Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
General
-
Target
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe
-
Size
54KB
-
MD5
b811c51873a98c783ac102140f14a5db
-
SHA1
d2e5683d0e1771ce6b79a952bb3c410cd15e4651
-
SHA256
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f
-
SHA512
69c42f8c50f39d15ef79033152e6fa27d246859b2d1c56d1a680e7b4f1dfb92755b0d63bdb824622d345f3e28117fa078b77d506b7313419d351fce3d59b50b3
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJV2:0cdpeeBSHHMHLf9RyIET2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/2172-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-33-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2932-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-59-0x00000000001E0000-0x0000000000209000-memory.dmp family_blackmoon behavioral1/memory/1948-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-123-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/3036-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-142-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2564-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-149-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1496-162-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2316-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-196-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1472-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-225-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1704-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-276-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2020-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-319-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2704-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-437-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-444-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-463-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-470-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2296-471-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-535-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/868-554-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-596-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2864-600-0x0000000000250000-0x0000000000279000-memory.dmp family_blackmoon behavioral1/memory/780-695-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/380-702-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1440-710-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2408-796-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/736-803-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/920-900-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/572-911-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2412-919-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2572-973-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2164-993-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1248-1006-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1652-1044-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-1144-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2816 jvjdj.exe 2712 3nbbbh.exe 1692 k84466.exe 2932 488006.exe 2568 xxllrrf.exe 1948 vpppp.exe 2900 pjpvd.exe 2560 vjpvp.exe 2108 rffrrlr.exe 1780 hbhtnb.exe 2776 640066.exe 3036 6466262.exe 2520 k82022.exe 1320 jjpjd.exe 2564 vpjdp.exe 1496 a0602.exe 2096 lfxlllx.exe 2428 m2000.exe 2316 xlrfxll.exe 2300 26840.exe 1472 flrlflf.exe 1760 nhnttn.exe 2132 46640.exe 688 2622622.exe 672 828402.exe 1704 8022684.exe 2352 lfrxffl.exe 824 8240044.exe 2424 48000.exe 2612 w86200.exe 2020 8208024.exe 2828 008866.exe 2876 q48468.exe 2840 ffrrflx.exe 1568 820628.exe 2704 hhnhht.exe 2056 rrxxffr.exe 2720 9vpjv.exe 700 a6844.exe 632 vvjjv.exe 528 k86644.exe 2208 7pdvd.exe 2624 vdvdp.exe 1280 1ffllrl.exe 1768 48060.exe 2656 