Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 03:47
Behavioral task
behavioral1
Sample
cfdc493b3ce740c729f168125c03650afb75ddfe4bc4c3164e8964a14f260ba3.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
cfdc493b3ce740c729f168125c03650afb75ddfe4bc4c3164e8964a14f260ba3.exe
-
Size
233KB
-
MD5
10da159a1d4ef2242664e3510bd8952c
-
SHA1
5eeb2e33d27476affe5684e2d19566aaad2b958a
-
SHA256
cfdc493b3ce740c729f168125c03650afb75ddfe4bc4c3164e8964a14f260ba3
-
SHA512
d0509982f103b6abb85a183f6f3261a9ee7116aa0cfd8a12c6aa621e18c901d6ff0fcc23cc2b455c73f35eddd23aee47af41e26deda2eb5e0012a2cb51f0c1b8
-
SSDEEP
6144:kcm4FmowdHoSSGpJw4PqhraHcpOmFTHDGYhEf5X2a90:y4wFHoSSGpJwGeeFmFTNAp2A0
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2232-10-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2968-13-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2648-31-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2116-49-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2792-58-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2568-45-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/3060-22-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2552-74-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2504-85-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/840-104-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2000-129-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2176-138-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/632-148-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2696-158-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1972-172-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1976-180-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2840-189-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1320-206-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2148-239-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/772-272-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2388-290-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/3000-329-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2976-355-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2472-375-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2904-383-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2888-409-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1788-445-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1972-478-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1372-526-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/904-561-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2564-635-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2944-710-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2696-754-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/304-872-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2464-935-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2944-1011-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2232-0-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x000d00000001269e-5.dat UPX behavioral1/memory/2232-10-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/memory/2968-13-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0007000000014aa2-28.dat UPX behavioral1/memory/2648-31-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0007000000014b27-38.dat UPX behavioral1/memory/2116-49-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0007000000014b63-47.dat UPX behavioral1/memory/2792-58-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0007000000014baa-56.dat UPX behavioral1/memory/2568-45-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/memory/3060-22-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x003200000001471d-20.dat