Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2023, 05:18
Behavioral task
behavioral1
Sample
NEAS.6ee9e5e3fb9b92125a60e50be5ee91f0.exe
Resource
win7-20231025-en
General
-
Target
NEAS.6ee9e5e3fb9b92125a60e50be5ee91f0.exe
-
Size
438KB
-
MD5
6ee9e5e3fb9b92125a60e50be5ee91f0
-
SHA1
2f1301d36a321e8a225e64bc939572a6f4cf5b7b
-
SHA256
42d3d779220e23514ca2b75270f73037b35749f1683b1c89f16420f59d803cf3
-
SHA512
aa841c6c03c3901e851909bf0315511591b2246b93b82a5f409b017bdb6519aeeaeded1847093aa12effaa57bbc2425f2f0c891d53da17dbe9e30aa096fb3065
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmHY:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMO
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2816-4-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1760-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3336-15-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1184-20-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3260-25-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/636-31-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4868-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4308-41-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1328-54-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4396-66-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2096-76-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1800-94-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1880-88-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/216-111-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1580-117-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/552-105-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1264-60-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4208-51-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3220-123-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1300-131-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2720-137-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3732-140-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1236-146-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/232-157-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1420-154-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3500-175-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4900-179-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2320-184-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4384-193-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4612-202-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3812-207-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4468-210-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1760-212-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3968-225-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4980-228-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1068-235-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4396-253-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4856-255-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2876-259-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1404-264-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1136-277-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4140-281-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/932-302-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3688-309-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3512-318-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4764-332-