Analysis
-
max time kernel
55s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe
-
Size
473KB
-
MD5
4c5a1dc80056294c398634238fb9ba00
-
SHA1
d377e1b5b4049ed6c1e0c6db55422d089f3ac4e6
-
SHA256
c78874414c56eb6f6338eb5d6af363953e8344258ea019a35bfee2a3ed2056df
-
SHA512
9b0b58dea7ad52b5c7329983dc550946a7f7073a1adb8ac44c01ce8f950a9a0a54695abc3ef36fadb2e688680c61aaef3b8c8e518fd8703a3369f4240f21ebc3
-
SSDEEP
6144:lcm7ImGddXmNt251UriZFwT+aZKl7pg1xBC:H7Tc2NYHUrAwT+OKLSjC
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral1/memory/3000-7-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1796-19-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2840-57-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2644-48-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1980-38-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2312-78-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1508-89-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2980-114-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1440-139-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2664-138-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1440-147-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1440-146-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1292-165-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2364-177-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/572-188-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2364-186-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2364-184-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2860-197-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/572-195-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2860-206-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/944-235-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1328-257-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2068-247-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2140-275-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2140-283-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2180-293-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2332-302-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1076-327-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2720-349-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2744-363-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2448-376-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2584-384-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2500-391-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2784-399-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2772-405-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2708-441-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1604-459-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/672-465-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1144-471-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/288-483-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1260-507-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/832-519-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1028-531-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1248-537-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1656-549-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1772-525-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/344-513-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2408-489-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1452-453-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2668-447-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1868-429-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2480-423-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2808-417-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