UPX behavioral1/files/0x0008000000014e51-64.dat UPX behavioral1/memory/2552-66-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0007000000015ce1-75.dat UPX behavioral1/memory/2552-74-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/memory/2504-76-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0006000000015ceb-82.dat UPX behavioral1/memory/2504-85-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0006000000015d07-93.dat UPX behavioral1/memory/840-94-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/memory/840-98-0x0000000000220000-0x0000000000257000-memory.dmp UPX behavioral1/files/0x0006000000015d28-101.dat UPX behavioral1/memory/840-104-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0006000000015d4a-112.dat UPX behavioral1/files/0x0006000000015d56-118.dat UPX behavioral1/memory/2000-129-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0006000000015d5e-128.dat UPX behavioral1/files/0x0006000000015d67-135.dat UPX behavioral1/memory/2176-138-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0006000000015d6f-146.dat UPX behavioral1/memory/632-148-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0006000000015d79-155.dat UPX behavioral1/memory/2696-158-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0032000000014726-163.dat UPX behavioral1/files/0x0006000000015d87-173.dat UPX behavioral1/memory/1972-172-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/memory/1976-180-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0006000000015d8f-181.dat UPX behavioral1/memory/2840-189-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0006000000015d9b-190.dat UPX behavioral1/files/0x0006000000015e3a-198.dat UPX behavioral1/memory/1320-206-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x0006000000015eaf-207.dat UPX behavioral1/files/0x0006000000015f6d-215.dat UPX behavioral1/files/0x0006000000015fe9-223.dat UPX behavioral1/files/0x0006000000016117-231.dat UPX behavioral1/memory/2148-239-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x00060000000161e7-241.dat UPX behavioral1/files/0x000600000001630b-248.dat UPX behavioral1/files/0x00060000000164b2-257.dat UPX behavioral1/files/0x0006000000016572-264.dat UPX behavioral1/memory/772-272-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/files/0x000600000001661c-273.dat UPX behavioral1/files/0x0006000000016843-281.dat UPX behavioral1/memory/2388-282-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/memory/2388-290-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/memory/2232-309-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/memory/3000-322-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/memory/3000-329-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/memory/2728-342-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral1/memory/2976-355-0x0000000000400000-0x0000000000437000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2968 nhntbb.exe 3060 9bhntt.exe 2648 46842.exe 2568 480404.exe 2116 240004.exe 2792 nthbtb.exe 2552 48244.exe 2504 084466.exe 2900 640600.exe 840 2628444.exe 2796 hbnttt.exe 2944 7xfxfxf.exe 2000 1xfflfl.exe 2176 tnhhht.exe 2256 pjvdp.exe 632 htbhhh.exe 2696 4680222.exe 1972 hbnttb.exe 1976 xlfxxfl.exe 2840 3frrxrx.exe 324 86288.exe 1320 86222.exe 2168 k20444.exe 1892 5lfxfll.exe 420 42284.exe 2148 1rlxlrl.exe 1536 llxlrxl.exe 960 1jjpv.exe 1036 806000.exe 772 88406.exe 3044 bbhbnn.exe 2388 4824624.exe 3052 nhnnhh.exe 2372 u866800.exe 1844 pjvpj.exe 2232 9djdj.exe 2952 ttnnbb.exe 3000 g0406.exe 2648 djvjj.exe 2568 3jdjd.exe 2728 1dvvd.exe 2732 llxlfxl.exe 2976 rrlrlff.exe 2612 u468406.exe 2436 64224.exe 2472 xlxxffl.exe 2904 jdppv.exe 2912 5fxlxxf.exe 2620 pjpvj.exe 2788 7jdpv.exe 2888 240268.exe 2932 6466880.exe 1204 044022.exe 300 26280.exe 1960 206084.exe 1788 pjdvj.exe 548 rflffff.exe 2744 8206406.exe 2756 e68244.exe 2280 m8062.exe 1972 44860.exe 2292 jdppd.exe 800 httntn.exe 1164 a6262.exe -
