Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 06:52
Behavioral task
behavioral1
Sample
b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe
-
Size
226KB
-
MD5
b5db5cb9cceb76898ade3123ac943d40
-
SHA1
8ac29c8be1e49e481afa9843880bdfa53eb0ec38
-
SHA256
c126a63b253799dedfd2c1c67b87ed7b66367df89e34828d01759fefeb8c0485
-
SHA512
d5b623e4198301806e35de7c6d4e1a49b0eca48d02950825638a4790c8f4affa18465536258399a6c9f99ea08ddf40538bb864a0bbd4a375c0f9bdbacac31deb
-
SSDEEP
6144:Jcm4FmowdHoS3dGmS4Z1hraHcpOaKHpaztyzl+SL:T4wFHoS3dJS4ZzeFaKHpCc7
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1020-4-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2960-48-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1564-107-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2472-230-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3904-226-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3668-238-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2980-242-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4016-254-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1524-235-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2828-222-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4176-218-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3144-211-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2604-204-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3400-260-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2172-197-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4732-183-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3464-178-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2064-131-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4184-126-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3016-120-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4100-118-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4828-101-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3076-92-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4108-90-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3032-83-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4228-77-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/548-72-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1908-54-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5076-47-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3996-42-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2164-37-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4804-24-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3372-23-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4656-13-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4660-7-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4660-271-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/468-277-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1396-287-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3660-290-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3096-292-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/952-311-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1788-315-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4396-320-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3556-327-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4680-331-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1160-346-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4920-365-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3716-366-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/408-373-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