Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 23:54
Behavioral task
behavioral1
Sample
2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe
-
Size
192KB
-
MD5
2512d4385e88b81fdffe82d7e38e95b0
-
SHA1
11bff0f6914b76390cf60765f23cd48ce8bb81b1
-
SHA256
7792a28004f9aca52ee2a87bb545ea49f8adba95f8b7a5a6a2db68a7d29a36ce
-
SHA512
e57797be0d03f44274555380e44941e5902e1837d2e01aac5398e947561ab13f3962c4b9ad64d6fa2ae2c1082fafc65aaa731b157446fe77bc03d00095e8de13
-
SSDEEP
3072:FhOmTsF93UYfwC6GIoutrVCfMoh52waAyiJ8mqtbfUVKty16hDsI/tSvv:Fcm4FmowdHoS8fMoSVAHubPtyYxfe
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4588-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3592-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4484-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4804-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/244-19-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4084-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2892-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/808-53-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4560-58-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1012-64-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1736-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3388-83-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1636-97-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3512-103-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3140-106-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5052-112-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2384-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4000-131-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2464-137-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3332-142-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4508-159-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1040-168-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4860-174-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5048-176-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/972-196-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2400-200-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/332-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3376-226-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4888-228-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3824-235-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3360-237-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2520-240-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4804-250-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3000-254-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/888-256-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4460-271-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1168-279-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2444-283-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4952-287-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1616-291-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2936-304-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1568-317-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2080-330-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4068-334-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1632-341-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1952-348-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/700-373-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2312-387-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4340-395-