Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 15:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4dfbfe769a796c5f5959b06cb43ccc8d2dc721e8ea7afffc7b79c23b1188bb56N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
4dfbfe769a796c5f5959b06cb43ccc8d2dc721e8ea7afffc7b79c23b1188bb56N.exe
-
Size
230KB
-
MD5
e2840e57e191c900d87dbd0bf2c74fe0
-
SHA1
c2be22b68bb4191392583a4d5f6a7c2e00df96b4
-
SHA256
4dfbfe769a796c5f5959b06cb43ccc8d2dc721e8ea7afffc7b79c23b1188bb56
-
SHA512
b32e44ed44632ac96fc8fabccf9fd168c419ff2a51213450b9b2af4605aa95653b9f09ccf23f9c185cb7fbc4bfd40e557d4819697f79fc570491fdceb83be398
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1fp:n3C9BRo7MlrWKo+lxKk1fp
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2804-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2804 ddpdv.exe 4748 djjdv.exe 228 xxxrffl.exe 940 lfxxffl.exe 8 lxlrfxl.exe 1592 9bbbtt.exe 1896 7xrrlll.exe 2820 3bnhbh.exe 4704 5pppj.exe 5032 frlrrxr.exe 4472 9htttt.exe 3932 ppjjj.exe 2708 rrlfxlf.exe 4356 bbhhbn.exe 808 1ppjj.exe 4632 bttnnn.exe 3220 vjdvp.exe 624 7lfxxxx.exe 4912 5bhbtt.exe 2184 flrrlff.exe 2448 tnnnhh.exe 1548 dvdvd.exe 5072 lrlllrl.exe 3744 bhbbbb.exe 3092 3djdd.exe 2072 9fxlrrf.exe 3588 xrxlxfr.exe 4992 1ntnbt.exe 3196 dvjjd.exe 2236 rrxfllr.exe 1576 bnbtnn.exe 1952 jvddp.exe 1588 5lffxll.exe 4184 hhnnnn.exe 4492 frlxlfx.exe 2872 xlrrrrf.exe 1452 bhbbbb.exe 3808 jjjjp.exe 4436 xffxrrl.exe 1056 flrlffx.exe 4536 thnnnn.exe 4720 5ppvj.exe 4748 ddvvv.exe 2008 1rlfffx.exe 2352 9tbttn.exe 3352 5ddvj.exe 4312 3pdvd.exe 2428 xrrfrrl.exe 2568 rlxfffx.exe 4364 9nbthb.exe 2324 1pjdp.exe 1912 jvdpd.exe 3132 flrfffr.exe 2792 ttbbtt.exe 3972 hnttnh.exe 2828 pjdvj.exe 1564 xxrlfll.exe 2916 lllfffx.exe 5112 btbnbt.exe 1936 7hbtnn.exe 1728 vvvpd.exe 2660 rlxrffx.exe 3512 lffxrrl.exe 3620 ttbttn.exe -
resource yara_rule behavioral2/memory/412-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 2804 412 4dfbfe769a796c5f5959b06cb43ccc8d2dc721e8ea7afffc7b79c23b1188bb56N.exe 82 PID 412 wrote to memory of 2804 412 4dfbfe769a796c5f5959b06cb43ccc8d2dc721e8ea7afffc7b79c23b1188bb56N.exe 82 PID 412 wrote to memory of 2804 412 4dfbfe769a796c5f5959b06cb43ccc8d2dc721e8ea7afffc7b79c23b1188bb56N.exe 82 PID 2804 wrote to memory of 4748 2804 ddpdv.exe 83 PID 2804 wrote to memory of 4748 2804 ddpdv.exe 83 PID 2804 wrote to memory of 4748 2804 ddpdv.exe 83 PID 4748 wrote to memory of 228 4748 djjdv.exe 84 PID 4748 wrote to memory of 228 4748 djjdv.exe 84 PID 4748 wrote to memory of 228 4748 djjdv.exe 84 PID 228 wrote to memory of 940 228 xxxrffl.exe 85 PID 228 wrote to memory of 940 228 xxxrffl.exe 85 PID 228 wrote to memory of 940 228 xxxrffl.exe 85 PID 940 wrote to memory of 8 940 lfxxffl.exe 86 PID 940 wrote to memory of 8 940 lfxxffl.exe 86 PID 940 wrote to memory of 8 940 lfxxffl.exe 86 PID 8 wrote to memory of 1592 8 lxlrfxl.exe 87 PID 8 wrote to memory of 1592 8 lxlrfxl.exe 87 PID 8 wrote to memory of 1592 8 lxlrfxl.exe 87 PID 1592 wrote to memory of 1896 1592 9bbbtt.exe 88 PID 1592 wrote to memory of 1896 1592 9bbbtt.exe 88 PID 1592 wrote to memory of 1896 1592 9bbbtt.exe 88 PID 1896 wrote to memory of 2820 1896 7xrrlll.exe 89 PID 1896 wrote to memory of 2820 1896 7xrrlll.exe 89 PID 1896 