Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 04:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe
-
Size
453KB
-
MD5
46b2d2bf23bafafc3fcaaca551002cd0
-
SHA1
3f8493c57af85fbe6de75c2e2c756c3f747ad724
-
SHA256
fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6
-
SHA512
8442598d62ead98abb16fbc3ab06a048f6779c0cb40bcbc2fe6f7c1d192d3563e961ffd8e95d92fffd6febdc0fd8491b85b152df072500c0c57c2d911f0c7450
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJY:q7Tc2NYHUrAwfMp3CDJY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/2824-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-631-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-953-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-970-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/996-1063-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 7nthhh.exe 2564 dvvdp.exe 2840 ffxrxlr.exe 2532 btntbh.exe 796 ttthtb.exe 3000 vpdjd.exe 1984 flfrfrf.exe 1568 bbtbnt.exe 3004 1pdjj.exe 2380 rlfllxf.exe 1704 hhttnn.exe 2320 pjjvj.exe 1564 xrllflr.exe 2764 ttnntt.exe 824 5dvvd.exe 1612 hhhnth.exe 1948 5pdjd.exe 2208 7nhntt.exe 2164 bbntbb.exe 2268 lfxlrrl.exe 2244 nhthnn.exe 236 llflflf.exe 1692 hhbhtb.exe 2452 xrrxllf.exe 1576 lxlrflx.exe 1092 vvppv.exe 328 xrllrrf.exe 2152 rrflrlr.exe 3024 btntbb.exe 1580 jjdpd.exe 2896 1thbbb.exe 2660 lfrrffx.exe 1516 tnnnnb.exe 2688 lrxflrf.exe 2540 btnhtt.exe 2700 pjjdj.exe 2552 rrlfrfx.exe 264 fxrrxxl.exe 2528 hthbnn.exe 1408 vpppd.exe 2864 3rffllr.exe 3004 tnttbt.exe 2172 9htnbb.exe 2036 5jdjv.exe 1192 lffrllr.exe 2884 nhttbb.exe 1108 hbtbhn.exe 1828 dpjdj.exe 1492 xlfflrf.exe 524 tnbbhn.exe 2756 bthhtb.exe 1732 jjdvj.exe 1736 5lflrrf.exe 1596 nhhnbn.exe 2408 dppjd.exe 2156 xrrlrlr.exe 2164 fxlrxxr.exe 2280 hbbhth.exe 1556 vpjjj.exe 1080 frxxffl.exe 2356 rllrllx.exe 1264 bhhhtt.exe 1696 7pvvp.exe 1576 5fxxlrx.exe -
resource yara_rule behavioral1/memory/2824-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-828-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-1038-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-1063-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-1130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-1143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-1198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-1283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-1321-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2684 2824 fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe 30 PID 2824 wrote to memory of 2684 2824 fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe 30 PID 2824 wrote to memory of 2684 2824 fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe 30 PID 2824 wrote to memory of 2684 2824 fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe 30 PID 2684 wrote to memory of 2564 2684 7nthhh.exe 31 PID 2684 wrote to memory of 2564 2684 7nthhh.exe 31 PID 2684 wrote to memory of 2564 2684 7nthhh.exe 31 PID 2684 wrote to memory of 2564 2684 7nthhh.exe 31 PID 2564 wrote to memory of 2840 2564 dvvdp.exe 32 PID 2564 wrote to memory of 2840 2564 dvvdp.exe 32 PID 2564 wrote to memory of 2840 2564 dvvdp.exe 32 PID 2564 wrote to memory of 2840 2564 dvvdp.exe 32 PID 2840 wrote to memory of 2532 2840 ffxrxlr.exe 33 PID 2840 wrote to memory of 2532 2840 ffxrxlr.exe 33 PID 2840 wrote to memory of 2532 2840 