Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 03:01
Static task
static1
Behavioral task
behavioral1
Sample
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe
Resource
win7-20241010-en
General
-
Target
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe
-
Size
93KB
-
MD5
789612a58fd4b8deaca1dcd85daa895d
-
SHA1
2c227d9ad452da6a3e763e2ab15908f9bf545031
-
SHA256
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85
-
SHA512
888e6de09c4f9ea6e52829ddc20ef6a2530386820e4613cbe377217a004e6ca3ba3818a5b1aaac1ccbbb5f994eb32720e85d1c35cf3a9cb8da92bbede1951a79
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp99zx/A0UtgK:ymb3NkkiQ3mdBjFo73tvn+Yp99zDut
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2372-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2712 nhnntt.exe 1488 ddvjj.exe 300 rflxxlx.exe 2916 pjvdd.exe 2776 248240.exe 3020 684462.exe 2880 xfffrlr.exe 2744 nhnhnh.exe 2660 jvddj.exe 2688 86484.exe 888 9frfrrr.exe 2076 46802.exe 1584 6200824.exe 1164 7thtbh.exe 2948 024026.exe 1776 u288488.exe 1964 ddpjj.exe 2444 xrffllr.exe 1916 08462.exe 324 dvjjj.exe 620 9rxxxfr.exe 1080 284022.exe 1144 fxfllxr.exe 984 tbbhhb.exe 780 xfffflf.exe 2148 428864.exe 3016 pdjjj.exe 1044 hbhhhb.exe 2400 0844006.exe 2316 628466.exe 1564 20042.exe 2352 9tbttn.exe 2364 42464.exe 1952 08822.exe 1608 9bhbbb.exe 2736 6844006.exe 2836 q84626.exe 2864 xrxrlfl.exe 2976 dpddj.exe 2888 62824.exe 2880 2208680.exe 2624 jvddd.exe 2644 nbnhtn.exe 2680 4282660.exe 2292 8404242.exe 2108 08646.exe 2972 7frxxlr.exe 1552 82680.exe 1584 bnbbnh.exe 2960 htbttt.exe 1792 2622228.exe 1576 frxxlrr.exe 2156 hthnhh.exe 2488 vvvpj.exe 2376 nhbhnb.exe 2552 m0402.exe 320 60286.exe 2424 rffflxx.exe 2136 080608.exe 912 xflxxlf.exe 1996 7jdjd.exe 1852 20628.exe 1580 btnntb.exe 2504 00886.exe -
resource yara_rule behavioral1/memory/2372-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-312-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 462888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04842.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 086628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s0246.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2712 2372 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 30 PID 2372 wrote to memory of 2712 2372 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 30 PID 2372 wrote to memory of 2712 2372 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 30 PID 2372 wrote to memory of 2712 2372 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 30 PID 2712 wrote to memory of 1488 2712 nhnntt.exe 31 PID 2712 wrote to memory of 1488 2712 nhnntt.exe 31 PID 2712 wrote to memory of 1488 2712 nhnntt.exe 31 PID 2712 wrote to memory of 1488 2712 nhnntt.exe 31 PID 1488 wrote to memory of 300 1488 ddvjj.exe 32 PID 1488 wrote to memory of 300 1488 ddvjj.exe 32 PID 1488 wrote to memory of 300 1488 ddvjj.exe 32 PID 1488 wrote to memory of 300 1488 ddvjj.exe 32 PID 300 wrote to memory of 2916 300 rflxxlx.exe 33 PID 300 wrote to memory of 2916 300 rflxxlx.exe 33 PID 300 wrote to memory of 2916 300 rflxxlx.exe 33 PID 300 wrote to memory of 2916 300 rflxxlx.exe 33 PID 2916 wrote to memory of 2776 2916 pjvdd.exe 34 PID 2916 wrote to memory of 2776 