Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd469dccb49459b1361bde40f4004dd0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
dd469dccb49459b1361bde40f4004dd0_NeikiAnalytics.exe
-
Size
205KB
-
MD5
dd469dccb49459b1361bde40f4004dd0
-
SHA1
427a63c7db0de6123fe0db709dbb196b7daf4961
-
SHA256
3e49fff2c7ede1bedd120d8c6ca8e78e27e69afe1540c684a1839e9ca2a9f7a5
-
SHA512
b7dd4b90250fe5dd3716c79625c7dfa363a03381451d0768acee10c510aa93400f913ec2cc335bf7ef89e7073734a4fe46380584092847141b3b6f6a8e8eafd3
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6TQpCihe:PhOm2sI93UufdC67ciJTU2HVS64he
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5084-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-445-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-449-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-459-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-490-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-500-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-586-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-593-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-609-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-664-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-680-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-699-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-925-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-980-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-1154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1520 hhhtbt.exe 4452 rxllflf.exe 1616 fxfxxxr.exe 1588 9xxlflr.exe 4936 xlllxxr.exe 3868 jjddd.exe 2972 tnhhbn.exe 3172 jjvvv.exe 512 htbbtb.exe 5064 1djvp.exe 2108 vddpd.exe 4924 jpppv.exe 4888 3tbnhb.exe 3796 3frrlrl.exe 4652 pjvdj.exe 4276 xfxrxrl.exe 4556 btnhbt.exe 3408 tntntb.exe 2668 vdpjd.exe 4988 flfrffx.exe 4520 nbbtnh.exe 2936 nbttnt.exe 5020 djjdv.exe 1732 9nhhtb.exe 1852 lxllfff.exe 4920 hhtnnh.exe 4948 lllxxfr.exe 4696 nhthbb.exe 880 ttbbnt.exe 4124 5flflff.exe 1672 bnhttt.exe 4728 1dvvv.exe 4868 httnhh.exe 2884 xrrrxxl.exe 3324 ddvpj.exe 2916 3rrrxrx.exe 5104 hhnnnt.exe 2396 jdvjd.exe 2448 fflrxxf.exe 1668 bbtttb.exe 2940 dppjd.exe 1160 fxfxrrl.exe 2312 tbnhbh.exe 2192 jddpj.exe 2584 lfrxfxr.exe 2328 bthbth.exe 1420 jdppv.exe 3664 lrrxxrr.exe 3532 7llfxxx.exe 4412 dpvpp.exe 4756 jddvj.exe 1108 1rrlffx.exe 940 nnnnhb.exe 3440 9jjjv.exe 3640 llrlrrx.exe 908 nbbntn.exe 3944 btttnn.exe 1772 9vjjv.exe 4784 lfrlrrx.exe 2020 htttnn.exe 4896 ttbhhh.exe 2972 rlrxxll.exe 1248 ffllxrl.exe 2356 tbtnnt.exe -
resource yara_rule behavioral2/memory/5084-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-334-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-437-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-445-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-449-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-459-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-490-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-500-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-516-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-586-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-593-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5084 wrote to memory of 1520 5084 dd469dccb49459b1361bde40f4004dd0_NeikiAnalytics.exe 81 PID 5084 wrote to memory of 1520 5084 dd469dccb49459b1361bde40f4004dd0_NeikiAnalytics.exe 81 PID 5084 wrote to memory of 1520 5084 dd469dccb49459b1361bde40f4004dd0_NeikiAnalytics.exe 81 