Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 19:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe
-
Size
106KB
-
MD5
196222614f4d7f8e424927d7a09ceb30
-
SHA1
8bfaaf9f1aedfbbb18088620abe80de30adde225
-
SHA256
70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971
-
SHA512
bb029b4a94a065ba872ee0274f36da218405a49c98e3e9ba5336e358297d9a918bfcdafc9ae40933463bf6c7749cf6dc8b51d7edacd560bdb593bee2171c5116
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3CA+:n3C9BRo7MlrWKVT+buBGu3PC
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2672-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1944 xrlxrrx.exe 1872 3nnbtt.exe 2068 nbhhbh.exe 2920 dddpd.exe 2732 rlrfxfr.exe 2884 xxlxrfr.exe 2896 ntbtth.exe 2612 jpvpj.exe 2900 1dpjv.exe 2660 nnnhbh.exe 2456 hbbnnt.exe 1668 9pddp.exe 2804 5fflrxf.exe 576 xxxllxl.exe 2824 nhtbhb.exe 2656 jvvjv.exe 1548 pjddj.exe 1672 lffrxfx.exe 2780 rrfrrxr.exe 2684 1ttntt.exe 2092 jvpjj.exe 2364 dvppd.exe 844 fxllrrf.exe 1692 lfxxlrx.exe 2252 thbbtb.exe 2484 7jvvp.exe 2180 9ddpv.exe 2100 rlxxfff.exe 1696 tnhnnn.exe 1524 nhbnhh.exe 1960 3jjpd.exe 1872 fxlflrf.exe 1996 frxrrll.exe 1644 5htbhn.exe 2920 tntnbn.exe 2728 tnhnhh.exe 1936 9vjjp.exe 2692 jdjdj.exe 2788 3flfxxl.exe 2624 lxxllxf.exe 2876 nbnhnh.exe 1520 thbtbt.exe 2652 ntbttn.exe 2416 pddpp.exe 772 jdjpp.exe 1484 5lxxrlr.exe 2928 lxfrllx.exe 1760 thbbbt.exe 2808 thhhnt.exe 812 hthtbn.exe 316 1vpvj.exe 1156 ddpvd.exe 396 xrfffrf.exe 2768 lfxfxlr.exe 2088 lflrrrf.exe 1988 nnnhhh.exe 1404 lxrxrrx.exe 2284 3lxlllr.exe 652 thhbtb.exe 1968 nhnbhn.exe 1084 tthnth.exe 2176 1pddp.exe 2288 3pdjv.exe 1648 1lrflfx.exe -
resource yara_rule behavioral1/memory/2672-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-272-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 1944 2672 70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe 30 PID 2672 wrote to memory of 1944 2672 70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe 30 PID 2672 wrote to memory of 1944 2672 70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe 30 PID 2672 wrote to memory of 1944 2672 70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe 30 PID 1944 wrote to memory of 1872 1944 xrlxrrx.exe 31 PID 1944 wrote to memory of 1872 1944 xrlxrrx.exe 31 PID 1944 wrote to memory of 1872 1944 xrlxrrx.exe 31 PID 1944 wrote to memory of 1872 1944 xrlxrrx.exe 31 PID 1872 wrote to memory of 2068 1872 3nnbtt.exe 32 PID 1872 wrote to memory of 2068 1872 3nnbtt.exe 32 PID 1872 wrote to memory of 2068 1872 3nnbtt.exe 32 PID 1872 wrote to memory of 2068 1872 3nnbtt.exe 32 PID 2068 wrote to memory of 2920 2068 nbhhbh.exe 33 PID 2068 wrote to memory of 2920 2068 nbhhbh.exe 33 PID 2068 wrote to memory of 2920 2068 nbhhbh.exe 33 PID 2068 wrote to memory of 2920 2068 nbhhbh.exe 33 PID 2920 wrote to memory of 2732 2920 dddpd.exe 34 PID 2920 wrote to memory of 2732 2920 dddpd.exe 34 PID 2920 wrote to memory of 2732 2920 dddpd.exe 34 PID 2920 wrote to memory of 2732 2920 dddpd.exe 34 PID 2732 wrote to memory of 2884 2732 rlrfxfr.exe 35 PID 2732 wrote to memory of 2884 2732 rlrfxfr.exe 35 PID 2732 wrote to memory of 2884 2732 rlrfxfr.exe 35 PID 2732 wrote to memory of 2884 2732 rlrfxfr.exe 