Overview
overview
10Static
static
10Malware.2024.12.25.7z
windows7-x64
1Malware.2024.12.25.7z
windows10-2004-x64
12024-12-25...19.exe
windows7-x64
2024-12-25...19.exe
windows10-2004-x64
2024-12-25...8a.pdf
windows7-x64
32024-12-25...8a.pdf
windows10-2004-x64
32024-12-25...0d.pdf
windows7-x64
32024-12-25...0d.pdf
windows10-2004-x64
32024-12-25...96.exe
windows7-x64
72024-12-25...96.exe
windows10-2004-x64
72024-12-25...61.exe
windows7-x64
12024-12-25...61.exe
windows10-2004-x64
12024-12-25...03.pdf
windows7-x64
32024-12-25...03.pdf
windows10-2004-x64
32024-12-25...62.exe
windows7-x64
102024-12-25...62.exe
windows10-2004-x64
102024-12-25...25.exe
windows7-x64
12024-12-25...25.exe
windows10-2004-x64
12024-12-25...6b.exe
windows7-x64
102024-12-25...6b.exe
windows10-2004-x64
102024-12-25...ec.exe
windows7-x64
12024-12-25...ec.exe
windows10-2004-x64
32024-12-25...cc.exe
windows7-x64
12024-12-25...cc.exe
windows10-2004-x64
32024-12-25...3a.exe
windows7-x64
102024-12-25...3a.exe
windows10-2004-x64
102024-12-25...66.exe
windows7-x64
32024-12-25...66.exe
windows10-2004-x64
32024-12-25...97.exe
windows7-x64
102024-12-25...97.exe
windows10-2004-x64
102024-12-25...1d.pdf
windows7-x64
32024-12-25...1d.pdf
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2025 17:40
Static task
static1
Behavioral task
behavioral1
Sample
Malware.2024.12.25.7z
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Malware.2024.12.25.7z
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
2024-12-25/unknown-df6ecbdc8f043bbe3a4018a4fd3734c474761e1c7505fb0917df4fb808087e19.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
2024-12-25/unknown-df6ecbdc8f043bbe3a4018a4fd3734c474761e1c7505fb0917df4fb808087e19.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
2024-12-25/unknown-e0b170a4440b174bb3d6bd6c5abb8833cd7eae6eadc74d4176c8bb8a4b38ca8a.pdf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
2024-12-25/unknown-e0b170a4440b174bb3d6bd6c5abb8833cd7eae6eadc74d4176c8bb8a4b38ca8a.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
2024-12-25/unknown-e1e08ee8a9d8d42268b3537c74ec3f099dc05a1cf1fd91d3c1e54084957c570d.pdf
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
2024-12-25/unknown-e1e08ee8a9d8d42268b3537c74ec3f099dc05a1cf1fd91d3c1e54084957c570d.pdf
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
2024-12-25/unknown-e1ffabc651f471b8d4141420d8e171310bc91a400462062ca96f6ac202a0a896.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
2024-12-25/unknown-e1ffabc651f471b8d4141420d8e171310bc91a400462062ca96f6ac202a0a896.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
2024-12-25/unknown-e2c57dce7eb054b47a8f96e8be747b91ad1fce0bc0de597c9d41fce2623d9361.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
2024-12-25/unknown-e2c57dce7eb054b47a8f96e8be747b91ad1fce0bc0de597c9d41fce2623d9361.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
2024-12-25/unknown-e3dcabde5987c263aef8243cba944e442658bfcf1ad19ebbd7c78b89be0ab203.pdf
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
2024-12-25/unknown-e3dcabde5987c263aef8243cba944e442658bfcf1ad19ebbd7c78b89be0ab203.pdf
Resource
win10v2004-20250129-en
Behavioral task
behavioral15
Sample
2024-12-25/unknown-e49324f54cdf00a226d1779157391c9c260ddb6a5179ece3276f326052b95962.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
2024-12-25/unknown-e49324f54cdf00a226d1779157391c9c260ddb6a5179ece3276f326052b95962.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral17
Sample
2024-12-25/unknown-e4c4e59c66b650e0d696b6ec194d61637a688293cd5e23be9c630f7748c74125.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
2024-12-25/unknown-e4c4e59c66b650e0d696b6ec194d61637a688293cd5e23be9c630f7748c74125.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral19
Sample
2024-12-25/unknown-e668037208d053a72e197f6b156805776bf8bd8823c0b850d7c6302e22eb726b.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
2024-12-25/unknown-e668037208d053a72e197f6b156805776bf8bd8823c0b850d7c6302e22eb726b.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral21
Sample
2024-12-25/unknown-e8c053991c3618b30dde741da46435044fd5ae153f78c53f526f0de329fd43ec.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
