Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:16
Behavioral task
behavioral1
Sample
047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9.exe
-
Size
497KB
-
MD5
203c7d849bcedf90f3a80f7042ec0650
-
SHA1
844e7da681f46ef55df70154f31bfd8a1c1d46c1
-
SHA256
047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9
-
SHA512
6b64c75e7aef5b6fa751cc4a824a6da5dcdef37700d81a20a2c170155cb5d40fe3b398c0ec562ae039af1e5bbaca68f4c19acdca471968c91ef811e90d8c43d2
-
SSDEEP
12288:S4wFHoSyoS3ebeFmFVvlrmwcT4wpteFmFTxj:0KFmFVtrRcFEFmF5
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3668-6-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3260-8-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1392-146-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5056-198-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5104-217-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1900-302-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2220-438-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4308-454-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1136-487-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4460-493-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3060-482-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4816-478-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/548-472-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1144-469-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4252-466-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1932-460-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2712-457-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/552-448-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1096-444-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4220-441-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/940-432-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2076-428-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/224-425-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3252-422-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/996-415-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3620-408-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3052-406-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3924-403-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/556-397-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3576-391-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3104-385-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3016-379-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4148-373-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/692-364-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1032-360-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2952-354-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5004-351-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3828-348-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1724-344-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3796-338-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5032-334-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4524-331-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2888-328-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5024-324-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1136-317-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4984-310-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1932-296-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2268-291-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4888-286-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