ffxrxlr.exe 33 PID 2840 wrote to memory of 2532 2840 ffxrxlr.exe 33 PID 2532 wrote to memory of 796 2532 btntbh.exe 34 PID 2532 wrote to memory of 796 2532 btntbh.exe 34 PID 2532 wrote to memory of 796 2532 btntbh.exe 34 PID 2532 wrote to memory of 796 2532 btntbh.exe 34 PID 796 wrote to memory of 3000 796 ttthtb.exe 35 PID 796 wrote to memory of 3000 796 ttthtb.exe 35 PID 796 wrote to memory of 3000 796 ttthtb.exe 35 PID 796 wrote to memory of 3000 796 ttthtb.exe 35 PID 3000 wrote to memory of 1984 3000 vpdjd.exe 36 PID 3000 wrote to memory of 1984 3000 vpdjd.exe 36 PID 3000 wrote to memory of 1984 3000 vpdjd.exe 36 PID 3000 wrote to memory of 1984 3000 vpdjd.exe 36 PID 1984 wrote to memory of 1568 1984 flfrfrf.exe 37 PID 1984 wrote to memory of 1568 1984 flfrfrf.exe 37 PID 1984 wrote to memory of 1568 1984 flfrfrf.exe 37 PID 1984 wrote to memory of 1568 1984 flfrfrf.exe 37 PID 1568 wrote to memory of 3004 1568 bbtbnt.exe 38 PID 1568 wrote to memory of 3004 1568 bbtbnt.exe 38 PID 1568 wrote to memory of 3004 1568 bbtbnt.exe 38 PID 1568 wrote to memory of 3004 1568 bbtbnt.exe 38 PID 3004 wrote to memory of 2380 3004 1pdjj.exe 39 PID 3004 wrote to memory of 2380 3004 1pdjj.exe 39 PID 3004 wrote to memory of 2380 3004 1pdjj.exe 39 PID 3004 wrote to memory of 2380 3004 1pdjj.exe 39 PID 2380 wrote to memory of 1704 2380 rlfllxf.exe 40 PID 2380 wrote to memory of 1704 2380 rlfllxf.exe 40 PID 2380 wrote to memory of 1704 2380 rlfllxf.exe 40 PID 2380 wrote to memory of 1704 2380 rlfllxf.exe 40 PID 1704 wrote to memory of 2320 1704 hhttnn.exe 41 PID 1704 wrote to memory of 2320 1704 hhttnn.exe 41 PID 1704 wrote to memory of 2320 1704 hhttnn.exe 41 PID 1704 wrote to memory of 2320 1704 hhttnn.exe 41 PID 2320 wrote to memory of 1564 2320 pjjvj.exe 42 PID 2320 wrote to memory of 1564 2320 pjjvj.exe 42 PID 2320 wrote to memory of 1564 2320 pjjvj.exe 42 PID 2320 wrote to memory of 1564 2320 pjjvj.exe 42 PID 1564 wrote to memory of 2764 1564 xrllflr.exe 43 PID 1564 wrote to memory of 2764 1564 xrllflr.exe 43 PID 1564 wrote to memory of 2764 1564 xrllflr.exe 43 PID 1564 wrote to memory of 2764 1564 xrllflr.exe 43 PID 2764 wrote to memory of 824 2764 ttnntt.exe 44 PID 2764 wrote to memory of 824 2764 ttnntt.exe 44 PID 2764 wrote to memory of 824 2764 ttnntt.exe 44 PID 2764 wrote to memory of 824 2764 ttnntt.exe 44 PID 824 wrote to memory of 1612 824 5dvvd.exe 45 PID 824 wrote to memory of 1612 824 5dvvd.exe 45 PID 824 wrote to memory of 1612 824 5dvvd.exe 45 PID 824 wrote to memory of 1612 824 5dvvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe"C:\Users\Admin\AppData\Local\Temp\fdc66efc13592576bb862375639ae99c21d8183b80e3a7e9a9421612577454a6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\7nthhh.exec:\7nthhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\dvvdp.exec:\dvvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ffxrxlr.exec:\ffxrxlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\btntbh.exec:\btntbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ttthtb.exec:\ttthtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\vpdjd.exec:\vpdjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\flfrfrf.exec:\flfrfrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\bbtbnt.exec:\bbtbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\1pdjj.exec:\1pdjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\rlfllxf.exec:\rlfllxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\hhttnn.exec:\hhttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\pjjvj.exec:\pjjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xrllflr.exec:\xrllflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\ttnntt.exec:\ttnntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5dvvd.exec:\5dvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\hhhnth.exec:\hhhnth.exe17⤵
