Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 11:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe
-
Size
521KB
-
MD5
100ffadba5aaf071814b14f9d8674a00
-
SHA1
5552cf5680cb7a3c6230b6864d6c5e47478aa6e6
-
SHA256
d2cc2f875c6c7190ae3d0bccc96cfc394d57be89e8517d57f78b7373827e22a1
-
SHA512
aec74afd0256c3c0b30024e41d567d940462123ebf01ae47488ee798d1006b0db110dc3c44d2051bb9d1030872d8c6e4bf10aef64b584a0bb3746c5006f57cbf
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H3r:q7Tc2NYHUrAwfMHNnpls4897
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2636-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/568-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-811-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-959-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1232 hbtbnh.exe 3160 7lrlfxr.exe 2912 2824208.exe 4680 1bhnbt.exe 1880 djjjd.exe 3500 2282226.exe 2460 bnbnnn.exe 1524 3bnhhh.exe 4176 s4660.exe 3196 nhnhhh.exe 1424 c804822.exe 3496 200882.exe 1872 860000.exe 3664 44004.exe 2208 jvvpj.exe 748 680444.exe 1940 8420000.exe 1900 lfffxxx.exe 2860 nbnnhb.exe 4112 5bbhhh.exe 2176 7rfxflx.exe 3652 028226.exe 2892 8226224.exe 3412 648860.exe 568 0448260.exe 3340 3xxrlll.exe 1128 0060444.exe 4660 1tnnnn.exe 1456 dvjjj.exe 2308 28882.exe 1860 2246060.exe 3704 0244822.exe 1020 0026666.exe 4940 pvjpj.exe 1160 k84886.exe 4356 5pjjd.exe 384 o460606.exe 2276 lffxrxl.exe 4172 62448.exe 3620 pvjjd.exe 4584 lxrllrr.exe 4688 lrrrrrr.exe 5072 m0848.exe 4700 1nnhhh.exe 396 66882.exe 3820 m0266.exe 3040 9hhbhh.exe 388 bthbhn.exe 3744 lffxfff.exe 4296 q88260.exe 3956 60664.exe 3480 thhtbt.exe 2808 268484.exe 1996 jjpjd.exe 1832 nbttnt.exe 3932 tnhbtb.exe 640 lflrffr.exe 1244 lfrlxfx.exe 1648 9vjjv.exe 4684 ddjjd.exe 1596 o008260.exe 1396 vdddv.exe 1936 26842.exe 3192 flrlffx.exe -
resource yara_rule behavioral2/memory/2636-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/568-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-659-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 1232 2636 100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe 80 PID 2636 wrote to memory of 1232 2636 100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe 80 PID 2636 wrote to memory of 1232 2636 100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe 80 PID 1232 wrote to memory of 3160 1232 hbtbnh.exe 81 PID 1232 wrote to memory of 3160 1232 hbtbnh.exe 81 PID 1232 wrote to memory of 3160 1232 hbtbnh.exe 81 PID 3160 wrote to memory of 2912 3160 7lrlfxr.exe 82 PID 3160 wrote to memory of 2912 3160 7lrlfxr.exe 82 PID 3160 wrote to memory of 2912 3160 7lrlfxr.exe 82 PID 2912 wrote to memory of 4680 2912 2824208.exe 83 PID 2912 wrote to memory of 4680 2912 2824208.exe 83 PID 2912 wrote to memory of 4680 2912 2824208.exe 83 PID 4680 wrote to memory of 1880 4680 1bhnbt.exe 84 PID 4680 wrote to memory of 1880 4680 1bhnbt.exe 84 PID 4680 wrote to memory of 1880 4680 1bhnbt.exe 84 PID 1880 wrote to memory of 3500 1880 djjjd.exe 85 PID 1880 wrote to memory of 3500 1880 djjjd.exe 85 PID 1880 wrote to memory of 3500 1880 djjjd.exe 85 PID 3500 wrote to memory of 2460 3500 2282226.exe 86 PID 3500 wrote