Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2024 04:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe
-
Size
438KB
-
MD5
ba18d9456e85927e1ef6ab9810c31b82
-
SHA1
1a91a56e602a7353c4bdf926a7c326c1985ed476
-
SHA256
edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d
-
SHA512
11e1bd483f1b05af4b8963fa9402578b9e30ba80bed7ac319e36392a41ebd484f9c0c8550f8f361a199f26de49f59dba922ec113bb904ac160979d640942db92
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09JN:n3C9ytvn8whkb4i3e3GFO6JN
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/2712-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5084 flrlffr.exe 4356 bbtnnn.exe 3872 jvvpj.exe 1392 llxrrrx.exe 2664 5pvvp.exe 4764 tbhhhh.exe 2100 lflfllf.exe 4256 hbhhbb.exe 1428 hnttnb.exe 1640 xrxrffx.exe 3212 jdjjv.exe 2968 5rlfrrl.exe 3672 5nttnt.exe 4660 pvppd.exe 3860 lfxxlll.exe 2724 rlxxllx.exe 4404 lfxrllx.exe 4044 5vvjd.exe 1120 flfxrrx.exe 1160 jvjdv.exe 4004 vddvp.exe 2684 ffrlfrl.exe 876 hntnhb.exe 4468 7xfxrrr.exe 3956 1djdd.exe 1976 nbbttn.exe 1280 rflrfxr.exe 4048 nttnhb.exe 2096 frfxrrl.exe 4128 llrlrrr.exe 3528 htthbb.exe 3596 1bbhtt.exe 1084 xxxxlll.exe 1584 nnbnnb.exe 4648 bthbtt.exe 2996 jjjdv.exe 2472 fxxrxrf.exe 3192 llrllxx.exe 4344 7tbbtn.exe 1632 dpdvd.exe 2932 3xlfxxr.exe 2432 thhnnn.exe 3080 djppj.exe 1864 dpvvp.exe 5116 9lrlffx.exe 4432 bbtnhn.exe 2696 vvjdj.exe 2828 rflfxxx.exe 2672 tntnnn.exe 4300 1nhhtt.exe 1784 jvpjd.exe 2148 xlrlxrl.exe 5060 hbhbbb.exe 2612 dpppp.exe 2580 xxffllr.exe 1376 xfxlfxr.exe 3820 7dpvv.exe 1400 7vvpd.exe 468 xxxrxxf.exe 804 thttnn.exe 796 dvpdj.exe 2908 dvdpj.exe 4364 5rfxrlf.exe 2388 1ffxrxr.exe -
resource yara_rule behavioral2/memory/2712-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 5084 2712 edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe 83 PID 2712 wrote to memory of 5084 2712 edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe 83 PID 2712 wrote to memory of 5084 2712 edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe 83 PID 5084 wrote to memory of 4356 5084 flrlffr.exe 84 PID 5084 wrote to memory of 4356 5084 flrlffr.exe 84 PID 5084 wrote to memory of 4356 5084 flrlffr.exe 84 PID 4356 wrote to memory of 3872 4356 bbtnnn.exe 85 PID 4356 wrote to memory of 3872 4356 bbtnnn.exe 85 PID 4356 wrote to memory of 3872 4356 bbtnnn.exe 85 PID 3872 wrote to memory of 1392 3872 jvvpj.exe 88 PID 3872 wrote to memory of 1392 3872 jvvpj.exe 88 PID 3872 wrote to memory of 1392 3872 jvvpj.exe 88 PID 1392 wrote to memory of 2664 1392 llxrrrx.exe 89 PID 1392 wrote to memory of 2664 1392 llxrrrx.exe 89 PID 1392 wrote to memory of 2664 1392 llxrrrx.exe 89 PID 2664 wrote to memory of 4764 2664 5pvvp.exe 91 PID 2664 wrote to memory of 4764 2664 5pvvp.exe 91 PID 2664 wrote to memory of 4764 2664 5pvvp.exe 91 PID 4764 wrote to memory of 2100 4764 tbhhhh.exe 92 PID 4764 wrote to memory of 2100 4764 tbhhhh.exe 92 PID 4764 wrote to memory of 2100 4764 tbhhhh.exe 92 PID 2100 wrote to memory of 4256 2100 lflfllf.exe 93 PID 2100 wrote to memory of 4256 2100 lflfllf.exe 93 PID 2100 wrote to memory of 4256 2100 lflfllf.exe 93 PID 4256 wrote to memory of 1428 4256 hbhhbb.exe 94 PID 