Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2025 04:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe
Resource
win7-20250207-en
7 signatures
150 seconds
General
-
Target
aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe
-
Size
73KB
-
MD5
ea1dd3c97a3acb03c2005a759f429939
-
SHA1
58ed73be3ebe41382fbf29c1971c283b2e73d715
-
SHA256
aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b
-
SHA512
6b54d0e4ea7e29596084929b0229055da99dc93684d83c15093fce36563f3ab2bfba7a6bea7424496a6853840248f489528a1b13ea688821f6812bd22b1f6a91
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdLH+O:ymb3NkkiQ3mdBjF0yMliCO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1836-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5660-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5664-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5288-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1144-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6092-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5764-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2652-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6088-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5576-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5460-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3984 ffxrllf.exe 5660 ntttnh.exe 5664 vppjp.exe 5288 djjdj.exe 2772 fxffxrl.exe 464 5bttnh.exe 1144 1xlfxxr.exe 1800 hnnhhb.exe 6092 vpjdd.exe 5060 1rrlxxr.exe 2024 nbtntt.exe 4208 vdpdd.exe 3220 dpjjv.exe 3888 rrrlxrl.exe 5764 7hbthb.exe 3716 thnhhh.exe 3032 lxxrllx.exe 768 9tnhbb.exe 4904 lllxllf.exe 4916 lxrlffr.exe 4320 pjvjj.exe 5172 djppj.exe 2652 lrlfrlf.exe 5044 tthbtn.exe 4536 1vjdj.exe 6088 jpvpj.exe 5576 vjjjv.exe 3296 7vpdp.exe 5460 xlrfxrl.exe 1612 xllfffx.exe 4088 httnhh.exe 736 9hnbtn.exe 2300 pjpjd.exe 2348 xfxlffx.exe 2020 rxlllrr.exe 4584 httnhb.exe 740 djddp.exe 4480 dpjpj.exe 2984 xrfrffr.exe 5792 rxfrlfx.exe 3648 hhntnh.exe 4572 nhhhbb.exe 3588 5dvvj.exe 2500 lffxrll.exe 3304 rlrllrl.exe 2040 nbbtnh.exe 2044 pdpdj.exe 4496 7ddvv.exe 4304 5flxffr.exe 6012 lxrlxlx.exe 5644 3tnhtn.exe 4552 tbtnhb.exe 4036 djpvj.exe 3464 vvvpd.exe 5040 7fxrfxr.exe 776 tbtnht.exe 3164 tbhhbt.exe 4968 5jdvj.exe 1904 vpvjj.exe 3116 rrxrxxx.exe 4924 9rrrlfx.exe 4700 bbnhbb.exe 5020 jvddd.exe 1256 djddv.exe -
resource yara_rule behavioral2/memory/1836-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5660-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5664-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5288-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5288-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5288-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5288-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6092-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5764-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2652-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6088-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5576-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5460-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-215-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1836 wrote to memory of 3984 1836 aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe 80 PID 1836 wrote to memory of 3984 1836 aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe 80 PID 1836 wrote to memory of 3984 1836 aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe 80 PID 3984 wrote