Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 19:34
Behavioral task
behavioral1
Sample
f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe
-
Size
253KB
-
MD5
f4d04404ded651cda9dcc5ba42a1d150
-
SHA1
e509b5aec318a2d0b8dc6aabcde5784ba44e315b
-
SHA256
399dc491d2a951480ed0bac618c7922fc4430b162fc288000df974f71c9887b9
-
SHA512
d051106ae534134524285a1b8842c9e2b90c3a199f2587b690dc7e1289463ccb0323954cab1a983789cdc091fe40d960c4690167db13c8c57ec29e776320d2bd
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+THkm:ccm4FmowdHoSi9EIBftapTs4WZazeE1Y
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3104-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4772-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2196-15-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3904-25-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2088-31-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1432-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1180-53-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3512-43-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3200-64-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3328-74-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4736-89-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4576-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4904-96-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2400-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3676-114-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2808-111-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4420-123-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/948-130-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3416-132-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3596-151-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/872-160-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4180-164-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2616-179-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1196-182-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3012-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2784-194-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2524-198-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4804-203-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4392-212-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4300-216-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2196-223-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3040-221-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3232-229-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3252-236-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2088-240-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1012-244-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3368-256-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2900-265-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2716-288-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1316-292-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1260-293-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4264-324-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/212-331-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3456-350-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3656-361-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4300-383-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4064-395-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4360-412-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2084-443-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/884-460-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3180-478-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4444-493-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1312-542-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1436-552-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3060-556-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2892-614-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2236-631-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4316-647-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4316-650-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3608-678-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2024-688-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4124-698-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2516-736-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1568-750-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022f51-6.dat