Analysis
-
max time kernel
131s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 18:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08e3b0c90b06283bc3d12b6f8dbb094b20f4bbe3dc552592a1bd26f46e414024.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
08e3b0c90b06283bc3d12b6f8dbb094b20f4bbe3dc552592a1bd26f46e414024.exe
-
Size
58KB
-
MD5
609e900a2937614355a5647bb6617549
-
SHA1
51957882a20e77ab7aa56d644f0c5f7168117912
-
SHA256
08e3b0c90b06283bc3d12b6f8dbb094b20f4bbe3dc552592a1bd26f46e414024
-
SHA512
5e92a90593f0a585698d706ca620c911a3760c7bb5169cae6f6d9762bba17370d0eb22e2c6d7af62739cd8678f6153cef009f7706825bbbd1b7b80314700aa55
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIms3:ymb3NkkiQ3mdBjFIsIF3
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral2/memory/3024-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-136-0x0000000000470000-0x000000000047C000-memory.dmp family_blackmoon behavioral2/memory/4592-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-381-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 51 IoCs
resource yara_rule behavioral2/memory/3024-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3024-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4576-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3500-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3152-28-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1444-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5000-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5016-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5016-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5044-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3092-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1400-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5068-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3412-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2524-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4076-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1540-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4904-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2940-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4592-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4784-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1984-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1756-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4480-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3888-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1616-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2436-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1168-217-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-226-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/216-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4488-238-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4020-245-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3932-254-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2580-263-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3760-267-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1804-276-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5000-277-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2792-284-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4012-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3856-321-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3256-325-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3256-327-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4448-343-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2644-344-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2644-347-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3516-356-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-369-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3968-373-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3968-377-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2880-381-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3468-388-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4576 