PID 1520 wrote to memory of 4452 1520 hhhtbt.exe 82 PID 1520 wrote to memory of 4452 1520 hhhtbt.exe 82 PID 1520 wrote to memory of 4452 1520 hhhtbt.exe 82 PID 4452 wrote to memory of 1616 4452 rxllflf.exe 83 PID 4452 wrote to memory of 1616 4452 rxllflf.exe 83 PID 4452 wrote to memory of 1616 4452 rxllflf.exe 83 PID 1616 wrote to memory of 1588 1616 fxfxxxr.exe 84 PID 1616 wrote to memory of 1588 1616 fxfxxxr.exe 84 PID 1616 wrote to memory of 1588 1616 fxfxxxr.exe 84 PID 1588 wrote to memory of 4936 1588 9xxlflr.exe 85 PID 1588 wrote to memory of 4936 1588 9xxlflr.exe 85 PID 1588 wrote to memory of 4936 1588 9xxlflr.exe 85 PID 4936 wrote to memory of 3868 4936 xlllxxr.exe 86 PID 4936 wrote to memory of 3868 4936 xlllxxr.exe 86 PID 4936 wrote to memory of 3868 4936 xlllxxr.exe 86 PID 3868 wrote to memory of 2972 3868 jjddd.exe 87 PID 3868 wrote to memory of 2972 3868 jjddd.exe 87 PID 3868 wrote to memory of 2972 3868 jjddd.exe 87 PID 2972 wrote to memory of 3172 2972 tnhhbn.exe 88 PID 2972 wrote to memory of 3172 2972 tnhhbn.exe 88 PID 2972 wrote to memory of 3172 2972 tnhhbn.exe 88 PID 3172 wrote to memory of 512 3172 jjvvv.exe 89 PID 3172 wrote to memory of 512 3172 jjvvv.exe 89 PID 3172 wrote to memory of 512 3172 jjvvv.exe 89 PID 512 wrote to memory of 5064 512 htbbtb.exe 90 PID 512 wrote to memory of 5064 512 htbbtb.exe 90 PID 512 wrote to memory of 5064 512 htbbtb.exe 90 PID 5064 wrote to memory of 2108 5064 1djvp.exe 91 PID 5064 wrote to memory of 2108 5064 1djvp.exe 91 PID 5064 wrote to memory of 2108 5064 1djvp.exe 91 PID 2108 wrote to memory of 4924 2108 vddpd.exe 92 PID 2108 wrote to memory of 4924 2108 vddpd.exe 92 PID 2108 wrote to memory of 4924 2108 vddpd.exe 92 PID 4924 wrote to memory of 4888 4924 jpppv.exe 93 PID 4924 wrote to memory of 4888 4924 jpppv.exe 93 PID 4924 wrote to memory of 4888 4924 jpppv.exe 93 PID 4888 wrote to memory of 3796 4888 3tbnhb.exe 94 PID 4888 wrote to memory of 3796 4888 3tbnhb.exe 94 PID 4888 wrote to memory of 3796 4888 3tbnhb.exe 94 PID 3796 wrote to memory of 4652 3796 3frrlrl.exe 95 PID 3796 wrote to memory of 4652 3796 3frrlrl.exe 95 PID 3796 wrote to memory of 4652 3796 3frrlrl.exe 95 PID 4652 wrote to memory of 4276 4652 pjvdj.exe 96 PID 4652 wrote to memory of 4276 4652 pjvdj.exe 96 PID 4652 wrote to memory of 4276 4652 pjvdj.exe 96 PID 4276 wrote to memory of 4556 4276 xfxrxrl.exe 97 PID 4276 wrote to memory of 4556 4276 xfxrxrl.exe 97 PID 4276 wrote to memory of 4556 4276 xfxrxrl.exe 97 PID 4556 wrote to memory of 3408 4556 btnhbt.exe 98 PID 4556 wrote to memory of 3408 4556 btnhbt.exe 98 PID 4556 wrote to memory of 3408 4556 btnhbt.exe 98 PID 3408 wrote to memory of 2668 3408 tntntb.exe 99 PID 3408 wrote to memory of 2668 3408 tntntb.exe 99 PID 3408 wrote to memory of 2668 3408 tntntb.exe 99 PID 2668 wrote to memory of 4988 2668 vdpjd.exe 100 PID 2668 wrote to memory of 4988 2668 vdpjd.exe 100 PID 2668 wrote to memory of 4988 2668 vdpjd.exe 100 PID 4988 wrote to memory of 4520 4988 flfrffx.exe 101 PID 4988 wrote to memory of 4520 4988 flfrffx.exe 101 PID 4988 wrote to memory of 4520 4988 flfrffx.exe 101 PID 4520 wrote to memory of 2936 4520 nbbtnh.