Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 23:59
Behavioral task
behavioral1
Sample
8b5ae228086003cfcd0352e673de62ce353c9be4195b73c6734f0b3b2289bf90.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
8b5ae228086003cfcd0352e673de62ce353c9be4195b73c6734f0b3b2289bf90.exe
-
Size
465KB
-
MD5
0c05f1a050d51133c7dd8b456affa340
-
SHA1
a546d841713e92f50bbc943c106789e4f25890eb
-
SHA256
8b5ae228086003cfcd0352e673de62ce353c9be4195b73c6734f0b3b2289bf90
-
SHA512
f2a741b56af8cd957dcda14968c5ed04076680067f477d620573cf9a3c599cd058919df4b61653351bf26afac78ede131e3a8757b70b469d9ce7df55ba056fcc
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1Ve:VeR0oykayRFp3lztP+OKaf1Ve
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/1108-429-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2940-397-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1756-396-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/864-389-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2488-363-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2664-343-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2080-323-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2240-304-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/240-291-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1900-282-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2284-266-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1120-250-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1480-233-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/848-230-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2316-182-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1864-173-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2184-164-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2552-139-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2356-130-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2532-121-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2416-103-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2512-84-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2744-75-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2764-66-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2620-50-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2656-47-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1360-37-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/868-28-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2544-18-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2216-9-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1668-512-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/564-553-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1900-564-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1900-567-0x00000000003A0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3056-603-0x00000000003A0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3048-604-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2620-641-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/564-843-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2540-936-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2424-944-0x00000000001B0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1960-990-0x00000000003B0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