Analysis
- max time kernel
150s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 05:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61a29f3e810fad435f0394e0cc975830_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
- Target 61a29f3e810fad435f0394e0cc975830_NeikiAnalytics.exe
- Size 487KB
- Sample240613-f1ynfsvhpg
- SHA256 97a00bd5729e904d9c2edb6d247011e79c2bc700a41c90d6e5d023172f97642c
- MD5 61a29f3e810fad435f0394e0cc975830
- SHA1 619512c2ad161942ab79300e27d82bc7e32da008
- SHA512 d3d81a2ef7c2b3429d31ab08c51ba1344b31aa138f31594ad6c4e26145cc665350fa82692ffa512f6fe07f5222745a014bf20aaa203cf5d2c0e510cbfad15289
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwu1b26X1wjdgyPPBy:q7Tc2NYHUrAwqzQ7PPA
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/324-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4660 ffrfxxr.exe 2704 nnhbtn.exe 1372 ttthnh.exe 2356 lrxrxrl.exe 1668 bbbhht.exe 2120 frfrxlx.exe 4444 tnnhbt.exe 4732 llflfxr.exe 3764 7lxlxxl.exe 3636 djjdp.exe 1764 bnhbnh.exe 2984 vppdd.exe 2576 ddpjv.exe 4320 lllxlfx.exe 4440 hbnbtn.exe 3328 dvjjd.exe 3448 bnhthb.exe 536 jdjdj.exe 4784 7hhtnb.exe 4980 jvvvp.exe 3968 tnthhb.exe 996 vjvpp.exe 1680 xllxxlx.exe 3516 jvvpp.exe 2892 lllfrrl.exe 5116 btbbhh.exe 5064 ppvvp.exe 3724 tbhhtt.exe 4340 nbhhhh.exe 4380 hbbttt.exe 3588 jjvjd.exe 4484 bhtnnn.exe 400 3ddvp.exe 4468 xrxrrrl.exe 2776 bbnnnn.exe 5072 vdjdd.exe 2000 fxxrrrl.exe 4708 hbhbbb.exe 3480 dddvv.exe 2300 jvjdp.exe 1016 lxxrrll.exe 1312 tbnnnt.exe 2688 jddvp.exe 3660 ffxrfxr.exe 1420 htbnnb.exe 2580 bhhtnn.exe 1812 jjddv.exe 1840 lfxrlfx.exe 3432 nbbbnb.exe 4580 dddjv.exe 1764 rffrfxl.exe 4120 bhbhhh.exe 4548 nttnbt.exe 432 5jjdv.exe 3216 lxxlxrf.exe 3940 bnnnnn.exe 1528 jpvpd.exe 380 xxxrlfr.exe 2684 rxxrrlf.exe 644 jdppj.exe 3812 xrrfrlx.exe 3504 7bbnbb.exe 2832 jpdvp.exe 764 fxfxxrx.exe -
resource yara_rule behavioral2/memory/4660-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/324-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-418-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 324 wrote to memory of 4660 324 61a29f3e810fad435f0394e0cc975830_NeikiAnalytics.exe 82 PID 324 wrote to memory of 4660 324 61a29f3e810fad435f0394e0cc975830_NeikiAnalytics.exe 82 PID 324 wrote to memory of 4660 324 61a29f3e810fad435f0394e0cc975830_NeikiAnalytics.exe 82 PID 4660 wrote to memory of 2704 4660 ffrfxxr.exe 83 PID 4660 wrote to memory of 2704 4660 ffrfxxr.exe 83 PID 4660 wrote to memory of 2704 4660 ffrfxxr.exe 83 PID 2704 wrote to memory of 1372 2704 nnhbtn.exe 84 PID 2704 wrote to memory of 1372 2704 nnhbtn.exe 84 PID 2704 wrote to memory of 1372 2704 nnhbtn.exe 84 PID 1372 wrote to memory of 2356 1372 ttthnh.exe 85 PID 1372 wrote to memory of 2356 1372 ttthnh.exe 85 PID 1372 wrote to memory of 2356 1372 ttthnh.exe 85 PID 2356 wrote to memory of 1668 2356 lrxrxrl.exe 86 PID 2356 wrote to memory of 1668 2356 lrxrxrl.exe 86 PID 2356 wrote to memory of 1668 2356 lrxrxrl.exe 86 PID 1668 wrote to memory of 2120 1668 bbbhht.exe 87 PID 1668 wrote to memory of 2120 1668 bbbhht.exe 87 PID 1668 wrote to memory of 2120 1668 bbbhht.exe 87 PID 2120 wrote to memory of 4444 2120 frfrxlx.exe 88 PID 2120 wrote to memory of 4444 2120 frfrxlx.exe 88 PID 2120 wrote to memory