Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 10:39
Behavioral task
behavioral1
Sample
73fbd939fc3a4539c5b92b92eb2e4ffd4285f5aee438b36abcabb74640c56122.exe
Resource
win7-20240221-en
General
-
Target
73fbd939fc3a4539c5b92b92eb2e4ffd4285f5aee438b36abcabb74640c56122.exe
-
Size
288KB
-
MD5
1072f3fe0698ded76995769ccd44ce10
-
SHA1
d799d2fcc37e4570f24685890f94da37b2bf0550
-
SHA256
73fbd939fc3a4539c5b92b92eb2e4ffd4285f5aee438b36abcabb74640c56122
-
SHA512
e2de4ce85cb2374b33b4c60e16e6e2502974c012db1125ef750dceb8e82949ce5706ff9751b2a5bcd8a29e07bcd8185910664ce368bcff014c779ec574e0cc22
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftOe:K4wFHoSQkuUHk1zBR/pMT9XvEhdfJ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4864-6-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3560-13-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4468-15-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2436-24-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2992-31-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4520-33-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4324-43-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2084-49-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4752-61-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2712-67-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/404-77-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1560-80-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3492-90-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4768-96-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1240-100-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2072-109-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4904-125-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2904-134-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4236-149-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2488-157-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1944-163-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4552-167-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/448-177-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4736-192-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4420-211-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/748-215-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3052-225-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3960-226-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3960-230-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/872-232-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4084-245-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3720-249-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2908-255-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/812-272-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/392-282-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4944-290-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1820-294-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4644-305-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1400-315-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1016-326-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5008-332-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2368-339-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2400-359-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2232-365-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