2788-411-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2448-377-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2744-370-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2556-362-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2516-348-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1072-340-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1072-339-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2876-320-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2876-319-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2832-312-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2832-310-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
0266282.exehbnhnb.exepjvdv.exe20464.exe3dpvj.exehtttnh.exeo840846.exeu880224.exennhnbh.exe48686.exejjdvp.exek66422.exec040280.exepvjvj.exebtnnbb.exettnbnt.exei484006.exejdvjv.exeq04240.exeffffrxf.exe5pjpd.exepvvjj.exe0446046.exe26802.exe60220.exe26468.exerlfxflf.exerrflxxr.exevjvdj.exe820022.exe260066.exe26840.exennhnbh.exeffxfrxr.exe04280.exee02806.exetnbnhb.exei802840.exexrffrrf.exe860066.exepjvdp.exevpjpd.exec688440.exe048462.exe9frxlrx.exe882088.exe868806.exe424088.exe04806.exew26800.exefxffrrf.exedvpvp.exeflxlllf.exebbhtnt.exe84848.exeg0880.exedvjpj.exe642204.exe088400.exe48062.exe8648440.exek62626.exepdpjv.exe048602.exepid process 1796 0266282.exe 3012 hbnhnb.exe 1980 pjvdv.exe 2644 20464.exe 2840 3dpvj.exe 2732 htttnh.exe 2312 o840846.exe 2420 u880224.exe 1508 nnhnbh.exe 2788 48686.exe 2980 jjdvp.exe 2952 k66422.exe 2664 c040280.exe 1440 pvjvj.exe 2676 btnnbb.exe 1292 ttnbnt.exe 1144 i484006.exe 2364 jdvjv.exe 572 q04240.exe 2860 ffffrxf.exe 396 5pjpd.exe 836 pvvjj.exe 944 0446046.exe 1996 26802.exe 2068 60220.exe 1328 26468.exe 568 rlfxflf.exe 2140 rrflxxr.exe 2180 vjvdj.exe 2332 820022.exe 2832 260066.exe 2876 26840.exe 1584 nnhnbh.exe 1076 ffxfrxr.exe 1072 04280.exe 2516 e02806.exe 2720 tnbnhb.exe 2556 i802840.exe 2744 xrffrrf.exe 2448 860066.exe 2584 pjvdp.exe 2500 vpjpd.exe 2784 c688440.exe 2772 048462.exe 2788 9frxlrx.exe 2808 882088.exe 2480 868806.exe 1868 424088.exe 2712 04806.exe 2708 w26800.exe 2668 fxffrrf.exe 1452 dvpvp.exe 1604 flxlllf.exe 672 bbhtnt.exe 1144 84848.exe 2112 g0880.exe 288 dvjpj.exe 2408 642204.exe 2856 088400.exe 396 48062.exe 1260 8648440.exe 344 k62626.exe 832 pdpjv.exe 1772 048602.exe -
Processes:
resource yara_rule behavioral1/memory/3000-0-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3000-7-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3000-6-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1796-11-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1796-19-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2840-57-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2644-48-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2644-40-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1980-38-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2312-69-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2312-78-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1508-89-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2980-106-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2980-114-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2952-118-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2664-138-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1440-147-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1440-146-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1144-166-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1292-165-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2364-177-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/572-188-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2364-186-