Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:26
Behavioral task
behavioral1
Sample
5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe
-
Size
81KB
-
MD5
5795e7d1e5ae624b824c2fe9e3cfd4c0
-
SHA1
20e3134dceec4f5e91e332de5c19382a004bf0d6
-
SHA256
22c2c9a00d98dca419a0dd3285b1622eddf585b7e66d588d90d22ab70db80f64
-
SHA512
d5afc922f75b8d21c16fd1ee581e00770228b81d015c9fb972adfac6b7e753d32c050419f622649e93a18d79b9f497433e6b923db80d2fc622388f0cef557d1e
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7QGIC:zhOmTsF93UYfwC6GIoutiTU2HVS63Qg
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1920-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2480-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/816-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1292-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3128-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2516-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2620-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-673-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-683-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-840-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-899-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-902-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frlrrrf.exetnnbhb.exedvjjp.exepjjpv.exe3rfffll.exetbtnnt.exepjjjp.exelrrllxf.exenbtntb.exebbhbbh.exepddpj.exelrrxxxl.exenhthbh.exe1pddj.exexxxxxlr.exebthhtn.exedpvpj.exerxfrfrr.exenhbbbh.exedvjjj.exejdjdd.exennnttb.exepdvvd.exejdjjv.exerllllrx.exe3hhnnt.exehhnnnb.exexlrrlxf.exetnnntt.exejddpp.exehbnhhn.exetbhnnt.exepjjvv.exerfxlrrl.exebntnhh.exejvvdp.exejppjd.exelrfrlxr.exenhhhbb.exepvvdj.exevjpdj.exelxrlfff.exebnbntt.exedvvdv.exerfllrff.exe1lrrxrf.exenbhttt.exevjvjd.exedppjd.exexlrlflf.exebbbbbh.exejvddd.exeddjjp.exelrrrrxr.exehbtnbb.exetnhhtn.exevjpjj.exe3lrrlrr.exebbtthn.exevjjdp.exe5djpp.exerxfrrxr.exedjvvv.exevpdvv.exepid process 404 frlrrrf.exe 3828 tnnbhb.exe 2916 dvjjp.exe 3364 pjjpv.exe 1228 3rfffll.exe 4884 tbtnnt.exe 2948 pjjjp.exe 4528 lrrllxf.exe 3104 nbtntb.exe 3176 bbhbbh.exe 4608 pddpj.exe 4076 lrrxxxl.exe 3524 nhthbh.exe 3500 1pddj.exe 624 xxxxxlr.exe 2168 bthhtn.exe 5052 dpvpj.exe 3212 rxfrfrr.exe 3168 nhbbbh.exe 2480 dvjjj.exe 4724 jdjdd.exe 2000 nnnttb.exe 2636 pdvvd.exe 2644 jdjjv.exe 4652 rllllrx.exe 1936 3hhnnt.exe 1292 hhnnnb.exe 816 xlrrlxf.exe 3868 tnnntt.exe 4712 jddpp.exe 2804 hbnhhn.exe 2124 tbhnnt.exe 2756 pjjvv.exe 3128 rfxlrrl.exe 4160 bntnhh.exe 1080 jvvdp.exe 5004 jppjd.exe 1612 lrfrlxr.exe 3148 nhhhbb.exe 4576 pvvdj.exe 3664 vjpdj.exe 4892 lxrlfff.exe 1156 bnbntt.exe 4596 dvvdv.exe 1832 rfllrff.exe 4956 1lrrxrf.exe 2924 nbhttt.exe 4664 vjvjd.exe 3680 dppjd.exe 3708 xlrlflf.exe 1056 bbbbbh.exe 4280 jvddd.exe 688 ddjjp.exe 4148 lrrrrxr.exe 2352 hbtnbb.exe 700 tnhhtn.exe 2204 vjpjj.exe 440 3lrrlrr.exe 4608 bbtthn.exe 1176 vjjdp.exe 1340 5djpp.exe 1812 rxfrrxr.exe 3580 djvvv.exe 3204 vpdvv.exe -
Processes:
