Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 02:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe
-
Size
351KB
-
MD5
24237c1bd743aa179b0c88080e8862c0
-
SHA1
249f1c7eae874bfd3a2e0b4155950e176b431b2f
-
SHA256
43e3eb45ab67e21ce85e775c3d9fc4b85de5a5f366d6d446040da06da16cd711
-
SHA512
886cef713bc4c044399f763768ee9cc56d2c4b063c8f1ad7088fd1341a967d56fa410baeb9870a6bfe919ed7756cd5e15599523f3ffe9b36ef46a947f034553f
-
SSDEEP
6144:4cm7ImGddXvJuzyy/SfVFKpU/sien7NuOpo0HmtDKe0wKyKqiOfm8RCfDK4TrHHO:+7TcBuGy/Sa+/sie0OpncKe/KFBOfmzm
Malware Config
Signatures
-
Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral2/memory/2964-7-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1324-8-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1716-21-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4628-17-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4812-26-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1772-33-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1456-42-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2668-49-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1588-58-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2032-55-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4004-67-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4976-74-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/228-75-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5084-85-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3220-101-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4040-105-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4224-118-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4584-132-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4372-133-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3284-145-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4460-151-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4104-163-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4424-183-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4924-193-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1532-201-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3504-205-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2364-209-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2336-213-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3788-218-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3856-227-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5024-234-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1372-235-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3868-252-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4636-266-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3200-270-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4172-277-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2496-304-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/216-313-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/228-320-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5072-324-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4024-336-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3248-359-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2264-366-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4964-370-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3292-396-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4924-409-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5000-424-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/220-448-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4336-456-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/428-505-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3344-532-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3228-542-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/432-549-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2264-553-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2616-588-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/460-635-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1132-850-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/216-863-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2664-1006-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2928-1156-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1324 