Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 05:44
Behavioral task
behavioral1
Sample
2084f48c2d61d255ce33045398a41ed0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2084f48c2d61d255ce33045398a41ed0_NeikiAnalytics.exe
-
Size
80KB
-
MD5
2084f48c2d61d255ce33045398a41ed0
-
SHA1
2a3ddda528d04d9630a6e2f576e03a18623ba184
-
SHA256
ba2c5e4ddeecd8c6c7aed2488c3068fc953cbaa3a33d2bddf02e3364fc22d637
-
SHA512
e1e42c1f7cccc7385bbaf552d3d94a20135177074f7bb7dfcf258e895b63b3eae4bdea9212b9a1da4e75f949283fc587a7698fcc52e7a05492a67205a70f176f
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TVqMJ89v:zhOmTsF93UYfwC6GIoutiTU2HVS6cMJC
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/4752-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1080-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2960-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-572-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1596-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1668-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vjpdd.exe00664.exe04606.exerxxlllx.exevvvpj.exe4026266.exe284400.exebhbnbb.exe046022.exexrxxfff.exe0040000.exeddddd.exe8044444.exelffxxrl.exelxrlfxl.exe684040.exeo800006.exe5djdv.exe608888.exe8022408.exerrrlfff.exe3xrrrrl.exettbttn.exe042644.exe28088.exeppjdj.exevjddd.exelfrrrxx.exefrffffl.exedvjpd.exe828044.exe2644662.exehbbttt.exe00466.exe802226.exehtbttn.exepppvd.exe1hnhhh.exedjdjd.exe3lffrrr.exe040666.exejdjvd.exe488866.exe00220.exe82888.exenbhhhh.exe9ppdv.exedpvvv.exe6060000.exehtbtnn.exe8200440.exe24484.exe62840.exe824444.exelfxrllf.exe4088822.exevjpjj.exehnnhbt.exe6406840.exelfflxxf.exe3bhhbb.exea2482.exerflfrrr.exe2006626.exepid process 4256 vjpdd.exe 2584 00664.exe 5048 04606.exe 1212 rxxlllx.exe 4752 vvvpj.exe 1668 4026266.exe 2092 284400.exe 932 bhbnbb.exe 4868 046022.exe 3316 xrxxfff.exe 3996 0040000.exe 4896 ddddd.exe 1496 8044444.exe 1016 lffxxrl.exe 3396 lxrlfxl.exe 5020 684040.exe 3956 o800006.exe 4600 5djdv.exe 3552 608888.exe 4292 8022408.exe 1596 rrrlfff.exe 2296 3xrrrrl.exe 812 ttbttn.exe 4768 042644.exe 4372 28088.exe 2864 ppjdj.exe 2440 vjddd.exe 808 lfrrrxx.exe 1868 frffffl.exe 412 dvjpd.exe 4532 828044.exe 3140 2644662.exe 1352 hbbttt.exe 4212 00466.exe 4384 802226.exe 1368 htbttn.exe 2420 pppvd.exe 1080 1hnhhh.exe 2372 djdjd.exe 4380 3lffrrr.exe 4572 040666.exe 4844 jdjvd.exe 1592 488866.exe 1148 00220.exe 4264 82888.exe 4256 nbhhhh.exe 1492 9ppdv.exe 552 dpvvv.exe 5080 6060000.exe 2544 htbtnn.exe 3476 8200440.exe 4848 24484.exe 2960 62840.exe 1520 824444.exe 2460 lfxrllf.exe 2948 4088822.exe 1516 vjpjj.exe 1072 hnnhbt.exe 2604 6406840.exe 3632 lfflxxf.exe 3544 3bhhbb.exe 4348 a2482.exe 3096 rflfrrr.exe 4832 2006626.exe -
Processes:
resource yara_rule C:\vjpdd.exe upx behavioral2/memory/4256-5-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxxlllx.exe upx behavioral2/memory/4752-33-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\046022.exe upx \??\c:\xrxxfff.exe upx behavioral2/memory/3316-59-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddddd.exe upx behavioral2/memory/3996-63-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lffxxrl.exe upx behavioral2/memory/1016-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3956-92-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrrlfff.exe upx \??\c:\3xrrrrl.exe upx \??\c:\ttbttn.exe upx C:\vjddd.exe upx \??