jjddp.exe 2776 66624.exe 2504 822800.exe 2880 o028628.exe 2536 vjpdj.exe 1388 3jvjp.exe 2572 1hntbh.exe 2860 486264.exe 1516 82484.exe 2240 5nhntt.exe 1680 pjjjp.exe 2168 602044.exe 2316 42440.exe 2296 4488468.exe 2272 3frxxff.exe 1896 u824224.exe 1672 002468.exe 2132 260682.exe 1588 9hhbhh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 008840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i060222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o200044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c200806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u822406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q64666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q28400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u828662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2816 2172 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 30 PID 2172 wrote to memory of 2816 2172 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 30 PID 2172 wrote to memory of 2816 2172 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 30 PID 2172 wrote to memory of 2816 2172 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 30 PID 2816 wrote to memory of 2712 2816 jvjdj.exe 31 PID 2816 wrote to memory of 2712 2816 jvjdj.exe 31 PID 2816 wrote to memory of 2712 2816 jvjdj.exe 31 PID 2816 wrote to memory of 2712 2816 jvjdj.exe 31 PID 2712 wrote to memory of 1692 2712 3nbbbh.exe 32 PID 2712 wrote to memory of 1692 2712 3nbbbh.exe 32 PID 2712 wrote to memory of 1692 2712 3nbbbh.exe 32 PID 2712 wrote to memory of 1692 2712 3nbbbh.exe 32 PID 1692 wrote to memory of 2932 1692 k84466.exe 33 PID 1692 wrote to memory of 2932 1692 k84466.exe 33 PID 1692 wrote to memory of 2932 1692 k84466.exe 33 PID 1692 wrote to memory of 2932 1692 k84466.exe 33 PID 2932 wrote to memory of 2568 2932 488006.exe 34 PID 2932 wrote to memory of 2568 2932 488006.exe 34 PID 2932 wrote to memory of 2568 2932 488006.exe 34 PID 2932 wrote to memory of 2568 2932 488006.exe 34 PID 2568 wrote to memory of 1948 2568 xxllrrf.exe 35 PID 2568 wrote to memory of 1948 2568 xxllrrf.exe 35 PID 2568 wrote to memory of 1948 2568 xxllrrf.exe 35 PID 2568 wrote to memory of 1948 2568 xxllrrf.exe 35 PID 1948 wrote to memory of 2900 1948 vpppp.exe 36 PID 1948 wrote to memory of 2900 1948 vpppp.exe 36 PID 1948 wrote to memory of 2900 1948 vpppp.exe 36 PID 1948 wrote to memory of 2900 1948 vpppp.exe 36 PID 2900 wrote to memory of 2560 2900 pjpvd.exe 37 PID 2900 wrote to memory of 2560 2900 pjpvd.exe 37 PID 2900 wrote to memory of 2560 2900 pjpvd.exe 37 PID 2900 wrote to memory of 2560 2900 pjpvd.exe 37 PID 2560 wrote to memory of 2108 2560 vjpvp.exe 38 PID 2560 wrote to memory of 2108 2560 vjpvp.exe 38 PID 2560 wrote to memory of 2108 2560 vjpvp.exe 38 PID 2560 wrote to memory of 2108 2560 vjpvp.exe 38 PID 2108 wrote to memory of 1780 2108 rffrrlr.exe 39 PID 2108 wrote to memory of 1780 2108 rffrrlr.exe 39 PID 2108 wrote to memory of 1780 2108 rffrrlr.exe 39 PID 2108 wrote to memory of 1780 2108 rffrrlr.exe 39 PID 1780 wrote to memory of 2776 1780 hbhtnb.exe 40 PID 1780 wrote to memory of 2776 1780 hbhtnb.exe 40 PID 1780 wrote to memory of 2776 1780 hbhtnb.exe 40 PID 1780 wrote to memory of 2776 1780 hbhtnb.exe 40 PID 2776 wrote to memory of 3036 2776 640066.exe 41 PID 2776 wrote to memory of 3036 2776 640066.exe 41 PID 2776 wrote to memory of 3036 2776 640066.exe 41 PID 2776 wrote to memory of 3036 2776 640066.exe 41 PID 3036 wrote to memory of 2520 3036 6466262.exe 42 PID 3036 wrote to memory of 2520 3036 6466262.exe 42 PID 3036 wrote to memory of 2520 3036 6466262.exe 42 PID 3036 wrote to memory of 2520 3036 6466262.exe 42 PID 2520 wrote to memory of 1320 2520 k82022.exe 43 PID 2520 wrote to memory of 1320 2520 k82022.exe 43 PID 2520 wrote to memory of 1320 2520 k82022.exe 43 PID 2520 wrote