Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe
-
Size
473KB
-
MD5
4c5a1dc80056294c398634238fb9ba00
-
SHA1
d377e1b5b4049ed6c1e0c6db55422d089f3ac4e6
-
SHA256
c78874414c56eb6f6338eb5d6af363953e8344258ea019a35bfee2a3ed2056df
-
SHA512
9b0b58dea7ad52b5c7329983dc550946a7f7073a1adb8ac44c01ce8f950a9a0a54695abc3ef36fadb2e688680c61aaef3b8c8e518fd8703a3369f4240f21ebc3
-
SSDEEP
6144:lcm7ImGddXmNt251UriZFwT+aZKl7pg1xBC:H7Tc2NYHUrAwT+OKLSjC
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4788-5-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/556-11-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/836-20-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4040-28-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4760-36-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/448-42-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4760-40-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4976-49-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/448-47-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4040-34-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/796-71-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2252-69-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2252-76-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2368-77-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3112-90-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4080-99-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2088-113-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3888-138-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1724-150-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4220-157-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4220-163-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4824-171-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/60-178-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4376-206-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4840-205-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4376-213-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2992-225-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2992-229-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4728-235-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/320-249-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/320-253-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4976-258-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2036-256-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1776-272-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1612-277-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4412-283-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1612-282-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1548-300-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4000-314-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4520-315-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1544-309-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1544-306-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1064-304-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4936-295-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4936-291-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2304-290-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2432-276-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