Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 00:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
671d108f79163b0bd9ae03da5e9239e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
671d108f79163b0bd9ae03da5e9239e0_NeikiAnalytics.exe
-
Size
393KB
-
MD5
671d108f79163b0bd9ae03da5e9239e0
-
SHA1
7b334ea6a8274899bfed7833f84d4903515289fe
-
SHA256
80e7a0cfbece452df0f557fde6101df26f6be93f8a761f2e4099036e5139ddf1
-
SHA512
436e8e1cc8f2854f0ce5c5e6cd143596454a63b45a255c12e6c4de85ddc34a916641bc92133c344e120d36e7075e5455be8e2bd688f4bf382879103f209297a9
-
SSDEEP
6144:Acm7ImGddX5WrXF5lpKGYV0aTk/BO0XJm4UEPOshN/xdKnvP48bmRt:m7TcJWjdpKGATTk/jYIOWN/KnnPe
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4752-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2668-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/420-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-740-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5040 bhttnn.exe 1068 vdvdd.exe 3128 xrlfxxr.exe 3496 tnntbh.exe 3872 3ntnhh.exe 2956 lrxlfxr.exe 1484 tnhhbt.exe 1388 fxrflll.exe 2508 jdddv.exe 5020 jdppd.exe 5060 btntht.exe 1724 dppjj.exe 4768 pvjjj.exe 2212 thtnht.exe 2900 ttbtnt.exe 2668 vpvpp.exe 4988 7lrlllf.exe 3976 xlxrfxr.exe 2156 jdjjj.exe 3404 xxfrlxf.exe 3548 vpdpj.exe 1100 bttnnt.exe 2204 jjppv.exe 2628 bnbnhh.exe 808 xlfffxl.exe 3908 hhhhnn.exe 5016 5dppd.exe 2824 dpdpd.exe 5012 vvjvp.exe 2236 htbbbt.exe 3528 pvvvp.exe 3200 xxrlxrl.exe 4948 rxflrrl.exe 4920 nhnnnn.exe 1368 7pddv.exe 5068 tnbbhh.exe 3784 djvvv.exe 1616 xrfrfxf.exe 64 hbnnnn.exe 4336 fllfxlx.exe 212 nbbnhh.exe 3436 rfrlfff.exe 1560 nhbbbn.exe 4404 vdjdj.exe 2700 tbnhnb.exe 1132 dpdjd.exe 3496 fffffff.exe 1148 nhbhtn.exe 2688 7ppjd.exe 516 rxrfrfl.exe 928 vvpvp.exe 1444 hhhbnn.exe 1940 dpvpj.exe 3672 3lflfxr.exe 1120 htnhbb.exe 5060 pvdpj.exe 4644 5rfxxfl.exe 1724 thttbb.exe 3996 3jjdj.exe 4768 rxxlxll.exe 2380 1bttnn.exe 2104 jdvdj.exe 4664 xxffxff.exe 420 nntttt.exe -
resource yara_rule behavioral2/memory/4752-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2668-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/420-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-508-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4752 wrote to memory of 5040 4752 671d108f79163b0bd9ae03da5e9239e0_NeikiAnalytics.exe 83 PID 4752 wrote to memory of 5040 4752 671d108f79163b0bd9ae03da5e9239e0_NeikiAnalytics.exe 83 PID 4752 wrote to memory of 5040 4752 671d108f79163b0bd9ae03da5e9239e0_NeikiAnalytics.exe 83 PID 5040 wrote to memory of 1068 5040 bhttnn.exe 84 PID 5040 wrote to memory of 1068 5040 bhttnn.exe 84 PID 5040 wrote to memory of 1068 5040 bhttnn.exe 84 PID 1068 wrote to memory of 3128 1068 vdvdd.exe 85 PID 1068 wrote to memory of 3128 1068 vdvdd.exe 85 PID 1068 wrote to memory of 3128 1068 vdvdd.exe 85 PID 3128 wrote to memory of 3496 3128 xrlfxxr.exe 86 PID 3128 wrote to memory of 3496 3128 xrlfxxr.exe 86 PID 3128 wrote to memory of 3496 3128 xrlfxxr.exe 86 PID 3496 wrote to memory of 3872 3496 tnntbh.exe 87 PID 3496 wrote to memory of 3872 3496 tnntbh.exe 87 PID 3496 wrote to memory of 3872 3496 tnntbh.exe 87 PID 3872 wrote to memory of 2956 3872 3ntnhh.exe 88 PID 3872 wrote to memory of 2956 3872 