Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 05:34
Static task
static1
Behavioral task
behavioral1
Sample
f9cb1eea530a3dee983a3f328d2458831137bf3ec8259e052f157f5f739109f1.exe
Resource
win7-20240704-en
General
-
Target
f9cb1eea530a3dee983a3f328d2458831137bf3ec8259e052f157f5f739109f1.exe
-
Size
96KB
-
MD5
2e5025eeefc7192c12d14f6e7234d9c8
-
SHA1
fc38fa5d794aba9d30ae82cb62e3c57aff804477
-
SHA256
f9cb1eea530a3dee983a3f328d2458831137bf3ec8259e052f157f5f739109f1
-
SHA512
3b226cae7fd45dadde4d5baf82176a107b4725b6e63d1094f687c028ca6f3c6d666ee4c190c6e1b9fc5a37069a165eb59895e0d353343d38a360487b8b18431a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTrg:ymb3NkkiQ3mdBjFIj+qNhvZuHQYfw4jS
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2740-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-8-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1272-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/828-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2104 pjvdj.exe 2780 480082.exe 2952 20882.exe 2716 2200222.exe 2728 httnnh.exe 2572 rrxrfrl.exe 3048 pppdp.exe 1428 662660.exe 2408 nbnbth.exe 3024 ddjvj.exe 2240 82482.exe 980 64668.exe 2872 5xxfflr.exe 2336 880800.exe 2076 0480246.exe 1272 5xlfxlx.exe 2328 820680.exe 2120 2242628.exe 2012 c466406.exe 448 rflrxfl.exe 3060 8868062.exe 1244 vvjpd.exe 2512 3dpvd.exe 828 5bntbn.exe 2092 482066.exe 1956 9xflllr.exe 2440 8602884.exe 992 260622.exe 1756 3hbbhn.exe 2248 88686.exe 1568 jdvjj.exe 2784 i024264.exe 2796 26802.exe 2760 rlffffl.exe 2952 208460.exe 2580 86286.exe 2832 400622.exe 2560 xxxfffr.exe 2676 64224.exe 2108 pjddj.exe 2332 lfxrllx.exe 2388 rrllxfl.exe 2412 jdpvd.exe 620 042244.exe 768 20026.exe 2844 8202046.exe 2812 040824.exe 2884 lfrxflr.exe 2436 llllxfl.exe 320 hbbbnn.exe 1760 4480246.exe 1272 0488662.exe 668 thbbbn.exe 2344 02288.exe 1980 pjpdj.exe 1512 9xrrxxf.exe 2292 824688.exe 3020 226444.exe 3064 o206440.exe 1244 jvdjp.exe 2512 vvjjv.exe 968 flxrffr.exe 2896 ppddj.exe 1040 6044062.exe -
resource yara_rule behavioral1/memory/2740-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1272-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-285-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8248000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i046446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0806880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s6468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2104 2740 f9cb1eea530a3dee983a3f328d2458831137bf3ec8259e052f157f5f739109f1.exe 30 PID 2740 wrote to memory of 2104 2740 f9cb1eea530a3dee983a3f328d2458831137bf3ec8259e052f157f5f739109f1.exe 30 PID 2740 wrote to memory of 2104 2740 f9cb1eea530a3dee983a3f328d2458831137bf3ec8259e052f157f5f739109f1.exe 30 PID 2740 wrote to memory of 2104 2740 f9cb1eea530a3dee983a3f328d2458831137bf3ec8259e052f157f5f739109f1.exe 30 PID 2104 wrote to memory of 2780 2104 pjvdj.exe 31 PID 2104 wrote to memory of 2780 2104 pjvdj.exe 31 PID 2104 wrote to memory of 2780 2104 pjvdj.exe 31 PID 2104 wrote to memory of 2780 2104 pjvdj.exe 31 PID 2780 wrote to memory of 2952 2780 480082.exe 32 PID 2780 wrote to memory of 2952 2780 480082.exe 32 PID 2780 wrote to memory of 2952 2780 480082.exe 32 PID 2780 wrote to memory of 2952 2780 480082.exe 32 PID 2952 wrote to memory of 2716 2952 20882.exe 33 PID 2952 wrote