Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 03:07
Static task
static1
Behavioral task
behavioral1
Sample
c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe
Resource
win7-20240903-en
General
-
Target
c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe
-
Size
96KB
-
MD5
78df64c258f26ecec4361c803b9934a8
-
SHA1
de84e215db2887f2c0b15110f814df1a67bda402
-
SHA256
c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346
-
SHA512
a7fdebceb0f20f9d01d66cb04be1b6f64b4c0843fb73dc8f26fe798fac1bf629e331173b1682d7e4dcdde7a0c76fb6938e3114428ed263625e560e9d62f86b69
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlZMzcLI:ymb3NkkiQ3mdBjFoLucjD7cM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/1680-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
48888.exee80040.exem0226.exejvdvp.exehthtnn.exe8204888.exe0844824.exe64044.exe828822.exe604264.exelxxlllx.exew06066.exettntht.exethnhbb.exe028262.exec660444.exeu464460.exebnhhhh.exe3btthh.exebntnnn.exetnnbbb.exe24260.exebhtnhb.exe0282000.exe46848.exe1djdv.exe086804.exe3flfrrl.exexrxllxx.exe882082.exe0266000.exec460000.exettbbbb.exeflffxrf.exefflxrlf.exettbtnh.exe42440.exelllrlll.exe3xrlffx.exew66822.exek40426.exe4282226.exe6406662.exe40066.exeppddd.exenttnbb.exettttbt.exee46088.exe20882.exe2406448.exe24004.exec060484.exeu242660.exehnbtnn.exe42882.exellrxrlf.exehbbtnn.exe2066828.exee46600.exe04004.exe044868.exe84660.exedjvvj.exexlrfrrr.exepid Process 2896 48888.exe 2924 e80040.exe 1740 m0226.exe 960 jvdvp.exe 3036 hthtnn.exe 1644 8204888.exe 2348 0844824.exe 4832 64044.exe 4464 828822.exe 4532 604264.exe 4504 lxxlllx.exe 2368 w06066.exe 4168 ttntht.exe 1064 thnhbb.exe 3000 028262.exe 2648 c660444.exe 1528 u464460.exe 1832 bnhhhh.exe 4996 3btthh.exe 4948 bntnnn.exe 3240 tnnbbb.exe 4040 24260.exe 3536 bhtnhb.exe 2396 0282000.exe 3188 46848.exe 3248 1djdv.exe 3772 086804.exe 2504 3flfrrl.exe 3448 xrxllxx.exe 1164 882082.exe 3520 0266000.exe 5052 c460000.exe 4964 ttbbbb.exe 2892 flffxrf.exe 4660 fflxrlf.exe 4692 ttbtnh.exe 736 42440.exe 4404 lllrlll.exe 4364 3xrlffx.exe 4644 w66822.exe 748 k40426.exe 3616 4282226.exe 3736 6406662.exe 3656 40066.exe 3352 ppddd.exe 940 nttnbb.exe 4304 ttttbt.exe 1176 e46088.exe 3560 20882.exe 368 2406448.exe 4360 24004.exe 2124 c060484.exe 2492 u242660.exe 4668 hnbtnn.exe 1904 42882.exe 1792 llrxrlf.exe 4324 hbbtnn.exe 1652 2066828.exe 3628 e46600.exe 2940 04004.exe 1064 044868.exe 1068 84660.exe 3484 djvvj.exe 2384 xlrfrrr.exe -
Processes:
resource yara_rule behavioral2/memory/1680-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
q28602.exe424882.exebnnbbt.exee46600.exe846000.exe6280808.exelxffxxx.exerlfxlfx.exe3hnnhn.exe5ffxlfx.exe40886.exe822608.exe484488.exerllxxff.exepvppj.exebbbbnn.exe7ddpd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q28602.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e46600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 846000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6280808.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40886.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 822608.