Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 20:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4e079399b2592aea9229a2b7835c3f10N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
4e079399b2592aea9229a2b7835c3f10N.exe
-
Size
382KB
-
MD5
4e079399b2592aea9229a2b7835c3f10
-
SHA1
ec1ea741310214a084b557b89e58d056e9f68342
-
SHA256
c904229d29d39b1477c0f9fe59b118f14c9162efebe421b47f876bc165340907
-
SHA512
497f1cba79c6f640bf29b48eab0562901ad0c90ff847447bd319dd2cf62f0d93ae2755d9940cb8d90dddaab5ac4f282c31eefc0966ab5b2f11bc4b362d075c9f
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHqL3yeHmlwe+axBcot39vUDbYhzod05:n3C9BRo7tvnJ99T/KZEL3c5BTkPXKph
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/1280-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2832 8828064.exe 2612 q64640.exe 2812 82024.exe 2740 o480624.exe 2616 8206408.exe 2148 q66862.exe 1316 00208.exe 2980 tnbbbh.exe 2480 2200286.exe 1604 8606646.exe 108 82068.exe 1652 20420.exe 2040 04606.exe 2872 268408.exe 1768 48680.exe 788 202480.exe 3028 602400.exe 552 82008.exe 1956 jdpdp.exe 1036 88246.exe 2336 06206.exe 280 dpvjd.exe 1664 ttthbh.exe 924 ddvvj.exe 1528 86406.exe 1720 486280.exe 2388 00086.exe 2140 868844.exe 2404 08004.exe 3048 82602.exe 2696 3llrfrf.exe 1280 tthntb.exe 2916 040840.exe 1716 llxlrxf.exe 2764 9xrrxlx.exe 2820 jddjp.exe 2808 26844.exe 2604 9xllxxl.exe 2724 jpjjp.exe 2024 4266262.exe 1148 4682844.exe 2892 btnbhn.exe 2992 9hhbbn.exe 2188 rrllxfx.exe 2296 rlflrrf.exe 2592 0800880.exe 376 u008620.exe 1692 604800.exe 1048 82062.exe 2852 bnbbbb.exe 632 djvdd.exe 536 8684068.exe 320 u048404.exe 2584 4202464.exe 1852 486262.exe 2524 w82022.exe 2316 5bnhnn.exe 448 k68000.exe 2284 hbhhnn.exe 828 g8628.exe 772 7rfllrl.exe 1072 k40060.exe 3044 240626.exe 288 5ffxrfl.exe -
resource yara_rule behavioral1/memory/1280-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 242222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2028002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8862006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6046068.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 266462.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e68888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 886880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s4044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8246240.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1280 wrote to memory of 2832 1280 4e079399b2592aea9229a2b7835c3f10N.exe 31 PID 1280 wrote to memory of 2832 1280 4e079399b2592aea9229a2b7835c3f10N.exe 31 PID 1280 wrote to memory of 2832 1280 4e079399b2592aea9229a2b7835c3f10N.exe 31 PID 1280 wrote to memory of 2832 1280 4e079399b2592aea9229a2b7835c3f10N.exe 31 PID 2832 wrote to memory of 2612 2832 8828064.exe 32 PID 2832 wrote to memory of 2612 2832 8828064.exe 32 PID 2832 wrote to memory of 2612 2832 8828064.exe 32 PID 2832 wrote to memory of 2612 2832 8828064.exe 32 PID 2612 wrote to memory of 2812 2612 q64640.exe 33 PID 2612 wrote to memory of 2812 2612 q64640.exe 33 PID 2612 wrote to memory of 2812 2612 q64640.exe 33 PID 2612 wrote to memory of 2812 2612 q64640.exe 33 PID 2812 wrote to memory of 2740 2812 82024.exe 34 PID 2812 wrote to memory of 2740 2812 82024.exe 34 PID 2812 wrote to memory of 2740 2812 82024.exe 34 PID 