Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 04:41
Static task
static1
Behavioral task
behavioral1
Sample
f9b57753d8a24987669f07e596989aec4c377eaeaf94fb639ea8cbaa6ca2cd47N.exe
Resource
win7-20240903-en
General
-
Target
f9b57753d8a24987669f07e596989aec4c377eaeaf94fb639ea8cbaa6ca2cd47N.exe
-
Size
74KB
-
MD5
93bbf19da1860bd5e537ab11edeee0d0
-
SHA1
5e9c3ea3b0c64d659963147734a5c060b973e6fb
-
SHA256
f9b57753d8a24987669f07e596989aec4c377eaeaf94fb639ea8cbaa6ca2cd47
-
SHA512
a8c07f28f39e149af4bc8e8bdc6499c736c14bd58756b7c5785b4190bbebc2983f827826a63826381ef988fc3460f1625d928bd670a213cb7ce005bbf70d9825
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmP5O:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHN
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2944-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2944 fflxlxr.exe 2084 ttnhtb.exe 3048 tthnbb.exe 2704 xxrrflx.exe 2700 hhnhbh.exe 2824 ddpvj.exe 2712 ffffxxl.exe 2564 bbnthn.exe 3056 5jddj.exe 1032 vpjjp.exe 304 ffxlrxl.exe 1756 hbhnnn.exe 1264 3tnntt.exe 760 jdvpv.exe 1652 7jvpv.exe 2040 lfrlflf.exe 2532 llllxrx.exe 2996 hbbntb.exe 2396 7pddp.exe 3052 dvvdd.exe 2156 9rlxllr.exe 1044 nhhtnb.exe 2000 tbthht.exe 896 jjddj.exe 928 3rrllxl.exe 2228 rrlrxxf.exe 1508 hhntbn.exe 1240 dvppj.exe 2448 1flrflr.exe 1620 tnnhbh.exe 2080 hntnnb.exe 1684 1jdvj.exe 1780 jvpdd.exe 2656 xxflxxr.exe 2788 1xrllfl.exe 2836 1httbb.exe 2384 tbtnnh.exe 2792 5jvpv.exe 2716 vpppj.exe 2588 fxxxflx.exe 2624 9rrlfrr.exe 2576 1rlflff.exe 1056 bthntt.exe 1716 bthtbb.exe 524 ddvjv.exe 1708 pdjpv.exe 1152 rlrxflx.exe 540 flxxfrf.exe 1968 httntb.exe 1660 bnhhht.exe 1272 nhbhnn.exe 2040 7vppd.exe 1816 xllxxfl.exe 2400 5nhhtt.exe 2968 ttnbnt.exe 448 dpjjp.exe 2724 vjpvj.exe 344 rfrllfl.exe 1540 lxllrxl.exe 1748 rlxlxlr.exe 1812 hbnttt.exe 2868 nhnnhh.exe 1276 9vjjv.exe 2212 pjddv.exe -
resource yara_rule behavioral1/memory/2832-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-275-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2832 wrote to memory of 2944 2832 f9b57753d8a24987669f07e596989aec4c377eaeaf94fb639ea8cbaa6ca2cd47N.exe 31 PID 2832 wrote to memory of 2944 2832 f9b57753d8a24987669f07e596989aec4c377eaeaf94fb639ea8cbaa6ca2cd47N.exe 31 PID 2832 wrote to memory of 2944 2832 f9b57753d8a24987669f07e596989aec4c377eaeaf94fb639ea8cbaa6ca2cd47N.exe 31 PID 2832 wrote to memory of 2944 2832 f9b57753d8a24987669f07e596989aec4c377eaeaf94fb639ea8cbaa6ca2cd47N.exe 31 PID 2944 wrote to memory of 2084 2944 fflxlxr.exe 32 PID 2944 wrote to memory of 2084 2944 fflxlxr.exe 32 PID 2944 wrote to memory of 2084 2944 fflxlxr.exe 32 PID 2944 wrote to memory of 2084 2944 fflxlxr.exe 32 PID 2084 wrote to memory of 3048 2084 ttnhtb.exe 33 PID 2084 wrote to memory of 3048 2084 ttnhtb.exe 33 PID 2084 wrote to memory of 3048 2084 ttnhtb.exe 33 PID 2084 wrote to memory of 3048 2084 ttnhtb.exe 33 PID 3048 wrote to memory of 2704 3048 tthnbb.exe 34 PID 3048 wrote to memory of 2704 3048 tthnbb.exe 34 PID 3048 wrote to memory of 2704 3048 tthnbb.exe 34 PID 3048 wrote to memory of 2704 3048 tthnbb.exe 34 PID 2704 wrote to memory of 2700 2704 xxrrflx.exe 35 PID 2704 wrote to memory of 2700 2704 xxrrflx.exe 35 PID 2704 wrote to memory of 2700 2704 xxrrflx.exe 35 PID 2704 wrote to