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/572-195-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2860-206-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/944-235-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1328-257-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2068-247-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2140-275-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2140-283-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2180-293-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2332-302-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1076-327-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2720-349-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2744-363-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2584-384-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2500-391-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2784-399-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2772-405-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2708-441-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1604-459-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/672-465-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1144-471-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/288-483-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1260-507-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1772-525-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/344-513-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1452-453-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2668-447-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1868-429-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2480-423-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2808-417-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2788-411-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2784-392-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2448-377-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2744-370-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2556-362-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2516-348-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2516-341-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1072-340-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1072-339-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2876-320-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2876-319-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2832-312-0x0000000000400000-0x00000000004C4000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe0266282.exehbnhnb.exepjvdv.exe20464.exe3dpvj.exehtttnh.exeo840846.exeu880224.exennhnbh.exe48686.exejjdvp.exek66422.exec040280.exepvjvj.exebtnnbb.exedescription pid process target process PID 3000 wrote to memory of 1796 3000 4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe 7frxffr.exe PID 3000 wrote to memory of 1796 3000 4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe 7frxffr.exe PID 3000 wrote to memory of 1796 3000 4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe 7frxffr.exe PID 3000 wrote to memory of 1796 3000 4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe 7frxffr.exe PID 1796 wrote to memory of 3012 1796 0266282.exe PID 1796 wrote to memory of 3012 1796 0266282.exe PID 1796 wrote to memory of 3012 1796 0266282.exe PID 1796 wrote to memory of 3012 1796 0266282.exe PID 3012 wrote to memory of 1980 3012 hbnhnb.exe pjvdv.exe PID 3012 wrote to memory of 1980 3012 hbnhnb.exe pjvdv.exe PID 3012 wrote to memory of 1980 3012 hbnhnb.exe pjvdv.exe PID 3012 wrote to memory of 1980 3012 hbnhnb.exe pjvdv.exe PID 1980 wrote to memory of 2644 1980 pjvdv.exe PID 1980 wrote to memory of 2644 1980 pjvdv.exe PID 1980 wrote to memory