Analysis
-
max time kernel
120s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 16:37
Static task
static1
Behavioral task
behavioral1
Sample
2fecb3c2fda7017609cb6d5837a60810N.exe
Resource
win7-20240705-en
General
-
Target
2fecb3c2fda7017609cb6d5837a60810N.exe
-
Size
77KB
-
MD5
2fecb3c2fda7017609cb6d5837a60810
-
SHA1
77456efa28d0c97c4109b388a285205b8eca9fbb
-
SHA256
1ed8319b64569a247d47dde52386ac518205451f1f053afac25f3b78f8c007a7
-
SHA512
ad5207f85e2c07c8a21279eaed878037728840a12372c54deb47a32004a8a0ed6a5f25f80eed851ebb11aa14e11fa15baa339d37647abff2eeeebf3072e9168a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIEgxdaqXU63hZ7Cp89Bm8:ymb3NkkiQ3mdBjFIEgSqtRZ7t9Bm8
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1672-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fllfxxx.exehhtbhh.exevdvpd.exerrffxfx.exenthbnb.exejjddv.exerrffxxl.exehbhbbt.exeppvpp.exepvpjd.exexxrlfxr.exetthbtn.exehbbbnn.exepdpdd.exeflrxflf.exe9jppp.exerlffxrr.exexlrlfxx.exehbbtnh.exe7ddvp.exelxlxlrx.exe5nbttb.exejpjdd.exelxxfxxx.exe9nthnn.exe7jpjd.exefxrllfl.exelxrxrrl.exennhnbh.exevvpvj.exexrllllf.exetnnhbb.exehnhnbb.exe3vjdp.exefrllffx.exetnnhtn.exedjddp.exe3rxxfxf.exe9ntnbb.exetnbtnt.exe7dddp.exevvpjv.exerffxllf.exexffxrll.exehnbbtb.exevpjpd.exexlrrrfx.exefflfrrl.exebbbhbb.exevvvvv.exelfllfff.exehnnttb.exenntnhh.exedjjdp.exeddjvp.exexrxrrlr.exethhhbt.exehnbnbh.exedvvvp.exellrfrfr.exefrxlfrl.exehbbtnh.exedvpjd.exe3vjjd.exepid process 3460 fllfxxx.exe 1880 hhtbhh.exe 4580 vdvpd.exe 4560 rrffxfx.exe 2460 nthbnb.exe 1968 jjddv.exe 2100 rrffxxl.exe 884 hbhbbt.exe 1020 ppvpp.exe 1624 pvpjd.exe 1068 xxrlfxr.exe 3908 tthbtn.exe 1384 hbbbnn.exe 4020 pdpdd.exe 2748 flrxflf.exe 2680 9jppp.exe 3428 rlffxrr.exe 3696 xlrlfxx.exe 2424 hbbtnh.exe 2288 7ddvp.exe 464 lxlxlrx.exe 4356 5nbttb.exe 2036 jpjdd.exe 968 lxxfxxx.exe 2928 9nthnn.exe 1660 7jpjd.exe 1084 fxrllfl.exe 1776 lxrxrrl.exe 4748 nnhnbh.exe 4900 vvpvj.exe 2376 xrllllf.exe 1172 tnnhbb.exe 2664 hnhnbb.exe 4964 3vjdp.exe 532 frllffx.exe 1044 tnnhtn.exe 1540 djddp.exe 3508 3rxxfxf.exe 3976 9ntnbb.exe 3248 tnbtnt.exe 3224 7dddp.exe 1840 vvpjv.exe 3732 rffxllf.exe 4024 xffxrll.exe 692 hnbbtb.exe 740 vpjpd.exe 912 xlrrrfx.exe 2040 fflfrrl.exe 3548 bbbhbb.exe 3480 vvvvv.exe 3512 lfllfff.exe 1980 hnnttb.exe 3052 nntnhh.exe 4520 djjdp.exe 2748 ddjvp.exe 3684 xrxrrlr.exe 1916 thhhbt.exe 3304 hnbnbh.exe 4380 dvvvp.exe 2424 llrfrfr.exe 2868 frxlfrl.exe 2144 hbbtnh.exe 2012 dvpjd.exe 3904 3vjjd.exe -
Processes:
resource yara_rule behavioral2/memory/1672-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hbhnhn.exehbbbbb.exelxlxlrx.exelflfllx.exerxxrrlf.exejvjdd.exefffffff.exejpdpd.exejjjpd.exelfxlrxr.exebnnnhn.exenhhhhn.exehthbbb.exexrffxff.exerlxrllx.exentbhbb.exerxxxflf.exevvjdj.exehbnntt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2fecb3c2fda7017609cb6d5837a60810N.exefllfxxx.exehhtbhh.exevdvpd.exerrffxfx.exenthbnb.exejjddv.exerrffxxl.exehbhbbt.exeppvpp.exepvpjd.exexxrlfxr.exetthbtn.exehbbbnn.exepdpdd.exeflrxflf.exe9jppp.exerlffxrr.exexlrlfxx.exehbbtnh.exe7ddvp.exelxlxlrx.exedescription pid process target process PID 1672 wrote to memory of 3460 1672 2fecb3c2fda7017609cb6d5837a60810N.exe fllfxxx.exe PID 1672 wrote to memory of 3460 1672 2fecb3c2fda7017609cb6d5837a60810N.exe fllfxxx.exe PID 1672 wrote to memory of 3460 1672 2fecb3c2fda7017609cb6d5837a60810N.exe fllfxxx.exe PID 3460 wrote to memory of 1880 3460 fllfxxx.exe hhtbhh.exe PID 3460 wrote to memory of 1880 3460 fllfxxx.exe hhtbhh.exe PID 3460 wrote to memory of 1880 3460 fllfxxx.exe hhtbhh.exe PID 1880 wrote to memory of 4580 1880 hhtbhh.exe vdvpd.exe PID 1880 wrote to memory of 4580 1880 hhtbhh.exe vdvpd.exe PID 1880 wrote to memory of 4580 1880 hhtbhh.exe vdvpd.exe PID 4580 wrote to memory of 4560 4580 vdvpd.exe rrffxfx.exe PID 4580 wrote to memory of 4560 4580 vdvpd.exe rrffxfx.exe PID 4580 wrote to memory of 4560 4580 vdvpd.exe rrffxfx.exe PID 4560 wrote to memory of 2460 4560 rrffxfx.exe nthbnb.exe PID 4560 wrote to memory of 2460 4560 rrffxfx.exe nthbnb.exe PID 4560 wrote to memory of 2460 4560 rrffxfx.exe nthbnb.exe PID 2460 wrote to memory of 1968 2460 nthbnb.exe jjddv.exe PID 2460 wrote to memory of 1968 2460 nthbnb.exe jjddv.exe PID 2460 wrote to memory of 1968 2460 nthbnb.exe jjddv.exe PID 1968 wrote to memory of 2100 1968 jjddv.exe rrffxxl.exe PID 1968 wrote to memory of 2100 1968 jjddv.exe rrffxxl.exe PID 1968 wrote to memory of 2100 1968 jjddv.exe rrffxxl.exe PID 2100 wrote to memory of 884 2100 rrffxxl.exe hbhbbt.exe PID 2100 wrote to memory of 884 2100 rrffxxl.exe hbhbbt.exe PID 2100 wrote to memory of 884 2100 rrffxxl.exe hbhbbt.exe PID 884 wrote to memory of 1020 884 hbhbbt.exe ppvpp.exe PID 884 wrote to memory of 1020 884 hbhbbt.exe ppvpp.exe PID 884 wrote to memory of 1020 884 hbhbbt.exe ppvpp.exe PID 1020 wrote to memory of 1624 1020 ppvpp.exe pvpjd.exe PID 1020 wrote to memory of 1624 1020 ppvpp.exe pvpjd.exe PID 1020 wrote to memory of 1624 1020 ppvpp.exe pvpjd.exe PID 1624 wrote to memory of 1068 1624 pvpjd.exe xxrlfxr.exe PID 1624 wrote to memory of 1068 1624 pvpjd.exe xxrlfxr.exe PID 1624 wrote to memory of 1068 1624 pvpjd.exe xxrlfxr.exe PID 1068 wrote to memory of 3908 1068 xxrlfxr.exe tthbtn.exe PID 1068 wrote to memory