2504-993-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2264-474-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/1132-449-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/2812-442-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/1108-429-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/1680-422-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/2940-397-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/1756-396-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/864-389-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/2520-376-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/2488-363-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/2472-350-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/2664-343-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/2080-323-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/2240-304-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/240-291-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\bnhbbn.exe UPX behavioral1/memory/1900-282-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\xlrlxlf.exe UPX \??\c:\pdddv.exe UPX behavioral1/memory/2284-266-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\hhhhtb.exe UPX behavioral1/memory/1120-250-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\vdpdp.exe UPX \??\c:\3vppd.exe UPX behavioral1/memory/1480-233-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\dppjj.exe UPX behavioral1/memory/848-230-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\3nbhbn.exe UPX \??\c:\jddpj.exe UPX \??\c:\jppvv.exe UPX \??\c:\rffffrx.exe UPX \??\c:\vjjvj.exe UPX \??\c:\nhthth.exe UPX behavioral1/memory/2316-182-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\lfxfrxr.exe UPX behavioral1/memory/1864-173-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\jpvjv.exe UPX behavioral1/memory/2184-164-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\nbnnnt.exe UPX \??\c:\jjppd.exe UPX \??\c:\hbbhbh.exe UPX behavioral1/memory/2552-139-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\llllxxx.exe UPX behavioral1/memory/2356-130-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\htnnbt.exe UPX behavioral1/memory/2532-121-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral1/memory/2532-118-0x0000000000220000-0x000000000025A000-memory.dmp UPX \??\c:\xfrrlrx.exe UPX \??\c:\pjvvj.exe UPX behavioral1/memory/2416-103-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\ntbttt.exe UPX behavioral1/memory/2924-93-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\vdpvp.exe UPX behavioral1/memory/2512-84-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\nhhhhh.exe UPX behavioral1/memory/2744-75-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\pvjvj.exe UPX behavioral1/memory/2764-66-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\xllxxrr.exe UPX behavioral1/memory/2620-50-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\5xxrxfr.exe UPX behavioral1/memory/2656-47-0x0000000000400000-0x000000000043A000-memory.dmp UPX \??