of 2644 1980 pjvdv.exe PID 1980 wrote to memory of 2644 1980 pjvdv.exe PID 2644 wrote to memory of 2840 2644 20464.exe PID 2644 wrote to memory of 2840 2644 20464.exe PID 2644 wrote to memory of 2840 2644 20464.exe PID 2644 wrote to memory of 2840 2644 20464.exe PID 2840 wrote to memory of 2732 2840 3dpvj.exe vpjjp.exe PID 2840 wrote to memory of 2732 2840 3dpvj.exe vpjjp.exe PID 2840 wrote to memory of 2732 2840 3dpvj.exe vpjjp.exe PID 2840 wrote to memory of 2732 2840 3dpvj.exe vpjjp.exe PID 2732 wrote to memory of 2312 2732 htttnh.exe o840846.exe PID 2732 wrote to memory of 2312 2732 htttnh.exe o840846.exe PID 2732 wrote to memory of 2312 2732 htttnh.exe o840846.exe PID 2732 wrote to memory of 2312 2732 htttnh.exe o840846.exe PID 2312 wrote to memory of 2420 2312 o840846.exe PID 2312 wrote to memory of 2420 2312 o840846.exe PID 2312 wrote to memory of 2420 2312 o840846.exe PID 2312 wrote to memory of 2420 2312 o840846.exe PID 2420 wrote to memory of 1508 2420 u880224.exe PID 2420 wrote to memory of 1508 2420 u880224.exe PID 2420 wrote to memory of 1508 2420 u880224.exe PID 2420 wrote to memory of 1508 2420 u880224.exe PID 1508 wrote to memory of 2788 1508 nnhnbh.exe PID 1508 wrote to memory of 2788 1508 nnhnbh.exe PID 1508 wrote to memory of 2788 1508 nnhnbh.exe PID 1508 wrote to memory of 2788 1508 nnhnbh.exe PID 2788 wrote to memory of 2980 2788 48686.exe jjdvp.exe PID 2788 wrote to memory of 2980 2788 48686.exe jjdvp.exe PID 2788 wrote to memory of 2980 2788 48686.exe jjdvp.exe PID 2788 wrote to memory of 2980 2788 48686.exe jjdvp.exe PID 2980 wrote to memory of 2952 2980 jjdvp.exe xrrffff.exe PID 2980 wrote to memory of 2952 2980 jjdvp.exe xrrffff.exe PID 2980 wrote to memory of 2952 2980 jjdvp.exe xrrffff.exe PID 2980 wrote to memory of 2952 2980 jjdvp.exe xrrffff.exe PID 2952 wrote to memory of 2664 2952 k66422.exe c040280.exe PID 2952 wrote to memory of 2664 2952 k66422.exe c040280.exe PID 2952 wrote to memory of 2664 2952 k66422.exe c040280.exe PID 2952 wrote to memory of 2664 2952 k66422.exe c040280.exe PID 2664 wrote to memory of 1440 2664 c040280.exe PID 2664 wrote to memory of 1440 2664 c040280.exe PID 2664 wrote to memory of 1440 2664 c040280.exe PID 2664 wrote to memory of 1440 2664 c040280.exe PID 1440 wrote to memory of 2676 1440 pvjvj.exe btnnbb.exe PID 1440 wrote to memory of 2676 1440 pvjvj.exe btnnbb.exe PID 1440 wrote to memory of 2676 1440 pvjvj.exe btnnbb.exe PID 1440 wrote to memory of 2676 1440 pvjvj.exe btnnbb.exe PID 2676 wrote to memory of 1292 2676 btnnbb.exe PID 2676 wrote to memory of 1292 2676 btnnbb.exe PID 2676 wrote to memory of 1292 2676 btnnbb.exe PID 2676 wrote to memory of 1292 2676 btnnbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\0266282.exec:\0266282.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\hbnhnb.exec:\hbnhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\pjvdv.exec:\pjvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\20464.exec:\20464.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\3dpvj.exec:\3dpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\htttnh.exec:\htttnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\o840846.exec:\o840846.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\u880224.exec:\u880224.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nnhnbh.exec:\nnhnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\48686.exec:\48686.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jjdvp.exec:\jjdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\k66422.exec:\k66422.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\c040280.exec:\c040280.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\pvjvj.exec:\pvjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\btnnbb.exec:\btnnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\ttnbnt.exec:\ttnbnt.exe17⤵