resource yara_rule behavioral1/memory/2232-0-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x000d00000001269e-5.dat upx behavioral1/memory/2232-10-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2968-13-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0007000000014aa2-28.dat upx behavioral1/memory/2648-31-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0007000000014b27-38.dat upx behavioral1/memory/2116-49-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0007000000014b63-47.dat upx behavioral1/memory/2792-58-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0007000000014baa-56.dat upx behavioral1/memory/2568-45-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/3060-22-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x003200000001471d-20.dat upx behavioral1/files/0x0008000000014e51-64.dat upx behavioral1/memory/2552-66-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0007000000015ce1-75.dat upx behavioral1/memory/2552-74-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2504-76-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015ceb-82.dat upx behavioral1/memory/2504-85-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015d07-93.dat upx behavioral1/memory/840-94-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/840-98-0x0000000000220000-0x0000000000257000-memory.dmp upx behavioral1/files/0x0006000000015d28-101.dat upx behavioral1/memory/840-104-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015d4a-112.dat upx behavioral1/files/0x0006000000015d56-118.dat upx behavioral1/memory/2000-129-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015d5e-128.dat upx behavioral1/files/0x0006000000015d67-135.dat upx behavioral1/memory/2176-138-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015d6f-146.dat upx behavioral1/memory/632-148-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015d79-155.dat upx behavioral1/memory/2696-158-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0032000000014726-163.dat upx behavioral1/files/0x0006000000015d87-173.dat upx behavioral1/memory/1972-172-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1976-180-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015d8f-181.dat upx behavioral1/memory/2840-189-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015d9b-190.dat upx behavioral1/files/0x0006000000015e3a-198.dat upx behavioral1/memory/1320-206-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0006000000015eaf-207.dat upx behavioral1/files/0x0006000000015f6d-215.dat upx behavioral1/files/0x0006000000015fe9-223.dat upx behavioral1/files/0x0006000000016117-231.dat upx behavioral1/memory/2148-239-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00060000000161e7-241.dat upx behavioral1/files/0x000600000001630b-248.dat upx behavioral1/files/0x00060000000164b2-257.dat upx behavioral1/files/0x0006000000016572-264.dat upx behavioral1/memory/772-272-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x000600000001661c-273.dat upx behavioral1/files/0x0006000000016843-281.dat upx behavioral1/memory/2388-282-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2388-290-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2232-309-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/3000-322-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/3000-329-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2728-342-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2976-355-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2968 