Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:26
Static task
static1
Behavioral task
behavioral1
Sample
44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe
Resource
win7-20240903-en
General
-
Target
44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe
-
Size
71KB
-
MD5
e6bd64c9052ea30a44c5ea7ba87bf2e0
-
SHA1
43b903f486e65d5dd28dd53e51e9e21982fb3725
-
SHA256
44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ff
-
SHA512
1f93b9e4b913d113361abac41ae58d458ec941ecef3875ac60bb086fd301a74b3e78568e7872f070a0159162d75b37a03bc6ccaf25a75ca2efac6a09e69117c1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdLH+t:ymb3NkkiQ3mdBjF0yMliCt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2392-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/748-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2740 hbbnnt.exe 2652 1rlrxxr.exe 2756 ttnhnn.exe 2796 hbbbhn.exe 2084 ppjjj.exe 2608 xxrxllf.exe 3052 btnbnn.exe 776 5dvjj.exe 2092 rlrxrxl.exe 2384 bbtbtt.exe 2856 ddvjj.exe 2612 xfxfxfx.exe 2888 7rrrxfr.exe 1032 7tbtnb.exe 556 vvvjd.exe 2368 lxfxxrr.exe 1760 xrrlrlx.exe 2728 tthnhb.exe 2120 dvpvp.exe 2140 xxlxflf.exe 2132 rxflfxf.exe 1464 ttthnb.exe 748 bttnth.exe 1896 pdpvp.exe 1960 lflrflr.exe 856 lxrrrrf.exe 1240 hbhntb.exe 2100 ddvjp.exe 872 xrxxfrx.exe 2684 hbthnb.exe 1692 tnhhhb.exe 2772 djvdj.exe 2652 llfxlrf.exe 2548 rrxlxxr.exe 2580 nhhhnn.exe 2796 1hhbtt.exe 2572 ppjpv.exe 2000 1ppvd.exe 1136 ffrlrrx.exe 772 lxrrfll.exe 1468 htnbhn.exe 3020 5hnntb.exe 2212 vvjvd.exe 2640 dvvdp.exe 2880 xxrrflr.exe 2792 xxxlfrf.exe 2812 nhbhtb.exe 1620 btntth.exe 348 vvvdj.exe 3004 9dppv.exe 1772 3lrrrxf.exe 2368 xrlfllx.exe 2320 tntbnn.exe 2788 tnnnhh.exe 1920 dvdpv.exe 2208 jpdjv.exe 2248 xrlxflx.exe 2200 lfffrxl.exe 1484 7hbhht.exe 1528 nhtthb.exe 2952 pvdvv.exe 1332 djpvj.exe 940 hhbhnt.exe 1740 nnhbnn.exe -
resource yara_rule behavioral1/memory/2392-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-293-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2740 2392 44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe 30 PID 2392 wrote to memory of 2740 2392 44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe 30 PID 2392 wrote to memory of 2740 2392 44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe 30 PID 2392 wrote to memory of 2740 2392 44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe 30 PID 2740 wrote to memory of 2652 2740 hbbnnt.exe 31 PID 2740 wrote to memory of 2652 2740 hbbnnt.exe 31 PID 2740 wrote to memory of 2652 2740 hbbnnt.exe 31 PID 2740 wrote to memory of 2652 2740 hbbnnt.exe 31 PID 2652 wrote to memory of 2756 2652 1rlrxxr.exe 32 PID 2652 wrote to memory of 2756 2652 1rlrxxr.exe 32 PID 2652 wrote to memory of 2756 2652 1rlrxxr.exe 32 PID 2652 wrote to memory of 2756 2652 1rlrxxr.exe 32 PID 2756 wrote to memory of 2796 2756 ttnhnn.exe 33 PID 2756 wrote to memory of 2796 2756 ttnhnn.exe 33 PID 2756 wrote to memory of 2796 2756 ttnhnn.exe 33 PID 2756 wrote to memory of 2796 2756 ttnhnn.exe 33 PID 2796 wrote to memory of 2084 2796 hbbbhn.exe 34 PID 2796 wrote to memory of 2084 2796 hbbbhn.exe 34 PID 2796 wrote to memory of 2084 2796 hbbbhn.exe 34 PID 2796 wrote to memory of 2084 2796 hbbbhn.exe 34 PID 2084 wrote to