wrote to memory of 2820 1896 7xrrlll.exe 89 PID 2820 wrote to memory of 4704 2820 3bnhbh.exe 90 PID 2820 wrote to memory of 4704 2820 3bnhbh.exe 90 PID 2820 wrote to memory of 4704 2820 3bnhbh.exe 90 PID 4704 wrote to memory of 5032 4704 5pppj.exe 91 PID 4704 wrote to memory of 5032 4704 5pppj.exe 91 PID 4704 wrote to memory of 5032 4704 5pppj.exe 91 PID 5032 wrote to memory of 4472 5032 frlrrxr.exe 92 PID 5032 wrote to memory of 4472 5032 frlrrxr.exe 92 PID 5032 wrote to memory of 4472 5032 frlrrxr.exe 92 PID 4472 wrote to memory of 3932 4472 9htttt.exe 93 PID 4472 wrote to memory of 3932 4472 9htttt.exe 93 PID 4472 wrote to memory of 3932 4472 9htttt.exe 93 PID 3932 wrote to memory of 2708 3932 ppjjj.exe 94 PID 3932 wrote to memory of 2708 3932 ppjjj.exe 94 PID 3932 wrote to memory of 2708 3932 ppjjj.exe 94 PID 2708 wrote to memory of 4356 2708 rrlfxlf.exe 95 PID 2708 wrote to memory of 4356 2708 rrlfxlf.exe 95 PID 2708 wrote to memory of 4356 2708 rrlfxlf.exe 95 PID 4356 wrote to memory of 808 4356 bbhhbn.exe 96 PID 4356 wrote to memory of 808 4356 bbhhbn.exe 96 PID 4356 wrote to memory of 808 4356 bbhhbn.exe 96 PID 808 wrote to memory of 4632 808 1ppjj.exe 97 PID 808 wrote to memory of 4632 808 1ppjj.exe 97 PID 808 wrote to memory of 4632 808 1ppjj.exe 97 PID 4632 wrote to memory of 3220 4632 bttnnn.exe 98 PID 4632 wrote to memory of 3220 4632 bttnnn.exe 98 PID 4632 wrote to memory of 3220 4632 bttnnn.exe 98 PID 3220 wrote to memory of 624 3220 vjdvp.exe 99 PID 3220 wrote to memory of 624 3220 vjdvp.exe 99 PID 3220 wrote to memory of 624 3220 vjdvp.exe 99 PID 624 wrote to memory of 4912 624 7lfxxxx.exe 100 PID 624 wrote to memory of 4912 624 7lfxxxx.exe 100 PID 624 wrote to memory of 4912 624 7lfxxxx.exe 100 PID 4912 wrote to memory of 2184 4912 5bhbtt.exe 101 PID 4912 wrote to memory of 2184 4912 5bhbtt.exe 101 PID 4912 wrote to memory of 2184 4912 5bhbtt.exe 101 PID 2184 wrote to memory of 2448 2184 flrrlff.exe 102 PID 2184 wrote to memory of 2448 2184 flrrlff.exe 102 PID 2184 wrote to memory of 2448 2184 flrrlff.exe 102 PID 2448 wrote to memory of 1548 2448 tnnnhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\4dfbfe769a796c5f5959b06cb43ccc8d2dc721e8ea7afffc7b79c23b1188bb56N.exe"C:\Users\Admin\AppData\Local\Temp\4dfbfe769a796c5f5959b06cb43ccc8d2dc721e8ea7afffc7b79c23b1188bb56N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\ddpdv.exec:\ddpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\djjdv.exec:\djjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\xxxrffl.exec:\xxxrffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\lfxxffl.exec:\lfxxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\lxlrfxl.exec:\lxlrfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\9bbbtt.exec:\9bbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\7xrrlll.exec:\7xrrlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\3bnhbh.exec:\3bnhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\5pppj.exec:\5pppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\frlrrxr.exec:\frlrrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\9htttt.exec:\9htttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\ppjjj.exec:\ppjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