2232 cfdc493b3ce740c729f168125c03650afb75ddfe4bc4c3164e8964a14f260ba3.exe 28 PID 2232 wrote to memory of 2968 2232 cfdc493b3ce740c729f168125c03650afb75ddfe4bc4c3164e8964a14f260ba3.exe 28 PID 2232 wrote to memory of 2968 2232 cfdc493b3ce740c729f168125c03650afb75ddfe4bc4c3164e8964a14f260ba3.exe 28 PID 2232 wrote to memory of 2968 2232 cfdc493b3ce740c729f168125c03650afb75ddfe4bc4c3164e8964a14f260ba3.exe 28 PID 2968 wrote to memory of 3060 2968 nhntbb.exe 29 PID 2968 wrote to memory of 3060 2968 nhntbb.exe 29 PID 2968 wrote to memory of 3060 2968 nhntbb.exe 29 PID 2968 wrote to memory of 3060 2968 nhntbb.exe 29 PID 3060 wrote to memory of 2648 3060 9bhntt.exe 30 PID 3060 wrote to memory of 2648 3060 9bhntt.exe 30 PID 3060 wrote to memory of 2648 3060 9bhntt.exe 30 PID 3060 wrote to memory of 2648 3060 9bhntt.exe 30 PID 2648 wrote to memory of 2568 2648 46842.exe 31 PID 2648 wrote to memory of 2568 2648 46842.exe 31 PID 2648 wrote to memory of 2568 2648 46842.exe 31 PID 2648 wrote to memory of 2568 2648 46842.exe 31 PID 2568 wrote to memory of 2116 2568 480404.exe 32 PID 2568 wrote to memory of 2116 2568 480404.exe 32 PID 2568 wrote to memory of 2116 2568 480404.exe 32 PID 2568 wrote to memory of 2116 2568 480404.exe 32 PID 2116 wrote to memory of 2792 2116 240004.exe 33 PID 2116 wrote to memory of 2792 2116 240004.exe 33 PID 2116 wrote to memory of 2792 2116 240004.exe 33 PID 2116 wrote to memory of 2792 2116 240004.exe 33 PID 2792 wrote to memory of 2552 2792 nthbtb.exe 34 PID 2792 wrote to memory of 2552 2792 nthbtb.exe 34 PID 2792 wrote to memory of 2552 2792 nthbtb.exe 34 PID 2792 wrote to memory of 2552 2792 nthbtb.exe 34 PID 2552 wrote to memory of 2504 2552 48244.exe 35 PID 2552 wrote to memory of 2504 2552 48244.exe 35 PID 2552 wrote to memory of 2504 2552 48244.exe 35 PID 2552 wrote to memory of 2504 2552 48244.exe 35 PID 2504 wrote to memory of 2900 2504 084466.exe 36 PID 2504 wrote to memory of 2900 2504 084466.exe 36 PID 2504 wrote to memory of 2900 2504 084466.exe 36 PID 2504 wrote to memory of 2900 2504 084466.exe 36 PID 2900 wrote to memory of 840 2900 640600.exe 37 PID 2900 wrote to memory of 840 2900 640600.exe 37 PID 2900 wrote to memory of 840 2900 640600.exe 37 PID 2900 wrote to memory of 840 2900 640600.exe 37 PID 840 wrote to memory of 2796 840 2628444.exe 38 PID 840 wrote to memory of 2796 840 2628444.exe 38 PID 840 wrote to memory of 2796 840 2628444.exe 38 PID 840 wrote to memory of 2796 840 2628444.exe 38 PID 2796 wrote to memory of 2944 2796 hbnttt.exe 39 PID 2796 wrote to memory of 2944 2796 hbnttt.exe 39 PID 2796 wrote to memory of 2944 2796 hbnttt.exe 39 PID 2796 wrote to memory of 2944 2796 hbnttt.exe 39 PID 2944 wrote to memory of 2000 2944 7xfxfxf.exe 40 PID 2944 wrote to memory of 2000 2944 7xfxfxf.exe 40 PID 2944 wrote to memory of 2000 2944 7xfxfxf.exe 40 PID 2944 wrote to memory of 2000 2944 7xfxfxf.exe 40 PID 2000 wrote to memory of 2176 2000 1xfflfl.exe 41 PID 2000 wrote to memory of 2176 2000 1xfflfl.exe 41 PID 2000 wrote to memory of 2176 2000 1xfflfl.exe 41 PID 2000 wrote to memory of 2176 2000 1xfflfl.exe 41 PID 2176 wrote to memory of 2256 2176 tnhhht.exe 42 PID 2176 wrote to memory of 2256 2176 tnhhht.exe 42 PID 2176 wrote to memory of 2256 2176 tnhhht.exe 42 PID 2176 wrote to memory of 2256 2176 tnhhht.exe 42 PID 2256 wrote to memory of 632 2256 pjvdp.exe 43 PID 2256 wrote to memory of 632 2256 pjvdp.exe 43 PID 2256 wrote to memory of 632 2256 pjvdp.exe 43 PID 2256 wrote to memory of 632 2256 pjvdp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfdc493b3ce740c729f168125c03650afb75ddfe4bc4c3164e8964a14f260ba3.exe"C:\Users\Admin\AppData\Local\Temp\cfdc493b3ce740c729f168125c03650afb75ddfe4bc4c3164e8964a14f260ba3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\nhntbb.exec:\nhntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\9bhntt.exec:\9bhntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\46842.exec:\46842.