2916 pjvdd.exe 34 PID 2916 wrote to memory of 2776 2916 pjvdd.exe 34 PID 2916 wrote to memory of 2776 2916 pjvdd.exe 34 PID 2776 wrote to memory of 3020 2776 248240.exe 35 PID 2776 wrote to memory of 3020 2776 248240.exe 35 PID 2776 wrote to memory of 3020 2776 248240.exe 35 PID 2776 wrote to memory of 3020 2776 248240.exe 35 PID 3020 wrote to memory of 2880 3020 684462.exe 36 PID 3020 wrote to memory of 2880 3020 684462.exe 36 PID 3020 wrote to memory of 2880 3020 684462.exe 36 PID 3020 wrote to memory of 2880 3020 684462.exe 36 PID 2880 wrote to memory of 2744 2880 xfffrlr.exe 37 PID 2880 wrote to memory of 2744 2880 xfffrlr.exe 37 PID 2880 wrote to memory of 2744 2880 xfffrlr.exe 37 PID 2880 wrote to memory of 2744 2880 xfffrlr.exe 37 PID 2744 wrote to memory of 2660 2744 nhnhnh.exe 38 PID 2744 wrote to memory of 2660 2744 nhnhnh.exe 38 PID 2744 wrote to memory of 2660 2744 nhnhnh.exe 38 PID 2744 wrote to memory of 2660 2744 nhnhnh.exe 38 PID 2660 wrote to memory of 2688 2660 jvddj.exe 39 PID 2660 wrote to memory of 2688 2660 jvddj.exe 39 PID 2660 wrote to memory of 2688 2660 jvddj.exe 39 PID 2660 wrote to memory of 2688 2660 jvddj.exe 39 PID 2688 wrote to memory of 888 2688 86484.exe 40 PID 2688 wrote to memory of 888 2688 86484.exe 40 PID 2688 wrote to memory of 888 2688 86484.exe 40 PID 2688 wrote to memory of 888 2688 86484.exe 40 PID 888 wrote to memory of 2076 888 9frfrrr.exe 41 PID 888 wrote to memory of 2076 888 9frfrrr.exe 41 PID 888 wrote to memory of 2076 888 9frfrrr.exe 41 PID 888 wrote to memory of 2076 888 9frfrrr.exe 41 PID 2076 wrote to memory of 1584 2076 46802.exe 42 PID 2076 wrote to memory of 1584 2076 46802.exe 42 PID 2076 wrote to memory of 1584 2076 46802.exe 42 PID 2076 wrote to memory of 1584 2076 46802.exe 42 PID 1584 wrote to memory of 1164 1584 6200824.exe 43 PID 1584 wrote to memory of 1164 1584 6200824.exe 43 PID 1584 wrote to memory of 1164 1584 6200824.exe 43 PID 1584 wrote to memory of 1164 1584 6200824.exe 43 PID 1164 wrote to memory of 2948 1164 7thtbh.exe 44 PID 1164 wrote to memory of 2948 1164 7thtbh.exe 44 PID 1164 wrote to memory of 2948 1164 7thtbh.exe 44 PID 1164 wrote to memory of 2948 1164 7thtbh.exe 44 PID 2948 wrote to memory of 1776 2948 024026.exe 45 PID 2948 wrote to memory of 1776 2948 024026.exe 45 PID 2948 wrote to memory of 1776 2948 024026.exe 45 PID 2948 wrote to memory of 1776 2948 024026.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe"C:\Users\Admin\AppData\Local\Temp\874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\nhnntt.exec:\nhnntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ddvjj.exec:\ddvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\rflxxlx.exec:\rflxxlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\pjvdd.exec:\pjvdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\248240.exec:\248240.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\684462.exec:\684462.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xfffrlr.exec:\xfffrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\nhnhnh.exec:\nhnhnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jvddj.exec:\jvddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\86484.exec:\86484.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\9frfrrr.exec:\9frfrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\46802.exec:\46802.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\6200824.exec:\6200824.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\7thtbh.exec:\7thtbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\024026.exec:\024026.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\u288488.exec:\u288488.exe17⤵
