Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/06/2024, 03:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b792fe8c6356d0dccf496eaed4fa930_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
- Target 7b792fe8c6356d0dccf496eaed4fa930_NeikiAnalytics.exe
- Size 197KB
- Sample240619-djpywaxarr
- SHA256 7c85eaf5a5046ddb391c52d759b5297edef18aface206fa46b00318e1b26cbc9
- MD5 7b792fe8c6356d0dccf496eaed4fa930
- SHA1 5fd2d737ad0a653ac4f80127abd5352b62538cd7
- SHA512 68fc62af2e6c842f7d994fc622bef7984a81b731898a4a4e206d604409c180f02f84f713563606a31aa56576399dc6158015d8c8d6133c2a477dd1d246d60ac2
- SSDEEP 3072:1hOm2sI93UufdC67ciifmCnmiYJUK+60Q:1cm7ImGddXCrcJHt0Q
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3596-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/656-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/780-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-1015-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-1115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3596 xxlfllx.exe 2724 fxfrrxl.exe 748 fxrlxrf.exe 656 rrxrxrl.exe 640 tbbthh.exe 3484 jjvvj.exe 4520 bhhtnh.exe 3188 nbbbht.exe 1064 flrxrfr.exe 3292 jvdvd.exe 3096 pdjvp.exe 2076 lxfxrrl.exe 4044 hbbtnh.exe 4372 jjdpj.exe 1560 fflxxrf.exe 1476 hbbtnn.exe 4460 jjvpd.exe 4340 3ffxllx.exe 3912 5bbttn.exe 3088 thbnbt.exe 1076 7ddpv.exe 5068 xxxrfxr.exe 4644 tbhbbn.exe 780 vjpjd.exe 388 pvjdp.exe 4548 3flxfff.exe 1816 5bhtnb.exe 1232 vvjdv.exe 3548 jdpdj.exe 4236 7hbthh.exe 2524 hhhbnh.exe 4064 9vdpd.exe 1968 rllffrf.exe 2720 xlxrrrx.exe 4312 7hhthb.exe 4432 3ddpd.exe 4160 3pvjj.exe 4492 7xrlxxr.exe 2324 lrfxlfx.exe 1920 hnhnnb.exe 4356 jvvpj.exe 4104 jjjdp.exe 3380 xxxlxlf.exe 3304 3nntnh.exe 3128 hbhhbb.exe 3932 ddjdp.exe 1620 jvvpd.exe 1448 fllxlfx.exe 2416 rlffrlf.exe 4148 bbthnb.exe 1724 djpdp.exe 400 pppdp.exe 4620 1xrfrlx.exe 3484 frlxlfx.exe 3056 hnnhtb.exe 3568 thnbtn.exe 772 5pjdj.exe 60 lffrrll.exe 5080 lxlfxxr.exe 3452 9hhbnn.exe 5056 btbntt.exe 3488 jddpj.exe 1008 djjdj.exe 2632 xrlfllf.exe -
resource yara_rule behavioral2/memory/3596-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/656-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/780-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-530-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3472 wrote to memory of 3596 3472 7b792fe8c6356d0dccf496eaed4fa930_NeikiAnalytics.exe 82 PID 3472 wrote to memory of 3596 3472 7b792fe8c6356d0dccf496eaed4fa930_NeikiAnalytics.exe 82 PID 3472 wrote to memory of 3596 3472 7b792fe8c6356d0dccf496eaed4fa930_NeikiAnalytics.exe 82 PID 3596 wrote to memory of 2724 3596 xxlfllx.exe 83 PID 3596 wrote to memory of 2724 3596 xxlfllx.exe 83 PID 3596 wrote to memory of 2724 3596 xxlfllx.exe 83 PID 2724 wrote to memory of 748 2724 fxfrrxl.exe 84 PID 2724 wrote to memory of 748 2724 fxfrrxl.exe 84 PID 2724 wrote to memory of 748 2724 fxfrrxl.exe 84 PID 748 wrote to memory of 656 748 fxrlxrf.exe 85 PID 748 wrote to memory of 656 748 fxrlxrf.exe 85 PID 748 wrote to memory of 656 748 fxrlxrf.exe 85 PID 656 wrote to memory of 640 656 rrxrxrl.exe 87 PID 656 wrote to memory of 640 656 rrxrxrl.exe 87 PID 656 wrote to memory of 640 656 rrxrxrl.exe 87 PID 640 wrote to memory of 3484 640 tbbthh.exe 88 PID 640 