\c:\bbhnhb.exe UPX behavioral1/memory/2656-38-0x0000000000400000-0x000000000043A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vjpjv.exetbnhhn.exe5rxrxfr.exebbhnhb.exe5xxrxfr.exexllxxrr.exepvjvj.exenhhhhh.exevdpvp.exentbttt.exepjvvj.exexfrrlrx.exehtnnbt.exellllxxx.exehbbhbh.exejjppd.exenbnnnt.exejpvjv.exelfxfrxr.exenhthth.exevjjvj.exerffffrx.exejppvv.exejddpj.exe3nbhbn.exedppjj.exe3vppd.exevdpdp.exehhhhtb.exepdddv.exexlrlxlf.exebnhbbn.exe1ppdd.exe3frlrfl.exebhbtnb.exevpjpj.exedjjdv.exeffxlrxx.exenttnbh.exevdvvp.exepdpvp.exexrlxfxx.exenhthtb.exevjppv.exe3djdp.exelrlffrr.exehtnbtn.exe7htttn.exedpdvv.exelfflfll.exehnhntn.exedddjv.exepdddp.exexfffxff.exethhthh.exepvvdj.exejpvjd.exerrrxxlr.exe5tbhtn.exetbtttn.exedjdvp.exerxfrrrl.exexlrllrx.exenhtnbh.exepid process 2544 vjpjv.exe 868 tbnhhn.exe 1360 5rxrxfr.exe 2656 bbhnhb.exe 2620 5xxrxfr.exe 2764 xllxxrr.exe 2744 pvjvj.exe 2512 nhhhhh.exe 2528 vdpvp.exe 2924 ntbttt.exe 2416 pjvvj.exe 2532 xfrrlrx.exe 2356 htnnbt.exe 2552 llllxxx.exe 320 hbbhbh.exe 2916 jjppd.exe 2184 nbnnnt.exe 1864 jpvjv.exe 2316 lfxfrxr.exe 1648 nhthth.exe 2040 vjjvj.exe 1604 rffffrx.exe 708 jppvv.exe 1516 jddpj.exe 848 3nbhbn.exe 1480 dppjj.exe 304 3vppd.exe 1120 vdpdp.exe 2284 hhhhtb.exe 1964 pdddv.exe 1900 xlrlxlf.exe 240 bnhbbn.exe 1712 1ppdd.exe 2240 3frlrfl.exe 2380 bhbtnb.exe 2548 vpjpj.exe 2080 djjdv.exe 868 ffxlrxx.exe 2592 nttnbh.exe 2844 vdvvp.exe 2664 pdpvp.exe 2472 xrlxfxx.exe 2488 nhthtb.exe 2732 vjppv.exe 2460 3djdp.exe 2520 lrlffrr.exe 864 htnbtn.exe 1756 7htttn.exe 2940 dpdvv.exe 2352 lfflfll.exe 2192 hnhntn.exe 1352 dddjv.exe 1680 pdddp.exe 1108 xfffxff.exe 2900 thhthh.exe 2812 pvvdj.exe 1132 jpvjd.exe 1164 rrrxxlr.exe 2148 5tbhtn.exe 1976 tbtttn.exe 2264 djdvp.exe 816 rxfrrrl.exe 1760 xlrllrx.exe 1604 nhtnbh.exe -
Processes:
resource yara_rule behavioral1/memory/2264-474-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1132-449-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2812-442-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1108-429-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1680-422-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2940-397-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1756-396-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/864-389-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2520-376-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2488-363-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2472-350-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2664-343-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2080-323-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2240-304-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/240-291-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\bnhbbn.exe upx behavioral1/memory/1900-282-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\xlrlxlf.exe upx \??\c:\pdddv.exe upx behavioral1/memory/2284-266-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\hhhhtb.exe upx behavioral1/memory/1120-250-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\vdpdp.exe upx \??\c:\3vppd.exe upx behavioral1/memory/1480-233-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\dppjj.exe upx behavioral1/memory/848-230-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\3nbhbn.exe upx \??\c:\jddpj.exe upx \??\c:\jppvv.exe upx \??\c:\rffffrx.exe upx \??\c:\vjjvj.exe upx \??\c:\nhthth.exe upx behavioral1/memory/2316-182-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\lfxfrxr.exe upx behavioral1/memory/1864-173-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\jpvjv.exe upx behavioral1/memory/2184-164-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nbnnnt.exe upx \??