Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 19:01
Static task
static1
Behavioral task
behavioral1
Sample
14fc7cb84068976f80e2890561db229a5ceb9573d6c108239cbce34a1779536c.exe
Resource
win7-20240705-en
General
-
Target
14fc7cb84068976f80e2890561db229a5ceb9573d6c108239cbce34a1779536c.exe
-
Size
371KB
-
MD5
9d0b685f846249b220195249830252b4
-
SHA1
4d927f0d3d35d5eb321b37e3694bbe51f5ee0f7f
-
SHA256
14fc7cb84068976f80e2890561db229a5ceb9573d6c108239cbce34a1779536c
-
SHA512
68ce4c56e7e4c4734533a1db7b6f11cf0b297f545dc51ed1b91a5cb3966ad76b7a0fc4dadbe6f3f11e5d4feb71dd9873dbb601b6b6e0ebd16ddb415c9c017d15
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwO:n3C9uYA7okVqdKwaO5CVJ
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/4416-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-70-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lfrlffl.exehbbtnn.exevdjdd.exelxlllll.exebhnntt.exepddpv.exellrrfxx.exebhhhnn.exehtnhbt.exetthbth.exedpjvd.exelfrlxxl.exehntttt.exejdjpd.exefffxxlr.exejpppj.exexlrlfxr.exe1bhttt.exehbbnhh.exepjvpj.exelfrrrrr.exejdpdd.exenhnhbh.exeppppp.exe7rrrrrl.exettnbhh.exedjvdd.exerllfrxf.exebbhnnt.exepjvpj.exexlxlllx.exenhttbb.exedvvpj.exefffllrr.exethhtbb.exejvdjp.exefrxlrrx.exebntttt.exejjpvj.exefxrxlff.exetnhttt.exeddpvd.exerrrxrxl.exebtthtb.exerxrrfrx.exehhnhhh.exe7jppp.exeppvvj.exelrfrfxx.exe7ntbtb.exexlrlffl.exennhbnh.exejjppp.exefrrxllx.exetnbnbt.exepvjpv.exefxrffll.exenhbthh.exevdpvp.exerlfrrxf.exexrxxrrx.exetnnbbh.exedjpjj.exeffrlffr.exepid process 2732 lfrlffl.exe 3500 hbbtnn.exe 3732 vdjdd.exe 2320 lxlllll.exe 880 bhnntt.exe 1492 pddpv.exe 1252 llrrfxx.exe 1672 bhhhnn.exe 228 htnhbt.exe 4916 tthbth.exe 1700 dpjvd.exe 4152 lfrlxxl.exe 4836 hntttt.exe 4288 jdjpd.exe 3908 fffxxlr.exe 1756 jpppj.exe 2888 xlrlfxr.exe 2376 1bhttt.exe 4760 hbbnhh.exe 4964 pjvpj.exe 4460 lfrrrrr.exe 1072 jdpdd.exe 1884 nhnhbh.exe 1020 ppppp.exe 3620 7rrrrrl.exe 2836 ttnbhh.exe 5004 djvdd.exe 744 rllfrxf.exe 5084 bbhnnt.exe 2088 pjvpj.exe 2980 xlxlllx.exe 4028 nhttbb.exe 1536 dvvpj.exe 1240 fffllrr.exe 3364 thhtbb.exe 2448 jvdjp.exe 4360 frxlrrx.exe 672 bntttt.exe 3560 jjpvj.exe 3732 fxrxlff.exe 3480 tnhttt.exe 768 ddpvd.exe 2876 rrrxrxl.exe 4500 btthtb.exe 3860 rxrrfrx.exe 3608 hhnhhh.exe 264 7jppp.exe 4956 ppvvj.exe 2292 lrfrfxx.exe 4320 7ntbtb.exe 4492 xlrlffl.exe 4740 nnhbnh.exe 4984 jjppp.exe 4708 frrxllx.exe 4172 tnbnbt.exe 2308 pvjpv.exe 5040 fxrffll.exe 2860 nhbthh.exe 4032 vdpvp.exe 5076 rlfrrxf.exe 4760 xrxxrrx.exe 4700 tnnbbh.exe 4212 djpjj.exe 2372 ffrlffr.exe -
Processes:
resource yara_rule behavioral2/memory/4416-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
