Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 01:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9a246b78e5b06ca797f0261b54410854b82d1ffd0cd451fcde3633f0f4253e8.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
a9a246b78e5b06ca797f0261b54410854b82d1ffd0cd451fcde3633f0f4253e8.exe
-
Size
122KB
-
MD5
ed8543c977134e88872e274798c7c1a0
-
SHA1
2836b6166f5102ebf449f1302fc4394d1bfd86ce
-
SHA256
a9a246b78e5b06ca797f0261b54410854b82d1ffd0cd451fcde3633f0f4253e8
-
SHA512
737ddcfe26609fda48641acd6042416f2dd20d317b30d1e7c203bf1c6b36e630dfcfa9df28a7e64bfc8555c9470ea6e559a2f6a48a6331fb47ccb0ce8a41d131
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDomRGApSuLAR2yPBCQ1nDFu1Q8sb:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgci
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
Processes:
resource yara_rule behavioral2/memory/4296-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-46-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-38-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 34 IoCs
Processes:
resource yara_rule behavioral2/memory/1604-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4296-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3236-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1444-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5108-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4484-212-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/960-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2252-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4896-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4064-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4392-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1492-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4148-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2972-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1524-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/808-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1664-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/640-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2132-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2132-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2132-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2132-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3956-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3956-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3956-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/764-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4476-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2868-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3588-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1604-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1604-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1604-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2588-