Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 20:39
Behavioral task
behavioral1
Sample
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe
Resource
win7-20240508-en
General
-
Target
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe
-
Size
329KB
-
MD5
06b0facf85ce6ccf71cc9ea2c4b09400
-
SHA1
950a3307b8cf758a82b87906de6d0e5bbc44784b
-
SHA256
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781
-
SHA512
ba3e548704a1ddf6653cc0d36f541ab29c31c4342db19acd9c543667972358171e1fed0afecc770d1abe2127007bf36881d5af2011bd449d0f82223a77b0e6ef
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhY:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTI
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/2104-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-481-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2628-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-846-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-886-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2500-946-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-1113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-1176-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-1187-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2516-1229-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-1282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\bnbnnt.exe family_berbew C:\pjdjv.exe family_berbew C:\pvvjj.exe family_berbew C:\5hbthh.exe family_berbew C:\vpjjd.exe family_berbew C:\bhbttn.exe family_berbew C:\jppjv.exe family_berbew C:\nntntb.exe family_berbew C:\3pvdd.exe family_berbew C:\rlflrrx.exe family_berbew C:\vpdjv.exe family_berbew C:\rxfrxll.exe family_berbew C:\7vjjp.exe family_berbew C:\frrlfll.exe family_berbew C:\djpjj.exe family_berbew C:\5xrffxx.exe family_berbew C:\pvdvd.exe family_berbew C:\vdpvj.exe family_berbew C:\ttthbh.exe family_berbew \??\c:\vjppp.exe family_berbew C:\5xllxlx.exe family_berbew C:\pppvv.exe family_berbew C:\vjvjv.exe family_berbew C:\bnnnbn.exe family_berbew C:\xxlxlrx.exe family_berbew C:\nttnhn.exe family_berbew C:\rllrfrl.exe family_berbew C:\tttbnb.exe family_berbew C:\xlffrrx.exe family_berbew C:\ttthbt.exe family_berbew \??\c:\pddpj.exe family_berbew C:\3frfrrf.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