- Executes dropped EXE
PID:1776 -
\??\c:\ddpjj.exec:\ddpjj.exe18⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xrffllr.exec:\xrffllr.exe19⤵
- Executes dropped EXE
PID:2444 -
\??\c:\08462.exec:\08462.exe20⤵
- Executes dropped EXE
PID:1916 -
\??\c:\dvjjj.exec:\dvjjj.exe21⤵
- Executes dropped EXE
PID:324 -
\??\c:\9rxxxfr.exec:\9rxxxfr.exe22⤵
- Executes dropped EXE
PID:620 -
\??\c:\284022.exec:\284022.exe23⤵
- Executes dropped EXE
PID:1080 -
\??\c:\fxfllxr.exec:\fxfllxr.exe24⤵
- Executes dropped EXE
PID:1144 -
\??\c:\tbbhhb.exec:\tbbhhb.exe25⤵
- Executes dropped EXE
PID:984 -
\??\c:\xfffflf.exec:\xfffflf.exe26⤵
- Executes dropped EXE
PID:780 -
\??\c:\428864.exec:\428864.exe27⤵
- Executes dropped EXE
PID:2148 -
\??\c:\pdjjj.exec:\pdjjj.exe28⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hbhhhb.exec:\hbhhhb.exe29⤵
- Executes dropped EXE
PID:1044 -
\??\c:\0844006.exec:\0844006.exe30⤵
- Executes dropped EXE
PID:2400 -
\??\c:\628466.exec:\628466.exe31⤵
- Executes dropped EXE
PID:2316 -
\??\c:\20042.exec:\20042.exe32⤵
- Executes dropped EXE
PID:1564 -
\??\c:\9tbttn.exec:\9tbttn.exe33⤵
- Executes dropped EXE
PID:2352 -
\??\c:\42464.exec:\42464.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\08822.exec:\08822.exe35⤵
- Executes dropped EXE
PID:1952 -
\??\c:\9bhbbb.exec:\9bhbbb.exe36⤵
- Executes dropped EXE
PID:1608 -
\??\c:\6844006.exec:\6844006.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\q84626.exec:\q84626.exe38⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xrxrlfl.exec:\xrxrlfl.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\dpddj.exec:\dpddj.exe40⤵
- Executes dropped EXE
PID:2976 -
\??\c:\62824.exec:\62824.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\2208680.exec:\2208680.exe42⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jvddd.exec:\jvddd.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbnhtn.exec:\nbnhtn.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\4282660.exec:\4282660.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\8404242.exec:\8404242.exe46⤵
- Executes dropped EXE
PID:2292 -
\??\c:\08646.exec:\08646.exe47⤵
- Executes dropped EXE
PID:2108 -
\??\c:\7frxxlr.exec:\7frxxlr.exe48⤵
- Executes dropped EXE
PID:2972 -
\??\c:\82680.exec:\82680.exe49⤵
- Executes dropped EXE
PID:1552 -
\??\c:\bnbbnh.exec:\bnbbnh.exe50⤵
- Executes dropped EXE
PID:1584 -
\??\c:\htbttt.exec:\htbttt.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\2622228.exec:\2622228.exe52⤵
- Executes dropped EXE
PID:1792 -
\??\c:\frxxlrr.exec:\frxxlrr.exe53⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hthnhh.exec:\hthnhh.exe54⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vvvpj.exec:\vvvpj.exe55⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nhbhnb.exec:\nhbhnb.exe56⤵
- Executes dropped EXE
PID:2376 -
