Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25-08-2024 11:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0fd8c69187cc7095f286c7423339c040N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
0fd8c69187cc7095f286c7423339c040N.exe
-
Size
67KB
-
MD5
0fd8c69187cc7095f286c7423339c040
-
SHA1
8478b9b7edf5d3187bd6d49cb1a143c81c863fb8
-
SHA256
3950c9f3a1a1323881693cc7219c987477cc53858c1ded958ceae81585c0bb90
-
SHA512
edfa1ed87e042316fb8bce89d9b79faedea5335d54b8baa16e84df53065a5c81a29e742dab9b0458c99e44bcc59fb3c1056ceedc4046447b973f3671b609e48f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcu:ymb3NkkiQ3mdBjFIsIVcu
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2652-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1064-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/448-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2780 nbttbt.exe 2700 pjjvd.exe 2660 dvjjd.exe 2828 3lffllr.exe 2536 bttnbt.exe 2712 dvpjp.exe 3048 pjvvv.exe 484 xrxrllx.exe 2184 btntth.exe 2488 dvvdp.exe 1520 9lxfffx.exe 2736 bbbtbn.exe 2848 tnhntt.exe 1932 dvjjv.exe 2900 fxxfrxf.exe 3028 rfrxfff.exe 1808 thntbh.exe 1308 vpjjp.exe 2500 dvppv.exe 2196 xrlrflx.exe 2164 rxfxxrl.exe 1064 hthhnn.exe 1816 ttnbht.exe 448 3jjpp.exe 1532 lfxfrrx.exe 1972 rxllfrr.exe 376 5hnhth.exe 108 pjdjv.exe 3016 lxlrxrx.exe 1500 fxflxxr.exe 2260 7bhhnt.exe 2340 vdpjp.exe 2700 3lxflfr.exe 2692 fllrfrl.exe 1592 nhthtb.exe 2708 tnhhtn.exe 2544 3dvdd.exe 2804 vjvdd.exe 2536 rlfrfrf.exe 2528 rlrrlfl.exe 536 nnhtnt.exe 752 nhntnt.exe 556 jvvdj.exe 2264 rfrxlxf.exe 2352 lflrffr.exe 2892 9nbhbn.exe 2472 vjpvd.exe 2736 3jjjj.exe 2296 xlfflfr.exe 2848 bbttbt.exe 2884 1ntbbb.exe 2924 vpdvd.exe 1008 vvpdv.exe 668 frlllrx.exe 872 fxflrxr.exe 2408 9tbbnn.exe 2500 nbnttb.exe 2084 pjjjd.exe 2020 pdvvp.exe 1516 xxxfxff.exe 408 1hnhhb.exe 2448 3bttbh.exe 848 dvdjv.exe 3056 vjpdd.exe -
resource yara_rule behavioral1/memory/2652-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/376-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2780 2652 0fd8c69187cc7095f286c7423339c040N.exe 30 PID 2652 wrote to memory of 2780 2652 0fd8c69187cc7095f286c7423339c040N.exe 30 PID 2652 wrote to memory of 2780 2652 0fd8c69187cc7095f286c7423339c040N.exe 30 PID 2652 wrote to memory of 2780 2652 0fd8c69187cc7095f286c7423339c040N.exe 30 PID 2780 wrote to memory of 2700 2780 nbttbt.exe 31 PID 2780 wrote to memory of 2700 2780 nbttbt.exe 31 PID 2780 wrote to memory of 2700 2780 nbttbt.exe 31 PID 2780 wrote to memory of 2700 2780 nbttbt.exe 31 PID 2700 wrote to memory of 2660 2700 pjjvd.exe 32 PID 2700 wrote to memory of 2660 2700 pjjvd.exe 32 PID 2700 wrote to memory of 2660 2700 pjjvd.exe 32 PID 2700 wrote to memory of 2660 2700 pjjvd.exe 32 PID 2660 wrote to memory of 2828 2660 dvjjd.exe 33 PID 2660 wrote to memory of 2828 2660 dvjjd.exe 33 PID 2660 wrote to memory of 2828 2660 dvjjd.exe 33 PID 2660 wrote to memory of 2828 2660 dvjjd.exe 33 PID 2828 wrote to memory of 2536 2828 3lffllr.exe 34 PID 2828 wrote to memory of 2536 2828 3lffllr.exe 34 PID 2828 wrote to memory of 2536 2828 3lffllr.exe 34 PID 2828 wrote to memory of 2536 2828 3lffllr.exe 34 PID 2536 wrote to memory of 2712 2536 bttnbt.exe 35 PID 2536 wrote to memory