Analysis
-
max time kernel
8s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 00:41
Behavioral task
behavioral1
Sample
9de86d6bd0da9db94bf9811578abc9cae528ede4a080052e466d53a32674af83.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
9de86d6bd0da9db94bf9811578abc9cae528ede4a080052e466d53a32674af83.exe
-
Size
228KB
-
MD5
f7f99f4c0b59de345267246008d4afc1
-
SHA1
33dd9ab34f026c1ba58dd85b84ac1558846d5132
-
SHA256
9de86d6bd0da9db94bf9811578abc9cae528ede4a080052e466d53a32674af83
-
SHA512
f898830e571c410922deb65c222e09dd8cafba0960f761b66fc264479a913fc83c904ff4ea142d88e72b90fcc98f91ffefb4c8c0b14cf40e5ff11993b4bbae38
-
SSDEEP
6144:Jcm4FmowdHoS3dGmS4Z1hraHcpOaKHpaztyzl+Sj:T4wFHoS3dJS4ZzeFaKHpCcz
Malware Config
Signatures
-
Detect Blackmoon payload 54 IoCs
Processes:
resource yara_rule behavioral1/memory/1620-11-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1220-9-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2504-19-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2504-28-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2584-31-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2500-46-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2928-59-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2536-57-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2424-77-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1348-92-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2676-103-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2676-100-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1616-112-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1588-128-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1896-130-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1416-146-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/3056-182-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2856-194-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2244-205-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1044-213-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1044-212-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2036-230-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1452-255-0x00000000002D0000-0x0000000000305000-memory.dmp family_blackmoon behavioral1/memory/1452-254-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/3048-285-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/3048-281-0x00000000003A0000-0x00000000003D5000-memory.dmp family_blackmoon behavioral1/memory/2904-301-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2236-330-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2236-329-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/3016-333-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2812-343-0x00000000001B0000-0x00000000001E5000-memory.dmp family_blackmoon behavioral1/memory/2812-347-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1508-345-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1508-352-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2228-367-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2360-392-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2360-399-0x00000000002F0000-0x0000000000325000-memory.dmp family_blackmoon behavioral1/memory/2680-412-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1776-426-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2152-441-0x00000000002A0000-0x00000000002D5000-memory.dmp