Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 18:42
Behavioral task
behavioral1
Sample
0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe
-
Size
58KB
-
MD5
10a9a6f41cc3b5e70acb6ca9a5ca4561
-
SHA1
ab0959f879972a4a75889c8e3912a1a73613a13a
-
SHA256
0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4
-
SHA512
fb313cd0d8153b10355bb128c043c2867cd27866ea372d0e23f77559e58aafa3e390e728e47718cf6424cf59fcf47c1b642b56adab9abac5b3278845722f5c2c
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNG1mjtREVR:khOmTsF93UYfwC6GIoutpY918cn
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/3008-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-81-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2984-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1232-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1092-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1040-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1364-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1348-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-400-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2728-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/396-569-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-898-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-955-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-1039-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2432-1310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-1317-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/3008-1-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhhtbn.exe UPX behavioral1/memory/3040-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\vpdjd.exe UPX behavioral1/memory/2884-18-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lfxflrx.exe UPX behavioral1/memory/2628-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2884-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3040-16-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5nnthb.exe UPX behavioral1/memory/2808-44-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/memory/2808-40-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\3lllxff.exe UPX \??\c:\vdjjp.exe UPX behavioral1/memory/2652-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2852-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxrffrx.exe UPX \??\c:\9nhbth.exe UPX behavioral1/memory/2684-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\htnbtt.exe UPX behavioral1/memory/2640-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2984-96-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pjvdp.exe UPX behavioral1/memory/2640-93-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fflxrll.exe UPX C:\nhhbhh.exe UPX behavioral1/memory/2748-113-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nnnhhn.exe UPX C:\ddvpv.exe UPX behavioral1/memory/2016-128-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2452-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rrllrxf.exe