4224-267-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4224-263-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2036-262-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4144-248-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2164-245-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4264-234-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4264-230-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3948-224-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3948-221-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4368-218-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4368-211-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4028-199-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4840-197-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4028-193-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4968-186-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3540-184-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/5012-152-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdjdd.exerllxrfx.exehtbnnn.exejvddp.exebhhhtn.exe3pjpd.exethbnht.exerlxfrxr.exehbbbbb.exepjpdv.exexflfxxr.exetnbnnb.exedjvjv.exe1rlfxfx.exettnhtn.exevddjp.exexxrfrlf.exebhhbnh.exedvjdj.exe5rxlxrf.exepjpjp.exeffxlxxf.exehbthbt.exejdjvd.exebththt.exe5llfxrr.exentnbth.exejpdvj.exehhbnbn.exe3xxlrrr.exexlllfxr.exebhhbnh.exevvjpd.exerflxfxr.exehhhtnn.exepjdvp.exe5bbnbb.exejppjd.exe3xxrfxr.exehbhbbh.exe9nnhbb.exepjjvp.exe5fxlfxl.exenbnhtn.exehtnhbt.exedddpp.exethbtbb.exe7jdpp.exelrrfrlf.exe5tttnn.exedppjp.exenntnbt.exepdddj.exexxxlfxl.exebtbnhb.exe3vvpp.exerfxlxfr.exehbnbnh.exebbbnbt.exepjpdd.exe7flffxl.exe3bbtbt.exe9djdd.exe1frrxll.exepid process 556 jdjdd.exe 836 rllxrfx.exe 1480 htbnnn.exe 4040 jvddp.exe 4760 bhhhtn.exe 448 3pjpd.exe 4976 thbnht.exe 2044 rlxfrxr.exe 796 hbbbbb.exe 2252 pjpdv.exe 2368 xflfxxr.exe 3112 tnbnnb.exe 1612 djvjv.exe 4080 1rlfxfx.exe 2088 ttnhtn.exe 1444 vddjp.exe 988 xxrfrlf.exe 4928 bhhbnh.exe 716 dvjdj.exe 3888 5rxlxrf.exe 1724 pjpjp.exe 5012 ffxlxxf.exe 4220 hbthbt.exe 4824 jdjvd.exe 60 bththt.exe 3540 5llfxrr.exe 4968 ntnbth.exe 4028 jpdvj.exe 4840 hhbnbn.exe 4376 3xxlrrr.exe 4368 xlllfxr.exe 3948 bhhbnh.exe 2992 vvjpd.exe 4264 rflxfxr.exe 4728 hhhtnn.exe 2164 pjdvp.exe 4144 5bbnbb.exe 320 jppjd.exe 4976 3xxrfxr.exe 2036 hbhbbh.exe 4224 9nnhbb.exe 1776 pjjvp.exe 2432 5fxlfxl.exe 1612 nbnhtn.exe 4412 htnhbt.exe 2304 dddpp.exe 4936 thbtbb.exe 1548 7jdpp.exe 1064 lrrfrlf.exe 1544 5tttnn.exe 4000 dppjp.exe 4520 nntnbt.exe 1716 pdddj.exe 4084 xxxlfxl.exe 1108 btbnhb.exe 4012 3vvpp.exe 3976 rfxlxfr.exe 3724 hbnbnh.exe 1252 bbbnbt.exe 1416 pjpdd.exe 1976 7flffxl.exe 1404 3bbtbt.exe 1536 9djdd.exe 2924 1frrxll.exe -
Processes:
resource yara_rule behavioral2/memory/4788-5-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/556-11-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1480-21-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/836-20-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4040-28-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4760-36-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/448-42-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4760-40-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/448-47-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4040-34-