\c:\jjppd.exe upx \??\c:\hbbhbh.exe upx behavioral1/memory/2552-139-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\llllxxx.exe upx behavioral1/memory/2356-130-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\htnnbt.exe upx behavioral1/memory/2532-121-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2532-118-0x0000000000220000-0x000000000025A000-memory.dmp upx \??\c:\xfrrlrx.exe upx \??\c:\pjvvj.exe upx behavioral1/memory/2416-103-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\ntbttt.exe upx behavioral1/memory/2924-93-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\vdpvp.exe upx behavioral1/memory/2512-84-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nhhhhh.exe upx behavioral1/memory/2744-75-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\pvjvj.exe upx behavioral1/memory/2764-66-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\xllxxrr.exe upx behavioral1/memory/2620-50-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\5xxrxfr.exe upx behavioral1/memory/2656-47-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\bbhnhb.exe upx behavioral1/memory/2656-38-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8b5ae228086003cfcd0352e673de62ce353c9be4195b73c6734f0b3b2289bf90.exevjpjv.exetbnhhn.exe5rxrxfr.exebbhnhb.exe5xxrxfr.exexllxxrr.exepvjvj.exenhhhhh.exevdpvp.exentbttt.exepjvvj.exexfrrlrx.exehtnnbt.exellllxxx.exehbbhbh.exedescription pid process target process PID 2216 wrote to memory of 2544 2216 8b5ae228086003cfcd0352e673de62ce353c9be4195b73c6734f0b3b2289bf90.exe vjpjv.exe PID 2216 wrote to memory of 2544 2216 8b5ae228086003cfcd0352e673de62ce353c9be4195b73c6734f0b3b2289bf90.exe vjpjv.exe PID 2216 wrote to memory of 2544 2216 8b5ae228086003cfcd0352e673de62ce353c9be4195b73c6734f0b3b2289bf90.exe vjpjv.exe PID 2216 wrote to memory of 2544 2216 8b5ae228086003cfcd0352e673de62ce353c9be4195b73c6734f0b3b2289bf90.exe vjpjv.exe PID 2544 wrote to memory of 868 2544 vjpjv.exe tbnhhn.exe PID 2544 wrote to memory of 868 2544 vjpjv.exe tbnhhn.exe PID 2544 wrote to memory of 868 2544 vjpjv.exe tbnhhn.exe PID 2544 wrote to memory of 868 2544 vjpjv.exe tbnhhn.exe PID 868 wrote to memory of 1360 868 tbnhhn.exe 5rxrxfr.exe PID 868 wrote to memory of 1360 868 tbnhhn.exe 5rxrxfr.exe PID 868 wrote to memory of 1360 868 tbnhhn.exe 5rxrxfr.exe PID 868 wrote to memory of 1360 868 tbnhhn.exe 5rxrxfr.exe PID 1360 wrote to memory of 2656 1360 5rxrxfr.exe bbhnhb.exe PID 1360 wrote to memory of 2656 1360 5rxrxfr.exe bbhnhb.exe PID 1360 wrote to memory of 2656 1360 5rxrxfr.exe bbhnhb.exe PID 1360 wrote to memory of 2656 1360 5rxrxfr.exe bbhnhb.exe PID 2656 wrote to memory of 2620 2656 bbhnhb.exe 5xxrxfr.exe PID 2656 wrote to memory of 2620 2656 bbhnhb.exe 5xxrxfr.exe PID 2656 wrote to memory of 2620 2656 bbhnhb.exe 5xxrxfr.exe PID 2656 wrote to memory of 2620 2656 bbhnhb.exe 5xxrxfr.exe PID 2620 wrote to memory of 2764 2620 5xxrxfr.exe xllxxrr.exe PID 2620 wrote to memory of 2764 2620 5xxrxfr.exe xllxxrr.exe PID 2620 wrote to memory of 2764 2620 5xxrxfr.exe xllxxrr.exe PID 2620 wrote to memory of 2764 2620 5xxrxfr.exe xllxxrr.exe PID 2764 wrote to memory of 2744 2764 xllxxrr.exe pvjvj.exe PID 2764 wrote