to memory of 5660 3984 ffxrllf.exe 81 PID 3984 wrote to memory of 5660 3984 ffxrllf.exe 81 PID 3984 wrote to memory of 5660 3984 ffxrllf.exe 81 PID 5660 wrote to memory of 5664 5660 ntttnh.exe 82 PID 5660 wrote to memory of 5664 5660 ntttnh.exe 82 PID 5660 wrote to memory of 5664 5660 ntttnh.exe 82 PID 5664 wrote to memory of 5288 5664 vppjp.exe 83 PID 5664 wrote to memory of 5288 5664 vppjp.exe 83 PID 5664 wrote to memory of 5288 5664 vppjp.exe 83 PID 5288 wrote to memory of 2772 5288 djjdj.exe 84 PID 5288 wrote to memory of 2772 5288 djjdj.exe 84 PID 5288 wrote to memory of 2772 5288 djjdj.exe 84 PID 2772 wrote to memory of 464 2772 fxffxrl.exe 85 PID 2772 wrote to memory of 464 2772 fxffxrl.exe 85 PID 2772 wrote to memory of 464 2772 fxffxrl.exe 85 PID 464 wrote to memory of 1144 464 5bttnh.exe 86 PID 464 wrote to memory of 1144 464 5bttnh.exe 86 PID 464 wrote to memory of 1144 464 5bttnh.exe 86 PID 1144 wrote to memory of 1800 1144 1xlfxxr.exe 87 PID 1144 wrote to memory of 1800 1144 1xlfxxr.exe 87 PID 1144 wrote to memory of 1800 1144 1xlfxxr.exe 87 PID 1800 wrote to memory of 6092 1800 hnnhhb.exe 88 PID 1800 wrote to memory of 6092 1800 hnnhhb.exe 88 PID 1800 wrote to memory of 6092 1800 hnnhhb.exe 88 PID 6092 wrote to memory of 5060 6092 vpjdd.exe 89 PID 6092 wrote to memory of 5060 6092 vpjdd.exe 89 PID 6092 wrote to memory of 5060 6092 vpjdd.exe 89 PID 5060 wrote to memory of 2024 5060 1rrlxxr.exe 90 PID 5060 wrote to memory of 2024 5060 1rrlxxr.exe 90 PID 5060 wrote to memory of 2024 5060 1rrlxxr.exe 90 PID 2024 wrote to memory of 4208 2024 nbtntt.exe 91 PID 2024 wrote to memory of 4208 2024 nbtntt.exe 91 PID 2024 wrote to memory of 4208 2024 nbtntt.exe 91 PID 4208 wrote to memory of 3220 4208 vdpdd.exe 92 PID 4208 wrote to memory of 3220 4208 vdpdd.exe 92 PID 4208 wrote to memory of 3220 4208 vdpdd.exe 92 PID 3220 wrote to memory of 3888 3220 dpjjv.exe 93 PID 3220 wrote to memory of 3888 3220 dpjjv.exe 93 PID 3220 wrote to memory of 3888 3220 dpjjv.exe 93 PID 3888 wrote to memory of 5764 3888 rrrlxrl.exe 94 PID 3888 wrote to memory of 5764 3888 rrrlxrl.exe 94 PID 3888 wrote to memory of 5764 3888 rrrlxrl.exe 94 PID 5764 wrote to memory of 3716 5764 7hbthb.exe 95 PID 5764 wrote to memory of 3716 5764 7hbthb.exe 95 PID 5764 wrote to memory of 3716 5764 7hbthb.exe 95 PID 3716 wrote to memory of 3032 3716 thnhhh.exe 96 PID 3716 wrote to memory of 3032 3716 thnhhh.exe 96 PID 3716 wrote to memory of 3032 3716 thnhhh.exe 96 PID 3032 wrote to memory of 768 3032 lxxrllx.exe 97 PID 3032 wrote to memory of 768 3032 lxxrllx.exe 97 PID 3032 wrote to memory of 768 3032 lxxrllx.exe 97 PID 768 wrote to memory of 4904 768 9tnhbb.exe 98 PID 768 wrote to memory of 4904 768 9tnhbb.exe 98 PID 768 wrote to memory of 4904 768 9tnhbb.exe 98 PID 4904 wrote to memory of 4916 4904 lllxllf.exe 99 PID 4904 wrote to memory of 4916 4904 lllxllf.exe 99 PID 4904 wrote to memory of 4916 4904 lllxllf.exe 99 PID 4916 wrote to memory of 4320 4916 lxrlffr.exe 100 PID 4916 wrote to memory of 4320 4916 lxrlffr.exe 100 PID 4916 wrote to memory of 4320 4916 lxrlffr.exe 100 PID 4320 wrote to memory of 5172 4320 pjvjj.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe"C:\Users\Admin\AppData\Local\Temp\aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\ffxrllf.exec:\ffxrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\ntttnh.exec:\ntttnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
\??\c:\vppjp.exec:\vppjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
