Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe
-
Size
205KB
-
MD5
1a6f27fd00e148bc8c10a7d2f73d4bd0
-
SHA1
c80a8e2aa67203bb70cd055ee47f1935498d4393
-
SHA256
ba0a6549a5260a2c34be5180b4f0d6ecb30d82aea35ada67cfc210bbce78ce81
-
SHA512
19ffc25b232c6da2c8ad15273657833f7990967e956049a3c98f9ef27d5125a593ad086d4974ed25b4808472f27778e0a2f6c1f66399217c70295436a9bf9ba0
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6TQpCihJ:PhOm2sI93UufdC67ciJTU2HVS64hJ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4216-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-351-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-371-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-387-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-442-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-457-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-489-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-493-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-513-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-561-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-633-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-635-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-777-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-1011-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-1133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-1497-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4216 llxxrff.exe 1256 bntnnt.exe 4776 fxrrxxf.exe 4332 rxlfxxr.exe 4624 bbntbb.exe 1092 xlrllll.exe 1400 hnthnn.exe 3144 5vvvv.exe 2940 vjpjd.exe 3020 vddvj.exe 2476 ffffxff.exe 2764 bthbtt.exe 512 xlllfll.exe 2804 nhtnnn.exe 1104 ddvpj.exe 1528 jpppj.exe 1064 9rrrlfx.exe 5072 btthbb.exe 756 rrrrrxx.exe 4584 tbttnn.exe 1672 ppjdd.exe 384 rllfxxl.exe 3672 bbnttt.exe 4056 dvddd.exe 4756 rlxxffl.exe 1644 frfxxxx.exe 444 9vpjd.exe 2876 frrlfxr.exe 3148 fxlxfxf.exe 3540 bbbtnh.exe 4696 jppjv.exe 1568 fxlxrrr.exe 4048 nbhbhb.exe 4036 hhhbnn.exe 2200 vddpd.exe 1252 rlfxrxr.exe 880 bnthtt.exe 3880 pvjjd.exe 4228 bbbbbt.exe 1164 pvvvd.exe 3860 lffxrrf.exe 4740 xffxrll.exe 972 5jpjp.exe 3660 lxffxxx.exe 3456 bttnhh.exe 1508 7jdpd.exe 1752 rrfrxxx.exe 1804 7nthhn.exe 428 bbbtth.exe 2928 djpdp.exe 2420 vjdvj.exe 2864 rlxrlff.exe 1108 lffrxxr.exe 2736 3ttthb.exe 1140 lfrfrlf.exe 3532 xffrlfx.exe 4728 nnbnhb.exe 3080 1pvjp.exe 2872 lxxrffr.exe 1412 fxxrfxl.exe 4968 thnhtt.exe 2624 jjpjj.exe 3920 9dvjv.exe 4980 1lrfrrf.exe -
resource yara_rule behavioral2/memory/4216-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1256-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-387-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-417-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-442-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-457-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-479-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-489-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-493-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-513-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-540-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 4216 2116 1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe 81 PID 2116 wrote to memory of 4216 2116 1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe 81 PID 2116 wrote to memory of 4216 2116 1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe 81 PID 4216 wrote to memory of 1256 4216 llxxrff.exe 82 PID 4216 wrote to memory of 1256 4216 llxxrff.exe 82 PID 4216 wrote to memory of 1256 4216 llxxrff.exe 82 PID 1256 wrote to memory of 4776 1256 bntnnt.exe 83 PID 1256 wrote to memory of 4776 1256 bntnnt.exe 83 PID 1256 wrote to memory of 4776 1256 bntnnt.exe 83 PID 4776 wrote to memory of 4332 4776 fxrrxxf.exe 84 PID 4776 wrote to memory of 4332 4776 fxrrxxf.exe 84 PID 4776 wrote to memory of 4332 4776 fxrrxxf.exe 84 PID 4332 wrote to memory of 4624 4332 rxlfxxr.exe 85 PID 4332 wrote to memory of 4624 4332 rxlfxxr.exe 85 PID 4332 wrote to memory of 4624 4332 rxlfxxr.exe 85 PID 4624 wrote to memory of 1092 4624 bbntbb.exe 86 PID 4624 wrote to memory of 1092 4624 bbntbb.exe 86 PID 4624 wrote to memory of 1092 4624 bbntbb.exe 86 PID 1092 wrote to memory of 1400 1092 xlrllll.exe 88 PID 1092 wrote to memory of 1400 1092 xlrllll.exe 88 PID 1092 wrote to memory of 1400 1092 xlrllll.exe 88 PID 1400 wrote to memory of 3144 1400 hnthnn.exe 89 PID 1400 wrote to memory of 3144 1400 hnthnn.exe 89 PID 1400 wrote to memory of 3144 1400 hnthnn.exe 89 PID 3144 wrote to memory of 2940 3144 5vvvv.exe 90 PID 3144 wrote to memory of 2940 3144 5vvvv.exe 90 PID 3144 wrote to memory of 2940 3144 5vvvv.exe 90 PID 2940 wrote to memory of 3020 2940 vjpjd.exe 91 PID 2940 wrote to memory of 3020 2940 vjpjd.exe 91 PID 2940 wrote to memory of 3020 2940 vjpjd.exe 91 PID 3020 wrote to memory of 2476 3020 vddvj.exe 93 PID 3020 wrote to memory of 2476 3020 vddvj.exe 93 PID 3020 wrote to memory of 2476 3020 vddvj.exe 93 PID 2476 wrote to memory of 2764 2476 ffffxff.exe 94 PID 2476 wrote to memory of 2764 2476 ffffxff.exe 94 PID 2476 wrote to memory of 2764 2476 ffffxff.exe 94 PID 2764 wrote to memory of 512 2764 bthbtt.exe 95 PID 2764 wrote to memory of 512 2764 bthbtt.exe 95 PID 2764 wrote to memory of 512 2764 bthbtt.exe 95 PID 512 wrote to memory of 2804 512 xlllfll.exe 97 PID 512 wrote to memory of 2804 512 xlllfll.exe 97 PID 512 wrote to memory of 2804 512 xlllfll.exe 97 PID 2804 wrote to memory of 1104 2804 nhtnnn.exe 98 PID 2804 wrote to memory of 1104 2804 nhtnnn.exe 98 PID 2804 wrote to memory of 1104 2804 nhtnnn.exe 98 PID 1104 wrote to memory of 1528 1104 ddvpj.exe 99 PID 1104 wrote to memory of 1528 1104 ddvpj.exe 99 PID 1104 wrote to memory of 1528 1104 ddvpj.exe 99 PID 1528 wrote to memory of 1064 1528 jpppj.exe 100 PID 1528 wrote to memory of 1064 1528 jpppj.exe 100 PID 1528 wrote to memory of 1064 1528 jpppj.exe 100 PID 1064 wrote to memory of 5072 1064 9rrrlfx.exe 101 PID 1064 wrote to memory of 5072 1064 9rrrlfx.exe 101 PID 1064 wrote to memory of 5072 1064 9rrrlfx.exe 101 PID 5072 wrote to memory of 756 5072 btthbb.exe 102 PID 5072 wrote to memory of 756 5072 btthbb.exe 102 PID 5072 wrote to memory of 756 5072 btthbb.exe 102 PID 756 wrote to memory of 4584 756 rrrrrxx.exe 103 PID 756 wrote to memory of 4584 756 rrrrrxx.exe 103 PID 756 wrote to memory of 4584 756 rrrrrxx.exe 103 PID 4584 wrote to memory of 1672 4584 tbttnn.exe 104 PID 4584 wrote to memory of 1672 4584 tbttnn.exe 104 PID 4584 wrote to memory of 1672 4584 tbttnn.exe 104 PID 1672 wrote to memory of 384 1672 