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3696-345-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4320-370-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3968-377-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4980-381-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1012-385-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2068-398-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2860-448-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4600-500-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2440-501-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2876-546-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1668-568-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4796-622-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3972-636-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4836-662-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4252-722-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1892-732-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1636-754-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1496-801-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022d50-5.dat family_berbew behavioral2/files/0x0008000000022d53-10.dat family_berbew behavioral2/files/0x0008000000022d53-11.dat family_berbew behavioral2/files/0x0008000000022d50-3.dat family_berbew behavioral2/files/0x0007000000022d58-12.dat family_berbew behavioral2/files/0x0007000000022d58-14.dat family_berbew behavioral2/files/0x0007000000022d58-16.dat family_berbew behavioral2/files/0x0007000000022d59-19.dat family_berbew behavioral2/files/0x0007000000022d59-21.dat family_berbew behavioral2/files/0x0007000000022d5c-24.dat family_berbew behavioral2/files/0x0007000000022d5c-26.dat family_berbew behavioral2/files/0x0007000000022d6a-30.dat family_berbew behavioral2/files/0x0007000000022d6a-32.dat family_berbew behavioral2/files/0x0006000000022d7a-35.dat family_berbew behavioral2/files/0x0006000000022d7a-37.dat family_berbew behavioral2/files/0x0006000000022d7b-42.dat family_berbew behavioral2/files/0x0006000000022d7b-40.dat family_berbew behavioral2/files/0x0006000000022d7c-46.dat family_berbew behavioral2/files/0x0006000000022d7c-47.dat family_berbew behavioral2/files/0x0006000000022d7e-50.dat family_berbew behavioral2/files/0x0006000000022d7f-58.dat family_berbew behavioral2/files/0x0006000000022d80-62.dat family_berbew behavioral2/files/0x0006000000022d80-63.dat family_berbew behavioral2/files/0x0006000000022d81-69.dat family_berbew behavioral2/files/0x0006000000022d82-74.dat family_berbew behavioral2/files/0x0006000000022d83-80.dat family_berbew behavioral2/files/0x0006000000022d83-81.dat family_berbew behavioral2/files/0x0006000000022d82-73.dat family_berbew behavioral2/files/0x0006000000022d84-84.dat family_berbew behavioral2/files/0x0006000000022d85-92.dat family_berbew behavioral2/files/0x0006000000022d86-98.dat family_berbew behavioral2/files/0x0006000000022d86-97.dat family_berbew behavioral2/files/0x0006000000022d85-91.dat family_berbew behavioral2/files/0x0006000000022d84-85.dat family_berbew behavioral2/files/0x0006000000022d81-68.dat family_berbew behavioral2/files/0x0006000000022d87-102.dat family_berbew behavioral2/files/0x0006000000022d89-115.dat family_berbew behavioral2/files/0x0006000000022d89-114.dat family_berbew behavioral2/files/0x0006000000022d88-108.dat family_berbew behavioral2/files/0x0006000000022d88-107.dat family_berbew behavioral2/files/0x0006000000022d87-101.dat family_berbew