Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 22:05
Behavioral task
behavioral1
Sample
147b98352cb8d036930e526f25cece70_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
147b98352cb8d036930e526f25cece70_NeikiAnalytics.exe
-
Size
483KB
-
MD5
147b98352cb8d036930e526f25cece70
-
SHA1
959a208d1c156e50ae9f7f16e7b85356bfcc76fd
-
SHA256
92d8d5645b2169c8caae759257d9aaf0b3491fd2447a4b5f34be07a51c9b3d22
-
SHA512
e6d24ade0639292603863d505fd103aae300236e39292b614c4f5018d0b9fd0a5ca10d390f09023d0bb0596ae477a2b6cf84ce47882caf1197efdbaa18eb2491
-
SSDEEP
12288:N4wFHoSMu49P9mPh2kkkkK4kXkkkkkkkkl888888888888888888nh:Cu49lmPh2kkkkK4kXkkkkkkkkT
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1660-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1892-10-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2056-23-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2684-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2716-41-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2576-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2516-67-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2580-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2948-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/856-100-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2772-108-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2820-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2912-126-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/340-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2272-157-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1572-155-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1460-174-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/484-191-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1048-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2852-239-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1256-248-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2984-276-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/912-274-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2860-293-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2140-294-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1524-321-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2732-328-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2312-461-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/356-594-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2300-622-0x0000000000440000-0x0000000000476000-memory.dmp family_blackmoon behavioral1/memory/2488-648-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2484-655-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2300-662-0x0000000000440000-0x0000000000476000-memory.dmp family_blackmoon behavioral1/memory/2760-703-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1616-742-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1544-847-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2732-909-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2744-984-0x00000000003A0000-0x00000000003D6000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/1892-0-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x000d00000001228a-5.dat family_berbew behavioral1/memory/1660-13-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1892-10-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2056-23-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2684-32-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0007000000015065-30.dat family_berbew behavioral1/memory/2716-41-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0007000000015609-39.dat family_berbew behavioral1/files/0x003600000001489f-21.dat family_berbew