Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 04:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe
-
Size
73KB
-
MD5
ea1dd3c97a3acb03c2005a759f429939
-
SHA1
58ed73be3ebe41382fbf29c1971c283b2e73d715
-
SHA256
aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b
-
SHA512
6b54d0e4ea7e29596084929b0229055da99dc93684d83c15093fce36563f3ab2bfba7a6bea7424496a6853840248f489528a1b13ea688821f6812bd22b1f6a91
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdLH+O:ymb3NkkiQ3mdBjF0yMliCO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2736-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2228 pjpjj.exe 2580 pjpvv.exe 2720 bntnnb.exe 2592 nhbhtb.exe 2212 djvvv.exe 2940 xlxxlfl.exe 2416 1nbthn.exe 2016 3pddj.exe 1196 dvjdp.exe 2444 rfrfxfr.exe 2032 nbtbhb.exe 848 bthnbb.exe 1576 pjpjp.exe 1748 frlrflx.exe 2116 5rxxxfx.exe 1968 htbbbh.exe 2200 tnhhtt.exe 2224 jvjdp.exe 1104 7rxrrff.exe 2408 rfflxxf.exe 1556 7hnhhh.exe 2496 1ttnhn.exe 2912 7vpvv.exe 2512 pjppp.exe 1232 rllrllr.exe 540 nbhhnt.exe 2508 dpjvd.exe 896 pdpjp.exe 1548 lfrxxxf.exe 2656 thhbht.exe 1508 nbnntt.exe 2228 dpjdd.exe 2716 lxfrxxf.exe 2588 lfrxffl.exe 2624 9bnhnn.exe 2964 bthhbt.exe 1676 dppvv.exe 2956 vpvvj.exe 2244 rfrrfxf.exe 2124 1lxfffl.exe 568 5nbbhb.exe 2020 tnhhhh.exe 2396 bnhhhh.exe 1996 jvvvv.exe 1952 3pjjj.exe 920 rrxrxfl.exe 1568 lrlxxlr.exe 596 nhnntb.exe 1576 nhhbbb.exe 2164 vjpvv.exe 2112 jdppv.exe 2300 lfrrxxl.exe 2180 rlrxfll.exe 1752 hnbtbt.exe 1460 5nhhnn.exe 2120 1dvpv.exe 952 rllffff.exe 2504 xllrxrx.exe 716 5fxxffr.exe 1956 thhhtb.exe 1744 jvdpv.exe 1492 vjjvv.exe 2628 rfrfllr.exe 644 lrrfxrf.exe -
resource yara_rule behavioral1/memory/2736-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1196-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-310-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2228 2736 aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe 30 PID 2736 wrote to memory of 2228 2736 aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe 30 PID 2736 wrote to memory of 2228 2736 aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe 30 PID 2736 wrote to memory of 2228 2736 aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe 30 PID 2228 wrote to memory of 2580 2228 pjpjj.exe 31 PID 2228 wrote to memory of 2580 2228 pjpjj.exe 31 PID 2228 wrote to memory of 2580 2228 pjpjj.exe 31 PID 2228 wrote to memory of 2580 2228 pjpjj.exe 31 PID 2580 wrote to memory of 2720 2580 pjpvv.exe 32 PID 2580 wrote to memory of 2720 2580 pjpvv.exe 32 PID 2580 wrote to memory of 2720 2580 pjpvv.exe 32 PID 2580 wrote to memory of 2720 2580 pjpvv.exe 32 PID 2720 wrote to memory of 2592 2720 bntnnb.exe 33 PID 2720 wrote to memory of 2592 2720 bntnnb.exe 33 PID 2720 wrote to memory of 2592 2720 bntnnb.exe 33 PID 2720 wrote to memory of 2592 2720 bntnnb.exe 33 PID 2592 wrote to memory of 2212 2592 nhbhtb.exe 34 PID 2592 wrote to memory of 2212 2592 nhbhtb.exe 34 PID 2592 wrote to memory of 2212 2592 nhbhtb.exe 34 PID 2592 wrote to memory of 2212 2592 nhbhtb.exe 34 PID 2212 wrote to memory of 2940 2212 djvvv.exe 35 PID 2212 wrote to memory of 2940 2212 djvvv.exe 35 PID 2212 wrote to memory of 2940 2212 djvvv.exe 35 PID 2212 wrote