Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 19:41
Behavioral task
behavioral1
Sample
235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe
-
Size
293KB
-
MD5
235507aa5337ec878fa469519003aed0
-
SHA1
224fab2f9646c32b0c81afa3b3b95d4afc211a21
-
SHA256
f04a98632698e49d16c992dd6340521bae2cf7ea38ae67dd8be97fd480d85bdd
-
SHA512
1685155a98920dd76c43bbd7e009c5a63cd062b8fb2f26abc902b386403e8a3535b1d4c93dc915117b2fc80736fd5f361531d11eaca6133274c723d04892023c
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftOH:K4wFHoSQkuUHk1zBR/pMT9XvEhdfw
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3508-5-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1300-14-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1860-12-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/372-25-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3672-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4788-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4080-42-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1528-48-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1552-54-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1272-71-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/208-72-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4892-81-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2608-84-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4460-89-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2068-100-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2972-106-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3596-108-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2516-127-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3204-137-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1780-147-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3748-153-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2140-133-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2612-169-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3156-174-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3600-180-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2556-200-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4488-204-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3516-211-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3008-215-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3372-228-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4788-232-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4080-239-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3152-243-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2932-250-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3928-254-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/400-271-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1444-287-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2064-297-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1416-305-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1192-310-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4828-316-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2288-327-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3424-337-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4400-347-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4172-360-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1108-366-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3008-374-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4064-375-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3812-382-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2316-390-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1184-409-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/8-460-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1088-474-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1124-483-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3404-491-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/224-528-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3492-536-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1688-591-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/732-654-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2608-677-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4988-733-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1000-753-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4964-1053-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4352-1274-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022f51-6.dat