/348-369-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4512-377-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5080-391-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2096-395-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3720-420-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5036-449-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2212-451-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4484-455-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1496-464-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2768-468-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/656-544-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1232-641-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/428-656-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2132-684-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/372-688-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3144-871-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/388-881-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4372-973-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/920-1050-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1964-1211-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\nhnnhh.exe family_berbew \??\c:\vjpjv.exe family_berbew C:\flrrlfx.exe family_berbew C:\fffrlfl.exe family_berbew C:\jddvp.exe family_berbew C:\rxfxrrx.exe family_berbew C:\9bhnhb.exe family_berbew C:\pdjjd.exe family_berbew C:\rlrllff.exe family_berbew \??\c:\nhttnt.exe family_berbew \??\c:\pdddv.exe family_berbew C:\ttbbbn.exe family_berbew C:\jvvvd.exe family_berbew \??\c:\fffxrrf.exe family_berbew C:\5jvvp.exe family_berbew C:\hbhbtt.exe family_berbew C:\vjvpj.exe family_berbew \??\c:\lrxxrrr.exe family_berbew C:\hhhhbt.exe family_berbew \??\c:\7bhbbt.exe family_berbew C:\xrrllxr.exe family_berbew C:\3fffrrl.exe family_berbew C:\pjpjd.exe family_berbew C:\flrlfxr.exe family_berbew C:\nhnnhn.exe family_berbew C:\dddvv.exe family_berbew C:\lflfxff.exe family_berbew C:\tnnnhh.exe family_berbew \??\c:\pdjdd.exe family_berbew C:\rllfxff.exe family_berbew C:\nbhbbb.exe family_berbew C:\vvvpj.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
nhnnhh.exevjpjv.exeflrrlfx.exefffrlfl.exejddvp.exerxfxrrx.exe9bhnhb.exepdjjd.exerlrllff.exenhttnt.exepdddv.exettbbbn.exejvvvd.exefffxrrf.exe5jvvp.exehbhbtt.exevjvpj.exelrxxrrr.exehhhhbt.exe7bhbbt.exexrrllxr.exe3fffrrl.exepjpjd.exeflrlfxr.exenhnnhn.exedddvv.exelflfxff.exetnnnhh.exepdjdd.exerllfxff.exenbhbbb.exevvvpj.exenntttt.exehhbbbb.exedvjdj.exeflxxrrr.exetnhntt.exebnbbbh.exe7djdd.exe1rxfxlf.exepvvjv.exejjpjd.exerlrxxxx.exexfrxllf.exe1tbnhh.exedvjdv.exeppdvj.exelxlllll.exebthnnn.exenhtnhh.exedvpjd.exe1xlfrrr.exenhtttt.exehhhhbt.exe7vvpv.exerrrrlfl.exebbhttt.exennhbhn.exeppppp.exelfxxrfx.exe3lrrrrx.exehnbhbb.exejvjdv.exe1rxrxxr.exepid process 4468 nhnnhh.exe 3560 vjpjv.exe 2436 flrrlfx.exe 2992 fffrlfl.exe 4520 jddvp.exe 4324 rxfxrrx.exe 3928 9bhnhb.exe 2084 pdjjd.exe 4752 rlrllff.exe 2712 nhttnt.exe 2632 pdddv.exe 404 ttbbbn.exe 1560 jvvvd.exe 3492 fffxrrf.exe 4768 5jvvp.exe 1240 hbhbtt.exe 940 vjvpj.exe 2072 lrxxrrr.exe 948 hhhhbt.exe 5072 7bhbbt.exe 4904 xrrllxr.exe 2904 3fffrrl.exe 4360 pjpjd.exe 3548 flrlfxr.exe 4236 nhnnhn.exe 2488 dddvv.exe 1944 lflfxff.exe 4552 tnnnhh.exe 2008 pdjdd.exe 448 rllfxff.exe 4160 nbhbbb.exe 4736 vvvpj.exe 1336 nntttt.exe 644 hhbbbb.exe 2396 dvjdj.exe 4892 flxxrrr.exe 680 tnhntt.exe 4420 bnbbbh.exe 748 7djdd.exe 3020 1rxfxlf.exe 4148 pvvjv.exe 3052 jjpjd.exe 3960 rlrxxxx.exe 872 xfrxllf.exe 1000 1tbnhh.exe 4324 dvjdv.exe 2100 ppdvj.exe 4084 lxlllll.exe 3720 bthnnn.exe 2908 nhtnhh.exe 2712 dvpjd.exe 1088 1xlfrrr.exe 3964 nhtttt.exe 380 hhhhbt.exe 812 7vvpv.exe 3904 rrrrlfl.exe 2740 bbhttt.exe 392 nnhbhn.exe 1476 ppppp.exe 4944 lfxxrfx.exe 1820 3lrrrrx.exe 2452 hnbhbb.exe 2588 jvjdv.exe 4644 1rxrxxr.exe -