to memory of 2940 2212 djvvv.exe 35 PID 2940 wrote to memory of 2416 2940 xlxxlfl.exe 36 PID 2940 wrote to memory of 2416 2940 xlxxlfl.exe 36 PID 2940 wrote to memory of 2416 2940 xlxxlfl.exe 36 PID 2940 wrote to memory of 2416 2940 xlxxlfl.exe 36 PID 2416 wrote to memory of 2016 2416 1nbthn.exe 37 PID 2416 wrote to memory of 2016 2416 1nbthn.exe 37 PID 2416 wrote to memory of 2016 2416 1nbthn.exe 37 PID 2416 wrote to memory of 2016 2416 1nbthn.exe 37 PID 2016 wrote to memory of 1196 2016 3pddj.exe 38 PID 2016 wrote to memory of 1196 2016 3pddj.exe 38 PID 2016 wrote to memory of 1196 2016 3pddj.exe 38 PID 2016 wrote to memory of 1196 2016 3pddj.exe 38 PID 1196 wrote to memory of 2444 1196 dvjdp.exe 39 PID 1196 wrote to memory of 2444 1196 dvjdp.exe 39 PID 1196 wrote to memory of 2444 1196 dvjdp.exe 39 PID 1196 wrote to memory of 2444 1196 dvjdp.exe 39 PID 2444 wrote to memory of 2032 2444 rfrfxfr.exe 40 PID 2444 wrote to memory of 2032 2444 rfrfxfr.exe 40 PID 2444 wrote to memory of 2032 2444 rfrfxfr.exe 40 PID 2444 wrote to memory of 2032 2444 rfrfxfr.exe 40 PID 2032 wrote to memory of 848 2032 nbtbhb.exe 41 PID 2032 wrote to memory of 848 2032 nbtbhb.exe 41 PID 2032 wrote to memory of 848 2032 nbtbhb.exe 41 PID 2032 wrote to memory of 848 2032 nbtbhb.exe 41 PID 848 wrote to memory of 1576 848 bthnbb.exe 42 PID 848 wrote to memory of 1576 848 bthnbb.exe 42 PID 848 wrote to memory of 1576 848 bthnbb.exe 42 PID 848 wrote to memory of 1576 848 bthnbb.exe 42 PID 1576 wrote to memory of 1748 1576 pjpjp.exe 43 PID 1576 wrote to memory of 1748 1576 pjpjp.exe 43 PID 1576 wrote to memory of 1748 1576 pjpjp.exe 43 PID 1576 wrote to memory of 1748 1576 pjpjp.exe 43 PID 1748 wrote to memory of 2116 1748 frlrflx.exe 44 PID 1748 wrote to memory of 2116 1748 frlrflx.exe 44 PID 1748 wrote to memory of 2116 1748 frlrflx.exe 44 PID 1748 wrote to memory of 2116 1748 frlrflx.exe 44 PID 2116 wrote to memory of 1968 2116 5rxxxfx.exe 45 PID 2116 wrote to memory of 1968 2116 5rxxxfx.exe 45 PID 2116 wrote to memory of 1968 2116 5rxxxfx.exe 45 PID 2116 wrote to memory of 1968 2116 5rxxxfx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe"C:\Users\Admin\AppData\Local\Temp\aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\pjpjj.exec:\pjpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\pjpvv.exec:\pjpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\bntnnb.exec:\bntnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nhbhtb.exec:\nhbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\djvvv.exec:\djvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\xlxxlfl.exec:\xlxxlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\1nbthn.exec:\1nbthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\3pddj.exec:\3pddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\dvjdp.exec:\dvjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\rfrfxfr.exec:\rfrfxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\nbtbhb.exec:\nbtbhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\bthnbb.exec:\bthnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\pjpjp.exec:\pjpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\frlrflx.exec:\frlrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\5rxxxfx.exec:\5rxxxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\htbbbh.exec:\htbbbh.exe17⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tnhhtt.exec:\tnhhtt.exe18⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jvjdp.exec:\jvjdp.exe19⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7rxrrff.exec:\7rxrrff.exe20⤵