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/796-71-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2252-69-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2252-76-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2368-77-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3112-90-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4080-99-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2088-103-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2088-113-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3888-138-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1724-145-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1724-150-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4220-157-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4220-163-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4824-171-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3540-179-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/60-178-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4376-206-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4840-205-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4376-213-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2992-225-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2992-229-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4728-235-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2164-239-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/320-249-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/320-253-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4976-258-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1776-268-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1776-272-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1612-277-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4412-283-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1612-282-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1548-300-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4000-310-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4000-314-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4520-315-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1544-309-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1544-306-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1064-304-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1548-296-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4936-295-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4936-291-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2304-290-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2432-276-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4224-267-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4224-263-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2036-262-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4144-248-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2164-245-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4264-234-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4264-230-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3948-224-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3948-221-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4368-218-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4028-199-0x0000000000400000-0x00000000004C4000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exejdjdd.exerllxrfx.exehtbnnn.exejvddp.exebhhhtn.exe3pjpd.exethbnht.exerlxfrxr.exehbbbbb.exepjpdv.exexflfxxr.exetnbnnb.exedjvjv.exe1rlfxfx.exettnhtn.exevddjp.exexxrfrlf.exebhhbnh.exedvjdj.exe5rxlxrf.exepjpjp.exedescription pid process target process PID 4788 wrote to memory of 556 4788 4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe hnbhnn.exe PID 4788 wrote to memory of 556 4788 4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe hnbhnn.exe PID 4788 wrote to memory of 556 4788 4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe hnbhnn.exe PID 556 wrote to memory of 836 556 jdjdd.exe rfxxllf.exe PID 556 wrote to memory of 836 556 jdjdd.exe rfxxllf.exe PID 556 wrote to memory of 836 556 jdjdd.exe rfxxllf.exe PID 836 wrote to memory of 1480 836 rllxrfx.exe hntbtb.exe PID 836 wrote to memory of 1480 836 rllxrfx.exe hntbtb.exe PID 836 wrote to memory of 1480 836 rllxrfx.exe hntbtb.exe PID 1480 wrote to memory of 4040 1480 htbnnn.exe jvddp.exe PID 1480 wrote to memory of 4040 1480 htbnnn.exe jvddp.exe PID 1480 wrote to memory of 4040 1480 htbnnn.exe jvddp.exe PID 4040 wrote to memory of 4760 4040 jvddp.exe bhhhtn.exe PID 4040 wrote to memory of 4760 4040 jvddp.exe bhhhtn.exe PID 4040 wrote to memory of 4760 4040 jvddp.exe bhhhtn.exe PID 4760 wrote to memory of 448 4760 bhhhtn.exe xxrrlxr.exe PID 4760 wrote to memory of 448 4760 bhhhtn.exe xxrrlxr.exe PID 4760 wrote to memory of 448 4760 bhhhtn.exe xxrrlxr.exe PID 448 wrote to memory of 4976 448 3pjpd.exe 3xxrfxr.exe PID 448 wrote to memory of 4976 448 3pjpd.exe 3xxrfxr.exe PID 448 wrote to memory of 4976 448 3pjpd.exe 3xxrfxr.exe PID 4976 wrote to memory of 2044 4976 thbnht.exe PID 4976 wrote to memory of 2044 4976 thbnht.exe PID 4976 wrote to memory of 2044 4976 thbnht.exe PID 2044 wrote to memory of 796 2044 rlxfrxr.exe pppjp.exe PID 2044 wrote to memory of 796 2044 rlxfrxr.exe pppjp.exe PID 2044 wrote to memory of 796 2044 rlxfrxr.exe pppjp.exe PID 796 wrote to memory of 2252 796 hbbbbb.exe 1frxflx.exe PID 796 wrote to memory of 2252 796 hbbbbb.exe 1frxflx.exe PID 796 wrote to memory of 2252 796 hbbbbb.exe 1frxflx.exe PID 2252 wrote to memory of 2368 2252 pjpdv.exe xflfxxr.exe PID 2252 wrote to memory of 2368 2252 pjpdv.exe xflfxxr.exe PID 2252 wrote to memory of 2368 2252 pjpdv.exe xflfxxr.exe PID 2368 wrote to memory of 3112 2368 xflfxxr.exe jvpjd.exe PID 2368 wrote to memory of 3112 2368 xflfxxr.exe jvpjd.exe PID 2368 wrote to memory of 3112 2368 xflfxxr.exe jvpjd.exe PID 3112 wrote to memory of 1612 3112 tnbnnb.exe djvjv.exe PID 3112 wrote to memory of 1612 3112 tnbnnb.exe djvjv.exe PID 3112 wrote to memory of 1612 3112 tnbnnb.exe djvjv.exe PID 1612 wrote to memory of 4080 1612 djvjv.exe 1rlfxfx.exe PID 1612 wrote to memory of 4080 1612 djvjv.exe 1rlfxfx.exe PID 1612 wrote to memory of 4080 1612 djvjv.exe 1rlfxfx.exe PID 4080 wrote to memory of 2088 4080 1rlfxfx.exe ttnhtn.exe PID 4080 wrote to memory of 2088 4080 1rlfxfx.exe ttnhtn.exe PID 4080 wrote to memory of 2088 4080 1rlfxfx.exe ttnhtn.exe PID 2088 wrote to memory of 1444 2088 ttnhtn.exe vddjp.exe PID 2088 wrote to memory of 1444 2088 ttnhtn.exe vddjp.exe PID 2088 wrote to memory of 1444 2088 ttnhtn.exe vddjp.exe PID 1444 wrote to memory of 988 1444 vddjp.exe xxrfrlf.exe PID 1444 wrote to memory of 988 1444 vddjp.exe