Processes:
resource yara_rule behavioral2/memory/4864-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4864-6-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\nhnnhh.exe upx behavioral2/memory/4468-7-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\vjpjv.exe upx behavioral2/memory/3560-13-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4468-15-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\flrrlfx.exe upx C:\fffrlfl.exe upx behavioral2/memory/2436-24-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jddvp.exe upx behavioral2/memory/2992-31-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4520-33-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rxfxrrx.exe upx C:\9bhnhb.exe upx behavioral2/memory/4324-43-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pdjjd.exe upx behavioral2/memory/2084-49-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rlrllff.exe upx behavioral2/memory/4752-55-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\nhttnt.exe upx behavioral2/memory/4752-61-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2712-67-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\pdddv.exe upx C:\ttbbbn.exe upx behavioral2/memory/404-77-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jvvvd.exe upx behavioral2/memory/1560-80-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\fffxrrf.exe upx C:\5jvvp.exe upx behavioral2/memory/3492-90-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\hbhbtt.exe upx behavioral2/memory/4768-96-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1240-100-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vjvpj.exe upx \??\c:\lrxxrrr.exe upx behavioral2/memory/2072-109-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\hhhhbt.exe upx \??\c:\7bhbbt.exe upx C:\xrrllxr.exe upx behavioral2/memory/4904-125-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3fffrrl.exe upx behavioral2/memory/2904-130-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pjpjd.exe upx behavioral2/memory/2904-134-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\flrlfxr.exe upx behavioral2/memory/3548-142-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nhnnhn.exe upx behavioral2/memory/4236-149-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\dddvv.exe upx C:\lflfxff.exe upx behavioral2/memory/2488-157-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1944-163-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\tnnnhh.exe upx behavioral2/memory/4552-167-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\pdjdd.exe upx C:\rllfxff.exe upx behavioral2/memory/448-177-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nbhbbb.exe upx behavioral2/memory/4160-183-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vvvpj.exe upx behavioral2/memory/4736-192-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4420-211-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/748-215-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
