Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 20:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe
-
Size
54KB
-
MD5
b286483fb6d61f417c889121666538d6
-
SHA1
d84d87728b018c74ec989cf5f5b353555b90b678
-
SHA256
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0
-
SHA512
7890f8e102c7e8d5877661704722c838f9268b3ce18f49ef90b9810f1427ec940c1df24c6c070a2a07e9ad63afafdf396fa897462bb00af084301034a2e79202
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJt:0cdpeeBSHHMHLf9RyIET
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/1504-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-25-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2644-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-64-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2740-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-120-0x00000000001C0000-0x00000000001E9000-memory.dmp family_blackmoon behavioral1/memory/2772-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-150-0x0000000000270000-0x0000000000299000-memory.dmp family_blackmoon behavioral1/memory/1800-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1332-219-0x00000000001C0000-0x00000000001E9000-memory.dmp family_blackmoon behavioral1/memory/2216-228-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/1752-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-269-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3068-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-304-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2644-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-333-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2540-368-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2708-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-393-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2860-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-434-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2376-466-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/936-501-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1736-508-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1896-533-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-579-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-612-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-697-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-698-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2996-701-0x00000000001C0000-0x00000000001E9000-memory.dmp family_blackmoon behavioral1/memory/344-718-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/344-738-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/752-802-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-883-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-923-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2848-942-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1068 608068.exe 2380 62248.exe 2728 2684286.exe 2644 202288.exe 2964 9frfflr.exe 2540 446806.exe 2740 1tntbb.exe 2592 pjdpv.exe 2144 82680.exe 1472 882800.exe 1696 nhnhtn.exe 2772 0046240.exe 2888 3vjpv.exe 2856 4800226.exe 3040 nhtbnh.exe 1800 8680284.exe 352 llfrlfr.exe 2152 hhtbhn.exe 1048 20222.exe 2264 008406.exe 2148 lffxxll.exe 1056 86282.exe 1332 lfrflrf.exe 2216 8662848.exe 2076 7nttht.exe 1752 248808.exe 2024 w64022.exe 2328 0028660.exe 2428 00406.exe 2308 602800.exe 3068 88402.exe 2664 btthnb.exe 2812 hbbbhh.exe 2644 nnnnnn.exe 1576 0488664.exe 1908 88646.exe 2828 442806.exe 2752 44802.exe 2540 44024.exe 2560 s0842.exe 2372 6600624.exe 2044 xxxxflx.exe 1676 446806.exe 2708 44086.exe 664 220228.exe 2860 s6468.exe 2416 008022.exe 2776 620028.exe 324 nhtbbb.exe 1948 k06806.exe 1144 5bhhnn.exe 2500 bbntbh.exe 2132 dvppv.exe 344 k60006.exe 2164 pppvj.exe 1732 208884.exe 2376 1pvjp.exe 2208 ppdpj.exe 1072 3dvdp.exe 1256 2262846.exe 1332 882844.exe 936 lfxxxxx.exe 1736 jjpvj.exe 3028 o862008.