\rrlfxlf.exec:\rrlfxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\bbhhbn.exec:\bbhhbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\1ppjj.exec:\1ppjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\bttnnn.exec:\bttnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\vjdvp.exec:\vjdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\7lfxxxx.exec:\7lfxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\5bhbtt.exec:\5bhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\flrrlff.exec:\flrrlff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\tnnnhh.exec:\tnnnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\dvdvd.exec:\dvdvd.exe23⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lrlllrl.exec:\lrlllrl.exe24⤵
- Executes dropped EXE
PID:5072 -
\??\c:\bhbbbb.exec:\bhbbbb.exe25⤵
- Executes dropped EXE
PID:3744 -
\??\c:\3djdd.exec:\3djdd.exe26⤵
- Executes dropped EXE
PID:3092 -
\??\c:\9fxlrrf.exec:\9fxlrrf.exe27⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xrxlxfr.exec:\xrxlxfr.exe28⤵
- Executes dropped EXE
PID:3588 -
\??\c:\1ntnbt.exec:\1ntnbt.exe29⤵
- Executes dropped EXE
PID:4992 -
\??\c:\dvjjd.exec:\dvjjd.exe30⤵
- Executes dropped EXE
PID:3196 -
\??\c:\rrxfllr.exec:\rrxfllr.exe31⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bnbtnn.exec:\bnbtnn.exe32⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jvddp.exec:\jvddp.exe33⤵
- Executes dropped EXE
PID:1952 -
\??\c:\5lffxll.exec:\5lffxll.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\hhnnnn.exec:\hhnnnn.exe35⤵
- Executes dropped EXE
PID:4184 -
\??\c:\frlxlfx.exec:\frlxlfx.exe36⤵
- Executes dropped EXE
PID:4492 -
\??\c:\xlrrrrf.exec:\xlrrrrf.exe37⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bhbbbb.exec:\bhbbbb.exe38⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jjjjp.exec:\jjjjp.exe39⤵
- Executes dropped EXE
PID:3808 -
\??\c:\xffxrrl.exec:\xffxrrl.exe40⤵
- Executes dropped EXE
PID:4436 -
\??\c:\flrlffx.exec:\flrlffx.exe41⤵
- Executes dropped EXE
PID:1056 -
\??\c:\thnnnn.exec:\thnnnn.exe42⤵
- Executes dropped EXE
PID:4536 -
\??\c:\5ppvj.exec:\5ppvj.exe43⤵
- Executes dropped EXE
PID:4720 -
\??\c:\ddvvv.exec:\ddvvv.exe44⤵
- Executes dropped EXE
PID:4748 -
\??\c:\1rlfffx.exec:\1rlfffx.exe45⤵
- Executes dropped EXE
PID:2008 -
\??\c:\9tbttn.exec:\9tbttn.exe46⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5ddvj.exec:\5ddvj.exe47⤵
- Executes dropped EXE
PID:3352 -
\??\c:\3pdvd.exec:\3pdvd.exe48⤵
- Executes dropped EXE
PID:4312 -
\??\c:\xrrfrrl.exec:\xrrfrrl.exe49⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rlxfffx.exec:\rlxfffx.exe50⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9nbthb.exec:\9nbthb.exe51⤵
- Executes dropped EXE
PID:4364 -
\??\c:\1pjdp.exec:\1pjdp.exe52⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jvdpd.exec:\jvdpd.exe53⤵
- Executes dropped EXE
PID:1912 -
\??\c:\flrfffr.exec:\flrfffr.exe54⤵
- Executes dropped EXE
PID:3132 -
\??\c:\ttbbtt.exec:\ttbbtt.exe55⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hnttnh.exec:\hnttnh.exe56⤵
- Executes dropped EXE
PID:3972 -
\??\c:\pjdvj.exec:\pjdvj.exe57⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xxrlfll.exec:\xxrlfll.exe58⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lllfffx.exec:\lllfffx.exe59⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btbnbt.exec:\btbnbt.exe60⤵