ppjdd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\llxxrff.exec:\llxxrff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\bntnnt.exec:\bntnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\bbntbb.exec:\bbntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\xlrllll.exec:\xlrllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\hnthnn.exec:\hnthnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\5vvvv.exec:\5vvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\vjpjd.exec:\vjpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\vddvj.exec:\vddvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\ffffxff.exec:\ffffxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\bthbtt.exec:\bthbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xlllfll.exec:\xlllfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\nhtnnn.exec:\nhtnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\ddvpj.exec:\ddvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\jpppj.exec:\jpppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\9rrrlfx.exec:\9rrrlfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\btthbb.exec:\btthbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\tbttnn.exec:\tbttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\ppjdd.exec:\ppjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\rllfxxl.exec:\rllfxxl.exe23⤵
- Executes dropped EXE
PID:384 -
\??\c:\bbnttt.exec:\bbnttt.exe24⤵
- Executes dropped EXE
PID:3672 -
\??\c:\dvddd.exec:\dvddd.exe25⤵
- Executes dropped EXE
PID:4056 -
\??\c:\rlxxffl.exec:\rlxxffl.exe26⤵
- Executes dropped EXE
PID:4756 -
\??\c:\frfxxxx.exec:\frfxxxx.exe27⤵
- Executes dropped EXE
PID:1644 -
\??\c:\9vpjd.exec:\9vpjd.exe28⤵
- Executes dropped EXE
PID:444 -
\??\c:\frrlfxr.exec:\frrlfxr.exe29⤵
- Executes dropped EXE
PID:2876 -
\??\c:\fxlxfxf.exec:\fxlxfxf.exe30⤵
- Executes dropped EXE
PID:3148 -
\??\c:\bbbtnh.exec:\bbbtnh.exe31⤵
- Executes dropped EXE
PID:3540 -
\??\c:\jppjv.exec:\jppjv.exe32⤵
- Executes dropped EXE
PID:4696 -
\??\c:\fxlxrrr.exec:\fxlxrrr.exe33⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nbhbhb.exec:\nbhbhb.exe34⤵
- Executes dropped EXE
PID:4048 -
\??\c:\hhhbnn.exec:\hhhbnn.exe35⤵
- Executes dropped EXE
PID:4036 -
\??\c:\vddpd.exec:\vddpd.exe36⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rlfxrxr.exec:\rlfxrxr.exe37⤵
- Executes dropped EXE
PID:1252 -
\??\c:\bnthtt.exec:\bnthtt.exe38⤵
- Executes dropped EXE
PID:880 -
\??\c:\pvjjd.exec:\pvjjd.exe39⤵
- Executes dropped EXE
PID:3880 -
\??\c:\bbbbbt.exec:\bbbbbt.exe40⤵
- Executes dropped EXE
PID:4228 -
\??\c:\pvvvd.exec:\pvvvd.exe41⤵
- Executes dropped EXE
PID:1164 -
\??\c:\lffxrrf.exec:\lffxrrf.exe42⤵
- Executes dropped EXE
PID:3860 -
\??\c:\xffxrll.exec:\xffxrll.exe43⤵
- Executes dropped EXE
PID:4740 -
\??\c:\nnnhbn.exec:\nnnhbn.exe44⤵PID:4620
-
\??\c:\5jpjp.exec:\5jpjp.exe45⤵
- Executes dropped EXE
PID:972 -
\??\c:\lxffxxx.exec:\lxffxxx.exe46⤵
- Executes dropped EXE
PID:3660 -
\??\c:\bttnhh.exec:\bttnhh.exe47⤵
- Executes dropped EXE
PID:3456 -
\??\c:\7jdpd.exec:\7jdpd.exe48⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rrfrxxx.exec:\rrfrxxx.exe49⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7nthhn.exec:\7nthhn.exe50⤵
- Executes dropped EXE
PID:1804 -
\??\c:\bbbtth.exec:\bbbtth.exe51⤵
- Executes dropped EXE
PID:428 -
\??\c:\djpdp.exec:\djpdp.exe52⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vjdvj.exec:\vjdvj.exe53⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rlxrlff.exec:\rlxrlff.exe54⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lffrxxr.exec:\lffrxxr.exe55⤵
- Executes dropped EXE
PID:1108 -