family_blackmoon behavioral1/memory/2152-440-0x00000000002A0000-0x00000000002D5000-memory.dmp family_blackmoon behavioral1/memory/2360-439-0x00000000002F0000-0x0000000000325000-memory.dmp family_blackmoon behavioral1/memory/780-462-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/852-470-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2744-484-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/900-498-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2208-532-0x0000000000250000-0x0000000000285000-memory.dmp family_blackmoon behavioral1/memory/1988-539-0x00000000003B0000-0x00000000003E5000-memory.dmp family_blackmoon behavioral1/memory/360-546-0x00000000002A0000-0x00000000002D5000-memory.dmp family_blackmoon behavioral1/memory/1744-560-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2924-567-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1636-603-0x00000000002D0000-0x0000000000305000-memory.dmp family_blackmoon behavioral1/memory/2468-652-0x00000000003A0000-0x00000000003D5000-memory.dmp family_blackmoon behavioral1/memory/2716-665-0x00000000002C0000-0x00000000002F5000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1220-0-0x0000000000400000-0x0000000000435000-memory.dmp UPX C:\664002.exe UPX behavioral1/memory/1620-11-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1220-9-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2504-19-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2504-28-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2584-31-0x0000000000400000-0x0000000000435000-memory.dmp UPX \??\c:\0408062.exe UPX C:\0426408.exe UPX C:\4680400.exe UPX behavioral1/memory/2500-46-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2500-38-0x0000000000400000-0x0000000000435000-memory.dmp UPX \??\c:\ppjjp.exe UPX \??\c:\2646846.exe UPX behavioral1/memory/2928-59-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2536-57-0x0000000000400000-0x0000000000435000-memory.dmp UPX C:\04402.exe UPX \??\c:\8242204.exe UPX behavioral1/memory/2424-77-0x0000000000400000-0x0000000000435000-memory.dmp UPX C:\608466.exe UPX \??\c:\88686.exe UPX behavioral1/memory/1348-92-0x0000000000400000-0x0000000000435000-memory.dmp UPX C:\282486.exe UPX behavioral1/memory/2676-103-0x0000000000400000-0x0000000000435000-memory.dmp UPX \??\c:\tttnht.exe UPX behavioral1/memory/1616-112-0x0000000000400000-0x0000000000435000-memory.dmp UPX C:\nntnnt.exe UPX behavioral1/memory/1588-128-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1896-130-0x0000000000400000-0x0000000000435000-memory.dmp UPX C:\jpjdv.exe UPX \??\c:\jppdp.exe UPX C:\nnthhn.exe UPX behavioral1/memory/1416-146-0x0000000000400000-0x0000000000435000-memory.dmp UPX C:\jjjdd.exe UPX \??\c:\62244.exe UPX C:\46648.exe UPX C:\lxxlxxx.exe UPX behavioral1/memory/3056-182-0x0000000000400000-0x0000000000435000-memory.dmp UPX C:\028286.exe UPX behavioral1/memory/2244-192-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2856-194-0x0000000000400000-0x0000000000435000-memory.dmp UPX C:\nnthht.exe UPX behavioral1/memory/2244-205-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1044-212-0x0000000000400000-0x0000000000435000-memory.dmp UPX C:\0028624.exe UPX \??\c:\hbtbnn.exe UPX C:\60886.exe UPX C:\4206840.exe UPX C:\flrlxlf.exe UPX C:\8682826.exe UPX behavioral1/memory/1452-254-0x0000000000400000-0x0000000000435000-memory.dmp UPX \??