Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 22:02
Static task
static1
Behavioral task
behavioral1
Sample
67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe
Resource
win7-20240708-en
General
-
Target
67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe
-
Size
76KB
-
MD5
347c97934e66190c88426f149b2f9250
-
SHA1
a44fd211f751951ec9f1596f00f8b59cf691e9ba
-
SHA256
67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893
-
SHA512
0a57a9077bd78f1f4069c49384442521efb6117f45e85ed2d3c18b0269a007cf3c69d35328b9c3406434fb89ea459bed5f6d8595b6e754df7e52d9f481ecd117
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmP76:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHT
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2248-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4796 m8840.exe 2692 c448604.exe 664 xfrrrxx.exe 4928 5jvpd.exe 688 ppjjd.exe 3560 nbtbnh.exe 3484 lrxffxl.exe 452 7vvvv.exe 640 c204000.exe 4228 jjjdp.exe 4260 426048.exe 2432 e86404.exe 2888 dvvpj.exe 4528 vvpjd.exe 4828 rxllffl.exe 4444 68426.exe 3064 bbthtn.exe 1964 g0604.exe 2592 vpdpv.exe 2804 222680.exe 436 2048440.exe 1428 g4422.exe 4112 pjvvj.exe 4576 668066.exe 1412 xlrllff.exe 2228 3pvdp.exe 1608 xlffxrr.exe 2396 i848800.exe 5004 446600.exe 4852 9pjdp.exe 4300 xlfxxff.exe 4524 886286.exe 4928 04060.exe 1144 482808.exe 4404 nbhtbt.exe 3560 g8080.exe 4776 e24866.exe 888 tntnbt.exe 940 dpvpj.exe 3252 64228.exe 2336 0848666.exe 1044 k66004.exe 1932 280024.exe 1860 864440.exe 3360 00228.exe 4460 242226.exe 4008 flfllfx.exe 3632 fxfxrff.exe 1356 9nnnhh.exe 1416 6088848.exe 3536 ttnnhh.exe 3284 4486802.exe 748 64860.exe 3288 hhnnnt.exe 4988 224422.exe 2792 2660404.exe 4536 xfllffx.exe 4564 flxlfxl.exe 456 vdjdv.exe 3936 s0882.exe 1540 nhtnhh.exe 2996 4604260.exe 4644 3hbthh.exe 8 280048.exe -
resource yara_rule behavioral2/memory/2248-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2082262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 440006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k22200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s2488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 4796 2248 67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe 90 PID 2248 wrote to memory of 4796 2248 67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe 90 PID 2248 wrote to memory of 4796 2248 67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe 90 PID 4796 wrote to memory of 2692 4796 m8840.exe 91 PID 4796 wrote to memory of 2692 4796 m8840.exe 91 PID 4796 wrote to memory of 2692 4796 m8840.exe 91 PID 2692 wrote to memory of 664 2692 c448604.exe 92 PID 2692 wrote to memory of 664 2692 c448604.exe 92 PID 2692 wrote to memory of 664 2692 c448604.exe 92 PID 664 wrote to memory of 4928 664 xfrrrxx.exe 93 PID 664 wrote to memory of 4928 664 xfrrrxx.exe 93 PID 664 wrote to memory of 4928 664 xfrrrxx.exe 93 PID 4928 wrote to memory of 688 4928 5jvpd.exe 94 PID 4928 wrote to memory of 688 4928 5jvpd.exe 94 PID 4928 wrote to memory of 688 4928 5jvpd.exe 94 PID 688 wrote to memory of 3560 688 ppjjd.exe 95 PID 688 wrote to memory of 3560 688 ppjjd.exe 95 PID 688 wrote to memory of 3560 688 ppjjd.exe 95 PID 3560 wrote to memory of 3484 3560 nbtbnh.exe 96 PID 3560 wrote to memory