Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 21:54
Behavioral task
behavioral1
Sample
69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe
-
Size
251KB
-
MD5
69d9be638f02536a48e42f4d1ef28960
-
SHA1
f962f39ce5e07410b9c255290b4f408e67829f51
-
SHA256
f9f19f07a5996f19be240df6c403f571898a2cdb9b2d379dd8d0966694b233c9
-
SHA512
e4302773a46cc376a12b8a397c7263cfdc5164c186c826133f1c8c08e9364a25eded2e0b293e6ee7efbc85a4f620dbe90ea1d183a628e44d7e3a55b93ca6c9a9
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+H:ccm4FmowdHoSi9EIBftapTs4WZazY
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/60-0-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1564-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3108-18-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4408-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4540-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3692-41-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2240-44-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1056-35-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4448-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1028-60-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3972-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1792-77-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2104-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3964-91-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/972-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4856-98-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4404-104-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/408-116-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3240-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3216-135-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3248-154-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2696-168-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4752-173-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2260-185-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2368-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4556-193-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1012-197-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4048-207-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4208-219-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3520-218-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3084-222-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2056-229-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2484-231-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1056-238-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2624-242-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1624-248-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2204-251-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2036-257-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3404-267-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3224-275-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1392-288-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1608-298-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4728-305-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4436-309-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/332-329-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1280-338-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1080-342-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3048-346-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2648-368-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/644-379-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2404-395-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4552-417-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1448-424-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1292-447-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2396-455-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/512-470-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4436-579-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5100-597-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2260-619-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3748-728-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2332-770-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3732-839-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2768-852-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3664-1065-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022f51-3.dat