- Executes dropped EXE
PID:1292 -
\??\c:\i484006.exec:\i484006.exe18⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jdvjv.exec:\jdvjv.exe19⤵
- Executes dropped EXE
PID:2364 -
\??\c:\q04240.exec:\q04240.exe20⤵
- Executes dropped EXE
PID:572 -
\??\c:\ffffrxf.exec:\ffffrxf.exe21⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5pjpd.exec:\5pjpd.exe22⤵
- Executes dropped EXE
PID:396 -
\??\c:\pvvjj.exec:\pvvjj.exe23⤵
- Executes dropped EXE
PID:836 -
\??\c:\0446046.exec:\0446046.exe24⤵
- Executes dropped EXE
PID:944 -
\??\c:\26802.exec:\26802.exe25⤵
- Executes dropped EXE
PID:1996 -
\??\c:\60220.exec:\60220.exe26⤵
- Executes dropped EXE
PID:2068 -
\??\c:\26468.exec:\26468.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rlfxflf.exec:\rlfxflf.exe28⤵
- Executes dropped EXE
PID:568 -
\??\c:\rrflxxr.exec:\rrflxxr.exe29⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vjvdj.exec:\vjvdj.exe30⤵
- Executes dropped EXE
PID:2180 -
\??\c:\820022.exec:\820022.exe31⤵
- Executes dropped EXE
PID:2332 -
\??\c:\260066.exec:\260066.exe32⤵
- Executes dropped EXE
PID:2832 -
\??\c:\26840.exec:\26840.exe33⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nnhnbh.exec:\nnhnbh.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe35⤵
- Executes dropped EXE
PID:1076 -
\??\c:\04280.exec:\04280.exe36⤵
- Executes dropped EXE
PID:1072 -
\??\c:\e02806.exec:\e02806.exe37⤵
- Executes dropped EXE
PID:2516 -
\??\c:\tnbnhb.exec:\tnbnhb.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\i802840.exec:\i802840.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\xrffrrf.exec:\xrffrrf.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\860066.exec:\860066.exe41⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pjvdp.exec:\pjvdp.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vpjpd.exec:\vpjpd.exe43⤵
- Executes dropped EXE
PID:2500 -
\??\c:\c688440.exec:\c688440.exe44⤵
- Executes dropped EXE
PID:2784 -
\??\c:\048462.exec:\048462.exe45⤵
- Executes dropped EXE
PID:2772 -
\??\c:\9frxlrx.exec:\9frxlrx.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\882088.exec:\882088.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\868806.exec:\868806.exe48⤵
- Executes dropped EXE
PID:2480 -
\??\c:\424088.exec:\424088.exe49⤵
- Executes dropped EXE
PID:1868 -
\??\c:\04806.exec:\04806.exe50⤵
- Executes dropped EXE
PID:2712 -
\??\c:\w26800.exec:\w26800.exe51⤵
- Executes dropped EXE
PID:2708 -
\??\c:\fxffrrf.exec:\fxffrrf.exe52⤵
- Executes dropped EXE
PID:2668 -
\??\c:\dvpvp.exec:\dvpvp.exe53⤵
- Executes dropped EXE
PID:1452 -
\??\c:\flxlllf.exec:\flxlllf.exe54⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bbhtnt.exec:\bbhtnt.exe55⤵
- Executes dropped EXE
PID:672 -
\??\c:\84848.exec:\84848.exe56⤵
- Executes dropped EXE
PID:1144 -
\??\c:\g0880.exec:\g0880.exe57⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dvjpj.exec:\dvjpj.exe58⤵
- Executes dropped EXE
PID:288 -
\??\c:\642204.exec:\642204.exe59⤵
- Executes dropped EXE
PID:2408 -
\??\c:\088400.exec:\088400.exe60⤵
- Executes dropped EXE
PID:2856 -
\??\c:\48062.exec:\48062.exe61⤵
- Executes dropped EXE
PID:396 -
\??\c:\8648440.exec:\8648440.exe62⤵
- Executes dropped EXE
PID:1260 -
\??\c:\k62626.exec:\k62626.exe63⤵
- Executes dropped EXE
PID:344 -
\??\c:\pdpjv.exec:\pdpjv.exe64⤵
- Executes dropped EXE
PID:832 -
\??\c:\048602.exec:\048602.exe65⤵
- Executes dropped EXE
PID:1772 -
\??\c:\llxxrxr.exec:\llxxrxr.exe66⤵PID:1028
-
\??\c:\xrfrxfx.exec:\xrfrxfx.exe67⤵PID:1248
-
\??\c:\nnhhnn.exec:\nnhhnn.exe68⤵PID:2220
-
\??\c:\822080.exec:\822080.exe69⤵PID:1656
-
\??\c:\3pjpv.exec:\3pjpv.exe70⤵PID:1264
-
\??\c:\04862.exec:\04862.exe71⤵PID:1684
-
\??\c:\g6446.exec:\g6446.exe72⤵PID:1188
-
\??\c:\8688484.exec:\8688484.exe73⤵PID:2196
-