behavioral2/files/0x0006000000022d7f-56.dat family_berbew behavioral2/files/0x0006000000022d7e-52.dat family_berbew behavioral2/files/0x0006000000022d8a-119.dat family_berbew behavioral2/files/0x0006000000022d8a-121.dat family_berbew behavioral2/files/0x0006000000022d8b-127.dat family_berbew behavioral2/files/0x0006000000022d8c-133.dat family_berbew behavioral2/files/0x0006000000022d8c-132.dat family_berbew behavioral2/files/0x0006000000022d8b-125.dat family_berbew behavioral2/files/0x0006000000022d8d-136.dat family_berbew behavioral2/files/0x0006000000022d8d-138.dat family_berbew behavioral2/files/0x0006000000022d8e-142.dat family_berbew behavioral2/files/0x0006000000022d8e-143.dat family_berbew behavioral2/files/0x0006000000022d8f-148.dat family_berbew behavioral2/files/0x0006000000022d8f-150.dat family_berbew behavioral2/files/0x0006000000022d90-153.dat family_berbew behavioral2/files/0x0006000000022d91-159.dat family_berbew behavioral2/files/0x0006000000022d91-160.dat family_berbew behavioral2/files/0x0006000000022d90-155.dat family_berbew behavioral2/files/0x0006000000022d92-165.dat family_berbew behavioral2/files/0x0006000000022d93-170.dat family_berbew behavioral2/files/0x0006000000022d93-171.dat family_berbew behavioral2/files/0x0006000000022d92-164.dat family_berbew behavioral2/files/0x0006000000022d94-174.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1760 pjnlph.exe 3336 dvfrfbx.exe 1184 hvdtr.exe 3260 fhdhltl.exe 636 bjnbxpt.exe 4868 tjdpvt.exe 4308 rhnlp.exe 1100 jlfvbnb.exe 4208 nvrtp.exe 1328 nrdrvx.exe 1264 nlplh.exe 4396 rjffv.exe 3408 dljnj.exe 2096 lpprlx.exe 4616 lplpx.exe 1880 xldhjpd.exe 1800 txxvb.exe 3948 trhpvjp.exe 552 rbhndvf.exe 216 rbdvph.exe 1580 fdbxv.exe 3220 rxvlnlj.exe 1300 hxvdv.exe 2720 xvflhnp.exe 3732 bdhhbh.exe 1236 xvxxvfv.exe 1420 bjbllld.exe 232 dfvbr.exe 3436 lntxxf.exe 748 pblbttb.exe 3500 nndfl.exe 4900 nftbrb.exe 2376 bbbfb.exe 2320 prjrb.exe 2128 bfltdtd.exe 1892 rhlhd.exe 4384 rlxprbv.exe 1480 prdxvhl.exe 4612 lxtxlrj.exe 3812 jhhxvpt.exe 4468 tthffjd.exe 1760 hlpnljx.exe 2476 vtxlxff.exe 2632 dnflxfn.exe 1184 tnhpfd.exe 3968 njtpv.exe 4980 dftlx.exe 1012 rtdrf.exe 1068 dphrlfh.exe 2704 rjvflnx.exe 4548 lrjbrp.exe 1328 xfjhhph.exe 540 xfxppx.exe 4396 nvtvlf.exe 4856 lvttnd.exe 2876 ljhrl.exe 1404 xhltn.exe 2156 hrvphrf.exe 1880 lhbhvh.exe 4412 lhtdt.exe 1136 fnvbdx.exe 3320 hrjjb.exe 4140 rtxxbhr.exe 1268 dxbhxj.exe -
resource yara_rule behavioral2/memory/2816-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0008000000022d50-5.dat upx behavioral2/memory/2816-4-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0008000000022d53-10.dat upx behavioral2/files/0x0008000000022d53-11.dat upx behavioral2/memory/1760-7-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0008000000022d50-3.dat upx behavioral2/files/0x0007000000022d58-12.dat upx behavioral2/memory/3336-15-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000022d58-14.dat upx behavioral2/files/0x0007000000022d58-16.dat upx behavioral2/memory/1184-20-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000022d59-19.dat upx behavioral2/files/0x0007000000022d59-21.dat upx behavioral2/files/0x0007000000022d5c-24.dat upx behavioral2/memory/3260-25-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000022d5c-26.dat upx behavioral2/memory/636-27-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000022d6a-30.dat upx behavioral2/memory/636-31-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000022d6a-32.dat upx behavioral2/files/0x0006000000022d7a-35.dat