resource yara_rule behavioral2/memory/1920-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frlrrrf.exe upx behavioral2/memory/1920-4-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnbhb.exe upx C:\dvjjp.exe upx behavioral2/memory/3828-12-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjjpv.exe upx behavioral2/memory/3364-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/404-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3rfffll.exe upx behavioral2/memory/1228-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbtnnt.exe upx behavioral2/memory/4884-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjjjp.exe upx behavioral2/memory/2948-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrrllxf.exe upx C:\bbhbbh.exe upx behavioral2/memory/3104-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3176-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4528-45-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pddpj.exe upx \??\c:\nbtntb.exe upx C:\lrrxxxl.exe upx behavioral2/memory/4608-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhthbh.exe upx C:\1pddj.exe upx behavioral2/memory/3524-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3500-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxxxlr.exe upx behavioral2/memory/3500-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthhtn.exe upx C:\dpvpj.exe upx C:\rxfrfrr.exe upx behavioral2/memory/5052-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3212-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbbbh.exe upx \??\c:\dvjjj.exe upx behavioral2/memory/2480-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdjdd.exe upx behavioral2/memory/3168-99-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnnttb.exe upx C:\pdvvd.exe upx \??\c:\jdjjv.exe upx behavioral2/memory/2636-114-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rllllrx.exe upx behavioral2/memory/4652-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2644-122-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3hhnnt.exe upx behavioral2/memory/1936-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhnnnb.exe upx C:\xlrrlxf.exe upx behavioral2/memory/816-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1292-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnntt.exe upx \??\c:\jddpp.exe upx behavioral2/memory/4712-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnhhn.exe upx behavioral2/memory/4712-151-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbhnnt.exe upx behavioral2/memory/2756-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3128-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5004-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1612-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4576-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exefrlrrrf.exetnnbhb.exedvjjp.exepjjpv.exe3rfffll.exetbtnnt.exepjjjp.exelrrllxf.exenbtntb.exebbhbbh.exepddpj.exelrrxxxl.exenhthbh.exe1pddj.exexxxxxlr.exebthhtn.exedpvpj.exerxfrfrr.exenhbbbh.exedvjjj.exejdjdd.exedescription pid process target process PID 1920 wrote to memory of 404 1920 5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe frlrrrf.exe PID 1920 wrote to memory of 404 1920 5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe frlrrrf.exe PID 1920 wrote to memory of 404 1920 5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe frlrrrf.exe PID 404 wrote to memory of 3828 404 frlrrrf.exe tnnbhb.exe PID 404 wrote to memory of 3828 404 frlrrrf.exe tnnbhb.exe PID 404 wrote to memory of 3828 404 frlrrrf.exe tnnbhb.exe PID 3828 wrote to memory of 2916 3828 tnnbhb.exe dvjjp.exe PID 3828 wrote to memory of 2916 3828 tnnbhb.exe dvjjp.exe PID 3828 wrote to memory of 2916 3828 tnnbhb.exe dvjjp.exe PID 2916 wrote to memory of 3364 2916 dvjjp.exe pjjpv.exe PID 2916 wrote to memory of 3364 2916 dvjjp.exe pjjpv.exe PID 2916 wrote to memory of 3364 2916 dvjjp.exe pjjpv.exe PID 3364 wrote to memory