\??\c:\djjdj.exec:\djjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
\??\c:\fxffxrl.exec:\fxffxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\5bttnh.exec:\5bttnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\1xlfxxr.exec:\1xlfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\hnnhhb.exec:\hnnhhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\vpjdd.exec:\vpjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
\??\c:\1rrlxxr.exec:\1rrlxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\nbtntt.exec:\nbtntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\vdpdd.exec:\vdpdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\dpjjv.exec:\dpjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\rrrlxrl.exec:\rrrlxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\7hbthb.exec:\7hbthb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
\??\c:\thnhhh.exec:\thnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\lxxrllx.exec:\lxxrllx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\9tnhbb.exec:\9tnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\lllxllf.exec:\lllxllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\lxrlffr.exec:\lxrlffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\pjvjj.exec:\pjvjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\djppj.exec:\djppj.exe23⤵
- Executes dropped EXE
PID:5172 -
\??\c:\lrlfrlf.exec:\lrlfrlf.exe24⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tthbtn.exec:\tthbtn.exe25⤵
- Executes dropped EXE
PID:5044 -
\??\c:\1vjdj.exec:\1vjdj.exe26⤵
- Executes dropped EXE
PID:4536 -
\??\c:\jpvpj.exec:\jpvpj.exe27⤵
- Executes dropped EXE
PID:6088 -
\??\c:\vjjjv.exec:\vjjjv.exe28⤵
- Executes dropped EXE
PID:5576 -
\??\c:\7vpdp.exec:\7vpdp.exe29⤵
- Executes dropped EXE
PID:3296 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe30⤵
- Executes dropped EXE
PID:5460 -
\??\c:\xllfffx.exec:\xllfffx.exe31⤵
- Executes dropped EXE
PID:1612 -
\??\c:\httnhh.exec:\httnhh.exe32⤵
- Executes dropped EXE
PID:4088 -
\??\c:\9hnbtn.exec:\9hnbtn.exe33⤵
- Executes dropped EXE
PID:736 -
\??\c:\pjpjd.exec:\pjpjd.exe34⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xfxlffx.exec:\xfxlffx.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rxlllrr.exec:\rxlllrr.exe36⤵
- Executes dropped EXE
PID:2020 -
\??\c:\httnhb.exec:\httnhb.exe37⤵
- Executes dropped EXE
PID:4584 -
\??\c:\djddp.exec:\djddp.exe38⤵
- Executes dropped EXE
PID:740 -
\??\c:\dpjpj.exec:\dpjpj.exe39⤵
- Executes dropped EXE
PID:4480 -
\??\c:\xrfrffr.exec:\xrfrffr.exe40⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rxfrlfx.exec:\rxfrlfx.exe41⤵
- Executes dropped EXE
PID:5792 -
\??\c:\hhntnh.exec:\hhntnh.exe42⤵
- Executes dropped EXE
PID:3648 -
\??\c:\nhhhbb.exec:\nhhhbb.exe43⤵
- Executes dropped EXE
PID:4572 -
\??\c:\5dvvj.exec:\5dvvj.exe44⤵
- Executes dropped EXE
PID:3588 -
\??\c:\lffxrll.exec:\lffxrll.exe45⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rlrllrl.exec:\rlrllrl.exe46⤵
- Executes dropped EXE
PID:3304 -
\??\c:\nbbtnh.exec:\nbbtnh.exe47⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pdpdj.exec:\pdpdj.exe48⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7ddvv.exec:\7ddvv.exe49⤵
- Executes dropped EXE
PID:4496 -
\??\c:\5flxffr.exec:\5flxffr.exe50⤵
- Executes dropped EXE
PID:4304 -
\??\c:\lxrlxlx.exec:\lxrlxlx.exe51⤵
- Executes dropped EXE
PID:6012 -
\??\c:\3tnhtn.exec:\3tnhtn.exe52⤵
- Executes dropped EXE
PID:5644 -
\??\c:\tbtnhb.exec:\tbtnhb.exe53⤵