xxrfrlf.exe PID 1444 wrote to memory of 988 1444 vddjp.exe xxrfrlf.exe PID 988 wrote to memory of 4928 988 xxrfrlf.exe bhhbnh.exe PID 988 wrote to memory of 4928 988 xxrfrlf.exe bhhbnh.exe PID 988 wrote to memory of 4928 988 xxrfrlf.exe bhhbnh.exe PID 4928 wrote to memory of 716 4928 bhhbnh.exe dvjdj.exe PID 4928 wrote to memory of 716 4928 bhhbnh.exe dvjdj.exe PID 4928 wrote to memory of 716 4928 bhhbnh.exe dvjdj.exe PID 716 wrote to memory of 3888 716 dvjdj.exe tnnhnb.exe PID 716 wrote to memory of 3888 716 dvjdj.exe tnnhnb.exe PID 716 wrote to memory of 3888 716 dvjdj.exe tnnhnb.exe PID 3888 wrote to memory of 1724 3888 5rxlxrf.exe pjpjp.exe PID 3888 wrote to memory of 1724 3888 5rxlxrf.exe pjpjp.exe PID 3888 wrote to memory of 1724 3888 5rxlxrf.exe pjpjp.exe PID 1724 wrote to memory of 5012 1724 pjpjp.exe ffxlxxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4c5a1dc80056294c398634238fb9ba00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\jdjdd.exec:\jdjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\rllxrfx.exec:\rllxrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\htbnnn.exec:\htbnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\jvddp.exec:\jvddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\bhhhtn.exec:\bhhhtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\3pjpd.exec:\3pjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\thbnht.exec:\thbnht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\rlxfrxr.exec:\rlxfrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\hbbbbb.exec:\hbbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\pjpdv.exec:\pjpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\xflfxxr.exec:\xflfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\tnbnnb.exec:\tnbnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\djvjv.exec:\djvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\1rlfxfx.exec:\1rlfxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\ttnhtn.exec:\ttnhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\vddjp.exec:\vddjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\xxrfrlf.exec:\xxrfrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\bhhbnh.exec:\bhhbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\dvjdj.exec:\dvjdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\5rxlxrf.exec:\5rxlxrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\pjpjp.exec:\pjpjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ffxlxxf.exec:\ffxlxxf.exe23⤵
- Executes dropped EXE
PID:5012 -
\??\c:\hbthbt.exec:\hbthbt.exe24⤵
- Executes dropped EXE
PID:4220 -
\??\c:\jdjvd.exec:\jdjvd.exe25⤵
- Executes dropped EXE
PID:4824 -
\??\c:\bththt.exec:\bththt.exe26⤵
- Executes dropped EXE
PID:60 -
\??\c:\5llfxrr.exec:\5llfxrr.exe27⤵
- Executes dropped EXE
PID:3540 -
\??\c:\ntnbth.exec:\ntnbth.exe28⤵
- Executes dropped EXE
PID:4968 -
\??\c:\jpdvj.exec:\jpdvj.exe29⤵
- Executes dropped EXE
PID:4028 -
\??\c:\hhbnbn.exec:\hhbnbn.exe30⤵
- Executes dropped EXE
PID:4840 -
\??\c:\3xxlrrr.exec:\3xxlrrr.exe31⤵
- Executes dropped EXE
PID:4376 -
\??\c:\xlllfxr.exec:\xlllfxr.exe32⤵
- Executes dropped EXE
PID:4368 -
\??\c:\bhhbnh.exec:\bhhbnh.exe33⤵
- Executes dropped EXE
PID:3948 -
\??\c:\vvjpd.exec:\vvjpd.exe34⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rflxfxr.exec:\rflxfxr.exe35⤵
- Executes dropped EXE
PID:4264 -
\??\c:\hhhtnn.exec:\hhhtnn.exe36⤵