UPX C:\bbnhtn.exe UPX behavioral1/memory/1956-147-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1232-146-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nnttbb.exe UPX behavioral1/memory/1956-155-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9pddv.exe UPX C:\rflxxlr.exe UPX C:\llfxlfx.exe UPX behavioral1/memory/1556-182-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1092-181-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhbnbh.exe UPX C:\pjdjv.exe UPX behavioral1/memory/2360-199-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pppjd.exe UPX C:\ffxxrxr.exe UPX behavioral1/memory/2696-217-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhttht.exe UPX C:\htbtbt.exe UPX behavioral1/memory/1040-235-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9vddd.exe UPX behavioral1/memory/1364-249-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rlxxlrf.exe UPX C:\nnttbb.exe UPX behavioral1/memory/1652-258-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1508-268-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vvpvj.exe UPX behavioral1/memory/1348-270-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppdjj.exe UPX behavioral1/memory/2124-289-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\lxflrxx.exe UPX behavioral1/memory/1252-285-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2864-313-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
nhhtbn.exevpdjd.exelfxflrx.exe3lllxff.exe5nnthb.exevdjjp.exexxrffrx.exe9nhbth.exehtnbtt.exepjvdp.exefflxrll.exenhhbhh.exennnhhn.exeddvpv.exerrllrxf.exebbnhtn.exennttbb.exe9pddv.exerflxxlr.exellfxlfx.exenhbnbh.exepjdjv.exepppjd.exeffxxrxr.exehhttht.exehtbtbt.exe9vddd.exerlxxlrf.exennttbb.exevvpvj.exeppdjj.exelxflrxx.exehbntbh.exevvppp.exepjddd.exe7fxllrf.exe5xxrflx.exe3nbbtn.exetthnbh.exejdvvj.exe7pdvd.exexxrxrrx.exehhbhtb.exettnthn.exejjvjp.exedvpjv.exerrrrxlx.exexrfrrfl.exe1hthnt.exedvjpd.exejdvdp.exe9rrxllf.exexrrflxf.exe5nnnnn.exepdvvv.exellfrfff.exe9lllrrf.exebbtntb.exepvpvv.exe3vvdp.exelfrfllx.exelxlrffl.exe1nntnt.exebtnntb.exepid process 3040 nhhtbn.exe 2884 vpdjd.exe 2628 lfxflrx.exe 2808 3lllxff.exe 2652 5nnthb.exe 2852 vdjjp.exe 2684 xxrffrx.exe 2524 9nhbth.exe 2640 htnbtt.exe 2984 pjvdp.exe 1684 fflxrll.exe 2748 nhhbhh.exe 2016 nnnhhn.exe 2452 ddvpv.exe 1232 rrllrxf.exe 1956 bbnhtn.exe 348 nnttbb.exe 596 9pddv.exe 1092 rflxxlr.exe 1556 llfxlfx.exe 2956 nhbnbh.exe 2360 pjdjv.exe 2740 pppjd.exe 2696 ffxxrxr.exe 1496 hhttht.exe 1040 htbtbt.exe 1364 9vddd.exe 1652 rlxxlrf.exe 1508 nnttbb.exe 1348 vvpvj.exe 1252 ppdjj.exe 2124 lxflrxx.exe 1464 hbntbh.exe 2216 vvppp.exe 2600 pjddd.exe 2864 7fxllrf.exe 2860 5xxrflx.exe 3044 3nbbtn.exe 2612 tthnbh.exe 2848 jdvvj.exe 2636 7pdvd.exe 2608 xxrxrrx.exe 2688 hhbhtb.exe 2520 ttnthn.exe 2516 jjvjp.exe 2164 dvpjv.exe 2640 rrrrxlx.exe 2204 xrfrrfl.exe 1576 1hthnt.exe 1052 dvjpd.exe 1988 jdvdp.exe 2728 9rrxllf.exe 1844 xrrflxf.exe 1928 5nnnnn.exe 2000 pdvvv.exe 1972 llfrfff.exe 688 9lllrrf.exe 1004 bbtntb.exe 2432 pvpvv.exe 1616 3vvdp.exe 1512 lfrfllx.exe 2872 lxlrffl.exe 2360 1nntnt.exe 3060 btnntb.exe -
