Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 18:40
Behavioral task
behavioral1
Sample
0debf3fa935dbda8f4141c6e44c9323c00f99d90f8ab6ab6a823446723f5329e.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0debf3fa935dbda8f4141c6e44c9323c00f99d90f8ab6ab6a823446723f5329e.exe
-
Size
339KB
-
MD5
2f6c44a040eacda9b01cce027cd8464c
-
SHA1
7db2d8c1491495de97950eaf24fbbbff9c03c1cb
-
SHA256
0debf3fa935dbda8f4141c6e44c9323c00f99d90f8ab6ab6a823446723f5329e
-
SHA512
3a06900178a1ac7f94ac7aa65e8718ad2c5bff4a4fe7c6b5b7c7a2be390733b427b9ddcce11e7df8057636a81e5ca40819e1c9e26500680c68ca5ab30512d7d0
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNiF:9cm4FmowdHoS4BtguSPKyHF
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/2236-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/644-130-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2764-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/860-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/804-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-608-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-791-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/2328-893-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-1026-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-1059-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2016-1062-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1140-1099-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1140-1131-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1528-1264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2236-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\0884662.exe UPX behavioral1/memory/2236-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2236-6-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/memory/2240-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\8626228.exe UPX behavioral1/memory/2240-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\o468046.exe UPX behavioral1/memory/3040-29-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpjpv.exe UPX behavioral1/memory/2632-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bbnttb.exe UPX behavioral1/memory/2260-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\k02282.exe UPX C:\bbhntn.exe UPX behavioral1/memory/2472-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ddppv.exe UPX behavioral1/memory/2456-73-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\k42840.exe UPX behavioral1/memory/2456-82-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2476-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tnhhnt.exe UPX C:\20628.exe UPX behavioral1/memory/1528-100-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2900-109-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5lflrrx.exe UPX C:\w46622.exe UPX C:\7pppv.exe UPX behavioral1/memory/2060-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hbhnbh.exe UPX behavioral1/memory/644-130-0x0000000000430000-0x0000000000457000-memory.dmp UPX C:\hthhtt.exe UPX behavioral1/memory/2764-151-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\u462884.exe UPX C:\5jpjp.exe UPX behavioral1/memory/860-168-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\i688046.exe UPX C:\0040840.exe