Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 03:34
Static task
static1
Behavioral task
behavioral1
Sample
50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe
Resource
win7-20240903-en
General
-
Target
50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe
-
Size
82KB
-
MD5
817ddd3b7c647fc56fed3c7b9b9ea0a0
-
SHA1
f408aa91aa6683ccc2d7aa08915da94f29fd7b2f
-
SHA256
50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2
-
SHA512
af4ff8916ba245d66e09fa07b9e2ca2956a648078b949176ab7e9bd60d66ead7188992508a8d1faa9927969544fcf950c7fbdcaf9281b589910eca31f979ebd6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqj:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4rb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2528-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/632-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1176-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2028 1ttthn.exe 2880 3dvdp.exe 2348 rlfrxfl.exe 2816 xxlxxfl.exe 2728 hhnhnh.exe 1716 pvvvd.exe 2776 lfllrrf.exe 2668 nnnbbb.exe 1052 nhnbbh.exe 1572 ddjvv.exe 2904 dvjvp.exe 628 3fxfrfl.exe 1916 5xrxlrx.exe 1724 hbbhnt.exe 1512 tthbnn.exe 2700 bnbbbb.exe 2192 dvpdd.exe 2068 1pjdp.exe 2204 rlflxfx.exe 2588 rrfrxlr.exe 632 tnbbtb.exe 2272 nhnnbb.exe 1176 hhtnbh.exe 1524 5dvpv.exe 1252 dvddd.exe 1688 rfxrxxr.exe 2952 1xxfllr.exe 1812 7lxlrll.exe 876 1bnntt.exe 2548 tnhhhb.exe 1488 3dpjd.exe 2120 jvpdv.exe 1912 ffxfxfr.exe 2800 xrxfrrl.exe 2848 frxffff.exe 2332 5nthht.exe 2828 htnntb.exe 2872 9jddj.exe 2640 9jddd.exe 1552 rfrrrrx.exe 664 frfxlff.exe 1752 tbntbh.exe 1664 5djjj.exe 1832 pjvdd.exe 1584 9lffrxr.exe 584 nnhthh.exe 536 hbhtth.exe 292 ddjjp.exe 1568 lrlxrxx.exe 3036 jpppp.exe 3064 lfxffll.exe 2144 lflrrlr.exe 2192 bntbhh.exe 1856 1nbhnn.exe 2140 3vjjj.exe 1788 ppjvj.exe 1796 xrlxflx.exe 2040 lfrfflr.exe 2272 thtnnt.exe 1672 nhtbhh.exe 816 jdjdv.exe 2316 dvjjp.exe 1948 xlrllfx.exe 2892 xffllfx.exe -
resource yara_rule behavioral1/memory/2528-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1176-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-119-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rflxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2028 2528 50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe 30 PID 2528 wrote to memory of 2028 2528 50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe 30 PID 2528 wrote to memory of 2028 2528 50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe 30 PID 2528 wrote to memory of 2028 2528 50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe 30 PID 2028 wrote to memory of 2880 2028 1ttthn.exe 31 PID 2028 wrote to memory of 2880 2028 1ttthn.exe 31 PID 2028 wrote to memory of 2880 2028 1ttthn.exe 31 PID 2028 wrote to memory of 2880 2028 1ttthn.exe 31 PID 2880 wrote to memory of 2348 2880 3dvdp.exe 32 PID 2880 wrote to memory of 2348 2880 3dvdp.exe 32 PID 2880 wrote to memory of 2348 2880 3dvdp.exe 32 PID 2880 wrote to memory of 2348 2880 3dvdp.exe 32 PID 2348 wrote to memory of 2816 2348 rlfrxfl.exe 33 PID 2348 wrote to memory of 2816 2348 rlfrxfl.exe 33 PID 2348 wrote to memory of 2816 2348 rlfrxfl.exe 33 PID 2348 wrote to memory of 2816 2348 rlfrxfl.exe 33 PID 2816 wrote to memory of 2728 2816 xxlxxfl.exe 34 PID 2816 wrote to memory