Processes:
resource yara_rule behavioral1/memory/3008-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhtbn.exe upx behavioral1/memory/3040-8-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vpdjd.exe upx behavioral1/memory/2884-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxflrx.exe upx behavioral1/memory/2628-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3040-16-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5nnthb.exe upx behavioral1/memory/2808-44-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2808-40-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3lllxff.exe upx \??\c:\vdjjp.exe upx behavioral1/memory/2652-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2852-59-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrffrx.exe upx \??\c:\9nhbth.exe upx behavioral1/memory/2684-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htnbtt.exe upx behavioral1/memory/2640-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-96-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjvdp.exe upx behavioral1/memory/2640-93-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fflxrll.exe upx C:\nhhbhh.exe upx behavioral1/memory/2748-113-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnnhhn.exe upx C:\ddvpv.exe upx behavioral1/memory/2016-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2452-131-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrllrxf.exe upx C:\bbnhtn.exe upx behavioral1/memory/1956-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1232-146-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnttbb.exe upx behavioral1/memory/1956-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9pddv.exe upx C:\rflxxlr.exe upx C:\llfxlfx.exe upx behavioral1/memory/1556-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1092-181-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbnbh.exe upx C:\pjdjv.exe upx behavioral1/memory/2360-199-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pppjd.exe upx C:\ffxxrxr.exe upx behavioral1/memory/2696-217-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhttht.exe upx C:\htbtbt.exe upx behavioral1/memory/1040-235-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vddd.exe upx behavioral1/memory/1364-249-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlxxlrf.exe upx C:\nnttbb.exe upx behavioral1/memory/1652-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1508-268-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvpvj.exe upx behavioral1/memory/1348-270-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppdjj.exe upx behavioral1/memory/2124-289-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxflrxx.exe upx behavioral1/memory/1252-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-313-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exenhhtbn.exevpdjd.exelfxflrx.exe3lllxff.exe5nnthb.exevdjjp.exexxrffrx.exe9nhbth.exehtnbtt.exepjvdp.exefflxrll.exenhhbhh.exennnhhn.exeddvpv.exerrllrxf.exedescription