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2424-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bthttn.exehtthbn.exepjpdp.exejvvpd.exexxxrrll.exefrllffl.exeppjjj.exe3pjpd.exelfrlllr.exe7rrllll.exehhnnnt.exebntntn.exevvvjj.exelffxxxx.exe5tthtn.exe1tnnhn.exevjjjj.exefrrfxrl.exelxxxrlf.exe1hhbbb.exevpvjd.exevpdjd.exe1pjvp.exellfxlfx.exelffxrlr.exebbbbtt.exe3pdpp.exevppvp.exe9xxlxxr.exehbbntt.exehnbthb.exejdpdj.exevpdvp.exexxllxxx.exenttnhh.exetntntt.exe1bbtnh.exejvpjv.exejpvdp.exexrxrffr.exerflllrr.exehbhhhh.exebnbhhn.exedpppj.exepjpjd.exerfrllxx.exeflxrlll.exebbhhtt.exehhbbnn.exenhnttt.exeddjpp.exedjjdv.exefffffll.exe7frlrxf.exe5tnhtb.exenhhbth.exevddpj.exe3djdp.exellrlfff.exerxffffr.exefxffxrl.exenhbtnh.exe9tbbbh.exevjppp.exepid process 2588 bthttn.exe 1604 htthbn.exe 3588 pjpdp.exe 2868 jvvpd.exe 4476 xxxrrll.exe 764 frllffl.exe 1732 ppjjj.exe 3956 3pjpd.exe 2132 lfrlllr.exe 640 7rrllll.exe 4296 hhnnnt.exe 1664 bntntn.exe 808 vvvjj.exe 1524 lffxxxx.exe 2972 5tthtn.exe 4148 1tnnhn.exe 1492 vjjjj.exe 4392 frrfxrl.exe 1564 lxxxrlf.exe 3236 1hhbbb.exe 1876 vpvjd.exe 2052 vpdjd.exe 4900 1pjvp.exe 1444 llfxlfx.exe 4064 lffxrlr.exe 4896 bbbbtt.exe 5108 3pdpp.exe 1660 vppvp.exe 2252 9xxlxxr.exe 960 hbbntt.exe 4484 hnbthb.exe 3556 jdpdj.exe 2060 vpdvp.exe 2040 xxllxxx.exe 2816 nttnhh.exe 464 tntntt.exe 3728 1bbtnh.exe 208 jvpjv.exe 776 jpvdp.exe 3800 xrxrffr.exe 3680 rflllrr.exe 1124 hbhhhh.exe 3568 bnbhhn.exe 4592 dpppj.exe 2348 pjpjd.exe 1392 rfrllxx.exe 2396 flxrlll.exe 680 bbhhtt.exe 1968 hhbbnn.exe 1684 nhnttt.exe 4276 ddjpp.exe 1856 djjdv.exe 2740 fffffll.exe 4472 7frlrxf.exe 3588 5tnhtb.exe 2868 nhhbth.exe 4476 vddpj.exe 764 3djdp.exe 2796 llrlfff.exe 2900 rxffffr.exe 4600 fxffxrl.exe 2920 nhbtnh.exe 2244 9tbbbh.exe 5004 vjppp.exe -
Processes:
resource yara_rule behavioral2/memory/1604-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a9a246b78e5b06ca797f0261b54410854b82d1ffd0cd451fcde3633f0f4253e8.exebthttn.exehtthbn.exepjpdp.exejvvpd.exexxxrrll.exefrllffl.exeppjjj.exe3pjpd.exelfrlllr.exe7rrllll.exehhnnnt.exebntntn.exevvvjj.exelffxxxx.exe5tthtn.exe1tnnhn.exevjjjj.exefrrfxrl.exelxxxrlf.exe1hhbbb.exevpvjd.exedescription pid process target process PID 2424 wrote to memory of 2588 2424 a9a246b78e5b06ca797f0261b54410854b82d1ffd0cd451fcde3633f0f4253e8.exe bthttn.exe PID 2424 wrote to memory of 2588 2424 a9a246b78e5b06ca797f0261b54410854b82d1ffd0cd451fcde3633f0f4253e8.exe bthttn.exe PID 2424 wrote to memory of 2588 2424 a9a246b78e5b06ca797f0261b54410854b82d1ffd0cd451fcde3633f0f4253e8.exe bthttn.exe PID 2588 wrote to memory of 1604 2588 bthttn.exe htthbn.exe PID 2588 wrote to memory of 1604 2588 bthttn.exe htthbn.exe PID 2588 wrote to memory of 1604 2588 bthttn.exe htthbn.exe PID 1604 wrote to memory of 3588 1604 htthbn.exe pjpdp.exe PID 1604 wrote to memory of 3588 1604 htthbn.exe pjpdp.exe PID 1604 wrote to memory of 3588 1604 htthbn.exe pjpdp.exe PID 3588 wrote to memory of 2868 3588 