UPX behavioral1/memory/2264-185-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bnbtbb.exe UPX C:\86406.exe UPX behavioral1/memory/2052-196-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\g6402.exe UPX C:\08440.exe UPX C:\640066.exe UPX behavioral1/memory/1792-221-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2384-229-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\bnhhhh.exe UPX C:\rfxlllr.exe UPX C:\3vvvd.exe UPX C:\480064.exe UPX behavioral1/memory/2828-255-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\080026.exe UPX behavioral1/memory/1648-270-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjppd.exe UPX C:\dvjjv.exe UPX behavioral1/memory/808-279-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1940-300-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2744-319-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2532-334-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2432-343-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2592-368-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2540-375-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/852-382-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
0884662.exe8626228.exeo468046.exevpjpv.exebbnttb.exek02282.exebbhntn.exeddppv.exek42840.exetnhhnt.exe20628.exe5lflrrx.exew46622.exe7pppv.exehbhnbh.exehthhtt.exeu462884.exe5jpjp.exei688046.exe0040840.exebnbtbb.exe86406.exeg6402.exe08440.exe640066.exebnhhhh.exerfxlllr.exe3vvvd.exe480064.exe080026.exejjppd.exedvjjv.exe84440.exexrllxfl.exeo624040.exe208282.exe3rllllf.exe428464.exedpvjp.exerlrrxfl.exedvvpj.exedvppp.exeg0882.exevpdvd.exe20200.exe600688.exe042062.exelxfxrrf.exew46288.exenbnbhb.exe2060224.exe88066.exe7xlffxx.exe9bbhnt.exe4206288.exelrfrllr.exe08046.exejvjjd.exec600280.exe040288.exetthhnn.exejdppj.exefrllflx.exellffllx.exepid process 2240 0884662.exe 3040 8626228.exe 2632 o468046.exe 2260 vpjpv.exe 2588 bbnttb.exe 3016 k02282.exe 2472 bbhntn.exe 2456 ddppv.exe 2476 k42840.exe 1528 tnhhnt.exe 2900 20628.exe 2960 5lflrrx.exe 2060 w46622.exe 644 7pppv.exe 532 hbhnbh.exe 2764 hthhtt.exe 960 u462884.exe 860 5jpjp.exe 2000 i688046.exe 2264 0040840.exe 2404 bnbtbb.exe 2052 86406.exe 3052 g6402.exe 2064 08440.exe 1792 640066.exe 2384 bnhhhh.exe 1772 rfxlllr.exe 1388 3vvvd.exe 2828 480064.exe 1648 080026.exe 808 jjppd.exe 1960 dvjjv.exe 2508 84440.exe 2352 xrllxfl.exe 1940 o624040.exe 2236 208282.exe 1984 3rllllf.exe 2744 428464.exe 2532 dpvjp.exe 2648 rlrrxfl.exe 2432 dvvpj.exe 2544 dvppp.exe 2752 g0882.exe 2592 vpdvd.exe 2540 20200.exe 2596 600688.exe 852 042062.exe 2788 lxfxrrf.exe 2820 w46288.exe 2920 nbnbhb.exe 2684 2060224.exe 2704 88066.exe 1048 7xlffxx.exe 540 9bbhnt.exe 804 4206288.exe 2524 lrfrllr.exe 2764 08046.exe 1404 jvjjd.exe 864 c600280.exe 2056 040288.exe 580 tthhnn.exe 2316 jdppj.exe 1444 frllflx.exe 2280 llffllx.exe -
Processes:
resource yara_rule behavioral1/memory/2236-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\0884662.exe upx behavioral1/memory/2236-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2236-6-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2240-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\8626228.exe upx behavioral1/memory/2240-20-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\o468046.exe upx behavioral1/memory/3040-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjpv.exe upx behavioral1/memory/2632-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbnttb.exe upx behavioral1/memory/2260-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\k02282.exe upx C:\bbhntn.exe upx behavioral1/memory/2472-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddppv.exe upx behavioral1/memory/2456-73-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\k42840.exe upx behavioral1/memory/2456-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2476-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhhnt.exe upx C:\20628.exe upx behavioral1/memory/1528-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lflrrx.exe upx C:\w46622.exe upx C:\7pppv.exe upx behavioral1/memory/2060-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhnbh.exe upx behavioral1/memory/644-130-0x0000000000430000-0x0000000000457000-memory.dmp upx C:\hthhtt.exe upx behavioral1/memory/2764-151-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\u462884.exe upx C:\5jpjp.exe upx behavioral1/memory/860-168-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\i688046.exe upx C:\0040840.exe upx behavioral1/memory/2264-185-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnbtbb.exe upx C:\86406.exe upx behavioral1/memory/2052-196-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\g6402.exe upx C:\08440.exe upx C:\640066.exe upx behavioral1/memory/1792-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2384-229-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bnhhhh.exe upx C:\rfxlllr.exe upx C:\3vvvd.exe upx C:\480064.exe upx behavioral1/memory/2828-255-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\080026.exe upx behavioral1/memory/1648-270-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjppd.exe upx C:\dvjjv.exe upx behavioral1/memory/808-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1940-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2432-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-368-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-375-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/852-382-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0debf3fa935dbda8f4141c6e44c9323c00f99d90f8ab6ab6a823446723f5329e.exe0884662.exe8626228.exeo468046.exevpjpv.exebbnttb.exek02282.exebbhntn.exeddppv.exek42840.exetnhhnt.exe20628.exe5lflrrx.exew46622.exe7pppv.exehbhnbh.exedescription pid process target process PID 2236 wrote to memory of 2240 2236 0debf3fa935dbda8f4141c6e44c9323c00f99d90f8ab6ab6a823446723f5329e.exe 0884662.exe PID 2236 wrote to memory of 2240 2236 0debf3fa935dbda8f4141c6e44c9323c00f99d90f8ab6ab6a823446723f5329e.exe 0884662.exe PID 2236 wrote to memory of 2240 2236 0debf3fa935dbda8f4141c6e44c9323c00f99d90f8ab6ab6a823446723f5329e.exe 0884662.exe PID 2236 wrote to memory of 2240 2236 0debf3fa935dbda8f4141c6e44c9323c00f99d90f8ab6ab6a823446723f5329e.exe 0884662.exe PID 2240 wrote to memory of 3040 2240 0884662.exe 8626228.exe PID 2240 wrote to memory of 3040 2240 0884662.exe 8626228.exe PID 2240 wrote to memory of 3040 2240 0884662.exe 8626228.exe PID 2240 