family_berbew behavioral2/files/0x00070000000233ec-11.dat family_berbew behavioral2/files/0x00070000000233ed-12.dat family_berbew behavioral2/files/0x00070000000233ee-21.dat family_berbew behavioral2/files/0x00070000000233ef-29.dat family_berbew behavioral2/files/0x00070000000233f0-33.dat family_berbew behavioral2/files/0x00070000000233f1-42.dat family_berbew behavioral2/files/0x00070000000233f2-46.dat family_berbew behavioral2/files/0x00070000000233f3-51.dat family_berbew behavioral2/files/0x00070000000233f4-61.dat family_berbew behavioral2/files/0x00070000000233f5-64.dat family_berbew behavioral2/files/0x00070000000233f6-70.dat family_berbew behavioral2/files/0x00070000000233f7-76.dat family_berbew behavioral2/files/0x00070000000233f8-82.dat family_berbew behavioral2/files/0x00070000000233f9-88.dat family_berbew behavioral2/files/0x00070000000233fa-94.dat family_berbew behavioral2/files/0x00070000000233fb-102.dat family_berbew behavioral2/files/0x00080000000233e9-107.dat family_berbew behavioral2/files/0x00070000000233fd-112.dat family_berbew behavioral2/files/0x00070000000233fe-119.dat family_berbew behavioral2/files/0x00070000000233ff-124.dat family_berbew behavioral2/files/0x0007000000023400-130.dat family_berbew behavioral2/files/0x0007000000023401-136.dat family_berbew behavioral2/files/0x0007000000023402-141.dat family_berbew behavioral2/files/0x0007000000023403-146.dat family_berbew behavioral2/files/0x0007000000023404-150.dat family_berbew behavioral2/files/0x0007000000023405-156.dat family_berbew behavioral2/files/0x0007000000023406-161.dat family_berbew behavioral2/files/0x0007000000023407-166.dat family_berbew behavioral2/files/0x0007000000023408-174.dat family_berbew behavioral2/files/0x0007000000023409-180.dat family_berbew behavioral2/files/0x000700000002340a-183.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1564 bbthth.exe 4408 7pdjp.exe 3108 rxflfll.exe 4540 hhbnbn.exe 1056 bntnhb.exe 3692 xfrlllr.exe 2240 nhhnhb.exe 4448 ppjvp.exe 1028 httnhh.exe 3972 lllrrll.exe 3724 1bhbbb.exe 1792 lflrrlr.exe 2104 thbhhh.exe 3964 5ppvj.exe 4856 1rfllrr.exe 972 ttbbtb.exe 4404 pddpj.exe 1608 lflrfrr.exe 408 lxfxlll.exe 3240 nhbhbh.exe 3196 9vjvj.exe 3216 htbhbb.exe 4284 xfllrfx.exe 4152 hhhthb.exe 3800 xxrxxrl.exe 3248 btbhhh.exe 3764 pvjdd.exe 2696 fxxllrr.exe 4752 llrrflx.exe 1500 dpppp.exe 2260 fxrfxrl.exe 2368 thtnhb.exe 4556 dvpdv.exe 1012 fxlffrx.exe 2648 3hthbt.exe 4512 pdjjd.exe 4048 lrrrrxr.exe 1312 hnhbnh.exe 4420 tntnhb.exe 3520 ddjdd.exe 4208 fxrxxll.exe 3084 lfxrlrr.exe 2056 bnbnnn.exe 2484 9vjpj.exe 1056 rxrxlxl.exe 2624 hhnbbb.exe 2404 nhnbtb.exe 1624 rxrlfxr.exe 2204 xxfrfxl.exe 2036 hbnhhb.exe 3576 lllfrrl.exe 2992 bbtbnh.exe 3404 dvjjd.exe 2028 hhbhhb.exe 5052 vdjjd.exe 3224 3ppjj.exe 1448 lfxrfll.exe 5068 nbhntb.exe 1392 pjjdd.exe 2536 lflrrxf.exe 408 tthnnn.exe 1608 hhttht.exe 2764 vpjjj.exe 4728 1flllrr.exe -
resource yara_rule behavioral2/memory/60-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/1564-8-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233ec-11.dat upx behavioral2/files/0x00070000000233ed-12.dat upx behavioral2/memory/3108-18-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233ee-21.dat upx behavioral2/memory/4540-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4408-13-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4540-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233ef-29.dat upx behavioral2/files/0x00070000000233f0-33.dat upx behavioral2/memory/3692-41-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f1-42.dat upx behavioral2/memory/2240-44-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1056-35-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f2-46.dat upx behavioral2/files/0x00070000000233f3-51.dat upx behavioral2/memory/4448-54-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1028-55-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1028-60-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f4-61.dat upx