to memory of 1320 2520 k82022.exe 43 PID 1320 wrote to memory of 2564 1320 jjpjd.exe 44 PID 1320 wrote to memory of 2564 1320 jjpjd.exe 44 PID 1320 wrote to memory of 2564 1320 jjpjd.exe 44 PID 1320 wrote to memory of 2564 1320 jjpjd.exe 44 PID 2564 wrote to memory of 1496 2564 vpjdp.exe 45 PID 2564 wrote to memory of 1496 2564 vpjdp.exe 45 PID 2564 wrote to memory of 1496 2564 vpjdp.exe 45 PID 2564 wrote to memory of 1496 2564 vpjdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe"C:\Users\Admin\AppData\Local\Temp\bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\jvjdj.exec:\jvjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\3nbbbh.exec:\3nbbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\k84466.exec:\k84466.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\488006.exec:\488006.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\xxllrrf.exec:\xxllrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vpppp.exec:\vpppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\pjpvd.exec:\pjpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\vjpvp.exec:\vjpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rffrrlr.exec:\rffrrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\hbhtnb.exec:\hbhtnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\640066.exec:\640066.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\6466262.exec:\6466262.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\k82022.exec:\k82022.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\jjpjd.exec:\jjpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\vpjdp.exec:\vpjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\a0602.exec:\a0602.exe17⤵
- Executes dropped EXE
PID:1496 -
\??\c:\lfxlllx.exec:\lfxlllx.exe18⤵
- Executes dropped EXE
PID:2096 -
\??\c:\m2000.exec:\m2000.exe19⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xlrfxll.exec:\xlrfxll.exe20⤵
- Executes dropped EXE
PID:2316 -
\??\c:\26840.exec:\26840.exe21⤵
- Executes dropped EXE
PID:2300 -
\??\c:\flrlflf.exec:\flrlflf.exe22⤵
- Executes dropped EXE
PID:1472 -
\??\c:\nhnttn.exec:\nhnttn.exe23⤵
- Executes dropped EXE
PID:1760 -
\??\c:\46640.exec:\46640.exe24⤵
- Executes dropped EXE
PID:2132 -
\??\c:\2622622.exec:\2622622.exe25⤵
- Executes dropped EXE
PID:688 -
\??\c:\828402.exec:\828402.exe26⤵
- Executes dropped EXE
PID:672 -
\??\c:\8022684.exec:\8022684.exe27⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lfrxffl.exec:\lfrxffl.exe28⤵
- Executes dropped EXE
PID:2352 -
\??\c:\8240044.exec:\8240044.exe29⤵
- Executes dropped EXE
PID:824 -
\??\c:\48000.exec:\48000.exe30⤵
- Executes dropped EXE
PID:2424 -
\??\c:\w86200.exec:\w86200.exe31⤵
- Executes dropped EXE
PID:2612 -
\??\c:\8208024.exec:\8208024.exe32⤵
- Executes dropped EXE
PID:2020 -
\??\c:\008866.exec:\008866.exe33⤵
- Executes dropped EXE
PID:2828 -
\??\c:\q48468.exec:\q48468.exe34⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ffrrflx.exec:\ffrrflx.exe35⤵
- Executes dropped EXE
PID:2840 -
\??\c:\820628.exec:\820628.exe36⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hhnhht.exec:\hhnhht.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rrxxffr.exec:\rrxxffr.exe38⤵
- Executes dropped EXE
PID:2056 -
\??\c:\9vpjv.exec:\9vpjv.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\a6844.exec:\a6844.exe40⤵
- Executes dropped EXE
PID:700 -
\??\c:\vvjjv.exec:\vvjjv.exe41⤵
- Executes dropped EXE
PID:632 -
\??\c:\k86644.exec:\k86644.exe42⤵
- Executes dropped EXE
PID:528 -
\??\c:\7pdvd.exec:\7pdvd.exe43⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vdvdp.exec:\vdvdp.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1ffllrl.exec:\1ffllrl.exe45⤵
- Executes dropped EXE
PID:1280 -
\??\c:\48060.exec:\48060.exe46⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jjddp.exec:\jjddp.exe47⤵
- Executes dropped EXE
PID:2656 -
