Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 03:20
Behavioral task
behavioral1
Sample
815442f7f882f4d272c50f57132a602bfa79090442c0c7d12db187f65555fea2.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
815442f7f882f4d272c50f57132a602bfa79090442c0c7d12db187f65555fea2.exe
-
Size
367KB
-
MD5
08e2e76b8ae5ddd5b1d5113849a3eba0
-
SHA1
b4ac3da5a19263c6a15040d708b3ae2899281f6e
-
SHA256
815442f7f882f4d272c50f57132a602bfa79090442c0c7d12db187f65555fea2
-
SHA512
db8f95a38b50e11943f2869e0d379ecebb46b3ef90dc7b9c25a7268b2cafdb7b395c825dedc715260134e378223ba44715063d6b0ed9060be33327c4be80575a
-
SSDEEP
6144:9cm4FmowdHoSdSyEAxyx/ZrTTr4qIMgE8L:/4wFHoSQuxy3rTXIM18L
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2652-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/244-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/728-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2336-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/956-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1280-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1156-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3076-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2560-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-636-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-676-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-758-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-783-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxrlfxl.exexffffff.exetbhbtt.exedjpjj.exepjpjd.exelfxrlff.exeppdvd.exelrfxffx.exejpvpv.exelxffrrl.exenttbtt.exevjvdp.exehnbnbh.exe3jjdd.exexlfflxx.exebnhbtt.exevdvvp.exeffxflrx.exe5ttntt.exenbbbtt.exe5thttb.exevdppj.exerlrlrxr.exe9hhbtt.exehhbbhh.exejjjvj.exenhtbbh.exedjpjd.exennbtnn.exevvdvp.exebthbtn.exetbtttn.exexlrxxrl.exentbbtn.exeddvvp.exexffxrrl.exehhtbhh.exejdjpv.exejjvvv.exe3ffrfrx.exehnbtnh.exejvvdj.exejppvd.exexfllffl.exebbhhhb.exevjjdd.exe3rrlrll.exe1llfffx.exenbhnnb.exeppvpv.exexrxrrxf.exe5nhhbt.exetbbbth.exedvdvp.exerxfxrll.exejdddv.exerxrllxr.exelflffff.exethnhhb.exedjvpp.exexxfxxxx.exehbhbbb.exe9ppdv.exevvvpv.exepid process 244 lxrlfxl.exe 1736 xffffff.exe 1952 tbhbtt.exe 1172 djpjj.exe 2156 pjpjd.exe 4024 lfxrlff.exe 5100 ppdvd.exe 4092 lrfxffx.exe 4308 jpvpv.exe 4016 lxffrrl.exe 2280 nttbtt.exe 1600 vjvdp.exe 4960 hnbnbh.exe 1708 3jjdd.exe 4208 xlfflxx.exe 4044 bnhbtt.exe 3684 vdvvp.exe 3932 ffxflrx.exe 1420 5ttntt.exe 956 nbbbtt.exe 2456 5thttb.exe 728 vdppj.exe 1324 rlrlrxr.exe 3968 9hhbtt.exe 2204 hhbbhh.exe 2336 jjjvj.exe 4108 nhtbbh.exe 2116 djpjd.exe 4904 nnbtnn.exe 2012 vvdvp.exe 2460 bthbtn.exe 1628 tbtttn.exe 1280 xlrxxrl.exe 2780 ntbbtn.exe 4116 ddvvp.exe 3252 