35 PID 2884 wrote to memory of 2896 2884 xxlxrfr.exe 36 PID 2884 wrote to memory of 2896 2884 xxlxrfr.exe 36 PID 2884 wrote to memory of 2896 2884 xxlxrfr.exe 36 PID 2884 wrote to memory of 2896 2884 xxlxrfr.exe 36 PID 2896 wrote to memory of 2612 2896 ntbtth.exe 37 PID 2896 wrote to memory of 2612 2896 ntbtth.exe 37 PID 2896 wrote to memory of 2612 2896 ntbtth.exe 37 PID 2896 wrote to memory of 2612 2896 ntbtth.exe 37 PID 2612 wrote to memory of 2900 2612 jpvpj.exe 38 PID 2612 wrote to memory of 2900 2612 jpvpj.exe 38 PID 2612 wrote to memory of 2900 2612 jpvpj.exe 38 PID 2612 wrote to memory of 2900 2612 jpvpj.exe 38 PID 2900 wrote to memory of 2660 2900 1dpjv.exe 39 PID 2900 wrote to memory of 2660 2900 1dpjv.exe 39 PID 2900 wrote to memory of 2660 2900 1dpjv.exe 39 PID 2900 wrote to memory of 2660 2900 1dpjv.exe 39 PID 2660 wrote to memory of 2456 2660 nnnhbh.exe 40 PID 2660 wrote to memory of 2456 2660 nnnhbh.exe 40 PID 2660 wrote to memory of 2456 2660 nnnhbh.exe 40 PID 2660 wrote to memory of 2456 2660 nnnhbh.exe 40 PID 2456 wrote to memory of 1668 2456 hbbnnt.exe 41 PID 2456 wrote to memory of 1668 2456 hbbnnt.exe 41 PID 2456 wrote to memory of 1668 2456 hbbnnt.exe 41 PID 2456 wrote to memory of 1668 2456 hbbnnt.exe 41 PID 1668 wrote to memory of 2804 1668 9pddp.exe 42 PID 1668 wrote to memory of 2804 1668 9pddp.exe 42 PID 1668 wrote to memory of 2804 1668 9pddp.exe 42 PID 1668 wrote to memory of 2804 1668 9pddp.exe 42 PID 2804 wrote to memory of 576 2804 5fflrxf.exe 43 PID 2804 wrote to memory of 576 2804 5fflrxf.exe 43 PID 2804 wrote to memory of 576 2804 5fflrxf.exe 43 PID 2804 wrote to memory of 576 2804 5fflrxf.exe 43 PID 576 wrote to memory of 2824 576 xxxllxl.exe 44 PID 576 wrote to memory of 2824 576 xxxllxl.exe 44 PID 576 wrote to memory of 2824 576 xxxllxl.exe 44 PID 576 wrote to memory of 2824 576 xxxllxl.exe 44 PID 2824 wrote to memory of 2656 2824 nhtbhb.exe 45 PID 2824 wrote to memory of 2656 2824 nhtbhb.exe 45 PID 2824 wrote to memory of 2656 2824 nhtbhb.exe 45 PID 2824 wrote to memory of 2656 2824 nhtbhb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe"C:\Users\Admin\AppData\Local\Temp\70df64508365c758623d945497efa4aeafb6d4a1ab0a611650bac2324580a971N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xrlxrrx.exec:\xrlxrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\3nnbtt.exec:\3nnbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\nbhhbh.exec:\nbhhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\dddpd.exec:\dddpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rlrfxfr.exec:\rlrfxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xxlxrfr.exec:\xxlxrfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\ntbtth.exec:\ntbtth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\jpvpj.exec:\jpvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\1dpjv.exec:\1dpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nnnhbh.exec:\nnnhbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\hbbnnt.exec:\hbbnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\9pddp.exec:\9pddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\5fflrxf.exec:\5fflrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