pjpdp.exe jvvpd.exe PID 3588 wrote to memory of 2868 3588 pjpdp.exe jvvpd.exe PID 3588 wrote to memory of 2868 3588 pjpdp.exe jvvpd.exe PID 2868 wrote to memory of 4476 2868 jvvpd.exe xxxrrll.exe PID 2868 wrote to memory of 4476 2868 jvvpd.exe xxxrrll.exe PID 2868 wrote to memory of 4476 2868 jvvpd.exe xxxrrll.exe PID 4476 wrote to memory of 764 4476 xxxrrll.exe frllffl.exe PID 4476 wrote to memory of 764 4476 xxxrrll.exe frllffl.exe PID 4476 wrote to memory of 764 4476 xxxrrll.exe frllffl.exe PID 764 wrote to memory of 1732 764 frllffl.exe ppjjj.exe PID 764 wrote to memory of 1732 764 frllffl.exe ppjjj.exe PID 764 wrote to memory of 1732 764 frllffl.exe ppjjj.exe PID 1732 wrote to memory of 3956 1732 ppjjj.exe 3pjpd.exe PID 1732 wrote to memory of 3956 1732 ppjjj.exe 3pjpd.exe PID 1732 wrote to memory of 3956 1732 ppjjj.exe 3pjpd.exe PID 3956 wrote to memory of 2132 3956 3pjpd.exe lfrlllr.exe PID 3956 wrote to memory of 2132 3956 3pjpd.exe lfrlllr.exe PID 3956 wrote to memory of 2132 3956 3pjpd.exe lfrlllr.exe PID 2132 wrote to memory of 640 2132 lfrlllr.exe 7rrllll.exe PID 2132 wrote to memory of 640 2132 lfrlllr.exe 7rrllll.exe PID 2132 wrote to memory of 640 2132 lfrlllr.exe 7rrllll.exe PID 640 wrote to memory of 4296 640 7rrllll.exe 5tbtht.exe PID 640 wrote to memory of 4296 640 7rrllll.exe 5tbtht.exe PID 640 wrote to memory of 4296 640 7rrllll.exe 5tbtht.exe PID 4296 wrote to memory of 1664 4296 hhnnnt.exe bntntn.exe PID 4296 wrote to memory of 1664 4296 hhnnnt.exe bntntn.exe PID 4296 wrote to memory of 1664 4296 hhnnnt.exe bntntn.exe PID 1664 wrote to memory of 808 1664 bntntn.exe vvvjj.exe PID 1664 wrote to memory of 808 1664 bntntn.exe vvvjj.exe PID 1664 wrote to memory of 808 1664 bntntn.exe vvvjj.exe PID 808 wrote to memory of 1524 808 vvvjj.exe lffxxxx.exe PID 808 wrote to memory of 1524 808 vvvjj.exe lffxxxx.exe PID 808 wrote to memory of 1524 808 vvvjj.exe lffxxxx.exe PID 1524 wrote to memory of 2972 1524 lffxxxx.exe 5tthtn.exe PID 1524 wrote to memory of 2972 1524 lffxxxx.exe 5tthtn.exe PID 1524 wrote to memory of 2972 1524 lffxxxx.exe 5tthtn.exe PID 2972 wrote to memory of 4148 2972 5tthtn.exe 1tnnhn.exe PID 2972 wrote to memory of 4148 2972 5tthtn.exe 1tnnhn.exe PID 2972 wrote to memory of 4148 2972 5tthtn.exe 1tnnhn.exe PID 4148 wrote to memory of 1492 4148 1tnnhn.exe vjjjj.exe PID 4148 wrote to memory of 1492 4148 1tnnhn.exe vjjjj.exe PID 4148 wrote to memory of 1492 4148 1tnnhn.exe vjjjj.exe PID 1492 wrote to memory of 4392 1492 vjjjj.exe btbbbh.exe PID 1492 wrote to memory of 4392 1492 vjjjj.exe btbbbh.exe PID 1492 wrote to memory of 4392 1492 vjjjj.exe btbbbh.exe PID 4392 wrote to memory of 1564 4392 frrfxrl.exe lxxxrlf.exe PID 4392 wrote to memory of 1564 4392 frrfxrl.exe lxxxrlf.exe PID 4392 wrote to memory of 1564 4392 frrfxrl.exe lxxxrlf.exe PID 1564 wrote to memory of 3236 1564 lxxxrlf.exe 1hhbbb.exe PID 1564 wrote to memory of 3236 1564 lxxxrlf.exe 1hhbbb.exe PID 1564 wrote to memory of 3236 1564 lxxxrlf.exe 1hhbbb.exe PID 3236 wrote to memory of 1876 3236 1hhbbb.exe vpvjd.exe PID 3236 wrote to memory of 1876 3236 1hhbbb.exe vpvjd.exe PID 3236 wrote to memory of 1876 3236 1hhbbb.exe vpvjd.exe PID 1876 wrote to memory of 2052 1876 vpvjd.exe vpdjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3566042146\zmstage.exeC:\Users\Admin\AppData\Local\Temp\3566042146\zmstage.exe1⤵
