Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 11:07
Behavioral task
behavioral1
Sample
cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe
-
Size
252KB
-
MD5
cdd51d1b11ce82e65ef693b6d1996500
-
SHA1
3b2fdcc562bf752983c944a5d6a14a80cc641848
-
SHA256
2e7173ef01778541bd29e2d7cabebfb00c15de17175d8296ee01ab70f9dc0812
-
SHA512
49c320c1a002a0794f04f3dc47470089dae1a58f97ca9c40f7e069036b11299366925a9a3283fd4b639fb4741c01bfb16285120f5ff55ada82b5b8890815b386
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+THk8:ccm4FmowdHoSi9EIBftapTs4WZazeE8
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1548-0-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2800-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/896-15-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4440-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3428-23-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3404-36-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4456-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1740-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3360-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4732-65-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3896-72-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3996-70-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1012-79-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2952-88-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4156-94-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4468-103-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1764-104-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1384-109-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1924-114-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2840-124-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2992-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2428-144-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3236-152-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4596-155-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4880-161-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3480-166-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3480-170-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4312-188-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3544-192-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1784-197-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/384-203-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4444-214-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3464-222-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/548-232-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3064-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2892-251-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4936-256-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2240-258-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4580-262-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3676-271-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1012-284-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/212-294-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3084-304-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4612-311-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2100-323-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/488-332-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1256-352-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1228-359-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1528-384-