/552-283-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1096-280-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/216-271-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4288-268-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3264-260-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3252-256-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4332-252-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1088-248-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/996-244-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2916-241-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/212-233-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4616-229-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3576-225-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4216-221-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3024-213-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppjjd.exelflflll.exebbbnnt.exeddpjv.exe3lrlffl.exetbhhbb.exebhnhbb.exeddppj.exerfrrrrr.exettbtbb.exeddvpd.exejjjdv.exexllfxrx.exennhbhh.exejdjpv.exerxlrfxf.exethhbtn.exevvjjj.exepjdvv.exefrxfxlf.exenbttnn.exedvdvp.exexrlfrrr.exe9nhbnn.exetthnnh.exejvjdv.exelrxrllf.exetnnnhh.exeddppd.exefrxrffl.exe9thhbb.exevjddd.exexfrffrl.exe9xfxrrl.exehbbthb.exe5pdvp.exexlfffff.exenttntt.exepjpjj.exepddpj.exefffxrrf.exethnhbh.exedpjdp.exexrfrlxr.exe9nbttt.exenhhhbb.exedjddd.exelffxxrr.exenthtnt.exejdjdv.exejddpj.exerxlfxxx.exehhtnhh.exeddjjd.exelrrrlff.exellrrlll.exetnbtnn.exedvppj.exelxxrlfx.exenhthtb.exepdvdv.exe3ppjd.exerlrllff.exehhnnhh.exepid process 3260 ppjjd.exe 2164 lflflll.exe 4288 bbbnnt.exe 216 ddpjv.exe 3468 3lrlffl.exe 2728 tbhhbb.exe 4416 bhnhbb.exe 4868 ddppj.exe 808 rfrrrrr.exe 4968 ttbtbb.exe 2696 ddvpd.exe 1156 jjjdv.exe 2596 xllfxrx.exe 2168 nnhbhh.exe 4984 jdjpv.exe 3060 rxlrfxf.exe 60 thhbtn.exe 1800 vvjjj.exe 1436 pjdvv.exe 3444 frxfxlf.exe 4524 nbttnn.exe 1392 dvdvp.exe 3432 xrlfrrr.exe 1016 9nhbnn.exe 728 tthnnh.exe 3828 jvjdv.exe 5004 lrxrllf.exe 3388 tnnnhh.exe 4812 ddppd.exe 3492 frxrffl.exe 4684 9thhbb.exe 5056 vjddd.exe 3684 xfrffrl.exe 3352 9xfxrrl.exe 388 hbbthb.exe 3024 5pdvp.exe 5104 xlfffff.exe 4216 nttntt.exe 3576 pjpjj.exe 4616 pddpj.exe 212 fffxrrf.exe 4480 thnhbh.exe 2916 dpjdp.exe 996 xrfrlxr.exe 1088 9nbttt.exe 4332 nhhhbb.exe 3252 djddd.exe 3264 lffxxrr.exe 940 nthtnt.exe 4288 jdjdv.exe 216 jddpj.exe 880 rxlfxxx.exe 1096 hhtnhh.exe 552 ddjjd.exe 4888 lrrrlff.exe 2268 llrrlll.exe 4552 tnbtnn.exe 1932 dvppj.exe 1900 lxxrlfx.exe 1180 nhthtb.exe 4984 pdvdv.exe 384 3ppjd.exe 2504 rlrllff.exe 1136 hhnnhh.exe -
Processes:
resource yara_rule behavioral2/memory/3668-0-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3668-6-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3260-8-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\ppjjd.exe upx C:\lflflll.exe upx C:\bbbnnt.exe upx \??\c:\ddpjv.exe upx \??\c:\3lrlffl.exe upx \??\c:\tbhhbb.exe upx \??\c:\bhnhbb.exe upx \??\c:\ddppj.exe upx \??\c:\jjjdv.exe upx \??\c:\nnhbhh.exe upx \??\c:\rxlrfxf.exe upx behavioral2/memory/1392-146-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/5056-198-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/5104-217-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1900-302-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2220-438-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4308-454-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1136-487-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4460-493-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3060-482-