\c:\frffffl.exe upx C:\2644662.exe upx behavioral2/memory/1368-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4572-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2372-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1080-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2960-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2956-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3916-352-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3324-438-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1980-435-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4836-490-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1516-572-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3396-578-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3484-580-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5084-621-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2892-614-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/976-601-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3412-567-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1460-540-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3920-531-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2096-528-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4304-521-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2956-512-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1672-505-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3296-500-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4836-493-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4352-485-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4484-482-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2264-469-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3640-464-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1592-448-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4376-416-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1476-395-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1476-392-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/844-389-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4648-386-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3420-377-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/440-358-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3916-355-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1520-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4752-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/468-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4988-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4036-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4036-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/412-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5008-279-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2084f48c2d61d255ce33045398a41ed0_NeikiAnalytics.exevjpdd.exe00664.exe04606.exerxxlllx.exevvvpj.exe4026266.exe284400.exebhbnbb.exe046022.exexrxxfff.exe0040000.exeddddd.exe8044444.exelffxxrl.exelxrlfxl.exe684040.exeo800006.exe5djdv.exe608888.exe8022408.exerrrlfff.exedescription pid process target process PID 2384 wrote to memory of 4256 2384 2084f48c2d61d255ce33045398a41ed0_NeikiAnalytics.exe vjpdd.exe PID 2384 wrote to memory of 4256 2384 2084f48c2d61d255ce33045398a41ed0_NeikiAnalytics.exe vjpdd.exe PID 2384 wrote to memory of 4256 2384 2084f48c2d61d255ce33045398a41ed0_NeikiAnalytics.exe vjpdd.exe PID 4256 wrote to memory of 2584 4256 vjpdd.exe 00664.exe PID 4256 wrote to memory of 2584 4256 vjpdd.exe 00664.exe PID 4256 wrote to memory of 2584 4256 vjpdd.exe 00664.exe PID 2584 wrote to memory of 5048 2584 00664.exe nbtbnn.exe PID 2584 wrote to memory of 5048 2584 00664.exe nbtbnn.exe PID 2584 wrote to memory of 5048 2584 00664.exe nbtbnn.exe PID 