Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
528657f0c2cd44677465b2e9e62a4ab0N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
528657f0c2cd44677465b2e9e62a4ab0N.exe
-
Size
82KB
-
MD5
528657f0c2cd44677465b2e9e62a4ab0
-
SHA1
2e1bb0041695e6da6146a9baca5bbbb559af8ca5
-
SHA256
ed6134a2c083d3d1444f6894fd919a7ea3378ee535c33267ee54000c17751efd
-
SHA512
7637cddbfb01cc582d8fe94be043f5368a6546268bc7dfecb2908c57488b14c86452993f0d4210ede9e3dbf1fc6573703b04eb3e1a29211d717441e5ef8fcf26
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qk:ymb3NkkiQ3mdBjFIIp9L9QrrA8H
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/2756-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/500-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/268-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-1198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2888 jjvvj.exe 2928 hbbbhh.exe 2420 rlxxlrx.exe 2664 tnbnbn.exe 2692 86062.exe 2236 tnnhbb.exe 1624 lrrfflr.exe 2564 bbnnbt.exe 2384 k64646.exe 3000 042884.exe 2944 dpjvj.exe 3044 68682.exe 1656 1xlrxfr.exe 2308 ffrlfxx.exe 500 042800.exe 2320 dvpdv.exe 2596 42444.exe 2472 jvjjv.exe 2052 60228.exe 1056 20668.exe 1984 rlflrrl.exe 916 rlfxlrf.exe 1252 ffrxffx.exe 1692 5xlxlxx.exe 268 9lfrfxl.exe 1040 k20680.exe 1768 ththnt.exe 2020 hbtbht.exe 1944 xrrfrrf.exe 1704 hhbtnt.exe 1584 hbnthn.exe 2912 hhttbh.exe 2896 o046842.exe 2776 1flrlrx.exe 2640 fxrfrfx.exe 2644 26840.exe 2648 6606880.exe 2688 u024240.exe 2632 9jjjj.exe 1388 rlxxlrr.exe 2856 m2684.exe 2072 jdpvj.exe 3028 thtbhh.exe 2060 5dvvd.exe 2800 w46866.exe 2840 5hbbhn.exe 2380 httnht.exe 3008 xrflfxl.exe 2656 nnnnbb.exe 2716 htnnhn.exe 1536 0286004.exe 804 0684624.exe 1764 ppjdv.exe 2216 pjvdp.exe 2488 082440.exe 2484 nbttbb.exe 1712 60844.exe 1860 9hbhtt.exe 1060 060862.exe 2116 8246628.exe 2360 xrlfllx.exe 1376 9btbtb.exe 764 646428.exe 268 26006.exe -
resource yara_rule behavioral1/memory/2756-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/500-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-840-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-1198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64084.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82068.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20808.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2888 2756 528657f0c2cd44677465b2e9e62a4ab0N.exe 30 PID 2756 wrote to memory of 2888 2756 528657f0c2cd44677465b2e9e62a4ab0N.exe 30 PID 2756 wrote to memory of 2888 2756 528657f0c2cd44677465b2e9e62a4ab0N.exe 30 PID 2756 wrote to memory of 2888 2756 528657f0c2cd44677465b2e9e62a4ab0N.exe 30 PID 2888 wrote to memory of 2928 2888 jjvvj.exe 31 PID 2888 wrote to memory of 2928 2888 jjvvj.exe 31 PID 2888 wrote to memory of 2928 2888 jjvvj.exe 31 PID 2888 wrote to memory of 2928 2888 jjvvj.exe 31 PID 2928 wrote to memory of 2420 2928 hbbbhh.exe 32 PID 2928 wrote to memory of 2420 2928 hbbbhh.exe 32 PID 2928 wrote to memory of 2420 2928 hbbbhh.exe 32 PID 2928 wrote to memory of 2420 2928 hbbbhh.exe 32 PID 2420 wrote to memory of 2664 2420 rlxxlrx.exe 33 PID 2420 wrote to memory of 2664 2420 rlxxlrx.exe 33 PID 2420 wrote to memory of 2664 2420 rlxxlrx.exe 33 PID 2420 wrote to memory of 2664 2420 rlxxlrx.exe 33 PID 2664 wrote to