Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 07:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
384defa8bda34f3b60b0f915c90f5a80_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
384defa8bda34f3b60b0f915c90f5a80_NeikiAnalytics.exe
-
Size
521KB
-
MD5
384defa8bda34f3b60b0f915c90f5a80
-
SHA1
72fddaf5f2b82953957b4f517c718b1c6ab7f566
-
SHA256
e8025c123ce11f9852200a5f64f5a82506fbd5e68c5538384da714263cf20cd7
-
SHA512
d283643b17313b43c3c65c43bfc70737e5df428e69075606eabc9d57786f6378eb6c1b133de1c9e463ad029217ffc02ff4c448bff8d4ce94b8ffb2f06570b322
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H3E:q7Tc2NYHUrAwfMHNnpls489U
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3252-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/424-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/988-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-750-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-811-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-1032-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-1103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3864 rxrflff.exe 4516 nhnhbt.exe 1504 5rxrlll.exe 368 5dpjj.exe 1244 rxrrrlr.exe 3392 bttttt.exe 4808 rrxxlll.exe 3260 nhtthh.exe 2652 xrxrfxr.exe 1576 vdjjd.exe 1608 ppppp.exe 4084 nntthn.exe 4076 9pjpd.exe 540 lffrxrr.exe 2392 rxfxlxr.exe 1012 3nnttt.exe 3516 xxfxxfr.exe 3608 9rxxxxx.exe 4712 lrrllxx.exe 5000 nhtnhb.exe 3964 pvddj.exe 1728 tnnhhn.exe 680 rrrlfff.exe 3556 nhhnnt.exe 1188 rflllfx.exe 3904 bhbtnn.exe 3720 vpvpv.exe 4064 xfrrlfr.exe 4212 dppjj.exe 2712 fxlxllf.exe 1156 1djjj.exe 4652 lxxrrll.exe 3652 nbnbbb.exe 408 jddvp.exe 3452 btthnn.exe 1592 jjvpj.exe 1960 rlrlllf.exe 2744 5tbhbb.exe 400 jdddv.exe 4460 lrrlfxr.exe 4436 ffllfxf.exe 3496 5nthbt.exe 4340 dpvvp.exe 3768 5llfllf.exe 1504 3hntnt.exe 4048 pjdvp.exe 5108 7rfrlfx.exe 636 hbbtnn.exe 4040 1dddp.exe 1904 frxrlff.exe 4808 nbbtnn.exe 4316 vpvdd.exe 1080 fxlfllr.exe 1036 nhtnnb.exe 3196 vjjpj.exe 1164 frfxllf.exe 424 1thtbb.exe 3544 djpjv.exe 3336 fllxrfr.exe 2920 3bhbth.exe 1332 vvdvp.exe 4396 fxfffff.exe 808 bnhbtn.exe 1900 vjvpp.exe -
resource yara_rule behavioral2/memory/3252-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/424-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/988-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-509-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3252 wrote to memory of 3864 3252 384defa8bda34f3b60b0f915c90f5a80_NeikiAnalytics.exe 81 PID 3252 wrote to memory of 3864 3252 384defa8bda34f3b60b0f915c90f5a80_NeikiAnalytics.exe 81 PID 3252 wrote to memory of 3864 3252 384defa8bda34f3b60b0f915c90f5a80_NeikiAnalytics.exe 81 PID 3864 wrote to memory of 4516 3864 rxrflff.exe 82 PID 3864 wrote to memory of 4516 3864 rxrflff.exe 82 PID 3864 wrote to memory of 4516 3864 rxrflff.exe 82 PID 4516 wrote to memory of 1504 4516 nhnhbt.exe 83 PID 4516 wrote to memory of 1504 4516 nhnhbt.exe 83 PID 4516 wrote to memory of 1504 4516 nhnhbt.exe 83 PID 1504 wrote to memory of 368 1504 5rxrlll.exe 84 PID 1504 wrote to memory of 368 1504 5rxrlll.exe 84 PID 1504 wrote to memory of 368 1504 5rxrlll.exe 84 PID 368 wrote to memory of 1244 368 5dpjj.exe 85 PID 368 wrote to memory of 1244 368 5dpjj.exe 85 PID 368 wrote to memory of 1244 368 5dpjj.exe 