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5016-454-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2952-458-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2100-493-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3992-519-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1336-526-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1624-542-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4056-614-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4388-726-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2064-750-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2360-757-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5104-820-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1012-924-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3504-947-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2284-1039-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1184-1293-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022f51-3.dat family_berbew behavioral2/files/0x00090000000233e8-9.dat family_berbew behavioral2/files/0x00080000000233f7-12.dat family_berbew behavioral2/files/0x00070000000233fd-27.dat family_berbew behavioral2/files/0x00070000000233fe-33.dat family_berbew behavioral2/files/0x00070000000233ff-38.dat family_berbew behavioral2/files/0x00070000000233fc-22.dat family_berbew behavioral2/files/0x0007000000023400-45.dat family_berbew behavioral2/files/0x0007000000023401-53.dat family_berbew behavioral2/files/0x0007000000023402-57.dat family_berbew behavioral2/files/0x0007000000023403-62.dat family_berbew behavioral2/files/0x0007000000023404-68.dat family_berbew behavioral2/files/0x0007000000023405-75.dat family_berbew behavioral2/files/0x0007000000023406-82.dat family_berbew behavioral2/files/0x0007000000023407-86.dat family_berbew behavioral2/files/0x0007000000023408-92.dat family_berbew behavioral2/files/0x000700000002340a-105.dat family_berbew behavioral2/files/0x000700000002340b-112.dat family_berbew behavioral2/files/0x0007000000023409-99.dat family_berbew behavioral2/files/0x00070000000233fe-118.dat family_berbew behavioral2/files/0x00090000000233ef-122.dat family_berbew behavioral2/files/0x000700000002340c-128.dat family_berbew behavioral2/files/0x000700000002340d-134.dat family_berbew behavioral2/files/0x000700000002340e-140.dat family_berbew behavioral2/files/0x000700000002340f-146.dat family_berbew behavioral2/files/0x0007000000023410-150.dat family_berbew behavioral2/files/0x0007000000023411-159.dat family_berbew behavioral2/files/0x0007000000023412-164.dat family_berbew behavioral2/files/0x0007000000023413-171.dat family_berbew behavioral2/files/0x0007000000023414-175.dat family_berbew behavioral2/files/0x0007000000023415-180.dat family_berbew behavioral2/files/0x0007000000023416-187.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2800 ddvpd.exe 896 3vpjv.exe 3428 rxllfxr.exe 4440 rlrfxrf.exe 4456 hhnhhh.exe 3404 7dvpj.exe 3360 vdppp.exe 1740 jdpdd.exe 1464 dvdvd.exe 4732 ppvpv.exe 3896 rfffxxr.exe 3996 rflrrrl.exe 1012 bthtnn.exe 2952 rffrlfx.exe 4156 tnbbnn.exe 4468 dpjdv.exe 1764 fffxllf.exe 1384 bnnhbt.exe 1924 nbhthb.exe 2840 7dvpj.exe 4844 pjpjv.exe 3900 fxlfrlf.exe 2992 tnnnhn.exe 2428 1pjdv.exe 3236 lffxrrl.exe 4596 pjjdv.exe 4880 9pjvj.exe 3480 xllxllf.exe 2916 vpjdv.exe 3128 vvvpd.exe 4312 rlxrlfx.exe 2948 hbbtnn.exe 3544 xlfxfxf.exe 1784 fxlfxff.exe 384 nbthbb.exe 3984 jvvpd.exe 2044 dvvpj.exe 4444 fxllxxr.exe 3200 tbbbhn.exe 1820 pjjdp.exe 3464 pjdvp.exe 724 9rxrxxl.exe 548 lllfffx.exe 3080 9bnntt.exe 2284 ddvpj.exe 3064 rxllfxf.exe 4048 rflxrrl.exe 2892 ttnnbt.exe 4936 vdvjv.exe 2240 xlxxrlf.exe 4580 rlxrlff.exe 744 bhbthh.exe 3676 9pjdv.exe 2412 7xfrfff.exe 3880 fxxrlfx.exe 5096 3hbtnh.exe 1012 3xrlflf.exe 1300 1hhhtt.exe 4944 vpjdv.exe 212 vpvpd.exe 2700 hbbnhh.exe 3264 9hhthh.exe 3084 xxfffll.exe 3648 xrxrxlr.exe -