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a9a246b78e5b06ca797f0261b54410854b82d1ffd0cd451fcde3633f0f4253e8.exe"C:\Users\Admin\AppData\Local\Temp\a9a246b78e5b06ca797f0261b54410854b82d1ffd0cd451fcde3633f0f4253e8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bthttn.exec:\bthttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htthbn.exec:\htthbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpdp.exec:\pjpdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvpd.exec:\jvvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxxrrll.exec:\xxxrrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frllffl.exec:\frllffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjjj.exec:\ppjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pjpd.exec:\3pjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrlllr.exec:\lfrlllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7rrllll.exec:\7rrllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhnnnt.exec:\hhnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bntntn.exec:\bntntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvjj.exec:\vvvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lffxxxx.exec:\lffxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5tthtn.exec:\5tthtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1tnnhn.exec:\1tnnhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjjjj.exec:\vjjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrfxrl.exec:\frrfxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxxxrlf.exec:\lxxxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1hhbbb.exec:\1hhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvjd.exec:\vpvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdjd.exec:\vpdjd.exe23⤵
- Executes dropped EXE
-
\??\c:\1pjvp.exec:\1pjvp.exe24⤵
- Executes dropped EXE
-
\??\c:\llfxlfx.exec:\llfxlfx.exe25⤵
- Executes dropped EXE
-
\??\c:\lffxrlr.exec:\lffxrlr.exe26⤵
- Executes dropped EXE
-
\??\c:\bbbbtt.exec:\bbbbtt.exe27⤵
- Executes dropped EXE
-
\??\c:\3pdpp.exec:\3pdpp.exe28⤵
- Executes dropped EXE
-
\??\c:\vppvp.exec:\vppvp.exe29⤵
- Executes dropped EXE
-
\??\c:\9xxlxxr.exec:\9xxlxxr.exe30⤵
- Executes dropped EXE
-
\??\c:\hbbntt.exec:\hbbntt.exe31⤵
- Executes dropped EXE
-
\??\c:\hnbthb.exec:\hnbthb.exe32⤵
- Executes dropped EXE
-
\??\c:\jdpdj.exec:\jdpdj.exe33⤵
- Executes dropped EXE
-
\??\c:\vpdvp.exec:\vpdvp.exe34⤵
- Executes dropped EXE
-
\??\c:\xxllxxx.exec:\xxllxxx.exe35⤵
- Executes dropped EXE
-
\??\c:\nttnhh.exec:\nttnhh.exe36⤵
- Executes dropped EXE
