Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe
-
Size
211KB
-
MD5
4f1b579425b09dd37ba4e79ff5a72200
-
SHA1
d1c513b2a3f0809e1ccea95e6a11ccdf22e1483c
-
SHA256
cfbcf45797965effe65361b7fb54c5be3745750cbd5d06c09317b0c14a4cf003
-
SHA512
b4eeb6346b6ab7dce15cbdfb04d66e8dabe62809bf74322ea3f8c0cc9f43cb8f128e0839623a9425008b3f3dd3ee99beabd91b39302e1cb7196b81682e68312d
-
SSDEEP
1536:wvQBeOGtrYSSsrc93UBIfdC67m6AJiqQfg3Cip8iXAsG5M0nj:whOm2sI93UufdC67cizfmCiiiXA/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/404-3-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3756-13-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2328-14-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3836-23-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4800-26-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1964-36-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4132-41-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4168-46-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4868-50-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1304-59-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/5080-61-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/544-73-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2408-84-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2356-92-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4848-99-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4200-104-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3872-110-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4460-113-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4572-124-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/5036-130-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4304-137-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2112-143-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1840-155-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4372-166-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1900-160-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3600-172-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3624-178-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2340-196-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4244-203-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1156-205-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1128-212-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1924-228-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3956-237-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2132-268-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2864-273-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/988-277-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1852-283-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4292-294-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/864-300-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2152-305-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4596-311-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2272-316-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3108-320-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/5032-326-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4636-337-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3260-341-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2852-345-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1624-353-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/536-366-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4352-390-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2652-399-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3456-409-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2152-476-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3260-511-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3468-582-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4968-596-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1684-602-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/5092-634-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1456-643-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4344-723-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4344-727-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1200-776-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/940-952-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2592-1001-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3756 