resource yara_rule behavioral2/memory/1548-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/files/0x00090000000233e8-9.dat upx behavioral2/memory/2800-13-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/896-15-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00080000000233f7-12.dat upx behavioral2/memory/2800-4-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4440-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3428-23-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fd-27.dat upx behavioral2/files/0x00070000000233fe-33.dat upx behavioral2/files/0x00070000000233ff-38.dat upx behavioral2/memory/3360-40-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3404-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4456-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fc-22.dat upx behavioral2/files/0x0007000000023400-45.dat upx behavioral2/memory/1740-50-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023401-53.dat upx behavioral2/memory/3360-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023402-57.dat upx behavioral2/files/0x0007000000023403-62.dat upx behavioral2/memory/4732-65-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023404-68.dat upx behavioral2/memory/3896-72-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023405-75.dat upx behavioral2/memory/3996-70-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1012-79-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023406-82.dat upx behavioral2/files/0x0007000000023407-86.dat upx behavioral2/memory/2952-88-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023408-92.dat upx behavioral2/memory/4156-94-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4468-103-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1764-104-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340a-105.dat upx behavioral2/memory/1384-109-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340b-112.dat upx behavioral2/memory/1924-114-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023409-99.dat upx behavioral2/files/0x00070000000233fe-118.dat upx behavioral2/memory/2840-124-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00090000000233ef-122.dat upx behavioral2/files/0x000700000002340c-128.dat upx behavioral2/files/0x000700000002340d-134.dat upx behavioral2/memory/2992-136-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340e-140.dat upx behavioral2/memory/2428-144-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340f-146.dat upx behavioral2/files/0x0007000000023410-150.dat upx behavioral2/memory/3236-152-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4596-155-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023411-159.dat upx behavioral2/memory/4880-161-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023412-164.dat upx behavioral2/memory/3480-166-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023413-171.dat upx behavioral2/memory/3480-170-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023414-175.dat upx behavioral2/files/0x0007000000023415-180.dat upx behavioral2/files/0x0007000000023416-187.dat upx behavioral2/memory/4312-188-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3544-192-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1784-197-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 