to memory of 2460 3500 2282226.exe 86 PID 3500 wrote to memory of 2460 3500 2282226.exe 86 PID 2460 wrote to memory of 1524 2460 bnbnnn.exe 87 PID 2460 wrote to memory of 1524 2460 bnbnnn.exe 87 PID 2460 wrote to memory of 1524 2460 bnbnnn.exe 87 PID 1524 wrote to memory of 4176 1524 3bnhhh.exe 88 PID 1524 wrote to memory of 4176 1524 3bnhhh.exe 88 PID 1524 wrote to memory of 4176 1524 3bnhhh.exe 88 PID 4176 wrote to memory of 3196 4176 s4660.exe 89 PID 4176 wrote to memory of 3196 4176 s4660.exe 89 PID 4176 wrote to memory of 3196 4176 s4660.exe 89 PID 3196 wrote to memory of 1424 3196 nhnhhh.exe 152 PID 3196 wrote to memory of 1424 3196 nhnhhh.exe 152 PID 3196 wrote to memory of 1424 3196 nhnhhh.exe 152 PID 1424 wrote to memory of 3496 1424 c804822.exe 91 PID 1424 wrote to memory of 3496 1424 c804822.exe 91 PID 1424 wrote to memory of 3496 1424 c804822.exe 91 PID 3496 wrote to memory of 1872 3496 200882.exe 92 PID 3496 wrote to memory of 1872 3496 200882.exe 92 PID 3496 wrote to memory of 1872 3496 200882.exe 92 PID 1872 wrote to memory of 3664 1872 860000.exe 93 PID 1872 wrote to memory of 3664 1872 860000.exe 93 PID 1872 wrote to memory of 3664 1872 860000.exe 93 PID 3664 wrote to memory of 2208 3664 44004.exe 94 PID 3664 wrote to memory of 2208 3664 44004.exe 94 PID 3664 wrote to memory of 2208 3664 44004.exe 94 PID 2208 wrote to memory of 748 2208 jvvpj.exe 95 PID 2208 wrote to memory of 748 2208 jvvpj.exe 95 PID 2208 wrote to memory of 748 2208 jvvpj.exe 95 PID 748 wrote to memory of 1940 748 680444.exe 96 PID 748 wrote to memory of 1940 748 680444.exe 96 PID 748 wrote to memory of 1940 748 680444.exe 96 PID 1940 wrote to memory of 1900 1940 8420000.exe 97 PID 1940 wrote to memory of 1900 1940 8420000.exe 97 PID 1940 wrote to memory of 1900 1940 8420000.exe 97 PID 1900 wrote to memory of 2860 1900 lfffxxx.exe 98 PID 1900 wrote to memory of 2860 1900 lfffxxx.exe 98 PID 1900 wrote to memory of 2860 1900 lfffxxx.exe 98 PID 2860 wrote to memory of 4112 2860 nbnnhb.exe 99 PID 2860 wrote to memory of 4112 2860 nbnnhb.exe 99 PID 2860 wrote to memory of 4112 2860 nbnnhb.exe 99 PID 4112 wrote to memory of 2176 4112 5bbhhh.exe 100 PID 4112 wrote to memory of 2176 4112 5bbhhh.exe 100 PID 4112 wrote to memory of 2176 4112 5bbhhh.exe 100 PID 2176 wrote to memory of 3652 2176 7rfxflx.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\hbtbnh.exec:\hbtbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\7lrlfxr.exec:\7lrlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\2824208.exec:\2824208.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\1bhnbt.exec:\1bhnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\djjjd.exec:\djjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\2282226.exec:\2282226.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\bnbnnn.exec:\bnbnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\3bnhhh.exec:\3bnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\s4660.exec:\s4660.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\nhnhhh.exec:\nhnhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\c804822.exec:\c804822.