\??\c:\3ttthb.exec:\3ttthb.exe56⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lfrfrlf.exec:\lfrfrlf.exe57⤵
- Executes dropped EXE
PID:1140 -
\??\c:\xffrlfx.exec:\xffrlfx.exe58⤵
- Executes dropped EXE
PID:3532 -
\??\c:\nnbnhb.exec:\nnbnhb.exe59⤵
- Executes dropped EXE
PID:4728 -
\??\c:\1pvjp.exec:\1pvjp.exe60⤵
- Executes dropped EXE
PID:3080 -
\??\c:\lxxrffr.exec:\lxxrffr.exe61⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fxxrfxl.exec:\fxxrfxl.exe62⤵
- Executes dropped EXE
PID:1412 -
\??\c:\thnhtt.exec:\thnhtt.exe63⤵
- Executes dropped EXE
PID:4968 -
\??\c:\jjpjj.exec:\jjpjj.exe64⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9dvjv.exec:\9dvjv.exe65⤵
- Executes dropped EXE
PID:3920 -
\??\c:\1lrfrrf.exec:\1lrfrrf.exe66⤵
- Executes dropped EXE
PID:4980 -
\??\c:\htthbt.exec:\htthbt.exe67⤵PID:3676
-
\??\c:\hbthtn.exec:\hbthtn.exe68⤵PID:3108
-
\??\c:\jdvjp.exec:\jdvjp.exe69⤵PID:4792
-
\??\c:\9vpjp.exec:\9vpjp.exe70⤵PID:3172
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe71⤵PID:2868
-
\??\c:\htnhbt.exec:\htnhbt.exe72⤵PID:4720
-
\??\c:\htbthb.exec:\htbthb.exe73⤵PID:1424
-
\??\c:\vddvp.exec:\vddvp.exe74⤵PID:1356
-
\??\c:\jvvjd.exec:\jvvjd.exe75⤵PID:1836
-
\??\c:\xfrlrrl.exec:\xfrlrrl.exe76⤵PID:3572
-
\??\c:\flffrxr.exec:\flffrxr.exe77⤵PID:1264
-
\??\c:\1tbnnn.exec:\1tbnnn.exe78⤵PID:4532
-
\??\c:\jpjdv.exec:\jpjdv.exe79⤵PID:4148
-
\??\c:\rxrlffx.exec:\rxrlffx.exe80⤵PID:4160
-
\??\c:\tttbtt.exec:\tttbtt.exe81⤵PID:5108
-
\??\c:\9ppdp.exec:\9ppdp.exe82⤵PID:2876
-
\??\c:\vjppj.exec:\vjppj.exe83⤵PID:636
-
\??\c:\1fxrlrr.exec:\1fxrlrr.exe84⤵PID:4812
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe85⤵PID:3432
-
\??\c:\btnhtn.exec:\btnhtn.exe86⤵PID:1548
-
\??\c:\nnbnbt.exec:\nnbnbt.exe87⤵PID:3588
-
\??\c:\dpvjp.exec:\dpvjp.exe88⤵PID:3632
-
\??\c:\jppdp.exec:\jppdp.exe89⤵PID:2772
-
\??\c:\xlffxfx.exec:\xlffxfx.exe90⤵PID:4672
-
\??\c:\nhbnbt.exec:\nhbnbt.exe91⤵PID:3104
-
\??\c:\bntntn.exec:\bntntn.exe92⤵PID:4952
-
\??\c:\9ppvp.exec:\9ppvp.exe93⤵PID:116
-
\??\c:\dvjjv.exec:\dvjjv.exe94⤵PID:4228
-
\??\c:\9xxxrrr.exec:\9xxxrrr.exe95⤵PID:1084
-
\??\c:\nbbbtt.exec:\nbbbtt.exe96⤵PID:2844
-
\??\c:\nbtntn.exec:\nbtntn.exe97⤵PID:3644
-
\??\c:\vddpj.exec:\vddpj.exe98⤵PID:4216
-
\??\c:\vvvpd.exec:\vvvpd.exe99⤵PID:4316
-
\??\c:\rxxxrlf.exec:\rxxxrlf.exe100⤵PID:5084
-
\??\c:\tnbttn.exec:\tnbttn.exe101⤵PID:3492
-
\??\c:\vjvpj.exec:\vjvpj.exe102⤵PID:3296
-
\??\c:\1dpjp.exec:\1dpjp.exe103⤵PID:4808
-
\??\c:\fxfrxrx.exec:\fxfrxrx.exe104⤵PID:1968
-
\??\c:\htnhbt.exec:\htnhbt.exe105⤵PID:428
-
\??\c:\3llfxrf.exec:\3llfxrf.exe106⤵PID:2928
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe107⤵PID:1200
-
\??\c:\tbtnbb.exec:\tbtnbb.exe108⤵PID:1976
-
\??\c:\1hntnn.exec:\1hntnn.exe109⤵PID:1536
-
\??\c:\ppvjv.exec:\ppvjv.exe110⤵PID:3144
-
\??\c:\rflxrrf.exec:\rflxrrf.exe111⤵PID:4608
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe112⤵PID:1988
-
\??\c:\ntbnhb.exec:\ntbnhb.exe113⤵PID:2168
-
\??\c:\dvvpv.exec:\dvvpv.exe114⤵PID:4664
-
\??\c:\jpjvp.exec:\jpjvp.exe115⤵PID:2800
-
\??\c:\lfxlfxx.exec:\lfxlfxx.exe116⤵PID:3000
-
\??\c:\xffrflf.exec:\xffrflf.exe117⤵PID:4180
-
\??\c:\rllfrrl.exec:\rllfrrl.exe118⤵PID:3368
-
\??\c:\nttnbb.exec:\nttnbb.exe119⤵PID:2848
-
\??\c:\jvvvv.exec:\jvvvv.exe120⤵PID:2140
-
\??\c:\jpvjv.exec:\jpvjv.exe121⤵PID:1148
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe122⤵PID:1716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-