Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 11:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ceddedc615c44774f8352391828864f0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
ceddedc615c44774f8352391828864f0_NeikiAnalytics.exe
-
Size
198KB
-
MD5
ceddedc615c44774f8352391828864f0
-
SHA1
6863c50dcf3eedbf729c4777a31aa0eb1037f67a
-
SHA256
74ee16d57f9e0ebc1167b8fff0b4072097d867eee6f6a07e3753b199ababb32c
-
SHA512
4ee6676561d95793f1e267a6dba0728af014862cbe096461ce140b18d29c5c0e77534c36cd72d92c0001821e78768711626621d8e04d242455998132ca17f17b
-
SSDEEP
1536:1vQBeOGtrYSSsrc93UBIfdC67m6AJiqpfg3Cn/uiYs6Rp:1hOm2sI93UufdC67ciifmCnmiYJD
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1328-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-806-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-1047-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-1070-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-1179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-1616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-1752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 924 pdpjd.exe 4460 3rlflxr.exe 4952 lxxlfxr.exe 3804 nhtnhh.exe 4984 jvvpj.exe 3592 5bthbt.exe 4928 1nnhnn.exe 4112 9rlfxxx.exe 2728 hhhbnh.exe 3048 vdvpj.exe 2252 llxrffr.exe 1040 hthbtt.exe 1972 vjjdv.exe 1672 nbhbtt.exe 1492 hthbtt.exe 4508 xrxfxrr.exe 2628 bnhbtn.exe 4212 3vpjv.exe 2072 rrrlfxr.exe 1376 httnhb.exe 3696 3pjvp.exe 4312 lffxxxr.exe 4908 bnnhtn.exe 4676 jvdvv.exe 868 3rxrfll.exe 4068 thhtnh.exe 1716 vpvpv.exe 1872 lfxxxll.exe 4036 3flxfff.exe 3368 bbhbnn.exe 4300 bttbtt.exe 816 lfxrlll.exe 4372 5nnhhb.exe 2396 ffxlffx.exe 2468 xlrlfff.exe 1588 hbbnhb.exe 1032 llxrfxl.exe 2664 xlrlllf.exe 4488 pddvp.exe 1272 dpvpd.exe 3112 rrlxxxr.exe 4648 nnthnt.exe 4936 hbnbhb.exe 924 pvvpd.exe 940 vjjvj.exe 980 fllxllf.exe 3184 thbbtt.exe 2708 1llxrlx.exe 3036 7xfxxxf.exe 1836 bbtnbb.exe 1896 bttnbb.exe 396 5ddvj.exe 1564 rllfxrl.exe 2440 nbnhbb.exe 3624 vpdpv.exe 408 fllxffx.exe 1404 rlllxxf.exe 3504 nhnhbb.exe 4376 jvpdv.exe 1628 9lrlxfx.exe 3636 nhhnht.exe 4184 vdvpp.exe 2152 thttnn.exe 3992 bbbbbb.exe -
resource yara_rule behavioral2/memory/1328-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-806-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1328 wrote to memory of 924 1328 ceddedc615c44774f8352391828864f0_NeikiAnalytics.exe 82 PID 1328 wrote to memory of 924 1328 ceddedc615c44774f8352391828864f0_NeikiAnalytics.exe 82 PID 1328 wrote to memory of 924 1328 ceddedc615c44774f8352391828864f0_NeikiAnalytics.exe 82 PID 924 wrote to memory of 4460 924 pdpjd.exe 83 PID 924 wrote to memory of 4460 924 pdpjd.exe 83 PID 924 wrote to memory of 4460 924 pdpjd.exe 83 PID 4460 wrote to memory of 4952 4460 3rlflxr.exe 84 PID 4460 wrote to memory of 4952 4460 3rlflxr.exe 84 PID 4460 wrote to memory of 4952 4460 3rlflxr.exe 84 PID 4952 wrote to memory of 3804 4952 lxxlfxr.exe 85 PID 4952 wrote to memory of 3804 4952 lxxlfxr.exe 85 PID 4952 wrote to memory of 3804 4952 lxxlfxr.exe 85 PID 3804 wrote to memory of 4984 3804 nhtnhh.exe 86 PID 3804 wrote to memory of 4984 3804 nhtnhh.exe 86 PID 3804 wrote to memory of 4984 3804 nhtnhh.exe 86 PID 4984 wrote to memory of 3592 4984 jvvpj.exe 87 PID 4984 wrote to memory of 3592 4984 