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 484488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe48888.exee80040.exem0226.exejvdvp.exehthtnn.exe8204888.exe0844824.exe64044.exe828822.exe604264.exelxxlllx.exew06066.exettntht.exethnhbb.exe028262.exec660444.exeu464460.exebnhhhh.exe3btthh.exebntnnn.exetnnbbb.exedescription pid Process procid_target PID 1680 wrote to memory of 2896 1680 c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe 83 PID 1680 wrote to memory of 2896 1680 c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe 83 PID 1680 wrote to memory of 2896 1680 c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe 83 PID 2896 wrote to memory of 2924 2896 48888.exe 84 PID 2896 wrote to memory of 2924 2896 48888.exe 84 PID 2896 wrote to memory of 2924 2896 48888.exe 84 PID 2924 wrote to memory of 1740 2924 e80040.exe 85 PID 2924 wrote to memory of 1740 2924 e80040.exe 85 PID 2924 wrote to memory of 1740 2924 e80040.exe 85 PID 1740 wrote to memory of 960 1740 m0226.exe 86 PID 1740 wrote to memory of 960 1740 m0226.exe 86 PID 1740 wrote to memory of 960 1740 m0226.exe 86 PID 960 wrote to memory of 3036 960 jvdvp.exe 87 PID 960 wrote to memory of 3036 960 jvdvp.exe 87 PID 960 wrote to memory of 3036 960 jvdvp.exe 87 PID 3036 wrote to memory of 1644 3036 hthtnn.exe 88 PID 3036 wrote to memory of 1644 3036 hthtnn.exe 88 PID 3036 wrote to memory of 1644 3036 hthtnn.exe 88 PID 1644 wrote to memory of 2348 1644 8204888.exe 89 PID 1644 wrote to memory of 2348 1644 8204888.exe 89 PID 1644 wrote to memory of 2348 1644 8204888.exe 89 PID 2348 wrote to memory of 4832 2348 0844824.exe 90 PID 2348 wrote to memory of 4832 2348 0844824.exe 90 PID 2348 wrote to memory of 4832 2348 0844824.exe 90 PID 4832 wrote to memory of 4464 4832 64044.exe 91 PID 4832 wrote to memory of 4464 4832 64044.exe 91 PID 4832 wrote to memory of 4464 4832 64044.exe 91 PID 4464 wrote to memory of 4532 4464 828822.exe 92 PID 4464 wrote to memory of 4532 4464 828822.exe 92 PID 4464 wrote to memory of 4532 4464 828822.exe 92 PID 4532 wrote to memory of 4504 4532 604264.exe 93 PID 4532 wrote to memory of 4504 4532 604264.exe 93 PID 4532 wrote to memory of 4504 4532 604264.exe 93 PID 4504 wrote to memory of 2368 4504 lxxlllx.exe 94 PID 4504 wrote to memory of 2368 4504 lxxlllx.exe 94 PID 4504 wrote to memory of 2368 4504 lxxlllx.exe 94 PID 2368 wrote to memory of 4168 2368 w06066.exe 95 PID 2368 wrote to memory of 4168 2368 w06066.exe 95 PID 2368 wrote to memory of 4168 2368 w06066.exe 95 PID 4168 wrote to memory of 1064 4168 ttntht.exe 96 PID 4168 wrote to memory of 1064 4168 ttntht.exe 96 PID 4168 wrote to memory of 1064 4168 ttntht.exe 96 PID 1064 wrote to memory of 3000 1064 thnhbb.exe 97 PID 1064 wrote to memory of 3000 1064 thnhbb.exe 97 PID 1064 wrote to memory of 3000 1064 thnhbb.exe 97 PID 3000 wrote to memory of 2648 3000 028262.exe 98 PID 3000 wrote to memory of 2648 3000 028262.exe 98 PID 3000 wrote to memory of 2648 3000 028262.exe 98 PID 2648 wrote to memory of 1528 2648 c660444.exe 99 PID 2648 wrote to memory of 1528 2648 c660444.exe 99 PID 2648 wrote to memory of 1528 2648 c660444.exe 99 PID 1528 wrote to memory of 1832 1528 u464460.exe 100 PID 1528 wrote to memory of 1832 1528 u464460.exe 100 PID 1528 wrote to memory of 1832 1528 u464460.exe 100 PID 1832 wrote to memory of 4996 1832 bnhhhh.exe 101 PID 1832 wrote to memory of 4996 1832 bnhhhh.exe 101 PID 1832 wrote to memory of 4996 1832 bnhhhh.exe 101 PID 4996 wrote to memory of 4948 4996 3btthh.exe 102 PID 4996 wrote to memory of 4948 4996 3btthh.exe 102 PID 4996 wrote to memory of 4948 4996 3btthh.exe 102 PID 4948 wrote to memory of 3240 4948 bntnnn.exe 103 PID 4948 wrote to memory of 3240 4948 bntnnn.exe 103 PID 4948 wrote to memory of 3240 4948 bntnnn.exe 103 PID 3240 wrote to memory of 4040 3240 tnnbbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe"C:\Users\Admin\AppData\Local\Temp\c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\48888.exec:\48888.