memory of 2692 2664 tnbnbn.exe 34 PID 2664 wrote to memory of 2692 2664 tnbnbn.exe 34 PID 2664 wrote to memory of 2692 2664 tnbnbn.exe 34 PID 2664 wrote to memory of 2692 2664 tnbnbn.exe 34 PID 2692 wrote to memory of 2236 2692 86062.exe 35 PID 2692 wrote to memory of 2236 2692 86062.exe 35 PID 2692 wrote to memory of 2236 2692 86062.exe 35 PID 2692 wrote to memory of 2236 2692 86062.exe 35 PID 2236 wrote to memory of 1624 2236 tnnhbb.exe 36 PID 2236 wrote to memory of 1624 2236 tnnhbb.exe 36 PID 2236 wrote to memory of 1624 2236 tnnhbb.exe 36 PID 2236 wrote to memory of 1624 2236 tnnhbb.exe 36 PID 1624 wrote to memory of 2564 1624 lrrfflr.exe 37 PID 1624 wrote to memory of 2564 1624 lrrfflr.exe 37 PID 1624 wrote to memory of 2564 1624 lrrfflr.exe 37 PID 1624 wrote to memory of 2564 1624 lrrfflr.exe 37 PID 2564 wrote to memory of 2384 2564 bbnnbt.exe 38 PID 2564 wrote to memory of 2384 2564 bbnnbt.exe 38 PID 2564 wrote to memory of 2384 2564 bbnnbt.exe 38 PID 2564 wrote to memory of 2384 2564 bbnnbt.exe 38 PID 2384 wrote to memory of 3000 2384 k64646.exe 39 PID 2384 wrote to memory of 3000 2384 k64646.exe 39 PID 2384 wrote to memory of 3000 2384 k64646.exe 39 PID 2384 wrote to memory of 3000 2384 k64646.exe 39 PID 3000 wrote to memory of 2944 3000 042884.exe 40 PID 3000 wrote to memory of 2944 3000 042884.exe 40 PID 3000 wrote to memory of 2944 3000 042884.exe 40 PID 3000 wrote to memory of 2944 3000 042884.exe 40 PID 2944 wrote to memory of 3044 2944 dpjvj.exe 41 PID 2944 wrote to memory of 3044 2944 dpjvj.exe 41 PID 2944 wrote to memory of 3044 2944 dpjvj.exe 41 PID 2944 wrote to memory of 3044 2944 dpjvj.exe 41 PID 3044 wrote to memory of 1656 3044 68682.exe 42 PID 3044 wrote to memory of 1656 3044 68682.exe 42 PID 3044 wrote to memory of 1656 3044 68682.exe 42 PID 3044 wrote to memory of 1656 3044 68682.exe 42 PID 1656 wrote to memory of 2308 1656 1xlrxfr.exe 43 PID 1656 wrote to memory of 2308 1656 1xlrxfr.exe 43 PID 1656 wrote to memory of 2308 1656 1xlrxfr.exe 43 PID 1656 wrote to memory of 2308 1656 1xlrxfr.exe 43 PID 2308 wrote to memory of 500 2308 ffrlfxx.exe 44 PID 2308 wrote to memory of 500 2308 ffrlfxx.exe 44 PID 2308 wrote to memory of 500 2308 ffrlfxx.exe 44 PID 2308 wrote to memory of 500 2308 ffrlfxx.exe 44 PID 500 wrote to memory of 2320 500 042800.exe 45 PID 500 wrote to memory of 2320 500 042800.exe 45 PID 500 wrote to memory of 2320 500 042800.exe 45 PID 500 wrote to memory of 2320 500 042800.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\528657f0c2cd44677465b2e9e62a4ab0N.exe"C:\Users\Admin\AppData\Local\Temp\528657f0c2cd44677465b2e9e62a4ab0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jjvvj.exec:\jjvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\hbbbhh.exec:\hbbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\tnbnbn.exec:\tnbnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\86062.exec:\86062.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\tnnhbb.exec:\tnnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\lrrfflr.exec:\lrrfflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\bbnnbt.exec:\bbnnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\k64646.exec:\k64646.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\042884.exec:\042884.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\dpjvj.exec:\dpjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\68682.exec:\68682.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\1xlrxfr.exec:\1xlrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\ffrlfxx.exec:\ffrlfxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\042800.exec:\042800.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