behavioral1/memory/1660-15-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew behavioral1/files/0x0007000000015670-45.dat family_berbew behavioral1/memory/2576-50-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x000a000000015678-56.dat family_berbew behavioral1/files/0x0009000000015686-63.dat family_berbew behavioral1/memory/2516-67-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0007000000015d73-73.dat family_berbew behavioral1/files/0x0006000000015d7b-80.dat family_berbew behavioral1/memory/2580-82-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015d83-91.dat family_berbew behavioral1/memory/2948-90-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015d90-98.dat family_berbew behavioral1/memory/856-100-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015d9f-109.dat family_berbew behavioral1/memory/2772-108-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2820-117-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015dca-118.dat family_berbew behavioral1/memory/2912-126-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015e1d-127.dat family_berbew behavioral1/memory/340-128-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000015f73-137.dat family_berbew behavioral1/memory/340-136-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0036000000014a10-145.dat family_berbew behavioral1/files/0x0006000000015fef-153.dat family_berbew behavioral1/memory/2272-157-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1572-155-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x000600000001611e-164.dat family_berbew behavioral1/files/0x000600000001615c-172.dat family_berbew behavioral1/memory/1460-174-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x00060000000162e4-181.dat family_berbew behavioral1/files/0x0006000000016455-189.dat family_berbew behavioral1/memory/484-191-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000016581-198.dat family_berbew behavioral1/memory/1048-206-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x00060000000165e1-207.dat family_berbew behavioral1/files/0x0006000000016835-215.dat family_berbew behavioral1/files/0x0006000000016a8a-223.dat family_berbew behavioral1/files/0x0006000000016c52-230.dat family_berbew behavioral1/memory/2852-239-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000016c6f-240.dat family_berbew behavioral1/memory/1256-248-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000016c78-249.dat family_berbew behavioral1/files/0x0006000000016cc1-257.dat family_berbew behavioral1/files/0x0006000000016ceb-265.dat family_berbew behavioral1/files/0x0006000000016d17-272.dat family_berbew behavioral1/memory/2984-276-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/912-274-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/files/0x0006000000016d2a-284.dat family_berbew behavioral1/memory/2860-293-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2140-294-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2024-307-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1524-314-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1524-321-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2732-328-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1660 tbnbnb.exe 2056 vdjpv.exe 2684 xrrlrxf.exe 2716 9bhhtt.exe 2576 1ppdp.exe 2708 xrrrxxl.exe 2516 1bntbb.exe 2580 3jdjd.exe 2948 3thhnt.exe 856 rllrxxl.exe 2772 btnnbt.exe 2820 vddjv.exe 2912 7tbbtt.exe 340 9ddvp.exe 344 hhbbnt.exe 1572 pjvdp.exe 2272 9tnhht.exe 2220 dvppd.exe 1460 7xfrlll.exe 1980 hhthbt.exe 484 3lxfflx.exe 1048 lflxflf.exe 1912 xrrflrf.exe 2372 tbnnhn.exe 444 rrxlrfx.exe 2852 nhbnhh.exe 1256 1rfrxfl.exe 952 1bnthn.exe 2076 fxlrxrr.exe 912 7jjpd.exe 2984 9rfrxfl.exe 2860 tnbhnh.exe 2140 9jpvd.exe 2544 7ttbnh.exe 2024 jpjjv.exe 1524 fxlfrrx.exe 2732 bnbhnn.exe 2056 hbtbhn.exe 2704 djjpj.exe 2724 rlrxllf.exe 2840 bhbnhn.exe 2720 jvpdd.exe 2576 lfrfrrf.exe 2112 nttnbh.exe 2492 hhbntb.exe 2368 3jvdj.exe 2304 lfffflx.exe 348 nbtbbt.exe 2448 ttnttb.exe 856 jjppd.exe 2636 ffrxxxl.exe 1884 btnbhn.exe 2348 3dppd.exe 2192 5xrxflx.exe 1680 5hhthn.exe 1856 5bbbnt.exe 1552 9jpvj.exe 2204 3lflllf.exe 2312 1hhbnn.exe 2500 1bbbhn.exe 2256 vvvdp.exe 320 lxrrrfl.exe 1980 lfrfllx.exe 584 5bttbh.exe -