djvdj.exe 4628 frrlfxx.exe 1716 hbhttn.exe 4812 7jpdp.exe 1772 rrxrlff.exe 1456 nhnhbt.exe 2668 fffxxxf.exe 2032 bntnnn.exe 1588 pjdvp.exe 4004 xrrlffx.exe 4976 vppjj.exe 228 flxlrxr.exe 5084 bthtnh.exe 4020 flrlfxf.exe 4920 bnnhhh.exe 3220 ffrfxxr.exe 4040 htnttn.exe 1964 5ddpj.exe 4224 hbhbbb.exe 4672 fxxlrrl.exe 4584 vppjd.exe 4372 hntnhb.exe 2220 5jdvd.exe 3284 llfxrlf.exe 4460 bbnhtn.exe 1192 djjvp.exe 4104 bbnnnh.exe 4244 pvpdj.exe 876 jjvdv.exe 4424 fllrrlx.exe 1804 thntht.exe 4924 rrxlrlf.exe 1168 nbnbtt.exe 1532 ppddj.exe 3504 btbnhn.exe 2364 9pjdv.exe 2336 lrfflll.exe 4676 lllffff.exe 3788 jddpp.exe 4100 lxlllrf.exe 3856 bbhthh.exe 2248 dvddv.exe 5024 rlxlfrf.exe 1372 bnnhbh.exe 3924 vjvjv.exe 1144 hhhbtb.exe 5060 3jpjd.exe 3868 dpvpp.exe 4160 xrrlrll.exe 3708 7nnnhh.exe 2016 1vppp.exe 4636 llrxxxr.exe 3200 tbnhtt.exe 1200 djvpj.exe 4172 pvdjp.exe 3412 lffxflx.exe 3780 bntntt.exe 4704 nhnhbt.exe 1456 7jjjd.exe 2052 djvpj.exe 2212 1fllflf.exe 2396 3bbtnn.exe 4936 tbhhnt.exe 2496 jjpvd.exe -
resource yara_rule behavioral2/memory/2964-7-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1324-8-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4628-12-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1716-21-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4628-17-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4812-26-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1772-33-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1456-42-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2668-49-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2032-50-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1588-58-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2032-55-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4004-67-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4976-74-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/228-75-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5084-85-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3220-101-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4040-105-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4224-118-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4584-126-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4584-132-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4372-133-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2220-138-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3284-145-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4460-151-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4104-163-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4244-168-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4424-183-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4924-193-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1532-197-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1532-201-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3504-205-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2364-209-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2336-213-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3788-218-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3856-227-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5024-234-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1372-235-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3868-248-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3868-252-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2016-259-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4636-266-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3200-270-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