1384-380-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2180-382-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3924-400-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/908-417-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3668-433-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2724-485-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/548-508-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4028-526-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3736-570-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1396-668-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/812-741-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/768-779-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1912-972-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1508-1104-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3080-1388-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x00090000000233c1-3.dat family_berbew behavioral2/files/0x00080000000233c4-9.dat family_berbew behavioral2/files/0x00070000000233c9-21.dat family_berbew behavioral2/files/0x00070000000233ca-29.dat family_berbew behavioral2/files/0x00070000000233cb-33.dat family_berbew behavioral2/files/0x00070000000233cc-39.dat family_berbew behavioral2/files/0x00070000000233cd-45.dat family_berbew behavioral2/files/0x00070000000233ce-52.dat family_berbew behavioral2/files/0x00070000000233cf-58.dat family_berbew behavioral2/files/0x00070000000233d0-63.dat family_berbew behavioral2/files/0x00070000000233d1-68.dat family_berbew behavioral2/files/0x00070000000233d3-80.dat family_berbew behavioral2/files/0x00070000000233d9-114.dat family_berbew behavioral2/files/0x00070000000233db-127.dat family_berbew behavioral2/files/0x00070000000233dd-139.dat family_berbew behavioral2/files/0x00070000000233df-149.dat family_berbew behavioral2/files/0x00070000000233e3-169.dat family_berbew behavioral2/files/0x00070000000233e5-180.dat family_berbew behavioral2/files/0x00070000000233e4-174.dat family_berbew behavioral2/files/0x00070000000233e2-164.dat family_berbew behavioral2/files/0x00070000000233e1-159.dat family_berbew behavioral2/files/0x00070000000233e0-154.dat family_berbew behavioral2/files/0x00070000000233de-144.dat family_berbew behavioral2/files/0x00070000000233dc-134.dat family_berbew behavioral2/files/0x00070000000233da-122.dat family_berbew behavioral2/files/0x00070000000233d8-110.dat family_berbew behavioral2/files/0x00070000000233d7-104.dat family_berbew behavioral2/files/0x00070000000233d6-98.dat family_berbew behavioral2/files/0x00070000000233d5-94.dat family_berbew behavioral2/files/0x00070000000233d4-86.dat family_berbew behavioral2/files/0x00070000000233d2-74.dat family_berbew behavioral2/files/0x00070000000233c8-16.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 4660 jvvpv.exe 4656 5vdpj.exe 4804 lxlfxxr.exe 3372 3tnhtt.exe 2164 bbhbnh.exe 3996 vjpjj.exe 5076 5vpdp.exe 2960 rrrllfx.exe 1908 fxfxxrr.exe 5048 hhtnbb.exe 548 djjjp.exe 4228 jdpdp.exe 3032 7xfrffx.exe 4108 rlxrllf.exe 3076 1thbnn.exe 4828 nntthh.exe 1564 3pjjd.exe 4100 flrlffx.exe 3016 5rlffxl.exe 4184 bbnhbt.exe 2064 tbtnbt.exe 3828 pjpjd.exe 3500 jpjdd.exe 1160 7fxrlrl.exe 2192 frrllff.exe 4856 thnnhb.exe 1640 htnhhn.exe 3928 vdvdv.exe 1044 dpdvp.exe 3464 fxfxxrl.exe 4732 htnbtn.exe 1384 tbhttn.exe 3216 pjjdv.exe 1272 dvpjd.exe 2172 llrrfrl.exe 5088 1xrlxxl.exe 2604 hbbnhh.exe 4248 nnnnbb.exe 3144 7vpjv.exe 2144 dpdvj.exe 4176 flxlrrf.exe 2828 rxfxlll.exe 3904 bnthhb.exe 2472 jdjdp.exe 1524 vvdvp.exe 3668 5xfxlfx.exe 2980 xrffxxr.exe 2956 nhnhbt.exe 2536 1nnnhh.exe 3636 jdjdp.exe 3192 jpppd.exe 4016 flxlxrx.exe 4560 nhhhtn.exe 3400 3hhbbt.exe 928 7jpjj.exe 4660 9xxlxrl.exe 4544 tbbbtt.exe 468 9ppjd.exe 2884 rxlrlfx.exe 1396 xxrfxrl.exe 3660 hbhhbt.exe 3096 jdppj.exe 2436 fxlffff.exe 448 bthtnh.exe -
