Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 12:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe
-
Size
64KB
-
MD5
23babc5fb7485d6f4a539544582ac0a0
-
SHA1
47b4d56548cb50773d284411097776c544c27486
-
SHA256
06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563
-
SHA512
2a680fd0be0ee2b0d766c684847c47fc28bb65d77e52f283c4b2db90ffd2654b351aaaf84f1bf32f849b889c0ba8e43d9abef0d275087adcd236c79aa6fd181b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B1R:ymb3NkkiQ3mdBjFI9cD
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2472-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3004 242224.exe 1432 6262666.exe 1852 bthhnt.exe 3204 4482644.exe 5032 vpjdj.exe 3688 a6842.exe 2768 228822.exe 1036 2424640.exe 3380 628022.exe 1060 pjppp.exe 2148 7rffrrl.exe 2948 hnnnnn.exe 656 60822.exe 3720 46882.exe 872 a8200.exe 1776 vvvvj.exe 2600 hbbttt.exe 3740 hhnhnh.exe 4696 lfxxrrr.exe 452 608822.exe 1220 u022044.exe 4628 886288.exe 1660 a8626.exe 2960 9bhtnn.exe 2224 w20208.exe 3564 5llxrrl.exe 1940 g8884.exe 1604 rrrlfff.exe 4292 4600222.exe 4672 bhnnnb.exe 4948 ppjjj.exe 2780 lrrlxxl.exe 4008 3hbbtt.exe 4032 jddvp.exe 2760 htbntt.exe 1408 i286080.exe 1416 006666.exe 1852 s2482.exe 2320 484822.exe 1116 4482608.exe 3628 002666.exe 688 xxffxxr.exe 3904 042644.exe 5076 vpdvv.exe 1036 s4004.exe 3832 82006.exe 4908 btbhht.exe 2060 hnbttt.exe 4824 lllfrrx.exe 1736 5hbhnn.exe 656 tnbtbb.exe 948 080488.exe 4252 xrlrflx.exe 2732 860222.exe 2364 5nbthh.exe 4328 llxxfrr.exe 3428 rlxfllf.exe 3180 c824202.exe 3224 2022282.exe 452 rxlxxff.exe 2316 jjjjj.exe 2384 rfffxrr.exe 4660 vjvdj.exe 4136 48066.exe -
resource yara_rule behavioral2/memory/2472-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 204002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s4004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o060488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0264642.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4208826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2064082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84888.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 3004 2472 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 89 PID 2472 wrote to memory of 3004 2472 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 89 PID 2472 wrote to memory of 3004 2472 06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe 89 PID 3004 wrote to memory of 1432 3004 242224.exe 90 PID 3004 wrote to memory of 1432 3004 242224.exe 90 PID 3004 wrote to memory of 1432 3004 242224.exe 90 PID 1432 wrote to memory of 1852 1432 6262666.exe 91 PID 1432 wrote to memory of 1852 1432 6262666.exe 91 PID 1432 wrote to memory of 1852 1432 6262666.exe 91 PID 1852 wrote to memory of 3204 1852 bthhnt.exe 92 PID 1852 wrote to memory of 3204 1852 bthhnt.exe 92 PID 1852 wrote to memory of 3204 1852 bthhnt.exe 92 PID 3204 wrote to memory of 5032 3204 4482644.exe 93 PID 3204 wrote to memory of 5032 3204 4482644.exe 93 PID 3204 wrote to memory of 5032 3204 4482644.exe 93 PID 5032 wrote to memory of 3688 5032 vpjdj.exe 94 PID 5032 wrote to memory of 3688 5032 vpjdj.exe 94 PID 5032 wrote to memory of 3688 5032 vpjdj.exe 94 PID 3688 wrote to memory of 2768 3688 