pjpjd.exe 2328 ffrrxlr.exe 3836 tnhbhh.exe 4800 1xxxrrl.exe 1964 5hnntt.exe 4132 ppvpp.exe 4168 tthttt.exe 4868 pjjdd.exe 1304 xlflffl.exe 5080 jjdvv.exe 544 pjjjd.exe 1020 nbbttt.exe 1092 3dvvp.exe 2408 rfrlffx.exe 2356 ttttnn.exe 4848 jvpvv.exe 4200 nttnnb.exe 3872 pddvv.exe 4460 fxfllrr.exe 4572 jppdv.exe 5036 3rfxxxr.exe 4304 3hhbbh.exe 2112 vdjjj.exe 3888 xfxfxfx.exe 1840 hnhhnn.exe 1900 nhhtnb.exe 4372 ddddd.exe 3600 frrlflf.exe 3624 nntntn.exe 2820 9pddv.exe 3968 lfxrlff.exe 3452 nhnhhn.exe 2340 jpvpj.exe 4480 xrlxrxr.exe 4244 7thhhh.exe 1156 dvvpj.exe 4612 lfxrrrl.exe 1128 llrlrrx.exe 4672 httbtb.exe 4340 vvjjp.exe 1540 lfxrrxx.exe 4564 flxllrx.exe 1924 tntnhh.exe 2376 jjjvj.exe 3956 lfxrlxl.exe 4844 5xxrlll.exe 3684 btthbn.exe 4684 1pjjp.exe 1788 lfxrrrx.exe 3884 1lrlfll.exe 4968 5hhbnn.exe 884 lfllffr.exe 4168 tnhbtn.exe 2132 bhnhnt.exe 672 vvjjd.exe 2864 rxrrrfx.exe 988 xfxffxf.exe 1852 7hnnhh.exe 332 jdpdd.exe 5060 pdddd.exe 5048 xfffxxr.exe 4292 nnnbbh.exe 864 hnbhtn.exe 3520 dvddv.exe -
resource yara_rule behavioral2/memory/404-3-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3756-6-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3756-13-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2328-14-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3836-23-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4800-26-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1964-36-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4132-41-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4168-46-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4868-50-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1304-59-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/5080-61-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/544-73-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2408-84-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2356-92-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4848-94-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4848-99-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4200-104-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3872-110-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4460-113-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4572-124-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/5036-130-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4304-137-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2112-143-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1840-155-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4372-166-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1900-160-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3600-172-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2820-179-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3624-178-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2340-196-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4244-203-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1156-205-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1128-212-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1924-228-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3956-237-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3684-241-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3884-251-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2132-268-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2864-273-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/988-277-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1852-283-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