Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 13:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe
-
Size
180KB
-
MD5
b9d4929fbc98678f0c37d4096538e0b0
-
SHA1
3e7337fcc431611399e71c21d250f72ac6d9b4fb
-
SHA256
b552788a98c2fef1e6ad5c505bd2c5a0225be330b1fa0bbbf88ff50baee00831
-
SHA512
715a38db6278cf67585aed000cecbb3677573c7f8da8a7ed72a0a0c57942c5c495429b16c1840f38898aa13ca7fd2d50d452fb3d5d9837f14ae66fcd71f5fd55
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJPhbMB:PhOm2sI93UufdC67ciJTm5hIB
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3360-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-325-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-354-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-365-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-406-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-445-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-512-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-522-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-525-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-536-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-547-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-572-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-620-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-628-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-665-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-675-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-717-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-767-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-804-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 1nnnnt.exe 1560 3djjj.exe 2680 nnnntn.exe 1664 jvvpj.exe 3364 nbtnhh.exe 1328 pjjjj.exe 1376 flrxrfr.exe 1904 thttnb.exe 1300 jjjjp.exe 3628 pjvvd.exe 4320 rrlxfrr.exe 748 hntnnn.exe 3664 dvdvv.exe 2820 rrflfxx.exe 4176 btttnn.exe 4960 5jpjd.exe 4068 rllflll.exe 2912 bbtntt.exe 1372 pddvv.exe 4076 9lrlrrl.exe 552 9tbhhh.exe 888 llfxlff.exe 2524 bhhbbt.exe 4224 lrlffxx.exe 3764 xfrrrrr.exe 2284 bbnbtn.exe 3088 xlfflrr.exe 5044 ntnntt.exe 2444 3dpjd.exe 60 3rfxrlf.exe 3864 3jppp.exe 2712 frfllll.exe 3264 xrrrrrl.exe 3032 tttnbb.exe 1392 jjvvv.exe 3516 7bbtnn.exe 1064 thnhhh.exe 2144 pdjjd.exe 3532 bbntnt.exe 1496 9vjpd.exe 3236 frlfrfr.exe 4644 hthbnn.exe 3084 frlllxf.exe 2932 tntbhh.exe 1112 dvvvd.exe 4688 ffllfff.exe 4740 hbthbt.exe 5004 pjdvp.exe 4600 lffxxrl.exe 4996 lrfxrll.exe 1472 hbnhbb.exe 1616 vjpjv.exe 4376 fxlfrlr.exe 1168 nhtthn.exe 1244 ntbttn.exe 2108 pvddj.exe 4416 xrfrlfx.exe 4320 7ntnhb.exe 440 ntthhb.exe 3604 dvppj.exe 4828 lxfxrlf.exe 1792 nnhnhb.exe 4700 htbtnn.exe 3204 pvddp.exe -
resource yara_rule behavioral2/memory/3360-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-365-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-406-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-445-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-479-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3360 wrote to memory of 2696 3360 b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe 82 PID 3360 wrote to memory of 2696 3360 b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe 82 PID 3360 wrote to memory of 2696 3360 b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe 82 PID 2696 wrote to memory of 1560 2696 1nnnnt.exe 83 PID 2696 wrote to memory of 1560 2696 1nnnnt.exe 83 PID 2696 wrote