- Executes dropped EXE
PID:4728 -
\??\c:\pjdvp.exec:\pjdvp.exe37⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5bbnbb.exec:\5bbnbb.exe38⤵
- Executes dropped EXE
PID:4144 -
\??\c:\jppjd.exec:\jppjd.exe39⤵
- Executes dropped EXE
PID:320 -
\??\c:\3xxrfxr.exec:\3xxrfxr.exe40⤵
- Executes dropped EXE
PID:4976 -
\??\c:\hbhbbh.exec:\hbhbbh.exe41⤵
- Executes dropped EXE
PID:2036 -
\??\c:\9nnhbb.exec:\9nnhbb.exe42⤵
- Executes dropped EXE
PID:4224 -
\??\c:\pjjvp.exec:\pjjvp.exe43⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5fxlfxl.exec:\5fxlfxl.exe44⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nbnhtn.exec:\nbnhtn.exe45⤵
- Executes dropped EXE
PID:1612 -
\??\c:\htnhbt.exec:\htnhbt.exe46⤵
- Executes dropped EXE
PID:4412 -
\??\c:\dddpp.exec:\dddpp.exe47⤵
- Executes dropped EXE
PID:2304 -
\??\c:\thbtbb.exec:\thbtbb.exe48⤵
- Executes dropped EXE
PID:4936 -
\??\c:\7jdpp.exec:\7jdpp.exe49⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lrrfrlf.exec:\lrrfrlf.exe50⤵
- Executes dropped EXE
PID:1064 -
\??\c:\5tttnn.exec:\5tttnn.exe51⤵
- Executes dropped EXE
PID:1544 -
\??\c:\dppjp.exec:\dppjp.exe52⤵
- Executes dropped EXE
PID:4000 -
\??\c:\nntnbt.exec:\nntnbt.exe53⤵
- Executes dropped EXE
PID:4520 -
\??\c:\pdddj.exec:\pdddj.exe54⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe55⤵
- Executes dropped EXE
PID:4084 -
\??\c:\btbnhb.exec:\btbnhb.exe56⤵
- Executes dropped EXE
PID:1108 -
\??\c:\3vvpp.exec:\3vvpp.exe57⤵
- Executes dropped EXE
PID:4012 -
\??\c:\rfxlxfr.exec:\rfxlxfr.exe58⤵
- Executes dropped EXE
PID:3976 -
\??\c:\hbnbnh.exec:\hbnbnh.exe59⤵
- Executes dropped EXE
PID:3724 -
\??\c:\bbbnbt.exec:\bbbnbt.exe60⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pjpdd.exec:\pjpdd.exe61⤵
- Executes dropped EXE
PID:1416 -
\??\c:\7flffxl.exec:\7flffxl.exe62⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3bbtbt.exec:\3bbtbt.exe63⤵
- Executes dropped EXE
PID:1404 -
\??\c:\9djdd.exec:\9djdd.exe64⤵
- Executes dropped EXE
PID:1536 -
\??\c:\1frrxll.exec:\1frrxll.exe65⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pdpdv.exec:\pdpdv.exe66⤵PID:3956
-
\??\c:\xxxlxrf.exec:\xxxlxrf.exe67⤵PID:1980
-
\??\c:\ntbbtt.exec:\ntbbtt.exe68⤵PID:808
-
\??\c:\pjjdd.exec:\pjjdd.exe69⤵PID:4572
-
\??\c:\rrllffx.exec:\rrllffx.exe70⤵PID:4440
-
\??\c:\lflllll.exec:\lflllll.exe71⤵PID:2420
-
\??\c:\hhhbtn.exec:\hhhbtn.exe72⤵PID:852
-
\??\c:\vdvpd.exec:\vdvpd.exe73⤵PID:2136
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe74⤵PID:2612
-
\??\c:\hnbhnn.exec:\hnbhnn.exe75⤵PID:556
-
\??\c:\ththhh.exec:\ththhh.exe76⤵PID:652
-
\??\c:\djpdv.exec:\djpdv.exe77⤵PID:4936
-
\??\c:\1rrrlxf.exec:\1rrrlxf.exe78⤵PID:348
-
\??\c:\ntnhnb.exec:\ntnhnb.exe79⤵PID:1972
-
\??\c:\jjdvp.exec:\jjdvp.exe80⤵PID:4848
-
\??\c:\ddjpv.exec:\ddjpv.exe81⤵PID:3848
-
\??\c:\nhbntn.exec:\nhbntn.exe82⤵PID:968
-
\??\c:\hhhbtt.exec:\hhhbtt.exe83⤵PID:1224
-
\??\c:\5jjjd.exec:\5jjjd.exe84⤵PID:408
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe85⤵PID:1108
-
\??\c:\nhhhbt.exec:\nhhhbt.exe86⤵PID:4012
-
\??\c:\1hnhhh.exec:\1hnhhh.exe87⤵PID:4884
-
\??\c:\vvjdj.exec:\vvjdj.exe88⤵PID:2844
-
\??\c:\ffrrlll.exec:\ffrrlll.exe89⤵PID:1252
-
\??\c:\frflfrl.exec:\frflfrl.exe90⤵PID:4028
-
\??\c:\hthbtn.exec:\hthbtn.exe91⤵PID:1976
-
\??\c:\jdvpv.exec:\jdvpv.exe92⤵PID:716
-
\??\c:\9vjdv.exec:\9vjdv.exe93⤵PID:4864
-