a6842.exe 95 PID 3688 wrote to memory of 2768 3688 a6842.exe 95 PID 3688 wrote to memory of 2768 3688 a6842.exe 95 PID 2768 wrote to memory of 1036 2768 228822.exe 96 PID 2768 wrote to memory of 1036 2768 228822.exe 96 PID 2768 wrote to memory of 1036 2768 228822.exe 96 PID 1036 wrote to memory of 3380 1036 2424640.exe 97 PID 1036 wrote to memory of 3380 1036 2424640.exe 97 PID 1036 wrote to memory of 3380 1036 2424640.exe 97 PID 3380 wrote to memory of 1060 3380 628022.exe 98 PID 3380 wrote to memory of 1060 3380 628022.exe 98 PID 3380 wrote to memory of 1060 3380 628022.exe 98 PID 1060 wrote to memory of 2148 1060 pjppp.exe 99 PID 1060 wrote to memory of 2148 1060 pjppp.exe 99 PID 1060 wrote to memory of 2148 1060 pjppp.exe 99 PID 2148 wrote to memory of 2948 2148 7rffrrl.exe 100 PID 2148 wrote to memory of 2948 2148 7rffrrl.exe 100 PID 2148 wrote to memory of 2948 2148 7rffrrl.exe 100 PID 2948 wrote to memory of 656 2948 hnnnnn.exe 101 PID 2948 wrote to memory of 656 2948 hnnnnn.exe 101 PID 2948 wrote to memory of 656 2948 hnnnnn.exe 101 PID 656 wrote to memory of 3720 656 60822.exe 102 PID 656 wrote to memory of 3720 656 60822.exe 102 PID 656 wrote to memory of 3720 656 60822.exe 102 PID 3720 wrote to memory of 872 3720 46882.exe 103 PID 3720 wrote to memory of 872 3720 46882.exe 103 PID 3720 wrote to memory of 872 3720 46882.exe 103 PID 872 wrote to memory of 1776 872 a8200.exe 104 PID 872 wrote to memory of 1776 872 a8200.exe 104 PID 872 wrote to memory of 1776 872 a8200.exe 104 PID 1776 wrote to memory of 2600 1776 vvvvj.exe 105 PID 1776 wrote to memory of 2600 1776 vvvvj.exe 105 PID 1776 wrote to memory of 2600 1776 vvvvj.exe 105 PID 2600 wrote to memory of 3740 2600 hbbttt.exe 106 PID 2600 wrote to memory of 3740 2600 hbbttt.exe 106 PID 2600 wrote to memory of 3740 2600 hbbttt.exe 106 PID 3740 wrote to memory of 4696 3740 hhnhnh.exe 107 PID 3740 wrote to memory of 4696 3740 hhnhnh.exe 107 PID 3740 wrote to memory of 4696 3740 hhnhnh.exe 107 PID 4696 wrote to memory of 452 4696 lfxxrrr.exe 108 PID 4696 wrote to memory of 452 4696 lfxxrrr.exe 108 PID 4696 wrote to memory of 452 4696 lfxxrrr.exe 108 PID 452 wrote to memory of 1220 452 608822.exe 109 PID 452 wrote to memory of 1220 452 608822.exe 109 PID 452 wrote to memory of 1220 452 608822.exe 109 PID 1220 wrote to memory of 4628 1220 u022044.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe"C:\Users\Admin\AppData\Local\Temp\06dafb89c7781bafba0760ef997dae43551e78696e582ffad9d9f1e546b18563N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\242224.exec:\242224.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\6262666.exec:\6262666.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\bthhnt.exec:\bthhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\4482644.exec:\4482644.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\vpjdj.exec:\vpjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\a6842.exec:\a6842.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\228822.exec:\228822.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\2424640.exec:\2424640.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\628022.exec:\628022.