Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe
-
Size
206KB
-
MD5
0f94d45ab5800f079ea8e6e1e4db5500
-
SHA1
0f00c10756732e71d0aaedefcb2cf0f6367426f9
-
SHA256
e451fda26406ceef6f017b3e414317049e478002b9a58604a7272a083dd96ac9
-
SHA512
dd6853f08208c72b0d580b8e7319949bcc31fe402129f94367effb4c8ef27b900027f53b028ea9d0698b4691e522d9d52d295745044526cfd5d14cc2d58372ef
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6TQpCihyo:PhOm2sI93UufdC67ciJTU2HVS64hyo
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4708-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-365-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-411-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-418-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-454-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-481-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-490-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-503-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-536-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-572-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-579-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-631-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-781-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-893-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-921-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-928-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-983-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4588 rxfxllf.exe 4420 tntnhb.exe 1984 hbttbb.exe 4808 9xffxxf.exe 464 ntbbbb.exe 2184 dvdvv.exe 1916 rxxrrff.exe 732 jpvjd.exe 228 rfrlrxr.exe 1360 httnhh.exe 1332 vjjdd.exe 4000 lxffxxx.exe 4852 ntttnt.exe 1704 1dpjj.exe 4328 hhhbhn.exe 3324 nbhbnn.exe 5004 pjpjd.exe 1272 lxrfxfx.exe 3164 nbbnhh.exe 4516 djpvv.exe 4680 lrlllxr.exe 3028 nbhbbn.exe 1992 lxfxrrl.exe 3320 htttnh.exe 516 dvvvd.exe 3644 9hbttt.exe 3300 tnnhbb.exe 2060 pvppd.exe 2036 vdjdd.exe 3876 nbhbtn.exe 4908 ddddj.exe 2948 ppjjd.exe 836 lllxlrx.exe 1964 ddvvp.exe 2808 rlxflll.exe 4064 rrfxrrr.exe 3232 5hhhbh.exe 3896 rrfxxxl.exe 4108 fxlxfff.exe 3580 hnbttt.exe 4336 bbhbnn.exe 2928 3djjd.exe 2272 lxfxrrl.exe 1556 1rxrxfl.exe 720 hhtnnn.exe 1248 jvddv.exe 1816 3rxxrxr.exe 4356 tbbbbt.exe 908 thnhbb.exe 380 vvpdv.exe 2404 lrxrxlr.exe 2452 xffxfxx.exe 1544 bhhhbb.exe 3944 nhbhbh.exe 5008 dddvp.exe 3032 rfllffx.exe 3196 flxlffr.exe 4676 hhtttt.exe 1332 3nnnhb.exe 3928 vddjv.exe 4984 9rfxffl.exe 1616 tbhhnt.exe 2164 btnnnt.exe 3772 vvvpp.exe -
resource yara_rule behavioral2/memory/4708-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-326-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-365-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-411-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-418-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-454-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-467-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-481-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-490-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-503-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4708 wrote to memory of 4588 4708 0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe 81 PID 4708 wrote to memory of 4588 4708 0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe 81 PID 4708 wrote to memory of 4588 4708 0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe 81 PID 4588 wrote to memory