\??\c:\xxxrfxr.exec:\xxxrfxr.exe94⤵PID:1536
-
\??\c:\htbbbb.exec:\htbbbb.exe95⤵PID:2716
-
\??\c:\hntbtb.exec:\hntbtb.exe96⤵PID:1480
-
\??\c:\vpvpp.exec:\vpvpp.exe97⤵PID:2800
-
\??\c:\ffrlllf.exec:\ffrlllf.exe98⤵PID:4804
-
\??\c:\frrllff.exec:\frrllff.exe99⤵PID:4144
-
\??\c:\tnnhbb.exec:\tnnhbb.exe100⤵PID:2500
-
\??\c:\pppjp.exec:\pppjp.exe101⤵PID:796
-
\??\c:\fllxlrx.exec:\fllxlrx.exe102⤵PID:1048
-
\??\c:\tnbbtt.exec:\tnbbtt.exe103⤵PID:3800
-
\??\c:\vddpp.exec:\vddpp.exe104⤵PID:4412
-
\??\c:\flllrlr.exec:\flllrlr.exe105⤵PID:4604
-
\??\c:\htnbbh.exec:\htnbbh.exe106⤵PID:2712
-
\??\c:\dvdpv.exec:\dvdpv.exe107⤵PID:2520
-
\??\c:\vjpjv.exec:\vjpjv.exe108⤵PID:1064
-
\??\c:\fflflfl.exec:\fflflfl.exe109⤵PID:1544
-
\??\c:\tnnnbb.exec:\tnnnbb.exe110⤵PID:4220
-
\??\c:\1ntnnn.exec:\1ntnnn.exe111⤵PID:2128
-
\??\c:\7pppj.exec:\7pppj.exe112⤵PID:2080
-
\??\c:\ffflffl.exec:\ffflffl.exe113⤵PID:3712
-
\??\c:\lfrllxr.exec:\lfrllxr.exe114⤵PID:1224
-
\??\c:\htbtnn.exec:\htbtnn.exe115⤵PID:628
-
\??\c:\vvdpd.exec:\vvdpd.exe116⤵PID:1744
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe117⤵PID:3976
-
\??\c:\flflxfx.exec:\flflxfx.exe118⤵PID:1728
-
\??\c:\htnthn.exec:\htnthn.exe119⤵PID:3724
-
\??\c:\ppdvd.exec:\ppdvd.exe120⤵PID:3688
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe121⤵PID:4404
-
\??\c:\bnbhhh.exec:\bnbhhh.exe122⤵PID:820
-
\??\c:\tnnhbt.exec:\tnnhbt.exe123⤵PID:5032
-
\??\c:\1jjjd.exec:\1jjjd.exe124⤵PID:4376
-
\??\c:\1rrrrxx.exec:\1rrrrxx.exe125⤵PID:1664
-
\??\c:\3hnhht.exec:\3hnhht.exe126⤵PID:1536
-
\??\c:\bthbbn.exec:\bthbbn.exe127⤵PID:452
-
\??\c:\vjdvv.exec:\vjdvv.exe128⤵PID:4152
-
\??\c:\tbtnbn.exec:\tbtnbn.exe129⤵PID:548
-
\??\c:\ttnnbn.exec:\ttnnbn.exe130⤵PID:4024
-
\??\c:\5dvpd.exec:\5dvpd.exe131⤵PID:5044
-
\??\c:\fffrxrr.exec:\fffrxrr.exe132⤵PID:2500
-
\??\c:\nhhnbn.exec:\nhhnbn.exe133⤵PID:4904
-
\??\c:\tthbhh.exec:\tthbhh.exe134⤵PID:1828
-
\??\c:\dvvpd.exec:\dvvpd.exe135⤵PID:4712
-
\??\c:\9xlflll.exec:\9xlflll.exe136⤵PID:3080
-
\??\c:\bnttnn.exec:\bnttnn.exe137⤵PID:652
-
\??\c:\djjdd.exec:\djjdd.exe138⤵PID:4936
-
\??\c:\3pjjp.exec:\3pjjp.exe139⤵PID:3692
-
\??\c:\rflfffx.exec:\rflfffx.exe140⤵PID:2360
-
\??\c:\hthbnt.exec:\hthbnt.exe141⤵PID:4320
-
\??\c:\rfrllll.exec:\rfrllll.exe142⤵PID:4848
-
\??\c:\tbhhbh.exec:\tbhhbh.exe143⤵PID:1716
-
\??\c:\ttnbbt.exec:\ttnbbt.exe144⤵PID:116
-
\??\c:\pvvpd.exec:\pvvpd.exe145⤵PID:1852
-
\??\c:\frxrlll.exec:\frxrlll.exe146⤵PID:3712
-
\??\c:\thnhhh.exec:\thnhhh.exe147⤵PID:1720
-
\??\c:\5bhbbb.exec:\5bhbbb.exe148⤵PID:3260
-
\??\c:\dpjdj.exec:\dpjdj.exe149⤵PID:432
-
\??\c:\9fffrrx.exec:\9fffrrx.exe150⤵PID:4012
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe151⤵PID:1640
-
\??\c:\ttnhtn.exec:\ttnhtn.exe152⤵PID:180
-
\??\c:\jpddp.exec:\jpddp.exe153⤵PID:2876
-
\??\c:\lflrlll.exec:\lflrlll.exe154⤵PID:1976
-
\??\c:\5rfrrfl.exec:\5rfrrfl.exe155⤵PID:4716
-
\??\c:\hbbhbh.exec:\hbbhbh.exe156⤵PID:392
-
\??\c:\pdjdd.exec:\pdjdd.exe157⤵PID:8
-
\??\c:\vpddv.exec:\vpddv.exe158⤵PID:3396
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe159⤵PID:1248
-
\??\c:\tthbnn.exec:\tthbnn.exe160⤵PID:2436
-
\??\c:\pjpjj.exec:\pjpjj.exe161⤵PID:4728
-
\??\c:\pvjvp.exec:\pvjvp.exe162⤵PID:808
-
\??\c:\1frxflx.exec:\1frxflx.exe163⤵PID:2252
-
\??\c:\1hhbbh.exec:\1hhbbh.exe164⤵PID:4440
-
\??\c:\7vdvv.exec:\7vdvv.exe165⤵PID:2676
-
\??\c:\jpppp.exec:\jpppp.exe166⤵PID:1940
-
\??\c:\xlxrxrl.exec:\xlxrxrl.exe167⤵PID:2500
