Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 05:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f6fb5b7c50fa7773545c8c2112189a0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7f6fb5b7c50fa7773545c8c2112189a0N.exe
-
Size
82KB
-
MD5
7f6fb5b7c50fa7773545c8c2112189a0
-
SHA1
529b3c9ad72c977c5ad64a765c07b3ed64f0e58f
-
SHA256
a5a1c4fcf2518b4d73d53569fdaa1f36773836081975ab35080769c55461b667
-
SHA512
0aea601c91b5f4212b6f5e723557f00447c81d7284f828c7068e90e031931b5a08c1face0179fb49205f87cc3e4d8806ffb1df8e22e188df7eef4a37fdf0bacf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QFq:ymb3NkkiQ3mdBjFIIp9L9QrrA8T
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2512-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1112-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1732 nhnntt.exe 1724 jvjjv.exe 1056 fxrlrxf.exe 2800 hnhntb.exe 2756 pvdpv.exe 2572 3rlrlrf.exe 2820 5btbhb.exe 2612 btnbbh.exe 3040 dpjpv.exe 1824 xrllflx.exe 2884 3frrxxl.exe 2880 btthtb.exe 1664 tnbnth.exe 1028 jjvdp.exe 2440 lfrxrrf.exe 1996 3rrfffr.exe 2368 hthbnb.exe 2068 pdvdp.exe 1632 7xrllrx.exe 2520 3xrlrlr.exe 2640 htbtbh.exe 1628 9tntnh.exe 2124 djdjv.exe 2296 3fllrrx.exe 676 xrfxfll.exe 848 3nhhnh.exe 1112 btntbt.exe 1744 1dpdp.exe 2248 lxxflxl.exe 2320 fxlrxfl.exe 888 hhthbh.exe 1616 3vpvd.exe 2252 pjvpj.exe 2780 lxrxxfx.exe 2828 7lxxflr.exe 2752 tntbtt.exe 2656 tnbtnh.exe 2728 vjvdj.exe 2652 dvjpv.exe 2556 xxllxxl.exe 3036 xrrxxlx.exe 3052 7rrxffl.exe 2848 tntbbh.exe 3032 tbbbhb.exe 2628 1dvvd.exe 2908 lxrrffl.exe 2284 9bnnnb.exe 1972 ntbhbh.exe 1672 djdpj.exe 580 vpjvd.exe 1448 5xrllff.exe 1948 fxxxlrr.exe 2380 5hbhnh.exe 2100 tntbbh.exe 2340 pdvpp.exe 1152 pvdpj.exe 1932 xrrxffx.exe 2240 lxfflff.exe 1192 tnnnhh.exe 328 nbbtht.exe 2516 nbnhht.exe 1596 pjjdv.exe 1796 jpvvp.exe 2116 xlxxfrr.exe -
resource yara_rule behavioral1/memory/2512-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1112-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 1732 2512 7f6fb5b7c50fa7773545c8c2112189a0N.exe 31 PID 2512 wrote to memory of 1732 2512 7f6fb5b7c50fa7773545c8c2112189a0N.exe 31 PID 2512 wrote to memory of 1732 2512 7f6fb5b7c50fa7773545c8c2112189a0N.exe 31 PID 2512 wrote to memory of 1732 2512 7f6fb5b7c50fa7773545c8c2112189a0N.exe 31 PID 1732 wrote to memory of 1724 1732 nhnntt.exe 32 PID 1732 wrote to memory of 1724 1732 nhnntt.exe 32 PID 1732 wrote to memory of 1724 1732 nhnntt.exe 32 PID 1732 wrote to memory of 1724 1732 nhnntt.exe 32 PID 1724 wrote to memory of 1056 1724 jvjjv.exe 33 PID 1724 wrote to memory of 1056 1724 jvjjv.exe 33 PID 1724 wrote to memory of 1056 1724 jvjjv.exe 33 PID 1724 wrote to memory of 1056 1724 jvjjv.exe 33 PID 1056 wrote to memory of 2800 1056 fxrlrxf.exe 34 PID 1056 wrote to memory of 2800 1056 fxrlrxf.exe 34 PID 1056 wrote to memory of 2800 1056 fxrlrxf.exe 34 PID 1056 wrote to memory of 2800 1056 fxrlrxf.exe 34 PID 2800 wrote to memory of 2756 2800 hnhntb.exe 35 PID 2800 wrote to memory of 2756 2800 hnhntb.exe 35 PID 2800 wrote to memory of 2756 2800 hnhntb.exe 35 PID 2800 wrote to memory of 2756 2800 hnhntb.exe 35 PID 2756 wrote to memory of 2572 2756 pvdpv.exe 36 PID 2756 wrote to memory of 2572 2756 pvdpv.exe 36 PID 2756 wrote to memory of 