pppjp.exexflfxfr.exerxlrxxf.exenbttnt.exedjjjj.exejddvv.exeflrllfl.exenntbht.exe5fflxrf.exexrxxrrx.exedpjpd.exefxfffxx.exerlfrrfx.exebbhhbt.exepvjdv.exentbntb.exefxrlxfr.exe3tttbh.exeppvvv.exerlrrlll.exenhnhbh.exevdpvv.exevpdvp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fflxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
14fc7cb84068976f80e2890561db229a5ceb9573d6c108239cbce34a1779536c.exelfrlffl.exehbbtnn.exevdjdd.exelxlllll.exebhnntt.exepddpv.exellrrfxx.exebhhhnn.exehtnhbt.exetthbth.exedpjvd.exelfrlxxl.exehntttt.exejdjpd.exefffxxlr.exejpppj.exexlrlfxr.exe1bhttt.exehbbnhh.exepjvpj.exelfrrrrr.exedescription pid process target process PID 4416 wrote to memory of 2732 4416 14fc7cb84068976f80e2890561db229a5ceb9573d6c108239cbce34a1779536c.exe lfrlffl.exe PID 4416 wrote to memory of 2732 4416 14fc7cb84068976f80e2890561db229a5ceb9573d6c108239cbce34a1779536c.exe lfrlffl.exe PID 4416 wrote to memory of 2732 4416 14fc7cb84068976f80e2890561db229a5ceb9573d6c108239cbce34a1779536c.exe lfrlffl.exe PID 2732 wrote to memory of 3500 2732 lfrlffl.exe hbbtnn.exe PID 2732 wrote to memory of 3500 2732 lfrlffl.exe hbbtnn.exe PID 2732 wrote to memory of 3500 2732 lfrlffl.exe hbbtnn.exe PID 3500 wrote to memory of 3732 3500 hbbtnn.exe vdjdd.exe PID 3500 wrote to memory of 3732 3500 hbbtnn.exe vdjdd.exe PID 3500 wrote to memory of 3732 3500 hbbtnn.exe vdjdd.exe PID 3732 wrote to memory of 2320 3732 vdjdd.exe lxlllll.exe PID 3732 wrote to memory of 2320 3732 vdjdd.exe lxlllll.exe PID 3732 wrote to memory of 2320 3732 vdjdd.exe lxlllll.exe PID 2320 wrote to memory of 880 2320 lxlllll.exe bhnntt.exe PID 2320 wrote to memory of 880 2320 lxlllll.exe bhnntt.exe PID 2320 wrote to memory of 880 2320 lxlllll.exe bhnntt.exe PID 880 wrote to memory of 1492 880 bhnntt.exe pddpv.exe PID 880 wrote to memory of 1492 880 bhnntt.exe pddpv.exe PID 880 wrote to memory of 1492 880 bhnntt.exe pddpv.exe PID 1492 wrote to memory of 1252 1492 pddpv.exe llrrfxx.exe PID 1492 wrote to memory of 1252 1492 pddpv.exe llrrfxx.exe PID 1492 wrote to memory of 1252 1492 pddpv.exe llrrfxx.exe PID 1252 wrote to memory of 1672 1252 llrrfxx.exe bhhhnn.exe PID 1252 wrote to memory of 1672 1252 llrrfxx.exe bhhhnn.exe PID 1252 wrote to memory of 1672 1252 llrrfxx.exe bhhhnn.exe PID 1672 wrote to memory of 228 1672 bhhhnn.exe htnhbt.exe PID 1672 wrote to memory of 228 1672 bhhhnn.exe htnhbt.exe PID 1672 wrote to memory of 228 1672 bhhhnn.exe htnhbt.exe PID 228 wrote to memory of 4916 228 htnhbt.exe tthbth.exe PID 228 wrote to memory of 4916 228 htnhbt.exe tthbth.exe PID 228 wrote to memory of 4916 228 htnhbt.exe tthbth.exe PID 4916 wrote to memory of 