family_berbew behavioral2/files/0x000800000002340c-10.dat family_berbew behavioral2/files/0x0007000000023410-13.dat family_berbew behavioral2/files/0x0007000000023411-23.dat family_berbew behavioral2/files/0x0007000000023412-29.dat family_berbew behavioral2/files/0x0007000000023413-34.dat family_berbew behavioral2/files/0x0007000000023414-40.dat family_berbew behavioral2/files/0x0007000000023415-46.dat family_berbew behavioral2/files/0x0007000000023417-53.dat family_berbew behavioral2/files/0x0007000000023418-58.dat family_berbew behavioral2/files/0x0007000000023419-63.dat family_berbew behavioral2/files/0x000700000002341a-69.dat family_berbew behavioral2/files/0x000700000002341b-75.dat family_berbew behavioral2/files/0x000700000002341c-80.dat family_berbew behavioral2/files/0x000700000002341d-86.dat family_berbew behavioral2/files/0x000700000002341e-92.dat family_berbew behavioral2/files/0x000700000002341f-97.dat family_berbew behavioral2/files/0x0007000000023420-103.dat family_berbew behavioral2/files/0x000800000002340d-110.dat family_berbew behavioral2/files/0x0007000000023421-115.dat family_berbew behavioral2/files/0x0007000000023423-122.dat family_berbew behavioral2/files/0x0007000000023424-128.dat family_berbew behavioral2/files/0x0007000000023425-134.dat family_berbew behavioral2/files/0x0007000000023426-139.dat family_berbew behavioral2/files/0x0007000000023427-145.dat family_berbew behavioral2/files/0x0007000000023428-150.dat family_berbew behavioral2/files/0x0007000000023429-156.dat family_berbew behavioral2/files/0x000700000002342a-163.dat family_berbew behavioral2/files/0x000700000002342b-166.dat family_berbew behavioral2/files/0x000700000002342c-175.dat family_berbew behavioral2/files/0x000700000002342e-186.dat family_berbew behavioral2/files/0x000700000002342d-181.dat family_berbew behavioral2/memory/1268-1112-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1860 3vvpp.exe 1300 5hnhbb.exe 3672 thnhbb.exe 372 ddjdd.exe 4788 rllfxrl.exe 3340 tnhtnn.exe 4080 tbthbb.exe 1528 1vvpd.exe 1552 xllfxxr.exe 3328 tnbhbn.exe 1272 jdddv.exe 208 bbnbnn.exe 4892 9vjjd.exe 2608 7xfxrlr.exe 4460 hbnbbb.exe 2068 frfxxxx.exe 2972 hbhhbb.exe 3596 vjpjd.exe 1136 nbtthb.exe 1140 3rxxrrl.exe 2516 dvvvv.exe 2140 lrrrrrl.exe 3204 hbhhhn.exe 5056 vpjdj.exe 1780 llffxxr.exe 3748 nnhhhn.exe 564 ddddd.exe 2612 tbhhhn.exe 3156 pjjdp.exe 3600 bnhbbh.exe 3592 jjjdp.exe 4528 lrxrxrr.exe 3416 thnhbh.exe 2400 jpvpj.exe 4888 1flfxxr.exe 2556 rxrfxlf.exe 4488 nhbnhb.exe 3516 djjdp.exe 3008 rfllllf.exe 1300 3bnnhn.exe 2180 tnnhhn.exe 4656 djpjj.exe 3372 rlrllfr.exe 4788 lrxxrrl.exe 4560 3hhbtt.exe 4080 djppv.exe 3152 1jpdd.exe 4712 xfllllf.exe 2932 ttnhbh.exe 3928 vdjjd.exe 3352 lrlfflf.exe 2088 nhbbtt.exe 4816 jjpjj.exe 4112 5xrlxxr.exe 4472 bhhbtt.exe 400 btnbtt.exe 1268 vpjjd.exe 1028 xrxrlfl.exe 3584 hbbtnn.exe 1444 vpppp.exe 2108 lrfxrrl.exe 2032 xrrrllf.exe 2064 pjvpv.exe 3616 ddpjv.exe -
resource yara_rule behavioral2/memory/3508-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0008000000022f51-6.dat upx behavioral2/memory/3508-5-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000800000002340c-10.dat upx behavioral2/memory/1300-14-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1860-12-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023410-13.dat upx behavioral2/files/0x0007000000023411-23.dat upx behavioral2/memory/372-25-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3672-19-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023412-29.dat upx behavioral2/files/0x0007000000023413-34.dat upx behavioral2/memory/4788-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023414-40.dat upx behavioral2/memory/4080-42-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023415-46.dat upx behavioral2/memory/1528-48-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023417-53.dat upx behavioral2/memory/1552-54-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023418-58.dat upx