pid process target process PID 3008 wrote to memory of 3040 3008 0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe nhhtbn.exe PID 3008 wrote to memory of 3040 3008 0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe nhhtbn.exe PID 3008 wrote to memory of 3040 3008 0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe nhhtbn.exe PID 3008 wrote to memory of 3040 3008 0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe nhhtbn.exe PID 3040 wrote to memory of 2884 3040 nhhtbn.exe vpdjd.exe PID 3040 wrote to memory of 2884 3040 nhhtbn.exe vpdjd.exe PID 3040 wrote to memory of 2884 3040 nhhtbn.exe vpdjd.exe PID 3040 wrote to memory of 2884 3040 nhhtbn.exe vpdjd.exe PID 2884 wrote to memory of 2628 2884 vpdjd.exe lfxflrx.exe PID 2884 wrote to memory of 2628 2884 vpdjd.exe lfxflrx.exe PID 2884 wrote to memory of 2628 2884 vpdjd.exe lfxflrx.exe PID 2884 wrote to memory of 2628 2884 vpdjd.exe lfxflrx.exe PID 2628 wrote to memory of 2808 2628 lfxflrx.exe 3lllxff.exe PID 2628 wrote to memory of 2808 2628 lfxflrx.exe 3lllxff.exe PID 2628 wrote to memory of 2808 2628 lfxflrx.exe 3lllxff.exe PID 2628 wrote to memory of 2808 2628 lfxflrx.exe 3lllxff.exe PID 2808 wrote to memory of 2652 2808 3lllxff.exe 5nnthb.exe PID 2808 wrote to memory of 2652 2808 3lllxff.exe 5nnthb.exe PID 2808 wrote to memory of 2652 2808 3lllxff.exe 5nnthb.exe PID 2808 wrote to memory of 2652 2808 3lllxff.exe 5nnthb.exe PID 2652 wrote to memory of 2852 2652 5nnthb.exe vdjjp.exe PID 2652 wrote to memory of 2852 2652 5nnthb.exe vdjjp.exe PID 2652 wrote to memory of 2852 2652 5nnthb.exe vdjjp.exe PID 2652 wrote to memory of 2852 2652 5nnthb.exe vdjjp.exe PID 2852 wrote to memory of 2684 2852 vdjjp.exe xxrffrx.exe PID 2852 wrote to memory of 2684 2852 vdjjp.exe xxrffrx.exe PID 2852 wrote to memory of 2684 2852 vdjjp.exe xxrffrx.exe PID 2852 wrote to memory of 2684 2852 vdjjp.exe xxrffrx.exe PID 2684 wrote to memory of 2524 2684 xxrffrx.exe 9nhbth.exe PID 2684 wrote to memory of 2524 2684 xxrffrx.exe 9nhbth.exe PID 2684 wrote to memory of 2524 2684 xxrffrx.exe 9nhbth.exe PID 2684 wrote to memory of 2524 2684 xxrffrx.exe 9nhbth.exe PID 2524 wrote to memory of 2640 2524 9nhbth.exe htnbtt.exe PID 2524 wrote to memory of 2640 2524 9nhbth.exe htnbtt.exe PID 2524 wrote to memory of 2640 2524 9nhbth.exe htnbtt.exe PID 2524 wrote to memory of 2640 2524 9nhbth.exe htnbtt.exe PID 2640 wrote to memory of 2984 2640 htnbtt.exe pjvdp.exe PID 2640 wrote to memory of 2984 2640 htnbtt.exe pjvdp.exe PID 2640 wrote to memory of 2984 2640 htnbtt.exe pjvdp.exe PID 2640 wrote to memory of 2984 2640 htnbtt.exe pjvdp.exe PID 2984 wrote to memory of 1684 2984 pjvdp.exe fflxrll.exe PID 2984 wrote to memory of 1684 2984 pjvdp.exe fflxrll.exe PID 2984 wrote to memory of 1684 2984 pjvdp.exe fflxrll.exe PID 2984 wrote to memory of 1684 2984 pjvdp.exe fflxrll.exe PID 1684 wrote to memory of 2748 1684 fflxrll.exe