Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 22:15
Behavioral task
behavioral1
Sample
44153139a223464d69a2f4a23f536b50_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
44153139a223464d69a2f4a23f536b50_NeikiAnalytics.exe
-
Size
75KB
-
MD5
44153139a223464d69a2f4a23f536b50
-
SHA1
f146b433e637acfc7f42979d6f049f977e3ed3d4
-
SHA256
3ee522c1ede0c41360b74f9a33e9dd829b501ab7110facdeca505d5042da787e
-
SHA512
15c603b10d1bc9f3a442d91dfaccb2208186a4726959e775ebcaee6c444b5c4df0d6857816fdeede3e083845f3a3330a9fd02fd0a1eb88ce58a4b9883ca5cab5
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE8a:9hOmTsF93UYfwC6GIoutz5yLpOSD0
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4472-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/724-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/960-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2336-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-601-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-634-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/732-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-714-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-801-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-874-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-897-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-984-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-1000-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjppv.exexlrllff.exe9hnhbb.exenbbtnh.exevpdvv.exerlrfflf.exellrrlll.exe9htnnn.exedvdvd.exexrrlfff.exe3nhhbn.exehhhbnh.exe1vdvp.exeffllrrx.exe9nnnhh.exepvpjv.exevdddd.exe3xxrllr.exenbtthn.exenhnbtb.exejvdvj.exefxxrfxx.exefxxxrxr.exe5nnthh.exevpjjv.exe9pvdv.exerllfrrl.exelflfffx.exetnbbtt.exebthtnb.exevpjpj.exexfxxxxl.exefrffffx.exe9nbbtt.exettbbnn.exevdddv.exevpppd.exellxrlll.exerlfrxlx.exebttnnb.exehnhhbb.exevjjdv.exerllfxrl.exefxrlllf.exebbbttn.exetttttt.exe9tbhhb.exe7vdvd.exe5xxxrrr.exexflrlff.exehbbhhb.exebbbbtt.exejvjpj.exevjjdv.exerrfxllf.exe5hhhbb.exevjdvd.exerrrlfff.exehbtbtt.exebhhhtt.exevjjjv.exevddjj.exellxrllf.exenhhbbb.exepid process 2084 jjppv.exe 4788 xlrllff.exe 3912 9hnhbb.exe 920 nbbtnh.exe 4204 vpdvv.exe 3948 rlrfflf.exe 1404 llrrlll.exe 4916 9htnnn.exe 4864 dvdvd.exe 2216 xrrlfff.exe 5080 3nhhbn.exe 3588 hhhbnh.exe 2608 1vdvp.exe 5084 ffllrrx.exe 4672 9nnnhh.exe 8 pvpjv.exe 3224 vdddd.exe 3632 3xxrllr.exe 4352 nbtthn.exe 2292 nhnbtb.exe 2788 jvdvj.exe 2484 fxxrfxx.exe 5116 fxxxrxr.exe 4844 5nnthh.exe 4616 vpjjv.exe 724 9pvdv.exe 1536 rllfrrl.exe 2456 lflfffx.exe 4936 tnbbtt.exe 4264 bthtnb.exe 3716 vpjpj.exe 3940 xfxxxxl.exe 2388 frffffx.exe 3496 9nbbtt.exe 2392 ttbbnn.exe 752 vdddv.exe 3512 vpppd.exe 3852 llxrlll.exe 468 rlfrxlx.exe 2172 bttnnb.exe 2452 hnhhbb.exe 1516 vjjdv.exe 2904 rllfxrl.exe 4344 fxrlllf.exe 1436 bbbttn.exe 2860 tttttt.exe 736 9tbhhb.exe 4788 7vdvd.exe 3436 5xxxrrr.exe 2664 xflrlff.exe 2800 hbbhhb.exe 4780 bbbbtt.exe 1556 jvjpj.exe 4312 vjjdv.exe 4448 rrfxllf.exe 532 5hhhbb.exe 4668 vjdvd.exe 2160 rrrlfff.exe 1608 hbtbtt.exe 4928 bhhhtt.exe 3220 vjjjv.exe 4612 vddjj.exe 4296 llxrllf.exe 1656 nhhbbb.exe -
Processes:
resource yara_rule behavioral2/memory/4472-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjppv.exe upx behavioral2/memory/2084-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrllff.exe upx C:\9hnhbb.exe upx behavioral2/memory/3912-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4788-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2084-13-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbbtnh.exe upx \??\c:\vpdvv.exe upx behavioral2/memory/4204-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/920-30-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlrfflf.exe upx behavioral2/memory/3948-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llrrlll.exe upx behavioral2/memory/3948-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1404-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9htnnn.exe upx C:\dvdvd.exe upx behavioral2/memory/4916-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4864-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrlfff.exe upx behavioral2/memory/4864-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3nhhbn.exe