\??\c:\dvpdv.exec:\dvpdv.exe17⤵
- Executes dropped EXE
PID:2320 -
\??\c:\42444.exec:\42444.exe18⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jvjjv.exec:\jvjjv.exe19⤵
- Executes dropped EXE
PID:2472 -
\??\c:\60228.exec:\60228.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\20668.exec:\20668.exe21⤵
- Executes dropped EXE
PID:1056 -
\??\c:\rlflrrl.exec:\rlflrrl.exe22⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rlfxlrf.exec:\rlfxlrf.exe23⤵
- Executes dropped EXE
PID:916 -
\??\c:\ffrxffx.exec:\ffrxffx.exe24⤵
- Executes dropped EXE
PID:1252 -
\??\c:\5xlxlxx.exec:\5xlxlxx.exe25⤵
- Executes dropped EXE
PID:1692 -
\??\c:\9lfrfxl.exec:\9lfrfxl.exe26⤵
- Executes dropped EXE
PID:268 -
\??\c:\k20680.exec:\k20680.exe27⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ththnt.exec:\ththnt.exe28⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hbtbht.exec:\hbtbht.exe29⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xrrfrrf.exec:\xrrfrrf.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hhbtnt.exec:\hhbtnt.exe31⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hbnthn.exec:\hbnthn.exe32⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hhttbh.exec:\hhttbh.exe33⤵
- Executes dropped EXE
PID:2912 -
\??\c:\o046842.exec:\o046842.exe34⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1flrlrx.exec:\1flrlrx.exe35⤵
- Executes dropped EXE
PID:2776 -
\??\c:\fxrfrfx.exec:\fxrfrfx.exe36⤵
- Executes dropped EXE
PID:2640 -
\??\c:\26840.exec:\26840.exe37⤵
- Executes dropped EXE
PID:2644 -
\??\c:\6606880.exec:\6606880.exe38⤵
- Executes dropped EXE
PID:2648 -
\??\c:\u024240.exec:\u024240.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9jjjj.exec:\9jjjj.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rlxxlrr.exec:\rlxxlrr.exe41⤵
- Executes dropped EXE
PID:1388 -
\??\c:\m2684.exec:\m2684.exe42⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jdpvj.exec:\jdpvj.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072 -
\??\c:\thtbhh.exec:\thtbhh.exe44⤵
- Executes dropped EXE
PID:3028 -
\??\c:\5dvvd.exec:\5dvvd.exe45⤵
- Executes dropped EXE
PID:2060 -
\??\c:\w46866.exec:\w46866.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\5hbbhn.exec:\5hbbhn.exe47⤵
- Executes dropped EXE
PID:2840 -
\??\c:\httnht.exec:\httnht.exe48⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xrflfxl.exec:\xrflfxl.exe49⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nnnnbb.exec:\nnnnbb.exe50⤵
- Executes dropped EXE
PID:2656 -
\??\c:\htnnhn.exec:\htnnhn.exe51⤵
- Executes dropped EXE
PID:2716 -
\??\c:\0286004.exec:\0286004.exe52⤵
- Executes dropped EXE
PID:1536 -
\??\c:\0684624.exec:\0684624.exe53⤵
- Executes dropped EXE
PID:804 -
\??\c:\ppjdv.exec:\ppjdv.exe54⤵
- Executes dropped EXE
PID:1764 -
\??\c:\pjvdp.exec:\pjvdp.exe55⤵
- Executes dropped EXE
PID:2216 -
