Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 20:05
Behavioral task
behavioral1
Sample
1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe
Resource
win7-20240220-en
General
-
Target
1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe
-
Size
351KB
-
MD5
1c693a60202ab21ec468e72d13cccbc0
-
SHA1
fcfb1405f40b31429d6344e39c466c5d4797e8b5
-
SHA256
f62958629395ecabe50259cfec131f1cd602e0ed2668bdd951e513bc6ffeda0c
-
SHA512
dd10f9914c201c8a74389d26bb433059e52b5804afbd437041897d0955acec414de1f3e8d7ea6c6b497135f44fcefbed4f1d9271cf4f513d157d04d84fc3d7f6
-
SSDEEP
6144:bcm4FmowdHoSgWrXD486jCpoAhlq1mEjBqLyOSlhNFF23k:h4wFHoSgWj168w1VjsyvhNFF20
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4252-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/980-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3128-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2648-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/676-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3832-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/672-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/676-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3028-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-665-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x00090000000233f9-5.dat family_berbew behavioral2/files/0x00080000000233fc-9.dat family_berbew behavioral2/files/0x0007000000023401-11.dat family_berbew behavioral2/files/0x0007000000023402-19.dat family_berbew behavioral2/files/0x0007000000023403-25.dat family_berbew behavioral2/files/0x0007000000023404-30.dat family_berbew behavioral2/files/0x0007000000023405-35.dat family_berbew behavioral2/files/0x0007000000023406-39.dat family_berbew behavioral2/files/0x0007000000023407-43.dat family_berbew behavioral2/files/0x0007000000023408-47.dat family_berbew behavioral2/files/0x0007000000023409-53.dat family_berbew behavioral2/files/0x000700000002340a-57.dat family_berbew behavioral2/files/0x000700000002340b-64.dat family_berbew behavioral2/files/0x000700000002340c-69.dat family_berbew behavioral2/files/0x000700000002340d-75.dat family_berbew behavioral2/files/0x000700000002340e-81.dat family_berbew behavioral2/files/0x000700000002340f-86.dat family_berbew behavioral2/files/0x0007000000023410-90.dat family_berbew behavioral2/files/0x0007000000023411-94.dat family_berbew behavioral2/files/0x0007000000023412-98.dat family_berbew behavioral2/files/0x0007000000023414-102.dat family_berbew behavioral2/files/0x00080000000233fd-108.dat family_berbew behavioral2/files/0x0007000000023415-113.dat family_berbew behavioral2/files/0x0007000000023416-118.dat family_berbew behavioral2/files/0x0007000000023417-125.dat family_berbew behavioral2/files/0x0007000000023418-128.dat family_berbew behavioral2/files/0x0007000000023419-133.dat family_berbew behavioral2/files/0x000700000002341a-138.dat family_berbew behavioral2/files/0x000700000002341b-143.dat family_berbew behavioral2/files/0x000700000002341c-149.dat family_berbew behavioral2/files/0x000700000002341d-153.dat family_berbew behavioral2/files/0x000700000002341e-158.