to memory of 1560 2696 1nnnnt.exe 83 PID 1560 wrote to memory of 2680 1560 3djjj.exe 84 PID 1560 wrote to memory of 2680 1560 3djjj.exe 84 PID 1560 wrote to memory of 2680 1560 3djjj.exe 84 PID 2680 wrote to memory of 1664 2680 nnnntn.exe 85 PID 2680 wrote to memory of 1664 2680 nnnntn.exe 85 PID 2680 wrote to memory of 1664 2680 nnnntn.exe 85 PID 1664 wrote to memory of 3364 1664 jvvpj.exe 86 PID 1664 wrote to memory of 3364 1664 jvvpj.exe 86 PID 1664 wrote to memory of 3364 1664 jvvpj.exe 86 PID 3364 wrote to memory of 1328 3364 nbtnhh.exe 87 PID 3364 wrote to memory of 1328 3364 nbtnhh.exe 87 PID 3364 wrote to memory of 1328 3364 nbtnhh.exe 87 PID 1328 wrote to memory of 1376 1328 pjjjj.exe 88 PID 1328 wrote to memory of 1376 1328 pjjjj.exe 88 PID 1328 wrote to memory of 1376 1328 pjjjj.exe 88 PID 1376 wrote to memory of 1904 1376 flrxrfr.exe 90 PID 1376 wrote to memory of 1904 1376 flrxrfr.exe 90 PID 1376 wrote to memory of 1904 1376 flrxrfr.exe 90 PID 1904 wrote to memory of 1300 1904 thttnb.exe 91 PID 1904 wrote to memory of 1300 1904 thttnb.exe 91 PID 1904 wrote to memory of 1300 1904 thttnb.exe 91 PID 1300 wrote to memory of 3628 1300 jjjjp.exe 92 PID 1300 wrote to memory of 3628 1300 jjjjp.exe 92 PID 1300 wrote to memory of 3628 1300 jjjjp.exe 92 PID 3628 wrote to memory of 4320 3628 pjvvd.exe 94 PID 3628 wrote to memory of 4320 3628 pjvvd.exe 94 PID 3628 wrote to memory of 4320 3628 pjvvd.exe 94 PID 4320 wrote to memory of 748 4320 rrlxfrr.exe 95 PID 4320 wrote to memory of 748 4320 rrlxfrr.exe 95 PID 4320 wrote to memory of 748 4320 rrlxfrr.exe 95 PID 748 wrote to memory of 3664 748 hntnnn.exe 96 PID 748 wrote to memory of 3664 748 hntnnn.exe 96 PID 748 wrote to memory of 3664 748 hntnnn.exe 96 PID 3664 wrote to memory of 2820 3664 dvdvv.exe 97 PID 3664 wrote to memory of 2820 3664 dvdvv.exe 97 PID 3664 wrote to memory of 2820 3664 dvdvv.exe 97 PID 2820 wrote to memory of 4176 2820 rrflfxx.exe 98 PID 2820 wrote to memory of 4176 2820 rrflfxx.exe 98 PID 2820 wrote to memory of 4176 2820 rrflfxx.exe 98 PID 4176 wrote to memory of 4960 4176 btttnn.exe 99 PID 4176 wrote to memory of 4960 4176 btttnn.exe 99 PID 4176 wrote to memory of 4960 4176 btttnn.exe 99 PID 4960 wrote to memory of 4068 4960 5jpjd.exe 101 PID 4960 wrote to memory of 4068 4960 5jpjd.exe 101 PID 4960 wrote to memory of 4068 4960 5jpjd.exe 101 PID 4068 wrote to memory of 2912 4068 rllflll.exe 102 PID 4068 wrote to memory of 2912 4068 rllflll.exe 102 PID 4068 wrote to memory of 2912 4068 rllflll.exe 102 PID 2912 wrote to memory of 1372 2912 bbtntt.exe 103 PID 2912 wrote to memory of 1372 2912 bbtntt.exe 103 PID 2912 wrote to memory of 1372 2912 bbtntt.exe 103 PID 1372 wrote to memory of 4076 1372 pddvv.exe 104 PID 1372 wrote to memory of 4076 1372 pddvv.exe 104 PID 1372 wrote to memory of 4076 1372 pddvv.exe 104 PID 4076 wrote to memory of 552 4076 9lrlrrl.exe 105 PID 4076 wrote to memory of 552 4076 9lrlrrl.exe 105 PID 4076 wrote to memory of 552 4076 9lrlrrl.exe 105 PID 552 wrote to memory of 888 552 9tbhhh.