upx behavioral2/memory/2216-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5080-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhbnh.exe upx C:\1vdvp.exe upx behavioral2/memory/3588-77-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffllrrx.exe upx behavioral2/memory/2608-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9nnnhh.exe upx C:\pvpjv.exe upx C:\vdddd.exe upx behavioral2/memory/8-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4672-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3224-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3xxrllr.exe upx behavioral2/memory/3224-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3632-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbtthn.exe upx C:\nhnbtb.exe upx C:\jvdvj.exe upx behavioral2/memory/2292-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2788-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxxrfxx.exe upx behavioral2/memory/2484-132-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxxxrxr.exe upx C:\5nnthh.exe upx behavioral2/memory/5116-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjjv.exe upx behavioral2/memory/4616-151-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9pvdv.exe upx C:\rllfrrl.exe upx behavioral2/memory/1536-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/724-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/724-154-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lflfffx.exe upx behavioral2/memory/2456-168-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbbtt.exe upx \??\c:\bthtnb.exe upx \??\c:\vpjpj.exe upx C:\xfxxxxl.exe upx behavioral2/memory/2388-192-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
44153139a223464d69a2f4a23f536b50_NeikiAnalytics.exejjppv.exexlrllff.exe9hnhbb.exenbbtnh.exevpdvv.exerlrfflf.exellrrlll.exe9htnnn.exedvdvd.exexrrlfff.exe3nhhbn.exehhhbnh.exe1vdvp.exeffllrrx.exe9nnnhh.exepvpjv.exevdddd.exe3xxrllr.exenbtthn.exenhnbtb.exejvdvj.exedescription pid process target process PID 4472 wrote to memory of 2084 4472 44153139a223464d69a2f4a23f536b50_NeikiAnalytics.exe jjppv.exe PID 4472 wrote to memory of 2084 4472 44153139a223464d69a2f4a23f536b50_NeikiAnalytics.exe jjppv.exe PID 4472 wrote to memory of 2084 4472 44153139a223464d69a2f4a23f536b50_NeikiAnalytics.exe jjppv.exe PID 2084 wrote to memory of 4788 2084 jjppv.exe xlrllff.exe PID 2084 wrote to memory of 4788 2084 jjppv.exe xlrllff.exe PID 2084 wrote to memory of 4788 2084 jjppv.exe xlrllff.exe PID 4788 wrote to memory of 3912 4788 xlrllff.exe 9hnhbb.exe PID 4788 wrote to memory of 3912 4788 xlrllff.exe 9hnhbb.exe PID 4788 wrote to memory of 3912 4788 xlrllff.exe 9hnhbb.exe PID 3912 wrote to memory of 920 3912 9hnhbb.exe nbbtnh.exe PID 3912 wrote to memory of 920 3912 9hnhbb.exe nbbtnh.exe PID 3912 wrote to memory of 920 3912 9hnhbb.exe nbbtnh.exe PID 920 wrote to memory of 4204 920 nbbtnh.exe vpdvv.exe PID 920 wrote to memory of 4204 920 nbbtnh.exe vpdvv.exe PID 920 wrote to memory of 4204 920 nbbtnh.exe vpdvv.exe PID 4204 wrote to memory of 3948 4204 vpdvv.exe rlrfflf.exe PID 4204 wrote to memory of 3948 4204 vpdvv.exe rlrfflf.exe PID 4204 wrote to memory of 3948 4204 vpdvv.exe rlrfflf.exe PID 3948 wrote to memory of 1404 3948 rlrfflf.exe llrrlll.exe PID 3948 wrote to memory of 1404 3948 rlrfflf.exe llrrlll.exe PID 3948 wrote to memory of 1404 3948 rlrfflf.exe llrrlll.exe PID 1404 wrote to memory of 4916 1404 llrrlll.exe 9htnnn.exe PID 1404 wrote to memory of 4916 1404 llrrlll.exe 9htnnn.exe PID 1404 wrote to memory of 4916 1404 llrrlll.exe 9htnnn.exe PID 4916 wrote to memory of 4864 4916 9htnnn.exe dvdvd.exe PID 4916 wrote to memory of 4864 4916 9htnnn.exe dvdvd.exe PID 4916 wrote to memory of 4864 4916 9htnnn.exe dvdvd.exe PID 4864 wrote to memory of 2216 4864 dvdvd.exe xrrlfff.exe PID 4864 wrote to memory of 2216 4864 dvdvd.exe xrrlfff.exe PID 4864 wrote to memory of 2216 4864 dvdvd.exe xrrlfff.exe PID 2216 wrote to memory of 5080 2216 xrrlfff.exe 3nhhbn.exe PID 2216 wrote to memory of 5080 2216 xrrlfff.exe 3nhhbn.exe PID 2216 wrote to memory of 5080 2216 xrrlfff.exe 3nhhbn.exe PID 5080 wrote to memory of 3588 5080 3nhhbn.exe hhhbnh.exe PID 5080 wrote to memory of 3588 