-
\??\c:\tntntt.exec:\tntntt.exe37⤵
- Executes dropped EXE
-
\??\c:\1bbtnh.exec:\1bbtnh.exe38⤵
- Executes dropped EXE
-
\??\c:\jvpjv.exec:\jvpjv.exe39⤵
- Executes dropped EXE
-
\??\c:\jpvdp.exec:\jpvdp.exe40⤵
- Executes dropped EXE
-
\??\c:\xrxrffr.exec:\xrxrffr.exe41⤵
- Executes dropped EXE
-
\??\c:\rflllrr.exec:\rflllrr.exe42⤵
- Executes dropped EXE
-
\??\c:\hbhhhh.exec:\hbhhhh.exe43⤵
- Executes dropped EXE
-
\??\c:\bnbhhn.exec:\bnbhhn.exe44⤵
- Executes dropped EXE
-
\??\c:\dpppj.exec:\dpppj.exe45⤵
- Executes dropped EXE
-
\??\c:\pjpjd.exec:\pjpjd.exe46⤵
- Executes dropped EXE
-
\??\c:\rfrllxx.exec:\rfrllxx.exe47⤵
- Executes dropped EXE
-
\??\c:\flxrlll.exec:\flxrlll.exe48⤵
- Executes dropped EXE
-
\??\c:\bbhhtt.exec:\bbhhtt.exe49⤵
- Executes dropped EXE
-
\??\c:\hhbbnn.exec:\hhbbnn.exe50⤵
- Executes dropped EXE
-
\??\c:\nhnttt.exec:\nhnttt.exe51⤵
- Executes dropped EXE
-
\??\c:\ddjpp.exec:\ddjpp.exe52⤵
- Executes dropped EXE
-
\??\c:\djjdv.exec:\djjdv.exe53⤵
- Executes dropped EXE
-
\??\c:\fffffll.exec:\fffffll.exe54⤵
- Executes dropped EXE
-
\??\c:\7frlrxf.exec:\7frlrxf.exe55⤵
- Executes dropped EXE
-
\??\c:\5tnhtb.exec:\5tnhtb.exe56⤵
- Executes dropped EXE
-
\??\c:\nhhbth.exec:\nhhbth.exe57⤵
- Executes dropped EXE
-
\??\c:\vddpj.exec:\vddpj.exe58⤵
- Executes dropped EXE
-
\??\c:\3djdp.exec:\3djdp.exe59⤵
- Executes dropped EXE
-
\??\c:\llrlfff.exec:\llrlfff.exe60⤵
- Executes dropped EXE
-
\??\c:\rxffffr.exec:\rxffffr.exe61⤵
- Executes dropped EXE
-
\??\c:\fxffxrl.exec:\fxffxrl.exe62⤵
- Executes dropped EXE
-
\??\c:\nhbtnh.exec:\nhbtnh.exe63⤵
- Executes dropped EXE
-
\??\c:\9tbbbh.exec:\9tbbbh.exe64⤵
- Executes dropped EXE
-
\??\c:\vjppp.exec:\vjppp.exe65⤵
- Executes dropped EXE
-
\??\c:\vdvvj.exec:\vdvvj.exe66⤵
-
\??\c:\rrrlxfl.exec:\rrrlxfl.exe67⤵
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe68⤵
-
\??\c:\bbnhtn.exec:\bbnhtn.exe69⤵
-
\??\c:\1nnnbt.exec:\1nnnbt.exe70⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe71⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe72⤵
-
\??\c:\1rfrlfr.exec:\1rfrlfr.exe73⤵
-
\??\c:\7xxrrxx.exec:\7xxrrxx.exe74⤵
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe75⤵
-
\??\c:\7nnhhh.exec:\7nnhhh.exe76⤵
-
\??\c:\nhbbbh.exec:\nhbbbh.exe77⤵
-
\??\c:\vjjvp.exec:\vjjvp.exe78⤵
-
\??\c:\ddddv.exec:\ddddv.exe79⤵
-
\??\c:\llfxllr.exec:\llfxllr.exe80⤵
-
\??\c:\lfrrrrl.exec:\lfrrrrl.exe81⤵
-
\??\c:\3flllrr.exec:\3flllrr.exe82⤵
-
\??\c:\hhbnnb.exec:\hhbnnb.exe83⤵
-
\??\c:\1tthbb.exec:\1tthbb.exe84⤵
-
\??\c:\vvvvp.exec:\vvvvp.exe85⤵
-
\??\c:\vjpvp.exec:\vjpvp.exe86⤵
-
\??\c:\rllrfxr.exec:\rllrfxr.exe87⤵
-
\??\c:\llrrxfl.exec:\llrrxfl.exe88⤵
-
\??\c:\1lrrrlx.exec:\1lrrrlx.exe89⤵
-
\??\c:\5tnhnn.exec:\5tnhnn.exe90⤵
-
\??\c:\nhbbbh.exec:\nhbbbh.exe91⤵
-
\??\c:\pjppj.exec:\pjppj.exe92⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe93⤵
-
\??\c:\3ffflrr.exec:\3ffflrr.exe94⤵
-
\??\c:\1rxxxrl.exec:\1rxxxrl.exe95⤵
-
\??\c:\1lrrrxl.exec:\1lrrrxl.exe96⤵