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2424-404-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3344-423-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4460-449-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3016-468-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1636-478-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4240-488-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1956-523-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2268-544-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4412-567-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4056-574-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5068-620-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5068-624-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2332-634-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4012-641-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1160-648-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x00090000000233dd-3.dat family_berbew behavioral2/files/0x0008000000023429-10.dat family_berbew behavioral2/files/0x000700000002342a-14.dat family_berbew behavioral2/files/0x000700000002342b-22.dat family_berbew behavioral2/files/0x000700000002342c-28.dat family_berbew behavioral2/files/0x000700000002342d-35.dat family_berbew behavioral2/files/0x000700000002342e-40.dat family_berbew behavioral2/files/0x000700000002342f-45.dat family_berbew behavioral2/files/0x0007000000023430-51.dat family_berbew behavioral2/files/0x0007000000023431-57.dat family_berbew behavioral2/files/0x0007000000023432-62.dat family_berbew behavioral2/files/0x0007000000023433-69.dat family_berbew behavioral2/files/0x0007000000023434-74.dat family_berbew behavioral2/files/0x0007000000023435-79.dat family_berbew behavioral2/files/0x0008000000023427-85.dat family_berbew behavioral2/files/0x0007000000023436-90.dat family_berbew behavioral2/files/0x0007000000023437-95.dat family_berbew behavioral2/files/0x0007000000023438-101.dat family_berbew behavioral2/files/0x0007000000023439-108.dat family_berbew behavioral2/files/0x000700000002343a-114.dat family_berbew behavioral2/files/0x000700000002343b-120.dat family_berbew behavioral2/files/0x000700000002343c-127.dat family_berbew behavioral2/files/0x000700000002343d-133.dat family_berbew behavioral2/files/0x0007000000023437-140.dat family_berbew behavioral2/files/0x000700000002343e-145.dat family_berbew behavioral2/files/0x000700000002343f-151.dat family_berbew behavioral2/files/0x0007000000023440-155.dat family_berbew behavioral2/files/0x0007000000023441-161.dat family_berbew behavioral2/files/0x0007000000023442-169.dat family_berbew behavioral2/files/0x0007000000023443-172.dat family_berbew behavioral2/files/0x0007000000023444-179.dat family_berbew behavioral2/files/0x0007000000023445-185.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 3592 pvjjj.exe 4484 7fxrllx.exe 244 7lllxxr.exe 4804 frrrllf.exe 4084 bthhhh.exe 3504 jdpjj.exe 2892 xrxfflx.exe 808 vdjpj.exe 4560 btbhhh.exe 1012 nhnnhn.exe 1736 jvvdv.exe 3816 7xfxrxx.exe 3388 dvjpp.exe 4788 lllfxxr.exe 2308 bbhhtb.exe 1636 rrrxxff.exe 3512 ddvvp.exe 3140 rxxxrff.exe 5052 ttttnn.exe 2384 vpjdp.exe 4576 jpjpv.exe 4000 fxrxlfx.exe 2464 ntbtbt.exe 3332 ddvvp.exe 3972 5llrfxf.exe 3828 xxxrxxf.exe 4508 ffxxxff.exe 1040 tbhhtt.exe 4860 ffflflf.exe 5048 tbhhht.exe 4716 flrrlll.exe 1420 rlllffx.exe 4844 pvdvp.exe 972 vddpv.exe 2400 fxxfffl.exe 332 bbtthh.exe 4660 jvvvp.exe 4200 lfrrxfl.exe 2508 tnthtn.exe 816 vpdpp.exe 4312 ddjjd.exe 3808 7rxllrl.exe 3376 hhnhbb.exe 4888 djjpv.exe 3824 fflfrrl.exe 3360 nbtnhh.exe 2520 jdpvv.exe 1756 lxfrrxx.exe 4804 btbthb.exe 3000 djppp.exe 888 rxffxxf.exe 1076 7xxxxxr.exe 1604 bntttt.exe 4316 nnttbb.exe 4460 vvddd.exe 5096 xxrlxrx.exe 1168 lxxrllf.exe 2444 nbtnhh.exe 4952 jdppd.exe 1616 xfllflx.exe 4396 ppjpv.exe 1332 rxxrrrf.exe 5024 nntnbh.exe 2936 tthnht.exe -
