Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 03:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe
-
Size
181KB
-
MD5
c6f02c59b49b45d68a56cc6296eaeed0
-
SHA1
a05a1821c4f31bcbec3df23cc40b27710fcba297
-
SHA256
74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671
-
SHA512
74f2ceca3d64096a36eeca50c02abf60654afec3dce478226aefeaf75c4df3e151b8a265e7f9f116bfb56b8346a55d216afa6ca05aa409ece66cef87defa93ac
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJPhbMX:PhOm2sI93UufdC67ciJTm5hIX
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1572-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2660-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-325-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/724-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-374-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-383-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-403-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-441-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-535-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-549-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-621-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-662-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-693-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-827-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-948-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-978-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-1124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-1412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3964 nnthhb.exe 4432 dpjvp.exe 2660 xrlfllx.exe 936 5vjvp.exe 2888 rrfxrrr.exe 2348 tbhhbb.exe 4116 fxxllfx.exe 3364 jppjj.exe 216 rflfffx.exe 2068 9bnhnn.exe 968 djpjd.exe 3048 xrxflrx.exe 4804 dvpjj.exe 4436 btbbbh.exe 764 5vjpd.exe 3160 pvpvp.exe 2776 bhhhhn.exe 3144 vpdvv.exe 1648 lrxflrf.exe 2184 vdjjp.exe 5028 pdpvv.exe 3796 lxrllfr.exe 4960 nntnnh.exe 2692 vvvpj.exe 4528 fffflff.exe 944 jpvvv.exe 4952 7xfxrxr.exe 1956 fflllll.exe 4856 hbnnhh.exe 976 rxxrlrr.exe 3248 bntnbh.exe 4640 jjpjj.exe 3836 3jjjd.exe 3256 hbhbtt.exe 4080 hhtntt.exe 2192 pdvdv.exe 1592 5xxfxxx.exe 2516 1tbnnh.exe 4408 jjdpp.exe 2980 rxlrfrf.exe 4588 fxffxxx.exe 3212 9ttttt.exe 4484 pjvdv.exe 3100 djjvp.exe 4944 xxxrlll.exe 4616 bttnnh.exe 4676 tbnntn.exe 3848 pdpvp.exe 4636 pjjdp.exe 3096 lflfflf.exe 1480 hntnhn.exe 1764 lllffff.exe 4500 bhttbb.exe 1752 1vjpp.exe 4000 rrfffxr.exe 4792 xxfxrxr.exe 4908 ppdvv.exe 1612 jddvv.exe 4684 frrxfxx.exe 4784 rrlrxxx.exe 1252 htbtnn.exe 1944 pvdvv.exe 4660 5lfxrrl.exe 3376 9ffxxxr.exe -
resource yara_rule behavioral2/memory/1572-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-359-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/724-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-403-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-451-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-465-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-472-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-535-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-549-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-583-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1572 wrote to memory of 3964 1572 74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe 81 PID 1572 wrote to memory of 3964 1572 74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe 