Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 12:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe
-
Size
64KB
-
MD5
3a4f979748217fad0d1037f57d6adf20
-
SHA1
e23aeab9eb69dd2e5f57a005625e507a9e7c8776
-
SHA256
e9331d367e2516fd5251f68876c031db7c172bc28890bd9c4c91b302d7cc2c5d
-
SHA512
b09f22183f124fa52d17ec1b59ef23cb9fe284ab8d0476e57ed53be0da6e523f705c1988ddda6561d351249120dae0e78675ad4f05eedebcdb74a65eb89457dc
-
SSDEEP
1536:fvQBeOGtrYSSsrc93UBIfdC67m6AJiqsKzX7LWY6i3:fhOm2sI93UufdC67ciynd6i3
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4644-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1804-68-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2544-88-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3432-189-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5188-242-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5532-250-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4148-316-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4092-399-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5636-477-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5252-491-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5528-523-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5760-536-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3616-695-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5796-645-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2092-582-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4624-540-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4088-501-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5208-487-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/6020-470-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4988-448-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3876-431-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2192-420-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3204-419-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1576-410-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4980-368-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5248-360-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/6012-353-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1408-342-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2972-334-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1744-320-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4436-305-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5300-298-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4668-280-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5676-276-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4752-274-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2508-267-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5736-255-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5632-252-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5188-238-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5128-231-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5444-229-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3928-225-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3928-221-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2112-218-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4552-192-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5048-174-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/372-173-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3628-161-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3736-155-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/6032-143-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2192-137-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1984-121-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4076-110-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3804-104-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1704-90-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4572-80-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3352-73-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5060-61-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4140-52-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/436-49-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5420-43-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4044-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3056-24-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2604-14-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2392 