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 4724 lxrlxxr.exe 3064 lfxrlfx.exe 2568 jvjpp.exe 4776 flxfxrf.exe 4956 9ththb.exe 1020 jpjvp.exe 2296 xrxfxrr.exe 1284 bbnhtn.exe 4992 ddpjv.exe 5076 fllrfxf.exe 2592 3hhttn.exe 5112 rlfllfr.exe 980 fxfrllf.exe 1924 hnhnbt.exe 3128 lfxrlrl.exe 4352 tbhbhh.exe 2236 vdvpp.exe 3012 lxxlxxr.exe 3824 1lxlxlx.exe 720 9vvjj.exe 2220 thbnbn.exe 1220 3tnhtt.exe 1624 9pdpv.exe 2648 fxrlrlf.exe 1600 xxxrfxl.exe 676 7pjvj.exe 3684 xrxrxfx.exe 5092 ntnnbt.exe 3456 nbhtbn.exe 3832 thhhbt.exe 2396 tttnth.exe 1816 pdjvd.exe 4792 rfxfxrx.exe 3608 9nhbbh.exe 2076 nhnhbt.exe 3188 1dvpv.exe 4396 3lfxfrl.exe 4332 bhntnh.exe 1368 jvvdj.exe 2868 xlxflxf.exe 4152 xrxllff.exe 4500 nhhbtt.exe 2536 9pvpv.exe 4776 fxrlxrl.exe 3656 3btbnh.exe 1756 pvpdp.exe 3464 xrrllxr.exe 4024 bnntbt.exe 4880 vdvjv.exe 1284 lxxfxxl.exe 4992 bhthbn.exe 2776 nnhnbb.exe 4404 vppjd.exe 672 xffrlxr.exe 2364 5thbnh.exe 2408 vjdvp.exe 3224 5dvjv.exe 1924 5rlxfxl.exe 4756 ttnhtn.exe 4288 ppddj.exe 4964 dpjvp.exe 4564 3llfxxr.exe 3120 tthbnh.exe 1928 ppvjd.exe -
resource yara_rule behavioral2/memory/4252-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233f9-5.dat upx behavioral2/memory/4252-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233fc-9.dat upx behavioral2/memory/4724-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-11.dat upx behavioral2/memory/3064-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2568-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-19.dat upx behavioral2/files/0x0007000000023403-25.dat upx behavioral2/memory/4776-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4956-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1020-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-30.dat upx behavioral2/memory/2296-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023405-35.dat upx behavioral2/files/0x0007000000023406-39.dat upx behavioral2/files/0x0007000000023407-43.dat upx behavioral2/files/0x0007000000023408-47.dat upx behavioral2/memory/4992-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5076-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023409-53.dat upx behavioral2/files/0x000700000002340a-57.dat upx behavioral2/memory/5112-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2592-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-64.dat upx behavioral2/memory/5112-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/980-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-69.dat upx behavioral2/memory/980-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1924-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-75.dat upx behavioral2/memory/3128-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-81.dat upx behavioral2/memory/4352-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-86.dat upx behavioral2/files/0x0007000000023410-90.dat upx behavioral2/memory/3824-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-94.dat upx behavioral2/files/0x0007000000023412-98.dat upx behavioral2/memory/3824-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-102.dat upx behavioral2/files/0x00080000000233fd-108.dat upx behavioral2/memory/2220-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2220-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-113.dat upx behavioral2/memory/1220-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-118.dat upx behavioral2/memory/2648-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1624-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-125.dat upx behavioral2/files/0x0007000000023418-128.dat upx behavioral2/memory/676-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-133.dat upx behavioral2/files/0x000700000002341a-138.dat upx behavioral2/memory/3684-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3456-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-143.dat upx behavioral2/files/0x000700000002341c-149.dat upx behavioral2/memory/3456-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3832-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-153.dat