81 PID 1572 wrote to memory of 3964 1572 74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe 81 PID 3964 wrote to memory of 4432 3964 nnthhb.exe 82 PID 3964 wrote to memory of 4432 3964 nnthhb.exe 82 PID 3964 wrote to memory of 4432 3964 nnthhb.exe 82 PID 4432 wrote to memory of 2660 4432 dpjvp.exe 83 PID 4432 wrote to memory of 2660 4432 dpjvp.exe 83 PID 4432 wrote to memory of 2660 4432 dpjvp.exe 83 PID 2660 wrote to memory of 936 2660 xrlfllx.exe 84 PID 2660 wrote to memory of 936 2660 xrlfllx.exe 84 PID 2660 wrote to memory of 936 2660 xrlfllx.exe 84 PID 936 wrote to memory of 2888 936 5vjvp.exe 85 PID 936 wrote to memory of 2888 936 5vjvp.exe 85 PID 936 wrote to memory of 2888 936 5vjvp.exe 85 PID 2888 wrote to memory of 2348 2888 rrfxrrr.exe 86 PID 2888 wrote to memory of 2348 2888 rrfxrrr.exe 86 PID 2888 wrote to memory of 2348 2888 rrfxrrr.exe 86 PID 2348 wrote to memory of 4116 2348 tbhhbb.exe 87 PID 2348 wrote to memory of 4116 2348 tbhhbb.exe 87 PID 2348 wrote to memory of 4116 2348 tbhhbb.exe 87 PID 4116 wrote to memory of 3364 4116 fxxllfx.exe 88 PID 4116 wrote to memory of 3364 4116 fxxllfx.exe 88 PID 4116 wrote to memory of 3364 4116 fxxllfx.exe 88 PID 3364 wrote to memory of 216 3364 jppjj.exe 89 PID 3364 wrote to memory of 216 3364 jppjj.exe 89 PID 3364 wrote to memory of 216 3364 jppjj.exe 89 PID 216 wrote to memory of 2068 216 rflfffx.exe 90 PID 216 wrote to memory of 2068 216 rflfffx.exe 90 PID 216 wrote to memory of 2068 216 rflfffx.exe 90 PID 2068 wrote to memory of 968 2068 9bnhnn.exe 91 PID 2068 wrote to memory of 968 2068 9bnhnn.exe 91 PID 2068 wrote to memory of 968 2068 9bnhnn.exe 91 PID 968 wrote to memory of 3048 968 djpjd.exe 92 PID 968 wrote to memory of 3048 968 djpjd.exe 92 PID 968 wrote to memory of 3048 968 djpjd.exe 92 PID 3048 wrote to memory of 4804 3048 xrxflrx.exe 93 PID 3048 wrote to memory of 4804 3048 xrxflrx.exe 93 PID 3048 wrote to memory of 4804 3048 xrxflrx.exe 93 PID 4804 wrote to memory of 4436 4804 dvpjj.exe 94 PID 4804 wrote to memory of 4436 4804 dvpjj.exe 94 PID 4804 wrote to memory of 4436 4804 dvpjj.exe 94 PID 4436 wrote to memory of 764 4436 btbbbh.exe 95 PID 4436 wrote to memory of 764 4436 btbbbh.exe 95 PID 4436 wrote to memory of 764 4436 btbbbh.exe 95 PID 764 wrote to memory of 3160 764 5vjpd.exe 96 PID 764 wrote to memory of 3160 764 5vjpd.exe 96 PID 764 wrote to memory of 3160 764 5vjpd.exe 96 PID 3160 wrote to memory of 2776 3160 pvpvp.exe 97 PID 3160 wrote to memory of 2776 3160 pvpvp.exe 97 PID 3160 wrote to memory of 2776 3160 pvpvp.exe 97 PID 2776 wrote to memory of 3144 2776 bhhhhn.exe 98 PID 2776 wrote to memory of 3144 2776 bhhhhn.exe 98 PID 2776 wrote to memory of 3144 2776 bhhhhn.exe 98 PID 3144 wrote to memory of 1648 3144 vpdvv.exe 99 PID 3144 wrote to memory of 1648 3144 vpdvv.exe 99 PID 3144 wrote to memory of 1648 3144 vpdvv.exe 99 PID 1648 wrote to memory of 2184 1648 lrxflrf.exe 100 PID 1648 wrote to memory of 2184 1648 lrxflrf.exe 100 PID 1648 wrote to memory of 2184 1648 lrxflrf.exe 100 PID 2184 wrote to memory of 5028 2184 vdjjp.exe 101 PID 2184 wrote to memory of 5028 2184 vdjjp.exe 101 PID 2184 wrote to memory of 5028 2184 vdjjp.exe 101 PID 5028 wrote to memory of 3796 5028 pdpvv.