Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 19:29
Behavioral task
behavioral1
Sample
32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717.exe
Resource
win7-20240221-en
General
-
Target
32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717.exe
-
Size
441KB
-
MD5
15a3a1e3d0537ff0a2fa18e54f2c2640
-
SHA1
2a9f6b339a9820e2d8067160419ad5157b7f1dce
-
SHA256
32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717
-
SHA512
c3bb391d66015a4ce997df167c9403497bb162063adf68f61d074b1f50b7d3e8343872224a04d46038d3dd70db99c07b2c5b2d445493e750bf2316c021403257
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmHZ:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMj
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4828-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/632-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4696-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1904-21-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2972-30-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1604-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1968-44-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1456-49-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1692-52-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3940-58-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1912-67-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1764-74-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4412-75-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3784-84-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2096-107-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1548-114-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4280-150-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1260-169-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4176-184-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/920-182-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4324-194-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3660-195-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3660-198-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3296-202-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1540-212-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2960-219-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5072-226-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3204-231-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3040-237-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1972-241-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3256-248-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2588-252-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2756-259-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3228-266-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3092-271-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1408-280-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2096-284-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3056-306-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3500-349-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1944-356-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2568-361-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2980-368-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/736-375-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1320-382-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3656-412-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3324-429-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3324-432-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4820-458-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2448-468-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4944-502-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1636-513-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3092-528-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4596-571-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1020-599-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1560-621-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2588-632-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4344-640-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1216-777-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3112-814-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1528-902-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/888-948-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2796-965-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4108-990-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3916-1065-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\fxxxrll.exe family_berbew C:\vjppj.exe family_berbew C:\1nnbth.exe family_berbew C:\dpvpd.exe family_berbew C:\9dvvv.exe family_berbew C:\ttbbtt.exe family_berbew C:\rrfxrrl.exe family_berbew \??\c:\xllllrx.exe family_berbew C:\jddjv.exe family_berbew C:\hbtnht.exe family_berbew C:\jdpjd.exe family_berbew \??\c:\rlrfxxl.exe family_berbew \??\c:\thnnht.exe family_berbew \??\c:\5bbbnn.exe family_berbew C:\dpvpj.exe family_berbew \??\c:\jdvpp.exe family_berbew C:\3rrlllf.exe family_berbew C:\tttnhh.exe family_berbew C:\rxflrrx.exe family_berbew \??\c:\nnnhhh.exe family_berbew \??\c:\jdddv.exe family_berbew C:\rflfffx.exe family_berbew \??\c:\1nbbtt.exe family_berbew \??\c:\dpvvp.exe family_berbew C:\xfrfffx.exe family_berbew C:\frffxff.exe family_berbew C:\pjppj.exe family_berbew C:\fxlfxrl.exe family_berbew \??\c:\jpvpj.exe family_berbew \??\c:\nbhhbh.exe family_berbew C:\xflfxxf.exe family_berbew C:\rrrrfff.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
vjppj.exefxxxrll.exe1nnbth.exedpvpd.exe9dvvv.exettbbtt.exerrfxrrl.exexllllrx.exejddjv.exehbtnht.exejdpjd.exerlrfxxl.exethnnht.exe5bbbnn.exedpvpj.exejdvpp.exe3rrlllf.exetttnhh.exerxflrrx.exennnhhh.exejdddv.exerflfffx.exe1nbbtt.exedpvvp.exexfrfffx.exefrffxff.exepjppj.exefxlfxrl.exenbhhbh.exejpvpj.exexflfxxf.exerrrrfff.exe7nnhhh.exe7flfxxr.exenhhhbb.exehntnhh.exeddjjv.exexlllfrl.exe1bbbtb.exe7pvvp.exexllllxx.exefrrrllr.exe5tnnnn.exepjpjp.exerxllfff.exe5rrrrxx.exenhbbtb.exepppjj.exefxfxlll.exehbhhbb.exevpvvv.exexlrrllf.exettbnhh.exehtbtnt.exefflfrfr.exenbnhhb.exe9bnnnn.exe3pvpj.exelfrlfrr.exetnbhnn.exedvppv.exerxlffff.exenbbbtt.exevpdpp.exepid process 632 vjppj.exe 1904 fxxxrll.exe 4696 1nnbth.exe 2972 dpvpd.exe 1604 9dvvv.exe 1968 ttbbtt.exe 1456 rrfxrrl.exe 1692 xllllrx.exe 3940 jddjv.exe 1912 hbtnht.exe 1764 jdpjd.exe 4412 rlrfxxl.exe 3784 thnnht.exe 1708 5bbbnn.exe 1112 dpvpj.exe 3504 jdvpp.exe 2096 3rrlllf.exe 4168 tttnhh.exe 1548 rxflrrx.exe 4932 nnnhhh.exe 3188 jdddv.exe 2620 rflfffx.exe 3136 1nbbtt.exe 1568 dpvvp.exe 4280 xfrfffx.exe 1036 frffxff.exe 2424 pjppj.exe 3580 fxlfxrl.exe 1260 