behavioral2/memory/3328-59-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023419-63.dat upx behavioral2/files/0x000700000002341a-69.dat upx behavioral2/memory/1272-71-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/208-72-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341b-75.dat upx behavioral2/files/0x000700000002341c-80.dat upx behavioral2/memory/4892-81-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2608-84-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341d-86.dat upx behavioral2/memory/4460-89-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341e-92.dat upx behavioral2/files/0x000700000002341f-97.dat upx behavioral2/memory/2068-100-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023420-103.dat upx behavioral2/memory/2972-106-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3596-108-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000800000002340d-110.dat upx behavioral2/files/0x0007000000023421-115.dat upx behavioral2/memory/1140-118-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023423-122.dat upx behavioral2/memory/2516-127-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023424-128.dat upx behavioral2/files/0x0007000000023425-134.dat upx behavioral2/files/0x0007000000023426-139.dat upx behavioral2/memory/3204-137-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023427-145.dat upx behavioral2/memory/1780-147-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023428-150.dat upx behavioral2/memory/3748-153-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2140-133-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023429-156.dat upx behavioral2/memory/564-159-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342a-163.dat upx behavioral2/files/0x000700000002342b-166.dat upx behavioral2/memory/2612-169-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342c-175.dat upx behavioral2/memory/3156-174-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342e-186.dat upx behavioral2/files/0x000700000002342d-181.dat upx behavioral2/memory/3600-180-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2556-200-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4488-204-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3516-211-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3508 wrote to memory of 1860 3508 235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe 82 PID 3508 wrote to memory of 1860 3508 235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe 82 PID 3508 wrote to memory of 1860 3508 235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe 82 PID 1860 wrote to memory of 1300 1860 3vvpp.exe 83 PID 1860 wrote to memory of 1300 1860 3vvpp.exe 83 PID 1860 wrote to memory of 1300 1860 3vvpp.exe 83 PID 1300 wrote to memory of 3672 1300 5hnhbb.exe 84 PID 1300 wrote to memory of 3672 1300 5hnhbb.exe 84 PID 1300 wrote to memory of 3672 1300 5hnhbb.exe 84 PID 3672 wrote to memory of 372 3672 thnhbb.exe 85 PID 3672 wrote to memory of 372 3672 thnhbb.exe 85 PID 3672 wrote to memory of 372 3672 thnhbb.exe 85 PID 372 wrote to memory of 4788 372 ddjdd.exe 86 PID 372 wrote to memory of 4788 372 ddjdd.exe 86 PID 372 wrote to memory of 4788 372 ddjdd.exe 86 PID 4788 wrote to memory of 3340 4788 rllfxrl.exe 87 PID 4788 wrote to memory of 3340 4788 rllfxrl.exe 87 PID 4788 wrote to memory of 3340 4788 rllfxrl.exe 87 PID 3340 wrote to memory of 4080 3340 tnhtnn.exe 88 PID 3340 wrote to memory of 4080 3340 tnhtnn.exe 88 PID 3340 wrote to memory of 4080 3340 tnhtnn.exe 88 PID 4080 wrote to memory of 1528 4080 tbthbb.exe 89 PID 4080 wrote to memory of 1528 4080 tbthbb.exe 89 PID 4080 wrote to memory of 1528 4080 tbthbb.exe 89 PID 1528 wrote to memory of 1552 1528 1vvpd.exe 90 PID 1528 wrote to memory of 1552 1528 1vvpd.exe 90 PID 1528 wrote to memory of 1552 1528 1vvpd.exe 90 PID 1552 wrote to memory of 3328 1552 xllfxxr.exe 91 PID 1552 wrote to memory of 3328 1552 xllfxxr.exe 91 PID 1552 wrote to memory of 3328 1552 xllfxxr.exe 91 PID 3328 wrote to memory of 1272 3328 tnbhbn.exe 93 PID 3328 wrote to memory of 1272 3328 tnbhbn.exe 93 PID 3328 wrote to memory of 1272 3328 tnbhbn.exe 93 PID 1272 wrote to memory of 208 1272 jdddv.exe 94 PID 1272 wrote to memory of 208 1272 jdddv.exe 94 PID 1272 wrote to memory of 208 1272 jdddv.exe 94 PID 208 wrote to