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 602660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m4222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g6424.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 446262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 008422.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202264.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1068 1504 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 30 PID 1504 wrote to memory of 1068 1504 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 30 PID 1504 wrote to memory of 1068 1504 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 30 PID 1504 wrote to memory of 1068 1504 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 30 PID 1068 wrote to memory of 2380 1068 608068.exe 31 PID 1068 wrote to memory of 2380 1068 608068.exe 31 PID 1068 wrote to memory of 2380 1068 608068.exe 31 PID 1068 wrote to memory of 2380 1068 608068.exe 31 PID 2380 wrote to memory of 2728 2380 62248.exe 32 PID 2380 wrote to memory of 2728 2380 62248.exe 32 PID 2380 wrote to memory of 2728 2380 62248.exe 32 PID 2380 wrote to memory of 2728 2380 62248.exe 32 PID 2728 wrote to memory of 2644 2728 2684286.exe 33 PID 2728 wrote to memory of 2644 2728 2684286.exe 33 PID 2728 wrote to memory of 2644 2728 2684286.exe 33 PID 2728 wrote to memory of 2644 2728 2684286.exe 33 PID 2644 wrote to memory of 2964 2644 202288.exe 34 PID 2644 wrote to memory of 2964 2644 202288.exe 34 PID 2644 wrote to memory of 2964 2644 202288.exe 34 PID 2644 wrote to memory of 2964 2644 202288.exe 34 PID 2964 wrote to memory of 2540 2964 9frfflr.exe 35 PID 2964 wrote to memory of 2540 2964 9frfflr.exe 35 PID 2964 wrote to memory of 2540 2964 9frfflr.exe 35 PID 2964 wrote to memory of 2540 2964 9frfflr.exe 35 PID 2540 wrote to memory of 2740 2540 446806.exe 36 PID 2540 wrote to memory of 2740 2540 446806.exe 36 PID 2540 wrote to memory of 2740 2540 446806.exe 36 PID 2540 wrote to memory of 2740 2540 446806.exe 36 PID 2740 wrote to memory of 2592 2740 1tntbb.exe 37 PID 2740 wrote to memory of 2592 2740 1tntbb.exe 37 PID 2740 wrote to memory of 2592 2740 1tntbb.exe 37 PID 2740 wrote to memory of 2592 2740 1tntbb.exe 37 PID 2592 wrote to memory of 2144 2592 pjdpv.exe 38 PID 2592 wrote to memory of 2144 2592 pjdpv.exe 38 PID 2592 wrote to memory of 2144 2592 pjdpv.exe 38 PID 2592 wrote to memory of 2144 2592 pjdpv.exe 38 PID 2144 wrote to memory of 1472 2144 82680.exe 39 PID 2144 wrote to memory of 1472 2144 82680.exe 39 PID 2144 wrote to memory of 1472 2144 82680.exe 39 PID 2144 wrote to memory of 1472 2144 82680.exe 39 PID 1472 wrote to memory of 1696 1472 882800.exe 40 PID 1472 wrote to memory of 1696 1472 882800.exe 40 PID 1472 wrote to memory of 1696 1472 882800.exe 40 PID 1472 wrote to memory of 1696 1472 882800.exe 40 PID 1696 wrote to memory of 2772 1696 nhnhtn.exe 41 PID 1696 wrote to memory of 2772 1696 nhnhtn.exe 41 PID 1696 wrote to memory of 2772 1696 nhnhtn.exe 41 PID 1696 wrote to memory of 2772 1696 nhnhtn.exe 41 PID 2772 wrote to memory of 2888 2772 0046240.exe 42 PID 2772 wrote to memory of 2888 2772 0046240.exe 42 PID 2772 wrote to memory of 2888 2772 0046240.exe 42 PID 2772 wrote to memory of 2888 2772 0046240.exe 42 PID 2888 wrote to memory of 2856 2888 3vjpv.exe 43 PID 2888 wrote to memory of 2856 2888 3vjpv.exe 43 PID 2888 wrote to memory of 2856 2888 3vjpv.exe 43 PID 2888 wrote to memory of 2856 2888 3vjpv.exe 43 PID 2856 wrote to memory of 3040 2856 4800226.exe 44 PID 2856 wrote to memory of 3040 2856 4800226.exe 44 PID 2856 wrote to memory of 3040 2856 4800226.exe 44 PID 2856 wrote to memory of 3040 2856 4800226.exe 44 PID 3040 wrote to memory of 1800 3040 nhtbnh.exe 45 PID 3040 wrote to memory of 1800 3040 nhtbnh.exe 45 PID 3040 wrote to memory of 1800 3040 nhtbnh.exe 45 PID 3040 wrote to memory of 1800 3040 nhtbnh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe"C:\Users\Admin\AppData\Local\Temp\21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\608068.exec:\608068.