vdvpj.exe 2604 rlrrrrr.exe 3056 lxxrffx.exe 4044 tnbthb.exe 4644 jddvv.exe 5420 9vvpp.exe 436 rllffff.exe 4140 nhbhnn.exe 5060 bbhbtt.exe 1804 ppjdv.exe 3352 9pdvp.exe 4572 5lxxxxl.exe 2544 bhnnbt.exe 1704 hbtnnb.exe 2788 pjddp.exe 3804 xxrxfrr.exe 4076 xxfxxxx.exe 3532 tbhhtt.exe 1984 btnhbt.exe 2812 jjjjv.exe 3204 9xllllf.exe 2192 5bhbbb.exe 6032 nbhbbb.exe 3912 djjdv.exe 3736 dppjd.exe 3628 7rrrffx.exe 3404 tbbtnn.exe 372 bhntnn.exe 5048 pvdvj.exe 3112 lxrrlfr.exe 3432 rrllfxx.exe 4552 9nhbbt.exe 2572 tnbbtt.exe 3884 1ddpp.exe 1756 pdddp.exe 5868 rlrlllr.exe 5592 flfrxrf.exe 3228 tnhbbt.exe 4544 btnhtn.exe 2112 jdpdv.exe 3928 pdjdp.exe 5444 3xfrlrl.exe 5128 rxfrfxr.exe 3020 nbtnbt.exe 5188 bhbtnn.exe 5200 3ddvj.exe 5532 vvpjj.exe 5632 lxrfxlx.exe 5736 fxllrrx.exe 1256 tnbtnh.exe 5480 tttnbt.exe 2508 3pjdv.exe 4752 vpdjj.exe 5676 7llxllf.exe 4668 btbhhb.exe 696 nhbbnn.exe 5112 5jvvj.exe 1164 rlrrrll.exe 6124 bbhhhb.exe 5140 7nnhtt.exe 5300 dpjjj.exe 4576 vpdvv.exe 4436 xrlffff.exe 4344 frrfxrl.exe -
resource yara_rule behavioral2/memory/4644-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1804-68-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2544-88-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3912-145-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3432-189-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5188-242-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5532-250-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4148-316-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3804-392-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4092-399-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/6132-424-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5636-477-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5252-491-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5528-523-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5760-536-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2288-715-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1256-813-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1464-797-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2984-793-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5128-789-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4520-764-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3616-695-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3396-674-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4296-667-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5796-645-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5436-641-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3552-631-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2092-582-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5680-572-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3208-547-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4624-540-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4088-501-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5208-487-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/6020-470-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/640-451-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4988-448-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3876-431-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2192-420-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3204-419-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1576-410-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