resource yara_rule behavioral1/memory/1892-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000d00000001228a-5.dat upx behavioral1/memory/1660-13-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1892-10-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2056-23-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2684-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015065-30.dat upx behavioral1/memory/2716-41-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015609-39.dat upx behavioral1/files/0x003600000001489f-21.dat upx behavioral1/memory/1660-15-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/files/0x0007000000015670-45.dat upx behavioral1/memory/2576-50-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000a000000015678-56.dat upx behavioral1/files/0x0009000000015686-63.dat upx behavioral1/memory/2516-67-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015d73-73.dat upx behavioral1/files/0x0006000000015d7b-80.dat upx behavioral1/memory/2580-82-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015d83-91.dat upx behavioral1/memory/2948-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015d90-98.dat upx behavioral1/memory/856-100-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015d9f-109.dat upx behavioral1/memory/2772-108-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2820-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015dca-118.dat upx behavioral1/memory/2912-126-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015e1d-127.dat upx behavioral1/memory/340-128-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015f73-137.dat upx behavioral1/memory/340-136-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0036000000014a10-145.dat upx behavioral1/files/0x0006000000015fef-153.dat upx behavioral1/memory/2272-157-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1572-155-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000600000001611e-164.dat upx behavioral1/files/0x000600000001615c-172.dat upx behavioral1/memory/1460-174-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000162e4-181.dat upx behavioral1/files/0x0006000000016455-189.dat upx behavioral1/memory/484-191-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016581-198.dat upx behavioral1/memory/1048-206-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000165e1-207.dat upx behavioral1/files/0x0006000000016835-215.dat upx behavioral1/files/0x0006000000016a8a-223.dat upx behavioral1/files/0x0006000000016c52-230.dat upx behavioral1/memory/2852-239-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c6f-240.dat upx behavioral1/memory/1256-248-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c78-249.dat upx behavioral1/files/0x0006000000016cc1-257.dat upx behavioral1/files/0x0006000000016ceb-265.dat upx behavioral1/files/0x0006000000016d17-272.dat upx behavioral1/memory/2984-276-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/912-274-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d2a-284.dat upx