to memory of 2716 2952 20882.exe 33 PID 2952 wrote to memory of 2716 2952 20882.exe 33 PID 2952 wrote to memory of 2716 2952 20882.exe 33 PID 2716 wrote to memory of 2728 2716 2200222.exe 34 PID 2716 wrote to memory of 2728 2716 2200222.exe 34 PID 2716 wrote to memory of 2728 2716 2200222.exe 34 PID 2716 wrote to memory of 2728 2716 2200222.exe 34 PID 2728 wrote to memory of 2572 2728 httnnh.exe 35 PID 2728 wrote to memory of 2572 2728 httnnh.exe 35 PID 2728 wrote to memory of 2572 2728 httnnh.exe 35 PID 2728 wrote to memory of 2572 2728 httnnh.exe 35 PID 2572 wrote to memory of 3048 2572 rrxrfrl.exe 36 PID 2572 wrote to memory of 3048 2572 rrxrfrl.exe 36 PID 2572 wrote to memory of 3048 2572 rrxrfrl.exe 36 PID 2572 wrote to memory of 3048 2572 rrxrfrl.exe 36 PID 3048 wrote to memory of 1428 3048 pppdp.exe 37 PID 3048 wrote to memory of 1428 3048 pppdp.exe 37 PID 3048 wrote to memory of 1428 3048 pppdp.exe 37 PID 3048 wrote to memory of 1428 3048 pppdp.exe 37 PID 1428 wrote to memory of 2408 1428 662660.exe 38 PID 1428 wrote to memory of 2408 1428 662660.exe 38 PID 1428 wrote to memory of 2408 1428 662660.exe 38 PID 1428 wrote to memory of 2408 1428 662660.exe 38 PID 2408 wrote to memory of 3024 2408 nbnbth.exe 39 PID 2408 wrote to memory of 3024 2408 nbnbth.exe 39 PID 2408 wrote to memory of 3024 2408 nbnbth.exe 39 PID 2408 wrote to memory of 3024 2408 nbnbth.exe 39 PID 3024 wrote to memory of 2240 3024 ddjvj.exe 40 PID 3024 wrote to memory of 2240 3024 ddjvj.exe 40 PID 3024 wrote to memory of 2240 3024 ddjvj.exe 40 PID 3024 wrote to memory of 2240 3024 ddjvj.exe 40 PID 2240 wrote to memory of 980 2240 82482.exe 41 PID 2240 wrote to memory of 980 2240 82482.exe 41 PID 2240 wrote to memory of 980 2240 82482.exe 41 PID 2240 wrote to memory of 980 2240 82482.exe 41 PID 980 wrote to memory of 2872 980 64668.exe 42 PID 980 wrote to memory of 2872 980 64668.exe 42 PID 980 wrote to memory of 2872 980 64668.exe 42 PID 980 wrote to memory of 2872 980 64668.exe 42 PID 2872 wrote to memory of 2336 2872 5xxfflr.exe 43 PID 2872 wrote to memory of 2336 2872 5xxfflr.exe 43 PID 2872 wrote to memory of 2336 2872 5xxfflr.exe 43 PID 2872 wrote to memory of 2336 2872 5xxfflr.exe 43 PID 2336 wrote to memory of 2076 2336 880800.exe 44 PID 2336 wrote to memory of 2076 2336 880800.exe 44 PID 2336 wrote to memory of 2076 2336 880800.exe 44 PID 2336 wrote to memory of 2076 2336 880800.exe 44 PID 2076 wrote to memory of 1272 2076 0480246.exe 45 PID 2076 wrote to memory of 1272 2076 0480246.exe 45 PID 2076 wrote to memory of 1272 2076 0480246.exe 45 PID 2076 wrote to memory of 1272 2076 0480246.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9cb1eea530a3dee983a3f328d2458831137bf3ec8259e052f157f5f739109f1.exe"C:\Users\Admin\AppData\Local\Temp\f9cb1eea530a3dee983a3f328d2458831137bf3ec8259e052f157f5f739109f1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pjvdj.exec:\pjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\480082.exec:\480082.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\20882.exec:\20882.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\2200222.exec:\2200222.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\httnnh.exec:\httnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rrxrfrl.exec:\rrxrfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pppdp.exec:\pppdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\662660.exec:\662660.