-
\??\c:\htbtbt.exec:\htbtbt.exe97⤵
-
\??\c:\9bbthh.exec:\9bbthh.exe98⤵
-
\??\c:\3vpjv.exec:\3vpjv.exe99⤵
-
\??\c:\jjpjv.exec:\jjpjv.exe100⤵
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe101⤵
-
\??\c:\9xlfxxf.exec:\9xlfxxf.exe102⤵
-
\??\c:\xfrlfff.exec:\xfrlfff.exe103⤵
-
\??\c:\bnnhhh.exec:\bnnhhh.exe104⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe105⤵
-
\??\c:\ppddp.exec:\ppddp.exe106⤵
-
\??\c:\dpddv.exec:\dpddv.exe107⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe108⤵
-
\??\c:\fxrrlll.exec:\fxrrlll.exe109⤵
-
\??\c:\xffrlfx.exec:\xffrlfx.exe110⤵
-
\??\c:\nntbnn.exec:\nntbnn.exe111⤵
-
\??\c:\3nttnn.exec:\3nttnn.exe112⤵
-
\??\c:\pjjdp.exec:\pjjdp.exe113⤵
-
\??\c:\thtttt.exec:\thtttt.exe114⤵
-
\??\c:\bhbtnh.exec:\bhbtnh.exe115⤵
-
\??\c:\3vdvv.exec:\3vdvv.exe116⤵
-
\??\c:\9djdp.exec:\9djdp.exe117⤵
-
\??\c:\xrfrrxf.exec:\xrfrrxf.exe118⤵
-
\??\c:\1xfxrxx.exec:\1xfxrxx.exe119⤵
-
\??\c:\3ntbbn.exec:\3ntbbn.exe120⤵
-
\??\c:\vddvj.exec:\vddvj.exe121⤵
-
\??\c:\ddjdj.exec:\ddjdj.exe122⤵
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe123⤵
-
\??\c:\rfflfll.exec:\rfflfll.exe124⤵
-
\??\c:\httnhb.exec:\httnhb.exe125⤵
-
\??\c:\nhbbnn.exec:\nhbbnn.exe126⤵
-
\??\c:\hhnhtt.exec:\hhnhtt.exe127⤵
-
\??\c:\dvvpp.exec:\dvvpp.exe128⤵
-
\??\c:\9jdvj.exec:\9jdvj.exe129⤵
-
\??\c:\xfxlxxr.exec:\xfxlxxr.exe130⤵
-
\??\c:\xxxrlll.exec:\xxxrlll.exe131⤵
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe132⤵
-
\??\c:\bbbttt.exec:\bbbttt.exe133⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe134⤵
-
\??\c:\vdjvj.exec:\vdjvj.exe135⤵
-
\??\c:\1jjjd.exec:\1jjjd.exe136⤵
-
\??\c:\jdddd.exec:\jdddd.exe137⤵
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe138⤵
-
\??\c:\xlfxrxr.exec:\xlfxrxr.exe139⤵
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe140⤵
-
\??\c:\tnnttt.exec:\tnnttt.exe141⤵
-
\??\c:\nttnbb.exec:\nttnbb.exe142⤵
-
\??\c:\vvppp.exec:\vvppp.exe143⤵
-
\??\c:\jddvp.exec:\jddvp.exe144⤵
-
\??\c:\rlxrrll.exec:\rlxrrll.exe145⤵
-
\??\c:\lxlffff.exec:\lxlffff.exe146⤵
-
\??\c:\7xfxxll.exec:\7xfxxll.exe147⤵
-
\??\c:\nhhhhh.exec:\nhhhhh.exe148⤵
-
\??\c:\9tnhnt.exec:\9tnhnt.exe149⤵
-
\??\c:\pjjvj.exec:\pjjvj.exe150⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe151⤵
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe152⤵
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe153⤵
-
\??\c:\btbttt.exec:\btbttt.exe154⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe155⤵
-
\??\c:\vddpj.exec:\vddpj.exe156⤵
-
\??\c:\3jjdv.exec:\3jjdv.exe157⤵
-
\??\c:\jvvpd.exec:\jvvpd.exe158⤵
-
\??\c:\fflllrr.exec:\fflllrr.exe159⤵
-
\??\c:\lxlffff.exec:\lxlffff.exe160⤵
-
\??\c:\bthbtt.exec:\bthbtt.exe161⤵
-
\??\c:\tthbhn.exec:\tthbhn.exe162⤵
-
\??\c:\9nhhbh.exec:\9nhhbh.exe163⤵
-
\??\c:\vvjdj.exec:\vvjdj.exe164⤵
-
\??\c:\jpddv.exec:\jpddv.exe165⤵
-
\??\c:\djjdv.exec:\djjdv.exe166⤵
-
\??\c:\lrffrxx.exec:\lrffrxx.exe167⤵
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe168⤵
-