\c:\5nhbbb.exe UPX C:\084028.exe UPX behavioral1/memory/3048-274-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/3048-285-0x0000000000400000-0x0000000000435000-memory.dmp UPX C:\7lfffxl.exe UPX C:\82062.exe UPX behavioral1/memory/2904-301-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2916-310-0x00000000003A0000-0x00000000003D5000-memory.dmp UPX behavioral1/memory/2236-330-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2812-347-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/1508-345-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2228-367-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral1/memory/2360-392-0x0000000000400000-0x0000000000435000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
664002.exeppjjp.exe0408062.exe0426408.exe4680400.exe2646846.exe04402.exe8242204.exe608466.exe88686.exe282486.exetttnht.exenntnnt.exejppdp.exejpjdv.exennthhn.exejjjdd.exe62244.exe46648.exelxxlxxx.exe028286.exennthht.exe0028624.exehbtbnn.exe60886.exe4206840.exeflrlxlf.exe8682826.exe5nhbbb.exe084028.exe7lfffxl.exe82062.exeg6888.exedjjpj.exe2428684.exe40682.exe60402.exefrxxfff.exe7pppj.exennthbh.exeppvjv.exevpjdp.exe80402.exe04460.exe4484246.exehnbhnn.exe0428002.exe9bnnbh.exepvpvj.exe222028.exepvddd.exerllxlxx.exew20488.exerflflrx.exetbtbnt.exe0604460.exe0648468.exefllllfr.exe6026484.exe4202060.exe1fxfxfl.exe06464.exe2684446.exe664466.exepid process 1620 664002.exe 2504 ppjjp.exe 2584 0408062.exe 2500 0426408.exe 2536 4680400.exe 2928 2646846.exe 2876 04402.exe 2424 8242204.exe 1348 608466.exe 2676 88686.exe 2720 282486.exe 1616 tttnht.exe 1896 nntnnt.exe 1588 jppdp.exe 1416 jpjdv.exe 592 nnthhn.exe 1684 jjjdd.exe 1260 62244.exe 3056 46648.exe 2856 lxxlxxx.exe 2244 028286.exe 1044 nnthht.exe 1788 0028624.exe 2036 hbtbnn.exe 1164 60886.exe 1680 4206840.exe 1452 flrlxlf.exe 1796 8682826.exe 1232 5nhbbb.exe 3048 084028.exe 1860 7lfffxl.exe 2904 82062.exe 1548 g6888.exe 2916 djjpj.exe 2460 2428684.exe 2236 40682.exe 3016 60402.exe 2812 frxxfff.exe 1508 7pppj.exe 2800 nnthbh.exe 2228 ppvjv.exe 2724 vpjdp.exe 2452 80402.exe 2080 04460.exe 2880 4484246.exe 2360 hnbhnn.exe 1840 0428002.exe 2680 9bnnbh.exe 1540 pvpvj.exe 1776 222028.exe 1800 pvddd.exe 2152 rllxlxx.exe 2172 w20488.exe 1016 rflflrx.exe 780 tbtbnt.exe 852 0604460.exe 2760 0648468.exe 2744 fllllfr.exe 2888 6026484.exe 900 4202060.exe 2224 1fxfxfl.exe 1664 06464.exe 2244 2684446.exe 1276 664466.exe -
Processes:
resource yara_rule behavioral1/memory/1220-0-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\664002.exe upx behavioral1/memory/1620-11-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1220-9-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2504-19-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2504-28-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2584-31-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\0408062.exe upx C:\0426408.exe upx C:\4680400.exe upx behavioral1/memory/2500-46-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2500-38-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\ppjjp.exe upx \??\c:\2646846.exe upx behavioral1/memory/2928-59-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2536-57-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\04402.exe upx \??\c:\8242204.exe upx behavioral1/memory/2424-77-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\608466.exe upx \??