bnbnnt.exepjdjv.exepvvjj.exe5hbthh.exevpjjd.exebhbttn.exejppjv.exenntntb.exe3pvdd.exerlflrrx.exevpdjv.exerxfrxll.exe7vjjp.exefrrlfll.exedjpjj.exe5xrffxx.exepvdvd.exevdpvj.exettthbh.exevjppp.exe5xllxlx.exepppvv.exevjvjv.exebnnnbn.exexxlxlrx.exenttnhn.exerllrfrl.exetttbnb.exexlffrrx.exettthbt.exepddpj.exe3frfrrf.exe1ddpv.exelllrxff.exexfxrfrx.exennbbnn.exe1dppv.exexrlrflf.exeflfrflx.exenbnbth.exeppdjp.exerxffrll.exe1nnbbt.exennbhth.exepvdpp.exefrfxlxr.exe1ththb.exentbbhn.exe3vjjv.exexfxrfrf.exerfxfxxl.exennnbnt.exevvvjj.exedvjdj.exexfxffrl.exehbtnbh.exedjddp.exevdvjv.exerflffrl.exebbbtnb.exepddvv.exefxxlfxr.exebhhbbb.exennbbnn.exepid process 2104 bnbnnt.exe 1280 pjdjv.exe 2636 pvvjj.exe 2864 5hbthh.exe 2848 vpjjd.exe 2832 bhbttn.exe 2708 jppjv.exe 2504 nntntb.exe 2180 3pvdd.exe 1852 rlflrrx.exe 2776 vpdjv.exe 2964 rxfrxll.exe 2376 7vjjp.exe 1628 frrlfll.exe 1448 djpjj.exe 1660 5xrffxx.exe 2556 pvdvd.exe 1340 vdpvj.exe 856 ttthbh.exe 1764 vjppp.exe 676 5xllxlx.exe 600 pppvv.exe 1472 vjvjv.exe 1404 bnnnbn.exe 2452 xxlxlrx.exe 2324 nttnhn.exe 1536 rllrfrl.exe 1364 tttbnb.exe 548 xlffrrx.exe 2316 ttthbt.exe 2000 pddpj.exe 1648 3frfrrf.exe 2432 1ddpv.exe 2044 lllrxff.exe 2100 xfxrfrx.exe 1592 nnbbnn.exe 1964 1dppv.exe 2700 xrlrflf.exe 2592 flfrflx.exe 2724 nbnbth.exe 2852 ppdjp.exe 2780 rxffrll.exe 2848 1nnbbt.exe 2536 nnbhth.exe 2492 pvdpp.exe 2552 frfxlxr.exe 2948 1ththb.exe 1792 ntbbhn.exe 2816 3vjjv.exe 2808 xfxrfrf.exe 2968 rfxfxxl.exe 1436 nnnbnt.exe 1196 vvvjj.exe 2096 dvjdj.exe 2124 xfxffrl.exe 2268 hbtnbh.exe 2756 djddp.exe 1624 vdvjv.exe 860 rflffrl.exe 2232 bbbtnb.exe 2240 pddvv.exe 2260 fxxlfxr.exe 484 bhhbbb.exe 588 nnbbnn.exe -
Processes:
resource yara_rule behavioral1/memory/3048-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-886-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2524-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-977-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-1075-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-1121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-1194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-1207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-1214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-1229-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2836-1282-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exebnbnnt.exepjdjv.exepvvjj.exe5hbthh.exevpjjd.exebhbttn.exejppjv.exenntntb.exe3pvdd.exerlflrrx.exevpdjv.exerxfrxll.exe7vjjp.exefrrlfll.exedjpjj.exedescription pid process target process PID 3048 wrote to memory of 2104 3048 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe bnbnnt.exe PID 3048 wrote to memory of 2104 3048 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe bnbnnt.exe PID 3048 wrote to memory of 2104 3048 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe bnbnnt.exe PID 3048 wrote to memory of 2104 3048 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe bnbnnt.exe PID 2104 wrote to memory of 1280 2104 bnbnnt.exe pjdjv.exe PID 2104 wrote to memory of 1280 2104 bnbnnt.exe pjdjv.exe PID 2104 