Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2025 06:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe
Resource
win7-20241010-en
6 signatures
120 seconds
General
-
Target
3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe
-
Size
54KB
-
MD5
61301f67b5b57197dd53e55360de5c20
-
SHA1
6a233d2a5657e010637d60dd8fc0d9428bb4eee7
-
SHA256
3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369a
-
SHA512
5936015718734b7d68f56695704b23f29a1f95bdb3281c79235aefb33e3130aa899cba54927548cae6f69cacbc02529a434093d25af2068e8cfba229b067cb75
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJM:0cdpeeBSHHMHLf9RyIEK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2056-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2812-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/32-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-364-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-372-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-469-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-491-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-567-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-583-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-842-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-904-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-1136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-1158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3636 vdjvp.exe 2676 rxllfxr.exe 1988 hhnnhb.exe 4564 hnnnht.exe 3880 ppvpv.exe 3172 rrxrlrl.exe 1700 xffllff.exe 1064 hthhhh.exe 1460 vjjjj.exe 3304 rrxrrfx.exe 228 xxfxxxx.exe 4340 hhbttb.exe 2780 ddjpp.exe 1356 frlfffx.exe 5072 xrfffrr.exe 4320 bbhbbh.exe 800 djppv.exe 748 xrlrrxx.exe 1928 thttbn.exe 2348 nhbhbn.exe 1876 ddddd.exe 1076 flxxrxx.exe 4768 flxxxxx.exe 4572 bbbbbh.exe 3988 vpdvv.exe 2044 bthbnh.exe 4132 pvpdv.exe 1048 vvpjd.exe 4428 vdpdv.exe 3088 7lrrrfx.exe 1932 tbtbht.exe 2812 jpdjv.exe 1848 pvpdv.exe 736 xrxxllf.exe 1272 hbtttt.exe 2504 bbhbtn.exe 2156 pvdpd.exe 1796 lfrlffx.exe 1860 bbbbnn.exe 1524 vjjdv.exe 456 lflffff.exe 4188 3xrrrff.exe 3936 thnnhh.exe 1368 nnnnbt.exe 1724 ppjvd.exe 5004 lfflxxx.exe 1156 3nbbbb.exe 4832 dppjd.exe 1728 9pvvj.exe 4040 9nhbtt.exe 868 bbhhbb.exe 4440 pvvpj.exe 1572 xllrxxr.exe 1564 hthbhh.exe 3636 bthbtt.exe 4524 3lrlxxr.exe 2720 llfffff.exe 4488 nnthhn.exe 1820 pvddp.exe 4192 lrrllff.exe 2216 flxrlll.exe 3172 hnttnt.exe 1952 hthhnt.exe 2176 lfrlffx.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 3636 2056 3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe 82 PID 2056 wrote to memory of 3636 2056 3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe 82 PID 2056 wrote to memory of 3636 2056 3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe 82 PID 3636 wrote to memory of 2676 3636 vdjvp.exe 83 PID 3636 wrote to memory of 2676 3636 vdjvp.exe 83 PID 3636 wrote to memory of 2676 3636 vdjvp.exe 83 PID 2676 wrote to memory of 1988 2676 rxllfxr.exe 84 PID 2676 wrote to memory of 1988 2676 rxllfxr.exe 84 PID 2676 wrote to memory of 1988 2676 rxllfxr.exe 84 PID 1988 wrote to memory of 4564 1988 hhnnhb.exe 85 PID 1988 wrote to memory of 4564 1988 hhnnhb.exe 85 PID 1988 wrote to memory of 4564 1988 hhnnhb.exe 85 PID 4564 wrote to memory of 3880 4564 hnnnht.exe 86 PID 4564 wrote to memory of 3880 