2800 1548 cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe 83 PID 1548 wrote to memory of 2800 1548 cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe 83 PID 1548 wrote to memory of 2800 1548 cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe 83 PID 2800 wrote to memory of 896 2800 ddvpd.exe 84 PID 2800 wrote to memory of 896 2800 ddvpd.exe 84 PID 2800 wrote to memory of 896 2800 ddvpd.exe 84 PID 896 wrote to memory of 3428 896 3vpjv.exe 85 PID 896 wrote to memory of 3428 896 3vpjv.exe 85 PID 896 wrote to memory of 3428 896 3vpjv.exe 85 PID 3428 wrote to memory of 4440 3428 rxllfxr.exe 86 PID 3428 wrote to memory of 4440 3428 rxllfxr.exe 86 PID 3428 wrote to memory of 4440 3428 rxllfxr.exe 86 PID 4440 wrote to memory of 4456 4440 rlrfxrf.exe 87 PID 4440 wrote to memory of 4456 4440 rlrfxrf.exe 87 PID 4440 wrote to memory of 4456 4440 rlrfxrf.exe 87 PID 4456 wrote to memory of 3404 4456 hhnhhh.exe 88 PID 4456 wrote to memory of 3404 4456 hhnhhh.exe 88 PID 4456 wrote to memory of 3404 4456 hhnhhh.exe 88 PID 3404 wrote to memory of 3360 3404 7dvpj.exe 89 PID 3404 wrote to memory of 3360 3404 7dvpj.exe 89 PID 3404 wrote to memory of 3360 3404 7dvpj.exe 89 PID 3360 wrote to memory of 1740 3360 vdppp.exe 90 PID 3360 wrote to memory of 1740 3360 vdppp.exe 90 PID 3360 wrote to memory of 1740 3360 vdppp.exe 90 PID 1740 wrote to memory of 1464 1740 jdpdd.exe 91 PID 1740 wrote to memory of 1464 1740 jdpdd.exe 91 PID 1740 wrote to memory of 1464 1740 jdpdd.exe 91 PID 1464 wrote to memory of 4732 1464 dvdvd.exe 92 PID 1464 wrote to memory of 4732 1464 dvdvd.exe 92 PID 1464 wrote to memory of 4732 1464 dvdvd.exe 92 PID 4732 wrote to memory of 3896 4732 ppvpv.exe 93 PID 4732 wrote to memory of 3896 4732 ppvpv.exe 93 PID 4732 wrote to memory of 3896 4732 ppvpv.exe 93 PID 3896 wrote to memory of 3996 3896 rfffxxr.exe 95 PID 3896 wrote to memory of 3996 3896 rfffxxr.exe 95 PID 3896 wrote to memory of 3996 3896 rfffxxr.exe 95 PID 3996 wrote to memory of 1012 3996 rflrrrl.exe 96 PID 3996 wrote to memory of 1012 3996 rflrrrl.exe 96 PID 3996 wrote to memory of 1012 3996 rflrrrl.exe 96 PID 1012 wrote to memory of 2952 1012 bthtnn.exe 98 PID 1012 wrote to memory of 2952 1012 bthtnn.exe 98 PID 1012 wrote to memory of 2952 1012 bthtnn.exe 98 PID 2952 wrote to memory of 4156 2952 rffrlfx.exe 99 PID 2952 wrote to memory of 4156 2952 rffrlfx.exe 99 PID 2952 wrote to memory of 4156 2952 rffrlfx.exe 99 PID 4156 wrote to memory of 4468 4156 tnbbnn.exe 100 PID 4156 wrote to memory of 4468 4156 tnbbnn.exe 100 PID 4156 wrote to memory of 4468 4156 tnbbnn.exe 100 PID 4468 wrote to memory of 1764 4468 dpjdv.exe 102 PID 4468 wrote to memory of 1764 4468 dpjdv.exe 102 PID 4468 wrote to memory of 1764 4468 dpjdv.exe 102 PID 1764 wrote to memory of 1384 1764 fffxllf.exe 103 PID 1764 wrote to memory of 1384 1764 fffxllf.exe 103 PID 1764 wrote to memory of 1384 1764 fffxllf.exe 103 PID 1384 wrote to memory of 1924 1384 bnnhbt.exe 104 PID 1384 wrote to memory of 1924 1384 bnnhbt.exe 104 PID 1384 wrote to memory of 1924 1384 bnnhbt.exe 104 PID 1924 wrote to memory of 2840 1924 nbhthb.exe 105 PID 1924 wrote to memory of 2840 1924 nbhthb.exe 105 PID 1924 wrote to memory of 2840 1924 nbhthb.exe 105 PID 2840 wrote to memory of 4844 2840 7dvpj.exe 106 PID 2840 wrote to memory of 4844 2840 7dvpj.exe 106 PID 2840 wrote to memory of 4844 2840 7dvpj.exe 106 PID 4844 wrote to memory of 3900 4844 