upx behavioral2/memory/4868-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d7a-37.dat upx behavioral2/files/0x0006000000022d7b-42.dat upx behavioral2/memory/4308-41-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d7b-40.dat upx behavioral2/files/0x0006000000022d7c-46.dat upx behavioral2/files/0x0006000000022d7c-47.dat upx behavioral2/files/0x0006000000022d7e-50.dat upx behavioral2/memory/1328-54-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d7f-58.dat upx behavioral2/files/0x0006000000022d80-62.dat upx behavioral2/files/0x0006000000022d80-63.dat upx behavioral2/memory/4396-66-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d81-69.dat upx behavioral2/files/0x0006000000022d82-74.dat upx behavioral2/memory/2096-76-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d83-80.dat upx behavioral2/files/0x0006000000022d83-81.dat upx behavioral2/files/0x0006000000022d82-73.dat upx behavioral2/files/0x0006000000022d84-84.dat upx behavioral2/files/0x0006000000022d85-92.dat upx behavioral2/memory/1800-94-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d86-98.dat upx behavioral2/files/0x0006000000022d86-97.dat upx behavioral2/files/0x0006000000022d85-91.dat upx behavioral2/memory/1880-88-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d84-85.dat upx behavioral2/files/0x0006000000022d81-68.dat upx behavioral2/files/0x0006000000022d87-102.dat upx behavioral2/memory/216-111-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d89-115.dat upx behavioral2/memory/1580-117-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d89-114.dat upx behavioral2/files/0x0006000000022d88-108.dat upx behavioral2/memory/552-105-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d88-107.dat upx behavioral2/files/0x0006000000022d87-101.dat upx behavioral2/memory/1264-60-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d7f-56.dat upx behavioral2/files/0x0006000000022d7e-52.dat upx behavioral2/memory/4208-51-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0006000000022d8a-119.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2816 wrote to memory of 1760 2816 NEAS.6ee9e5e3fb9b92125a60e50be5ee91f0.exe 84 PID 2816 wrote to memory of 1760 2816 NEAS.6ee9e5e3fb9b92125a60e50be5ee91f0.exe 84 PID 2816 wrote to memory of 1760 2816 NEAS.6ee9e5e3fb9b92125a60e50be5ee91f0.exe 84 PID 1760 wrote to memory of 3336 1760 pjnlph.exe 85 PID 1760 wrote to memory of 3336 1760 pjnlph.exe 85 PID 1760 wrote to memory of 3336 1760 pjnlph.exe 85 PID 3336 wrote to memory of 1184 3336 dvfrfbx.exe 86 PID 3336 wrote to memory of 1184 3336 dvfrfbx.exe 86 PID 3336 wrote to memory of 1184 3336 dvfrfbx.exe 86 PID 1184 wrote to memory of 3260 1184 hvdtr.exe 87 PID 1184 wrote to memory of 3260 1184 hvdtr.exe 87 PID 1184 wrote to memory of 3260 1184 hvdtr.exe 87 PID 3260 wrote to memory of 636 3260 fhdhltl.exe 88 PID 3260 wrote to memory of 636 3260 fhdhltl.exe 88 PID 3260 wrote to memory of 636 3260 fhdhltl.exe 88 PID 636 wrote to memory of 4868 636 bjnbxpt.exe 89 PID 636 wrote to memory of 4868 636 bjnbxpt.exe 89 PID 636 wrote to memory of 4868 636 bjnbxpt.exe 89 PID 4868 wrote to memory of 4308 4868 tjdpvt.exe 90 PID 4868 wrote to memory of 4308 4868 tjdpvt.exe 90 PID 4868 wrote to memory of 4308 4868 tjdpvt.exe 90 PID 4308 wrote to memory of 1100 4308 rhnlp.exe 91 PID 4308 wrote to memory of 1100 4308 rhnlp.exe 91 PID 4308 wrote to memory of 1100 4308 rhnlp.exe 91 PID 1100 wrote to memory of 4208 1100 jlfvbnb.exe 92 PID 1100 wrote to memory of 4208 