xffxrrl.exe 1156 hhtbhh.exe 740 jdjpv.exe 4272 jjvvv.exe 3076 3ffrfrx.exe 232 hnbtnh.exe 412 jvvdj.exe 1976 jppvd.exe 2784 xfllffl.exe 2088 bbhhhb.exe 1424 vjjdd.exe 2868 3rrlrll.exe 4316 1llfffx.exe 456 nbhnnb.exe 2560 ppvpv.exe 4900 xrxrrxf.exe 4336 5nhhbt.exe 4092 tbbbth.exe 4688 dvdvp.exe 436 rxfxrll.exe 4928 jdddv.exe 1552 rxrllxr.exe 1972 lflffff.exe 392 thnhhb.exe 3144 djvpp.exe 4208 xxfxxxx.exe 4764 hbhbbb.exe 4468 9ppdv.exe 3932 vvvpv.exe -
Processes:
resource yara_rule behavioral2/memory/2652-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxrlfxl.exe upx behavioral2/memory/2652-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/244-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/244-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xffffff.exe upx C:\tbhbtt.exe upx behavioral2/memory/1952-18-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\djpjj.exe upx behavioral2/memory/1736-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1172-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjpjd.exe upx behavioral2/memory/1172-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2156-34-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxrlff.exe upx C:\ppdvd.exe upx behavioral2/memory/4024-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5100-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrfxffx.exe upx behavioral2/memory/5100-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpvpv.exe upx \??\c:\lxffrrl.exe upx behavioral2/memory/4308-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4016-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2280-67-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nttbtt.exe upx C:\vjvdp.exe upx behavioral2/memory/1600-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnbnbh.exe upx behavioral2/memory/4960-79-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3jjdd.exe upx \??\c:\xlfflxx.exe upx \??\c:\bnhbtt.exe upx behavioral2/memory/4044-93-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vdvvp.exe upx C:\ffxflrx.exe upx behavioral2/memory/3684-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3932-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ttntt.exe upx behavioral2/memory/1420-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbbbtt.exe upx C:\5thttb.exe upx \??\c:\vdppj.exe upx \??