Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 21:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c7691c902eba35831ad3d6ce80fd3a0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
2c7691c902eba35831ad3d6ce80fd3a0_NeikiAnalytics.exe
-
Size
521KB
-
MD5
2c7691c902eba35831ad3d6ce80fd3a0
-
SHA1
3a632f9ef16581f461c42eed7749e595e2468699
-
SHA256
13d57f0dd84d3510a2618610c98f188095b308dae998a4d0d93f326af312442a
-
SHA512
fd2cb7a3f5f5264a0489faf8949c816b0ef8b6abfafe9df41d7dd047edf179038d391841038013828503d9e997de024e82d5bf431d85566ae46638510043fe5f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H36:q7Tc2NYHUrAwfMHNnpls489K
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2476-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/332-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-934-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-986-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-1123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4564 nthbbh.exe 4120 llxfxfx.exe 4552 jpdvj.exe 348 hthnbt.exe 396 djpjd.exe 2040 5xxrlll.exe 2968 hnhbnh.exe 2124 9dvpp.exe 3696 7lfxfff.exe 3532 flrllll.exe 3800 ffxfxxr.exe 2396 dpppv.exe 3968 lxfrrrl.exe 4624 jdjjv.exe 4928 hbhhnn.exe 4972 9pppj.exe 5084 pdjdp.exe 4528 xfllfff.exe 3980 hbhbtt.exe 3752 vvpjp.exe 4856 nhbtht.exe 4604 lllrfrx.exe 960 jdddv.exe 4188 3rllllf.exe 332 dvdjj.exe 5072 xlrrlrl.exe 1960 nnnnhh.exe 4660 7rllflf.exe 2328 7lffxxx.exe 1660 5frlffx.exe 2912 jdpjd.exe 4964 thnhbt.exe 1896 lflrrll.exe 4088 1htnhh.exe 516 7ddvv.exe 4480 xfxrffr.exe 3928 hnnnhn.exe 1928 pdjdd.exe 532 jdjdv.exe 3380 llffxlf.exe 2352 5hthbb.exe 3856 9vvpj.exe 1172 7flfxxr.exe 4140 3thbhn.exe 528 vppjd.exe 4520 rrffllr.exe 2948 nhnhhh.exe 3224 xlrrlll.exe 2372 xrrxrrl.exe 2556 thnhbt.exe 4052 ddppp.exe 3972 bhnhtn.exe 3192 3dppp.exe 4548 lfxrllf.exe 2708 nbbbtt.exe 4508 vpppp.exe 4724 bbnhbb.exe 2396 bbtnnh.exe 4648 jjvpj.exe 2116 ffrlfxx.exe 644 bnnbnh.exe 5000 1pdpv.exe 1520 frrxrlx.exe 1872 5rrlxxr.exe -
resource yara_rule behavioral2/memory/2476-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/332-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-521-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 4564 2476 2c7691c902eba35831ad3d6ce80fd3a0_NeikiAnalytics.exe 82 PID 2476 wrote to memory of 4564 2476 2c7691c902eba35831ad3d6ce80fd3a0_NeikiAnalytics.exe 82 PID 2476 wrote to memory of 4564 2476 2c7691c902eba35831ad3d6ce80fd3a0_NeikiAnalytics.exe 82 PID 4564 wrote to memory of 4120 4564 nthbbh.exe 83 PID 4564 wrote to memory of 4120 4564 nthbbh.exe 83 PID 4564 wrote to memory of 4120 4564 nthbbh.exe 83 PID 4120 wrote to memory of 4552 4120 llxfxfx.exe 84 PID 4120 wrote to memory of 4552 4120 llxfxfx.exe 84 PID 4120 wrote to memory of 4552 4120 llxfxfx.exe 84 PID 4552 wrote to memory of 348 4552 jpdvj.exe 85 PID 4552 wrote to memory of 348 4552 jpdvj.exe 85 PID 4552 wrote to memory of 348 4552 jpdvj.exe 85 PID 348 wrote to memory of 396 348 hthnbt.exe 86 PID 348 wrote to memory of 396 348 hthnbt.exe 86 PID 348 wrote to memory of 396 348 hthnbt.exe 86 PID 396 wrote to memory of 2040 396 djpjd.exe 87 PID 396 wrote to memory of 2040 396 djpjd.exe 87 PID 396 wrote to memory of 2040 396 djpjd.exe 87 PID 2040 wrote to