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\e80040.exec:\e80040.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\m0226.exec:\m0226.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\jvdvp.exec:\jvdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\hthtnn.exec:\hthtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\8204888.exec:\8204888.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\0844824.exec:\0844824.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\64044.exec:\64044.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\828822.exec:\828822.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\604264.exec:\604264.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\lxxlllx.exec:\lxxlllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\w06066.exec:\w06066.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\ttntht.exec:\ttntht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\thnhbb.exec:\thnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\028262.exec:\028262.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\c660444.exec:\c660444.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\u464460.exec:\u464460.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\bnhhhh.exec:\bnhhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\3btthh.exec:\3btthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\bntnnn.exec:\bntnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\tnnbbb.exec:\tnnbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\24260.exec:\24260.exe23⤵
- Executes dropped EXE
PID:4040 -
\??\c:\bhtnhb.exec:\bhtnhb.exe24⤵
- Executes dropped EXE
PID:3536 -
\??\c:\0282000.exec:\0282000.exe25⤵
- Executes dropped EXE
PID:2396 -
\??\c:\46848.exec:\46848.exe26⤵
- Executes dropped EXE
PID:3188 -
\??\c:\1djdv.exec:\1djdv.exe27⤵
- Executes dropped EXE
PID:3248 -
\??\c:\086804.exec:\086804.exe28⤵
- Executes dropped EXE
PID:3772 -
\??\c:\3flfrrl.exec:\3flfrrl.exe29⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xrxllxx.exec:\xrxllxx.exe30⤵
- Executes dropped EXE
PID:3448 -
\??\c:\882082.exec:\882082.exe31⤵
- Executes dropped EXE
PID:1164 -
\??\c:\0266000.exec:\0266000.exe32⤵
- Executes dropped EXE
PID:3520 -
\??\c:\c460000.exec:\c460000.exe33⤵
- Executes dropped EXE
PID:5052 -
\??\c:\ttbbbb.exec:\ttbbbb.exe34⤵
- Executes dropped EXE
PID:4964 -
\??\c:\flffxrf.exec:\flffxrf.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fflxrlf.exec:\fflxrlf.exe36⤵
- Executes dropped EXE
PID:4660 -
\??\c:\ttbtnh.exec:\ttbtnh.exe37⤵
- Executes dropped EXE
PID:4692 -
\??\c:\42440.exec:\42440.exe38⤵
- Executes dropped EXE
PID:736 -
\??\c:\lllrlll.exec:\lllrlll.exe39⤵
- Executes dropped EXE
PID:4404 -
\??\c:\3xrlffx.exec:\3xrlffx.exe40⤵
- Executes dropped EXE
PID:4364 -
\??\c:\w66822.exec:\w66822.exe41⤵
- Executes dropped EXE
PID:4644 -
\??\c:\k40426.exec:\k40426.exe42⤵
- Executes dropped EXE
PID:748 -
\??\c:\4282226.exec:\4282226.exe43⤵
- Executes dropped EXE
PID:3616 -
\??\c:\6406662.exec:\6406662.exe44⤵
- Executes dropped EXE
PID:3736 -
\??\c:\40066.exec:\40066.exe45⤵
- Executes dropped EXE
PID:3656 -
\??\c:\ppddd.exec:\ppddd.exe46⤵
- Executes dropped EXE
PID:3352 -
\??\c:\nttnbb.exec:\nttnbb.exe47⤵
- Executes dropped EXE
PID:940 -
\??\c:\ttttbt.exec:\ttttbt.exe48⤵
- Executes dropped EXE
PID:4304 -
\??\c:\e46088.exec:\e46088.exe49⤵
- Executes dropped EXE
PID:1176 -
\??\c:\20882.exec:\20882.exe50⤵
- Executes dropped EXE
PID:3560 -
\??\c:\2406448.exec:\2406448.exe51⤵
- Executes dropped EXE
PID:368 -
\??\c:\24004.exec:\24004.exe52⤵