behavioral1/memory/2860-293-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2140-294-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2024-307-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1524-314-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1524-321-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2732-328-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1892 wrote to memory of 1660 1892 147b98352cb8d036930e526f25cece70_NeikiAnalytics.exe 28 PID 1892 wrote to memory of 1660 1892 147b98352cb8d036930e526f25cece70_NeikiAnalytics.exe 28 PID 1892 wrote to memory of 1660 1892 147b98352cb8d036930e526f25cece70_NeikiAnalytics.exe 28 PID 1892 wrote to memory of 1660 1892 147b98352cb8d036930e526f25cece70_NeikiAnalytics.exe 28 PID 1660 wrote to memory of 2056 1660 tbnbnb.exe 29 PID 1660 wrote to memory of 2056 1660 tbnbnb.exe 29 PID 1660 wrote to memory of 2056 1660 tbnbnb.exe 29 PID 1660 wrote to memory of 2056 1660 tbnbnb.exe 29 PID 2056 wrote to memory of 2684 2056 vdjpv.exe 30 PID 2056 wrote to memory of 2684 2056 vdjpv.exe 30 PID 2056 wrote to memory of 2684 2056 vdjpv.exe 30 PID 2056 wrote to memory of 2684 2056 vdjpv.exe 30 PID 2684 wrote to memory of 2716 2684 xrrlrxf.exe 31 PID 2684 wrote to memory of 2716 2684 xrrlrxf.exe 31 PID 2684 wrote to memory of 2716 2684 xrrlrxf.exe 31 PID 2684 wrote to memory of 2716 2684 xrrlrxf.exe 31 PID 2716 wrote to memory of 2576 2716 9bhhtt.exe 32 PID 2716 wrote to memory of 2576 2716 9bhhtt.exe 32 PID 2716 wrote to memory of 2576 2716 9bhhtt.exe 32 PID 2716 wrote to memory of 2576 2716 9bhhtt.exe 32 PID 2576 wrote to memory of 2708 2576 1ppdp.exe 33 PID 2576 wrote to memory of 2708 2576 1ppdp.exe 33 PID 2576 wrote to memory of 2708 2576 1ppdp.exe 33 PID 2576 wrote to memory of 2708 2576 1ppdp.exe 33 PID 2708 wrote to memory of 2516 2708 xrrrxxl.exe 34 PID 2708 wrote to memory of 2516 2708 xrrrxxl.exe 34 PID 2708 wrote to memory of 2516 2708 xrrrxxl.exe 34 PID 2708 wrote to memory of 2516 2708 xrrrxxl.exe 34 PID 2516 wrote to memory of 2580 2516 1bntbb.exe 35 PID 2516 wrote to memory of 2580 2516 1bntbb.exe 35 PID 2516 wrote to memory of 2580 2516 1bntbb.exe 35 PID 2516 wrote to memory of 2580 2516 1bntbb.exe 35 PID 2580 wrote to memory of 2948 2580 3jdjd.exe 36 PID 2580 wrote to memory of 2948 2580 3jdjd.exe 36 PID 2580 wrote to memory of 2948 2580 3jdjd.exe 36 PID 2580 wrote to memory of 2948 2580 3jdjd.exe 36 PID 2948 wrote to memory of 856 2948 3thhnt.exe 37 PID 2948 wrote to memory of 856 2948 3thhnt.exe 37 PID 2948 wrote to memory of 856 2948 3thhnt.exe 37 PID 2948 wrote to memory of 856 2948 3thhnt.exe 37 PID 856 wrote to memory of 2772 856 rllrxxl.exe 38 PID 856 wrote to memory of 2772 856 rllrxxl.exe 38 PID 856 wrote to memory of 2772 856 rllrxxl.exe 38 PID 856 wrote to memory of 2772 856 rllrxxl.exe 38 PID 2772 wrote to memory of 2820 2772 btnnbt.exe 39 PID 2772 wrote to memory of 2820 2772 btnnbt.exe 39 PID 2772 wrote to memory of 2820 2772 btnnbt.exe 39 PID 2772 wrote to memory of 2820 2772 btnnbt.exe 39 PID 2820 wrote to memory of 2912 2820 vddjv.exe 40 PID 2820 wrote to memory of 2912 2820 vddjv.exe 40 PID 2820 wrote to memory of 2912 2820 vddjv.exe 40 PID 2820 wrote to memory of 2912 2820 vddjv.exe 40 PID 2912 wrote to memory of 340 2912 7tbbtt.exe 41 PID 2912 wrote to memory of 340 2912 7tbbtt.exe 41 PID 2912 wrote to memory of 340 2912 7tbbtt.exe 41 PID 2912 wrote to memory of 340 2912 7tbbtt.exe 41 PID 340 wrote to memory of 344 340 9ddvp.exe 42 PID 340 wrote to memory of 344 340 9ddvp.exe 42 PID 340 wrote to memory of 344 340 9ddvp.exe 42 PID 340 wrote to memory of 344 340 9ddvp.exe 42 PID 344 wrote to memory of 1572 344 hhbbnt.exe 43 PID 344 wrote to memory of 1572 344 hhbbnt.exe 43 PID 344 wrote to memory of 1572 344 hhbbnt.exe 43 PID 344 wrote to memory of 1572 344 hhbbnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\147b98352cb8d036930e526f25cece70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\147b98352cb8d036930e526f25cece70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\tbnbnb.exec:\tbnbnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\vdjpv.exec:\vdjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\xrrlrxf.exec:\xrrlrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\9bhhtt.exec:\9bhhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\1ppdp.exec:\1ppdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\xrrrxxl.exec:\xrrrxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\1bntbb.exec:\1bntbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\3jdjd.exec:\3jdjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\3thhnt.exec:\3thhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\rllrxxl.exec:\rllrxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\btnnbt.exec:\btnnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vddjv.exec:\vddjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\7tbbtt.exec:\7tbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\9ddvp.exec:\9ddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\hhbbnt.exec:\hhbbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\pjvdp.exec:\pjvdp.exe17⤵
- Executes dropped EXE
PID:1572 -
\??\c:\9tnhht.exec:\9tnhht.exe18⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dvppd.exec:\dvppd.exe19⤵
- Executes dropped EXE
PID:2220 -
\??\c:\7xfrlll.exec:\7xfrlll.exe20⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hhthbt.exec:\hhthbt.exe21⤵
- Executes dropped EXE
PID:1980 -
\??\c:\3lxfflx.exec:\3lxfflx.exe22⤵
- Executes dropped EXE
PID:484 -
\??\c:\lflxflf.exec:\lflxflf.exe23⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xrrflrf.exec:\xrrflrf.exe24⤵
- Executes dropped EXE
PID:1912 -
\??\c:\tbnnhn.exec:\tbnnhn.exe25⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rrxlrfx.exec:\rrxlrfx.exe26⤵
- Executes dropped EXE
PID:444 -
\??\c:\nhbnhh.exec:\nhbnhh.exe27⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1rfrxfl.exec:\1rfrxfl.exe28⤵
- Executes dropped EXE
PID:1256 -
\??\c:\1bnthn.exec:\1bnthn.exe29⤵
- Executes dropped EXE
PID:952 -
\??\c:\fxlrxrr.exec:\fxlrxrr.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7jjpd.exec:\7jjpd.exe31⤵
- Executes dropped EXE
PID:912 -
\??\c:\9rfrxfl.exec:\9rfrxfl.exe32⤵
- Executes dropped EXE
PID:2984 -
\??\c:\tnbhnh.exec:\tnbhnh.exe33⤵
- Executes dropped EXE
PID:2860 -
\??\c:\9jpvd.exec:\9jpvd.exe34⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7ttbnh.exec:\7ttbnh.exe35⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jpjjv.exec:\jpjjv.exe36⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fxlfrrx.exec:\fxlfrrx.exe37⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bnbhnn.exec:\bnbhnn.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hbtbhn.exec:\hbtbhn.exe39⤵
- Executes dropped EXE
PID:2056 -
\??\c:\djjpj.exec:\djjpj.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rlrxllf.exec:\rlrxllf.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bhbnhn.exec:\bhbnhn.exe42⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jvpdd.exec:\jvpdd.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lfrfrrf.exec:\lfrfrrf.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nttnbh.exec:\nttnbh.exe45⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hhbntb.exec:\hhbntb.exe46⤵
- Executes dropped EXE
PID:2492 -
\??\c:\3jvdj.exec:\3jvdj.exe47⤵
- Executes dropped EXE
PID:2368 -
\??\c:\lfffflx.exec:\lfffflx.exe48⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nbtbbt.exec:\nbtbbt.exe49⤵
- Executes dropped EXE
PID:348 -