4980-368-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5248-360-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/6012-353-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2076-343-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1408-342-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1408-338-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2972-334-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4428-321-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1744-320-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4436-305-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5300-298-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4668-280-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5676-276-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4752-274-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4752-270-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2508-267-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1256-259-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5736-255-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5632-252-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5532-246-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5188-238-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3020-234-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5128-231-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5444-229-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3968 wrote to memory of 2392 3968 3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe 83 PID 3968 wrote to memory of 2392 3968 3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe 83 PID 3968 wrote to memory of 2392 3968 3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe 83 PID 2392 wrote to memory of 2604 2392 vdvpj.exe 84 PID 2392 wrote to memory of 2604 2392 vdvpj.exe 84 PID 2392 wrote to memory of 2604 2392 vdvpj.exe 84 PID 2604 wrote to memory of 3056 2604 rlrrrrr.exe 85 PID 2604 wrote to memory of 3056 2604 rlrrrrr.exe 85 PID 2604 wrote to memory of 3056 2604 rlrrrrr.exe 85 PID 3056 wrote to memory of 4044 3056 lxxrffx.exe 86 PID 3056 wrote to memory of 4044 3056 lxxrffx.exe 86 PID 3056 wrote to memory of 4044 3056 lxxrffx.exe 86 PID 4044 wrote to memory of 4644 4044 tnbthb.exe 87 PID 4044 wrote to memory of 4644 4044 tnbthb.exe 87 PID 4044 wrote to memory of 4644 4044 tnbthb.exe 87 PID 4644 wrote to memory of 5420 4644 jddvv.exe 88 PID 4644 wrote to memory of 5420 4644 jddvv.exe 88 PID 4644 wrote to memory of 5420 4644 jddvv.exe 88 PID 5420 wrote to memory of 436 5420 9vvpp.exe 89 PID 5420 wrote to memory of 436 5420 9vvpp.exe 89 PID 5420 wrote to memory of 436 5420 9vvpp.exe 89 PID 436 wrote to memory of 4140 436 rllffff.exe 90 PID 436 wrote to memory of 4140 436 rllffff.exe 90 PID 436 wrote to memory of 4140 436 rllffff.exe 90 PID 4140 wrote to memory of 5060 4140 nhbhnn.exe 91 PID 4140 wrote to memory of 5060 4140 nhbhnn.exe 91 PID 4140 wrote to memory of 5060 4140 nhbhnn.exe 91 PID 5060 wrote to memory of 1804 5060 bbhbtt.exe 92 PID 5060 wrote to memory of 1804 5060 bbhbtt.exe 92 PID 5060 wrote to memory of 1804 5060 bbhbtt.exe 92 PID 1804 wrote to memory of 3352 1804 ppjdv.exe 93 PID 1804 wrote to memory of 3352 1804 ppjdv.exe 93 PID 1804 wrote to memory of 3352 1804 ppjdv.exe 93 PID 3352 wrote to memory of 4572 3352 9pdvp.exe 94 PID 3352 wrote to memory of 4572 3352 9pdvp.exe 94 PID 3352 wrote to memory of 4572 3352 9pdvp.exe 94 PID 4572 wrote to memory of 2544 4572 5lxxxxl.exe 96 PID 4572 wrote to memory of 2544 4572 5lxxxxl.exe 96 PID 4572 wrote to memory of 2544 4572 5lxxxxl.exe 96 PID 2544 wrote to memory of 1704 2544 bhnnbt.exe 97 PID 2544 wrote to memory of 1704 2544 bhnnbt.exe 97 PID 2544 wrote to memory of 1704 2544 bhnnbt.exe 97 PID 1704 wrote to memory of 2788 1704 hbtnnb.exe 98 PID 1704 wrote to memory of 2788 1704 hbtnnb.exe 98 PID 1704 wrote to memory of 2788 1704 hbtnnb.exe 98 PID 2788 wrote to memory of 3804 2788 pjddp.exe 99 PID 2788 wrote to