nhhbhh.exe PID 1684 wrote to memory of 2748 1684 fflxrll.exe nhhbhh.exe PID 1684 wrote to memory of 2748 1684 fflxrll.exe nhhbhh.exe PID 1684 wrote to memory of 2748 1684 fflxrll.exe nhhbhh.exe PID 2748 wrote to memory of 2016 2748 nhhbhh.exe nnnhhn.exe PID 2748 wrote to memory of 2016 2748 nhhbhh.exe nnnhhn.exe PID 2748 wrote to memory of 2016 2748 nhhbhh.exe nnnhhn.exe PID 2748 wrote to memory of 2016 2748 nhhbhh.exe nnnhhn.exe PID 2016 wrote to memory of 2452 2016 nnnhhn.exe ddvpv.exe PID 2016 wrote to memory of 2452 2016 nnnhhn.exe ddvpv.exe PID 2016 wrote to memory of 2452 2016 nnnhhn.exe ddvpv.exe PID 2016 wrote to memory of 2452 2016 nnnhhn.exe ddvpv.exe PID 2452 wrote to memory of 1232 2452 ddvpv.exe rrllrxf.exe PID 2452 wrote to memory of 1232 2452 ddvpv.exe rrllrxf.exe PID 2452 wrote to memory of 1232 2452 ddvpv.exe rrllrxf.exe PID 2452 wrote to memory of 1232 2452 ddvpv.exe rrllrxf.exe PID 1232 wrote to memory of 1956 1232 rrllrxf.exe bbnhtn.exe PID 1232 wrote to memory of 1956 1232 rrllrxf.exe bbnhtn.exe PID 1232 wrote to memory of 1956 1232 rrllrxf.exe bbnhtn.exe PID 1232 wrote to memory of 1956 1232 rrllrxf.exe bbnhtn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe"C:\Users\Admin\AppData\Local\Temp\0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhtbn.exec:\nhhtbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdjd.exec:\vpdjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxflrx.exec:\lfxflrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lllxff.exec:\3lllxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nnthb.exec:\5nnthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdjjp.exec:\vdjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrffrx.exec:\xxrffrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9nhbth.exec:\9nhbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnbtt.exec:\htnbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvdp.exec:\pjvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflxrll.exec:\fflxrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhbhh.exec:\nhhbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnnhhn.exec:\nnnhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvpv.exec:\ddvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrllrxf.exec:\rrllrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnhtn.exec:\bbnhtn.exe17⤵
- Executes dropped EXE
-
\??\c:\nnttbb.exec:\nnttbb.exe18⤵
- Executes dropped EXE
-
\??\c:\9pddv.exec:\9pddv.exe19⤵
- Executes dropped EXE
-
\??\c:\rflxxlr.exec:\rflxxlr.exe20⤵
- Executes dropped EXE
-
\??\c:\llfxlfx.exec:\llfxlfx.exe21⤵
- Executes dropped EXE
-
\??\c:\nhbnbh.exec:\nhbnbh.exe22⤵
- Executes dropped EXE
-
\??\c:\pjdjv.exec:\pjdjv.exe23⤵
- Executes dropped EXE
-
\??\c:\pppjd.exec:\pppjd.exe24⤵
- Executes dropped EXE
-
\??\c:\ffxxrxr.exec:\ffxxrxr.exe25⤵
- Executes dropped EXE
-
\??\c:\hhttht.exec:\hhttht.exe26⤵
- Executes dropped EXE
-
\??\c:\htbtbt.exec:\htbtbt.exe27⤵
- Executes dropped EXE
-
\??\c:\9vddd.exec:\9vddd.exe28⤵