2024-12-25/unknown-e8c053991c3618b30dde741da46435044fd5ae153f78c53f526f0de329fd43ec.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral23
Sample
2024-12-25/unknown-ea34039dbd854222e03748c548a5210e552bbfaa600ae0f24dfb55397a3136cc.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
2024-12-25/unknown-ea34039dbd854222e03748c548a5210e552bbfaa600ae0f24dfb55397a3136cc.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral25
Sample
2024-12-25/unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
2024-12-25/unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
2024-12-25/unknown-ec6a36915e9f9d331e80881a2336503416fc441a599fec36e2601e6f27229b66.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
2024-12-25/unknown-ec6a36915e9f9d331e80881a2336503416fc441a599fec36e2601e6f27229b66.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral29
Sample
2024-12-25/unknown-ed34607d35c3e5e97ce126000df93ecdcc854d9e7bde1ee42e08b243df314697.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
2024-12-25/unknown-ed34607d35c3e5e97ce126000df93ecdcc854d9e7bde1ee42e08b243df314697.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral31
Sample
2024-12-25/unknown-ed52a60eea60738501367935811e2f8a9ffe366ff9656cca8d4d9c78555d581d.pdf
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
2024-12-25/unknown-ed52a60eea60738501367935811e2f8a9ffe366ff9656cca8d4d9c78555d581d.pdf
Resource
win10v2004-20250129-en
General
-
Target
2024-12-25/unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe
-
Size
455KB
-
MD5
fde5e265ba6cdbb0270cbaddc3993a10
-
SHA1
f4d328bb4f667389b248f6e2509c04e153e2e87e
-
SHA256
ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a
-
SHA512
055f22c437be2c63ae28d3bd567ca4801d2e537e9c827627d0f5003c3b21c8546abcd6e0e4b065914e5b5acc869e91e5006f2e7a70c948b40fc97221f52bd814
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral26/memory/3856-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/532-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4984-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/5032-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3832-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4776-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4980-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3408-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3524-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3064-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2916-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3760-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/5040-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2072-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4512-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/5016-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3476-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/1148-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4928-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4148-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2488-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3632-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4972-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4780-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/452-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2472-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2972-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2284-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4300-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4740-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4012-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2056-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4320-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/748-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3076-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4208-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/1096-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3408-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4276-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4976-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/5048-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2208-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