nbhhbh.exe 3368 jpvpj.exe 920 xflfxxf.exe 4176 rrrrfff.exe 3568 7nnhhh.exe 4324 7flfxxr.exe 3660 nhhhbb.exe 3296 hntnhh.exe 1904 ddjjv.exe 3168 xlllfrl.exe 1540 1bbbtb.exe 1860 7pvvp.exe 2960 xllllxx.exe 4208 frrrllr.exe 5072 5tnnnn.exe 1968 pjpjp.exe 3204 rxllfff.exe 3040 5rrrrxx.exe 1972 nhbbtb.exe 4936 pppjj.exe 3256 fxfxlll.exe 2588 hbhhbb.exe 2344 vpvvv.exe 2756 xlrrllf.exe 1580 ttbnhh.exe 3228 htbtnt.exe 1444 fflfrfr.exe 3092 nbnhhb.exe 4984 9bnnnn.exe 1408 3pvpj.exe 2096 lfrlfrr.exe 4756 tnbhnn.exe 4328 dvppv.exe 4340 rxlffff.exe 2072 nbbbtt.exe 4460 vpdpp.exe -
Processes:
resource yara_rule behavioral2/memory/4828-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4828-7-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/632-8-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\fxxxrll.exe upx behavioral2/memory/1904-13-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vjppj.exe upx C:\1nnbth.exe upx behavioral2/memory/4696-19-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1904-21-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\dpvpd.exe upx behavioral2/memory/2972-30-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\9dvvv.exe upx behavioral2/memory/1604-32-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ttbbtt.exe upx behavioral2/memory/1604-37-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rrfxrrl.exe upx behavioral2/memory/1968-44-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1456-49-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\xllllrx.exe upx behavioral2/memory/1692-52-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jddjv.exe upx C:\hbtnht.exe upx behavioral2/memory/3940-58-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jdpjd.exe upx behavioral2/memory/1912-67-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1764-74-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4412-75-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\rlrfxxl.exe upx \??\c:\thnnht.exe upx behavioral2/memory/3784-84-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\5bbbnn.exe upx C:\dpvpj.exe upx \??\c:\jdvpp.exe upx C:\3rrlllf.exe upx C:\tttnhh.exe upx behavioral2/memory/2096-107-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rxflrrx.exe upx behavioral2/memory/1548-114-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\nnnhhh.exe upx \??\c:\jdddv.exe upx C:\rflfffx.exe upx behavioral2/memory/2620-129-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\1nbbtt.exe upx \??\c:\dpvvp.exe upx C:\xfrfffx.exe upx C:\frffxff.exe upx behavioral2/memory/4280-150-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1036-151-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pjppj.exe upx C:\fxlfxrl.exe upx \??\c:\jpvpj.exe upx behavioral2/memory/1260-169-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\nbhhbh.exe upx C:\xflfxxf.exe upx C:\rrrrfff.exe upx behavioral2/memory/4176-184-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/920-182-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4324-194-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3660-195-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3660-198-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3296-202-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1540-212-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2960-219-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5072-223-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717.exevjppj.exefxxxrll.exe1nnbth.exedpvpd.exe9dvvv.exettbbtt.exerrfxrrl.exexllllrx.exejddjv.exehbtnht.exejdpjd.exerlrfxxl.exethnnht.exe5bbbnn.exedpvpj.exejdvpp.exe3rrlllf.exetttnhh.exerxflrrx.exennnhhh.exejdddv.exedescription