48062.exe 3500 vjjdp.exe 3152 3vdvp.exe 1444 thhhbb.exe 5000 tntttt.exe 5016 8288822.exe 5044 46444.exe 3092 682666.exe 1400 xlfxffl.exe 5068 vvpjj.exe 3412 8800020.exe 2524 nhbbtt.exe 4076 vvvpj.exe 1540 pdvpj.exe 2160 640088.exe 4904 tnnnht.exe 2940 22864.exe 4824 jdjpj.exe 2324 jdvdv.exe 4592 840006.exe 4784 48406.exe 1984 bbhhnn.exe 1756 4848660.exe 4480 7hnnhn.exe 3888 lxxxllf.exe 1616 nbhbtt.exe 2828 e82644.exe 3980 o284404.exe 2436 rlfxfxf.exe 1168 3lrlffx.exe 3860 k42600.exe 216 8466286.exe 4488 s8886.exe 4020 bhnhhh.exe 3868 pjdvv.exe 3932 lrxllfr.exe 2932 frfxffx.exe 2580 206604.exe 3760 7djdd.exe 1804 20242.exe 5000 028204.exe 2792 rlffrrl.exe 1788 68868.exe 3680 844626.exe 2420 ffrfxrr.exe 4012 rlrxxxr.exe 2532 64004.exe 824 fllfllf.exe 2452 i460006.exe 2248 42888.exe 3856 88608.exe 3256 nbhbbt.exe 2276 64888.exe 2616 jdjdv.exe 4448 djjdp.exe 2644 0808260.exe 2832 xffxlfx.exe 3516 1jjdj.exe 1480 664444.exe 4608 bthbnt.exe 4724 22242.exe 3968 862044.exe 2880 tbhhbh.exe 4296 xxxrrlf.exe -
resource yara_rule behavioral2/memory/3024-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-343-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-388-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 4576 3024 08e3b0c90b06283bc3d12b6f8dbb094b20f4bbe3dc552592a1bd26f46e414024.exe 85 PID 3024 wrote to memory of 4576 3024 08e3b0c90b06283bc3d12b6f8dbb094b20f4bbe3dc552592a1bd26f46e414024.exe 85 PID 3024 wrote to memory of 4576 3024 08e3b0c90b06283bc3d12b6f8dbb094b20f4bbe3dc552592a1bd26f46e414024.exe 85 PID 4576 wrote to memory of 3500 4576 48062.exe 86 PID 4576 wrote to memory of 3500 4576 48062.exe 86 PID 4576 wrote to memory of 3500 4576 48062.exe 86 PID 3500 wrote to memory of 3152 3500 vjjdp.exe 87 PID 3500 wrote to memory of 3152 3500 vjjdp.exe 87 PID 3500 wrote to memory of 3152 3500 vjjdp.exe 87 PID 3152 wrote to memory of 1444 3152 3vdvp.exe 88 PID 3152 wrote to memory of 1444 3152 3vdvp.exe 88 PID 3152 wrote to memory of 1444 3152 3vdvp.exe 88 PID 1444 wrote to memory of 5000 1444 thhhbb.exe 89 PID 1444 wrote to memory of 5000 1444 thhhbb.exe 89 PID 1444 wrote to memory of 5000 1444 thhhbb.exe 89 PID 5000 wrote to memory of 5016 5000 tntttt.exe 90 PID 5000 wrote to memory of 5016 5000 tntttt.exe 90 PID 5000 wrote to memory of 5016 5000 tntttt.exe 90 PID 5016 wrote to memory of 5044 5016 8288822.exe 91 PID 5016 wrote to memory of 5044 5016 8288822.exe 91 PID 5016 wrote to memory of 5044 5016 8288822.exe 91 PID 5044 wrote to memory of 3092 5044 46444.exe 92 PID 5044 wrote to memory of 3092 5044 46444.exe 92 PID 5044 wrote to memory of 3092 5044 46444.exe 92 PID 3092 wrote to memory of 1400 3092 682666.exe 93 PID 3092 wrote to memory of 1400 3092 682666.exe 93 PID 3092 wrote to memory of 1400 3092 682666.exe 93 PID 1400 wrote to memory of 5068 1400 xlfxffl.exe 94 PID 1400 wrote to memory of 5068 1400 xlfxffl.exe 94 PID 1400 wrote to memory of 5068 1400 xlfxffl.exe 94 PID 5068 wrote to memory of 3412 5068 vvpjj.exe 95 PID 5068 wrote to memory of 3412 5068 vvpjj.exe 95 PID 5068 wrote to memory of 3412 5068 vvpjj.exe 95 PID 3412 wrote to memory of 2524 3412 8800020.exe 96 PID 3412 wrote to memory of 2524 3412 8800020.exe 96 PID 3412 wrote to memory of 2524 3412 8800020.exe 96 PID 2524 wrote to memory of 4076 2524 nhbbtt.exe 97 PID 2524 wrote to memory of 4076 2524 nhbbtt.exe 97 PID 2524 wrote to memory of 4076 2524 nhbbtt.exe 97 PID 4076 wrote to memory of 1540 4076 vvvpj.exe 98 PID 4076 wrote to memory of 1540 4076 vvvpj.exe 98 PID 4076 wrote to memory of 1540 4076 vvvpj.exe 98 PID 1540 wrote to memory of 2160 1540 pdvpj.exe 99 PID 1540 wrote to memory of 2160 1540 pdvpj.exe 99 PID 1540 wrote to memory of 2160 1540 pdvpj.exe 99 PID 2160 wrote to memory of 4904 2160 640088.exe 100 PID 2160 wrote to memory of 4904 2160 640088.exe 100 PID 2160 wrote to memory of 4904 2160 640088.exe 100 PID 4904 wrote to memory of 2940 4904 tnnnht.exe 101 PID 4904 wrote to memory of 2940 4904 tnnnht.exe 101 PID 4904 wrote to