memory of 2700 2704 xxrrflx.exe 35 PID 2700 wrote to memory of 2824 2700 hhnhbh.exe 36 PID 2700 wrote to memory of 2824 2700 hhnhbh.exe 36 PID 2700 wrote to memory of 2824 2700 hhnhbh.exe 36 PID 2700 wrote to memory of 2824 2700 hhnhbh.exe 36 PID 2824 wrote to memory of 2712 2824 ddpvj.exe 37 PID 2824 wrote to memory of 2712 2824 ddpvj.exe 37 PID 2824 wrote to memory of 2712 2824 ddpvj.exe 37 PID 2824 wrote to memory of 2712 2824 ddpvj.exe 37 PID 2712 wrote to memory of 2564 2712 ffffxxl.exe 38 PID 2712 wrote to memory of 2564 2712 ffffxxl.exe 38 PID 2712 wrote to memory of 2564 2712 ffffxxl.exe 38 PID 2712 wrote to memory of 2564 2712 ffffxxl.exe 38 PID 2564 wrote to memory of 3056 2564 bbnthn.exe 39 PID 2564 wrote to memory of 3056 2564 bbnthn.exe 39 PID 2564 wrote to memory of 3056 2564 bbnthn.exe 39 PID 2564 wrote to memory of 3056 2564 bbnthn.exe 39 PID 3056 wrote to memory of 1032 3056 5jddj.exe 40 PID 3056 wrote to memory of 1032 3056 5jddj.exe 40 PID 3056 wrote to memory of 1032 3056 5jddj.exe 40 PID 3056 wrote to memory of 1032 3056 5jddj.exe 40 PID 1032 wrote to memory of 304 1032 vpjjp.exe 41 PID 1032 wrote to memory of 304 1032 vpjjp.exe 41 PID 1032 wrote to memory of 304 1032 vpjjp.exe 41 PID 1032 wrote to memory of 304 1032 vpjjp.exe 41 PID 304 wrote to memory of 1756 304 ffxlrxl.exe 42 PID 304 wrote to memory of 1756 304 ffxlrxl.exe 42 PID 304 wrote to memory of 1756 304 ffxlrxl.exe 42 PID 304 wrote to memory of 1756 304 ffxlrxl.exe 42 PID 1756 wrote to memory of 1264 1756 hbhnnn.exe 43 PID 1756 wrote to memory of 1264 1756 hbhnnn.exe 43 PID 1756 wrote to memory of 1264 1756 hbhnnn.exe 43 PID 1756 wrote to memory of 1264 1756 hbhnnn.exe 43 PID 1264 wrote to memory of 760 1264 3tnntt.exe 44 PID 1264 wrote to memory of 760 1264 3tnntt.exe 44 PID 1264 wrote to memory of 760 1264 3tnntt.exe 44 PID 1264 wrote to memory of 760 1264 3tnntt.exe 44 PID 760 wrote to memory of 1652 760 jdvpv.exe 45 PID 760 wrote to memory of 1652 760 jdvpv.exe 45 PID 760 wrote to memory of 1652 760 jdvpv.exe 45 PID 760 wrote to memory of 1652 760 jdvpv.exe 45 PID 1652 wrote to memory of 2040 1652 7jvpv.exe 46 PID 1652 wrote to memory of 2040 1652 7jvpv.exe 46 PID 1652 wrote to memory of 2040 1652 7jvpv.exe 46 PID 1652 wrote to memory of 2040 1652 7jvpv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9b57753d8a24987669f07e596989aec4c377eaeaf94fb639ea8cbaa6ca2cd47N.exe"C:\Users\Admin\AppData\Local\Temp\f9b57753d8a24987669f07e596989aec4c377eaeaf94fb639ea8cbaa6ca2cd47N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\fflxlxr.exec:\fflxlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\ttnhtb.exec:\ttnhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\tthnbb.exec:\tthnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\xxrrflx.exec:\xxrrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hhnhbh.exec:\hhnhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ddpvj.exec:\ddpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ffffxxl.exec:\ffffxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\bbnthn.exec:\bbnthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\5jddj.exec:\5jddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\vpjjp.exec:\vpjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\hbhnnn.exec:\hbhnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\3tnntt.exec:\3tnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\jdvpv.exec:\jdvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\7jvpv.exec:\7jvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\lfrlflf.exec:\lfrlflf.exe17⤵