pid process target process PID 4828 wrote to memory of 632 4828 32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717.exe vjppj.exe PID 4828 wrote to memory of 632 4828 32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717.exe vjppj.exe PID 4828 wrote to memory of 632 4828 32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717.exe vjppj.exe PID 632 wrote to memory of 1904 632 vjppj.exe fxxxrll.exe PID 632 wrote to memory of 1904 632 vjppj.exe fxxxrll.exe PID 632 wrote to memory of 1904 632 vjppj.exe fxxxrll.exe PID 1904 wrote to memory of 4696 1904 fxxxrll.exe 1nnbth.exe PID 1904 wrote to memory of 4696 1904 fxxxrll.exe 1nnbth.exe PID 1904 wrote to memory of 4696 1904 fxxxrll.exe 1nnbth.exe PID 4696 wrote to memory of 2972 4696 1nnbth.exe dpvpd.exe PID 4696 wrote to memory of 2972 4696 1nnbth.exe dpvpd.exe PID 4696 wrote to memory of 2972 4696 1nnbth.exe dpvpd.exe PID 2972 wrote to memory of 1604 2972 dpvpd.exe 9dvvv.exe PID 2972 wrote to memory of 1604 2972 dpvpd.exe 9dvvv.exe PID 2972 wrote to memory of 1604 2972 dpvpd.exe 9dvvv.exe PID 1604 wrote to memory of 1968 1604 9dvvv.exe ttbbtt.exe PID 1604 wrote to memory of 1968 1604 9dvvv.exe ttbbtt.exe PID 1604 wrote to memory of 1968 1604 9dvvv.exe ttbbtt.exe PID 1968 wrote to memory of 1456 1968 ttbbtt.exe rrfxrrl.exe PID 1968 wrote to memory of 1456 1968 ttbbtt.exe rrfxrrl.exe PID 1968 wrote to memory of 1456 1968 ttbbtt.exe rrfxrrl.exe PID 1456 wrote to memory of 1692 1456 rrfxrrl.exe xllllrx.exe PID 1456 wrote to memory of 1692 1456 rrfxrrl.exe xllllrx.exe PID 1456 wrote to memory of 1692 1456 rrfxrrl.exe xllllrx.exe PID 1692 wrote to memory of 3940 1692 xllllrx.exe jddjv.exe PID 1692 wrote to memory of 3940 1692 xllllrx.exe jddjv.exe PID 1692 wrote to memory of 3940 1692 xllllrx.exe jddjv.exe PID 3940 wrote to memory of 1912 3940 jddjv.exe hbtnht.exe PID 3940 wrote to memory of 1912 3940 jddjv.exe hbtnht.exe PID 3940 wrote to memory of 1912 3940 jddjv.exe hbtnht.exe PID 1912 wrote to memory of 1764 1912 hbtnht.exe jdpjd.exe PID 1912 wrote to memory of 1764 1912 hbtnht.exe jdpjd.exe PID 1912 wrote to memory of 1764 1912 hbtnht.exe jdpjd.exe PID 1764 wrote to memory of 4412 1764 jdpjd.exe rlrfxxl.exe PID 1764 wrote to memory of 4412 1764 jdpjd.exe rlrfxxl.exe PID 1764 wrote to memory of 4412 1764 jdpjd.exe rlrfxxl.exe PID 4412 wrote to memory of 3784 4412 rlrfxxl.exe thnnht.exe PID 4412 wrote to memory of 3784 4412 rlrfxxl.exe thnnht.exe PID 4412 wrote to memory of 3784 4412 rlrfxxl.exe thnnht.exe PID 3784 wrote to memory of 1708 3784 thnnht.exe 5bbbnn.exe PID 3784 wrote to memory of 1708 3784 thnnht.exe 5bbbnn.exe PID 3784 wrote to memory of 1708 3784 thnnht.exe 5bbbnn.exe PID 1708 wrote to memory of 1112 1708 5bbbnn.exe dpvpj.exe PID 1708 wrote to memory of 1112 1708 5bbbnn.exe dpvpj.exe PID 1708 wrote to memory of 1112 1708 5bbbnn.exe dpvpj.exe PID 1112 wrote to memory of 3504 1112 dpvpj.exe jdvpp.exe PID 1112 wrote to memory of 3504 1112 dpvpj.exe jdvpp.exe PID 1112 wrote to memory of 3504 1112 dpvpj.exe jdvpp.exe PID 3504 wrote to memory of 2096 3504 jdvpp.exe 