/1888-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/1240-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3160-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/1664-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4280-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4752-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/1812-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/1900-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/1616-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2872-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3988-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2352-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2988-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4556-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4900-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4372-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2484-815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/1932-822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/2232-838-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/4580-1016-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/3284-1047-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral26/memory/1520-1199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 532 ntnnnt.exe 5032 dddvp.exe 4984 bnbhhh.exe 4980 jjppj.exe 3832 lffxrxr.exe 4776 ntnhtb.exe 3408 9ddvv.exe 3524 dpppd.exe 3064 nntnnn.exe 2916 rrrllrl.exe 3760 nhhhbb.exe 5040 tttntn.exe 2072 jvdjd.exe 4512 hnnnth.exe 5016 ppjvv.exe 3476 htnbhn.exe 1520 ddvvp.exe 4324 lxlfxlf.exe 1148 7htthn.exe 1636 dvjdd.exe 2028 nhtnnn.exe 4928 vvpvj.exe 4724 xxxrrrr.exe 800 ffrffrr.exe 1640 bthhhn.exe 4148 dpvpj.exe 2488 nbhbnh.exe 788 jvdjd.exe 1572 lflfxxx.exe 3632 bbbthh.exe 1176 3rlfxrf.exe 4972 xrxlffr.exe 4900 pjdpv.exe 4552 rlfrlfx.exe 4780 nnhhhn.exe 316 9djdv.exe 392 frxxlfx.exe 452 bhhhhb.exe 1612 htnbth.exe 4720 ffffrfr.exe 2308 xrrrlll.exe 2472 btbttb.exe 620 pddvp.exe 388 3xlfrlf.exe 2972 hhttnn.exe 2284 ttnbnt.exe 4300 7djpj.exe 4740 rlxxffr.exe 1416 thhntb.exe 4012 7nhbbb.exe 2056 dvvpj.exe 3920 lflxrlf.exe 1860 7tnnhb.exe 2936 nhbhbn.exe 1616 dvvpj.exe 4320 llllxrf.exe 2772 nntbnn.exe 2864 vvpdp.exe 1192 djvpj.exe 5056 rfxrffx.exe 748 ntnhhn.exe 312 vpvpj.exe 3076 lfrfrlx.exe 4208 ttnnnn.exe -
resource yara_rule behavioral26/memory/3856-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/5032-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/532-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4984-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/5032-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3832-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3832-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4776-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4980-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3408-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3524-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3064-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2916-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3760-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/5040-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2072-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4512-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/5016-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3476-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/1148-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4928-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4148-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2488-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3632-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4972-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4780-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/452-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2472-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2972-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2284-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4300-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4740-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