\c:\88686.exe upx behavioral1/memory/1348-92-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\282486.exe upx behavioral1/memory/2676-103-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\tttnht.exe upx behavioral1/memory/1616-112-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\nntnnt.exe upx behavioral1/memory/1588-128-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1896-130-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\jpjdv.exe upx \??\c:\jppdp.exe upx C:\nnthhn.exe upx behavioral1/memory/1416-146-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\jjjdd.exe upx \??\c:\62244.exe upx C:\46648.exe upx C:\lxxlxxx.exe upx behavioral1/memory/3056-182-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\028286.exe upx behavioral1/memory/2244-192-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2856-194-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\nnthht.exe upx behavioral1/memory/2244-205-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1044-212-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\0028624.exe upx \??\c:\hbtbnn.exe upx C:\60886.exe upx C:\4206840.exe upx C:\flrlxlf.exe upx C:\8682826.exe upx behavioral1/memory/1452-254-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\5nhbbb.exe upx C:\084028.exe upx behavioral1/memory/3048-274-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3048-285-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\7lfffxl.exe upx C:\82062.exe upx behavioral1/memory/2904-301-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2916-310-0x00000000003A0000-0x00000000003D5000-memory.dmp upx behavioral1/memory/2236-330-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2812-347-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1508-345-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2228-367-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2360-392-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9de86d6bd0da9db94bf9811578abc9cae528ede4a080052e466d53a32674af83.exe664002.exeppjjp.exe0408062.exe0426408.exe4680400.exe2646846.exe04402.exe8242204.exe608466.exe88686.exe282486.exetttnht.exenntnnt.exejppdp.exejpjdv.exedescription pid process target process PID 1220 wrote to memory of 1620 1220 9de86d6bd0da9db94bf9811578abc9cae528ede4a080052e466d53a32674af83.exe 664002.exe PID 1220 wrote to memory of 1620 1220 9de86d6bd0da9db94bf9811578abc9cae528ede4a080052e466d53a32674af83.exe 664002.exe PID 1220 wrote to memory of 1620 1220 9de86d6bd0da9db94bf9811578abc9cae528ede4a080052e466d53a32674af83.exe 664002.exe PID 1220 wrote to memory of 1620 1220 9de86d6bd0da9db94bf9811578abc9cae528ede4a080052e466d53a32674af83.exe 664002.exe PID 1620 wrote to memory of 2504 1620 664002.exe ppjjp.exe PID 1620 wrote to memory of 2504 1620 664002.exe ppjjp.exe PID 1620 wrote to memory of 2504 1620 664002.exe ppjjp.exe PID 1620 wrote to memory of 2504 1620 664002.exe ppjjp.exe PID 2504 wrote to memory of 2584 2504 ppjjp.exe 0408062.exe PID 2504 wrote to memory of 2584 2504 ppjjp.exe 0408062.exe PID 2504 wrote to memory of 2584 2504 ppjjp.exe 0408062.exe PID 2504 wrote to memory of 2584 2504 ppjjp.exe 0408062.exe PID 2584 wrote to memory of 2500 2584 0408062.exe 0426408.exe PID 2584 wrote to memory of 2500 2584 0408062.exe 0426408.exe PID 2584 wrote to memory of 2500 2584 0408062.exe 0426408.exe PID 2584 wrote to memory of 2500 2584 0408062.exe 0426408.exe PID 2500 wrote to memory of 2536 2500 0426408.exe 4680400.exe PID 2500 wrote to