4172-277-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4704-284-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2496-304-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/216-313-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/228-320-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5072-324-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4020-328-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1020-332-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4024-336-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3248-355-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3248-359-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2264-366-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4964-370-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2272-380-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3292-396-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4924-409-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4892-413-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5000-424-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/220-448-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4336-452-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4336-456-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 1324 2964 24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe 80 PID 2964 wrote to memory of 1324 2964 24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe 80 PID 2964 wrote to memory of 1324 2964 24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe 80 PID 1324 wrote to memory of 4628 1324 djvdj.exe 81 PID 1324 wrote to memory of 4628 1324 djvdj.exe 81 PID 1324 wrote to memory of 4628 1324 djvdj.exe 81 PID 4628 wrote to memory of 1716 4628 frrlfxx.exe 82 PID 4628 wrote to memory of 1716 4628 frrlfxx.exe 82 PID 4628 wrote to memory of 1716 4628 frrlfxx.exe 82 PID 1716 wrote to memory of 4812 1716 hbhttn.exe 83 PID 1716 wrote to memory of 4812 1716 hbhttn.exe 83 PID 1716 wrote to memory of 4812 1716 hbhttn.exe 83 PID 4812 wrote to memory of 1772 4812 7jpdp.exe 84 PID 4812 wrote to memory of 1772 4812 7jpdp.exe 84 PID 4812 wrote to memory of 1772 4812 7jpdp.exe 84 PID 1772 wrote to memory of 1456 1772 rrxrlff.exe 85 PID 1772 wrote to memory of 1456 1772 rrxrlff.exe 85 PID 1772 wrote to memory of 1456 1772 rrxrlff.exe 85 PID 1456 wrote to memory of 2668 1456 nhnhbt.exe 86 PID 1456 wrote to memory of 2668 1456 nhnhbt.exe 86 PID 1456 wrote to memory of 2668 1456 nhnhbt.exe 86 PID 2668 wrote to memory of 2032 2668 fffxxxf.exe 87 PID 2668 wrote to memory of 2032 2668 fffxxxf.exe 87 PID 2668 wrote to memory of 2032 2668 fffxxxf.exe 87 PID 2032 wrote to memory of 1588 2032 bntnnn.exe 88 PID 2032 wrote to memory of 1588 2032 bntnnn.exe 88 PID 2032 wrote to memory of 1588 2032 bntnnn.exe 88 PID 1588 wrote to memory of 4004 1588 pjdvp.exe 89 PID 1588 wrote to memory of 4004 1588 pjdvp.exe 89 PID 1588 wrote to memory of 4004 1588 pjdvp.exe 89 PID 4004 wrote to memory of 4976 4004 xrrlffx.exe 90 PID 4004 wrote to memory of 4976 4004 xrrlffx.exe 90 PID 4004 wrote to memory of 4976 4004 xrrlffx.exe 90 PID 4976 wrote to memory of 228 4976 vppjj.exe 91 PID 4976 wrote to memory of 228 4976 vppjj.exe 91 PID 4976 wrote to memory of 228 4976 vppjj.exe 91 PID 228 wrote to memory of 5084 228 flxlrxr.exe 92 PID 228 wrote to memory of 5084 228 flxlrxr.exe 92 PID 228 wrote to memory of 5084 228 flxlrxr.exe 92 PID 5084 wrote to memory of 4020 5084 bthtnh.exe 93 PID 5084 wrote to memory of 4020 5084 bthtnh.exe 93 PID 5084 wrote to memory of 4020 5084 bthtnh.exe 93 PID 4020 wrote to memory of 4920 4020 flrlfxf.exe 94 PID 4020 wrote to memory of 4920 4020 flrlfxf.exe 94 PID 4020 wrote to memory of 4920 4020 flrlfxf.exe 94 PID 4920 wrote to memory of 3220 4920 bnnhhh.exe 95 PID 4920 wrote to memory of 3220 4920 bnnhhh.exe 95 PID 4920 wrote to memory of 3220 4920 bnnhhh.exe 95 PID 3220 wrote to memory of 4040 3220 ffrfxxr.exe 96 PID 3220 wrote to memory of 4040 3220 ffrfxxr.exe 96 PID 