resource yara_rule behavioral2/memory/4588-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00090000000233dd-3.dat upx behavioral2/memory/4588-5-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3592-12-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023429-10.dat upx behavioral2/memory/4484-13-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342a-14.dat upx behavioral2/files/0x000700000002342b-22.dat upx behavioral2/memory/4804-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/244-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342c-28.dat upx behavioral2/memory/4084-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342d-35.dat upx behavioral2/files/0x000700000002342e-40.dat upx behavioral2/memory/2892-42-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342f-45.dat upx behavioral2/memory/2892-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023430-51.dat upx behavioral2/memory/808-53-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023431-57.dat upx behavioral2/memory/4560-58-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023432-62.dat upx behavioral2/memory/1012-64-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1736-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023433-69.dat upx behavioral2/files/0x0007000000023434-74.dat upx behavioral2/files/0x0007000000023435-79.dat upx behavioral2/memory/3388-83-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023427-85.dat upx behavioral2/files/0x0007000000023436-90.dat upx behavioral2/files/0x0007000000023437-95.dat upx behavioral2/memory/1636-97-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023438-101.dat upx behavioral2/memory/3512-103-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3140-106-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023439-108.dat upx behavioral2/memory/5052-112-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002343a-114.dat upx behavioral2/memory/2384-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002343b-120.dat upx behavioral2/memory/2384-122-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4576-125-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002343c-127.dat upx behavioral2/memory/4000-131-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002343d-133.dat upx behavioral2/memory/2464-137-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023437-140.dat upx behavioral2/memory/3332-142-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002343e-145.dat upx behavioral2/files/0x000700000002343f-151.dat upx behavioral2/files/0x0007000000023440-155.dat upx behavioral2/memory/4508-159-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023441-161.dat upx behavioral2/memory/1040-168-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023442-169.dat upx behavioral2/memory/4860-174-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023443-172.dat upx behavioral2/memory/5048-176-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023444-179.dat upx behavioral2/files/0x0007000000023445-185.dat upx behavioral2/memory/972-196-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2400-200-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/332-204-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3376-226-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4588 