pjpjv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\ddvpd.exec:\ddvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\3vpjv.exec:\3vpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\rxllfxr.exec:\rxllfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\rlrfxrf.exec:\rlrfxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\hhnhhh.exec:\hhnhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\7dvpj.exec:\7dvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\vdppp.exec:\vdppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\jdpdd.exec:\jdpdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\dvdvd.exec:\dvdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\ppvpv.exec:\ppvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\rfffxxr.exec:\rfffxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\rflrrrl.exec:\rflrrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\bthtnn.exec:\bthtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\rffrlfx.exec:\rffrlfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\tnbbnn.exec:\tnbbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\dpjdv.exec:\dpjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\fffxllf.exec:\fffxllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\bnnhbt.exec:\bnnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\nbhthb.exec:\nbhthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\7dvpj.exec:\7dvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\pjpjv.exec:\pjpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\fxlfrlf.exec:\fxlfrlf.exe23⤵
- Executes dropped EXE
PID:3900 -
\??\c:\tnnnhn.exec:\tnnnhn.exe24⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1pjdv.exec:\1pjdv.exe25⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lffxrrl.exec:\lffxrrl.exe26⤵
- Executes dropped EXE
PID:3236 -
\??\c:\pjjdv.exec:\pjjdv.exe27⤵
- Executes dropped EXE
PID:4596 -
\??\c:\9pjvj.exec:\9pjvj.exe28⤵
- Executes dropped EXE
PID:4880 -
\??\c:\xllxllf.exec:\xllxllf.exe29⤵
- Executes dropped EXE
PID:3480 -
\??\c:\vpjdv.exec:\vpjdv.exe30⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vvvpd.exec:\vvvpd.exe31⤵
- Executes dropped EXE
PID:3128 -
\??\c:\rlxrlfx.exec:\rlxrlfx.exe32⤵
- Executes dropped EXE
PID:4312 -
\??\c:\hbbtnn.exec:\hbbtnn.exe33⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xlfxfxf.exec:\xlfxfxf.exe34⤵
- Executes dropped EXE
PID:3544 -
\??\c:\fxlfxff.exec:\fxlfxff.exe35⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nbthbb.exec:\nbthbb.exe36⤵
- Executes dropped EXE
PID:384 -
\??\c:\jvvpd.exec:\jvvpd.exe37⤵
- Executes dropped EXE
PID:3984 -
\??\c:\dvvpj.exec:\dvvpj.exe38⤵
- Executes dropped EXE
PID:2044 -
\??\c:\fxllxxr.exec:\fxllxxr.exe39⤵
- Executes dropped EXE
PID:4444 -
\??\c:\tbbbhn.exec:\tbbbhn.exe40⤵
- Executes dropped EXE
PID:3200 -
\??\c:\pjjdp.exec:\pjjdp.exe41⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pjdvp.exec:\pjdvp.exe42⤵
- Executes dropped EXE
PID:3464 -
\??\c:\9rxrxxl.exec:\9rxrxxl.exe43⤵
- Executes dropped EXE
PID:724 -
\??\c:\lllfffx.exec:\lllfffx.exe44⤵
- Executes dropped EXE
PID:548 -
\??\c:\9bnntt.exec:\9bnntt.exe45⤵
- Executes dropped EXE
PID:3080 -
\??\c:\ddvpj.exec:\ddvpj.exe46⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rxllfxf.exec:\rxllfxf.exe47⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rflxrrl.exec:\rflxrrl.exe48⤵
- Executes dropped EXE
PID:4048 -
\??\c:\ttnnbt.exec:\ttnnbt.exe49⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vdvjv.exec:\vdvjv.exe50⤵
- Executes dropped EXE
PID:4936 -
\??\c:\xlxxrlf.exec:\xlxxrlf.exe51⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rlxrlff.exec:\rlxrlff.exe52⤵