73fbd939fc3a4539c5b92b92eb2e4ffd4285f5aee438b36abcabb74640c56122.exenhnnhh.exevjpjv.exeflrrlfx.exefffrlfl.exejddvp.exerxfxrrx.exe9bhnhb.exepdjjd.exerlrllff.exenhttnt.exepdddv.exettbbbn.exejvvvd.exefffxrrf.exe5jvvp.exehbhbtt.exevjvpj.exelrxxrrr.exehhhhbt.exe7bhbbt.exexrrllxr.exedescription pid process target process PID 4864 wrote to memory of 4468 4864 73fbd939fc3a4539c5b92b92eb2e4ffd4285f5aee438b36abcabb74640c56122.exe nhnnhh.exe PID 4864 wrote to memory of 4468 4864 73fbd939fc3a4539c5b92b92eb2e4ffd4285f5aee438b36abcabb74640c56122.exe nhnnhh.exe PID 4864 wrote to memory of 4468 4864 73fbd939fc3a4539c5b92b92eb2e4ffd4285f5aee438b36abcabb74640c56122.exe nhnnhh.exe PID 4468 wrote to memory of 3560 4468 nhnnhh.exe vjpjv.exe PID 4468 wrote to memory of 3560 4468 nhnnhh.exe vjpjv.exe PID 4468 wrote to memory of 3560 4468 nhnnhh.exe vjpjv.exe PID 3560 wrote to memory of 2436 3560 vjpjv.exe flrrlfx.exe PID 3560 wrote to memory of 2436 3560 vjpjv.exe flrrlfx.exe PID 3560 wrote to memory of 2436 3560 vjpjv.exe flrrlfx.exe PID 2436 wrote to memory of 2992 2436 flrrlfx.exe fffrlfl.exe PID 2436 wrote to memory of 2992 2436 flrrlfx.exe fffrlfl.exe PID 2436 wrote to memory of 2992 2436 flrrlfx.exe fffrlfl.exe PID 2992 wrote to memory of 4520 2992 fffrlfl.exe jddvp.exe PID 2992 wrote to memory of 4520 2992 fffrlfl.exe jddvp.exe PID 2992 wrote to memory of 4520 2992 fffrlfl.exe jddvp.exe PID 4520 wrote to memory of 4324 4520 jddvp.exe rxfxrrx.exe PID 4520 wrote to memory of 4324 4520 jddvp.exe rxfxrrx.exe PID 4520 wrote to memory of 4324 4520 jddvp.exe rxfxrrx.exe PID 4324 wrote to memory of 3928 4324 rxfxrrx.exe 9bhnhb.exe PID 4324 wrote to memory of 3928 4324 rxfxrrx.exe 9bhnhb.exe PID 4324 wrote to memory of 3928 4324 rxfxrrx.exe 9bhnhb.exe PID 3928 wrote to memory of 2084 3928 9bhnhb.exe pdjjd.exe PID 3928 wrote to memory of 2084 3928 9bhnhb.exe pdjjd.exe PID 3928 wrote to memory of 2084 3928 9bhnhb.exe pdjjd.exe PID 2084 wrote to memory of 4752 2084 pdjjd.exe rlrllff.exe PID 2084 wrote to memory of 4752 2084 pdjjd.exe rlrllff.exe PID 2084 wrote to memory of 4752 2084 pdjjd.exe rlrllff.exe PID 4752 wrote to memory of 2712 4752 rlrllff.exe nhttnt.exe PID 4752 wrote to memory of 2712 4752 rlrllff.exe nhttnt.exe PID 4752 wrote to memory of 2712 4752 rlrllff.exe nhttnt.exe PID 2712 wrote to memory of 2632 2712 nhttnt.exe pdddv.exe PID 2712 wrote to memory of 2632 2712 nhttnt.exe pdddv.exe PID 2712 wrote to memory of 2632 2712 nhttnt.exe pdddv.exe PID 2632 wrote to memory of 404 2632 pdddv.exe ttbbbn.exe PID 2632 wrote to memory of 404 2632 pdddv.exe ttbbbn.exe PID 2632 wrote to memory of 404 2632 pdddv.exe ttbbbn.exe PID 404 wrote to memory of 1560 404 ttbbbn.exe jvvvd.exe PID 404 wrote to memory of 1560 404 ttbbbn.exe jvvvd.exe PID 404 wrote to memory of 1560 404 ttbbbn.exe jvvvd.exe PID 1560 wrote to memory of 3492 1560 jvvvd.exe fffxrrf.exe PID 1560 wrote to memory of 3492 1560 jvvvd.exe fffxrrf.exe PID 1560 wrote to memory of 3492 1560 jvvvd.exe fffxrrf.exe PID 3492 wrote to memory of 4768 3492 fffxrrf.exe 5jvvp.exe PID 3492 wrote to memory of 4768 3492 fffxrrf.exe 5jvvp.exe PID 3492 wrote to memory of 4768 3492 fffxrrf.exe 5jvvp.exe PID 4768 wrote to memory of 1240 4768 5jvvp.exe hbhbtt.exe PID 4768 wrote to memory of 1240 4768 5jvvp.exe hbhbtt.exe PID 4768 wrote to memory of 1240 4768 5jvvp.exe hbhbtt.exe PID 1240 wrote to memory of 940 1240 