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\200882.exec:\200882.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\860000.exec:\860000.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\44004.exec:\44004.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\jvvpj.exec:\jvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\680444.exec:\680444.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\8420000.exec:\8420000.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\lfffxxx.exec:\lfffxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\nbnnhb.exec:\nbnnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\5bbhhh.exec:\5bbhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\7rfxflx.exec:\7rfxflx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\028226.exec:\028226.exe23⤵
- Executes dropped EXE
PID:3652 -
\??\c:\8226224.exec:\8226224.exe24⤵
- Executes dropped EXE
PID:2892 -
\??\c:\648860.exec:\648860.exe25⤵
- Executes dropped EXE
PID:3412 -
\??\c:\0448260.exec:\0448260.exe26⤵
- Executes dropped EXE
PID:568 -
\??\c:\3xxrlll.exec:\3xxrlll.exe27⤵
- Executes dropped EXE
PID:3340 -
\??\c:\0060444.exec:\0060444.exe28⤵
- Executes dropped EXE
PID:1128 -
\??\c:\1tnnnn.exec:\1tnnnn.exe29⤵
- Executes dropped EXE
PID:4660 -
\??\c:\dvjjj.exec:\dvjjj.exe30⤵
- Executes dropped EXE
PID:1456 -
\??\c:\28882.exec:\28882.exe31⤵
- Executes dropped EXE
PID:2308 -
\??\c:\2246060.exec:\2246060.exe32⤵
- Executes dropped EXE
PID:1860 -
\??\c:\0244822.exec:\0244822.exe33⤵
- Executes dropped EXE
PID:3704 -
\??\c:\0026666.exec:\0026666.exe34⤵
- Executes dropped EXE
PID:1020 -
\??\c:\pvjpj.exec:\pvjpj.exe35⤵
- Executes dropped EXE
PID:4940 -
\??\c:\k84886.exec:\k84886.exe36⤵
- Executes dropped EXE
PID:1160 -
\??\c:\5pjjd.exec:\5pjjd.exe37⤵
- Executes dropped EXE
PID:4356 -
\??\c:\o460606.exec:\o460606.exe38⤵
- Executes dropped EXE
PID:384 -
\??\c:\lffxrxl.exec:\lffxrxl.exe39⤵
- Executes dropped EXE
PID:2276 -
\??\c:\62448.exec:\62448.exe40⤵
- Executes dropped EXE
PID:4172 -
\??\c:\pvjjd.exec:\pvjjd.exe41⤵
- Executes dropped EXE
PID:3620 -
\??\c:\lxrllrr.exec:\lxrllrr.exe42⤵
- Executes dropped EXE
PID:4584 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe43⤵
- Executes dropped EXE
PID:4688 -
\??\c:\m0848.exec:\m0848.exe44⤵
- Executes dropped EXE
PID:5072 -
\??\c:\1nnhhh.exec:\1nnhhh.exe45⤵
- Executes dropped EXE
PID:4700 -
\??\c:\66882.exec:\66882.exe46⤵
- Executes dropped EXE
PID:396 -
\??\c:\m0266.exec:\m0266.exe47⤵
- Executes dropped EXE
PID:3820 -
\??\c:\9hhbhh.exec:\9hhbhh.exe48⤵
- Executes dropped EXE
PID:3040 -
\??\c:\bthbhn.exec:\bthbhn.exe49⤵
- Executes dropped EXE
PID:388 -
\??\c:\lffxfff.exec:\lffxfff.exe50⤵
- Executes dropped EXE
PID:3744 -
\??\c:\q88260.exec:\q88260.exe51⤵
- Executes dropped EXE
PID:4296 -
\??\c:\60664.exec:\60664.exe52⤵
- Executes dropped EXE
PID:3956 -
\??\c:\thhtbt.exec:\thhtbt.exe53⤵
- Executes dropped EXE
PID:3480 -
\??\c:\268484.exec:\268484.exe54⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jjpjd.exec:\jjpjd.exe55⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nbttnt.exec:\nbttnt.exe56⤵
- Executes dropped EXE
PID:1832 -
\??\c:\tnhbtb.exec:\tnhbtb.exe57⤵
- Executes dropped EXE