wrote to memory of 1280 2104 bnbnnt.exe pjdjv.exe PID 2104 wrote to memory of 1280 2104 bnbnnt.exe pjdjv.exe PID 1280 wrote to memory of 2636 1280 pjdjv.exe pvvjj.exe PID 1280 wrote to memory of 2636 1280 pjdjv.exe pvvjj.exe PID 1280 wrote to memory of 2636 1280 pjdjv.exe pvvjj.exe PID 1280 wrote to memory of 2636 1280 pjdjv.exe pvvjj.exe PID 2636 wrote to memory of 2864 2636 pvvjj.exe 5hbthh.exe PID 2636 wrote to memory of 2864 2636 pvvjj.exe 5hbthh.exe PID 2636 wrote to memory of 2864 2636 pvvjj.exe 5hbthh.exe PID 2636 wrote to memory of 2864 2636 pvvjj.exe 5hbthh.exe PID 2864 wrote to memory of 2848 2864 5hbthh.exe vpjjd.exe PID 2864 wrote to memory of 2848 2864 5hbthh.exe vpjjd.exe PID 2864 wrote to memory of 2848 2864 5hbthh.exe vpjjd.exe PID 2864 wrote to memory of 2848 2864 5hbthh.exe vpjjd.exe PID 2848 wrote to memory of 2832 2848 vpjjd.exe bhbttn.exe PID 2848 wrote to memory of 2832 2848 vpjjd.exe bhbttn.exe PID 2848 wrote to memory of 2832 2848 vpjjd.exe bhbttn.exe PID 2848 wrote to memory of 2832 2848 vpjjd.exe bhbttn.exe PID 2832 wrote to memory of 2708 2832 bhbttn.exe jppjv.exe PID 2832 wrote to memory of 2708 2832 bhbttn.exe jppjv.exe PID 2832 wrote to memory of 2708 2832 bhbttn.exe jppjv.exe PID 2832 wrote to memory of 2708 2832 bhbttn.exe jppjv.exe PID 2708 wrote to memory of 2504 2708 jppjv.exe nntntb.exe PID 2708 wrote to memory of 2504 2708 jppjv.exe nntntb.exe PID 2708 wrote to memory of 2504 2708 jppjv.exe nntntb.exe PID 2708 wrote to memory of 2504 2708 jppjv.exe nntntb.exe PID 2504 wrote to memory of 2180 2504 nntntb.exe 3pvdd.exe PID 2504 wrote to memory of 2180 2504 nntntb.exe 3pvdd.exe PID 2504 wrote to memory of 2180 2504 nntntb.exe 3pvdd.exe PID 2504 wrote to memory of 2180 2504 nntntb.exe 3pvdd.exe PID 2180 wrote to memory of 1852 2180 3pvdd.exe rlflrrx.exe PID 2180 wrote to memory of 1852 2180 3pvdd.exe rlflrrx.exe PID 2180 wrote to memory of 1852 2180 3pvdd.exe rlflrrx.exe PID 2180 wrote to memory of 1852 2180 3pvdd.exe rlflrrx.exe PID 1852 wrote to memory of 2776 1852 rlflrrx.exe vpdjv.exe PID 1852 wrote to memory of 2776 1852 rlflrrx.exe vpdjv.exe PID 1852 wrote to memory of 2776 1852 rlflrrx.exe vpdjv.exe PID 1852 wrote to memory of 2776 1852 rlflrrx.exe vpdjv.exe PID 2776 wrote to memory of 2964 2776 vpdjv.exe rxfrxll.exe PID 2776 wrote to memory of 2964 2776 vpdjv.exe rxfrxll.exe PID 2776 wrote to memory of 2964 2776 vpdjv.exe rxfrxll.exe PID 2776 wrote to memory of 2964 2776 vpdjv.exe rxfrxll.exe PID 2964 wrote to memory of 2376 2964 rxfrxll.exe 7vjjp.exe PID 2964 wrote to memory of 2376 2964 rxfrxll.exe 7vjjp.exe PID 2964 wrote to memory of 2376 2964 rxfrxll.exe 7vjjp.exe PID 2964 wrote to memory of 2376 