of 3908 1068 xxrlfxr.exe tthbtn.exe PID 1068 wrote to memory of 3908 1068 xxrlfxr.exe tthbtn.exe PID 3908 wrote to memory of 1384 3908 tthbtn.exe hbbbnn.exe PID 3908 wrote to memory of 1384 3908 tthbtn.exe hbbbnn.exe PID 3908 wrote to memory of 1384 3908 tthbtn.exe hbbbnn.exe PID 1384 wrote to memory of 4020 1384 hbbbnn.exe pdpdd.exe PID 1384 wrote to memory of 4020 1384 hbbbnn.exe pdpdd.exe PID 1384 wrote to memory of 4020 1384 hbbbnn.exe pdpdd.exe PID 4020 wrote to memory of 2748 4020 pdpdd.exe flrxflf.exe PID 4020 wrote to memory of 2748 4020 pdpdd.exe flrxflf.exe PID 4020 wrote to memory of 2748 4020 pdpdd.exe flrxflf.exe PID 2748 wrote to memory of 2680 2748 flrxflf.exe 9jppp.exe PID 2748 wrote to memory of 2680 2748 flrxflf.exe 9jppp.exe PID 2748 wrote to memory of 2680 2748 flrxflf.exe 9jppp.exe PID 2680 wrote to memory of 3428 2680 9jppp.exe rlffxrr.exe PID 2680 wrote to memory of 3428 2680 9jppp.exe rlffxrr.exe PID 2680 wrote to memory of 3428 2680 9jppp.exe rlffxrr.exe PID 3428 wrote to memory of 3696 3428 rlffxrr.exe xlrlfxx.exe PID 3428 wrote to memory of 3696 3428 rlffxrr.exe xlrlfxx.exe PID 3428 wrote to memory of 3696 3428 rlffxrr.exe xlrlfxx.exe PID 3696 wrote to memory of 2424 3696 xlrlfxx.exe hbbtnh.exe PID 3696 wrote to memory of 2424 3696 xlrlfxx.exe hbbtnh.exe PID 3696 wrote to memory of 2424 3696 xlrlfxx.exe hbbtnh.exe PID 2424 wrote to memory of 2288 2424 hbbtnh.exe 7ddvp.exe PID 2424 wrote to memory of 2288 2424 hbbtnh.exe 7ddvp.exe PID 2424 wrote to memory of 2288 2424 hbbtnh.exe 7ddvp.exe PID 2288 wrote to memory of 464 2288 7ddvp.exe lxlxlrx.exe PID 2288 wrote to memory of 464 2288 7ddvp.exe lxlxlrx.exe PID 2288 wrote to memory of 464 2288 7ddvp.exe lxlxlrx.exe PID 464 wrote to memory of 4356 464 lxlxlrx.exe 5nbttb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fecb3c2fda7017609cb6d5837a60810N.exe"C:\Users\Admin\AppData\Local\Temp\2fecb3c2fda7017609cb6d5837a60810N.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\fllfxxx.exec:\fllfxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhtbhh.exec:\hhtbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdvpd.exec:\vdvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrffxfx.exec:\rrffxfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nthbnb.exec:\nthbnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjddv.exec:\jjddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrffxxl.exec:\rrffxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbbt.exec:\hbhbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvpp.exec:\ppvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpjd.exec