3rrlllf.exe PID 3504 wrote to memory of 2096 3504 jdvpp.exe 3rrlllf.exe PID 3504 wrote to memory of 2096 3504 jdvpp.exe 3rrlllf.exe PID 2096 wrote to memory of 4168 2096 3rrlllf.exe tttnhh.exe PID 2096 wrote to memory of 4168 2096 3rrlllf.exe tttnhh.exe PID 2096 wrote to memory of 4168 2096 3rrlllf.exe tttnhh.exe PID 4168 wrote to memory of 1548 4168 tttnhh.exe rxflrrx.exe PID 4168 wrote to memory of 1548 4168 tttnhh.exe rxflrrx.exe PID 4168 wrote to memory of 1548 4168 tttnhh.exe rxflrrx.exe PID 1548 wrote to memory of 4932 1548 rxflrrx.exe nnnhhh.exe PID 1548 wrote to memory of 4932 1548 rxflrrx.exe nnnhhh.exe PID 1548 wrote to memory of 4932 1548 rxflrrx.exe nnnhhh.exe PID 4932 wrote to memory of 3188 4932 nnnhhh.exe jdddv.exe PID 4932 wrote to memory of 3188 4932 nnnhhh.exe jdddv.exe PID 4932 wrote to memory of 3188 4932 nnnhhh.exe jdddv.exe PID 3188 wrote to memory of 2620 3188 jdddv.exe rflfffx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717.exe"C:\Users\Admin\AppData\Local\Temp\32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\vjppj.exec:\vjppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\fxxxrll.exec:\fxxxrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\1nnbth.exec:\1nnbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\dpvpd.exec:\dpvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\9dvvv.exec:\9dvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\ttbbtt.exec:\ttbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\xllllrx.exec:\xllllrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\jddjv.exec:\jddjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\hbtnht.exec:\hbtnht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\jdpjd.exec:\jdpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\rlrfxxl.exec:\rlrfxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\thnnht.exec:\thnnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\5bbbnn.exec:\5bbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\dpvpj.exec:\dpvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\jdvpp.exec:\jdvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\3rrlllf.exec:\3rrlllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\tttnhh.exec:\tttnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\rxflrrx.exec:\rxflrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\nnnhhh.exec:\nnnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\jdddv.exec:\jdddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\rflfffx.exec:\rflfffx.exe23⤵
- Executes dropped EXE
PID:2620 -
\??\c:\1nbbtt.exec:\1nbbtt.exe24⤵
- Executes dropped EXE
PID:3136 -
\??\c:\dpvvp.exec:\dpvvp.exe25⤵
- Executes dropped EXE
PID:1568 -
\??\c:\xfrfffx.exec:\xfrfffx.exe26⤵
- Executes dropped EXE
PID:4280 -
\??\c:\frffxff.exec:\frffxff.exe27⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pjppj.exec:\pjppj.exe28⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fxlfxrl.exec:\fxlfxrl.exe29⤵
- Executes dropped EXE
PID:3580 -
\??\c:\nbhhbh.exec:\nbhhbh.exe30⤵
- Executes dropped EXE
PID:1260 -
\??\c:\jpvpj.exec:\jpvpj.exe31⤵
- Executes dropped EXE
PID:3368 -
\??\c:\xflfxxf.exec:\xflfxxf.exe32⤵
- Executes dropped EXE
PID:920 -
\??\c:\rrrrfff.exec:\rrrrfff.exe33⤵
- Executes dropped EXE
PID:4176 -
\??\c:\7nnhhh.exec:\7nnhhh.exe34⤵
- Executes dropped EXE
PID:3568 -
\??\c:\7flfxxr.exec:\7flfxxr.exe35⤵
- Executes dropped EXE
