Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 11:18
Behavioral task
behavioral1
Sample
55f561719d8c1c230446d304a8dc6cc0_NEAS.exe
Resource
win7-20231129-en
General
-
Target
55f561719d8c1c230446d304a8dc6cc0_NEAS.exe
-
Size
463KB
-
MD5
55f561719d8c1c230446d304a8dc6cc0
-
SHA1
3acd91b33e23f8e46f8a52bc0192b16d402d9cb3
-
SHA256
b04619375c603a0087c03cfd14994081818487f7b1d685d18e68820da7b9d335
-
SHA512
b8750ca9980cc0750f9a724301b65955e958f5693310f2261dc3358efbd5b99d6b46927678c3c2725434ae9bfaf62c9b6a9027dda8d85f0d58240515cc10045a
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1V9:VeR0oykayRFp3lztP+OKaf1V9
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2328-9-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1664-18-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2836-28-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2916-30-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2564-46-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2652-55-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2684-65-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2688-73-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2664-83-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2408-85-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2472-103-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1640-111-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2400-121-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1572-139-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1260-149-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2120-174-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1052-209-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1436-207-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1292-233-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1292-235-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2980-244-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/604-264-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2932-280-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2248-297-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/872-298-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2296-311-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2456-375-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2384-432-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2384-439-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/840-472-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2416-523-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2508-567-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1732-593-0x00000000002D0000-0x000000000030A000-memory.dmp family_blackmoon behavioral1/memory/2176-634-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2648-643-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1504-698-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1412-791-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/844-817-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1596-863-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2668-948-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/948-992-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2328-3-0x0000000000220000-0x000000000025A000-memory.dmp family_berbew behavioral1/files/0x0009000000014390-7.dat family_berbew behavioral1/memory/2328-9-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1664-10-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00090000000146a2-19.dat family_berbew behavioral1/memory/1664-18-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00080000000147ea-25.dat family_berbew