85 PID 1244 wrote to memory of 3392 1244 rxrrrlr.exe 86 PID 1244 wrote to memory of 3392 1244 rxrrrlr.exe 86 PID 1244 wrote to memory of 3392 1244 rxrrrlr.exe 86 PID 3392 wrote to memory of 4808 3392 bttttt.exe 87 PID 3392 wrote to memory of 4808 3392 bttttt.exe 87 PID 3392 wrote to memory of 4808 3392 bttttt.exe 87 PID 4808 wrote to memory of 3260 4808 rrxxlll.exe 88 PID 4808 wrote to memory of 3260 4808 rrxxlll.exe 88 PID 4808 wrote to memory of 3260 4808 rrxxlll.exe 88 PID 3260 wrote to memory of 2652 3260 nhtthh.exe 89 PID 3260 wrote to memory of 2652 3260 nhtthh.exe 89 PID 3260 wrote to memory of 2652 3260 nhtthh.exe 89 PID 2652 wrote to memory of 1576 2652 xrxrfxr.exe 91 PID 2652 wrote to memory of 1576 2652 xrxrfxr.exe 91 PID 2652 wrote to memory of 1576 2652 xrxrfxr.exe 91 PID 1576 wrote to memory of 1608 1576 vdjjd.exe 92 PID 1576 wrote to memory of 1608 1576 vdjjd.exe 92 PID 1576 wrote to memory of 1608 1576 vdjjd.exe 92 PID 1608 wrote to memory of 4084 1608 ppppp.exe 94 PID 1608 wrote to memory of 4084 1608 ppppp.exe 94 PID 1608 wrote to memory of 4084 1608 ppppp.exe 94 PID 4084 wrote to memory of 4076 4084 nntthn.exe 95 PID 4084 wrote to memory of 4076 4084 nntthn.exe 95 PID 4084 wrote to memory of 4076 4084 nntthn.exe 95 PID 4076 wrote to memory of 540 4076 9pjpd.exe 96 PID 4076 wrote to memory of 540 4076 9pjpd.exe 96 PID 4076 wrote to memory of 540 4076 9pjpd.exe 96 PID 540 wrote to memory of 2392 540 lffrxrr.exe 98 PID 540 wrote to memory of 2392 540 lffrxrr.exe 98 PID 540 wrote to memory of 2392 540 lffrxrr.exe 98 PID 2392 wrote to memory of 1012 2392 rxfxlxr.exe 99 PID 2392 wrote to memory of 1012 2392 rxfxlxr.exe 99 PID 2392 wrote to memory of 1012 2392 rxfxlxr.exe 99 PID 1012 wrote to memory of 3516 1012 3nnttt.exe 100 PID 1012 wrote to memory of 3516 1012 3nnttt.exe 100 PID 1012 wrote to memory of 3516 1012 3nnttt.exe 100 PID 3516 wrote to memory of 3608 3516 xxfxxfr.exe 101 PID 3516 wrote to memory of 3608 3516 xxfxxfr.exe 101 PID 3516 wrote to memory of 3608 3516 xxfxxfr.exe 101 PID 3608 wrote to memory of 4712 3608 9rxxxxx.exe 102 PID 3608 wrote to memory of 4712 3608 9rxxxxx.exe 102 PID 3608 wrote to memory of 4712 3608 9rxxxxx.exe 102 PID 4712 wrote to memory of 5000 4712 lrrllxx.exe 103 PID 4712 wrote to memory of 5000 4712 lrrllxx.exe 103 PID 4712 wrote to memory of 5000 4712 lrrllxx.exe 103 PID 5000 wrote to memory of 3964 5000 nhtnhb.exe 104 PID 5000 wrote to memory of 3964 5000 nhtnhb.exe 104 PID 5000 wrote to memory of 3964 5000 nhtnhb.exe 104 PID 3964 wrote to memory of 1728 3964 pvddj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\384defa8bda34f3b60b0f915c90f5a80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\384defa8bda34f3b60b0f915c90f5a80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\rxrflff.exec:\rxrflff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\nhnhbt.exec:\nhnhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\5rxrlll.exec:\5rxrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\5dpjj.exec:\5dpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\rxrrrlr.exec:\rxrrrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\bttttt.exec:\bttttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\rrxxlll.exec:\rrxxlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