memory of 2536 2500 0426408.exe 4680400.exe PID 2500 wrote to memory of 2536 2500 0426408.exe 4680400.exe PID 2500 wrote to memory of 2536 2500 0426408.exe 4680400.exe PID 2536 wrote to memory of 2928 2536 4680400.exe 2646846.exe PID 2536 wrote to memory of 2928 2536 4680400.exe 2646846.exe PID 2536 wrote to memory of 2928 2536 4680400.exe 2646846.exe PID 2536 wrote to memory of 2928 2536 4680400.exe 2646846.exe PID 2928 wrote to memory of 2876 2928 2646846.exe 04402.exe PID 2928 wrote to memory of 2876 2928 2646846.exe 04402.exe PID 2928 wrote to memory of 2876 2928 2646846.exe 04402.exe PID 2928 wrote to memory of 2876 2928 2646846.exe 04402.exe PID 2876 wrote to memory of 2424 2876 04402.exe 8242204.exe PID 2876 wrote to memory of 2424 2876 04402.exe 8242204.exe PID 2876 wrote to memory of 2424 2876 04402.exe 8242204.exe PID 2876 wrote to memory of 2424 2876 04402.exe 8242204.exe PID 2424 wrote to memory of 1348 2424 8242204.exe jjdvd.exe PID 2424 wrote to memory of 1348 2424 8242204.exe jjdvd.exe PID 2424 wrote to memory of 1348 2424 8242204.exe jjdvd.exe PID 2424 wrote to memory of 1348 2424 8242204.exe jjdvd.exe PID 1348 wrote to memory of 2676 1348 608466.exe 88686.exe PID 1348 wrote to memory of 2676 1348 608466.exe 88686.exe PID 1348 wrote to memory of 2676 1348 608466.exe 88686.exe PID 1348 wrote to memory of 2676 1348 608466.exe 88686.exe PID 2676 wrote to memory of 2720 2676 88686.exe 282486.exe PID 2676 wrote to memory of 2720 2676 88686.exe 282486.exe PID 2676 wrote to memory of 2720 2676 88686.exe 282486.exe PID 2676 wrote to memory of 2720 2676 88686.exe 282486.exe PID 2720 wrote to memory of 1616 2720 282486.exe tttnht.exe PID 2720 wrote to memory of 1616 2720 282486.exe tttnht.exe PID 2720 wrote to memory of 1616 2720 282486.exe tttnht.exe PID 2720 wrote to memory of 1616 2720 282486.exe tttnht.exe PID 1616 wrote to memory of 1896 1616 tttnht.exe 0606808.exe PID 1616 wrote to memory of 1896 1616 tttnht.exe 0606808.exe PID 1616 wrote to memory of 1896 1616 tttnht.exe 0606808.exe PID 1616 wrote to memory of 1896 1616 tttnht.exe 0606808.exe PID 1896 wrote to memory of 1588 1896 nntnnt.exe 3frrlll.exe PID 1896 wrote to memory of 1588 1896 nntnnt.exe 3frrlll.exe PID 1896 wrote to memory of 1588 1896 nntnnt.exe 3frrlll.exe PID 1896 wrote to memory of 1588 1896 nntnnt.exe 3frrlll.exe PID 1588 wrote to memory of 1416 1588 jppdp.exe 00482.exe PID 1588 wrote to memory of 1416 1588 jppdp.exe 00482.exe PID 1588 wrote to memory of 1416 1588 jppdp.exe 00482.exe PID 1588 wrote to memory of 1416 1588 jppdp.exe 00482.exe PID 1416 wrote to memory of 592 1416 jpjdv.exe dvddj.exe PID 1416 wrote to memory of 592 1416 jpjdv.exe dvddj.exe PID 1416 wrote to memory of 592 1416 jpjdv.exe dvddj.exe PID 1416 wrote to memory of 592 1416 jpjdv.exe dvddj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9de86d6bd0da9db94bf9811578abc9cae528ede4a080052e466d53a32674af83.exe"C:\Users\Admin\AppData\Local\Temp\9de86d6bd0da9db94bf9811578abc9cae528ede4a080052e466d53a32674af83.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\664002.exec:\664002.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjjp.exec:\ppjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\0408062.exec:\0408062.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\0426408.exec:\0426408.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\4680400.exec:\4680400.