memory of 2608 2084 ppjjj.exe 35 PID 2084 wrote to memory of 2608 2084 ppjjj.exe 35 PID 2084 wrote to memory of 2608 2084 ppjjj.exe 35 PID 2084 wrote to memory of 2608 2084 ppjjj.exe 35 PID 2608 wrote to memory of 3052 2608 xxrxllf.exe 36 PID 2608 wrote to memory of 3052 2608 xxrxllf.exe 36 PID 2608 wrote to memory of 3052 2608 xxrxllf.exe 36 PID 2608 wrote to memory of 3052 2608 xxrxllf.exe 36 PID 3052 wrote to memory of 776 3052 btnbnn.exe 37 PID 3052 wrote to memory of 776 3052 btnbnn.exe 37 PID 3052 wrote to memory of 776 3052 btnbnn.exe 37 PID 3052 wrote to memory of 776 3052 btnbnn.exe 37 PID 776 wrote to memory of 2092 776 5dvjj.exe 38 PID 776 wrote to memory of 2092 776 5dvjj.exe 38 PID 776 wrote to memory of 2092 776 5dvjj.exe 38 PID 776 wrote to memory of 2092 776 5dvjj.exe 38 PID 2092 wrote to memory of 2384 2092 rlrxrxl.exe 39 PID 2092 wrote to memory of 2384 2092 rlrxrxl.exe 39 PID 2092 wrote to memory of 2384 2092 rlrxrxl.exe 39 PID 2092 wrote to memory of 2384 2092 rlrxrxl.exe 39 PID 2384 wrote to memory of 2856 2384 bbtbtt.exe 40 PID 2384 wrote to memory of 2856 2384 bbtbtt.exe 40 PID 2384 wrote to memory of 2856 2384 bbtbtt.exe 40 PID 2384 wrote to memory of 2856 2384 bbtbtt.exe 40 PID 2856 wrote to memory of 2612 2856 ddvjj.exe 41 PID 2856 wrote to memory of 2612 2856 ddvjj.exe 41 PID 2856 wrote to memory of 2612 2856 ddvjj.exe 41 PID 2856 wrote to memory of 2612 2856 ddvjj.exe 41 PID 2612 wrote to memory of 2888 2612 xfxfxfx.exe 42 PID 2612 wrote to memory of 2888 2612 xfxfxfx.exe 42 PID 2612 wrote to memory of 2888 2612 xfxfxfx.exe 42 PID 2612 wrote to memory of 2888 2612 xfxfxfx.exe 42 PID 2888 wrote to memory of 1032 2888 7rrrxfr.exe 43 PID 2888 wrote to memory of 1032 2888 7rrrxfr.exe 43 PID 2888 wrote to memory of 1032 2888 7rrrxfr.exe 43 PID 2888 wrote to memory of 1032 2888 7rrrxfr.exe 43 PID 1032 wrote to memory of 556 1032 7tbtnb.exe 44 PID 1032 wrote to memory of 556 1032 7tbtnb.exe 44 PID 1032 wrote to memory of 556 1032 7tbtnb.exe 44 PID 1032 wrote to memory of 556 1032 7tbtnb.exe 44 PID 556 wrote to memory of 2368 556 vvvjd.exe 45 PID 556 wrote to memory of 2368 556 vvvjd.exe 45 PID 556 wrote to memory of 2368 556 vvvjd.exe 45 PID 556 wrote to memory of 2368 556 vvvjd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe"C:\Users\Admin\AppData\Local\Temp\44ae6f453ca8e3f32e341bdc513e40ebacb14b3928374419957e77e17a3001ffN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\hbbnnt.exec:\hbbnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\1rlrxxr.exec:\1rlrxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\ttnhnn.exec:\ttnhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\hbbbhn.exec:\hbbbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\ppjjj.exec:\ppjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\xxrxllf.exec:\xxrxllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\btnbnn.exec:\btnbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\5dvjj.exec:\5dvjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\rlrxrxl.exec:\rlrxrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\bbtbtt.exec:\bbtbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\ddvjj.exec:\ddvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xfxfxfx.exec:\xfxfxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\7rrrxfr.exec:\7rrrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\7tbtnb.exec:\7tbtnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\vvvjd.exec:\vvvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe17⤵