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4816-478-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/548-472-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1144-469-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4252-466-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1932-460-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2712-457-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/552-448-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1096-444-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4220-441-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/940-432-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2076-428-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/224-425-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3252-422-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/996-415-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3620-408-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3052-406-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3924-403-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/556-397-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3576-391-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3104-385-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3016-379-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4148-373-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/692-364-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1032-360-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2952-354-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/5004-351-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3828-348-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1724-344-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3796-338-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/5032-334-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4524-331-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2888-328-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/5024-324-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1136-317-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4984-310-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1932-296-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2268-291-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4888-286-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/552-283-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1096-280-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/216-271-0x0000000000400000-0x0000000000484000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9.exeppjjd.exelflflll.exebbbnnt.exeddpjv.exe3lrlffl.exetbhhbb.exebhnhbb.exeddppj.exerfrrrrr.exettbtbb.exeddvpd.exejjjdv.exexllfxrx.exennhbhh.exejdjpv.exerxlrfxf.exethhbtn.exevvjjj.exepjdvv.exefrxfxlf.exenbttnn.exedescription pid process target process PID 3668 wrote to memory of 3260 3668 047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9.exe ppjjd.exe PID 3668 wrote to memory of 3260 3668 047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9.exe ppjjd.exe PID 3668 wrote to memory of 3260 3668 047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9.exe ppjjd.exe PID 3260 wrote to memory of 2164 3260 ppjjd.exe lflflll.exe PID 3260 wrote to memory of 2164 3260 ppjjd.exe lflflll.exe PID 3260 wrote to memory of 2164 3260 ppjjd.exe lflflll.exe PID 2164 wrote to memory of 4288 2164 lflflll.exe bbbnnt.exe PID 2164 wrote to memory of 4288 2164 lflflll.exe bbbnnt.exe PID 2164 wrote to memory of 4288 2164 lflflll.exe bbbnnt.exe PID 4288 wrote to memory of 216 4288 bbbnnt.exe