wrote to memory of 3040 2240 0884662.exe 8626228.exe PID 3040 wrote to memory of 2632 3040 8626228.exe o468046.exe PID 3040 wrote to memory of 2632 3040 8626228.exe o468046.exe PID 3040 wrote to memory of 2632 3040 8626228.exe o468046.exe PID 3040 wrote to memory of 2632 3040 8626228.exe o468046.exe PID 2632 wrote to memory of 2260 2632 o468046.exe vpjpv.exe PID 2632 wrote to memory of 2260 2632 o468046.exe vpjpv.exe PID 2632 wrote to memory of 2260 2632 o468046.exe vpjpv.exe PID 2632 wrote to memory of 2260 2632 o468046.exe vpjpv.exe PID 2260 wrote to memory of 2588 2260 vpjpv.exe bbnttb.exe PID 2260 wrote to memory of 2588 2260 vpjpv.exe bbnttb.exe PID 2260 wrote to memory of 2588 2260 vpjpv.exe bbnttb.exe PID 2260 wrote to memory of 2588 2260 vpjpv.exe bbnttb.exe PID 2588 wrote to memory of 3016 2588 bbnttb.exe k02282.exe PID 2588 wrote to memory of 3016 2588 bbnttb.exe k02282.exe PID 2588 wrote to memory of 3016 2588 bbnttb.exe k02282.exe PID 2588 wrote to memory of 3016 2588 bbnttb.exe k02282.exe PID 3016 wrote to memory of 2472 3016 k02282.exe bbhntn.exe PID 3016 wrote to memory of 2472 3016 k02282.exe bbhntn.exe PID 3016 wrote to memory of 2472 3016 k02282.exe bbhntn.exe PID 3016 wrote to memory of 2472 3016 k02282.exe bbhntn.exe PID 2472 wrote to memory of 2456 2472 bbhntn.exe ddppv.exe PID 2472 wrote to memory of 2456 2472 bbhntn.exe ddppv.exe PID 2472 wrote to memory of 2456 2472 bbhntn.exe ddppv.exe PID 2472 wrote to memory of 2456 2472 bbhntn.exe ddppv.exe PID 2456 wrote to memory of 2476 2456 ddppv.exe k42840.exe PID 2456 wrote to memory of 2476 2456 ddppv.exe k42840.exe PID 2456 wrote to memory of 2476 2456 ddppv.exe k42840.exe PID 2456 wrote to memory of 2476 2456 ddppv.exe k42840.exe PID 2476 wrote to memory of 1528 2476 k42840.exe tnhhnt.exe PID 2476 wrote to memory of 1528 2476 k42840.exe tnhhnt.exe PID 2476 wrote to memory of 1528 2476 k42840.exe tnhhnt.exe PID 2476 wrote to memory of 1528 2476 k42840.exe tnhhnt.exe PID 1528 wrote to memory of 2900 1528 tnhhnt.exe 20628.exe PID 1528 wrote to memory of 2900 1528 tnhhnt.exe 20628.exe PID 1528 wrote to memory of 2900 1528 tnhhnt.exe 20628.exe PID 1528 wrote to memory of 2900 1528 tnhhnt.exe 20628.exe PID 2900 wrote to memory of 2960 2900 20628.exe 5lflrrx.exe PID 2900 wrote to memory of 2960 2900 20628.exe 5lflrrx.exe PID 2900 wrote to memory of 2960 2900 20628.exe 5lflrrx.exe PID 2900 wrote to memory of 2960 2900 20628.exe 5lflrrx.exe PID 2960 wrote to memory of 2060 2960 5lflrrx.exe w46622.exe PID 2960 wrote to memory of 2060 2960 5lflrrx.exe w46622.exe PID 2960 wrote to memory of 2060 2960 5lflrrx.exe w46622.exe PID 2960 wrote to memory of 2060 2960 5lflrrx.exe w46622.exe PID 2060 wrote to memory of 644 2060 w46622.exe 7pppv.exe PID 2060 wrote to memory of 644 2060 w46622.exe 7pppv.exe PID 2060 wrote to memory of 644 2060 w46622.exe 7pppv.exe PID 2060 wrote to memory of 644 2060 w46622.exe 7pppv.exe PID 644 wrote to memory of 532 644 7pppv.exe hbhnbh.exe PID 644 wrote to memory of 532 644 7pppv.exe hbhnbh.exe PID 644 wrote to memory of 532 644 7pppv.exe hbhnbh.exe PID 644 wrote to memory of 532 644 7pppv.exe hbhnbh.exe PID 532 wrote to memory of 2764 532 hbhnbh.exe hthhtt.exe PID 532 wrote to memory of 2764 532 hbhnbh.exe hthhtt.exe PID 532 wrote to memory of 2764 532 hbhnbh.exe hthhtt.exe PID 532 wrote to memory of 2764 532 hbhnbh.exe hthhtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0debf3fa935dbda8f4141c6e44c9323c00f99d90f8ab6ab6a823446723f5329e.exe"C:\Users\Admin\AppData\Local\Temp\0debf3fa935dbda8f4141c6e44c9323c00f99d90f8ab6ab6a823446723f5329e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\0884662.exec:\0884662.