upx behavioral2/files/0x000700000002341e-158.dat upx behavioral2/memory/2396-159-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4252 wrote to memory of 4724 4252 1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe 83 PID 4252 wrote to memory of 4724 4252 1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe 83 PID 4252 wrote to memory of 4724 4252 1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe 83 PID 4724 wrote to memory of 3064 4724 lxrlxxr.exe 84 PID 4724 wrote to memory of 3064 4724 lxrlxxr.exe 84 PID 4724 wrote to memory of 3064 4724 lxrlxxr.exe 84 PID 3064 wrote to memory of 2568 3064 lfxrlfx.exe 85 PID 3064 wrote to memory of 2568 3064 lfxrlfx.exe 85 PID 3064 wrote to memory of 2568 3064 lfxrlfx.exe 85 PID 2568 wrote to memory of 4776 2568 jvjpp.exe 86 PID 2568 wrote to memory of 4776 2568 jvjpp.exe 86 PID 2568 wrote to memory of 4776 2568 jvjpp.exe 86 PID 4776 wrote to memory of 4956 4776 flxfxrf.exe 87 PID 4776 wrote to memory of 4956 4776 flxfxrf.exe 87 PID 4776 wrote to memory of 4956 4776 flxfxrf.exe 87 PID 4956 wrote to memory of 1020 4956 9ththb.exe 88 PID 4956 wrote to memory of 1020 4956 9ththb.exe 88 PID 4956 wrote to memory of 1020 4956 9ththb.exe 88 PID 1020 wrote to memory of 2296 1020 jpjvp.exe 89 PID 1020 wrote to memory of 2296 1020 jpjvp.exe 89 PID 1020 wrote to memory of 2296 1020 jpjvp.exe 89 PID 2296 wrote to memory of 1284 2296 xrxfxrr.exe 90 PID 2296 wrote to memory of 1284 2296 xrxfxrr.exe 90 PID 2296 wrote to memory of 1284 2296 xrxfxrr.exe 90 PID 1284 wrote to memory of 4992 1284 bbnhtn.exe 92 PID 1284 wrote to memory of 4992 1284 bbnhtn.exe 92 PID 1284 wrote to memory of 4992 1284 bbnhtn.exe 92 PID 4992 wrote to memory of 5076 4992 ddpjv.exe 93 PID 4992 wrote to memory of 5076 4992 ddpjv.exe 93 PID 4992 wrote to memory of 5076 4992 ddpjv.exe 93 PID 5076 wrote to memory of 2592 5076 fllrfxf.exe 94 PID 5076 wrote to memory of 2592 5076 fllrfxf.exe 94 PID 5076 wrote to memory of 2592 5076 fllrfxf.exe 94 PID 2592 wrote to memory of 5112 2592 3hhttn.exe 95 PID 2592 wrote to memory of 5112 2592 3hhttn.exe 95 PID 2592 wrote to memory of 5112 2592 3hhttn.exe 95 PID 5112 wrote to memory of 980 5112 rlfllfr.exe 96 PID 5112 wrote to memory of 980 5112 rlfllfr.exe 96 PID 5112 wrote to memory of 980 5112 rlfllfr.exe 96 PID 980 wrote to memory of 1924 980 fxfrllf.exe 97 PID 980 wrote to memory of 1924 980 fxfrllf.exe 97 PID 980 wrote to memory of 1924 980 fxfrllf.exe 97 PID 1924 wrote to memory of 3128 1924 hnhnbt.exe 98 PID 1924 wrote to memory of 3128 1924 hnhnbt.exe 98 PID 1924 wrote to memory of 3128 1924 hnhnbt.exe 98 PID 3128 wrote to memory of 4352 3128 lfxrlrl.exe 99 PID 3128 wrote to memory of 4352 3128 lfxrlrl.exe 99 PID 3128 wrote to memory of 4352 3128 lfxrlrl.exe 99 PID 4352 wrote to memory of 2236 4352 tbhbhh.exe 100 PID 4352 wrote to memory of 2236 4352 tbhbhh.exe 100 PID 4352 wrote to memory of 2236 4352 tbhbhh.exe 100 PID 2236 wrote to memory of 3012 2236 vdvpp.exe 102 PID 2236 wrote to memory of 3012 2236 vdvpp.exe 102 PID 2236 wrote to memory of 3012 2236 vdvpp.exe 102 PID 3012 wrote to memory of 3824 3012 lxxlxxr.exe 103 PID 3012 wrote to memory of 3824 3012 lxxlxxr.exe 103 PID 3012 wrote to memory of 3824 3012 lxxlxxr.exe 103 PID 3824 wrote to memory of 720 3824 1lxlxlx.exe 104 PID 3824 wrote to memory of 720 3824 1lxlxlx.exe 104 PID 3824 wrote to memory of 720 3824 1lxlxlx.exe 104 PID 720 wrote to memory of 2220 720 9vvjj.exe 105 PID 720 wrote to memory of 2220 720 9vvjj.exe 105 