\nhtthh.exec:\nhtthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\xrxrfxr.exec:\xrxrfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vdjjd.exec:\vdjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\ppppp.exec:\ppppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\nntthn.exec:\nntthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\9pjpd.exec:\9pjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\lffrxrr.exec:\lffrxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\rxfxlxr.exec:\rxfxlxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\3nnttt.exec:\3nnttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\xxfxxfr.exec:\xxfxxfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\9rxxxxx.exec:\9rxxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\lrrllxx.exec:\lrrllxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\nhtnhb.exec:\nhtnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\pvddj.exec:\pvddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\tnnhhn.exec:\tnnhhn.exe23⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rrrlfff.exec:\rrrlfff.exe24⤵
- Executes dropped EXE
PID:680 -
\??\c:\nhhnnt.exec:\nhhnnt.exe25⤵
- Executes dropped EXE
PID:3556 -
\??\c:\rflllfx.exec:\rflllfx.exe26⤵
- Executes dropped EXE
PID:1188 -
\??\c:\bhbtnn.exec:\bhbtnn.exe27⤵
- Executes dropped EXE
PID:3904 -
\??\c:\vpvpv.exec:\vpvpv.exe28⤵
- Executes dropped EXE
PID:3720 -
\??\c:\xfrrlfr.exec:\xfrrlfr.exe29⤵
- Executes dropped EXE
PID:4064 -
\??\c:\dppjj.exec:\dppjj.exe30⤵
- Executes dropped EXE
PID:4212 -
\??\c:\fxlxllf.exec:\fxlxllf.exe31⤵
- Executes dropped EXE
PID:2712 -
\??\c:\1djjj.exec:\1djjj.exe32⤵
- Executes dropped EXE
PID:1156 -
\??\c:\lxxrrll.exec:\lxxrrll.exe33⤵
- Executes dropped EXE
PID:4652 -
\??\c:\nbnbbb.exec:\nbnbbb.exe34⤵
- Executes dropped EXE
PID:3652 -
\??\c:\jddvp.exec:\jddvp.exe35⤵
- Executes dropped EXE
PID:408 -
\??\c:\btthnn.exec:\btthnn.exe36⤵
- Executes dropped EXE
PID:3452 -
\??\c:\jjvpj.exec:\jjvpj.exe37⤵
- Executes dropped EXE
PID:1592 -
\??\c:\rlrlllf.exec:\rlrlllf.exe38⤵
- Executes dropped EXE
PID:1960 -
\??\c:\5tbhbb.exec:\5tbhbb.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jdddv.exec:\jdddv.exe40⤵
- Executes dropped EXE
PID:400 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe41⤵
- Executes dropped EXE
PID:4460 -
\??\c:\ffllfxf.exec:\ffllfxf.exe42⤵
- Executes dropped EXE
PID:4436 -
\??\c:\5nthbt.exec:\5nthbt.exe43⤵
- Executes dropped EXE
PID:3496 -
\??\c:\dpvvp.exec:\dpvvp.exe44⤵
- Executes dropped EXE
PID:4340 -
\??\c:\5llfllf.exec:\5llfllf.exe45⤵
- Executes dropped EXE
PID:3768 -
\??\c:\3hntnt.exec:\3hntnt.exe46⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pjdvp.exec:\pjdvp.exe47⤵
- Executes dropped EXE
PID:4048 -
\??\c:\7rfrlfx.exec:\7rfrlfx.exe48⤵
- Executes dropped EXE
PID:5108 -
\??\c:\hbbtnn.exec:\hbbtnn.exe49⤵
- Executes dropped EXE
PID:636 -
\??\c:\1dddp.exec:\1dddp.exe50⤵
- Executes dropped EXE
PID:4040 -
\??\c:\frxrlff.exec:\frxrlff.exe51⤵
- Executes dropped EXE
PID:1904 -
\??\c:\nbbtnn.exec:\nbbtnn.exe52⤵
- Executes dropped EXE
PID:4808 -
\??\c:\vpvdd.exec:\vpvdd.exe53⤵
- Executes dropped EXE
PID:4316 -
\??\c:\fxlfllr.exec:\fxlfllr.exe54⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nhtnnb.exec:\nhtnnb.exe55⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vjjpj.exec:\vjjpj.exe56⤵