4564 hnnnht.exe 86 PID 4564 wrote to memory of 3880 4564 hnnnht.exe 86 PID 3880 wrote to memory of 3172 3880 ppvpv.exe 87 PID 3880 wrote to memory of 3172 3880 ppvpv.exe 87 PID 3880 wrote to memory of 3172 3880 ppvpv.exe 87 PID 3172 wrote to memory of 1700 3172 rrxrlrl.exe 88 PID 3172 wrote to memory of 1700 3172 rrxrlrl.exe 88 PID 3172 wrote to memory of 1700 3172 rrxrlrl.exe 88 PID 1700 wrote to memory of 1064 1700 xffllff.exe 89 PID 1700 wrote to memory of 1064 1700 xffllff.exe 89 PID 1700 wrote to memory of 1064 1700 xffllff.exe 89 PID 1064 wrote to memory of 1460 1064 hthhhh.exe 90 PID 1064 wrote to memory of 1460 1064 hthhhh.exe 90 PID 1064 wrote to memory of 1460 1064 hthhhh.exe 90 PID 1460 wrote to memory of 3304 1460 vjjjj.exe 91 PID 1460 wrote to memory of 3304 1460 vjjjj.exe 91 PID 1460 wrote to memory of 3304 1460 vjjjj.exe 91 PID 3304 wrote to memory of 228 3304 rrxrrfx.exe 92 PID 3304 wrote to memory of 228 3304 rrxrrfx.exe 92 PID 3304 wrote to memory of 228 3304 rrxrrfx.exe 92 PID 228 wrote to memory of 4340 228 xxfxxxx.exe 93 PID 228 wrote to memory of 4340 228 xxfxxxx.exe 93 PID 228 wrote to memory of 4340 228 xxfxxxx.exe 93 PID 4340 wrote to memory of 2780 4340 hhbttb.exe 94 PID 4340 wrote to memory of 2780 4340 hhbttb.exe 94 PID 4340 wrote to memory of 2780 4340 hhbttb.exe 94 PID 2780 wrote to memory of 1356 2780 ddjpp.exe 95 PID 2780 wrote to memory of 1356 2780 ddjpp.exe 95 PID 2780 wrote to memory of 1356 2780 ddjpp.exe 95 PID 1356 wrote to memory of 5072 1356 frlfffx.exe 96 PID 1356 wrote to memory of 5072 1356 frlfffx.exe 96 PID 1356 wrote to memory of 5072 1356 frlfffx.exe 96 PID 5072 wrote to memory of 4320 5072 xrfffrr.exe 97 PID 5072 wrote to memory of 4320 5072 xrfffrr.exe 97 PID 5072 wrote to memory of 4320 5072 xrfffrr.exe 97 PID 4320 wrote to memory of 800 4320 bbhbbh.exe 98 PID 4320 wrote to memory of 800 4320 bbhbbh.exe 98 PID 4320 wrote to memory of 800 4320 bbhbbh.exe 98 PID 800 wrote to memory of 748 800 djppv.exe 99 PID 800 wrote to memory of 748 800 djppv.exe 99 PID 800 wrote to memory of 748 800 djppv.exe 99 PID 748 wrote to memory of 1928 748 xrlrrxx.exe 100 PID 748 wrote to memory of 1928 748 xrlrrxx.exe 100 PID 748 wrote to memory of 1928 748 xrlrrxx.exe 100 PID 1928 wrote to memory of 2348 1928 thttbn.exe 101 PID 1928 wrote to memory of 2348 1928 thttbn.exe 101 PID 1928 wrote to memory of 2348 1928 thttbn.exe 101 PID 2348 wrote to memory of 1876 2348 nhbhbn.exe 102 PID 2348 wrote to memory of 1876 2348 nhbhbn.exe 102 PID 2348 wrote to memory of 1876 2348 nhbhbn.exe 102 PID 1876 wrote to memory of 1076 1876 ddddd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe"C:\Users\Admin\AppData\Local\Temp\3ba94b9ddc1c3c688b9b0143f7871ef26678f34b5fac72965da63dcb28b0369aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\vdjvp.exec:\vdjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\rxllfxr.exec:\rxllfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hhnnhb.exec:\hhnnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\hnnnht.exec:\hnnnht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\ppvpv.exec:\ppvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\rrxrlrl.exec:\rrxrlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\xffllff.exec:\xffllff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\hthhhh.exec:\hthhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\vjjjj.exec:\vjjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\rrxrrfx.exec:\rrxrrfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\hhbttb.exec:\hhbttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\ddjpp.exec:\ddjpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\frlfffx.exec:\frlfffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\xrfffrr.exec:\xrfffrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\bbhbbh.exec:\bbhbbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\djppv.exec:\djppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\xrlrrxx.exec:\xrlrrxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\thttbn.exec:\thttbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\nhbhbn.exec:\nhbhbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\ddddd.exec:\ddddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\flxxrxx.exec:\flxxrxx.exe23⤵
- Executes dropped EXE
PID:1076 -
\??\c:\flxxxxx.exec:\flxxxxx.exe24⤵
- Executes dropped EXE
PID:4768 -
\??\c:\bbbbbh.exec:\bbbbbh.exe25⤵
- Executes dropped EXE
PID:4572 -
\??\c:\vpdvv.exec:\vpdvv.exe26⤵
- Executes dropped EXE
PID:3988 -
\??\c:\bthbnh.exec:\bthbnh.exe27⤵
- Executes dropped EXE
PID:2044 -
\??\c:\pvpdv.exec:\pvpdv.exe28⤵
- Executes dropped EXE
PID:4132 -
\??\c:\vvpjd.exec:\vvpjd.exe29⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vdpdv.exec:\vdpdv.exe30⤵
- Executes dropped EXE
PID:4428 -
\??\c:\7lrrrfx.exec:\7lrrrfx.exe31⤵
- Executes dropped EXE
PID:3088 -
\??\c:\tbtbht.exec:\tbtbht.exe32⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jpdjv.exec:\jpdjv.exe33⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pvpdv.exec:\pvpdv.exe34⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xrxxllf.exec:\xrxxllf.exe35⤵
- Executes dropped EXE
PID:736 -
\??\c:\hbtttt.exec:\hbtttt.exe36⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bbhbtn.exec:\bbhbtn.exe37⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pvdpd.exec:\pvdpd.exe38⤵
- Executes dropped EXE
PID:2156 -
\??\c:\lfrlffx.exec:\lfrlffx.exe39⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bbbbnn.exec:\bbbbnn.exe40⤵
- Executes dropped EXE
PID:1860 -
\??\c:\vjjdv.exec:\vjjdv.exe41⤵
- Executes dropped EXE
PID:1524 -
\??\c:\lflffff.exec:\lflffff.exe42⤵
- Executes dropped EXE
PID:456 -
\??\c:\3xrrrff.exec:\3xrrrff.exe43⤵
- Executes dropped EXE
PID:4188 -
\??\c:\thnnhh.exec:\thnnhh.exe44⤵
- Executes dropped EXE
PID:3936 -
\??\c:\nnnnbt.exec:\nnnnbt.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1368 -
\??\c:\ppjvd.exec:\ppjvd.exe46⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lfflxxx.exec:\lfflxxx.exe47⤵
- Executes dropped EXE
PID:5004 -
\??\c:\3nbbbb.exec:\3nbbbb.exe48⤵
- Executes dropped EXE
PID:1156 -
\??\c:\dppjd.exec:\dppjd.exe49⤵
- Executes dropped EXE
PID:4832 -
\??\c:\9pvvj.exec:\9pvvj.exe50⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9nhbtt.exec:\9nhbtt.exe51⤵
- Executes dropped EXE
PID:4040 -
\??\c:\bbhhbb.exec:\bbhhbb.exe52⤵
- Executes dropped EXE
PID:868 -
\??\c:\pvvpj.exec:\pvvpj.exe53⤵
- Executes dropped EXE
PID:4440 -
\??\c:\xllrxxr.exec:\xllrxxr.exe54⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hthbhh.exec:\hthbhh.exe55⤵
- Executes dropped EXE
PID:1564 -
\??\c:\bthbtt.exec:\bthbtt.exe56⤵