4292-294-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/864-300-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2152-305-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4596-311-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2272-316-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3108-320-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/5032-326-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4636-333-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4636-337-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3260-341-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2852-345-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1624-353-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/536-366-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2580-367-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4352-390-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2652-399-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3456-409-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2152-476-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3108-489-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1068-500-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3260-511-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1488-523-0x0000000000400000-0x000000000042C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 404 wrote to memory of 3756 404 4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe 82 PID 404 wrote to memory of 3756 404 4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe 82 PID 404 wrote to memory of 3756 404 4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe 82 PID 3756 wrote to memory of 2328 3756 pjpjd.exe 83 PID 3756 wrote to memory of 2328 3756 pjpjd.exe 83 PID 3756 wrote to memory of 2328 3756 pjpjd.exe 83 PID 2328 wrote to memory of 3836 2328 ffrrxlr.exe 85 PID 2328 wrote to memory of 3836 2328 ffrrxlr.exe 85 PID 2328 wrote to memory of 3836 2328 ffrrxlr.exe 85 PID 3836 wrote to memory of 4800 3836 tnhbhh.exe 87 PID 3836 wrote to memory of 4800 3836 tnhbhh.exe 87 PID 3836 wrote to memory of 4800 3836 tnhbhh.exe 87 PID 4800 wrote to memory of 1964 4800 1xxxrrl.exe 88 PID 4800 wrote to memory of 1964 4800 1xxxrrl.exe 88 PID 4800 wrote to memory of 1964 4800 1xxxrrl.exe 88 PID 1964 wrote to memory of 4132 1964 5hnntt.exe 89 PID 1964 wrote to memory of 4132 1964 5hnntt.exe 89 PID 1964 wrote to memory of 4132 1964 5hnntt.exe 89 PID 4132 wrote to memory of 4168 4132 ppvpp.exe 90 PID 4132 wrote to memory of 4168 4132 ppvpp.exe 90 PID 4132 wrote to memory of 4168 4132 ppvpp.exe 90 PID 4168 wrote to memory of 4868 4168 tthttt.exe 92 PID 4168 wrote to memory of 4868 4168 tthttt.exe 92 PID 4168 wrote to memory of 4868 4168 tthttt.exe 92 PID 4868 wrote to memory of 1304 4868 pjjdd.exe 93 PID 4868 wrote to memory of 1304 4868 pjjdd.exe 93 PID 4868 wrote to memory of 1304 4868 pjjdd.exe 93 PID 1304 wrote to memory of 5080 1304 xlflffl.exe 94 PID 1304 wrote to memory of 5080 1304 xlflffl.exe 94 PID 1304 wrote to memory of 5080 1304 xlflffl.exe 94 PID 5080 wrote to memory of 544 5080 jjdvv.exe 95 PID 5080 wrote to memory of 544 5080 jjdvv.exe 95 PID 5080 wrote to memory of 544 5080 jjdvv.exe 95 PID 544 wrote to memory of 1020 544 pjjjd.exe 96 PID 544 wrote to memory of 1020 544 pjjjd.exe 96 PID 544 wrote to memory of 1020 544 pjjjd.exe 96 PID 1020 wrote to memory of 1092 1020 nbbttt.exe 97 PID 1020 wrote to memory of 1092 1020 nbbttt.exe 97 PID 1020 wrote to memory of 1092 1020 nbbttt.exe 97 PID 1092 wrote to memory of 2408 1092 3dvvp.exe 98 PID 1092 wrote to memory of 2408 1092 3dvvp.exe 98 PID 1092 wrote to memory of 2408 1092 3dvvp.exe 98 PID 2408 wrote to memory of 2356 2408 rfrlffx.exe 99 PID 2408 wrote to memory of 2356 2408 rfrlffx.exe 99 PID 2408 wrote to memory of 2356 2408 rfrlffx.exe 99 PID 2356 wrote to memory of 4848 2356 ttttnn.exe 100 PID 2356 wrote to memory of 4848 2356 ttttnn.exe 100 PID 2356 wrote to memory of 4848 2356 ttttnn.exe 100 PID 4848 