\c:\rlrlrxr.exe upx behavioral2/memory/1324-135-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9hhbtt.exe upx behavioral2/memory/3968-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/728-131-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhbbhh.exe upx behavioral2/memory/2204-146-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjjvj.exe upx behavioral2/memory/2336-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/956-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtbbh.exe upx C:\djpjd.exe upx behavioral2/memory/4108-163-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnbtnn.exe upx behavioral2/memory/4904-171-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvdvp.exe upx \??\c:\bthbtn.exe upx behavioral2/memory/2012-181-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbtttn.exe upx behavioral2/memory/1280-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2780-197-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
815442f7f882f4d272c50f57132a602bfa79090442c0c7d12db187f65555fea2.exelxrlfxl.exexffffff.exetbhbtt.exedjpjj.exepjpjd.exelfxrlff.exeppdvd.exelrfxffx.exejpvpv.exelxffrrl.exenttbtt.exevjvdp.exehnbnbh.exe3jjdd.exexlfflxx.exebnhbtt.exevdvvp.exeffxflrx.exe5ttntt.exenbbbtt.exe5thttb.exedescription pid process target process PID 2652 wrote to memory of 244 2652 815442f7f882f4d272c50f57132a602bfa79090442c0c7d12db187f65555fea2.exe lxrlfxl.exe PID 2652 wrote to memory of 244 2652 815442f7f882f4d272c50f57132a602bfa79090442c0c7d12db187f65555fea2.exe lxrlfxl.exe PID 2652 wrote to memory of 244 2652 815442f7f882f4d272c50f57132a602bfa79090442c0c7d12db187f65555fea2.exe lxrlfxl.exe PID 244 wrote to memory of 1736 244 lxrlfxl.exe xffffff.exe PID 244 wrote to memory of 1736 244 lxrlfxl.exe xffffff.exe PID 244 wrote to memory of 1736 244 lxrlfxl.exe xffffff.exe PID 1736 wrote to memory of 1952 1736 xffffff.exe tbhbtt.exe PID 1736 wrote to memory of 1952 1736 xffffff.exe tbhbtt.exe PID 1736 wrote to memory of 1952 1736 xffffff.exe tbhbtt.exe PID 1952 wrote to memory of 1172 1952 tbhbtt.exe djpjj.exe PID 1952 wrote to memory of 1172 1952 tbhbtt.exe djpjj.exe PID 1952 wrote to memory of 1172 1952 tbhbtt.exe djpjj.exe PID 1172 wrote to memory of 2156 1172 djpjj.exe pjpjd.exe PID 1172 wrote to memory of 2156 1172 djpjj.exe pjpjd.exe PID 1172 wrote to memory of 2156 1172 djpjj.exe pjpjd.exe PID 2156 wrote to memory of 4024 2156 pjpjd.exe lfxrlff.exe PID 2156 wrote to memory of 4024 2156 pjpjd.exe lfxrlff.exe PID 2156 wrote to memory of 4024 2156 pjpjd.exe lfxrlff.exe PID 4024 wrote to memory of 5100 4024 lfxrlff.exe ppdvd.exe PID 4024 wrote to memory of 5100 4024 lfxrlff.exe ppdvd.exe PID 4024 wrote to memory of 5100 4024 lfxrlff.exe ppdvd.exe PID 5100 wrote to memory of 4092 5100 ppdvd.exe lrfxffx.exe PID 5100 wrote to memory of 4092 5100 ppdvd.exe lrfxffx.exe PID 5100 wrote to memory of 4092 5100 ppdvd.exe lrfxffx.exe PID 4092 wrote to memory of 4308 4092 lrfxffx.exe jpvpv.exe PID 4092 wrote to memory of 4308 4092 lrfxffx.exe jpvpv.exe PID 4092 wrote