Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
05/08/2024, 11:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84662193a084a8a84001e14c27b1a600N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
84662193a084a8a84001e14c27b1a600N.exe
-
Size
123KB
-
MD5
84662193a084a8a84001e14c27b1a600
-
SHA1
8f8e0bd0cb951d025dea233a5a318c5eee82811d
-
SHA256
1356da78c06b99468c12625e9468784239787fd3194914ae2448c40cd38f51ab
-
SHA512
77770188215e978842e7cfdd8e82b81092f705d0c6563a01e6b07c731eaf2c4a4fa010c5ca17dad93d21d1aaf07d470ef7c895e41e65a4171d0a7390a4d797ca
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73oYUCD7R2F2UVbyy0NgVyFsJJ:ymb3NkkiQ3mdBjFo73HUoMsAbrxVbV
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2776-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-68-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1292-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2856 nhtnbh.exe 2892 vvjvj.exe 2612 jdvvp.exe 2632 fxffrrf.exe 2616 nnhbnt.exe 1652 jjvjp.exe 944 ffrxrxl.exe 1776 9ddjv.exe 1968 pjdjp.exe 1452 3xxflxl.exe 1196 tththn.exe 2100 nhthbb.exe 1292 djpvp.exe 1712 rrxxllr.exe 2180 hbntnb.exe 2232 5ddvj.exe 1816 jdvvp.exe 324 lxllflx.exe 2204 lfflrxf.exe 2456 tnhntt.exe 2424 nnhtth.exe 960 1dppj.exe 2092 rrlxffr.exe 580 nnhnbh.exe 1468 9hhtnt.exe 1976 pjjpp.exe 1952 pddvj.exe 1396 frxllxx.exe 1088 hhhnhn.exe 3020 jjjpd.exe 2856 7vddj.exe 2972 rrllflf.exe 1612 bhhnbn.exe 2752 hhnttt.exe 2612 1jjvv.exe 1924 3vvjv.exe 2704 3xlrxlx.exe 3056 lfrlxlx.exe 1036 hhbtnn.exe 1016 nhnthh.exe 2564 ppdjd.exe 1644 ppdjv.exe 2544 jdppd.exe 1260 ffxrflx.exe 1320 7xfrfrf.exe 1448 ttnbtt.exe 988 nhthhn.exe 1292 pjdjv.exe 2228 vpvjj.exe 308 xlxlxfr.exe 772 fxffrfr.exe 264 rlffxlf.exe 324 btbhtt.exe 1156 3bbhth.exe 2152 pjddp.exe 1060 vvvdj.exe 2428 fffrfxr.exe 2216 xxxlflx.exe 928 tntbtt.exe 1748 bbhnbb.exe 700 ppjpj.exe 2328 pjppj.exe 2096 xrlxrrf.exe 872 xfxlfrl.exe -
resource yara_rule behavioral1/memory/2776-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1196-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-234-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2856 2776 84662193a084a8a84001e14c27b1a600N.exe 30 PID 2776 wrote to memory of 2856 2776 84662193a084a8a84001e14c27b1a600N.exe 30 PID 2776 wrote to memory of 2856 2776 84662193a084a8a84001e14c27b1a600N.exe 30 PID 2776 wrote to memory of 2856 2776 84662193a084a8a84001e14c27b1a600N.exe 30 PID 2856 wrote to memory of 2892 2856 nhtnbh.exe 31 PID 2856 wrote to memory of 2892 2856 nhtnbh.exe 31 PID 2856 wrote to memory of 2892 2856 nhtnbh.exe 31 PID 2856 wrote to memory of 2892 2856 nhtnbh.exe 31 PID 2892 wrote to memory of 2612 2892 vvjvj.exe 32 PID 2892 wrote to memory of 2612 2892 vvjvj.exe 32 PID 2892 wrote to memory of 2612 2892 vvjvj.exe 32 PID 2892 wrote to memory of 2612 2892 vvjvj.exe 32 PID 2612 wrote to memory of 2632 2612 jdvvp.exe 33 PID 2612 wrote to memory of 2632 2612 jdvvp.exe 33 PID 2612 wrote to memory of 2632 2612 jdvvp.exe 33 PID 2612 wrote to memory of 2632 2612 jdvvp.exe 33 PID 2632 wrote to memory of 2616 2632 fxffrrf.exe 34 PID 2632 wrote to memory of 2616 2632 fxffrrf.exe 34 PID 2632 wrote to memory of 2616 2632 fxffrrf.exe 34 PID 2632 wrote to memory of 2616 2632 fxffrrf.exe 34 PID 2616 wrote to memory