PID:4324 -
\??\c:\nhhhbb.exec:\nhhhbb.exe36⤵
- Executes dropped EXE
PID:3660 -
\??\c:\hntnhh.exec:\hntnhh.exe37⤵
- Executes dropped EXE
PID:3296 -
\??\c:\ddjjv.exec:\ddjjv.exe38⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xlllfrl.exec:\xlllfrl.exe39⤵
- Executes dropped EXE
PID:3168 -
\??\c:\1bbbtb.exec:\1bbbtb.exe40⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7pvvp.exec:\7pvvp.exe41⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xllllxx.exec:\xllllxx.exe42⤵
- Executes dropped EXE
PID:2960 -
\??\c:\frrrllr.exec:\frrrllr.exe43⤵
- Executes dropped EXE
PID:4208 -
\??\c:\5tnnnn.exec:\5tnnnn.exe44⤵
- Executes dropped EXE
PID:5072 -
\??\c:\pjpjp.exec:\pjpjp.exe45⤵
- Executes dropped EXE
PID:1968 -
\??\c:\rxllfff.exec:\rxllfff.exe46⤵
- Executes dropped EXE
PID:3204 -
\??\c:\5rrrrxx.exec:\5rrrrxx.exe47⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nhbbtb.exec:\nhbbtb.exe48⤵
- Executes dropped EXE
PID:1972 -
\??\c:\pppjj.exec:\pppjj.exe49⤵
- Executes dropped EXE
PID:4936 -
\??\c:\fxfxlll.exec:\fxfxlll.exe50⤵
- Executes dropped EXE
PID:3256 -
\??\c:\hbhhbb.exec:\hbhhbb.exe51⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vpvvv.exec:\vpvvv.exe52⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xlrrllf.exec:\xlrrllf.exe53⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ttbnhh.exec:\ttbnhh.exe54⤵
- Executes dropped EXE
PID:1580 -
\??\c:\htbtnt.exec:\htbtnt.exe55⤵
- Executes dropped EXE
PID:3228 -
\??\c:\fflfrfr.exec:\fflfrfr.exe56⤵
- Executes dropped EXE
PID:1444 -
\??\c:\nbnhhb.exec:\nbnhhb.exe57⤵
- Executes dropped EXE
PID:3092 -
\??\c:\9bnnnn.exec:\9bnnnn.exe58⤵
- Executes dropped EXE
PID:4984 -
\??\c:\3pvpj.exec:\3pvpj.exe59⤵
- Executes dropped EXE
PID:1408 -
\??\c:\lfrlfrr.exec:\lfrlfrr.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tnbhnn.exec:\tnbhnn.exe61⤵
- Executes dropped EXE
PID:4756 -
\??\c:\dvppv.exec:\dvppv.exe62⤵
- Executes dropped EXE
PID:4328 -
\??\c:\rxlffff.exec:\rxlffff.exe63⤵
- Executes dropped EXE
PID:4340 -
\??\c:\nbbbtt.exec:\nbbbtt.exe64⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vpdpp.exec:\vpdpp.exe65⤵
- Executes dropped EXE
PID:4460 -
\??\c:\3rlfrrl.exec:\3rlfrrl.exe66⤵PID:1952
-
\??\c:\3llffxf.exec:\3llffxf.exe67⤵PID:3056
-
\??\c:\htbbtt.exec:\htbbtt.exe68⤵PID:4380
-
\??\c:\djvjd.exec:\djvjd.exe69⤵PID:1792
-
\??\c:\lrxlrlf.exec:\lrxlrlf.exe70⤵PID:3540
-
\??\c:\bthnhh.exec:\bthnhh.exe71⤵PID:3240
-
\??\c:\hbbhbt.exec:\hbbhbt.exe72⤵PID:4596
-
\??\c:\ddppv.exec:\ddppv.exe73⤵PID:4228
-
\??\c:\3lfxxxx.exec:\3lfxxxx.exe74⤵PID:1592
-
\??\c:\7rflfrl.exec:\7rflfrl.exe75⤵PID:3000
-
\??\c:\hhntbt.exec:\hhntbt.exe76⤵PID:4084
-
\??\c:\1flflxl.exec:\1flflxl.exe77⤵PID:2448
-
\??\c:\3lfxrlf.exec:\3lfxrlf.exe78⤵PID:3492
-
\??\c:\jpddv.exec:\jpddv.exe79⤵PID:1420
-
\??\c:\jddvp.exec:\jddvp.exe80⤵PID:2884
-
\??\c:\ffffxff.exec:\ffffxff.exe81⤵PID:916
-
\??\c:\dvvpj.exec:\dvvpj.exe82⤵PID:3500
-
\??\c:\vjjpj.exec:\vjjpj.exe83⤵PID:1944
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe84⤵PID:2568
-
\??\c:\tbbbtt.exec:\tbbbtt.exe85⤵PID:888
-
\??\c:\jpvpj.exec:\jpvpj.exe86⤵PID:2980
-
\??\c:\rfxrffx.exec:\rfxrffx.exe87⤵PID:644
-
\??\c:\bhnhnn.exec:\bhnhnn.exe88⤵PID:216
-
\??\c:\3dvpj.exec:\3dvpj.exe89⤵PID:736
-
\??\c:\3jpjj.exec:\3jpjj.exe90⤵PID:2288
-
\??\c:\lffxllx.exec:\lffxllx.exe91⤵PID:1320
-
\??\c:\htnhhb.exec:\htnhhb.exe92⤵PID:1572
-
\??\c:\dvppp.exec:\dvppp.exe93⤵PID:3256