\??\c:\04246.exec:\04246.exe74⤵PID:1992
-
\??\c:\0484662.exec:\0484662.exe75⤵PID:2056
-
\??\c:\fxrrflf.exec:\fxrrflf.exe76⤵PID:1816
-
\??\c:\20624.exec:\20624.exe77⤵PID:2760
-
\??\c:\ddjpv.exec:\ddjpv.exe78⤵PID:2532
-
\??\c:\268266.exec:\268266.exe79⤵PID:2184
-
\??\c:\k42844.exec:\k42844.exe80⤵PID:1980
-
\??\c:\g6402.exec:\g6402.exe81⤵PID:2208
-
\??\c:\tnbhtt.exec:\tnbhtt.exe82⤵PID:2840
-
\??\c:\280448.exec:\280448.exe83⤵PID:2768
-
\??\c:\608800.exec:\608800.exe84⤵PID:2728
-
\??\c:\5dvvd.exec:\5dvvd.exe85⤵PID:2448
-
\??\c:\xrfrrrr.exec:\xrfrrrr.exe86⤵PID:1800
-
\??\c:\dppjj.exec:\dppjj.exe87⤵PID:2764
-
\??\c:\880220.exec:\880220.exe88⤵PID:304
-
\??\c:\frrrflx.exec:\frrrflx.exe89⤵PID:2696
-
\??\c:\04686.exec:\04686.exe90⤵PID:1916
-
\??\c:\k68266.exec:\k68266.exe91⤵PID:2928
-
\??\c:\2224620.exec:\2224620.exe92⤵PID:2236
-
\??\c:\o684066.exec:\o684066.exe93⤵PID:2672
-
\??\c:\jjjpp.exec:\jjjpp.exe94⤵PID:2948
-
\??\c:\2260008.exec:\2260008.exe95⤵PID:536
-
\??\c:\tthnhn.exec:\tthnhn.exe96⤵PID:2204
-
\??\c:\3frxrfr.exec:\3frxrfr.exe97⤵PID:2232
-
\??\c:\fxxffll.exec:\fxxffll.exe98⤵PID:1256
-
\??\c:\xlxxlfl.exec:\xlxxlfl.exe99⤵PID:1604
-
\??\c:\6602022.exec:\6602022.exe100⤵PID:2308
-
\??\c:\6040824.exec:\6040824.exe101⤵PID:2160
-
\??\c:\lxxrlrr.exec:\lxxrlrr.exe102⤵PID:2976
-
\??\c:\tnhtnb.exec:\tnhtnb.exe103⤵PID:1844
-
\??\c:\42484.exec:\42484.exe104⤵PID:1808
-
\??\c:\42446.exec:\42446.exe105⤵PID:2660
-
\??\c:\820640.exec:\820640.exe106⤵PID:2960
-
\??\c:\26448.exec:\26448.exe107⤵PID:836
-
\??\c:\hbntbb.exec:\hbntbb.exe108⤵PID:300
-
\??\c:\bhthnh.exec:\bhthnh.exe109⤵PID:2040
-
\??\c:\0888686.exec:\0888686.exe110⤵PID:1540
-
\??\c:\3tnttt.exec:\3tnttt.exe111⤵PID:2012
-
\??\c:\028026.exec:\028026.exe112⤵PID:2272
-
\??\c:\bbhbhh.exec:\bbhbhh.exe113⤵PID:2268
-
\??\c:\jdjvj.exec:\jdjvj.exe114⤵PID:1348
-
\??\c:\e64684.exec:\e64684.exe115⤵PID:880
-
\??\c:\9hhtnn.exec:\9hhtnn.exe116⤵PID:988
-
\??\c:\jpvpj.exec:\jpvpj.exe117⤵PID:884
-
\??\c:\fxrrffl.exec:\fxrrffl.exe118⤵PID:1752
-
\??\c:\lrrfxfx.exec:\lrrfxfx.exe119⤵PID:2888
-
\??\c:\60464.exec:\60464.exe120⤵PID:1992
-
\??\c:\640228.exec:\640228.exe121⤵PID:2056
-
\??\c:\7frxffr.exec:\7frxffr.exe122⤵PID:1796
-
\??\c:\pvvdp.exec:\pvvdp.exe123⤵PID:2760
-
\??\c:\64868.exec:\64868.exe124⤵PID:1672
-
\??\c:\48086.exec:\48086.exe125⤵PID:2648
-
\??\c:\fxxrxfx.exec:\fxxrxfx.exe126⤵PID:2640
-
\??\c:\xrfrlrf.exec:\xrfrlrf.exe127⤵PID:2548
-
\??\c:\04008.exec:\04008.exe128⤵PID:2556
-
\??\c:\1xxfllr.exec:\1xxfllr.exe129⤵PID:2628
-
\??\c:\3fxxllr.exec:\3fxxllr.exe130⤵PID:876
-
\??\c:\o488624.exec:\o488624.exe131⤵PID:2560
-
\??\c:\82002.exec:\82002.exe132⤵PID:3000
-
\??\c:\044680.exec:\044680.exe133⤵PID:2700
-
\??\c:\xfllrxl.exec:\xfllrxl.exe134⤵PID:2820
-
\??\c:\282042.exec:\282042.exe135⤵PID:2172
-
\??\c:\c648840.exec:\c648840.exe136⤵PID:1376
-
\??\c:\ppjvd.exec:\ppjvd.exe137⤵PID:1300
-
\??\c:\rrxlfrl.exec:\rrxlfrl.exe138⤵PID:2424
-
\??\c:\lxlxxfr.exec:\lxlxxfr.exe139⤵PID:2480
-
\??\c:\xrrffff.exec:\xrrffff.exe140⤵PID:2952
-
\??\c:\jjvvj.exec:\jjvvj.exe141⤵PID:2672
-
\??\c:\204080.exec:\204080.exe142⤵PID:2948
-
\??\c:\dvjpv.exec:\dvjpv.exe143⤵PID:536
-
\??\c:\4806440.exec:\4806440.exe144⤵PID:2580
-
\??\c:\pdddp.exec:\pdddp.exe145⤵PID:1272
-
\??\c:\xrlxlfl.exec:\xrlxlfl.exe146⤵PID:1932
-
\??\c:\rlffrrf.exec:\rlffrrf.exe147⤵PID:1604
-
\??\c:\226864.exec:\226864.exe148⤵PID:1512
-
\??\c:\9btttb.exec:\9btttb.exe149⤵PID:1944
-
\??\c:\ppjpv.exec:\ppjpv.exe150⤵PID:2376
-
\??\c:\9nbbhn.exec:\9nbbhn.exe151⤵PID:648
-
\??\c:\jdddj.exec:\jdddj.exe152⤵PID:584
-
\??\c:\6028624.exec:\6028624.exe153⤵PID:1788
-
\??\c:\64284.exec:\64284.exe154⤵PID:436
-
\??\c:\4200224.exec:\4200224.exe155⤵PID:2088
-
\??\c:\1pjpp.exec:\1pjpp.exe156⤵PID:2612
-
\??\c:\e60684.exec:\e60684.exe157⤵PID:832
-
\??\c:\04248.exec:\04248.exe158⤵PID:3068