resource yara_rule behavioral2/memory/1020-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00090000000233c1-3.dat upx behavioral2/memory/1020-4-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00080000000233c4-9.dat upx behavioral2/files/0x00070000000233c9-21.dat upx behavioral2/files/0x00070000000233ca-29.dat upx behavioral2/files/0x00070000000233cb-33.dat upx behavioral2/files/0x00070000000233cc-39.dat upx behavioral2/files/0x00070000000233cd-45.dat upx behavioral2/memory/2960-48-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00070000000233ce-52.dat upx behavioral2/files/0x00070000000233cf-58.dat upx behavioral2/files/0x00070000000233d0-63.dat upx behavioral2/files/0x00070000000233d1-68.dat upx behavioral2/files/0x00070000000233d3-80.dat upx behavioral2/memory/1564-107-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00070000000233d9-114.dat upx behavioral2/files/0x00070000000233db-127.dat upx behavioral2/files/0x00070000000233dd-139.dat upx behavioral2/files/0x00070000000233df-149.dat upx behavioral2/files/0x00070000000233e3-169.dat upx behavioral2/memory/2472-230-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3904-226-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3668-238-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2980-242-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4016-254-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1524-235-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2828-222-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4176-218-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3144-211-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2604-204-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3400-260-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2172-197-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4732-183-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00070000000233e5-180.dat upx behavioral2/memory/3464-178-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00070000000233e4-174.dat upx behavioral2/files/0x00070000000233e2-164.dat upx behavioral2/files/0x00070000000233e1-159.dat upx behavioral2/files/0x00070000000233e0-154.dat upx behavioral2/files/0x00070000000233de-144.dat upx behavioral2/files/0x00070000000233dc-134.dat upx behavioral2/memory/2064-131-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4184-126-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00070000000233da-122.dat upx behavioral2/memory/3016-120-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4100-118-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00070000000233d8-110.dat upx behavioral2/files/0x00070000000233d7-104.dat upx behavioral2/memory/4828-101-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00070000000233d6-98.dat upx behavioral2/files/0x00070000000233d5-94.dat upx behavioral2/memory/3076-92-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4108-90-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00070000000233d4-86.dat upx behavioral2/memory/3032-83-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4228-77-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00070000000233d2-74.dat upx