memory of 2968 2040 5xxrlll.exe 90 PID 2040 wrote to memory of 2968 2040 5xxrlll.exe 90 PID 2040 wrote to memory of 2968 2040 5xxrlll.exe 90 PID 2968 wrote to memory of 2124 2968 hnhbnh.exe 92 PID 2968 wrote to memory of 2124 2968 hnhbnh.exe 92 PID 2968 wrote to memory of 2124 2968 hnhbnh.exe 92 PID 2124 wrote to memory of 3696 2124 9dvpp.exe 93 PID 2124 wrote to memory of 3696 2124 9dvpp.exe 93 PID 2124 wrote to memory of 3696 2124 9dvpp.exe 93 PID 3696 wrote to memory of 3532 3696 7lfxfff.exe 94 PID 3696 wrote to memory of 3532 3696 7lfxfff.exe 94 PID 3696 wrote to memory of 3532 3696 7lfxfff.exe 94 PID 3532 wrote to memory of 3800 3532 flrllll.exe 95 PID 3532 wrote to memory of 3800 3532 flrllll.exe 95 PID 3532 wrote to memory of 3800 3532 flrllll.exe 95 PID 3800 wrote to memory of 2396 3800 ffxfxxr.exe 96 PID 3800 wrote to memory of 2396 3800 ffxfxxr.exe 96 PID 3800 wrote to memory of 2396 3800 ffxfxxr.exe 96 PID 2396 wrote to memory of 3968 2396 dpppv.exe 97 PID 2396 wrote to memory of 3968 2396 dpppv.exe 97 PID 2396 wrote to memory of 3968 2396 dpppv.exe 97 PID 3968 wrote to memory of 4624 3968 lxfrrrl.exe 98 PID 3968 wrote to memory of 4624 3968 lxfrrrl.exe 98 PID 3968 wrote to memory of 4624 3968 lxfrrrl.exe 98 PID 4624 wrote to memory of 4928 4624 jdjjv.exe 99 PID 4624 wrote to memory of 4928 4624 jdjjv.exe 99 PID 4624 wrote to memory of 4928 4624 jdjjv.exe 99 PID 4928 wrote to memory of 4972 4928 hbhhnn.exe 100 PID 4928 wrote to memory of 4972 4928 hbhhnn.exe 100 PID 4928 wrote to memory of 4972 4928 hbhhnn.exe 100 PID 4972 wrote to memory of 5084 4972 9pppj.exe 101 PID 4972 wrote to memory of 5084 4972 9pppj.exe 101 PID 4972 wrote to memory of 5084 4972 9pppj.exe 101 PID 5084 wrote to memory of 4528 5084 pdjdp.exe 102 PID 5084 wrote to memory of 4528 5084 pdjdp.exe 102 PID 5084 wrote to memory of 4528 5084 pdjdp.exe 102 PID 4528 wrote to memory of 3980 4528 xfllfff.exe 103 PID 4528 wrote to memory of 3980 4528 xfllfff.exe 103 PID 4528 wrote to memory of 3980 4528 xfllfff.exe 103 PID 3980 wrote to memory of 3752 3980 hbhbtt.exe 104 PID 3980 wrote to memory of 3752 3980 hbhbtt.exe 104 PID 3980 wrote to memory of 3752 3980 hbhbtt.exe 104 PID 3752 wrote to memory of 4856 3752 vvpjp.exe 105 PID 3752 wrote to memory of 4856 3752 vvpjp.exe 105 PID 3752 wrote to memory of 4856 3752 vvpjp.exe 105 PID 4856 wrote to memory of 4604 4856 nhbtht.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c7691c902eba35831ad3d6ce80fd3a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2c7691c902eba35831ad3d6ce80fd3a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\nthbbh.exec:\nthbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\llxfxfx.exec:\llxfxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\jpdvj.exec:\jpdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\hthnbt.exec:\hthnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\djpjd.exec:\djpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\5xxrlll.exec:\5xxrlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\hnhbnh.exec:\hnhbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\9dvpp.exec:\9dvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\7lfxfff.exec:\7lfxfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\flrllll