to memory of 2744 2764 xllxxrr.exe pvjvj.exe PID 2764 wrote to memory of 2744 2764 xllxxrr.exe pvjvj.exe PID 2764 wrote to memory of 2744 2764 xllxxrr.exe pvjvj.exe PID 2744 wrote to memory of 2512 2744 pvjvj.exe nhhhhh.exe PID 2744 wrote to memory of 2512 2744 pvjvj.exe nhhhhh.exe PID 2744 wrote to memory of 2512 2744 pvjvj.exe nhhhhh.exe PID 2744 wrote to memory of 2512 2744 pvjvj.exe nhhhhh.exe PID 2512 wrote to memory of 2528 2512 nhhhhh.exe vdpvp.exe PID 2512 wrote to memory of 2528 2512 nhhhhh.exe vdpvp.exe PID 2512 wrote to memory of 2528 2512 nhhhhh.exe vdpvp.exe PID 2512 wrote to memory of 2528 2512 nhhhhh.exe vdpvp.exe PID 2528 wrote to memory of 2924 2528 vdpvp.exe ntbttt.exe PID 2528 wrote to memory of 2924 2528 vdpvp.exe ntbttt.exe PID 2528 wrote to memory of 2924 2528 vdpvp.exe ntbttt.exe PID 2528 wrote to memory of 2924 2528 vdpvp.exe ntbttt.exe PID 2924 wrote to memory of 2416 2924 ntbttt.exe pjvvj.exe PID 2924 wrote to memory of 2416 2924 ntbttt.exe pjvvj.exe PID 2924 wrote to memory of 2416 2924 ntbttt.exe pjvvj.exe PID 2924 wrote to memory of 2416 2924 ntbttt.exe pjvvj.exe PID 2416 wrote to memory of 2532 2416 pjvvj.exe xfrrlrx.exe PID 2416 wrote to memory of 2532 2416 pjvvj.exe xfrrlrx.exe PID 2416 wrote to memory of 2532 2416 pjvvj.exe xfrrlrx.exe PID 2416 wrote to memory of 2532 2416 pjvvj.exe xfrrlrx.exe PID 2532 wrote to memory of 2356 2532 xfrrlrx.exe htnnbt.exe PID 2532 wrote to memory of 2356 2532 xfrrlrx.exe htnnbt.exe PID 2532 wrote to memory of 2356 2532 xfrrlrx.exe htnnbt.exe PID 2532 wrote to memory of 2356 2532 xfrrlrx.exe htnnbt.exe PID 2356 wrote to memory of 2552 2356 htnnbt.exe llllxxx.exe PID 2356 wrote to memory of 2552 2356 htnnbt.exe llllxxx.exe PID 2356 wrote to memory of 2552 2356 htnnbt.exe llllxxx.exe PID 2356 wrote to memory of 2552 2356 htnnbt.exe llllxxx.exe PID 2552 wrote to memory of 320 2552 llllxxx.exe hbbhbh.exe PID 2552 wrote to memory of 320 2552 llllxxx.exe hbbhbh.exe PID 2552 wrote to memory of 320 2552 llllxxx.exe hbbhbh.exe PID 2552 wrote to memory of 320 2552 llllxxx.exe hbbhbh.exe PID 320 wrote to memory of 2916 320 hbbhbh.exe jjppd.exe PID 320 wrote to memory of 2916 320 hbbhbh.exe jjppd.exe PID 320 wrote to memory of 2916 320 hbbhbh.exe jjppd.exe PID 320 wrote to memory of 2916 320 hbbhbh.exe jjppd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b5ae228086003cfcd0352e673de62ce353c9be4195b73c6734f0b3b2289bf90.exe"C:\Users\Admin\AppData\Local\Temp\8b5ae228086003cfcd0352e673de62ce353c9be4195b73c6734f0b3b2289bf90.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vjpjv.exec:\vjpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbnhhn.exec:\tbnhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5rxrxfr.exec:\5rxrxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhnhb.exec:\bbhnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xxrxfr.exec:\5xxrxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xllxxrr.exec:\xllxxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvjvj.exec:\pvjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhhhh.exec:\nhhhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdpvp.exec:\vdpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntbttt.exec:\ntbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvvj.exec:\pjvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfrrlrx.exec:\xfrrlrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnnbt.exec:\htnnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llllxxx.exec:\llllxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbhbh.exec:\hbbhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjppd.exec:\jjppd.exe17⤵