2812 wrote to memory of 2740 2812 82024.exe 34 PID 2740 wrote to memory of 2616 2740 o480624.exe 35 PID 2740 wrote to memory of 2616 2740 o480624.exe 35 PID 2740 wrote to memory of 2616 2740 o480624.exe 35 PID 2740 wrote to memory of 2616 2740 o480624.exe 35 PID 2616 wrote to memory of 2148 2616 8206408.exe 36 PID 2616 wrote to memory of 2148 2616 8206408.exe 36 PID 2616 wrote to memory of 2148 2616 8206408.exe 36 PID 2616 wrote to memory of 2148 2616 8206408.exe 36 PID 2148 wrote to memory of 1316 2148 q66862.exe 37 PID 2148 wrote to memory of 1316 2148 q66862.exe 37 PID 2148 wrote to memory of 1316 2148 q66862.exe 37 PID 2148 wrote to memory of 1316 2148 q66862.exe 37 PID 1316 wrote to memory of 2980 1316 00208.exe 38 PID 1316 wrote to memory of 2980 1316 00208.exe 38 PID 1316 wrote to memory of 2980 1316 00208.exe 38 PID 1316 wrote to memory of 2980 1316 00208.exe 38 PID 2980 wrote to memory of 2480 2980 tnbbbh.exe 39 PID 2980 wrote to memory of 2480 2980 tnbbbh.exe 39 PID 2980 wrote to memory of 2480 2980 tnbbbh.exe 39 PID 2980 wrote to memory of 2480 2980 tnbbbh.exe 39 PID 2480 wrote to memory of 1604 2480 2200286.exe 40 PID 2480 wrote to memory of 1604 2480 2200286.exe 40 PID 2480 wrote to memory of 1604 2480 2200286.exe 40 PID 2480 wrote to memory of 1604 2480 2200286.exe 40 PID 1604 wrote to memory of 108 1604 8606646.exe 41 PID 1604 wrote to memory of 108 1604 8606646.exe 41 PID 1604 wrote to memory of 108 1604 8606646.exe 41 PID 1604 wrote to memory of 108 1604 8606646.exe 41 PID 108 wrote to memory of 1652 108 82068.exe 42 PID 108 wrote to memory of 1652 108 82068.exe 42 PID 108 wrote to memory of 1652 108 82068.exe 42 PID 108 wrote to memory of 1652 108 82068.exe 42 PID 1652 wrote to memory of 2040 1652 20420.exe 43 PID 1652 wrote to memory of 2040 1652 20420.exe 43 PID 1652 wrote to memory of 2040 1652 20420.exe 43 PID 1652 wrote to memory of 2040 1652 20420.exe 43 PID 2040 wrote to memory of 2872 2040 04606.exe 44 PID 2040 wrote to memory of 2872 2040 04606.exe 44 PID 2040 wrote to memory of 2872 2040 04606.exe 44 PID 2040 wrote to memory of 2872 2040 04606.exe 44 PID 2872 wrote to memory of 1768 2872 268408.exe 45 PID 2872 wrote to memory of 1768 2872 268408.exe 45 PID 2872 wrote to memory of 1768 2872 268408.exe 45 PID 2872 wrote to memory of 1768 2872 268408.exe 45 PID 1768 wrote to memory of 788 1768 48680.exe 46 PID 1768 wrote to memory of 788 1768 48680.exe 46 PID 1768 wrote to memory of 788 1768 48680.exe 46 PID 1768 wrote to memory of 788 1768 48680.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e079399b2592aea9229a2b7835c3f10N.exe"C:\Users\Admin\AppData\Local\Temp\4e079399b2592aea9229a2b7835c3f10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\8828064.exec:\8828064.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\q64640.exec:\q64640.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\82024.exec:\82024.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\o480624.exec:\o480624.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\8206408.exec:\8206408.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\q66862.exec:\q66862.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\00208.exec:\00208.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\tnbbbh.exec:\tnbbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\2200286.exec:\2200286.