2964 rxfrxll.exe 7vjjp.exe PID 2376 wrote to memory of 1628 2376 7vjjp.exe frrlfll.exe PID 2376 wrote to memory of 1628 2376 7vjjp.exe frrlfll.exe PID 2376 wrote to memory of 1628 2376 7vjjp.exe frrlfll.exe PID 2376 wrote to memory of 1628 2376 7vjjp.exe frrlfll.exe PID 1628 wrote to memory of 1448 1628 frrlfll.exe djpjj.exe PID 1628 wrote to memory of 1448 1628 frrlfll.exe djpjj.exe PID 1628 wrote to memory of 1448 1628 frrlfll.exe djpjj.exe PID 1628 wrote to memory of 1448 1628 frrlfll.exe djpjj.exe PID 1448 wrote to memory of 1660 1448 djpjj.exe 5xrffxx.exe PID 1448 wrote to memory of 1660 1448 djpjj.exe 5xrffxx.exe PID 1448 wrote to memory of 1660 1448 djpjj.exe 5xrffxx.exe PID 1448 wrote to memory of 1660 1448 djpjj.exe 5xrffxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe"C:\Users\Admin\AppData\Local\Temp\0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\bnbnnt.exec:\bnbnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\pjdjv.exec:\pjdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\pvvjj.exec:\pvvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\5hbthh.exec:\5hbthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vpjjd.exec:\vpjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\bhbttn.exec:\bhbttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\jppjv.exec:\jppjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\nntntb.exec:\nntntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\3pvdd.exec:\3pvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\rlflrrx.exec:\rlflrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\vpdjv.exec:\vpdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rxfrxll.exec:\rxfrxll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\7vjjp.exec:\7vjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\frrlfll.exec:\frrlfll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\djpjj.exec:\djpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\5xrffxx.exec:\5xrffxx.exe17⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pvdvd.exec:\pvdvd.exe18⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vdpvj.exec:\vdpvj.exe19⤵
- Executes dropped EXE
PID:1340 -
\??\c:\ttthbh.exec:\ttthbh.exe20⤵
- Executes dropped EXE
PID:856 -
\??\c:\vjppp.exec:\vjppp.exe21⤵
- Executes dropped EXE
PID:1764 -
\??\c:\5xllxlx.exec:\5xllxlx.exe22⤵
- Executes dropped EXE
PID:676 -
\??\c:\pppvv.exec:\pppvv.exe23⤵
- Executes dropped EXE
PID:600 -
\??\c:\vjvjv.exec:\vjvjv.exe24⤵
- Executes dropped EXE
PID:1472 -
\??\c:\bnnnbn.exec:\bnnnbn.exe25⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xxlxlrx.exec:\xxlxlrx.exe26⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nttnhn.exec:\nttnhn.exe27⤵