memory of 3804 2788 pjddp.exe 99 PID 2788 wrote to memory of 3804 2788 pjddp.exe 99 PID 3804 wrote to memory of 4076 3804 xxrxfrr.exe 100 PID 3804 wrote to memory of 4076 3804 xxrxfrr.exe 100 PID 3804 wrote to memory of 4076 3804 xxrxfrr.exe 100 PID 4076 wrote to memory of 3532 4076 xxfxxxx.exe 101 PID 4076 wrote to memory of 3532 4076 xxfxxxx.exe 101 PID 4076 wrote to memory of 3532 4076 xxfxxxx.exe 101 PID 3532 wrote to memory of 1984 3532 tbhhtt.exe 102 PID 3532 wrote to memory of 1984 3532 tbhhtt.exe 102 PID 3532 wrote to memory of 1984 3532 tbhhtt.exe 102 PID 1984 wrote to memory of 2812 1984 btnhbt.exe 103 PID 1984 wrote to memory of 2812 1984 btnhbt.exe 103 PID 1984 wrote to memory of 2812 1984 btnhbt.exe 103 PID 2812 wrote to memory of 3204 2812 jjjjv.exe 105 PID 2812 wrote to memory of 3204 2812 jjjjv.exe 105 PID 2812 wrote to memory of 3204 2812 jjjjv.exe 105 PID 3204 wrote to memory of 2192 3204 9xllllf.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2669163743\zmstage.exeC:\Users\Admin\AppData\Local\Temp\2669163743\zmstage.exe1⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\vdvpj.exec:\vdvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\lxxrffx.exec:\lxxrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\tnbthb.exec:\tnbthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\jddvv.exec:\jddvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\9vvpp.exec:\9vvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
\??\c:\rllffff.exec:\rllffff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\nhbhnn.exec:\nhbhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\bbhbtt.exec:\bbhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\ppjdv.exec:\ppjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\9pdvp.exec:\9pdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\5lxxxxl.exec:\5lxxxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\bhnnbt.exec:\bhnnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\hbtnnb.exec:\hbtnnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\pjddp.exec:\pjddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xxrxfrr.exec:\xxrxfrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\tbhhtt.exec:\tbhhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\btnhbt.exec:\btnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\jjjjv.exec:\jjjjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\9xllllf.exec:\9xllllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\5bhbbb.exec:\5bhbbb.exe23⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nbhbbb.exec:\nbhbbb.exe24⤵
- Executes dropped EXE
PID:6032 -
\??\c:\djjdv.exec:\djjdv.exe25⤵
- Executes dropped EXE
PID:3912 -
\??\c:\dppjd.exec:\dppjd.exe26⤵
- Executes dropped EXE
PID:3736 -
\??\c:\7rrrffx.exec:\7rrrffx.exe27⤵
- Executes dropped EXE
PID:3628 -
\??\c:\tbbtnn.exec:\tbbtnn.exe28⤵
- Executes dropped EXE
PID:3404 -
\??\c:\bhntnn.exec:\bhntnn.exe29⤵
- Executes dropped EXE
PID:372 -
\??\c:\pvdvj.exec:\pvdvj.exe30⤵
- Executes dropped EXE
PID:5048 -
\??\c:\lxrrlfr.exec:\lxrrlfr.exe31⤵
- Executes dropped EXE
PID:3112 -
\??\c:\rrllfxx.exec:\rrllfxx.exe32⤵
- Executes dropped EXE
PID:3432 -
\??\c:\9nhbbt.exec:\9nhbbt.exe33⤵
- Executes dropped EXE
PID:4552 -
\??\c:\tnbbtt.exec:\tnbbtt.exe34⤵
- Executes dropped EXE
PID:2572 -
\??\c:\1ddpp.exec:\1ddpp.exe35⤵
- Executes dropped EXE
PID:3884 -
\??\c:\pdddp.exec:\pdddp.exe36⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rlrlllr.exec:\rlrlllr.exe37⤵
- Executes dropped EXE
PID:5868 -
\??\c:\flfrxrf.exec:\flfrxrf.exe38⤵
- Executes dropped EXE
PID:5592 -
\??\c:\tnhbbt.exec:\tnhbbt.exe39⤵
- Executes dropped EXE
PID:3228 -
\??\c:\btnhtn.exec:\btnhtn.exe40⤵
- Executes dropped EXE
PID:4544 -
\??\c:\jdpdv.exec:\jdpdv.exe41⤵
- Executes dropped EXE
PID:2112 -
\??\c:\pdjdp.exec:\pdjdp.exe42⤵
- Executes dropped EXE
PID:3928 -
\??\c:\3xfrlrl.exec:\3xfrlrl.exe43⤵
- Executes dropped EXE
PID:5444 -
\??\c:\rxfrfxr.exec:\rxfrfxr.exe44⤵
- Executes dropped EXE
PID:5128 -