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\8606646.exec:\8606646.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\82068.exec:\82068.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\20420.exec:\20420.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\04606.exec:\04606.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\268408.exec:\268408.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\48680.exec:\48680.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\202480.exec:\202480.exe17⤵
- Executes dropped EXE
PID:788 -
\??\c:\602400.exec:\602400.exe18⤵
- Executes dropped EXE
PID:3028 -
\??\c:\82008.exec:\82008.exe19⤵
- Executes dropped EXE
PID:552 -
\??\c:\jdpdp.exec:\jdpdp.exe20⤵
- Executes dropped EXE
PID:1956 -
\??\c:\88246.exec:\88246.exe21⤵
- Executes dropped EXE
PID:1036 -
\??\c:\06206.exec:\06206.exe22⤵
- Executes dropped EXE
PID:2336 -
\??\c:\dpvjd.exec:\dpvjd.exe23⤵
- Executes dropped EXE
PID:280 -
\??\c:\ttthbh.exec:\ttthbh.exe24⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ddvvj.exec:\ddvvj.exe25⤵
- Executes dropped EXE
PID:924 -
\??\c:\86406.exec:\86406.exe26⤵
- Executes dropped EXE
PID:1528 -
\??\c:\486280.exec:\486280.exe27⤵
- Executes dropped EXE
PID:1720 -
\??\c:\00086.exec:\00086.exe28⤵
- Executes dropped EXE
PID:2388 -
\??\c:\868844.exec:\868844.exe29⤵
- Executes dropped EXE
PID:2140 -
\??\c:\08004.exec:\08004.exe30⤵
- Executes dropped EXE
PID:2404 -
\??\c:\82602.exec:\82602.exe31⤵
- Executes dropped EXE
PID:3048 -
\??\c:\3llrfrf.exec:\3llrfrf.exe32⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tthntb.exec:\tthntb.exe33⤵
- Executes dropped EXE
PID:1280 -
\??\c:\040840.exec:\040840.exe34⤵
- Executes dropped EXE
PID:2916 -
\??\c:\llxlrxf.exec:\llxlrxf.exe35⤵
- Executes dropped EXE
PID:1716 -
\??\c:\9xrrxlx.exec:\9xrrxlx.exe36⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jddjp.exec:\jddjp.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\26844.exec:\26844.exe38⤵
- Executes dropped EXE
PID:2808 -
\??\c:\9xllxxl.exec:\9xllxxl.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jpjjp.exec:\jpjjp.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\4266262.exec:\4266262.exe41⤵
- Executes dropped EXE
PID:2024 -
\??\c:\4682844.exec:\4682844.exe42⤵
- Executes dropped EXE
PID:1148 -
\??\c:\btnbhn.exec:\btnbhn.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9hhbbn.exec:\9hhbbn.exe44⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rrllxfx.exec:\rrllxfx.exe45⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rlflrrf.exec:\rlflrrf.exe46⤵
- Executes dropped EXE
PID:2296 -
\??\c:\0800880.exec:\0800880.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\u008620.exec:\u008620.exe48⤵
- Executes dropped EXE
PID:376 -
\??\c:\604800.exec:\604800.exe49⤵
- Executes dropped EXE
PID:1692 -
\??\c:\82062.exec:\82062.exe50⤵
- Executes dropped EXE
PID:1048 -
\??\c:\bnbbbb.exec:\bnbbbb.exe51⤵
- Executes dropped EXE
PID:2852 -
\??\c:\djvdd.exec:\djvdd.exe52⤵
- Executes dropped EXE
PID:632 -
\??\c:\8684068.exec:\8684068.exe53⤵
- Executes dropped EXE
PID:536 -
\??\c:\u048404.exec:\u048404.exe54⤵
- Executes dropped EXE
PID:320 -
\??\c:\4202464.exec:\4202464.exe55⤵
- Executes dropped EXE
PID:2584 -
\??\c:\486262.exec:\486262.exe56⤵
- Executes dropped EXE
PID:1852 -