-
\??\c:\vdvpj.exec:\vdvpj.exe159⤵PID:1028
-
\??\c:\04286.exec:\04286.exe160⤵PID:756
-
\??\c:\hhhtbb.exec:\hhhtbb.exe161⤵PID:2524
-
\??\c:\4448264.exec:\4448264.exe162⤵PID:1472
-
\??\c:\btnntt.exec:\btnntt.exe163⤵PID:1348
-
\??\c:\hbtbnn.exec:\hbtbnn.exe164⤵PID:3028
-
\??\c:\jdvdj.exec:\jdvdj.exe165⤵PID:988
-
\??\c:\82402.exec:\82402.exe166⤵PID:884
-
\??\c:\jjddp.exec:\jjddp.exe167⤵PID:1752
-
\??\c:\nbhhhh.exec:\nbhhhh.exe168⤵PID:2888
-
\??\c:\tbtbnt.exec:\tbtbnt.exe169⤵PID:1584
-
\??\c:\e66280.exec:\e66280.exe170⤵PID:2036
-
\??\c:\dvvdp.exec:\dvvdp.exe171⤵PID:2828
-
\??\c:\bthnbt.exec:\bthnbt.exe172⤵PID:2636
-
\??\c:\bbthnt.exec:\bbthnt.exe173⤵PID:484
-
\??\c:\q42862.exec:\q42862.exe174⤵PID:2552
-
\??\c:\e44200.exec:\e44200.exe175⤵PID:1432
-
\??\c:\88664.exec:\88664.exe176⤵PID:2452
-
\??\c:\pvjjp.exec:\pvjjp.exe177⤵PID:704
-
\??\c:\7nhthn.exec:\7nhthn.exe178⤵PID:2704
-
\??\c:\lrrfrll.exec:\lrrfrll.exe179⤵PID:2736
-
\??\c:\e44206.exec:\e44206.exe180⤵PID:2388
-
\??\c:\ttbttt.exec:\ttbttt.exe181⤵PID:1800
-
\??\c:\hnbhtb.exec:\hnbhtb.exe182⤵PID:2280
-
\??\c:\0486448.exec:\0486448.exe183⤵PID:2924
-
\??\c:\82626.exec:\82626.exe184⤵PID:2812
-
\??\c:\vpjjp.exec:\vpjjp.exe185⤵PID:2696
-
\??\c:\9ffxffr.exec:\9ffxffr.exe186⤵PID:1376
-
\??\c:\00682.exec:\00682.exe187⤵PID:1300
-
\??\c:\u288888.exec:\u288888.exe188⤵PID:2596
-
\??\c:\264640.exec:\264640.exe189⤵PID:2480
-
\??\c:\8442448.exec:\8442448.exe190⤵PID:2712
-
\??\c:\3tnbtb.exec:\3tnbtb.exe191⤵PID:1284
-
\??\c:\s8620.exec:\s8620.exe192⤵PID:660
-
\??\c:\jdvdv.exec:\jdvdv.exe193⤵PID:1636
-
\??\c:\1thhnt.exec:\1thhnt.exe194⤵PID:2204
-
\??\c:\5xllrxl.exec:\5xllrxl.exe195⤵PID:1272
-
\??\c:\482884.exec:\482884.exe196⤵PID:1932
-
\??\c:\vpdjp.exec:\vpdjp.exe197⤵PID:2604
-
\??\c:\04622.exec:\04622.exe198⤵PID:1356
-
\??\c:\9jdjj.exec:\9jdjj.exe199⤵PID:2816
-
\??\c:\nttbnb.exec:\nttbnb.exe200⤵PID:1108
-
\??\c:\5frrflr.exec:\5frrflr.exe201⤵PID:648
-
\??\c:\9dppv.exec:\9dppv.exe202⤵PID:1252
-
\??\c:\642428.exec:\642428.exe203⤵PID:1260
-
\??\c:\828406.exec:\828406.exe204⤵PID:2372
-
\??\c:\4268620.exec:\4268620.exe205⤵PID:2088
-
\??\c:\jdvdj.exec:\jdvdj.exe206⤵PID:2612
-
\??\c:\w04028.exec:\w04028.exe207⤵PID:1540
-
\??\c:\q86006.exec:\q86006.exe208⤵PID:2012
-
\??\c:\3jdvp.exec:\3jdvp.exe209⤵PID:1028
-
\??\c:\c040224.exec:\c040224.exe210⤵PID:1780
-
\??\c:\6040280.exec:\6040280.exe211⤵PID:984
-
\??\c:\28248.exec:\28248.exe212⤵PID:2912
-
\??\c:\w00202.exec:\w00202.exe213⤵PID:1348
-
\??\c:\rxrxllr.exec:\rxrxllr.exe214⤵PID:2132
-
\??\c:\vjvvj.exec:\vjvvj.exe215⤵PID:2392
-
\??\c:\7jdvv.exec:\7jdvv.exe216⤵PID:2324
-
\??\c:\jjjvj.exec:\jjjvj.exe217⤵PID:1752
-
\??\c:\c428064.exec:\c428064.exe218⤵PID:2608
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe219⤵PID:1068
-
\??\c:\httnhn.exec:\httnhn.exe220⤵PID:2056
-
\??\c:\7flxflx.exec:\7flxflx.exe221⤵PID:2200
-
\??\c:\hnhbnn.exec:\hnhbnn.exe222⤵PID:2052
-
\??\c:\82022.exec:\82022.exe223⤵PID:2532
-
\??\c:\xxflxxf.exec:\xxflxxf.exe224⤵PID:2752
-
\??\c:\206666.exec:\206666.exe225⤵PID:2720
-
\??\c:\a0468.exec:\a0468.exe226⤵PID:1736
-
\??\c:\bbtbtt.exec:\bbtbtt.exe227⤵PID:2732
-
\??\c:\a8662.exec:\a8662.exe228⤵PID:2428
-
\??\c:\3tbtbt.exec:\3tbtbt.exe229⤵PID:2448
-
\??\c:\7ttbth.exec:\7ttbth.exe230⤵PID:2420
-
\??\c:\822800.exec:\822800.exe231⤵PID:2500
-
\??\c:\nhbbhh.exec:\nhbbhh.exe232⤵PID:2152
-
\??\c:\nhttbh.exec:\nhttbh.exe233⤵PID:2412
-
\??\c:\0462808.exec:\0462808.exe234⤵PID:784
-
\??\c:\pdpvj.exec:\pdpvj.exe235⤵PID:1444
-
\??\c:\5pvvp.exec:\5pvvp.exe236⤵PID:1916
-
\??\c:\86468.exec:\86468.exe237⤵PID:1564
-
\??\c:\g8208.exec:\g8208.exe238⤵PID:2808
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe239⤵PID:1440
-
\??\c:\q04428.exec:\q04428.exe240⤵PID:2340
-
\??\c:\jdvdp.exec:\jdvdp.exe241⤵PID:800
-
\??\c:\820666.exec:\820666.exe242⤵PID:684