5048 wrote to memory of 1212 5048 04606.exe rxxlllx.exe PID 5048 wrote to memory of 1212 5048 04606.exe rxxlllx.exe PID 5048 wrote to memory of 1212 5048 04606.exe rxxlllx.exe PID 1212 wrote to memory of 4752 1212 rxxlllx.exe vvvpj.exe PID 1212 wrote to memory of 4752 1212 rxxlllx.exe vvvpj.exe PID 1212 wrote to memory of 4752 1212 rxxlllx.exe vvvpj.exe PID 4752 wrote to memory of 1668 4752 vvvpj.exe 4026266.exe PID 4752 wrote to memory of 1668 4752 vvvpj.exe 4026266.exe PID 4752 wrote to memory of 1668 4752 vvvpj.exe 4026266.exe PID 1668 wrote to memory of 2092 1668 4026266.exe 284400.exe PID 1668 wrote to memory of 2092 1668 4026266.exe 284400.exe PID 1668 wrote to memory of 2092 1668 4026266.exe 284400.exe PID 2092 wrote to memory of 932 2092 284400.exe bhbnbb.exe PID 2092 wrote to memory of 932 2092 284400.exe bhbnbb.exe PID 2092 wrote to memory of 932 2092 284400.exe bhbnbb.exe PID 932 wrote to memory of 4868 932 bhbnbb.exe 046022.exe PID 932 wrote to memory of 4868 932 bhbnbb.exe 046022.exe PID 932 wrote to memory of 4868 932 bhbnbb.exe 046022.exe PID 4868 wrote to memory of 3316 4868 046022.exe xrxxfff.exe PID 4868 wrote to memory of 3316 4868 046022.exe xrxxfff.exe PID 4868 wrote to memory of 3316 4868 046022.exe xrxxfff.exe PID 3316 wrote to memory of 3996 3316 xrxxfff.exe 0040000.exe PID 3316 wrote to memory of 3996 3316 xrxxfff.exe 0040000.exe PID 3316 wrote to memory of 3996 3316 xrxxfff.exe 0040000.exe PID 3996 wrote to memory of 4896 3996 0040000.exe ddddd.exe PID 3996 wrote to memory of 4896 3996 0040000.exe ddddd.exe PID 3996 wrote to memory of 4896 3996 0040000.exe ddddd.exe PID 4896 wrote to memory of 1496 4896 ddddd.exe 8044444.exe PID 4896 wrote to memory of 1496 4896 ddddd.exe 8044444.exe PID 4896 wrote to memory of 1496 4896 ddddd.exe 8044444.exe PID 1496 wrote to memory of 1016 1496 8044444.exe lffxxrl.exe PID 1496 wrote to memory of 1016 1496 8044444.exe lffxxrl.exe PID 1496 wrote to memory of 1016 1496 8044444.exe lffxxrl.exe PID 1016 wrote to memory of 3396 1016 lffxxrl.exe lxrlfxl.exe PID 1016 wrote to memory of 3396 1016 lffxxrl.exe lxrlfxl.exe PID 1016 wrote to memory of 3396 1016 lffxxrl.exe lxrlfxl.exe PID 3396 wrote to memory of 5020 3396 lxrlfxl.exe 684040.exe PID 3396 wrote to memory of 5020 3396 lxrlfxl.exe 684040.exe PID 3396 wrote to memory of 5020 3396 lxrlfxl.exe 684040.exe PID 5020 wrote to memory of 3956 5020 684040.exe o800006.exe PID 5020 wrote to memory of 3956 5020 684040.exe o800006.exe PID 5020 wrote to memory of 3956 5020 684040.exe o800006.exe PID 3956 wrote to memory of 4600 3956 o800006.exe 5djdv.exe PID 3956 wrote to memory of 4600 3956 o800006.exe 5djdv.exe PID 3956 wrote to memory of 4600 3956 o800006.exe 5djdv.exe PID 4600 wrote to memory of 3552 4600 5djdv.exe 608888.exe PID 4600 wrote to memory of 3552 4600 5djdv.exe 608888.exe PID 4600 wrote to memory of 3552 4600 5djdv.exe 608888.exe PID 3552 wrote to memory of 4292 3552 608888.exe 6804400.exe PID 3552 wrote to memory of 4292 3552 608888.exe 6804400.exe PID 3552 wrote to memory of 4292 3552 608888.exe 6804400.exe PID 4292 wrote to memory of 1596 4292 8022408.exe rrrlfff.exe PID 4292 wrote to memory of 1596 4292 8022408.exe rrrlfff.exe PID 4292 wrote to memory of 1596 4292 8022408.exe rrrlfff.exe PID 1596 wrote to memory of 2296 1596 rrrlfff.exe 3xrrrrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2840231261\zmstage.exeC:\Users\Admin\AppData\Local\Temp\2840231261\zmstage.exe1⤵PID:468