\??\c:\w82022.exec:\w82022.exe57⤵
- Executes dropped EXE
PID:2524 -
\??\c:\5bnhnn.exec:\5bnhnn.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\k68000.exec:\k68000.exe59⤵
- Executes dropped EXE
PID:448 -
\??\c:\hbhhnn.exec:\hbhhnn.exe60⤵
- Executes dropped EXE
PID:2284 -
\??\c:\g8628.exec:\g8628.exe61⤵
- Executes dropped EXE
PID:828 -
\??\c:\7rfllrl.exec:\7rfllrl.exe62⤵
- Executes dropped EXE
PID:772 -
\??\c:\k40060.exec:\k40060.exe63⤵
- Executes dropped EXE
PID:1072 -
\??\c:\240626.exec:\240626.exe64⤵
- Executes dropped EXE
PID:3044 -
\??\c:\5ffxrfl.exec:\5ffxrfl.exe65⤵
- Executes dropped EXE
PID:288 -
\??\c:\nnbtnt.exec:\nnbtnt.exe66⤵PID:1756
-
\??\c:\hthnnn.exec:\hthnnn.exe67⤵PID:1544
-
\??\c:\1xlffxf.exec:\1xlffxf.exe68⤵PID:3064
-
\??\c:\42884.exec:\42884.exe69⤵PID:2368
-
\??\c:\k68800.exec:\k68800.exe70⤵PID:2688
-
\??\c:\xflxrlf.exec:\xflxrlf.exe71⤵PID:852
-
\??\c:\4068640.exec:\4068640.exe72⤵PID:3048
-
\??\c:\s4044.exec:\s4044.exe73⤵
- System Location Discovery: System Language Discovery
PID:2500 -
\??\c:\2022840.exec:\2022840.exe74⤵PID:2844
-
\??\c:\httnnh.exec:\httnnh.exe75⤵PID:2832
-
\??\c:\48804.exec:\48804.exe76⤵PID:2276
-
\??\c:\20840.exec:\20840.exe77⤵PID:2612
-
\??\c:\fxrlrrf.exec:\fxrlrrf.exe78⤵PID:2640
-
\??\c:\820062.exec:\820062.exe79⤵PID:1916
-
\??\c:\6008484.exec:\6008484.exe80⤵PID:2776
-
\??\c:\4824220.exec:\4824220.exe81⤵PID:2616
-
\??\c:\9vpvd.exec:\9vpvd.exe82⤵PID:2724
-
\??\c:\9dvpv.exec:\9dvpv.exe83⤵PID:2036
-
\??\c:\5rrflfr.exec:\5rrflfr.exe84⤵PID:2964
-
\??\c:\208028.exec:\208028.exe85⤵PID:2944
-
\??\c:\1xxxflx.exec:\1xxxflx.exe86⤵PID:3068
-
\??\c:\480628.exec:\480628.exe87⤵PID:2480
-
\??\c:\3jvdj.exec:\3jvdj.exe88⤵PID:1612
-
\??\c:\0802884.exec:\0802884.exe89⤵PID:1572
-
\??\c:\rfxlrxf.exec:\rfxlrxf.exe90⤵PID:108
-
\??\c:\rllrrxf.exec:\rllrrxf.exe91⤵
- System Location Discovery: System Language Discovery
PID:1364 -
\??\c:\66020.exec:\66020.exe92⤵PID:2864
-
\??\c:\k22800.exec:\k22800.exe93⤵PID:2880
-
\??\c:\82028.exec:\82028.exe94⤵PID:484
-
\??\c:\48684.exec:\48684.exe95⤵PID:356
-
\??\c:\tbbtbn.exec:\tbbtbn.exe96⤵PID:1760
-
\??\c:\tbtnht.exec:\tbtnht.exe97⤵PID:1092
-
\??\c:\26024.exec:\26024.exe98⤵PID:1592
-
\??\c:\8208208.exec:\8208208.exe99⤵PID:1956
-
\??\c:\482866.exec:\482866.exe100⤵PID:2304
-
\??\c:\822806.exec:\822806.exe101⤵PID:2948
-
\??\c:\vpjpv.exec:\vpjpv.exe102⤵PID:1596
-
\??\c:\3tthnn.exec:\3tthnn.exe103⤵PID:1752
-
\??\c:\c866840.exec:\c866840.exe104⤵PID:904
-
\??\c:\826840.exec:\826840.exe105⤵PID:1344
-
\??\c:\tnhhtt.exec:\tnhhtt.exe106⤵PID:2020
-
\??\c:\pdpjj.exec:\pdpjj.exe107⤵PID:2008
-
\??\c:\5vjjv.exec:\5vjjv.exe108⤵PID:2168
-
\??\c:\868680.exec:\868680.exe109⤵PID:776
-
\??\c:\6080284.exec:\6080284.exe110⤵PID:2140
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe111⤵PID:2996
-
\??\c:\0406840.exec:\0406840.exe112⤵PID:1688
-
\??\c:\22424.exec:\22424.exe113⤵PID:2076
-
\??\c:\8862064.exec:\8862064.exe114⤵PID:2836
-
\??\c:\6646882.exec:\6646882.exe115⤵PID:2904
-
\??\c:\jjdpd.exec:\jjdpd.exe116⤵PID:1588
-
\??\c:\5xrxlrf.exec:\5xrxlrf.exe117⤵PID:2928
-
\??\c:\g0228.exec:\g0228.exe118⤵PID:2756
-
\??\c:\jpjjd.exec:\jpjjd.exe119⤵PID:2812
-
\??\c:\7vpvv.exec:\7vpvv.exe120⤵PID:2768
-
\??\c:\44240.exec:\44240.exe121⤵PID:2620
-
\??\c:\046682.exec:\046682.exe122⤵PID:2224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-