of 3484 3560 nbtbnh.exe 96 PID 3560 wrote to memory of 3484 3560 nbtbnh.exe 96 PID 3484 wrote to memory of 452 3484 lrxffxl.exe 97 PID 3484 wrote to memory of 452 3484 lrxffxl.exe 97 PID 3484 wrote to memory of 452 3484 lrxffxl.exe 97 PID 452 wrote to memory of 640 452 7vvvv.exe 98 PID 452 wrote to memory of 640 452 7vvvv.exe 98 PID 452 wrote to memory of 640 452 7vvvv.exe 98 PID 640 wrote to memory of 4228 640 c204000.exe 99 PID 640 wrote to memory of 4228 640 c204000.exe 99 PID 640 wrote to memory of 4228 640 c204000.exe 99 PID 4228 wrote to memory of 4260 4228 jjjdp.exe 101 PID 4228 wrote to memory of 4260 4228 jjjdp.exe 101 PID 4228 wrote to memory of 4260 4228 jjjdp.exe 101 PID 4260 wrote to memory of 2432 4260 426048.exe 102 PID 4260 wrote to memory of 2432 4260 426048.exe 102 PID 4260 wrote to memory of 2432 4260 426048.exe 102 PID 2432 wrote to memory of 2888 2432 e86404.exe 103 PID 2432 wrote to memory of 2888 2432 e86404.exe 103 PID 2432 wrote to memory of 2888 2432 e86404.exe 103 PID 2888 wrote to memory of 4528 2888 dvvpj.exe 104 PID 2888 wrote to memory of 4528 2888 dvvpj.exe 104 PID 2888 wrote to memory of 4528 2888 dvvpj.exe 104 PID 4528 wrote to memory of 4828 4528 vvpjd.exe 105 PID 4528 wrote to memory of 4828 4528 vvpjd.exe 105 PID 4528 wrote to memory of 4828 4528 vvpjd.exe 105 PID 4828 wrote to memory of 4444 4828 rxllffl.exe 106 PID 4828 wrote to memory of 4444 4828 rxllffl.exe 106 PID 4828 wrote to memory of 4444 4828 rxllffl.exe 106 PID 4444 wrote to memory of 3064 4444 68426.exe 107 PID 4444 wrote to memory of 3064 4444 68426.exe 107 PID 4444 wrote to memory of 3064 4444 68426.exe 107 PID 3064 wrote to memory of 1964 3064 bbthtn.exe 108 PID 3064 wrote to memory of 1964 3064 bbthtn.exe 108 PID 3064 wrote to memory of 1964 3064 bbthtn.exe 108 PID 1964 wrote to memory of 2592 1964 g0604.exe 109 PID 1964 wrote to memory of 2592 1964 g0604.exe 109 PID 1964 wrote to memory of 2592 1964 g0604.exe 109 PID 2592 wrote to memory of 2804 2592 vpdpv.exe 110 PID 2592 wrote to memory of 2804 2592 vpdpv.exe 110 PID 2592 wrote to memory of 2804 2592 vpdpv.exe 110 PID 2804 wrote to memory of 436 2804 222680.exe 111 PID 2804 wrote to memory of 436 2804 222680.exe 111 PID 2804 wrote to memory of 436 2804 222680.exe 111 PID 436 wrote to memory of 1428 436 2048440.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe"C:\Users\Admin\AppData\Local\Temp\67ff51d99d16261ebbccef74f7f8eaa19e31631e5cdd391bd8d1f0fabfae5893.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\m8840.exec:\m8840.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\c448604.exec:\c448604.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xfrrrxx.exec:\xfrrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\5jvpd.exec:\5jvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\ppjjd.exec:\ppjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\nbtbnh.exec:\nbtbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\lrxffxl.exec:\lrxffxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\7vvvv.exec:\7vvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\c204000.exec:\c204000.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\jjjdp.exec:\jjjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\426048.exec:\426048.