:\pvpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthbtn.exec:\tthbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbbnn.exec:\hbbbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpdd.exec:\pdpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flrxflf.exec:\flrxflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jppp.exec:\9jppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlffxrr.exec:\rlffxrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbtnh.exec:\hbbtnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7ddvp.exec:\7ddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlxlrx.exec:\lxlxlrx.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\5nbttb.exec:\5nbttb.exe23⤵
- Executes dropped EXE
-
\??\c:\jpjdd.exec:\jpjdd.exe24⤵
- Executes dropped EXE
-
\??\c:\lxxfxxx.exec:\lxxfxxx.exe25⤵
- Executes dropped EXE
-
\??\c:\9nthnn.exec:\9nthnn.exe26⤵
- Executes dropped EXE
-
\??\c:\7jpjd.exec:\7jpjd.exe27⤵
- Executes dropped EXE
-
\??\c:\fxrllfl.exec:\fxrllfl.exe28⤵
- Executes dropped EXE
-
\??\c:\lxrxrrl.exec:\lxrxrrl.exe29⤵
- Executes dropped EXE
-
\??\c:\nnhnbh.exec:\nnhnbh.exe30⤵
- Executes dropped EXE
-
\??\c:\vvpvj.exec:\vvpvj.exe31⤵
- Executes dropped EXE
-
\??\c:\xrllllf.exec:\xrllllf.exe32⤵
- Executes dropped EXE
-
\??\c:\tnnhbb.exec:\tnnhbb.exe33⤵
- Executes dropped EXE
-
\??\c:\hnhnbb.exec:\hnhnbb.exe34⤵
- Executes dropped EXE
-
\??\c:\3vjdp.exec:\3vjdp.exe35⤵
- Executes dropped EXE
-
\??\c:\frllffx.exec:\frllffx.exe36⤵
- Executes dropped EXE
-
\??\c:\tnnhtn.exec:\tnnhtn.exe37⤵
- Executes dropped EXE
-
\??\c:\djddp.exec:\djddp.exe38⤵
- Executes dropped EXE
-
\??\c:\3rxxfxf.exec:\3rxxfxf.exe39⤵
- Executes dropped EXE
-
\??\c:\9ntnbb.exec:\9ntnbb.exe40⤵
- Executes dropped EXE
-
\??\c:\tnbtnt.exec:\tnbtnt.exe41⤵
- Executes dropped EXE
-
\??\c:\7dddp.exec:\7dddp.exe42⤵
- Executes dropped EXE
-
\??\c:\vvpjv.exec:\vvpjv.exe43⤵
- Executes dropped EXE
-
\??\c:\rffxllf.exec:\rffxllf.exe44⤵
- Executes dropped EXE
-
\??\c:\xffxrll.exec:\xffxrll.exe45⤵
- Executes dropped EXE
-
\??\c:\hnbbtb.exec:\hnbbtb.exe46⤵
- Executes dropped EXE
-
\??\c:\vpjpd.exec:\vpjpd.exe47⤵
- Executes dropped EXE
-
\??\c:\xlrrrfx.exec:\xlrrrfx.exe48⤵
- Executes dropped EXE
-
\??\c:\fflfrrl.exec:\fflfrrl.exe49⤵
- Executes dropped EXE
-
\??\c:\bbbhbb.exec:\bbbhbb.exe50⤵
- Executes dropped EXE
-
\??\c:\vvvvv.exec:\vvvvv.exe51⤵
- Executes dropped EXE
-
\??\c:\lfllfff.exec:\lfllfff.exe52⤵
- Executes dropped EXE
-
\??\c:\hnnttb.exec:\hnnttb.exe53⤵
- Executes dropped EXE
-
\??\c:\nntnhh.exec:\nntnhh.exe54⤵
- Executes dropped EXE
-
\??\c:\djjdp.exec:\djjdp.exe55⤵
- Executes dropped EXE