of 1228 3364 pjjpv.exe 3rfffll.exe PID 3364 wrote to memory of 1228 3364 pjjpv.exe 3rfffll.exe PID 3364 wrote to memory of 1228 3364 pjjpv.exe 3rfffll.exe PID 1228 wrote to memory of 4884 1228 3rfffll.exe tbtnnt.exe PID 1228 wrote to memory of 4884 1228 3rfffll.exe tbtnnt.exe PID 1228 wrote to memory of 4884 1228 3rfffll.exe tbtnnt.exe PID 4884 wrote to memory of 2948 4884 tbtnnt.exe pjjjp.exe PID 4884 wrote to memory of 2948 4884 tbtnnt.exe pjjjp.exe PID 4884 wrote to memory of 2948 4884 tbtnnt.exe pjjjp.exe PID 2948 wrote to memory of 4528 2948 pjjjp.exe lrrllxf.exe PID 2948 wrote to memory of 4528 2948 pjjjp.exe lrrllxf.exe PID 2948 wrote to memory of 4528 2948 pjjjp.exe lrrllxf.exe PID 4528 wrote to memory of 3104 4528 lrrllxf.exe nbtntb.exe PID 4528 wrote to memory of 3104 4528 lrrllxf.exe nbtntb.exe PID 4528 wrote to memory of 3104 4528 lrrllxf.exe nbtntb.exe PID 3104 wrote to memory of 3176 3104 nbtntb.exe bbhbbh.exe PID 3104 wrote to memory of 3176 3104 nbtntb.exe bbhbbh.exe PID 3104 wrote to memory of 3176 3104 nbtntb.exe bbhbbh.exe PID 3176 wrote to memory of 4608 3176 bbhbbh.exe pddpj.exe PID 3176 wrote to memory of 4608 3176 bbhbbh.exe pddpj.exe PID 3176 wrote to memory of 4608 3176 bbhbbh.exe pddpj.exe PID 4608 wrote to memory of 4076 4608 pddpj.exe lrrxxxl.exe PID 4608 wrote to memory of 4076 4608 pddpj.exe lrrxxxl.exe PID 4608 wrote to memory of 4076 4608 pddpj.exe lrrxxxl.exe PID 4076 wrote to memory of 3524 4076 lrrxxxl.exe nhthbh.exe PID 4076 wrote to memory of 3524 4076 lrrxxxl.exe nhthbh.exe PID 4076 wrote to memory of 3524 4076 lrrxxxl.exe nhthbh.exe PID 3524 wrote to memory of 3500 3524 nhthbh.exe 1pddj.exe PID 3524 wrote to memory of 3500 3524 nhthbh.exe 1pddj.exe PID 3524 wrote to memory of 3500 3524 nhthbh.exe 1pddj.exe PID 3500 wrote to memory of 624 3500 1pddj.exe xxxxxlr.exe PID 3500 wrote to memory of 624 3500 1pddj.exe xxxxxlr.exe PID 3500 wrote to memory of 624 3500 1pddj.exe xxxxxlr.exe PID 624 wrote to memory of 2168 624 xxxxxlr.exe bthhtn.exe PID 624 wrote to memory of 2168 624 xxxxxlr.exe bthhtn.exe PID 624 wrote to memory of 2168 624 xxxxxlr.exe bthhtn.exe PID 2168 wrote to memory of 5052 2168 bthhtn.exe dpvpj.exe PID 2168 wrote to memory of 5052 2168 bthhtn.exe dpvpj.exe PID 2168 wrote to memory of 5052 2168 bthhtn.exe dpvpj.exe PID 5052 wrote to memory of 3212 5052 dpvpj.exe rxfrfrr.exe PID 5052 wrote to memory of 3212 5052 dpvpj.exe rxfrfrr.exe PID 5052 wrote to memory of 3212 5052 dpvpj.exe rxfrfrr.exe PID 3212 wrote to memory of 3168 3212 rxfrfrr.exe nhbbbh.exe PID 3212 wrote to memory of 3168 3212 rxfrfrr.exe nhbbbh.exe PID 3212 wrote to memory of 3168 3212 rxfrfrr.exe nhbbbh.exe PID 3168 wrote to memory of 2480 3168 nhbbbh.exe dvjjj.exe PID 3168 wrote to memory of 2480 3168 nhbbbh.exe dvjjj.exe PID 3168 wrote to memory of 2480 3168 nhbbbh.exe dvjjj.exe PID 2480 wrote to memory of 4724 2480 dvjjj.exe jdjdd.exe PID 2480 wrote to memory of 4724 2480 dvjjj.exe jdjdd.exe PID 2480 wrote to memory of 4724 2480 dvjjj.exe jdjdd.exe PID 4724 wrote to memory of 2000 4724 jdjdd.exe