- Executes dropped EXE
PID:2324 -
\??\c:\rllrfrl.exec:\rllrfrl.exe28⤵
- Executes dropped EXE
PID:1536 -
\??\c:\tttbnb.exec:\tttbnb.exe29⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xlffrrx.exec:\xlffrrx.exe30⤵
- Executes dropped EXE
PID:548 -
\??\c:\ttthbt.exec:\ttthbt.exe31⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pddpj.exec:\pddpj.exe32⤵
- Executes dropped EXE
PID:2000 -
\??\c:\3frfrrf.exec:\3frfrrf.exe33⤵
- Executes dropped EXE
PID:1648 -
\??\c:\1ddpv.exec:\1ddpv.exe34⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lllrxff.exec:\lllrxff.exe35⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xfxrfrx.exec:\xfxrfrx.exe36⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nnbbnn.exec:\nnbbnn.exe37⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1dppv.exec:\1dppv.exe38⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xrlrflf.exec:\xrlrflf.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\flfrflx.exec:\flfrflx.exe40⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nbnbth.exec:\nbnbth.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ppdjp.exec:\ppdjp.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rxffrll.exec:\rxffrll.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1nnbbt.exec:\1nnbbt.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\nnbhth.exec:\nnbhth.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pvdpp.exec:\pvdpp.exe46⤵
- Executes dropped EXE
PID:2492 -
\??\c:\frfxlxr.exec:\frfxlxr.exe47⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1ththb.exec:\1ththb.exe48⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ntbbhn.exec:\ntbbhn.exe49⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3vjjv.exec:\3vjjv.exe50⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xfxrfrf.exec:\xfxrfrf.exe51⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rfxfxxl.exec:\rfxfxxl.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nnnbnt.exec:\nnnbnt.exe53⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vvvjj.exec:\vvvjj.exe54⤵
- Executes dropped EXE
PID:1196 -
\??\c:\dvjdj.exec:\dvjdj.exe55⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xfxffrl.exec:\xfxffrl.exe56⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hbtnbh.exec:\hbtnbh.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\djddp.exec:\djddp.exe58⤵
- Executes dropped EXE
PID:2756 -
\??\c:\vdvjv.exec:\vdvjv.exe59⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rflffrl.exec:\rflffrl.exe60⤵
- Executes dropped EXE
PID:860 -
\??\c:\bbbtnb.exec:\bbbtnb.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pddvv.exec:\pddvv.exe62⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fxxlfxr.exec:\fxxlfxr.exe63⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bhhbbb.exec:\bhhbbb.exe64⤵