-
\??\c:\ddjvp.exec:\ddjvp.exe56⤵
- Executes dropped EXE
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe57⤵
- Executes dropped EXE
-
\??\c:\thhhbt.exec:\thhhbt.exe58⤵
- Executes dropped EXE
-
\??\c:\hnbnbh.exec:\hnbnbh.exe59⤵
- Executes dropped EXE
-
\??\c:\dvvvp.exec:\dvvvp.exe60⤵
- Executes dropped EXE
-
\??\c:\llrfrfr.exec:\llrfrfr.exe61⤵
- Executes dropped EXE
-
\??\c:\frxlfrl.exec:\frxlfrl.exe62⤵
- Executes dropped EXE
-
\??\c:\hbbtnh.exec:\hbbtnh.exe63⤵
- Executes dropped EXE
-
\??\c:\dvpjd.exec:\dvpjd.exe64⤵
- Executes dropped EXE
-
\??\c:\3vjjd.exec:\3vjjd.exe65⤵
- Executes dropped EXE
-
\??\c:\lfxlrxr.exec:\lfxlrxr.exe66⤵
- System Location Discovery: System Language Discovery
-
\??\c:\7nthhn.exec:\7nthhn.exe67⤵
-
\??\c:\htthtn.exec:\htthtn.exe68⤵
-
\??\c:\ddjvd.exec:\ddjvd.exe69⤵
-
\??\c:\rxfxxlx.exec:\rxfxxlx.exe70⤵
-
\??\c:\lrfrrfl.exec:\lrfrrfl.exe71⤵
-
\??\c:\bbhhhn.exec:\bbhhhn.exe72⤵
-
\??\c:\jpjjp.exec:\jpjjp.exe73⤵
-
\??\c:\pvjpj.exec:\pvjpj.exe74⤵
-
\??\c:\rfxrxxr.exec:\rfxrxxr.exe75⤵
-
\??\c:\btnhnn.exec:\btnhnn.exe76⤵
-
\??\c:\vppdd.exec:\vppdd.exe77⤵
-
\??\c:\xffrlfx.exec:\xffrlfx.exe78⤵
-
\??\c:\nhnnhb.exec:\nhnnhb.exe79⤵
-
\??\c:\tttntt.exec:\tttntt.exe80⤵
-
\??\c:\xrfxlxl.exec:\xrfxlxl.exe81⤵
-
\??\c:\tththt.exec:\tththt.exe82⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe83⤵
-
\??\c:\rlxrlll.exec:\rlxrlll.exe84⤵
-
\??\c:\xrrxxxr.exec:\xrrxxxr.exe85⤵
-
\??\c:\nnbbnb.exec:\nnbbnb.exe86⤵
-
\??\c:\bhnnnt.exec:\bhnnnt.exe87⤵
-
\??\c:\vjvpp.exec:\vjvpp.exe88⤵
-
\??\c:\pjpjv.exec:\pjpjv.exe89⤵
-
\??\c:\llffxfx.exec:\llffxfx.exe90⤵
-
\??\c:\lrllffx.exec:\lrllffx.exe91⤵
-
\??\c:\5bbhbh.exec:\5bbhbh.exe92⤵
-
\??\c:\9dpvj.exec:\9dpvj.exe93⤵
-
\??\c:\vvjpp.exec:\vvjpp.exe94⤵
-
\??\c:\vjdpp.exec:\vjdpp.exe95⤵
-
\??\c:\rllffff.exec:\rllffff.exe96⤵
-
\??\c:\rrfffll.exec:\rrfffll.exe97⤵
-
\??\c:\nbnhhh.exec:\nbnhhh.exe98⤵
-
\??\c:\hbthbt.exec:\hbthbt.exe99⤵
-
\??\c:\dvppd.exec:\dvppd.exe100⤵
-
\??\c:\ddjjp.exec:\ddjjp.exe101⤵
-
\??\c:\lllllrr.exec:\lllllrr.exe102⤵
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe103⤵
-
\??\c:\5bbnnt.exec:\5bbnnt.exe104⤵
-
\??\c:\nthbhn.exec:\nthbhn.exe105⤵
-
\??\c:\pdvpd.exec:\pdvpd.exe106⤵
-
\??\c:\pdjvv.exec:\pdjvv.exe107⤵
-
\??\c:\fxxrrrx.exec:\fxxrrrx.exe108⤵
-
\??\c:\tbnbbb.exec:\tbnbbb.exe109⤵
-
\??\c:\btbtnn.exec:\btbtnn.exe110⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe111⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe112⤵
-
\??\c:\fxrllll.exec:\fxrllll.exe113⤵
-
\??\c:\xxllflf.exec:\xxllflf.exe114⤵
-
\??\c:\hbhbtb.exec:\hbhbtb.exe115⤵
-
\??\c:\hbhhhn.exec:\hbhhhn.exe116⤵