2572 2756 pvdpv.exe 36 PID 2756 wrote to memory of 2572 2756 pvdpv.exe 36 PID 2572 wrote to memory of 2820 2572 3rlrlrf.exe 37 PID 2572 wrote to memory of 2820 2572 3rlrlrf.exe 37 PID 2572 wrote to memory of 2820 2572 3rlrlrf.exe 37 PID 2572 wrote to memory of 2820 2572 3rlrlrf.exe 37 PID 2820 wrote to memory of 2612 2820 5btbhb.exe 38 PID 2820 wrote to memory of 2612 2820 5btbhb.exe 38 PID 2820 wrote to memory of 2612 2820 5btbhb.exe 38 PID 2820 wrote to memory of 2612 2820 5btbhb.exe 38 PID 2612 wrote to memory of 3040 2612 btnbbh.exe 39 PID 2612 wrote to memory of 3040 2612 btnbbh.exe 39 PID 2612 wrote to memory of 3040 2612 btnbbh.exe 39 PID 2612 wrote to memory of 3040 2612 btnbbh.exe 39 PID 3040 wrote to memory of 1824 3040 dpjpv.exe 40 PID 3040 wrote to memory of 1824 3040 dpjpv.exe 40 PID 3040 wrote to memory of 1824 3040 dpjpv.exe 40 PID 3040 wrote to memory of 1824 3040 dpjpv.exe 40 PID 1824 wrote to memory of 2884 1824 xrllflx.exe 41 PID 1824 wrote to memory of 2884 1824 xrllflx.exe 41 PID 1824 wrote to memory of 2884 1824 xrllflx.exe 41 PID 1824 wrote to memory of 2884 1824 xrllflx.exe 41 PID 2884 wrote to memory of 2880 2884 3frrxxl.exe 42 PID 2884 wrote to memory of 2880 2884 3frrxxl.exe 42 PID 2884 wrote to memory of 2880 2884 3frrxxl.exe 42 PID 2884 wrote to memory of 2880 2884 3frrxxl.exe 42 PID 2880 wrote to memory of 1664 2880 btthtb.exe 43 PID 2880 wrote to memory of 1664 2880 btthtb.exe 43 PID 2880 wrote to memory of 1664 2880 btthtb.exe 43 PID 2880 wrote to memory of 1664 2880 btthtb.exe 43 PID 1664 wrote to memory of 1028 1664 tnbnth.exe 44 PID 1664 wrote to memory of 1028 1664 tnbnth.exe 44 PID 1664 wrote to memory of 1028 1664 tnbnth.exe 44 PID 1664 wrote to memory of 1028 1664 tnbnth.exe 44 PID 1028 wrote to memory of 2440 1028 jjvdp.exe 45 PID 1028 wrote to memory of 2440 1028 jjvdp.exe 45 PID 1028 wrote to memory of 2440 1028 jjvdp.exe 45 PID 1028 wrote to memory of 2440 1028 jjvdp.exe 45 PID 2440 wrote to memory of 1996 2440 lfrxrrf.exe 46 PID 2440 wrote to memory of 1996 2440 lfrxrrf.exe 46 PID 2440 wrote to memory of 1996 2440 lfrxrrf.exe 46 PID 2440 wrote to memory of 1996 2440 lfrxrrf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f6fb5b7c50fa7773545c8c2112189a0N.exe"C:\Users\Admin\AppData\Local\Temp\7f6fb5b7c50fa7773545c8c2112189a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\nhnntt.exec:\nhnntt.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\jvjjv.exec:\jvjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\fxrlrxf.exec:\fxrlrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\hnhntb.exec:\hnhntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\pvdpv.exec:\pvdpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\3rlrlrf.exec:\3rlrlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\5btbhb.exec:\5btbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\btnbbh.exec:\btnbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\dpjpv.exec:\dpjpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\xrllflx.exec:\xrllflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\3frrxxl.exec:\3frrxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\btthtb.exec:\btthtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\tnbnth.exec:\tnbnth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\jjvdp.exec:\jjvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\lfrxrrf.exec:\lfrxrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\3rrfffr.exec:\3rrfffr.exe17⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hthbnb.exec:\hthbnb.exe18⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pdvdp.exec:\pdvdp.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068 -