-
\??\c:\pdddp.exec:\pdddp.exe94⤵PID:1380
-
\??\c:\frxfxxx.exec:\frxfxxx.exe95⤵PID:4024
-
\??\c:\5lrlfrr.exec:\5lrlfrr.exe96⤵PID:1988
-
\??\c:\nbhbtn.exec:\nbhbtn.exe97⤵PID:4108
-
\??\c:\dvvpj.exec:\dvvpj.exe98⤵PID:1980
-
\??\c:\dvjjd.exec:\dvjjd.exe99⤵PID:3260
-
\??\c:\5rlfxrr.exec:\5rlfxrr.exe100⤵PID:3656
-
\??\c:\nbhbtn.exec:\nbhbtn.exe101⤵PID:4040
-
\??\c:\nnhnnn.exec:\nnhnnn.exe102⤵PID:4720
-
\??\c:\dppjd.exec:\dppjd.exe103⤵PID:1208
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe104⤵PID:1824
-
\??\c:\thhbtt.exec:\thhbtt.exe105⤵PID:3324
-
\??\c:\1nthbt.exec:\1nthbt.exe106⤵PID:812
-
\??\c:\pvdpj.exec:\pvdpj.exe107⤵PID:4920
-
\??\c:\nhhhbb.exec:\nhhhbb.exe108⤵PID:2808
-
\??\c:\pjpvp.exec:\pjpvp.exe109⤵PID:4764
-
\??\c:\1xfxlll.exec:\1xfxlll.exe110⤵PID:2360
-
\??\c:\7tntth.exec:\7tntth.exe111⤵PID:3804
-
\??\c:\9hhbnh.exec:\9hhbnh.exe112⤵PID:1260
-
\??\c:\vpvjv.exec:\vpvjv.exe113⤵PID:4820
-
\??\c:\5xfxllf.exec:\5xfxllf.exe114⤵PID:1404
-
\??\c:\7tnbtn.exec:\7tnbtn.exe115⤵PID:4084
-
\??\c:\jpdvp.exec:\jpdvp.exe116⤵PID:2448
-
\??\c:\5xxlflx.exec:\5xxlflx.exe117⤵PID:1196
-
\??\c:\1llfxxr.exec:\1llfxxr.exe118⤵PID:3364
-
\??\c:\7nnhbb.exec:\7nnhbb.exe119⤵PID:5048
-
\??\c:\3vdvj.exec:\3vdvj.exe120⤵PID:472
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe121⤵PID:3120
-
\??\c:\7xfxxxx.exec:\7xfxxxx.exe122⤵PID:1944
-
\??\c:\1hbbtt.exec:\1hbbtt.exe123⤵PID:2568
-
\??\c:\dpvjj.exec:\dpvjj.exe124⤵PID:3924
-
\??\c:\7pdvp.exec:\7pdvp.exe125⤵PID:4208
-
\??\c:\7rlfxrl.exec:\7rlfxrl.exe126⤵PID:2296
-
\??\c:\nttbtn.exec:\nttbtn.exe127⤵PID:4944
-
\??\c:\jpvjd.exec:\jpvjd.exe128⤵PID:3940
-
\??\c:\ppdvv.exec:\ppdvv.exe129⤵PID:4956
-
\??\c:\3xxxfff.exec:\3xxxfff.exe130⤵PID:3048
-
\??\c:\5tnhbt.exec:\5tnhbt.exe131⤵PID:1636
-
\??\c:\jvjdv.exec:\jvjdv.exe132⤵PID:4188
-
\??\c:\fffxxff.exec:\fffxxff.exe133⤵PID:3264
-
\??\c:\frxxfxl.exec:\frxxfxl.exe134⤵PID:3504
-
\??\c:\1hhbnn.exec:\1hhbnn.exe135⤵PID:3092
-
\??\c:\ppvvd.exec:\ppvvd.exe136⤵PID:4772
-
\??\c:\rfrlxfx.exec:\rfrlxfx.exe137⤵PID:1632
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe138⤵PID:4044
-
\??\c:\thnhbb.exec:\thnhbb.exe139⤵PID:2604
-
\??\c:\jddvj.exec:\jddvj.exe140⤵PID:3852
-
\??\c:\1djdv.exec:\1djdv.exe141⤵PID:1208
-
\??\c:\xxlllll.exec:\xxlllll.exe142⤵PID:4488
-
\??\c:\btthbb.exec:\btthbb.exe143⤵PID:1140
-
\??\c:\nhtntt.exec:\nhtntt.exe144⤵PID:1728
-
\??\c:\jpvdd.exec:\jpvdd.exe145⤵PID:1960
-
\??\c:\rxfxrxx.exec:\rxfxrxx.exe146⤵PID:3600
-
\??\c:\nhnhhb.exec:\nhnhhb.exe147⤵PID:5036
-
\??\c:\btbhtt.exec:\btbhtt.exe148⤵PID:1836
-
\??\c:\ppdpp.exec:\ppdpp.exe149⤵PID:4596
-
\??\c:\xlllllf.exec:\xlllllf.exe150⤵PID:4628
-
\??\c:\bnhhbh.exec:\bnhhbh.exe151⤵PID:2520
-
\??\c:\tnbbbt.exec:\tnbbbt.exe152⤵PID:2404
-
\??\c:\jpvpj.exec:\jpvpj.exe153⤵PID:3728
-
\??\c:\xlxrlxr.exec:\xlxrlxr.exe154⤵PID:4320
-
\??\c:\thhbtt.exec:\thhbtt.exe155⤵PID:2368
-
\??\c:\nhthtn.exec:\nhthtn.exe156⤵PID:4828
-
\??\c:\ppdvd.exec:\ppdvd.exe157⤵PID:4696
-
\??\c:\7rlrllx.exec:\7rlrllx.exe158⤵PID:5060
-
\??\c:\httnnn.exec:\httnnn.exe159⤵PID:1020
-
\??\c:\nnbbhh.exec:\nnbbhh.exe160⤵PID:2972
-
\??\c:\pjppj.exec:\pjppj.exe161⤵PID:3596
-
\??\c:\lxffxrf.exec:\lxffxrf.exe162⤵PID:2892
-
\??\c:\7ntnnt.exec:\7ntnnt.exe163⤵PID:3268
-
\??\c:\hbnhbb.exec:\hbnhbb.exe164⤵PID:1968
-
\??\c:\dvdpj.exec:\dvdpj.exe165⤵PID:2792
-
\??\c:\rfllfxr.exec:\rfllfxr.exe166⤵PID:1560
-
\??\c:\fllllll.exec:\fllllll.exe167⤵PID:4852