- Executes dropped EXE
PID:484 -
\??\c:\nnbbnn.exec:\nnbbnn.exe65⤵
- Executes dropped EXE
PID:588 -
\??\c:\ddppv.exec:\ddppv.exe66⤵PID:1092
-
\??\c:\ffxfrfl.exec:\ffxfrfl.exe67⤵PID:1832
-
\??\c:\llxfxfr.exec:\llxfxfr.exe68⤵PID:1008
-
\??\c:\hnbbtb.exec:\hnbbtb.exe69⤵PID:2244
-
\??\c:\7jjpv.exec:\7jjpv.exe70⤵PID:2452
-
\??\c:\jdpjj.exec:\jdpjj.exe71⤵PID:1784
-
\??\c:\lxffxfx.exec:\lxffxfx.exe72⤵PID:872
-
\??\c:\7tnthn.exec:\7tnthn.exe73⤵PID:1996
-
\??\c:\5hnbht.exec:\5hnbht.exe74⤵PID:812
-
\??\c:\vjjjv.exec:\vjjjv.exe75⤵PID:1992
-
\??\c:\5xrlllx.exec:\5xrlllx.exe76⤵PID:2384
-
\??\c:\lllxrfr.exec:\lllxrfr.exe77⤵PID:2292
-
\??\c:\ttntbb.exec:\ttntbb.exe78⤵PID:1064
-
\??\c:\vddjj.exec:\vddjj.exe79⤵PID:1500
-
\??\c:\rrxxflx.exec:\rrxxflx.exe80⤵PID:2432
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe81⤵PID:2216
-
\??\c:\7tntbb.exec:\7tntbb.exe82⤵PID:1596
-
\??\c:\vdjdj.exec:\vdjdj.exe83⤵PID:2628
-
\??\c:\vpdjv.exec:\vpdjv.exe84⤵PID:1964
-
\??\c:\xxllrrr.exec:\xxllrrr.exe85⤵PID:2700
-
\??\c:\hbhtnn.exec:\hbhtnn.exe86⤵PID:2580
-
\??\c:\bttbbh.exec:\bttbbh.exe87⤵PID:2496
-
\??\c:\dvddd.exec:\dvddd.exe88⤵PID:2620
-
\??\c:\dddvj.exec:\dddvj.exe89⤵PID:2764
-
\??\c:\lrffxxl.exec:\lrffxxl.exe90⤵PID:2748
-
\??\c:\bbbnhb.exec:\bbbnhb.exe91⤵PID:2544
-
\??\c:\nnnnbb.exec:\nnnnbb.exe92⤵PID:2484
-
\??\c:\jdpvp.exec:\jdpvp.exe93⤵PID:2944
-
\??\c:\1vjpd.exec:\1vjpd.exe94⤵PID:2320
-
\??\c:\llflflx.exec:\llflflx.exe95⤵PID:2032
-
\??\c:\7httht.exec:\7httht.exe96⤵PID:2812
-
\??\c:\5tttnn.exec:\5tttnn.exe97⤵PID:2932
-
\??\c:\1pdpd.exec:\1pdpd.exe98⤵PID:2528
-
\??\c:\pvjdp.exec:\pvjdp.exe99⤵PID:2968
-
\??\c:\7xxrlxf.exec:\7xxrlxf.exe100⤵PID:1436
-
\??\c:\hnnttn.exec:\hnnttn.exe101⤵PID:1288
-
\??\c:\9jpdp.exec:\9jpdp.exe102⤵PID:1820
-
\??\c:\rlrflrf.exec:\rlrflrf.exe103⤵PID:1524
-
\??\c:\ffrxllx.exec:\ffrxllx.exe104⤵PID:1076
-
\??\c:\5hnnnb.exec:\5hnnnb.exe105⤵PID:2556
-
\??\c:\vpdjj.exec:\vpdjj.exe106⤵PID:2464
-
\??\c:\djpvj.exec:\djpvj.exe107⤵PID:2076
-
\??\c:\xxlxfrf.exec:\xxlxfrf.exe108⤵PID:1340
-
\??\c:\hhhnbn.exec:\hhhnbn.exe109⤵PID:1732
-
\??\c:\7tnbht.exec:\7tnbht.exe110⤵PID:992
-
\??\c:\vdvdv.exec:\vdvdv.exe111⤵PID:676
-
\??\c:\vddvj.exec:\vddvj.exe112⤵PID:1072
-
\??\c:\1xrlxfx.exec:\1xrlxfx.exe113⤵PID:832
-
\??\c:\bttnbh.exec:\bttnbh.exe114⤵PID:1472
-
\??\c:\hhnbnt.exec:\hhnbnt.exe115⤵PID:1692
-
\??\c:\ppjvd.exec:\ppjvd.exe116⤵PID:2368
-
\??\c:\rrlxxfx.exec:\rrlxxfx.exe117⤵PID:1160
-
\??\c:\xfxrfrl.exec:\xfxrfrl.exe118⤵PID:1760
-
\??\c:\9tnbtb.exec:\9tnbtb.exe119⤵PID:748
-
\??\c:\7vdpj.exec:\7vdpj.exe120⤵PID:3020
-
\??\c:\dddjd.exec:\dddjd.exe121⤵PID:880
-