PID 720 wrote to memory of 2220 720 9vvjj.exe 105 PID 2220 wrote to memory of 1220 2220 thbnbn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\jvjpp.exec:\jvjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\flxfxrf.exec:\flxfxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\9ththb.exec:\9ththb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\jpjvp.exec:\jpjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\xrxfxrr.exec:\xrxfxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\bbnhtn.exec:\bbnhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\ddpjv.exec:\ddpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\fllrfxf.exec:\fllrfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\3hhttn.exec:\3hhttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rlfllfr.exec:\rlfllfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\fxfrllf.exec:\fxfrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\hnhnbt.exec:\hnhnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\lfxrlrl.exec:\lfxrlrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\tbhbhh.exec:\tbhbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\vdvpp.exec:\vdvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\lxxlxxr.exec:\lxxlxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\1lxlxlx.exec:\1lxlxlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\9vvjj.exec:\9vvjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\thbnbn.exec:\thbnbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\3tnhtt.exec:\3tnhtt.exe23⤵
- Executes dropped EXE
PID:1220 -
\??\c:\9pdpv.exec:\9pdpv.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fxrlrlf.exec:\fxrlrlf.exe25⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xxxrfxl.exec:\xxxrfxl.exe26⤵
- Executes dropped EXE
PID:1600 -
\??\c:\7pjvj.exec:\7pjvj.exe27⤵
- Executes dropped EXE
PID:676 -
\??\c:\xrxrxfx.exec:\xrxrxfx.exe28⤵
- Executes dropped EXE
PID:3684 -
\??\c:\ntnnbt.exec:\ntnnbt.exe29⤵
- Executes dropped EXE
PID:5092 -
\??\c:\nbhtbn.exec:\nbhtbn.exe30⤵
- Executes dropped EXE
PID:3456 -
\??\c:\thhhbt.exec:\thhhbt.exe31⤵
- Executes dropped EXE
PID:3832 -
\??\c:\tttnth.exec:\tttnth.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\pdjvd.exec:\pdjvd.exe33⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rfxfxrx.exec:\rfxfxrx.exe34⤵
- Executes dropped EXE
PID:4792 -
\??\c:\9nhbbh.exec:\9nhbbh.exe35⤵
- Executes dropped EXE
PID:3608 -
\??\c:\nhnhbt.exec:\nhnhbt.exe36⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1dvpv.exec:\1dvpv.exe37⤵
- Executes dropped EXE
PID:3188 -
\??\c:\3lfxfrl.exec:\3lfxfrl.exe38⤵
- Executes dropped EXE
PID:4396 -
\??\c:\bhntnh.exec:\bhntnh.exe39⤵
- Executes dropped EXE
PID:4332 -
\??\c:\jvvdj.exec:\jvvdj.exe40⤵
- Executes dropped EXE
PID:1368 -
\??\c:\xlxflxf.exec:\xlxflxf.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xrxllff.exec:\xrxllff.exe42⤵
- Executes dropped EXE
PID:4152 -
\??\c:\nhhbtt.exec:\nhhbtt.exe43⤵
- Executes dropped EXE
PID:4500 -
\??\c:\9pvpv.exec:\9pvpv.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe45⤵
- Executes dropped EXE
PID:4776 -
\??\c:\3btbnh.exec:\3btbnh.exe46⤵
- Executes dropped EXE
PID:3656 -
\??\c:\pvpdp.exec:\pvpdp.exe47⤵
- Executes dropped EXE
PID:1756 -
\??\c:\xrrllxr.exec:\xrrllxr.exe48⤵
- Executes dropped EXE
PID:3464 -
\??\c:\bnntbt.exec:\bnntbt.exe49⤵
- Executes dropped EXE
PID:4024 -
\??\c:\vdvjv.exec:\vdvjv.exe50⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lxxfxxl.exec:\lxxfxxl.exe51⤵
- Executes dropped EXE
PID:1284 -
\??\c:\bhthbn.exec:\bhthbn.exe52⤵