- Executes dropped EXE
PID:1104 -
\??\c:\rfflxxf.exec:\rfflxxf.exe21⤵
- Executes dropped EXE
PID:2408 -
\??\c:\7hnhhh.exec:\7hnhhh.exe22⤵
- Executes dropped EXE
PID:1556 -
\??\c:\1ttnhn.exec:\1ttnhn.exe23⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7vpvv.exec:\7vpvv.exe24⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pjppp.exec:\pjppp.exe25⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rllrllr.exec:\rllrllr.exe26⤵
- Executes dropped EXE
PID:1232 -
\??\c:\nbhhnt.exec:\nbhhnt.exe27⤵
- Executes dropped EXE
PID:540 -
\??\c:\dpjvd.exec:\dpjvd.exe28⤵
- Executes dropped EXE
PID:2508 -
\??\c:\pdpjp.exec:\pdpjp.exe29⤵
- Executes dropped EXE
PID:896 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe30⤵
- Executes dropped EXE
PID:1548 -
\??\c:\thhbht.exec:\thhbht.exe31⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nbnntt.exec:\nbnntt.exe32⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dpjdd.exec:\dpjdd.exe33⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lxfrxxf.exec:\lxfrxxf.exe34⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lfrxffl.exec:\lfrxffl.exe35⤵
- Executes dropped EXE
PID:2588 -
\??\c:\9bnhnn.exec:\9bnhnn.exe36⤵
- Executes dropped EXE
PID:2624 -
\??\c:\bthhbt.exec:\bthhbt.exe37⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dppvv.exec:\dppvv.exe38⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vpvvj.exec:\vpvvj.exe39⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rfrrfxf.exec:\rfrrfxf.exe40⤵
- Executes dropped EXE
PID:2244 -
\??\c:\1lxfffl.exec:\1lxfffl.exe41⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5nbbhb.exec:\5nbbhb.exe42⤵
- Executes dropped EXE
PID:568 -
\??\c:\tnhhhh.exec:\tnhhhh.exe43⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bnhhhh.exec:\bnhhhh.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jvvvv.exec:\jvvvv.exe45⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3pjjj.exec:\3pjjj.exe46⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rrxrxfl.exec:\rrxrxfl.exe47⤵
- Executes dropped EXE
PID:920 -
\??\c:\lrlxxlr.exec:\lrlxxlr.exe48⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nhnntb.exec:\nhnntb.exe49⤵
- Executes dropped EXE
PID:596 -
\??\c:\nhhbbb.exec:\nhhbbb.exe50⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vjpvv.exec:\vjpvv.exe51⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jdppv.exec:\jdppv.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe53⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rlrxfll.exec:\rlrxfll.exe54⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hnbtbt.exec:\hnbtbt.exe55⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5nhhnn.exec:\5nhhnn.exe56⤵
- Executes dropped EXE
PID:1460 -
\??\c:\1dvpv.exec:\1dvpv.exe57⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rllffff.exec:\rllffff.exe58⤵