\??\c:\7xrllrx.exec:\7xrllrx.exe20⤵
- Executes dropped EXE
PID:1632 -
\??\c:\3xrlrlr.exec:\3xrlrlr.exe21⤵
- Executes dropped EXE
PID:2520 -
\??\c:\htbtbh.exec:\htbtbh.exe22⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9tntnh.exec:\9tntnh.exe23⤵
- Executes dropped EXE
PID:1628 -
\??\c:\djdjv.exec:\djdjv.exe24⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3fllrrx.exec:\3fllrrx.exe25⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xrfxfll.exec:\xrfxfll.exe26⤵
- Executes dropped EXE
PID:676 -
\??\c:\3nhhnh.exec:\3nhhnh.exe27⤵
- Executes dropped EXE
PID:848 -
\??\c:\btntbt.exec:\btntbt.exe28⤵
- Executes dropped EXE
PID:1112 -
\??\c:\1dpdp.exec:\1dpdp.exe29⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lxxflxl.exec:\lxxflxl.exe30⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe31⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hhthbh.exec:\hhthbh.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\3vpvd.exec:\3vpvd.exe33⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pjvpj.exec:\pjvpj.exe34⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lxrxxfx.exec:\lxrxxfx.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7lxxflr.exec:\7lxxflr.exe36⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tntbtt.exec:\tntbtt.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\tnbtnh.exec:\tnbtnh.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vjvdj.exec:\vjvdj.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dvjpv.exec:\dvjpv.exe40⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xxllxxl.exec:\xxllxxl.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\xrrxxlx.exec:\xrrxxlx.exe42⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7rrxffl.exec:\7rrxffl.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\tntbbh.exec:\tntbbh.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tbbbhb.exec:\tbbbhb.exe45⤵
- Executes dropped EXE
PID:3032 -
\??\c:\1dvvd.exec:\1dvvd.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lxrrffl.exec:\lxrrffl.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\9bnnnb.exec:\9bnnnb.exe48⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ntbhbh.exec:\ntbhbh.exe49⤵
- Executes dropped EXE
PID:1972 -
\??\c:\djdpj.exec:\djdpj.exe50⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vpjvd.exec:\vpjvd.exe51⤵
- Executes dropped EXE
PID:580 -
\??\c:\5xrllff.exec:\5xrllff.exe52⤵
- Executes dropped EXE
PID:1448 -
\??\c:\fxxxlrr.exec:\fxxxlrr.exe53⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5hbhnh.exec:\5hbhnh.exe54⤵
- Executes dropped EXE
PID:2380 -