of 4444 2120 frfrxlx.exe 88 PID 4444 wrote to memory of 4732 4444 tnnhbt.exe 90 PID 4444 wrote to memory of 4732 4444 tnnhbt.exe 90 PID 4444 wrote to memory of 4732 4444 tnnhbt.exe 90 PID 4732 wrote to memory of 3764 4732 llflfxr.exe 91 PID 4732 wrote to memory of 3764 4732 llflfxr.exe 91 PID 4732 wrote to memory of 3764 4732 llflfxr.exe 91 PID 3764 wrote to memory of 3636 3764 7lxlxxl.exe 92 PID 3764 wrote to memory of 3636 3764 7lxlxxl.exe 92 PID 3764 wrote to memory of 3636 3764 7lxlxxl.exe 92 PID 3636 wrote to memory of 1764 3636 djjdp.exe 94 PID 3636 wrote to memory of 1764 3636 djjdp.exe 94 PID 3636 wrote to memory of 1764 3636 djjdp.exe 94 PID 1764 wrote to memory of 2984 1764 bnhbnh.exe 95 PID 1764 wrote to memory of 2984 1764 bnhbnh.exe 95 PID 1764 wrote to memory of 2984 1764 bnhbnh.exe 95 PID 2984 wrote to memory of 2576 2984 vppdd.exe 97 PID 2984 wrote to memory of 2576 2984 vppdd.exe 97 PID 2984 wrote to memory of 2576 2984 vppdd.exe 97 PID 2576 wrote to memory of 4320 2576 ddpjv.exe 98 PID 2576 wrote to memory of 4320 2576 ddpjv.exe 98 PID 2576 wrote to memory of 4320 2576 ddpjv.exe 98 PID 4320 wrote to memory of 4440 4320 lllxlfx.exe 99 PID 4320 wrote to memory of 4440 4320 lllxlfx.exe 99 PID 4320 wrote to memory of 4440 4320 lllxlfx.exe 99 PID 4440 wrote to memory of 3328 4440 hbnbtn.exe 100 PID 4440 wrote to memory of 3328 4440 hbnbtn.exe 100 PID 4440 wrote to memory of 3328 4440 hbnbtn.exe 100 PID 3328 wrote to memory of 3448 3328 dvjjd.exe 101 PID 3328 wrote to memory of 3448 3328 dvjjd.exe 101 PID 3328 wrote to memory of 3448 3328 dvjjd.exe 101 PID 3448 wrote to memory of 536 3448 bnhthb.exe 102 PID 3448 wrote to memory of 536 3448 bnhthb.exe 102 PID 3448 wrote to memory of 536 3448 bnhthb.exe 102 PID 536 wrote to memory of 4784 536 jdjdj.exe 103 PID 536 wrote to memory of 4784 536 jdjdj.exe 103 PID 536 wrote to memory of 4784 536 jdjdj.exe 103 PID 4784 wrote to memory of 4980 4784 7hhtnb.exe 104 PID 4784 wrote to memory of 4980 4784 7hhtnb.exe 104 PID 4784 wrote to memory of 4980 4784 7hhtnb.exe 104 PID 4980 wrote to memory of 3968 4980 jvvvp.exe 105 PID 4980 wrote to memory of 3968 4980 jvvvp.exe 105 PID 4980 wrote to memory of 3968 4980 jvvvp.exe 105 PID 3968 wrote to memory of 996 3968 tnthhb.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\61a29f3e810fad435f0394e0cc975830_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\61a29f3e810fad435f0394e0cc975830_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\ffrfxxr.exec:\ffrfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\nnhbtn.exec:\nnhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\ttthnh.exec:\ttthnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\lrxrxrl.exec:\lrxrxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\bbbhht.exec:\bbbhht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\frfrxlx.exec:\frfrxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\tnnhbt.exec:\tnnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\llflfxr.exec:\llflfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\7lxlxxl.exec:\7lxlxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\djjdp.exec:\djjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\bnhbnh.exec:\bnhbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\vppdd.exec:\vppdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\ddpjv.exec:\ddpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\lllxlfx.exec:\lllxlfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\hbnbtn.exec:\hbnbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\dvjjd.exec:\dvjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\bnhthb.exec:\bnhthb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\jdjdj.exec:\jdjdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\7hhtnb.exec:\7hhtnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\jvvvp.exec:\jvvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\tnthhb.exec:\tnthhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\vjvpp.exec:\vjvpp.exe23⤵
- Executes dropped EXE
PID:996 -
\??\c:\xllxxlx.exec:\xllxxlx.exe24⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jvvpp.exec:\jvvpp.exe25⤵
- Executes dropped EXE
PID:3516 -
\??\c:\lllfrrl.exec:\lllfrrl.exe26⤵
- Executes dropped EXE
PID:2892 -
\??\c:\btbbhh.exec:\btbbhh.exe27⤵
- Executes dropped EXE
PID:5116 -
\??\c:\ppvvp.exec:\ppvvp.exe28⤵
- Executes dropped EXE
PID:5064 -
\??\c:\tbhhtt.exec:\tbhhtt.exe29⤵
- Executes dropped EXE
PID:3724 -
\??\c:\nbhhhh.exec:\nbhhhh.exe30⤵
- Executes dropped EXE
PID:4340 -
\??\c:\hbbttt.exec:\hbbttt.exe31⤵
- Executes dropped EXE
PID:4380 -
\??\c:\jjvjd.exec:\jjvjd.exe32⤵
- Executes dropped EXE
PID:3588 -
\??\c:\bhtnnn.exec:\bhtnnn.exe33⤵
- Executes dropped EXE
PID:4484 -
\??\c:\3ddvp.exec:\3ddvp.exe34⤵
- Executes dropped EXE
PID:400 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe35⤵
- Executes dropped EXE
PID:4468 -
\??\c:\bbnnnn.exec:\bbnnnn.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vdjdd.exec:\vdjdd.exe37⤵
- Executes dropped EXE
PID:5072 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe38⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hbhbbb.exec:\hbhbbb.exe39⤵
- Executes dropped EXE
PID:4708 -
\??\c:\dddvv.exec:\dddvv.exe40⤵
- Executes dropped EXE
PID:3480 -
\??\c:\jvjdp.exec:\jvjdp.exe41⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lxxrrll.exec:\lxxrrll.exe42⤵
- Executes dropped EXE
PID:1016 -
\??\c:\tbnnnt.exec:\tbnnnt.exe43⤵
- Executes dropped EXE
PID:1312 -
\??\c:\jddvp.exec:\jddvp.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ffxrfxr.exec:\ffxrfxr.exe45⤵
- Executes dropped EXE
PID:3660 -
\??\c:\htbnnb.exec:\htbnnb.exe46⤵
- Executes dropped EXE
PID:1420 -
\??\c:\bhhtnn.exec:\bhhtnn.exe47⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jjddv.exec:\jjddv.exe48⤵
- Executes dropped EXE
PID:1812 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe49⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nbbbnb.exec:\nbbbnb.exe50⤵
- Executes dropped EXE
PID:3432 -
\??\c:\dddjv.exec:\dddjv.exe51⤵
- Executes dropped EXE
PID:4580 -
\??\c:\rffrfxl.exec:\rffrfxl.exe52⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bhbhhh.exec:\bhbhhh.exe53⤵
- Executes dropped EXE
PID:4120 -
\??\c:\nttnbt.exec:\nttnbt.exe54⤵
- Executes dropped EXE
PID:4548 -
\??\c:\5jjdv.exec:\5jjdv.exe55⤵
- Executes dropped EXE
PID:432 -
\??\c:\lxxlxrf.exec:\lxxlxrf.exe56⤵
- Executes dropped EXE
PID:3216 -
\??\c:\bnnnnn.exec:\bnnnnn.exe57⤵
- Executes dropped EXE
PID:3940 -
