\1djvd.exec:\1djvd.exe36⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ppvdj.exec:\ppvdj.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\3rlrrrr.exec:\3rlrrrr.exe38⤵
- Executes dropped EXE
PID:2928 -
\??\c:\5hbbbb.exec:\5hbbbb.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1jddv.exec:\1jddv.exe40⤵
- Executes dropped EXE
PID:2404 -
\??\c:\llxrrxx.exec:\llxrrxx.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ttntht.exec:\ttntht.exe42⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ppdpj.exec:\ppdpj.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\llflxfr.exec:\llflxfr.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nbnnnb.exec:\nbnnnb.exe45⤵
- Executes dropped EXE
PID:332 -
\??\c:\jdpjp.exec:\jdpjp.exe46⤵
- Executes dropped EXE
PID:1216 -
\??\c:\frllxxr.exec:\frllxxr.exe47⤵
- Executes dropped EXE
PID:1804 -
\??\c:\5rllrrf.exec:\5rllrrf.exe48⤵
- Executes dropped EXE
PID:1164 -
\??\c:\bbntbh.exec:\bbntbh.exe49⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vpvdj.exec:\vpvdj.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rrxxfrx.exec:\rrxxfrx.exe51⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tnhtbh.exec:\tnhtbh.exe52⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vddjv.exec:\vddjv.exe53⤵
- Executes dropped EXE
PID:1712 -
\??\c:\fxffrll.exec:\fxffrll.exe54⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bnhhht.exec:\bnhhht.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\bnbnnt.exec:\bnbnnt.exe56⤵
- Executes dropped EXE
PID:2552 -
\??\c:\pjppd.exec:\pjppd.exe57⤵
- Executes dropped EXE
PID:1752 -
\??\c:\llxrxlr.exec:\llxrxlr.exe58⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9hhhnt.exec:\9hhhnt.exe59⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5dpvj.exec:\5dpvj.exe60⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rrlrrlx.exec:\rrlrrlx.exe61⤵
- Executes dropped EXE
PID:1896 -
\??\c:\7fxxxff.exec:\7fxxxff.exe62⤵
- Executes dropped EXE
PID:1920 -
\??\c:\btbhbh.exec:\btbhbh.exe63⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jjddj.exec:\jjddj.exe64⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lxrfllr.exec:\lxrfllr.exe65⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ttntnn.exec:\ttntnn.exe66⤵PID:2392
-
\??\c:\5vjjv.exec:\5vjjv.exe67⤵PID:1736
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe68⤵PID:3060
-
\??\c:\bbhnnn.exec:\bbhnnn.exe69⤵PID:1688
-
\??\c:\5dvjj.exec:\5dvjj.exe70⤵PID:1684
-
\??\c:\7dpdp.exec:\7dpdp.exe71⤵PID:1868
-
\??\c:\fxxfflr.exec:\fxxfflr.exe72⤵PID:2128
-
\??\c:\ttnnbh.exec:\ttnnbh.exe73⤵PID:2336
-
\??\c:\pjvjv.exec:\pjvjv.exe74⤵PID:2368
-
\??\c:\fxrxlxr.exec:\fxrxlxr.exe75⤵PID:2432
-
\??\c:\fxllxrx.exec:\fxllxrx.exe76⤵PID:2384
-
\??\c:\hhtbth.exec:\hhtbth.exe77⤵PID:2244
-
\??\c:\ddvdj.exec:\ddvdj.exe78⤵PID:2400
-
\??\c:\lllxlxl.exec:\lllxlxl.exe79⤵PID:2784
-
\??\c:\rffrxxf.exec:\rffrxxf.exe80⤵PID:2928
-
\??\c:\9hbnnt.exec:\9hbnnt.exe81⤵PID:3052
-
\??\c:\jdpvd.exec:\jdpvd.exe82⤵PID:2404
-
\??\c:\lfrxflr.exec:\lfrxflr.exe83⤵PID:2980
-
\??\c:\tttbbh.exec:\tttbbh.exe84⤵PID:2868
-
\??\c:\7vdjv.exec:\7vdjv.exe85⤵PID:2748
-
\??\c:\xlrxffr.exec:\xlrxffr.exe86⤵PID:2692
-
\??\c:\9nbbhb.exec:\9nbbhb.exe87⤵PID:332
-
\??\c:\ttnthn.exec:\ttnthn.exe88⤵PID:1216
-
\??\c:\jpppv.exec:\jpppv.exe89⤵PID:1804
-
\??\c:\rflflfl.exec:\rflflfl.exe90⤵PID:2968
-
\??\c:\hhnnth.exec:\hhnnth.exe91⤵PID:3028
-
\??\c:\dvjpv.exec:\dvjpv.exe92⤵PID:3020
-
\??\c:\frrxlrx.exec:\frrxlrx.exe93⤵PID:1824
-
\??\c:\lllrfrx.exec:\lllrfrx.exe94⤵PID:2616
-
\??\c:\nnbhnt.exec:\nnbhnt.exe95⤵PID:1712
-
\??\c:\jdvdj.exec:\jdvdj.exe96⤵PID:2380
-
\??\c:\xxfxflf.exec:\xxfxflf.exe97⤵PID:2388
-
\??\c:\nnnhhn.exec:\nnnhhn.exe98⤵PID:2552
-
\??\c:\ppvdj.exec:\ppvdj.exe99⤵PID:2412
-
\??\c:\1xxxrrr.exec:\1xxxrrr.exe100⤵PID:2208
-
\??\c:\tnbhnt.exec:\tnbhnt.exe101⤵PID:2164
-
\??\c:\nnbhnt.exec:\nnbhnt.exe102⤵PID:1924
-
\??\c:\3pdvv.exec:\3pdvv.exe103⤵PID:572
-
\??\c:\xrxfrlf.exec:\xrxfrlf.exe104⤵PID:1920
-
\??\c:\nhtbhn.exec:\nhtbhn.exe105⤵PID:352
-
\??\c:\dvvvd.exec:\dvvvd.exe106⤵PID:1980
-
\??\c:\lxxllrx.exec:\lxxllrx.exe107⤵PID:1720
-
\??\c:\tttnnt.exec:\tttnnt.exe108⤵PID:2392
-
\??\c:\ppdpv.exec:\ppdpv.exe109⤵PID:1428
-
\??\c:\jdvjv.exec:\jdvjv.exe110⤵PID:1460
-
\??\c:\xxxfllr.exec:\xxxfllr.exe111⤵PID:2120
-
\??\c:\hhhthn.exec:\hhhthn.exe112⤵PID:1684
-
\??\c:\jppdp.exec:\jppdp.exe113⤵PID:1992
-
\??\c:\rxflrfr.exec:\rxflrfr.exe114⤵PID:1860
-
\??\c:\rxfllll.exec:\rxfllll.exe115⤵PID:2336
-
\??\c:\nntbnn.exec:\nntbnn.exe116⤵PID:2508
-
\??\c:\7vjpv.exec:\7vjpv.exe117⤵PID:2432
-
\??\c:\xffrrfx.exec:\xffrrfx.exe118⤵PID:2320
-
\??\c:\frlxrfx.exec:\frlxrfx.exe119⤵PID:2580
-
\??\c:\nbnhhh.exec:\nbnhhh.exe120⤵PID:2820
-
\??\c:\jdjdj.exec:\jdjdj.exe121⤵PID:2924
-
\??\c:\rlrlffl.exec:\rlrlffl.exe122⤵PID:2928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-