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd469dccb49459b1361bde40f4004dd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dd469dccb49459b1361bde40f4004dd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\hhhtbt.exec:\hhhtbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\rxllflf.exec:\rxllflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\9xxlflr.exec:\9xxlflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\xlllxxr.exec:\xlllxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\jjddd.exec:\jjddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\tnhhbn.exec:\tnhhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\jjvvv.exec:\jjvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\htbbtb.exec:\htbbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\1djvp.exec:\1djvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vddpd.exec:\vddpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\jpppv.exec:\jpppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\3tbnhb.exec:\3tbnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\3frrlrl.exec:\3frrlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\pjvdj.exec:\pjvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\xfxrxrl.exec:\xfxrxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\btnhbt.exec:\btnhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\tntntb.exec:\tntntb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\vdpjd.exec:\vdpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\flfrffx.exec:\flfrffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\nbbtnh.exec:\nbbtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\nbttnt.exec:\nbttnt.exe23⤵
- Executes dropped EXE
PID:2936 -
\??\c:\djjdv.exec:\djjdv.exe24⤵
- Executes dropped EXE
PID:5020 -
\??\c:\9nhhtb.exec:\9nhhtb.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lxllfff.exec:\lxllfff.exe26⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hhtnnh.exec:\hhtnnh.exe27⤵
- Executes dropped EXE
PID:4920 -
\??\c:\lllxxfr.exec:\lllxxfr.exe28⤵
- Executes dropped EXE
PID:4948 -
\??\c:\nhthbb.exec:\nhthbb.exe29⤵
- Executes dropped EXE
PID:4696 -
\??\c:\ttbbnt.exec:\ttbbnt.exe30⤵
- Executes dropped EXE
PID:880 -
\??\c:\5flflff.exec:\5flflff.exe31⤵
- Executes dropped EXE
PID:4124 -
\??\c:\bnhttt.exec:\bnhttt.exe32⤵
- Executes dropped EXE
PID:1672 -
\??\c:\1dvvv.exec:\1dvvv.exe33⤵
- Executes dropped EXE
PID:4728 -
\??\c:\httnhh.exec:\httnhh.exe34⤵
- Executes dropped EXE
PID:4868 -
\??\c:\xrrrxxl.exec:\xrrrxxl.exe35⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ddvpj.exec:\ddvpj.exe36⤵
- Executes dropped EXE
PID:3324 -
\??\c:\3rrrxrx.exec:\3rrrxrx.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\hhnnnt.exec:\hhnnnt.exe38⤵
- Executes dropped EXE
PID:5104 -
\??\c:\jdvjd.exec:\jdvjd.exe39⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fflrxxf.exec:\fflrxxf.exe40⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bbtttb.exec:\bbtttb.exe41⤵
- Executes dropped EXE
PID:1668 -
\??\c:\dppjd.exec:\dppjd.exe42⤵
- Executes dropped EXE
PID:2940 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe43⤵
- Executes dropped EXE
PID:1160 -
\??\c:\tbnhbh.exec:\tbnhbh.exe44⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jddpj.exec:\jddpj.exe45⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lfrxfxr.exec:\lfrxfxr.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bthbth.exec:\bthbth.exe47⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jdppv.exec:\jdppv.exe48⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lrrxxrr.exec:\lrrxxrr.exe49⤵
- Executes dropped EXE
PID:3664 -
\??\c:\7llfxxx.exec:\7llfxxx.exe50⤵
- Executes dropped EXE
PID:3532 -
\??\c:\dpvpp.exec:\dpvpp.exe51⤵
- Executes dropped EXE
PID:4412 -
\??\c:\jddvj.exec:\jddvj.exe52⤵
- Executes dropped EXE
PID:4756 -