jvvpj.exe 87 PID 4984 wrote to memory of 3592 4984 jvvpj.exe 87 PID 3592 wrote to memory of 4928 3592 5bthbt.exe 89 PID 3592 wrote to memory of 4928 3592 5bthbt.exe 89 PID 3592 wrote to memory of 4928 3592 5bthbt.exe 89 PID 4928 wrote to memory of 4112 4928 1nnhnn.exe 90 PID 4928 wrote to memory of 4112 4928 1nnhnn.exe 90 PID 4928 wrote to memory of 4112 4928 1nnhnn.exe 90 PID 4112 wrote to memory of 2728 4112 9rlfxxx.exe 91 PID 4112 wrote to memory of 2728 4112 9rlfxxx.exe 91 PID 4112 wrote to memory of 2728 4112 9rlfxxx.exe 91 PID 2728 wrote to memory of 3048 2728 hhhbnh.exe 92 PID 2728 wrote to memory of 3048 2728 hhhbnh.exe 92 PID 2728 wrote to memory of 3048 2728 hhhbnh.exe 92 PID 3048 wrote to memory of 2252 3048 vdvpj.exe 94 PID 3048 wrote to memory of 2252 3048 vdvpj.exe 94 PID 3048 wrote to memory of 2252 3048 vdvpj.exe 94 PID 2252 wrote to memory of 1040 2252 llxrffr.exe 95 PID 2252 wrote to memory of 1040 2252 llxrffr.exe 95 PID 2252 wrote to memory of 1040 2252 llxrffr.exe 95 PID 1040 wrote to memory of 1972 1040 hthbtt.exe 96 PID 1040 wrote to memory of 1972 1040 hthbtt.exe 96 PID 1040 wrote to memory of 1972 1040 hthbtt.exe 96 PID 1972 wrote to memory of 1672 1972 vjjdv.exe 98 PID 1972 wrote to memory of 1672 1972 vjjdv.exe 98 PID 1972 wrote to memory of 1672 1972 vjjdv.exe 98 PID 1672 wrote to memory of 1492 1672 nbhbtt.exe 99 PID 1672 wrote to memory of 1492 1672 nbhbtt.exe 99 PID 1672 wrote to memory of 1492 1672 nbhbtt.exe 99 PID 1492 wrote to memory of 4508 1492 hthbtt.exe 100 PID 1492 wrote to memory of 4508 1492 hthbtt.exe 100 PID 1492 wrote to memory of 4508 1492 hthbtt.exe 100 PID 4508 wrote to memory of 2628 4508 xrxfxrr.exe 101 PID 4508 wrote to memory of 2628 4508 xrxfxrr.exe 101 PID 4508 wrote to memory of 2628 4508 xrxfxrr.exe 101 PID 2628 wrote to memory of 4212 2628 bnhbtn.exe 102 PID 2628 wrote to memory of 4212 2628 bnhbtn.exe 102 PID 2628 wrote to memory of 4212 2628 bnhbtn.exe 102 PID 4212 wrote to memory of 2072 4212 3vpjv.exe 103 PID 4212 wrote to memory of 2072 4212 3vpjv.exe 103 PID 4212 wrote to memory of 2072 4212 3vpjv.exe 103 PID 2072 wrote to memory of 1376 2072 rrrlfxr.exe 104 PID 2072 wrote to memory of 1376 2072 rrrlfxr.exe 104 PID 2072 wrote to memory of 1376 2072 rrrlfxr.exe 104 PID 1376 wrote to memory of 3696 1376 httnhb.exe 105 PID 1376 wrote to memory of 3696 1376 httnhb.exe 105 PID 1376 wrote to memory of 3696 1376 httnhb.exe 105 PID 3696 wrote to memory of 4312 3696 3pjvp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\ceddedc615c44774f8352391828864f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ceddedc615c44774f8352391828864f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\pdpjd.exec:\pdpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\3rlflxr.exec:\3rlflxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\nhtnhh.exec:\nhtnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\jvvpj.exec:\jvvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\5bthbt.exec:\5bthbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\1nnhnn.exec:\1nnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\9rlfxxx.exec:\9rlfxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\hhhbnh.exec:\hhhbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vdvpj.exec:\vdvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\llxrffr.exec:\llxrffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\hthbtt.exec:\hthbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\vjjdv.exec:\vjjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\nbhbtt.exec:\nbhbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\hthbtt.exec:\hthbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\xrxfxrr.exec:\xrxfxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\bnhbtn.exec:\bnhbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\3vpjv.exec:\3vpjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\rrrlfxr.exec:\rrrlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\httnhb.exec:\httnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\3pjvp.exec:\3pjvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\lffxxxr.exec:\lffxxxr.exe23⤵
- Executes dropped EXE
PID:4312 -
\??\c:\bnnhtn.exec:\bnnhtn.exe24⤵
- Executes dropped EXE
PID:4908 -
\??\c:\jvdvv.exec:\jvdvv.exe25⤵
- Executes dropped EXE
PID:4676 -
\??\c:\3rxrfll.exec:\3rxrfll.exe26⤵
- Executes dropped EXE
PID:868 -
\??\c:\thhtnh.exec:\thhtnh.exe27⤵
- Executes dropped EXE
PID:4068 -
\??\c:\vpvpv.exec:\vpvpv.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lfxxxll.exec:\lfxxxll.exe29⤵
- Executes dropped EXE
PID:1872 -
\??\c:\3flxfff.exec:\3flxfff.exe30⤵
- Executes dropped EXE
PID:4036 -
\??\c:\bbhbnn.exec:\bbhbnn.exe31⤵
- Executes dropped EXE
PID:3368 -
\??\c:\bttbtt.exec:\bttbtt.exe32⤵
- Executes dropped EXE
PID:4300 -
\??\c:\lfxrlll.exec:\lfxrlll.exe33⤵
- Executes dropped EXE
PID:816 -
\??\c:\5nnhhb.exec:\5nnhhb.exe34⤵
- Executes dropped EXE
PID:4372 -
\??\c:\ffxlffx.exec:\ffxlffx.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xlrlfff.exec:\xlrlfff.exe36⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hbbnhb.exec:\hbbnhb.exe37⤵
- Executes dropped EXE
PID:1588 -
\??\c:\llxrfxl.exec:\llxrfxl.exe38⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xlrlllf.exec:\xlrlllf.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pddvp.exec:\pddvp.exe40⤵
- Executes dropped EXE
PID:4488 -
\??\c:\dpvpd.exec:\dpvpd.exe41⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rrlxxxr.exec:\rrlxxxr.exe42⤵
- Executes dropped EXE
PID:3112 -
\??\c:\nnthnt.exec:\nnthnt.exe43⤵
- Executes dropped EXE
PID:4648 -
\??\c:\hbnbhb.exec:\hbnbhb.exe44⤵
- Executes dropped EXE
PID:4936 -
\??\c:\pvvpd.exec:\pvvpd.exe45⤵
- Executes dropped EXE
PID:924 -
\??\c:\vjjvj.exec:\vjjvj.exe46⤵
- Executes dropped EXE
PID:940 -
\??\c:\fllxllf.exec:\fllxllf.exe47⤵
- Executes dropped EXE
PID:980 -
\??\c:\thbbtt.exec:\thbbtt.exe48⤵
- Executes dropped EXE
PID:3184 -
\??\c:\1llxrlx.exec:\1llxrlx.exe49⤵
- Executes dropped EXE
PID:2708 -
\??\c:\7xfxxxf.exec:\7xfxxxf.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\bbtnbb.exec:\bbtnbb.exe51⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bttnbb.exec:\bttnbb.exe52⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5ddvj.exec:\5ddvj.exe53⤵
- Executes dropped EXE
PID:396 -
\??\c:\rllfxrl.exec:\rllfxrl.exe54⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nbnhbb.exec:\nbnhbb.exe55⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vpdpv.exec:\vpdpv.exe56⤵
- Executes dropped EXE
PID:3624 -
\??\c:\fllxffx.exec:\fllxffx.exe57⤵