memory of 2940 4904 tnnnht.exe 101 PID 2940 wrote to memory of 4824 2940 22864.exe 102 PID 2940 wrote to memory of 4824 2940 22864.exe 102 PID 2940 wrote to memory of 4824 2940 22864.exe 102 PID 4824 wrote to memory of 2324 4824 jdjpj.exe 103 PID 4824 wrote to memory of 2324 4824 jdjpj.exe 103 PID 4824 wrote to memory of 2324 4824 jdjpj.exe 103 PID 2324 wrote to memory of 4592 2324 jdvdv.exe 104 PID 2324 wrote to memory of 4592 2324 jdvdv.exe 104 PID 2324 wrote to memory of 4592 2324 jdvdv.exe 104 PID 4592 wrote to memory of 4784 4592 840006.exe 105 PID 4592 wrote to memory of 4784 4592 840006.exe 105 PID 4592 wrote to memory of 4784 4592 840006.exe 105 PID 4784 wrote to memory of 1984 4784 48406.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\08e3b0c90b06283bc3d12b6f8dbb094b20f4bbe3dc552592a1bd26f46e414024.exe"C:\Users\Admin\AppData\Local\Temp\08e3b0c90b06283bc3d12b6f8dbb094b20f4bbe3dc552592a1bd26f46e414024.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\48062.exec:\48062.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\vjjdp.exec:\vjjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\3vdvp.exec:\3vdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\thhhbb.exec:\thhhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\tntttt.exec:\tntttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\8288822.exec:\8288822.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\46444.exec:\46444.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\682666.exec:\682666.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\xlfxffl.exec:\xlfxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\vvpjj.exec:\vvpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\8800020.exec:\8800020.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\nhbbtt.exec:\nhbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\vvvpj.exec:\vvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\pdvpj.exec:\pdvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\640088.exec:\640088.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\tnnnht.exec:\tnnnht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\22864.exec:\22864.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\jdjpj.exec:\jdjpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\jdvdv.exec:\jdvdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\840006.exec:\840006.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\48406.exec:\48406.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\bbhhnn.exec:\bbhhnn.exe23⤵
- Executes dropped EXE
PID:1984 -
\??\c:\4848660.exec:\4848660.exe24⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7hnnhn.exec:\7hnnhn.exe25⤵
- Executes dropped EXE
PID:4480 -
\??\c:\lxxxllf.exec:\lxxxllf.exe26⤵
- Executes dropped EXE
PID:3888 -
\??\c:\nbhbtt.exec:\nbhbtt.exe27⤵
- Executes dropped EXE
PID:1616 -
\??\c:\e82644.exec:\e82644.exe28⤵
- Executes dropped EXE
PID:2828 -
\??\c:\o284404.exec:\o284404.exe29⤵
- Executes dropped EXE
PID:3980 -
\??\c:\rlfxfxf.exec:\rlfxfxf.exe30⤵
- Executes dropped EXE
PID:2436 -
\??\c:\3lrlffx.exec:\3lrlffx.exe31⤵
- Executes dropped EXE
PID:1168 -
\??\c:\k42600.exec:\k42600.exe32⤵
- Executes dropped EXE
PID:3860 -
\??\c:\8466286.exec:\8466286.exe33⤵
- Executes dropped EXE
PID:216 -
\??\c:\s8886.exec:\s8886.exe34⤵
- Executes dropped EXE
PID:4488 -
\??\c:\bhnhhh.exec:\bhnhhh.exe35⤵
- Executes dropped EXE
PID:4020 -
\??\c:\pjdvv.exec:\pjdvv.exe36⤵
- Executes dropped EXE
PID:3868 -
\??\c:\lrxllfr.exec:\lrxllfr.exe37⤵
- Executes dropped EXE
PID:3932 -
\??\c:\frfxffx.exec:\frfxffx.exe38⤵
- Executes dropped EXE
PID:2932 -
\??\c:\206604.exec:\206604.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7djdd.exec:\7djdd.exe40⤵
- Executes dropped EXE
PID:3760 -
\??\c:\20242.exec:\20242.exe41⤵
- Executes dropped EXE
PID:1804 -
\??\c:\028204.exec:\028204.exe42⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rlffrrl.exec:\rlffrrl.exe43⤵
- Executes dropped EXE
PID:2792 -
\??\c:\68868.exec:\68868.exe44⤵
- Executes dropped EXE
PID:1788 -
\??\c:\844626.exec:\844626.exe45⤵
- Executes dropped EXE