-
\??\c:\hbbbbt.exec:\hbbbbt.exe168⤵PID:2588
-
\??\c:\9vvpj.exec:\9vvpj.exe169⤵PID:2852
-
\??\c:\lrflfxx.exec:\lrflfxx.exe170⤵PID:4344
-
\??\c:\hhttbh.exec:\hhttbh.exe171⤵PID:3264
-
\??\c:\bttnbb.exec:\bttnbb.exe172⤵PID:4984
-
\??\c:\1pjjd.exec:\1pjjd.exe173⤵PID:1408
-
\??\c:\5xxrrxx.exec:\5xxrrxx.exe174⤵PID:4740
-
\??\c:\bnbtnn.exec:\bnbtnn.exe175⤵PID:3308
-
\??\c:\jddvp.exec:\jddvp.exe176⤵PID:4592
-
\??\c:\ppdvd.exec:\ppdvd.exe177⤵PID:4428
-
\??\c:\frfrlfx.exec:\frfrlfx.exe178⤵PID:460
-
\??\c:\nhhnht.exec:\nhhnht.exe179⤵PID:2532
-
\??\c:\9pppp.exec:\9pppp.exe180⤵PID:3324
-
\??\c:\7llfxxx.exec:\7llfxxx.exe181⤵PID:1140
-
\??\c:\rxfxrll.exec:\rxfxrll.exe182⤵PID:1792
-
\??\c:\ntnhhh.exec:\ntnhhh.exe183⤵PID:4764
-
\??\c:\7djdv.exec:\7djdv.exe184⤵PID:5036
-
\??\c:\lflrrrl.exec:\lflrrrl.exe185⤵PID:4464
-
\??\c:\ntbhbh.exec:\ntbhbh.exe186⤵PID:4812
-
\??\c:\nhhbbb.exec:\nhhbbb.exe187⤵PID:3544
-
\??\c:\7vddv.exec:\7vddv.exe188⤵PID:4820
-
\??\c:\lrrlffx.exec:\lrrlffx.exe189⤵PID:3336
-
\??\c:\ttnhbb.exec:\ttnhbb.exe190⤵PID:1756
-
\??\c:\tttnhh.exec:\tttnhh.exe191⤵PID:2448
-
\??\c:\jjpjp.exec:\jjpjp.exe192⤵PID:1196
-
\??\c:\flrrrll.exec:\flrrrll.exe193⤵PID:3296
-
\??\c:\htttnn.exec:\htttnn.exe194⤵PID:4216
-
\??\c:\bbbtnn.exec:\bbbtnn.exe195⤵PID:3120
-
\??\c:\vdjjd.exec:\vdjjd.exe196⤵PID:1712
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe197⤵PID:2268
-
\??\c:\bbhhnt.exec:\bbhhnt.exe198⤵PID:556
-
\??\c:\jdppj.exec:\jdppj.exe199⤵PID:3924
-
\??\c:\fxrrrrl.exec:\fxrrrrl.exe200⤵PID:4784
-
\??\c:\rlllflf.exec:\rlllflf.exe201⤵PID:3204
-
\??\c:\hnnbtb.exec:\hnnbtb.exe202⤵PID:1692
-
\??\c:\pvddv.exec:\pvddv.exe203⤵PID:4500
-
\??\c:\xfffxxr.exec:\xfffxxr.exe204⤵PID:3244
-
\??\c:\7nttnn.exec:\7nttnn.exe205⤵PID:4412
-
\??\c:\jjpjd.exec:\jjpjd.exe206⤵PID:2588
-
\??\c:\vdvpp.exec:\vdvpp.exe207⤵PID:1584
-
\??\c:\rlffxfx.exec:\rlffxfx.exe208⤵PID:4200
-
\??\c:\5ntnhh.exec:\5ntnhh.exe209⤵PID:1980
-
\??\c:\vddvv.exec:\vddvv.exe210⤵PID:3900
-
\??\c:\3llfxxr.exec:\3llfxxr.exe211⤵PID:4120
-
\??\c:\7tbhhn.exec:\7tbhhn.exe212⤵PID:3656
-
\??\c:\jddvv.exec:\jddvv.exe213⤵PID:3344
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe214⤵PID:2324
-
\??\c:\lxlrrrr.exec:\lxlrrrr.exe215⤵PID:1216
-
\??\c:\bbnnbb.exec:\bbnnbb.exe216⤵PID:1952
-
\??\c:\7dvpv.exec:\7dvpv.exe217⤵PID:4360
-
\??\c:\rlflrfl.exec:\rlflrfl.exe218⤵PID:3324
-
\??\c:\5bhbhb.exec:\5bhbhb.exe219⤵PID:1616
-
\??\c:\vvpjj.exec:\vvpjj.exe220⤵PID:3240
-
\??\c:\lflfffx.exec:\lflfffx.exe221⤵PID:2008
-
\??\c:\1nnhbb.exec:\1nnhbb.exe222⤵PID:3832
-
\??\c:\hbbtnt.exec:\hbbtnt.exe223⤵PID:4312
-
\??\c:\pjvpj.exec:\pjvpj.exe224⤵PID:1592
-
\??\c:\llllffx.exec:\llllffx.exe225⤵PID:2760
-
\??\c:\bnttnh.exec:\bnttnh.exe226⤵PID:2108
-
\??\c:\bnntnb.exec:\bnntnb.exe227⤵PID:3112
-
\??\c:\jddjj.exec:\jddjj.exe228⤵PID:4320
-
\??\c:\xxfxxrr.exec:\xxfxxrr.exe229⤵PID:2264
-
\??\c:\7bhbhb.exec:\7bhbhb.exe230⤵PID:1848
-
\??\c:\ttbtnn.exec:\ttbtnn.exe231⤵PID:5032
-
\??\c:\3ppjj.exec:\3ppjj.exe232⤵PID:5060
-
\??\c:\1xxrllf.exec:\1xxrllf.exe233⤵PID:1072
-
\??\c:\3tbttn.exec:\3tbttn.exe234⤵PID:1484
-
\??\c:\vpjjd.exec:\vpjjd.exe235⤵PID:2972
-
\??\c:\flrlfxr.exec:\flrlfxr.exe236⤵PID:3596
-
\??\c:\thnhhb.exec:\thnhhb.exe237⤵PID:5072
-
\??\c:\tbbbtt.exec:\tbbbtt.exe238⤵PID:4848
-
\??\c:\dvjjd.exec:\dvjjd.exe239⤵PID:3040
-
\??\c:\ffxfllf.exec:\ffxfllf.exe240⤵PID:2792
-
\??\c:\thbttb.exec:\thbttb.exe241⤵PID:3456
-