Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 21:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
116e4bf631367e89e40071cb22a98a7fd4f63f27bbc7ab550e94f9f05db94a3e.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
116e4bf631367e89e40071cb22a98a7fd4f63f27bbc7ab550e94f9f05db94a3e.exe
-
Size
71KB
-
MD5
3debd701d84403eb3db51dae47662d70
-
SHA1
7553ccb5d652a8a0784620ace4f246c69eec68eb
-
SHA256
116e4bf631367e89e40071cb22a98a7fd4f63f27bbc7ab550e94f9f05db94a3e
-
SHA512
130ec0149cf118b972b23b40db0bb7522281f5d9cc507c8e844b648de68c6122a909bb08210dfd77331953d8d54bcddea196f0a747ce8e26a777ed6bcc755371
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjl:ymb3NkkiQ3mdBjFI4V1
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3280-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3948 pvpvv.exe 5004 lflxxxf.exe 760 hbbttn.exe 2472 djpjj.exe 1020 pjppv.exe 4664 lflfffx.exe 3588 3tttnh.exe 4444 dvdvv.exe 3652 jdddp.exe 536 frrlffl.exe 2020 btbttt.exe 392 3ntnhh.exe 2012 1jpjv.exe 4720 rffrllf.exe 232 nbbbtn.exe 3816 9tbthh.exe 3308 vvddd.exe 4172 9fxlllf.exe 5080 1nnnhh.exe 732 pdjdj.exe 4388 rrlfrrl.exe 2468 frfxflr.exe 1552 9lffxxf.exe 2696 htbtnh.exe 1132 nbhbnn.exe 2888 pjjdv.exe 4532 jdjvv.exe 3436 5rrfxlf.exe 3208 3bbthh.exe 3236 dppjd.exe 3512 jvpjd.exe 2656 xlxrfxx.exe 1436 hhtnhh.exe 4040 ddpdv.exe 960 pddvj.exe 3720 frrlxxr.exe 1792 7lxrlxr.exe 3520 tbbbnn.exe 2780 dvjvp.exe 3416 9jpvp.exe 376 1jpjd.exe 3864 xllfrrr.exe 1636 xrlrlff.exe 3008 nhbbnn.exe 3404 jvpjv.exe 436 xffrfxf.exe 444 nbtntt.exe 3768 pjjdd.exe 2232 9jjdp.exe 536 fllfxll.exe 876 5fllrrr.exe 1100 thhbtn.exe 224 ttbthh.exe 4120 jddvv.exe 4720 pjpjp.exe 4520 9rlfffl.exe 1004 xlfxrlf.exe 1072 hbtnhh.exe 4508 1nnbbh.exe 4872 vdvdv.exe 3056 vpjvj.exe 5008 3frlrlr.exe 1512 fffxffx.exe 948 hhhthh.exe -
resource yara_rule behavioral2/memory/3280-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3280 wrote to memory of 3948 3280 116e4bf631367e89e40071cb22a98a7fd4f63f27bbc7ab550e94f9f05db94a3e.exe 84 PID 3280 wrote to memory of 3948 3280 116e4bf631367e89e40071cb22a98a7fd4f63f27bbc7ab550e94f9f05db94a3e.exe 84 PID 3280 wrote to memory of 3948 3280 116e4bf631367e89e40071cb22a98a7fd4f63f27bbc7ab550e94f9f05db94a3e.exe 84 PID 3948 wrote to memory of 5004 3948 pvpvv.exe 85 PID 3948 wrote to memory of 5004 3948 pvpvv.exe 85 PID 3948 wrote to memory of 5004 3948 pvpvv.exe 85 PID 5004 wrote to memory of 760 5004 lflxxxf.exe 86 PID 5004 wrote to memory of 760 5004 lflxxxf.exe 86 PID 5004 wrote to memory of 760 5004 lflxxxf.exe 86 PID 760 wrote to memory of 2472 760 hbbttn.exe 87 PID 760 wrote to memory of 2472 760 hbbttn.exe 87 PID 760 wrote to memory of 2472 760 hbbttn.exe 87 PID 2472 wrote to memory of 1020 2472 djpjj.exe 88 PID 2472 wrote to memory of 1020 2472 djpjj.exe 88 PID 2472 wrote to memory of 1020 2472 djpjj.exe 88 PID 1020 wrote to memory of 4664 1020 pjppv.exe 89 PID 1020 wrote to memory of 4664 1020 pjppv.exe 89 PID 1020 wrote to memory of 4664 1020 pjppv.exe 89 PID 4664 wrote to memory of 3588 4664 lflfffx.exe 90 PID 4664 wrote to memory of 3588 4664 lflfffx.exe 90 PID 4664 wrote to memory of 3588 4664 lflfffx.exe 90 PID 3588 wrote to memory