4256 wrote to memory of 1428 4256 hbhhbb.exe 94 PID 4256 wrote to memory of 1428 4256 hbhhbb.exe 94 PID 1428 wrote to memory of 1640 1428 hnttnb.exe 95 PID 1428 wrote to memory of 1640 1428 hnttnb.exe 95 PID 1428 wrote to memory of 1640 1428 hnttnb.exe 95 PID 1640 wrote to memory of 3212 1640 xrxrffx.exe 96 PID 1640 wrote to memory of 3212 1640 xrxrffx.exe 96 PID 1640 wrote to memory of 3212 1640 xrxrffx.exe 96 PID 3212 wrote to memory of 2968 3212 jdjjv.exe 97 PID 3212 wrote to memory of 2968 3212 jdjjv.exe 97 PID 3212 wrote to memory of 2968 3212 jdjjv.exe 97 PID 2968 wrote to memory of 3672 2968 5rlfrrl.exe 98 PID 2968 wrote to memory of 3672 2968 5rlfrrl.exe 98 PID 2968 wrote to memory of 3672 2968 5rlfrrl.exe 98 PID 3672 wrote to memory of 4660 3672 5nttnt.exe 99 PID 3672 wrote to memory of 4660 3672 5nttnt.exe 99 PID 3672 wrote to memory of 4660 3672 5nttnt.exe 99 PID 4660 wrote to memory of 3860 4660 pvppd.exe 100 PID 4660 wrote to memory of 3860 4660 pvppd.exe 100 PID 4660 wrote to memory of 3860 4660 pvppd.exe 100 PID 3860 wrote to memory of 2724 3860 lfxxlll.exe 101 PID 3860 wrote to memory of 2724 3860 lfxxlll.exe 101 PID 3860 wrote to memory of 2724 3860 lfxxlll.exe 101 PID 2724 wrote to memory of 4404 2724 rlxxllx.exe 102 PID 2724 wrote to memory of 4404 2724 rlxxllx.exe 102 PID 2724 wrote to memory of 4404 2724 rlxxllx.exe 102 PID 4404 wrote to memory of 4044 4404 lfxrllx.exe 103 PID 4404 wrote to memory of 4044 4404 lfxrllx.exe 103 PID 4404 wrote to memory of 4044 4404 lfxrllx.exe 103 PID 4044 wrote to memory of 1120 4044 5vvjd.exe 104 PID 4044 wrote to memory of 1120 4044 5vvjd.exe 104 PID 4044 wrote to memory of 1120 4044 5vvjd.exe 104 PID 1120 wrote to memory of 1160 1120 flfxrrx.exe 105 PID 1120 wrote to memory of 1160 1120 flfxrrx.exe 105 PID 1120 wrote to memory of 1160 1120 flfxrrx.exe 105 PID 1160 wrote to memory of 4004 1160 jvjdv.exe 106 PID 1160 wrote to memory of 4004 1160 jvjdv.exe 106 PID 1160 wrote to memory of 4004 1160 jvjdv.exe 106 PID 4004 wrote to memory of 2684 4004 vddvp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe"C:\Users\Admin\AppData\Local\Temp\edd230ed5dc98255ce6e311b135ef01152eb77475368e2bf5ba37c5c5923fa8d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\flrlffr.exec:\flrlffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\bbtnnn.exec:\bbtnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\jvvpj.exec:\jvvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\llxrrrx.exec:\llxrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\5pvvp.exec:\5pvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\tbhhhh.exec:\tbhhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\lflfllf.exec:\lflfllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hbhhbb.exec:\hbhhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\hnttnb.exec:\hnttnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\xrxrffx.exec:\xrxrffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\jdjjv.exec:\jdjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\5rlfrrl.exec:\5rlfrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\5nttnt.exec:\5nttnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