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\2646846.exec:\2646846.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\04402.exec:\04402.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\8242204.exec:\8242204.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\608466.exec:\608466.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\88686.exec:\88686.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\282486.exec:\282486.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tttnht.exec:\tttnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nntnnt.exec:\nntnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jppdp.exec:\jppdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpjdv.exec:\jpjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnthhn.exec:\nnthhn.exe17⤵
- Executes dropped EXE
-
\??\c:\jjjdd.exec:\jjjdd.exe18⤵
- Executes dropped EXE
-
\??\c:\62244.exec:\62244.exe19⤵
- Executes dropped EXE
-
\??\c:\46648.exec:\46648.exe20⤵
- Executes dropped EXE
-
\??\c:\lxxlxxx.exec:\lxxlxxx.exe21⤵
- Executes dropped EXE
-
\??\c:\028286.exec:\028286.exe22⤵
- Executes dropped EXE
-
\??\c:\nnthht.exec:\nnthht.exe23⤵
- Executes dropped EXE
-
\??\c:\0028624.exec:\0028624.exe24⤵
- Executes dropped EXE
-
\??\c:\hbtbnn.exec:\hbtbnn.exe25⤵
- Executes dropped EXE
-
\??\c:\60886.exec:\60886.exe26⤵
- Executes dropped EXE
-
\??\c:\4206840.exec:\4206840.exe27⤵
- Executes dropped EXE
-
\??\c:\flrlxlf.exec:\flrlxlf.exe28⤵
- Executes dropped EXE
-
\??\c:\8682826.exec:\8682826.exe29⤵
- Executes dropped EXE
-
\??\c:\5nhbbb.exec:\5nhbbb.exe30⤵
- Executes dropped EXE
-
\??\c:\084028.exec:\084028.exe31⤵
- Executes dropped EXE
-
\??\c:\7lfffxl.exec:\7lfffxl.exe32⤵
- Executes dropped EXE
-
\??\c:\82062.exec:\82062.exe33⤵
- Executes dropped EXE
-
\??\c:\g6888.exec:\g6888.exe34⤵
- Executes dropped EXE
-
\??\c:\djjpj.exec:\djjpj.exe35⤵
- Executes dropped EXE
-
\??\c:\2428684.exec:\2428684.exe36⤵
- Executes dropped EXE
-
\??\c:\40682.exec:\40682.exe37⤵
- Executes dropped EXE
-
\??\c:\60402.exec:\60402.exe38⤵
- Executes dropped EXE
-
\??\c:\frxxfff.exec:\frxxfff.exe39⤵
- Executes dropped EXE
-
\??\c:\7pppj.exec:\7pppj.exe40⤵
- Executes dropped EXE
-
\??\c:\nnthbh.exec:\nnthbh.exe41⤵
- Executes dropped EXE
-
\??\c:\ppvjv.exec:\ppvjv.exe42⤵
- Executes dropped EXE
-
\??\c:\vpjdp.exec:\vpjdp.exe43⤵
- Executes dropped EXE
-
\??\c:\80402.exec:\80402.exe44⤵
- Executes dropped EXE
-
\??\c:\04460.exec:\04460.exe45⤵
- Executes dropped EXE
-
\??\c:\4484246.exec:\4484246.exe46⤵
- Executes dropped EXE
-
\??\c:\hnbhnn.exec:\hnbhnn.exe47⤵
- Executes dropped EXE
-
\??\c:\0428002.exec:\0428002.exe48⤵
- Executes dropped EXE
-
\??\c:\9bnnbh.exec:\9bnnbh.exe49⤵
- Executes dropped EXE
-
\??\c:\pvpvj.exec:\pvpvj.exe50⤵
- Executes dropped EXE
-
\??\c:\222028.exec:\222028.exe51⤵
- Executes dropped EXE
-
\??\c:\pvddd.exec:\pvddd.exe52⤵
- Executes dropped EXE
-
\??\c:\rllxlxx.exec:\rllxlxx.exe53⤵
- Executes dropped EXE
-
\??\c:\w20488.exec:\w20488.exe54⤵
- Executes dropped EXE
-
\??\c:\rflflrx.exec:\rflflrx.exe55⤵
- Executes dropped EXE
-
\??\c:\tbtbnt.exec:\tbtbnt.exe56⤵
- Executes dropped EXE
-
\??\c:\0604460.exec:\0604460.exe57⤵
- Executes dropped EXE
-
\??\c:\0648468.exec:\0648468.exe58⤵
- Executes dropped EXE
-
\??\c:\fllllfr.exec:\fllllfr.exe59⤵
- Executes dropped EXE
-
\??\c:\6026484.exec:\6026484.exe60⤵
- Executes dropped EXE
-
\??\c:\4202060.exec:\4202060.exe61⤵
- Executes dropped EXE
-