of 4420 4588 rxfxllf.exe 82 PID 4588 wrote to memory of 4420 4588 rxfxllf.exe 82 PID 4588 wrote to memory of 4420 4588 rxfxllf.exe 82 PID 4420 wrote to memory of 1984 4420 tntnhb.exe 83 PID 4420 wrote to memory of 1984 4420 tntnhb.exe 83 PID 4420 wrote to memory of 1984 4420 tntnhb.exe 83 PID 1984 wrote to memory of 4808 1984 hbttbb.exe 84 PID 1984 wrote to memory of 4808 1984 hbttbb.exe 84 PID 1984 wrote to memory of 4808 1984 hbttbb.exe 84 PID 4808 wrote to memory of 464 4808 9xffxxf.exe 86 PID 4808 wrote to memory of 464 4808 9xffxxf.exe 86 PID 4808 wrote to memory of 464 4808 9xffxxf.exe 86 PID 464 wrote to memory of 2184 464 ntbbbb.exe 87 PID 464 wrote to memory of 2184 464 ntbbbb.exe 87 PID 464 wrote to memory of 2184 464 ntbbbb.exe 87 PID 2184 wrote to memory of 1916 2184 dvdvv.exe 88 PID 2184 wrote to memory of 1916 2184 dvdvv.exe 88 PID 2184 wrote to memory of 1916 2184 dvdvv.exe 88 PID 1916 wrote to memory of 732 1916 rxxrrff.exe 89 PID 1916 wrote to memory of 732 1916 rxxrrff.exe 89 PID 1916 wrote to memory of 732 1916 rxxrrff.exe 89 PID 732 wrote to memory of 228 732 jpvjd.exe 91 PID 732 wrote to memory of 228 732 jpvjd.exe 91 PID 732 wrote to memory of 228 732 jpvjd.exe 91 PID 228 wrote to memory of 1360 228 rfrlrxr.exe 92 PID 228 wrote to memory of 1360 228 rfrlrxr.exe 92 PID 228 wrote to memory of 1360 228 rfrlrxr.exe 92 PID 1360 wrote to memory of 1332 1360 httnhh.exe 93 PID 1360 wrote to memory of 1332 1360 httnhh.exe 93 PID 1360 wrote to memory of 1332 1360 httnhh.exe 93 PID 1332 wrote to memory of 4000 1332 vjjdd.exe 94 PID 1332 wrote to memory of 4000 1332 vjjdd.exe 94 PID 1332 wrote to memory of 4000 1332 vjjdd.exe 94 PID 4000 wrote to memory of 4852 4000 lxffxxx.exe 95 PID 4000 wrote to memory of 4852 4000 lxffxxx.exe 95 PID 4000 wrote to memory of 4852 4000 lxffxxx.exe 95 PID 4852 wrote to memory of 1704 4852 ntttnt.exe 97 PID 4852 wrote to memory of 1704 4852 ntttnt.exe 97 PID 4852 wrote to memory of 1704 4852 ntttnt.exe 97 PID 1704 wrote to memory of 4328 1704 1dpjj.exe 98 PID 1704 wrote to memory of 4328 1704 1dpjj.exe 98 PID 1704 wrote to memory of 4328 1704 1dpjj.exe 98 PID 4328 wrote to memory of 3324 4328 hhhbhn.exe 99 PID 4328 wrote to memory of 3324 4328 hhhbhn.exe 99 PID 4328 wrote to memory of 3324 4328 hhhbhn.exe 99 PID 3324 wrote to memory of 5004 3324 nbhbnn.exe 100 PID 3324 wrote to memory of 5004 3324 nbhbnn.exe 100 PID 3324 wrote to memory of 5004 3324 nbhbnn.exe 100 PID 5004 wrote to memory of 1272 5004 pjpjd.exe 102 PID 5004 wrote to memory of 1272 5004 pjpjd.exe 102 PID 5004 wrote to memory of 1272 5004 pjpjd.exe 102 PID 1272 wrote to memory of 3164 1272 lxrfxfx.exe 103 PID 1272 wrote to memory of 3164 1272 lxrfxfx.exe 103 PID 1272 wrote to memory of 3164 1272 lxrfxfx.exe 103 PID 3164 wrote to memory of 4516 3164 nbbnhh.exe 104 PID 3164 wrote to memory of 4516 3164 nbbnhh.exe 104 PID 3164 wrote to memory of 4516 3164 nbbnhh.exe 104 PID 4516 wrote to memory of 4680 4516 djpvv.exe 105 PID 4516 wrote to memory of 4680 4516 djpvv.exe 105 PID 4516 wrote to memory of 4680 4516 djpvv.exe 105 PID 4680 wrote to memory of 3028 4680 lrlllxr.