memory of 4892 208 bbnbnn.exe 95 PID 208 wrote to memory of 4892 208 bbnbnn.exe 95 PID 208 wrote to memory of 4892 208 bbnbnn.exe 95 PID 4892 wrote to memory of 2608 4892 9vjjd.exe 96 PID 4892 wrote to memory of 2608 4892 9vjjd.exe 96 PID 4892 wrote to memory of 2608 4892 9vjjd.exe 96 PID 2608 wrote to memory of 4460 2608 7xfxrlr.exe 97 PID 2608 wrote to memory of 4460 2608 7xfxrlr.exe 97 PID 2608 wrote to memory of 4460 2608 7xfxrlr.exe 97 PID 4460 wrote to memory of 2068 4460 hbnbbb.exe 98 PID 4460 wrote to memory of 2068 4460 hbnbbb.exe 98 PID 4460 wrote to memory of 2068 4460 hbnbbb.exe 98 PID 2068 wrote to memory of 2972 2068 frfxxxx.exe 99 PID 2068 wrote to memory of 2972 2068 frfxxxx.exe 99 PID 2068 wrote to memory of 2972 2068 frfxxxx.exe 99 PID 2972 wrote to memory of 3596 2972 hbhhbb.exe 100 PID 2972 wrote to memory of 3596 2972 hbhhbb.exe 100 PID 2972 wrote to memory of 3596 2972 hbhhbb.exe 100 PID 3596 wrote to memory of 1136 3596 vjpjd.exe 101 PID 3596 wrote to memory of 1136 3596 vjpjd.exe 101 PID 3596 wrote to memory of 1136 3596 vjpjd.exe 101 PID 1136 wrote to memory of 1140 1136 nbtthb.exe 103 PID 1136 wrote to memory of 1140 1136 nbtthb.exe 103 PID 1136 wrote to memory of 1140 1136 nbtthb.exe 103 PID 1140 wrote to memory of 2516 1140 3rxxrrl.exe 104 PID 1140 wrote to memory of 2516 1140 3rxxrrl.exe 104 PID 1140 wrote to memory of 2516 1140 3rxxrrl.exe 104 PID 2516 wrote to memory of 2140 2516 dvvvv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\3vvpp.exec:\3vvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\5hnhbb.exec:\5hnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\thnhbb.exec:\thnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\ddjdd.exec:\ddjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\rllfxrl.exec:\rllfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\tnhtnn.exec:\tnhtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\tbthbb.exec:\tbthbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\1vvpd.exec:\1vvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\xllfxxr.exec:\xllfxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\tnbhbn.exec:\tnbhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\jdddv.exec:\jdddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\bbnbnn.exec:\bbnbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\9vjjd.exec:\9vjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\7xfxrlr.exec:\7xfxrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hbnbbb.exec:\hbnbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\frfxxxx.exec:\frfxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\hbhhbb.exec:\hbhhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vjpjd.exec:\vjpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\nbtthb.exec:\nbtthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\3rxxrrl.exec:\3rxxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\dvvvv.exec:\dvvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\lrrrrrl.exec:\lrrrrrl.exe23⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hbhhhn.exec:\hbhhhn.exe24⤵
- Executes dropped EXE
PID:3204 -
\??\c:\vpjdj.exec:\vpjdj.exe25⤵
- Executes dropped EXE
PID:5056 -
\??\c:\llffxxr.exec:\llffxxr.exe26⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nnhhhn.exec:\nnhhhn.exe27⤵
- Executes dropped EXE
PID:3748 -
\??\c:\ddddd.exec:\ddddd.exe28⤵
- Executes dropped EXE
PID:564 -
\??\c:\tbhhhn.exec:\tbhhhn.exe29⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pjjdp.exec:\pjjdp.exe30⤵
- Executes dropped EXE
PID:3156 -
\??\c:\bnhbbh.exec:\bnhbbh.exe31⤵
- Executes dropped EXE
PID:3600 -
\??\c:\jjjdp.exec:\jjjdp.exe32⤵
- Executes dropped EXE
PID:3592 -
\??\c:\lrxrxrr.exec:\lrxrxrr.exe33⤵
- Executes dropped EXE
PID:4528 -
\??\c:\thnhbh.exec:\thnhbh.exe34⤵
- Executes dropped EXE
PID:3416 -
\??\c:\jpvpj.exec:\jpvpj.exe35⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1flfxxr.exec:\1flfxxr.exe36⤵
- Executes dropped EXE
PID:4888 -
\??\c:\rxrfxlf.exec:\rxrfxlf.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nhbnhb.exec:\nhbnhb.exe38⤵
- Executes dropped EXE
PID:4488 -
\??\c:\djjdp.exec:\djjdp.exe39⤵
- Executes dropped EXE
PID:3516 -
\??\c:\rfllllf.exec:\rfllllf.exe40⤵
- Executes dropped EXE
PID:3008 -
\??\c:\3bnnhn.exec:\3bnnhn.exe41⤵