\??\c:\jpvpd.exec:\jpvpd.exe58⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xxxrlfr.exec:\xxxrlfr.exe59⤵
- Executes dropped EXE
PID:380 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe60⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jdppj.exec:\jdppj.exe61⤵
- Executes dropped EXE
PID:644 -
\??\c:\xrrfrlx.exec:\xrrfrlx.exe62⤵
- Executes dropped EXE
PID:3812 -
\??\c:\7bbnbb.exec:\7bbnbb.exe63⤵
- Executes dropped EXE
PID:3504 -
\??\c:\jpdvp.exec:\jpdvp.exe64⤵
- Executes dropped EXE
PID:2832 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe65⤵
- Executes dropped EXE
PID:764 -
\??\c:\nhhbtt.exec:\nhhbtt.exe66⤵PID:2732
-
\??\c:\jvdvp.exec:\jvdvp.exe67⤵PID:808
-
\??\c:\xlrllff.exec:\xlrllff.exe68⤵PID:996
-
\??\c:\bthbtb.exec:\bthbtb.exe69⤵PID:4892
-
\??\c:\ntthtn.exec:\ntthtn.exe70⤵PID:3396
-
\??\c:\dvpjd.exec:\dvpjd.exe71⤵PID:3364
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe72⤵PID:1808
-
\??\c:\hthbbb.exec:\hthbbb.exe73⤵PID:5116
-
\??\c:\nhbbtn.exec:\nhbbtn.exe74⤵PID:2976
-
\??\c:\jvdjd.exec:\jvdjd.exe75⤵PID:3820
-
\??\c:\frxrlff.exec:\frxrlff.exe76⤵PID:3680
-
\??\c:\rfrrlfr.exec:\rfrrlfr.exe77⤵PID:3212
-
\??\c:\hnhbnh.exec:\hnhbnh.exe78⤵PID:1984
-
\??\c:\jddpj.exec:\jddpj.exe79⤵PID:4380
-
\??\c:\lflffll.exec:\lflffll.exe80⤵PID:3588
-
\??\c:\lfrxfxx.exec:\lfrxfxx.exe81⤵PID:2828
-
\??\c:\nbbnbt.exec:\nbbnbt.exe82⤵PID:1996
-
\??\c:\dpjdd.exec:\dpjdd.exe83⤵PID:2464
-
\??\c:\5llrrlx.exec:\5llrrlx.exe84⤵PID:2052
-
\??\c:\hbtnhb.exec:\hbtnhb.exe85⤵PID:4056
-
\??\c:\djjpp.exec:\djjpp.exe86⤵PID:1480
-
\??\c:\3jjvp.exec:\3jjvp.exe87⤵PID:3972
-
\??\c:\lxlxrlx.exec:\lxlxrlx.exe88⤵PID:4420
-
\??\c:\nnhhbt.exec:\nnhhbt.exe89⤵PID:1372
-
\??\c:\dpdpp.exec:\dpdpp.exe90⤵PID:2356
-
\??\c:\lxfrrll.exec:\lxfrrll.exe91⤵PID:2344
-
\??\c:\ffxrrfx.exec:\ffxrrfx.exe92⤵PID:3108
-
\??\c:\bhthtt.exec:\bhthtt.exe93⤵PID:1312
-
\??\c:\vpvpp.exec:\vpvpp.exe94⤵PID:2688
-
\??\c:\3lrlrrf.exec:\3lrlrrf.exe95⤵PID:4444
-
\??\c:\nnbbnn.exec:\nnbbnn.exe96⤵PID:1604
-
\??\c:\nbbbnn.exec:\nbbbnn.exe97⤵PID:1856
-
\??\c:\vdvdv.exec:\vdvdv.exe98⤵PID:1588
-
\??\c:\rllfxfl.exec:\rllfxfl.exe99⤵PID:1992
-
\??\c:\hbttnn.exec:\hbttnn.exe100⤵PID:4236
-
\??\c:\vpjdp.exec:\vpjdp.exe101⤵PID:2920
-
\??\c:\rffrfrl.exec:\rffrfrl.exe102⤵PID:4880
-
\??\c:\flllffx.exec:\flllffx.exe103⤵PID:1948
-
\??\c:\tthbtt.exec:\tthbtt.exe104⤵PID:3556
-
\??\c:\vvvpd.exec:\vvvpd.exe105⤵PID:1208
-
\??\c:\xffrxrx.exec:\xffrxrx.exe106⤵PID:2276
-
\??\c:\frlfxxf.exec:\frlfxxf.exe107⤵PID:4840
-
\??\c:\bhtnhh.exec:\bhtnhh.exe108⤵PID:732
-
\??\c:\pvvjp.exec:\pvvjp.exe109⤵PID:3360
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe110⤵PID:2944
-
\??\c:\btbthh.exec:\btbthh.exe111⤵PID:4068
-
\??\c:\pvdpj.exec:\pvdpj.exe112⤵PID:644
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe113⤵PID:3812
-
\??\c:\nntnhb.exec:\nntnhb.exe114⤵PID:5084
-
\??\c:\ttnbnh.exec:\ttnbnh.exe115⤵PID:2832
-
\??\c:\jjpdp.exec:\jjpdp.exe116⤵PID:724
-
\??\c:\rrrfxxx.exec:\rrrfxxx.exe117⤵PID:2732
-
\??\c:\hbthhb.exec:\hbthhb.exe118⤵PID:4328
-
\??\c:\5bhthb.exec:\5bhthb.exe119⤵PID:3996
-
\??\c:\djdjj.exec:\djdjj.exe120⤵PID:2096
-
\??\c:\flrlrlf.exec:\flrlrlf.exe121⤵PID:2968
-
\??\c:\nttttn.exec:\nttttn.exe122⤵PID:1888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-