behavioral2/memory/548-72-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1908-54-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/5076-47-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3996-42-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2164-37-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4804-24-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1020 wrote to memory of 4660 1020 b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe 138 PID 1020 wrote to memory of 4660 1020 b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe 138 PID 1020 wrote to memory of 4660 1020 b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe 138 PID 4660 wrote to memory of 4656 4660 jvvpv.exe 83 PID 4660 wrote to memory of 4656 4660 jvvpv.exe 83 PID 4660 wrote to memory of 4656 4660 jvvpv.exe 83 PID 4656 wrote to memory of 4804 4656 5vdpj.exe 84 PID 4656 wrote to memory of 4804 4656 5vdpj.exe 84 PID 4656 wrote to memory of 4804 4656 5vdpj.exe 84 PID 4804 wrote to memory of 3372 4804 lxlfxxr.exe 85 PID 4804 wrote to memory of 3372 4804 lxlfxxr.exe 85 PID 4804 wrote to memory of 3372 4804 lxlfxxr.exe 85 PID 3372 wrote to memory of 2164 3372 3tnhtt.exe 86 PID 3372 wrote to memory of 2164 3372 3tnhtt.exe 86 PID 3372 wrote to memory of 2164 3372 3tnhtt.exe 86 PID 2164 wrote to memory of 3996 2164 bbhbnh.exe 87 PID 2164 wrote to memory of 3996 2164 bbhbnh.exe 87 PID 2164 wrote to memory of 3996 2164 bbhbnh.exe 87 PID 3996 wrote to memory of 5076 3996 vjpjj.exe 88 PID 3996 wrote to memory of 5076 3996 vjpjj.exe 88 PID 3996 wrote to memory of 5076 3996 vjpjj.exe 88 PID 5076 wrote to memory of 2960 5076 5vpdp.exe 89 PID 5076 wrote to memory of 2960 5076 5vpdp.exe 89 PID 5076 wrote to memory of 2960 5076 5vpdp.exe 89 PID 2960 wrote to memory of 1908 2960 rrrllfx.exe 90 PID 2960 wrote to memory of 1908 2960 rrrllfx.exe 90 PID 2960 wrote to memory of 1908 2960 rrrllfx.exe 90 PID 1908 wrote to memory of 5048 1908 fxfxxrr.exe 91 PID 1908 wrote to memory of 5048 1908 fxfxxrr.exe 91 PID 1908 wrote to memory of 5048 1908 fxfxxrr.exe 91 PID 5048 wrote to memory of 548 5048 hhtnbb.exe 92 PID 5048 wrote to memory of 548 5048 hhtnbb.exe 92 PID 5048 wrote to memory of 548 5048 hhtnbb.exe 92 PID 548 wrote to memory of 4228 548 djjjp.exe 93 PID 548 wrote to memory of 4228 548 djjjp.exe 93 PID 548 wrote to memory of 4228 548 djjjp.exe 93 PID 4228 wrote to memory of 3032 4228 jdpdp.exe 94 PID 4228 wrote to memory of 3032 4228 jdpdp.exe 94 PID 4228 wrote to memory of 3032 4228 jdpdp.exe 94 PID 3032 wrote to memory of 4108 3032 7xfrffx.exe 95 PID 3032 wrote to memory of 4108 3032 7xfrffx.exe 95 PID 3032 wrote to memory of 4108 3032 7xfrffx.exe 95 PID 4108 wrote to memory of 3076 4108 rlxrllf.exe 96 PID 4108 wrote to memory of 3076 4108 rlxrllf.exe 96 PID 4108 wrote to memory of 3076 4108 rlxrllf.exe 96 PID 3076 wrote to memory of 4828 3076 1thbnn.exe 97 PID 3076 wrote to memory of 4828 3076 1thbnn.exe 97 PID 3076 wrote to memory of 4828 3076 1thbnn.exe 97 PID 4828 wrote to memory of 1564 4828 nntthh.exe 98 PID 4828 wrote to memory of 1564 4828 nntthh.exe 98 PID 4828 wrote to memory of 1564 4828 nntthh.exe 98 PID 1564 wrote to memory of 4100 1564 3pjjd.exe 99 PID 1564 wrote to memory of 4100 1564 3pjjd.exe 99 PID 1564 wrote to memory of 4100 1564 3pjjd.exe 99 PID 4100 wrote to memory of 3016 4100 flrlffx.exe 100 PID 4100 wrote to memory of 3016 4100 flrlffx.exe 100 PID 4100 wrote to memory of 3016 4100 flrlffx.exe 100 PID 3016 wrote to memory of 4184 3016 5rlffxl.exe 101 PID 3016 wrote to memory of 4184 3016 5rlffxl.exe 101 PID 3016 wrote to memory of 4184 3016 5rlffxl.exe 101 PID 4184 wrote to memory of 2064 4184 bbnhbt.exe 102 PID 4184 wrote to memory of 2064 4184 bbnhbt.exe 102 PID 4184 