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\pjppp.exec:\pjppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\7rffrrl.exec:\7rffrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\hnnnnn.exec:\hnnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\60822.exec:\60822.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\46882.exec:\46882.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\a8200.exec:\a8200.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\vvvvj.exec:\vvvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\hbbttt.exec:\hbbttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\hhnhnh.exec:\hhnhnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\608822.exec:\608822.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\u022044.exec:\u022044.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\886288.exec:\886288.exe23⤵
- Executes dropped EXE
PID:4628 -
\??\c:\a8626.exec:\a8626.exe24⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9bhtnn.exec:\9bhtnn.exe25⤵
- Executes dropped EXE
PID:2960 -
\??\c:\w20208.exec:\w20208.exe26⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5llxrrl.exec:\5llxrrl.exe27⤵
- Executes dropped EXE
PID:3564 -
\??\c:\g8884.exec:\g8884.exe28⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rrrlfff.exec:\rrrlfff.exe29⤵
- Executes dropped EXE
PID:1604 -
\??\c:\4600222.exec:\4600222.exe30⤵
- Executes dropped EXE
PID:4292 -
\??\c:\bhnnnb.exec:\bhnnnb.exe31⤵
- Executes dropped EXE
PID:4672 -
\??\c:\ppjjj.exec:\ppjjj.exe32⤵
- Executes dropped EXE
PID:4948 -
\??\c:\lrrlxxl.exec:\lrrlxxl.exe33⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3hbbtt.exec:\3hbbtt.exe34⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jddvp.exec:\jddvp.exe35⤵
- Executes dropped EXE
PID:4032 -
\??\c:\htbntt.exec:\htbntt.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\i286080.exec:\i286080.exe37⤵
- Executes dropped EXE
PID:1408 -
\??\c:\006666.exec:\006666.exe38⤵
- Executes dropped EXE
PID:1416 -
\??\c:\s2482.exec:\s2482.exe39⤵
- Executes dropped EXE
PID:1852 -
\??\c:\484822.exec:\484822.exe40⤵
- Executes dropped EXE
PID:2320 -
\??\c:\4482608.exec:\4482608.exe41⤵
- Executes dropped EXE
PID:1116 -
\??\c:\002666.exec:\002666.exe42⤵
- Executes dropped EXE
PID:3628 -
\??\c:\xxffxxr.exec:\xxffxxr.exe43⤵
- Executes dropped EXE
PID:688 -
\??\c:\042644.exec:\042644.exe44⤵
- Executes dropped EXE
PID:3904 -
\??\c:\vpdvv.exec:\vpdvv.exe45⤵
- Executes dropped EXE
PID:5076 -
\??\c:\s4004.exec:\s4004.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1036 -
\??\c:\82006.exec:\82006.exe47⤵
- Executes dropped EXE
PID:3832 -
\??\c:\btbhht.exec:\btbhht.exe48⤵
- Executes dropped EXE
PID:4908 -
\??\c:\hnbttt.exec:\hnbttt.exe49⤵
- Executes dropped EXE
PID:2060 -
\??\c:\lllfrrx.exec:\lllfrrx.exe50⤵
- Executes dropped EXE
PID:4824 -
\??\c:\5hbhnn.exec:\5hbhnn.exe51⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tnbtbb.exec:\tnbtbb.exe52⤵
- Executes dropped EXE
PID:656 -
\??\c:\080488.exec:\080488.exe53⤵
- Executes dropped EXE
PID:948 -
\??\c:\xrlrflx.exec:\xrlrflx.exe54⤵
- Executes dropped EXE
PID:4252 -
\??\c:\860222.exec:\860222.exe55⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5nbthh.exec:\5nbthh.exe56⤵
- Executes dropped EXE
PID:2364 -
\??\c:\llxxfrr.exec:\llxxfrr.exe57⤵