-
\??\c:\vpddp.exec:\vpddp.exe117⤵
-
\??\c:\ffllffl.exec:\ffllffl.exe118⤵
-
\??\c:\7lxxxfx.exec:\7lxxxfx.exe119⤵
-
\??\c:\nhhbbn.exec:\nhhbbn.exe120⤵
-
\??\c:\btbbbb.exec:\btbbbb.exe121⤵
-
\??\c:\3ddvv.exec:\3ddvv.exe122⤵
-
\??\c:\jdddv.exec:\jdddv.exe123⤵
-
\??\c:\xxfxffl.exec:\xxfxffl.exe124⤵
-
\??\c:\rrrxrrr.exec:\rrrxrrr.exe125⤵
-
\??\c:\3hhhbb.exec:\3hhhbb.exe126⤵
-
\??\c:\bntttt.exec:\bntttt.exe127⤵
-
\??\c:\7jvpv.exec:\7jvpv.exe128⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe129⤵
-
\??\c:\xlxrflx.exec:\xlxrflx.exe130⤵
-
\??\c:\rxfllll.exec:\rxfllll.exe131⤵
-
\??\c:\tnbnhh.exec:\tnbnhh.exe132⤵
-
\??\c:\jjpjv.exec:\jjpjv.exe133⤵
-
\??\c:\pjddv.exec:\pjddv.exe134⤵
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe135⤵
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe136⤵
-
\??\c:\tttttt.exec:\tttttt.exe137⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe138⤵
-
\??\c:\ddvjj.exec:\ddvjj.exe139⤵
-
\??\c:\frrrffl.exec:\frrrffl.exe140⤵
-
\??\c:\9lrrllf.exec:\9lrrllf.exe141⤵
-
\??\c:\nbhhbb.exec:\nbhhbb.exe142⤵
-
\??\c:\nnbbbb.exec:\nnbbbb.exe143⤵
-
\??\c:\pvvvv.exec:\pvvvv.exe144⤵
-
\??\c:\rrxrlll.exec:\rrxrlll.exe145⤵
-
\??\c:\rlxflrr.exec:\rlxflrr.exe146⤵
-
\??\c:\nnhhhh.exec:\nnhhhh.exe147⤵
-
\??\c:\bnnbhb.exec:\bnnbhb.exe148⤵
-
\??\c:\vdvvp.exec:\vdvvp.exe149⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe150⤵
-
\??\c:\rxxxflf.exec:\rxxxflf.exe151⤵
- System Location Discovery: System Language Discovery
-
\??\c:\ffffxxx.exec:\ffffxxx.exe152⤵
-
\??\c:\bnbtbt.exec:\bnbtbt.exe153⤵
-
\??\c:\hhbbbb.exec:\hhbbbb.exe154⤵
-
\??\c:\vvjdp.exec:\vvjdp.exe155⤵
-
\??\c:\ppvvj.exec:\ppvvj.exe156⤵
-
\??\c:\5xfxxll.exec:\5xfxxll.exe157⤵
-
\??\c:\rxfxxxf.exec:\rxfxxxf.exe158⤵
-
\??\c:\tntbbb.exec:\tntbbb.exe159⤵
-
\??\c:\bbtnhb.exec:\bbtnhb.exe160⤵
-
\??\c:\1pjpv.exec:\1pjpv.exe161⤵
-
\??\c:\1pjjj.exec:\1pjjj.exe162⤵
-
\??\c:\djjvp.exec:\djjvp.exe163⤵
-
\??\c:\fffffff.exec:\fffffff.exe164⤵
- System Location Discovery: System Language Discovery
-
\??\c:\bbhbhn.exec:\bbhbhn.exe165⤵
-
\??\c:\pvdvv.exec:\pvdvv.exe166⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe167⤵
-
\??\c:\1llfxrr.exec:\1llfxrr.exe168⤵
-
\??\c:\ffflfll.exec:\ffflfll.exe169⤵
-
\??\c:\ntbbnn.exec:\ntbbnn.exe170⤵
-
\??\c:\ddppp.exec:\ddppp.exe171⤵
-
\??\c:\pvjdv.exec:\pvjdv.exe172⤵
-
\??\c:\xxllllx.exec:\xxllllx.exe173⤵
-
\??\c:\nnhhbb.exec:\nnhhbb.exe174⤵
-
\??\c:\bbhbtt.exec:\bbhbtt.exe175⤵
-
\??\c:\jjpjj.exec:\jjpjj.exe176⤵
-
\??\c:\dvvpv.exec:\dvvpv.exe177⤵
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe178⤵
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe179⤵
-