of 1652 2616 nnhbnt.exe 35 PID 2616 wrote to memory of 1652 2616 nnhbnt.exe 35 PID 2616 wrote to memory of 1652 2616 nnhbnt.exe 35 PID 2616 wrote to memory of 1652 2616 nnhbnt.exe 35 PID 1652 wrote to memory of 944 1652 jjvjp.exe 36 PID 1652 wrote to memory of 944 1652 jjvjp.exe 36 PID 1652 wrote to memory of 944 1652 jjvjp.exe 36 PID 1652 wrote to memory of 944 1652 jjvjp.exe 36 PID 944 wrote to memory of 1776 944 ffrxrxl.exe 37 PID 944 wrote to memory of 1776 944 ffrxrxl.exe 37 PID 944 wrote to memory of 1776 944 ffrxrxl.exe 37 PID 944 wrote to memory of 1776 944 ffrxrxl.exe 37 PID 1776 wrote to memory of 1968 1776 9ddjv.exe 38 PID 1776 wrote to memory of 1968 1776 9ddjv.exe 38 PID 1776 wrote to memory of 1968 1776 9ddjv.exe 38 PID 1776 wrote to memory of 1968 1776 9ddjv.exe 38 PID 1968 wrote to memory of 1452 1968 pjdjp.exe 39 PID 1968 wrote to memory of 1452 1968 pjdjp.exe 39 PID 1968 wrote to memory of 1452 1968 pjdjp.exe 39 PID 1968 wrote to memory of 1452 1968 pjdjp.exe 39 PID 1452 wrote to memory of 1196 1452 3xxflxl.exe 40 PID 1452 wrote to memory of 1196 1452 3xxflxl.exe 40 PID 1452 wrote to memory of 1196 1452 3xxflxl.exe 40 PID 1452 wrote to memory of 1196 1452 3xxflxl.exe 40 PID 1196 wrote to memory of 2100 1196 tththn.exe 41 PID 1196 wrote to memory of 2100 1196 tththn.exe 41 PID 1196 wrote to memory of 2100 1196 tththn.exe 41 PID 1196 wrote to memory of 2100 1196 tththn.exe 41 PID 2100 wrote to memory of 1292 2100 nhthbb.exe 42 PID 2100 wrote to memory of 1292 2100 nhthbb.exe 42 PID 2100 wrote to memory of 1292 2100 nhthbb.exe 42 PID 2100 wrote to memory of 1292 2100 nhthbb.exe 42 PID 1292 wrote to memory of 1712 1292 djpvp.exe 43 PID 1292 wrote to memory of 1712 1292 djpvp.exe 43 PID 1292 wrote to memory of 1712 1292 djpvp.exe 43 PID 1292 wrote to memory of 1712 1292 djpvp.exe 43 PID 1712 wrote to memory of 2180 1712 rrxxllr.exe 44 PID 1712 wrote to memory of 2180 1712 rrxxllr.exe 44 PID 1712 wrote to memory of 2180 1712 rrxxllr.exe 44 PID 1712 wrote to memory of 2180 1712 rrxxllr.exe 44 PID 2180 wrote to memory of 2232 2180 hbntnb.exe 45 PID 2180 wrote to memory of 2232 2180 hbntnb.exe 45 PID 2180 wrote to memory of 2232 2180 hbntnb.exe 45 PID 2180 wrote to memory of 2232 2180 hbntnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\84662193a084a8a84001e14c27b1a600N.exe"C:\Users\Admin\AppData\Local\Temp\84662193a084a8a84001e14c27b1a600N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nhtnbh.exec:\nhtnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vvjvj.exec:\vvjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\jdvvp.exec:\jdvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\fxffrrf.exec:\fxffrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\nnhbnt.exec:\nnhbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jjvjp.exec:\jjvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\ffrxrxl.exec:\ffrxrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\9ddjv.exec:\9ddjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\pjdjp.exec:\pjdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\3xxflxl.exec:\3xxflxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\tththn.exec:\tththn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\nhthbb.exec:\nhthbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\djpvp.exec:\djpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\rrxxllr.exec:\rrxxllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\hbntnb.exec:\hbntnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\5ddvj.exec:\5ddvj.exe17⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jdvvp.exec:\jdvvp.exe18⤵
