Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe
-
Size
65KB
-
MD5
7bb7e715ea25c8a1a922af47cfac55e9
-
SHA1
36e7d34a40e4ec9a683a16b1ac00b79f6661a932
-
SHA256
ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869
-
SHA512
83fdb769e79e4b20ae49d4d459ce847e5e3565b4c6ad26267a1997142238dba7526c877052f00b06b0e08e7eae7d2cfeb41cb438ad4b00e68e46bb6102a7ee2a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfl9:ymb3NkkiQ3mdBjFI9cqf7
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2132-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/824-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2532 fxfrxrf.exe 2388 1nbhnt.exe 2056 vpjvp.exe 2860 rlxxffl.exe 2892 bbnthn.exe 2724 jvjpv.exe 2776 xrfflfr.exe 2656 thnttt.exe 824 1hbhnh.exe 2004 9vjvd.exe 2664 xrxxlrf.exe 2128 rrflrfr.exe 1624 nbntbh.exe 2032 7nntbn.exe 1668 jdvvj.exe 1664 lxlxrlr.exe 2836 fxflllr.exe 3000 5hbhtt.exe 2700 dvjjp.exe 2956 jvjjj.exe 408 fxrrfxl.exe 2236 ffflrrx.exe 940 hbhhhn.exe 1448 jdpdp.exe 1588 vpjdp.exe 1564 rflflxf.exe 1820 1btbbb.exe 316 hbnntt.exe 2080 pjddd.exe 2536 9rrxrff.exe 2480 rlflrrx.exe 1608 1vdjp.exe 2272 vpddj.exe 2900 lfrxflr.exe 2760 rxxllxx.exe 2860 5bnnnn.exe 2756 tnbhbh.exe 2888 7jvvv.exe 2604 djvjp.exe 2680 xrxrxrf.exe 2156 frflrrf.exe 2000 3nhnnt.exe 824 ttntnt.exe 1716 3vvdj.exe 1924 dvjjp.exe 1264 xrfxxxx.exe 1180 9flrrrl.exe 1624 tttbtb.exe 2672 9bnntn.exe 348 tnttnn.exe 2800 vdjjp.exe 2988 dvpvj.exe 2972 rlfffff.exe 2208 rlrlrxf.exe 1976 htnntt.exe 1556 tthttb.exe 3048 hbhbhb.exe 1856 pjddj.exe 2840 jjvjj.exe 1276 3fxxflx.exe 1916 9xllrlx.exe 1724 nhnhnt.exe 1432 5bhhtn.exe 1404 3jddp.exe -
resource yara_rule behavioral1/memory/2132-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/824-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2532 2132 ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe 31 PID 2132 wrote to memory of 2532 2132 ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe 31 PID 2132 wrote to memory of 2532 2132 ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe 31 PID 2132 wrote to memory of 2532 2132 ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe 31 PID 2532 wrote to memory of 2388 2532 fxfrxrf.exe 32 PID 2532 wrote to memory of 2388 2532 fxfrxrf.exe 32 PID 2532 wrote to memory of 2388 2532 fxfrxrf.exe 32 PID 2532 wrote to memory of 2388 2532 fxfrxrf.exe 32 PID 2388 wrote to memory of 2056 2388 1nbhnt.exe 33 PID 2388 wrote to memory of 2056 2388 1nbhnt.exe 33 PID 2388 wrote to memory of 2056 2388 1nbhnt.exe 33 PID 2388 wrote to memory of 2056 2388 1nbhnt.exe 33 PID 2056 wrote to memory of 2860 2056 vpjvp.exe 34 PID 2056 wrote to memory of 2860 2056 vpjvp.exe 34 PID 2056 wrote to memory of 2860 2056 vpjvp.exe 34 PID 2056 wrote to memory of 2860 2056 vpjvp.exe 34 PID 2860 wrote to memory of 2892 2860 rlxxffl.exe 35 PID 2860 wrote to memory of 2892 2860 rlxxffl.exe 35 PID 2860 wrote to memory of 2892 2860 rlxxffl.exe 35 PID 2860 wrote to memory of 2892 2860 rlxxffl.exe 35 PID 2892 wrote to memory of 2724 2892 bbnthn.exe 36 PID 2892 wrote to memory of 2724 2892 bbnthn.exe 36 PID 2892 wrote to memory of 2724 2892 bbnthn.exe 36 PID 2892 wrote to memory of 2724 2892 bbnthn.exe 36 PID 2724 wrote to memory