wrote to memory of 3592 4588 2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe 82 PID 4588 wrote to memory of 3592 4588 2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe 82 PID 4588 wrote to memory of 3592 4588 2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe 82 PID 3592 wrote to memory of 4484 3592 pvjjj.exe 83 PID 3592 wrote to memory of 4484 3592 pvjjj.exe 83 PID 3592 wrote to memory of 4484 3592 pvjjj.exe 83 PID 4484 wrote to memory of 244 4484 7fxrllx.exe 84 PID 4484 wrote to memory of 244 4484 7fxrllx.exe 84 PID 4484 wrote to memory of 244 4484 7fxrllx.exe 84 PID 244 wrote to memory of 4804 244 7lllxxr.exe 85 PID 244 wrote to memory of 4804 244 7lllxxr.exe 85 PID 244 wrote to memory of 4804 244 7lllxxr.exe 85 PID 4804 wrote to memory of 4084 4804 frrrllf.exe 86 PID 4804 wrote to memory of 4084 4804 frrrllf.exe 86 PID 4804 wrote to memory of 4084 4804 frrrllf.exe 86 PID 4084 wrote to memory of 3504 4084 bthhhh.exe 87 PID 4084 wrote to memory of 3504 4084 bthhhh.exe 87 PID 4084 wrote to memory of 3504 4084 bthhhh.exe 87 PID 3504 wrote to memory of 2892 3504 jdpjj.exe 88 PID 3504 wrote to memory of 2892 3504 jdpjj.exe 88 PID 3504 wrote to memory of 2892 3504 jdpjj.exe 88 PID 2892 wrote to memory of 808 2892 xrxfflx.exe 89 PID 2892 wrote to memory of 808 2892 xrxfflx.exe 89 PID 2892 wrote to memory of 808 2892 xrxfflx.exe 89 PID 808 wrote to memory of 4560 808 vdjpj.exe 91 PID 808 wrote to memory of 4560 808 vdjpj.exe 91 PID 808 wrote to memory of 4560 808 vdjpj.exe 91 PID 4560 wrote to memory of 1012 4560 btbhhh.exe 92 PID 4560 wrote to memory of 1012 4560 btbhhh.exe 92 PID 4560 wrote to memory of 1012 4560 btbhhh.exe 92 PID 1012 wrote to memory of 1736 1012 nhnnhn.exe 94 PID 1012 wrote to memory of 1736 1012 nhnnhn.exe 94 PID 1012 wrote to memory of 1736 1012 nhnnhn.exe 94 PID 1736 wrote to memory of 3816 1736 jvvdv.exe 95 PID 1736 wrote to memory of 3816 1736 jvvdv.exe 95 PID 1736 wrote to memory of 3816 1736 jvvdv.exe 95 PID 3816 wrote to memory of 3388 3816 7xfxrxx.exe 96 PID 3816 wrote to memory of 3388 3816 7xfxrxx.exe 96 PID 3816 wrote to memory of 3388 3816 7xfxrxx.exe 96 PID 3388 wrote to memory of 4788 3388 dvjpp.exe 97 PID 3388 wrote to memory of 4788 3388 dvjpp.exe 97 PID 3388 wrote to memory of 4788 3388 dvjpp.exe 97 PID 4788 wrote to memory of 2308 4788 lllfxxr.exe 98 PID 4788 wrote to memory of 2308 4788 lllfxxr.exe 98 PID 4788 wrote to memory of 2308 4788 lllfxxr.exe 98 PID 2308 wrote to memory of 1636 2308 bbhhtb.exe 100 PID 2308 wrote to memory of 1636 2308 bbhhtb.exe 100 PID 2308 wrote to memory of 1636 2308 bbhhtb.exe 100 PID 1636 wrote to memory of 3512 1636 rrrxxff.exe 101 PID 1636 wrote to memory of 3512 1636 rrrxxff.exe 101 PID 1636 wrote to memory of 3512 1636 rrrxxff.exe 101 PID 3512 wrote to memory of 3140 3512 ddvvp.exe 102 PID 3512 wrote to memory of 3140 3512 ddvvp.exe 102 PID 3512 wrote to memory of 3140 3512 ddvvp.exe 102 PID 3140 wrote to memory of 5052 3140 rxxxrff.exe 103 PID 3140 wrote to memory of 5052 3140 rxxxrff.exe 103 PID 3140 wrote to memory of 5052 3140 rxxxrff.exe 103 PID 5052 wrote to memory of 2384 5052 ttttnn.exe 104 PID 5052 wrote to memory of 2384 5052 ttttnn.exe 104 PID 5052 wrote to memory of 2384 5052 ttttnn.exe 104 PID 2384 wrote to memory of 4576 2384 vpjdp.exe 105 PID 2384 wrote to memory of 4576 2384 vpjdp.exe 105 PID 2384 wrote to memory of 4576 2384 vpjdp.exe 105 PID 4576 wrote to memory of 4000 4576 