of 2728 2816 xxlxxfl.exe 34 PID 2816 wrote to memory of 2728 2816 xxlxxfl.exe 34 PID 2816 wrote to memory of 2728 2816 xxlxxfl.exe 34 PID 2728 wrote to memory of 1716 2728 hhnhnh.exe 35 PID 2728 wrote to memory of 1716 2728 hhnhnh.exe 35 PID 2728 wrote to memory of 1716 2728 hhnhnh.exe 35 PID 2728 wrote to memory of 1716 2728 hhnhnh.exe 35 PID 1716 wrote to memory of 2776 1716 pvvvd.exe 36 PID 1716 wrote to memory of 2776 1716 pvvvd.exe 36 PID 1716 wrote to memory of 2776 1716 pvvvd.exe 36 PID 1716 wrote to memory of 2776 1716 pvvvd.exe 36 PID 2776 wrote to memory of 2668 2776 lfllrrf.exe 37 PID 2776 wrote to memory of 2668 2776 lfllrrf.exe 37 PID 2776 wrote to memory of 2668 2776 lfllrrf.exe 37 PID 2776 wrote to memory of 2668 2776 lfllrrf.exe 37 PID 2668 wrote to memory of 1052 2668 nnnbbb.exe 38 PID 2668 wrote to memory of 1052 2668 nnnbbb.exe 38 PID 2668 wrote to memory of 1052 2668 nnnbbb.exe 38 PID 2668 wrote to memory of 1052 2668 nnnbbb.exe 38 PID 1052 wrote to memory of 1572 1052 nhnbbh.exe 39 PID 1052 wrote to memory of 1572 1052 nhnbbh.exe 39 PID 1052 wrote to memory of 1572 1052 nhnbbh.exe 39 PID 1052 wrote to memory of 1572 1052 nhnbbh.exe 39 PID 1572 wrote to memory of 2904 1572 ddjvv.exe 40 PID 1572 wrote to memory of 2904 1572 ddjvv.exe 40 PID 1572 wrote to memory of 2904 1572 ddjvv.exe 40 PID 1572 wrote to memory of 2904 1572 ddjvv.exe 40 PID 2904 wrote to memory of 628 2904 dvjvp.exe 41 PID 2904 wrote to memory of 628 2904 dvjvp.exe 41 PID 2904 wrote to memory of 628 2904 dvjvp.exe 41 PID 2904 wrote to memory of 628 2904 dvjvp.exe 41 PID 628 wrote to memory of 1916 628 3fxfrfl.exe 42 PID 628 wrote to memory of 1916 628 3fxfrfl.exe 42 PID 628 wrote to memory of 1916 628 3fxfrfl.exe 42 PID 628 wrote to memory of 1916 628 3fxfrfl.exe 42 PID 1916 wrote to memory of 1724 1916 5xrxlrx.exe 43 PID 1916 wrote to memory of 1724 1916 5xrxlrx.exe 43 PID 1916 wrote to memory of 1724 1916 5xrxlrx.exe 43 PID 1916 wrote to memory of 1724 1916 5xrxlrx.exe 43 PID 1724 wrote to memory of 1512 1724 hbbhnt.exe 44 PID 1724 wrote to memory of 1512 1724 hbbhnt.exe 44 PID 1724 wrote to memory of 1512 1724 hbbhnt.exe 44 PID 1724 wrote to memory of 1512 1724 hbbhnt.exe 44 PID 1512 wrote to memory of 2700 1512 tthbnn.exe 45 PID 1512 wrote to memory of 2700 1512 tthbnn.exe 45 PID 1512 wrote to memory of 2700 1512 tthbnn.exe 45 PID 1512 wrote to memory of 2700 1512 tthbnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe"C:\Users\Admin\AppData\Local\Temp\50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\1ttthn.exec:\1ttthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\3dvdp.exec:\3dvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rlfrxfl.exec:\rlfrxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\xxlxxfl.exec:\xxlxxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hhnhnh.exec:\hhnhnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pvvvd.exec:\pvvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\lfllrrf.exec:\lfllrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nnnbbb.exec:\nnnbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nhnbbh.exec:\nhnbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\ddjvv.exec:\ddjvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\dvjvp.exec:\dvjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\3fxfrfl.exec:\3fxfrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\5xrxlrx.exec:\5xrxlrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\hbbhnt.exec:\hbbhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\tthbnn.exec:\tthbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\bnbbbb.exec:\bnbbbb.exe17⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dvpdd.exec:\dvpdd.exe18⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1pjdp.exec:\1pjdp.exe19⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rlflxfx.exec:\rlflxfx.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rrfrxlr.exec:\rrfrxlr.exe21⤵
- Executes dropped EXE
PID:2588 -
\??\c:\tnbbtb.exec:\tnbbtb.exe22⤵
- Executes dropped EXE
PID:632 -
\??\c:\nhnnbb.exec:\nhnnbb.exe23⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hhtnbh.exec:\hhtnbh.exe24⤵
- Executes dropped EXE
PID:1176 -
\??\c:\5dvpv.exec:\5dvpv.exe25⤵
- Executes dropped EXE
PID:1524 -
\??\c:\dvddd.exec:\dvddd.exe26⤵
- Executes dropped EXE
PID:1252 -
\??\c:\rfxrxxr.exec:\rfxrxxr.exe27⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1xxfllr.exec:\1xxfllr.exe28⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7lxlrll.exec:\7lxlrll.exe29⤵
- Executes dropped EXE
PID:1812 -
\??\c:\1bnntt.exec:\1bnntt.exe30⤵
- Executes dropped EXE
PID:876 -
\??\c:\tnhhhb.exec:\tnhhhb.exe31⤵
- Executes dropped EXE
PID:2548 -
\??\c:\3dpjd.exec:\3dpjd.exe32⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jvpdv.exec:\jvpdv.exe33⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ffxfxfr.exec:\ffxfxfr.exe34⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xrxfrrl.exec:\xrxfrrl.exe35⤵
- Executes dropped EXE
PID:2800 -
\??\c:\frxffff.exec:\frxffff.exe36⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5nthht.exec:\5nthht.exe37⤵
- Executes dropped EXE
PID:2332 -
\??\c:\htnntb.exec:\htnntb.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9jddj.exec:\9jddj.exe39⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9jddd.exec:\9jddd.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe41⤵
- Executes dropped EXE
PID:1552 -
\??\c:\frfxlff.exec:\frfxlff.exe42⤵
- Executes dropped EXE
PID:664 -
\??\c:\tbntbh.exec:\tbntbh.exe43⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5djjj.exec:\5djjj.exe44⤵
- Executes dropped EXE
PID:1664 -
\??\c:\pjvdd.exec:\pjvdd.exe45⤵
- Executes dropped EXE
PID:1832 -
\??\c:\9lffrxr.exec:\9lffrxr.exe46⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nnhthh.exec:\nnhthh.exe47⤵
- Executes dropped EXE
PID:584 -
\??\c:\hbhtth.exec:\hbhtth.exe48⤵
- Executes dropped EXE
PID:536 -
\??\c:\ddjjp.exec:\ddjjp.exe49⤵
- Executes dropped EXE
PID:292 -
\??\c:\lrlxrxx.exec:\lrlxrxx.exe50⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jpppp.exec:\jpppp.exe51⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lfxffll.exec:\lfxffll.exe52⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lflrrlr.exec:\lflrrlr.exe53⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bntbhh.exec:\bntbhh.exe54⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1nbhnn.exec:\1nbhnn.exe55⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3vjjj.exec:\3vjjj.exe56⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ppjvj.exec:\ppjvj.exe57⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xrlxflx.exec:\xrlxflx.exe58⤵