4012-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2056-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4320-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/748-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3076-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4208-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/1096-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3408-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4276-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4976-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/5048-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2208-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/1888-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/1240-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3160-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/1664-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4280-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4752-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/1812-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/1900-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/1616-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2872-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/3988-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2352-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2988-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4556-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4900-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/228-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/4372-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2484-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/1932-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral26/memory/2232-838-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3856 wrote to memory of 532 3856 unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe 81 PID 3856 wrote to memory of 532 3856 unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe 81 PID 3856 wrote to memory of 532 3856 unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe 81 PID 532 wrote to memory of 5032 532 ntnnnt.exe 82 PID 532 wrote to memory of 5032 532 ntnnnt.exe 82 PID 532 wrote to memory of 5032 532 ntnnnt.exe 82 PID 5032 wrote to memory of 4984 5032 dddvp.exe 83 PID 5032 wrote to memory of 4984 5032 dddvp.exe 83 PID 5032 wrote to memory of 4984 5032 dddvp.exe 83 PID 4984 wrote to memory of 4980 4984 bnbhhh.exe 84 PID 4984 wrote to memory of 4980 4984 bnbhhh.exe 84 PID 4984 wrote to memory of 4980 4984 bnbhhh.exe 84 PID 4980 wrote to memory of 3832 4980 jjppj.exe 85 PID 4980 wrote to memory of 3832 4980 jjppj.exe 85 PID 4980 wrote to memory of 3832 4980 jjppj.exe 85 PID 3832 wrote to memory of 4776 3832 lffxrxr.exe 86 PID 3832 wrote to memory of 4776 3832 lffxrxr.exe 86 PID 3832 wrote to memory of 4776 3832 lffxrxr.exe 86 PID 4776 wrote to memory of 3408 4776 ntnhtb.exe 87 PID 4776 wrote to memory of 3408 4776 ntnhtb.exe 87 PID 4776 wrote to memory of 3408 4776 ntnhtb.exe 87 PID 3408 wrote to memory of 3524 3408 9ddvv.exe 88 PID 3408 wrote to memory of 3524 3408 9ddvv.exe 88 PID 3408 wrote to memory of 3524 3408 9ddvv.exe 88 PID 3524 wrote to memory of 3064 3524 dpppd.exe 89 PID 3524 wrote to memory of 3064 3524 dpppd.exe 89 PID 3524 wrote to memory of 3064 3524 dpppd.exe 89 PID 3064 wrote to memory of 2916 3064 nntnnn.exe 90 PID 3064 wrote to memory of 2916 3064 nntnnn.exe 90 PID 3064 wrote to memory of 2916 3064 nntnnn.exe 90 PID 2916 wrote to memory of 3760 2916 rrrllrl.exe 91 PID 2916 wrote to memory of 3760 2916 rrrllrl.exe 91 PID 2916 wrote to memory of 3760 2916 rrrllrl.exe 91 PID 3760 wrote to memory of 5040 3760 nhhhbb.exe 92 PID 3760 wrote to memory of 5040 3760 nhhhbb.exe 92 PID 3760 wrote to memory of 5040 3760 nhhhbb.exe 92 PID 5040 wrote to memory of 2072 5040 tttntn.exe 93 PID 5040 wrote to memory of 2072 5040 tttntn.exe 93 PID 5040 wrote to memory of 2072 5040 tttntn.exe 93 PID 2072 wrote to memory of 4512 2072 jvdjd.exe 94 PID 2072 wrote to memory of 4512 2072 jvdjd.exe 94 PID 2072 wrote to memory of 4512 2072 jvdjd.exe 94 PID 4512 wrote to memory of 