wrote to memory of 3484 640 tbbthh.exe 88 PID 640 wrote to memory of 3484 640 tbbthh.exe 88 PID 3484 wrote to memory of 4520 3484 jjvvj.exe 90 PID 3484 wrote to memory of 4520 3484 jjvvj.exe 90 PID 3484 wrote to memory of 4520 3484 jjvvj.exe 90 PID 4520 wrote to memory of 3188 4520 bhhtnh.exe 91 PID 4520 wrote to memory of 3188 4520 bhhtnh.exe 91 PID 4520 wrote to memory of 3188 4520 bhhtnh.exe 91 PID 3188 wrote to memory of 1064 3188 nbbbht.exe 92 PID 3188 wrote to memory of 1064 3188 nbbbht.exe 92 PID 3188 wrote to memory of 1064 3188 nbbbht.exe 92 PID 1064 wrote to memory of 3292 1064 flrxrfr.exe 93 PID 1064 wrote to memory of 3292 1064 flrxrfr.exe 93 PID 1064 wrote to memory of 3292 1064 flrxrfr.exe 93 PID 3292 wrote to memory of 3096 3292 jvdvd.exe 94 PID 3292 wrote to memory of 3096 3292 jvdvd.exe 94 PID 3292 wrote to memory of 3096 3292 jvdvd.exe 94 PID 3096 wrote to memory of 2076 3096 pdjvp.exe 96 PID 3096 wrote to memory of 2076 3096 pdjvp.exe 96 PID 3096 wrote to memory of 2076 3096 pdjvp.exe 96 PID 2076 wrote to memory of 4044 2076 lxfxrrl.exe 97 PID 2076 wrote to memory of 4044 2076 lxfxrrl.exe 97 PID 2076 wrote to memory of 4044 2076 lxfxrrl.exe 97 PID 4044 wrote to memory of 4372 4044 hbbtnh.exe 98 PID 4044 wrote to memory of 4372 4044 hbbtnh.exe 98 PID 4044 wrote to memory of 4372 4044 hbbtnh.exe 98 PID 4372 wrote to memory of 1560 4372 jjdpj.exe 99 PID 4372 wrote to memory of 1560 4372 jjdpj.exe 99 PID 4372 wrote to memory of 1560 4372 jjdpj.exe 99 PID 1560 wrote to memory of 1476 1560 fflxxrf.exe 100 PID 1560 wrote to memory of 1476 1560 fflxxrf.exe 100 PID 1560 wrote to memory of 1476 1560 fflxxrf.exe 100 PID 1476 wrote to memory of 4460 1476 hbbtnn.exe 101 PID 1476 wrote to memory of 4460 1476 hbbtnn.exe 101 PID 1476 wrote to memory of 4460 1476 hbbtnn.exe 101 PID 4460 wrote to memory of 4340 4460 jjvpd.exe 102 PID 4460 wrote to memory of 4340 4460 jjvpd.exe 102 PID 4460 wrote to memory of 4340 4460 jjvpd.exe 102 PID 4340 wrote to memory of 3912 4340 3ffxllx.exe 103 PID 4340 wrote to memory of 3912 4340 3ffxllx.exe 103 PID 4340 wrote to memory of 3912 4340 3ffxllx.exe 103 PID 3912 wrote to memory of 3088 3912 5bbttn.exe 104 PID 3912 wrote to memory of 3088 3912 5bbttn.exe 104 PID 3912 wrote to memory of 3088 3912 5bbttn.exe 104 PID 3088 wrote to memory of 1076 3088 thbnbt.exe 105 PID 3088 wrote to memory of 1076 3088 thbnbt.exe 105 PID 3088 wrote to memory of 1076 3088 thbnbt.exe 105 PID 1076 wrote to memory of 5068 1076 7ddpv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b792fe8c6356d0dccf496eaed4fa930_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7b792fe8c6356d0dccf496eaed4fa930_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\xxlfllx.exec:\xxlfllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\fxfrrxl.exec:\fxfrrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\fxrlxrf.exec:\fxrlxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\rrxrxrl.exec:\rrxrxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\tbbthh.exec:\tbbthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\jjvvj.exec:\jjvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\bhhtnh.exec:\bhhtnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\nbbbht.exec:\nbbbht