\??\c:\082440.exec:\082440.exe56⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nbttbb.exec:\nbttbb.exe57⤵
- Executes dropped EXE
PID:2484 -
\??\c:\60844.exec:\60844.exe58⤵
- Executes dropped EXE
PID:1712 -
\??\c:\9hbhtt.exec:\9hbhtt.exe59⤵
- Executes dropped EXE
PID:1860 -
\??\c:\060862.exec:\060862.exe60⤵
- Executes dropped EXE
PID:1060 -
\??\c:\8246628.exec:\8246628.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xrlfllx.exec:\xrlfllx.exe62⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9btbtb.exec:\9btbtb.exe63⤵
- Executes dropped EXE
PID:1376 -
\??\c:\646428.exec:\646428.exe64⤵
- Executes dropped EXE
PID:764 -
\??\c:\26006.exec:\26006.exe65⤵
- Executes dropped EXE
PID:268 -
\??\c:\bbnbth.exec:\bbnbth.exe66⤵PID:2388
-
\??\c:\48808.exec:\48808.exe67⤵PID:2352
-
\??\c:\tthtbh.exec:\tthtbh.exe68⤵PID:1104
-
\??\c:\4280288.exec:\4280288.exe69⤵PID:1936
-
\??\c:\rrlxlfx.exec:\rrlxlfx.exe70⤵PID:2152
-
\??\c:\3rffxll.exec:\3rffxll.exe71⤵PID:2764
-
\??\c:\26082.exec:\26082.exe72⤵PID:2916
-
\??\c:\48620.exec:\48620.exe73⤵PID:2772
-
\??\c:\9vdpv.exec:\9vdpv.exe74⤵PID:3060
-
\??\c:\48284.exec:\48284.exe75⤵PID:2920
-
\??\c:\6088066.exec:\6088066.exe76⤵PID:2752
-
\??\c:\xrxfrfr.exec:\xrxfrfr.exe77⤵PID:2640
-
\??\c:\q82088.exec:\q82088.exe78⤵PID:2680
-
\??\c:\08624.exec:\08624.exe79⤵PID:2344
-
\??\c:\rfxrxlr.exec:\rfxrxlr.exe80⤵PID:2336
-
\??\c:\hbnbtt.exec:\hbnbtt.exe81⤵PID:1488
-
\??\c:\vvjdj.exec:\vvjdj.exe82⤵PID:1912
-
\??\c:\pdvjv.exec:\pdvjv.exe83⤵PID:1264
-
\??\c:\00464.exec:\00464.exe84⤵PID:1820
-
\??\c:\xrlrllf.exec:\xrlrllf.exe85⤵PID:2384
-
\??\c:\4468006.exec:\4468006.exe86⤵PID:2808
-
\??\c:\btbhbb.exec:\btbhbb.exe87⤵PID:2836
-
\??\c:\642400.exec:\642400.exe88⤵PID:2604
-
\??\c:\2224662.exec:\2224662.exe89⤵PID:2588
-
\??\c:\64686.exec:\64686.exe90⤵PID:2080
-
\??\c:\9rffllf.exec:\9rffllf.exe91⤵PID:2712
-
\??\c:\nnhbtn.exec:\nnhbtn.exe92⤵PID:2100
-
\??\c:\0466280.exec:\0466280.exe93⤵PID:1164
-
\??\c:\2000402.exec:\2000402.exe94⤵PID:2476
-
\??\c:\08646.exec:\08646.exe95⤵PID:700
-
\??\c:\m4688.exec:\m4688.exe96⤵PID:2472
-
\??\c:\m2002.exec:\m2002.exe97⤵PID:1544
-
\??\c:\hhbhtb.exec:\hhbhtb.exe98⤵PID:1044
-
\??\c:\8688884.exec:\8688884.exe99⤵PID:1056
-
\??\c:\vpvvj.exec:\vpvvj.exe100⤵PID:448
-
\??\c:\208484.exec:\208484.exe101⤵PID:836
-
\??\c:\0866284.exec:\0866284.exe102⤵PID:2116
-
\??\c:\02066.exec:\02066.exe103⤵PID:2240
-
\??\c:\802688.exec:\802688.exe104⤵PID:1352
-
\??\c:\46488.exec:\46488.exe105⤵PID:1692
-
\??\c:\o280444.exec:\o280444.exe106⤵PID:1816
-
\??\c:\tthtth.exec:\tthtth.exe107⤵PID:1668
-
\??\c:\w26244.exec:\w26244.exe108⤵PID:1940
-
\??\c:\lfrxxff.exec:\lfrxxff.exe109⤵PID:896
-
\??\c:\hhtnth.exec:\hhtnth.exe110⤵PID:2756
-
\??\c:\jvddp.exec:\jvddp.exe111⤵PID:1704
-
\??\c:\0046806.exec:\0046806.exe112⤵PID:1584
-
\??\c:\g0240.exec:\g0240.exe113⤵PID:2868
-
\??\c:\i200688.exec:\i200688.exe114⤵PID:2952
-
\??\c:\fxlrrxx.exec:\fxlrrxx.exe115⤵PID:3060
-
\??\c:\0862228.exec:\0862228.exe116⤵PID:2784
-
\??\c:\6682046.exec:\6682046.exe117⤵PID:2196
-
\??\c:\9flrlxl.exec:\9flrlxl.exe118⤵PID:2736
-
\??\c:\7hnthn.exec:\7hnthn.exe119⤵PID:2680
-
\??\c:\w86440.exec:\w86440.exe120⤵PID:1088
-
\??\c:\86284.exec:\86284.exe121⤵PID:2236
-
\??\c:\s4848.exec:\s4848.exe122⤵PID:592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-