\??\c:\lfrlrlf.exec:\lfrlrlf.exe122⤵PID:1252
-
\??\c:\nnnbth.exec:\nnnbth.exe123⤵PID:1836
-
\??\c:\vdjdj.exec:\vdjdj.exe124⤵PID:1728
-
\??\c:\xfflxfl.exec:\xfflxfl.exe125⤵PID:1648
-
\??\c:\pjvdj.exec:\pjvdj.exe126⤵PID:1828
-
\??\c:\dvvdp.exec:\dvvdp.exe127⤵PID:2444
-
\??\c:\3lflxfl.exec:\3lflxfl.exe128⤵PID:2116
-
\??\c:\1lflrxl.exec:\1lflrxl.exe129⤵PID:1720
-
\??\c:\bbtbnn.exec:\bbtbnn.exe130⤵PID:3024
-
\??\c:\5jjpp.exec:\5jjpp.exe131⤵PID:3052
-
\??\c:\fflxrxl.exec:\fflxrxl.exe132⤵PID:2712
-
\??\c:\rrlllxl.exec:\rrlllxl.exe133⤵PID:2640
-
\??\c:\hhthtb.exec:\hhthtb.exe134⤵PID:2680
-
\??\c:\7tntht.exec:\7tntht.exe135⤵PID:2524
-
\??\c:\ddjjj.exec:\ddjjj.exe136⤵PID:2512
-
\??\c:\rxrxrxl.exec:\rxrxrxl.exe137⤵PID:2576
-
\??\c:\hbthbt.exec:\hbthbt.exe138⤵PID:2500
-
\??\c:\1jvdj.exec:\1jvdj.exe139⤵PID:2492
-
\??\c:\ddjvp.exec:\ddjvp.exe140⤵PID:2036
-
\??\c:\xrxllfl.exec:\xrxllfl.exe141⤵PID:1892
-
\??\c:\bbntnt.exec:\bbntnt.exe142⤵PID:1852
-
\??\c:\5hnnnh.exec:\5hnnnh.exe143⤵PID:2940
-
\??\c:\9ddpd.exec:\9ddpd.exe144⤵PID:2908
-
\??\c:\1xrxlrf.exec:\1xrxlrf.exe145⤵PID:1440
-
\??\c:\3bnthb.exec:\3bnthb.exe146⤵PID:2968
-
\??\c:\7nhtbn.exec:\7nhtbn.exe147⤵PID:2296
-
\??\c:\jdvdv.exec:\jdvdv.exe148⤵PID:1288
-
\??\c:\jjdjv.exec:\jjdjv.exe149⤵PID:1820
-
\??\c:\ffxxflf.exec:\ffxxflf.exe150⤵PID:2124
-
\??\c:\nhthtb.exec:\nhthtb.exe151⤵PID:2268
-
\??\c:\vdvdp.exec:\vdvdp.exe152⤵PID:852
-
\??\c:\ddjjv.exec:\ddjjv.exe153⤵PID:2192
-
\??\c:\xfrlxlr.exec:\xfrlxlr.exe154⤵PID:1716
-
\??\c:\bhnhbt.exec:\bhnhbt.exe155⤵PID:1764
-
\??\c:\hbtbnb.exec:\hbtbnb.exe156⤵PID:320
-
\??\c:\1dvjv.exec:\1dvjv.exe157⤵PID:2304
-
\??\c:\xrlllrx.exec:\xrlllrx.exe158⤵PID:1148
-
\??\c:\xxxrlxr.exec:\xxxrlxr.exe159⤵PID:1880
-
\??\c:\bnttbt.exec:\bnttbt.exe160⤵PID:1404
-
\??\c:\5jppv.exec:\5jppv.exe161⤵PID:2456
-
\??\c:\rrlxfrf.exec:\rrlxfrf.exe162⤵PID:1056
-
\??\c:\1hnthn.exec:\1hnthn.exe163⤵PID:3068
-
\??\c:\htntbt.exec:\htntbt.exe164⤵PID:1760
-
\??\c:\3pvdp.exec:\3pvdp.exe165⤵PID:748
-
\??\c:\llxrfrf.exec:\llxrfrf.exe166⤵PID:808
-
\??\c:\llxlxxl.exec:\llxlxxl.exe167⤵PID:900
-
\??\c:\nntbnt.exec:\nntbnt.exe168⤵PID:576
-
\??\c:\3jdjj.exec:\3jdjj.exe169⤵PID:2408
-
\??\c:\dvvpv.exec:\dvvpv.exe170⤵PID:2392
-
\??\c:\xffxlxf.exec:\xffxlxf.exe171⤵PID:664
-
\??\c:\bhbbtb.exec:\bhbbtb.exe172⤵PID:2976
-
\??\c:\bhtntb.exec:\bhtntb.exe173⤵PID:1704
-
\??\c:\pdvpp.exec:\pdvpp.exe174⤵PID:2840
-
\??\c:\rrflxlx.exec:\rrflxlx.exe175⤵PID:1144
-
\??\c:\htbthn.exec:\htbthn.exe176⤵PID:2052
-
\??\c:\djjpp.exec:\djjpp.exe177⤵PID:2628
-
\??\c:\rrlrxxl.exec:\rrlrxxl.exe178⤵PID:2688
-
\??\c:\rrlflrf.exec:\rrlflrf.exe179⤵PID:2636
-
\??\c:\tttthh.exec:\tttthh.exe180⤵PID:2604
-
\??\c:\jjvdp.exec:\jjvdp.exe181⤵PID:2680
-