behavioral2/files/0x00070000000233f5-64.dat upx behavioral2/memory/3972-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f6-70.dat upx behavioral2/memory/1792-73-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1792-77-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f7-76.dat upx behavioral2/files/0x00070000000233f8-82.dat upx behavioral2/memory/2104-84-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3964-85-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f9-88.dat upx behavioral2/memory/3964-91-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fa-94.dat upx behavioral2/memory/972-99-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4856-98-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4404-104-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fb-102.dat upx behavioral2/files/0x00080000000233e9-107.dat upx behavioral2/files/0x00070000000233fd-112.dat upx behavioral2/memory/408-116-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fe-119.dat upx behavioral2/memory/3240-122-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233ff-124.dat upx behavioral2/files/0x0007000000023400-130.dat upx behavioral2/files/0x0007000000023401-136.dat upx behavioral2/memory/3216-135-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023402-141.dat upx behavioral2/files/0x0007000000023403-146.dat upx behavioral2/files/0x0007000000023404-150.dat upx behavioral2/memory/3248-154-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023405-156.dat upx behavioral2/files/0x0007000000023406-161.dat upx behavioral2/files/0x0007000000023407-166.dat upx behavioral2/memory/2696-168-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4752-173-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023408-174.dat upx behavioral2/files/0x0007000000023409-180.dat upx behavioral2/files/0x000700000002340a-183.dat upx behavioral2/memory/2260-185-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2368-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4556-193-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1012-197-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4048-207-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 60 wrote to memory of 1564 60 69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe 83 PID 60 wrote to memory of 1564 60 69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe 83 PID 60 wrote to memory of 1564 60 69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe 83 PID 1564 wrote to memory of 4408 1564 bbthth.exe 84 PID 1564 wrote to memory of 4408 1564 bbthth.exe 84 PID 1564 wrote to memory of 4408 1564 bbthth.exe 84 PID 4408 wrote to memory of 3108 4408 7pdjp.exe 85 PID 4408 wrote to memory of 3108 4408 7pdjp.exe 85 PID 4408 wrote to memory of 3108 4408 7pdjp.exe 85 PID 3108 wrote to memory of 4540 3108 rxflfll.exe 86 PID 3108 wrote to memory of 4540 3108 rxflfll.exe 86 PID 3108 wrote to memory of 4540 3108 rxflfll.exe 86 PID 4540 wrote to memory of 1056 4540 hhbnbn.exe 87 PID 4540 wrote to memory of 1056 4540 hhbnbn.exe 87 PID 4540 wrote to memory of 1056 4540 hhbnbn.exe 87 PID 1056 wrote to memory of 3692 1056 bntnhb.exe 88 PID 1056 wrote to memory of 3692 1056 bntnhb.exe 88 PID 1056 wrote to memory of 3692 1056 bntnhb.exe 88 PID 3692 wrote to memory of 2240 3692 xfrlllr.exe 89 PID 3692 wrote to memory of 2240 3692 xfrlllr.exe 89 PID 3692 wrote to memory of 2240 3692 xfrlllr.exe 89 PID 2240 wrote to memory of 4448 2240 nhhnhb.exe 90 PID 2240 wrote to memory of 4448 2240 nhhnhb.exe 90 PID 2240 wrote to memory of 4448 2240 nhhnhb.exe 90 PID 4448 wrote to memory of 1028 4448 ppjvp.exe 91 PID 4448 wrote to memory of 1028 4448 ppjvp.exe 91 PID 4448 wrote to memory of 1028 4448 ppjvp.exe 91 PID 1028 wrote to memory of 3972 1028 httnhh.exe 92 PID 1028 wrote to memory of 3972 1028 httnhh.exe 92 PID 1028 wrote to memory of 3972 1028 httnhh.exe 92 PID 3972 wrote to memory of 3724 3972 lllrrll.exe 93 PID 3972 wrote to memory of 3724 3972 lllrrll.exe 93 PID 3972 wrote to memory of 3724 3972 lllrrll.exe 93 PID 3724 wrote to memory of 1792 3724 1bhbbb.exe 94 PID 3724 wrote to memory of 1792 3724 1bhbbb.exe 94 PID 3724 wrote to memory of 1792 3724 1bhbbb.exe 94 PID 1792 wrote to memory of 2104 1792 lflrrlr.exe 96 PID 1792 wrote to memory of 2104 1792 lflrrlr.exe 