\??\c:\ttnttb.exec:\ttnttb.exe50⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jjppd.exec:\jjppd.exe51⤵
- Executes dropped EXE
PID:856 -
\??\c:\ffrxxxl.exec:\ffrxxxl.exe52⤵
- Executes dropped EXE
PID:2636 -
\??\c:\btnbhn.exec:\btnbhn.exe53⤵
- Executes dropped EXE
PID:1884 -
\??\c:\3dppd.exec:\3dppd.exe54⤵
- Executes dropped EXE
PID:2348 -
\??\c:\5xrxflx.exec:\5xrxflx.exe55⤵
- Executes dropped EXE
PID:2192 -
\??\c:\5hhthn.exec:\5hhthn.exe56⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5bbbnt.exec:\5bbbnt.exe57⤵
- Executes dropped EXE
PID:1856 -
\??\c:\9jpvj.exec:\9jpvj.exe58⤵
- Executes dropped EXE
PID:1552 -
\??\c:\3lflllf.exec:\3lflllf.exe59⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1hhbnn.exec:\1hhbnn.exe60⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1bbbhn.exec:\1bbbhn.exe61⤵
- Executes dropped EXE
PID:2500 -
\??\c:\vvvdp.exec:\vvvdp.exe62⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lxrrrfl.exec:\lxrrrfl.exe63⤵
- Executes dropped EXE
PID:320 -
\??\c:\lfrfllx.exec:\lfrfllx.exe64⤵
- Executes dropped EXE
PID:1980 -
\??\c:\5bttbh.exec:\5bttbh.exe65⤵
- Executes dropped EXE
PID:584 -
\??\c:\3dppd.exec:\3dppd.exe66⤵PID:2796
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe67⤵PID:2648
-
\??\c:\9nnnth.exec:\9nnnth.exe68⤵PID:2324
-
\??\c:\bbnbnn.exec:\bbnbnn.exe69⤵PID:956
-
\??\c:\9ppvj.exec:\9ppvj.exe70⤵PID:2092
-
\??\c:\xxrflxf.exec:\xxrflxf.exe71⤵PID:884
-
\??\c:\lfllxfl.exec:\lfllxfl.exe72⤵PID:2440
-
\??\c:\7bthhh.exec:\7bthhh.exe73⤵PID:1312
-
\??\c:\7ppvd.exec:\7ppvd.exe74⤵PID:1544
-
\??\c:\jddpv.exec:\jddpv.exe75⤵PID:1588
-
\??\c:\xlxxffl.exec:\xlxxffl.exe76⤵PID:608
-
\??\c:\hhnhhn.exec:\hhnhhn.exe77⤵PID:836
-
\??\c:\ddvjv.exec:\ddvjv.exe78⤵PID:552
-
\??\c:\pvvjp.exec:\pvvjp.exe79⤵PID:2800
-
\??\c:\rxfrrxx.exec:\rxfrrxx.exe80⤵PID:2396
-
\??\c:\bbttht.exec:\bbttht.exe81⤵PID:356
-
\??\c:\dvdjd.exec:\dvdjd.exe82⤵PID:2832
-
\??\c:\pjdvj.exec:\pjdvj.exe83⤵PID:2024
-
\??\c:\rlfrffr.exec:\rlfrffr.exe84⤵PID:2940
-
\??\c:\3ntbnb.exec:\3ntbnb.exe85⤵PID:2300
-
\??\c:\pjvdp.exec:\pjvdp.exe86⤵PID:2248
-
\??\c:\vpjvp.exec:\vpjvp.exe87⤵PID:2684
-
\??\c:\7lxfrrx.exec:\7lxfrrx.exe88⤵PID:1104
-
\??\c:\7hnnnt.exec:\7hnnnt.exe89⤵PID:2836
-
\??\c:\bbthtb.exec:\bbthtb.exe90⤵PID:2488
-
\??\c:\ppjjp.exec:\ppjjp.exe91⤵PID:2484
-
\??\c:\flxlfrf.exec:\flxlfrf.exe92⤵PID:2356
-
\??\c:\tnbhnt.exec:\tnbhnt.exe93⤵PID:2512
-
\??\c:\5pdvj.exec:\5pdvj.exe94⤵PID:2580
-
\??\c:\dvvjv.exec:\dvvjv.exe95⤵PID:2304
-
\??\c:\5xrxfll.exec:\5xrxfll.exe96⤵PID:1924
-
\??\c:\nhtntb.exec:\nhtntb.exe97⤵PID:2448
-
\??\c:\tttbhh.exec:\tttbhh.exe98⤵PID:2760
-
\??\c:\jvvdj.exec:\jvvdj.exe99⤵PID:2108
-
\??\c:\fxlxlrf.exec:\fxlxlrf.exe100⤵PID:2152
-
\??\c:\bthhnn.exec:\bthhnn.exe101⤵PID:2168
-
\??\c:\ppjvv.exec:\ppjvv.exe102⤵PID:2144
-
\??\c:\5dpdp.exec:\5dpdp.exe103⤵PID:1512
-
\??\c:\llfrxfr.exec:\llfrxfr.exe104⤵PID:1616
-
\??\c:\bbtbnt.exec:\bbtbnt.exe105⤵PID:2228
-
\??\c:\hthhhh.exec:\hthhhh.exe106⤵PID:1992
-
\??\c:\dvjpd.exec:\dvjpd.exe107⤵PID:2220
-
\??\c:\lfxflxf.exec:\lfxflxf.exe108⤵PID:2500
-
\??\c:\3rlrflr.exec:\3rlrflr.exe109⤵PID:2260
-
\??\c:\hbtbnt.exec:\hbtbnt.exe110⤵PID:984
-
\??\c:\dvvjv.exec:\dvvjv.exe111⤵PID:796
-
\??\c:\rrrrxfx.exec:\rrrrxfx.exe112⤵PID:2444
-
\??\c:\9bthbn.exec:\9bthbn.exe113⤵PID:2796
-
\??\c:\7dvpv.exec:\7dvpv.exe114⤵PID:3012
-
\??\c:\ffxrxfr.exec:\ffxrxfr.exe115⤵PID:2276
-
\??\c:\5bhbnt.exec:\5bhbnt.exe116⤵PID:2412
-
\??\c:\vpjpv.exec:\vpjpv.exe117⤵PID:2092
-
\??\c:\xrfxxfr.exec:\xrfxxfr.exe118⤵PID:848
-
\??\c:\tnhhnt.exec:\tnhhnt.exe119⤵PID:2440
-
\??\c:\3bbtnb.exec:\3bbtnb.exe120⤵PID:1548
-
\??\c:\ddpjv.exec:\ddpjv.exe121⤵PID:1544
-
\??\c:\5frrllr.exec:\5frrllr.exe122⤵PID:1588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-