PID:3680 -
\??\c:\ffrfxrr.exec:\ffrfxrr.exe46⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rlrxxxr.exec:\rlrxxxr.exe47⤵
- Executes dropped EXE
PID:4012 -
\??\c:\64004.exec:\64004.exe48⤵
- Executes dropped EXE
PID:2532 -
\??\c:\fllfllf.exec:\fllfllf.exe49⤵
- Executes dropped EXE
PID:824 -
\??\c:\i460006.exec:\i460006.exe50⤵
- Executes dropped EXE
PID:2452 -
\??\c:\42888.exec:\42888.exe51⤵
- Executes dropped EXE
PID:2248 -
\??\c:\88608.exec:\88608.exe52⤵
- Executes dropped EXE
PID:3856 -
\??\c:\nbhbbt.exec:\nbhbbt.exe53⤵
- Executes dropped EXE
PID:3256 -
\??\c:\64888.exec:\64888.exe54⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jdjdv.exec:\jdjdv.exe55⤵
- Executes dropped EXE
PID:2616 -
\??\c:\djjdp.exec:\djjdp.exe56⤵
- Executes dropped EXE
PID:4448 -
\??\c:\0808260.exec:\0808260.exe57⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xffxlfx.exec:\xffxlfx.exe58⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1jjdj.exec:\1jjdj.exe59⤵
- Executes dropped EXE
PID:3516 -
\??\c:\664444.exec:\664444.exe60⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bthbnt.exec:\bthbnt.exe61⤵
- Executes dropped EXE
PID:4608 -
\??\c:\22242.exec:\22242.exe62⤵
- Executes dropped EXE
PID:4724 -
\??\c:\862044.exec:\862044.exe63⤵
- Executes dropped EXE
PID:3968 -
\??\c:\tbhhbh.exec:\tbhhbh.exe64⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xxxrrlf.exec:\xxxrrlf.exe65⤵
- Executes dropped EXE
PID:4296 -
\??\c:\00288.exec:\00288.exe66⤵PID:3468
-
\??\c:\c260882.exec:\c260882.exe67⤵PID:2296
-
\??\c:\8626666.exec:\8626666.exe68⤵PID:4056
-
\??\c:\rxfhnhb.exec:\rxfhnhb.exe69⤵PID:3316
-
\??\c:\vvddj.exec:\vvddj.exe70⤵PID:2812
-
\??\c:\vjpjd.exec:\vjpjd.exe71⤵PID:1772
-
\??\c:\868226.exec:\868226.exe72⤵PID:4240
-
\??\c:\nbbtnn.exec:\nbbtnn.exe73⤵PID:3860
-
\??\c:\jdjdd.exec:\jdjdd.exe74⤵PID:2344
-
\??\c:\40204.exec:\40204.exe75⤵PID:4336
-
\??\c:\5dvjd.exec:\5dvjd.exe76⤵PID:3052
-
\??\c:\484888.exec:\484888.exe77⤵PID:2300
-
\??\c:\68486.exec:\68486.exe78⤵PID:924
-
\??\c:\a8860.exec:\a8860.exe79⤵PID:1836
-
\??\c:\24042.exec:\24042.exe80⤵PID:3148
-
\??\c:\bnnhbt.exec:\bnnhbt.exe81⤵PID:3940
-
\??\c:\62826.exec:\62826.exe82⤵PID:2036
-
\??\c:\dvppv.exec:\dvppv.exe83⤵PID:1872
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe84⤵PID:1744
-
\??\c:\pjjjd.exec:\pjjjd.exe85⤵PID:5044
-
\??\c:\thntnn.exec:\thntnn.exe86⤵PID:1788
-
\??\c:\5bhtnn.exec:\5bhtnn.exe87⤵PID:3680
-
\??\c:\468282.exec:\468282.exe88⤵PID:2288
-
\??\c:\a8664.exec:\a8664.exe89⤵PID:4352
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe90⤵PID:4084
-
\??\c:\u060482.exec:\u060482.exe91⤵PID:5076
-
\??\c:\s2440.exec:\s2440.exe92⤵PID:3028
-
\??\c:\c282048.exec:\c282048.exe93⤵PID:4640
-
\??\c:\hbbtnn.exec:\hbbtnn.exe94⤵PID:1160
-
\??\c:\42060.exec:\42060.exe95⤵PID:2936
-
\??\c:\608488.exec:\608488.exe96⤵PID:392
-
\??\c:\rllflll.exec:\rllflll.exe97⤵PID:3504
-
\??\c:\3jpjd.exec:\3jpjd.exe98⤵PID:4560
-
\??\c:\rrlllrx.exec:\rrlllrx.exe99⤵PID:1048
-
\??\c:\m8066.exec:\m8066.exe100⤵PID:1848
-
\??\c:\440088.exec:\440088.exe101⤵PID:2736
-
\??\c:\ntbthb.exec:\ntbthb.exe102⤵PID:3080
-
\??\c:\rffxrll.exec:\rffxrll.exe103⤵PID:4832
-
\??\c:\666660.exec:\666660.exe104⤵PID:3984
-
\??\c:\66266.exec:\66266.exe105⤵PID:2040
-
\??\c:\6066022.exec:\6066022.exe106⤵PID:4480
-
\??\c:\nhnhbt.exec:\nhnhbt.exe107⤵PID:3116
-
\??\c:\0840844.exec:\0840844.exe108⤵PID:2240
-
\??\c:\0804848.exec:\0804848.exe109⤵PID:3920
-
\??\c:\tnnnhb.exec:\tnnnhb.exe110⤵PID:3600
-
\??\c:\668204.exec:\668204.exe111⤵PID:2044
-
\??\c:\i842604.exec:\i842604.exe112⤵PID:4524
-
\??\c:\468268.exec:\468268.exe113⤵PID:440
-
\??\c:\4826448.exec:\4826448.exe114⤵PID:4500
-
\??\c:\82426.exec:\82426.exe115⤵PID:216
-
\??\c:\thbbnt.exec:\thbbnt.exe116⤵PID:2884
-
\??\c:\9ppjv.exec:\9ppjv.exe117⤵PID:1544
-
\??\c:\8008064.exec:\8008064.exe118⤵PID:2092
-
\??\c:\46226.exec:\46226.exe119⤵PID:1932
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe120⤵PID:2380
-
\??\c:\a6260.exec:\a6260.exe121⤵PID:636
-
\??\c:\vpvpp.exec:\vpvpp.exe122⤵PID:920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-