- Executes dropped EXE
-
\??\c:\nbnnnt.exec:\nbnnnt.exe18⤵
- Executes dropped EXE
-
\??\c:\jpvjv.exec:\jpvjv.exe19⤵
- Executes dropped EXE
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe20⤵
- Executes dropped EXE
-
\??\c:\nhthth.exec:\nhthth.exe21⤵
- Executes dropped EXE
-
\??\c:\vjjvj.exec:\vjjvj.exe22⤵
- Executes dropped EXE
-
\??\c:\rffffrx.exec:\rffffrx.exe23⤵
- Executes dropped EXE
-
\??\c:\jppvv.exec:\jppvv.exe24⤵
- Executes dropped EXE
-
\??\c:\jddpj.exec:\jddpj.exe25⤵
- Executes dropped EXE
-
\??\c:\3nbhbn.exec:\3nbhbn.exe26⤵
- Executes dropped EXE
-
\??\c:\dppjj.exec:\dppjj.exe27⤵
- Executes dropped EXE
-
\??\c:\3vppd.exec:\3vppd.exe28⤵
- Executes dropped EXE
-
\??\c:\vdpdp.exec:\vdpdp.exe29⤵
- Executes dropped EXE
-
\??\c:\hhhhtb.exec:\hhhhtb.exe30⤵
- Executes dropped EXE
-
\??\c:\pdddv.exec:\pdddv.exe31⤵
- Executes dropped EXE
-
\??\c:\xlrlxlf.exec:\xlrlxlf.exe32⤵
- Executes dropped EXE
-
\??\c:\bnhbbn.exec:\bnhbbn.exe33⤵
- Executes dropped EXE
-
\??\c:\1ppdd.exec:\1ppdd.exe34⤵
- Executes dropped EXE
-
\??\c:\3frlrfl.exec:\3frlrfl.exe35⤵
- Executes dropped EXE
-
\??\c:\bhbtnb.exec:\bhbtnb.exe36⤵
- Executes dropped EXE
-
\??\c:\vpjpj.exec:\vpjpj.exe37⤵
- Executes dropped EXE
-
\??\c:\djjdv.exec:\djjdv.exe38⤵
- Executes dropped EXE
-
\??\c:\ffxlrxx.exec:\ffxlrxx.exe39⤵
- Executes dropped EXE
-
\??\c:\nttnbh.exec:\nttnbh.exe40⤵
- Executes dropped EXE
-
\??\c:\vdvvp.exec:\vdvvp.exe41⤵
- Executes dropped EXE
-
\??\c:\pdpvp.exec:\pdpvp.exe42⤵
- Executes dropped EXE
-
\??\c:\xrlxfxx.exec:\xrlxfxx.exe43⤵
- Executes dropped EXE
-
\??\c:\nhthtb.exec:\nhthtb.exe44⤵
- Executes dropped EXE
-
\??\c:\vjppv.exec:\vjppv.exe45⤵
- Executes dropped EXE
-
\??\c:\3djdp.exec:\3djdp.exe46⤵
- Executes dropped EXE
-
\??\c:\lrlffrr.exec:\lrlffrr.exe47⤵
- Executes dropped EXE
-
\??\c:\htnbtn.exec:\htnbtn.exe48⤵
- Executes dropped EXE
-
\??\c:\7htttn.exec:\7htttn.exe49⤵
- Executes dropped EXE
-
\??\c:\dpdvv.exec:\dpdvv.exe50⤵
- Executes dropped EXE
-
\??\c:\lfflfll.exec:\lfflfll.exe51⤵
- Executes dropped EXE
-
\??\c:\hnhntn.exec:\hnhntn.exe52⤵
- Executes dropped EXE
-
\??\c:\dddjv.exec:\dddjv.exe53⤵
- Executes dropped EXE
-
\??\c:\pdddp.exec:\pdddp.exe54⤵
- Executes dropped EXE
-
\??\c:\xfffxff.exec:\xfffxff.exe55⤵
- Executes dropped EXE
-
\??\c:\thhthh.exec:\thhthh.exe56⤵
- Executes dropped EXE
-
\??\c:\pvvdj.exec:\pvvdj.exe57⤵
- Executes dropped EXE
-
\??\c:\jpvjd.exec:\jpvjd.exe58⤵
- Executes dropped EXE
-
\??\c:\rrrxxlr.exec:\rrrxxlr.exe59⤵
- Executes dropped EXE
-
\??\c:\5tbhtn.exec:\5tbhtn.exe60⤵
- Executes dropped EXE
-
\??\c:\tbtttn.exec:\tbtttn.exe61⤵
- Executes dropped EXE
-
\??\c:\djdvp.exec:\djdvp.exe62⤵
- Executes dropped EXE
-
\??\c:\rxfrrrl.exec:\rxfrrrl.exe63⤵
- Executes dropped EXE
-
\??\c:\xlrllrx.exec:\xlrllrx.exe64⤵
- Executes dropped EXE
-
\??\c:\nhtnbh.exec:\nhtnbh.exe65⤵
- Executes dropped EXE
-
\??\c:\pvvjp.exec:\pvvjp.exe66⤵
-
\??\c:\rfrrxlx.exec:\rfrrxlx.exe67⤵
-
\??\c:\tbbnnb.exec:\tbbnnb.exe68⤵
-
\??\c:\bhnhht.exec:\bhnhht.exe69⤵