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\62248.exec:\62248.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\2684286.exec:\2684286.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\202288.exec:\202288.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\9frfflr.exec:\9frfflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\446806.exec:\446806.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\1tntbb.exec:\1tntbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pjdpv.exec:\pjdpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\82680.exec:\82680.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\882800.exec:\882800.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\nhnhtn.exec:\nhnhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\0046240.exec:\0046240.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3vjpv.exec:\3vjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\4800226.exec:\4800226.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nhtbnh.exec:\nhtbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\8680284.exec:\8680284.exe17⤵
- Executes dropped EXE
PID:1800 -
\??\c:\llfrlfr.exec:\llfrlfr.exe18⤵
- Executes dropped EXE
PID:352 -
\??\c:\hhtbhn.exec:\hhtbhn.exe19⤵
- Executes dropped EXE
PID:2152 -
\??\c:\20222.exec:\20222.exe20⤵
- Executes dropped EXE
PID:1048 -
\??\c:\008406.exec:\008406.exe21⤵
- Executes dropped EXE
PID:2264 -
\??\c:\lffxxll.exec:\lffxxll.exe22⤵
- Executes dropped EXE
PID:2148 -
\??\c:\86282.exec:\86282.exe23⤵
- Executes dropped EXE
PID:1056 -
\??\c:\lfrflrf.exec:\lfrflrf.exe24⤵
- Executes dropped EXE
PID:1332 -
\??\c:\8662848.exec:\8662848.exe25⤵
- Executes dropped EXE
PID:2216 -
\??\c:\7nttht.exec:\7nttht.exe26⤵
- Executes dropped EXE
PID:2076 -
\??\c:\248808.exec:\248808.exe27⤵
- Executes dropped EXE
PID:1752 -
\??\c:\w64022.exec:\w64022.exe28⤵
- Executes dropped EXE
PID:2024 -
\??\c:\0028660.exec:\0028660.exe29⤵
- Executes dropped EXE
PID:2328 -
\??\c:\00406.exec:\00406.exe30⤵
- Executes dropped EXE
PID:2428 -
\??\c:\602800.exec:\602800.exe31⤵
- Executes dropped EXE
PID:2308 -
\??\c:\88402.exec:\88402.exe32⤵
- Executes dropped EXE
PID:3068 -
\??\c:\btthnb.exec:\btthnb.exe33⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hbbbhh.exec:\hbbbhh.exe34⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nnnnnn.exec:\nnnnnn.exe35⤵
- Executes dropped EXE
PID:2644 -
\??\c:\0488664.exec:\0488664.exe36⤵
- Executes dropped EXE
PID:1576 -
\??\c:\88646.exec:\88646.exe37⤵
- Executes dropped EXE
PID:1908 -
\??\c:\442806.exec:\442806.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\44802.exec:\44802.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\44024.exec:\44024.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\s0842.exec:\s0842.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\6600624.exec:\6600624.exe42⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xxxxflx.exec:\xxxxflx.exe43⤵
- Executes dropped EXE
PID:2044 -
\??\c:\446806.exec:\446806.exe44⤵
- Executes dropped EXE
PID:1676 -
\??\c:\44086.exec:\44086.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\220228.exec:\220228.exe46⤵
- Executes dropped EXE
PID:664 -
\??\c:\s6468.exec:\s6468.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\008022.exec:\008022.exe48⤵
- Executes dropped EXE
PID:2416 -
\??\c:\620028.exec:\620028.exe49⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nhtbbb.exec:\nhtbbb.exe50⤵
- Executes dropped EXE
