Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 07:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f9e02b011583abd9e934a552224d0d0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
8f9e02b011583abd9e934a552224d0d0N.exe
-
Size
72KB
-
MD5
8f9e02b011583abd9e934a552224d0d0
-
SHA1
cb37fff0c3ca91df4a5042167f19f01768b27d32
-
SHA256
a0c0134c1663dc7814e4178fea8987327a784dfffd499e2ec442bbbc091f51e9
-
SHA512
33c629c9f68be9abbd5d405e626d13891779e4acc0920edc8c5573a4529b725ec4fa1ffc812ed4fbfa6de0c26809ff500ca62fe968094fb1ccbd043c1cec6cf1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIYgC/KSLJUu:ymb3NkkiQ3mdBjFI3eF7
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/1312-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-293-0x0000000076B80000-0x0000000076C9F000-memory.dmp family_blackmoon behavioral1/memory/2204-294-0x0000000076CA0000-0x0000000076D9A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2692 fxxxxxx.exe 2148 bnbhtt.exe 2516 jdjpp.exe 568 ffxfrxl.exe 2720 tnhbhn.exe 3024 jdvjp.exe 3020 vdjpp.exe 2640 rrrrxrf.exe 2632 hbnntn.exe 2304 pjdjv.exe 1712 9rlrxfr.exe 896 xrrxflr.exe 1924 nhnbht.exe 2040 dvjjp.exe 1608 jvvdj.exe 1596 rrrxrxl.exe 1736 1xfrffl.exe 2880 3hnbnn.exe 2968 9dvdp.exe 3000 jdjpp.exe 1092 xxlflrx.exe 2596 xrrxfll.exe 604 nhbbhh.exe 812 5vvvj.exe 1280 vjpvv.exe 2256 xrllrrf.exe 2460 5bnthn.exe 1776 dvjvd.exe 1620 1vpvj.exe 2204 fxrxxfl.exe 2416 ttbbnn.exe 2320 jdvdd.exe 2156 dvjjp.exe 2796 rxrfffr.exe 2516 xrrxllx.exe 2844 tththn.exe 2840 bthhnt.exe 2804 jvjjj.exe 2776 djpvj.exe 2980 9lrfxxf.exe 2660 rlxfxrf.exe 2676 tnhthn.exe 1624 bthnbh.exe 2632 dvpvv.exe 1512 jjdpd.exe 2028 llrxffx.exe 2512 nhtbhn.exe 340 nhbbnn.exe 1796 ppddj.exe 1180 jdjdj.exe 1608 ffxxrfl.exe 1892 xrrxflr.exe 2888 7lfrflr.exe 2188 nbtbhn.exe 2196 hhtbtn.exe 2968 3dvjp.exe 352 1pvvj.exe 1128 xlxfxxf.exe 2012 lfxlrrx.exe 1848 hbnbbn.exe 1944 hbntnt.exe 884 jdppv.exe 1308 jjppd.exe 1320 frxrxlx.exe -
resource yara_rule behavioral1/memory/1312-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1312 wrote to memory of 2692 1312 8f9e02b011583abd9e934a552224d0d0N.exe 30 PID 1312 wrote to memory of 2692 1312 8f9e02b011583abd9e934a552224d0d0N.exe 30 PID 1312 wrote to memory of 2692 1312 8f9e02b011583abd9e934a552224d0d0N.exe 30 PID 1312 wrote to memory of 2692 1312 8f9e02b011583abd9e934a552224d0d0N.exe 30 PID 2692 wrote to memory of 2148 2692 fxxxxxx.exe 31 PID 2692 wrote to memory of 2148 2692 fxxxxxx.exe 31 PID 2692 wrote to memory of 2148 2692 fxxxxxx.exe 31 PID 2692 wrote to memory of 2148 2692 fxxxxxx.exe 31 PID 2148 wrote to memory of 2516 2148 bnbhtt.exe 32 PID 2148 wrote to memory of 2516 2148 bnbhtt.exe 32 PID 2148 wrote to memory of 2516 2148 bnbhtt.exe 32 PID 2148 wrote to memory of 2516 2148 bnbhtt.exe 32 PID 2516 wrote to memory of 568 2516 jdjpp.exe 33 PID 2516 wrote to memory of 568 2516 jdjpp.exe 33 PID 2516 wrote to memory of 568 2516 jdjpp.exe 33 PID 2516 wrote to memory of 568 2516 jdjpp.exe 33 PID 568 wrote to memory of 2720 568 ffxfrxl.exe 34 PID 568 wrote to memory of 2720 568 ffxfrxl.exe 34 PID 568 wrote to memory of 2720 568 ffxfrxl.exe 34 PID 568 wrote to memory of 2720 568 ffxfrxl.exe 34 PID 2720 wrote to