behavioral1/memory/2836-28-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2916-30-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0007000000014825-37.dat family_berbew behavioral1/memory/2564-46-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00070000000149f5-44.dat family_berbew behavioral1/memory/2652-47-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0007000000014abe-56.dat family_berbew behavioral1/memory/2652-55-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x000a000000014af6-63.dat family_berbew behavioral1/memory/2684-65-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2688-73-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0009000000014de9-74.dat family_berbew behavioral1/files/0x0007000000014ef8-80.dat family_berbew behavioral1/memory/2664-83-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2408-85-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0007000000015018-92.dat family_berbew behavioral1/files/0x00070000000155ed-99.dat family_berbew behavioral1/memory/2472-103-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00060000000155f3-112.dat family_berbew behavioral1/memory/1640-111-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00060000000155f7-119.dat family_berbew behavioral1/memory/1884-122-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2400-121-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000015605-130.dat family_berbew behavioral1/files/0x0006000000015616-136.dat family_berbew behavioral1/memory/1572-139-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000015626-147.dat family_berbew behavioral1/memory/1260-149-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000015b6f-155.dat family_berbew behavioral1/files/0x0006000000015c3d-162.dat family_berbew behavioral1/files/0x0006000000015c52-171.dat family_berbew behavioral1/memory/2120-174-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000015c6b-181.dat family_berbew behavioral1/files/0x00090000000146b8-187.dat family_berbew behavioral1/files/0x0006000000015c78-198.dat family_berbew behavioral1/files/0x0006000000015c83-204.dat family_berbew behavioral1/memory/1052-209-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1436-207-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000015c9f-216.dat family_berbew behavioral1/memory/1236-217-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000015cb6-227.dat family_berbew behavioral1/memory/1292-233-0x0000000000220000-0x000000000025A000-memory.dmp family_berbew behavioral1/files/0x0006000000015cce-236.dat family_berbew behavioral1/files/0x0006000000015cee-246.dat family_berbew behavioral1/memory/2980-244-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000015cf6-253.dat family_berbew behavioral1/memory/376-254-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/604-264-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000015cfe-263.dat family_berbew behavioral1/files/0x0006000000015d07-271.dat family_berbew behavioral1/files/0x0006000000015d0f-278.dat family_berbew behavioral1/memory/1292-282-0x0000000000220000-0x000000000025A000-memory.dmp family_berbew behavioral1/memory/2932-280-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000015d1a-289.dat family_berbew behavioral1/memory/2248-297-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/872-298-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1664 bbhbhb.exe 2836 5rfxflx.exe 2916 7pdjp.exe 2564 vjvdv.exe 2652 tnbbbb.exe 2684 jdppd.exe 2688 xlxflfl.exe 2664 pjpvv.exe 2408 ffrrxff.exe 2472 bntnnt.exe 1640 pdpjp.exe 2400 fxlxxlr.exe 1884 ddppv.exe 1572 pdvdp.exe 884 7rflxlr.exe 1260 htbthh.exe 2716 3djjv.exe 1392 rflffff.exe 2120 dvppd.exe 2860 pdpjj.exe 2100 lflffxr.exe 1436 btbthh.exe 1052 5vdvp.exe 1236 lxllrlr.exe 1292 3dvvd.exe 2980 flrxfrr.exe 