- Executes dropped EXE
PID:2040 -
\??\c:\llllxrx.exec:\llllxrx.exe18⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hbbntb.exec:\hbbntb.exe19⤵
- Executes dropped EXE
PID:2996 -
\??\c:\7pddp.exec:\7pddp.exe20⤵
- Executes dropped EXE
PID:2396 -
\??\c:\dvvdd.exec:\dvvdd.exe21⤵
- Executes dropped EXE
PID:3052 -
\??\c:\9rlxllr.exec:\9rlxllr.exe22⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nhhtnb.exec:\nhhtnb.exe23⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tbthht.exec:\tbthht.exe24⤵
- Executes dropped EXE
PID:2000 -
\??\c:\jjddj.exec:\jjddj.exe25⤵
- Executes dropped EXE
PID:896 -
\??\c:\3rrllxl.exec:\3rrllxl.exe26⤵
- Executes dropped EXE
PID:928 -
\??\c:\rrlrxxf.exec:\rrlrxxf.exe27⤵
- Executes dropped EXE
PID:2228 -
\??\c:\hhntbn.exec:\hhntbn.exe28⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dvppj.exec:\dvppj.exe29⤵
- Executes dropped EXE
PID:1240 -
\??\c:\1flrflr.exec:\1flrflr.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tnnhbh.exec:\tnnhbh.exe31⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hntnnb.exec:\hntnnb.exe32⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1jdvj.exec:\1jdvj.exe33⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jvpdd.exec:\jvpdd.exe34⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xxflxxr.exec:\xxflxxr.exe35⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1xrllfl.exec:\1xrllfl.exe36⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1httbb.exec:\1httbb.exe37⤵
- Executes dropped EXE
PID:2836 -
\??\c:\tbtnnh.exec:\tbtnnh.exe38⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5jvpv.exec:\5jvpv.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vpppj.exec:\vpppj.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fxxxflx.exec:\fxxxflx.exe41⤵
- Executes dropped EXE
PID:2588 -
\??\c:\9rrlfrr.exec:\9rrlfrr.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1rlflff.exec:\1rlflff.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2576 -
\??\c:\bthntt.exec:\bthntt.exe44⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bthtbb.exec:\bthtbb.exe45⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ddvjv.exec:\ddvjv.exe46⤵
- Executes dropped EXE
PID:524 -
\??\c:\pdjpv.exec:\pdjpv.exe47⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rlrxflx.exec:\rlrxflx.exe48⤵
- Executes dropped EXE
PID:1152 -
\??\c:\flxxfrf.exec:\flxxfrf.exe49⤵
- Executes dropped EXE
PID:540 -
\??\c:\httntb.exec:\httntb.exe50⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bnhhht.exec:\bnhhht.exe51⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nhbhnn.exec:\nhbhnn.exe52⤵
- Executes dropped EXE
PID:1272 -
\??\c:\7vppd.exec:\7vppd.exe53⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xllxxfl.exec:\xllxxfl.exe54⤵
- Executes dropped EXE
PID:1816 -
\??\c:\5nhhtt.exec:\5nhhtt.exe55⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ttnbnt.exec:\ttnbnt.exe56⤵
- Executes dropped EXE
PID:2968 -