to memory of 4308 4092 lrfxffx.exe jpvpv.exe PID 4308 wrote to memory of 4016 4308 jpvpv.exe lxffrrl.exe PID 4308 wrote to memory of 4016 4308 jpvpv.exe lxffrrl.exe PID 4308 wrote to memory of 4016 4308 jpvpv.exe lxffrrl.exe PID 4016 wrote to memory of 2280 4016 lxffrrl.exe nttbtt.exe PID 4016 wrote to memory of 2280 4016 lxffrrl.exe nttbtt.exe PID 4016 wrote to memory of 2280 4016 lxffrrl.exe nttbtt.exe PID 2280 wrote to memory of 1600 2280 nttbtt.exe vjvdp.exe PID 2280 wrote to memory of 1600 2280 nttbtt.exe vjvdp.exe PID 2280 wrote to memory of 1600 2280 nttbtt.exe vjvdp.exe PID 1600 wrote to memory of 4960 1600 vjvdp.exe hnbnbh.exe PID 1600 wrote to memory of 4960 1600 vjvdp.exe hnbnbh.exe PID 1600 wrote to memory of 4960 1600 vjvdp.exe hnbnbh.exe PID 4960 wrote to memory of 1708 4960 hnbnbh.exe 3jjdd.exe PID 4960 wrote to memory of 1708 4960 hnbnbh.exe 3jjdd.exe PID 4960 wrote to memory of 1708 4960 hnbnbh.exe 3jjdd.exe PID 1708 wrote to memory of 4208 1708 3jjdd.exe xlfflxx.exe PID 1708 wrote to memory of 4208 1708 3jjdd.exe xlfflxx.exe PID 1708 wrote to memory of 4208 1708 3jjdd.exe xlfflxx.exe PID 4208 wrote to memory of 4044 4208 xlfflxx.exe bnhbtt.exe PID 4208 wrote to memory of 4044 4208 xlfflxx.exe bnhbtt.exe PID 4208 wrote to memory of 4044 4208 xlfflxx.exe bnhbtt.exe PID 4044 wrote to memory of 3684 4044 bnhbtt.exe vdvvp.exe PID 4044 wrote to memory of 3684 4044 bnhbtt.exe vdvvp.exe PID 4044 wrote to memory of 3684 4044 bnhbtt.exe vdvvp.exe PID 3684 wrote to memory of 3932 3684 vdvvp.exe ffxflrx.exe PID 3684 wrote to memory of 3932 3684 vdvvp.exe ffxflrx.exe PID 3684 wrote to memory of 3932 3684 vdvvp.exe ffxflrx.exe PID 3932 wrote to memory of 1420 3932 ffxflrx.exe 5ttntt.exe PID 3932 wrote to memory of 1420 3932 ffxflrx.exe 5ttntt.exe PID 3932 wrote to memory of 1420 3932 ffxflrx.exe 5ttntt.exe PID 1420 wrote to memory of 956 1420 5ttntt.exe nbbbtt.exe PID 1420 wrote to memory of 956 1420 5ttntt.exe nbbbtt.exe PID 1420 wrote to memory of 956 1420 5ttntt.exe nbbbtt.exe PID 956 wrote to memory of 2456 956 nbbbtt.exe 5thttb.exe PID 956 wrote to memory of 2456 956 nbbbtt.exe 5thttb.exe PID 956 wrote to memory of 2456 956 nbbbtt.exe 5thttb.exe PID 2456 wrote to memory of 728 2456 5thttb.exe vdppj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\815442f7f882f4d272c50f57132a602bfa79090442c0c7d12db187f65555fea2.exe"C:\Users\Admin\AppData\Local\Temp\815442f7f882f4d272c50f57132a602bfa79090442c0c7d12db187f65555fea2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lxrlfxl.exec:\lxrlfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xffffff.exec:\xffffff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbhbtt.exec:\tbhbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djpjj.exec:\djpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpjd.exec:\pjpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxrlff.exec:\lfxrlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppdvd.exec:\ppdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrfxffx.exec:\lrfxffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvpv.exec:\jpvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxffrrl.exec:\lxffrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nttbtt.exec:\nttbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvdp.exec:\vjvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbnbh.exec:\hnbnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3jjdd.exec:\3jjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlfflxx.exec:\xlfflxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhbtt.exec:\bnhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdvvp.exec:\vdvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxflrx.exec:\ffxflrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5ttntt.exec:\5ttntt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbbtt.exec:\nbbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5thttb.exec:\5thttb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdppj.exec:\vdppj.exe23⤵
- Executes dropped EXE
-
\??\c:\rlrlrxr.exec:\rlrlrxr.exe24⤵
- Executes dropped EXE
-
\??\c:\9hhbtt.exec:\9hhbtt.exe25⤵
- Executes dropped EXE
-
\??\c:\hhbbhh.exec:\hhbbhh.exe26⤵
- Executes dropped EXE
-
\??\c:\jjjvj.exec:\jjjvj.exe27⤵
- Executes dropped EXE
-
\??\c:\nhtbbh.exec:\nhtbbh.exe28⤵
- Executes dropped EXE
-
\??\c:\djpjd.exec:\djpjd.exe29⤵
- Executes dropped EXE
-
\??\c:\nnbtnn.exec:\nnbtnn.exe30⤵
- Executes dropped EXE
-
\??\c:\vvdvp.exec:\vvdvp.exe31⤵
- Executes dropped EXE
-
\??\c:\bthbtn.exec:\bthbtn.exe32⤵
- Executes dropped EXE
-
\??\c:\tbtttn.exec:\tbtttn.exe33⤵
- Executes dropped EXE
-
\??\c:\xlrxxrl.exec:\xlrxxrl.exe34⤵
- Executes dropped EXE
-
\??\c:\ntbbtn.exec:\ntbbtn.exe35⤵
- Executes dropped EXE
-
\??\c:\ddvvp.exec:\ddvvp.exe36⤵
- Executes dropped EXE
-
\??\c:\xffxrrl.exec:\xffxrrl.exe37⤵
- Executes dropped EXE
-
\??\c:\hhtbhh.exec:\hhtbhh.exe38⤵
- Executes dropped EXE
-
\??\c:\jdjpv.exec:\jdjpv.exe39⤵
- Executes dropped EXE
-
\??\c:\jjvvv.exec:\jjvvv.exe40⤵
- Executes dropped EXE
-
\??\c:\3ffrfrx.exec:\3ffrfrx.exe41⤵
- Executes dropped EXE
-
\??\c:\hnbtnh.exec:\hnbtnh.exe42⤵
- Executes dropped EXE
-
\??\c:\jvvdj.exec:\jvvdj.exe43⤵
- Executes dropped EXE
-
\??\c:\jppvd.exec:\jppvd.exe44⤵
- Executes dropped EXE
-
\??\c:\xfllffl.exec:\xfllffl.exe45⤵
- Executes dropped EXE
-
\??\c:\bbhhhb.exec:\bbhhhb.exe46⤵