- Executes dropped EXE
PID:1300 -
\??\c:\tnnhhn.exec:\tnnhhn.exe42⤵
- Executes dropped EXE
PID:2180 -
\??\c:\djpjj.exec:\djpjj.exe43⤵
- Executes dropped EXE
PID:4656 -
\??\c:\rlrllfr.exec:\rlrllfr.exe44⤵
- Executes dropped EXE
PID:3372 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe45⤵
- Executes dropped EXE
PID:4788 -
\??\c:\3hhbtt.exec:\3hhbtt.exe46⤵
- Executes dropped EXE
PID:4560 -
\??\c:\djppv.exec:\djppv.exe47⤵
- Executes dropped EXE
PID:4080 -
\??\c:\1jpdd.exec:\1jpdd.exe48⤵
- Executes dropped EXE
PID:3152 -
\??\c:\xfllllf.exec:\xfllllf.exe49⤵
- Executes dropped EXE
PID:4712 -
\??\c:\ttnhbh.exec:\ttnhbh.exe50⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vdjjd.exec:\vdjjd.exe51⤵
- Executes dropped EXE
PID:3928 -
\??\c:\lrlfflf.exec:\lrlfflf.exe52⤵
- Executes dropped EXE
PID:3352 -
\??\c:\nhbbtt.exec:\nhbbtt.exe53⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jjpjj.exec:\jjpjj.exe54⤵
- Executes dropped EXE
PID:4816 -
\??\c:\5xrlxxr.exec:\5xrlxxr.exe55⤵
- Executes dropped EXE
PID:4112 -
\??\c:\bhhbtt.exec:\bhhbtt.exe56⤵
- Executes dropped EXE
PID:4472 -
\??\c:\btnbtt.exec:\btnbtt.exe57⤵
- Executes dropped EXE
PID:400 -
\??\c:\vpjjd.exec:\vpjjd.exe58⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xrxrlfl.exec:\xrxrlfl.exe59⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hbbtnn.exec:\hbbtnn.exe60⤵
- Executes dropped EXE
PID:3584 -
\??\c:\vpppp.exec:\vpppp.exe61⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xrrrllf.exec:\xrrrllf.exe63⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pjvpv.exec:\pjvpv.exe64⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ddpjv.exec:\ddpjv.exe65⤵
- Executes dropped EXE
PID:3616 -
\??\c:\rrxrllf.exec:\rrxrllf.exe66⤵PID:1416
-
\??\c:\thbbbb.exec:\thbbbb.exe67⤵PID:1304
-
\??\c:\jvvdp.exec:\jvvdp.exe68⤵PID:1192
-
\??\c:\xlxlfxf.exec:\xlxlfxf.exe69⤵PID:4828
-
\??\c:\hnbtnh.exec:\hnbtnh.exe70⤵PID:1996
-
\??\c:\1jjdv.exec:\1jjdv.exe71⤵PID:2080
-
\??\c:\3vvdd.exec:\3vvdd.exe72⤵PID:1456
-
\??\c:\xlxxxfl.exec:\xlxxxfl.exe73⤵PID:2288
-
\??\c:\hhttbb.exec:\hhttbb.exe74⤵PID:4344
-
\??\c:\jvdvp.exec:\jvdvp.exe75⤵PID:564
-
\??\c:\ddppp.exec:\ddppp.exe76⤵PID:3424
-
\??\c:\ffxxfxr.exec:\ffxxfxr.exe77⤵PID:1420
-
\??\c:\hhtnht.exec:\hhtnht.exe78⤵PID:4400
-
\??\c:\7nhbbb.exec:\7nhbbb.exe79⤵PID:556
-
\??\c:\vdpjd.exec:\vdpjd.exe80⤵PID:3236
-
\??\c:\flrlxxr.exec:\flrlxxr.exe81⤵PID:924
-
\??\c:\hbnhbb.exec:\hbnhbb.exe82⤵PID:2560
-
\??\c:\hbhbtt.exec:\hbhbtt.exe83⤵PID:4172
-
\??\c:\1vvvd.exec:\1vvvd.exe84⤵PID:1108
-
\??\c:\9xxrfxr.exec:\9xxrfxr.exe85⤵PID:3212
-
\??\c:\bnthtb.exec:\bnthtb.exe86⤵PID:3008
-
\??\c:\tnnhbt.exec:\tnnhbt.exe87⤵PID:4064
-
\??\c:\5jvpj.exec:\5jvpj.exe88⤵PID:3812
-
\??\c:\xrffxfr.exec:\xrffxfr.exe89⤵PID:2300
-
\??\c:\rflxrll.exec:\rflxrll.exe90⤵PID:2316
-
\??\c:\nthbbb.exec:\nthbbb.exe91⤵PID:5052
-
\??\c:\vpjdp.exec:\vpjdp.exe92⤵PID:4964
-
\??\c:\jdpjj.exec:\jdpjj.exe93⤵PID:3868
-
\??\c:\rffxrll.exec:\rffxrll.exe94⤵PID:3552
-
\??\c:\3xfxrrr.exec:\3xfxrrr.exe95⤵PID:3684
-
\??\c:\7thtnb.exec:\7thtnb.exe96⤵PID:1184
-
\??\c:\7rrlllf.exec:\7rrlllf.exe97⤵PID:4024
-
\??\c:\ttbtnn.exec:\ttbtnn.exe98⤵PID:1580
-
\??\c:\1hhbbb.exec:\1hhbbb.exe99⤵PID:4816
-
\??\c:\9ddvd.exec:\9ddvd.exe100⤵PID:1532
-
\??\c:\7ddvp.exec:\7ddvp.exe101⤵PID:400
-
\??\c:\rxfxllf.exec:\rxfxllf.exe102⤵PID:3676
-
\??\c:\tnhtnb.exec:\tnhtnb.exe103⤵PID:2652
-
\??\c:\nnnnhb.exec:\nnnnhb.exe104⤵PID:2108
-
\??\c:\jvvpj.exec:\jvvpj.exe105⤵PID:4908
-
\??\c:\dpvvj.exec:\dpvvj.exe106⤵PID:2600
-
\??\c:\xxffrrx.exec:\xxffrrx.exe107⤵PID:4316
-
\??\c:\thnhbh.exec:\thnhbh.exe108⤵PID:1416
-
\??\c:\5btnhn.exec:\5btnhn.exe109⤵PID:4796
-
\??\c:\3vvjd.exec:\3vvjd.exe110⤵PID:3984
-
\??\c:\tbnnht.exec:\tbnnht.exe111⤵PID:2004
-
\??\c:\nnnhtt.exec:\nnnhtt.exe112⤵PID:8
-
\??\c:\vddvj.exec:\vddvj.exe113⤵PID:4396
-
\??\c:\xxxxxxl.exec:\xxxxxxl.exe114⤵PID:920
-
\??\c:\1xxrllr.exec:\1xxrllr.exe115⤵PID:5008
-
\??\c:\nntbhn.exec:\nntbhn.exe116⤵PID:956
-
\??\c:\3vdvj.exec:\3vdvj.exe117⤵PID:1088
-
\??\c:\vdvjv.exec:\vdvjv.exe118⤵PID:2236
-
\??\c:\bhhnhn.exec:\bhhnhn.exe119⤵PID:1124
-
\??\c:\pvpjj.exec:\pvpjj.exe120⤵PID:3160
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe121⤵PID:3404
-
\??\c:\5pjdp.exec:\5pjdp.exe122⤵PID:1800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-