3220 wrote to memory of 4040 3220 ffrfxxr.exe 96 PID 4040 wrote to memory of 1964 4040 htnttn.exe 97 PID 4040 wrote to memory of 1964 4040 htnttn.exe 97 PID 4040 wrote to memory of 1964 4040 htnttn.exe 97 PID 1964 wrote to memory of 4224 1964 5ddpj.exe 98 PID 1964 wrote to memory of 4224 1964 5ddpj.exe 98 PID 1964 wrote to memory of 4224 1964 5ddpj.exe 98 PID 4224 wrote to memory of 4672 4224 hbhbbb.exe 99 PID 4224 wrote to memory of 4672 4224 hbhbbb.exe 99 PID 4224 wrote to memory of 4672 4224 hbhbbb.exe 99 PID 4672 wrote to memory of 4584 4672 fxxlrrl.exe 100 PID 4672 wrote to memory of 4584 4672 fxxlrrl.exe 100 PID 4672 wrote to memory of 4584 4672 fxxlrrl.exe 100 PID 4584 wrote to memory of 4372 4584 vppjd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\24237c1bd743aa179b0c88080e8862c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\djvdj.exec:\djvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\frrlfxx.exec:\frrlfxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\hbhttn.exec:\hbhttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\7jpdp.exec:\7jpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\rrxrlff.exec:\rrxrlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\nhnhbt.exec:\nhnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\fffxxxf.exec:\fffxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bntnnn.exec:\bntnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\pjdvp.exec:\pjdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\xrrlffx.exec:\xrrlffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\vppjj.exec:\vppjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\flxlrxr.exec:\flxlrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\bthtnh.exec:\bthtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\flrlfxf.exec:\flrlfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\bnnhhh.exec:\bnnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\ffrfxxr.exec:\ffrfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\htnttn.exec:\htnttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\5ddpj.exec:\5ddpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\hbhbbb.exec:\hbhbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\fxxlrrl.exec:\fxxlrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\vppjd.exec:\vppjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\hntnhb.exec:\hntnhb.exe23⤵
- Executes dropped EXE
PID:4372 -
\??\c:\5jdvd.exec:\5jdvd.exe24⤵
- Executes dropped EXE
PID:2220 -
\??\c:\llfxrlf.exec:\llfxrlf.exe25⤵
- Executes dropped EXE
PID:3284 -
\??\c:\bbnhtn.exec:\bbnhtn.exe26⤵
- Executes dropped EXE
PID:4460 -
\??\c:\djjvp.exec:\djjvp.exe27⤵
- Executes dropped EXE
PID:1192 -
\??\c:\bbnnnh.exec:\bbnnnh.exe28⤵
- Executes dropped EXE
PID:4104 -
\??\c:\pvpdj.exec:\pvpdj.exe29⤵
- Executes dropped EXE
PID:4244 -
\??\c:\jjvdv.exec:\jjvdv.exe30⤵
- Executes dropped EXE
PID:876 -
\??\c:\fllrrlx.exec:\fllrrlx.exe31⤵
- Executes dropped EXE
PID:4424 -
\??\c:\thntht.exec:\thntht.exe32⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rrxlrlf.exec:\rrxlrlf.exe33⤵
- Executes dropped EXE
PID:4924 -
\??\c:\nbnbtt.exec:\nbnbtt.exe34⤵
- Executes dropped EXE
PID:1168 -
\??\c:\ppddj.exec:\ppddj.exe35⤵
- Executes dropped EXE
PID:1532 -
\??\c:\btbnhn.exec:\btbnhn.exe36⤵
- Executes dropped EXE
PID:3504 -
\??\c:\9pjdv.exec:\9pjdv.exe37⤵
- Executes dropped EXE
PID:2364 -
\??\c:\lrfflll.exec:\lrfflll.exe38⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lllffff.exec:\lllffff.exe39⤵
- Executes dropped EXE
PID:4676 -
\??\c:\jddpp.exec:\jddpp.exe40⤵
- Executes dropped EXE
PID:3788 -
\??\c:\lxlllrf.exec:\lxlllrf.exe41⤵
- Executes dropped EXE
PID:4100 -
\??\c:\bbhthh.exec:\bbhthh.exe42⤵
- Executes dropped EXE
PID:3856 -
\??\c:\dvddv.exec:\dvddv.exe43⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rlxlfrf.exec:\rlxlfrf.exe44⤵
- Executes dropped EXE
PID:5024 -
\??\c:\bnnhbh.exec:\bnnhbh.exe45⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vjvjv.exec:\vjvjv.exe46⤵
- Executes dropped EXE
PID:3924 -