1540 nhthnn.exe 376 pjpjd.exe 604 7xlflxx.exe 2932 hbtbht.exe 2772 pvjpv.exe 2248 lrxflll.exe 872 hbnthn.exe 2296 vvpvp.exe 1696 rfxrxfx.exe 1680 fxfffxf.exe 2852 thbbhb.exe 2176 9jvpv.exe 2900 7llxllr.exe 2776 llxlfxl.exe 2800 1htbht.exe 2548 dvvvd.exe 2640 dvdvd.exe 2684 lxrffrx.exe 2456 nbttbb.exe 2644 bhntht.exe 2496 pdpvv.exe 2376 ffxlxxl.exe 2204 btbbtb.exe 1452 hhbnht.exe 1272 3jjvv.exe 1720 5fxflfl.exe 2484 9lfxxrr.exe 2384 hbtbnn.exe 1944 dpddj.exe 1316 xlflflx.exe 1848 hbnnhn.exe 1444 pdppp.exe 1448 pjvvj.exe 840 lxxxflx.exe 1704 thhnhn.exe 2860 jpdpj.exe 2100 7dvdv.exe 1096 xxxflxf.exe -
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2328-3-0x0000000000220000-0x000000000025A000-memory.dmp upx behavioral1/files/0x0009000000014390-7.dat upx behavioral1/memory/2328-9-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1664-10-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00090000000146a2-19.dat upx behavioral1/memory/1664-18-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00080000000147ea-25.dat upx behavioral1/memory/2836-28-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2916-30-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0007000000014825-37.dat upx behavioral1/memory/2564-46-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00070000000149f5-44.dat upx behavioral1/memory/2652-47-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0007000000014abe-56.dat upx behavioral1/memory/2652-55-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000a000000014af6-63.dat upx behavioral1/memory/2684-65-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2688-73-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0009000000014de9-74.dat upx behavioral1/files/0x0007000000014ef8-80.dat upx behavioral1/memory/2664-83-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2408-85-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0007000000015018-92.dat upx behavioral1/files/0x00070000000155ed-99.dat upx behavioral1/memory/2472-103-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00060000000155f3-112.dat upx behavioral1/memory/1640-111-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00060000000155f7-119.dat upx behavioral1/memory/1884-122-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2400-121-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015605-130.dat upx behavioral1/files/0x0006000000015616-136.dat upx behavioral1/memory/1572-139-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015626-147.dat upx behavioral1/memory/1260-149-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015b6f-155.dat upx behavioral1/files/0x0006000000015c3d-162.dat upx behavioral1/files/0x0006000000015c52-171.dat upx behavioral1/memory/2120-174-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015c6b-181.dat upx behavioral1/files/0x00090000000146b8-187.dat upx behavioral1/files/0x0006000000015c78-198.dat upx behavioral1/files/0x0006000000015c83-204.dat upx behavioral1/memory/1052-209-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1436-207-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015c9f-216.dat upx behavioral1/memory/1236-217-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1236-225-0x0000000000440000-0x000000000047A000-memory.dmp upx behavioral1/files/0x0006000000015cb6-227.dat upx behavioral1/files/0x0006000000015cce-236.dat upx behavioral1/files/0x0006000000015cee-246.dat upx behavioral1/memory/2980-244-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015cf6-253.dat upx behavioral1/memory/376-254-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/604-264-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015cfe-263.dat upx behavioral1/files/0x0006000000015d07-271.dat upx