\xxxllxl.exec:\xxxllxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\nhtbhb.exec:\nhtbhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\jvvjv.exec:\jvvjv.exe17⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pjddj.exec:\pjddj.exe18⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lffrxfx.exec:\lffrxfx.exe19⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rrfrrxr.exec:\rrfrrxr.exe20⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1ttntt.exec:\1ttntt.exe21⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jvpjj.exec:\jvpjj.exe22⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dvppd.exec:\dvppd.exe23⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fxllrrf.exec:\fxllrrf.exe24⤵
- Executes dropped EXE
PID:844 -
\??\c:\lfxxlrx.exec:\lfxxlrx.exe25⤵
- Executes dropped EXE
PID:1692 -
\??\c:\thbbtb.exec:\thbbtb.exe26⤵
- Executes dropped EXE
PID:2252 -
\??\c:\7jvvp.exec:\7jvvp.exe27⤵
- Executes dropped EXE
PID:2484 -
\??\c:\9ddpv.exec:\9ddpv.exe28⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rlxxfff.exec:\rlxxfff.exe29⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tnhnnn.exec:\tnhnnn.exe30⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nhbnhh.exec:\nhbnhh.exe31⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3jjpd.exec:\3jjpd.exe32⤵
- Executes dropped EXE
PID:1960 -
\??\c:\fxlflrf.exec:\fxlflrf.exe33⤵
- Executes dropped EXE
PID:1872 -
\??\c:\frxrrll.exec:\frxrrll.exe34⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5htbhn.exec:\5htbhn.exe35⤵
- Executes dropped EXE
PID:1644 -
\??\c:\tntnbn.exec:\tntnbn.exe36⤵
- Executes dropped EXE
PID:2920 -
\??\c:\tnhnhh.exec:\tnhnhh.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\9vjjp.exec:\9vjjp.exe38⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jdjdj.exec:\jdjdj.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3flfxxl.exec:\3flfxxl.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\lxxllxf.exec:\lxxllxf.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbnhnh.exec:\nbnhnh.exe42⤵
- Executes dropped EXE
PID:2876 -
\??\c:\thbtbt.exec:\thbtbt.exe43⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ntbttn.exec:\ntbttn.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pddpp.exec:\pddpp.exe45⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jdjpp.exec:\jdjpp.exe46⤵
- Executes dropped EXE
PID:772 -
\??\c:\5lxxrlr.exec:\5lxxrlr.exe47⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lxfrllx.exec:\lxfrllx.exe48⤵
- Executes dropped EXE
PID:2928 -
\??\c:\thbbbt.exec:\thbbbt.exe49⤵
- Executes dropped EXE
PID:1760 -
\??\c:\thhhnt.exec:\thhhnt.exe50⤵
- Executes dropped EXE
PID:2808 -
\??\c:\hthtbn.exec:\hthtbn.exe51⤵
- Executes dropped EXE
PID:812 -
\??\c:\1vpvj.exec:\1vpvj.exe52⤵
- Executes dropped EXE
PID:316 -
\??\c:\ddpvd.exec:\ddpvd.exe53⤵
- Executes dropped EXE
PID:1156 -
\??\c:\xrfffrf.exec:\xrfffrf.exe54⤵
- Executes dropped EXE
PID:396 -
\??\c:\lfxfxlr.exec:\lfxfxlr.exe55⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lflrrrf.exec:\lflrrrf.exe56⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nnnhhh.exec:\nnnhhh.exe57⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lxrxrrx.exec:\lxrxrrx.exe58⤵