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\480404.exec:\480404.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\240004.exec:\240004.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\nthbtb.exec:\nthbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\48244.exec:\48244.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\084466.exec:\084466.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\640600.exec:\640600.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\2628444.exec:\2628444.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\hbnttt.exec:\hbnttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\7xfxfxf.exec:\7xfxfxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\1xfflfl.exec:\1xfflfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\tnhhht.exec:\tnhhht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\pjvdp.exec:\pjvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\htbhhh.exec:\htbhhh.exe17⤵
- Executes dropped EXE
PID:632 -
\??\c:\4680222.exec:\4680222.exe18⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hbnttb.exec:\hbnttb.exe19⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xlfxxfl.exec:\xlfxxfl.exe20⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3frrxrx.exec:\3frrxrx.exe21⤵
- Executes dropped EXE
PID:2840 -
\??\c:\86288.exec:\86288.exe22⤵
- Executes dropped EXE
PID:324 -
\??\c:\86222.exec:\86222.exe23⤵
- Executes dropped EXE
PID:1320 -
\??\c:\k20444.exec:\k20444.exe24⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5lfxfll.exec:\5lfxfll.exe25⤵
- Executes dropped EXE
PID:1892 -
\??\c:\42284.exec:\42284.exe26⤵
- Executes dropped EXE
PID:420 -
\??\c:\1rlxlrl.exec:\1rlxlrl.exe27⤵
- Executes dropped EXE
PID:2148 -
\??\c:\llxlrxl.exec:\llxlrxl.exe28⤵
- Executes dropped EXE
PID:1536 -
\??\c:\1jjpv.exec:\1jjpv.exe29⤵
- Executes dropped EXE
PID:960 -
\??\c:\806000.exec:\806000.exe30⤵
- Executes dropped EXE
PID:1036 -
\??\c:\88406.exec:\88406.exe31⤵
- Executes dropped EXE
PID:772 -
\??\c:\bbhbnn.exec:\bbhbnn.exe32⤵
- Executes dropped EXE
PID:3044 -
\??\c:\4824624.exec:\4824624.exe33⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nhnnhh.exec:\nhnnhh.exe34⤵
- Executes dropped EXE
PID:3052 -
\??\c:\u866800.exec:\u866800.exe35⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pjvpj.exec:\pjvpj.exe36⤵
- Executes dropped EXE
PID:1844 -
\??\c:\9djdj.exec:\9djdj.exe37⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ttnnbb.exec:\ttnnbb.exe38⤵
- Executes dropped EXE
PID:2952 -
\??\c:\g0406.exec:\g0406.exe39⤵
- Executes dropped EXE
PID:3000 -
\??\c:\djvjj.exec:\djvjj.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\3jdjd.exec:\3jdjd.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\1dvvd.exec:\1dvvd.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\llxlfxl.exec:\llxlfxl.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rrlrlff.exec:\rrlrlff.exe44⤵
- Executes dropped EXE
PID:2976 -
\??\c:\u468406.exec:\u468406.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\64224.exec:\64224.exe46⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xlxxffl.exec:\xlxxffl.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jdppv.exec:\jdppv.exe48⤵
- Executes dropped EXE
PID:2904 -
\??\c:\5fxlxxf.exec:\5fxlxxf.exe49⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pjpvj.exec:\pjpvj.exe50⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7jdpv.exec:\7jdpv.exe51⤵