behavioral1/files/0x0006000000015d0f-278.dat upx behavioral1/memory/2932-280-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015d1a-289.dat upx behavioral1/memory/2248-297-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/872-298-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2296-311-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1664 2328 55f561719d8c1c230446d304a8dc6cc0_NEAS.exe 28 PID 2328 wrote to memory of 1664 2328 55f561719d8c1c230446d304a8dc6cc0_NEAS.exe 28 PID 2328 wrote to memory of 1664 2328 55f561719d8c1c230446d304a8dc6cc0_NEAS.exe 28 PID 2328 wrote to memory of 1664 2328 55f561719d8c1c230446d304a8dc6cc0_NEAS.exe 28 PID 1664 wrote to memory of 2836 1664 bbhbhb.exe 29 PID 1664 wrote to memory of 2836 1664 bbhbhb.exe 29 PID 1664 wrote to memory of 2836 1664 bbhbhb.exe 29 PID 1664 wrote to memory of 2836 1664 bbhbhb.exe 29 PID 2836 wrote to memory of 2916 2836 5rfxflx.exe 30 PID 2836 wrote to memory of 2916 2836 5rfxflx.exe 30 PID 2836 wrote to memory of 2916 2836 5rfxflx.exe 30 PID 2836 wrote to memory of 2916 2836 5rfxflx.exe 30 PID 2916 wrote to memory of 2564 2916 7pdjp.exe 31 PID 2916 wrote to memory of 2564 2916 7pdjp.exe 31 PID 2916 wrote to memory of 2564 2916 7pdjp.exe 31 PID 2916 wrote to memory of 2564 2916 7pdjp.exe 31 PID 2564 wrote to memory of 2652 2564 vjvdv.exe 32 PID 2564 wrote to memory of 2652 2564 vjvdv.exe 32 PID 2564 wrote to memory of 2652 2564 vjvdv.exe 32 PID 2564 wrote to memory of 2652 2564 vjvdv.exe 32 PID 2652 wrote to memory of 2684 2652 tnbbbb.exe 33 PID 2652 wrote to memory of 2684 2652 tnbbbb.exe 33 PID 2652 wrote to memory of 2684 2652 tnbbbb.exe 33 PID 2652 wrote to memory of 2684 2652 tnbbbb.exe 33 PID 2684 wrote to memory of 2688 2684 jdppd.exe 34 PID 2684 wrote to memory of 2688 2684 jdppd.exe 34 PID 2684 wrote to memory of 2688 2684 jdppd.exe 34 PID 2684 wrote to memory of 2688 2684 jdppd.exe 34 PID 2688 wrote to memory of 2664 2688 xlxflfl.exe 35 PID 2688 wrote to memory of 2664 2688 xlxflfl.exe 35 PID 2688 wrote to memory of 2664 2688 xlxflfl.exe 35 PID 2688 wrote to memory of 2664 2688 xlxflfl.exe 35 PID 2664 wrote to memory of 2408 2664 pjpvv.exe 36 PID 2664 wrote to memory of 2408 2664 pjpvv.exe 36 PID 2664 wrote to memory of 2408 2664 pjpvv.exe 36 PID 2664 wrote to memory of 2408 2664 pjpvv.exe 36 PID 2408 wrote to memory of 2472 2408 ffrrxff.exe 37 PID 2408 wrote to memory of 2472 2408 ffrrxff.exe 37 PID 2408 wrote to memory of 2472 2408 ffrrxff.exe 37 PID 2408 wrote to memory of 2472 2408 ffrrxff.exe 37 PID 2472 wrote to memory of 1640 2472 bntnnt.exe 38 PID 2472 wrote to memory of 1640 2472 bntnnt.exe 38 PID 2472 wrote to memory of 1640 2472 bntnnt.exe 38 PID 2472 wrote to memory of 1640 2472 bntnnt.exe 38 PID 1640 wrote to memory of 2400 1640 pdpjp.exe 39 PID 1640 wrote to memory of 2400 1640 pdpjp.exe 39 PID 1640 wrote to memory of 2400 1640 pdpjp.exe 39 PID 1640 wrote to memory of 2400 1640 pdpjp.exe 39 PID 2400 wrote to memory of 1884 2400 fxlxxlr.exe 40 PID 2400 wrote to memory of 1884 2400 fxlxxlr.exe 40 PID 2400 wrote to memory of 1884 2400 fxlxxlr.exe 40 PID 2400 wrote to memory of 1884 2400 fxlxxlr.exe 40 PID 1884 wrote to memory of 1572 1884 ddppv.exe 41 PID 1884 wrote to memory of 1572 1884 ddppv.exe 41 PID 1884 wrote to memory of 1572 1884 ddppv.exe 41 PID 1884 wrote to memory of 1572 1884 ddppv.exe 41 PID 1572 wrote to memory of 884 1572 pdvdp.exe 42 PID 1572 wrote to memory of 884 1572 pdvdp.exe 42 PID 1572 wrote to memory of 884 1572 pdvdp.exe 42 PID 1572 wrote to memory of 884 1572 pdvdp.exe 42 PID 884 wrote to memory of 1260 884 7rflxlr.exe 43 PID 884 wrote to memory of 1260 884 7rflxlr.exe 43 PID 884 wrote to memory of 1260 884 7rflxlr.exe 43 PID 884 wrote