family_berbew behavioral2/files/0x00080000000233fa-10.dat family_berbew behavioral2/files/0x00070000000233fb-17.dat family_berbew behavioral2/files/0x00070000000233fc-22.dat family_berbew behavioral2/files/0x00070000000233fe-28.dat family_berbew behavioral2/files/0x00070000000233ff-34.dat family_berbew behavioral2/files/0x0007000000023401-45.dat family_berbew behavioral2/files/0x0007000000023402-51.dat family_berbew behavioral2/files/0x0007000000023400-41.dat family_berbew behavioral2/files/0x0007000000023403-57.dat family_berbew behavioral2/files/0x0007000000023404-62.dat family_berbew behavioral2/files/0x0007000000023405-68.dat family_berbew behavioral2/files/0x0007000000023406-75.dat family_berbew behavioral2/files/0x0007000000023407-79.dat family_berbew behavioral2/files/0x0007000000023408-86.dat family_berbew behavioral2/files/0x0007000000023409-93.dat family_berbew behavioral2/files/0x000700000002340a-100.dat family_berbew behavioral2/files/0x000700000002340b-105.dat family_berbew behavioral2/files/0x000a0000000233f3-109.dat family_berbew behavioral2/files/0x000700000002340c-116.dat family_berbew behavioral2/files/0x000700000002340e-121.dat family_berbew behavioral2/files/0x000700000002340f-127.dat family_berbew behavioral2/files/0x0007000000023410-135.dat family_berbew behavioral2/files/0x0007000000023411-139.dat family_berbew behavioral2/files/0x0007000000023412-145.dat family_berbew behavioral2/files/0x0007000000023413-149.dat family_berbew behavioral2/files/0x0007000000023414-156.dat family_berbew behavioral2/files/0x0007000000023415-161.dat family_berbew behavioral2/files/0x0007000000023416-168.dat family_berbew behavioral2/files/0x0007000000023417-174.dat family_berbew behavioral2/files/0x0007000000023418-177.dat family_berbew behavioral2/files/0x0007000000023419-184.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 4772 9jpjj.exe 2196 xrlllff.exe 3904 tthbbb.exe 1428 bhnbtn.exe 2088 dppdv.exe 3608 rfffxxr.exe 3512 7btbtt.exe 1432 dvjjd.exe 1180 rlffffr.exe 3200 dpdvp.exe 3552 lxlxrrl.exe 3328 jdvvv.exe 2400 lxxxfrx.exe 4736 jjjdv.exe 4576 3rfxxlr.exe 4904 nnhbbb.exe 4384 jpdvd.exe 2808 lrfffrx.exe 3676 pdjdp.exe 4420 xffffrr.exe 948 3vppp.exe 3416 xxrllll.exe 3112 tbbnhh.exe 2504 nhhnhn.exe 3596 pdjvv.exe 4276 rrrrflf.exe 872 9nnnhb.exe 4180 9pvdv.exe 3456 vpvjp.exe 2616 rlrrrrx.exe 1196 hbntbb.exe 3012 fxxrxff.exe 2784 jjjvv.exe 612 pdjvp.exe 2524 lfxxlll.exe 4804 vdjjd.exe 1776 pvdvv.exe 4392 rrxrllf.exe 4300 tbbthh.exe 3040 9vvdp.exe 2196 1lrlflr.exe 3232 hthttb.exe 4484 jvppj.exe 3252 xllfxrl.exe 2088 hbbbth.exe 1012 pddpd.exe 4172 7xfxrrr.exe 792 fxxlxrf.exe 828 nhnhbh.exe 3368 ddvvp.exe 3692 pdjdv.exe 2900 lfxflll.exe 636 tbtttt.exe 3552 vpvvp.exe 3844 vddvp.exe 4108 5lxxllx.exe 516 nhbntb.exe 696 nhtnhb.exe 2716 vvvpd.exe 1316 xlrrlxx.exe 1260 llxrlll.exe 2044 nhtnht.exe 5008 dddvd.exe 3800 xxrrfll.exe -
resource yara_rule behavioral2/memory/3104-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000022f51-6.dat upx behavioral2/memory/3104-5-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4772-8-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00080000000233fa-10.dat upx behavioral2/memory/3904-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fb-17.dat upx behavioral2/memory/2196-15-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3904-25-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fc-22.dat upx behavioral2/files/0x00070000000233fe-28.dat upx behavioral2/files/0x00070000000233ff-34.dat upx behavioral2/memory/2088-31-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023401-45.dat upx behavioral2/memory/1432-48-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023402-51.dat upx behavioral2/memory/1180-53-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3512-43-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023400-41.dat upx behavioral2/files/0x0007000000023403-57.dat upx behavioral2/files/0x0007000000023404-62.dat upx behavioral2/memory/3200-64-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023405-68.dat