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\8626228.exec:\8626228.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\o468046.exec:\o468046.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vpjpv.exec:\vpjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\bbnttb.exec:\bbnttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\k02282.exec:\k02282.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\bbhntn.exec:\bbhntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\ddppv.exec:\ddppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\k42840.exec:\k42840.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\tnhhnt.exec:\tnhhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\20628.exec:\20628.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\5lflrrx.exec:\5lflrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\w46622.exec:\w46622.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\7pppv.exec:\7pppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\hbhnbh.exec:\hbhnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\hthhtt.exec:\hthhtt.exe17⤵
- Executes dropped EXE
PID:2764 -
\??\c:\u462884.exec:\u462884.exe18⤵
- Executes dropped EXE
PID:960 -
\??\c:\5jpjp.exec:\5jpjp.exe19⤵
- Executes dropped EXE
PID:860 -
\??\c:\i688046.exec:\i688046.exe20⤵
- Executes dropped EXE
PID:2000 -
\??\c:\0040840.exec:\0040840.exe21⤵
- Executes dropped EXE
PID:2264 -
\??\c:\bnbtbb.exec:\bnbtbb.exe22⤵
- Executes dropped EXE
PID:2404 -
\??\c:\86406.exec:\86406.exe23⤵
- Executes dropped EXE
PID:2052 -
\??\c:\g6402.exec:\g6402.exe24⤵
- Executes dropped EXE
PID:3052 -
\??\c:\08440.exec:\08440.exe25⤵
- Executes dropped EXE
PID:2064 -
\??\c:\640066.exec:\640066.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bnhhhh.exec:\bnhhhh.exe27⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rfxlllr.exec:\rfxlllr.exe28⤵
- Executes dropped EXE
PID:1772 -
\??\c:\3vvvd.exec:\3vvvd.exe29⤵
- Executes dropped EXE
PID:1388 -
\??\c:\480064.exec:\480064.exe30⤵
- Executes dropped EXE
PID:2828 -
\??\c:\080026.exec:\080026.exe31⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jjppd.exec:\jjppd.exe32⤵
- Executes dropped EXE
PID:808 -
\??\c:\dvjjv.exec:\dvjjv.exe33⤵
- Executes dropped EXE
PID:1960 -
\??\c:\84440.exec:\84440.exe34⤵
- Executes dropped EXE
PID:2508 -
\??\c:\xrllxfl.exec:\xrllxfl.exe35⤵
- Executes dropped EXE
PID:2352 -
\??\c:\o624040.exec:\o624040.exe36⤵
- Executes dropped EXE
PID:1940 -
\??\c:\208282.exec:\208282.exe37⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3rllllf.exec:\3rllllf.exe38⤵
- Executes dropped EXE
PID:1984 -