- Executes dropped EXE
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe29⤵
- Executes dropped EXE
-
\??\c:\nnttbb.exec:\nnttbb.exe30⤵
- Executes dropped EXE
-
\??\c:\vvpvj.exec:\vvpvj.exe31⤵
- Executes dropped EXE
-
\??\c:\ppdjj.exec:\ppdjj.exe32⤵
- Executes dropped EXE
-
\??\c:\lxflrxx.exec:\lxflrxx.exe33⤵
- Executes dropped EXE
-
\??\c:\hbntbh.exec:\hbntbh.exe34⤵
- Executes dropped EXE
-
\??\c:\vvppp.exec:\vvppp.exe35⤵
- Executes dropped EXE
-
\??\c:\pjddd.exec:\pjddd.exe36⤵
- Executes dropped EXE
-
\??\c:\7fxllrf.exec:\7fxllrf.exe37⤵
- Executes dropped EXE
-
\??\c:\5xxrflx.exec:\5xxrflx.exe38⤵
- Executes dropped EXE
-
\??\c:\3nbbtn.exec:\3nbbtn.exe39⤵
- Executes dropped EXE
-
\??\c:\tthnbh.exec:\tthnbh.exe40⤵
- Executes dropped EXE
-
\??\c:\jdvvj.exec:\jdvvj.exe41⤵
- Executes dropped EXE
-
\??\c:\7pdvd.exec:\7pdvd.exe42⤵
- Executes dropped EXE
-
\??\c:\xxrxrrx.exec:\xxrxrrx.exe43⤵
- Executes dropped EXE
-
\??\c:\hhbhtb.exec:\hhbhtb.exe44⤵
- Executes dropped EXE
-
\??\c:\ttnthn.exec:\ttnthn.exe45⤵
- Executes dropped EXE
-
\??\c:\jjvjp.exec:\jjvjp.exe46⤵
- Executes dropped EXE
-
\??\c:\dvpjv.exec:\dvpjv.exe47⤵
- Executes dropped EXE
-
\??\c:\rrrrxlx.exec:\rrrrxlx.exe48⤵
- Executes dropped EXE
-
\??\c:\xrfrrfl.exec:\xrfrrfl.exe49⤵
- Executes dropped EXE
-
\??\c:\1hthnt.exec:\1hthnt.exe50⤵
- Executes dropped EXE
-
\??\c:\dvjpd.exec:\dvjpd.exe51⤵
- Executes dropped EXE
-
\??\c:\jdvdp.exec:\jdvdp.exe52⤵
- Executes dropped EXE
-
\??\c:\9rrxllf.exec:\9rrxllf.exe53⤵
- Executes dropped EXE
-
\??\c:\xrrflxf.exec:\xrrflxf.exe54⤵
- Executes dropped EXE
-
\??\c:\5nnnnn.exec:\5nnnnn.exe55⤵
- Executes dropped EXE
-
\??\c:\pdvvv.exec:\pdvvv.exe56⤵
- Executes dropped EXE
-
\??\c:\llfrfff.exec:\llfrfff.exe57⤵
- Executes dropped EXE
-
\??\c:\9lllrrf.exec:\9lllrrf.exe58⤵
- Executes dropped EXE
-
\??\c:\bbtntb.exec:\bbtntb.exe59⤵
- Executes dropped EXE
-
\??\c:\pvpvv.exec:\pvpvv.exe60⤵
- Executes dropped EXE
-
\??\c:\3vvdp.exec:\3vvdp.exe61⤵
- Executes dropped EXE
-
\??\c:\lfrfllx.exec:\lfrfllx.exe62⤵
- Executes dropped EXE
-
\??\c:\lxlrffl.exec:\lxlrffl.exe63⤵
- Executes dropped EXE
-
\??\c:\1nntnt.exec:\1nntnt.exe64⤵
- Executes dropped EXE
-
\??\c:\btnntb.exec:\btnntb.exe65⤵
- Executes dropped EXE
-
\??\c:\7jvjp.exec:\7jvjp.exe66⤵
-
\??\c:\3fffflr.exec:\3fffflr.exe67⤵
-
\??\c:\ffffrxl.exec:\ffffrxl.exe68⤵
-
\??\c:\tbthbh.exec:\tbthbh.exe69⤵
-
\??\c:\hhthht.exec:\hhthht.exe70⤵
-
\??\c:\dvdjp.exec:\dvdjp.exe71⤵
-
\??\c:\lflrxfl.exec:\lflrxfl.exe72⤵
-
\??\c:\1lffxfx.exec:\1lffxfx.exe73⤵
-
\??\c:\hbtbhn.exec:\hbtbhn.exe74⤵
-
\??\c:\nnhtbh.exec:\nnhtbh.exe75⤵
-
\??\c:\jdvvd.exec:\jdvvd.exe76⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe77⤵
-
\??\c:\xfxrrll.exec:\xfxrrll.exe78⤵
-
\??\c:\xxxxflx.exec:\xxxxflx.exe79⤵
-
\??\c:\ttbnbb.exec:\ttbnbb.exe80⤵
-
\??\c:\1hthbh.exec:\1hthbh.exe81⤵
-
\??\c:\9dvvv.exec:\9dvvv.exe82⤵
-
\??\c:\ppdjd.exec:\ppdjd.exe83⤵
-
\??\c:\7rlxffl.exec:\7rlxffl.exe84⤵
-
\??\c:\9hbnbn.exec:\9hbnbn.exe85⤵
-