- Executes dropped EXE
PID:1816 -
\??\c:\lxllflx.exec:\lxllflx.exe19⤵
- Executes dropped EXE
PID:324 -
\??\c:\lfflrxf.exec:\lfflrxf.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\tnhntt.exec:\tnhntt.exe21⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nnhtth.exec:\nnhtth.exe22⤵
- Executes dropped EXE
PID:2424 -
\??\c:\1dppj.exec:\1dppj.exe23⤵
- Executes dropped EXE
PID:960 -
\??\c:\rrlxffr.exec:\rrlxffr.exe24⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nnhnbh.exec:\nnhnbh.exe25⤵
- Executes dropped EXE
PID:580 -
\??\c:\9hhtnt.exec:\9hhtnt.exe26⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pjjpp.exec:\pjjpp.exe27⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pddvj.exec:\pddvj.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\frxllxx.exec:\frxllxx.exe29⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hhhnhn.exec:\hhhnhn.exe30⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jjjpd.exec:\jjjpd.exe31⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7vddj.exec:\7vddj.exe32⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rrllflf.exec:\rrllflf.exe33⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bhhnbn.exec:\bhhnbn.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hhnttt.exec:\hhnttt.exe35⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1jjvv.exec:\1jjvv.exe36⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3vvjv.exec:\3vvjv.exe37⤵
- Executes dropped EXE
PID:1924 -
\??\c:\3xlrxlx.exec:\3xlrxlx.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lfrlxlx.exec:\lfrlxlx.exe39⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hhbtnn.exec:\hhbtnn.exe40⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nhnthh.exec:\nhnthh.exe41⤵
- Executes dropped EXE
PID:1016 -
\??\c:\ppdjd.exec:\ppdjd.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ppdjv.exec:\ppdjv.exe43⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jdppd.exec:\jdppd.exe44⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ffxrflx.exec:\ffxrflx.exe45⤵
- Executes dropped EXE
PID:1260 -
\??\c:\7xfrfrf.exec:\7xfrfrf.exe46⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ttnbtt.exec:\ttnbtt.exe47⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nhthhn.exec:\nhthhn.exe48⤵
- Executes dropped EXE
PID:988 -
\??\c:\pjdjv.exec:\pjdjv.exe49⤵
- Executes dropped EXE
PID:1292 -
\??\c:\vpvjj.exec:\vpvjj.exe50⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xlxlxfr.exec:\xlxlxfr.exe51⤵
- Executes dropped EXE
PID:308 -
\??\c:\fxffrfr.exec:\fxffrfr.exe52⤵
- Executes dropped EXE
PID:772 -
\??\c:\rlffxlf.exec:\rlffxlf.exe53⤵
- Executes dropped EXE
PID:264 -
\??\c:\btbhtt.exec:\btbhtt.exe54⤵
- Executes dropped EXE
PID:324 -
\??\c:\3bbhth.exec:\3bbhth.exe55⤵
- Executes dropped EXE
PID:1156 -
\??\c:\pjddp.exec:\pjddp.exe56⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vvvdj.exec:\vvvdj.exe57⤵
- Executes dropped EXE