\??\c:\66624.exec:\66624.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\822800.exec:\822800.exe49⤵
- Executes dropped EXE
PID:2504 -
\??\c:\o028628.exec:\o028628.exe50⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vjpdj.exec:\vjpdj.exe51⤵
- Executes dropped EXE
PID:2536 -
\??\c:\3jvjp.exec:\3jvjp.exe52⤵
- Executes dropped EXE
PID:1388 -
\??\c:\1hntbh.exec:\1hntbh.exe53⤵
- Executes dropped EXE
PID:2572 -
\??\c:\486264.exec:\486264.exe54⤵
- Executes dropped EXE
PID:2860 -
\??\c:\82484.exec:\82484.exe55⤵
- Executes dropped EXE
PID:1516 -
\??\c:\5nhntt.exec:\5nhntt.exe56⤵
- Executes dropped EXE
PID:2240 -
\??\c:\pjjjp.exec:\pjjjp.exe57⤵
- Executes dropped EXE
PID:1680 -
\??\c:\602044.exec:\602044.exe58⤵
- Executes dropped EXE
PID:2168 -
\??\c:\42440.exec:\42440.exe59⤵
- Executes dropped EXE
PID:2316 -
\??\c:\4488468.exec:\4488468.exe60⤵
- Executes dropped EXE
PID:2296 -
\??\c:\3frxxff.exec:\3frxxff.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\u824224.exec:\u824224.exe62⤵
- Executes dropped EXE
PID:1896 -
\??\c:\002468.exec:\002468.exe63⤵
- Executes dropped EXE
PID:1672 -
\??\c:\260682.exec:\260682.exe64⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9hhbhh.exec:\9hhbhh.exe65⤵
- Executes dropped EXE
PID:1588 -
\??\c:\82262.exec:\82262.exe66⤵PID:1852
-
\??\c:\dpddd.exec:\dpddd.exe67⤵PID:1616
-
\??\c:\3nbtbn.exec:\3nbtbn.exe68⤵PID:1744
-
\??\c:\ddppd.exec:\ddppd.exe69⤵PID:2448
-
\??\c:\4248480.exec:\4248480.exe70⤵PID:296
-
\??\c:\dvpvv.exec:\dvpvv.exe71⤵PID:2184
-
\??\c:\5vpvd.exec:\5vpvd.exe72⤵PID:868
-
\??\c:\a0660.exec:\a0660.exe73⤵PID:1892
-
\??\c:\xllrlrr.exec:\xllrlrr.exe74⤵PID:2780
-
\??\c:\m8624.exec:\m8624.exe75⤵PID:2808
-
\??\c:\llrxrxr.exec:\llrxrxr.exe76⤵PID:2828
-
\??\c:\486260.exec:\486260.exe77⤵PID:2680
-
\??\c:\6066880.exec:\6066880.exe78⤵PID:2788
-
\??\c:\s8000.exec:\s8000.exe79⤵PID:1568
-
\??\c:\6042606.exec:\6042606.exe80⤵PID:2864
-
\??\c:\4406622.exec:\4406622.exe81⤵PID:2524
-
\??\c:\i684088.exec:\i684088.exe82⤵PID:536
-
\??\c:\3htbtn.exec:\3htbtn.exe83⤵PID:1012
-
\??\c:\084684.exec:\084684.exe84⤵PID:580
-
\??\c:\82844.exec:\82844.exe85⤵PID:1720
-
\??\c:\42882.exec:\42882.exe86⤵PID:2772
-
\??\c:\dvjjp.exec:\dvjjp.exe87⤵
- System Location Discovery: System Language Discovery
PID:2624 -
\??\c:\862882.exec:\862882.exe88⤵PID:2364
-
\??\c:\pjvvv.exec:\pjvvv.exe89⤵PID:1184
-
\??\c:\w46288.exec:\w46288.exe90⤵PID:3052
-
\??\c:\m2646.exec:\m2646.exe91⤵PID:3012
-
\??\c:\ddjvv.exec:\ddjvv.exe92⤵PID:1644
-
\??\c:\fxxrrlx.exec:\fxxrrlx.exe93⤵PID:2508
-
\??\c:\dddjv.exec:\dddjv.exe94⤵PID:780
-
\??\c:\xrfxfxx.exec:\xrfxfxx.exe95⤵PID:380
-
\??\c:\rlrffxx.exec:\rlrffxx.exe96⤵PID:1440
-
\??\c:\9nbbtn.exec:\9nbbtn.exe97⤵PID:1740
-
\??\c:\tthnht.exec:\tthnht.exe98⤵PID:2452
-
\??\c:\5djjj.exec:\5djjj.exe99⤵PID:2240
-
\??\c:\220660.exec:\220660.exe100⤵PID:668
-
\??\c:\rlfxffr.exec:\rlfxffr.exe101⤵PID:2168
-
\??\c:\m8624.exec:\m8624.exe102⤵PID:2212
-
\??\c:\88066.exec:\88066.exe103⤵PID:552
-
\??\c:\42208.exec:\42208.exe104⤵PID:1472
-
\??\c:\e08840.exec:\e08840.exe105⤵PID:2312
-
\??\c:\5pjjp.exec:\5pjjp.exe106⤵PID:2264
-
\??\c:\226860.exec:\226860.exe107⤵PID:2652
-
\??\c:\44424.exec:\44424.exe108⤵PID:1808
-
\??\c:\xflllff.exec:\xflllff.exe109⤵PID:1804
-
\??\c:\vppvp.exec:\vppvp.exe110⤵PID:2408
-
\??\c:\42884.exec:\42884.exe111⤵PID:736
-
\??\c:\tthhnh.exec:\tthhnh.exe112⤵PID:1696
-
\??\c:\jppvd.exec:\jppvd.exe113⤵PID:2332
-
\??\c:\820222.exec:\820222.exe114⤵PID:2952
-
\??\c:\04064.exec:\04064.exe115⤵PID:3000
-
\??\c:\5pdvv.exec:\5pdvv.exe116⤵PID:2956
-
\??\c:\ttnbhh.exec:\ttnbhh.exe117⤵PID:1788
-
\??\c:\9jdjp.exec:\9jdjp.exe118⤵PID:2712
-
\??\c:\9bnntt.exec:\9bnntt.exe119⤵PID:2732
-
\??\c:\vvddp.exec:\vvddp.exe120⤵PID:1544
-
\??\c:\04620.exec:\04620.exe121⤵PID:2696
-
\??\c:\hthntb.exec:\hthntb.exe122⤵PID:1708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-