of 2712 2536 bttnbt.exe 35 PID 2536 wrote to memory of 2712 2536 bttnbt.exe 35 PID 2536 wrote to memory of 2712 2536 bttnbt.exe 35 PID 2712 wrote to memory of 3048 2712 dvpjp.exe 36 PID 2712 wrote to memory of 3048 2712 dvpjp.exe 36 PID 2712 wrote to memory of 3048 2712 dvpjp.exe 36 PID 2712 wrote to memory of 3048 2712 dvpjp.exe 36 PID 3048 wrote to memory of 484 3048 pjvvv.exe 37 PID 3048 wrote to memory of 484 3048 pjvvv.exe 37 PID 3048 wrote to memory of 484 3048 pjvvv.exe 37 PID 3048 wrote to memory of 484 3048 pjvvv.exe 37 PID 484 wrote to memory of 2184 484 xrxrllx.exe 38 PID 484 wrote to memory of 2184 484 xrxrllx.exe 38 PID 484 wrote to memory of 2184 484 xrxrllx.exe 38 PID 484 wrote to memory of 2184 484 xrxrllx.exe 38 PID 2184 wrote to memory of 2488 2184 btntth.exe 39 PID 2184 wrote to memory of 2488 2184 btntth.exe 39 PID 2184 wrote to memory of 2488 2184 btntth.exe 39 PID 2184 wrote to memory of 2488 2184 btntth.exe 39 PID 2488 wrote to memory of 1520 2488 dvvdp.exe 40 PID 2488 wrote to memory of 1520 2488 dvvdp.exe 40 PID 2488 wrote to memory of 1520 2488 dvvdp.exe 40 PID 2488 wrote to memory of 1520 2488 dvvdp.exe 40 PID 1520 wrote to memory of 2736 1520 9lxfffx.exe 41 PID 1520 wrote to memory of 2736 1520 9lxfffx.exe 41 PID 1520 wrote to memory of 2736 1520 9lxfffx.exe 41 PID 1520 wrote to memory of 2736 1520 9lxfffx.exe 41 PID 2736 wrote to memory of 2848 2736 bbbtbn.exe 42 PID 2736 wrote to memory of 2848 2736 bbbtbn.exe 42 PID 2736 wrote to memory of 2848 2736 bbbtbn.exe 42 PID 2736 wrote to memory of 2848 2736 bbbtbn.exe 42 PID 2848 wrote to memory of 1932 2848 tnhntt.exe 43 PID 2848 wrote to memory of 1932 2848 tnhntt.exe 43 PID 2848 wrote to memory of 1932 2848 tnhntt.exe 43 PID 2848 wrote to memory of 1932 2848 tnhntt.exe 43 PID 1932 wrote to memory of 2900 1932 dvjjv.exe 44 PID 1932 wrote to memory of 2900 1932 dvjjv.exe 44 PID 1932 wrote to memory of 2900 1932 dvjjv.exe 44 PID 1932 wrote to memory of 2900 1932 dvjjv.exe 44 PID 2900 wrote to memory of 3028 2900 fxxfrxf.exe 45 PID 2900 wrote to memory of 3028 2900 fxxfrxf.exe 45 PID 2900 wrote to memory of 3028 2900 fxxfrxf.exe 45 PID 2900 wrote to memory of 3028 2900 fxxfrxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fd8c69187cc7095f286c7423339c040N.exe"C:\Users\Admin\AppData\Local\Temp\0fd8c69187cc7095f286c7423339c040N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\nbttbt.exec:\nbttbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\pjjvd.exec:\pjjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\dvjjd.exec:\dvjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\3lffllr.exec:\3lffllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\bttnbt.exec:\bttnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\dvpjp.exec:\dvpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\pjvvv.exec:\pjvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\xrxrllx.exec:\xrxrllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\btntth.exec:\btntth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\dvvdp.exec:\dvvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\9lxfffx.exec:\9lxfffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\bbbtbn.exec:\bbbtbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\tnhntt.exec:\tnhntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\dvjjv.exec:\dvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\fxxfrxf.exec:\fxxfrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\rfrxfff.exec:\rfrxfff.exe17⤵