- Executes dropped EXE
PID:3636 -
\??\c:\3lrlxxr.exec:\3lrlxxr.exe57⤵
- Executes dropped EXE
PID:4524 -
\??\c:\llfffff.exec:\llfffff.exe58⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nnthhn.exec:\nnthhn.exe59⤵
- Executes dropped EXE
PID:4488 -
\??\c:\pvddp.exec:\pvddp.exe60⤵
- Executes dropped EXE
PID:1820 -
\??\c:\lrrllff.exec:\lrrllff.exe61⤵
- Executes dropped EXE
PID:4192 -
\??\c:\flxrlll.exec:\flxrlll.exe62⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hnttnt.exec:\hnttnt.exe63⤵
- Executes dropped EXE
PID:3172 -
\??\c:\hthhnt.exec:\hthhnt.exe64⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lfrlffx.exec:\lfrlffx.exe65⤵
- Executes dropped EXE
PID:2176 -
\??\c:\thhnhn.exec:\thhnhn.exe66⤵PID:2456
-
\??\c:\bhnnhb.exec:\bhnnhb.exe67⤵PID:1052
-
\??\c:\3dddd.exec:\3dddd.exe68⤵PID:372
-
\??\c:\fffxrll.exec:\fffxrll.exe69⤵PID:3592
-
\??\c:\thhnth.exec:\thhnth.exe70⤵PID:5112
-
\??\c:\pdvdd.exec:\pdvdd.exe71⤵PID:1580
-
\??\c:\xflfffl.exec:\xflfffl.exe72⤵PID:3568
-
\??\c:\xrfrxff.exec:\xrfrxff.exe73⤵PID:5064
-
\??\c:\bthnnn.exec:\bthnnn.exe74⤵PID:1780
-
\??\c:\btbtnt.exec:\btbtnt.exe75⤵PID:5000
-
\??\c:\5ddjd.exec:\5ddjd.exe76⤵PID:4264
-
\??\c:\9dppj.exec:\9dppj.exe77⤵PID:32
-
\??\c:\rllllrr.exec:\rllllrr.exe78⤵PID:4328
-
\??\c:\nnhhbh.exec:\nnhhbh.exe79⤵PID:1168
-
\??\c:\nhntnh.exec:\nhntnh.exe80⤵PID:2212
-
\??\c:\vjjjd.exec:\vjjjd.exe81⤵PID:4864
-
\??\c:\dvvvp.exec:\dvvvp.exe82⤵PID:5108
-
\??\c:\flxrlfl.exec:\flxrlfl.exe83⤵PID:2348
-
\??\c:\lxfrrxr.exec:\lxfrrxr.exe84⤵PID:3416
-
\??\c:\thnhbb.exec:\thnhbb.exe85⤵PID:3572
-
\??\c:\jvvvv.exec:\jvvvv.exe86⤵PID:2284
-
\??\c:\vvddv.exec:\vvddv.exe87⤵PID:4300
-
\??\c:\xrllfll.exec:\xrllfll.exe88⤵PID:4828
-
\??\c:\hhhhbb.exec:\hhhhbb.exe89⤵PID:1004
-
\??\c:\tnnnhh.exec:\tnnnhh.exe90⤵PID:4088
-
\??\c:\3jppj.exec:\3jppj.exe91⤵PID:4528
-
\??\c:\pjjdp.exec:\pjjdp.exe92⤵PID:4468
-
\??\c:\xfffrxr.exec:\xfffrxr.exe93⤵PID:4200
-
\??\c:\bbhntn.exec:\bbhntn.exe94⤵PID:1048
-
\??\c:\tntbtt.exec:\tntbtt.exe95⤵PID:208
-
\??\c:\vvdvj.exec:\vvdvj.exe96⤵PID:3088
-
\??\c:\vvvpj.exec:\vvvpj.exe97⤵PID:2520
-
\??\c:\xxxxllf.exec:\xxxxllf.exe98⤵PID:764
-
\??\c:\hhnhbb.exec:\hhnhbb.exe99⤵PID:2812
-
\??\c:\hnbthb.exec:\hnbthb.exe100⤵PID:60
-
\??\c:\pjvpp.exec:\pjvpp.exe101⤵PID:2468
-
\??\c:\vpvvj.exec:\vpvvj.exe102⤵PID:3184
-
\??\c:\rrrfllf.exec:\rrrfllf.exe103⤵PID:3996
-
\??\c:\llxrxxr.exec:\llxrxxr.exe104⤵PID:4336
-
\??\c:\tntbhh.exec:\tntbhh.exe105⤵PID:3460
-
\??\c:\nnhbnn.exec:\nnhbnn.exe106⤵PID:3392
-
\??\c:\vpvdp.exec:\vpvdp.exe107⤵PID:3100
-
\??\c:\ppppj.exec:\ppppj.exe108⤵PID:1524
-
\??\c:\xfxrllf.exec:\xfxrllf.exe109⤵PID:3388
-
\??\c:\tbtnhb.exec:\tbtnhb.exe110⤵PID:4188
-
\??\c:\nhnhbb.exec:\nhnhbb.exe111⤵PID:3936
-
\??\c:\vvddv.exec:\vvddv.exe112⤵PID:3440
-
\??\c:\pjdvp.exec:\pjdvp.exe113⤵PID:3900
-
\??\c:\lrfxllx.exec:\lrfxllx.exe114⤵PID:684
-
\??\c:\3rfllxf.exec:\3rfllxf.exe115⤵PID:4236
-
\??\c:\1bnnhb.exec:\1bnnhb.exe116⤵PID:696
-
\??\c:\vvjpj.exec:\vvjpj.exe117⤵PID:1728
-
\??\c:\1lffrrl.exec:\1lffrrl.exe118⤵PID:1264
-
\??\c:\ntbnnt.exec:\ntbnnt.exe119⤵PID:2552
-
\??\c:\vpppp.exec:\vpppp.exe120⤵
- System Location Discovery: System Language Discovery
PID:4584 -
\??\c:\vjjjd.exec:\vjjjd.exe121⤵PID:2388
-
\??\c:\7lxlllf.exec:\7lxlllf.exe122⤵PID:4308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-