- Executes dropped EXE
PID:1404 -
\??\c:\3lxlllr.exec:\3lxlllr.exe59⤵
- Executes dropped EXE
PID:2284 -
\??\c:\thhbtb.exec:\thhbtb.exe60⤵
- Executes dropped EXE
PID:652 -
\??\c:\nhnbhn.exec:\nhnbhn.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tthnth.exec:\tthnth.exe62⤵
- Executes dropped EXE
PID:1084 -
\??\c:\1pddp.exec:\1pddp.exe63⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3pdjv.exec:\3pdjv.exe64⤵
- Executes dropped EXE
PID:2288 -
\??\c:\1lrflfx.exec:\1lrflfx.exe65⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lfrrxlr.exec:\lfrrxlr.exe66⤵PID:1504
-
\??\c:\9hbhtb.exec:\9hbhtb.exe67⤵PID:1784
-
\??\c:\hhbhtt.exec:\hhbhtt.exe68⤵PID:2280
-
\??\c:\hhbhnn.exec:\hhbhnn.exe69⤵PID:1444
-
\??\c:\vpppd.exec:\vpppd.exe70⤵PID:1524
-
\??\c:\5pjjp.exec:\5pjjp.exe71⤵PID:1948
-
\??\c:\9xrrrrx.exec:\9xrrrrx.exe72⤵PID:1848
-
\??\c:\3lflxxx.exec:\3lflxxx.exe73⤵PID:2116
-
\??\c:\hhhthh.exec:\hhhthh.exe74⤵PID:1248
-
\??\c:\thtnbb.exec:\thtnbb.exe75⤵PID:2852
-
\??\c:\nbthtt.exec:\nbthtt.exe76⤵PID:1596
-
\??\c:\5pjpd.exec:\5pjpd.exe77⤵PID:2740
-
\??\c:\jdjpj.exec:\jdjpj.exe78⤵PID:2596
-
\??\c:\9ddpv.exec:\9ddpv.exe79⤵PID:2888
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe80⤵PID:2616
-
\??\c:\xrrfrfr.exec:\xrrfrfr.exe81⤵PID:2644
-
\??\c:\hbhnth.exec:\hbhnth.exe82⤵PID:2600
-
\??\c:\5bhhbn.exec:\5bhhbn.exe83⤵PID:2216
-
\??\c:\dvpvj.exec:\dvpvj.exe84⤵PID:2168
-
\??\c:\dvjpp.exec:\dvjpp.exe85⤵PID:1096
-
\??\c:\pdvdp.exec:\pdvdp.exe86⤵PID:1676
-
\??\c:\fxfrxrf.exec:\fxfrxrf.exe87⤵PID:756
-
\??\c:\lflfffl.exec:\lflfffl.exe88⤵PID:2024
-
\??\c:\thhthn.exec:\thhthn.exe89⤵PID:760
-
\??\c:\bhthbh.exec:\bhthbh.exe90⤵PID:2824
-
\??\c:\hbnhbn.exec:\hbnhbn.exe91⤵PID:1068
-
\??\c:\1jdjd.exec:\1jdjd.exe92⤵PID:1200
-
\??\c:\pppvp.exec:\pppvp.exe93⤵PID:2140
-
\??\c:\lfflrxl.exec:\lfflrxl.exe94⤵PID:2944
-
\??\c:\1lrxxxf.exec:\1lrxxxf.exe95⤵PID:2780
-
\??\c:\ttthnt.exec:\ttthnt.exe96⤵PID:2104
-
\??\c:\nnhnbn.exec:\nnhnbn.exe97⤵PID:2360
-
\??\c:\dvddp.exec:\dvddp.exe98⤵PID:1712
-
\??\c:\pjvdd.exec:\pjvdd.exe99⤵PID:840
-
\??\c:\9vpvd.exec:\9vpvd.exe100⤵PID:1968
-
\??\c:\lfflrlf.exec:\lfflrlf.exe101⤵PID:1324
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe102⤵PID:580
-
\??\c:\nnhtnt.exec:\nnhtnt.exe103⤵PID:2256
-
\??\c:\5nhhhn.exec:\5nhhhn.exe104⤵PID:2292
-
\??\c:\tbbhtt.exec:\tbbhtt.exe105⤵PID:1076
-
\??\c:\1jdpp.exec:\1jdpp.exe106⤵PID:2100
-
\??\c:\dddjv.exec:\dddjv.exe107⤵PID:2672
-
\??\c:\7xxfrrr.exec:\7xxfrrr.exe108⤵PID:2340
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe109⤵PID:1932
-
\??\c:\7tntnh.exec:\7tntnh.exe110⤵PID:2260
-
\??\c:\bbnbhh.exec:\bbnbhh.exe111⤵PID:2136
-
\??\c:\9jdjj.exec:\9jdjj.exe112⤵PID:2068
-
\??\c:\vjjdd.exec:\vjjdd.exe113⤵PID:1644
-
\??\c:\1xrrrrl.exec:\1xrrrrl.exe114⤵PID:1560
-
\??\c:\rlfrrxf.exec:\rlfrrxf.exe115⤵PID:2728
-
\??\c:\nnhbnn.exec:\nnhbnn.exe116⤵PID:2880
-
\??\c:\tnnbht.exec:\tnnbht.exe117⤵PID:2692
-
\??\c:\dvpvv.exec:\dvpvv.exe118⤵PID:2904
-
\??\c:\3jdvj.exec:\3jdvj.exe119⤵PID:2896
-
\??\c:\1fxffrf.exec:\1fxffrf.exe120⤵PID:2700
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe121⤵PID:2588
-
\??\c:\7htbtt.exec:\7htbtt.exe122⤵PID:2508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-