- Executes dropped EXE
PID:1796 -
\??\c:\lfrfflr.exec:\lfrfflr.exe59⤵
- Executes dropped EXE
PID:2040 -
\??\c:\thtnnt.exec:\thtnnt.exe60⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nhtbhh.exec:\nhtbhh.exe61⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jdjdv.exec:\jdjdv.exe62⤵
- Executes dropped EXE
PID:816 -
\??\c:\dvjjp.exec:\dvjjp.exe63⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xlrllfx.exec:\xlrllfx.exe64⤵
- Executes dropped EXE
PID:1948 -
\??\c:\xffllfx.exec:\xffllfx.exe65⤵
- Executes dropped EXE
PID:2892 -
\??\c:\btbbhh.exec:\btbbhh.exe66⤵PID:2952
-
\??\c:\3btnbb.exec:\3btnbb.exe67⤵PID:1744
-
\??\c:\dpddd.exec:\dpddd.exe68⤵PID:2408
-
\??\c:\3vjjj.exec:\3vjjj.exe69⤵PID:2996
-
\??\c:\lxxflrr.exec:\lxxflrr.exe70⤵PID:2548
-
\??\c:\frlrrrr.exec:\frlrrrr.exe71⤵PID:2028
-
\??\c:\hbnhtn.exec:\hbnhtn.exe72⤵PID:1592
-
\??\c:\7hhbbn.exec:\7hhbbn.exe73⤵PID:2448
-
\??\c:\pddvv.exec:\pddvv.exe74⤵PID:1912
-
\??\c:\5pdvp.exec:\5pdvp.exe75⤵PID:2484
-
\??\c:\jvddp.exec:\jvddp.exe76⤵PID:2816
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe77⤵PID:2804
-
\??\c:\nbnbbn.exec:\nbnbbn.exe78⤵PID:2780
-
\??\c:\9htbtb.exec:\9htbtb.exe79⤵PID:2720
-
\??\c:\bthhbb.exec:\bthhbb.exe80⤵PID:2716
-
\??\c:\vdjjj.exec:\vdjjj.exe81⤵PID:2668
-
\??\c:\pdppp.exec:\pdppp.exe82⤵PID:2600
-
\??\c:\rfrfxxx.exec:\rfrfxxx.exe83⤵PID:1752
-
\??\c:\lxfffxf.exec:\lxfffxf.exe84⤵PID:2788
-
\??\c:\xxxllxf.exec:\xxxllxf.exe85⤵PID:2704
-
\??\c:\bbhntn.exec:\bbhntn.exe86⤵PID:2904
-
\??\c:\9tbbbb.exec:\9tbbbb.exe87⤵PID:2664
-
\??\c:\pdddd.exec:\pdddd.exe88⤵PID:484
-
\??\c:\7dpjj.exec:\7dpjj.exe89⤵PID:3060
-
\??\c:\1rxflll.exec:\1rxflll.exe90⤵PID:1724
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe91⤵PID:1644
-
\??\c:\tnhbbt.exec:\tnhbbt.exe92⤵PID:2236
-
\??\c:\5bnnht.exec:\5bnnht.exe93⤵PID:1964
-
\??\c:\5vjjv.exec:\5vjjv.exe94⤵PID:1240
-
\??\c:\vjpjp.exec:\vjpjp.exe95⤵PID:348
-
\??\c:\3xllffl.exec:\3xllffl.exe96⤵PID:1856
-
\??\c:\9lrrxrr.exec:\9lrrxrr.exe97⤵PID:2140
-
\??\c:\bnttbb.exec:\bnttbb.exe98⤵PID:1732
-
\??\c:\nhtnhn.exec:\nhtnhn.exe99⤵PID:1796
-
\??\c:\7nbhhn.exec:\7nbhhn.exe100⤵PID:928
-
\??\c:\dvjjj.exec:\dvjjj.exe101⤵PID:2228
-
\??\c:\5pddd.exec:\5pddd.exe102⤵PID:1524
-
\??\c:\frfflfl.exec:\frfflfl.exe103⤵PID:1688
-
\??\c:\lxrxxxf.exec:\lxrxxxf.exe104⤵PID:1852
-
\??\c:\3htttt.exec:\3htttt.exe105⤵PID:3008
-
\??\c:\tnnbbt.exec:\tnnbbt.exe106⤵PID:1784
-
\??\c:\btbbhn.exec:\btbbhn.exe107⤵PID:2104
-
\??\c:\vjpjp.exec:\vjpjp.exe108⤵PID:2216
-
\??\c:\vjdvv.exec:\vjdvv.exe109⤵PID:2060
-
\??\c:\3fllllr.exec:\3fllllr.exe110⤵PID:1808
-
\??\c:\rfrrlfl.exec:\rfrrlfl.exe111⤵PID:2696
-
\??\c:\9xllllr.exec:\9xllllr.exe112⤵PID:2784
-
\??\c:\nbhbbt.exec:\nbhbbt.exe113⤵PID:2752
-
\??\c:\nhhbnb.exec:\nhhbnb.exe114⤵PID:1620
-
\??\c:\pjvdv.exec:\pjvdv.exe115⤵PID:2812
-
\??\c:\5pddd.exec:\5pddd.exe116⤵PID:2848
-
\??\c:\9lllrll.exec:\9lllrll.exe117⤵PID:2332
-
\??\c:\frxrfxf.exec:\frxrfxf.exe118⤵PID:2756
-
\??\c:\9rfflfx.exec:\9rfflfx.exe119⤵PID:2632
-
\??\c:\5bhhhb.exec:\5bhhhb.exe120⤵PID:1716
-
\??\c:\ttbbht.exec:\ttbbht.exe121⤵PID:3040
-
\??\c:\dpvpp.exec:\dpvpp.exe122⤵PID:664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-