ddpjv.exe PID 4288 wrote to memory of 216 4288 bbbnnt.exe ddpjv.exe PID 4288 wrote to memory of 216 4288 bbbnnt.exe ddpjv.exe PID 216 wrote to memory of 3468 216 ddpjv.exe 3lrlffl.exe PID 216 wrote to memory of 3468 216 ddpjv.exe 3lrlffl.exe PID 216 wrote to memory of 3468 216 ddpjv.exe 3lrlffl.exe PID 3468 wrote to memory of 2728 3468 3lrlffl.exe tbhhbb.exe PID 3468 wrote to memory of 2728 3468 3lrlffl.exe tbhhbb.exe PID 3468 wrote to memory of 2728 3468 3lrlffl.exe tbhhbb.exe PID 2728 wrote to memory of 4416 2728 tbhhbb.exe bhnhbb.exe PID 2728 wrote to memory of 4416 2728 tbhhbb.exe bhnhbb.exe PID 2728 wrote to memory of 4416 2728 tbhhbb.exe bhnhbb.exe PID 4416 wrote to memory of 4868 4416 bhnhbb.exe ddppj.exe PID 4416 wrote to memory of 4868 4416 bhnhbb.exe ddppj.exe PID 4416 wrote to memory of 4868 4416 bhnhbb.exe ddppj.exe PID 4868 wrote to memory of 808 4868 ddppj.exe rfrrrrr.exe PID 4868 wrote to memory of 808 4868 ddppj.exe rfrrrrr.exe PID 4868 wrote to memory of 808 4868 ddppj.exe rfrrrrr.exe PID 808 wrote to memory of 4968 808 rfrrrrr.exe ttbtbb.exe PID 808 wrote to memory of 4968 808 rfrrrrr.exe ttbtbb.exe PID 808 wrote to memory of 4968 808 rfrrrrr.exe ttbtbb.exe PID 4968 wrote to memory of 2696 4968 ttbtbb.exe ddvpd.exe PID 4968 wrote to memory of 2696 4968 ttbtbb.exe ddvpd.exe PID 4968 wrote to memory of 2696 4968 ttbtbb.exe ddvpd.exe PID 2696 wrote to memory of 1156 2696 ddvpd.exe jjjdv.exe PID 2696 wrote to memory of 1156 2696 ddvpd.exe jjjdv.exe PID 2696 wrote to memory of 1156 2696 ddvpd.exe jjjdv.exe PID 1156 wrote to memory of 2596 1156 jjjdv.exe xllfxrx.exe PID 1156 wrote to memory of 2596 1156 jjjdv.exe xllfxrx.exe PID 1156 wrote to memory of 2596 1156 jjjdv.exe xllfxrx.exe PID 2596 wrote to memory of 2168 2596 xllfxrx.exe nnhbhh.exe PID 2596 wrote to memory of 2168 2596 xllfxrx.exe nnhbhh.exe PID 2596 wrote to memory of 2168 2596 xllfxrx.exe nnhbhh.exe PID 2168 wrote to memory of 4984 2168 nnhbhh.exe jdjpv.exe PID 2168 wrote to memory of 4984 2168 nnhbhh.exe jdjpv.exe PID 2168 wrote to memory of 4984 2168 nnhbhh.exe jdjpv.exe PID 4984 wrote to memory of 3060 4984 jdjpv.exe rxlrfxf.exe PID 4984 wrote to memory of 3060 4984 jdjpv.exe rxlrfxf.exe PID 4984 wrote to memory of 3060 4984 jdjpv.exe rxlrfxf.exe PID 3060 wrote to memory of 60 3060 rxlrfxf.exe thhbtn.exe PID 3060 wrote to memory of 60 3060 rxlrfxf.exe thhbtn.exe PID 3060 wrote to memory of 60 3060 rxlrfxf.exe thhbtn.exe PID 60 wrote to memory of 1800 60 thhbtn.exe vvjjj.exe PID 60 wrote to memory of 1800 60 thhbtn.exe vvjjj.exe PID 60 wrote to memory of 1800 60 thhbtn.exe vvjjj.exe PID 1800 wrote to memory of 1436 1800 vvjjj.exe pjdvv.exe PID 1800 wrote to memory of 1436 1800 vvjjj.exe pjdvv.exe PID 1800 wrote to memory of 1436 1800 vvjjj.exe pjdvv.exe PID 1436 wrote to memory of 3444 1436 pjdvv.exe frxfxlf.exe PID 1436 wrote to memory of 3444 1436 pjdvv.exe frxfxlf.exe PID 1436 wrote to memory of 3444 1436 pjdvv.exe frxfxlf.exe PID 3444 wrote to memory of 4524 3444 frxfxlf.exe nbttnn.exe PID 3444 wrote to memory of 4524 3444 frxfxlf.exe nbttnn.exe PID 3444 wrote to memory of 4524 3444 frxfxlf.exe nbttnn.exe PID 4524 wrote to memory of 1392 4524 nbttnn.exe dvdvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9.exe"C:\Users\Admin\AppData\Local\Temp\047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjjd.exec:\ppjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflflll.exec:\lflflll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbbnnt.exec:\bbbnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddpjv.exec:\ddpjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lrlffl.exec:\3lrlffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbhhbb.exec:\tbhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnhbb.exec:\bhnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddppj.exec:\ddppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttbtbb.exec:\ttbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvpd.exec:\ddvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjdv.exec:\jjjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xllfxrx.exec:\xllfxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhbhh.exec:\nnhbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjpv.exec:\jdjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxlrfxf.exec:\rxlrfxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thhbtn.exec:\thhbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjjj.exec:\vvjjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdvv.exec:\pjdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxfxlf.exec:\frxfxlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbttnn.exec:\nbttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdvp.exec:\dvdvp.exe23⤵
- Executes dropped EXE
-
\??\c:\xrlfrrr.exec:\xrlfrrr.exe24⤵
- Executes dropped EXE
-
\??\c:\9nhbnn.exec:\9nhbnn.exe25⤵
- Executes dropped EXE
-
\??\c:\tthnnh.exec:\tthnnh.exe26⤵
- Executes dropped EXE
-
\??\c:\jvjdv.exec:\jvjdv.exe27⤵
- Executes dropped EXE
-
\??\c:\lrxrllf.exec:\lrxrllf.exe28⤵
- Executes dropped EXE
-
\??\c:\tnnnhh.exec:\tnnnhh.exe29⤵
- Executes dropped EXE
-
\??\c:\ddppd.exec:\ddppd.exe30⤵
- Executes dropped EXE
-
\??\c:\frxrffl.exec:\frxrffl.exe31⤵
- Executes dropped EXE
-
\??\c:\9thhbb.exec:\9thhbb.exe32⤵
- Executes dropped EXE
-
\??\c:\vjddd.exec:\vjddd.exe33⤵
- Executes dropped EXE
-
\??\c:\xfrffrl.exec:\xfrffrl.exe34⤵
- Executes dropped EXE
-
\??\c:\9xfxrrl.exec:\9xfxrrl.exe35⤵
- Executes dropped EXE
-
\??\c:\hbbthb.exec:\hbbthb.exe36⤵
- Executes dropped EXE
-
\??\c:\5pdvp.exec:\5pdvp.exe37⤵
- Executes dropped EXE
-
\??\c:\xlfffff.exec:\xlfffff.exe38⤵
- Executes dropped EXE
-
\??\c:\nttntt.exec:\nttntt.exe39⤵
- Executes dropped EXE
-
\??\c:\pjpjj.exec:\pjpjj.exe40⤵
- Executes dropped EXE
-
\??\c:\pddpj.exec:\pddpj.exe41⤵
- Executes dropped EXE
-
\??\c:\fffxrrf.exec:\fffxrrf.exe42⤵
- Executes dropped EXE
-
\??\c:\thnhbh.exec:\thnhbh.exe43⤵
- Executes dropped EXE
-
\??\c:\dpjdp.exec:\dpjdp.exe44⤵
- Executes dropped EXE
-
\??\c:\xrfrlxr.exec:\xrfrlxr.exe45⤵
- Executes dropped EXE
-
\??\c:\9nbttt.exec:\9nbttt.exe46⤵
- Executes dropped EXE
-
\??\c:\nhhhbb.exec:\nhhhbb.exe47⤵
- Executes dropped EXE
-
\??\c:\djddd.exec:\djddd.exe48⤵
- Executes dropped EXE
-
\??\c:\lffxxrr.exec:\lffxxrr.exe49⤵
- Executes dropped EXE
-
\??\c:\nthtnt.exec:\nthtnt.exe50⤵
- Executes dropped EXE
-
\??\c:\jdjdv.exec:\jdjdv.exe51⤵
- Executes dropped EXE
-
\??\c:\jddpj.exec:\jddpj.exe52⤵
- Executes dropped EXE
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe53⤵
- Executes dropped EXE
-
\??\c:\hhtnhh.exec:\hhtnhh.exe54⤵
- Executes dropped EXE
-
\??\c:\ddjjd.exec:\ddjjd.exe55⤵
- Executes dropped EXE
-
\??\c:\lrrrlff.exec:\lrrrlff.exe56⤵
- Executes dropped EXE
-
\??\c:\llrrlll.exec:\llrrlll.exe57⤵
- Executes dropped EXE
-
\??\c:\tnbtnn.exec:\tnbtnn.exe58⤵
- Executes dropped EXE
-
\??\c:\dvppj.exec:\dvppj.exe59⤵
- Executes dropped EXE
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe60⤵
- Executes dropped EXE
-
\??\c:\nhthtb.exec:\nhthtb.exe61⤵
- Executes dropped EXE
-
\??\c:\pdvdv.exec:\pdvdv.exe62⤵
- Executes dropped EXE
-
\??\c:\3ppjd.exec:\3ppjd.exe63⤵
- Executes dropped EXE
-
\??\c:\rlrllff.exec:\rlrllff.exe64⤵
- Executes dropped EXE