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\flrxrfr.exec:\flrxrfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\jvdvd.exec:\jvdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\pdjvp.exec:\pdjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\hbbtnh.exec:\hbbtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\jjdpj.exec:\jjdpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\fflxxrf.exec:\fflxxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\hbbtnn.exec:\hbbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\jjvpd.exec:\jjvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\3ffxllx.exec:\3ffxllx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\5bbttn.exec:\5bbttn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\thbnbt.exec:\thbnbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\7ddpv.exec:\7ddpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\xxxrfxr.exec:\xxxrfxr.exe23⤵
- Executes dropped EXE
PID:5068 -
\??\c:\tbhbbn.exec:\tbhbbn.exe24⤵
- Executes dropped EXE
PID:4644 -
\??\c:\vjpjd.exec:\vjpjd.exe25⤵
- Executes dropped EXE
PID:780 -
\??\c:\pvjdp.exec:\pvjdp.exe26⤵
- Executes dropped EXE
PID:388 -
\??\c:\3flxfff.exec:\3flxfff.exe27⤵
- Executes dropped EXE
PID:4548 -
\??\c:\5bhtnb.exec:\5bhtnb.exe28⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vvjdv.exec:\vvjdv.exe29⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jdpdj.exec:\jdpdj.exe30⤵
- Executes dropped EXE
PID:3548 -
\??\c:\7hbthh.exec:\7hbthh.exe31⤵
- Executes dropped EXE
PID:4236 -
\??\c:\hhhbnh.exec:\hhhbnh.exe32⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9vdpd.exec:\9vdpd.exe33⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rllffrf.exec:\rllffrf.exe34⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe35⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7hhthb.exec:\7hhthb.exe36⤵
- Executes dropped EXE
PID:4312 -
\??\c:\3ddpd.exec:\3ddpd.exe37⤵
- Executes dropped EXE
PID:4432 -
\??\c:\3pvjj.exec:\3pvjj.exe38⤵
- Executes dropped EXE
PID:4160 -
\??\c:\7xrlxxr.exec:\7xrlxxr.exe39⤵
- Executes dropped EXE
PID:4492 -
\??\c:\lrfxlfx.exec:\lrfxlfx.exe40⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hnhnnb.exec:\hnhnnb.exe41⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jvvpj.exec:\jvvpj.exe42⤵
- Executes dropped EXE
PID:4356 -
\??\c:\jjjdp.exec:\jjjdp.exe43⤵
- Executes dropped EXE
PID:4104 -
\??\c:\xxxlxlf.exec:\xxxlxlf.exe44⤵
- Executes dropped EXE
PID:3380 -
\??\c:\3nntnh.exec:\3nntnh.exe45⤵
- Executes dropped EXE
PID:3304 -
\??\c:\hbhhbb.exec:\hbhhbb.exe46⤵
- Executes dropped EXE
PID:3128 -
\??\c:\ddjdp.exec:\ddjdp.exe47⤵
- Executes dropped EXE
PID:3932 -
\??\c:\jvvpd.exec:\jvvpd.exe48⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fllxlfx.exec:\fllxlfx.exe49⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rlffrlf.exec:\rlffrlf.exe50⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bbthnb.exec:\bbthnb.exe51⤵
- Executes dropped EXE
PID:4148 -
\??\c:\djpdp.exec:\djpdp.exe52⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pppdp.exec:\pppdp.exe53⤵
- Executes dropped EXE
PID:400 -
\??\c:\1xrfrlx.exec:\1xrfrlx.exe54⤵
- Executes dropped EXE
PID:4620 -
\??\c:\frlxlfx.exec:\frlxlfx.exe55⤵
- Executes dropped EXE
PID:3484 -
\??\c:\hnnhtb.exec:\hnnhtb.exe56⤵