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\2084f48c2d61d255ce33045398a41ed0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2084f48c2d61d255ce33045398a41ed0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vjpdd.exec:\vjpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\00664.exec:\00664.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\04606.exec:\04606.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\rxxlllx.exec:\rxxlllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\vvvpj.exec:\vvvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\4026266.exec:\4026266.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\284400.exec:\284400.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\bhbnbb.exec:\bhbnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\046022.exec:\046022.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\xrxxfff.exec:\xrxxfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\0040000.exec:\0040000.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\ddddd.exec:\ddddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\8044444.exec:\8044444.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\lffxxrl.exec:\lffxxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\lxrlfxl.exec:\lxrlfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\684040.exec:\684040.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\o800006.exec:\o800006.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\5djdv.exec:\5djdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\608888.exec:\608888.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\8022408.exec:\8022408.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\rrrlfff.exec:\rrrlfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\3xrrrrl.exec:\3xrrrrl.exe23⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ttbttn.exec:\ttbttn.exe24⤵
- Executes dropped EXE
PID:812 -
\??\c:\042644.exec:\042644.exe25⤵
- Executes dropped EXE
PID:4768 -
\??\c:\28088.exec:\28088.exe26⤵
- Executes dropped EXE
PID:4372 -
\??\c:\ppjdj.exec:\ppjdj.exe27⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vjddd.exec:\vjddd.exe28⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lfrrrxx.exec:\lfrrrxx.exe29⤵
- Executes dropped EXE
PID:808 -
\??\c:\frffffl.exec:\frffffl.exe30⤵
- Executes dropped EXE
PID:1868 -
\??\c:\dvjpd.exec:\dvjpd.exe31⤵
- Executes dropped EXE
PID:412 -
\??\c:\828044.exec:\828044.exe32⤵
- Executes dropped EXE
PID:4532 -
\??\c:\2644662.exec:\2644662.exe33⤵
- Executes dropped EXE
PID:3140 -
\??\c:\hbbttt.exec:\hbbttt.exe34⤵
- Executes dropped EXE
PID:1352 -
\??\c:\00466.exec:\00466.exe35⤵
- Executes dropped EXE
PID:4212 -
\??\c:\802226.exec:\802226.exe36⤵
- Executes dropped EXE
PID:4384 -
\??\c:\htbttn.exec:\htbttn.exe37⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pppvd.exec:\pppvd.exe38⤵
- Executes dropped EXE
PID:2420 -
\??\c:\1hnhhh.exec:\1hnhhh.exe39⤵
- Executes dropped EXE
PID:1080 -
\??\c:\djdjd.exec:\djdjd.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\3lffrrr.exec:\3lffrrr.exe41⤵
- Executes dropped EXE
PID:4380 -
\??\c:\040666.exec:\040666.exe42⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jdjvd.exec:\jdjvd.exe43⤵
- Executes dropped EXE
PID:4844 -
\??\c:\488866.exec:\488866.exe44⤵
- Executes dropped EXE
PID:1592 -
\??\c:\00220.exec:\00220.exe45⤵
- Executes dropped EXE
PID:1148 -
\??\c:\82888.exec:\82888.exe46⤵
- Executes dropped EXE
PID:4264 -
\??\c:\nbhhhh.exec:\nbhhhh.exe47⤵
- Executes dropped EXE
PID:4256 -
\??\c:\9ppdv.exec:\9ppdv.exe48⤵
- Executes dropped EXE
PID:1492 -
\??\c:\dpvvv.exec:\dpvvv.exe49⤵
- Executes dropped EXE
PID:552 -
\??\c:\6060000.exec:\6060000.exe50⤵
- Executes dropped EXE
PID:5080 -
\??\c:\htbtnn.exec:\htbtnn.exe51⤵