upx behavioral2/memory/3328-74-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023406-75.dat upx behavioral2/files/0x0007000000023407-79.dat upx behavioral2/memory/4736-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023408-86.dat upx behavioral2/memory/4736-89-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4576-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023409-93.dat upx behavioral2/memory/4904-96-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340a-100.dat upx behavioral2/memory/2400-84-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340b-105.dat upx behavioral2/files/0x000a0000000233f3-109.dat upx behavioral2/memory/3676-114-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2808-111-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340c-116.dat upx behavioral2/files/0x000700000002340e-121.dat upx behavioral2/memory/4420-123-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340f-127.dat upx behavioral2/memory/948-130-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3416-132-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023410-135.dat upx behavioral2/files/0x0007000000023411-139.dat upx behavioral2/files/0x0007000000023412-145.dat upx behavioral2/memory/3596-151-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023413-149.dat upx behavioral2/files/0x0007000000023414-156.dat upx behavioral2/files/0x0007000000023415-161.dat upx behavioral2/memory/872-160-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4180-164-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023416-168.dat upx behavioral2/files/0x0007000000023417-174.dat upx behavioral2/files/0x0007000000023418-177.dat upx behavioral2/memory/2616-179-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1196-182-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023419-184.dat upx behavioral2/memory/2784-190-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3012-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2784-194-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2524-198-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4804-203-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3104 wrote to memory of 4772 3104 f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe 84 PID 3104 wrote to memory of 4772 3104 f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe 84 PID 3104 wrote to memory of 4772 3104 f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe 84 PID 4772 wrote to memory of 2196 4772 9jpjj.exe 85 PID 4772 wrote to memory of 2196 4772 9jpjj.exe 85 PID 4772 wrote to memory of 2196 4772 9jpjj.exe 85 PID 2196 wrote to memory of 3904 2196 xrlllff.exe 86 PID 2196 wrote to memory of 3904 2196 xrlllff.exe 86 PID 2196 wrote to memory of 3904 2196 xrlllff.exe 86 PID 3904 wrote to memory of 1428 3904 tthbbb.exe 87 PID 3904 wrote to memory of 1428 3904 tthbbb.exe 87 PID 3904 wrote to memory of 1428 3904 tthbbb.exe 87 PID 1428 wrote to memory of 2088 1428 bhnbtn.exe 88 PID 1428 wrote to memory of 2088 1428 bhnbtn.exe 88 PID 1428 wrote to memory of 2088 1428 bhnbtn.exe 88 PID 2088 wrote to memory of 3608 2088 dppdv.exe 89 PID 2088 wrote to memory of 3608 2088 dppdv.exe 89 PID 2088 wrote to memory of 3608 2088 dppdv.exe 89 PID 3608 wrote to memory of 3512 3608 rfffxxr.exe 90 PID 3608 wrote to memory of 3512 3608 rfffxxr.exe 90 PID 3608 wrote to memory of 3512 3608 rfffxxr.exe 90 PID 3512 wrote to memory of 1432 3512 7btbtt.exe 91 PID 3512 wrote to memory of 1432 3512 7btbtt.exe 91 PID 3512 wrote to memory of 1432 3512 7btbtt.exe 91 PID 1432 wrote to memory of 1180 1432 dvjjd.exe 92 PID 1432 wrote to memory of 1180 1432 dvjjd.exe 92 PID 1432 wrote to memory of 1180 1432 dvjjd.exe 92 PID 1180 wrote to memory of 3200 1180 rlffffr.exe 93 PID 1180 wrote to memory of 3200 1180 rlffffr.exe 93 PID 1180 wrote to memory of 3200 1180 rlffffr.exe 93 PID 3200 wrote to memory of 3552 3200 dpdvp.exe 94 PID 3200 wrote to memory of 3552 3200 dpdvp.exe 94 PID 3200 wrote to memory of 3552 3200 dpdvp.exe 94 PID 3552 wrote to memory of 3328 3552 lxlxrrl.exe 95 PID 3552 wrote to memory of 3328 3552 lxlxrrl.exe 95 PID 3552 wrote to memory of 3328 3552 lxlxrrl.exe 95 PID 3328 wrote to memory of 2400 3328 jdvvv.exe 96 PID 3328 wrote to memory of 2400 3328 jdvvv.exe 96 