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\e86404.exec:\e86404.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\dvvpj.exec:\dvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vvpjd.exec:\vvpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\rxllffl.exec:\rxllffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\68426.exec:\68426.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\bbthtn.exec:\bbthtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\g0604.exec:\g0604.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\vpdpv.exec:\vpdpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\222680.exec:\222680.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\2048440.exec:\2048440.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\g4422.exec:\g4422.exe23⤵
- Executes dropped EXE
PID:1428 -
\??\c:\pjvvj.exec:\pjvvj.exe24⤵
- Executes dropped EXE
PID:4112 -
\??\c:\668066.exec:\668066.exe25⤵
- Executes dropped EXE
PID:4576 -
\??\c:\xlrllff.exec:\xlrllff.exe26⤵
- Executes dropped EXE
PID:1412 -
\??\c:\3pvdp.exec:\3pvdp.exe27⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xlffxrr.exec:\xlffxrr.exe28⤵
- Executes dropped EXE
PID:1608 -
\??\c:\i848800.exec:\i848800.exe29⤵
- Executes dropped EXE
PID:2396 -
\??\c:\446600.exec:\446600.exe30⤵
- Executes dropped EXE
PID:5004 -
\??\c:\9pjdp.exec:\9pjdp.exe31⤵
- Executes dropped EXE
PID:4852 -
\??\c:\xlfxxff.exec:\xlfxxff.exe32⤵
- Executes dropped EXE
PID:4300 -
\??\c:\886286.exec:\886286.exe33⤵
- Executes dropped EXE
PID:4524 -
\??\c:\04060.exec:\04060.exe34⤵
- Executes dropped EXE
PID:4928 -
\??\c:\482808.exec:\482808.exe35⤵
- Executes dropped EXE
PID:1144 -
\??\c:\nbhtbt.exec:\nbhtbt.exe36⤵
- Executes dropped EXE
PID:4404 -
\??\c:\g8080.exec:\g8080.exe37⤵
- Executes dropped EXE
PID:3560 -
\??\c:\e24866.exec:\e24866.exe38⤵
- Executes dropped EXE
PID:4776 -
\??\c:\tntnbt.exec:\tntnbt.exe39⤵
- Executes dropped EXE
PID:888 -
\??\c:\dpvpj.exec:\dpvpj.exe40⤵
- Executes dropped EXE
PID:940 -
\??\c:\64228.exec:\64228.exe41⤵
- Executes dropped EXE
PID:3252 -
\??\c:\0848666.exec:\0848666.exe42⤵
- Executes dropped EXE
PID:2336 -
\??\c:\k66004.exec:\k66004.exe43⤵
- Executes dropped EXE
PID:1044 -
\??\c:\280024.exec:\280024.exe44⤵
- Executes dropped EXE
PID:1932 -
\??\c:\864440.exec:\864440.exe45⤵
- Executes dropped EXE
PID:1860 -
\??\c:\00228.exec:\00228.exe46⤵
- Executes dropped EXE
PID:3360 -
\??\c:\242226.exec:\242226.exe47⤵
- Executes dropped EXE
PID:4460 -
\??\c:\flfllfx.exec:\flfllfx.exe48⤵
- Executes dropped EXE
PID:4008 -
\??\c:\fxfxrff.exec:\fxfxrff.exe49⤵
- Executes dropped EXE
PID:3632 -
\??\c:\9nnnhh.exec:\9nnnhh.exe50⤵
- Executes dropped EXE
PID:1356 -
\??\c:\6088848.exec:\6088848.exe51⤵
- Executes dropped EXE
PID:1416 -
\??\c:\ttnnhh.exec:\ttnnhh.exe52⤵
- Executes dropped EXE
PID:3536 -
\??\c:\4486802.exec:\4486802.exe53⤵
- Executes dropped EXE
PID:3284 -
\??\c:\64860.exec:\64860.exe54⤵
- Executes dropped EXE
PID:748 -
\??\c:\hhnnnt.exec:\hhnnnt.exe55⤵
- Executes dropped EXE
PID:3288 -
\??\c:\224422.exec:\224422.exe56⤵
- Executes dropped EXE
PID:4988 -
\??\c:\2660404.exec:\2660404.exe57⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xfllffx.exec:\xfllffx.exe58⤵
- Executes dropped EXE
PID:4536 -