memory of 3024 2720 tnhbhn.exe 35 PID 2720 wrote to memory of 3024 2720 tnhbhn.exe 35 PID 2720 wrote to memory of 3024 2720 tnhbhn.exe 35 PID 2720 wrote to memory of 3024 2720 tnhbhn.exe 35 PID 3024 wrote to memory of 3020 3024 jdvjp.exe 36 PID 3024 wrote to memory of 3020 3024 jdvjp.exe 36 PID 3024 wrote to memory of 3020 3024 jdvjp.exe 36 PID 3024 wrote to memory of 3020 3024 jdvjp.exe 36 PID 3020 wrote to memory of 2640 3020 vdjpp.exe 37 PID 3020 wrote to memory of 2640 3020 vdjpp.exe 37 PID 3020 wrote to memory of 2640 3020 vdjpp.exe 37 PID 3020 wrote to memory of 2640 3020 vdjpp.exe 37 PID 2640 wrote to memory of 2632 2640 rrrrxrf.exe 38 PID 2640 wrote to memory of 2632 2640 rrrrxrf.exe 38 PID 2640 wrote to memory of 2632 2640 rrrrxrf.exe 38 PID 2640 wrote to memory of 2632 2640 rrrrxrf.exe 38 PID 2632 wrote to memory of 2304 2632 hbnntn.exe 39 PID 2632 wrote to memory of 2304 2632 hbnntn.exe 39 PID 2632 wrote to memory of 2304 2632 hbnntn.exe 39 PID 2632 wrote to memory of 2304 2632 hbnntn.exe 39 PID 2304 wrote to memory of 1712 2304 pjdjv.exe 40 PID 2304 wrote to memory of 1712 2304 pjdjv.exe 40 PID 2304 wrote to memory of 1712 2304 pjdjv.exe 40 PID 2304 wrote to memory of 1712 2304 pjdjv.exe 40 PID 1712 wrote to memory of 896 1712 9rlrxfr.exe 41 PID 1712 wrote to memory of 896 1712 9rlrxfr.exe 41 PID 1712 wrote to memory of 896 1712 9rlrxfr.exe 41 PID 1712 wrote to memory of 896 1712 9rlrxfr.exe 41 PID 896 wrote to memory of 1924 896 xrrxflr.exe 42 PID 896 wrote to memory of 1924 896 xrrxflr.exe 42 PID 896 wrote to memory of 1924 896 xrrxflr.exe 42 PID 896 wrote to memory of 1924 896 xrrxflr.exe 42 PID 1924 wrote to memory of 2040 1924 nhnbht.exe 43 PID 1924 wrote to memory of 2040 1924 nhnbht.exe 43 PID 1924 wrote to memory of 2040 1924 nhnbht.exe 43 PID 1924 wrote to memory of 2040 1924 nhnbht.exe 43 PID 2040 wrote to memory of 1608 2040 dvjjp.exe 44 PID 2040 wrote to memory of 1608 2040 dvjjp.exe 44 PID 2040 wrote to memory of 1608 2040 dvjjp.exe 44 PID 2040 wrote to memory of 1608 2040 dvjjp.exe 44 PID 1608 wrote to memory of 1596 1608 jvvdj.exe 45 PID 1608 wrote to memory of 1596 1608 jvvdj.exe 45 PID 1608 wrote to memory of 1596 1608 jvvdj.exe 45 PID 1608 wrote to memory of 1596 1608 jvvdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f9e02b011583abd9e934a552224d0d0N.exe"C:\Users\Admin\AppData\Local\Temp\8f9e02b011583abd9e934a552224d0d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\bnbhtt.exec:\bnbhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\jdjpp.exec:\jdjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\tnhbhn.exec:\tnhbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jdvjp.exec:\jdvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\vdjpp.exec:\vdjpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\rrrrxrf.exec:\rrrrxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hbnntn.exec:\hbnntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pjdjv.exec:\pjdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\9rlrxfr.exec:\9rlrxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\xrrxflr.exec:\xrrxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\nhnbht.exec:\nhnbht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\dvjjp.exec:\dvjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jvvdj.exec:\jvvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\rrrxrxl.exec:\rrrxrxl.exe17⤵