-
\??\c:\hhnnhh.exec:\hhnnhh.exe65⤵
- Executes dropped EXE
-
\??\c:\9ddvp.exec:\9ddvp.exe66⤵
-
\??\c:\3lrrlrx.exec:\3lrrlrx.exe67⤵
-
\??\c:\fxrlfxf.exec:\fxrlfxf.exe68⤵
-
\??\c:\1bhbtt.exec:\1bhbtt.exe69⤵
-
\??\c:\vvjdv.exec:\vvjdv.exe70⤵
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe71⤵
-
\??\c:\tnhbnt.exec:\tnhbnt.exe72⤵
-
\??\c:\jvvvd.exec:\jvvvd.exe73⤵
-
\??\c:\jpdvd.exec:\jpdvd.exe74⤵
-
\??\c:\lrffrxx.exec:\lrffrxx.exe75⤵
-
\??\c:\bbhbtt.exec:\bbhbtt.exe76⤵
-
\??\c:\jvjjd.exec:\jvjjd.exe77⤵
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe78⤵
-
\??\c:\nnhhht.exec:\nnhhht.exe79⤵
-
\??\c:\djvdj.exec:\djvdj.exe80⤵
-
\??\c:\ntttbb.exec:\ntttbb.exe81⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe82⤵
-
\??\c:\frrrxrx.exec:\frrrxrx.exe83⤵
-
\??\c:\tbbtth.exec:\tbbtth.exe84⤵
-
\??\c:\vjvpv.exec:\vjvpv.exe85⤵
-
\??\c:\vvjdv.exec:\vvjdv.exe86⤵
-
\??\c:\rflfxrf.exec:\rflfxrf.exe87⤵
-
\??\c:\bbnhbn.exec:\bbnhbn.exe88⤵
-
\??\c:\vjvpp.exec:\vjvpp.exe89⤵
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe90⤵
-
\??\c:\lxffxxr.exec:\lxffxxr.exe91⤵
-
\??\c:\rlrrllf.exec:\rlrrllf.exe92⤵
-
\??\c:\ntnbtt.exec:\ntnbtt.exe93⤵
-
\??\c:\ttnnhn.exec:\ttnnhn.exe94⤵
-
\??\c:\pdpjj.exec:\pdpjj.exe95⤵
-
\??\c:\rlxrfrl.exec:\rlxrfrl.exe96⤵
-
\??\c:\thbhbb.exec:\thbhbb.exe97⤵
-
\??\c:\pdddd.exec:\pdddd.exe98⤵
-
\??\c:\lrlrrrr.exec:\lrlrrrr.exe99⤵
-
\??\c:\bthtbh.exec:\bthtbh.exe100⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe101⤵
-
\??\c:\rlxfxxl.exec:\rlxfxxl.exe102⤵
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe103⤵
-
\??\c:\thnnhh.exec:\thnnhh.exe104⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe105⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe106⤵
-
\??\c:\frrrffl.exec:\frrrffl.exe107⤵
-
\??\c:\btbbtb.exec:\btbbtb.exe108⤵
-
\??\c:\ppdvj.exec:\ppdvj.exe109⤵
-
\??\c:\dddvv.exec:\dddvv.exe110⤵
-
\??\c:\xlxxffl.exec:\xlxxffl.exe111⤵
-
\??\c:\nthbbb.exec:\nthbbb.exe112⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe113⤵
-
\??\c:\ppppj.exec:\ppppj.exe114⤵
-
\??\c:\lfrxxff.exec:\lfrxxff.exe115⤵
-
\??\c:\tttnnn.exec:\tttnnn.exe116⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe117⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe118⤵
-
\??\c:\lllfxrr.exec:\lllfxrr.exe119⤵
-
\??\c:\nnhhtt.exec:\nnhhtt.exe120⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe121⤵
-
\??\c:\jjvpj.exec:\jjvpj.exe122⤵
-
\??\c:\fxflxlf.exec:\fxflxlf.exe123⤵
-
\??\c:\hbhbhb.exec:\hbhbhb.exe124⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe125⤵
-
\??\c:\djjjj.exec:\djjjj.exe126⤵
-
\??\c:\rlxfrff.exec:\rlxfrff.exe127⤵
-
\??\c:\bhnntb.exec:\bhnntb.exe128⤵
-
\??\c:\btthht.exec:\btthht.exe129⤵
-
\??\c:\pdjpv.exec:\pdjpv.exe130⤵
-
\??\c:\rfrlrxx.exec:\rfrlrxx.exe131⤵
-
\??\c:\nttnhh.exec:\nttnhh.exe132⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe133⤵
-
\??\c:\5jjvv.exec:\5jjvv.exe134⤵
-
\??\c:\fxllllr.exec:\fxllllr.exe135⤵
-
\??\c:\btttnn.exec:\btttnn.exe136⤵
-
\??\c:\hbnnnn.exec:\hbnnnn.exe137⤵
-
\??\c:\vvppj.exec:\vvppj.exe138⤵
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe139⤵
-
\??\c:\fxxrlll.exec:\fxxrlll.exe140⤵
-
\??\c:\btbhbh.exec:\btbhbh.exe141⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe142⤵
-
\??\c:\hhbtnt.exec:\hhbtnt.exe143⤵
-
\??\c:\vjjjj.exec:\vjjjj.exe144⤵
-
\??\c:\ddpjj.exec:\ddpjj.exe145⤵
-
\??\c:\5rfxxrl.exec:\5rfxxrl.exe146⤵
-
\??\c:\bhhhtb.exec:\bhhhtb.exe147⤵
-
\??\c:\pvddj.exec:\pvddj.exe148⤵
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe149⤵
-
\??\c:\fxllrlr.exec:\fxllrlr.exe150⤵
-
\??\c:\nbntbb.exec:\nbntbb.exe151⤵
-
\??\c:\pdjjp.exec:\pdjjp.exe152⤵