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f94d45ab5800f079ea8e6e1e4db5500_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\rxfxllf.exec:\rxfxllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\tntnhb.exec:\tntnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\hbttbb.exec:\hbttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\9xffxxf.exec:\9xffxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\ntbbbb.exec:\ntbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\dvdvv.exec:\dvdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\rxxrrff.exec:\rxxrrff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\jpvjd.exec:\jpvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\rfrlrxr.exec:\rfrlrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\httnhh.exec:\httnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\vjjdd.exec:\vjjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\lxffxxx.exec:\lxffxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\ntttnt.exec:\ntttnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\1dpjj.exec:\1dpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\hhhbhn.exec:\hhhbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\nbhbnn.exec:\nbhbnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\pjpjd.exec:\pjpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\lxrfxfx.exec:\lxrfxfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\nbbnhh.exec:\nbbnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\djpvv.exec:\djpvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\lrlllxr.exec:\lrlllxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\nbhbbn.exec:\nbhbbn.exe23⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe24⤵
- Executes dropped EXE
PID:1992 -
\??\c:\htttnh.exec:\htttnh.exe25⤵
- Executes dropped EXE
PID:3320 -
\??\c:\dvvvd.exec:\dvvvd.exe26⤵
- Executes dropped EXE
PID:516 -
\??\c:\9hbttt.exec:\9hbttt.exe27⤵
- Executes dropped EXE
PID:3644 -
\??\c:\tnnhbb.exec:\tnnhbb.exe28⤵
- Executes dropped EXE
PID:3300 -
\??\c:\pvppd.exec:\pvppd.exe29⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vdjdd.exec:\vdjdd.exe30⤵
- Executes dropped EXE
PID:2036 -
\??\c:\nbhbtn.exec:\nbhbtn.exe31⤵
- Executes dropped EXE
PID:3876 -
\??\c:\ddddj.exec:\ddddj.exe32⤵
- Executes dropped EXE
PID:4908 -
\??\c:\ppjjd.exec:\ppjjd.exe33⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lllxlrx.exec:\lllxlrx.exe34⤵
- Executes dropped EXE
PID:836 -
\??\c:\ddvvp.exec:\ddvvp.exe35⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rlxflll.exec:\rlxflll.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe37⤵
- Executes dropped EXE
PID:4064 -
\??\c:\5hhhbh.exec:\5hhhbh.exe38⤵
- Executes dropped EXE
PID:3232 -
\??\c:\rrfxxxl.exec:\rrfxxxl.exe39⤵
- Executes dropped EXE
PID:3896 -
\??\c:\fxlxfff.exec:\fxlxfff.exe40⤵
- Executes dropped EXE
PID:4108 -
\??\c:\hnbttt.exec:\hnbttt.exe41⤵
- Executes dropped EXE
PID:3580 -
\??\c:\bbhbnn.exec:\bbhbnn.exe42⤵
- Executes dropped EXE
PID:4336 -
\??\c:\3djjd.exec:\3djjd.exe43⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe44⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1rxrxfl.exec:\1rxrxfl.exe45⤵
- Executes dropped EXE
PID:1556 -
\??\c:\hhtnnn.exec:\hhtnnn.exe46⤵
- Executes dropped EXE
PID:720 -
\??\c:\jvddv.exec:\jvddv.exe47⤵
- Executes dropped EXE
PID:1248 -
\??\c:\3rxxrxr.exec:\3rxxrxr.exe48⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tbbbbt.exec:\tbbbbt.exe49⤵
- Executes dropped EXE
PID:4356 -
\??\c:\thnhbb.exec:\thnhbb.exe50⤵
- Executes dropped EXE
PID:908 -
\??\c:\vvpdv.exec:\vvpdv.exe51⤵
- Executes dropped EXE
PID:380 -
\??\c:\lrxrxlr.exec:\lrxrxlr.exe52⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xffxfxx.exec:\xffxfxx.exe53⤵
- Executes dropped EXE
PID:2452 -