- Executes dropped EXE
PID:3028 -
\??\c:\thntbh.exec:\thntbh.exe18⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vpjjp.exec:\vpjjp.exe19⤵
- Executes dropped EXE
PID:1308 -
\??\c:\dvppv.exec:\dvppv.exe20⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xrlrflx.exec:\xrlrflx.exe21⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rxfxxrl.exec:\rxfxxrl.exe22⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hthhnn.exec:\hthhnn.exe23⤵
- Executes dropped EXE
PID:1064 -
\??\c:\ttnbht.exec:\ttnbht.exe24⤵
- Executes dropped EXE
PID:1816 -
\??\c:\3jjpp.exec:\3jjpp.exe25⤵
- Executes dropped EXE
PID:448 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe26⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rxllfrr.exec:\rxllfrr.exe27⤵
- Executes dropped EXE
PID:1972 -
\??\c:\5hnhth.exec:\5hnhth.exe28⤵
- Executes dropped EXE
PID:376 -
\??\c:\pjdjv.exec:\pjdjv.exe29⤵
- Executes dropped EXE
PID:108 -
\??\c:\lxlrxrx.exec:\lxlrxrx.exe30⤵
- Executes dropped EXE
PID:3016 -
\??\c:\fxflxxr.exec:\fxflxxr.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\7bhhnt.exec:\7bhhnt.exe32⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vdpjp.exec:\vdpjp.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\3lxflfr.exec:\3lxflfr.exe34⤵
- Executes dropped EXE
PID:2700 -
\??\c:\fllrfrl.exec:\fllrfrl.exe35⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nhthtb.exec:\nhthtb.exe36⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tnhhtn.exec:\tnhhtn.exe37⤵
- Executes dropped EXE
PID:2708 -
\??\c:\3dvdd.exec:\3dvdd.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vjvdd.exec:\vjvdd.exe39⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rlfrfrf.exec:\rlfrfrf.exe40⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rlrrlfl.exec:\rlrrlfl.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\nnhtnt.exec:\nnhtnt.exe42⤵
- Executes dropped EXE
PID:536 -
\??\c:\nhntnt.exec:\nhntnt.exe43⤵
- Executes dropped EXE
PID:752 -
\??\c:\jvvdj.exec:\jvvdj.exe44⤵
- Executes dropped EXE
PID:556 -
\??\c:\rfrxlxf.exec:\rfrxlxf.exe45⤵
- Executes dropped EXE
PID:2264 -
\??\c:\lflrffr.exec:\lflrffr.exe46⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9nbhbn.exec:\9nbhbn.exe47⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vjpvd.exec:\vjpvd.exe48⤵
- Executes dropped EXE
PID:2472 -
\??\c:\3jjjj.exec:\3jjjj.exe49⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xlfflfr.exec:\xlfflfr.exe50⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bbttbt.exec:\bbttbt.exe51⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1ntbbb.exec:\1ntbbb.exe52⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vpdvd.exec:\vpdvd.exe53⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vvpdv.exec:\vvpdv.exe54⤵
- Executes dropped EXE
PID:1008 -
\??\c:\frlllrx.exec:\frlllrx.exe55⤵
- Executes dropped EXE
PID:668 -
\??\c:\fxflrxr.exec:\fxflrxr.exe56⤵
- Executes dropped EXE
PID:872 -