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\nnthhb.exec:\nnthhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\dpjvp.exec:\dpjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\xrlfllx.exec:\xrlfllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\5vjvp.exec:\5vjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\tbhhbb.exec:\tbhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\fxxllfx.exec:\fxxllfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\jppjj.exec:\jppjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\rflfffx.exec:\rflfffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\9bnhnn.exec:\9bnhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\djpjd.exec:\djpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\xrxflrx.exec:\xrxflrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\dvpjj.exec:\dvpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\btbbbh.exec:\btbbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\5vjpd.exec:\5vjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\pvpvp.exec:\pvpvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\bhhhhn.exec:\bhhhhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vpdvv.exec:\vpdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\lrxflrf.exec:\lrxflrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\vdjjp.exec:\vdjjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\pdpvv.exec:\pdpvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\lxrllfr.exec:\lxrllfr.exe23⤵
- Executes dropped EXE
PID:3796 -
\??\c:\nntnnh.exec:\nntnnh.exe24⤵
- Executes dropped EXE
PID:4960 -
\??\c:\vvvpj.exec:\vvvpj.exe25⤵
- Executes dropped EXE
PID:2692 -
\??\c:\fffflff.exec:\fffflff.exe26⤵
- Executes dropped EXE
PID:4528 -
\??\c:\jpvvv.exec:\jpvvv.exe27⤵
- Executes dropped EXE
PID:944 -
\??\c:\7xfxrxr.exec:\7xfxrxr.exe28⤵
- Executes dropped EXE
PID:4952 -
\??\c:\fflllll.exec:\fflllll.exe29⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hbnnhh.exec:\hbnnhh.exe30⤵
- Executes dropped EXE
PID:4856 -
\??\c:\rxxrlrr.exec:\rxxrlrr.exe31⤵
- Executes dropped EXE
PID:976 -
\??\c:\bntnbh.exec:\bntnbh.exe32⤵
- Executes dropped EXE
PID:3248 -
\??\c:\jjpjj.exec:\jjpjj.exe33⤵
- Executes dropped EXE
PID:4640 -
\??\c:\3jjjd.exec:\3jjjd.exe34⤵
- Executes dropped EXE
PID:3836 -
\??\c:\hbhbtt.exec:\hbhbtt.exe35⤵
- Executes dropped EXE
PID:3256 -
\??\c:\hhtntt.exec:\hhtntt.exe36⤵
- Executes dropped EXE
PID:4080 -
\??\c:\pdvdv.exec:\pdvdv.exe37⤵
- Executes dropped EXE
PID:2192 -
\??\c:\5xxfxxx.exec:\5xxfxxx.exe38⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1tbnnh.exec:\1tbnnh.exe39⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jjdpp.exec:\jjdpp.exe40⤵
- Executes dropped EXE
PID:4408 -
\??\c:\rxlrfrf.exec:\rxlrfrf.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\fxffxxx.exec:\fxffxxx.exe42⤵
- Executes dropped EXE
PID:4588 -
\??\c:\9ttttt.exec:\9ttttt.exe43⤵
- Executes dropped EXE
PID:3212 -
\??\c:\pjvdv.exec:\pjvdv.exe44⤵
- Executes dropped EXE
PID:4484 -
\??\c:\djjvp.exec:\djjvp.exe45⤵
- Executes dropped EXE
PID:3100 -
\??\c:\xxxrlll.exec:\xxxrlll.exe46⤵
- Executes dropped EXE
PID:4944 -
\??\c:\bttnnh.exec:\bttnnh.exe47⤵
- Executes dropped EXE
PID:4616 -
\??\c:\tbnntn.exec:\tbnntn.exe48⤵
- Executes dropped EXE
PID:4676 -
\??\c:\pdpvp.exec:\pdpvp.exe49⤵
- Executes dropped EXE
PID:3848 -
\??\c:\pjjdp.exec:\pjjdp.exe50⤵
- Executes dropped EXE
PID:4636 -
\??\c:\lflfflf.exec:\lflfflf.exe51⤵
- Executes dropped EXE
PID:3096 -
\??\c:\hntnhn.exec:\hntnhn.exe52⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lllffff.exec:\lllffff.exe53⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bhttbb.exec:\bhttbb.exe54⤵