nnnttb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5795e7d1e5ae624b824c2fe9e3cfd4c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\frlrrrf.exec:\frlrrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\tnnbhb.exec:\tnnbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\dvjjp.exec:\dvjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\pjjpv.exec:\pjjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\3rfffll.exec:\3rfffll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\tbtnnt.exec:\tbtnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\pjjjp.exec:\pjjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\lrrllxf.exec:\lrrllxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\nbtntb.exec:\nbtntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\bbhbbh.exec:\bbhbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\pddpj.exec:\pddpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\lrrxxxl.exec:\lrrxxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\nhthbh.exec:\nhthbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\1pddj.exec:\1pddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\xxxxxlr.exec:\xxxxxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\bthhtn.exec:\bthhtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\dpvpj.exec:\dpvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\rxfrfrr.exec:\rxfrfrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\nhbbbh.exec:\nhbbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\dvjjj.exec:\dvjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\jdjdd.exec:\jdjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\nnnttb.exec:\nnnttb.exe23⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pdvvd.exec:\pdvvd.exe24⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jdjjv.exec:\jdjjv.exe25⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rllllrx.exec:\rllllrx.exe26⤵
- Executes dropped EXE
PID:4652 -
\??\c:\3hhnnt.exec:\3hhnnt.exe27⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hhnnnb.exec:\hhnnnb.exe28⤵
- Executes dropped EXE
PID:1292 -
\??\c:\xlrrlxf.exec:\xlrrlxf.exe29⤵
- Executes dropped EXE
PID:816 -
\??\c:\tnnntt.exec:\tnnntt.exe30⤵
- Executes dropped EXE
PID:3868 -
\??\c:\jddpp.exec:\jddpp.exe31⤵
- Executes dropped EXE
PID:4712 -
\??\c:\hbnhhn.exec:\hbnhhn.exe32⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tbhnnt.exec:\tbhnnt.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pjjvv.exec:\pjjvv.exe34⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rfxlrrl.exec:\rfxlrrl.exe35⤵
- Executes dropped EXE
PID:3128 -
\??\c:\bntnhh.exec:\bntnhh.exe36⤵
- Executes dropped EXE
PID:4160 -
\??\c:\jvvdp.exec:\jvvdp.exe37⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jppjd.exec:\jppjd.exe38⤵
- Executes dropped EXE
PID:5004 -
\??\c:\lrfrlxr.exec:\lrfrlxr.exe39⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nhhhbb.exec:\nhhhbb.exe40⤵
- Executes dropped EXE
PID:3148 -
\??\c:\pvvdj.exec:\pvvdj.exe41⤵
- Executes dropped EXE
PID:4576 -
\??\c:\vjpdj.exec:\vjpdj.exe42⤵
- Executes dropped EXE
PID:3664 -
\??\c:\lxrlfff.exec:\lxrlfff.exe43⤵
- Executes dropped EXE
PID:4892 -
\??\c:\bnbntt.exec:\bnbntt.exe44⤵
- Executes dropped EXE
PID:1156 -
\??\c:\dvvdv.exec:\dvvdv.exe45⤵
- Executes dropped EXE
PID:4596 -
\??\c:\rfllrff.exec:\rfllrff.exe46⤵
- Executes dropped EXE
PID:1832 -
\??\c:\1lrrxrf.exec:\1lrrxrf.exe47⤵
- Executes dropped EXE
PID:4956 -
\??\c:\nbhttt.exec:\nbhttt.exe48⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vjvjd.exec:\vjvjd.exe49⤵
- Executes dropped EXE
PID:4664 -
\??\c:\dppjd.exec:\dppjd.exe50⤵
- Executes dropped EXE
PID:3680 -
\??\c:\xlrlflf.exec:\xlrlflf.exe51⤵
- Executes dropped EXE
PID:3708 -
\??\c:\bbbbbh.exec:\bbbbbh.exe52⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jvddd.exec:\jvddd.exe53⤵