.exec:\flrllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\ffxfxxr.exec:\ffxfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\dpppv.exec:\dpppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\lxfrrrl.exec:\lxfrrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\jdjjv.exec:\jdjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\hbhhnn.exec:\hbhhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\9pppj.exec:\9pppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\pdjdp.exec:\pdjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\xfllfff.exec:\xfllfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\hbhbtt.exec:\hbhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\vvpjp.exec:\vvpjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\nhbtht.exec:\nhbtht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\lllrfrx.exec:\lllrfrx.exe23⤵
- Executes dropped EXE
PID:4604 -
\??\c:\jdddv.exec:\jdddv.exe24⤵
- Executes dropped EXE
PID:960 -
\??\c:\3rllllf.exec:\3rllllf.exe25⤵
- Executes dropped EXE
PID:4188 -
\??\c:\dvdjj.exec:\dvdjj.exe26⤵
- Executes dropped EXE
PID:332 -
\??\c:\xlrrlrl.exec:\xlrrlrl.exe27⤵
- Executes dropped EXE
PID:5072 -
\??\c:\nnnnhh.exec:\nnnnhh.exe28⤵
- Executes dropped EXE
PID:1960 -
\??\c:\7rllflf.exec:\7rllflf.exe29⤵
- Executes dropped EXE
PID:4660 -
\??\c:\7lffxxx.exec:\7lffxxx.exe30⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5frlffx.exec:\5frlffx.exe31⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jdpjd.exec:\jdpjd.exe32⤵
- Executes dropped EXE
PID:2912 -
\??\c:\thnhbt.exec:\thnhbt.exe33⤵
- Executes dropped EXE
PID:4964 -
\??\c:\lflrrll.exec:\lflrrll.exe34⤵
- Executes dropped EXE
PID:1896 -
\??\c:\1htnhh.exec:\1htnhh.exe35⤵
- Executes dropped EXE
PID:4088 -
\??\c:\7ddvv.exec:\7ddvv.exe36⤵
- Executes dropped EXE
PID:516 -
\??\c:\xfxrffr.exec:\xfxrffr.exe37⤵
- Executes dropped EXE
PID:4480 -
\??\c:\hnnnhn.exec:\hnnnhn.exe38⤵
- Executes dropped EXE
PID:3928 -
\??\c:\pdjdd.exec:\pdjdd.exe39⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jdjdv.exec:\jdjdv.exe40⤵
- Executes dropped EXE
PID:532 -
\??\c:\llffxlf.exec:\llffxlf.exe41⤵
- Executes dropped EXE
PID:3380 -
\??\c:\5hthbb.exec:\5hthbb.exe42⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9vvpj.exec:\9vvpj.exe43⤵
- Executes dropped EXE
PID:3856 -
\??\c:\7flfxxr.exec:\7flfxxr.exe44⤵
- Executes dropped EXE
PID:1172 -
\??\c:\3thbhn.exec:\3thbhn.exe45⤵
- Executes dropped EXE
PID:4140 -
\??\c:\vppjd.exec:\vppjd.exe46⤵
- Executes dropped EXE
PID:528 -
\??\c:\rrffllr.exec:\rrffllr.exe47⤵
- Executes dropped EXE
PID:4520 -
\??\c:\nhnhhh.exec:\nhnhhh.exe48⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xlrrlll.exec:\xlrrlll.exe49⤵
- Executes dropped EXE
PID:3224 -
\??\c:\xrrxrrl.exec:\xrrxrrl.exe50⤵
- Executes dropped EXE
PID:2372 -
\??\c:\thnhbt.exec:\thnhbt.exe51⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ddppp.exec:\ddppp.exe52⤵
- Executes dropped EXE
PID:4052 -
\??\c:\bhnhtn.exec:\bhnhtn.exe53⤵
- Executes dropped EXE
PID:3972 -
\??\c:\3dppp.exec:\3dppp.exe54⤵
- Executes dropped EXE
PID:3192 -
\??\c:\lfxrllf.exec:\lfxrllf.exe55⤵
- Executes dropped EXE
PID:4548 -
\??\c:\nbbbtt.exec:\nbbbtt.exe56⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vpppp.exec:\vpppp.exe57⤵