hbhbtt.exe vjvpj.exe PID 1240 wrote to memory of 940 1240 hbhbtt.exe vjvpj.exe PID 1240 wrote to memory of 940 1240 hbhbtt.exe vjvpj.exe PID 940 wrote to memory of 2072 940 vjvpj.exe lrxxrrr.exe PID 940 wrote to memory of 2072 940 vjvpj.exe lrxxrrr.exe PID 940 wrote to memory of 2072 940 vjvpj.exe lrxxrrr.exe PID 2072 wrote to memory of 948 2072 lrxxrrr.exe hhhhbt.exe PID 2072 wrote to memory of 948 2072 lrxxrrr.exe hhhhbt.exe PID 2072 wrote to memory of 948 2072 lrxxrrr.exe hhhhbt.exe PID 948 wrote to memory of 5072 948 hhhhbt.exe 7bhbbt.exe PID 948 wrote to memory of 5072 948 hhhhbt.exe 7bhbbt.exe PID 948 wrote to memory of 5072 948 hhhhbt.exe 7bhbbt.exe PID 5072 wrote to memory of 4904 5072 7bhbbt.exe xrrllxr.exe PID 5072 wrote to memory of 4904 5072 7bhbbt.exe xrrllxr.exe PID 5072 wrote to memory of 4904 5072 7bhbbt.exe xrrllxr.exe PID 4904 wrote to memory of 2904 4904 xrrllxr.exe 3fffrrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73fbd939fc3a4539c5b92b92eb2e4ffd4285f5aee438b36abcabb74640c56122.exe"C:\Users\Admin\AppData\Local\Temp\73fbd939fc3a4539c5b92b92eb2e4ffd4285f5aee438b36abcabb74640c56122.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\nhnnhh.exec:\nhnnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\vjpjv.exec:\vjpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\flrrlfx.exec:\flrrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\fffrlfl.exec:\fffrlfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\jddvp.exec:\jddvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\rxfxrrx.exec:\rxfxrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\9bhnhb.exec:\9bhnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\pdjjd.exec:\pdjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\rlrllff.exec:\rlrllff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\nhttnt.exec:\nhttnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\pdddv.exec:\pdddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ttbbbn.exec:\ttbbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\jvvvd.exec:\jvvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\fffxrrf.exec:\fffxrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\5jvvp.exec:\5jvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\hbhbtt.exec:\hbhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\vjvpj.exec:\vjvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\hhhhbt.exec:\hhhhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\7bhbbt.exec:\7bhbbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\xrrllxr.exec:\xrrllxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\3fffrrl.exec:\3fffrrl.exe23⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pjpjd.exec:\pjpjd.exe24⤵
- Executes dropped EXE
PID:4360 -
\??\c:\flrlfxr.exec:\flrlfxr.exe25⤵
- Executes dropped EXE
PID:3548 -
\??\c:\nhnnhn.exec:\nhnnhn.exe26⤵
- Executes dropped EXE
PID:4236 -
\??\c:\dddvv.exec:\dddvv.exe27⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lflfxff.exec:\lflfxff.exe28⤵
- Executes dropped EXE
PID:1944 -
\??\c:\tnnnhh.exec:\tnnnhh.exe29⤵
- Executes dropped EXE
PID:4552 -
\??\c:\pdjdd.exec:\pdjdd.exe30⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rllfxff.exec:\rllfxff.exe31⤵
- Executes dropped EXE
PID:448 -
\??\c:\nbhbbb.exec:\nbhbbb.exe32⤵
- Executes dropped EXE
PID:4160 -
\??\c:\vvvpj.exec:\vvvpj.exe33⤵
- Executes dropped EXE
PID:4736 -
\??\c:\nntttt.exec:\nntttt.exe34⤵
- Executes dropped EXE