1700 4916 tthbth.exe dpjvd.exe PID 4916 wrote to memory of 1700 4916 tthbth.exe dpjvd.exe PID 4916 wrote to memory of 1700 4916 tthbth.exe dpjvd.exe PID 1700 wrote to memory of 4152 1700 dpjvd.exe lfrlxxl.exe PID 1700 wrote to memory of 4152 1700 dpjvd.exe lfrlxxl.exe PID 1700 wrote to memory of 4152 1700 dpjvd.exe lfrlxxl.exe PID 4152 wrote to memory of 4836 4152 lfrlxxl.exe hntttt.exe PID 4152 wrote to memory of 4836 4152 lfrlxxl.exe hntttt.exe PID 4152 wrote to memory of 4836 4152 lfrlxxl.exe hntttt.exe PID 4836 wrote to memory of 4288 4836 hntttt.exe jdjpd.exe PID 4836 wrote to memory of 4288 4836 hntttt.exe jdjpd.exe PID 4836 wrote to memory of 4288 4836 hntttt.exe jdjpd.exe PID 4288 wrote to memory of 3908 4288 jdjpd.exe fffxxlr.exe PID 4288 wrote to memory of 3908 4288 jdjpd.exe fffxxlr.exe PID 4288 wrote to memory of 3908 4288 jdjpd.exe fffxxlr.exe PID 3908 wrote to memory of 1756 3908 fffxxlr.exe jpppj.exe PID 3908 wrote to memory of 1756 3908 fffxxlr.exe jpppj.exe PID 3908 wrote to memory of 1756 3908 fffxxlr.exe jpppj.exe PID 1756 wrote to memory of 2888 1756 jpppj.exe xlrlfxr.exe PID 1756 wrote to memory of 2888 1756 jpppj.exe xlrlfxr.exe PID 1756 wrote to memory of 2888 1756 jpppj.exe xlrlfxr.exe PID 2888 wrote to memory of 2376 2888 xlrlfxr.exe 1bhttt.exe PID 2888 wrote to memory of 2376 2888 xlrlfxr.exe 1bhttt.exe PID 2888 wrote to memory of 2376 2888 xlrlfxr.exe 1bhttt.exe PID 2376 wrote to memory of 4760 2376 1bhttt.exe hbbnhh.exe PID 2376 wrote to memory of 4760 2376 1bhttt.exe hbbnhh.exe PID 2376 wrote to memory of 4760 2376 1bhttt.exe hbbnhh.exe PID 4760 wrote to memory of 4964 4760 hbbnhh.exe pjvpj.exe PID 4760 wrote to memory of 4964 4760 hbbnhh.exe pjvpj.exe PID 4760 wrote to memory of 4964 4760 hbbnhh.exe pjvpj.exe PID 4964 wrote to memory of 4460 4964 pjvpj.exe lfrrrrr.exe PID 4964 wrote to memory of 4460 4964 pjvpj.exe lfrrrrr.exe PID 4964 wrote to memory of 4460 4964 pjvpj.exe lfrrrrr.exe PID 4460 wrote to memory of 1072 4460 lfrrrrr.exe jdpdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14fc7cb84068976f80e2890561db229a5ceb9573d6c108239cbce34a1779536c.exe"C:\Users\Admin\AppData\Local\Temp\14fc7cb84068976f80e2890561db229a5ceb9573d6c108239cbce34a1779536c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrlffl.exec:\lfrlffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbtnn.exec:\hbbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdjdd.exec:\vdjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlllll.exec:\lxlllll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnntt.exec:\bhnntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pddpv.exec:\pddpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llrrfxx.exec:\llrrfxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhhhnn.exec:\bhhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnhbt.exec:\htnhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthbth.exec:\tthbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpjvd.exec:\dpjvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hntttt.exec:\hntttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjpd.exec:\jdjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffxxlr.exec:\fffxxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpppj.exec:\jpppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1bhttt.exec:\1bhttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbnhh.exec:\hbbnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvpj.exec:\pjvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpdd.exec:\jdpdd.exe23⤵
- Executes dropped EXE
-
\??\c:\nhnhbh.exec:\nhnhbh.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\ppppp.exec:\ppppp.exe25⤵
- Executes dropped EXE
-
\??\c:\7rrrrrl.exec:\7rrrrrl.exe26⤵
- Executes dropped EXE
-
\??\c:\ttnbhh.exec:\ttnbhh.exe27⤵
- Executes dropped EXE
-
\??\c:\djvdd.exec:\djvdd.exe28⤵
- Executes dropped EXE
-
\??\c:\rllfrxf.exec:\rllfrxf.exe29⤵
- Executes dropped EXE
-
\??\c:\bbhnnt.exec:\bbhnnt.exe30⤵
- Executes dropped EXE
-
\??\c:\pjvpj.exec:\pjvpj.exe31⤵
- Executes dropped EXE
-
\??\c:\xlxlllx.exec:\xlxlllx.exe32⤵
- Executes dropped EXE
-
\??\c:\nhttbb.exec:\nhttbb.exe33⤵
- Executes dropped EXE
-
\??\c:\dvvpj.exec:\dvvpj.exe34⤵
- Executes dropped EXE
-
\??\c:\fffllrr.exec:\fffllrr.exe35⤵
- Executes dropped EXE
-
\??\c:\thhtbb.exec:\thhtbb.exe36⤵
- Executes dropped EXE
-
\??\c:\jvdjp.exec:\jvdjp.exe37⤵
- Executes dropped EXE
-
\??\c:\frxlrrx.exec:\frxlrrx.exe38⤵
- Executes dropped EXE
-
\??\c:\bntttt.exec:\bntttt.exe39⤵
- Executes dropped EXE
-
\??\c:\jjpvj.exec:\jjpvj.exe40⤵
- Executes dropped EXE
-
\??\c:\fxrxlff.exec:\fxrxlff.exe41⤵
- Executes dropped EXE
-
\??\c:\tnhttt.exec:\tnhttt.exe42⤵
- Executes dropped EXE
-
\??\c:\ddpvd.exec:\ddpvd.exe43⤵
- Executes dropped EXE
-
\??\c:\rrrxrxl.exec:\rrrxrxl.exe44⤵
- Executes dropped EXE
-
\??\c:\btthtb.exec:\btthtb.exe45⤵
- Executes dropped EXE
-
\??\c:\rxrrfrx.exec:\rxrrfrx.exe46⤵
- Executes dropped EXE
-
\??\c:\hhnhhh.exec:\hhnhhh.exe47⤵
- Executes dropped EXE
-
\??\c:\7jppp.exec:\7jppp.exe48⤵
- Executes dropped EXE
-
\??\c:\ppvvj.exec:\ppvvj.exe49⤵
- Executes dropped EXE
-
\??\c:\lrfrfxx.exec:\lrfrfxx.exe50⤵
- Executes dropped EXE
-
\??\c:\7ntbtb.exec:\7ntbtb.exe51⤵
- Executes dropped EXE
-
\??\c:\xlrlffl.exec:\xlrlffl.exe52⤵
- Executes dropped EXE