\??\c:\428464.exec:\428464.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\dpvjp.exec:\dpvjp.exe40⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\dvvpj.exec:\dvvpj.exe42⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dvppp.exec:\dvppp.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\g0882.exec:\g0882.exe44⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vpdvd.exec:\vpdvd.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\20200.exec:\20200.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\600688.exec:\600688.exe47⤵
- Executes dropped EXE
PID:2596 -
\??\c:\042062.exec:\042062.exe48⤵
- Executes dropped EXE
PID:852 -
\??\c:\lxfxrrf.exec:\lxfxrrf.exe49⤵
- Executes dropped EXE
PID:2788 -
\??\c:\w46288.exec:\w46288.exe50⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nbnbhb.exec:\nbnbhb.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\2060224.exec:\2060224.exe52⤵
- Executes dropped EXE
PID:2684 -
\??\c:\88066.exec:\88066.exe53⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7xlffxx.exec:\7xlffxx.exe54⤵
- Executes dropped EXE
PID:1048 -
\??\c:\9bbhnt.exec:\9bbhnt.exe55⤵
- Executes dropped EXE
PID:540 -
\??\c:\4206288.exec:\4206288.exe56⤵
- Executes dropped EXE
PID:804 -
\??\c:\lrfrllr.exec:\lrfrllr.exe57⤵
- Executes dropped EXE
PID:2524 -
\??\c:\08046.exec:\08046.exe58⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jvjjd.exec:\jvjjd.exe59⤵
- Executes dropped EXE
PID:1404 -
\??\c:\c600280.exec:\c600280.exe60⤵
- Executes dropped EXE
PID:864 -
\??\c:\040288.exec:\040288.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tthhnn.exec:\tthhnn.exe62⤵
- Executes dropped EXE
PID:580 -
\??\c:\jdppj.exec:\jdppj.exe63⤵
- Executes dropped EXE
PID:2316 -
\??\c:\frllflx.exec:\frllflx.exe64⤵
- Executes dropped EXE
PID:1444 -
\??\c:\llffllx.exec:\llffllx.exe65⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xrllrrx.exec:\xrllrrx.exe66⤵PID:2860
-
\??\c:\vpvvd.exec:\vpvvd.exe67⤵PID:1124
-
\??\c:\lxrlxxx.exec:\lxrlxxx.exe68⤵PID:2128
-
\??\c:\26806.exec:\26806.exe69⤵PID:1792
-
\??\c:\hhbbnt.exec:\hhbbnt.exe70⤵PID:2388
-
\??\c:\fxlfllr.exec:\fxlfllr.exe71⤵PID:1400
-
\??\c:\08000.exec:\08000.exe72⤵PID:784
-
\??\c:\o024606.exec:\o024606.exe73⤵PID:2676
-
\??\c:\7pddj.exec:\7pddj.exe74⤵PID:928
-
\??\c:\7jvdd.exec:\7jvdd.exe75⤵PID:652
-
\??\c:\08666.exec:\08666.exe76⤵PID:3000
-
\??\c:\7rllxxl.exec:\7rllxxl.exe77⤵PID:2292
-
\??\c:\o284040.exec:\o284040.exe78⤵PID:1160
-
\??\c:\lxfffff.exec:\lxfffff.exe79⤵PID:1744
-
\??\c:\642228.exec:\642228.exe80⤵PID:2216
-
\??\c:\086284.exec:\086284.exe81⤵PID:1596
-
\??\c:\80224.exec:\80224.exe82⤵PID:1928
-
\??\c:\rfxfrrx.exec:\rfxfrrx.exe83⤵PID:2520
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe84⤵PID:3064
-
\??\c:\pdppd.exec:\pdppd.exe85⤵PID:2616
-
\??\c:\2662846.exec:\2662846.exe86⤵PID:2632
-
\??\c:\7tnttt.exec:\7tnttt.exe87⤵PID:3068
-
\??\c:\q08422.exec:\q08422.exe88⤵PID:2660
-
\??\c:\686402.exec:\686402.exe89⤵PID:2600
-
\??\c:\424404.exec:\424404.exe90⤵PID:2640
-
\??\c:\7pdjp.exec:\7pdjp.exe91⤵PID:2428
-
\??\c:\9pvvd.exec:\9pvvd.exe92⤵PID:1584
-
\??\c:\5nhthh.exec:\5nhthh.exe93⤵PID:2596
-
\??\c:\e86888.exec:\e86888.exe94⤵PID:852
-
\??\c:\5thhbn.exec:\5thhbn.exe95⤵PID:2788
-
\??\c:\hbnntt.exec:\hbnntt.exe96⤵PID:2820
-
\??\c:\7vvpv.exec:\7vvpv.exe97⤵PID:2664
-
\??\c:\bbtbnt.exec:\bbtbnt.exe98⤵PID:1812
-
\??\c:\w46262.exec:\w46262.exe99⤵PID:2412
-