of 2776 2724 jvjpv.exe 37 PID 2724 wrote to memory of 2776 2724 jvjpv.exe 37 PID 2724 wrote to memory of 2776 2724 jvjpv.exe 37 PID 2724 wrote to memory of 2776 2724 jvjpv.exe 37 PID 2776 wrote to memory of 2656 2776 xrfflfr.exe 38 PID 2776 wrote to memory of 2656 2776 xrfflfr.exe 38 PID 2776 wrote to memory of 2656 2776 xrfflfr.exe 38 PID 2776 wrote to memory of 2656 2776 xrfflfr.exe 38 PID 2656 wrote to memory of 824 2656 thnttt.exe 39 PID 2656 wrote to memory of 824 2656 thnttt.exe 39 PID 2656 wrote to memory of 824 2656 thnttt.exe 39 PID 2656 wrote to memory of 824 2656 thnttt.exe 39 PID 824 wrote to memory of 2004 824 1hbhnh.exe 40 PID 824 wrote to memory of 2004 824 1hbhnh.exe 40 PID 824 wrote to memory of 2004 824 1hbhnh.exe 40 PID 824 wrote to memory of 2004 824 1hbhnh.exe 40 PID 2004 wrote to memory of 2664 2004 9vjvd.exe 41 PID 2004 wrote to memory of 2664 2004 9vjvd.exe 41 PID 2004 wrote to memory of 2664 2004 9vjvd.exe 41 PID 2004 wrote to memory of 2664 2004 9vjvd.exe 41 PID 2664 wrote to memory of 2128 2664 xrxxlrf.exe 42 PID 2664 wrote to memory of 2128 2664 xrxxlrf.exe 42 PID 2664 wrote to memory of 2128 2664 xrxxlrf.exe 42 PID 2664 wrote to memory of 2128 2664 xrxxlrf.exe 42 PID 2128 wrote to memory of 1624 2128 rrflrfr.exe 43 PID 2128 wrote to memory of 1624 2128 rrflrfr.exe 43 PID 2128 wrote to memory of 1624 2128 rrflrfr.exe 43 PID 2128 wrote to memory of 1624 2128 rrflrfr.exe 43 PID 1624 wrote to memory of 2032 1624 nbntbh.exe 44 PID 1624 wrote to memory of 2032 1624 nbntbh.exe 44 PID 1624 wrote to memory of 2032 1624 nbntbh.exe 44 PID 1624 wrote to memory of 2032 1624 nbntbh.exe 44 PID 2032 wrote to memory of 1668 2032 7nntbn.exe 45 PID 2032 wrote to memory of 1668 2032 7nntbn.exe 45 PID 2032 wrote to memory of 1668 2032 7nntbn.exe 45 PID 2032 wrote to memory of 1668 2032 7nntbn.exe 45 PID 1668 wrote to memory of 1664 1668 jdvvj.exe 46 PID 1668 wrote to memory of 1664 1668 jdvvj.exe 46 PID 1668 wrote to memory of 1664 1668 jdvvj.exe 46 PID 1668 wrote to memory of 1664 1668 jdvvj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe"C:\Users\Admin\AppData\Local\Temp\ed9947e6ec9324c8b0be31a6686b13f2571b518070df11cb92c4ed308f658869.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\fxfrxrf.exec:\fxfrxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\1nbhnt.exec:\1nbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\vpjvp.exec:\vpjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\rlxxffl.exec:\rlxxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\bbnthn.exec:\bbnthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\jvjpv.exec:\jvjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xrfflfr.exec:\xrfflfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\thnttt.exec:\thnttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\1hbhnh.exec:\1hbhnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\9vjvd.exec:\9vjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\xrxxlrf.exec:\xrxxlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\rrflrfr.exec:\rrflrfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\nbntbh.exec:\nbntbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\7nntbn.exec:\7nntbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jdvvj.exec:\jdvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\lxlxrlr.exec:\lxlxrlr.exe17⤵