- Executes dropped EXE
PID:4328 -
\??\c:\rlxfllf.exec:\rlxfllf.exe58⤵
- Executes dropped EXE
PID:3428 -
\??\c:\c824202.exec:\c824202.exe59⤵
- Executes dropped EXE
PID:3180 -
\??\c:\2022282.exec:\2022282.exe60⤵
- Executes dropped EXE
PID:3224 -
\??\c:\rxlxxff.exec:\rxlxxff.exe61⤵
- Executes dropped EXE
PID:452 -
\??\c:\jjjjj.exec:\jjjjj.exe62⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rfffxrr.exec:\rfffxrr.exe63⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vjvdj.exec:\vjvdj.exe64⤵
- Executes dropped EXE
PID:4660 -
\??\c:\48066.exec:\48066.exe65⤵
- Executes dropped EXE
PID:4136 -
\??\c:\xrlxlfr.exec:\xrlxlfr.exe66⤵PID:4100
-
\??\c:\2660826.exec:\2660826.exe67⤵PID:1960
-
\??\c:\88048.exec:\88048.exe68⤵PID:1248
-
\??\c:\vppjv.exec:\vppjv.exe69⤵PID:3052
-
\??\c:\jddpd.exec:\jddpd.exe70⤵PID:2840
-
\??\c:\a8680.exec:\a8680.exe71⤵PID:952
-
\??\c:\460248.exec:\460248.exe72⤵PID:4280
-
\??\c:\0426066.exec:\0426066.exe73⤵PID:4680
-
\??\c:\3ttthh.exec:\3ttthh.exe74⤵PID:4948
-
\??\c:\jdvjp.exec:\jdvjp.exe75⤵PID:3060
-
\??\c:\bhbthb.exec:\bhbthb.exe76⤵PID:968
-
\??\c:\1rrlfxr.exec:\1rrlfxr.exe77⤵PID:848
-
\??\c:\7ntntt.exec:\7ntntt.exe78⤵PID:3956
-
\??\c:\dvvpj.exec:\dvvpj.exe79⤵PID:3120
-
\??\c:\frrlxrl.exec:\frrlxrl.exe80⤵
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\llrrlll.exec:\llrrlll.exe81⤵PID:2896
-
\??\c:\6848266.exec:\6848266.exe82⤵PID:2036
-
\??\c:\22888.exec:\22888.exe83⤵PID:1536
-
\??\c:\o466004.exec:\o466004.exe84⤵PID:3524
-
\??\c:\080048.exec:\080048.exe85⤵PID:4888
-
\??\c:\06222.exec:\06222.exe86⤵PID:2312
-
\??\c:\7fxrxxr.exec:\7fxrxxr.exe87⤵PID:2828
-
\??\c:\i806622.exec:\i806622.exe88⤵PID:5076
-
\??\c:\dvpdj.exec:\dvpdj.exe89⤵PID:2956
-
\??\c:\7rlfrrf.exec:\7rlfrrf.exe90⤵PID:1120
-
\??\c:\1pdvp.exec:\1pdvp.exe91⤵PID:3420
-
\??\c:\44048.exec:\44048.exe92⤵PID:1936
-
\??\c:\k66222.exec:\k66222.exe93⤵PID:4976
-
\??\c:\062646.exec:\062646.exe94⤵PID:1848
-
\??\c:\jvdvj.exec:\jvdvj.exe95⤵PID:704
-
\??\c:\800040.exec:\800040.exe96⤵PID:948
-
\??\c:\7dvdp.exec:\7dvdp.exe97⤵PID:3876
-
\??\c:\2026448.exec:\2026448.exe98⤵PID:2716
-
\??\c:\llrrllr.exec:\llrrllr.exe99⤵PID:392
-
\??\c:\866408.exec:\866408.exe100⤵PID:4172
-
\??\c:\g4008.exec:\g4008.exe101⤵PID:4192
-
\??\c:\2848608.exec:\2848608.exe102⤵PID:4696
-
\??\c:\1xxrllf.exec:\1xxrllf.exe103⤵PID:868
-
\??\c:\jdpjp.exec:\jdpjp.exe104⤵PID:1220
-
\??\c:\rxrlfxx.exec:\rxrlfxx.exe105⤵PID:3944
-
\??\c:\rlrxrxx.exec:\rlrxrxx.exe106⤵PID:3920
-
\??\c:\pjpjd.exec:\pjpjd.exe107⤵PID:472
-
\??\c:\644828.exec:\644828.exe108⤵PID:4304
-
\??\c:\408604.exec:\408604.exe109⤵PID:820
-
\??\c:\4806466.exec:\4806466.exe110⤵PID:4608
-
\??\c:\0444288.exec:\0444288.exe111⤵PID:232
-
\??\c:\0622600.exec:\0622600.exe112⤵PID:1940
-
\??\c:\ttbtnn.exec:\ttbtnn.exe113⤵PID:2724
-
\??\c:\pppdd.exec:\pppdd.exe114⤵PID:5064
-
\??\c:\hnthbh.exec:\hnthbh.exe115⤵PID:2104
-
\??\c:\8442040.exec:\8442040.exe116⤵PID:4404
-
\??\c:\vvjvj.exec:\vvjvj.exe117⤵PID:184
-
\??\c:\frlxfxf.exec:\frlxfxf.exe118⤵PID:2780
-
\??\c:\46826.exec:\46826.exe119⤵PID:4848
-
\??\c:\flfrfxx.exec:\flfrfxx.exe120⤵PID:3232
-
\??\c:\1ffxxrx.exec:\1ffxxrx.exe121⤵PID:1596
-
\??\c:\60406.exec:\60406.exe122⤵PID:3940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-