\??\c:\dpjjp.exec:\dpjjp.exe57⤵
- Executes dropped EXE
PID:448 -
\??\c:\vjpvj.exec:\vjpvj.exe58⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rfrllfl.exec:\rfrllfl.exe59⤵
- Executes dropped EXE
PID:344 -
\??\c:\lxllrxl.exec:\lxllrxl.exe60⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rlxlxlr.exec:\rlxlxlr.exe61⤵
- Executes dropped EXE
PID:1748 -
\??\c:\hbnttt.exec:\hbnttt.exe62⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nhnnhh.exec:\nhnnhh.exe63⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9vjjv.exec:\9vjjv.exe64⤵
- Executes dropped EXE
PID:1276 -
\??\c:\pjddv.exec:\pjddv.exe65⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rxxflrl.exec:\rxxflrl.exe66⤵PID:2312
-
\??\c:\lxlllfl.exec:\lxlllfl.exe67⤵PID:3028
-
\??\c:\bnhthn.exec:\bnhthn.exe68⤵PID:2832
-
\??\c:\nntthb.exec:\nntthb.exe69⤵PID:2448
-
\??\c:\5pppp.exec:\5pppp.exe70⤵PID:3016
-
\??\c:\jdjdj.exec:\jdjdj.exe71⤵PID:348
-
\??\c:\7lrlrxf.exec:\7lrlrxf.exe72⤵PID:1948
-
\??\c:\xlrlffr.exec:\xlrlffr.exe73⤵PID:2640
-
\??\c:\nnbtth.exec:\nnbtth.exe74⤵PID:2392
-
\??\c:\9hnttt.exec:\9hnttt.exe75⤵PID:2892
-
\??\c:\pjvpp.exec:\pjvpp.exe76⤵PID:2672
-
\??\c:\7xlflfl.exec:\7xlflfl.exe77⤵PID:2708
-
\??\c:\frxflfl.exec:\frxflfl.exe78⤵PID:2728
-
\??\c:\3lffffl.exec:\3lffffl.exe79⤵PID:2820
-
\??\c:\btbbnn.exec:\btbbnn.exe80⤵PID:2720
-
\??\c:\pjjpd.exec:\pjjpd.exe81⤵PID:3012
-
\??\c:\ddvdp.exec:\ddvdp.exe82⤵PID:1852
-
\??\c:\xxrfflr.exec:\xxrfflr.exe83⤵PID:1656
-
\??\c:\htbhnn.exec:\htbhnn.exe84⤵PID:1008
-
\??\c:\3nhtbb.exec:\3nhtbb.exe85⤵PID:532
-
\??\c:\vpdjd.exec:\vpdjd.exe86⤵PID:1704
-
\??\c:\pjvvd.exec:\pjvvd.exe87⤵PID:568
-
\??\c:\xrfxffr.exec:\xrfxffr.exe88⤵PID:2376
-
\??\c:\xlfflrx.exec:\xlfflrx.exe89⤵PID:540
-
\??\c:\hbttnn.exec:\hbttnn.exe90⤵PID:1652
-
\??\c:\nbtntb.exec:\nbtntb.exe91⤵PID:2604
-
\??\c:\dddjp.exec:\dddjp.exe92⤵PID:2872
-
\??\c:\rflxflr.exec:\rflxflr.exe93⤵PID:2992
-
\??\c:\7rlxlrf.exec:\7rlxlrf.exe94⤵PID:1816
-
\??\c:\hbthnn.exec:\hbthnn.exe95⤵PID:1996
-
\??\c:\7nhtbn.exec:\7nhtbn.exe96⤵PID:772
-
\??\c:\pjdpv.exec:\pjdpv.exe97⤵PID:1720
-
\??\c:\djdvj.exec:\djdvj.exe98⤵PID:1632
-
\??\c:\xrfflrf.exec:\xrfflrf.exe99⤵PID:1044
-
\??\c:\xlllflr.exec:\xlllflr.exe100⤵PID:2000
-
\??\c:\nnhnhn.exec:\nnhnhn.exe101⤵PID:940
-
\??\c:\ttttht.exec:\ttttht.exe102⤵PID:1776
-
\??\c:\vjpvp.exec:\vjpvp.exe103⤵PID:1564
-
\??\c:\xrrxlfl.exec:\xrrxlfl.exe104⤵PID:1276
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe105⤵PID:872
-
\??\c:\bthnbb.exec:\bthnbb.exe106⤵PID:2316
-
\??\c:\hbnthn.exec:\hbnthn.exe107⤵PID:2192
-
\??\c:\dpvvv.exec:\dpvvv.exe108⤵PID:1588
-
\??\c:\jdppd.exec:\jdppd.exe109⤵PID:2944
-
\??\c:\rxlxlxf.exec:\rxlxlxf.exe110⤵PID:1912
-
\??\c:\ffflxxl.exec:\ffflxxl.exe111⤵PID:2164
-
\??\c:\nhbttb.exec:\nhbttb.exe112⤵PID:2688
-
\??\c:\ppjpj.exec:\ppjpj.exe113⤵PID:2760
-
\??\c:\pdvvd.exec:\pdvvd.exe114⤵PID:2748
-
\??\c:\xrrrxrr.exec:\xrrrxrr.exe115⤵PID:3064
-
\??\c:\btthhb.exec:\btthhb.exe116⤵PID:2764
-
\??\c:\hbhtbn.exec:\hbhtbn.exe117⤵PID:2580
-
\??\c:\5vpvv.exec:\5vpvv.exe118⤵PID:2544
-
\??\c:\pjjjd.exec:\pjjjd.exe119⤵PID:2980
-
\??\c:\5fxxffl.exec:\5fxxffl.exe120⤵PID:2356
-
\??\c:\rxlrffl.exec:\rxlrffl.exe121⤵PID:2564
-
\??\c:\nnhtbb.exec:\nnhtbb.exe122⤵PID:1852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-