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\1nnnnt.exec:\1nnnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3djjj.exec:\3djjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\nnnntn.exec:\nnnntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\jvvpj.exec:\jvvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\nbtnhh.exec:\nbtnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\pjjjj.exec:\pjjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\flrxrfr.exec:\flrxrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\thttnb.exec:\thttnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\jjjjp.exec:\jjjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\pjvvd.exec:\pjvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\rrlxfrr.exec:\rrlxfrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\hntnnn.exec:\hntnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\dvdvv.exec:\dvdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\rrflfxx.exec:\rrflfxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\btttnn.exec:\btttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\5jpjd.exec:\5jpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\rllflll.exec:\rllflll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\bbtntt.exec:\bbtntt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\pddvv.exec:\pddvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\9lrlrrl.exec:\9lrlrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\9tbhhh.exec:\9tbhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\llfxlff.exec:\llfxlff.exe23⤵
- Executes dropped EXE
PID:888 -
\??\c:\bhhbbt.exec:\bhhbbt.exe24⤵
- Executes dropped EXE
PID:2524 -
\??\c:\lrlffxx.exec:\lrlffxx.exe25⤵
- Executes dropped EXE
PID:4224 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe26⤵
- Executes dropped EXE
PID:3764 -
\??\c:\bbnbtn.exec:\bbnbtn.exe27⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xlfflrr.exec:\xlfflrr.exe28⤵
- Executes dropped EXE
PID:3088 -
\??\c:\ntnntt.exec:\ntnntt.exe29⤵
- Executes dropped EXE
PID:5044 -
\??\c:\3dpjd.exec:\3dpjd.exe30⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3rfxrlf.exec:\3rfxrlf.exe31⤵
- Executes dropped EXE
PID:60 -
\??\c:\3jppp.exec:\3jppp.exe32⤵
- Executes dropped EXE
PID:3864 -
\??\c:\frfllll.exec:\frfllll.exe33⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xrrrrrl.exec:\xrrrrrl.exe34⤵
- Executes dropped EXE
PID:3264 -
\??\c:\tttnbb.exec:\tttnbb.exe35⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jjvvv.exec:\jjvvv.exe36⤵
- Executes dropped EXE
PID:1392 -
\??\c:\7bbtnn.exec:\7bbtnn.exe37⤵
- Executes dropped EXE
PID:3516 -
\??\c:\thnhhh.exec:\thnhhh.exe38⤵
- Executes dropped EXE
PID:1064 -
\??\c:\pdjjd.exec:\pdjjd.exe39⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bbntnt.exec:\bbntnt.exe40⤵
- Executes dropped EXE
PID:3532 -
\??\c:\9vjpd.exec:\9vjpd.exe41⤵
- Executes dropped EXE
PID:1496 -
\??\c:\frlfrfr.exec:\frlfrfr.exe42⤵
- Executes dropped EXE
PID:3236 -
\??\c:\hthbnn.exec:\hthbnn.exe43⤵
- Executes dropped EXE
PID:4644 -
\??\c:\frlllxf.exec:\frlllxf.exe44⤵
- Executes dropped EXE
PID:3084 -
\??\c:\tntbhh.exec:\tntbhh.exe45⤵
- Executes dropped EXE
PID:2932 -
\??\c:\dvvvd.exec:\dvvvd.exe46⤵
- Executes dropped EXE
PID:1112 -
\??\c:\ffllfff.exec:\ffllfff.exe47⤵
- Executes dropped EXE
PID:4688 -
\??\c:\hbthbt.exec:\hbthbt.exe48⤵
- Executes dropped EXE
PID:4740 -
\??\c:\pjdvp.exec:\pjdvp.exe49⤵
- Executes dropped EXE
PID:5004 -
\??\c:\lffxxrl.exec:\lffxxrl.exe50⤵
- Executes dropped EXE
PID:4600 -
\??\c:\lrfxrll.exec:\lrfxrll.exe51⤵
- Executes dropped EXE
PID:4996 -
\??\c:\hbnhbb.exec:\hbnhbb.exe52⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vjpjv.exec:\vjpjv.exe53⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fxlfrlr.exec:\fxlfrlr.exe54⤵