of 4444 3588 3tttnh.exe 91 PID 3588 wrote to memory of 4444 3588 3tttnh.exe 91 PID 3588 wrote to memory of 4444 3588 3tttnh.exe 91 PID 4444 wrote to memory of 3652 4444 dvdvv.exe 92 PID 4444 wrote to memory of 3652 4444 dvdvv.exe 92 PID 4444 wrote to memory of 3652 4444 dvdvv.exe 92 PID 3652 wrote to memory of 536 3652 jdddp.exe 93 PID 3652 wrote to memory of 536 3652 jdddp.exe 93 PID 3652 wrote to memory of 536 3652 jdddp.exe 93 PID 536 wrote to memory of 2020 536 frrlffl.exe 94 PID 536 wrote to memory of 2020 536 frrlffl.exe 94 PID 536 wrote to memory of 2020 536 frrlffl.exe 94 PID 2020 wrote to memory of 392 2020 btbttt.exe 95 PID 2020 wrote to memory of 392 2020 btbttt.exe 95 PID 2020 wrote to memory of 392 2020 btbttt.exe 95 PID 392 wrote to memory of 2012 392 3ntnhh.exe 96 PID 392 wrote to memory of 2012 392 3ntnhh.exe 96 PID 392 wrote to memory of 2012 392 3ntnhh.exe 96 PID 2012 wrote to memory of 4720 2012 1jpjv.exe 97 PID 2012 wrote to memory of 4720 2012 1jpjv.exe 97 PID 2012 wrote to memory of 4720 2012 1jpjv.exe 97 PID 4720 wrote to memory of 232 4720 rffrllf.exe 98 PID 4720 wrote to memory of 232 4720 rffrllf.exe 98 PID 4720 wrote to memory of 232 4720 rffrllf.exe 98 PID 232 wrote to memory of 3816 232 nbbbtn.exe 99 PID 232 wrote to memory of 3816 232 nbbbtn.exe 99 PID 232 wrote to memory of 3816 232 nbbbtn.exe 99 PID 3816 wrote to memory of 3308 3816 9tbthh.exe 100 PID 3816 wrote to memory of 3308 3816 9tbthh.exe 100 PID 3816 wrote to memory of 3308 3816 9tbthh.exe 100 PID 3308 wrote to memory of 4172 3308 vvddd.exe 102 PID 3308 wrote to memory of 4172 3308 vvddd.exe 102 PID 3308 wrote to memory of 4172 3308 vvddd.exe 102 PID 4172 wrote to memory of 5080 4172 9fxlllf.exe 103 PID 4172 wrote to memory of 5080 4172 9fxlllf.exe 103 PID 4172 wrote to memory of 5080 4172 9fxlllf.exe 103 PID 5080 wrote to memory of 732 5080 1nnnhh.exe 105 PID 5080 wrote to memory of 732 5080 1nnnhh.exe 105 PID 5080 wrote to memory of 732 5080 1nnnhh.exe 105 PID 732 wrote to memory of 4388 732 pdjdj.exe 106 PID 732 wrote to memory of 4388 732 pdjdj.exe 106 PID 732 wrote to memory of 4388 732 pdjdj.exe 106 PID 4388 wrote to memory of 2468 4388 rrlfrrl.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\116e4bf631367e89e40071cb22a98a7fd4f63f27bbc7ab550e94f9f05db94a3e.exe"C:\Users\Admin\AppData\Local\Temp\116e4bf631367e89e40071cb22a98a7fd4f63f27bbc7ab550e94f9f05db94a3e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\pvpvv.exec:\pvpvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\lflxxxf.exec:\lflxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\hbbttn.exec:\hbbttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\djpjj.exec:\djpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\pjppv.exec:\pjppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\lflfffx.exec:\lflfffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\3tttnh.exec:\3tttnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\dvdvv.exec:\dvdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\jdddp.exec:\jdddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\frrlffl.exec:\frrlffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\btbttt.exec