PID:3932 -
\??\c:\lflrffr.exec:\lflrffr.exe58⤵
- Executes dropped EXE
PID:640 -
\??\c:\lfrlxfx.exec:\lfrlxfx.exe59⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9vjjv.exec:\9vjjv.exe60⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ddjjd.exec:\ddjjd.exe61⤵
- Executes dropped EXE
PID:4684 -
\??\c:\o008260.exec:\o008260.exe62⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vdddv.exec:\vdddv.exe63⤵
- Executes dropped EXE
PID:1396 -
\??\c:\26842.exec:\26842.exe64⤵
- Executes dropped EXE
PID:1936 -
\??\c:\flrlffx.exec:\flrlffx.exe65⤵
- Executes dropped EXE
PID:3192 -
\??\c:\flrrxrl.exec:\flrrxrl.exe66⤵PID:4496
-
\??\c:\0066062.exec:\0066062.exe67⤵PID:1560
-
\??\c:\vjjvv.exec:\vjjvv.exe68⤵PID:2072
-
\??\c:\dpppj.exec:\dpppj.exe69⤵PID:2488
-
\??\c:\48484.exec:\48484.exe70⤵PID:2612
-
\??\c:\s0200.exec:\s0200.exe71⤵PID:2964
-
\??\c:\jppjj.exec:\jppjj.exe72⤵PID:4984
-
\??\c:\m4848.exec:\m4848.exe73⤵PID:3196
-
\??\c:\tbhnbt.exec:\tbhnbt.exe74⤵PID:1424
-
\??\c:\m8420.exec:\m8420.exe75⤵PID:1740
-
\??\c:\djjvj.exec:\djjvj.exe76⤵PID:3772
-
\??\c:\u664260.exec:\u664260.exe77⤵PID:4092
-
\??\c:\482604.exec:\482604.exe78⤵PID:2968
-
\??\c:\m2866.exec:\m2866.exe79⤵PID:3952
-
\??\c:\82424.exec:\82424.exe80⤵PID:4932
-
\??\c:\rfxxlfx.exec:\rfxxlfx.exe81⤵PID:1616
-
\??\c:\488248.exec:\488248.exe82⤵PID:4012
-
\??\c:\664426.exec:\664426.exe83⤵PID:4244
-
\??\c:\26804.exec:\26804.exe84⤵PID:2828
-
\??\c:\88042.exec:\88042.exe85⤵PID:4792
-
\??\c:\bhbhtn.exec:\bhbhtn.exe86⤵PID:1892
-
\??\c:\802266.exec:\802266.exe87⤵PID:3984
-
\??\c:\88046.exec:\88046.exe88⤵PID:3444
-
\??\c:\llfrllf.exec:\llfrllf.exe89⤵PID:3776
-
\??\c:\o280428.exec:\o280428.exe90⤵PID:3412
-
\??\c:\1nhbtt.exec:\1nhbtt.exe91⤵PID:1164
-
\??\c:\26228.exec:\26228.exe92⤵PID:620
-
\??\c:\djjvv.exec:\djjvv.exe93⤵PID:3244
-
\??\c:\vvpdv.exec:\vvpdv.exe94⤵PID:2868
-
\??\c:\xxlfffl.exec:\xxlfffl.exe95⤵PID:2292
-
\??\c:\hhthbb.exec:\hhthbb.exe96⤵PID:1856
-
\??\c:\pjpjp.exec:\pjpjp.exe97⤵PID:2388
-
\??\c:\6682604.exec:\6682604.exe98⤵PID:384
-
\??\c:\hhhthb.exec:\hhhthb.exe99⤵PID:4600
-
\??\c:\ttbbhh.exec:\ttbbhh.exe100⤵PID:3620
-
\??\c:\248226.exec:\248226.exe101⤵PID:4916
-
\??\c:\42682.exec:\42682.exe102⤵PID:2456
-
\??\c:\llrfxxr.exec:\llrfxxr.exe103⤵PID:3312
-
\??\c:\42688.exec:\42688.exe104⤵PID:2296
-
\??\c:\tnhbbt.exec:\tnhbbt.exe105⤵PID:3820
-
\??\c:\vpvpp.exec:\vpvpp.exe106⤵PID:4788
-
\??\c:\624684.exec:\624684.exe107⤵PID:3740
-
\??\c:\nththb.exec:\nththb.exe108⤵PID:2484
-
\??\c:\26606.exec:\26606.exe109⤵PID:4520
-
\??\c:\a8826.exec:\a8826.exe110⤵PID:1476
-
\??\c:\c686606.exec:\c686606.exe111⤵PID:2548
-
\??\c:\nbhhtn.exec:\nbhhtn.exe112⤵PID:3480
-
\??\c:\jjvpd.exec:\jjvpd.exe113⤵PID:1996
-
\??\c:\88482.exec:\88482.exe114⤵PID:1832
-
\??\c:\jvpdp.exec:\jvpdp.exe115⤵PID:2632
-
\??\c:\20040.exec:\20040.exe116⤵PID:2360
-
\??\c:\6848246.exec:\6848246.exe117⤵PID:2852
-
\??\c:\lfrrxff.exec:\lfrrxff.exe118⤵PID:1340
-
\??\c:\nnthhb.exec:\nnthhb.exe119⤵PID:4920
-
\??\c:\06222.exec:\06222.exe120⤵PID:1172
-
\??\c:\c440886.exec:\c440886.exe121⤵PID:1032
-
\??\c:\3lrlffr.exec:\3lrlffr.exe122⤵PID:4568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-