5016 4512 hnnnth.exe 95 PID 4512 wrote to memory of 5016 4512 hnnnth.exe 95 PID 4512 wrote to memory of 5016 4512 hnnnth.exe 95 PID 5016 wrote to memory of 3476 5016 ppjvv.exe 96 PID 5016 wrote to memory of 3476 5016 ppjvv.exe 96 PID 5016 wrote to memory of 3476 5016 ppjvv.exe 96 PID 3476 wrote to memory of 1520 3476 htnbhn.exe 97 PID 3476 wrote to memory of 1520 3476 htnbhn.exe 97 PID 3476 wrote to memory of 1520 3476 htnbhn.exe 97 PID 1520 wrote to memory of 4324 1520 ddvvp.exe 98 PID 1520 wrote to memory of 4324 1520 ddvvp.exe 98 PID 1520 wrote to memory of 4324 1520 ddvvp.exe 98 PID 4324 wrote to memory of 1148 4324 lxlfxlf.exe 99 PID 4324 wrote to memory of 1148 4324 lxlfxlf.exe 99 PID 4324 wrote to memory of 1148 4324 lxlfxlf.exe 99 PID 1148 wrote to memory of 1636 1148 7htthn.exe 100 PID 1148 wrote to memory of 1636 1148 7htthn.exe 100 PID 1148 wrote to memory of 1636 1148 7htthn.exe 100 PID 1636 wrote to memory of 2028 1636 dvjdd.exe 101 PID 1636 wrote to memory of 2028 1636 dvjdd.exe 101 PID 1636 wrote to memory of 2028 1636 dvjdd.exe 101 PID 2028 wrote to memory of 4928 2028 nhtnnn.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25\unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25\unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\ntnnnt.exec:\ntnnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\dddvp.exec:\dddvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\bnbhhh.exec:\bnbhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\jjppj.exec:\jjppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\lffxrxr.exec:\lffxrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\ntnhtb.exec:\ntnhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\9ddvv.exec:\9ddvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\dpppd.exec:\dpppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\nntnnn.exec:\nntnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\rrrllrl.exec:\rrrllrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\nhhhbb.exec:\nhhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\tttntn.exec:\tttntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\jvdjd.exec:\jvdjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\hnnnth.exec:\hnnnth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\ppjvv.exec:\ppjvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\htnbhn.exec:\htnbhn.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\ddvvp.exec:\ddvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\lxlfxlf.exec:\lxlfxlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\7htthn.exec:\7htthn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\dvjdd.exec:\dvjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\nhtnnn.exec:\nhtnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\vvpvj.exec:\vvpvj.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4928 -
\??\c:\xxxrrrr.exec:\xxxrrrr.exe24⤵
- Executes dropped EXE
PID:4724 -
\??\c:\ffrffrr.exec:\ffrffrr.exe25⤵
- Executes dropped EXE
PID:800 -
\??\c:\bthhhn.exec:\bthhhn.exe26⤵
- Executes dropped EXE
PID:1640 -
\??\c:\dpvpj.exec:\dpvpj.exe27⤵
- Executes dropped EXE
PID:4148 -
\??\c:\nbhbnh.exec:\nbhbnh.exe28⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jvdjd.exec:\jvdjd.exe29⤵
- Executes dropped EXE
PID:788 -
\??\c:\lflfxxx.exec:\lflfxxx.exe30⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bbbthh.exec:\bbbthh.exe31⤵
- Executes dropped EXE
PID:3632 -
\??\c:\3rlfxrf.exec:\3rlfxrf.exe32⤵
- Executes dropped EXE
PID:1176 -
\??\c:\xrxlffr.exec:\xrxlffr.exe33⤵
- Executes dropped EXE
PID:4972 -
\??\c:\pjdpv.exec:\pjdpv.exe34⤵
- Executes dropped EXE
PID:4900 -
\??\c:\rlfrlfx.exec:\rlfrlfx.exe35⤵
- Executes dropped EXE
PID:4552 -
\??\c:\nnhhhn.exec:\nnhhhn.exe36⤵
- Executes dropped EXE
PID:4780 -
\??\c:\9djdv.exec:\9djdv.exe37⤵
- Executes dropped EXE
PID:316 -
\??\c:\frxxlfx.exec:\frxxlfx.exe38⤵
- Executes dropped EXE
PID:392 -
\??\c:\bhhhhb.exec:\bhhhhb.exe39⤵
- Executes dropped EXE
PID:452 -
\??\c:\htnbth.exec:\htnbth.exe40⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ffffrfr.exec:\ffffrfr.exe41⤵
- Executes dropped EXE
PID:4720 -
\??\c:\xrrrlll.exec:\xrrrlll.exe42⤵
- Executes dropped EXE
PID:2308 -