PID:1336 -
\??\c:\hhbbbb.exec:\hhbbbb.exe35⤵
- Executes dropped EXE
PID:644 -
\??\c:\dvjdj.exec:\dvjdj.exe36⤵
- Executes dropped EXE
PID:2396 -
\??\c:\flxxrrr.exec:\flxxrrr.exe37⤵
- Executes dropped EXE
PID:4892 -
\??\c:\tnhntt.exec:\tnhntt.exe38⤵
- Executes dropped EXE
PID:680 -
\??\c:\bnbbbh.exec:\bnbbbh.exe39⤵
- Executes dropped EXE
PID:4420 -
\??\c:\7djdd.exec:\7djdd.exe40⤵
- Executes dropped EXE
PID:748 -
\??\c:\1rxfxlf.exec:\1rxfxlf.exe41⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pvvjv.exec:\pvvjv.exe42⤵
- Executes dropped EXE
PID:4148 -
\??\c:\jjpjd.exec:\jjpjd.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rlrxxxx.exec:\rlrxxxx.exe44⤵
- Executes dropped EXE
PID:3960 -
\??\c:\xfrxllf.exec:\xfrxllf.exe45⤵
- Executes dropped EXE
PID:872 -
\??\c:\1tbnhh.exec:\1tbnhh.exe46⤵
- Executes dropped EXE
PID:1000 -
\??\c:\dvjdv.exec:\dvjdv.exe47⤵
- Executes dropped EXE
PID:4324 -
\??\c:\ppdvj.exec:\ppdvj.exe48⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lxlllll.exec:\lxlllll.exe49⤵
- Executes dropped EXE
PID:4084 -
\??\c:\bthnnn.exec:\bthnnn.exe50⤵
- Executes dropped EXE
PID:3720 -
\??\c:\nhtnhh.exec:\nhtnhh.exe51⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dvpjd.exec:\dvpjd.exe52⤵
- Executes dropped EXE
PID:2712 -
\??\c:\1xlfrrr.exec:\1xlfrrr.exe53⤵
- Executes dropped EXE
PID:1088 -
\??\c:\nhtttt.exec:\nhtttt.exe54⤵
- Executes dropped EXE
PID:3964 -
\??\c:\hhhhbt.exec:\hhhhbt.exe55⤵
- Executes dropped EXE
PID:380 -
\??\c:\7vvpv.exec:\7vvpv.exe56⤵
- Executes dropped EXE
PID:812 -
\??\c:\rrrrlfl.exec:\rrrrlfl.exe57⤵
- Executes dropped EXE
PID:3904 -
\??\c:\bbhttt.exec:\bbhttt.exe58⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nnhbhn.exec:\nnhbhn.exe59⤵
- Executes dropped EXE
PID:392 -
\??\c:\ppppp.exec:\ppppp.exe60⤵
- Executes dropped EXE
PID:1476 -
\??\c:\lfxxrfx.exec:\lfxxrfx.exe61⤵
- Executes dropped EXE
PID:4944 -
\??\c:\3lrrrrx.exec:\3lrrrrx.exe62⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hnbhbb.exec:\hnbhbb.exe63⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jvjdv.exec:\jvjdv.exe64⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1rxrxxr.exec:\1rxrxxr.exe65⤵
- Executes dropped EXE
PID:4644 -
\??\c:\3bhbbb.exec:\3bhbbb.exe66⤵PID:948
-
\??\c:\nbtthh.exec:\nbtthh.exe67⤵PID:4548
-
\??\c:\vvjdd.exec:\vvjdd.exe68⤵PID:1400
-
\??\c:\9lllffx.exec:\9lllffx.exe69⤵PID:840
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe70⤵PID:1232
-
\??\c:\nhnhhb.exec:\nhnhhb.exe71⤵PID:4360
-
\??\c:\9ntnhh.exec:\9ntnhh.exe72⤵PID:1016
-
\??\c:\3jpjj.exec:\3jpjj.exe73⤵PID:5008
-
\??\c:\1rrfxxx.exec:\1rrfxxx.exe74⤵PID:3564
-
\??\c:\bttntt.exec:\bttntt.exe75⤵PID:2368
-
\??\c:\pjvpj.exec:\pjvpj.exe76⤵PID:1944
-
\??\c:\1bnhhh.exec:\1bnhhh.exe77⤵PID:4824
-
\??\c:\hnntnb.exec:\hnntnb.exe78⤵PID:1020
-
\??\c:\jjjjd.exec:\jjjjd.exe79⤵PID:4312
-
\??\c:\7vvjv.exec:\7vvjv.exe80⤵PID:4724
-
\??\c:\lfllffx.exec:\lfllffx.exe81⤵PID:1916
-
\??\c:\fflfffl.exec:\fflfffl.exe82⤵PID:2400
-
\??\c:\1nttbb.exec:\1nttbb.exe83⤵PID:2232
-
\??\c:\pvppj.exec:\pvppj.exe84⤵PID:348
-
\??\c:\flrlrrl.exec:\flrlrrl.exe85⤵PID:2396
-
\??\c:\frrlffx.exec:\frrlffx.exe86⤵PID:4892
-
\??\c:\tbhbtt.exec:\tbhbtt.exe87⤵PID:4512
-
\??\c:\vjdvp.exec:\vjdvp.exe88⤵PID:4424
-
\??\c:\xrfxllr.exec:\xrfxllr.exe89⤵PID:2124
-
\??\c:\rrxxffl.exec:\rrxxffl.exe90⤵PID:1660
-
\??\c:\thtnht.exec:\thtnht.exe91⤵PID:5080
-
\??\c:\ppppv.exec:\ppppv.exe92⤵PID:2096
-