- Executes dropped EXE
PID:4376 -
\??\c:\nhtthn.exec:\nhtthn.exe55⤵
- Executes dropped EXE
PID:1168 -
\??\c:\ntbttn.exec:\ntbttn.exe56⤵
- Executes dropped EXE
PID:1244 -
\??\c:\pvddj.exec:\pvddj.exe57⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xrfrlfx.exec:\xrfrlfx.exe58⤵
- Executes dropped EXE
PID:4416 -
\??\c:\7ntnhb.exec:\7ntnhb.exe59⤵
- Executes dropped EXE
PID:4320 -
\??\c:\ntthhb.exec:\ntthhb.exe60⤵
- Executes dropped EXE
PID:440 -
\??\c:\dvppj.exec:\dvppj.exe61⤵
- Executes dropped EXE
PID:3604 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe62⤵
- Executes dropped EXE
PID:4828 -
\??\c:\nnhnhb.exec:\nnhnhb.exe63⤵
- Executes dropped EXE
PID:1792 -
\??\c:\htbtnn.exec:\htbtnn.exe64⤵
- Executes dropped EXE
PID:4700 -
\??\c:\pvddp.exec:\pvddp.exe65⤵
- Executes dropped EXE
PID:3204 -
\??\c:\3lllffx.exec:\3lllffx.exe66⤵PID:4176
-
\??\c:\thtbhh.exec:\thtbhh.exe67⤵PID:1280
-
\??\c:\vjjjd.exec:\vjjjd.exe68⤵PID:3288
-
\??\c:\xxxlffx.exec:\xxxlffx.exe69⤵PID:1272
-
\??\c:\nnbbtt.exec:\nnbbtt.exe70⤵PID:4344
-
\??\c:\btbtnn.exec:\btbtnn.exe71⤵PID:208
-
\??\c:\vpppd.exec:\vpppd.exe72⤵PID:4592
-
\??\c:\lfrflxx.exec:\lfrflxx.exe73⤵PID:1148
-
\??\c:\hhhbtn.exec:\hhhbtn.exe74⤵PID:4788
-
\??\c:\bhnhbb.exec:\bhnhbb.exe75⤵PID:2524
-
\??\c:\dpvpv.exec:\dpvpv.exe76⤵PID:2288
-
\??\c:\rffxrrl.exec:\rffxrrl.exe77⤵PID:976
-
\??\c:\rrrxxxf.exec:\rrrxxxf.exe78⤵PID:2384
-
\??\c:\btntbt.exec:\btntbt.exe79⤵PID:4112
-
\??\c:\dppjv.exec:\dppjv.exe80⤵PID:1852
-
\??\c:\ppjdv.exec:\ppjdv.exe81⤵PID:5044
-
\??\c:\rllxrfx.exec:\rllxrfx.exe82⤵PID:4704
-
\??\c:\tnttbb.exec:\tnttbb.exe83⤵PID:3104
-
\??\c:\hbbtnn.exec:\hbbtnn.exe84⤵PID:5092
-
\??\c:\vpddv.exec:\vpddv.exe85⤵PID:3608
-
\??\c:\llllrxf.exec:\llllrxf.exe86⤵PID:952
-
\??\c:\lfxrlff.exec:\lfxrlff.exe87⤵PID:1660
-
\??\c:\bttnhh.exec:\bttnhh.exe88⤵PID:3032
-
\??\c:\pvdvp.exec:\pvdvp.exe89⤵PID:392
-
\??\c:\djddp.exec:\djddp.exe90⤵PID:4412
-
\??\c:\lxxlrfr.exec:\lxxlrfr.exe91⤵PID:1064
-
\??\c:\lxfrlff.exec:\lxfrlff.exe92⤵PID:2144
-
\??\c:\nbbttt.exec:\nbbttt.exe93⤵PID:1764
-
\??\c:\5hhbtn.exec:\5hhbtn.exe94⤵PID:1440
-
\??\c:\djddv.exec:\djddv.exe95⤵PID:3388
-
\??\c:\dppjd.exec:\dppjd.exe96⤵PID:4132
-
\??\c:\fxlxrlf.exec:\fxlxrlf.exe97⤵PID:672
-
\??\c:\nhhbnn.exec:\nhhbnn.exe98⤵PID:4724
-
\??\c:\vvpjj.exec:\vvpjj.exe99⤵PID:4820
-
\??\c:\7vvpd.exec:\7vvpd.exe100⤵PID:3016
-
\??\c:\rxfrrlx.exec:\rxfrrlx.exe101⤵PID:4304
-
\??\c:\bttntn.exec:\bttntn.exe102⤵PID:4680
-
\??\c:\hbbnnn.exec:\hbbnnn.exe103⤵PID:632
-
\??\c:\pjjdv.exec:\pjjdv.exe104⤵PID:3912
-
\??\c:\rlxflxf.exec:\rlxflxf.exe105⤵PID:2008
-
\??\c:\hnnhbh.exec:\hnnhbh.exe106⤵PID:4364
-
\??\c:\rfrrllf.exec:\rfrrllf.exe107⤵PID:3056
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe108⤵PID:1756
-
\??\c:\5bhnnn.exec:\5bhnnn.exe109⤵PID:1300
-
\??\c:\3ttntt.exec:\3ttntt.exe110⤵PID:3136
-
\??\c:\pjjdd.exec:\pjjdd.exe111⤵PID:4312
-
\??\c:\vjvpd.exec:\vjvpd.exe112⤵PID:1820
-
\??\c:\rxllfxx.exec:\rxllfxx.exe113⤵PID:780
-
\??\c:\bnhbbh.exec:\bnhbbh.exe114⤵PID:3828
-
\??\c:\bhtnhh.exec:\bhtnhh.exe115⤵PID:4532
-
\??\c:\pjppj.exec:\pjppj.exe116⤵PID:512
-
\??\c:\ppvpj.exec:\ppvpj.exe117⤵PID:3788
-
\??\c:\fllfrrl.exec:\fllfrrl.exe118⤵PID:4960
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe119⤵PID:4636
-
\??\c:\nbbbnn.exec:\nbbbnn.exe120⤵PID:3428
-
\??\c:\3pvpv.exec:\3pvpv.exe121⤵PID:932
-
\??\c:\pjppd.exec:\pjppd.exe122⤵PID:3660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-