\??\c:\9tbbnn.exec:\9tbbnn.exe57⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nbnttb.exec:\nbnttb.exe58⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pjjjd.exec:\pjjjd.exe59⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pdvvp.exec:\pdvvp.exe60⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xxxfxff.exec:\xxxfxff.exe61⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1hnhhb.exec:\1hnhhb.exe62⤵
- Executes dropped EXE
PID:408 -
\??\c:\3bttbh.exec:\3bttbh.exe63⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dvdjv.exec:\dvdjv.exe64⤵
- Executes dropped EXE
PID:848 -
\??\c:\vjpdd.exec:\vjpdd.exe65⤵
- Executes dropped EXE
PID:3056 -
\??\c:\frrffxl.exec:\frrffxl.exe66⤵PID:2000
-
\??\c:\ffxllll.exec:\ffxllll.exe67⤵PID:568
-
\??\c:\1fxxxxf.exec:\1fxxxxf.exe68⤵PID:336
-
\??\c:\hnbhbn.exec:\hnbhbn.exe69⤵PID:1652
-
\??\c:\nhthtt.exec:\nhthtt.exe70⤵PID:3024
-
\??\c:\pjvdv.exec:\pjvdv.exe71⤵PID:1500
-
\??\c:\vpddj.exec:\vpddj.exe72⤵PID:2780
-
\??\c:\frxrrrx.exec:\frxrrrx.exe73⤵PID:2540
-
\??\c:\xrrflxf.exec:\xrrflxf.exe74⤵PID:2300
-
\??\c:\9nnthb.exec:\9nnthb.exe75⤵PID:2700
-
\??\c:\btttbb.exec:\btttbb.exe76⤵PID:2724
-
\??\c:\jdpvd.exec:\jdpvd.exe77⤵PID:1592
-
\??\c:\7xfxxxf.exec:\7xfxxxf.exe78⤵PID:2708
-
\??\c:\rxxlxfr.exec:\rxxlxfr.exe79⤵PID:2544
-
\??\c:\tnhnbh.exec:\tnhnbh.exe80⤵PID:2804
-
\??\c:\tntntb.exec:\tntntb.exe81⤵PID:3036
-
\??\c:\btnnbh.exec:\btnnbh.exe82⤵PID:1012
-
\??\c:\pjvvd.exec:\pjvvd.exe83⤵PID:3044
-
\??\c:\xrrlxlr.exec:\xrrlxlr.exe84⤵PID:752
-
\??\c:\5lrllfr.exec:\5lrllfr.exe85⤵PID:556
-
\??\c:\lxflrrr.exec:\lxflrrr.exe86⤵PID:2264
-
\??\c:\bntnnh.exec:\bntnnh.exe87⤵PID:1800
-
\??\c:\bntttn.exec:\bntttn.exe88⤵PID:2504
-
\??\c:\pdjpp.exec:\pdjpp.exe89⤵PID:2472
-
\??\c:\vjdjj.exec:\vjdjj.exe90⤵PID:2520
-
\??\c:\lxllffl.exec:\lxllffl.exe91⤵PID:2296
-
\??\c:\nbhhnt.exec:\nbhhnt.exe92⤵PID:2360
-
\??\c:\7htbbb.exec:\7htbbb.exe93⤵PID:2884
-
\??\c:\bnhhhb.exec:\bnhhhb.exe94⤵PID:3012
-
\??\c:\pdpvv.exec:\pdpvv.exe95⤵PID:1008
-
\??\c:\pjdpp.exec:\pjdpp.exe96⤵PID:1292
-
\??\c:\rfrllfl.exec:\rfrllfl.exe97⤵PID:872
-
\??\c:\fflfxfl.exec:\fflfxfl.exe98⤵PID:2120
-
\??\c:\9ttttt.exec:\9ttttt.exe99⤵PID:2500
-
\??\c:\nbnthn.exec:\nbnthn.exe100⤵PID:2084
-
\??\c:\dpppv.exec:\dpppv.exe101⤵PID:2020
-
\??\c:\5jvvd.exec:\5jvvd.exe102⤵PID:1516
-
\??\c:\frfxlfl.exec:\frfxlfl.exe103⤵PID:408
-
\??\c:\hthhtt.exec:\hthhtt.exe104⤵PID:2448
-
\??\c:\nhbbhh.exec:\nhbbhh.exe105⤵PID:848
-
\??\c:\dpvpv.exec:\dpvpv.exe106⤵PID:3004
-
\??\c:\3dpvp.exec:\3dpvp.exe107⤵PID:2000
-
\??\c:\flxfrrx.exec:\flxfrrx.exe108⤵PID:2992
-
\??\c:\lxfflff.exec:\lxfflff.exe109⤵PID:336
-
\??\c:\bntntt.exec:\bntntt.exe110⤵PID:2176
-
\??\c:\hbnbtb.exec:\hbnbtb.exe111⤵PID:3024
-
\??\c:\1pjvd.exec:\1pjvd.exe112⤵PID:2400
-
\??\c:\dvppp.exec:\dvppp.exe113⤵PID:2780
-
\??\c:\7xfxxfr.exec:\7xfxxfr.exe114⤵PID:2644
-
\??\c:\xfrllff.exec:\xfrllff.exe115⤵PID:2300
-
\??\c:\nbbntb.exec:\nbbntb.exe116⤵PID:2148
-
\??\c:\bnbbnh.exec:\bnbbnh.exe117⤵PID:2724
-
\??\c:\jdvdj.exec:\jdvdj.exe118⤵PID:2576
-
\??\c:\3djvp.exec:\3djvp.exe119⤵PID:2548
-
\??\c:\lrrrllx.exec:\lrrrllx.exe120⤵PID:2276
-
\??\c:\rlxrfxf.exec:\rlxrfxf.exe121⤵PID:2764
-
\??\c:\7hhntb.exec:\7hhntb.exe122⤵PID:572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-