- Executes dropped EXE
PID:1664 -
\??\c:\fxflllr.exec:\fxflllr.exe18⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5hbhtt.exec:\5hbhtt.exe19⤵
- Executes dropped EXE
PID:3000 -
\??\c:\dvjjp.exec:\dvjjp.exe20⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jvjjj.exec:\jvjjj.exe21⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fxrrfxl.exec:\fxrrfxl.exe22⤵
- Executes dropped EXE
PID:408 -
\??\c:\ffflrrx.exec:\ffflrrx.exe23⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hbhhhn.exec:\hbhhhn.exe24⤵
- Executes dropped EXE
PID:940 -
\??\c:\jdpdp.exec:\jdpdp.exe25⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vpjdp.exec:\vpjdp.exe26⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rflflxf.exec:\rflflxf.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\1btbbb.exec:\1btbbb.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hbnntt.exec:\hbnntt.exe29⤵
- Executes dropped EXE
PID:316 -
\??\c:\pjddd.exec:\pjddd.exe30⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9rrxrff.exec:\9rrxrff.exe31⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rlflrrx.exec:\rlflrrx.exe32⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1vdjp.exec:\1vdjp.exe33⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vpddj.exec:\vpddj.exe34⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lfrxflr.exec:\lfrxflr.exe35⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rxxllxx.exec:\rxxllxx.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5bnnnn.exec:\5bnnnn.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tnbhbh.exec:\tnbhbh.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7jvvv.exec:\7jvvv.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\djvjp.exec:\djvjp.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xrxrxrf.exec:\xrxrxrf.exe41⤵
- Executes dropped EXE
PID:2680 -
\??\c:\frflrrf.exec:\frflrrf.exe42⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3nhnnt.exec:\3nhnnt.exe43⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ttntnt.exec:\ttntnt.exe44⤵
- Executes dropped EXE
PID:824 -
\??\c:\3vvdj.exec:\3vvdj.exe45⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dvjjp.exec:\dvjjp.exe46⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xrfxxxx.exec:\xrfxxxx.exe47⤵
- Executes dropped EXE
PID:1264 -
\??\c:\9flrrrl.exec:\9flrrrl.exe48⤵
- Executes dropped EXE
PID:1180 -
\??\c:\tttbtb.exec:\tttbtb.exe49⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9bnntn.exec:\9bnntn.exe50⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tnttnn.exec:\tnttnn.exe51⤵
- Executes dropped EXE
PID:348 -
\??\c:\vdjjp.exec:\vdjjp.exe52⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dvpvj.exec:\dvpvj.exe53⤵
- Executes dropped EXE
PID:2988 -
\??\c:\rlfffff.exec:\rlfffff.exe54⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rlrlrxf.exec:\rlrlrxf.exe55⤵
- Executes dropped EXE
PID:2208 -
\??\c:\htnntt.exec:\htnntt.exe56⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tthttb.exec:\tthttb.exe57⤵
- Executes dropped EXE
PID:1556 -