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\nbnbth.exec:\nbnbth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\ddjvj.exec:\ddjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\82482.exec:\82482.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\64668.exec:\64668.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\5xxfflr.exec:\5xxfflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\880800.exec:\880800.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\0480246.exec:\0480246.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\5xlfxlx.exec:\5xlfxlx.exe17⤵
- Executes dropped EXE
PID:1272 -
\??\c:\820680.exec:\820680.exe18⤵
- Executes dropped EXE
PID:2328 -
\??\c:\2242628.exec:\2242628.exe19⤵
- Executes dropped EXE
PID:2120 -
\??\c:\c466406.exec:\c466406.exe20⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rflrxfl.exec:\rflrxfl.exe21⤵
- Executes dropped EXE
PID:448 -
\??\c:\8868062.exec:\8868062.exe22⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vvjpd.exec:\vvjpd.exe23⤵
- Executes dropped EXE
PID:1244 -
\??\c:\3dpvd.exec:\3dpvd.exe24⤵
- Executes dropped EXE
PID:2512 -
\??\c:\5bntbn.exec:\5bntbn.exe25⤵
- Executes dropped EXE
PID:828 -
\??\c:\482066.exec:\482066.exe26⤵
- Executes dropped EXE
PID:2092 -
\??\c:\9xflllr.exec:\9xflllr.exe27⤵
- Executes dropped EXE
PID:1956 -
\??\c:\8602884.exec:\8602884.exe28⤵
- Executes dropped EXE
PID:2440 -
\??\c:\260622.exec:\260622.exe29⤵
- Executes dropped EXE
PID:992 -
\??\c:\3hbbhn.exec:\3hbbhn.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\88686.exec:\88686.exe31⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jdvjj.exec:\jdvjj.exe32⤵
- Executes dropped EXE
PID:1568 -
\??\c:\i024264.exec:\i024264.exe33⤵
- Executes dropped EXE
PID:2784 -
\??\c:\26802.exec:\26802.exe34⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rlffffl.exec:\rlffffl.exe35⤵
- Executes dropped EXE
PID:2760 -
\??\c:\208460.exec:\208460.exe36⤵
- Executes dropped EXE
PID:2952 -
\??\c:\86286.exec:\86286.exe37⤵
- Executes dropped EXE
PID:2580 -
\??\c:\400622.exec:\400622.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xxxfffr.exec:\xxxfffr.exe39⤵
- Executes dropped EXE
PID:2560 -
\??\c:\64224.exec:\64224.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pjddj.exec:\pjddj.exe41⤵
- Executes dropped EXE
PID:2108 -
\??\c:\lfxrllx.exec:\lfxrllx.exe42⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rrllxfl.exec:\rrllxfl.exe43⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jdpvd.exec:\jdpvd.exe44⤵
- Executes dropped EXE
PID:2412 -
\??\c:\042244.exec:\042244.exe45⤵
- Executes dropped EXE
PID:620 -
\??\c:\20026.exec:\20026.exe46⤵
- Executes dropped EXE
PID:768 -
\??\c:\8202046.exec:\8202046.exe47⤵
- Executes dropped EXE
PID:2844 -
\??\c:\040824.exec:\040824.exe48⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lfrxflr.exec:\lfrxflr.exe49⤵
- Executes dropped EXE
PID:2884 -
\??\c:\llllxfl.exec:\llllxfl.exe50⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hbbbnn.exec:\hbbbnn.exe51⤵
- Executes dropped EXE
PID:320 -
\??\c:\4480246.exec:\4480246.exe52⤵
- Executes dropped EXE
PID:1760 -
\??\c:\0488662.exec:\0488662.exe53⤵
- Executes dropped EXE
PID:1272 -
\??\c:\thbbbn.exec:\thbbbn.exe54⤵
- Executes dropped EXE
PID:668 -