1100 jlfvbnb.exe 92 PID 1100 wrote to memory of 4208 1100 jlfvbnb.exe 92 PID 4208 wrote to memory of 1328 4208 nvrtp.exe 93 PID 4208 wrote to memory of 1328 4208 nvrtp.exe 93 PID 4208 wrote to memory of 1328 4208 nvrtp.exe 93 PID 1328 wrote to memory of 1264 1328 nrdrvx.exe 94 PID 1328 wrote to memory of 1264 1328 nrdrvx.exe 94 PID 1328 wrote to memory of 1264 1328 nrdrvx.exe 94 PID 1264 wrote to memory of 4396 1264 nlplh.exe 106 PID 1264 wrote to memory of 4396 1264 nlplh.exe 106 PID 1264 wrote to memory of 4396 1264 nlplh.exe 106 PID 4396 wrote to memory of 3408 4396 rjffv.exe 104 PID 4396 wrote to memory of 3408 4396 rjffv.exe 104 PID 4396 wrote to memory of 3408 4396 rjffv.exe 104 PID 3408 wrote to memory of 2096 3408 dljnj.exe 100 PID 3408 wrote to memory of 2096 3408 dljnj.exe 100 PID 3408 wrote to memory of 2096 3408 dljnj.exe 100 PID 2096 wrote to memory of 4616 2096 lpprlx.exe 95 PID 2096 wrote to memory of 4616 2096 lpprlx.exe 95 PID 2096 wrote to memory of 4616 2096 lpprlx.exe 95 PID 4616 wrote to memory of 1880 4616 lplpx.exe 96 PID 4616 wrote to memory of 1880 4616 lplpx.exe 96 PID 4616 wrote to memory of 1880 4616 lplpx.exe 96 PID 1880 wrote to memory of 1800 1880 xldhjpd.exe 99 PID 1880 wrote to memory of 1800 1880 xldhjpd.exe 99 PID 1880 wrote to memory of 1800 1880 xldhjpd.exe 99 PID 1800 wrote to memory of 3948 1800 txxvb.exe 97 PID 1800 wrote to memory of 3948 1800 txxvb.exe 97 PID 1800 wrote to memory of 3948 1800 txxvb.exe 97 PID 3948 wrote to memory of 552 3948 trhpvjp.exe 98 PID 3948 wrote to memory of 552 3948 trhpvjp.exe 98 PID 3948 wrote to memory of 552 3948 trhpvjp.exe 98 PID 552 wrote to memory of 216 552 rbhndvf.exe 101 PID 552 wrote to memory of 216 552 rbhndvf.exe 101 PID 552 wrote to memory of 216 552 rbhndvf.exe 101 PID 216 wrote to memory of 1580 216 rbdvph.exe 102 PID 216 wrote to memory of 1580 216 rbdvph.exe 102 PID 216 wrote to memory of 1580 216 rbdvph.exe 102 PID 1580 wrote to memory of 3220 1580 fdbxv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6ee9e5e3fb9b92125a60e50be5ee91f0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6ee9e5e3fb9b92125a60e50be5ee91f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\pjnlph.exec:\pjnlph.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\dvfrfbx.exec:\dvfrfbx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\hvdtr.exec:\hvdtr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\fhdhltl.exec:\fhdhltl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\bjnbxpt.exec:\bjnbxpt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\tjdpvt.exec:\tjdpvt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\rhnlp.exec:\rhnlp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\jlfvbnb.exec:\jlfvbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\nvrtp.exec:\nvrtp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\nrdrvx.exec:\nrdrvx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\nlplh.exec:\nlplh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\rjffv.exec:\rjffv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\lplpx.exec:\lplpx.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\xldhjpd.exec:\xldhjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\txxvb.exec:\txxvb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800
-
-
-
\??\c:\trhpvjp.exec:\trhpvjp.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\rbhndvf.exec:\rbhndvf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\rbdvph.exec:\rbdvph.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\fdbxv.exec:\fdbxv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\rxvlnlj.exec:\rxvlnlj.exe5⤵