jpjpv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\pvjjj.exec:\pvjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\7fxrllx.exec:\7fxrllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\7lllxxr.exec:\7lllxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\frrrllf.exec:\frrrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\bthhhh.exec:\bthhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\jdpjj.exec:\jdpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\xrxfflx.exec:\xrxfflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\vdjpj.exec:\vdjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\btbhhh.exec:\btbhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\nhnnhn.exec:\nhnnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\jvvdv.exec:\jvvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\7xfxrxx.exec:\7xfxrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\dvjpp.exec:\dvjpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\lllfxxr.exec:\lllfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\bbhhtb.exec:\bbhhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\rrrxxff.exec:\rrrxxff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\ddvvp.exec:\ddvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\rxxxrff.exec:\rxxxrff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\ttttnn.exec:\ttttnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\vpjdp.exec:\vpjdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\jpjpv.exec:\jpjpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\fxrxlfx.exec:\fxrxlfx.exe23⤵
- Executes dropped EXE
PID:4000 -
\??\c:\ntbtbt.exec:\ntbtbt.exe24⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ddvvp.exec:\ddvvp.exe25⤵
- Executes dropped EXE
PID:3332 -
\??\c:\5llrfxf.exec:\5llrfxf.exe26⤵
- Executes dropped EXE
PID:3972 -
\??\c:\xxxrxxf.exec:\xxxrxxf.exe27⤵
- Executes dropped EXE
PID:3828 -
\??\c:\ffxxxff.exec:\ffxxxff.exe28⤵
- Executes dropped EXE
PID:4508 -
\??\c:\tbhhtt.exec:\tbhhtt.exe29⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ffflflf.exec:\ffflflf.exe30⤵
- Executes dropped EXE
PID:4860 -
\??\c:\tbhhht.exec:\tbhhht.exe31⤵
- Executes dropped EXE
PID:5048 -
\??\c:\flrrlll.exec:\flrrlll.exe32⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rlllffx.exec:\rlllffx.exe33⤵
- Executes dropped EXE
PID:1420 -
\??\c:\pvdvp.exec:\pvdvp.exe34⤵
- Executes dropped EXE
PID:4844 -
\??\c:\vddpv.exec:\vddpv.exe35⤵
- Executes dropped EXE
PID:972 -
\??\c:\fxxfffl.exec:\fxxfffl.exe36⤵
- Executes dropped EXE
PID:2400 -
\??\c:\bbtthh.exec:\bbtthh.exe37⤵
- Executes dropped EXE
PID:332 -
\??\c:\jvvvp.exec:\jvvvp.exe38⤵
- Executes dropped EXE
PID:4660 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe39⤵
- Executes dropped EXE
PID:4200 -
\??\c:\tnthtn.exec:\tnthtn.exe40⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vpdpp.exec:\vpdpp.exe41⤵
- Executes dropped EXE
PID:816 -
\??\c:\ddjjd.exec:\ddjjd.exe42⤵
- Executes dropped EXE
PID:4312 -
\??\c:\7rxllrl.exec:\7rxllrl.exe43⤵
- Executes dropped EXE
PID:3808 -
\??\c:\hhnhbb.exec:\hhnhbb.exe44⤵
- Executes dropped EXE
PID:3376 -
\??\c:\djjpv.exec:\djjpv.exe45⤵
- Executes dropped EXE
PID:4888 -
\??\c:\fflfrrl.exec:\fflfrrl.exe46⤵
- Executes dropped EXE
PID:3824 -
\??\c:\nbtnhh.exec:\nbtnhh.exe47⤵
- Executes dropped EXE
PID:3360 -
\??\c:\jdpvv.exec:\jdpvv.exe48⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lxfrrxx.exec:\lxfrrxx.exe49⤵
- Executes dropped EXE
PID:1756 -
\??\c:\btbthb.exec:\btbthb.exe50⤵
- Executes dropped EXE
PID:4804 -
\??\c:\djppp.exec:\djppp.exe51⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rxffxxf.exec:\rxffxxf.exe52⤵