\??\c:\1fxfxfl.exec:\1fxfxfl.exe62⤵
- Executes dropped EXE
-
\??\c:\06464.exec:\06464.exe63⤵
- Executes dropped EXE
-
\??\c:\2684446.exec:\2684446.exe64⤵
- Executes dropped EXE
-
\??\c:\664466.exec:\664466.exe65⤵
- Executes dropped EXE
-
\??\c:\002244.exec:\002244.exe66⤵
-
\??\c:\82008.exec:\82008.exe67⤵
-
\??\c:\6224208.exec:\6224208.exe68⤵
-
\??\c:\844220.exec:\844220.exe69⤵
-
\??\c:\bnbtbt.exec:\bnbtbt.exe70⤵
-
\??\c:\ppjdp.exec:\ppjdp.exe71⤵
-
\??\c:\3hbntb.exec:\3hbntb.exe72⤵
-
\??\c:\208460.exec:\208460.exe73⤵
-
\??\c:\26440.exec:\26440.exe74⤵
-
\??\c:\888046.exec:\888046.exe75⤵
-
\??\c:\4280066.exec:\4280066.exe76⤵
-
\??\c:\6222084.exec:\6222084.exe77⤵
-
\??\c:\4484284.exec:\4484284.exe78⤵
-
\??\c:\xfllrrl.exec:\xfllrrl.exe79⤵
-
\??\c:\djvjv.exec:\djvjv.exe80⤵
-
\??\c:\rxflxfx.exec:\rxflxfx.exe81⤵
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe82⤵
-
\??\c:\k66640.exec:\k66640.exe83⤵
-
\??\c:\e26262.exec:\e26262.exe84⤵
-
\??\c:\620686.exec:\620686.exe85⤵
-
\??\c:\lxflrxf.exec:\lxflrxf.exe86⤵
-
\??\c:\djjjj.exec:\djjjj.exe87⤵
-
\??\c:\240486.exec:\240486.exe88⤵
-
\??\c:\fflxrfr.exec:\fflxrfr.exe89⤵
-
\??\c:\400886.exec:\400886.exe90⤵
-
\??\c:\jjvpv.exec:\jjvpv.exe91⤵
-
\??\c:\62260.exec:\62260.exe92⤵
-
\??\c:\nbhhnn.exec:\nbhhnn.exe93⤵
-
\??\c:\ddvdp.exec:\ddvdp.exe94⤵
-
\??\c:\rrlxlxr.exec:\rrlxlxr.exe95⤵
-
\??\c:\8264866.exec:\8264866.exe96⤵
-
\??\c:\224024.exec:\224024.exe97⤵
-
\??\c:\bnhntb.exec:\bnhntb.exe98⤵
-
\??\c:\hnbtnn.exec:\hnbtnn.exe99⤵
-
\??\c:\tnbnth.exec:\tnbnth.exe100⤵
-
\??\c:\000260.exec:\000260.exe101⤵
-
\??\c:\dvjjd.exec:\dvjjd.exe102⤵
-
\??\c:\hthnbh.exec:\hthnbh.exe103⤵
-
\??\c:\nnnbth.exec:\nnnbth.exe104⤵
-
\??\c:\28064.exec:\28064.exe105⤵
-
\??\c:\4442020.exec:\4442020.exe106⤵
-
\??\c:\flxxlxr.exec:\flxxlxr.exe107⤵
-
\??\c:\66620.exec:\66620.exe108⤵
-
\??\c:\fffrlrf.exec:\fffrlrf.exe109⤵
-
\??\c:\82064.exec:\82064.exe110⤵
-
\??\c:\ddvvd.exec:\ddvvd.exe111⤵
-
\??\c:\446862.exec:\446862.exe112⤵
-
\??\c:\vpvdd.exec:\vpvdd.exe113⤵
-
\??\c:\26068.exec:\26068.exe114⤵
-
\??\c:\444042.exec:\444042.exe115⤵
-
\??\c:\5htntn.exec:\5htntn.exe116⤵
-
\??\c:\604028.exec:\604028.exe117⤵
-
\??\c:\ttbbnt.exec:\ttbbnt.exe118⤵
-
\??\c:\3ntttt.exec:\3ntttt.exe119⤵
-
\??\c:\4442604.exec:\4442604.exe120⤵
-
\??\c:\jjpvj.exec:\jjpvj.exe121⤵
-
\??\c:\48224.exec:\48224.exe122⤵
-
\??\c:\6462840.exec:\6462840.exe123⤵
-
\??\c:\0862440.exec:\0862440.exe124⤵
-
\??\c:\tbhbth.exec:\tbhbth.exe125⤵
-
\??\c:\28864.exec:\28864.exe126⤵
-
\??\c:\8682846.exec:\8682846.exe127⤵
-
\??\c:\lrlllfx.exec:\lrlllfx.exe128⤵
-
\??\c:\e86640.exec:\e86640.exe129⤵
-
\??\c:\664086.exec:\664086.exe130⤵
-
\??\c:\666828.exec:\666828.exe131⤵
-
\??\c:\a8006.exec:\a8006.exe132⤵
-
\??\c:\84868.exec:\84868.exe133⤵
-
\??\c:\vdvjv.exec:\vdvjv.exe134⤵
-
\??\c:\268228.exec:\268228.exe135⤵
-
\??\c:\lllxrlf.exec:\lllxrlf.exe136⤵
-
\??\c:\26842.exec:\26842.exe137⤵
-
\??\c:\08624.exec:\08624.exe138⤵
-
\??\c:\604044.exec:\604044.exe139⤵
-
\??\c:\xfrrxxr.exec:\xfrrxxr.exe140⤵
-
\??\c:\66408.exec:\66408.exe141⤵
-
\??\c:\9llrlrf.exec:\9llrlrf.exe142⤵
-
\??\c:\jddpj.exec:\jddpj.exe143⤵
-
\??\c:\8206842.exec:\8206842.exe144⤵
-
\??\c:\lrfxrxx.exec:\lrfxrxx.exe145⤵
-
\??\c:\bnbhnn.exec:\bnbhnn.exe146⤵
-
\??\c:\24624.exec:\24624.exe147⤵
-
\??\c:\4806240.exec:\4806240.exe148⤵
-
\??\c:\0620484.exec:\0620484.exe149⤵
-
\??\c:\44480.exec:\44480.exe150⤵
-
\??\c:\7lflrxl.exec:\7lflrxl.exe151⤵
-