\??\c:\5ntnnt.exec:\5ntnnt.exe86⤵
-
\??\c:\dvjjp.exec:\dvjjp.exe87⤵
-
\??\c:\ppvdd.exec:\ppvdd.exe88⤵
-
\??\c:\rrrflxl.exec:\rrrflxl.exe89⤵
-
\??\c:\5rrxlrx.exec:\5rrxlrx.exe90⤵
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe91⤵
-
\??\c:\1ntnnb.exec:\1ntnnb.exe92⤵
-
\??\c:\hbthnb.exec:\hbthnb.exe93⤵
-
\??\c:\7dvpp.exec:\7dvpp.exe94⤵
-
\??\c:\3lfrlrf.exec:\3lfrlrf.exe95⤵
-
\??\c:\frfflxr.exec:\frfflxr.exe96⤵
-
\??\c:\hbbbth.exec:\hbbbth.exe97⤵
-
\??\c:\nhbhbh.exec:\nhbhbh.exe98⤵
-
\??\c:\9ppvp.exec:\9ppvp.exe99⤵
-
\??\c:\pjpdv.exec:\pjpdv.exe100⤵
-
\??\c:\lrlfrrl.exec:\lrlfrrl.exe101⤵
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe102⤵
-
\??\c:\1thbht.exec:\1thbht.exe103⤵
-
\??\c:\hhbhnt.exec:\hhbhnt.exe104⤵
-
\??\c:\5jvdd.exec:\5jvdd.exe105⤵
-
\??\c:\3frfrrf.exec:\3frfrrf.exe106⤵
-
\??\c:\3llxlrf.exec:\3llxlrf.exe107⤵
-
\??\c:\hhbhtt.exec:\hhbhtt.exe108⤵
-
\??\c:\9ttntt.exec:\9ttntt.exe109⤵
-
\??\c:\9vppd.exec:\9vppd.exe110⤵
-
\??\c:\3jjjv.exec:\3jjjv.exe111⤵
-
\??\c:\ffxxxfl.exec:\ffxxxfl.exe112⤵
-
\??\c:\5nnnnt.exec:\5nnnnt.exe113⤵
-
\??\c:\ttbhnt.exec:\ttbhnt.exe114⤵
-
\??\c:\5hthnh.exec:\5hthnh.exe115⤵
-
\??\c:\pjppv.exec:\pjppv.exe116⤵
-
\??\c:\dpjpv.exec:\dpjpv.exe117⤵
-
\??\c:\7lrxfrx.exec:\7lrxfrx.exe118⤵
-
\??\c:\1bbthn.exec:\1bbthn.exe119⤵
-
\??\c:\1ntntt.exec:\1ntntt.exe120⤵
-
\??\c:\tnhntb.exec:\tnhntb.exe121⤵
-
\??\c:\9vpdv.exec:\9vpdv.exe122⤵
-
\??\c:\vpppv.exec:\vpppv.exe123⤵
-
\??\c:\rrflrrf.exec:\rrflrrf.exe124⤵
-
\??\c:\xfrlflf.exec:\xfrlflf.exe125⤵
-
\??\c:\nbnnbb.exec:\nbnnbb.exe126⤵
-
\??\c:\nhtbhn.exec:\nhtbhn.exe127⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe128⤵
-
\??\c:\jjpvj.exec:\jjpvj.exe129⤵
-
\??\c:\7frrflf.exec:\7frrflf.exe130⤵
-
\??\c:\frflrrx.exec:\frflrrx.exe131⤵
-
\??\c:\3tthtn.exec:\3tthtn.exe132⤵
-
\??\c:\ttnbbh.exec:\ttnbbh.exe133⤵
-
\??\c:\vppvd.exec:\vppvd.exe134⤵
-
\??\c:\9llfffl.exec:\9llfffl.exe135⤵
-
\??\c:\lflxfxf.exec:\lflxfxf.exe136⤵
-
\??\c:\nhtttb.exec:\nhtttb.exe137⤵
-
\??\c:\jvddd.exec:\jvddd.exe138⤵
-
\??\c:\jjpvd.exec:\jjpvd.exe139⤵
-
\??\c:\7fllrxr.exec:\7fllrxr.exe140⤵
-
\??\c:\fxlrxrx.exec:\fxlrxrx.exe141⤵
-
\??\c:\btnbhh.exec:\btnbhh.exe142⤵
-
\??\c:\7thttb.exec:\7thttb.exe143⤵
-
\??\c:\vpdvv.exec:\vpdvv.exe144⤵
-
\??\c:\dddpj.exec:\dddpj.exe145⤵
-
\??\c:\lffrxfl.exec:\lffrxfl.exe146⤵
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe147⤵
-
\??\c:\hnbnbb.exec:\hnbnbb.exe148⤵
-
\??\c:\jpdvv.exec:\jpdvv.exe149⤵
-
\??\c:\9vvvd.exec:\9vvvd.exe150⤵
-
\??\c:\lfxffff.exec:\lfxffff.exe151⤵
-
\??\c:\rllrxrf.exec:\rllrxrf.exe152⤵
-
\??\c:\9nnbhb.exec:\9nnbhb.exe153⤵
-
\??\c:\nhhntt.exec:\nhhntt.exe154⤵
-
\??\c:\jdjvj.exec:\jdjvj.exe155⤵
-
\??\c:\jjdjp.exec:\jjdjp.exe156⤵
-
\??\c:\xxrrxfr.exec:\xxrrxfr.exe157⤵
-
\??\c:\hhntnb.exec:\hhntnb.exe158⤵
-
\??\c:\5tnthn.exec:\5tnthn.exe159⤵
-
\??\c:\7pjpd.exec:\7pjpd.exe160⤵
-
\??\c:\jdvpv.exec:\jdvpv.exe161⤵
-
\??\c:\lfrlffl.exec:\lfrlffl.exe162⤵
-
\??\c:\hhnbhh.exec:\hhnbhh.exe163⤵
-
\??\c:\5bttbh.exec:\5bttbh.exe164⤵
-