- Executes dropped EXE
PID:3220 -
\??\c:\hxvdv.exec:\hxvdv.exe6⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xvflhnp.exec:\xvflhnp.exe7⤵
- Executes dropped EXE
PID:2720
-
-
-
-
-
-
-
\??\c:\lpprlx.exec:\lpprlx.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096
-
\??\c:\dljnj.exec:\dljnj.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408
-
\??\c:\bdhhbh.exec:\bdhhbh.exe1⤵
- Executes dropped EXE
PID:3732 -
\??\c:\xvxxvfv.exec:\xvxxvfv.exe2⤵
- Executes dropped EXE
PID:1236 -
\??\c:\bjbllld.exec:\bjbllld.exe3⤵
- Executes dropped EXE
PID:1420 -
\??\c:\dfvbr.exec:\dfvbr.exe4⤵
- Executes dropped EXE
PID:232 -
\??\c:\lntxxf.exec:\lntxxf.exe5⤵
- Executes dropped EXE
PID:3436 -
\??\c:\pblbttb.exec:\pblbttb.exe6⤵
- Executes dropped EXE
PID:748 -
\??\c:\nndfl.exec:\nndfl.exe7⤵
- Executes dropped EXE
PID:3500 -
\??\c:\nftbrb.exec:\nftbrb.exe8⤵
- Executes dropped EXE
PID:4900 -
\??\c:\bbbfb.exec:\bbbfb.exe9⤵
- Executes dropped EXE
PID:2376 -
\??\c:\prjrb.exec:\prjrb.exe10⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bfltdtd.exec:\bfltdtd.exe11⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rhlhd.exec:\rhlhd.exe12⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rlxprbv.exec:\rlxprbv.exe13⤵
- Executes dropped EXE
PID:4384 -
\??\c:\prdxvhl.exec:\prdxvhl.exe14⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lxtxlrj.exec:\lxtxlrj.exe15⤵
- Executes dropped EXE
PID:4612 -
\??\c:\jhhxvpt.exec:\jhhxvpt.exe16⤵
- Executes dropped EXE
PID:3812 -
\??\c:\tthffjd.exec:\tthffjd.exe17⤵
- Executes dropped EXE
PID:4468 -
\??\c:\hlpnljx.exec:\hlpnljx.exe18⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vtxlxff.exec:\vtxlxff.exe19⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dnflxfn.exec:\dnflxfn.exe20⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tnhpfd.exec:\tnhpfd.exe21⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rjptlx.exec:\rjptlx.exe22⤵PID:3968
-
\??\c:\njdxhpx.exec:\njdxhpx.exe23⤵PID:4980
-
\??\c:\lnpxrd.exec:\lnpxrd.exe24⤵PID:1012
-
\??\c:\dphrlfh.exec:\dphrlfh.exe25⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rjvflnx.exec:\rjvflnx.exe26⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lrjbrp.exec:\lrjbrp.exe27⤵
- Executes dropped EXE
PID:4548 -
\??\c:\xfjhhph.exec:\xfjhhph.exe28⤵
- Executes dropped EXE
PID:1328 -
\??\c:\xfxppx.exec:\xfxppx.exe29⤵
- Executes dropped EXE
PID:540 -
\??\c:\nvtvlf.exec:\nvtvlf.exe30⤵
- Executes dropped EXE
PID:4396 -
\??\c:\lvttnd.exec:\lvttnd.exe31⤵
- Executes dropped EXE
PID:4856 -
\??\c:\ljhrl.exec:\ljhrl.exe32⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hppjr.exec:\hppjr.exe33⤵PID:1404
-
\??\c:\xpfpht.exec:\xpfpht.exe34⤵PID:2156
-
\??\c:\lhbhvh.exec:\lhbhvh.exe35⤵
- Executes dropped EXE
PID:1880 -
\??\c:\jrbrxjd.exec:\jrbrxjd.exe36⤵PID:4412
-
\??\c:\fnvbdx.exec:\fnvbdx.exe37⤵
- Executes dropped EXE
PID:1136 -
\??\c:\hrjjb.exec:\hrjjb.exe38⤵
- Executes dropped EXE
PID:3320 -
\??\c:\rtxxbhr.exec:\rtxxbhr.exe39⤵
- Executes dropped EXE
PID:4140 -
\??\c:\dxbhxj.exec:\dxbhxj.exe40⤵
- Executes dropped EXE
PID:1268 -
\??\c:\jvvbxnt.exec:\jvvbxnt.exe41⤵PID:3848
-
\??\c:\htjvrhn.exec:\htjvrhn.exe42⤵PID:1576
-
\??\c:\tpdnrx.exec:\tpdnrx.exe43⤵PID:4376
-
\??\c:\drtdn.exec:\drtdn.exe44⤵PID:932
-
\??\c:\llxnj.exec:\llxnj.exe45⤵PID:4496
-
\??\c:\rhhlxxh.exec:\rhhlxxh.exe46⤵PID:804
-
\??\c:\vtlxnb.exec:\vtlxnb.exe47⤵PID:3688
-