wrote to memory of 4200 4848 jvpvv.exe 101 PID 4848 wrote to memory of 4200 4848 jvpvv.exe 101 PID 4848 wrote to memory of 4200 4848 jvpvv.exe 101 PID 4200 wrote to memory of 3872 4200 nttnnb.exe 102 PID 4200 wrote to memory of 3872 4200 nttnnb.exe 102 PID 4200 wrote to memory of 3872 4200 nttnnb.exe 102 PID 3872 wrote to memory of 4460 3872 pddvv.exe 103 PID 3872 wrote to memory of 4460 3872 pddvv.exe 103 PID 3872 wrote to memory of 4460 3872 pddvv.exe 103 PID 4460 wrote to memory of 4572 4460 fxfllrr.exe 104 PID 4460 wrote to memory of 4572 4460 fxfllrr.exe 104 PID 4460 wrote to memory of 4572 4460 fxfllrr.exe 104 PID 4572 wrote to memory of 5036 4572 jppdv.exe 105 PID 4572 wrote to memory of 5036 4572 jppdv.exe 105 PID 4572 wrote to memory of 5036 4572 jppdv.exe 105 PID 5036 wrote to memory of 4304 5036 3rfxxxr.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f1b579425b09dd37ba4e79ff5a72200_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\pjpjd.exec:\pjpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\ffrrxlr.exec:\ffrrxlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\tnhbhh.exec:\tnhbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\1xxxrrl.exec:\1xxxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\5hnntt.exec:\5hnntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\ppvpp.exec:\ppvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\tthttt.exec:\tthttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\pjjdd.exec:\pjjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\xlflffl.exec:\xlflffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\jjdvv.exec:\jjdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\pjjjd.exec:\pjjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\nbbttt.exec:\nbbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\3dvvp.exec:\3dvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\rfrlffx.exec:\rfrlffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\ttttnn.exec:\ttttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\jvpvv.exec:\jvpvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\nttnnb.exec:\nttnnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\pddvv.exec:\pddvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\fxfllrr.exec:\fxfllrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\jppdv.exec:\jppdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\3rfxxxr.exec:\3rfxxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\3hhbbh.exec:\3hhbbh.exe23⤵
- Executes dropped EXE
PID:4304 -
\??\c:\vdjjj.exec:\vdjjj.exe24⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xfxfxfx.exec:\xfxfxfx.exe25⤵
- Executes dropped EXE
PID:3888 -
\??\c:\hnhhnn.exec:\hnhhnn.exe26⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nhhtnb.exec:\nhhtnb.exe27⤵
- Executes dropped EXE
PID:1900 -
\??\c:\ddddd.exec:\ddddd.exe28⤵
- Executes dropped EXE
PID:4372 -
\??\c:\frrlflf.exec:\frrlflf.exe29⤵
- Executes dropped EXE
PID:3600 -
\??\c:\nntntn.exec:\nntntn.exe30⤵
- Executes dropped EXE
PID:3624 -
\??\c:\9pddv.exec:\9pddv.exe31⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lfxrlff.exec:\lfxrlff.exe32⤵
- Executes dropped EXE
PID:3968 -
\??\c:\nhnhhn.exec:\nhnhhn.exe33⤵
- Executes dropped EXE
PID:3452 -
\??\c:\jpvpj.exec:\jpvpj.exe34⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xrlxrxr.exec:\xrlxrxr.exe35⤵
- Executes dropped EXE
PID:4480 -
\??\c:\7thhhh.exec:\7thhhh.exe36⤵
- Executes dropped EXE
PID:4244 -
\??\c:\dvvpj.exec:\dvvpj.exe37⤵
- Executes dropped EXE
PID:1156 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe38⤵
- Executes dropped EXE
PID:4612 -
\??\c:\llrlrrx.exec:\llrlrrx.exe39⤵
- Executes dropped EXE
PID:1128 -
\??\c:\httbtb.exec:\httbtb.exe40⤵
- Executes dropped EXE
PID:4672 -
\??\c:\vvjjp.exec:\vvjjp.exe41⤵
- Executes dropped EXE
PID:4340 -
\??\c:\lfxrrxx.exec:\lfxrrxx.exe42⤵
- Executes dropped EXE
PID:1540 -
\??\c:\flxllrx.exec:\flxllrx.exe43⤵
- Executes dropped EXE
PID:4564 -
\??\c:\tntnhh.exec:\tntnhh.exe44⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jjjvj.exec:\jjjvj.exe45⤵