- Executes dropped EXE
PID:1612 -
\??\c:\5pdjd.exec:\5pdjd.exe18⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7nhntt.exec:\7nhntt.exe19⤵
- Executes dropped EXE
PID:2208 -
\??\c:\bbntbb.exec:\bbntbb.exe20⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lfxlrrl.exec:\lfxlrrl.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nhthnn.exec:\nhthnn.exe22⤵
- Executes dropped EXE
PID:2244 -
\??\c:\llflflf.exec:\llflflf.exe23⤵
- Executes dropped EXE
PID:236 -
\??\c:\hhbhtb.exec:\hhbhtb.exe24⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xrrxllf.exec:\xrrxllf.exe25⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lxlrflx.exec:\lxlrflx.exe26⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vvppv.exec:\vvppv.exe27⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xrllrrf.exec:\xrllrrf.exe28⤵
- Executes dropped EXE
PID:328 -
\??\c:\rrflrlr.exec:\rrflrlr.exe29⤵
- Executes dropped EXE
PID:2152 -
\??\c:\btntbb.exec:\btntbb.exe30⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jjdpd.exec:\jjdpd.exe31⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1thbbb.exec:\1thbbb.exe32⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lfrrffx.exec:\lfrrffx.exe33⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tnnnnb.exec:\tnnnnb.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\lrxflrf.exec:\lrxflrf.exe35⤵
- Executes dropped EXE
PID:2688 -
\??\c:\btnhtt.exec:\btnhtt.exe36⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pjjdj.exec:\pjjdj.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rrlfrfx.exec:\rrlfrfx.exe38⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe39⤵
- Executes dropped EXE
PID:264 -
\??\c:\hthbnn.exec:\hthbnn.exe40⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vpppd.exec:\vpppd.exe41⤵
- Executes dropped EXE
PID:1408 -
\??\c:\3rffllr.exec:\3rffllr.exe42⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tnttbt.exec:\tnttbt.exe43⤵
- Executes dropped EXE
PID:3004 -
\??\c:\9htnbb.exec:\9htnbb.exe44⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5jdjv.exec:\5jdjv.exe45⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lffrllr.exec:\lffrllr.exe46⤵
- Executes dropped EXE
PID:1192 -
\??\c:\nhttbb.exec:\nhttbb.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hbtbhn.exec:\hbtbhn.exe48⤵
- Executes dropped EXE
PID:1108 -
\??\c:\dpjdj.exec:\dpjdj.exe49⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xlfflrf.exec:\xlfflrf.exe50⤵
- Executes dropped EXE
PID:1492 -
\??\c:\tnbbhn.exec:\tnbbhn.exe51⤵
- Executes dropped EXE
PID:524 -
\??\c:\bthhtb.exec:\bthhtb.exe52⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jjdvj.exec:\jjdvj.exe53⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5lflrrf.exec:\5lflrrf.exe54⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nhhnbn.exec:\nhhnbn.exe55⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dppjd.exec:\dppjd.exe56⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xrrlrlr.exec:\xrrlrlr.exe57⤵
