Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-09-2024 12:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6281c3bd3847542a6dd73c29a6d73d16748848e1c9c60d99e38634b86ae808faN.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
6281c3bd3847542a6dd73c29a6d73d16748848e1c9c60d99e38634b86ae808faN.exe
-
Size
418KB
-
MD5
4ad438824d278a6a85ac68d0079d10d0
-
SHA1
a0dc803bc7b73cb775304be6a11fd1417aa9fd05
-
SHA256
6281c3bd3847542a6dd73c29a6d73d16748848e1c9c60d99e38634b86ae808fa
-
SHA512
b12be3338ed39e705b4ae4a07d3faade087e0c4d5e58da004a6ff0b04bffe965478325d8f8582c93f6dbad0075468a367668f3b06fa5f4cb71cd64f2e0a7e173
-
SSDEEP
12288:n3C9ytvngQj4DtvnV9wLn9UTfC8eieJNBNIsYPT:SgdnJUdnV9z
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1320-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/316-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2744 xxrfrxl.exe 2696 xlrxfll.exe 2756 ppdjv.exe 2592 btthth.exe 2588 xfxflrx.exe 3016 hbtbhn.exe 1596 xxlrflr.exe 2880 ntnbnt.exe 2364 xllrxxf.exe 1656 hhbhnt.exe 2052 7lfffxx.exe 2272 tnttbh.exe 2724 3pjvd.exe 316 5xfxffl.exe 576 ddppp.exe 2352 xrrxffl.exe 2268 vjvpv.exe 2432 dpvdd.exe 2388 tnbhhn.exe 2124 pdppd.exe 720 1lxffxr.exe 2508 bbtbnn.exe 1016 xllflfx.exe 2984 rfrxffr.exe 1584 1jvvp.exe 2460 nnnntb.exe 2248 3jvpp.exe 1944 xfllrxx.exe 1764 jdpvd.exe 1552 fxllrrx.exe 2776 thnnnn.exe 2652 jvjjv.exe 2664 9thhnn.exe 2728 1jdpv.exe 2816 3lxxfrx.exe 2720 hthhhh.exe 2660 jvjdv.exe 2072 1vvvd.exe 3008 rfxlrlr.exe 3016 bntbnh.exe 2916 3nnthn.exe 3024 1pvpd.exe 2136 frxrxrx.exe 1536 3thttt.exe 1308 9vpvp.exe 2348 xrllxfr.exe 2052 xrffrrx.exe 2852 nhhhtn.exe 2740 jjppv.exe 2864 jdjpp.exe 236 xlrllll.exe 592 tntbhn.exe 1316 ddppj.exe 2436 5dpjp.exe 2456 rflffxf.exe 448 hbhbnt.exe 2096 vjvpv.exe 1388 pjvvd.exe 972 fxrxlxr.exe 1880 nhbhtb.exe 1292 bbnntt.exe 1348 9pppp.exe 3036 rrxxlff.exe 1248 htnntn.exe -
resource yara_rule behavioral1/memory/1320-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1320 wrote to memory of 2744 1320 6281c3bd3847542a6dd73c29a6d73d16748848e1c9c60d99e38634b86ae808faN.exe 30 PID 1320 wrote to memory of 2744 1320 6281c3bd3847542a6dd73c29a6d73d16748848e1c9c60d99e38634b86ae808faN.exe 30 PID 1320 wrote to memory of 2744 1320 6281c3bd3847542a6dd73c29a6d73d16748848e1c9c60d99e38634b86ae808faN.exe 30 PID 1320 wrote to memory of 2744 1320 6281c3bd3847542a6dd73c29a6d73d16748848e1c9c60d99e38634b86ae808faN.exe 30 PID 2744 wrote to memory of 2696 2744 xxrfrxl.exe 31 PID 2744 wrote to memory of 2696 2744 xxrfrxl.exe 31 PID 2744 wrote to memory of 2696 2744 xxrfrxl.exe 31 PID 2744 wrote to memory of 2696 2744 xxrfrxl.exe 31 PID 2696 wrote to memory of 2756 2696 xlrxfll.exe 32 PID 2696 wrote to memory of 2756 2696 xlrxfll.exe 32 PID 2696 wrote to memory of 2756 2696 xlrxfll.exe 32 PID 2696 wrote to memory of 2756 2696 xlrxfll.exe 32 PID 2756 wrote to memory of 2592 2756 ppdjv.exe 33 PID 2756 wrote to memory of 2592 2756 ppdjv.exe 33 PID 2756 wrote to memory of 2592 2756 ppdjv.exe 33 PID 2756 wrote to memory of 2592 2756 ppdjv.exe 33 PID 2592 wrote to memory of 2588 2592 btthth.exe 34 PID 2592 wrote to memory of 2588 2592 btthth.exe 34 PID 2592 wrote to memory of 2588 2592 btthth.exe 34 PID 2592 wrote to memory of 2588 2592 