-
\??\c:\nnhbnh.exec:\nnhbnh.exe53⤵
- Executes dropped EXE
-
\??\c:\jjppp.exec:\jjppp.exe54⤵
- Executes dropped EXE
-
\??\c:\frrxllx.exec:\frrxllx.exe55⤵
- Executes dropped EXE
-
\??\c:\tnbnbt.exec:\tnbnbt.exe56⤵
- Executes dropped EXE
-
\??\c:\pvjpv.exec:\pvjpv.exe57⤵
- Executes dropped EXE
-
\??\c:\fxrffll.exec:\fxrffll.exe58⤵
- Executes dropped EXE
-
\??\c:\nhbthh.exec:\nhbthh.exe59⤵
- Executes dropped EXE
-
\??\c:\vdpvp.exec:\vdpvp.exe60⤵
- Executes dropped EXE
-
\??\c:\rlfrrxf.exec:\rlfrrxf.exe61⤵
- Executes dropped EXE
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\tnnbbh.exec:\tnnbbh.exe63⤵
- Executes dropped EXE
-
\??\c:\djpjj.exec:\djpjj.exe64⤵
- Executes dropped EXE
-
\??\c:\ffrlffr.exec:\ffrlffr.exe65⤵
- Executes dropped EXE
-
\??\c:\hbbtbh.exec:\hbbtbh.exe66⤵
-
\??\c:\hhbttt.exec:\hhbttt.exe67⤵
-
\??\c:\vpjjj.exec:\vpjjj.exe68⤵
-
\??\c:\lfxllfx.exec:\lfxllfx.exe69⤵
-
\??\c:\rfrlrxx.exec:\rfrlrxx.exe70⤵
-
\??\c:\nntbnb.exec:\nntbnb.exe71⤵
-
\??\c:\jvddd.exec:\jvddd.exe72⤵
-
\??\c:\rlrrlll.exec:\rlrrlll.exe73⤵
-
\??\c:\flxxrfr.exec:\flxxrfr.exe74⤵
-
\??\c:\hbtnht.exec:\hbtnht.exe75⤵
-
\??\c:\jvvvd.exec:\jvvvd.exe76⤵
-
\??\c:\flxrrfr.exec:\flxrrfr.exe77⤵
-
\??\c:\ttbtht.exec:\ttbtht.exe78⤵
-
\??\c:\bthbhb.exec:\bthbhb.exe79⤵
-
\??\c:\vpvjp.exec:\vpvjp.exe80⤵
-
\??\c:\5fxxllf.exec:\5fxxllf.exe81⤵
-
\??\c:\bbbttb.exec:\bbbttb.exe82⤵
-
\??\c:\hnhnnb.exec:\hnhnnb.exe83⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe84⤵
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe85⤵
-
\??\c:\flrllfl.exec:\flrllfl.exe86⤵
- System Location Discovery: System Language Discovery
-
\??\c:\7tbthh.exec:\7tbthh.exe87⤵
-
\??\c:\jdddd.exec:\jdddd.exe88⤵
-
\??\c:\3ttnhb.exec:\3ttnhb.exe89⤵
-
\??\c:\bbbbbb.exec:\bbbbbb.exe90⤵
-
\??\c:\dvppp.exec:\dvppp.exe91⤵
-
\??\c:\5flfxxx.exec:\5flfxxx.exe92⤵
-
\??\c:\7tntnt.exec:\7tntnt.exe93⤵
-
\??\c:\pppjd.exec:\pppjd.exe94⤵
-
\??\c:\llfxrrl.exec:\llfxrrl.exe95⤵
-
\??\c:\nbnthb.exec:\nbnthb.exe96⤵
-
\??\c:\9vjjp.exec:\9vjjp.exe97⤵
-
\??\c:\1tttbh.exec:\1tttbh.exe98⤵
-
\??\c:\pjvjp.exec:\pjvjp.exe99⤵
-
\??\c:\hhbnbn.exec:\hhbnbn.exe100⤵
-
\??\c:\jvjjp.exec:\jvjjp.exe101⤵
-
\??\c:\nhbttb.exec:\nhbttb.exe102⤵
-
\??\c:\jvjjp.exec:\jvjjp.exe103⤵
-
\??\c:\frllffl.exec:\frllffl.exe104⤵
-
\??\c:\bbthnh.exec:\bbthnh.exe105⤵
-
\??\c:\pvvjp.exec:\pvvjp.exe106⤵
-
\??\c:\bbnnhh.exec:\bbnnhh.exe107⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe108⤵
-
\??\c:\thtbhn.exec:\thtbhn.exe109⤵
-
\??\c:\jjvjd.exec:\jjvjd.exe110⤵
-
\??\c:\rxfxllx.exec:\rxfxllx.exe111⤵
-
\??\c:\nbhhhn.exec:\nbhhhn.exe112⤵
-
\??\c:\vdpvv.exec:\vdpvv.exe113⤵