\??\c:\jddvp.exec:\jddvp.exe93⤵PID:4648
-
\??\c:\lfrrllf.exec:\lfrrllf.exe94⤵PID:452
-
\??\c:\hhnnnb.exec:\hhnnnb.exe95⤵PID:4928
-
\??\c:\jjpdv.exec:\jjpdv.exe96⤵PID:4556
-
\??\c:\pdddv.exec:\pdddv.exe97⤵PID:2100
-
\??\c:\3frlflf.exec:\3frlflf.exe98⤵PID:5000
-
\??\c:\hbhbtb.exec:\hbhbtb.exe99⤵PID:3720
-
\??\c:\ppjjv.exec:\ppjjv.exe100⤵PID:3692
-
\??\c:\rflllff.exec:\rflllff.exe101⤵PID:2808
-
\??\c:\fxrffxf.exec:\fxrffxf.exe102⤵PID:1956
-
\??\c:\1hnbbb.exec:\1hnbbb.exe103⤵PID:2572
-
\??\c:\jpvvv.exec:\jpvvv.exe104⤵PID:2792
-
\??\c:\dvvpj.exec:\dvvpj.exe105⤵PID:1556
-
\??\c:\llfrxrx.exec:\llfrxrx.exe106⤵PID:4348
-
\??\c:\lrlflfx.exec:\lrlflfx.exe107⤵PID:3912
-
\??\c:\nhtttt.exec:\nhtttt.exe108⤵PID:5036
-
\??\c:\5tbtbh.exec:\5tbtbh.exe109⤵PID:2212
-
\??\c:\vpjdd.exec:\vpjdd.exe110⤵PID:4484
-
\??\c:\xfxrlff.exec:\xfxrlff.exe111⤵PID:2716
-
\??\c:\9xrrlll.exec:\9xrrlll.exe112⤵PID:1496
-
\??\c:\hbnbbn.exec:\hbnbbn.exe113⤵PID:2972
-
\??\c:\vjppj.exec:\vjppj.exe114⤵PID:2768
-
\??\c:\jvddv.exec:\jvddv.exe115⤵PID:1576
-
\??\c:\3rrlllx.exec:\3rrlllx.exe116⤵PID:3220
-
\??\c:\htbbtt.exec:\htbbtt.exe117⤵PID:4600
-
\??\c:\hthbtt.exec:\hthbtt.exe118⤵PID:840
-
\??\c:\vjpjj.exec:\vjpjj.exe119⤵PID:1232
-
\??\c:\lfflllx.exec:\lfflllx.exe120⤵PID:3548
-
\??\c:\nhthnn.exec:\nhthnn.exe121⤵PID:4628
-
\??\c:\3jjdv.exec:\3jjdv.exe122⤵PID:4568
-
\??\c:\7xxrlrl.exec:\7xxrlrl.exe123⤵PID:2488
-
\??\c:\7ffllxr.exec:\7ffllxr.exe124⤵PID:3032
-
\??\c:\3nttnn.exec:\3nttnn.exe125⤵PID:1196
-
\??\c:\pjjdd.exec:\pjjdd.exe126⤵PID:4412
-
\??\c:\vjjdv.exec:\vjjdv.exe127⤵PID:1224
-
\??\c:\fxfffff.exec:\fxfffff.exe128⤵PID:4744
-
\??\c:\btbtnn.exec:\btbtnn.exe129⤵PID:1256
-
\??\c:\bnnnhb.exec:\bnnnhb.exe130⤵PID:4160
-
\??\c:\djjdd.exec:\djjdd.exe131⤵PID:4572
-
\??\c:\rlxrlll.exec:\rlxrlll.exe132⤵PID:2400
-
\??\c:\llrrffl.exec:\llrrffl.exe133⤵PID:2232
-
\??\c:\frfxrrr.exec:\frfxrrr.exe134⤵PID:2704
-
\??\c:\bttnbt.exec:\bttnbt.exe135⤵PID:372
-
\??\c:\vddpv.exec:\vddpv.exe136⤵PID:4396
-
\??\c:\pvvpj.exec:\pvvpj.exe137⤵PID:3748
-
\??\c:\xxxrlxr.exec:\xxxrlxr.exe138⤵PID:656
-
\??\c:\bbttbn.exec:\bbttbn.exe139⤵PID:2176
-
\??\c:\dpvvv.exec:\dpvvv.exe140⤵PID:1524
-
\??\c:\pjpdd.exec:\pjpdd.exe141⤵PID:2460
-
\??\c:\rxfxllf.exec:\rxfxllf.exe142⤵PID:3960
-
\??\c:\rxrrxrf.exec:\rxrrxrf.exe143⤵PID:2096
-
\??\c:\hhhhht.exec:\hhhhht.exe144⤵PID:872
-
\??\c:\jppjv.exec:\jppjv.exe145⤵PID:3452
-
\??\c:\fxrrlfr.exec:\fxrrlfr.exe146⤵PID:3292
-
\??\c:\rffxrlf.exec:\rffxrlf.exe147⤵PID:4084
-
\??\c:\bbhnbh.exec:\bbhnbh.exe148⤵PID:4624
-
\??\c:\tnnbtn.exec:\tnnbtn.exe149⤵PID:3720
-
\??\c:\lxflllf.exec:\lxflllf.exe150⤵PID:1220
-
\??\c:\ffxxffr.exec:\ffxxffr.exe151⤵PID:3656
-
\??\c:\hbbtnn.exec:\hbbtnn.exe152⤵PID:404
-
\??\c:\bnttnn.exec:\bnttnn.exe153⤵PID:3716
-
\??\c:\pvvdp.exec:\pvvdp.exe154⤵PID:3904
-
\??\c:\5rrlfrl.exec:\5rrlfrl.exe155⤵PID:2252
-
\??\c:\hhhhhh.exec:\hhhhhh.exe156⤵PID:1072
-
\??\c:\btbtnn.exec:\btbtnn.exe157⤵PID:3084
-
\??\c:\jpvvp.exec:\jpvvp.exe158⤵PID:4768
-
\??\c:\7xfxlfx.exec:\7xfxlfx.exe159⤵PID:3144
-
\??\c:\nnnnnn.exec:\nnnnnn.exe160⤵PID:1544
-
\??\c:\5nnbnn.exec:\5nnbnn.exe161⤵PID:2944
-
\??\c:\pjvpj.exec:\pjvpj.exe162⤵PID:4632
-
\??\c:\1vvvj.exec:\1vvvj.exe163⤵PID:2972
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe164⤵PID:4660
-
\??\c:\9ttnbn.exec:\9ttnbn.exe165⤵PID:3028
-
\??\c:\nnhbbt.exec:\nnhbbt.exe166⤵PID:2192
-
\??\c:\dvjvj.exec:\dvjvj.exe167⤵PID:2172
-
\??\c:\dddjv.exec:\dddjv.exe168⤵PID:4360
-