3ntnhh.exe 88 PID 3872 wrote to memory of 2956 3872 3ntnhh.exe 88 PID 2956 wrote to memory of 1484 2956 lrxlfxr.exe 89 PID 2956 wrote to memory of 1484 2956 lrxlfxr.exe 89 PID 2956 wrote to memory of 1484 2956 lrxlfxr.exe 89 PID 1484 wrote to memory of 1388 1484 tnhhbt.exe 90 PID 1484 wrote to memory of 1388 1484 tnhhbt.exe 90 PID 1484 wrote to memory of 1388 1484 tnhhbt.exe 90 PID 1388 wrote to memory of 2508 1388 fxrflll.exe 91 PID 1388 wrote to memory of 2508 1388 fxrflll.exe 91 PID 1388 wrote to memory of 2508 1388 fxrflll.exe 91 PID 2508 wrote to memory of 5020 2508 jdddv.exe 92 PID 2508 wrote to memory of 5020 2508 jdddv.exe 92 PID 2508 wrote to memory of 5020 2508 jdddv.exe 92 PID 5020 wrote to memory of 5060 5020 jdppd.exe 94 PID 5020 wrote to memory of 5060 5020 jdppd.exe 94 PID 5020 wrote to memory of 5060 5020 jdppd.exe 94 PID 5060 wrote to memory of 1724 5060 btntht.exe 95 PID 5060 wrote to memory of 1724 5060 btntht.exe 95 PID 5060 wrote to memory of 1724 5060 btntht.exe 95 PID 1724 wrote to memory of 4768 1724 dppjj.exe 96 PID 1724 wrote to memory of 4768 1724 dppjj.exe 96 PID 1724 wrote to memory of 4768 1724 dppjj.exe 96 PID 4768 wrote to memory of 2212 4768 pvjjj.exe 97 PID 4768 wrote to memory of 2212 4768 pvjjj.exe 97 PID 4768 wrote to memory of 2212 4768 pvjjj.exe 97 PID 2212 wrote to memory of 2900 2212 thtnht.exe 99 PID 2212 wrote to memory of 2900 2212 thtnht.exe 99 PID 2212 wrote to memory of 2900 2212 thtnht.exe 99 PID 2900 wrote to memory of 2668 2900 ttbtnt.exe 100 PID 2900 wrote to memory of 2668 2900 ttbtnt.exe 100 PID 2900 wrote to memory of 2668 2900 ttbtnt.exe 100 PID 2668 wrote to memory of 4988 2668 vpvpp.exe 101 PID 2668 wrote to memory of 4988 2668 vpvpp.exe 101 PID 2668 wrote to memory of 4988 2668 vpvpp.exe 101 PID 4988 wrote to memory of 3976 4988 7lrlllf.exe 102 PID 4988 wrote to memory of 3976 4988 7lrlllf.exe 102 PID 4988 wrote to memory of 3976 4988 7lrlllf.exe 102 PID 3976 wrote to memory of 2156 3976 xlxrfxr.exe 103 PID 3976 wrote to memory of 2156 3976 xlxrfxr.exe 103 PID 3976 wrote to memory of 2156 3976 xlxrfxr.exe 103 PID 2156 wrote to memory of 3404 2156 jdjjj.exe 104 PID 2156 wrote to memory of 3404 2156 jdjjj.exe 104 PID 2156 wrote to memory of 3404 2156 jdjjj.exe 104 PID 3404 wrote to memory of 3548 3404 xxfrlxf.exe 105 PID 3404 wrote to memory of 3548 3404 xxfrlxf.exe 105 PID 3404 wrote to memory of 3548 3404 xxfrlxf.exe 105 PID 3548 wrote to memory of 1100 3548 vpdpj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\671d108f79163b0bd9ae03da5e9239e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\671d108f79163b0bd9ae03da5e9239e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\bhttnn.exec:\bhttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\vdvdd.exec:\vdvdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\tnntbh.exec:\tnntbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\3ntnhh.exec:\3ntnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\tnhhbt.exec:\tnhhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\fxrflll.exec:\fxrflll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\jdddv.exec:\jdddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\jdppd.exec:\jdppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\btntht.exec:\btntht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\dppjj.exec:\dppjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\pvjjj.exec:\pvjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\thtnht.exec:\thtnht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\ttbtnt.exec:\ttbtnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\vpvpp.exec:\vpvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\7lrlllf.exec:\7lrlllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\xlxrfxr.exec:\xlxrfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\jdjjj.exec:\jdjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\xxfrlxf.exec:\xxfrlxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\vpdpj.exec:\vpdpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\bttnnt.exec:\bttnnt.exe23⤵
- Executes dropped EXE
PID:1100 -
\??\c:\jjppv.exec:\jjppv.exe24⤵
- Executes dropped EXE
PID:2204 -
\??\c:\bnbnhh.exec:\bnbnhh.exe25⤵
- Executes dropped EXE
PID:2628 -
\??\c:\xlfffxl.exec:\xlfffxl.exe26⤵
- Executes dropped EXE
PID:808 -
\??\c:\hhhhnn.exec:\hhhhnn.exe27⤵
- Executes dropped EXE
PID:3908 -
\??\c:\5dppd.exec:\5dppd.exe28⤵
- Executes dropped EXE
PID:5016 -
\??\c:\dpdpd.exec:\dpdpd.exe29⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vvjvp.exec:\vvjvp.exe30⤵
- Executes dropped EXE
PID:5012 -
\??\c:\htbbbt.exec:\htbbbt.exe31⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pvvvp.exec:\pvvvp.exe32⤵
- Executes dropped EXE
PID:3528 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe33⤵
- Executes dropped EXE
PID:3200 -
\??\c:\rxflrrl.exec:\rxflrrl.exe34⤵
- Executes dropped EXE
PID:4948 -
\??\c:\nhnnnn.exec:\nhnnnn.exe35⤵
- Executes dropped EXE
PID:4920 -
\??\c:\7pddv.exec:\7pddv.exe36⤵
- Executes dropped EXE
PID:1368 -
\??\c:\tnbbhh.exec:\tnbbhh.exe37⤵
- Executes dropped EXE
PID:5068 -
\??\c:\djvvv.exec:\djvvv.exe38⤵
- Executes dropped EXE
PID:3784 -
\??\c:\xrfrfxf.exec:\xrfrfxf.exe39⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hbnnnn.exec:\hbnnnn.exe40⤵
- Executes dropped EXE
PID:64 -
\??\c:\fllfxlx.exec:\fllfxlx.exe41⤵
- Executes dropped EXE
PID:4336 -
\??\c:\nbbnhh.exec:\nbbnhh.exe42⤵
- Executes dropped EXE
PID:212 -
\??\c:\rfrlfff.exec:\rfrlfff.exe43⤵
- Executes dropped EXE
PID:3436 -
\??\c:\nhbbbn.exec:\nhbbbn.exe44⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vdjdj.exec:\vdjdj.exe45⤵
- Executes dropped EXE
PID:4404 -
\??\c:\tbnhnb.exec:\tbnhnb.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dpdjd.exec:\dpdjd.exe47⤵
- Executes dropped EXE
PID:1132 -
\??\c:\fffffff.exec:\fffffff.exe48⤵
- Executes dropped EXE
PID:3496 -
\??\c:\nhbhtn.exec:\nhbhtn.exe49⤵
- Executes dropped EXE
PID:1148 -
\??\c:\7ppjd.exec:\7ppjd.exe50⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rxrfrfl.exec:\rxrfrfl.exe51⤵
- Executes dropped EXE
PID:516 -
\??\c:\vvpvp.exec:\vvpvp.exe52⤵
- Executes dropped EXE
PID:928 -
\??\c:\hhhbnn.exec:\hhhbnn.exe53⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dpvpj.exec:\dpvpj.exe54⤵
- Executes dropped EXE
PID:1940 -
\??\c:\3lflfxr.exec:\3lflfxr.exe55⤵
- Executes dropped EXE
PID:3672 -
\??\c:\htnhbb.exec:\htnhbb.exe56⤵
- Executes dropped EXE
PID:1120 -
\??\c:\pvdpj.exec:\pvdpj.exe57⤵