- Executes dropped EXE
PID:2368 -
\??\c:\xrrlrlx.exec:\xrrlrlx.exe18⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tthnhb.exec:\tthnhb.exe19⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dvpvp.exec:\dvpvp.exe20⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xxlxflf.exec:\xxlxflf.exe21⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rxflfxf.exec:\rxflfxf.exe22⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ttthnb.exec:\ttthnb.exe23⤵
- Executes dropped EXE
PID:1464 -
\??\c:\bttnth.exec:\bttnth.exe24⤵
- Executes dropped EXE
PID:748 -
\??\c:\pdpvp.exec:\pdpvp.exe25⤵
- Executes dropped EXE
PID:1896 -
\??\c:\lflrflr.exec:\lflrflr.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\lxrrrrf.exec:\lxrrrrf.exe27⤵
- Executes dropped EXE
PID:856 -
\??\c:\hbhntb.exec:\hbhntb.exe28⤵
- Executes dropped EXE
PID:1240 -
\??\c:\ddvjp.exec:\ddvjp.exe29⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xrxxfrx.exec:\xrxxfrx.exe30⤵
- Executes dropped EXE
PID:872 -
\??\c:\hbthnb.exec:\hbthnb.exe31⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tnhhhb.exec:\tnhhhb.exe32⤵
- Executes dropped EXE
PID:1692 -
\??\c:\djvdj.exec:\djvdj.exe33⤵
- Executes dropped EXE
PID:2772 -
\??\c:\llfxlrf.exec:\llfxlrf.exe34⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rrxlxxr.exec:\rrxlxxr.exe35⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nhhhnn.exec:\nhhhnn.exe36⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1hhbtt.exec:\1hhbtt.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ppjpv.exec:\ppjpv.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\1ppvd.exec:\1ppvd.exe39⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ffrlrrx.exec:\ffrlrrx.exe40⤵
- Executes dropped EXE
PID:1136 -
\??\c:\lxrrfll.exec:\lxrrfll.exe41⤵
- Executes dropped EXE
PID:772 -
\??\c:\htnbhn.exec:\htnbhn.exe42⤵
- Executes dropped EXE
PID:1468 -
\??\c:\5hnntb.exec:\5hnntb.exe43⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vvjvd.exec:\vvjvd.exe44⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dvvdp.exec:\dvvdp.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xxrrflr.exec:\xxrrflr.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xxxlfrf.exec:\xxxlfrf.exe47⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nhbhtb.exec:\nhbhtb.exe48⤵
- Executes dropped EXE
PID:2812 -
\??\c:\btntth.exec:\btntth.exe49⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vvvdj.exec:\vvvdj.exe50⤵
- Executes dropped EXE
PID:348 -
\??\c:\9dppv.exec:\9dppv.exe51⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3lrrrxf.exec:\3lrrrxf.exe52⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xrlfllx.exec:\xrlfllx.exe53⤵
- Executes dropped EXE
PID:2368 -
\??\c:\tntbnn.exec:\tntbnn.exe54⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tnnnhh.exec:\tnnnhh.exe55⤵
- Executes dropped EXE
PID:2788 -