- Executes dropped EXE
PID:2544 -
\??\c:\8200440.exec:\8200440.exe52⤵
- Executes dropped EXE
PID:3476 -
\??\c:\24484.exec:\24484.exe53⤵
- Executes dropped EXE
PID:4848 -
\??\c:\62840.exec:\62840.exe54⤵
- Executes dropped EXE
PID:2960 -
\??\c:\824444.exec:\824444.exe55⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lfxrllf.exec:\lfxrllf.exe56⤵
- Executes dropped EXE
PID:2460 -
\??\c:\4088822.exec:\4088822.exe57⤵
- Executes dropped EXE
PID:2948 -
\??\c:\vjpjj.exec:\vjpjj.exe58⤵
- Executes dropped EXE
PID:1516 -
\??\c:\hnnhbt.exec:\hnnhbt.exe59⤵
- Executes dropped EXE
PID:1072 -
\??\c:\6406840.exec:\6406840.exe60⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lfflxxf.exec:\lfflxxf.exe61⤵
- Executes dropped EXE
PID:3632 -
\??\c:\3bhhbb.exec:\3bhhbb.exe62⤵
- Executes dropped EXE
PID:3544 -
\??\c:\a2482.exec:\a2482.exe63⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rflfrrr.exec:\rflfrrr.exe64⤵
- Executes dropped EXE
PID:3096 -
\??\c:\2006626.exec:\2006626.exe65⤵
- Executes dropped EXE
PID:4832 -
\??\c:\3hhbhh.exec:\3hhbhh.exe66⤵PID:4880
-
\??\c:\xffxxxr.exec:\xffxxxr.exe67⤵PID:1876
-
\??\c:\hbhbhh.exec:\hbhbhh.exe68⤵PID:3340
-
\??\c:\i064826.exec:\i064826.exe69⤵PID:2124
-
\??\c:\26224.exec:\26224.exe70⤵PID:1692
-
\??\c:\xflrrlf.exec:\xflrrlf.exe71⤵PID:4324
-
\??\c:\o848488.exec:\o848488.exe72⤵PID:3524
-
\??\c:\btnhhn.exec:\btnhhn.exe73⤵PID:4648
-
\??\c:\8866060.exec:\8866060.exe74⤵PID:4760
-
\??\c:\088284.exec:\088284.exe75⤵PID:976
-
\??\c:\jvddd.exec:\jvddd.exe76⤵PID:1444
-
\??\c:\vvppj.exec:\vvppj.exe77⤵PID:812
-
\??\c:\22604.exec:\22604.exe78⤵PID:4788
-
\??\c:\48040.exec:\48040.exe79⤵PID:4636
-
\??\c:\640082.exec:\640082.exe80⤵PID:5008
-
\??\c:\dvvpd.exec:\dvvpd.exe81⤵PID:3056
-
\??\c:\rllffrr.exec:\rllffrr.exe82⤵PID:2956
-
\??\c:\000048.exec:\000048.exe83⤵PID:1224
-
\??\c:\1bbtnh.exec:\1bbtnh.exe84⤵PID:3960
-
\??\c:\rfrlrll.exec:\rfrlrll.exe85⤵PID:4924
-
\??\c:\60660.exec:\60660.exe86⤵PID:412
-
\??\c:\44048.exec:\44048.exe87⤵PID:2216
-
\??\c:\064084.exec:\064084.exe88⤵PID:3600
-
\??\c:\bnhtth.exec:\bnhtth.exe89⤵PID:4036
-
\??\c:\tnbbtt.exec:\tnbbtt.exe90⤵PID:2668
-
\??\c:\26882.exec:\26882.exe91⤵PID:2416
-
\??\c:\062666.exec:\062666.exe92⤵PID:3024
-
\??\c:\62000.exec:\62000.exe93⤵PID:2828
-
\??\c:\hnbnhh.exec:\hnbnhh.exe94⤵PID:3548
-
\??\c:\8066004.exec:\8066004.exe95⤵PID:1460
-
\??\c:\rfrlfrr.exec:\rfrlfrr.exe96⤵PID:2268
-
\??\c:\06222.exec:\06222.exe97⤵PID:2064
-
\??\c:\pjpvv.exec:\pjpvv.exe98⤵PID:2736
-
\??\c:\60226.exec:\60226.exe99⤵PID:4988
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe100⤵PID:468
-
\??\c:\ppvvj.exec:\ppvvj.exe101⤵PID:4288
-
\??\c:\5lllrll.exec:\5lllrll.exe102⤵PID:4920
-
\??\c:\0244884.exec:\0244884.exe103⤵PID:1960
-
\??\c:\88004.exec:\88004.exe104⤵PID:2452
-
\??\c:\9lxrxrr.exec:\9lxrxrr.exe105⤵PID:1256
-
\??\c:\btttnn.exec:\btttnn.exe106⤵PID:2812
-
\??\c:\vddvj.exec:\vddvj.exe107⤵PID:4752
-
\??\c:\nbnhtn.exec:\nbnhtn.exe108⤵PID:3036
-
\??\c:\s8848.exec:\s8848.exe109⤵PID:1656
-
\??\c:\26682.exec:\26682.exe110⤵PID:4848
-
\??\c:\64282.exec:\64282.exe111⤵PID:2960
-
\??\c:\480460.exec:\480460.exe112⤵PID:1520
-
\??\c:\bbbbbb.exec:\bbbbbb.exe113⤵PID:3492
-
\??\c:\9tbbbb.exec:\9tbbbb.exe114⤵PID:3916
-
\??\c:\042600.exec:\042600.exe115⤵PID:440
-
\??\c:\frxrfff.exec:\frxrfff.exe116⤵PID:4340
-
\??\c:\04228.exec:\04228.exe117⤵PID:3156
-
\??\c:\e22600.exec:\e22600.exe118⤵PID:4584
-
\??\c:\8000044.exec:\8000044.exe119⤵PID:4168
-
\??\c:\468282.exec:\468282.exe120⤵PID:2832
-
\??\c:\dpjdv.exec:\dpjdv.exe121⤵PID:876
-
\??\c:\04266.exec:\04266.exe122⤵PID:2480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-