- Executes dropped EXE
PID:1596 -
\??\c:\1xfrffl.exec:\1xfrffl.exe18⤵
- Executes dropped EXE
PID:1736 -
\??\c:\3hnbnn.exec:\3hnbnn.exe19⤵
- Executes dropped EXE
PID:2880 -
\??\c:\9dvdp.exec:\9dvdp.exe20⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jdjpp.exec:\jdjpp.exe21⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xxlflrx.exec:\xxlflrx.exe22⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xrrxfll.exec:\xrrxfll.exe23⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nhbbhh.exec:\nhbbhh.exe24⤵
- Executes dropped EXE
PID:604 -
\??\c:\5vvvj.exec:\5vvvj.exe25⤵
- Executes dropped EXE
PID:812 -
\??\c:\vjpvv.exec:\vjpvv.exe26⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xrllrrf.exec:\xrllrrf.exe27⤵
- Executes dropped EXE
PID:2256 -
\??\c:\5bnthn.exec:\5bnthn.exe28⤵
- Executes dropped EXE
PID:2460 -
\??\c:\dvjvd.exec:\dvjvd.exe29⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1vpvj.exec:\1vpvj.exe30⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe31⤵
- Executes dropped EXE
PID:2204 -
\??\c:\fxflxfr.exec:\fxflxfr.exe32⤵PID:2088
-
\??\c:\ttbbnn.exec:\ttbbnn.exe33⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jdvdd.exec:\jdvdd.exe34⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dvjjp.exec:\dvjjp.exe35⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rxrfffr.exec:\rxrfffr.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xrrxllx.exec:\xrrxllx.exe37⤵
- Executes dropped EXE
PID:2516 -
\??\c:\tththn.exec:\tththn.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bthhnt.exec:\bthhnt.exe39⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jvjjj.exec:\jvjjj.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\djpvj.exec:\djpvj.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9lrfxxf.exec:\9lrfxxf.exe42⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rlxfxrf.exec:\rlxfxrf.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tnhthn.exec:\tnhthn.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bthnbh.exec:\bthnbh.exe45⤵
- Executes dropped EXE
PID:1624 -
\??\c:\dvpvv.exec:\dvpvv.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jjdpd.exec:\jjdpd.exe47⤵
- Executes dropped EXE
PID:1512 -
\??\c:\llrxffx.exec:\llrxffx.exe48⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nhtbhn.exec:\nhtbhn.exe49⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nhbbnn.exec:\nhbbnn.exe50⤵
- Executes dropped EXE
PID:340 -
\??\c:\ppddj.exec:\ppddj.exe51⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jdjdj.exec:\jdjdj.exe52⤵
- Executes dropped EXE
PID:1180 -
\??\c:\ffxxrfl.exec:\ffxxrfl.exe53⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xrrxflr.exec:\xrrxflr.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\7lfrflr.exec:\7lfrflr.exe55⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nbtbhn.exec:\nbtbhn.exe56⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hhtbtn.exec:\hhtbtn.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\3dvjp.exec:\3dvjp.exe58⤵