- Executes dropped EXE
PID:4500 -
\??\c:\1vjpp.exec:\1vjpp.exe55⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rrfffxr.exec:\rrfffxr.exe56⤵
- Executes dropped EXE
PID:4000 -
\??\c:\xxfxrxr.exec:\xxfxrxr.exe57⤵
- Executes dropped EXE
PID:4792 -
\??\c:\ppdvv.exec:\ppdvv.exe58⤵
- Executes dropped EXE
PID:4908 -
\??\c:\jddvv.exec:\jddvv.exe59⤵
- Executes dropped EXE
PID:1612 -
\??\c:\frrxfxx.exec:\frrxfxx.exe60⤵
- Executes dropped EXE
PID:4684 -
\??\c:\rrlrxxx.exec:\rrlrxxx.exe61⤵
- Executes dropped EXE
PID:4784 -
\??\c:\htbtnn.exec:\htbtnn.exe62⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pvdvv.exec:\pvdvv.exe63⤵
- Executes dropped EXE
PID:1944 -
\??\c:\5lfxrrl.exec:\5lfxrrl.exe64⤵
- Executes dropped EXE
PID:4660 -
\??\c:\9ffxxxr.exec:\9ffxxxr.exe65⤵
- Executes dropped EXE
PID:3376 -
\??\c:\bbhhhh.exec:\bbhhhh.exe66⤵PID:4116
-
\??\c:\7pdvd.exec:\7pdvd.exe67⤵PID:5112
-
\??\c:\lfrlffr.exec:\lfrlffr.exe68⤵PID:1948
-
\??\c:\llfxxrr.exec:\llfxxrr.exe69⤵PID:1952
-
\??\c:\nnnhbb.exec:\nnnhbb.exe70⤵PID:3020
-
\??\c:\5djdv.exec:\5djdv.exe71⤵PID:3976
-
\??\c:\jjjdd.exec:\jjjdd.exe72⤵PID:3040
-
\??\c:\7lrrlll.exec:\7lrrlll.exe73⤵PID:3436
-
\??\c:\rfrlffx.exec:\rfrlffx.exe74⤵PID:3272
-
\??\c:\btbbtt.exec:\btbbtt.exe75⤵PID:1220
-
\??\c:\tnttbh.exec:\tnttbh.exe76⤵PID:1920
-
\??\c:\vvvpp.exec:\vvvpp.exe77⤵PID:4980
-
\??\c:\lfffflf.exec:\lfffflf.exe78⤵PID:2004
-
\??\c:\1xxxxxx.exec:\1xxxxxx.exe79⤵PID:1668
-
\??\c:\nthhnn.exec:\nthhnn.exe80⤵PID:2776
-
\??\c:\vjddd.exec:\vjddd.exe81⤵PID:5060
-
\??\c:\lxfllff.exec:\lxfllff.exe82⤵PID:3144
-
\??\c:\3rlxrxr.exec:\3rlxrxr.exe83⤵PID:432
-
\??\c:\nbhthh.exec:\nbhthh.exe84⤵PID:2752
-
\??\c:\9jvdp.exec:\9jvdp.exe85⤵PID:724
-
\??\c:\ddjvp.exec:\ddjvp.exe86⤵PID:5028
-
\??\c:\3xxxrrl.exec:\3xxxrrl.exe87⤵PID:4516
-
\??\c:\thnhbb.exec:\thnhbb.exe88⤵PID:1148
-
\??\c:\3hhhbh.exec:\3hhhbh.exe89⤵PID:1744
-
\??\c:\5vvvp.exec:\5vvvp.exe90⤵PID:4884
-
\??\c:\xflffxx.exec:\xflffxx.exe91⤵PID:888
-
\??\c:\tnntth.exec:\tnntth.exe92⤵PID:428
-
\??\c:\vdjjp.exec:\vdjjp.exe93⤵PID:456
-
\??\c:\vvpjp.exec:\vvpjp.exe94⤵PID:556
-
\??\c:\fllrrxx.exec:\fllrrxx.exe95⤵PID:2188
-
\??\c:\tnbhhn.exec:\tnbhhn.exe96⤵PID:2856
-
\??\c:\nbttbh.exec:\nbttbh.exe97⤵PID:3876
-
\??\c:\pddvp.exec:\pddvp.exe98⤵PID:976
-
\??\c:\1flllrl.exec:\1flllrl.exe99⤵PID:1748
-
\??\c:\1nnnhn.exec:\1nnnhn.exe100⤵PID:4620
-
\??\c:\9jpjd.exec:\9jpjd.exe101⤵PID:2744
-
\??\c:\vdpvj.exec:\vdpvj.exe102⤵PID:2596
-
\??\c:\3xxfxxx.exec:\3xxfxxx.exe103⤵PID:3256
-
\??\c:\tnntbb.exec:\tnntbb.exe104⤵PID:4404
-
\??\c:\btnttt.exec:\btnttt.exe105⤵PID:5000
-
\??\c:\vvjjj.exec:\vvjjj.exe106⤵PID:3568
-
\??\c:\pvddp.exec:\pvddp.exe107⤵PID:3400
-
\??\c:\xfxrrlx.exec:\xfxrrlx.exe108⤵PID:4408
-
\??\c:\tntnnt.exec:\tntnnt.exe109⤵PID:2980
-
\??\c:\jdpdp.exec:\jdpdp.exe110⤵PID:4472
-
\??\c:\pjvdv.exec:\pjvdv.exe111⤵PID:3212
-
\??\c:\xflllrl.exec:\xflllrl.exe112⤵PID:2180
-
\??\c:\1tbbbh.exec:\1tbbbh.exe113⤵PID:3100
-
\??\c:\pdvvv.exec:\pdvvv.exe114⤵PID:3268
-
\??\c:\vjvjj.exec:\vjvjj.exe115⤵PID:3968
-
\??\c:\llrlllr.exec:\llrlllr.exe116⤵PID:3352
-
\??\c:\bbnnht.exec:\bbnnht.exe117⤵PID:4412
-
\??\c:\5vjdd.exec:\5vjdd.exe118⤵PID:4636
-
\??\c:\jpjdv.exec:\jpjdv.exe119⤵PID:4632
-
\??\c:\rfrlffr.exec:\rfrlffr.exe120⤵PID:1480
-
\??\c:\thtttb.exec:\thtttb.exe121⤵PID:4244
-
\??\c:\nhtntb.exec:\nhtntb.exe122⤵PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-