- Executes dropped EXE
PID:4508 -
\??\c:\bbnhbb.exec:\bbnhbb.exe58⤵
- Executes dropped EXE
PID:4724 -
\??\c:\bbtnnh.exec:\bbtnnh.exe59⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jjvpj.exec:\jjvpj.exe60⤵
- Executes dropped EXE
PID:4648 -
\??\c:\ffrlfxx.exec:\ffrlfxx.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bnnbnh.exec:\bnnbnh.exe62⤵
- Executes dropped EXE
PID:644 -
\??\c:\1pdpv.exec:\1pdpv.exe63⤵
- Executes dropped EXE
PID:5000 -
\??\c:\frrxrlx.exec:\frrxrlx.exe64⤵
- Executes dropped EXE
PID:1520 -
\??\c:\5rrlxxr.exec:\5rrlxxr.exe65⤵
- Executes dropped EXE
PID:1872 -
\??\c:\nhtnbt.exec:\nhtnbt.exe66⤵PID:4908
-
\??\c:\jvjvv.exec:\jvjvv.exe67⤵PID:4804
-
\??\c:\3xxxrlx.exec:\3xxxrlx.exe68⤵PID:3868
-
\??\c:\1rrlfxl.exec:\1rrlfxl.exe69⤵PID:1532
-
\??\c:\tnthhb.exec:\tnthhb.exe70⤵PID:2624
-
\??\c:\jvvpd.exec:\jvvpd.exe71⤵PID:4604
-
\??\c:\frxrllx.exec:\frxrllx.exe72⤵PID:3916
-
\??\c:\nbhttt.exec:\nbhttt.exe73⤵PID:4476
-
\??\c:\vpvjv.exec:\vpvjv.exe74⤵PID:1716
-
\??\c:\rllxxrr.exec:\rllxxrr.exe75⤵PID:640
-
\??\c:\llfxlfx.exec:\llfxlfx.exe76⤵PID:4404
-
\??\c:\1hhthh.exec:\1hhthh.exe77⤵PID:1200
-
\??\c:\dvvjv.exec:\dvvjv.exe78⤵PID:2084
-
\??\c:\frlfxxl.exec:\frlfxxl.exe79⤵PID:1624
-
\??\c:\nhhbtt.exec:\nhhbtt.exe80⤵PID:4064
-
\??\c:\5pdpp.exec:\5pdpp.exe81⤵PID:628
-
\??\c:\xllxrlx.exec:\xllxrlx.exe82⤵PID:2912
-
\??\c:\rffxlfx.exec:\rffxlfx.exe83⤵PID:2752
-
\??\c:\hbnttn.exec:\hbnttn.exe84⤵PID:2460
-
\??\c:\5vjdd.exec:\5vjdd.exe85⤵PID:5056
-
\??\c:\1fffxrl.exec:\1fffxrl.exe86⤵PID:4572
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe87⤵PID:2308
-
\??\c:\htbtnt.exec:\htbtnt.exe88⤵PID:3004
-
\??\c:\jvjdd.exec:\jvjdd.exe89⤵PID:4588
-
\??\c:\lxflfxr.exec:\lxflfxr.exe90⤵PID:2776
-
\??\c:\rxrfxrx.exec:\rxrfxrx.exe91⤵PID:4360
-
\??\c:\nhtnht.exec:\nhtnht.exe92⤵PID:2476
-
\??\c:\jpjdv.exec:\jpjdv.exe93⤵PID:4560
-
\??\c:\pjjdv.exec:\pjjdv.exe94⤵PID:1492
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe95⤵PID:4472
-
\??\c:\thhhhh.exec:\thhhhh.exe96⤵PID:348
-
\??\c:\dddvv.exec:\dddvv.exe97⤵PID:3444
-
\??\c:\ddpjd.exec:\ddpjd.exe98⤵PID:4008
-
\??\c:\rxfxrll.exec:\rxfxrll.exe99⤵PID:940
-
\??\c:\3bhhht.exec:\3bhhht.exe100⤵PID:1852
-
\??\c:\nnhhhn.exec:\nnhhhn.exe101⤵PID:2160
-
\??\c:\vpppj.exec:\vpppj.exe102⤵PID:3528
-
\??\c:\1rlfrrr.exec:\1rlfrrr.exe103⤵PID:3972
-
\??\c:\xlrrlfx.exec:\xlrrlfx.exe104⤵PID:632
-
\??\c:\btttnn.exec:\btttnn.exe105⤵PID:4844
-
\??\c:\9vdvd.exec:\9vdvd.exe106⤵PID:1536
-
\??\c:\lxfxffx.exec:\lxfxffx.exe107⤵PID:2888
-
\??\c:\xfrlffx.exec:\xfrlffx.exe108⤵PID:832
-
\??\c:\3bhbtt.exec:\3bhbtt.exe109⤵PID:2396
-
\??\c:\3pjdp.exec:\3pjdp.exe110⤵PID:4608
-
\??\c:\dpjdp.exec:\dpjdp.exe111⤵PID:912
-
\??\c:\rlfxxxl.exec:\rlfxxxl.exe112⤵PID:804
-
\??\c:\thhbtn.exec:\thhbtn.exe113⤵PID:5104
-
\??\c:\7vppj.exec:\7vppj.exe114⤵PID:2036
-
\??\c:\pjvpp.exec:\pjvpp.exe115⤵PID:5016
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe116⤵PID:4012
-
\??\c:\nthhnn.exec:\nthhnn.exe117⤵PID:4040
-
\??\c:\1ddvp.exec:\1ddvp.exe118⤵PID:4932
-
\??\c:\xrfxrxr.exec:\xrfxrxr.exe119⤵PID:5040
-
\??\c:\xrllxxl.exec:\xrllxxl.exe120⤵PID:960
-
\??\c:\nnhtnb.exec:\nnhtnb.exe121⤵PID:880
-
\??\c:\jdppp.exec:\jdppp.exe122⤵PID:3152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-