- Executes dropped EXE
PID:2968 -
\??\c:\1pvvj.exec:\1pvvj.exe59⤵
- Executes dropped EXE
PID:352 -
\??\c:\xlxfxxf.exec:\xlxfxxf.exe60⤵
- Executes dropped EXE
PID:1128 -
\??\c:\lfxlrrx.exec:\lfxlrrx.exe61⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hbnbbn.exec:\hbnbbn.exe62⤵
- Executes dropped EXE
PID:1848 -
\??\c:\hbntnt.exec:\hbntnt.exe63⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jdppv.exec:\jdppv.exe64⤵
- Executes dropped EXE
PID:884 -
\??\c:\jjppd.exec:\jjppd.exe65⤵
- Executes dropped EXE
PID:1308 -
\??\c:\frxrxlx.exec:\frxrxlx.exe66⤵
- Executes dropped EXE
PID:1320 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe67⤵PID:344
-
\??\c:\tnhthn.exec:\tnhthn.exe68⤵PID:2484
-
\??\c:\bbnbnt.exec:\bbnbnt.exe69⤵PID:1480
-
\??\c:\pjdvd.exec:\pjdvd.exe70⤵PID:1312
-
\??\c:\vpjpd.exec:\vpjpd.exe71⤵PID:2204
-
\??\c:\5xrlxxl.exec:\5xrlxxl.exe72⤵PID:2088
-
\??\c:\lrxlfxr.exec:\lrxlfxr.exe73⤵PID:1692
-
\??\c:\ntthbt.exec:\ntthbt.exe74⤵PID:2176
-
\??\c:\5tttbt.exec:\5tttbt.exe75⤵PID:2320
-
\??\c:\ddvvj.exec:\ddvvj.exe76⤵PID:2440
-
\??\c:\3djjv.exec:\3djjv.exe77⤵PID:2796
-
\??\c:\9fxxllx.exec:\9fxxllx.exe78⤵PID:2516
-
\??\c:\rxfflfl.exec:\rxfflfl.exe79⤵PID:2844
-
\??\c:\hbthbh.exec:\hbthbh.exe80⤵PID:2748
-
\??\c:\bthnhb.exec:\bthnhb.exe81⤵PID:2804
-
\??\c:\dvdjp.exec:\dvdjp.exe82⤵PID:2700
-
\??\c:\jdjvd.exec:\jdjvd.exe83⤵PID:2980
-
\??\c:\llfxlxf.exec:\llfxlxf.exe84⤵PID:2660
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe85⤵PID:2684
-
\??\c:\htnbth.exec:\htnbth.exe86⤵PID:1400
-
\??\c:\hbnhtt.exec:\hbnhtt.exe87⤵PID:2632
-
\??\c:\jjvjj.exec:\jjvjj.exe88⤵PID:2444
-
\??\c:\vvdjv.exec:\vvdjv.exe89⤵PID:2028
-
\??\c:\5rrrxlf.exec:\5rrrxlf.exe90⤵PID:1672
-
\??\c:\9lllrrl.exec:\9lllrrl.exe91⤵PID:340
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe92⤵PID:1560
-
\??\c:\9nhhnb.exec:\9nhhnb.exe93⤵PID:2032
-
\??\c:\5nnthn.exec:\5nnthn.exe94⤵PID:2900
-
\??\c:\jjdjp.exec:\jjdjp.exe95⤵PID:2292
-
\??\c:\5ppvd.exec:\5ppvd.exe96⤵PID:764
-
\??\c:\9rlrffl.exec:\9rlrffl.exe97⤵PID:2436
-
\??\c:\9fflrfr.exec:\9fflrfr.exe98⤵PID:2248
-
\??\c:\tbhbtn.exec:\tbhbtn.exe99⤵PID:1784
-
\??\c:\9nbhnn.exec:\9nbhnn.exe100⤵PID:2216
-
\??\c:\bhntnn.exec:\bhntnn.exe101⤵PID:2596
-
\??\c:\9pjvj.exec:\9pjvj.exe102⤵PID:1076
-
\??\c:\pvdvp.exec:\pvdvp.exe103⤵PID:1768
-
\??\c:\5rlxllx.exec:\5rlxllx.exe104⤵PID:2184
-
\??\c:\rlxxffr.exec:\rlxxffr.exe105⤵PID:884
-
\??\c:\nhtbtb.exec:\nhtbtb.exe106⤵PID:2124
-
\??\c:\hbnthh.exec:\hbnthh.exe107⤵PID:2496
-
\??\c:\jvddj.exec:\jvddj.exe108⤵PID:372
-
\??\c:\5dpdd.exec:\5dpdd.exe109⤵PID:2540
-
\??\c:\lxxfxfx.exec:\lxxfxfx.exe110⤵PID:2424
-
\??\c:\llfrxlf.exec:\llfrxlf.exe111⤵PID:924
-
\??\c:\tntbtn.exec:\tntbtn.exe112⤵PID:1428
-
\??\c:\bttbbh.exec:\bttbbh.exe113⤵PID:2504
-
\??\c:\3dpdj.exec:\3dpdj.exe114⤵PID:2120
-
\??\c:\3dddj.exec:\3dddj.exe115⤵PID:2172
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe116⤵PID:2400
-
\??\c:\xrlrxlx.exec:\xrlrxlx.exe117⤵PID:2744
-
\??\c:\tntbbh.exec:\tntbbh.exe118⤵PID:2768
-
\??\c:\5bnntt.exec:\5bnntt.exe119⤵PID:2740
-
\??\c:\nnbhhn.exec:\nnbhhn.exe120⤵PID:2732
-
\??\c:\1dpdv.exec:\1dpdv.exe121⤵PID:2984
-
\??\c:\pjvdj.exec:\pjvdj.exe122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-