\??\c:\m0402.exec:\m0402.exe57⤵
- Executes dropped EXE
PID:2552 -
\??\c:\60286.exec:\60286.exe58⤵
- Executes dropped EXE
PID:320 -
\??\c:\rffflxx.exec:\rffflxx.exe59⤵
- Executes dropped EXE
PID:2424 -
\??\c:\080608.exec:\080608.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xflxxlf.exec:\xflxxlf.exe61⤵
- Executes dropped EXE
PID:912 -
\??\c:\7jdjd.exec:\7jdjd.exe62⤵
- Executes dropped EXE
PID:1996 -
\??\c:\20628.exec:\20628.exe63⤵
- Executes dropped EXE
PID:1852 -
\??\c:\btnntb.exec:\btnntb.exe64⤵
- Executes dropped EXE
PID:1580 -
\??\c:\00886.exec:\00886.exe65⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pjvjp.exec:\pjvjp.exe66⤵PID:1592
-
\??\c:\4688000.exec:\4688000.exe67⤵PID:2464
-
\??\c:\m6062.exec:\m6062.exe68⤵PID:2592
-
\??\c:\hbtnnh.exec:\hbtnnh.exe69⤵PID:2372
-
\??\c:\nhtnbb.exec:\nhtnbb.exe70⤵PID:1560
-
\??\c:\0424628.exec:\0424628.exe71⤵PID:2316
-
\??\c:\bbttbn.exec:\bbttbn.exe72⤵PID:1564
-
\??\c:\s0246.exec:\s0246.exe73⤵
- System Location Discovery: System Language Discovery
PID:2340 -
\??\c:\6062446.exec:\6062446.exe74⤵PID:1688
-
\??\c:\084060.exec:\084060.exe75⤵PID:1336
-
\??\c:\2262446.exec:\2262446.exe76⤵PID:2772
-
\??\c:\68064.exec:\68064.exe77⤵PID:2916
-
\??\c:\ppdpv.exec:\ppdpv.exe78⤵PID:2764
-
\??\c:\nnthbn.exec:\nnthbn.exe79⤵PID:2900
-
\??\c:\vpddd.exec:\vpddd.exe80⤵PID:2664
-
\??\c:\8660080.exec:\8660080.exe81⤵PID:2860
-
\??\c:\0420246.exec:\0420246.exe82⤵PID:2628
-
\??\c:\60842.exec:\60842.exe83⤵PID:2744
-
\??\c:\088882.exec:\088882.exe84⤵PID:2216
-
\??\c:\tbttbn.exec:\tbttbn.exe85⤵PID:2112
-
\??\c:\6660600.exec:\6660600.exe86⤵PID:1588
-
\??\c:\3frflfx.exec:\3frflfx.exe87⤵PID:2528
-
\??\c:\3lxxllf.exec:\3lxxllf.exe88⤵PID:1904
-
\??\c:\w42866.exec:\w42866.exe89⤵PID:2892
-
\??\c:\vpdpd.exec:\vpdpd.exe90⤵PID:2020
-
\??\c:\w64088.exec:\w64088.exe91⤵PID:2932
-
\??\c:\8684668.exec:\8684668.exe92⤵PID:1436
-
\??\c:\m4224.exec:\m4224.exe93⤵PID:1776
-
\??\c:\ddpjd.exec:\ddpjd.exe94⤵PID:1972
-
\??\c:\608044.exec:\608044.exe95⤵PID:2244
-
\??\c:\084606.exec:\084606.exe96⤵PID:1976
-
\??\c:\dvjjv.exec:\dvjjv.exe97⤵PID:772
-
\??\c:\48240.exec:\48240.exe98⤵PID:944
-
\??\c:\046644.exec:\046644.exe99⤵PID:680
-
\??\c:\0800262.exec:\0800262.exe100⤵PID:832
-
\??\c:\60802.exec:\60802.exe101⤵PID:1600
-
\??\c:\frffllr.exec:\frffllr.exe102⤵PID:1144
-
\??\c:\djpjj.exec:\djpjj.exe103⤵PID:984
-
\??\c:\dpvdv.exec:\dpvdv.exe104⤵PID:1284
-
\??\c:\02002.exec:\02002.exe105⤵PID:2460
-
\??\c:\ntthnn.exec:\ntthnn.exe106⤵PID:2524
-
\??\c:\tntbhb.exec:\tntbhb.exe107⤵PID:2996
-
\??\c:\s8222.exec:\s8222.exe108⤵PID:2196
-
\??\c:\208866.exec:\208866.exe109⤵PID:2712
-
\??\c:\004640.exec:\004640.exe110⤵PID:1544
-
\??\c:\frxfffl.exec:\frxfffl.exe111⤵PID:2988
-
\??\c:\hhbbnt.exec:\hhbbnt.exe112⤵PID:1824
-
\??\c:\80600.exec:\80600.exe113⤵PID:948
-
\??\c:\flxrxxx.exec:\flxrxxx.exe114⤵PID:2364
-
\??\c:\2688628.exec:\2688628.exe115⤵PID:2848
-
\??\c:\08806.exec:\08806.exe116⤵PID:2920
-
\??\c:\4682888.exec:\4682888.exe117⤵PID:1928
-
\??\c:\42222.exec:\42222.exe118⤵PID:2780
-
\??\c:\82024.exec:\82024.exe119⤵PID:2264
-
\??\c:\thtntb.exec:\thtntb.exe120⤵PID:2808
-
\??\c:\hhbbtb.exec:\hhbbtb.exe121⤵PID:2816
-
\??\c:\486800.exec:\486800.exe122⤵PID:2696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-