\??\c:\3hbntb.exec:\3hbntb.exe165⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe166⤵
-
\??\c:\dvvdj.exec:\dvvdj.exe167⤵
-
\??\c:\fxfxlfr.exec:\fxfxlfr.exe168⤵
-
\??\c:\fxrrffr.exec:\fxrrffr.exe169⤵
-
\??\c:\bbnnhb.exec:\bbnnhb.exe170⤵
-
\??\c:\nthhnb.exec:\nthhnb.exe171⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe172⤵
-
\??\c:\jvjjd.exec:\jvjjd.exe173⤵
-
\??\c:\rlxlffl.exec:\rlxlffl.exe174⤵
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe175⤵
-
\??\c:\3hbtht.exec:\3hbtht.exe176⤵
-
\??\c:\ttntnt.exec:\ttntnt.exe177⤵
-
\??\c:\dvppd.exec:\dvppd.exe178⤵
-
\??\c:\3jddj.exec:\3jddj.exe179⤵
-
\??\c:\jvppd.exec:\jvppd.exe180⤵
-
\??\c:\fxflrrf.exec:\fxflrrf.exe181⤵
-
\??\c:\fxflrrr.exec:\fxflrrr.exe182⤵
-
\??\c:\nhhhtn.exec:\nhhhtn.exe183⤵
-
\??\c:\nhhbnt.exec:\nhhbnt.exe184⤵
-
\??\c:\9vpdj.exec:\9vpdj.exe185⤵
-
\??\c:\dpppp.exec:\dpppp.exe186⤵
-
\??\c:\rlrxllx.exec:\rlrxllx.exe187⤵
-
\??\c:\lfxrfff.exec:\lfxrfff.exe188⤵
-
\??\c:\tbntbh.exec:\tbntbh.exe189⤵
-
\??\c:\nntnth.exec:\nntnth.exe190⤵
-
\??\c:\flxrrll.exec:\flxrrll.exe191⤵
-
\??\c:\fxlllrf.exec:\fxlllrf.exe192⤵
-
\??\c:\nhbbhh.exec:\nhbbhh.exe193⤵
-
\??\c:\nhnhhh.exec:\nhnhhh.exe194⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe195⤵
-
\??\c:\1jdpp.exec:\1jdpp.exe196⤵
-
\??\c:\9bhthb.exec:\9bhthb.exe197⤵
-
\??\c:\bthhhh.exec:\bthhhh.exe198⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe199⤵
-
\??\c:\ddvvd.exec:\ddvvd.exe200⤵
-
\??\c:\5xrxflx.exec:\5xrxflx.exe201⤵
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe202⤵
-
\??\c:\7bnbbh.exec:\7bnbbh.exe203⤵
-
\??\c:\tnbtbh.exec:\tnbtbh.exe204⤵
-
\??\c:\ddvvp.exec:\ddvvp.exe205⤵
-
\??\c:\ppdjd.exec:\ppdjd.exe206⤵
-
\??\c:\7rffllr.exec:\7rffllr.exe207⤵
-
\??\c:\xrfflrf.exec:\xrfflrf.exe208⤵
-
\??\c:\nbnbnt.exec:\nbnbnt.exe209⤵
-
\??\c:\hbbnbh.exec:\hbbnbh.exe210⤵
-
\??\c:\7vjdd.exec:\7vjdd.exe211⤵
-
\??\c:\9pjpv.exec:\9pjpv.exe212⤵
-
\??\c:\xxlflrr.exec:\xxlflrr.exe213⤵
-
\??\c:\nhtnhh.exec:\nhtnhh.exe214⤵
-
\??\c:\bbthht.exec:\bbthht.exe215⤵
-
\??\c:\dvjvd.exec:\dvjvd.exe216⤵
-
\??\c:\djjvd.exec:\djjvd.exe217⤵
-
\??\c:\jjdjd.exec:\jjdjd.exe218⤵
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe219⤵
-
\??\c:\fxxfllr.exec:\fxxfllr.exe220⤵
-
\??\c:\bnttnn.exec:\bnttnn.exe221⤵
-
\??\c:\thbtbn.exec:\thbtbn.exe222⤵
-
\??\c:\jjdpj.exec:\jjdpj.exe223⤵
-
\??\c:\9vpvd.exec:\9vpvd.exe224⤵
-
\??\c:\rrffrfr.exec:\rrffrfr.exe225⤵
-
\??\c:\fxllxxl.exec:\fxllxxl.exe226⤵
-
\??\c:\nhtbtb.exec:\nhtbtb.exe227⤵
-
\??\c:\9nnbbh.exec:\9nnbbh.exe228⤵
-
\??\c:\ppjdj.exec:\ppjdj.exe229⤵
-
\??\c:\ddjvv.exec:\ddjvv.exe230⤵
-
\??\c:\5rrxrxf.exec:\5rrxrxf.exe231⤵
-
\??\c:\xxrffxf.exec:\xxrffxf.exe232⤵
-
\??\c:\7hnhtn.exec:\7hnhtn.exe233⤵
-
\??\c:\tnbnth.exec:\tnbnth.exe234⤵
-
\??\c:\jdvdp.exec:\jdvdp.exe235⤵
-
\??\c:\9pjdv.exec:\9pjdv.exe236⤵
-
\??\c:\dvdjv.exec:\dvdjv.exe237⤵
-
\??\c:\ffxfllr.exec:\ffxfllr.exe238⤵
-
\??\c:\7lfxflr.exec:\7lfxflr.exe239⤵
-
\??\c:\bthhtt.exec:\bthhtt.exe240⤵
-
\??\c:\nbhhnt.exec:\nbhhnt.exe241⤵