- Executes dropped EXE
PID:5060 -
\??\c:\5rfxxfl.exec:\5rfxxfl.exe58⤵
- Executes dropped EXE
PID:4644 -
\??\c:\thttbb.exec:\thttbb.exe59⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3jjdj.exec:\3jjdj.exe60⤵
- Executes dropped EXE
PID:3996 -
\??\c:\rxxlxll.exec:\rxxlxll.exe61⤵
- Executes dropped EXE
PID:4768 -
\??\c:\1bttnn.exec:\1bttnn.exe62⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jdvdj.exec:\jdvdj.exe63⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xxffxff.exec:\xxffxff.exe64⤵
- Executes dropped EXE
PID:4664 -
\??\c:\nntttt.exec:\nntttt.exe65⤵
- Executes dropped EXE
PID:420 -
\??\c:\jvdvp.exec:\jvdvp.exe66⤵PID:4988
-
\??\c:\hbnbtn.exec:\hbnbtn.exe67⤵PID:1340
-
\??\c:\jjpdd.exec:\jjpdd.exe68⤵PID:4092
-
\??\c:\jdppv.exec:\jdppv.exe69⤵PID:4984
-
\??\c:\lxfflll.exec:\lxfflll.exe70⤵PID:3460
-
\??\c:\bthbbb.exec:\bthbbb.exe71⤵PID:4492
-
\??\c:\vjpvv.exec:\vjpvv.exe72⤵PID:948
-
\??\c:\htnhht.exec:\htnhht.exe73⤵PID:3548
-
\??\c:\dpppp.exec:\dpppp.exe74⤵PID:2124
-
\??\c:\xlllrxf.exec:\xlllrxf.exe75⤵PID:1700
-
\??\c:\lfllllr.exec:\lfllllr.exe76⤵PID:1036
-
\??\c:\hhthnt.exec:\hhthnt.exe77⤵PID:1596
-
\??\c:\ddvvp.exec:\ddvvp.exe78⤵PID:1916
-
\??\c:\xffxffl.exec:\xffxffl.exe79⤵PID:3172
-
\??\c:\hbhbbh.exec:\hbhbbh.exe80⤵PID:4396
-
\??\c:\vjppv.exec:\vjppv.exe81⤵PID:1920
-
\??\c:\5ddvp.exec:\5ddvp.exe82⤵PID:4832
-
\??\c:\ntnhtb.exec:\ntnhtb.exe83⤵PID:2640
-
\??\c:\9vvdv.exec:\9vvdv.exe84⤵PID:2492
-
\??\c:\3lfxlrf.exec:\3lfxlrf.exe85⤵PID:3516
-
\??\c:\btttnn.exec:\btttnn.exe86⤵PID:4948
-
\??\c:\hhnnnt.exec:\hhnnnt.exe87⤵PID:968
-
\??\c:\vdvvd.exec:\vdvvd.exe88⤵PID:3784
-
\??\c:\lffflrl.exec:\lffflrl.exe89⤵PID:2424
-
\??\c:\pjjpd.exec:\pjjpd.exe90⤵PID:224
-
\??\c:\frlrllr.exec:\frlrllr.exe91⤵PID:5040
-
\??\c:\jvdvp.exec:\jvdvp.exe92⤵PID:1928
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe93⤵PID:2436
-
\??\c:\nbnnhn.exec:\nbnnhn.exe94⤵PID:4404
-
\??\c:\jpvpp.exec:\jpvpp.exe95⤵PID:2676
-
\??\c:\xrrlrxl.exec:\xrrlrxl.exe96⤵PID:4592
-
\??\c:\ntttnn.exec:\ntttnn.exe97⤵PID:2476
-
\??\c:\3hnnht.exec:\3hnnht.exe98⤵PID:1148
-
\??\c:\lrlfrxr.exec:\lrlfrxr.exe99⤵PID:1156
-
\??\c:\bhbbtn.exec:\bhbbtn.exe100⤵PID:3124
-
\??\c:\7jpjd.exec:\7jpjd.exe101⤵PID:928
-
\??\c:\5lrrxlx.exec:\5lrrxlx.exe102⤵PID:4756
-
\??\c:\tthbbb.exec:\tthbbb.exe103⤵PID:2508
-
\??\c:\pjjdd.exec:\pjjdd.exe104⤵PID:2792
-
\??\c:\lrlffrr.exec:\lrlffrr.exe105⤵PID:2416
-
\??\c:\rxxrlll.exec:\rxxrlll.exe106⤵PID:4416
-
\??\c:\bthhhn.exec:\bthhhn.exe107⤵PID:1808
-
\??\c:\5dppv.exec:\5dppv.exe108⤵PID:1708
-
\??\c:\ppvvv.exec:\ppvvv.exe109⤵PID:4872
-
\??\c:\1xllrxl.exec:\1xllrxl.exe110⤵PID:2080
-
\??\c:\7nnnnn.exec:\7nnnnn.exe111⤵PID:444
-
\??\c:\jjpdv.exec:\jjpdv.exe112⤵PID:804
-
\??\c:\rllrxrr.exec:\rllrxrr.exe113⤵PID:4928
-
\??\c:\nbbbbb.exec:\nbbbbb.exe114⤵PID:4884
-
\??\c:\ddddv.exec:\ddddv.exe115⤵PID:3076
-
\??\c:\ffxxflx.exec:\ffxxflx.exe116⤵PID:3552
-
\??\c:\lxlffxx.exec:\lxlffxx.exe117⤵PID:4512
-
\??\c:\thttbh.exec:\thttbh.exe118⤵PID:2252
-
\??\c:\jvjjj.exec:\jvjjj.exe119⤵PID:2300
-
\??\c:\1rffllf.exec:\1rffllf.exe120⤵PID:5056
-
\??\c:\xrrfffx.exec:\xrrfffx.exe121⤵PID:1500
-
\??\c:\hthnbn.exec:\hthnbn.exe122⤵PID:4192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-