- System Location Discovery: System Language Discovery
-
\??\c:\xxxrffx.exec:\xxxrffx.exe114⤵
-
\??\c:\tttthh.exec:\tttthh.exe115⤵
-
\??\c:\dvvdv.exec:\dvvdv.exe116⤵
-
\??\c:\fffxxll.exec:\fffxxll.exe117⤵
-
\??\c:\ttttbn.exec:\ttttbn.exe118⤵
-
\??\c:\pppjp.exec:\pppjp.exe119⤵
- System Location Discovery: System Language Discovery
-
\??\c:\xrlxlfx.exec:\xrlxlfx.exe120⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe121⤵
-
\??\c:\djppp.exec:\djppp.exe122⤵
-
\??\c:\ttntnb.exec:\ttntnb.exe123⤵
-
\??\c:\ddjvp.exec:\ddjvp.exe124⤵
-
\??\c:\llxlrrr.exec:\llxlrrr.exe125⤵
-
\??\c:\9nbbtb.exec:\9nbbtb.exe126⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe127⤵
-
\??\c:\dddjd.exec:\dddjd.exe128⤵
-
\??\c:\3flfflf.exec:\3flfflf.exe129⤵
-
\??\c:\bnthbb.exec:\bnthbb.exe130⤵
-
\??\c:\pjpdd.exec:\pjpdd.exe131⤵
-
\??\c:\xfrlrrl.exec:\xfrlrrl.exe132⤵
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe133⤵
-
\??\c:\htnbtt.exec:\htnbtt.exe134⤵
-
\??\c:\pjppj.exec:\pjppj.exe135⤵
-
\??\c:\llrrllf.exec:\llrrllf.exe136⤵
-
\??\c:\3bnnbh.exec:\3bnnbh.exe137⤵
-
\??\c:\ddvdp.exec:\ddvdp.exe138⤵
-
\??\c:\lxxrxlf.exec:\lxxrxlf.exe139⤵
-
\??\c:\tnhhnh.exec:\tnhhnh.exe140⤵
-
\??\c:\dpdpd.exec:\dpdpd.exe141⤵
-
\??\c:\rlffllr.exec:\rlffllr.exe142⤵
-
\??\c:\hhnhhn.exec:\hhnhhn.exe143⤵
-
\??\c:\1pvvd.exec:\1pvvd.exe144⤵
-
\??\c:\rflxxxx.exec:\rflxxxx.exe145⤵
-
\??\c:\lrllxrx.exec:\lrllxrx.exe146⤵
-
\??\c:\hhttnh.exec:\hhttnh.exe147⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe148⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe149⤵
-
\??\c:\1rllrxx.exec:\1rllrxx.exe150⤵
-
\??\c:\htbhth.exec:\htbhth.exe151⤵
-
\??\c:\jdvdj.exec:\jdvdj.exe152⤵
-
\??\c:\9lxffll.exec:\9lxffll.exe153⤵
-
\??\c:\htbhhn.exec:\htbhhn.exe154⤵
-
\??\c:\dpppj.exec:\dpppj.exe155⤵
-
\??\c:\rfrrlrr.exec:\rfrrlrr.exe156⤵
-
\??\c:\9hbttt.exec:\9hbttt.exe157⤵
-
\??\c:\tbnttn.exec:\tbnttn.exe158⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe159⤵
-
\??\c:\lfxrllf.exec:\lfxrllf.exe160⤵
-
\??\c:\dvpvp.exec:\dvpvp.exe161⤵
-
\??\c:\xxxlflx.exec:\xxxlflx.exe162⤵
-
\??\c:\ttbbnn.exec:\ttbbnn.exe163⤵
-
\??\c:\dppdp.exec:\dppdp.exe164⤵
-
\??\c:\rlfflll.exec:\rlfflll.exe165⤵
-
\??\c:\ttntth.exec:\ttntth.exe166⤵
-
\??\c:\btbbtb.exec:\btbbtb.exe167⤵
-
\??\c:\fllxrxl.exec:\fllxrxl.exe168⤵
-
\??\c:\bhttnh.exec:\bhttnh.exe169⤵
-
\??\c:\vdjjj.exec:\vdjjj.exe170⤵
-
\??\c:\xrxrffx.exec:\xrxrffx.exe171⤵
-
\??\c:\xlllffx.exec:\xlllffx.exe172⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe173⤵
-
\??\c:\vvpjj.exec:\vvpjj.exe174⤵
-
\??\c:\rlrrflf.exec:\rlrrflf.exe175⤵
-
\??\c:\nbnhnn.exec:\nbnhnn.exe176⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe177⤵
-