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe70⤵
-
\??\c:\5tbbhn.exec:\5tbbhn.exe71⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe72⤵
-
\??\c:\7lfrxfl.exec:\7lfrxfl.exe73⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe74⤵
-
\??\c:\rlxxxrr.exec:\rlxxxrr.exe75⤵
-
\??\c:\3nnnnh.exec:\3nnnnh.exe76⤵
-
\??\c:\nbhbtb.exec:\nbhbtb.exe77⤵
-
\??\c:\rxflxlf.exec:\rxflxlf.exe78⤵
-
\??\c:\hnbnbn.exec:\hnbnbn.exe79⤵
-
\??\c:\xffxlrl.exec:\xffxlrl.exe80⤵
-
\??\c:\ttbbbn.exec:\ttbbbn.exe81⤵
-
\??\c:\xfrrffl.exec:\xfrrffl.exe82⤵
-
\??\c:\thtbnt.exec:\thtbnt.exe83⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe84⤵
-
\??\c:\rxxrfxf.exec:\rxxrfxf.exe85⤵
-
\??\c:\3htbnb.exec:\3htbnb.exe86⤵
-
\??\c:\3pvpd.exec:\3pvpd.exe87⤵
-
\??\c:\9lrrrxf.exec:\9lrrrxf.exe88⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe89⤵
-
\??\c:\xxfxlrr.exec:\xxfxlrr.exe90⤵
-
\??\c:\thnbbn.exec:\thnbbn.exe91⤵
-
\??\c:\vdjdp.exec:\vdjdp.exe92⤵
-
\??\c:\xxrrrxl.exec:\xxrrrxl.exe93⤵
-
\??\c:\pddjp.exec:\pddjp.exe94⤵
-
\??\c:\frxxllr.exec:\frxxllr.exe95⤵
-
\??\c:\bbhbbb.exec:\bbhbbb.exe96⤵
-
\??\c:\dpjjp.exec:\dpjjp.exe97⤵
-
\??\c:\lxrlxff.exec:\lxrlxff.exe98⤵
-
\??\c:\nbnhhb.exec:\nbnhhb.exe99⤵
-
\??\c:\vdpjd.exec:\vdpjd.exe100⤵
-
\??\c:\flxxxfl.exec:\flxxxfl.exe101⤵
-
\??\c:\3bbttn.exec:\3bbttn.exe102⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe103⤵
-
\??\c:\hbnhnh.exec:\hbnhnh.exe104⤵
-
\??\c:\rfrllfx.exec:\rfrllfx.exe105⤵
-
\??\c:\hbbnht.exec:\hbbnht.exe106⤵
-
\??\c:\lrlffxr.exec:\lrlffxr.exe107⤵
-
\??\c:\fffxrxx.exec:\fffxrxx.exe108⤵
-
\??\c:\hbbhtb.exec:\hbbhtb.exe109⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe110⤵
-
\??\c:\pvvvv.exec:\pvvvv.exe111⤵
-
\??\c:\5xfrxlx.exec:\5xfrxlx.exe112⤵
-
\??\c:\hbbnbh.exec:\hbbnbh.exe113⤵
-
\??\c:\jjpdd.exec:\jjpdd.exe114⤵
-
\??\c:\llfrxxr.exec:\llfrxxr.exe115⤵
-
\??\c:\ttnbnb.exec:\ttnbnb.exe116⤵
-
\??\c:\bhbntb.exec:\bhbntb.exe117⤵
-
\??\c:\vjvdv.exec:\vjvdv.exe118⤵
-
\??\c:\5rrrrxr.exec:\5rrrrxr.exe119⤵
-
\??\c:\1hhtnh.exec:\1hhtnh.exe120⤵
-
\??\c:\jvdpj.exec:\jvdpj.exe121⤵
-
\??\c:\xrxffrf.exec:\xrxffrf.exe122⤵
-
\??\c:\hnhhth.exec:\hnhhth.exe123⤵
-
\??\c:\djvpv.exec:\djvpv.exe124⤵
-
\??\c:\jvjpj.exec:\jvjpj.exe125⤵
-
\??\c:\lrrlflf.exec:\lrrlflf.exe126⤵
-
\??\c:\3bnnbn.exec:\3bnnbn.exe127⤵
-
\??\c:\vppdv.exec:\vppdv.exe128⤵
-
\??\c:\flxffxl.exec:\flxffxl.exe129⤵
-
\??\c:\nbnbth.exec:\nbnbth.exe130⤵
-
\??\c:\pdjvd.exec:\pdjvd.exe131⤵
-
\??\c:\vpdvd.exec:\vpdvd.exe132⤵
-
\??\c:\llfrxlr.exec:\llfrxlr.exe133⤵
-
\??\c:\btbtbn.exec:\btbtbn.exe134⤵
-
\??\c:\7jpjj.exec:\7jpjj.exe135⤵
-
\??\c:\rllxrrr.exec:\rllxrrr.exe136⤵
-
\??\c:\btthbh.exec:\btthbh.exe137⤵
-
\??\c:\ddddv.exec:\ddddv.exe138⤵
-
\??\c:\dddpj.exec:\dddpj.exe139⤵
-
\??\c:\7flxxll.exec:\7flxxll.exe140⤵
-
\??\c:\thnttt.exec:\thnttt.exe141⤵
-
\??\c:\3pvdd.exec:\3pvdd.exe142⤵
-
\??\c:\frrffxx.exec:\frrffxx.exe143⤵
-
\??\c:\bntnnb.exec:\bntnnb.exe144⤵
-
\??\c:\vdjpj.exec:\vdjpj.exe145⤵
-
\??\c:\xlfrlrl.exec:\xlfrlrl.exe146⤵
-
\??\c:\tthhth.exec:\tthhth.exe147⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe148⤵
-
\??\c:\fxxrrfx.exec:\fxxrrfx.exe149⤵
-
\??\c:\hntbhb.exec:\hntbhb.exe150⤵
-
\??\c:\3nthbn.exec:\3nthbn.exe151⤵
-
\??\c:\dppjj.exec:\dppjj.exe152⤵
-
\??\c:\xlllfrl.exec:\xlllfrl.exe153⤵
-
\??\c:\nbthnb.exec:\nbthnb.exe154⤵