\??\c:\btbttb.exec:\btbttb.exe180⤵
-
\??\c:\9vddv.exec:\9vddv.exe181⤵
-
\??\c:\djppp.exec:\djppp.exe182⤵
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe183⤵
- System Location Discovery: System Language Discovery
-
\??\c:\frffxrr.exec:\frffxrr.exe184⤵
-
\??\c:\ttbhtb.exec:\ttbhtb.exe185⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe186⤵
-
\??\c:\pjppj.exec:\pjppj.exe187⤵
-
\??\c:\1xlfrrf.exec:\1xlfrrf.exe188⤵
-
\??\c:\rflllll.exec:\rflllll.exe189⤵
-
\??\c:\lrfrlfl.exec:\lrfrlfl.exe190⤵
-
\??\c:\bthhbh.exec:\bthhbh.exe191⤵
-
\??\c:\btnhtt.exec:\btnhtt.exe192⤵
-
\??\c:\jpdjv.exec:\jpdjv.exe193⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe194⤵
-
\??\c:\7fllxxr.exec:\7fllxxr.exe195⤵
-
\??\c:\lfffxrr.exec:\lfffxrr.exe196⤵
-
\??\c:\hhbbbh.exec:\hhbbbh.exe197⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe198⤵
-
\??\c:\vvddp.exec:\vvddp.exe199⤵
-
\??\c:\xrrrrfx.exec:\xrrrrfx.exe200⤵
-
\??\c:\xxfrxrr.exec:\xxfrxrr.exe201⤵
-
\??\c:\bnbbbb.exec:\bnbbbb.exe202⤵
-
\??\c:\hnnhbn.exec:\hnnhbn.exe203⤵
-
\??\c:\pdvvd.exec:\pdvvd.exe204⤵
-
\??\c:\ffrrlxx.exec:\ffrrlxx.exe205⤵
-
\??\c:\nhnhhh.exec:\nhnhhh.exe206⤵
-
\??\c:\frxffff.exec:\frxffff.exe207⤵
-
\??\c:\xxxrrxx.exec:\xxxrrxx.exe208⤵
-
\??\c:\thttbb.exec:\thttbb.exe209⤵
-
\??\c:\nnhbbb.exec:\nnhbbb.exe210⤵
-
\??\c:\dvvdd.exec:\dvvdd.exe211⤵
-
\??\c:\dppjj.exec:\dppjj.exe212⤵
-
\??\c:\flrlfff.exec:\flrlfff.exe213⤵
-
\??\c:\bhnnnt.exec:\bhnnnt.exe214⤵
-
\??\c:\bbbbnt.exec:\bbbbnt.exe215⤵
-
\??\c:\pvvpd.exec:\pvvpd.exe216⤵
-
\??\c:\lflffxr.exec:\lflffxr.exe217⤵
-
\??\c:\xflllrr.exec:\xflllrr.exe218⤵
-
\??\c:\htttnt.exec:\htttnt.exe219⤵
-
\??\c:\tntnhn.exec:\tntnhn.exe220⤵
-
\??\c:\dpddv.exec:\dpddv.exe221⤵
-
\??\c:\vvjdj.exec:\vvjdj.exe222⤵
- System Location Discovery: System Language Discovery
-
\??\c:\flrrxxl.exec:\flrrxxl.exe223⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe224⤵
- System Location Discovery: System Language Discovery
-
\??\c:\nbnnnt.exec:\nbnnnt.exe225⤵
-
\??\c:\jjjjj.exec:\jjjjj.exe226⤵
-
\??\c:\ddpjp.exec:\ddpjp.exe227⤵
-
\??\c:\xrlxrxx.exec:\xrlxrxx.exe228⤵
-
\??\c:\llxfflr.exec:\llxfflr.exe229⤵
-
\??\c:\bntttb.exec:\bntttb.exe230⤵
-
\??\c:\bthnth.exec:\bthnth.exe231⤵
-
\??\c:\djvvd.exec:\djvvd.exe232⤵
-
\??\c:\xxflrrr.exec:\xxflrrr.exe233⤵
-
\??\c:\hbhnhn.exec:\hbhnhn.exe234⤵
- System Location Discovery: System Language Discovery
-
\??\c:\tntnnn.exec:\tntnnn.exe235⤵
-
\??\c:\jppjj.exec:\jppjj.exe236⤵
-
\??\c:\dvdjv.exec:\dvdjv.exe237⤵
-
\??\c:\lrffxxf.exec:\lrffxxf.exe238⤵
-
\??\c:\7ffxrrr.exec:\7ffxrrr.exe239⤵
-
\??\c:\dddvp.exec:\dddvp.exe240⤵
-
\??\c:\jjppj.exec:\jjppj.exe241⤵