\??\c:\66402.exec:\66402.exe152⤵
-
\??\c:\9fxflrf.exec:\9fxflrf.exe153⤵
-
\??\c:\2262402.exec:\2262402.exe154⤵
-
\??\c:\4886266.exec:\4886266.exe155⤵
-
\??\c:\6644208.exec:\6644208.exe156⤵
-
\??\c:\jvdjp.exec:\jvdjp.exe157⤵
-
\??\c:\bhbhbn.exec:\bhbhbn.exe158⤵
-
\??\c:\82668.exec:\82668.exe159⤵
-
\??\c:\202240.exec:\202240.exe160⤵
-
\??\c:\48628.exec:\48628.exe161⤵
-
\??\c:\48668.exec:\48668.exe162⤵
-
\??\c:\426808.exec:\426808.exe163⤵
-
\??\c:\7dpvj.exec:\7dpvj.exe164⤵
-
\??\c:\xxflxfr.exec:\xxflxfr.exe165⤵
-
\??\c:\q88462.exec:\q88462.exe166⤵
-
\??\c:\1hnntb.exec:\1hnntb.exe167⤵
-
\??\c:\0440624.exec:\0440624.exe168⤵
-
\??\c:\hthtnn.exec:\hthtnn.exe169⤵
-
\??\c:\djjpj.exec:\djjpj.exe170⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe171⤵
-
\??\c:\fxfflrx.exec:\fxfflrx.exe172⤵
-
\??\c:\4886442.exec:\4886442.exe173⤵
-
\??\c:\2660420.exec:\2660420.exe174⤵
-
\??\c:\606028.exec:\606028.exe175⤵
-
\??\c:\ttnthb.exec:\ttnthb.exe176⤵
-
\??\c:\vdjvv.exec:\vdjvv.exe177⤵
-
\??\c:\44044.exec:\44044.exe178⤵
-
\??\c:\080622.exec:\080622.exe179⤵
-
\??\c:\7xfflff.exec:\7xfflff.exe180⤵
-
\??\c:\4484804.exec:\4484804.exe181⤵
-
\??\c:\6066466.exec:\6066466.exe182⤵
-
\??\c:\048082.exec:\048082.exe183⤵
-
\??\c:\jjdvd.exec:\jjdvd.exe184⤵
-
\??\c:\rrfrrff.exec:\rrfrrff.exe185⤵
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe186⤵
-
\??\c:\lfxfxlx.exec:\lfxfxlx.exe187⤵
-
\??\c:\i806802.exec:\i806802.exe188⤵
-
\??\c:\nnbbnt.exec:\nnbbnt.exe189⤵
-
\??\c:\66008.exec:\66008.exe190⤵
-
\??\c:\0606808.exec:\0606808.exe191⤵
-
\??\c:\3frrxfl.exec:\3frrxfl.exe192⤵
-
\??\c:\tnhhbb.exec:\tnhhbb.exe193⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe194⤵
-
\??\c:\9bbnhn.exec:\9bbnhn.exe195⤵
-
\??\c:\c488064.exec:\c488064.exe196⤵
-
\??\c:\4424624.exec:\4424624.exe197⤵
-
\??\c:\bhtbhn.exec:\bhtbhn.exe198⤵
-
\??\c:\44280.exec:\44280.exe199⤵
-
\??\c:\s2406.exec:\s2406.exe200⤵
-
\??\c:\22062.exec:\22062.exe201⤵
-
\??\c:\224028.exec:\224028.exe202⤵
-
\??\c:\nnnbnb.exec:\nnnbnb.exe203⤵
-
\??\c:\3jppv.exec:\3jppv.exe204⤵
-
\??\c:\jjjvp.exec:\jjjvp.exe205⤵
-
\??\c:\608480.exec:\608480.exe206⤵
-
\??\c:\1djdp.exec:\1djdp.exe207⤵
-
\??\c:\hhbbhh.exec:\hhbbhh.exe208⤵
-
\??\c:\5bbhnn.exec:\5bbhnn.exe209⤵
-
\??\c:\frlrlrx.exec:\frlrlrx.exe210⤵
-
\??\c:\bntbbb.exec:\bntbbb.exe211⤵
-
\??\c:\64042.exec:\64042.exe212⤵
-
\??\c:\40048.exec:\40048.exe213⤵
-
\??\c:\406042.exec:\406042.exe214⤵
-
\??\c:\000202.exec:\000202.exe215⤵
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe216⤵
-
\??\c:\66608.exec:\66608.exe217⤵
-
\??\c:\nbntbb.exec:\nbntbb.exe218⤵
-
\??\c:\pddjv.exec:\pddjv.exe219⤵
-
\??\c:\28668.exec:\28668.exe220⤵
-
\??\c:\xxxxxfx.exec:\xxxxxfx.exe221⤵
-
\??\c:\i202468.exec:\i202468.exe222⤵
-
\??\c:\46220.exec:\46220.exe223⤵
-
\??\c:\842608.exec:\842608.exe224⤵
-
\??\c:\7pjjv.exec:\7pjjv.exe225⤵
-
\??\c:\7djvd.exec:\7djvd.exe226⤵
-
\??\c:\26824.exec:\26824.exe227⤵
-
\??\c:\hhtnnh.exec:\hhtnnh.exe228⤵
-
\??\c:\xflxlxl.exec:\xflxlxl.exe229⤵
-
\??\c:\268484.exec:\268484.exe230⤵
-
\??\c:\26446.exec:\26446.exe231⤵
-
\??\c:\rrflrlr.exec:\rrflrlr.exe232⤵
-
\??\c:\ntnnht.exec:\ntnnht.exe233⤵
-
\??\c:\thbntn.exec:\thbntn.exe234⤵
-
\??\c:\20464.exec:\20464.exe235⤵
-
\??\c:\8268286.exec:\8268286.exe236⤵
-
\??\c:\8288002.exec:\8288002.exe237⤵
-
\??\c:\tthnbn.exec:\tthnbn.exe238⤵
-
\??\c:\0226048.exec:\0226048.exe239⤵
-
\??\c:\c800024.exec:\c800024.exe240⤵
-
\??\c:\3frrlll.exec:\3frrlll.exe241⤵