\pvppd.exec:\pvppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\lfxxlll.exec:\lfxxlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\rlxxllx.exec:\rlxxllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\lfxrllx.exec:\lfxrllx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\5vvjd.exec:\5vvjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\flfxrrx.exec:\flfxrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\jvjdv.exec:\jvjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\vddvp.exec:\vddvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\ffrlfrl.exec:\ffrlfrl.exe23⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hntnhb.exec:\hntnhb.exe24⤵
- Executes dropped EXE
PID:876 -
\??\c:\7xfxrrr.exec:\7xfxrrr.exe25⤵
- Executes dropped EXE
PID:4468 -
\??\c:\1djdd.exec:\1djdd.exe26⤵
- Executes dropped EXE
PID:3956 -
\??\c:\nbbttn.exec:\nbbttn.exe27⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rflrfxr.exec:\rflrfxr.exe28⤵
- Executes dropped EXE
PID:1280 -
\??\c:\nttnhb.exec:\nttnhb.exe29⤵
- Executes dropped EXE
PID:4048 -
\??\c:\frfxrrl.exec:\frfxrrl.exe30⤵
- Executes dropped EXE
PID:2096 -
\??\c:\llrlrrr.exec:\llrlrrr.exe31⤵
- Executes dropped EXE
PID:4128 -
\??\c:\htthbb.exec:\htthbb.exe32⤵
- Executes dropped EXE
PID:3528 -
\??\c:\1bbhtt.exec:\1bbhtt.exe33⤵
- Executes dropped EXE
PID:3596 -
\??\c:\xxxxlll.exec:\xxxxlll.exe34⤵
- Executes dropped EXE
PID:1084 -
\??\c:\nnbnnb.exec:\nnbnnb.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\bthbtt.exec:\bthbtt.exe36⤵
- Executes dropped EXE
PID:4648 -
\??\c:\jjjdv.exec:\jjjdv.exe37⤵
- Executes dropped EXE
PID:2996 -
\??\c:\fxxrxrf.exec:\fxxrxrf.exe38⤵
- Executes dropped EXE
PID:2472 -
\??\c:\llrllxx.exec:\llrllxx.exe39⤵
- Executes dropped EXE
PID:3192 -
\??\c:\7tbbtn.exec:\7tbbtn.exe40⤵
- Executes dropped EXE
PID:4344 -
\??\c:\dpdvd.exec:\dpdvd.exe41⤵
- Executes dropped EXE
PID:1632 -
\??\c:\3xlfxxr.exec:\3xlfxxr.exe42⤵
- Executes dropped EXE
PID:2932 -
\??\c:\thhnnn.exec:\thhnnn.exe43⤵
- Executes dropped EXE
PID:2432 -
\??\c:\djppj.exec:\djppj.exe44⤵
- Executes dropped EXE
PID:3080 -
\??\c:\dpvvp.exec:\dpvvp.exe45⤵
- Executes dropped EXE
PID:1864 -
\??\c:\9lrlffx.exec:\9lrlffx.exe46⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bbtnhn.exec:\bbtnhn.exe47⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vvjdj.exec:\vvjdj.exe48⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rflfxxx.exec:\rflfxxx.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tntnnn.exec:\tntnnn.exe50⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1nhhtt.exec:\1nhhtt.exe51⤵
- Executes dropped EXE
PID:4300 -
\??\c:\jvpjd.exec:\jvpjd.exe52⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xlrlxrl.exec:\xlrlxrl.exe53⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hbhbbb.exec:\hbhbbb.exe54⤵
- Executes dropped EXE
PID:5060 -
\??\c:\dpppp.exec:\dpppp.exe55⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xxffllr.exec:\xxffllr.exe56⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xfxlfxr.exec:\xfxlfxr.exe57⤵
- Executes dropped EXE
PID:1376 -
\??\c:\7dpvv.exec:\7dpvv.exe58⤵
- Executes dropped EXE
PID:3820 -