\??\c:\9rlxrlx.exec:\9rlxrlx.exe169⤵PID:1232
-
\??\c:\hbnhbt.exec:\hbnhbt.exe170⤵PID:3548
-
\??\c:\vvpjd.exec:\vvpjd.exe171⤵PID:4848
-
\??\c:\xxrlxfl.exec:\xxrlxfl.exe172⤵PID:4844
-
\??\c:\xrfxfxr.exec:\xrfxfxr.exe173⤵PID:428
-
\??\c:\hbhtnh.exec:\hbhtnh.exe174⤵PID:4524
-
\??\c:\9pppj.exec:\9pppj.exe175⤵PID:3444
-
\??\c:\fxlfrrl.exec:\fxlfrrl.exe176⤵PID:2008
-
\??\c:\1rllffx.exec:\1rllffx.exe177⤵PID:2444
-
\??\c:\hntnbn.exec:\hntnbn.exe178⤵PID:1248
-
\??\c:\jvvdj.exec:\jvvdj.exe179⤵PID:3456
-
\??\c:\vpdvv.exec:\vpdvv.exe180⤵PID:232
-
\??\c:\lxrxfrf.exec:\lxrxfrf.exe181⤵PID:4532
-
\??\c:\fxxrfxr.exec:\fxxrfxr.exe182⤵PID:2132
-
\??\c:\nhttnh.exec:\nhttnh.exe183⤵PID:372
-
\??\c:\1jpjd.exec:\1jpjd.exe184⤵PID:2416
-
\??\c:\pjvpj.exec:\pjvpj.exe185⤵PID:4148
-
\??\c:\xrlffff.exec:\xrlffff.exe186⤵PID:3572
-
\??\c:\fflxfrf.exec:\fflxfrf.exe187⤵PID:1892
-
\??\c:\htttnn.exec:\htttnn.exe188⤵PID:4648
-
\??\c:\jvvpd.exec:\jvvpd.exe189⤵PID:2776
-
\??\c:\vpvvj.exec:\vpvvj.exe190⤵PID:4896
-
\??\c:\xrrrfxr.exec:\xrrrfxr.exe191⤵PID:1980
-
\??\c:\flrrlfx.exec:\flrrlfx.exe192⤵PID:1484
-
\??\c:\nbntnn.exec:\nbntnn.exe193⤵PID:1488
-
\??\c:\vddvp.exec:\vddvp.exe194⤵PID:2572
-
\??\c:\rlxrffl.exec:\rlxrffl.exe195⤵PID:4856
-
\??\c:\jvvvp.exec:\jvvvp.exe196⤵PID:3716
-
\??\c:\rxffxrr.exec:\rxffxrr.exe197⤵PID:3904
-
\??\c:\hhttnn.exec:\hhttnn.exe198⤵PID:2848
-
\??\c:\jdpjd.exec:\jdpjd.exe199⤵PID:2664
-
\??\c:\rxlxrxr.exec:\rxlxrxr.exe200⤵PID:2212
-
\??\c:\nnhhbb.exec:\nnhhbb.exe201⤵PID:4768
-
\??\c:\bthhhh.exec:\bthhhh.exe202⤵PID:2640
-
\??\c:\9pvpj.exec:\9pvpj.exe203⤵PID:2716
-
\??\c:\1flrlll.exec:\1flrlll.exe204⤵PID:1464
-
\??\c:\thtnnn.exec:\thtnnn.exe205⤵PID:5072
-
\??\c:\7pppd.exec:\7pppd.exe206⤵PID:1532
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe207⤵PID:1400
-
\??\c:\3htnnn.exec:\3htnnn.exe208⤵PID:3028
-
\??\c:\btbtnn.exec:\btbtnn.exe209⤵PID:4528
-
\??\c:\9pvvp.exec:\9pvvp.exe210⤵PID:2172
-
\??\c:\ddjdp.exec:\ddjdp.exe211⤵PID:1016
-
\??\c:\llllffx.exec:\llllffx.exe212⤵PID:4740
-
\??\c:\hntnnh.exec:\hntnnh.exe213⤵PID:2748
-
\??\c:\ddpjp.exec:\ddpjp.exe214⤵PID:2368
-
\??\c:\xrrlffl.exec:\xrrlffl.exe215⤵PID:1944
-
\??\c:\hhbnnh.exec:\hhbnnh.exe216⤵PID:4824
-
\??\c:\hbtnhb.exec:\hbtnhb.exe217⤵PID:4432
-
\??\c:\dvvvj.exec:\dvvvj.exe218⤵PID:1224
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe219⤵PID:448
-
\??\c:\bhnhbb.exec:\bhnhbb.exe220⤵PID:1916
-
\??\c:\tthbnt.exec:\tthbnt.exe221⤵PID:2472
-
\??\c:\ddpdd.exec:\ddpdd.exe222⤵PID:3456
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe223⤵PID:232
-
\??\c:\nnbtnt.exec:\nnbtnt.exe224⤵PID:3304
-
\??\c:\bbtnhh.exec:\bbtnhh.exe225⤵PID:2132
-
\??\c:\dvjdd.exec:\dvjdd.exe226⤵PID:4396
-
\??\c:\jdvpd.exec:\jdvpd.exe227⤵PID:4468
-
\??\c:\xxxrlrx.exec:\xxxrlrx.exe228⤵PID:5080
-
\??\c:\1nnnnn.exec:\1nnnnn.exe229⤵PID:3052
-
\??\c:\ddvdp.exec:\ddvdp.exe230⤵PID:2104
-
\??\c:\pvvpd.exec:\pvvpd.exe231⤵PID:4648
-
\??\c:\1ffxllx.exec:\1ffxllx.exe232⤵PID:4556
-
\??\c:\hhhhbb.exec:\hhhhbb.exe233⤵PID:4084
-
\??\c:\ppppj.exec:\ppppj.exe234⤵PID:1540
-
\??\c:\dppdv.exec:\dppdv.exe235⤵PID:1088
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe236⤵PID:1956
-
\??\c:\rfrfxxr.exec:\rfrfxxr.exe237⤵PID:4792
-
\??\c:\ntbbhh.exec:\ntbbhh.exe238⤵PID:3492
-
\??\c:\dvvvj.exec:\dvvvj.exe239⤵PID:3184
-
\??\c:\dvdvp.exec:\dvdvp.exe240⤵PID:392
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe241⤵PID:5036
-
\??\c:\hbnnnn.exec:\hbnnnn.exe242⤵PID:2844