- Executes dropped EXE
PID:4360 -
\??\c:\c060484.exec:\c060484.exe53⤵
- Executes dropped EXE
PID:2124 -
\??\c:\u242660.exec:\u242660.exe54⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hnbtnn.exec:\hnbtnn.exe55⤵
- Executes dropped EXE
PID:4668 -
\??\c:\42882.exec:\42882.exe56⤵
- Executes dropped EXE
PID:1904 -
\??\c:\llrxrlf.exec:\llrxrlf.exe57⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hbbtnn.exec:\hbbtnn.exe58⤵
- Executes dropped EXE
PID:4324 -
\??\c:\2066828.exec:\2066828.exe59⤵
- Executes dropped EXE
PID:1652 -
\??\c:\e46600.exec:\e46600.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3628 -
\??\c:\04004.exec:\04004.exe61⤵
- Executes dropped EXE
PID:2940 -
\??\c:\044868.exec:\044868.exe62⤵
- Executes dropped EXE
PID:1064 -
\??\c:\84660.exec:\84660.exe63⤵
- Executes dropped EXE
PID:1068 -
\??\c:\djvvj.exec:\djvvj.exe64⤵
- Executes dropped EXE
PID:3484 -
\??\c:\xlrfrrr.exec:\xlrfrrr.exe65⤵
- Executes dropped EXE
PID:2384 -
\??\c:\dpvvd.exec:\dpvvd.exe66⤵PID:1528
-
\??\c:\xxlffff.exec:\xxlffff.exe67⤵PID:1832
-
\??\c:\640444.exec:\640444.exe68⤵PID:3404
-
\??\c:\vjvpv.exec:\vjvpv.exe69⤵PID:3960
-
\??\c:\80604.exec:\80604.exe70⤵PID:4400
-
\??\c:\886000.exec:\886000.exe71⤵PID:5116
-
\??\c:\8282884.exec:\8282884.exe72⤵PID:3392
-
\??\c:\xrrxffl.exec:\xrrxffl.exe73⤵PID:2396
-
\??\c:\8448826.exec:\8448826.exe74⤵PID:3216
-
\??\c:\48488.exec:\48488.exe75⤵PID:1448
-
\??\c:\bthbht.exec:\bthbht.exe76⤵PID:2784
-
\??\c:\602860.exec:\602860.exe77⤵PID:3772
-
\??\c:\w02600.exec:\w02600.exe78⤵PID:2504
-
\??\c:\tttnht.exec:\tttnht.exe79⤵PID:1972
-
\??\c:\ddvvd.exec:\ddvvd.exe80⤵PID:392
-
\??\c:\bnnhbb.exec:\bnnhbb.exe81⤵PID:2980
-
\??\c:\xrfxrlf.exec:\xrfxrlf.exe82⤵PID:4160
-
\??\c:\xllfrlf.exec:\xllfrlf.exe83⤵PID:2228
-
\??\c:\xrrlrlr.exec:\xrrlrlr.exe84⤵PID:1360
-
\??\c:\bhbbnn.exec:\bhbbnn.exe85⤵PID:3940
-
\??\c:\0468024.exec:\0468024.exe86⤵PID:2912
-
\??\c:\2622444.exec:\2622444.exe87⤵PID:1092
-
\??\c:\frlrllf.exec:\frlrllf.exe88⤵PID:4696
-
\??\c:\084202.exec:\084202.exe89⤵PID:1648
-
\??\c:\868266.exec:\868266.exe90⤵PID:4404
-
\??\c:\k46840.exec:\k46840.exe91⤵PID:4364
-
\??\c:\g2884.exec:\g2884.exe92⤵PID:4644
-
\??\c:\0882048.exec:\0882048.exe93⤵PID:2104
-
\??\c:\7ppjd.exec:\7ppjd.exe94⤵PID:3236
-
\??\c:\vppjv.exec:\vppjv.exe95⤵PID:3736
-
\??\c:\5ntnhb.exec:\5ntnhb.exe96⤵PID:1236
-
\??\c:\bnnhtn.exec:\bnnhtn.exe97⤵PID:3352
-
\??\c:\w24826.exec:\w24826.exe98⤵PID:1484
-
\??\c:\3jjpj.exec:\3jjpj.exe99⤵PID:2532
-
\??\c:\88844.exec:\88844.exe100⤵PID:4856
-
\??\c:\rlfxlfr.exec:\rlfxlfr.exe101⤵PID:368
-
\??\c:\8404882.exec:\8404882.exe102⤵PID:1796
-
\??\c:\0064828.exec:\0064828.exe103⤵PID:2032
-
\??\c:\bnbtbb.exec:\bnbtbb.exe104⤵PID:2476
-
\??\c:\g0082.exec:\g0082.exe105⤵PID:3884
-
\??\c:\28480.exec:\28480.exe106⤵PID:3540
-
\??\c:\i004204.exec:\i004204.exe107⤵PID:2940
-
\??\c:\pddjj.exec:\pddjj.exe108⤵PID:1064
-
\??\c:\vppdv.exec:\vppdv.exe109⤵PID:2280
-
\??\c:\dppjv.exec:\dppjv.exe110⤵PID:4500
-
\??\c:\9hhthb.exec:\9hhthb.exe111⤵PID:4576
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe112⤵PID:984
-
\??\c:\6284800.exec:\6284800.exe113⤵PID:3404
-
\??\c:\jvvvp.exec:\jvvvp.exe114⤵PID:2884
-
\??\c:\3bbnhb.exec:\3bbnhb.exe115⤵PID:3944
-
\??\c:\vdjpv.exec:\vdjpv.exe116⤵PID:3424
-
\??\c:\g2204.exec:\g2204.exe117⤵PID:4104
-
\??\c:\hbnhbt.exec:\hbnhbt.exe118⤵PID:1596
-
\??\c:\04480.exec:\04480.exe119⤵PID:3188
-
\??\c:\thnnhh.exec:\thnnhh.exe120⤵PID:2448
-
\??\c:\xlfrfxr.exec:\xlfrfxr.exe121⤵PID:1448
-
\??\c:\a2264.exec:\a2264.exe122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-