\??\c:\btbttb.exec:\btbttb.exe43⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pddvp.exec:\pddvp.exe44⤵
- Executes dropped EXE
PID:620 -
\??\c:\3xlfrlf.exec:\3xlfrlf.exe45⤵
- Executes dropped EXE
PID:388 -
\??\c:\hhttnn.exec:\hhttnn.exe46⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ttnbnt.exec:\ttnbnt.exe47⤵
- Executes dropped EXE
PID:2284 -
\??\c:\7djpj.exec:\7djpj.exe48⤵
- Executes dropped EXE
PID:4300 -
\??\c:\rlxxffr.exec:\rlxxffr.exe49⤵
- Executes dropped EXE
PID:4740 -
\??\c:\thhntb.exec:\thhntb.exe50⤵
- Executes dropped EXE
PID:1416 -
\??\c:\7nhbbb.exec:\7nhbbb.exe51⤵
- Executes dropped EXE
PID:4012 -
\??\c:\dvvpj.exec:\dvvpj.exe52⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lflxrlf.exec:\lflxrlf.exe53⤵
- Executes dropped EXE
PID:3920 -
\??\c:\7tnnhb.exec:\7tnnhb.exe54⤵
- Executes dropped EXE
PID:1860 -
\??\c:\nhbhbn.exec:\nhbhbn.exe55⤵
- Executes dropped EXE
PID:2936 -
\??\c:\dvvpj.exec:\dvvpj.exe56⤵
- Executes dropped EXE
PID:1616 -
\??\c:\llllxrf.exec:\llllxrf.exe57⤵
- Executes dropped EXE
PID:4320 -
\??\c:\nntbnn.exec:\nntbnn.exe58⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vvpdp.exec:\vvpdp.exe59⤵
- Executes dropped EXE
PID:2864 -
\??\c:\djvpj.exec:\djvpj.exe60⤵
- Executes dropped EXE
PID:1192 -
\??\c:\rfxrffx.exec:\rfxrffx.exe61⤵
- Executes dropped EXE
PID:5056 -
\??\c:\ntnhhn.exec:\ntnhhn.exe62⤵
- Executes dropped EXE
PID:748 -
\??\c:\vpvpj.exec:\vpvpj.exe63⤵
- Executes dropped EXE
PID:312 -
\??\c:\lfrfrlx.exec:\lfrfrlx.exe64⤵
- Executes dropped EXE
PID:3076 -
\??\c:\ttnnnn.exec:\ttnnnn.exe65⤵
- Executes dropped EXE
PID:4208 -
\??\c:\djpdp.exec:\djpdp.exe66⤵PID:1096
-
\??\c:\xrlffxx.exec:\xrlffxx.exe67⤵PID:3020
-
\??\c:\thhbtn.exec:\thhbtn.exe68⤵PID:3408
-
\??\c:\pppvj.exec:\pppvj.exe69⤵PID:1456
-
\??\c:\fllrflf.exec:\fllrflf.exe70⤵PID:1816
-
\??\c:\nbthtn.exec:\nbthtn.exe71⤵PID:3692
-
\??\c:\pddpj.exec:\pddpj.exe72⤵PID:2868
-
\??\c:\xxxlffx.exec:\xxxlffx.exe73⤵PID:2320
-
\??\c:\xrrrlrl.exec:\xrrrlrl.exe74⤵PID:2136
-
\??\c:\bbnhhh.exec:\bbnhhh.exe75⤵PID:4276
-
\??\c:\5dpdj.exec:\5dpdj.exe76⤵PID:4976
-
\??\c:\lfxxxfx.exec:\lfxxxfx.exe77⤵PID:5048
-
\??\c:\9bbnnn.exec:\9bbnnn.exe78⤵PID:1464
-
\??\c:\jpjvj.exec:\jpjvj.exe79⤵
- System Location Discovery: System Language Discovery
PID:4528 -
\??\c:\jjvpv.exec:\jjvpv.exe80⤵PID:2208
-
\??\c:\xxxxxxr.exec:\xxxxxxr.exe81⤵PID:3332
-
\??\c:\nhnttb.exec:\nhnttb.exe82⤵PID:1888
-
\??\c:\jjdvp.exec:\jjdvp.exe83⤵PID:4204
-
\??\c:\vvpdv.exec:\vvpdv.exe84⤵PID:4932
-
\??\c:\lrxffxf.exec:\lrxffxf.exe85⤵PID:1240
-
\??\c:\hbhbnn.exec:\hbhbnn.exe86⤵PID:856
-
\??\c:\ppvpv.exec:\ppvpv.exe87⤵PID:2028
-
\??\c:\fxlrlxf.exec:\fxlrlxf.exe88⤵PID:3380
-
\??\c:\bthbth.exec:\bthbth.exe89⤵PID:3452
-
\??\c:\pjvjp.exec:\pjvjp.exe90⤵PID:3960
-
\??\c:\fxfxllx.exec:\fxfxllx.exe91⤵PID:2596
-
\??\c:\1bbtnh.exec:\1bbtnh.exe92⤵PID:3916
-
\??\c:\nbtnhb.exec:\nbtnhb.exe93⤵PID:2848
-
\??\c:\dpdvv.exec:\dpdvv.exe94⤵PID:3052
-
\??\c:\ffxrfxr.exec:\ffxrfxr.exe95⤵PID:3160
-
\??\c:\lrxfffr.exec:\lrxfffr.exe96⤵PID:3104
-
\??\c:\tnnbnn.exec:\tnnbnn.exe97⤵PID:3172
-
\??\c:\5pjdp.exec:\5pjdp.exe98⤵PID:3972
-
\??\c:\3vddv.exec:\3vddv.exe99⤵PID:1920
-
\??\c:\rfrrrfr.exec:\rfrrrfr.exe100⤵PID:3360
-
\??\c:\ntnhtn.exec:\ntnhtn.exe101⤵PID:3284
-
\??\c:\7jjdp.exec:\7jjdp.exe102⤵PID:3124
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe103⤵PID:2732
-
\??\c:\3tnbtn.exec:\3tnbtn.exe104⤵PID:1064
-
\??\c:\nnhtht.exec:\nnhtht.exe105⤵PID:1664
-
\??\c:\5djvj.exec:\5djvj.exe106⤵PID:3940
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe107⤵PID:4392
-
\??\c:\lflflff.exec:\lflflff.exe108⤵PID:4280
-
\??\c:\hbhbth.exec:\hbhbth.exe109⤵PID:4752
-
\??\c:\9pddp.exec:\9pddp.exe110⤵PID:3412
-
\??\c:\frfxrfr.exec:\frfxrfr.exe111⤵PID:1988
-
\??\c:\htthbn.exec:\htthbn.exe112⤵PID:1812
-
\??\c:\bnnhtt.exec:\bnnhtt.exe113⤵PID:428
-
\??\c:\pjjvj.exec:\pjjvj.exe114⤵PID:1740
-
\??\c:\3rllxlx.exec:\3rllxlx.exe115⤵PID:4544
-
\??\c:\xllfxxr.exec:\xllfxxr.exe116⤵PID:1408
-
\??\c:\hhnnht.exec:\hhnnht.exe117⤵PID:1900
-
\??\c:\9djvp.exec:\9djvp.exe118⤵PID:3912
-
\??\c:\fxlxrxr.exec:\fxlxrxr.exe119⤵PID:4824
-
\??\c:\htnbnn.exec:\htnbnn.exe120⤵PID:1008
-
\??\c:\hhtbht.exec:\hhtbht.exe121⤵PID:2628
-
\??\c:\3jpjj.exec:\3jpjj.exe122⤵PID:5096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-