\??\c:\tntbbh.exec:\tntbbh.exe55⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pdvpp.exec:\pdvpp.exe56⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pvdpj.exec:\pvdpj.exe57⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xrrxffx.exec:\xrrxffx.exe58⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lxfflff.exec:\lxfflff.exe59⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tnnnhh.exec:\tnnnhh.exe60⤵
- Executes dropped EXE
PID:1192 -
\??\c:\nbbtht.exec:\nbbtht.exe61⤵
- Executes dropped EXE
PID:328 -
\??\c:\nbnhht.exec:\nbnhht.exe62⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pjjdv.exec:\pjjdv.exe63⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jpvvp.exec:\jpvvp.exe64⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xlxxfrr.exec:\xlxxfrr.exe65⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xlxflll.exec:\xlxflll.exe66⤵PID:828
-
\??\c:\frrfxxr.exec:\frrfxxr.exe67⤵PID:1756
-
\??\c:\hbnnbh.exec:\hbnnbh.exe68⤵PID:1808
-
\??\c:\tnhtnb.exec:\tnhtnb.exe69⤵PID:628
-
\??\c:\ntbntb.exec:\ntbntb.exe70⤵PID:2456
-
\??\c:\1vddj.exec:\1vddj.exe71⤵PID:1612
-
\??\c:\7dppv.exec:\7dppv.exe72⤵PID:2412
-
\??\c:\xlrrlxx.exec:\xlrrlxx.exe73⤵PID:1060
-
\??\c:\lffffff.exec:\lffffff.exe74⤵PID:2784
-
\??\c:\thnnhn.exec:\thnnhn.exe75⤵PID:2644
-
\??\c:\tnbtnh.exec:\tnbtnh.exe76⤵PID:2160
-
\??\c:\vjjjd.exec:\vjjjd.exe77⤵PID:2776
-
\??\c:\jvjvp.exec:\jvjvp.exe78⤵PID:2656
-
\??\c:\frxxxxl.exec:\frxxxxl.exe79⤵PID:2852
-
\??\c:\lflrrrx.exec:\lflrrrx.exe80⤵PID:2748
-
\??\c:\nthhhn.exec:\nthhhn.exe81⤵PID:2388
-
\??\c:\9nbbhb.exec:\9nbbhb.exe82⤵PID:3036
-
\??\c:\bhnnnn.exec:\bhnnnn.exe83⤵PID:2856
-
\??\c:\vjvdv.exec:\vjvdv.exe84⤵PID:3068
-
\??\c:\pjvdv.exec:\pjvdv.exe85⤵PID:2872
-
\??\c:\7lrrrrr.exec:\7lrrrrr.exe86⤵PID:3060
-
\??\c:\3hnntt.exec:\3hnntt.exe87⤵PID:1752
-
\??\c:\3nnnhn.exec:\3nnnhn.exe88⤵PID:3012
-
\??\c:\9nbbht.exec:\9nbbht.exe89⤵PID:3016
-
\??\c:\pvpjd.exec:\pvpjd.exe90⤵PID:1672
-
\??\c:\1jddd.exec:\1jddd.exe91⤵PID:1036
-
\??\c:\rrxxffx.exec:\rrxxffx.exe92⤵PID:2120
-
\??\c:\lxrllff.exec:\lxrllff.exe93⤵PID:1936
-
\??\c:\5frflfl.exec:\5frflfl.exe94⤵PID:2084
-
\??\c:\btbhnn.exec:\btbhnn.exe95⤵PID:2092
-
\??\c:\tbnbbn.exec:\tbnbbn.exe96⤵PID:2504
-
\??\c:\vppvv.exec:\vppvv.exe97⤵PID:984
-
\??\c:\vjpjj.exec:\vjpjj.exe98⤵PID:2640
-
\??\c:\lrfrxfr.exec:\lrfrxfr.exe99⤵PID:1848
-
\??\c:\rrllrfx.exec:\rrllrfx.exe100⤵PID:324
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe101⤵PID:2716
-
\??\c:\ntnnnt.exec:\ntnnnt.exe102⤵PID:952
-
\??\c:\bnbhbb.exec:\bnbhbb.exe103⤵PID:1272
-
\??\c:\1dpdp.exec:\1dpdp.exe104⤵PID:1564
-
\??\c:\dpvpj.exec:\dpvpj.exe105⤵PID:2224
-
\??\c:\flrrrrx.exec:\flrrrrx.exe106⤵PID:2276
-
\??\c:\lxlrrll.exec:\lxlrrll.exe107⤵PID:1172
-
\??\c:\btnbbh.exec:\btnbbh.exe108⤵PID:576
-
\??\c:\1bbbbb.exec:\1bbbbb.exe109⤵PID:2300
-
\??\c:\pjddd.exec:\pjddd.exe110⤵PID:888
-
\??\c:\pvjdp.exec:\pvjdp.exe111⤵PID:2172
-
\??\c:\1vdpp.exec:\1vdpp.exe112⤵PID:2696
-
\??\c:\ffxlfll.exec:\ffxlfll.exe113⤵PID:2832
-
\??\c:\7nhbbh.exec:\7nhbbh.exe114⤵PID:568
-
\??\c:\hbhhhb.exec:\hbhhhb.exe115⤵PID:2700
-
\??\c:\dvppp.exec:\dvppp.exe116⤵PID:2756
-
\??\c:\vjpjv.exec:\vjpjv.exe117⤵PID:2536
-
\??\c:\vjppd.exec:\vjppd.exe118⤵PID:2656
-
\??\c:\frrlfxx.exec:\frrlfxx.exe119⤵PID:2568
-
\??\c:\9bhhhh.exec:\9bhhhh.exe120⤵PID:2712
-
\??\c:\thnhnn.exec:\thnhnn.exe121⤵PID:2600
-
\??\c:\httttt.exec:\httttt.exe122⤵PID:3048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-