96 PID 1792 wrote to memory of 2104 1792 lflrrlr.exe 96 PID 2104 wrote to memory of 3964 2104 thbhhh.exe 97 PID 2104 wrote to memory of 3964 2104 thbhhh.exe 97 PID 2104 wrote to memory of 3964 2104 thbhhh.exe 97 PID 3964 wrote to memory of 4856 3964 5ppvj.exe 98 PID 3964 wrote to memory of 4856 3964 5ppvj.exe 98 PID 3964 wrote to memory of 4856 3964 5ppvj.exe 98 PID 4856 wrote to memory of 972 4856 1rfllrr.exe 99 PID 4856 wrote to memory of 972 4856 1rfllrr.exe 99 PID 4856 wrote to memory of 972 4856 1rfllrr.exe 99 PID 972 wrote to memory of 4404 972 ttbbtb.exe 100 PID 972 wrote to memory of 4404 972 ttbbtb.exe 100 PID 972 wrote to memory of 4404 972 ttbbtb.exe 100 PID 4404 wrote to memory of 1608 4404 pddpj.exe 101 PID 4404 wrote to memory of 1608 4404 pddpj.exe 101 PID 4404 wrote to memory of 1608 4404 pddpj.exe 101 PID 1608 wrote to memory of 408 1608 lflrfrr.exe 102 PID 1608 wrote to memory of 408 1608 lflrfrr.exe 102 PID 1608 wrote to memory of 408 1608 lflrfrr.exe 102 PID 408 wrote to memory of 3240 408 lxfxlll.exe 103 PID 408 wrote to memory of 3240 408 lxfxlll.exe 103 PID 408 wrote to memory of 3240 408 lxfxlll.exe 103 PID 3240 wrote to memory of 3196 3240 nhbhbh.exe 104 PID 3240 wrote to memory of 3196 3240 nhbhbh.exe 104 PID 3240 wrote to memory of 3196 3240 nhbhbh.exe 104 PID 3196 wrote to memory of 3216 3196 9vjvj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\bbthth.exec:\bbthth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\7pdjp.exec:\7pdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\rxflfll.exec:\rxflfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\hhbnbn.exec:\hhbnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\bntnhb.exec:\bntnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\xfrlllr.exec:\xfrlllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\nhhnhb.exec:\nhhnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\ppjvp.exec:\ppjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\httnhh.exec:\httnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\lllrrll.exec:\lllrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\1bhbbb.exec:\1bhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\lflrrlr.exec:\lflrrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\thbhhh.exec:\thbhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\5ppvj.exec:\5ppvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\1rfllrr.exec:\1rfllrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\ttbbtb.exec:\ttbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\pddpj.exec:\pddpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\lflrfrr.exec:\lflrfrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\lxfxlll.exec:\lxfxlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\nhbhbh.exec:\nhbhbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\9vjvj.exec:\9vjvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\htbhbb.exec:\htbhbb.exe23⤵
- Executes dropped EXE
PID:3216 -
\??\c:\xfllrfx.exec:\xfllrfx.exe24⤵
- Executes dropped EXE
PID:4284 -
\??\c:\hhhthb.exec:\hhhthb.exe25⤵
- Executes dropped EXE
PID:4152 -
\??\c:\xxrxxrl.exec:\xxrxxrl.exe26⤵
- Executes dropped EXE
PID:3800 -
\??\c:\btbhhh.exec:\btbhhh.exe27⤵
- Executes dropped EXE
PID:3248 -
\??\c:\pvjdd.exec:\pvjdd.exe28⤵
- Executes dropped EXE
PID:3764 -
\??\c:\fxxllrr.exec:\fxxllrr.exe29⤵
- Executes dropped EXE
PID:2696 -
\??\c:\llrrflx.exec:\llrrflx.exe30⤵
- Executes dropped EXE
PID:4752 -
\??\c:\dpppp.exec:\dpppp.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe32⤵
- Executes dropped EXE
PID:2260 -
\??\c:\thtnhb.exec:\thtnhb.exe33⤵
- Executes dropped EXE
PID:2368 -
\??\c:\dvpdv.exec:\dvpdv.exe34⤵
- Executes dropped EXE
PID:4556 -
\??\c:\fxlffrx.exec:\fxlffrx.exe35⤵
- Executes dropped EXE
PID:1012 -
\??\c:\3hthbt.exec:\3hthbt.exe36⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pdjjd.exec:\pdjjd.exe37⤵
- Executes dropped EXE
PID:4512 -
\??\c:\lrrrrxr.exec:\lrrrrxr.exe38⤵
- Executes dropped EXE
PID:4048 -
\??\c:\hnhbnh.exec:\hnhbnh.exe39⤵
- Executes dropped EXE
PID:1312 -
\??\c:\tntnhb.exec:\tntnhb.exe40⤵
- Executes dropped EXE
PID:4420 -
\??\c:\ddjdd.exec:\ddjdd.exe41⤵
- Executes dropped EXE
PID:3520 -
\??\c:\fxrxxll.exec:\fxrxxll.exe42⤵
- Executes dropped EXE
PID:4208 -