\??\c:\ffflfxl.exec:\ffflfxl.exe182⤵PID:2516
-
\??\c:\lfflxlr.exec:\lfflxlr.exe183⤵PID:2996
-
\??\c:\tttbtt.exec:\tttbtt.exe184⤵PID:2736
-
\??\c:\5ppdj.exec:\5ppdj.exe185⤵PID:2520
-
\??\c:\fffrxxl.exec:\fffrxxl.exe186⤵PID:2508
-
\??\c:\lffxxxl.exec:\lffxxxl.exe187⤵PID:2320
-
\??\c:\bbthnb.exec:\bbthnb.exe188⤵PID:2032
-
\??\c:\9bttht.exec:\9bttht.exe189⤵PID:2768
-
\??\c:\ddppj.exec:\ddppj.exe190⤵PID:2808
-
\??\c:\9rrxfrf.exec:\9rrxfrf.exe191⤵PID:2836
-
\??\c:\1hhhbb.exec:\1hhhbb.exe192⤵PID:1588
-
\??\c:\nnhtht.exec:\nnhtht.exe193⤵PID:1436
-
\??\c:\7dvjv.exec:\7dvjv.exe194⤵PID:396
-
\??\c:\rrfrffr.exec:\rrfrffr.exe195⤵PID:2096
-
\??\c:\flxllxr.exec:\flxllxr.exe196⤵PID:2548
-
\??\c:\tnbhbb.exec:\tnbhbb.exe197⤵PID:2584
-
\??\c:\ppjjv.exec:\ppjjv.exe198⤵PID:1624
-
\??\c:\ppjvp.exec:\ppjvp.exe199⤵PID:860
-
\??\c:\xrfrxfr.exec:\xrfrxfr.exe200⤵PID:1768
-
\??\c:\5thbbb.exec:\5thbbb.exe201⤵PID:380
-
\??\c:\pjvvd.exec:\pjvvd.exe202⤵PID:1968
-
\??\c:\pjpvj.exec:\pjpvj.exe203⤵PID:1764
-
\??\c:\xrfllrr.exec:\xrfllrr.exe204⤵PID:320
-
\??\c:\nhnnhn.exec:\nhnnhn.exe205⤵PID:2304
-
\??\c:\tbhtbh.exec:\tbhtbh.exe206⤵PID:2028
-
\??\c:\dvjjd.exec:\dvjjd.exe207⤵PID:2164
-
\??\c:\9xxfrfr.exec:\9xxfrfr.exe208⤵PID:2460
-
\??\c:\nhtbth.exec:\nhtbth.exe209⤵PID:1692
-
\??\c:\btbhhh.exec:\btbhhh.exe210⤵PID:344
-
\??\c:\ppjjd.exec:\ppjjd.exe211⤵PID:1548
-
\??\c:\dvppp.exec:\dvppp.exe212⤵PID:1888
-
\??\c:\3fllxfl.exec:\3fllxfl.exe213⤵PID:912
-
\??\c:\bnnnbh.exec:\bnnnbh.exe214⤵PID:548
-
\??\c:\vpvpp.exec:\vpvpp.exe215⤵PID:2264
-
\??\c:\pjvdj.exec:\pjvdj.exe216⤵PID:976
-
\??\c:\7rllxxl.exec:\7rllxxl.exe217⤵PID:612
-
\??\c:\ttnbth.exec:\ttnbth.exe218⤵PID:1688
-
\??\c:\tnbnbn.exec:\tnbnbn.exe219⤵PID:888
-
\??\c:\vvpjp.exec:\vvpjp.exe220⤵PID:1648
-
\??\c:\lfxllrl.exec:\lfxllrl.exe221⤵PID:2044
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe222⤵PID:1724
-
\??\c:\nnbbbh.exec:\nnbbbh.exe223⤵PID:3056
-
\??\c:\vvdpv.exec:\vvdpv.exe224⤵PID:1720
-
\??\c:\pjvjp.exec:\pjvjp.exe225⤵PID:2220
-
\??\c:\rrlrxlr.exec:\rrlrxlr.exe226⤵PID:2616
-
\??\c:\hbtbtb.exec:\hbtbtb.exe227⤵PID:2612
-
\??\c:\tnhntb.exec:\tnhntb.exe228⤵PID:2636
-
\??\c:\7dvdp.exec:\7dvdp.exe229⤵PID:2604
-
\??\c:\rlrxrxx.exec:\rlrxrxx.exe230⤵PID:2524
-
\??\c:\rlflrrf.exec:\rlflrrf.exe231⤵PID:2600
-
\??\c:\hnbtbt.exec:\hnbtbt.exe232⤵PID:2488
-
\??\c:\7dppv.exec:\7dppv.exe233⤵PID:3000
-
\??\c:\xrfxllr.exec:\xrfxllr.exe234⤵PID:2492
-
\??\c:\tnhtbh.exec:\tnhtbh.exe235⤵PID:2036
-
\??\c:\nnntbn.exec:\nnntbn.exe236⤵PID:2952
-
\??\c:\pvppv.exec:\pvppv.exe237⤵PID:2812
-
\??\c:\xlxrfrx.exec:\xlxrfrx.exe238⤵PID:2588
-
\??\c:\1llrxxl.exec:\1llrxxl.exe239⤵PID:2932
-
\??\c:\thntnn.exec:\thntnn.exe240⤵PID:1780
-
\??\c:\ddvpd.exec:\ddvpd.exe241⤵PID:1844
-