- Executes dropped EXE
PID:4280 -
\??\c:\ddjjp.exec:\ddjjp.exe54⤵
- Executes dropped EXE
PID:688 -
\??\c:\lrrrrxr.exec:\lrrrrxr.exe55⤵
- Executes dropped EXE
PID:4148 -
\??\c:\hbtnbb.exec:\hbtnbb.exe56⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tnhhtn.exec:\tnhhtn.exe57⤵
- Executes dropped EXE
PID:700 -
\??\c:\vjpjj.exec:\vjpjj.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3lrrlrr.exec:\3lrrlrr.exe59⤵
- Executes dropped EXE
PID:440 -
\??\c:\bbtthn.exec:\bbtthn.exe60⤵
- Executes dropped EXE
PID:4608 -
\??\c:\vjjdp.exec:\vjjdp.exe61⤵
- Executes dropped EXE
PID:1176 -
\??\c:\5djpp.exec:\5djpp.exe62⤵
- Executes dropped EXE
PID:1340 -
\??\c:\rxfrrxr.exec:\rxfrrxr.exe63⤵
- Executes dropped EXE
PID:1812 -
\??\c:\djvvv.exec:\djvvv.exe64⤵
- Executes dropped EXE
PID:3580 -
\??\c:\vpdvv.exec:\vpdvv.exe65⤵
- Executes dropped EXE
PID:3204 -
\??\c:\lxfxlll.exec:\lxfxlll.exe66⤵PID:2104
-
\??\c:\hhbtbt.exec:\hhbtbt.exe67⤵PID:4500
-
\??\c:\vjjpd.exec:\vjjpd.exe68⤵PID:1344
-
\??\c:\xflrllx.exec:\xflrllx.exe69⤵PID:5052
-
\??\c:\3ttttn.exec:\3ttttn.exe70⤵PID:972
-
\??\c:\jdvdp.exec:\jdvdp.exe71⤵PID:3720
-
\??\c:\vpjdv.exec:\vpjdv.exe72⤵PID:4736
-
\??\c:\xrrrfrr.exec:\xrrrfrr.exe73⤵PID:3956
-
\??\c:\bnbtnn.exec:\bnbtnn.exe74⤵PID:3740
-
\??\c:\djpjj.exec:\djpjj.exe75⤵PID:2692
-
\??\c:\llrrrxl.exec:\llrrrxl.exe76⤵PID:1084
-
\??\c:\fflfffx.exec:\fflfffx.exe77⤵PID:4548
-
\??\c:\ttbnnh.exec:\ttbnnh.exe78⤵PID:4532
-
\??\c:\jdjpj.exec:\jdjpj.exe79⤵PID:2292
-
\??\c:\xflflfx.exec:\xflflfx.exe80⤵PID:4152
-
\??\c:\xfrflfl.exec:\xfrflfl.exe81⤵PID:2752
-
\??\c:\djjpj.exec:\djjpj.exe82⤵PID:3144
-
\??\c:\ddjjp.exec:\ddjjp.exe83⤵PID:3376
-
\??\c:\lxxflfl.exec:\lxxflfl.exe84⤵PID:4692
-
\??\c:\rrrrxrr.exec:\rrrrxrr.exe85⤵PID:3764
-
\??\c:\tbbhnn.exec:\tbbhnn.exe86⤵PID:2264
-
\??\c:\djppp.exec:\djppp.exe87⤵PID:2280
-
\??\c:\jppjv.exec:\jppjv.exe88⤵PID:3916
-
\??\c:\flxffrr.exec:\flxffrr.exe89⤵PID:3628
-
\??\c:\nntbnh.exec:\nntbnh.exe90⤵PID:428
-
\??\c:\nbbhbn.exec:\nbbhbn.exe91⤵PID:2516
-
\??\c:\pvdvj.exec:\pvdvj.exe92⤵PID:2448
-
\??\c:\7dvpp.exec:\7dvpp.exe93⤵PID:2272
-
\??\c:\xlrrrxf.exec:\xlrrrxf.exe94⤵PID:3148
-
\??\c:\xllllxf.exec:\xllllxf.exe95⤵PID:968
-
\??\c:\btttbb.exec:\btttbb.exe96⤵PID:2444
-
\??\c:\htbntn.exec:\htbntn.exe97⤵PID:4876
-
\??\c:\ffllxxf.exec:\ffllxxf.exe98⤵PID:1504
-
\??\c:\nbttth.exec:\nbttth.exe99⤵PID:4492
-
\??\c:\nnnntb.exec:\nnnntb.exe100⤵PID:752
-
\??\c:\jjvdj.exec:\jjvdj.exe101⤵PID:2620
-
\??\c:\frxfxlf.exec:\frxfxlf.exe102⤵PID:3296
-
\??\c:\ffrxlll.exec:\ffrxlll.exe103⤵PID:2956
-
\??\c:\bntnnh.exec:\bntnnh.exe104⤵PID:4588
-
\??\c:\nnttnn.exec:\nnttnn.exe105⤵PID:1912
-
\??\c:\dvdvp.exec:\dvdvp.exe106⤵PID:876
-
\??\c:\rfxfllf.exec:\rfxfllf.exe107⤵PID:4740
-
\??\c:\thnntt.exec:\thnntt.exe108⤵PID:2404
-
\??\c:\jdjpp.exec:\jdjpp.exe109⤵PID:4132
-
\??\c:\vpvvv.exec:\vpvvv.exe110⤵PID:4176
-
\??\c:\ffllrrx.exec:\ffllrrx.exe111⤵PID:4116
-
\??\c:\flxfxfx.exec:\flxfxfx.exe112⤵PID:4004
-
\??\c:\ttthnh.exec:\ttthnh.exe113⤵PID:3524
-
\??\c:\ppjpv.exec:\ppjpv.exe114⤵PID:1812
-
\??\c:\7ppvd.exec:\7ppvd.exe115⤵PID:1744
-
\??\c:\ffrrflx.exec:\ffrrflx.exe116⤵PID:2104
-
\??\c:\fflxfxx.exec:\fflxfxx.exe117⤵PID:4500
-
\??\c:\tttttt.exec:\tttttt.exe118⤵PID:4580
-
\??\c:\1htbbn.exec:\1htbbn.exe119⤵PID:3224
-
\??\c:\pjvvv.exec:\pjvvv.exe120⤵PID:5068
-
\??\c:\lffllrl.exec:\lffllrl.exe121⤵PID:2480
-
\??\c:\xxrlrxx.exec:\xxrlrxx.exe122⤵PID:2936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-