- Executes dropped EXE
-
\??\c:\vjjdd.exec:\vjjdd.exe47⤵
- Executes dropped EXE
-
\??\c:\3rrlrll.exec:\3rrlrll.exe48⤵
- Executes dropped EXE
-
\??\c:\1llfffx.exec:\1llfffx.exe49⤵
- Executes dropped EXE
-
\??\c:\nbhnnb.exec:\nbhnnb.exe50⤵
- Executes dropped EXE
-
\??\c:\ppvpv.exec:\ppvpv.exe51⤵
- Executes dropped EXE
-
\??\c:\xrxrrxf.exec:\xrxrrxf.exe52⤵
- Executes dropped EXE
-
\??\c:\5nhhbt.exec:\5nhhbt.exe53⤵
- Executes dropped EXE
-
\??\c:\tbbbth.exec:\tbbbth.exe54⤵
- Executes dropped EXE
-
\??\c:\dvdvp.exec:\dvdvp.exe55⤵
- Executes dropped EXE
-
\??\c:\rxfxrll.exec:\rxfxrll.exe56⤵
- Executes dropped EXE
-
\??\c:\jdddv.exec:\jdddv.exe57⤵
- Executes dropped EXE
-
\??\c:\rxrllxr.exec:\rxrllxr.exe58⤵
- Executes dropped EXE
-
\??\c:\lflffff.exec:\lflffff.exe59⤵
- Executes dropped EXE
-
\??\c:\thnhhb.exec:\thnhhb.exe60⤵
- Executes dropped EXE
-
\??\c:\djvpp.exec:\djvpp.exe61⤵
- Executes dropped EXE
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe62⤵
- Executes dropped EXE
-
\??\c:\hbhbbb.exec:\hbhbbb.exe63⤵
- Executes dropped EXE
-
\??\c:\9ppdv.exec:\9ppdv.exe64⤵
- Executes dropped EXE
-
\??\c:\vvvpv.exec:\vvvpv.exe65⤵
- Executes dropped EXE
-
\??\c:\xrxrxrr.exec:\xrxrxrr.exe66⤵
-
\??\c:\hnnbbh.exec:\hnnbbh.exe67⤵
-
\??\c:\pjppj.exec:\pjppj.exe68⤵
-
\??\c:\pvjjj.exec:\pvjjj.exe69⤵
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe70⤵
-
\??\c:\bnnnnb.exec:\bnnnnb.exe71⤵
-
\??\c:\3vvdv.exec:\3vvdv.exe72⤵
-
\??\c:\7llfxxx.exec:\7llfxxx.exe73⤵
-
\??\c:\xlxrrff.exec:\xlxrrff.exe74⤵
-
\??\c:\hbhbbb.exec:\hbhbbb.exe75⤵
-
\??\c:\ttttnn.exec:\ttttnn.exe76⤵
-
\??\c:\dvddj.exec:\dvddj.exe77⤵
-
\??\c:\rllfffx.exec:\rllfffx.exe78⤵
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe79⤵
-
\??\c:\tthtnt.exec:\tthtnt.exe80⤵
-
\??\c:\9jjdv.exec:\9jjdv.exe81⤵
-
\??\c:\fxfxxfx.exec:\fxfxxfx.exe82⤵
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe83⤵
-
\??\c:\tntnhb.exec:\tntnhb.exe84⤵
-
\??\c:\rfffffx.exec:\rfffffx.exe85⤵
-
\??\c:\9rxrrrr.exec:\9rxrrrr.exe86⤵
-
\??\c:\7bhbth.exec:\7bhbth.exe87⤵
-
\??\c:\vvvvp.exec:\vvvvp.exe88⤵
-
\??\c:\xfxrlll.exec:\xfxrlll.exe89⤵
-
\??\c:\lffffff.exec:\lffffff.exe90⤵
-
\??\c:\tnthhh.exec:\tnthhh.exe91⤵
-
\??\c:\jdvpp.exec:\jdvpp.exe92⤵
-
\??\c:\3fffxxx.exec:\3fffxxx.exe93⤵
-
\??\c:\nhbthn.exec:\nhbthn.exe94⤵
-
\??\c:\djjjv.exec:\djjjv.exe95⤵
-
\??\c:\dvpdv.exec:\dvpdv.exe96⤵
-
\??\c:\lxlrlll.exec:\lxlrlll.exe97⤵
-
\??\c:\nhhbnh.exec:\nhhbnh.exe98⤵
-
\??\c:\7jppj.exec:\7jppj.exe99⤵
-
\??\c:\dvppd.exec:\dvppd.exe100⤵
-
\??\c:\fllfxxr.exec:\fllfxxr.exe101⤵
-
\??\c:\7hhbtb.exec:\7hhbtb.exe102⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe103⤵
-
\??\c:\lxxllrx.exec:\lxxllrx.exe104⤵
-
\??\c:\9nhbbn.exec:\9nhbbn.exe105⤵