-
\??\c:\dvvvj.exec:\dvvvj.exe155⤵
-
\??\c:\7vppd.exec:\7vppd.exe156⤵
-
\??\c:\xxrxfxl.exec:\xxrxfxl.exe157⤵
-
\??\c:\bbthbh.exec:\bbthbh.exe158⤵
-
\??\c:\bntbbb.exec:\bntbbb.exe159⤵
-
\??\c:\pvjdv.exec:\pvjdv.exe160⤵
-
\??\c:\rrflxfl.exec:\rrflxfl.exe161⤵
-
\??\c:\bhtbbt.exec:\bhtbbt.exe162⤵
-
\??\c:\bbnnbn.exec:\bbnnbn.exe163⤵
-
\??\c:\vjjpd.exec:\vjjpd.exe164⤵
-
\??\c:\flrrlxr.exec:\flrrlxr.exe165⤵
-
\??\c:\nntthh.exec:\nntthh.exe166⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe167⤵
-
\??\c:\rlrxxrf.exec:\rlrxxrf.exe168⤵
-
\??\c:\nbnbbb.exec:\nbnbbb.exe169⤵
-
\??\c:\jppvp.exec:\jppvp.exe170⤵
-
\??\c:\flfrlrx.exec:\flfrlrx.exe171⤵
-
\??\c:\bntbth.exec:\bntbth.exe172⤵
-
\??\c:\nhttbt.exec:\nhttbt.exe173⤵
-
\??\c:\jpjpj.exec:\jpjpj.exe174⤵
-
\??\c:\lxrlrrr.exec:\lxrlrrr.exe175⤵
-
\??\c:\hnbhtt.exec:\hnbhtt.exe176⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe177⤵
-
\??\c:\rffrrll.exec:\rffrrll.exe178⤵
-
\??\c:\rxxlfrl.exec:\rxxlfrl.exe179⤵
-
\??\c:\htnnnn.exec:\htnnnn.exe180⤵
-
\??\c:\9dvdv.exec:\9dvdv.exe181⤵
-
\??\c:\flrfxff.exec:\flrfxff.exe182⤵
-
\??\c:\tbhbnh.exec:\tbhbnh.exe183⤵
-
\??\c:\7dvpj.exec:\7dvpj.exe184⤵
-
\??\c:\lxrrxrl.exec:\lxrrxrl.exe185⤵
-
\??\c:\hthhtt.exec:\hthhtt.exe186⤵
-
\??\c:\jpdpd.exec:\jpdpd.exe187⤵
-
\??\c:\lxxxxfx.exec:\lxxxxfx.exe188⤵
-
\??\c:\rxlrflx.exec:\rxlrflx.exe189⤵
-
\??\c:\bttbbt.exec:\bttbbt.exe190⤵
-
\??\c:\ppvdp.exec:\ppvdp.exe191⤵
-
\??\c:\1rlxlrl.exec:\1rlxlrl.exe192⤵
-
\??\c:\htnhth.exec:\htnhth.exe193⤵
-
\??\c:\pvjpj.exec:\pvjpj.exe194⤵
-
\??\c:\xrlxfll.exec:\xrlxfll.exe195⤵
-
\??\c:\hbbtbb.exec:\hbbtbb.exe196⤵
-
\??\c:\7ppvj.exec:\7ppvj.exe197⤵
-
\??\c:\jvjjp.exec:\jvjjp.exe198⤵
-
\??\c:\rrxffxl.exec:\rrxffxl.exe199⤵
-
\??\c:\bnthnt.exec:\bnthnt.exe200⤵
-
\??\c:\7djvj.exec:\7djvj.exe201⤵
-
\??\c:\rlllfxl.exec:\rlllfxl.exe202⤵
-
\??\c:\hthhnn.exec:\hthhnn.exe203⤵
-
\??\c:\bthtnb.exec:\bthtnb.exe204⤵
-
\??\c:\9dvdv.exec:\9dvdv.exe205⤵
-
\??\c:\lrrrffr.exec:\lrrrffr.exe206⤵
-
\??\c:\9bbbhh.exec:\9bbbhh.exe207⤵
-
\??\c:\bhbnbh.exec:\bhbnbh.exe208⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe209⤵
-
\??\c:\9xfxrff.exec:\9xfxrff.exe210⤵
-
\??\c:\ttbtth.exec:\ttbtth.exe211⤵
-
\??\c:\dpvvj.exec:\dpvvj.exe212⤵
-
\??\c:\fflllrl.exec:\fflllrl.exe213⤵
-
\??\c:\lfxrfxl.exec:\lfxrfxl.exe214⤵
-
\??\c:\nhhtnn.exec:\nhhtnn.exe215⤵
-
\??\c:\ddvjp.exec:\ddvjp.exe216⤵
-
\??\c:\lffllfl.exec:\lffllfl.exe217⤵
-
\??\c:\flfxxfl.exec:\flfxxfl.exe218⤵
-
\??\c:\3ttthn.exec:\3ttthn.exe219⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe220⤵
-
\??\c:\ffffrxf.exec:\ffffrxf.exe221⤵
-
\??\c:\tbbthh.exec:\tbbthh.exe222⤵
-
\??\c:\pppdv.exec:\pppdv.exe223⤵
-
\??\c:\llffrxf.exec:\llffrxf.exe224⤵
-
\??\c:\tnbbbn.exec:\tnbbbn.exe225⤵
-
\??\c:\jvjpj.exec:\jvjpj.exe226⤵
-
\??\c:\vdjdd.exec:\vdjdd.exe227⤵
-
\??\c:\lrrrrfl.exec:\lrrrrfl.exe228⤵
-
\??\c:\nhttbn.exec:\nhttbn.exe229⤵
-
\??\c:\3jddd.exec:\3jddd.exe230⤵
-
\??\c:\frlfffl.exec:\frlfffl.exe231⤵
-
\??\c:\hbhbnb.exec:\hbhbnb.exe232⤵
-
\??\c:\frfxffr.exec:\frfxffr.exe233⤵
-
\??\c:\hhtnhb.exec:\hhtnhb.exe234⤵
-
\??\c:\pddjv.exec:\pddjv.exe235⤵
-
\??\c:\vdjdp.exec:\vdjdp.exe236⤵
-
\??\c:\lrxlxrl.exec:\lrxlxrl.exe237⤵
-
\??\c:\9ttnbn.exec:\9ttnbn.exe238⤵
-
\??\c:\pdddd.exec:\pdddd.exe239⤵
-
\??\c:\rfxxfxf.exec:\rfxxfxf.exe240⤵
-
\??\c:\ntnbth.exec:\ntnbth.exe241⤵