\??\c:\1rrlffx.exec:\1rrlffx.exe53⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nnnnhb.exec:\nnnnhb.exe54⤵
- Executes dropped EXE
PID:940 -
\??\c:\9jjjv.exec:\9jjjv.exe55⤵
- Executes dropped EXE
PID:3440 -
\??\c:\llrlrrx.exec:\llrlrrx.exe56⤵
- Executes dropped EXE
PID:3640 -
\??\c:\nbbntn.exec:\nbbntn.exe57⤵
- Executes dropped EXE
PID:908 -
\??\c:\btttnn.exec:\btttnn.exe58⤵
- Executes dropped EXE
PID:3944 -
\??\c:\9vjjv.exec:\9vjjv.exe59⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe60⤵
- Executes dropped EXE
PID:4784 -
\??\c:\htttnn.exec:\htttnn.exe61⤵
- Executes dropped EXE
PID:2020 -
\??\c:\ttbhhh.exec:\ttbhhh.exe62⤵
- Executes dropped EXE
PID:4896 -
\??\c:\rlrxxll.exec:\rlrxxll.exe63⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ffllxrl.exec:\ffllxrl.exe64⤵
- Executes dropped EXE
PID:1248 -
\??\c:\tbtnnt.exec:\tbtnnt.exe65⤵
- Executes dropped EXE
PID:2356 -
\??\c:\jvvvp.exec:\jvvvp.exe66⤵PID:3200
-
\??\c:\rlllffr.exec:\rlllffr.exe67⤵PID:5044
-
\??\c:\9lfffff.exec:\9lfffff.exe68⤵PID:3616
-
\??\c:\hnttbh.exec:\hnttbh.exe69⤵PID:4596
-
\??\c:\pdvvd.exec:\pdvvd.exe70⤵PID:3448
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe71⤵PID:4536
-
\??\c:\rfrrlrl.exec:\rfrrlrl.exe72⤵PID:4376
-
\??\c:\5hhbtt.exec:\5hhbtt.exe73⤵PID:4864
-
\??\c:\djvpp.exec:\djvpp.exe74⤵PID:3048
-
\??\c:\vpvpj.exec:\vpvpj.exe75⤵PID:1900
-
\??\c:\xrlfllx.exec:\xrlfllx.exe76⤵PID:2944
-
\??\c:\nhbnhh.exec:\nhbnhh.exe77⤵PID:4996
-
\??\c:\dpddd.exec:\dpddd.exe78⤵PID:2420
-
\??\c:\xllfxfx.exec:\xllfxfx.exe79⤵PID:3044
-
\??\c:\3hhhbh.exec:\3hhhbh.exe80⤵PID:3932
-
\??\c:\1jppj.exec:\1jppj.exe81⤵PID:3688
-
\??\c:\5dpjj.exec:\5dpjj.exe82⤵PID:220
-
\??\c:\fxxfxxf.exec:\fxxfxxf.exe83⤵PID:2936
-
\??\c:\hnnnnn.exec:\hnnnnn.exe84⤵PID:5020
-
\??\c:\hbtnhh.exec:\hbtnhh.exe85⤵PID:4932
-
\??\c:\jpvpd.exec:\jpvpd.exe86⤵PID:1732
-
\??\c:\3lfffll.exec:\3lfffll.exe87⤵PID:212
-
\??\c:\lfrlffx.exec:\lfrlffx.exe88⤵PID:2780
-
\??\c:\hbttnt.exec:\hbttnt.exe89⤵PID:2200
-
\??\c:\pjjdj.exec:\pjjdj.exe90⤵PID:2960
-
\??\c:\dvpjd.exec:\dvpjd.exe91⤵PID:4960
-
\??\c:\lfffllr.exec:\lfffllr.exe92⤵PID:996
-
\??\c:\fxxrllf.exec:\fxxrllf.exe93⤵PID:3628
-
\??\c:\hbtnhh.exec:\hbtnhh.exe94⤵PID:2496
-
\??\c:\dvvpj.exec:\dvvpj.exe95⤵PID:3976
-
\??\c:\lffxxxx.exec:\lffxxxx.exe96⤵PID:4632
-
\??\c:\fxllrrx.exec:\fxllrrx.exe97⤵PID:3540
-
\??\c:\thnhhh.exec:\thnhhh.exe98⤵PID:516
-
\??\c:\pdppj.exec:\pdppj.exe99⤵PID:1668
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe100⤵PID:3516
-
\??\c:\rrrlrrx.exec:\rrrlrrx.exe101⤵PID:1160
-
\??\c:\tbtbnb.exec:\tbtbnb.exe102⤵PID:4544
-
\??\c:\dpjjj.exec:\dpjjj.exe103⤵PID:1840
-
\??\c:\1xxrlfx.exec:\1xxrlfx.exe104⤵PID:2192
-
\??\c:\frfrlrx.exec:\frfrlrx.exe105⤵PID:2584
-
\??\c:\tnnnbh.exec:\tnnnbh.exe106⤵PID:216
-
\??\c:\5vjdj.exec:\5vjdj.exe107⤵PID:3004
-
\??\c:\dddjd.exec:\dddjd.exe108⤵PID:4456
-
\??\c:\lllflfl.exec:\lllflfl.exe109⤵PID:1736
-
\??\c:\vjpjj.exec:\vjpjj.exe110⤵PID:1320
-
\??\c:\vjpdd.exec:\vjpdd.exe111⤵PID:1104
-
\??\c:\tbbtnh.exec:\tbbtnh.exe112⤵PID:3536
-
\??\c:\jvddd.exec:\jvddd.exe113⤵PID:3872
-
\??\c:\vpdvv.exec:\vpdvv.exe114⤵PID:1332
-
\??\c:\9frrlfx.exec:\9frrlfx.exe115⤵PID:4644
-
\??\c:\tttnhh.exec:\tttnhh.exe116⤵PID:908
-
\??\c:\bbbtnn.exec:\bbbtnn.exe117⤵PID:1472
-
\??\c:\dpvdj.exec:\dpvdj.exe118⤵PID:2268
-
\??\c:\7lxlfxr.exec:\7lxlfxr.exe119⤵PID:2604
-
\??\c:\tttttt.exec:\tttttt.exe120⤵PID:4532
-
\??\c:\btttnn.exec:\btttnn.exe121⤵PID:2488
-
\??\c:\jjdvp.exec:\jjdvp.exe122⤵PID:2408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-