-
\??\c:\dpdvp.exec:\dpdvp.exe106⤵
-
\??\c:\xxfrxrf.exec:\xxfrxrf.exe107⤵
-
\??\c:\hntbnt.exec:\hntbnt.exe108⤵
-
\??\c:\dpjvj.exec:\dpjvj.exe109⤵
-
\??\c:\xffffff.exec:\xffffff.exe110⤵
-
\??\c:\xxxrllf.exec:\xxxrllf.exe111⤵
-
\??\c:\5nnhhh.exec:\5nnhhh.exe112⤵
-
\??\c:\vpppp.exec:\vpppp.exe113⤵
-
\??\c:\llrrrlf.exec:\llrrrlf.exe114⤵
-
\??\c:\tnnhhh.exec:\tnnhhh.exe115⤵
-
\??\c:\pvddj.exec:\pvddj.exe116⤵
-
\??\c:\jvvpd.exec:\jvvpd.exe117⤵
-
\??\c:\7rrxrfx.exec:\7rrxrfx.exe118⤵
-
\??\c:\htbbtt.exec:\htbbtt.exe119⤵
-
\??\c:\3vvdd.exec:\3vvdd.exe120⤵
-
\??\c:\lffxrrf.exec:\lffxrrf.exe121⤵
-
\??\c:\bbtntt.exec:\bbtntt.exe122⤵
-
\??\c:\9hhbtt.exec:\9hhbtt.exe123⤵
-
\??\c:\pjvvp.exec:\pjvvp.exe124⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe125⤵
-
\??\c:\xrfxrxr.exec:\xrfxrxr.exe126⤵
-
\??\c:\bthhnn.exec:\bthhnn.exe127⤵
-
\??\c:\btttnh.exec:\btttnh.exe128⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe129⤵
-
\??\c:\rxxrlrr.exec:\rxxrlrr.exe130⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe131⤵
-
\??\c:\5vddd.exec:\5vddd.exe132⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe133⤵
-
\??\c:\xrfrrxr.exec:\xrfrrxr.exe134⤵
-
\??\c:\btbbtt.exec:\btbbtt.exe135⤵
-
\??\c:\5djdd.exec:\5djdd.exe136⤵
-
\??\c:\vjpjp.exec:\vjpjp.exe137⤵
-
\??\c:\rllfxrl.exec:\rllfxrl.exe138⤵
-
\??\c:\3hhbbb.exec:\3hhbbb.exe139⤵
-
\??\c:\1bhhnn.exec:\1bhhnn.exe140⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe141⤵
-
\??\c:\llfrrrx.exec:\llfrrrx.exe142⤵
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe143⤵
-
\??\c:\tntnhb.exec:\tntnhb.exe144⤵
-
\??\c:\dvppv.exec:\dvppv.exe145⤵
-
\??\c:\pvvpj.exec:\pvvpj.exe146⤵
-
\??\c:\1fffxff.exec:\1fffxff.exe147⤵
-
\??\c:\bnthbb.exec:\bnthbb.exe148⤵
-
\??\c:\hbhbnh.exec:\hbhbnh.exe149⤵
-
\??\c:\xxxrlrx.exec:\xxxrlrx.exe150⤵
-
\??\c:\frrlfxr.exec:\frrlfxr.exe151⤵
-
\??\c:\5bhbhn.exec:\5bhbhn.exe152⤵
-
\??\c:\thnnhb.exec:\thnnhb.exe153⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe154⤵
-
\??\c:\fxllxrx.exec:\fxllxrx.exe155⤵
-
\??\c:\thnhhh.exec:\thnhhh.exe156⤵
-
\??\c:\dvjjd.exec:\dvjjd.exe157⤵
-
\??\c:\dpvdp.exec:\dpvdp.exe158⤵
-
\??\c:\rrfxlxr.exec:\rrfxlxr.exe159⤵
-
\??\c:\bnbttt.exec:\bnbttt.exe160⤵
-
\??\c:\hntbbb.exec:\hntbbb.exe161⤵
-
\??\c:\vvpjj.exec:\vvpjj.exe162⤵
-
\??\c:\xrxrllr.exec:\xrxrllr.exe163⤵
-
\??\c:\lfxxlxl.exec:\lfxxlxl.exe164⤵
-
\??\c:\tntnhn.exec:\tntnhn.exe165⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe166⤵
-
\??\c:\vppjj.exec:\vppjj.exe167⤵
-
\??\c:\7ffllll.exec:\7ffllll.exe168⤵
-
\??\c:\nnhbnn.exec:\nnhbnn.exe169⤵
-
\??\c:\vjjjd.exec:\vjjjd.exe170⤵
-
\??\c:\frfxrrl.exec:\frfxrrl.exe171⤵
-
\??\c:\7xlfxfx.exec:\7xlfxfx.exe172⤵
-