- Executes dropped EXE
PID:2788 -
\??\c:\240268.exec:\240268.exe52⤵
- Executes dropped EXE
PID:2888 -
\??\c:\6466880.exec:\6466880.exe53⤵
- Executes dropped EXE
PID:2932 -
\??\c:\044022.exec:\044022.exe54⤵
- Executes dropped EXE
PID:1204 -
\??\c:\26280.exec:\26280.exe55⤵
- Executes dropped EXE
PID:300 -
\??\c:\206084.exec:\206084.exe56⤵
- Executes dropped EXE
PID:1960 -
\??\c:\pjdvj.exec:\pjdvj.exe57⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rflffff.exec:\rflffff.exe58⤵
- Executes dropped EXE
PID:548 -
\??\c:\8206406.exec:\8206406.exe59⤵
- Executes dropped EXE
PID:2744 -
\??\c:\e68244.exec:\e68244.exe60⤵
- Executes dropped EXE
PID:2756 -
\??\c:\m8062.exec:\m8062.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\44860.exec:\44860.exe62⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jdppd.exec:\jdppd.exe63⤵
- Executes dropped EXE
PID:2292 -
\??\c:\httntn.exec:\httntn.exe64⤵
- Executes dropped EXE
PID:800 -
\??\c:\a6262.exec:\a6262.exe65⤵
- Executes dropped EXE
PID:1164 -
\??\c:\3flrxrx.exec:\3flrxrx.exe66⤵PID:1180
-
\??\c:\llxfrll.exec:\llxfrll.exe67⤵PID:1684
-
\??\c:\frfxlrl.exec:\frfxlrl.exe68⤵PID:2168
-
\??\c:\608868.exec:\608868.exe69⤵PID:2396
-
\??\c:\bbnhtt.exec:\bbnhtt.exe70⤵PID:1372
-
\??\c:\pdjpp.exec:\pdjpp.exe71⤵PID:2384
-
\??\c:\200404.exec:\200404.exe72⤵PID:1524
-
\??\c:\m4668.exec:\m4668.exe73⤵PID:1100
-
\??\c:\w64422.exec:\w64422.exe74⤵PID:1328
-
\??\c:\hbhhbh.exec:\hbhhbh.exe75⤵PID:904
-
\??\c:\8688484.exec:\8688484.exe76⤵PID:2016
-
\??\c:\642240.exec:\642240.exe77⤵PID:3036
-
\??\c:\600622.exec:\600622.exe78⤵PID:3044
-
\??\c:\nbnhtn.exec:\nbnhtn.exe79⤵PID:2860
-
\??\c:\fxffxxf.exec:\fxffxxf.exe80⤵PID:892
-
\??\c:\k64422.exec:\k64422.exe81⤵PID:1716
-
\??\c:\xrllflr.exec:\xrllflr.exe82⤵PID:1848
-
\??\c:\1xrfllr.exec:\1xrfllr.exe83⤵PID:1588
-
\??\c:\864022.exec:\864022.exe84⤵PID:2100
-
\??\c:\2028040.exec:\2028040.exe85⤵PID:2668
-
\??\c:\xlxxrfr.exec:\xlxxrfr.exe86⤵PID:2304
-
\??\c:\btbbhn.exec:\btbbhn.exe87⤵PID:3032
-
\??\c:\bbtbbb.exec:\bbtbbb.exe88⤵PID:2564
-
\??\c:\0406240.exec:\0406240.exe89⤵PID:2024
-
\??\c:\nhbntb.exec:\nhbntb.exe90⤵PID:2588
-
\??\c:\4202468.exec:\4202468.exe91⤵PID:2708
-
\??\c:\ffrffxf.exec:\ffrffxf.exe92⤵PID:2456
-
\??\c:\nhnnbt.exec:\nhnnbt.exe93⤵PID:2552
-
\??\c:\062628.exec:\062628.exe94⤵PID:1708
-
\??\c:\ttnttb.exec:\ttnttb.exe95⤵PID:2900
-
\??\c:\vvjpv.exec:\vvjpv.exe96⤵PID:2768
-
\??\c:\pjdvv.exec:\pjdvv.exe97⤵PID:2780
-
\??\c:\w86684.exec:\w86684.exe98⤵PID:2796
-
\??\c:\dvvpd.exec:\dvvpd.exe99⤵PID:1056
-
\??\c:\5vppj.exec:\5vppj.exe100⤵PID:2944
-
\??\c:\7jddv.exec:\7jddv.exe101⤵PID:1204
-
\??\c:\a6484.exec:\a6484.exe102⤵PID:300
-
\??\c:\9btbbb.exec:\9btbbb.exe103⤵PID:2272
-
\??\c:\7ttnnn.exec:\7ttnnn.exe104⤵PID:1788
-
\??\c:\djvjd.exec:\djvjd.exe105⤵PID:2760
-
\??\c:\002244.exec:\002244.exe106⤵PID:2036
-
\??\c:\ntnnhh.exec:\ntnnhh.exe107⤵PID:2696
-
\??\c:\a0842.exec:\a0842.exe108⤵PID:2316
-
\??\c:\lxffrrf.exec:\lxffrrf.exe109⤵PID:2252
-
\??\c:\042082.exec:\042082.exe110⤵PID:1996
-
\??\c:\86802.exec:\86802.exe111⤵PID:784
-
\??\c:\8688440.exec:\8688440.exe112⤵PID:1356
-
\??\c:\26062.exec:\26062.exe113⤵PID:1888
-
\??\c:\042240.exec:\042240.exe114⤵PID:1008
-
\??\c:\2688884.exec:\2688884.exe115⤵PID:1148
-
\??\c:\6424284.exec:\6424284.exe116⤵PID:2188
-
\??\c:\jdpvj.exec:\jdpvj.exe117⤵PID:1224
-
\??\c:\0428442.exec:\0428442.exe118⤵PID:1400
-
\??\c:\vpjjp.exec:\vpjjp.exe119⤵PID:1952
-
\??\c:\bbnnbh.exec:\bbnnbh.exe120⤵PID:2268
-
\??\c:\rrffrrf.exec:\rrffrrf.exe121⤵PID:960
-
\??\c:\fxflxxf.exec:\fxflxxf.exe122⤵PID:704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-