\??\c:\hbhbhb.exec:\hbhbhb.exe58⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pjddj.exec:\pjddj.exe59⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jjvjj.exec:\jjvjj.exe60⤵
- Executes dropped EXE
PID:2840 -
\??\c:\3fxxflx.exec:\3fxxflx.exe61⤵
- Executes dropped EXE
PID:1276 -
\??\c:\9xllrlx.exec:\9xllrlx.exe62⤵
- Executes dropped EXE
PID:1916 -
\??\c:\nhnhnt.exec:\nhnhnt.exe63⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5bhhtn.exec:\5bhhtn.exe64⤵
- Executes dropped EXE
PID:1432 -
\??\c:\3jddp.exec:\3jddp.exe65⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jppjj.exec:\jppjj.exe66⤵PID:2064
-
\??\c:\rrxlxfr.exec:\rrxlxfr.exe67⤵PID:276
-
\??\c:\rrfrxxf.exec:\rrfrxxf.exe68⤵PID:2348
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe69⤵PID:2540
-
\??\c:\tnhbnt.exec:\tnhbnt.exe70⤵PID:2408
-
\??\c:\5thntb.exec:\5thntb.exe71⤵PID:1520
-
\??\c:\vpvvv.exec:\vpvvv.exe72⤵PID:2716
-
\??\c:\9pjvj.exec:\9pjvj.exe73⤵PID:2096
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe74⤵PID:2920
-
\??\c:\fxrxxfl.exec:\fxrxxfl.exe75⤵PID:2880
-
\??\c:\9hntbh.exec:\9hntbh.exe76⤵PID:2768
-
\??\c:\nhbhhb.exec:\nhbhhb.exe77⤵PID:2640
-
\??\c:\dpjjp.exec:\dpjjp.exe78⤵PID:2724
-
\??\c:\7vjpv.exec:\7vjpv.exe79⤵PID:2600
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe80⤵PID:2668
-
\??\c:\3fxxxxf.exec:\3fxxxxf.exe81⤵PID:2636
-
\??\c:\9lflrrf.exec:\9lflrrf.exe82⤵PID:1984
-
\??\c:\1hbhnn.exec:\1hbhnn.exe83⤵PID:1600
-
\??\c:\ntntnt.exec:\ntntnt.exe84⤵PID:2360
-
\??\c:\pdjdj.exec:\pdjdj.exe85⤵PID:1596
-
\??\c:\9jvvd.exec:\9jvvd.exe86⤵PID:2128
-
\??\c:\xrxxxfr.exec:\xrxxxfr.exe87⤵PID:1548
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe88⤵PID:1944
-
\??\c:\5bhhbh.exec:\5bhhbh.exe89⤵PID:2032
-
\??\c:\nhtbbb.exec:\nhtbbb.exe90⤵PID:2832
-
\??\c:\jvddd.exec:\jvddd.exe91⤵PID:2828
-
\??\c:\pjdvd.exec:\pjdvd.exe92⤵PID:2804
-
\??\c:\lffllfr.exec:\lffllfr.exe93⤵PID:2168
-
\??\c:\7xrfffl.exec:\7xrfffl.exe94⤵PID:2812
-
\??\c:\hbhnnb.exec:\hbhnnb.exe95⤵PID:1544
-
\??\c:\9hnttn.exec:\9hnttn.exe96⤵PID:2956
-
\??\c:\bththn.exec:\bththn.exe97⤵PID:1656
-
\??\c:\dvjpp.exec:\dvjpp.exe98⤵PID:3044
-
\??\c:\jdpvd.exec:\jdpvd.exe99⤵PID:308
-
\??\c:\9fxlrlx.exec:\9fxlrlx.exe100⤵PID:1920
-
\??\c:\3xllrxx.exec:\3xllrxx.exe101⤵PID:1948
-
\??\c:\bnhnbh.exec:\bnhnbh.exe102⤵PID:1588
-
\??\c:\btbtnn.exec:\btbtnn.exe103⤵PID:2092
-
\??\c:\pjppp.exec:\pjppp.exe104⤵PID:1684
-
\??\c:\jvjdp.exec:\jvjdp.exe105⤵PID:2176
-
\??\c:\1lflxrx.exec:\1lflxrx.exe106⤵PID:2180
-
\??\c:\fxrflfx.exec:\fxrflfx.exe107⤵PID:1528
-
\??\c:\thtttb.exec:\thtttb.exe108⤵PID:2512
-
\??\c:\hhtbbh.exec:\hhtbbh.exe109⤵PID:2540
-
\??\c:\hnhbtn.exec:\hnhbtn.exe110⤵PID:2408
-
\??\c:\dpdjv.exec:\dpdjv.exe111⤵PID:2124
-
\??\c:\vpppv.exec:\vpppv.exe112⤵PID:2940
-
\??\c:\7fllfxx.exec:\7fllfxx.exe113⤵PID:2096
-
\??\c:\3xlxxff.exec:\3xlxxff.exe114⤵PID:2760
-
\??\c:\bttttt.exec:\bttttt.exe115⤵PID:2880
-
\??\c:\nhnntn.exec:\nhnntn.exe116⤵PID:2732
-
\??\c:\hthhhn.exec:\hthhhn.exe117⤵PID:2640
-
\??\c:\3pvvv.exec:\3pvvv.exe118⤵PID:2772
-
\??\c:\3vpvv.exec:\3vpvv.exe119⤵PID:2392
-
\??\c:\xxfrxxf.exec:\xxfrxxf.exe120⤵PID:2676
-
\??\c:\xrlfrfl.exec:\xrlfrfl.exe121⤵PID:944
-
\??\c:\3thbbb.exec:\3thbbb.exe122⤵PID:1828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-