- Executes dropped EXE
PID:4552 -
\??\c:\djpvj.exec:\djpvj.exe54⤵
- Executes dropped EXE
PID:4036 -
\??\c:\vvvpd.exec:\vvvpd.exe55⤵
- Executes dropped EXE
PID:3464 -
\??\c:\7fxrfxr.exec:\7fxrfxr.exe56⤵
- Executes dropped EXE
PID:5040 -
\??\c:\tbtnht.exec:\tbtnht.exe57⤵
- Executes dropped EXE
PID:776 -
\??\c:\tbhhbt.exec:\tbhhbt.exe58⤵
- Executes dropped EXE
PID:3164 -
\??\c:\5jdvj.exec:\5jdvj.exe59⤵
- Executes dropped EXE
PID:4968 -
\??\c:\vpvjj.exec:\vpvjj.exe60⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rrxrxxx.exec:\rrxrxxx.exe61⤵
- Executes dropped EXE
PID:3116 -
\??\c:\9rrrlfx.exec:\9rrrlfx.exe62⤵
- Executes dropped EXE
PID:4924 -
\??\c:\bbnhbb.exec:\bbnhbb.exe63⤵
- Executes dropped EXE
PID:4700 -
\??\c:\jvddd.exec:\jvddd.exe64⤵
- Executes dropped EXE
PID:5020 -
\??\c:\djddv.exec:\djddv.exe65⤵
- Executes dropped EXE
PID:1256 -
\??\c:\rffrxxx.exec:\rffrxxx.exe66⤵PID:1408
-
\??\c:\httttt.exec:\httttt.exe67⤵PID:3584
-
\??\c:\btnbtt.exec:\btnbtt.exe68⤵PID:1588
-
\??\c:\vpjvj.exec:\vpjvj.exe69⤵PID:4576
-
\??\c:\pvvpj.exec:\pvvpj.exe70⤵PID:900
-
\??\c:\xlrrrxr.exec:\xlrrrxr.exe71⤵PID:3316
-
\??\c:\xllfrrl.exec:\xllfrrl.exe72⤵PID:5324
-
\??\c:\htbhbn.exec:\htbhbn.exe73⤵PID:1424
-
\??\c:\thhbnt.exec:\thhbnt.exe74⤵PID:6112
-
\??\c:\vpjvv.exec:\vpjvv.exe75⤵PID:1140
-
\??\c:\5ffrllf.exec:\5ffrllf.exe76⤵PID:2684
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe77⤵PID:2376
-
\??\c:\tnnntn.exec:\tnnntn.exe78⤵PID:6000
-
\??\c:\jpjdv.exec:\jpjdv.exe79⤵PID:5868
-
\??\c:\frxxrxl.exec:\frxxrxl.exe80⤵PID:3424
-
\??\c:\xlfrrrr.exec:\xlfrrrr.exe81⤵PID:3928
-
\??\c:\nntbbt.exec:\nntbbt.exe82⤵PID:628
-
\??\c:\btbtnh.exec:\btbtnh.exe83⤵PID:6028
-
\??\c:\dvvdv.exec:\dvvdv.exe84⤵PID:3112
-
\??\c:\frllxfx.exec:\frllxfx.exe85⤵PID:4284
-
\??\c:\frllxlx.exec:\frllxlx.exe86⤵PID:3100
-
\??\c:\3hhbtn.exec:\3hhbtn.exe87⤵PID:5340
-
\??\c:\jjvdp.exec:\jjvdp.exe88⤵PID:4544
-
\??\c:\ppvpd.exec:\ppvpd.exe89⤵PID:2900
-
\??\c:\fxrrlll.exec:\fxrrlll.exe90⤵PID:5660
-
\??\c:\3ntnbt.exec:\3ntnbt.exe91⤵PID:4312
-
\??\c:\bttnnn.exec:\bttnnn.exe92⤵PID:1636
-
\??\c:\pdjpp.exec:\pdjpp.exe93⤵PID:652
-
\??\c:\pjppj.exec:\pjppj.exe94⤵PID:5296
-
\??\c:\fffrfxl.exec:\fffrfxl.exe95⤵PID:1108
-
\??\c:\5lxrllf.exec:\5lxrllf.exe96⤵PID:4356
-
\??\c:\nhttbb.exec:\nhttbb.exe97⤵PID:1692
-
\??\c:\bbbtnn.exec:\bbbtnn.exe98⤵PID:6068
-
\??\c:\dddvv.exec:\dddvv.exe99⤵PID:4180
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe100⤵PID:5500
-
\??\c:\fxxxrlx.exec:\fxxxrlx.exe101⤵PID:1404
-
\??\c:\btbhhn.exec:\btbhhn.exe102⤵PID:4144
-
\??\c:\vvvpp.exec:\vvvpp.exe103⤵PID:3564
-
\??\c:\pppjd.exec:\pppjd.exe104⤵PID:2024
-
\??\c:\5xfrxrl.exec:\5xfrxrl.exe105⤵PID:5596
-
\??\c:\rlxrlrl.exec:\rlxrlrl.exe106⤵PID:3892
-
\??\c:\bbhbbt.exec:\bbhbbt.exe107⤵PID:1196
-
\??\c:\tbbnbt.exec:\tbbnbt.exe108⤵PID:3000
-
\??\c:\vdvjv.exec:\vdvjv.exe109⤵PID:5240
-
\??\c:\pjpjd.exec:\pjpjd.exe110⤵PID:2216
-
\??\c:\7xlfxxx.exec:\7xlfxxx.exe111⤵PID:5176
-
\??\c:\lllfxxl.exec:\lllfxxl.exe112⤵PID:3032
-
\??\c:\nbnbht.exec:\nbnbht.exe113⤵PID:1988
-
\??\c:\vdvpp.exec:\vdvpp.exe114⤵PID:4904
-
\??\c:\jjvjv.exec:\jjvjv.exe115⤵PID:2064
-
\??\c:\xfxxxlx.exec:\xfxxxlx.exe116⤵PID:1260
-
\??\c:\1xrlxrl.exec:\1xrlxrl.exe117⤵PID:5144
-
\??\c:\9bbbth.exec:\9bbbth.exe118⤵PID:5172
-
\??\c:\bnhtbt.exec:\bnhtbt.exe119⤵PID:3360
-
\??\c:\5pjvd.exec:\5pjvd.exe120⤵PID:5516
-
\??\c:\dvvpj.exec:\dvvpj.exe121⤵PID:1596
-
\??\c:\lrxlxrl.exec:\lrxlxrl.exe122⤵PID:5584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-