PID 3328 wrote to memory of 2400 3328 jdvvv.exe 96 PID 2400 wrote to memory of 4736 2400 lxxxfrx.exe 97 PID 2400 wrote to memory of 4736 2400 lxxxfrx.exe 97 PID 2400 wrote to memory of 4736 2400 lxxxfrx.exe 97 PID 4736 wrote to memory of 4576 4736 jjjdv.exe 98 PID 4736 wrote to memory of 4576 4736 jjjdv.exe 98 PID 4736 wrote to memory of 4576 4736 jjjdv.exe 98 PID 4576 wrote to memory of 4904 4576 3rfxxlr.exe 99 PID 4576 wrote to memory of 4904 4576 3rfxxlr.exe 99 PID 4576 wrote to memory of 4904 4576 3rfxxlr.exe 99 PID 4904 wrote to memory of 4384 4904 nnhbbb.exe 100 PID 4904 wrote to memory of 4384 4904 nnhbbb.exe 100 PID 4904 wrote to memory of 4384 4904 nnhbbb.exe 100 PID 4384 wrote to memory of 2808 4384 jpdvd.exe 101 PID 4384 wrote to memory of 2808 4384 jpdvd.exe 101 PID 4384 wrote to memory of 2808 4384 jpdvd.exe 101 PID 2808 wrote to memory of 3676 2808 lrfffrx.exe 102 PID 2808 wrote to memory of 3676 2808 lrfffrx.exe 102 PID 2808 wrote to memory of 3676 2808 lrfffrx.exe 102 PID 3676 wrote to memory of 4420 3676 pdjdp.exe 103 PID 3676 wrote to memory of 4420 3676 pdjdp.exe 103 PID 3676 wrote to memory of 4420 3676 pdjdp.exe 103 PID 4420 wrote to memory of 948 4420 xffffrr.exe 104 PID 4420 wrote to memory of 948 4420 xffffrr.exe 104 PID 4420 wrote to memory of 948 4420 xffffrr.exe 104 PID 948 wrote to memory of 3416 948 3vppp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\9jpjj.exec:\9jpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\xrlllff.exec:\xrlllff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\tthbbb.exec:\tthbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\bhnbtn.exec:\bhnbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\dppdv.exec:\dppdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\rfffxxr.exec:\rfffxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\7btbtt.exec:\7btbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\dvjjd.exec:\dvjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\rlffffr.exec:\rlffffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\dpdvp.exec:\dpdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\lxlxrrl.exec:\lxlxrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\jdvvv.exec:\jdvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\lxxxfrx.exec:\lxxxfrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jjjdv.exec:\jjjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\3rfxxlr.exec:\3rfxxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\nnhbbb.exec:\nnhbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\jpdvd.exec:\jpdvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\lrfffrx.exec:\lrfffrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\pdjdp.exec:\pdjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\xffffrr.exec:\xffffrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\3vppp.exec:\3vppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\xxrllll.exec:\xxrllll.exe23⤵
- Executes dropped EXE
PID:3416 -
\??\c:\tbbnhh.exec:\tbbnhh.exe24⤵
- Executes dropped EXE
PID:3112 -
\??\c:\nhhnhn.exec:\nhhnhn.exe25⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pdjvv.exec:\pdjvv.exe26⤵
- Executes dropped EXE
PID:3596 -
\??\c:\rrrrflf.exec:\rrrrflf.exe27⤵
- Executes dropped EXE
PID:4276 -
\??\c:\9nnnhb.exec:\9nnnhb.exe28⤵
- Executes dropped EXE
PID:872 -
\??\c:\9pvdv.exec:\9pvdv.exe29⤵
- Executes dropped EXE
PID:4180 -
\??\c:\vpvjp.exec:\vpvjp.exe30⤵
- Executes dropped EXE
PID:3456 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe31⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hbntbb.exec:\hbntbb.exe32⤵
- Executes dropped EXE
PID:1196 -
\??\c:\fxxrxff.exec:\fxxrxff.exe33⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jjjvv.exec:\jjjvv.exe34⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pdjvp.exec:\pdjvp.exe35⤵
- Executes dropped EXE
PID:612 -
\??\c:\lfxxlll.exec:\lfxxlll.exe36⤵
- Executes dropped EXE
PID:2524 -
\??\c:\vdjjd.exec:\vdjjd.exe37⤵
- Executes dropped EXE
PID:4804 -
\??\c:\pvdvv.exec:\pvdvv.exe38⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rrxrllf.exec:\rrxrllf.exe39⤵
- Executes dropped EXE
PID:4392 -
\??\c:\tbbthh.exec:\tbbthh.exe40⤵
- Executes dropped EXE
PID:4300 -