to memory of 1260 884 7rflxlr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\55f561719d8c1c230446d304a8dc6cc0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\55f561719d8c1c230446d304a8dc6cc0_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\bbhbhb.exec:\bbhbhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\5rfxflx.exec:\5rfxflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\7pdjp.exec:\7pdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\vjvdv.exec:\vjvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\tnbbbb.exec:\tnbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jdppd.exec:\jdppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xlxflfl.exec:\xlxflfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pjpvv.exec:\pjpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ffrrxff.exec:\ffrrxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\bntnnt.exec:\bntnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\pdpjp.exec:\pdpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\fxlxxlr.exec:\fxlxxlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\ddppv.exec:\ddppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\pdvdp.exec:\pdvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\7rflxlr.exec:\7rflxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\htbthh.exec:\htbthh.exe17⤵
- Executes dropped EXE
PID:1260 -
\??\c:\3djjv.exec:\3djjv.exe18⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rflffff.exec:\rflffff.exe19⤵
- Executes dropped EXE
PID:1392 -
\??\c:\dvppd.exec:\dvppd.exe20⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pdpjj.exec:\pdpjj.exe21⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lflffxr.exec:\lflffxr.exe22⤵
- Executes dropped EXE
PID:2100 -
\??\c:\btbthh.exec:\btbthh.exe23⤵
- Executes dropped EXE
PID:1436 -
\??\c:\5vdvp.exec:\5vdvp.exe24⤵
- Executes dropped EXE
PID:1052 -
\??\c:\lxllrlr.exec:\lxllrlr.exe25⤵
- Executes dropped EXE
PID:1236 -
\??\c:\3dvvd.exec:\3dvvd.exe26⤵
- Executes dropped EXE
PID:1292 -
\??\c:\flrxfrr.exec:\flrxfrr.exe27⤵
- Executes dropped EXE
PID:2980 -
\??\c:\nhthnn.exec:\nhthnn.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pjpjd.exec:\pjpjd.exe29⤵
- Executes dropped EXE
PID:376 -
\??\c:\7xlflxx.exec:\7xlflxx.exe30⤵
- Executes dropped EXE
PID:604 -
\??\c:\hbtbht.exec:\hbtbht.exe31⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pvjpv.exec:\pvjpv.exe32⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lrxflll.exec:\lrxflll.exe33⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hbnthn.exec:\hbnthn.exe34⤵
- Executes dropped EXE
PID:872 -
\??\c:\vvpvp.exec:\vvpvp.exe35⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rfxrxfx.exec:\rfxrxfx.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fxfffxf.exec:\fxfffxf.exe37⤵
- Executes dropped EXE
PID:1680 -
\??\c:\thbbhb.exec:\thbbhb.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9jvpv.exec:\9jvpv.exe39⤵
- Executes dropped EXE
PID:2176 -
\??\c:\7llxllr.exec:\7llxllr.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\llxlfxl.exec:\llxlfxl.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1htbht.exec:\1htbht.exe42⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dvvvd.exec:\dvvvd.exe43⤵
- Executes dropped EXE
PID:2548 -
\??\c:\dvdvd.exec:\dvdvd.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lxrffrx.exec:\lxrffrx.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nbttbb.exec:\nbttbb.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bhntht.exec:\bhntht.exe47⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pdpvv.exec:\pdpvv.exe48⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe49⤵
- Executes dropped EXE
PID:2376 -