- Executes dropped EXE
PID:4992 -
\??\c:\nnhnbb.exec:\nnhnbb.exe53⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vppjd.exec:\vppjd.exe54⤵
- Executes dropped EXE
PID:4404 -
\??\c:\xffrlxr.exec:\xffrlxr.exe55⤵
- Executes dropped EXE
PID:672 -
\??\c:\5thbnh.exec:\5thbnh.exe56⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vjdvp.exec:\vjdvp.exe57⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5dvjv.exec:\5dvjv.exe58⤵
- Executes dropped EXE
PID:3224 -
\??\c:\5rlxfxl.exec:\5rlxfxl.exe59⤵
- Executes dropped EXE
PID:1924 -
\??\c:\ttnhtn.exec:\ttnhtn.exe60⤵
- Executes dropped EXE
PID:4756 -
\??\c:\ppddj.exec:\ppddj.exe61⤵
- Executes dropped EXE
PID:4288 -
\??\c:\dpjvp.exec:\dpjvp.exe62⤵
- Executes dropped EXE
PID:4964 -
\??\c:\3llfxxr.exec:\3llfxxr.exe63⤵
- Executes dropped EXE
PID:4564 -
\??\c:\tthbnh.exec:\tthbnh.exe64⤵
- Executes dropped EXE
PID:3120 -
\??\c:\ppvjd.exec:\ppvjd.exe65⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vvjdp.exec:\vvjdp.exe66⤵PID:3612
-
\??\c:\lrlxlfl.exec:\lrlxlfl.exe67⤵PID:208
-
\??\c:\1nnbnh.exec:\1nnbnh.exe68⤵PID:872
-
\??\c:\pjvpv.exec:\pjvpv.exe69⤵PID:4932
-
\??\c:\fllxrfx.exec:\fllxrfx.exe70⤵PID:3032
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe71⤵PID:1692
-
\??\c:\ttnnbt.exec:\ttnnbt.exe72⤵PID:1064
-
\??\c:\1pjpp.exec:\1pjpp.exe73⤵PID:4760
-
\??\c:\3fxlxrf.exec:\3fxlxrf.exe74⤵PID:2648
-
\??\c:\llfxlfr.exec:\llfxlfr.exe75⤵PID:4016
-
\??\c:\hbnhnh.exec:\hbnhnh.exe76⤵PID:560
-
\??\c:\bnttbn.exec:\bnttbn.exe77⤵PID:676
-
\??\c:\7jdpv.exec:\7jdpv.exe78⤵PID:4184
-
\??\c:\lrlxlxl.exec:\lrlxlxl.exe79⤵PID:4984
-
\??\c:\nthbnh.exec:\nthbnh.exe80⤵PID:2448
-
\??\c:\bnhbnh.exec:\bnhbnh.exe81⤵PID:3336
-
\??\c:\rllxlfr.exec:\rllxlfr.exe82⤵PID:4340
-
\??\c:\hbnbth.exec:\hbnbth.exe83⤵PID:1952
-
\??\c:\djdvp.exec:\djdvp.exe84⤵PID:876
-
\??\c:\pvpjv.exec:\pvpjv.exe85⤵PID:2104
-
\??\c:\rffxfxf.exec:\rffxfxf.exe86⤵PID:1608
-
\??\c:\bnnbnb.exec:\bnnbnb.exe87⤵PID:3264
-
\??\c:\5pdpj.exec:\5pdpj.exe88⤵PID:3608
-
\??\c:\vddpd.exec:\vddpd.exe89⤵PID:3116
-
\??\c:\llxfxxx.exec:\llxfxxx.exe90⤵PID:3080
-
\??\c:\lffrfxl.exec:\lffrfxl.exe91⤵PID:4160
-
\??\c:\nhnhtn.exec:\nhnhtn.exe92⤵PID:3212
-
\??\c:\ttnnhb.exec:\ttnnhb.exe93⤵PID:2960
-
\??\c:\vpjdd.exec:\vpjdd.exe94⤵PID:2880
-
\??\c:\rrxrllf.exec:\rrxrllf.exe95⤵PID:2868
-
\??\c:\xlflxlx.exec:\xlflxlx.exe96⤵PID:4728
-
\??\c:\btbbnb.exec:\btbbnb.exe97⤵PID:544
-
\??\c:\nnnhtn.exec:\nnnhtn.exe98⤵PID:2036
-
\??\c:\7vpdv.exec:\7vpdv.exe99⤵PID:2892
-
\??\c:\rrrlrlf.exec:\rrrlrlf.exe100⤵PID:648
-
\??\c:\5llxxrf.exec:\5llxxrf.exe101⤵PID:5116
-
\??\c:\bttnnh.exec:\bttnnh.exe102⤵PID:3800
-
\??\c:\dpdjj.exec:\dpdjj.exe103⤵PID:2744
-
\??\c:\5ddpd.exec:\5ddpd.exe104⤵PID:456
-
\??\c:\rlxffrr.exec:\rlxffrr.exe105⤵PID:2776
-
\??\c:\7xxlxrf.exec:\7xxlxrf.exe106⤵PID:3056
-
\??\c:\7bttnt.exec:\7bttnt.exe107⤵PID:4568
-
\??\c:\vdvvj.exec:\vdvvj.exe108⤵PID:1824
-
\??\c:\jvjjj.exec:\jvjjj.exe109⤵PID:3788
-
\??\c:\rlfflfx.exec:\rlfflfx.exe110⤵PID:1068
-
\??\c:\nnhbnh.exec:\nnhbnh.exe111⤵PID:4564
-
\??\c:\jvdpj.exec:\jvdpj.exe112⤵PID:3616
-
\??\c:\rxrfxlf.exec:\rxrfxlf.exe113⤵PID:532
-
\??\c:\rffrfxr.exec:\rffrfxr.exe114⤵PID:2156
-
\??\c:\htthtn.exec:\htthtn.exe115⤵PID:2608
-
\??\c:\5pjdp.exec:\5pjdp.exe116⤵PID:748
-
\??\c:\jjpjd.exec:\jjpjd.exe117⤵PID:3644
-
\??\c:\llxrllr.exec:\llxrllr.exe118⤵PID:1748
-
\??\c:\7hntnt.exec:\7hntnt.exe119⤵PID:1532
-
\??\c:\7pvjv.exec:\7pvjv.exe120⤵PID:4720
-
\??\c:\9pvjp.exec:\9pvjp.exe121⤵PID:4996
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe122⤵PID:2648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-