PID:1060 -
\??\c:\fffrfxr.exec:\fffrfxr.exe58⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xxxlflx.exec:\xxxlflx.exe59⤵
- Executes dropped EXE
PID:2216 -
\??\c:\tntbtt.exec:\tntbtt.exe60⤵
- Executes dropped EXE
PID:928 -
\??\c:\bbhnbb.exec:\bbhnbb.exe61⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ppjpj.exec:\ppjpj.exe62⤵
- Executes dropped EXE
PID:700 -
\??\c:\pjppj.exec:\pjppj.exe63⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xrlxrrf.exec:\xrlxrrf.exe64⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xfxlfrl.exec:\xfxlfrl.exe65⤵
- Executes dropped EXE
PID:872 -
\??\c:\7nnhth.exec:\7nnhth.exe66⤵PID:2932
-
\??\c:\3nhhtb.exec:\3nhhtb.exe67⤵PID:1480
-
\??\c:\jjjvp.exec:\jjjvp.exe68⤵PID:1088
-
\??\c:\lxllrxl.exec:\lxllrxl.exe69⤵PID:2668
-
\??\c:\xlxxflx.exec:\xlxxflx.exe70⤵PID:2984
-
\??\c:\ttbnnh.exec:\ttbnnh.exe71⤵PID:2892
-
\??\c:\nhthhn.exec:\nhthhn.exe72⤵PID:2108
-
\??\c:\pjvvp.exec:\pjvvp.exe73⤵PID:1612
-
\??\c:\7vvdp.exec:\7vvdp.exe74⤵PID:2752
-
\??\c:\rrlxflx.exec:\rrlxflx.exe75⤵PID:2612
-
\??\c:\7lrfrxl.exec:\7lrfrxl.exe76⤵PID:2556
-
\??\c:\nnnntt.exec:\nnnntt.exe77⤵PID:3044
-
\??\c:\hbhnhn.exec:\hbhnhn.exe78⤵PID:1744
-
\??\c:\pjvdv.exec:\pjvdv.exe79⤵PID:1036
-
\??\c:\xxfxrxf.exec:\xxfxrxf.exe80⤵PID:2336
-
\??\c:\xxlrfrf.exec:\xxlrfrf.exe81⤵PID:2564
-
\??\c:\1bhbnb.exec:\1bhbnb.exe82⤵PID:2404
-
\??\c:\nnntbh.exec:\nnntbh.exe83⤵PID:2544
-
\??\c:\vjvpp.exec:\vjvpp.exe84⤵PID:2476
-
\??\c:\3rrrxxl.exec:\3rrrxxl.exe85⤵PID:2624
-
\??\c:\rrlfrxr.exec:\rrlfrxr.exe86⤵PID:288
-
\??\c:\bbtnht.exec:\bbtnht.exe87⤵PID:1792
-
\??\c:\hbnhtb.exec:\hbnhtb.exe88⤵PID:836
-
\??\c:\1vjdj.exec:\1vjdj.exe89⤵PID:2180
-
\??\c:\vdjdp.exec:\vdjdp.exe90⤵PID:804
-
\??\c:\rrllxlx.exec:\rrllxlx.exe91⤵PID:2124
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe92⤵PID:2472
-
\??\c:\ttthnb.exec:\ttthnb.exe93⤵PID:2240
-
\??\c:\bbtbtt.exec:\bbtbtt.exe94⤵PID:2456
-
\??\c:\dpdpj.exec:\dpdpj.exe95⤵PID:1128
-
\??\c:\5xrrlxx.exec:\5xrrlxx.exe96⤵PID:536
-
\??\c:\fxllxfx.exec:\fxllxfx.exe97⤵
- System Location Discovery: System Language Discovery
PID:992 -
\??\c:\nhtbth.exec:\nhtbth.exe98⤵PID:2384
-
\??\c:\9htbbt.exec:\9htbbt.exe99⤵PID:984
-
\??\c:\9vdjj.exec:\9vdjj.exe100⤵PID:1468
-
\??\c:\rlfflrf.exec:\rlfflrf.exe101⤵PID:1492
-
\??\c:\xflrrrf.exec:\xflrrrf.exe102⤵PID:2328
-
\??\c:\bthbnn.exec:\bthbnn.exe103⤵PID:1952
-
\??\c:\7bbntt.exec:\7bbntt.exe104⤵PID:1956
-
\??\c:\3jppp.exec:\3jppp.exe105⤵PID:1076
-
\??\c:\ddpjv.exec:\ddpjv.exe106⤵PID:2776
-
\??\c:\fxxfrxf.exec:\fxxfrxf.exe107⤵PID:2864
-
\??\c:\1xfxllr.exec:\1xfxllr.exe108⤵PID:2856
-
\??\c:\hnhhnh.exec:\hnhhnh.exe109⤵PID:2740
-
\??\c:\bthnbb.exec:\bthnbb.exe110⤵PID:2756
-
\??\c:\jpjpd.exec:\jpjpd.exe111⤵PID:2976
-
\??\c:\xxxxfrx.exec:\xxxxfrx.exe112⤵PID:2584
-
\??\c:\lfrxrxf.exec:\lfrxrxf.exe113⤵PID:2648
-
\??\c:\tnttbt.exec:\tnttbt.exe114⤵PID:2604
-
\??\c:\nnbbtb.exec:\nnbbtb.exe115⤵PID:2420
-
\??\c:\ppdjp.exec:\ppdjp.exe116⤵PID:2032
-
\??\c:\dvppd.exec:\dvppd.exe117⤵PID:2568
-
\??\c:\3xrrfxl.exec:\3xrrfxl.exe118⤵PID:1776
-
\??\c:\tnnntb.exec:\tnnntb.exe119⤵PID:1920
-
\??\c:\hhtbnh.exec:\hhtbnh.exe120⤵PID:1460
-
\??\c:\ddjvp.exec:\ddjvp.exe121⤵PID:1720
-
\??\c:\5vvpd.exec:\5vvpd.exe122⤵PID:1196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-