\??\c:\btbbtb.exec:\btbbtb.exe50⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hhbnht.exec:\hhbnht.exe51⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3jjvv.exec:\3jjvv.exe52⤵
- Executes dropped EXE
PID:1272 -
\??\c:\5fxflfl.exec:\5fxflfl.exe53⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9lfxxrr.exec:\9lfxxrr.exe54⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hbtbnn.exec:\hbtbnn.exe55⤵
- Executes dropped EXE
PID:2384 -
\??\c:\dpddj.exec:\dpddj.exe56⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xlflflx.exec:\xlflflx.exe57⤵
- Executes dropped EXE
PID:1316 -
\??\c:\hbnnhn.exec:\hbnnhn.exe58⤵
- Executes dropped EXE
PID:1848 -
\??\c:\pdppp.exec:\pdppp.exe59⤵
- Executes dropped EXE
PID:1444 -
\??\c:\pjvvj.exec:\pjvvj.exe60⤵
- Executes dropped EXE
PID:1448 -
\??\c:\lxxxflx.exec:\lxxxflx.exe61⤵
- Executes dropped EXE
PID:840 -
\??\c:\thhnhn.exec:\thhnhn.exe62⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jpdpj.exec:\jpdpj.exe63⤵
- Executes dropped EXE
PID:2860 -
\??\c:\7dvdv.exec:\7dvdv.exe64⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xxxflxf.exec:\xxxflxf.exe65⤵
- Executes dropped EXE
PID:1096 -
\??\c:\hhhtht.exec:\hhhtht.exe66⤵PID:1988
-
\??\c:\tbtnhh.exec:\tbtnhh.exe67⤵PID:352
-
\??\c:\1jvdd.exec:\1jvdd.exe68⤵PID:1516
-
\??\c:\xrfrxlx.exec:\xrfrxlx.exe69⤵PID:2416
-
\??\c:\btnntn.exec:\btnntn.exe70⤵PID:2104
-
\??\c:\nbthbh.exec:\nbthbh.exe71⤵PID:280
-
\??\c:\jvppd.exec:\jvppd.exe72⤵PID:1540
-
\??\c:\vpvvd.exec:\vpvvd.exe73⤵PID:1240
-
\??\c:\fxrlrlx.exec:\fxrlrlx.exe74⤵PID:896
-
\??\c:\5tnnhh.exec:\5tnnhh.exe75⤵PID:340
-
\??\c:\dpjdj.exec:\dpjdj.exe76⤵PID:2508
-
\??\c:\vjppv.exec:\vjppv.exe77⤵PID:3028
-
\??\c:\rllrffr.exec:\rllrffr.exe78⤵PID:2380
-
\??\c:\3btthn.exec:\3btthn.exe79⤵PID:1732
-
\??\c:\hthhnn.exec:\hthhnn.exe80⤵PID:2036
-
\??\c:\vppvj.exec:\vppvj.exe81⤵PID:2780
-
\??\c:\frflrrx.exec:\frflrrx.exe82⤵PID:1692
-
\??\c:\rfflxxf.exec:\rfflxxf.exe83⤵PID:2904
-
\??\c:\7tbbhn.exec:\7tbbhn.exe84⤵PID:2852
-
\??\c:\jdppv.exec:\jdppv.exe85⤵PID:2176
-
\??\c:\1fxxlrl.exec:\1fxxlrl.exe86⤵PID:2632
-
\??\c:\hhhtnt.exec:\hhhtnt.exe87⤵PID:2648
-
\??\c:\nnnbhh.exec:\nnnbhh.exe88⤵PID:2656
-
\??\c:\3vvvj.exec:\3vvvj.exe89⤵PID:2568
-
\??\c:\rrlrflr.exec:\rrlrflr.exe90⤵PID:2640
-
\??\c:\frllrrx.exec:\frllrrx.exe91⤵PID:2684
-
\??\c:\tbhhnt.exec:\tbhhnt.exe92⤵PID:2664
-
\??\c:\vvjpv.exec:\vvjpv.exe93⤵PID:2872
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe94⤵PID:2936
-
\??\c:\lxxfxxr.exec:\lxxfxxr.exe95⤵PID:1948
-
\??\c:\hnnbth.exec:\hnnbth.exe96⤵PID:1504
-
\??\c:\vddpp.exec:\vddpp.exe97⤵PID:1452
-
\??\c:\vjjjj.exec:\vjjjj.exe98⤵PID:2312
-
\??\c:\rfrllfl.exec:\rfrllfl.exe99⤵PID:2132
-
\??\c:\nnnhtt.exec:\nnnhtt.exe100⤵PID:1852
-
\??\c:\vvppv.exec:\vvppv.exe101⤵PID:2732
-
\??\c:\pdppp.exec:\pdppp.exe102⤵PID:1776
-
\??\c:\xxrrflr.exec:\xxrrflr.exe103⤵PID:1512
-
\??\c:\hhbbhh.exec:\hhbbhh.exe104⤵PID:2876
-
\??\c:\9pdjp.exec:\9pdjp.exe105⤵PID:1160
-
\??\c:\3pjvv.exec:\3pjvv.exe106⤵PID:1448
-
\??\c:\ffrfxff.exec:\ffrfxff.exe107⤵PID:2520
-
\??\c:\tnhnbn.exec:\tnhnbn.exe108⤵PID:2124
-
\??\c:\tnhhnt.exec:\tnhhnt.exe109⤵PID:2056
-
\??\c:\djvdv.exec:\djvdv.exe110⤵PID:1412
-
\??\c:\xrrflrl.exec:\xrrflrl.exe111⤵PID:1020
-
\??\c:\xrlrxrx.exec:\xrlrxrx.exe112⤵PID:1836
-
\??\c:\tnbhbb.exec:\tnbhbb.exe113⤵PID:2920
-
\??\c:\dpvdp.exec:\dpvdp.exe114⤵PID:1648
-
\??\c:\llflffr.exec:\llflffr.exe115⤵PID:844
-
\??\c:\5nnhbt.exec:\5nnhbt.exe116⤵PID:2980
-
\??\c:\bhthnh.exec:\bhthnh.exe117⤵PID:1784
-
\??\c:\jvpjp.exec:\jvpjp.exe118⤵PID:972
-
\??\c:\vvpdp.exec:\vvpdp.exe119⤵PID:1124
-
\??\c:\tttbnb.exec:\tttbnb.exe120⤵PID:976
-
\??\c:\5pjjp.exec:\5pjjp.exe121⤵PID:2280
-
\??\c:\lfflrrf.exec:\lfflrrf.exe122⤵PID:1596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-