btthth.exe 34 PID 2588 wrote to memory of 3016 2588 xfxflrx.exe 35 PID 2588 wrote to memory of 3016 2588 xfxflrx.exe 35 PID 2588 wrote to memory of 3016 2588 xfxflrx.exe 35 PID 2588 wrote to memory of 3016 2588 xfxflrx.exe 35 PID 3016 wrote to memory of 1596 3016 hbtbhn.exe 36 PID 3016 wrote to memory of 1596 3016 hbtbhn.exe 36 PID 3016 wrote to memory of 1596 3016 hbtbhn.exe 36 PID 3016 wrote to memory of 1596 3016 hbtbhn.exe 36 PID 1596 wrote to memory of 2880 1596 xxlrflr.exe 37 PID 1596 wrote to memory of 2880 1596 xxlrflr.exe 37 PID 1596 wrote to memory of 2880 1596 xxlrflr.exe 37 PID 1596 wrote to memory of 2880 1596 xxlrflr.exe 37 PID 2880 wrote to memory of 2364 2880 ntnbnt.exe 38 PID 2880 wrote to memory of 2364 2880 ntnbnt.exe 38 PID 2880 wrote to memory of 2364 2880 ntnbnt.exe 38 PID 2880 wrote to memory of 2364 2880 ntnbnt.exe 38 PID 2364 wrote to memory of 1656 2364 xllrxxf.exe 39 PID 2364 wrote to memory of 1656 2364 xllrxxf.exe 39 PID 2364 wrote to memory of 1656 2364 xllrxxf.exe 39 PID 2364 wrote to memory of 1656 2364 xllrxxf.exe 39 PID 1656 wrote to memory of 2052 1656 hhbhnt.exe 40 PID 1656 wrote to memory of 2052 1656 hhbhnt.exe 40 PID 1656 wrote to memory of 2052 1656 hhbhnt.exe 40 PID 1656 wrote to memory of 2052 1656 hhbhnt.exe 40 PID 2052 wrote to memory of 2272 2052 7lfffxx.exe 41 PID 2052 wrote to memory of 2272 2052 7lfffxx.exe 41 PID 2052 wrote to memory of 2272 2052 7lfffxx.exe 41 PID 2052 wrote to memory of 2272 2052 7lfffxx.exe 41 PID 2272 wrote to memory of 2724 2272 tnttbh.exe 42 PID 2272 wrote to memory of 2724 2272 tnttbh.exe 42 PID 2272 wrote to memory of 2724 2272 tnttbh.exe 42 PID 2272 wrote to memory of 2724 2272 tnttbh.exe 42 PID 2724 wrote to memory of 316 2724 3pjvd.exe 43 PID 2724 wrote to memory of 316 2724 3pjvd.exe 43 PID 2724 wrote to memory of 316 2724 3pjvd.exe 43 PID 2724 wrote to memory of 316 2724 3pjvd.exe 43 PID 316 wrote to memory of 576 316 5xfxffl.exe 44 PID 316 wrote to memory of 576 316 5xfxffl.exe 44 PID 316 wrote to memory of 576 316 5xfxffl.exe 44 PID 316 wrote to memory of 576 316 5xfxffl.exe 44 PID 576 wrote to memory of 2352 576 ddppp.exe 45 PID 576 wrote to memory of 2352 576 ddppp.exe 45 PID 576 wrote to memory of 2352 576 ddppp.exe 45 PID 576 wrote to memory of 2352 576 ddppp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6281c3bd3847542a6dd73c29a6d73d16748848e1c9c60d99e38634b86ae808faN.exe"C:\Users\Admin\AppData\Local\Temp\6281c3bd3847542a6dd73c29a6d73d16748848e1c9c60d99e38634b86ae808faN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xlrxfll.exec:\xlrxfll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\ppdjv.exec:\ppdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\btthth.exec:\btthth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xfxflrx.exec:\xfxflrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hbtbhn.exec:\hbtbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\xxlrflr.exec:\xxlrflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\ntnbnt.exec:\ntnbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xllrxxf.exec:\xllrxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\hhbhnt.exec:\hhbhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\7lfffxx.exec:\7lfffxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\tnttbh.exec:\tnttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\3pjvd.exec:\3pjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\5xfxffl.exec:\5xfxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\ddppp.exec:\ddppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\xrrxffl.exec:\xrrxffl.exe17⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vjvpv.exec:\vjvpv.exe18⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dpvdd.exec:\dpvdd.exe19⤵
- Executes dropped EXE
PID:2432 -
\??\c:\tnbhhn.exec:\tnbhhn.exe20⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pdppd.exec:\pdppd.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\1lxffxr.exec:\1lxffxr.exe22⤵
- Executes dropped EXE
PID:720 -
\??\c:\bbtbnn.exec:\bbtbnn.exe23⤵
- Executes dropped EXE
PID:2508 -
\??\c:\xllflfx.exec:\xllflfx.exe24⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rfrxffr.exec:\rfrxffr.exe25⤵
- Executes dropped EXE
PID:2984 -
\??\c:\1jvvp.exec:\1jvvp.exe26⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nnnntb.exec:\nnnntb.exe27⤵
- Executes dropped EXE
PID:2460 -
\??\c:\3jvpp.exec:\3jvpp.exe28⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xfllrxx.exec:\xfllrxx.exe29⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jdpvd.exec:\jdpvd.exe30⤵
- Executes dropped EXE
PID:1764 -
\??\c:\fxllrrx.exec:\fxllrrx.exe31⤵
- Executes dropped EXE
PID:1552 -
\??\c:\thnnnn.exec:\thnnnn.exe32⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jvjjv.exec:\jvjjv.exe33⤵
- Executes dropped EXE
PID:2652 -
\??\c:\9thhnn.exec:\9thhnn.exe34⤵
- Executes dropped EXE
PID:2664 -
\??\c:\1jdpv.exec:\1jdpv.exe35⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3lxxfrx.exec:\3lxxfrx.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hthhhh.exec:\hthhhh.exe37⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jvjdv.exec:\jvjdv.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\1vvvd.exec:\1vvvd.exe39⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rfxlrlr.exec:\rfxlrlr.exe40⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bntbnh.exec:\bntbnh.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3nnthn.exec:\3nnthn.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1pvpd.exec:\1pvpd.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\frxrxrx.exec:\frxrxrx.exe44⤵
- Executes dropped EXE
PID:2136 -
\??\c:\3thttt.exec:\3thttt.exe45⤵
- Executes dropped EXE
PID:1536 -
\??\c:\9vpvp.exec:\9vpvp.exe46⤵
- Executes dropped EXE
PID:1308 -
\??\c:\xrllxfr.exec:\xrllxfr.exe47⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xrffrrx.exec:\xrffrrx.exe48⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nhhhtn.exec:\nhhhtn.exe49⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jjppv.exec:\jjppv.exe50⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jdjpp.exec:\jdjpp.exe51⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xlrllll.exec:\xlrllll.exe52⤵
- Executes dropped EXE
PID:236 -
\??\c:\tntbhn.exec:\tntbhn.exe53⤵
- Executes dropped EXE
PID:592 -
\??\c:\ddppj.exec:\ddppj.exe54⤵
- Executes dropped EXE
PID:1316 -
\??\c:\5dpjp.exec:\5dpjp.exe55⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rflffxf.exec:\rflffxf.exe56⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hbhbnt.exec:\hbhbnt.exe57⤵