-
\??\c:\7nhbtt.exec:\7nhbtt.exe168⤵PID:2996
-
\??\c:\nnnhhh.exec:\nnnhhh.exe169⤵PID:1244
-
\??\c:\ppppj.exec:\ppppj.exe170⤵PID:2840
-
\??\c:\lxxrllf.exec:\lxxrllf.exe171⤵PID:2280
-
\??\c:\5lrlfxr.exec:\5lrlfxr.exe172⤵PID:3080
-
\??\c:\5hnhtt.exec:\5hnhtt.exe173⤵PID:2572
-
\??\c:\dvdvd.exec:\dvdvd.exe174⤵PID:1956
-
\??\c:\dpjvj.exec:\dpjvj.exe175⤵PID:4636
-
\??\c:\fxrxrfl.exec:\fxrxrfl.exe176⤵PID:2360
-
\??\c:\1tttnn.exec:\1tttnn.exe177⤵PID:4172
-
\??\c:\ppjdv.exec:\ppjdv.exe178⤵PID:3448
-
\??\c:\ddjdv.exec:\ddjdv.exe179⤵PID:4000
-
\??\c:\xlxlxrf.exec:\xlxlxrf.exe180⤵PID:4456
-
\??\c:\jpvjp.exec:\jpvjp.exe181⤵PID:3944
-
\??\c:\7ffxllf.exec:\7ffxllf.exe182⤵PID:3688
-
\??\c:\xrrfrlf.exec:\xrrfrlf.exe183⤵PID:1404
-
\??\c:\bbhhht.exec:\bbhhht.exe184⤵PID:636
-
\??\c:\vvvpd.exec:\vvvpd.exe185⤵PID:1976
-
\??\c:\xfrxrfl.exec:\xfrxrfl.exe186⤵PID:5032
-
\??\c:\nntbht.exec:\nntbht.exe187⤵PID:2924
-
\??\c:\nbnthb.exec:\nbnthb.exe188⤵PID:2992
-
\??\c:\5pjdp.exec:\5pjdp.exe189⤵PID:2528
-
\??\c:\lllfxfl.exec:\lllfxfl.exe190⤵PID:3400
-
\??\c:\3xfxxff.exec:\3xfxxff.exe191⤵PID:2988
-
\??\c:\bthhbh.exec:\bthhbh.exe192⤵PID:544
-
\??\c:\vppjj.exec:\vppjj.exe193⤵PID:1388
-
\??\c:\jjjdd.exec:\jjjdd.exe194⤵PID:4804
-
\??\c:\5lfxrrl.exec:\5lfxrrl.exe195⤵PID:2880
-
\??\c:\btbbtt.exec:\btbbtt.exe196⤵PID:808
-
\??\c:\btbhhn.exec:\btbhhn.exe197⤵PID:4932
-
\??\c:\jdppp.exec:\jdppp.exe198⤵PID:4224
-
\??\c:\fxlrxrr.exec:\fxlrxrr.exe199⤵PID:740
-
\??\c:\ttbhhh.exec:\ttbhhh.exe200⤵PID:984
-
\??\c:\7tnhbb.exec:\7tnhbb.exe201⤵PID:5116
-
\??\c:\vppjj.exec:\vppjj.exe202⤵PID:1540
-
\??\c:\jjvpj.exec:\jjvpj.exe203⤵PID:4656
-
\??\c:\ffxrrlr.exec:\ffxrrlr.exe204⤵PID:4928
-
\??\c:\tbhbnn.exec:\tbhbnn.exe205⤵PID:4972
-
\??\c:\5djdv.exec:\5djdv.exe206⤵PID:1548
-
\??\c:\dddpp.exec:\dddpp.exe207⤵PID:348
-
\??\c:\5lrllll.exec:\5lrllll.exe208⤵PID:4284
-
\??\c:\tnnhbt.exec:\tnnhbt.exe209⤵PID:2440
-
\??\c:\dvdvp.exec:\dvdvp.exe210⤵PID:2424
-
\??\c:\vdpjj.exec:\vdpjj.exe211⤵PID:4820
-
\??\c:\llfxlfr.exec:\llfxlfr.exe212⤵PID:4256
-
\??\c:\bhntth.exec:\bhntth.exe213⤵PID:2080
-
\??\c:\pdjpj.exec:\pdjpj.exe214⤵PID:2504
-
\??\c:\ppjpj.exec:\ppjpj.exe215⤵PID:1224
-
\??\c:\rxxllrr.exec:\rxxllrr.exe216⤵PID:5056
-
\??\c:\nttnht.exec:\nttnht.exe217⤵PID:3260
-
\??\c:\pjpjd.exec:\pjpjd.exe218⤵PID:4300
-
\??\c:\pjpjj.exec:\pjpjj.exe219⤵PID:4136
-
\??\c:\3lxxrrl.exec:\3lxxrrl.exe220⤵PID:4000
-
\??\c:\xrxlffx.exec:\xrxlffx.exe221⤵PID:4456
-
\??\c:\5hhbnn.exec:\5hhbnn.exe222⤵PID:180
-
\??\c:\pvddp.exec:\pvddp.exe223⤵PID:4512
-
\??\c:\djdvd.exec:\djdvd.exe224⤵PID:2824
-
\??\c:\frxlfxx.exec:\frxlfxx.exe225⤵PID:4580
-
\??\c:\9fxrlxr.exec:\9fxrlxr.exe226⤵PID:3068
-
\??\c:\hnbhtn.exec:\hnbhtn.exe227⤵PID:2876
-
\??\c:\jvdvp.exec:\jvdvp.exe228⤵PID:4036
-
\??\c:\3xrrlrl.exec:\3xrrlrl.exe229⤵PID:3324
-
\??\c:\5fxxrrr.exec:\5fxxrrr.exe230⤵PID:1976
-
\??\c:\bbbbtt.exec:\bbbbtt.exe231⤵PID:5032
-
\??\c:\jjpjj.exec:\jjpjj.exe232⤵PID:1664
-
\??\c:\vvvpd.exec:\vvvpd.exe233⤵PID:1564
-
\??\c:\xxfrlrr.exec:\xxfrlrr.exe234⤵PID:5028
-
\??\c:\bttnhh.exec:\bttnhh.exe235⤵PID:3400
-
\??\c:\7nhhhn.exec:\7nhhhn.exe236⤵PID:2436
-
\??\c:\3ddvd.exec:\3ddvd.exe237⤵PID:4728
-
\??\c:\vvvpj.exec:\vvvpj.exe238⤵PID:4588
-
\??\c:\lflfxrl.exec:\lflfxrl.exe239⤵PID:4804
-
\??\c:\hbthhn.exec:\hbthhn.exe240⤵PID:4144
-
\??\c:\3tbttn.exec:\3tbttn.exe241⤵PID:4024
-
\??\c:\1dpjp.exec:\1dpjp.exe242⤵PID:2420