\??\c:\02288.exec:\02288.exe55⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pjpdj.exec:\pjpdj.exe56⤵
- Executes dropped EXE
PID:1980 -
\??\c:\9xrrxxf.exec:\9xrrxxf.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512 -
\??\c:\824688.exec:\824688.exe58⤵
- Executes dropped EXE
PID:2292 -
\??\c:\226444.exec:\226444.exe59⤵
- Executes dropped EXE
PID:3020 -
\??\c:\o206440.exec:\o206440.exe60⤵
- Executes dropped EXE
PID:3064 -
\??\c:\jvdjp.exec:\jvdjp.exe61⤵
- Executes dropped EXE
PID:1244 -
\??\c:\vvjjv.exec:\vvjjv.exe62⤵
- Executes dropped EXE
PID:2512 -
\??\c:\flxrffr.exec:\flxrffr.exe63⤵
- Executes dropped EXE
PID:968 -
\??\c:\ppddj.exec:\ppddj.exe64⤵
- Executes dropped EXE
PID:2896 -
\??\c:\6044062.exec:\6044062.exe65⤵
- Executes dropped EXE
PID:1040 -
\??\c:\3pvvd.exec:\3pvvd.exe66⤵PID:1956
-
\??\c:\jdppd.exec:\jdppd.exe67⤵PID:2508
-
\??\c:\dddpj.exec:\dddpj.exe68⤵PID:1788
-
\??\c:\xxllrrf.exec:\xxllrrf.exe69⤵PID:1812
-
\??\c:\226828.exec:\226828.exe70⤵PID:2740
-
\??\c:\08402.exec:\08402.exe71⤵PID:1560
-
\??\c:\2088480.exec:\2088480.exe72⤵PID:1260
-
\??\c:\080640.exec:\080640.exe73⤵PID:1988
-
\??\c:\48684.exec:\48684.exe74⤵PID:2816
-
\??\c:\7vjjv.exec:\7vjjv.exe75⤵PID:2756
-
\??\c:\nthhnn.exec:\nthhnn.exe76⤵PID:2584
-
\??\c:\dvvdj.exec:\dvvdj.exe77⤵PID:2604
-
\??\c:\7rfflxl.exec:\7rfflxl.exe78⤵PID:2728
-
\??\c:\8868002.exec:\8868002.exe79⤵PID:2628
-
\??\c:\o800628.exec:\o800628.exe80⤵PID:2572
-
\??\c:\0428062.exec:\0428062.exe81⤵PID:1128
-
\??\c:\48628.exec:\48628.exe82⤵PID:1212
-
\??\c:\60222.exec:\60222.exe83⤵PID:1488
-
\??\c:\frlflrx.exec:\frlflrx.exe84⤵PID:1516
-
\??\c:\0024006.exec:\0024006.exe85⤵PID:2904
-
\??\c:\46844.exec:\46844.exe86⤵PID:2624
-
\??\c:\e86642.exec:\e86642.exe87⤵PID:2924
-
\??\c:\0600224.exec:\0600224.exe88⤵PID:2132
-
\??\c:\rrllxfl.exec:\rrllxfl.exe89⤵PID:2656
-
\??\c:\nhntnt.exec:\nhntnt.exe90⤵PID:536
-
\??\c:\5djpv.exec:\5djpv.exe91⤵PID:856
-
\??\c:\e84804.exec:\e84804.exe92⤵PID:1908
-
\??\c:\4288420.exec:\4288420.exe93⤵PID:2008
-
\??\c:\082666.exec:\082666.exe94⤵PID:2040
-
\??\c:\64664.exec:\64664.exe95⤵PID:2212
-
\??\c:\jpvpv.exec:\jpvpv.exe96⤵PID:2012
-
\??\c:\lrxrllr.exec:\lrxrllr.exe97⤵PID:2152
-
\??\c:\nbhntn.exec:\nbhntn.exe98⤵PID:584
-
\??\c:\vpdvv.exec:\vpdvv.exe99⤵PID:1364
-
\??\c:\fxrfxfl.exec:\fxrfxfl.exe100⤵PID:732
-
\??\c:\82888.exec:\82888.exe101⤵PID:2312
-
\??\c:\3nbbbb.exec:\3nbbbb.exe102⤵PID:1752
-
\??\c:\3vjdj.exec:\3vjdj.exe103⤵PID:300
-
\??\c:\lfllllr.exec:\lfllllr.exe104⤵PID:2144
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe105⤵PID:1676
-
\??\c:\tntnnb.exec:\tntnnb.exe106⤵PID:2440
-
\??\c:\04624.exec:\04624.exe107⤵PID:3012
-
\??\c:\442240.exec:\442240.exe108⤵PID:1916
-
\??\c:\nhtbbh.exec:\nhtbbh.exe109⤵PID:3056
-
\??\c:\202284.exec:\202284.exe110⤵PID:2248
-
\??\c:\7jppp.exec:\7jppp.exe111⤵PID:2704
-
\??\c:\202666.exec:\202666.exe112⤵PID:2104
-
\??\c:\vjvdj.exec:\vjvdj.exe113⤵PID:2100
-
\??\c:\2280426.exec:\2280426.exe114⤵PID:2764
-
\??\c:\86802.exec:\86802.exe115⤵PID:2672
-
\??\c:\08624.exec:\08624.exe116⤵PID:2720
-
\??\c:\20606.exec:\20606.exe117⤵PID:2724
-
\??\c:\6460000.exec:\6460000.exe118⤵PID:2568
-
\??\c:\o440040.exec:\o440040.exe119⤵PID:2576
-
\??\c:\42440.exec:\42440.exe120⤵PID:2188
-
\??\c:\9lxrrrr.exec:\9lxrrrr.exe121⤵PID:1264
-
\??\c:\46846.exec:\46846.exe122⤵PID:1428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-