\??\c:\dvdpv.exec:\dvdpv.exe56⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jpdjv.exec:\jpdjv.exe57⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xrlxflx.exec:\xrlxflx.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lfffrxl.exec:\lfffrxl.exe59⤵
- Executes dropped EXE
PID:2200 -
\??\c:\7hbhht.exec:\7hbhht.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nhtthb.exec:\nhtthb.exe61⤵
- Executes dropped EXE
PID:1528 -
\??\c:\pvdvv.exec:\pvdvv.exe62⤵
- Executes dropped EXE
PID:2952 -
\??\c:\djpvj.exec:\djpvj.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\hhbhnt.exec:\hhbhnt.exe64⤵
- Executes dropped EXE
PID:940 -
\??\c:\nnhbnn.exec:\nnhbnn.exe65⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pjdvd.exec:\pjdvd.exe66⤵PID:1952
-
\??\c:\vpjpv.exec:\vpjpv.exe67⤵PID:2068
-
\??\c:\rrflxxl.exec:\rrflxxl.exe68⤵PID:1708
-
\??\c:\frfflfx.exec:\frfflfx.exe69⤵PID:2280
-
\??\c:\tnbnbh.exec:\tnbnbh.exe70⤵PID:2752
-
\??\c:\ntnbnb.exec:\ntnbnb.exe71⤵PID:2648
-
\??\c:\jddjv.exec:\jddjv.exe72⤵PID:2688
-
\??\c:\pjddv.exec:\pjddv.exe73⤵PID:1988
-
\??\c:\rlllxrx.exec:\rlllxrx.exe74⤵PID:2192
-
\??\c:\5tbnht.exec:\5tbnht.exe75⤵PID:2548
-
\??\c:\bnnhnb.exec:\bnnhnb.exe76⤵PID:2544
-
\??\c:\pvvpd.exec:\pvvpd.exe77⤵PID:2588
-
\??\c:\pjpdp.exec:\pjpdp.exe78⤵PID:2388
-
\??\c:\xrlflll.exec:\xrlflll.exe79⤵PID:2804
-
\??\c:\xxlfrxl.exec:\xxlfrxl.exe80⤵PID:568
-
\??\c:\1bhbbt.exec:\1bhbbt.exe81⤵PID:2152
-
\??\c:\tnhhhn.exec:\tnhhhn.exe82⤵PID:2260
-
\??\c:\pvvdv.exec:\pvvdv.exe83⤵PID:1904
-
\??\c:\9vvjd.exec:\9vvjd.exe84⤵PID:2436
-
\??\c:\xfxxfll.exec:\xfxxfll.exe85⤵PID:808
-
\??\c:\fxlfffl.exec:\fxlfffl.exe86⤵PID:2876
-
\??\c:\hbbhbb.exec:\hbbhbb.exe87⤵PID:2376
-
\??\c:\btnbhh.exec:\btnbhh.exe88⤵PID:2888
-
\??\c:\5jjdj.exec:\5jjdj.exe89⤵PID:2632
-
\??\c:\7dvjp.exec:\7dvjp.exe90⤵PID:352
-
\??\c:\fflfrfl.exec:\fflfrfl.exe91⤵PID:1424
-
\??\c:\ffxxlfx.exec:\ffxxlfx.exe92⤵PID:1772
-
\??\c:\nhtntn.exec:\nhtntn.exe93⤵PID:2364
-
\??\c:\nhtbth.exec:\nhtbth.exe94⤵PID:2004
-
\??\c:\1vpvd.exec:\1vpvd.exe95⤵PID:2156
-
\??\c:\jjpvd.exec:\jjpvd.exe96⤵PID:2124
-
\??\c:\lfffllr.exec:\lfffllr.exe97⤵PID:316
-
\??\c:\fffrflr.exec:\fffrflr.exe98⤵PID:1852
-
\??\c:\ntthhn.exec:\ntthhn.exe99⤵PID:1464
-
\??\c:\nhtbhn.exec:\nhtbhn.exe100⤵PID:1092
-
\??\c:\ddddp.exec:\ddddp.exe101⤵PID:1676
-
\??\c:\7rlrxxr.exec:\7rlrxxr.exe102⤵PID:1356
-
\??\c:\lfxxflx.exec:\lfxxflx.exe103⤵PID:288
-
\??\c:\5thntb.exec:\5thntb.exe104⤵PID:2356
-
\??\c:\thtnbb.exec:\thtnbb.exe105⤵PID:2256
-
\??\c:\pdddv.exec:\pdddv.exe106⤵PID:1728
-
\??\c:\jdddj.exec:\jdddj.exe107⤵PID:2672
-
\??\c:\7rfxxrr.exec:\7rfxxrr.exe108⤵PID:2744
-
\??\c:\ffflrxf.exec:\ffflrxf.exe109⤵PID:2760
-
\??\c:\nnbbtt.exec:\nnbbtt.exe110⤵PID:2732
-
\??\c:\pppdp.exec:\pppdp.exe111⤵PID:2012
-
\??\c:\pjpjj.exec:\pjpjj.exe112⤵PID:2660
-
\??\c:\dvpvp.exec:\dvpvp.exe113⤵PID:2564
-
\??\c:\1lxfllr.exec:\1lxfllr.exe114⤵PID:2768
-
\??\c:\9lrrrxl.exec:\9lrrrxl.exe115⤵PID:2556
-
\??\c:\hbnbtb.exec:\hbnbtb.exe116⤵PID:1500
-
\??\c:\ppjjd.exec:\ppjjd.exe117⤵PID:1628
-
\??\c:\jdvvv.exec:\jdvvv.exe118⤵PID:332
-
\??\c:\lxrxxxl.exec:\lxrxxxl.exe119⤵PID:476
-
\??\c:\fxflrxf.exec:\fxflrxf.exe120⤵PID:920
-
\??\c:\9bbbhh.exec:\9bbbhh.exe121⤵PID:1776
-
\??\c:\bnbhhh.exec:\bnbhhh.exe122⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-