\??\c:\hhhbtb.exec:\hhhbtb.exe47⤵
- Executes dropped EXE
PID:1144 -
\??\c:\3jpjd.exec:\3jpjd.exe48⤵
- Executes dropped EXE
PID:5060 -
\??\c:\dpvpp.exec:\dpvpp.exe49⤵
- Executes dropped EXE
PID:3868 -
\??\c:\xrrlrll.exec:\xrrlrll.exe50⤵
- Executes dropped EXE
PID:4160 -
\??\c:\7nnnhh.exec:\7nnnhh.exe51⤵
- Executes dropped EXE
PID:3708 -
\??\c:\1vppp.exec:\1vppp.exe52⤵
- Executes dropped EXE
PID:2016 -
\??\c:\llrxxxr.exec:\llrxxxr.exe53⤵
- Executes dropped EXE
PID:4636 -
\??\c:\tbnhtt.exec:\tbnhtt.exe54⤵
- Executes dropped EXE
PID:3200 -
\??\c:\djvpj.exec:\djvpj.exe55⤵
- Executes dropped EXE
PID:1200 -
\??\c:\pvdjp.exec:\pvdjp.exe56⤵
- Executes dropped EXE
PID:4172 -
\??\c:\lffxflx.exec:\lffxflx.exe57⤵
- Executes dropped EXE
PID:3412 -
\??\c:\bntntt.exec:\bntntt.exe58⤵
- Executes dropped EXE
PID:3780 -
\??\c:\nhnhbt.exec:\nhnhbt.exe59⤵
- Executes dropped EXE
PID:4704 -
\??\c:\7jjjd.exec:\7jjjd.exe60⤵
- Executes dropped EXE
PID:1456 -
\??\c:\djvpj.exec:\djvpj.exe61⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1fllflf.exec:\1fllflf.exe62⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3bbtnn.exec:\3bbtnn.exe63⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tbhhnt.exec:\tbhhnt.exe64⤵
- Executes dropped EXE
PID:4936 -
\??\c:\jjpvd.exec:\jjpvd.exe65⤵
- Executes dropped EXE
PID:2496 -
\??\c:\frxrllf.exec:\frxrllf.exe66⤵PID:4004
-
\??\c:\ntbtnn.exec:\ntbtnn.exe67⤵PID:216
-
\??\c:\ppvvv.exec:\ppvvv.exe68⤵PID:312
-
\??\c:\9dvpp.exec:\9dvpp.exe69⤵PID:228
-
\??\c:\xlxxrll.exec:\xlxxrll.exe70⤵PID:4536
-
\??\c:\tnbnth.exec:\tnbnth.exe71⤵PID:5072
-
\??\c:\ttbbtb.exec:\ttbbtb.exe72⤵PID:4020
-
\??\c:\vvvdv.exec:\vvvdv.exe73⤵PID:1020
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe74⤵PID:4024
-
\??\c:\9htntt.exec:\9htntt.exe75⤵PID:2788
-
\??\c:\bbhbbt.exec:\bbhbbt.exe76⤵PID:4664
-
\??\c:\rxrffxx.exec:\rxrffxx.exe77⤵PID:3400
-
\??\c:\xrfrllf.exec:\xrfrllf.exe78⤵PID:2532
-
\??\c:\bntnhb.exec:\bntnhb.exe79⤵PID:3332
-
\??\c:\3vvpj.exec:\3vvpj.exe80⤵PID:3248
-
\??\c:\3jddv.exec:\3jddv.exe81⤵PID:2324
-
\??\c:\7hhttn.exec:\7hhttn.exe82⤵PID:2264
-
\??\c:\dvvjd.exec:\dvvjd.exe83⤵PID:4964
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe84⤵PID:4064
-
\??\c:\lxlfxlf.exec:\lxlfxlf.exe85⤵PID:376
-
\??\c:\nthbbn.exec:\nthbbn.exe86⤵PID:4608
-
\??\c:\vvpvv.exec:\vvpvv.exe87⤵PID:2272
-
\??\c:\lffllxl.exec:\lffllxl.exe88⤵PID:3960
-
\??\c:\hhtntt.exec:\hhtntt.exe89⤵PID:4684
-
\??\c:\thnnhh.exec:\thnnhh.exe90⤵PID:3496
-
\??\c:\5jddv.exec:\5jddv.exe91⤵PID:3292
-
\??\c:\lllfxxr.exec:\lllfxxr.exe92⤵PID:3520
-
\??\c:\frfflll.exec:\frfflll.exe93⤵PID:2876
-
\??\c:\nhhhhb.exec:\nhhhhb.exe94⤵PID:4084
-
\??\c:\dddvp.exec:\dddvp.exe95⤵PID:4924
-
\??\c:\xxrrfxf.exec:\xxrrfxf.exe96⤵PID:1168
-
\??\c:\hbnnhh.exec:\hbnnhh.exe97⤵PID:4892
-
\??\c:\vddvv.exec:\vddvv.exe98⤵PID:4588
-
\??\c:\3rxxrxx.exec:\3rxxrxx.exe99⤵PID:756
-
\??\c:\flxrrrr.exec:\flxrrrr.exe100⤵PID:5000
-
\??\c:\hnnhtt.exec:\hnnhtt.exe101⤵PID:4292
-
\??\c:\pvdvj.exec:\pvdvj.exe102⤵PID:2456
-
\??\c:\vjpjd.exec:\vjpjd.exe103⤵PID:4100
-
\??\c:\lffxrrr.exec:\lffxrrr.exe104⤵PID:3356
-
\??\c:\fxfflxf.exec:\fxfflxf.exe105⤵PID:1832
-
\??\c:\1hthbb.exec:\1hthbb.exe106⤵PID:1732
-
\??\c:\bnbtnt.exec:\bnbtnt.exe107⤵PID:220
-
\??\c:\7pjvv.exec:\7pjvv.exe108⤵PID:3004
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe109⤵PID:4336
-
\??\c:\7ntntn.exec:\7ntntn.exe110⤵PID:912
-
\??\c:\9vvpp.exec:\9vvpp.exe111⤵PID:4636
-
\??\c:\xllrfxf.exec:\xllrfxf.exe112⤵PID:3200
-
\??\c:\tbhbtt.exec:\tbhbtt.exe113⤵PID:4812
-
\??\c:\tthbnn.exec:\tthbnn.exe114⤵PID:1916
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe115⤵PID:3160
-
\??\c:\hnnhbh.exec:\hnnhbh.exe116⤵PID:2504
-
\??\c:\pjpdd.exec:\pjpdd.exe117⤵PID:1636
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe118⤵PID:1436
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe119⤵PID:4700
-
\??\c:\3hhtnh.exec:\3hhtnh.exe120⤵PID:1320
-
\??\c:\dvdvp.exec:\dvdvp.exe121⤵PID:2528
-
\??\c:\5dppj.exec:\5dppj.exe122⤵PID:4936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-