PID:324 -
\??\c:\k06806.exec:\k06806.exe51⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5bhhnn.exec:\5bhhnn.exe52⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bbntbh.exec:\bbntbh.exe53⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dvppv.exec:\dvppv.exe54⤵
- Executes dropped EXE
PID:2132 -
\??\c:\k60006.exec:\k60006.exe55⤵
- Executes dropped EXE
PID:344 -
\??\c:\pppvj.exec:\pppvj.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\208884.exec:\208884.exe57⤵
- Executes dropped EXE
PID:1732 -
\??\c:\1pvjp.exec:\1pvjp.exe58⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ppdpj.exec:\ppdpj.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\3dvdp.exec:\3dvdp.exe60⤵
- Executes dropped EXE
PID:1072 -
\??\c:\2262846.exec:\2262846.exe61⤵
- Executes dropped EXE
PID:1256 -
\??\c:\882844.exec:\882844.exe62⤵
- Executes dropped EXE
PID:1332 -
\??\c:\lfxxxxx.exec:\lfxxxxx.exe63⤵
- Executes dropped EXE
PID:936 -
\??\c:\jjpvj.exec:\jjpvj.exe64⤵
- Executes dropped EXE
PID:1736 -
\??\c:\o862008.exec:\o862008.exe65⤵
- Executes dropped EXE
PID:3028 -
\??\c:\46208.exec:\46208.exe66⤵PID:560
-
\??\c:\7bnbbh.exec:\7bnbbh.exe67⤵PID:2024
-
\??\c:\xxffllx.exec:\xxffllx.exe68⤵PID:1896
-
\??\c:\5hbntb.exec:\5hbntb.exe69⤵PID:1500
-
\??\c:\jdjvv.exec:\jdjvv.exe70⤵PID:1068
-
\??\c:\3xrxflr.exec:\3xrxflr.exe71⤵PID:2456
-
\??\c:\1rlrlrx.exec:\1rlrlrx.exe72⤵PID:2628
-
\??\c:\dvjvd.exec:\dvjvd.exe73⤵PID:2660
-
\??\c:\6840668.exec:\6840668.exe74⤵PID:2824
-
\??\c:\m2840.exec:\m2840.exe75⤵PID:2680
-
\??\c:\btbhtt.exec:\btbhtt.exe76⤵PID:2840
-
\??\c:\8284624.exec:\8284624.exe77⤵PID:2940
-
\??\c:\1xlxfll.exec:\1xlxfll.exe78⤵PID:2252
-
\??\c:\rrrxxll.exec:\rrrxxll.exe79⤵PID:2564
-
\??\c:\6484046.exec:\6484046.exe80⤵PID:2688
-
\??\c:\bthnhn.exec:\bthnhn.exe81⤵PID:2584
-
\??\c:\82846.exec:\82846.exe82⤵PID:2576
-
\??\c:\86480.exec:\86480.exe83⤵PID:2372
-
\??\c:\tbbtth.exec:\tbbtth.exe84⤵PID:1968
-
\??\c:\626204.exec:\626204.exe85⤵PID:2852
-
\??\c:\402220.exec:\402220.exe86⤵PID:340
-
\??\c:\1frxxff.exec:\1frxxff.exe87⤵PID:2764
-
\??\c:\5nhbhh.exec:\5nhbhh.exe88⤵PID:2860
-
\??\c:\82066.exec:\82066.exe89⤵PID:2888
-
\??\c:\8828840.exec:\8828840.exe90⤵PID:348
-
\??\c:\o024068.exec:\o024068.exe91⤵PID:324
-
\??\c:\xxxfxfr.exec:\xxxfxfr.exe92⤵PID:1756
-
\??\c:\3vdjj.exec:\3vdjj.exe93⤵PID:1800
-
\??\c:\u422440.exec:\u422440.exe94⤵PID:2996
-
\??\c:\tnhntb.exec:\tnhntb.exe95⤵PID:2196
-
\??\c:\48640.exec:\48640.exe96⤵PID:344
-
\??\c:\rxlrxxf.exec:\rxlrxxf.exe97⤵PID:2288
-
\??\c:\2262846.exec:\2262846.exe98⤵PID:2264
-
\??\c:\llxfxxl.exec:\llxfxxl.exe99⤵PID:2136
-
\??\c:\jpvvd.exec:\jpvvd.exe100⤵
- System Location Discovery: System Language Discovery
PID:444 -
\??\c:\7thbtt.exec:\7thbtt.exe101⤵PID:1072
-
\??\c:\228022.exec:\228022.exe102⤵PID:1256
-
\??\c:\xxffffr.exec:\xxffffr.exe103⤵PID:2124
-
\??\c:\3hbhnt.exec:\3hbhnt.exe104⤵PID:964
-
\??\c:\480682.exec:\480682.exe105⤵PID:2972
-
\??\c:\s0284.exec:\s0284.exe106⤵PID:2336
-
\??\c:\frlrxll.exec:\frlrxll.exe107⤵PID:1716
-
\??\c:\220040.exec:\220040.exe108⤵PID:2304
-
\??\c:\202486.exec:\202486.exe109⤵PID:752
-
\??\c:\0606004.exec:\0606004.exe110⤵PID:748
-
\??\c:\i428062.exec:\i428062.exe111⤵PID:2308
-
\??\c:\8268060.exec:\8268060.exe112⤵PID:3068
-
\??\c:\fllflfl.exec:\fllflfl.exe113⤵
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\042860.exec:\042860.exe114⤵PID:2744
-
\??\c:\flrxxfr.exec:\flrxxfr.exe115⤵PID:2808
-
\??\c:\xxllrxl.exec:\xxllrxl.exe116⤵PID:2624
-
\??\c:\882028.exec:\882028.exe117⤵PID:2716
-
\??\c:\226806.exec:\226806.exe118⤵PID:2904
-
\??\c:\442288.exec:\442288.exe119⤵PID:2544
-
\??\c:\3bbttb.exec:\3bbttb.exe120⤵PID:2520
-
\??\c:\nnbbbh.exec:\nnbbbh.exe121⤵PID:2692
-
\??\c:\rllxrxx.exec:\rllxrxx.exe122⤵PID:2016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-