wrote to memory of 2064 4184 bbnhbt.exe 102 PID 2064 wrote to memory of 3828 2064 tbtnbt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\jvvpv.exec:\jvvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\5vdpj.exec:\5vdpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\3tnhtt.exec:\3tnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\bbhbnh.exec:\bbhbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\vjpjj.exec:\vjpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\5vpdp.exec:\5vpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\rrrllfx.exec:\rrrllfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\hhtnbb.exec:\hhtnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\djjjp.exec:\djjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\jdpdp.exec:\jdpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\7xfrffx.exec:\7xfrffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\rlxrllf.exec:\rlxrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\1thbnn.exec:\1thbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\nntthh.exec:\nntthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\3pjjd.exec:\3pjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\flrlffx.exec:\flrlffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\5rlffxl.exec:\5rlffxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\bbnhbt.exec:\bbnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\tbtnbt.exec:\tbtnbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\pjpjd.exec:\pjpjd.exe23⤵
- Executes dropped EXE
PID:3828 -
\??\c:\jpjdd.exec:\jpjdd.exe24⤵
- Executes dropped EXE
PID:3500 -
\??\c:\7fxrlrl.exec:\7fxrlrl.exe25⤵
- Executes dropped EXE
PID:1160 -
\??\c:\frrllff.exec:\frrllff.exe26⤵
- Executes dropped EXE
PID:2192 -
\??\c:\thnnhb.exec:\thnnhb.exe27⤵
- Executes dropped EXE
PID:4856 -
\??\c:\htnhhn.exec:\htnhhn.exe28⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vdvdv.exec:\vdvdv.exe29⤵
- Executes dropped EXE
PID:3928 -
\??\c:\dpdvp.exec:\dpdvp.exe30⤵
- Executes dropped EXE
PID:1044 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe31⤵
- Executes dropped EXE
PID:3464 -
\??\c:\htnbtn.exec:\htnbtn.exe32⤵
- Executes dropped EXE
PID:4732 -
\??\c:\tbhttn.exec:\tbhttn.exe33⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pjjdv.exec:\pjjdv.exe34⤵
- Executes dropped EXE
PID:3216 -
\??\c:\dvpjd.exec:\dvpjd.exe35⤵
- Executes dropped EXE
PID:1272 -
\??\c:\llrrfrl.exec:\llrrfrl.exe36⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1xrlxxl.exec:\1xrlxxl.exe37⤵
- Executes dropped EXE
PID:5088 -
\??\c:\hbbnhh.exec:\hbbnhh.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nnnnbb.exec:\nnnnbb.exe39⤵
- Executes dropped EXE
PID:4248 -
\??\c:\7vpjv.exec:\7vpjv.exe40⤵
- Executes dropped EXE
PID:3144 -
\??\c:\dpdvj.exec:\dpdvj.exe41⤵
- Executes dropped EXE
PID:2144 -
\??\c:\flxlrrf.exec:\flxlrrf.exe42⤵
- Executes dropped EXE
PID:4176 -
\??\c:\rxfxlll.exec:\rxfxlll.exe43⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bnthhb.exec:\bnthhb.exe44⤵
- Executes dropped EXE
PID:3904 -
\??\c:\jdjdp.exec:\jdjdp.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vvdvp.exec:\vvdvp.exe46⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5xfxlfx.exec:\5xfxlfx.exe47⤵
- Executes dropped EXE
PID:3668 -
\??\c:\xrffxxr.exec:\xrffxxr.exe48⤵
- Executes dropped EXE
PID:2980 -
\??\c:\nhnhbt.exec:\nhnhbt.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1nnnhh.exec:\1nnnhh.exe50⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jdjdp.exec:\jdjdp.exe51⤵
- Executes dropped EXE
PID:3636 -
\??\c:\jpppd.exec:\jpppd.exe52⤵