- Executes dropped EXE
PID:448 -
\??\c:\vjvpv.exec:\vjvpv.exe58⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjvvd.exec:\pjvvd.exe59⤵
- Executes dropped EXE
PID:1388 -
\??\c:\fxrxlxr.exec:\fxrxlxr.exe60⤵
- Executes dropped EXE
PID:972 -
\??\c:\nhbhtb.exec:\nhbhtb.exe61⤵
- Executes dropped EXE
PID:1880 -
\??\c:\bbnntt.exec:\bbnntt.exe62⤵
- Executes dropped EXE
PID:1292 -
\??\c:\9pppp.exec:\9pppp.exe63⤵
- Executes dropped EXE
PID:1348 -
\??\c:\rrxxlff.exec:\rrxxlff.exe64⤵
- Executes dropped EXE
PID:3036 -
\??\c:\htnntn.exec:\htnntn.exe65⤵
- Executes dropped EXE
PID:1248 -
\??\c:\1tbttt.exec:\1tbttt.exe66⤵PID:2148
-
\??\c:\7pjpj.exec:\7pjpj.exe67⤵PID:2036
-
\??\c:\3xxlrrx.exec:\3xxlrrx.exe68⤵PID:1384
-
\??\c:\fxrxxxf.exec:\fxrxxxf.exe69⤵PID:2328
-
\??\c:\thnnhn.exec:\thnnhn.exe70⤵PID:1728
-
\??\c:\vvjdp.exec:\vvjdp.exe71⤵PID:2688
-
\??\c:\dpddj.exec:\dpddj.exe72⤵PID:2804
-
\??\c:\ffrxflx.exec:\ffrxflx.exe73⤵PID:2552
-
\??\c:\btbbhb.exec:\btbbhb.exe74⤵PID:2652
-
\??\c:\htbntn.exec:\htbntn.exe75⤵PID:2664
-
\??\c:\pvjdd.exec:\pvjdd.exe76⤵PID:2728
-
\??\c:\lfxfllx.exec:\lfxfllx.exe77⤵PID:2548
-
\??\c:\xrxlxxl.exec:\xrxlxxl.exe78⤵PID:2720
-
\??\c:\tnhntb.exec:\tnhntb.exe79⤵PID:2660
-
\??\c:\pjvpp.exec:\pjvpp.exe80⤵PID:2072
-
\??\c:\fxrxllx.exec:\fxrxllx.exe81⤵PID:1748
-
\??\c:\lfrxxrx.exec:\lfrxxrx.exe82⤵PID:3016
-
\??\c:\3hhttb.exec:\3hhttb.exe83⤵PID:2240
-
\??\c:\vppjj.exec:\vppjj.exe84⤵PID:3024
-
\??\c:\jvjjp.exec:\jvjjp.exe85⤵PID:2408
-
\??\c:\lflrflr.exec:\lflrflr.exe86⤵PID:1536
-
\??\c:\1bbbnn.exec:\1bbbnn.exe87⤵PID:1756
-
\??\c:\1pjjp.exec:\1pjjp.exe88⤵PID:2348
-
\??\c:\5vpvv.exec:\5vpvv.exe89⤵PID:2052
-
\??\c:\lfrxllr.exec:\lfrxllr.exe90⤵PID:2852
-
\??\c:\9hbhnn.exec:\9hbhnn.exe91⤵PID:320
-
\??\c:\hbhbhb.exec:\hbhbhb.exe92⤵PID:2864
-
\??\c:\dvjpj.exec:\dvjpj.exe93⤵PID:2164
-
\??\c:\3fxxflr.exec:\3fxxflr.exe94⤵PID:592
-
\??\c:\9hbtbb.exec:\9hbtbb.exe95⤵PID:1316
-
\??\c:\bbhhtn.exec:\bbhhtn.exe96⤵PID:2436
-
\??\c:\pjvdj.exec:\pjvdj.exe97⤵PID:2144
-
\??\c:\9llrflr.exec:\9llrflr.exe98⤵PID:448
-
\??\c:\hbhhtb.exec:\hbhhtb.exe99⤵PID:3000
-
\??\c:\nbhbhh.exec:\nbhbhh.exe100⤵PID:1096
-
\??\c:\ppdjp.exec:\ppdjp.exe101⤵PID:1000
-
\??\c:\lxrllfl.exec:\lxrllfl.exe102⤵PID:1880
-
\??\c:\thtthh.exec:\thtthh.exe103⤵PID:2976
-
\??\c:\ntnbnn.exec:\ntnbnn.exe104⤵PID:1784
-
\??\c:\djdjp.exec:\djdjp.exe105⤵PID:1584
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe106⤵PID:1248
-
\??\c:\llxlllx.exec:\llxlllx.exe107⤵PID:2148
-
\??\c:\7bnthh.exec:\7bnthh.exe108⤵PID:2460
-
\??\c:\7jppp.exec:\7jppp.exe109⤵PID:1944
-
\??\c:\vjdvp.exec:\vjdvp.exe110⤵PID:1420
-
\??\c:\xrrrlll.exec:\xrrrlll.exe111⤵PID:1552
-
\??\c:\bhtbhh.exec:\bhtbhh.exe112⤵PID:2688
-
\??\c:\tnbbhh.exec:\tnbbhh.exe113⤵PID:2800
-
\??\c:\jjjvp.exec:\jjjvp.exe114⤵PID:2552
-
\??\c:\fxfrrxl.exec:\fxfrrxl.exe115⤵PID:2568
-
\??\c:\rlxxllr.exec:\rlxxllr.exe116⤵PID:2664
-
\??\c:\hbtbht.exec:\hbtbht.exe117⤵PID:2728
-
\??\c:\vjppv.exec:\vjppv.exe118⤵PID:2548
-
\??\c:\9vvdp.exec:\9vvdp.exe119⤵PID:3020
-
\??\c:\rlrlllr.exec:\rlrlllr.exe120⤵PID:2016
-
\??\c:\hbnthh.exec:\hbnthh.exe121⤵PID:2072
-
\??\c:\jdpvv.exec:\jdpvv.exe122⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-