- Executes dropped EXE
PID:2156 -
\??\c:\fxlrxxr.exec:\fxlrxxr.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hbbhth.exec:\hbbhth.exe59⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vpjjj.exec:\vpjjj.exe60⤵
- Executes dropped EXE
PID:1556 -
\??\c:\frxxffl.exec:\frxxffl.exe61⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rllrllx.exec:\rllrllx.exe62⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bhhhtt.exec:\bhhhtt.exe63⤵
- Executes dropped EXE
PID:1264 -
\??\c:\7pvvp.exec:\7pvvp.exe64⤵
- Executes dropped EXE
PID:1696 -
\??\c:\5fxxlrx.exec:\5fxxlrx.exe65⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rfrrxrx.exec:\rfrrxrx.exe66⤵PID:2348
-
\??\c:\1thhbb.exec:\1thhbb.exe67⤵PID:3044
-
\??\c:\ddvvd.exec:\ddvvd.exe68⤵PID:288
-
\??\c:\7lrrrrr.exec:\7lrrrrr.exe69⤵PID:1856
-
\??\c:\9fffrll.exec:\9fffrll.exe70⤵PID:1920
-
\??\c:\3thbbt.exec:\3thbbt.exe71⤵PID:880
-
\??\c:\vjdvd.exec:\vjdvd.exe72⤵PID:996
-
\??\c:\lfrlrrf.exec:\lfrlrrf.exe73⤵PID:2672
-
\??\c:\hhbbhh.exec:\hhbbhh.exe74⤵PID:2852
-
\??\c:\9tnttb.exec:\9tnttb.exe75⤵PID:2196
-
\??\c:\1pjdj.exec:\1pjdj.exe76⤵PID:1640
-
\??\c:\rlffllr.exec:\rlffllr.exe77⤵PID:2592
-
\??\c:\nhtntt.exec:\nhtntt.exe78⤵PID:2548
-
\??\c:\tntttt.exec:\tntttt.exe79⤵PID:2580
-
\??\c:\vvvvj.exec:\vvvvj.exe80⤵PID:3000
-
\??\c:\xxrrxxf.exec:\xxrrxxf.exe81⤵PID:1984
-
\??\c:\xrffllr.exec:\xrffllr.exe82⤵PID:1772
-
\??\c:\htnnnn.exec:\htnnnn.exe83⤵PID:1048
-
\??\c:\5ppdj.exec:\5ppdj.exe84⤵PID:2864
-
\??\c:\vpdjv.exec:\vpdjv.exe85⤵PID:3004
-
\??\c:\lxrlrlx.exec:\lxrlrlx.exe86⤵PID:3048
-
\??\c:\nnbbbb.exec:\nnbbbb.exe87⤵PID:1700
-
\??\c:\thhntb.exec:\thhntb.exe88⤵PID:2436
-
\??\c:\dppdp.exec:\dppdp.exe89⤵PID:2888
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe90⤵PID:2420
-
\??\c:\fxflrrf.exec:\fxflrrf.exe91⤵PID:2400
-
\??\c:\tbtttt.exec:\tbtttt.exe92⤵PID:2764
-
\??\c:\dvvvj.exec:\dvvvj.exe93⤵PID:2760
-
\??\c:\5jpjp.exec:\5jpjp.exe94⤵PID:824
-
\??\c:\3llrrlx.exec:\3llrrlx.exe95⤵PID:1728
-
\??\c:\btnntb.exec:\btnntb.exe96⤵PID:2680
-
\??\c:\tntntt.exec:\tntntt.exe97⤵PID:1948
-
\??\c:\jjdpp.exec:\jjdpp.exe98⤵PID:2512
-
\??\c:\fxxrrxl.exec:\fxxrrxl.exe99⤵PID:2184
-
\??\c:\rfrlllr.exec:\rfrlllr.exe100⤵PID:2056
-
\??\c:\bthnnh.exec:\bthnnh.exe101⤵PID:1616
-
\??\c:\hbtbbn.exec:\hbtbbn.exe102⤵PID:2280
-
\??\c:\1jjpp.exec:\1jjpp.exe103⤵PID:836
-
\??\c:\lxlllll.exec:\lxlllll.exe104⤵PID:324
-
\??\c:\btnnnn.exec:\btnnnn.exe105⤵PID:2356
-
\??\c:\nhnntt.exec:\nhnntt.exe106⤵PID:1692
-
\??\c:\9vdjp.exec:\9vdjp.exe107⤵PID:1456
-
\??\c:\5vjjd.exec:\5vjjd.exe108⤵PID:2384
-
\??\c:\1lrrlll.exec:\1lrrlll.exe109⤵PID:1584
-
\??\c:\tnbbhb.exec:\tnbbhb.exe110⤵PID:1992
-
\??\c:\nhbtbt.exec:\nhbtbt.exe111⤵PID:3036
-
\??\c:\pjvvj.exec:\pjvvj.exe112⤵PID:988
-
\??\c:\dvpjj.exec:\dvpjj.exe113⤵PID:1428
-
\??\c:\rlrrfxl.exec:\rlrrfxl.exe114⤵PID:2716
-
\??\c:\nhtbbt.exec:\nhtbbt.exe115⤵PID:2652
-
\??\c:\dvpjj.exec:\dvpjj.exe116⤵PID:2296
-
\??\c:\vdvpd.exec:\vdvpd.exe117⤵PID:2124
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe118⤵PID:1516
-
\??\c:\lllrxlx.exec:\lllrxlx.exe119⤵PID:2688
-
\??\c:\bnbbhh.exec:\bnbbhh.exe120⤵PID:2664
-
\??\c:\5jjjp.exec:\5jjjp.exe121⤵PID:3016
-
\??\c:\llffflr.exec:\llffflr.exe122⤵PID:2552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-