\??\c:\flxlfxl.exec:\flxlfxl.exe59⤵
- Executes dropped EXE
PID:4564 -
\??\c:\vdjdv.exec:\vdjdv.exe60⤵
- Executes dropped EXE
PID:456 -
\??\c:\9vvpd.exec:\9vvpd.exe61⤵PID:2168
-
\??\c:\s0882.exec:\s0882.exe62⤵
- Executes dropped EXE
PID:3936 -
\??\c:\nhtnhh.exec:\nhtnhh.exe63⤵
- Executes dropped EXE
PID:1540 -
\??\c:\4604260.exec:\4604260.exe64⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3hbthh.exec:\3hbthh.exe65⤵
- Executes dropped EXE
PID:4644 -
\??\c:\280048.exec:\280048.exe66⤵
- Executes dropped EXE
PID:8 -
\??\c:\tbhhbb.exec:\tbhhbb.exe67⤵
- System Location Discovery: System Language Discovery
PID:2188 -
\??\c:\628200.exec:\628200.exe68⤵PID:4060
-
\??\c:\ffxlxlf.exec:\ffxlxlf.exe69⤵PID:1992
-
\??\c:\6488226.exec:\6488226.exe70⤵PID:1924
-
\??\c:\xlxxflr.exec:\xlxxflr.exe71⤵PID:1288
-
\??\c:\vvpdd.exec:\vvpdd.exe72⤵PID:2276
-
\??\c:\7btnhb.exec:\7btnhb.exe73⤵PID:1248
-
\??\c:\4226042.exec:\4226042.exe74⤵PID:380
-
\??\c:\bbhhbb.exec:\bbhhbb.exe75⤵PID:4588
-
\??\c:\3tnnhh.exec:\3tnnhh.exe76⤵PID:1676
-
\??\c:\jdvpd.exec:\jdvpd.exe77⤵PID:4772
-
\??\c:\0022046.exec:\0022046.exe78⤵PID:4260
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe79⤵PID:2696
-
\??\c:\6846240.exec:\6846240.exe80⤵PID:1932
-
\??\c:\a2624.exec:\a2624.exe81⤵PID:4528
-
\??\c:\428288.exec:\428288.exe82⤵PID:3304
-
\??\c:\nhbhbn.exec:\nhbhbn.exe83⤵PID:4444
-
\??\c:\82028.exec:\82028.exe84⤵PID:3064
-
\??\c:\8244604.exec:\8244604.exe85⤵PID:2540
-
\??\c:\08826.exec:\08826.exe86⤵PID:1964
-
\??\c:\s2488.exec:\s2488.exe87⤵
- System Location Discovery: System Language Discovery
PID:4744 -
\??\c:\vjjdd.exec:\vjjdd.exe88⤵PID:2804
-
\??\c:\9lrfxxx.exec:\9lrfxxx.exe89⤵PID:4732
-
\??\c:\28660.exec:\28660.exe90⤵PID:4548
-
\??\c:\9tbnnh.exec:\9tbnnh.exe91⤵PID:2680
-
\??\c:\2222666.exec:\2222666.exe92⤵PID:4988
-
\??\c:\9xfxxrr.exec:\9xfxxrr.exe93⤵PID:4112
-
\??\c:\86262.exec:\86262.exe94⤵PID:1412
-
\??\c:\tttnnh.exec:\tttnnh.exe95⤵PID:4396
-
\??\c:\tnttbh.exec:\tnttbh.exe96⤵PID:4680
-
\??\c:\xxfxffr.exec:\xxfxffr.exe97⤵PID:3936
-
\??\c:\7ttnbt.exec:\7ttnbt.exe98⤵PID:5060
-
\??\c:\jddvd.exec:\jddvd.exe99⤵PID:2992
-
\??\c:\480066.exec:\480066.exe100⤵PID:1520
-
\??\c:\48048.exec:\48048.exe101⤵PID:4024
-
\??\c:\u482226.exec:\u482226.exe102⤵PID:3620
-
\??\c:\xxxrrxx.exec:\xxxrrxx.exe103⤵PID:2732
-
\??\c:\2282020.exec:\2282020.exe104⤵PID:2088
-
\??\c:\3xxxxxx.exec:\3xxxxxx.exe105⤵PID:1288
-
\??\c:\428828.exec:\428828.exe106⤵PID:2276
-
\??\c:\6228420.exec:\6228420.exe107⤵PID:2860
-
\??\c:\3bhhhh.exec:\3bhhhh.exe108⤵
- System Location Discovery: System Language Discovery
PID:4588 -
\??\c:\7jppp.exec:\7jppp.exe109⤵PID:3984
-
\??\c:\m4222.exec:\m4222.exe110⤵PID:4772
-
\??\c:\rflflxl.exec:\rflflxl.exe111⤵PID:2316
-
\??\c:\062662.exec:\062662.exe112⤵PID:1564
-
\??\c:\640000.exec:\640000.exe113⤵PID:3360
-
\??\c:\djdjv.exec:\djdjv.exe114⤵PID:4460
-
\??\c:\fxllfll.exec:\fxllfll.exe115⤵PID:3304
-
\??\c:\w40000.exec:\w40000.exe116⤵PID:3632
-
\??\c:\jjpjv.exec:\jjpjv.exe117⤵PID:5076
-
\??\c:\nhhhbh.exec:\nhhhbh.exe118⤵PID:1416
-
\??\c:\pdvdd.exec:\pdvdd.exe119⤵PID:3536
-
\??\c:\2488884.exec:\2488884.exe120⤵PID:4744
-
\??\c:\0662666.exec:\0662666.exe121⤵PID:2804
-
\??\c:\e46884.exec:\e46884.exe122⤵PID:4732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-