:\btbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\3ntnhh.exec:\3ntnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\1jpjv.exec:\1jpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\rffrllf.exec:\rffrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\nbbbtn.exec:\nbbbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\9tbthh.exec:\9tbthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\vvddd.exec:\vvddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\9fxlllf.exec:\9fxlllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\1nnnhh.exec:\1nnnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\pdjdj.exec:\pdjdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\frfxflr.exec:\frfxflr.exe23⤵
- Executes dropped EXE
PID:2468 -
\??\c:\9lffxxf.exec:\9lffxxf.exe24⤵
- Executes dropped EXE
PID:1552 -
\??\c:\htbtnh.exec:\htbtnh.exe25⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nbhbnn.exec:\nbhbnn.exe26⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pjjdv.exec:\pjjdv.exe27⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jdjvv.exec:\jdjvv.exe28⤵
- Executes dropped EXE
PID:4532 -
\??\c:\5rrfxlf.exec:\5rrfxlf.exe29⤵
- Executes dropped EXE
PID:3436 -
\??\c:\3bbthh.exec:\3bbthh.exe30⤵
- Executes dropped EXE
PID:3208 -
\??\c:\dppjd.exec:\dppjd.exe31⤵
- Executes dropped EXE
PID:3236 -
\??\c:\jvpjd.exec:\jvpjd.exe32⤵
- Executes dropped EXE
PID:3512 -
\??\c:\xlxrfxx.exec:\xlxrfxx.exe33⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hhtnhh.exec:\hhtnhh.exe34⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ddpdv.exec:\ddpdv.exe35⤵
- Executes dropped EXE
PID:4040 -
\??\c:\pddvj.exec:\pddvj.exe36⤵
- Executes dropped EXE
PID:960 -
\??\c:\frrlxxr.exec:\frrlxxr.exe37⤵
- Executes dropped EXE
PID:3720 -
\??\c:\7lxrlxr.exec:\7lxrlxr.exe38⤵
- Executes dropped EXE
PID:1792 -
\??\c:\tbbbnn.exec:\tbbbnn.exe39⤵
- Executes dropped EXE
PID:3520 -
\??\c:\dvjvp.exec:\dvjvp.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9jpvp.exec:\9jpvp.exe41⤵
- Executes dropped EXE
PID:3416 -
\??\c:\1jpjd.exec:\1jpjd.exe42⤵
- Executes dropped EXE
PID:376 -
\??\c:\xllfrrr.exec:\xllfrrr.exe43⤵
- Executes dropped EXE
PID:3864 -
\??\c:\xrlrlff.exec:\xrlrlff.exe44⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nhbbnn.exec:\nhbbnn.exe45⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jvpjv.exec:\jvpjv.exe46⤵
- Executes dropped EXE
PID:3404 -
\??\c:\xffrfxf.exec:\xffrfxf.exe47⤵
- Executes dropped EXE
PID:436 -
\??\c:\nbtntt.exec:\nbtntt.exe48⤵
- Executes dropped EXE
PID:444 -
\??\c:\pjjdd.exec:\pjjdd.exe49⤵
- Executes dropped EXE
PID:3768 -
\??\c:\9jjdp.exec:\9jjdp.exe50⤵
- Executes dropped EXE
PID:2232 -
\??\c:\fllfxll.exec:\fllfxll.exe51⤵
- Executes dropped EXE
PID:536 -
\??\c:\5fllrrr.exec:\5fllrrr.exe52⤵
- Executes dropped EXE
PID:876 -
\??\c:\thhbtn.exec:\thhbtn.exe53⤵
- Executes dropped EXE
PID:1100 -
\??\c:\ttbthh.exec:\ttbthh.exe54⤵
- Executes dropped EXE
PID:224 -
\??\c:\jddvv.exec:\jddvv.exe55⤵
- Executes dropped EXE
PID:4120 -
\??\c:\pjpjp.exec:\pjpjp.exe56⤵
- Executes dropped EXE
PID:4720 -
\??\c:\9rlfffl.exec:\9rlfffl.exe57⤵
- Executes dropped EXE
PID:4520 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe58⤵