\??\c:\flxrrxl.exec:\flxrrxl.exe178⤵
-
\??\c:\hhhhhh.exec:\hhhhhh.exe179⤵
-
\??\c:\htbhnn.exec:\htbhnn.exe180⤵
-
\??\c:\jdddv.exec:\jdddv.exe181⤵
-
\??\c:\frfrffr.exec:\frfrffr.exe182⤵
-
\??\c:\hthnnn.exec:\hthnnn.exe183⤵
-
\??\c:\5pdvj.exec:\5pdvj.exe184⤵
-
\??\c:\xxrlflx.exec:\xxrlflx.exe185⤵
-
\??\c:\bhthnb.exec:\bhthnb.exe186⤵
-
\??\c:\lffxfrx.exec:\lffxfrx.exe187⤵
-
\??\c:\1rfrlfx.exec:\1rfrlfx.exe188⤵
-
\??\c:\hnbnbn.exec:\hnbnbn.exe189⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe190⤵
-
\??\c:\xrxxxfr.exec:\xrxxxfr.exe191⤵
-
\??\c:\tbhhbb.exec:\tbhhbb.exe192⤵
-
\??\c:\hhtntt.exec:\hhtntt.exe193⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe194⤵
-
\??\c:\lfrllll.exec:\lfrllll.exe195⤵
-
\??\c:\bnbttb.exec:\bnbttb.exe196⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe197⤵
-
\??\c:\lrllllr.exec:\lrllllr.exe198⤵
-
\??\c:\bthttn.exec:\bthttn.exe199⤵
-
\??\c:\dpddj.exec:\dpddj.exe200⤵
-
\??\c:\rrfxffr.exec:\rrfxffr.exe201⤵
-
\??\c:\nnbbnn.exec:\nnbbnn.exe202⤵
-
\??\c:\jvdpd.exec:\jvdpd.exe203⤵
-
\??\c:\lfrxrrl.exec:\lfrxrrl.exe204⤵
-
\??\c:\tbhhth.exec:\tbhhth.exe205⤵
-
\??\c:\nhhtbt.exec:\nhhtbt.exe206⤵
-
\??\c:\pvppj.exec:\pvppj.exe207⤵
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe208⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe209⤵
-
\??\c:\xxfrxll.exec:\xxfrxll.exe210⤵
-
\??\c:\xffxfxf.exec:\xffxfxf.exe211⤵
-
\??\c:\httnnt.exec:\httnnt.exe212⤵
-
\??\c:\dpjpd.exec:\dpjpd.exe213⤵
- System Location Discovery: System Language Discovery
-
\??\c:\lrlrfrr.exec:\lrlrfrr.exe214⤵
-
\??\c:\hnbtth.exec:\hnbtth.exe215⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe216⤵
-
\??\c:\lxxrllr.exec:\lxxrllr.exe217⤵
-
\??\c:\bbnhtt.exec:\bbnhtt.exe218⤵
-
\??\c:\jjvpj.exec:\jjvpj.exe219⤵
-
\??\c:\xrxllxf.exec:\xrxllxf.exe220⤵
-
\??\c:\ttbbbb.exec:\ttbbbb.exe221⤵
-
\??\c:\jdjpd.exec:\jdjpd.exe222⤵
-
\??\c:\fxfrrfl.exec:\fxfrrfl.exe223⤵
-
\??\c:\9ttnnt.exec:\9ttnnt.exe224⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe225⤵
-
\??\c:\7dpjd.exec:\7dpjd.exe226⤵
-
\??\c:\rlrrfrr.exec:\rlrrfrr.exe227⤵
-
\??\c:\bhhbhn.exec:\bhhbhn.exe228⤵
-
\??\c:\jppvp.exec:\jppvp.exe229⤵
-
\??\c:\vdjvd.exec:\vdjvd.exe230⤵
-
\??\c:\lfxfffx.exec:\lfxfffx.exe231⤵
-
\??\c:\hnhbbt.exec:\hnhbbt.exe232⤵
-
\??\c:\7jdvp.exec:\7jdvp.exe233⤵
-
\??\c:\dddvp.exec:\dddvp.exe234⤵
-
\??\c:\ffrlffx.exec:\ffrlffx.exe235⤵
-
\??\c:\djjjj.exec:\djjjj.exe236⤵
- System Location Discovery: System Language Discovery
-
\??\c:\vjvjd.exec:\vjvjd.exe237⤵
-
\??\c:\hntnnn.exec:\hntnnn.exe238⤵
-
\??\c:\vdvdd.exec:\vdvdd.exe239⤵
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe240⤵
-
\??\c:\bhtttb.exec:\bhtttb.exe241⤵