- Executes dropped EXE
PID:3192 -
\??\c:\flxlxrx.exec:\flxlxrx.exe53⤵
- Executes dropped EXE
PID:4016 -
\??\c:\nhhhtn.exec:\nhhhtn.exe54⤵
- Executes dropped EXE
PID:4560 -
\??\c:\3hhbbt.exec:\3hhbbt.exe55⤵
- Executes dropped EXE
PID:3400 -
\??\c:\ddpjp.exec:\ddpjp.exe56⤵PID:4332
-
\??\c:\7jpjj.exec:\7jpjj.exe57⤵
- Executes dropped EXE
PID:928 -
\??\c:\9xxlxrl.exec:\9xxlxrl.exe58⤵
- Executes dropped EXE
PID:4660 -
\??\c:\tbbbtt.exec:\tbbbtt.exe59⤵
- Executes dropped EXE
PID:4544 -
\??\c:\9ppjd.exec:\9ppjd.exe60⤵
- Executes dropped EXE
PID:468 -
\??\c:\rxlrlfx.exec:\rxlrlfx.exe61⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xxrfxrl.exec:\xxrfxrl.exe62⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hbhhbt.exec:\hbhhbt.exe63⤵
- Executes dropped EXE
PID:3660 -
\??\c:\jdppj.exec:\jdppj.exe64⤵
- Executes dropped EXE
PID:3096 -
\??\c:\fxlffff.exec:\fxlffff.exe65⤵
- Executes dropped EXE
PID:2436 -
\??\c:\bthtnh.exec:\bthtnh.exe66⤵
- Executes dropped EXE
PID:448 -
\??\c:\bhbhth.exec:\bhbhth.exe67⤵PID:3652
-
\??\c:\9dpjp.exec:\9dpjp.exe68⤵PID:1936
-
\??\c:\rlllffx.exec:\rlllffx.exe69⤵PID:952
-
\??\c:\1nhbtn.exec:\1nhbtn.exe70⤵PID:1788
-
\??\c:\vjjdv.exec:\vjjdv.exe71⤵PID:2040
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe72⤵PID:4396
-
\??\c:\rllfffr.exec:\rllfffr.exe73⤵PID:2524
-
\??\c:\tttbtt.exec:\tttbtt.exe74⤵PID:3556
-
\??\c:\1djdp.exec:\1djdp.exe75⤵PID:4680
-
\??\c:\1jvpj.exec:\1jvpj.exe76⤵PID:3168
-
\??\c:\xxxlxfx.exec:\xxxlxfx.exe77⤵PID:612
-
\??\c:\nhnbnh.exec:\nhnbnh.exe78⤵PID:1952
-
\??\c:\hnttnn.exec:\hnttnn.exe79⤵PID:1832
-
\??\c:\vdvvj.exec:\vdvvj.exe80⤵PID:1160
-
\??\c:\dvpjd.exec:\dvpjd.exe81⤵PID:4852
-
\??\c:\7xlfxxr.exec:\7xlfxxr.exe82⤵PID:2304
-
\??\c:\3nnnnn.exec:\3nnnnn.exe83⤵PID:4420
-
\??\c:\vjjjd.exec:\vjjjd.exe84⤵PID:1928
-
\??\c:\pjjjd.exec:\pjjjd.exe85⤵PID:4920
-
\??\c:\rrxrllf.exec:\rrxrllf.exe86⤵PID:3716
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe87⤵PID:408
-
\??\c:\pjpjd.exec:\pjpjd.exe88⤵PID:3484
-
\??\c:\pjddd.exec:\pjddd.exe89⤵PID:1384
-
\??\c:\vpvvj.exec:\vpvvj.exe90⤵PID:2180
-
\??\c:\lrffffx.exec:\lrffffx.exe91⤵PID:1620
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe92⤵PID:4288
-
\??\c:\3bhbtn.exec:\3bhbtn.exe93⤵PID:3744
-
\??\c:\tnnhbn.exec:\tnnhbn.exe94⤵PID:972
-
\??\c:\jjpjj.exec:\jjpjj.exe95⤵PID:3924
-
\??\c:\dvjdd.exec:\dvjdd.exe96⤵PID:2896
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe97⤵PID:3420
-
\??\c:\5llfxxr.exec:\5llfxxr.exe98⤵PID:2144
-
\??\c:\ddpjj.exec:\ddpjj.exe99⤵PID:3088
-
\??\c:\ntnnht.exec:\ntnnht.exe100⤵PID:908
-
\??\c:\rxxrlff.exec:\rxxrlff.exe101⤵PID:2736
-
\??\c:\hhttbb.exec:\hhttbb.exe102⤵PID:3100
-
\??\c:\ddjdv.exec:\ddjdv.exe103⤵PID:3024
-
\??\c:\jddjd.exec:\jddjd.exe104⤵PID:1764
-
\??\c:\nbbtnb.exec:\nbbtnb.exe105⤵PID:3668
-
\??\c:\5vvdv.exec:\5vvdv.exe106⤵PID:4156
-
\??\c:\vjjjv.exec:\vjjjv.exe107⤵PID:2936
-
\??\c:\rlxrllf.exec:\rlxrllf.exe108⤵PID:1816
-
\??\c:\nhbtnn.exec:\nhbtnn.exe109⤵PID:5092
-
\??\c:\dvjjd.exec:\dvjjd.exe110⤵PID:3992
-
\??\c:\7ppjv.exec:\7ppjv.exe111⤵PID:2340
-
\??\c:\rlrrlfx.exec:\rlrrlfx.exe112⤵PID:4948
-
\??\c:\5hhhhh.exec:\5hhhhh.exe113⤵PID:3192
-
\??\c:\btbttt.exec:\btbttt.exe114⤵PID:1416
-
\??\c:\vdppj.exec:\vdppj.exe115⤵PID:1252
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe116⤵PID:4560
-
\??\c:\vpvpj.exec:\vpvpj.exe117⤵PID:4820
-
\??\c:\lflfxrx.exec:\lflfxrx.exe118⤵PID:3676
-
\??\c:\pjpdp.exec:\pjpdp.exe119⤵PID:1944
-
\??\c:\llxrrrr.exec:\llxrrrr.exe120⤵PID:4804
-
\??\c:\vvdpj.exec:\vvdpj.exe121⤵PID:2724
-
\??\c:\lfrllll.exec:\lfrllll.exe122⤵PID:468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-