- Executes dropped EXE
PID:3056 -
\??\c:\thnbtn.exec:\thnbtn.exe57⤵
- Executes dropped EXE
PID:3568 -
\??\c:\5pjdj.exec:\5pjdj.exe58⤵
- Executes dropped EXE
PID:772 -
\??\c:\lffrrll.exec:\lffrrll.exe59⤵
- Executes dropped EXE
PID:60 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe60⤵
- Executes dropped EXE
PID:5080 -
\??\c:\9hhbnn.exec:\9hhbnn.exe61⤵
- Executes dropped EXE
PID:3452 -
\??\c:\btbntt.exec:\btbntt.exe62⤵
- Executes dropped EXE
PID:5056 -
\??\c:\jddpj.exec:\jddpj.exe63⤵
- Executes dropped EXE
PID:3488 -
\??\c:\djjdj.exec:\djjdj.exe64⤵
- Executes dropped EXE
PID:1008 -
\??\c:\xrlfllf.exec:\xrlfllf.exe65⤵
- Executes dropped EXE
PID:2632 -
\??\c:\lflflfl.exec:\lflflfl.exe66⤵PID:392
-
\??\c:\btbtnn.exec:\btbtnn.exe67⤵PID:380
-
\??\c:\3hntbt.exec:\3hntbt.exe68⤵PID:816
-
\??\c:\1jvjj.exec:\1jvjj.exe69⤵PID:1108
-
\??\c:\llfxrlf.exec:\llfxrlf.exe70⤵PID:2572
-
\??\c:\rflffxl.exec:\rflffxl.exe71⤵PID:2740
-
\??\c:\tnhhbb.exec:\tnhhbb.exe72⤵PID:4496
-
\??\c:\ppvpd.exec:\ppvpd.exe73⤵PID:8
-
\??\c:\fffxffx.exec:\fffxffx.exe74⤵PID:4036
-
\??\c:\ffxrfxr.exec:\ffxrfxr.exe75⤵PID:2844
-
\??\c:\tbbthb.exec:\tbbthb.exe76⤵PID:2796
-
\??\c:\pjdvd.exec:\pjdvd.exe77⤵PID:1396
-
\??\c:\dvpdp.exec:\dvpdp.exe78⤵PID:1300
-
\??\c:\3fxlxrf.exec:\3fxlxrf.exe79⤵PID:5068
-
\??\c:\lfrfrxr.exec:\lfrfrxr.exe80⤵PID:1856
-
\??\c:\bnnbtn.exec:\bnnbtn.exe81⤵PID:1576
-
\??\c:\dvpdp.exec:\dvpdp.exe82⤵PID:3016
-
\??\c:\pjdvp.exec:\pjdvp.exe83⤵PID:4904
-
\??\c:\xrrfxrf.exec:\xrrfxrf.exe84⤵PID:3220
-
\??\c:\llxrrlf.exec:\llxrrlf.exe85⤵PID:5064
-
\??\c:\tnhbbb.exec:\tnhbbb.exe86⤵PID:528
-
\??\c:\tnhbnn.exec:\tnhbnn.exe87⤵PID:4888
-
\??\c:\ppddp.exec:\ppddp.exe88⤵PID:1016
-
\??\c:\jvvdp.exec:\jvvdp.exe89⤵PID:1520
-
\??\c:\5rffrll.exec:\5rffrll.exe90⤵PID:3564
-
\??\c:\hhnbhb.exec:\hhnbhb.exe91⤵PID:4844
-
\??\c:\bttntn.exec:\bttntn.exe92⤵PID:2748
-
\??\c:\ddpjp.exec:\ddpjp.exe93⤵PID:1968
-
\??\c:\ddjdp.exec:\ddjdp.exe94⤵PID:2204
-
\??\c:\rffxffr.exec:\rffxffr.exe95⤵PID:1020
-
\??\c:\bhhhbt.exec:\bhhhbt.exe96⤵PID:3444
-
\??\c:\bbnhtn.exec:\bbnhtn.exe97⤵PID:1052
-
\??\c:\dppdp.exec:\dppdp.exe98⤵PID:2444
-
\??\c:\9rlxfxr.exec:\9rlxfxr.exe99⤵PID:1248
-
\??\c:\5hbtnh.exec:\5hbtnh.exe100⤵PID:1572
-
\??\c:\btnhtn.exec:\btnhtn.exe101⤵PID:3900
-
\??\c:\7pdpv.exec:\7pdpv.exe102⤵PID:3684
-
\??\c:\fxrxfrx.exec:\fxrxfrx.exe103⤵PID:2936
-
\??\c:\nnnbth.exec:\nnnbth.exe104⤵PID:3496
-
\??\c:\ttnhtt.exec:\ttnhtt.exe105⤵PID:3304
-
\??\c:\5pdjd.exec:\5pdjd.exe106⤵PID:348
-
\??\c:\xffxrll.exec:\xffxrll.exe107⤵PID:4004
-
\??\c:\rxxrffx.exec:\rxxrffx.exe108⤵PID:1500
-
\??\c:\tttnhb.exec:\tttnhb.exe109⤵PID:4852
-
\??\c:\ddpvj.exec:\ddpvj.exe110⤵PID:2416
-
\??\c:\1vjvd.exec:\1vjvd.exe111⤵PID:4148
-
\??\c:\rrllxxr.exec:\rrllxxr.exe112⤵PID:1724
-
\??\c:\1hbtnh.exec:\1hbtnh.exe113⤵PID:400
-
\??\c:\9hhbhb.exec:\9hhbhb.exe114⤵PID:2460
-
\??\c:\dvpdp.exec:\dvpdp.exe115⤵PID:4648
-
\??\c:\5xlfxrl.exec:\5xlfxrl.exe116⤵PID:848
-
\??\c:\rllfrlf.exec:\rllfrlf.exe117⤵PID:4928
-
\??\c:\nbtnbt.exec:\nbtnbt.exe118⤵PID:3052
-
\??\c:\vpjvj.exec:\vpjvj.exe119⤵PID:2100
-
\??\c:\rlfxfxf.exec:\rlfxfxf.exe120⤵PID:2776
-
\??\c:\xlrllll.exec:\xlrllll.exe121⤵PID:4752
-
\??\c:\httnnn.exec:\httnnn.exe122⤵PID:3288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-