- Executes dropped EXE
PID:952 -
\??\c:\xllrxrx.exec:\xllrxrx.exe59⤵
- Executes dropped EXE
PID:2504 -
\??\c:\5fxxffr.exec:\5fxxffr.exe60⤵
- Executes dropped EXE
PID:716 -
\??\c:\thhhtb.exec:\thhhtb.exe61⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jvdpv.exec:\jvdpv.exe62⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vjjvv.exec:\vjjvv.exe63⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rfrfllr.exec:\rfrfllr.exe64⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lrrfxrf.exec:\lrrfxrf.exe65⤵
- Executes dropped EXE
PID:644 -
\??\c:\nbhhhh.exec:\nbhhhh.exe66⤵PID:540
-
\??\c:\nbhbbt.exec:\nbhbbt.exe67⤵PID:1856
-
\??\c:\hbhntb.exec:\hbhntb.exe68⤵PID:1892
-
\??\c:\lfrfrlr.exec:\lfrfrlr.exe69⤵PID:2884
-
\??\c:\fxlfrrr.exec:\fxlfrrr.exe70⤵PID:1532
-
\??\c:\thtthb.exec:\thtthb.exe71⤵PID:2980
-
\??\c:\nhhnhh.exec:\nhhnhh.exe72⤵PID:1508
-
\??\c:\jjvvj.exec:\jjvvj.exe73⤵PID:3008
-
\??\c:\ddpdd.exec:\ddpdd.exe74⤵PID:2580
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe75⤵PID:2612
-
\??\c:\9lllrrf.exec:\9lllrrf.exe76⤵PID:2968
-
\??\c:\bnbhtb.exec:\bnbhtb.exe77⤵PID:2972
-
\??\c:\thttnn.exec:\thttnn.exe78⤵PID:2756
-
\??\c:\jdppj.exec:\jdppj.exe79⤵PID:1788
-
\??\c:\vjvdj.exec:\vjvdj.exe80⤵PID:2648
-
\??\c:\pvvpj.exec:\pvvpj.exe81⤵PID:2052
-
\??\c:\5xrrllr.exec:\5xrrllr.exe82⤵PID:1692
-
\??\c:\xrffrrf.exec:\xrffrrf.exe83⤵PID:2044
-
\??\c:\hthnbb.exec:\hthnbb.exe84⤵PID:1520
-
\??\c:\btttnt.exec:\btttnt.exe85⤵PID:2276
-
\??\c:\nbhhbb.exec:\nbhhbb.exe86⤵PID:1260
-
\??\c:\vvvdv.exec:\vvvdv.exe87⤵PID:2832
-
\??\c:\3pddd.exec:\3pddd.exe88⤵PID:2532
-
\??\c:\frfflrx.exec:\frfflrx.exe89⤵PID:1716
-
\??\c:\xlxfrrr.exec:\xlxfrrr.exe90⤵PID:1864
-
\??\c:\bththh.exec:\bththh.exe91⤵PID:2240
-
\??\c:\nhnbhh.exec:\nhnbhh.exe92⤵PID:2216
-
\??\c:\bhhnbt.exec:\bhhnbt.exe93⤵PID:2176
-
\??\c:\pdjpj.exec:\pdjpj.exe94⤵PID:1584
-
\??\c:\vvpvp.exec:\vvpvp.exe95⤵PID:444
-
\??\c:\fxllffl.exec:\fxllffl.exe96⤵PID:2336
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe97⤵PID:2432
-
\??\c:\1nbhnn.exec:\1nbhnn.exe98⤵PID:2800
-
\??\c:\thnhhh.exec:\thnhhh.exe99⤵PID:620
-
\??\c:\hbthhh.exec:\hbthhh.exe100⤵PID:2280
-
\??\c:\3vjjj.exec:\3vjjj.exe101⤵PID:2920
-
\??\c:\pjdvj.exec:\pjdvj.exe102⤵PID:1280
-
\??\c:\xxffxxl.exec:\xxffxxl.exe103⤵PID:2308
-
\??\c:\fxflffr.exec:\fxflffr.exe104⤵PID:1792
-
\??\c:\3rllllr.exec:\3rllllr.exe105⤵PID:1424
-
\??\c:\nbhhnh.exec:\nbhhnh.exe106⤵PID:564
-
\??\c:\nbtttb.exec:\nbtttb.exe107⤵PID:2660
-
\??\c:\vdjvd.exec:\vdjvd.exe108⤵PID:2840
-
\??\c:\3jdvd.exec:\3jdvd.exe109⤵PID:1548
-
\??\c:\xrffrlr.exec:\xrffrlr.exe110⤵PID:2676
-
\??\c:\9lllxxf.exec:\9lllxxf.exe111⤵PID:2824
-
\??\c:\fxlxrrf.exec:\fxlxrrf.exe112⤵PID:2636
-
\??\c:\htbbbb.exec:\htbbbb.exe113⤵PID:2724
-
\??\c:\9hbntt.exec:\9hbntt.exe114⤵PID:2556
-
\??\c:\pdpvj.exec:\pdpvj.exe115⤵PID:2576
-
\??\c:\pjpjp.exec:\pjpjp.exe116⤵PID:2468
-
\??\c:\1pjjv.exec:\1pjjv.exe117⤵PID:2864
-
\??\c:\xrfxfll.exec:\xrfxfll.exe118⤵PID:3068
-
\??\c:\rlrrxxr.exec:\rlrrxxr.exe119⤵PID:2360
-
\??\c:\bnttbb.exec:\bnttbb.exe120⤵PID:1464
-
\??\c:\bnbbtb.exec:\bnbbtb.exe121⤵PID:2040
-
\??\c:\jdjpd.exec:\jdjpd.exe122⤵PID:1172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-