\??\c:\7vvpd.exec:\7vvpd.exe59⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xxxrxxf.exec:\xxxrxxf.exe60⤵
- Executes dropped EXE
PID:468 -
\??\c:\thttnn.exec:\thttnn.exe61⤵
- Executes dropped EXE
PID:804 -
\??\c:\dvpdj.exec:\dvpdj.exe62⤵
- Executes dropped EXE
PID:796 -
\??\c:\dvdpj.exec:\dvdpj.exe63⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5rfxrlf.exec:\5rfxrlf.exe64⤵
- Executes dropped EXE
PID:4364 -
\??\c:\1ffxrxr.exec:\1ffxrxr.exe65⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nhhbtn.exec:\nhhbtn.exe66⤵PID:2420
-
\??\c:\3pdvv.exec:\3pdvv.exe67⤵PID:2848
-
\??\c:\ddjpp.exec:\ddjpp.exe68⤵PID:692
-
\??\c:\xrllffx.exec:\xrllffx.exe69⤵PID:1892
-
\??\c:\rxxrllf.exec:\rxxrllf.exe70⤵PID:4552
-
\??\c:\9nnnhh.exec:\9nnnhh.exe71⤵PID:3204
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe72⤵PID:1284
-
\??\c:\ffxxrrx.exec:\ffxxrrx.exe73⤵PID:4540
-
\??\c:\nththt.exec:\nththt.exe74⤵PID:4408
-
\??\c:\pjddp.exec:\pjddp.exe75⤵PID:972
-
\??\c:\djpvp.exec:\djpvp.exe76⤵PID:1636
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe77⤵PID:1676
-
\??\c:\7hthbh.exec:\7hthbh.exe78⤵PID:756
-
\??\c:\3nbthh.exec:\3nbthh.exe79⤵PID:992
-
\??\c:\dvvpj.exec:\dvvpj.exe80⤵PID:4972
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe81⤵PID:4352
-
\??\c:\xffrxlf.exec:\xffrxlf.exe82⤵PID:4520
-
\??\c:\3hbtnh.exec:\3hbtnh.exe83⤵PID:3644
-
\??\c:\3hbtnh.exec:\3hbtnh.exe84⤵PID:2320
-
\??\c:\jvpvd.exec:\jvpvd.exe85⤵PID:3052
-
\??\c:\flxrllf.exec:\flxrllf.exe86⤵PID:1756
-
\??\c:\flrrlll.exec:\flrrlll.exe87⤵PID:3208
-
\??\c:\bnnhhb.exec:\bnnhhb.exe88⤵PID:4648
-
\??\c:\pjjvp.exec:\pjjvp.exe89⤵PID:2832
-
\??\c:\9vdvj.exec:\9vdvj.exe90⤵PID:3192
-
\??\c:\3lfrflf.exec:\3lfrflf.exe91⤵PID:232
-
\??\c:\tbtnhb.exec:\tbtnhb.exe92⤵PID:4588
-
\??\c:\btnhtt.exec:\btnhtt.exe93⤵PID:208
-
\??\c:\pvdpj.exec:\pvdpj.exe94⤵PID:4416
-
\??\c:\rfrllfl.exec:\rfrllfl.exe95⤵PID:8
-
\??\c:\lfxxlxl.exec:\lfxxlxl.exe96⤵PID:1416
-
\??\c:\nthbbb.exec:\nthbbb.exe97⤵PID:1156
-
\??\c:\5nnbtb.exec:\5nnbtb.exe98⤵PID:3060
-
\??\c:\jpdvj.exec:\jpdvj.exe99⤵PID:4764
-
\??\c:\xxfrlfl.exec:\xxfrlfl.exe100⤵PID:2148
-
\??\c:\nhtnhb.exec:\nhtnhb.exe101⤵PID:5060
-
\??\c:\9rxxrxr.exec:\9rxxrxr.exe102⤵PID:2612
-
\??\c:\nnbtbh.exec:\nnbtbh.exe103⤵PID:2580
-
\??\c:\ppvvd.exec:\ppvvd.exe104⤵PID:4668
-
\??\c:\ddjdj.exec:\ddjdj.exe105⤵PID:3820
-
\??\c:\xfllllf.exec:\xfllllf.exe106⤵PID:2968
-
\??\c:\vvvpj.exec:\vvvpj.exe107⤵PID:4632
-
\??\c:\9pvpj.exec:\9pvpj.exe108⤵PID:4056
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe109⤵PID:3660
-
\??\c:\hbhbbb.exec:\hbhbbb.exe110⤵PID:4784
-
\??\c:\1ddvp.exec:\1ddvp.exe111⤵PID:2724
-
\??\c:\7rrlxlf.exec:\7rrlxlf.exe112⤵PID:4912
-
\??\c:\bttttt.exec:\bttttt.exe113⤵PID:4044
-
\??\c:\vdjjd.exec:\vdjjd.exe114⤵PID:2864
-
\??\c:\llrlxlf.exec:\llrlxlf.exe115⤵PID:4484
-
\??\c:\rfrfxrl.exec:\rfrfxrl.exe116⤵PID:2180
-
\??\c:\5nhbbb.exec:\5nhbbb.exe117⤵PID:4552
-
\??\c:\5pdvv.exec:\5pdvv.exe118⤵PID:3204
-
\??\c:\jjddp.exec:\jjddp.exe119⤵PID:2572
-
\??\c:\3lxrxxl.exec:\3lxrxxl.exe120⤵PID:3032
-
\??\c:\hntnhn.exec:\hntnhn.exe121⤵PID:4468
-
\??\c:\jddvv.exec:\jddvv.exe122⤵PID:972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-