\??\c:\5ntnnn.exec:\5ntnnn.exe173⤵
-
\??\c:\pvjjd.exec:\pvjjd.exe174⤵
-
\??\c:\vdjdj.exec:\vdjdj.exe175⤵
-
\??\c:\xxllrxf.exec:\xxllrxf.exe176⤵
-
\??\c:\7bhhhh.exec:\7bhhhh.exe177⤵
-
\??\c:\jvppp.exec:\jvppp.exe178⤵
-
\??\c:\rrrrlfx.exec:\rrrrlfx.exe179⤵
-
\??\c:\9nthnb.exec:\9nthnb.exe180⤵
-
\??\c:\7pdpj.exec:\7pdpj.exe181⤵
-
\??\c:\rrlrlrl.exec:\rrlrlrl.exe182⤵
-
\??\c:\tntbbh.exec:\tntbbh.exe183⤵
-
\??\c:\bntbbb.exec:\bntbbb.exe184⤵
-
\??\c:\ddjpp.exec:\ddjpp.exe185⤵
-
\??\c:\7xrllrx.exec:\7xrllrx.exe186⤵
-
\??\c:\tnhhbb.exec:\tnhhbb.exe187⤵
-
\??\c:\tntnnn.exec:\tntnnn.exe188⤵
-
\??\c:\jjppj.exec:\jjppj.exe189⤵
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe190⤵
-
\??\c:\rrxrrxx.exec:\rrxrrxx.exe191⤵
-
\??\c:\1bnhhh.exec:\1bnhhh.exe192⤵
-
\??\c:\jjvvd.exec:\jjvvd.exe193⤵
-
\??\c:\5vddd.exec:\5vddd.exe194⤵
-
\??\c:\rrfrllr.exec:\rrfrllr.exe195⤵
-
\??\c:\bhnhbt.exec:\bhnhbt.exe196⤵
-
\??\c:\vpppv.exec:\vpppv.exe197⤵
-
\??\c:\lrxrffr.exec:\lrxrffr.exe198⤵
-
\??\c:\frxxrrr.exec:\frxxrrr.exe199⤵
-
\??\c:\nhbtnh.exec:\nhbtnh.exe200⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe201⤵
-
\??\c:\5dddv.exec:\5dddv.exe202⤵
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe203⤵
-
\??\c:\htntbt.exec:\htntbt.exe204⤵
-
\??\c:\1nnhth.exec:\1nnhth.exe205⤵
-
\??\c:\pvdvv.exec:\pvdvv.exe206⤵
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe207⤵
-
\??\c:\bbhhhh.exec:\bbhhhh.exe208⤵
-
\??\c:\jvdpp.exec:\jvdpp.exe209⤵
-
\??\c:\jvdjj.exec:\jvdjj.exe210⤵
-
\??\c:\rrllfff.exec:\rrllfff.exe211⤵
-
\??\c:\tnttnt.exec:\tnttnt.exe212⤵
-
\??\c:\5hhhbh.exec:\5hhhbh.exe213⤵
-
\??\c:\jvppv.exec:\jvppv.exe214⤵
-
\??\c:\fffxllf.exec:\fffxllf.exe215⤵
-
\??\c:\httnhh.exec:\httnhh.exe216⤵
-
\??\c:\dpppp.exec:\dpppp.exe217⤵
-
\??\c:\lrfxxrl.exec:\lrfxxrl.exe218⤵
-
\??\c:\bbhhhn.exec:\bbhhhn.exe219⤵
-
\??\c:\vdjjj.exec:\vdjjj.exe220⤵
-
\??\c:\pvdvv.exec:\pvdvv.exe221⤵
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe222⤵
-
\??\c:\bbbthh.exec:\bbbthh.exe223⤵
-
\??\c:\jvvvp.exec:\jvvvp.exe224⤵
-
\??\c:\7dpjd.exec:\7dpjd.exe225⤵
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe226⤵
-
\??\c:\lxfxrlr.exec:\lxfxrlr.exe227⤵
-
\??\c:\tbhbnb.exec:\tbhbnb.exe228⤵
-
\??\c:\vpjpd.exec:\vpjpd.exe229⤵
-
\??\c:\1lrlfxr.exec:\1lrlfxr.exe230⤵
-
\??\c:\nnbthh.exec:\nnbthh.exe231⤵
-
\??\c:\dppjv.exec:\dppjv.exe232⤵
-
\??\c:\7xxxrxr.exec:\7xxxrxr.exe233⤵
-
\??\c:\xlrllll.exec:\xlrllll.exe234⤵
-
\??\c:\httnhb.exec:\httnhb.exe235⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe236⤵
-
\??\c:\dddpj.exec:\dddpj.exe237⤵
-
\??\c:\lrffffx.exec:\lrffffx.exe238⤵
-
\??\c:\tnthbt.exec:\tnthbt.exe239⤵
-
\??\c:\1vpjd.exec:\1vpjd.exe240⤵
-
\??\c:\rxlxxlf.exec:\rxlxxlf.exe241⤵