- Executes dropped EXE
PID:888 -
\??\c:\7xxxxxr.exec:\7xxxxxr.exe53⤵
- Executes dropped EXE
PID:1076 -
\??\c:\bntttt.exec:\bntttt.exe54⤵
- Executes dropped EXE
PID:1604 -
\??\c:\nnttbb.exec:\nnttbb.exe55⤵
- Executes dropped EXE
PID:4316 -
\??\c:\vvddd.exec:\vvddd.exe56⤵
- Executes dropped EXE
PID:4460 -
\??\c:\xxrlxrx.exec:\xxrlxrx.exe57⤵
- Executes dropped EXE
PID:5096 -
\??\c:\lxxrllf.exec:\lxxrllf.exe58⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nbtnhh.exec:\nbtnhh.exe59⤵
- Executes dropped EXE
PID:2444 -
\??\c:\jdppd.exec:\jdppd.exe60⤵
- Executes dropped EXE
PID:4952 -
\??\c:\xfllflx.exec:\xfllflx.exe61⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ppjpv.exec:\ppjpv.exe62⤵
- Executes dropped EXE
PID:4396 -
\??\c:\rxxrrrf.exec:\rxxrrrf.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\nntnbh.exec:\nntnbh.exe64⤵
- Executes dropped EXE
PID:5024 -
\??\c:\tthnht.exec:\tthnht.exe65⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pvpdj.exec:\pvpdj.exe66⤵PID:4680
-
\??\c:\ntnbtt.exec:\ntnbtt.exe67⤵PID:3512
-
\??\c:\jjvvp.exec:\jjvvp.exe68⤵PID:1712
-
\??\c:\frlxxll.exec:\frlxxll.exe69⤵PID:1568
-
\??\c:\pvddd.exec:\pvddd.exe70⤵PID:400
-
\??\c:\tttnhn.exec:\tttnhn.exe71⤵PID:4516
-
\??\c:\fxlflrx.exec:\fxlflrx.exe72⤵PID:740
-
\??\c:\nhhbtb.exec:\nhhbtb.exe73⤵PID:2080
-
\??\c:\3pjjd.exec:\3pjjd.exe74⤵PID:2160
-
\??\c:\llrxrrr.exec:\llrxrrr.exe75⤵PID:4068
-
\??\c:\xxfllrx.exec:\xxfllrx.exe76⤵PID:1632
-
\??\c:\btttnb.exec:\btttnb.exe77⤵PID:3912
-
\??\c:\pvvdd.exec:\pvvdd.exe78⤵PID:1952
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe79⤵PID:4160
-
\??\c:\hhnhnt.exec:\hhnhnt.exe80⤵PID:1956
-
\??\c:\hnttbb.exec:\hnttbb.exe81⤵PID:1784
-
\??\c:\jvjpp.exec:\jvjpp.exe82⤵PID:4996
-
\??\c:\lxlxxfr.exec:\lxlxxfr.exe83⤵PID:4908
-
\??\c:\thttnt.exec:\thttnt.exe84⤵PID:4860
-
\??\c:\hbtntt.exec:\hbtntt.exe85⤵PID:664
-
\??\c:\jjpjv.exec:\jjpjv.exe86⤵PID:700
-
\??\c:\xxlfllx.exec:\xxlfllx.exe87⤵PID:2556
-
\??\c:\xrxrllf.exec:\xrxrllf.exe88⤵PID:4880
-
\??\c:\bnbtth.exec:\bnbtth.exe89⤵PID:972
-
\??\c:\ddvvd.exec:\ddvvd.exe90⤵PID:2312
-
\??\c:\ddvpv.exec:\ddvpv.exe91⤵PID:4944
-
\??\c:\ffrfxrf.exec:\ffrfxrf.exe92⤵PID:824
-
\??\c:\htbthh.exec:\htbthh.exe93⤵PID:4340
-
\??\c:\jvjjd.exec:\jvjjd.exe94⤵PID:4344
-
\??\c:\jdpvp.exec:\jdpvp.exe95⤵PID:2424
-
\??\c:\xrffflr.exec:\xrffflr.exe96⤵PID:828
-
\??\c:\djvjv.exec:\djvjv.exe97⤵PID:3752
-
\??\c:\jdppj.exec:\jdppj.exe98⤵PID:2024
-
\??\c:\frfrflx.exec:\frfrflx.exe99⤵PID:440
-
\??\c:\nnhhhh.exec:\nnhhhh.exe100⤵PID:2292
-
\??\c:\hbbbth.exec:\hbbbth.exe101⤵PID:2520
-
\??\c:\5pvpp.exec:\5pvpp.exe102⤵PID:3344
-
\??\c:\frxrlrf.exec:\frxrlrf.exe103⤵PID:4432
-
\??\c:\bhbbhh.exec:\bhbbhh.exe104⤵PID:3000
-
\??\c:\vvdjp.exec:\vvdjp.exe105⤵PID:2892
-
\??\c:\fxlflfx.exec:\fxlflfx.exe106⤵PID:1076
-
\??\c:\lflfxll.exec:\lflfxll.exe107⤵PID:3264
-
\??\c:\tnbnhb.exec:\tnbnhb.exe108⤵PID:1196
-
\??\c:\jpvdd.exec:\jpvdd.exe109⤵PID:4460
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe110⤵PID:5096
-
\??\c:\llrffll.exec:\llrffll.exe111⤵PID:5068
-
\??\c:\bttnhh.exec:\bttnhh.exe112⤵PID:2340
-
\??\c:\vppdv.exec:\vppdv.exe113⤵PID:2428
-
\??\c:\lxfxfrr.exec:\lxfxfrr.exe114⤵PID:1060
-
\??\c:\xrffxxr.exec:\xrffxxr.exe115⤵PID:3016
-
\??\c:\hhhbbb.exec:\hhhbbb.exe116⤵PID:3612
-
\??\c:\1ddvj.exec:\1ddvj.exe117⤵PID:224
-
\??\c:\jdvvp.exec:\jdvvp.exe118⤵PID:1636
-
\??\c:\xlflrrr.exec:\xlflrrr.exe119⤵PID:2468
-
\??\c:\nhhbbb.exec:\nhhbbb.exe120⤵PID:4816
-
\??\c:\vjvpd.exec:\vjvpd.exe121⤵PID:4240
-
\??\c:\rxrlrrf.exec:\rxrlrrf.exe122⤵PID:1568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-