-
\??\c:\rfxrrxl.exec:\rfxrrxl.exe153⤵
-
\??\c:\3ntnnn.exec:\3ntnnn.exe154⤵
-
\??\c:\dddvv.exec:\dddvv.exe155⤵
-
\??\c:\jdddv.exec:\jdddv.exe156⤵
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe157⤵
-
\??\c:\3nbttt.exec:\3nbttt.exe158⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe159⤵
-
\??\c:\flxlxff.exec:\flxlxff.exe160⤵
-
\??\c:\hhtntn.exec:\hhtntn.exe161⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe162⤵
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe163⤵
-
\??\c:\bhhnht.exec:\bhhnht.exe164⤵
-
\??\c:\vddjj.exec:\vddjj.exe165⤵
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe166⤵
-
\??\c:\hbbtnb.exec:\hbbtnb.exe167⤵
-
\??\c:\9djdd.exec:\9djdd.exe168⤵
-
\??\c:\rrllrrl.exec:\rrllrrl.exe169⤵
-
\??\c:\hbbbtt.exec:\hbbbtt.exe170⤵
-
\??\c:\vvpdv.exec:\vvpdv.exe171⤵
-
\??\c:\flffrxl.exec:\flffrxl.exe172⤵
-
\??\c:\nbhbtb.exec:\nbhbtb.exe173⤵
-
\??\c:\5djjd.exec:\5djjd.exe174⤵
-
\??\c:\rfllrrl.exec:\rfllrrl.exe175⤵
-
\??\c:\hbntnn.exec:\hbntnn.exe176⤵
-
\??\c:\dvjdd.exec:\dvjdd.exe177⤵
-
\??\c:\lxllfll.exec:\lxllfll.exe178⤵
-
\??\c:\xfxxfrl.exec:\xfxxfrl.exe179⤵
-
\??\c:\hhbbtb.exec:\hhbbtb.exe180⤵
-
\??\c:\xlfxffl.exec:\xlfxffl.exe181⤵
-
\??\c:\3ntnhb.exec:\3ntnhb.exe182⤵
-
\??\c:\jjvpp.exec:\jjvpp.exe183⤵
-
\??\c:\flrrlll.exec:\flrrlll.exe184⤵
-
\??\c:\bthbbb.exec:\bthbbb.exe185⤵
-
\??\c:\tntbth.exec:\tntbth.exe186⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe187⤵
-
\??\c:\5xfxxrx.exec:\5xfxxrx.exe188⤵
-
\??\c:\nbhhbb.exec:\nbhhbb.exe189⤵
-
\??\c:\9pvpj.exec:\9pvpj.exe190⤵
-
\??\c:\dpvpp.exec:\dpvpp.exe191⤵
-
\??\c:\frllfff.exec:\frllfff.exe192⤵
-
\??\c:\hhnttt.exec:\hhnttt.exe193⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe194⤵
-
\??\c:\dvjdp.exec:\dvjdp.exe195⤵
-
\??\c:\xrrlfff.exec:\xrrlfff.exe196⤵
-
\??\c:\9nbtbt.exec:\9nbtbt.exe197⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe198⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe199⤵
-
\??\c:\xrrxxfx.exec:\xrrxxfx.exe200⤵
-
\??\c:\hhhhtt.exec:\hhhhtt.exe201⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe202⤵
-
\??\c:\xrxrllf.exec:\xrxrllf.exe203⤵
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe204⤵
-
\??\c:\nnnhbn.exec:\nnnhbn.exe205⤵
-
\??\c:\jvvvd.exec:\jvvvd.exe206⤵
-
\??\c:\1flfrrl.exec:\1flfrrl.exe207⤵
-
\??\c:\nhtntn.exec:\nhtntn.exe208⤵
-
\??\c:\djpjj.exec:\djpjj.exe209⤵
-
\??\c:\xrrrlll.exec:\xrrrlll.exe210⤵
-
\??\c:\rfllfll.exec:\rfllfll.exe211⤵
-
\??\c:\tbbbbb.exec:\tbbbbb.exe212⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe213⤵
-
\??\c:\nttntn.exec:\nttntn.exe214⤵
-
\??\c:\vdjdd.exec:\vdjdd.exe215⤵
-
\??\c:\djjpp.exec:\djjpp.exe216⤵
-
\??\c:\flrxrrf.exec:\flrxrrf.exe217⤵
-
\??\c:\nhbttt.exec:\nhbttt.exe218⤵
-
\??\c:\ddvvv.exec:\ddvvv.exe219⤵
-
\??\c:\7lfxrrr.exec:\7lfxrrr.exe220⤵
-
\??\c:\7nhhhh.exec:\7nhhhh.exe221⤵
-
\??\c:\jvvvp.exec:\jvvvp.exe222⤵
-
\??\c:\pjppd.exec:\pjppd.exe223⤵
-
\??\c:\xrrlffx.exec:\xrrlffx.exe224⤵
-
\??\c:\hhbthh.exec:\hhbthh.exe225⤵
-
\??\c:\djvvv.exec:\djvvv.exe226⤵
-
\??\c:\xffrrrl.exec:\xffrrrl.exe227⤵
-
\??\c:\tbhbbb.exec:\tbhbbb.exe228⤵
-
\??\c:\lfxxfxf.exec:\lfxxfxf.exe229⤵
-
\??\c:\5hnhhh.exec:\5hnhhh.exe230⤵
-
\??\c:\vpjjv.exec:\vpjjv.exe231⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe232⤵
-
\??\c:\vjjvv.exec:\vjjvv.exe233⤵
-
\??\c:\rflxxfx.exec:\rflxxfx.exe234⤵
-
\??\c:\hthbtt.exec:\hthbtt.exe235⤵
-
\??\c:\5vddd.exec:\5vddd.exe236⤵
-
\??\c:\9frrxfr.exec:\9frrxfr.exe237⤵
-
\??\c:\nntnnn.exec:\nntnnn.exe238⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe239⤵
-
\??\c:\frxxflr.exec:\frxxflr.exe240⤵
-
\??\c:\xlrrxxx.exec:\xlrrxxx.exe241⤵