\??\c:\3xrrrrx.exec:\3xrrrrx.exe100⤵PID:600
-
\??\c:\20222.exec:\20222.exe101⤵PID:2772
-
\??\c:\9lxrxxx.exec:\9lxrxxx.exe102⤵PID:2516
-
\??\c:\00242.exec:\00242.exe103⤵PID:2756
-
\??\c:\5vjjj.exec:\5vjjj.exe104⤵PID:280
-
\??\c:\080440.exec:\080440.exe105⤵PID:1328
-
\??\c:\fxllrrx.exec:\fxllrrx.exe106⤵PID:1148
-
\??\c:\1bnntn.exec:\1bnntn.exe107⤵PID:2016
-
\??\c:\bttttb.exec:\bttttb.exe108⤵PID:1484
-
\??\c:\e64800.exec:\e64800.exe109⤵PID:1656
-
\??\c:\480066.exec:\480066.exe110⤵PID:2096
-
\??\c:\a0884.exec:\a0884.exe111⤵PID:1820
-
\??\c:\20224.exec:\20224.exe112⤵PID:608
-
\??\c:\2608484.exec:\2608484.exe113⤵PID:2380
-
\??\c:\dvjpp.exec:\dvjpp.exe114⤵PID:1164
-
\??\c:\5dvdp.exec:\5dvdp.exe115⤵PID:1168
-
\??\c:\824088.exec:\824088.exe116⤵PID:1840
-
\??\c:\fxflrrx.exec:\fxflrrx.exe117⤵PID:792
-
\??\c:\8282280.exec:\8282280.exe118⤵PID:1388
-
\??\c:\9bbntt.exec:\9bbntt.exe119⤵PID:472
-
\??\c:\602848.exec:\602848.exe120⤵PID:2512
-
\??\c:\s2406.exec:\s2406.exe121⤵PID:1924
-
\??\c:\m4240.exec:\m4240.exe122⤵PID:2836
-
\??\c:\602626.exec:\602626.exe123⤵PID:3056
-
\??\c:\m6086.exec:\m6086.exe124⤵PID:896
-
\??\c:\s6440.exec:\s6440.exe125⤵PID:2896
-
\??\c:\vpjvj.exec:\vpjvj.exe126⤵PID:2888
-
\??\c:\48440.exec:\48440.exe127⤵PID:2220
-
\??\c:\llxfrff.exec:\llxfrff.exe128⤵PID:2328
-
\??\c:\404004.exec:\404004.exe129⤵PID:2744
-
\??\c:\frxxflr.exec:\frxxflr.exe130⤵PID:2112
-
\??\c:\lxrxlrx.exec:\lxrxlrx.exe131⤵PID:2620
-
\??\c:\4228484.exec:\4228484.exe132⤵PID:2856
-
\??\c:\m8622.exec:\m8622.exe133⤵PID:2716
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe134⤵PID:2740
-
\??\c:\a6444.exec:\a6444.exe135⤵PID:2420
-
\??\c:\dpddd.exec:\dpddd.exe136⤵PID:2640
-
\??\c:\lfrlxrx.exec:\lfrlxrx.exe137⤵PID:2132
-
\??\c:\04224.exec:\04224.exe138⤵PID:2992
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe139⤵PID:1516
-
\??\c:\86446.exec:\86446.exe140⤵PID:2912
-
\??\c:\hhbntb.exec:\hhbntb.exe141⤵PID:2464
-
\??\c:\btnbtb.exec:\btnbtb.exe142⤵PID:2820
-
\??\c:\268804.exec:\268804.exe143⤵PID:2808
-
\??\c:\7lxxxfx.exec:\7lxxxfx.exe144⤵PID:1812
-
\??\c:\1vppv.exec:\1vppv.exe145⤵PID:2060
-
\??\c:\26006.exec:\26006.exe146⤵PID:2672
-
\??\c:\86228.exec:\86228.exe147⤵PID:572
-
\??\c:\nhttbt.exec:\nhttbt.exe148⤵PID:2776
-
\??\c:\jjppv.exec:\jjppv.exe149⤵PID:2756
-
\??\c:\nbtntb.exec:\nbtntb.exe150⤵PID:1948
-
\??\c:\lflrxxf.exec:\lflrxxf.exe151⤵PID:280
-
\??\c:\3jjpp.exec:\3jjpp.exe152⤵PID:1676
-
\??\c:\4462406.exec:\4462406.exe153⤵PID:2024
-
\??\c:\604084.exec:\604084.exe154⤵PID:2016
-
\??\c:\lfxxflx.exec:\lfxxflx.exe155⤵PID:1652
-
\??\c:\8688400.exec:\8688400.exe156⤵PID:848
-
\??\c:\7jddd.exec:\7jddd.exe157⤵PID:3052
-
\??\c:\jdpjp.exec:\jdpjp.exe158⤵PID:1820
-
\??\c:\9hhnnt.exec:\9hhnnt.exe159⤵PID:1140
-
\??\c:\dvjvv.exec:\dvjvv.exe160⤵PID:1124
-
\??\c:\pvppj.exec:\pvppj.exe161⤵PID:1672
-
\??\c:\48068.exec:\48068.exe162⤵PID:2388
-
\??\c:\422802.exec:\422802.exe163⤵PID:1772
-
\??\c:\rxlxrfr.exec:\rxlxrfr.exe164⤵PID:1044
-
\??\c:\jjddp.exec:\jjddp.exe165⤵PID:3028
-
\??\c:\tnhttn.exec:\tnhttn.exe166⤵PID:1648
-
\??\c:\080688.exec:\080688.exe167⤵PID:3012
-
\??\c:\5hbbhh.exec:\5hbbhh.exe168⤵PID:2228
-
\??\c:\3hhbhh.exec:\3hhbhh.exe169⤵PID:1504
-
\??\c:\jdvvp.exec:\jdvvp.exe170⤵PID:2124
-
\??\c:\q08662.exec:\q08662.exe171⤵PID:1976