\??\c:\9vvdp.exec:\9vvdp.exe41⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1lrlflr.exec:\1lrlflr.exe42⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hthttb.exec:\hthttb.exe43⤵
- Executes dropped EXE
PID:3232 -
\??\c:\jvppj.exec:\jvppj.exe44⤵
- Executes dropped EXE
PID:4484 -
\??\c:\xllfxrl.exec:\xllfxrl.exe45⤵
- Executes dropped EXE
PID:3252 -
\??\c:\hbbbth.exec:\hbbbth.exe46⤵
- Executes dropped EXE
PID:2088 -
\??\c:\pddpd.exec:\pddpd.exe47⤵
- Executes dropped EXE
PID:1012 -
\??\c:\7xfxrrr.exec:\7xfxrrr.exe48⤵
- Executes dropped EXE
PID:4172 -
\??\c:\fxxlxrf.exec:\fxxlxrf.exe49⤵
- Executes dropped EXE
PID:792 -
\??\c:\nhnhbh.exec:\nhnhbh.exe50⤵
- Executes dropped EXE
PID:828 -
\??\c:\ddvvp.exec:\ddvvp.exe51⤵
- Executes dropped EXE
PID:3368 -
\??\c:\pdjdv.exec:\pdjdv.exe52⤵
- Executes dropped EXE
PID:3692 -
\??\c:\lfxflll.exec:\lfxflll.exe53⤵
- Executes dropped EXE
PID:2900 -
\??\c:\tbtttt.exec:\tbtttt.exe54⤵
- Executes dropped EXE
PID:636 -
\??\c:\vpvvp.exec:\vpvvp.exe55⤵
- Executes dropped EXE
PID:3552 -
\??\c:\vddvp.exec:\vddvp.exe56⤵
- Executes dropped EXE
PID:3844 -
\??\c:\5lxxllx.exec:\5lxxllx.exe57⤵
- Executes dropped EXE
PID:4108 -
\??\c:\nhbntb.exec:\nhbntb.exe58⤵
- Executes dropped EXE
PID:516 -
\??\c:\nhtnhb.exec:\nhtnhb.exe59⤵
- Executes dropped EXE
PID:696 -
\??\c:\vvvpd.exec:\vvvpd.exe60⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xlrrlxx.exec:\xlrrlxx.exe61⤵
- Executes dropped EXE
PID:1316 -
\??\c:\llxrlll.exec:\llxrlll.exe62⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nhtnht.exec:\nhtnht.exe63⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dddvd.exec:\dddvd.exe64⤵
- Executes dropped EXE
PID:5008 -
\??\c:\xxrrfll.exec:\xxrrfll.exe65⤵
- Executes dropped EXE
PID:3800 -
\??\c:\nhnnhh.exec:\nhnnhh.exe66⤵PID:4648
-
\??\c:\nthhhb.exec:\nthhhb.exe67⤵PID:2944
-
\??\c:\7pvpp.exec:\7pvpp.exe68⤵PID:4272
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe69⤵PID:2516
-
\??\c:\xrfffxr.exec:\xrfffxr.exe70⤵PID:452
-
\??\c:\tnnhnb.exec:\tnnhnb.exe71⤵PID:4264
-
\??\c:\vvdpd.exec:\vvdpd.exe72⤵PID:4348
-
\??\c:\rfrfxxr.exec:\rfrfxxr.exe73⤵PID:212
-
\??\c:\btttbh.exec:\btttbh.exe74⤵PID:2032
-
\??\c:\vvpjd.exec:\vvpjd.exe75⤵PID:3980
-
\??\c:\1rrrfff.exec:\1rrrfff.exe76⤵PID:3032
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe77⤵PID:4180
-
\??\c:\tnntnh.exec:\tnntnh.exe78⤵PID:2980
-
\??\c:\pdvdv.exec:\pdvdv.exe79⤵PID:3456
-
\??\c:\7rlrrxf.exec:\7rlrrxf.exe80⤵PID:2236
-
\??\c:\bbbbhh.exec:\bbbbhh.exe81⤵PID:2988
-
\??\c:\vvddj.exec:\vvddj.exe82⤵PID:4916
-
\??\c:\djjdj.exec:\djjdj.exe83⤵PID:3656
-
\??\c:\xxxrxxl.exec:\xxxrxxl.exe84⤵PID:2508
-
\??\c:\ntbnbh.exec:\ntbnbh.exe85⤵PID:4920
-
\??\c:\thntbn.exec:\thntbn.exe86⤵PID:4052
-
\??\c:\bhtnth.exec:\bhtnth.exe87⤵PID:2436
-
\??\c:\jddvp.exec:\jddvp.exe88⤵PID:2676
-
\??\c:\lfxxfxx.exec:\lfxxfxx.exe89⤵PID:1624
-
\??\c:\nnnnth.exec:\nnnnth.exe90⤵PID:4300
-
\??\c:\pvpjd.exec:\pvpjd.exe91⤵PID:3040
-
\??\c:\7jvdd.exec:\7jvdd.exe92⤵PID:2224
-
\??\c:\xxxrffx.exec:\xxxrffx.exe93⤵PID:4064
-
\??\c:\hnnhbb.exec:\hnnhbb.exe94⤵PID:2132
-
\??\c:\bnbbbb.exec:\bnbbbb.exe95⤵PID:1380
-
\??\c:\vpddv.exec:\vpddv.exe96⤵PID:4652
-
\??\c:\fxxlfxx.exec:\fxxlfxx.exe97⤵PID:2300
-
\??\c:\rxffxxr.exec:\rxffxxr.exe98⤵PID:4360
-
\??\c:\tbhnbb.exec:\tbhnbb.exe99⤵PID:1752
-
\??\c:\vppvp.exec:\vppvp.exe100⤵PID:4724
-
\??\c:\dppdv.exec:\dppdv.exe101⤵PID:4040
-
\??\c:\xfflrxr.exec:\xfflrxr.exe102⤵PID:3376
-
\??\c:\bbhhhn.exec:\bbhhhn.exe103⤵PID:888
-
\??\c:\hbnntb.exec:\hbnntb.exe104⤵PID:3952
-
\??\c:\pjppp.exec:\pjppp.exe105⤵PID:3920
-
\??\c:\ppddd.exec:\ppddd.exe106⤵PID:1688
-
\??\c:\rrrflxx.exec:\rrrflxx.exe107⤵PID:2764
-
\??\c:\nnbbnt.exec:\nnbbnt.exe108⤵PID:2084
-
\??\c:\ddppj.exec:\ddppj.exe109⤵PID:4612
-
\??\c:\1jjjj.exec:\1jjjj.exe110⤵PID:1676
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe111⤵PID:4432
-
\??\c:\rxxlffx.exec:\rxxlffx.exe112⤵PID:3956
-
\??\c:\nnnhbt.exec:\nnnhbt.exe113⤵PID:884
-
\??\c:\vjppj.exec:\vjppj.exe114⤵PID:3984
-
\??\c:\rfrrlll.exec:\rfrrlll.exe115⤵PID:4292
-
\??\c:\rxllllr.exec:\rxllllr.exe116⤵PID:708
-
\??\c:\nhtntn.exec:\nhtntn.exe117⤵PID:3928
-
\??\c:\ddvvp.exec:\ddvvp.exe118⤵PID:2136
-
\??\c:\vdjjd.exec:\vdjjd.exe119⤵PID:3180
-
\??\c:\xlxrrlf.exec:\xlxrrlf.exe120⤵PID:3092
-
\??\c:\1frxrrx.exec:\1frxrrx.exe121⤵PID:60
-
\??\c:\jvvpj.exec:\jvvpj.exe122⤵PID:3488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-