- Executes dropped EXE
PID:4580 -
\??\c:\bhbthh.exec:\bhbthh.exe53⤵
- Executes dropped EXE
PID:744 -
\??\c:\9pjdv.exec:\9pjdv.exe54⤵
- Executes dropped EXE
PID:3676 -
\??\c:\7xfrfff.exec:\7xfrfff.exe55⤵
- Executes dropped EXE
PID:2412 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe56⤵
- Executes dropped EXE
PID:3880 -
\??\c:\3hbtnh.exec:\3hbtnh.exe57⤵
- Executes dropped EXE
PID:5096 -
\??\c:\3xrlflf.exec:\3xrlflf.exe58⤵
- Executes dropped EXE
PID:1012 -
\??\c:\1hhhtt.exec:\1hhhtt.exe59⤵
- Executes dropped EXE
PID:1300 -
\??\c:\vpjdv.exec:\vpjdv.exe60⤵
- Executes dropped EXE
PID:4944 -
\??\c:\vpvpd.exec:\vpvpd.exe61⤵
- Executes dropped EXE
PID:212 -
\??\c:\hbbnhh.exec:\hbbnhh.exe62⤵
- Executes dropped EXE
PID:2700 -
\??\c:\9hhthh.exec:\9hhthh.exe63⤵
- Executes dropped EXE
PID:3264 -
\??\c:\xxfffll.exec:\xxfffll.exe64⤵
- Executes dropped EXE
PID:3084 -
\??\c:\xrxrxlr.exec:\xrxrxlr.exe65⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jvddv.exec:\jvddv.exe66⤵PID:4612
-
\??\c:\3dddp.exec:\3dddp.exe67⤵PID:3504
-
\??\c:\xlrlfxl.exec:\xlrlfxl.exe68⤵PID:4188
-
\??\c:\rlrrrlx.exec:\rlrrrlx.exe69⤵PID:2408
-
\??\c:\5btnhb.exec:\5btnhb.exe70⤵PID:2100
-
\??\c:\5jpdd.exec:\5jpdd.exe71⤵PID:3252
-
\??\c:\pvvpv.exec:\pvvpv.exe72⤵PID:488
-
\??\c:\tbnnhn.exec:\tbnnhn.exe73⤵PID:1768
-
\??\c:\thtttt.exec:\thtttt.exe74⤵PID:768
-
\??\c:\rxllfff.exec:\rxllfff.exe75⤵PID:944
-
\??\c:\nbnhhn.exec:\nbnhhn.exe76⤵PID:4596
-
\??\c:\7vvpd.exec:\7vvpd.exe77⤵PID:3600
-
\??\c:\1fxrlrl.exec:\1fxrlrl.exe78⤵PID:1256
-
\??\c:\jjjjv.exec:\jjjjv.exe79⤵PID:3480
-
\??\c:\lxxrfxr.exec:\lxxrfxr.exe80⤵PID:1228
-
\??\c:\tnnhbt.exec:\tnnhbt.exe81⤵PID:4128
-
\??\c:\xrrrrxf.exec:\xrrrrxf.exe82⤵PID:4912
-
\??\c:\hhhbtn.exec:\hhhbtn.exe83⤵PID:832
-
\??\c:\dvdvv.exec:\dvdvv.exe84⤵PID:3472
-
\??\c:\frrfxrl.exec:\frrfxrl.exe85⤵PID:1624
-
\??\c:\bbbhhh.exec:\bbbhhh.exe86⤵PID:1160
-
\??\c:\pddpd.exec:\pddpd.exe87⤵PID:2376
-
\??\c:\llxrlfx.exec:\llxrlfx.exe88⤵PID:1528
-
\??\c:\7httnn.exec:\7httnn.exe89⤵PID:2884
-
\??\c:\dvdpj.exec:\dvdpj.exe90⤵PID:4560
-
\??\c:\1xlfffx.exec:\1xlfffx.exe91⤵PID:4448
-
\??\c:\bbnntb.exec:\bbnntb.exe92⤵PID:2300
-
\??\c:\btbtbt.exec:\btbtbt.exe93⤵PID:2320
-
\??\c:\vdjjv.exec:\vdjjv.exe94⤵PID:1916
-
\??\c:\5lrrxxr.exec:\5lrrxxr.exe95⤵PID:4388
-
\??\c:\lffrfll.exec:\lffrfll.exe96⤵PID:2468
-
\??\c:\tthhnt.exec:\tthhnt.exe97⤵PID:4400
-
\??\c:\jddjd.exec:\jddjd.exe98⤵PID:3220
-
\??\c:\vvdpj.exec:\vvdpj.exe99⤵PID:1372
-
\??\c:\xlrlrrf.exec:\xlrlrrf.exe100⤵PID:1308
-
\??\c:\xxfllxf.exec:\xxfllxf.exe101⤵PID:2940
-
\??\c:\nntttb.exec:\nntttb.exe102⤵PID:3360
-
\??\c:\ddvvv.exec:\ddvvv.exe103⤵PID:2064
-
\??\c:\vpjjj.exec:\vpjjj.exe104⤵PID:2240
-
\??\c:\lflfffx.exec:\lflfffx.exe105⤵PID:2880
-
\??\c:\nhtttb.exec:\nhtttb.exe106⤵PID:2180
-
\??\c:\ntbbbb.exec:\ntbbbb.exe107⤵PID:4884
-
\??\c:\tbnhhn.exec:\tbnhhn.exe108⤵PID:2304
-
\??\c:\9djjj.exec:\9djjj.exe109⤵PID:2520
-
\??\c:\rlxxrxf.exec:\rlxxrxf.exe110⤵PID:3144
-
\??\c:\tbbhhb.exec:\tbbhhb.exe111⤵PID:5016
-
\??\c:\tbntnn.exec:\tbntnn.exe112⤵PID:2952
-
\??\c:\vdjdv.exec:\vdjdv.exe113⤵PID:4276
-
\??\c:\xxxfxxx.exec:\xxxfxxx.exe114⤵PID:1532
-
\??\c:\bthhbh.exec:\bthhbh.exe115⤵PID:4548
-
\??\c:\nnbbtb.exec:\nnbbtb.exe116⤵PID:4860
-
\??\c:\jdpvv.exec:\jdpvv.exe117⤵PID:3152
-
\??\c:\1fffxfr.exec:\1fffxfr.exe118⤵PID:4512
-
\??\c:\tbhhhh.exec:\tbhhhh.exe119⤵PID:1920
-
\??\c:\vvddv.exec:\vvddv.exe120⤵PID:4392
-
\??\c:\ppvpp.exec:\ppvpp.exe121⤵PID:2876
-
\??\c:\lfllllr.exec:\lfllllr.exe122⤵PID:4188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-