\??\c:\bhhhbb.exec:\bhhhbb.exe54⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nhbhbh.exec:\nhbhbh.exe55⤵
- Executes dropped EXE
PID:3944 -
\??\c:\dddvp.exec:\dddvp.exe56⤵
- Executes dropped EXE
PID:5008 -
\??\c:\rfllffx.exec:\rfllffx.exe57⤵
- Executes dropped EXE
PID:3032 -
\??\c:\flxlffr.exec:\flxlffr.exe58⤵
- Executes dropped EXE
PID:3196 -
\??\c:\hhtttt.exec:\hhtttt.exe59⤵
- Executes dropped EXE
PID:4676 -
\??\c:\3nnnhb.exec:\3nnnhb.exe60⤵
- Executes dropped EXE
PID:1332 -
\??\c:\vddjv.exec:\vddjv.exe61⤵
- Executes dropped EXE
PID:3928 -
\??\c:\9rfxffl.exec:\9rfxffl.exe62⤵
- Executes dropped EXE
PID:4984 -
\??\c:\tbhhnt.exec:\tbhhnt.exe63⤵
- Executes dropped EXE
PID:1616 -
\??\c:\btnnnt.exec:\btnnnt.exe64⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vvvpp.exec:\vvvpp.exe65⤵
- Executes dropped EXE
PID:3772 -
\??\c:\xrrlrrr.exec:\xrrlrrr.exe66⤵PID:1268
-
\??\c:\rflxxxr.exec:\rflxxxr.exe67⤵PID:1352
-
\??\c:\thnnhn.exec:\thnnhn.exe68⤵PID:3784
-
\??\c:\jjjdd.exec:\jjjdd.exe69⤵PID:1736
-
\??\c:\pdpjp.exec:\pdpjp.exe70⤵PID:4492
-
\??\c:\3rllxxr.exec:\3rllxxr.exe71⤵PID:3164
-
\??\c:\xflffff.exec:\xflffff.exe72⤵PID:4784
-
\??\c:\btbttn.exec:\btbttn.exe73⤵PID:4868
-
\??\c:\bhbthh.exec:\bhbthh.exe74⤵PID:1016
-
\??\c:\pdjdv.exec:\pdjdv.exe75⤵PID:2352
-
\??\c:\dvpjd.exec:\dvpjd.exe76⤵PID:712
-
\??\c:\7xfxrlf.exec:\7xfxrlf.exe77⤵PID:1764
-
\??\c:\fffxrrl.exec:\fffxrrl.exe78⤵PID:1848
-
\??\c:\jpjdv.exec:\jpjdv.exe79⤵PID:3320
-
\??\c:\dpvpp.exec:\dpvpp.exe80⤵PID:4668
-
\??\c:\xllfxfx.exec:\xllfxfx.exe81⤵PID:1260
-
\??\c:\nnhnnn.exec:\nnhnnn.exe82⤵PID:3644
-
\??\c:\btbnnn.exec:\btbnnn.exe83⤵PID:2724
-
\??\c:\dpvvp.exec:\dpvvp.exe84⤵PID:4084
-
\??\c:\xflfxxf.exec:\xflfxxf.exe85⤵PID:1472
-
\??\c:\1bbthh.exec:\1bbthh.exe86⤵PID:4692
-
\??\c:\tbhbtt.exec:\tbhbtt.exe87⤵PID:3816
-
\??\c:\vpdvv.exec:\vpdvv.exe88⤵PID:4908
-
\??\c:\3djvp.exec:\3djvp.exe89⤵PID:4088
-
\??\c:\fxxrffx.exec:\fxxrffx.exe90⤵PID:5076
-
\??\c:\bnttbn.exec:\bnttbn.exe91⤵PID:1888
-
\??\c:\jvvpj.exec:\jvvpj.exe92⤵PID:2912
-
\??\c:\3fllxxx.exec:\3fllxxx.exe93⤵PID:4004
-
\??\c:\9lrlrxf.exec:\9lrlrxf.exe94⤵PID:1400
-
\??\c:\nthbtt.exec:\nthbtt.exe95⤵PID:3232
-
\??\c:\hhttnn.exec:\hhttnn.exe96⤵PID:5080
-
\??\c:\dvpjj.exec:\dvpjj.exe97⤵PID:4332
-
\??\c:\xrfrfrr.exec:\xrfrfrr.exe98⤵PID:4336
-
\??\c:\9hnhbb.exec:\9hnhbb.exe99⤵PID:4288
-
\??\c:\hbtnhh.exec:\hbtnhh.exe100⤵PID:4416
-
\??\c:\dppjv.exec:\dppjv.exe101⤵PID:5064
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe102⤵PID:4324
-
\??\c:\xxxrlrf.exec:\xxxrlrf.exe103⤵PID:4932
-
\??\c:\nntnbb.exec:\nntnbb.exe104⤵PID:452
-
\??\c:\pjddv.exec:\pjddv.exe105⤵PID:1184
-
\??\c:\dpvpj.exec:\dpvpj.exe106⤵PID:1972
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe107⤵PID:4272
-
\??\c:\hbbttt.exec:\hbbttt.exe108⤵PID:3024
-
\??\c:\hbtbht.exec:\hbtbht.exe109⤵PID:732
-
\??\c:\vjddv.exec:\vjddv.exe110⤵PID:3840
-
\??\c:\vdjvd.exec:\vdjvd.exe111⤵PID:1980
-
\??\c:\1frlxxr.exec:\1frlxxr.exe112⤵PID:3212
-
\??\c:\9tbhhb.exec:\9tbhhb.exe113⤵PID:1360
-
\??\c:\btnhhh.exec:\btnhhh.exe114⤵PID:3196
-
\??\c:\dppjj.exec:\dppjj.exe115⤵PID:4372
-
\??\c:\vppjd.exec:\vppjd.exe116⤵PID:4052
-
\??\c:\flrrrrr.exec:\flrrrrr.exe117⤵PID:3612
-
\??\c:\tthbhh.exec:\tthbhh.exe118⤵PID:5056
-
\??\c:\7tthtt.exec:\7tthtt.exe119⤵PID:4900
-
\??\c:\djpvd.exec:\djpvd.exe120⤵PID:4128
-
\??\c:\pdvpd.exec:\pdvpd.exe121⤵PID:4328
-
\??\c:\flfxxxr.exec:\flfxxxr.exe122⤵PID:5116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-