-
\??\c:\thhnbb.exec:\thhnbb.exe172⤵PID:1940
-
\??\c:\xlxrlfr.exec:\xlxrlfr.exe173⤵PID:3044
-
\??\c:\3pvvj.exec:\3pvvj.exe174⤵PID:1984
-
\??\c:\dvjdj.exec:\dvjdj.exe175⤵PID:2520
-
\??\c:\rlxllrf.exec:\rlxllrf.exe176⤵PID:2552
-
\??\c:\u640688.exec:\u640688.exe177⤵PID:2656
-
\??\c:\642406.exec:\642406.exe178⤵PID:2620
-
\??\c:\hbttbn.exec:\hbttbn.exe179⤵PID:2856
-
\??\c:\262406.exec:\262406.exe180⤵PID:2716
-
\??\c:\pdjdd.exec:\pdjdd.exe181⤵PID:2472
-
\??\c:\vpddj.exec:\vpddj.exe182⤵PID:2436
-
\??\c:\4828028.exec:\4828028.exe183⤵PID:2492
-
\??\c:\k22048.exec:\k22048.exe184⤵PID:3020
-
\??\c:\tbtnbh.exec:\tbtnbh.exe185⤵PID:2988
-
\??\c:\a8246.exec:\a8246.exe186⤵PID:1528
-
\??\c:\08680.exec:\08680.exe187⤵PID:2788
-
\??\c:\60284.exec:\60284.exe188⤵PID:2956
-
\??\c:\44202.exec:\44202.exe189⤵PID:2820
-
\??\c:\5dpvd.exec:\5dpvd.exe190⤵PID:2808
-
\??\c:\nhhbhn.exec:\nhhbhn.exe191⤵PID:644
-
\??\c:\086028.exec:\086028.exe192⤵PID:2708
-
\??\c:\8246024.exec:\8246024.exe193⤵PID:944
-
\??\c:\xrlxfrl.exec:\xrlxfrl.exe194⤵PID:2312
-
\??\c:\lfrflrl.exec:\lfrflrl.exe195⤵PID:2776
-
\??\c:\djdjv.exec:\djdjv.exe196⤵PID:2756
-
\??\c:\thtbnn.exec:\thtbnn.exe197⤵PID:1948
-
\??\c:\9xrrflx.exec:\9xrrflx.exe198⤵PID:280
-
\??\c:\lllfxfr.exec:\lllfxfr.exe199⤵PID:1676
-
\??\c:\g2628.exec:\g2628.exe200⤵PID:2408
-
\??\c:\868884.exec:\868884.exe201⤵PID:2016
-
\??\c:\pjddd.exec:\pjddd.exe202⤵PID:2052
-
\??\c:\0482068.exec:\0482068.exe203⤵PID:1756
-
\??\c:\bnnthn.exec:\bnnthn.exe204⤵PID:1512
-
\??\c:\a6884.exec:\a6884.exe205⤵PID:2008
-
\??\c:\820688.exec:\820688.exe206⤵PID:1748
-
\??\c:\lflrrrx.exec:\lflrrrx.exe207⤵PID:1296
-
\??\c:\48006.exec:\48006.exe208⤵PID:1552
-
\??\c:\1lfffxl.exec:\1lfffxl.exe209⤵PID:1400
-
\??\c:\4204044.exec:\4204044.exe210⤵PID:276
-
\??\c:\c866262.exec:\c866262.exe211⤵PID:1312
-
\??\c:\8200246.exec:\8200246.exe212⤵PID:2828
-
\??\c:\hthnbh.exec:\hthnbh.exe213⤵PID:2512
-
\??\c:\vdjjp.exec:\vdjjp.exe214⤵PID:1924
-
\??\c:\u082884.exec:\u082884.exe215⤵PID:2072
-
\??\c:\nbtthb.exec:\nbtthb.exe216⤵PID:2228
-
\??\c:\268800.exec:\268800.exe217⤵PID:1504
-
\??\c:\nttbnt.exec:\nttbnt.exe218⤵PID:2508
-
\??\c:\tntbhh.exec:\tntbhh.exe219⤵PID:2216
-
\??\c:\bhhhth.exec:\bhhhth.exe220⤵PID:2612
-
\??\c:\m2006.exec:\m2006.exe221⤵PID:2328
-
\??\c:\6860000.exec:\6860000.exe222⤵PID:2536
-
\??\c:\g4884.exec:\g4884.exe223⤵PID:2112
-
\??\c:\nbthbh.exec:\nbthbh.exe224⤵PID:3040
-
\??\c:\jdvvj.exec:\jdvvj.exe225⤵PID:2276
-
\??\c:\w06664.exec:\w06664.exe226⤵PID:2040
-
\??\c:\3lxflrx.exec:\3lxflrx.exe227⤵PID:2752
-
\??\c:\482406.exec:\482406.exe228⤵PID:2740
-
\??\c:\646062.exec:\646062.exe229⤵PID:2540
-
\??\c:\0444668.exec:\0444668.exe230⤵PID:2456
-
\??\c:\9htbhh.exec:\9htbhh.exe231⤵PID:2132
-
\??\c:\vjvvv.exec:\vjvvv.exe232⤵PID:2944
-
\??\c:\5thhnn.exec:\5thhnn.exe233⤵PID:2932
-
\??\c:\9dvpp.exec:\9dvpp.exe234⤵PID:2900
-
\??\c:\a0884.exec:\a0884.exe235⤵PID:1932
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe236⤵PID:2956
-
\??\c:\4862466.exec:\4862466.exe237⤵PID:2960
-
\??\c:\a8006.exec:\a8006.exe238⤵PID:1856
-
\??\c:\pjddj.exec:\pjddj.exe239⤵PID:688
-
\??\c:\lfxlrfl.exec:\lfxlrfl.exe240⤵PID:804
-
\??\c:\ffxxxxf.exec:\ffxxxxf.exe241⤵PID:572
-
\??\c:\04202.exec:\04202.exe242⤵PID:1788