- Executes dropped EXE
PID:408 -
\??\c:\rlllxxf.exec:\rlllxxf.exe58⤵
- Executes dropped EXE
PID:1404 -
\??\c:\nhnhbb.exec:\nhnhbb.exe59⤵
- Executes dropped EXE
PID:3504 -
\??\c:\jvpdv.exec:\jvpdv.exe60⤵
- Executes dropped EXE
PID:4376 -
\??\c:\9lrlxfx.exec:\9lrlxfx.exe61⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nhhnht.exec:\nhhnht.exe62⤵
- Executes dropped EXE
PID:3636 -
\??\c:\vdvpp.exec:\vdvpp.exe63⤵
- Executes dropped EXE
PID:4184 -
\??\c:\thttnn.exec:\thttnn.exe64⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bbbbbb.exec:\bbbbbb.exe65⤵
- Executes dropped EXE
PID:3992 -
\??\c:\jdpjd.exec:\jdpjd.exe66⤵PID:744
-
\??\c:\rrrlfll.exec:\rrrlfll.exe67⤵PID:5056
-
\??\c:\7ttttt.exec:\7ttttt.exe68⤵PID:556
-
\??\c:\tbntbh.exec:\tbntbh.exe69⤵PID:3888
-
\??\c:\ddvjv.exec:\ddvjv.exe70⤵PID:4988
-
\??\c:\lfxrlll.exec:\lfxrlll.exe71⤵PID:1380
-
\??\c:\llxrxxr.exec:\llxrxxr.exe72⤵PID:4212
-
\??\c:\hthbnn.exec:\hthbnn.exe73⤵PID:2548
-
\??\c:\bttnnn.exec:\bttnnn.exe74⤵PID:4164
-
\??\c:\jvddd.exec:\jvddd.exe75⤵PID:4216
-
\??\c:\rllllll.exec:\rllllll.exe76⤵PID:1600
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe77⤵PID:4780
-
\??\c:\bbnntt.exec:\bbnntt.exe78⤵PID:4948
-
\??\c:\ddjjp.exec:\ddjjp.exe79⤵PID:4536
-
\??\c:\jjppj.exec:\jjppj.exe80⤵PID:4676
-
\??\c:\xlxrlll.exec:\xlxrlll.exe81⤵PID:1732
-
\??\c:\3hnhnn.exec:\3hnhnn.exe82⤵PID:1952
-
\??\c:\btnhnh.exec:\btnhnh.exe83⤵PID:4176
-
\??\c:\1pvpj.exec:\1pvpj.exe84⤵PID:2372
-
\??\c:\3fxxrff.exec:\3fxxrff.exe85⤵PID:4820
-
\??\c:\3lrlllr.exec:\3lrlllr.exe86⤵PID:2624
-
\??\c:\tnnnhh.exec:\tnnnhh.exe87⤵PID:3884
-
\??\c:\ntbhbt.exec:\ntbhbt.exe88⤵PID:3040
-
\??\c:\ddddd.exec:\ddddd.exe89⤵PID:4644
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe90⤵PID:2536
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe91⤵PID:4624
-
\??\c:\nbhbtt.exec:\nbhbtt.exe92⤵PID:2800
-
\??\c:\hhtbtb.exec:\hhtbtb.exe93⤵PID:3460
-
\??\c:\pvppj.exec:\pvppj.exe94⤵PID:216
-
\??\c:\rrllfff.exec:\rrllfff.exe95⤵PID:1604
-
\??\c:\fflxxxx.exec:\fflxxxx.exe96⤵PID:2664
-
\??\c:\hhnbtn.exec:\hhnbtn.exe97⤵PID:1880
-
\??\c:\ppjvp.exec:\ppjvp.exe98⤵PID:4476
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe99⤵PID:2588
-
\??\c:\rrrrlxl.exec:\rrrrlxl.exe100⤵PID:4892
-
\??\c:\nhbtnh.exec:\nhbtnh.exe101⤵PID:5092
-
\??\c:\7jvpj.exec:\7jvpj.exe102⤵PID:2012
-
\??\c:\pvvpj.exec:\pvvpj.exe103⤵PID:368
-
\??\c:\5llllrr.exec:\5llllrr.exe104⤵PID:4952
-
\??\c:\3dvpj.exec:\3dvpj.exe105⤵PID:232
-
\??\c:\jpjvp.exec:\jpjvp.exe106⤵PID:3128
-
\??\c:\3xxlffx.exec:\3xxlffx.exe107⤵PID:4984
-
\??\c:\rxxllff.exec:\rxxllff.exe108⤵PID:1536
-
\??\c:\hthbtt.exec:\hthbtt.exe109⤵PID:4548
-
\??\c:\jddpp.exec:\jddpp.exe110⤵PID:4316
-
\??\c:\9pvjj.exec:\9pvjj.exe111⤵PID:1668
-
\??\c:\9lrrxrl.exec:\9lrrxrl.exe112⤵PID:3080
-
\??\c:\nnhhhb.exec:\nnhhhb.exe113⤵PID:2440
-
\??\c:\btbbnt.exec:\btbbnt.exe114⤵PID:3624
-
\??\c:\djjdd.exec:\djjdd.exe115⤵PID:408
-
\??\c:\lrllllf.exec:\lrllllf.exe116⤵PID:1404
-
\??\c:\lflrflf.exec:\lflrflf.exe117⤵PID:3504
-
\??\c:\nhhnnn.exec:\nhhnnn.exe118⤵PID:4684
-
\??\c:\nbnhbh.exec:\nbnhbh.exe119⤵PID:2916
-
\??\c:\3pvpj.exec:\3pvpj.exe120⤵PID:3636
-
\??\c:\flxrlrl.exec:\flxrlrl.exe121⤵PID:2384
-
\??\c:\nbnttt.exec:\nbnttt.exe122⤵PID:2152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-