- Executes dropped EXE
PID:1004 -
\??\c:\hbtnhh.exec:\hbtnhh.exe59⤵
- Executes dropped EXE
PID:1072 -
\??\c:\1nnbbh.exec:\1nnbbh.exe60⤵
- Executes dropped EXE
PID:4508 -
\??\c:\vdvdv.exec:\vdvdv.exe61⤵
- Executes dropped EXE
PID:4872 -
\??\c:\vpjvj.exec:\vpjvj.exe62⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3frlrlr.exec:\3frlrlr.exe63⤵
- Executes dropped EXE
PID:5008 -
\??\c:\fffxffx.exec:\fffxffx.exe64⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hhhthh.exec:\hhhthh.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\1pvjd.exec:\1pvjd.exe66⤵PID:996
-
\??\c:\vjjdp.exec:\vjjdp.exe67⤵PID:888
-
\??\c:\5ffxllf.exec:\5ffxllf.exe68⤵PID:1148
-
\??\c:\bhnttt.exec:\bhnttt.exe69⤵PID:2696
-
\??\c:\9httnb.exec:\9httnb.exe70⤵PID:1132
-
\??\c:\vvdvp.exec:\vvdvp.exe71⤵PID:3156
-
\??\c:\jddvp.exec:\jddvp.exe72⤵PID:4504
-
\??\c:\9frlxxr.exec:\9frlxxr.exe73⤵PID:3572
-
\??\c:\lfflllr.exec:\lfflllr.exe74⤵PID:4460
-
\??\c:\thtntn.exec:\thtntn.exe75⤵PID:3200
-
\??\c:\tbhbnh.exec:\tbhbnh.exe76⤵PID:448
-
\??\c:\dppjv.exec:\dppjv.exe77⤵PID:3384
-
\??\c:\1djdp.exec:\1djdp.exe78⤵PID:3264
-
\??\c:\frrlxxr.exec:\frrlxxr.exe79⤵PID:1076
-
\??\c:\xrxrlll.exec:\xrxrlll.exe80⤵PID:2408
-
\??\c:\7bnbtb.exec:\7bnbtb.exe81⤵PID:2524
-
\??\c:\btthtt.exec:\btthtt.exe82⤵PID:3132
-
\??\c:\pjpjv.exec:\pjpjv.exe83⤵PID:2488
-
\??\c:\vjvdd.exec:\vjvdd.exe84⤵PID:4868
-
\??\c:\frlfffx.exec:\frlfffx.exe85⤵PID:2968
-
\??\c:\frxrllf.exec:\frxrllf.exe86⤵PID:4024
-
\??\c:\bbnhnh.exec:\bbnhnh.exe87⤵PID:4556
-
\??\c:\7dvvp.exec:\7dvvp.exe88⤵PID:1880
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe89⤵PID:3624
-
\??\c:\lffxrrr.exec:\lffxrrr.exe90⤵PID:3316
-
\??\c:\bbtnht.exec:\bbtnht.exe91⤵PID:3248
-
\??\c:\jpjdv.exec:\jpjdv.exe92⤵PID:4664
-
\??\c:\jjpjv.exec:\jjpjv.exe93⤵PID:4244
-
\??\c:\llxfxfx.exec:\llxfxfx.exe94⤵PID:1804
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe95⤵PID:444
-
\??\c:\rrrlffx.exec:\rrrlffx.exe96⤵PID:2504
-
\??\c:\hbtnhh.exec:\hbtnhh.exe97⤵PID:4400
-
\??\c:\1ntnnn.exec:\1ntnnn.exe98⤵PID:3192
-
\??\c:\pjdjd.exec:\pjdjd.exe99⤵PID:2192
-
\??\c:\5djdv.exec:\5djdv.exe100⤵PID:392
-
\??\c:\xlrxlrr.exec:\xlrxlrr.exe101⤵PID:3312
-
\??\c:\frlfrrl.exec:\frlfrrl.exe102⤵PID:3680
-
\??\c:\htnhbb.exec:\htnhbb.exe103⤵PID:1400
-
\??\c:\dpvpj.exec:\dpvpj.exe104⤵PID:2920
-
\??\c:\5ffrllf.exec:\5ffrllf.exe105⤵PID:3968
-
\??\c:\lfllfxx.exec:\lfllfxx.exe106⤵PID:3984
-
\??\c:\tbbtnn.exec:\tbbtnn.exe107⤵PID:828
-
\??\c:\hnbttn.exec:\hnbttn.exe108⤵PID:5080
-
\??\c:\pddvv.exec:\pddvv.exe109⤵PID:732
-
\??\c:\jjpjv.exec:\jjpjv.exe110⤵PID:1084
-
\??\c:\7lrrllf.exec:\7lrrllf.exe111⤵PID:2468
-
\??\c:\3lrrlrr.exec:\3lrrlrr.exe112⤵PID:4488
-
\??\c:\btbtbb.exec:\btbtbb.exe113⤵PID:4688
-
\??\c:\hbbtnh.exec:\hbbtnh.exe114⤵PID:4836
-
\??\c:\7pjdv.exec:\7pjdv.exe115⤵PID:2412
-
\??\c:\3jjdv.exec:\3jjdv.exe116⤵PID:3456
-
\??\c:\5rrrlll.exec:\5rrrlll.exe117⤵PID:1480
-
\??\c:\3rlfrrf.exec:\3rlfrrf.exe118⤵PID:3592
-
\??\c:\bbtbht.exec:\bbtbht.exe119⤵PID:2456
-
\??\c:\jdpvd.exec:\jdpvd.exe120⤵PID:4732
-
\??\c:\dddpv.exec:\dddpv.exe121⤵PID:1788
-
\??\c:\xlxlrlf.exec:\xlxlrlf.exe122⤵PID:4984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-