- Executes dropped EXE
PID:5112 -
\??\c:\7hbtnn.exec:\7hbtnn.exe61⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vvvpd.exec:\vvvpd.exe62⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rlxrffx.exec:\rlxrffx.exe63⤵
- Executes dropped EXE
PID:2660 -
\??\c:\lffxrrl.exec:\lffxrrl.exe64⤵
- Executes dropped EXE
PID:3512 -
\??\c:\ttbttn.exec:\ttbttn.exe65⤵
- Executes dropped EXE
PID:3620 -
\??\c:\nbtnhn.exec:\nbtnhn.exe66⤵PID:2952
-
\??\c:\pddpj.exec:\pddpj.exe67⤵PID:808
-
\??\c:\xffxrrl.exec:\xffxrrl.exe68⤵PID:4920
-
\??\c:\hnnhnb.exec:\hnnhnb.exe69⤵PID:4632
-
\??\c:\dvjvj.exec:\dvjvj.exe70⤵PID:2780
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe71⤵PID:744
-
\??\c:\frxxfxx.exec:\frxxfxx.exe72⤵PID:1788
-
\??\c:\hhnhhb.exec:\hhnhhb.exe73⤵PID:392
-
\??\c:\jjdvj.exec:\jjdvj.exe74⤵PID:4292
-
\??\c:\vvvjv.exec:\vvvjv.exe75⤵PID:916
-
\??\c:\7xfxxxr.exec:\7xfxxxr.exe76⤵
- System Location Discovery: System Language Discovery
PID:1456 -
\??\c:\ttbtnh.exec:\ttbtnh.exe77⤵PID:2024
-
\??\c:\3nhtnh.exec:\3nhtnh.exe78⤵PID:2212
-
\??\c:\1dpdp.exec:\1dpdp.exe79⤵PID:4596
-
\??\c:\lfxrllr.exec:\lfxrllr.exe80⤵PID:3728
-
\??\c:\3lxrlfr.exec:\3lxrlfr.exe81⤵PID:2816
-
\??\c:\nnnhhh.exec:\nnnhhh.exe82⤵PID:4380
-
\??\c:\vdjdp.exec:\vdjdp.exe83⤵PID:1324
-
\??\c:\pjppp.exec:\pjppp.exe84⤵PID:1052
-
\??\c:\1llrlll.exec:\1llrlll.exe85⤵PID:768
-
\??\c:\flffxxx.exec:\flffxxx.exe86⤵PID:3232
-
\??\c:\bbhhnn.exec:\bbhhnn.exe87⤵PID:5068
-
\??\c:\vvdvd.exec:\vvdvd.exe88⤵PID:3444
-
\??\c:\7vddv.exec:\7vddv.exe89⤵PID:1584
-
\??\c:\frxrlll.exec:\frxrlll.exe90⤵PID:5064
-
\??\c:\nnbhbn.exec:\nnbhbn.exe91⤵PID:568
-
\??\c:\tnnhtt.exec:\tnnhtt.exe92⤵PID:5020
-
\??\c:\vjvjj.exec:\vjvjj.exe93⤵PID:1932
-
\??\c:\xlxrfxl.exec:\xlxrfxl.exe94⤵PID:4988
-
\??\c:\5lrxllx.exec:\5lrxllx.exe95⤵PID:2732
-
\??\c:\hnnhbn.exec:\hnnhbn.exe96⤵PID:4344
-
\??\c:\rxrlrrl.exec:\rxrlrrl.exe97⤵PID:3808
-
\??\c:\1nnbtn.exec:\1nnbtn.exe98⤵PID:4436
-
\??\c:\3hnhbb.exec:\3hnhbb.exe99⤵PID:1056
-
\??\c:\djvjd.exec:\djvjd.exe100⤵PID:4536
-
\??\c:\3xfxrxr.exec:\3xfxrxr.exe101⤵PID:516
-
\??\c:\thbbnn.exec:\thbbnn.exe102⤵PID:1092
-
\??\c:\btbtth.exec:\btbtth.exe103⤵PID:216
-
\??\c:\1jdpj.exec:\1jdpj.exe104⤵PID:4776
-
\??\c:\3xxrlxx.exec:\3xxrlxx.exe105⤵PID:616
-
\??\c:\9hnhbn.exec:\9hnhbn.exe106⤵PID:2764
-
\??\c:\3jppd.exec:\3jppd.exe107⤵PID:4260
-
\??\c:\jpjjv.exec:\jpjjv.exe108⤵PID:4220
-
\??\c:\rrllxxr.exec:\rrllxxr.exe109⤵
- System Location Discovery: System Language Discovery
PID:3864 -
\??\c:\7hnhhh.exec:\7hnhhh.exe110⤵PID:4296
-
\??\c:\nnbhbt.exec:\nnbhbt.exe111⤵PID:2300
-
\??\c:\ppvjv.exec:\ppvjv.exe112⤵PID:4564
-
\??\c:\jvddv.exec:\jvddv.exe113⤵PID:4900
-
\??\c:\xxxxxfx.exec:\xxxxxfx.exe114⤵PID:964
-
\??\c:\tbhhtt.exec:\tbhhtt.exe115⤵PID:4704
-
\??\c:\hnnhth.exec:\hnnhth.exe116⤵PID:4040
-
\??\c:\7jdvv.exec:\7jdvv.exe117⤵PID:4984
-
\??\c:\vpdvj.exec:\vpdvj.exe118⤵PID:4472
-
\??\c:\lrrlrlf.exec:\lrrlrlf.exe119⤵PID:4772
-
\??\c:\ntnnhh.exec:\ntnnhh.exe120⤵PID:1936
-
\??\c:\bnnnhh.exec:\bnnnhh.exe121⤵PID:1652
-
\??\c:\ddjjd.exec:\ddjjd.exe122⤵PID:3528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-