\??\c:\nbtnbt.exec:\nbtnbt.exe45⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bhbtnn.exec:\bhbtnn.exe46⤵
- Executes dropped EXE
PID:5188 -
\??\c:\3ddvj.exec:\3ddvj.exe47⤵
- Executes dropped EXE
PID:5200 -
\??\c:\vvpjj.exec:\vvpjj.exe48⤵
- Executes dropped EXE
PID:5532 -
\??\c:\lxrfxlx.exec:\lxrfxlx.exe49⤵
- Executes dropped EXE
PID:5632 -
\??\c:\fxllrrx.exec:\fxllrrx.exe50⤵
- Executes dropped EXE
PID:5736 -
\??\c:\tnbtnh.exec:\tnbtnh.exe51⤵
- Executes dropped EXE
PID:1256 -
\??\c:\tttnbt.exec:\tttnbt.exe52⤵
- Executes dropped EXE
PID:5480 -
\??\c:\3pjdv.exec:\3pjdv.exe53⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vpdjj.exec:\vpdjj.exe54⤵
- Executes dropped EXE
PID:4752 -
\??\c:\7llxllf.exec:\7llxllf.exe55⤵
- Executes dropped EXE
PID:5676 -
\??\c:\btbhhb.exec:\btbhhb.exe56⤵
- Executes dropped EXE
PID:4668 -
\??\c:\nhbbnn.exec:\nhbbnn.exe57⤵
- Executes dropped EXE
PID:696 -
\??\c:\5jvvj.exec:\5jvvj.exe58⤵
- Executes dropped EXE
PID:5112 -
\??\c:\rlrrrll.exec:\rlrrrll.exe59⤵
- Executes dropped EXE
PID:1164 -
\??\c:\bbhhhb.exec:\bbhhhb.exe60⤵
- Executes dropped EXE
PID:6124 -
\??\c:\7nnhtt.exec:\7nnhtt.exe61⤵
- Executes dropped EXE
PID:5140 -
\??\c:\dpjjj.exec:\dpjjj.exe62⤵
- Executes dropped EXE
PID:5300 -
\??\c:\vpdvv.exec:\vpdvv.exe63⤵
- Executes dropped EXE
PID:4576 -
\??\c:\xrlffff.exec:\xrlffff.exe64⤵
- Executes dropped EXE
PID:4436 -
\??\c:\frrfxrl.exec:\frrfxrl.exe65⤵
- Executes dropped EXE
PID:4344 -
\??\c:\bbttbh.exec:\bbttbh.exe66⤵PID:4148
-
\??\c:\bbhbbb.exec:\bbhbbb.exe67⤵PID:1744
-
\??\c:\dvpdd.exec:\dvpdd.exe68⤵PID:4428
-
\??\c:\jdjjp.exec:\jdjjp.exe69⤵PID:1632
-
\??\c:\ffxffxf.exec:\ffxffxf.exe70⤵PID:3368
-
\??\c:\xrxxfff.exec:\xrxxfff.exe71⤵PID:2972
-
\??\c:\ntnbht.exec:\ntnbht.exe72⤵PID:1296
-
\??\c:\bnhbnh.exec:\bnhbnh.exe73⤵PID:1408
-
\??\c:\3pjdv.exec:\3pjdv.exe74⤵PID:2076
-
\??\c:\vdppj.exec:\vdppj.exe75⤵PID:884
-
\??\c:\3flfrlf.exec:\3flfrlf.exe76⤵PID:4716
-
\??\c:\lrrrrfl.exec:\lrrrrfl.exe77⤵PID:6012
-
\??\c:\5lllxlx.exec:\5lllxlx.exe78⤵PID:5248
-
\??\c:\nbtttb.exec:\nbtttb.exe79⤵PID:2224
-
\??\c:\hnhhtt.exec:\hnhhtt.exe80⤵PID:2532
-
\??\c:\pdpjv.exec:\pdpjv.exe81⤵PID:4980
-
\??\c:\vjdpd.exec:\vjdpd.exe82⤵PID:4972
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe83⤵PID:1172
-
\??\c:\lffrxlx.exec:\lffrxlx.exe84⤵PID:3840
-
\??\c:\tnnhbt.exec:\tnnhbt.exe85⤵PID:556
-
\??\c:\tbhbtt.exec:\tbhbtt.exe86⤵PID:456
-
\??\c:\pdjpv.exec:\pdjpv.exe87⤵PID:2012
-
\??\c:\jpdvv.exec:\jpdvv.exe88⤵PID:3004
-
\??\c:\rflxrlf.exec:\rflxrlf.exe89⤵PID:3804
-
\??\c:\rrllfff.exec:\rrllfff.exe90⤵PID:4092
-
\??\c:\nttbnt.exec:\nttbnt.exe91⤵PID:5168
-
\??\c:\jpppp.exec:\jpppp.exe92⤵PID:1148
-
\??\c:\pjdjd.exec:\pjdjd.exe93⤵PID:2504
-
\??\c:\djjdv.exec:\djjdv.exe94⤵PID:1576
-
\??\c:\lffxfff.exec:\lffxfff.exe95⤵PID:3996
-
\??\c:\rxlfxxf.exec:\rxlfxxf.exe96⤵PID:3204
-
\??\c:\ttbhth.exec:\ttbhth.exe97⤵PID:2192
-
\??\c:\hnhhhh.exec:\hnhhhh.exe98⤵PID:6132
-
\??\c:\3dvvp.exec:\3dvvp.exe99⤵PID:3876
-
\??\c:\pddvj.exec:\pddvj.exe100⤵PID:5724
-
\??\c:\vvpjd.exec:\vvpjd.exe101⤵PID:2240
-
\??\c:\xllfxxr.exec:\xllfxxr.exe102⤵PID:5412
-
\??\c:\xfrrrlr.exec:\xfrrrlr.exe103⤵PID:876
-
\??\c:\nbnhhb.exec:\nbnhhb.exe104⤵PID:2020
-
\??\c:\ttnhbb.exec:\ttnhbb.exe105⤵PID:4988
-
\??\c:\hhtnnh.exec:\hhtnnh.exe106⤵PID:640
-
\??\c:\vpppd.exec:\vpppd.exe107⤵PID:1580
-
\??\c:\pjvpj.exec:\pjvpj.exe108⤵PID:5596
-
\??\c:\9rllrrx.exec:\9rllrrx.exe109⤵PID:3612
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe110⤵PID:2988
-
\??\c:\rffxrlf.exec:\rffxrlf.exe111⤵PID:1888
-
\??\c:\btbnbt.exec:\btbnbt.exe112⤵PID:6020
-
\??\c:\ntnhhn.exec:\ntnhhn.exe113⤵PID:5636
-
\??\c:\pddvj.exec:\pddvj.exe114⤵PID:1540
-
\??\c:\5dppj.exec:\5dppj.exe115⤵PID:1300
-
\??\c:\7flfxxr.exec:\7flfxxr.exe116⤵PID:5208
-
\??\c:\5lfxrrl.exec:\5lfxrrl.exe117⤵PID:5252
-
\??\c:\tbhtnn.exec:\tbhtnn.exe118⤵PID:4280
-
\??\c:\1tnnhh.exec:\1tnnhh.exe119⤵PID:5052
-
\??\c:\vvppj.exec:\vvppj.exe120⤵PID:4088
-
\??\c:\pvdvd.exec:\pvdvd.exe121⤵PID:1724
-
\??\c:\jppvv.exec:\jppvv.exe122⤵PID:2304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-