\??\c:\hbnhhh.exec:\hbnhhh.exe169⤵
-
\??\c:\nhbbht.exec:\nhbbht.exe170⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe171⤵
-
\??\c:\ppppj.exec:\ppppj.exe172⤵
-
\??\c:\ddjjp.exec:\ddjjp.exe173⤵
-
\??\c:\rfrllrx.exec:\rfrllrx.exe174⤵
-
\??\c:\rrlfxff.exec:\rrlfxff.exe175⤵
-
\??\c:\rllrrfx.exec:\rllrrfx.exe176⤵
-
\??\c:\btttnt.exec:\btttnt.exe177⤵
-
\??\c:\nhbbhh.exec:\nhbbhh.exe178⤵
-
\??\c:\7btttb.exec:\7btttb.exe179⤵
-
\??\c:\pdjjj.exec:\pdjjj.exe180⤵
-
\??\c:\dpddp.exec:\dpddp.exe181⤵
-
\??\c:\lfllffx.exec:\lfllffx.exe182⤵
-
\??\c:\rllffff.exec:\rllffff.exe183⤵
-
\??\c:\rflffff.exec:\rflffff.exe184⤵
-
\??\c:\bntttb.exec:\bntttb.exe185⤵
-
\??\c:\nnnnnn.exec:\nnnnnn.exe186⤵
-
\??\c:\hbtnnn.exec:\hbtnnn.exe187⤵
-
\??\c:\vjjpp.exec:\vjjpp.exe188⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe189⤵
-
\??\c:\ffffxxx.exec:\ffffxxx.exe190⤵
-
\??\c:\xfxxrxx.exec:\xfxxrxx.exe191⤵
-
\??\c:\xrflxxr.exec:\xrflxxr.exe192⤵
-
\??\c:\5ntbbb.exec:\5ntbbb.exe193⤵
-
\??\c:\7tttnt.exec:\7tttnt.exe194⤵
-
\??\c:\bbbntt.exec:\bbbntt.exe195⤵
-
\??\c:\1jvdv.exec:\1jvdv.exe196⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe197⤵
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe198⤵
-
\??\c:\xrrrflf.exec:\xrrrflf.exe199⤵
-
\??\c:\5flfxfx.exec:\5flfxfx.exe200⤵
-
\??\c:\bnnhtn.exec:\bnnhtn.exe201⤵
-
\??\c:\tnhhhn.exec:\tnhhhn.exe202⤵
-
\??\c:\jvppj.exec:\jvppj.exe203⤵
-
\??\c:\pdpjj.exec:\pdpjj.exe204⤵
-
\??\c:\ffffxff.exec:\ffffxff.exe205⤵
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe206⤵
-
\??\c:\7frxlrx.exec:\7frxlrx.exe207⤵
-
\??\c:\nbhhhh.exec:\nbhhhh.exe208⤵
-
\??\c:\hhhnnt.exec:\hhhnnt.exe209⤵
-
\??\c:\tthhbh.exec:\tthhbh.exe210⤵
-
\??\c:\dpvpp.exec:\dpvpp.exe211⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe212⤵
-
\??\c:\lrffxxx.exec:\lrffxxx.exe213⤵
-
\??\c:\lrrrrrx.exec:\lrrrrrx.exe214⤵
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe215⤵
-
\??\c:\3ntnnn.exec:\3ntnnn.exe216⤵
-
\??\c:\9nhnbn.exec:\9nhnbn.exe217⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe218⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe219⤵
-
\??\c:\vdvpd.exec:\vdvpd.exe220⤵
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe221⤵
-
\??\c:\llflfrf.exec:\llflfrf.exe222⤵
-
\??\c:\bhnnnt.exec:\bhnnnt.exe223⤵
-
\??\c:\tntnnt.exec:\tntnnt.exe224⤵
-
\??\c:\bbbhnh.exec:\bbbhnh.exe225⤵
-
\??\c:\djvpv.exec:\djvpv.exe226⤵
-
\??\c:\jdppj.exec:\jdppj.exe227⤵
-
\??\c:\5frllll.exec:\5frllll.exe228⤵
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe229⤵
-
\??\c:\hbhtth.exec:\hbhtth.exe230⤵
-
\??\c:\ntnntt.exec:\ntnntt.exe231⤵
-
\??\c:\bttttt.exec:\bttttt.exe232⤵
-
\??\c:\jvvdd.exec:\jvvdd.exe233⤵
-
\??\c:\jvppp.exec:\jvppp.exe234⤵
-
\??\c:\lrffrxx.exec:\lrffrxx.exe235⤵
-
\??\c:\xrfxrxf.exec:\xrfxrxf.exe236⤵
-
\??\c:\flrrlrr.exec:\flrrlrr.exe237⤵
-
\??\c:\hhnthn.exec:\hhnthn.exe238⤵
-
\??\c:\3ntttt.exec:\3ntttt.exe239⤵
-
\??\c:\pdpvv.exec:\pdpvv.exe240⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe241⤵