\??\c:\lfxrlrr.exec:\lfxrlrr.exe43⤵
- Executes dropped EXE
PID:3084 -
\??\c:\bnbnnn.exec:\bnbnnn.exe44⤵
- Executes dropped EXE
PID:2056 -
\??\c:\9vjpj.exec:\9vjpj.exe45⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rxrxlxl.exec:\rxrxlxl.exe46⤵
- Executes dropped EXE
PID:1056 -
\??\c:\hhnbbb.exec:\hhnbbb.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nhnbtb.exec:\nhnbtb.exe48⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe49⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xxfrfxl.exec:\xxfrfxl.exe50⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hbnhhb.exec:\hbnhhb.exe51⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lllfrrl.exec:\lllfrrl.exe52⤵
- Executes dropped EXE
PID:3576 -
\??\c:\bbtbnh.exec:\bbtbnh.exe53⤵
- Executes dropped EXE
PID:2992 -
\??\c:\dvjjd.exec:\dvjjd.exe54⤵
- Executes dropped EXE
PID:3404 -
\??\c:\hhbhhb.exec:\hhbhhb.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vdjjd.exec:\vdjjd.exe56⤵
- Executes dropped EXE
PID:5052 -
\??\c:\3ppjj.exec:\3ppjj.exe57⤵
- Executes dropped EXE
PID:3224 -
\??\c:\lfxrfll.exec:\lfxrfll.exe58⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nbhntb.exec:\nbhntb.exe59⤵
- Executes dropped EXE
PID:5068 -
\??\c:\pjjdd.exec:\pjjdd.exe60⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lflrrxf.exec:\lflrrxf.exe61⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tthnnn.exec:\tthnnn.exe62⤵
- Executes dropped EXE
PID:408 -
\??\c:\hhttht.exec:\hhttht.exe63⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vpjjj.exec:\vpjjj.exe64⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1flllrr.exec:\1flllrr.exe65⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nbnhhn.exec:\nbnhhn.exe66⤵PID:4436
-
\??\c:\jvppp.exec:\jvppp.exe67⤵PID:2896
-
\??\c:\1xfxxfl.exec:\1xfxxfl.exe68⤵PID:532
-
\??\c:\lrrrfll.exec:\lrrrfll.exe69⤵PID:4152
-
\??\c:\hhtbbn.exec:\hhtbbn.exe70⤵PID:4712
-
\??\c:\nnbbbh.exec:\nnbbbh.exe71⤵PID:1844
-
\??\c:\djvdj.exec:\djvdj.exe72⤵PID:3248
-
\??\c:\xxrffff.exec:\xxrffff.exe73⤵PID:332
-
\??\c:\fxffrxx.exec:\fxffrxx.exe74⤵PID:3448
-
\??\c:\nthhtb.exec:\nthhtb.exe75⤵PID:1280
-
\??\c:\jpvvv.exec:\jpvvv.exe76⤵PID:1080
-
\??\c:\thbhhn.exec:\thbhhn.exe77⤵PID:3048
-
\??\c:\1dddj.exec:\1dddj.exe78⤵PID:968
-
\??\c:\vvdvj.exec:\vvdvj.exe79⤵PID:1984
-
\??\c:\lfxxflx.exec:\lfxxflx.exe80⤵PID:4460
-
\??\c:\hbhbbb.exec:\hbhbbb.exe81⤵PID:4576
-
\??\c:\jjvvd.exec:\jjvvd.exe82⤵PID:2640
-
\??\c:\vvdjp.exec:\vvdjp.exe83⤵PID:4520
-
\??\c:\xxrlffx.exec:\xxrlffx.exe84⤵PID:2648
-
\??\c:\bhnnbn.exec:\bhnnbn.exe85⤵PID:4200
-
\??\c:\9ttnht.exec:\9ttnht.exe86⤵PID:4356
-
\??\c:\vjjjd.exec:\vjjjd.exe87⤵PID:3556
-
\??\c:\lfrxlfx.exec:\lfrxlfx.exe88⤵PID:644
-
\??\c:\xrrlrfx.exec:\xrrlrfx.exe89⤵PID:2972
-
\??\c:\hnbbnn.exec:\hnbbnn.exe90⤵PID:4036
-
\??\c:\vdvpv.exec:\vdvpv.exe91⤵PID:3792
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe92⤵PID:3372
-
\??\c:\xrfxxff.exec:\xrfxxff.exe93⤵PID:2404
-
\??\c:\thbbnb.exec:\thbbnb.exe94⤵PID:1636
-
\??\c:\ppjdp.exec:\ppjdp.exe95⤵PID:4732
-
\??\c:\vjjjv.exec:\vjjjv.exe96⤵PID:4864
-
\??\c:\lxxxxrx.exec:\lxxxxrx.exe97⤵PID:2080
-
\??\c:\hthnnb.exec:\hthnnb.exe98⤵PID:2104
-
\??\c:\djvvj.exec:\djvvj.exe99⤵PID:4552
-
\??\c:\jpjvj.exec:\jpjvj.exe100⤵PID:4856
-
\??\c:\1lxxrxx.exec:\1lxxrxx.exe101⤵PID:1448
-
\??\c:\ntnhhh.exec:\ntnhhh.exe102⤵PID:1468
-
\??\c:\pdjjj.exec:\pdjjj.exe103⤵PID:2704
-
\??\c:\5dppj.exec:\5dppj.exe104⤵PID:3944
-
\??\c:\fxxxfrr.exec:\fxxxfrr.exe105⤵PID:4532
-
\??\c:\tntttb.exec:\tntttb.exe106⤵PID:1692
-
\??\c:\jvvjv.exec:\jvvjv.exe107⤵PID:3196
-
\??\c:\flfffxr.exec:\flfffxr.exe108⤵PID:1292
-
\??\c:\hbhhht.exec:\hbhhht.exe109⤵PID:4372
-
\??\c:\ppvvj.exec:\ppvvj.exe110⤵PID:2988
-
\??\c:\xflfrrf.exec:\xflfrrf.exe111⤵PID:2396
-
\??\c:\bbhbbh.exec:\bbhbbh.exe112⤵PID:1860
-
\??\c:\3vjjj.exec:\3vjjj.exe113⤵PID:2804
-
\??\c:\xrxxfll.exec:\xrxxfll.exe114⤵PID:1996
-
\??\c:\hhbhtb.exec:\hhbhtb.exe115⤵PID:512
-
\??\c:\pdppv.exec:\pdppv.exe116⤵PID:2668
-
\??\c:\thnnnt.exec:\thnnnt.exe117⤵PID:3448
-
\??\c:\ppvpp.exec:\ppvpp.exe118⤵PID:4584
-
\??\c:\dppvv.exec:\dppvv.exe119⤵PID:3768
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe120⤵PID:4696
-
\??\c:\pvppv.exec:\pvppv.exe121⤵PID:4440
-
\??\c:\xlrlxrx.exec:\xlrlxrx.exe122⤵PID:3348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-