- Executes dropped EXE
PID:3196 -
\??\c:\frfxllf.exec:\frfxllf.exe57⤵
- Executes dropped EXE
PID:1164 -
\??\c:\1thtbb.exec:\1thtbb.exe58⤵
- Executes dropped EXE
PID:424 -
\??\c:\djpjv.exec:\djpjv.exe59⤵
- Executes dropped EXE
PID:3544 -
\??\c:\fllxrfr.exec:\fllxrfr.exe60⤵
- Executes dropped EXE
PID:3336 -
\??\c:\3bhbth.exec:\3bhbth.exe61⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vvdvp.exec:\vvdvp.exe62⤵
- Executes dropped EXE
PID:1332 -
\??\c:\fxfffff.exec:\fxfffff.exe63⤵
- Executes dropped EXE
PID:4396 -
\??\c:\bnhbtn.exec:\bnhbtn.exe64⤵
- Executes dropped EXE
PID:808 -
\??\c:\vjvpp.exec:\vjvpp.exe65⤵
- Executes dropped EXE
PID:1900 -
\??\c:\llrxxlx.exec:\llrxxlx.exe66⤵PID:3860
-
\??\c:\bhbthh.exec:\bhbthh.exe67⤵PID:832
-
\??\c:\9ffxllx.exec:\9ffxllx.exe68⤵PID:1312
-
\??\c:\7nnbtn.exec:\7nnbtn.exe69⤵PID:2040
-
\??\c:\jvjdj.exec:\jvjdj.exe70⤵PID:4636
-
\??\c:\frxrllf.exec:\frxrllf.exe71⤵PID:3212
-
\??\c:\tbhbtt.exec:\tbhbtt.exe72⤵PID:3492
-
\??\c:\vdddp.exec:\vdddp.exe73⤵PID:4676
-
\??\c:\pvdvp.exec:\pvdvp.exe74⤵PID:3832
-
\??\c:\xrfxrlx.exec:\xrfxrlx.exe75⤵PID:1392
-
\??\c:\9hnhhb.exec:\9hnhhb.exe76⤵PID:4364
-
\??\c:\jpdvp.exec:\jpdvp.exe77⤵PID:4668
-
\??\c:\flxlfxr.exec:\flxlfxr.exe78⤵PID:2420
-
\??\c:\httnhb.exec:\httnhb.exe79⤵PID:2120
-
\??\c:\9bhhnt.exec:\9bhhnt.exe80⤵PID:2280
-
\??\c:\djvvp.exec:\djvvp.exe81⤵PID:3704
-
\??\c:\rffxrlx.exec:\rffxrlx.exe82⤵PID:4768
-
\??\c:\nnbtnn.exec:\nnbtnn.exe83⤵PID:2264
-
\??\c:\djpjv.exec:\djpjv.exe84⤵PID:2292
-
\??\c:\rxrrffx.exec:\rxrrffx.exe85⤵PID:1156
-
\??\c:\bhhbtt.exec:\bhhbtt.exe86⤵PID:2084
-
\??\c:\ddjpp.exec:\ddjpp.exe87⤵PID:4756
-
\??\c:\lffflrf.exec:\lffflrf.exe88⤵PID:1944
-
\??\c:\hhntbt.exec:\hhntbt.exe89⤵PID:872
-
\??\c:\pdpdd.exec:\pdpdd.exe90⤵PID:4472
-
\??\c:\jvvpj.exec:\jvvpj.exe91⤵PID:5032
-
\??\c:\hhthnh.exec:\hhthnh.exe92⤵PID:2244
-
\??\c:\7ddvj.exec:\7ddvj.exe93⤵PID:400
-
\??\c:\ffrlxrr.exec:\ffrlxrr.exe94⤵PID:4656
-
\??\c:\fxxfrrf.exec:\fxxfrrf.exe95⤵PID:4436
-
\??\c:\djdjp.exec:\djdjp.exe96⤵PID:988
-
\??\c:\vdpjd.exec:\vdpjd.exe97⤵PID:4340
-
\??\c:\frrlxrl.exec:\frrlxrl.exe98⤵PID:1724
-
\??\c:\bhtbth.exec:\bhtbth.exe99⤵PID:1504
-
\??\c:\jppjd.exec:\jppjd.exe100⤵PID:4048
-
\??\c:\lllffxx.exec:\lllffxx.exe101⤵PID:1244
-
\??\c:\9bhbhh.exec:\9bhbhh.exe102⤵PID:4368
-
\??\c:\vjdvj.exec:\vjdvj.exe103⤵PID:4128
-
\??\c:\rlfrlfr.exec:\rlfrlfr.exe104⤵PID:4540
-
\??\c:\tthhbh.exec:\tthhbh.exe105⤵PID:1020
-
\??\c:\hnbthn.exec:\hnbthn.exe106⤵PID:652
-
\??\c:\5jdjp.exec:\5jdjp.exe107⤵PID:4788
-
\??\c:\1rxrrrr.exec:\1rxrrrr.exe108⤵PID:3304
-
\??\c:\djjpv.exec:\djjpv.exe109⤵PID:1608
-
\??\c:\dvvpp.exec:\dvvpp.exe110⤵PID:4084
-
\??\c:\xrrfrlx.exec:\xrrfrlx.exe111⤵PID:4076
-
\??\c:\7htnbb.exec:\7htnbb.exe112⤵PID:2804
-
\??\c:\pjvpp.exec:\pjvpp.exe113⤵PID:4124
-
\??\c:\5xrrfrl.exec:\5xrrfrl.exe114⤵PID:1972
-
\??\c:\lllrrff.exec:\lllrrff.exe115⤵PID:3616
-
\??\c:\ttnbtn.exec:\ttnbtn.exe116⤵PID:2392
-
\??\c:\vjjdp.exec:\vjjdp.exe117⤵PID:640
-
\??\c:\frllfxr.exec:\frllfxr.exe118⤵PID:1008
-
\??\c:\rllxrrl.exec:\rllxrrl.exe119⤵PID:3860
-
\??\c:\hhbthh.exec:\hhbthh.exe120⤵PID:1916
-
\??\c:\jdjdv.exec:\jdjdv.exe121⤵PID:1336
-
\??\c:\xxlxlfr.exec:\xxlxlfr.exe122⤵PID:5000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-