\??\c:\lbpbbdb.exec:\lbpbbdb.exe48⤵PID:3056
-
\??\c:\fhxltll.exec:\fhxltll.exe49⤵PID:3512
-
\??\c:\bprrt.exec:\bprrt.exe50⤵PID:780
-
\??\c:\vrhttj.exec:\vrhttj.exe51⤵PID:2912
-
\??\c:\lpphffb.exec:\lpphffb.exe52⤵PID:2872
-
\??\c:\lnfppll.exec:\lnfppll.exe53⤵PID:4480
-
\??\c:\jtjppf.exec:\jtjppf.exe54⤵PID:4764
-
\??\c:\ltllxrr.exec:\ltllxrr.exe55⤵PID:3988
-
\??\c:\rdjlhx.exec:\rdjlhx.exe56⤵PID:2376
-
\??\c:\fdlpnp.exec:\fdlpnp.exe57⤵PID:5036
-
\??\c:\llhxp.exec:\llhxp.exe58⤵PID:3696
-
\??\c:\ddpbl.exec:\ddpbl.exe59⤵PID:2008
-
\??\c:\rvxdhv.exec:\rvxdhv.exe60⤵PID:3080
-
\??\c:\rhnll.exec:\rhnll.exe61⤵PID:4280
-
\??\c:\xpvrjd.exec:\xpvrjd.exe62⤵PID:4336
-
\??\c:\fnxrjv.exec:\fnxrjv.exe63⤵PID:4472
-
\??\c:\bbddd.exec:\bbddd.exe64⤵PID:1444
-
\??\c:\rtfxp.exec:\rtfxp.exe65⤵PID:2208
-
\??\c:\lxnlvvp.exec:\lxnlvvp.exe66⤵PID:4320
-
\??\c:\xdnnj.exec:\xdnnj.exe67⤵PID:4340
-
\??\c:\njtpv.exec:\njtpv.exe68⤵
- Executes dropped EXE
PID:3968 -
\??\c:\dftlx.exec:\dftlx.exe69⤵
- Executes dropped EXE
PID:4980 -
\??\c:\rtdrf.exec:\rtdrf.exe70⤵
- Executes dropped EXE
PID:1012 -
\??\c:\hfnxhb.exec:\hfnxhb.exe71⤵PID:5044
-
\??\c:\ptnvnh.exec:\ptnvnh.exe72⤵PID:5032
-
\??\c:\phnjnp.exec:\phnjnp.exe73⤵PID:2068
-
\??\c:\hdjrtdl.exec:\hdjrtdl.exe74⤵PID:1120
-
\??\c:\dhhlbjl.exec:\dhhlbjl.exe75⤵PID:4756
-
\??\c:\btxxr.exec:\btxxr.exe76⤵PID:2916
-
\??\c:\dxbdvjt.exec:\dxbdvjt.exe77⤵PID:4648
-
\??\c:\jbvbll.exec:\jbvbll.exe78⤵PID:1496
-
\??\c:\xhltn.exec:\xhltn.exe79⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hrvphrf.exec:\hrvphrf.exe80⤵
- Executes dropped EXE
PID:2156 -
\??\c:\bbjprb.exec:\bbjprb.exe81⤵PID:4536
-
\??\c:\lhtdt.exec:\lhtdt.exe82⤵
- Executes dropped EXE
PID:4412 -
\??\c:\bvrjx.exec:\bvrjx.exe83⤵PID:2140
-
\??\c:\xtrjx.exec:\xtrjx.exe84⤵PID:4432
-
\??\c:\blttt.exec:\blttt.exe85⤵PID:832
-
\??\c:\fpldlld.exec:\fpldlld.exe86⤵PID:3600
-
\??\c:\lnlbth.exec:\lnlbth.exe87⤵PID:3848
-
\??\c:\xftvflj.exec:\xftvflj.exe88⤵PID:1576
-
\??\c:\fxrvv.exec:\fxrvv.exe89⤵PID:3932
-
\??\c:\lvjdf.exec:\lvjdf.exe90⤵PID:2860
-
\??\c:\hvhpfl.exec:\hvhpfl.exe91⤵PID:4284
-
\??\c:\ntjvrpx.exec:\ntjvrpx.exe92⤵PID:3892
-
\??\c:\jvdhxx.exec:\jvdhxx.exe93⤵PID:3044
-
\??\c:\bfflf.exec:\bfflf.exe94⤵PID:3056
-
\??\c:\bvljj.exec:\bvljj.exe95⤵PID:1832
-
\??\c:\ddxttbj.exec:\ddxttbj.exe96⤵PID:920
-
\??\c:\jvppn.exec:\jvppn.exe97⤵PID:4252
-
\??\c:\hpjjb.exec:\hpjjb.exe98⤵PID:4248
-
\??\c:\drxxlvb.exec:\drxxlvb.exe99⤵PID:2204
-
\??\c:\rtlrpvx.exec:\rtlrpvx.exe100⤵PID:4524
-
\??\c:\dpnbjxr.exec:\dpnbjxr.exe101⤵PID:1252
-
\??\c:\vjrrfpx.exec:\vjrrfpx.exe102⤵PID:3776
-
\??\c:\llxvhp.exec:\llxvhp.exe103⤵PID:1892
-
\??\c:\jbxjbnh.exec:\jbxjbnh.exe104⤵PID:4228
-
\??\c:\rvxlr.exec:\rvxlr.exe105⤵PID:3080
-
\??\c:\jtbpj.exec:\jtbpj.exe106⤵PID:4600
-
\??\c:\hjfvln.exec:\hjfvln.exe107⤵PID:2440
-
\??\c:\hhdrb.exec:\hhdrb.exe108⤵PID:3984
-
\??\c:\rrxtdb.exec:\rrxtdb.exe109⤵PID:1884
-
\??\c:\fllnlv.exec:\fllnlv.exe110⤵PID:2732
-
\??\c:\rjhtbj.exec:\rjhtbj.exe111⤵PID:2904
-
\??\c:\njphpp.exec:\njphpp.exe112⤵PID:2612
-
\??\c:\tbxfrn.exec:\tbxfrn.exe113⤵PID:4720
-
\??\c:\rpptln.exec:\rpptln.exe114⤵PID:4420
-
\??\c:\pfvlpdl.exec:\pfvlpdl.exe115⤵PID:4512
-
\??\c:\htpjnd.exec:\htpjnd.exe116⤵PID:4776
-
\??\c:\ftbrtf.exec:\ftbrtf.exe117⤵PID:4024
-
\??\c:\rvpvdtj.exec:\rvpvdtj.exe118⤵PID:1164
-
\??\c:\xdntbb.exec:\xdntbb.exe119⤵PID:2124
-
\??\c:\flpnhfv.exec:\flpnhfv.exe120⤵PID:2876
-
\??\c:\dxnvb.exec:\dxnvb.exe121⤵PID:2000
-
\??\c:\vdtfhph.exec:\vdtfhph.exe122⤵PID:3280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-