- Executes dropped EXE
PID:2376 -
\??\c:\lfxrlxl.exec:\lfxrlxl.exe46⤵
- Executes dropped EXE
PID:3956 -
\??\c:\5xxrlll.exec:\5xxrlll.exe47⤵
- Executes dropped EXE
PID:4844 -
\??\c:\btthbn.exec:\btthbn.exe48⤵
- Executes dropped EXE
PID:3684 -
\??\c:\1pjjp.exec:\1pjjp.exe49⤵
- Executes dropped EXE
PID:4684 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe50⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1lrlfll.exec:\1lrlfll.exe51⤵
- Executes dropped EXE
PID:3884 -
\??\c:\5hhbnn.exec:\5hhbnn.exe52⤵
- Executes dropped EXE
PID:4968 -
\??\c:\lfllffr.exec:\lfllffr.exe53⤵
- Executes dropped EXE
PID:884 -
\??\c:\tnhbtn.exec:\tnhbtn.exe54⤵
- Executes dropped EXE
PID:4168 -
\??\c:\bhnhnt.exec:\bhnhnt.exe55⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vvjjd.exec:\vvjjd.exe56⤵
- Executes dropped EXE
PID:672 -
\??\c:\rxrrrfx.exec:\rxrrrfx.exe57⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xfxffxf.exec:\xfxffxf.exe58⤵
- Executes dropped EXE
PID:988 -
\??\c:\7hnnhh.exec:\7hnnhh.exe59⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jdpdd.exec:\jdpdd.exe60⤵
- Executes dropped EXE
PID:332 -
\??\c:\pdddd.exec:\pdddd.exe61⤵
- Executes dropped EXE
PID:5060 -
\??\c:\xfffxxr.exec:\xfffxxr.exe62⤵
- Executes dropped EXE
PID:5048 -
\??\c:\nnnbbh.exec:\nnnbbh.exe63⤵
- Executes dropped EXE
PID:4292 -
\??\c:\hnbhtn.exec:\hnbhtn.exe64⤵
- Executes dropped EXE
PID:864 -
\??\c:\dvddv.exec:\dvddv.exe65⤵
- Executes dropped EXE
PID:3520 -
\??\c:\xlfrxfx.exec:\xlfrxfx.exe66⤵PID:2152
-
\??\c:\lxxflfl.exec:\lxxflfl.exe67⤵PID:4596
-
\??\c:\bbnnnn.exec:\bbnnnn.exe68⤵PID:2236
-
\??\c:\3djdp.exec:\3djdp.exe69⤵PID:2272
-
\??\c:\ddpjj.exec:\ddpjj.exe70⤵PID:3108
-
\??\c:\xflrrrr.exec:\xflrrrr.exe71⤵PID:5032
-
\??\c:\1nhnhn.exec:\1nhnhn.exe72⤵PID:2036
-
\??\c:\jjjdd.exec:\jjjdd.exe73⤵PID:1548
-
\??\c:\ppjjj.exec:\ppjjj.exe74⤵PID:4636
-
\??\c:\fxrllxr.exec:\fxrllxr.exe75⤵PID:4520
-
\??\c:\1xrrrrr.exec:\1xrrrrr.exe76⤵PID:3260
-
\??\c:\nhbtbb.exec:\nhbtbb.exe77⤵PID:2852
-
\??\c:\jpdpp.exec:\jpdpp.exe78⤵PID:1624
-
\??\c:\5frrrxx.exec:\5frrrxx.exe79⤵PID:4268
-
\??\c:\hbnhhh.exec:\hbnhhh.exe80⤵PID:860
-
\??\c:\tntbth.exec:\tntbth.exe81⤵PID:528
-
\??\c:\vdppd.exec:\vdppd.exe82⤵PID:536
-
\??\c:\fffxxxl.exec:\fffxxxl.exe83⤵PID:2580
-
\??\c:\7xfxfll.exec:\7xfxfll.exe84⤵PID:4696
-
\??\c:\nhbtnt.exec:\nhbtnt.exe85⤵PID:3340
-
\??\c:\jpvvp.exec:\jpvvp.exe86⤵PID:4552
-
\??\c:\rfffffl.exec:\rfffffl.exe87⤵PID:1724
-
\??\c:\htbhbn.exec:\htbhbn.exe88⤵PID:4668
-
\??\c:\9bhhbb.exec:\9bhhbb.exe89⤵PID:3156
-
\??\c:\jddvv.exec:\jddvv.exe90⤵PID:4352
-
\??\c:\7jvjd.exec:\7jvjd.exe91⤵PID:1696
-
\??\c:\frxfflr.exec:\frxfflr.exe92⤵PID:2652
-
\??\c:\hhnhbh.exec:\hhnhbh.exe93⤵PID:4788
-
\??\c:\nhtnnn.exec:\nhtnnn.exe94⤵PID:412
-
\??\c:\1vvdp.exec:\1vvdp.exe95⤵PID:3456
-
\??\c:\1tthnb.exec:\1tthnb.exe96⤵PID:212
-
\??\c:\jjpjd.exec:\jjpjd.exe97⤵PID:1044
-
\??\c:\xlxrlfr.exec:\xlxrlfr.exe98⤵PID:1608
-
\??\c:\nhnhtt.exec:\nhnhtt.exe99⤵PID:4800
-
\??\c:\nhhbtn.exec:\nhhbtn.exe100⤵PID:1964
-
\??\c:\vpdvj.exec:\vpdvj.exe101⤵PID:1788
-
\??\c:\xrrllfr.exec:\xrrllfr.exe102⤵PID:2444
-
\??\c:\rrxrxfl.exec:\rrxrxfl.exe103⤵PID:868
-
\??\c:\tnnhtn.exec:\tnnhtn.exe104⤵PID:3240
-
\??\c:\9bhhhn.exec:\9bhhhn.exe105⤵PID:776
-
\??\c:\dpddd.exec:\dpddd.exe106⤵PID:2052
-
\??\c:\frlxrll.exec:\frlxrll.exe107⤵PID:4152
-
\??\c:\xlxxffx.exec:\xlxxffx.exe108⤵PID:672
-
\??\c:\tnhbtt.exec:\tnhbtt.exe109⤵PID:216
-
\??\c:\1nbtnn.exec:\1nbtnn.exe110⤵PID:1020
-
\??\c:\vdjdv.exec:\vdjdv.exe111⤵PID:1520
-
\??\c:\rrflxxf.exec:\rrflxxf.exe112⤵PID:2456
-
\??\c:\hnbnbt.exec:\hnbnbt.exe113⤵PID:1368
-
\??\c:\vvvpp.exec:\vvvpp.exe114⤵PID:4792
-
\??\c:\7dvvd.exec:\7dvvd.exe115⤵PID:2564
-
\??\c:\flrxrlf.exec:\flrxrlf.exe116⤵PID:3000
-
\??\c:\nbbtnh.exec:\nbbtnh.exe117⤵PID:2368
-
\??\c:\7tnhhh.exec:\7tnhhh.exe118⤵PID:2152
-
\??\c:\vvvvv.exec:\vvvvv.exe119⤵PID:2592
-
\??\c:\pjvpp.exec:\pjvpp.exe120⤵PID:2928
-
\??\c:\7xxxrrx.exec:\7xxxrrx.exe121⤵PID:2272
-
\??\c:\hnnhtb.exec:\hnnhtb.exe122⤵PID:3108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-