5080 3nhhbn.exe hhhbnh.exe PID 5080 wrote to memory of 3588 5080 3nhhbn.exe hhhbnh.exe PID 3588 wrote to memory of 2608 3588 hhhbnh.exe 1vdvp.exe PID 3588 wrote to memory of 2608 3588 hhhbnh.exe 1vdvp.exe PID 3588 wrote to memory of 2608 3588 hhhbnh.exe 1vdvp.exe PID 2608 wrote to memory of 5084 2608 1vdvp.exe ffllrrx.exe PID 2608 wrote to memory of 5084 2608 1vdvp.exe ffllrrx.exe PID 2608 wrote to memory of 5084 2608 1vdvp.exe ffllrrx.exe PID 5084 wrote to memory of 4672 5084 ffllrrx.exe 9nnnhh.exe PID 5084 wrote to memory of 4672 5084 ffllrrx.exe 9nnnhh.exe PID 5084 wrote to memory of 4672 5084 ffllrrx.exe 9nnnhh.exe PID 4672 wrote to memory of 8 4672 9nnnhh.exe pvpjv.exe PID 4672 wrote to memory of 8 4672 9nnnhh.exe pvpjv.exe PID 4672 wrote to memory of 8 4672 9nnnhh.exe pvpjv.exe PID 8 wrote to memory of 3224 8 pvpjv.exe vdddd.exe PID 8 wrote to memory of 3224 8 pvpjv.exe vdddd.exe PID 8 wrote to memory of 3224 8 pvpjv.exe vdddd.exe PID 3224 wrote to memory of 3632 3224 vdddd.exe 3xxrllr.exe PID 3224 wrote to memory of 3632 3224 vdddd.exe 3xxrllr.exe PID 3224 wrote to memory of 3632 3224 vdddd.exe 3xxrllr.exe PID 3632 wrote to memory of 4352 3632 3xxrllr.exe nbtthn.exe PID 3632 wrote to memory of 4352 3632 3xxrllr.exe nbtthn.exe PID 3632 wrote to memory of 4352 3632 3xxrllr.exe nbtthn.exe PID 4352 wrote to memory of 2292 4352 nbtthn.exe nhnbtb.exe PID 4352 wrote to memory of 2292 4352 nbtthn.exe nhnbtb.exe PID 4352 wrote to memory of 2292 4352 nbtthn.exe nhnbtb.exe PID 2292 wrote to memory of 2788 2292 nhnbtb.exe jvdvj.exe PID 2292 wrote to memory of 2788 2292 nhnbtb.exe jvdvj.exe PID 2292 wrote to memory of 2788 2292 nhnbtb.exe jvdvj.exe PID 2788 wrote to memory of 2484 2788 jvdvj.exe fxxrfxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44153139a223464d69a2f4a23f536b50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\44153139a223464d69a2f4a23f536b50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\jjppv.exec:\jjppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\xlrllff.exec:\xlrllff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\9hnhbb.exec:\9hnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\nbbtnh.exec:\nbbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\vpdvv.exec:\vpdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\rlrfflf.exec:\rlrfflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\llrrlll.exec:\llrrlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\9htnnn.exec:\9htnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\dvdvd.exec:\dvdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\xrrlfff.exec:\xrrlfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\3nhhbn.exec:\3nhhbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\hhhbnh.exec:\hhhbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\1vdvp.exec:\1vdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\ffllrrx.exec:\ffllrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\9nnnhh.exec:\9nnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\pvpjv.exec:\pvpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\vdddd.exec:\vdddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\3xxrllr.exec:\3xxrllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\nbtthn.exec:\nbtthn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\nhnbtb.exec:\nhnbtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\jvdvj.exec:\jvdvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\fxxrfxx.exec:\fxxrfxx.exe23⤵
- Executes dropped EXE
PID:2484 -
\??\c:\fxxxrxr.exec:\fxxxrxr.exe24⤵
- Executes dropped EXE
PID:5116 -
\??\c:\5nnthh.exec:\5nnthh.exe25⤵
- Executes dropped EXE
PID:4844 -
\??\c:\vpjjv.exec:\vpjjv.exe26⤵
- Executes dropped EXE
PID:4616 -
\??\c:\9pvdv.exec:\9pvdv.exe27⤵
- Executes dropped EXE
PID:724 -
\??\c:\rllfrrl.exec:\rllfrrl.exe28⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lflfffx.exec:\lflfffx.exe29⤵
- Executes dropped EXE
PID:2456 -
\??\c:\tnbbtt.exec:\tnbbtt.exe30⤵
- Executes dropped EXE
PID:4936 -
\??\c:\bthtnb.exec:\bthtnb.exe31⤵
- Executes dropped EXE
PID:4264 -
\??\c:\vpjpj.exec:\vpjpj.exe32⤵
- Executes dropped EXE
PID:3716 -
\??\c:\xfxxxxl.exec:\xfxxxxl.exe33⤵
- Executes dropped EXE
PID:3940 -
\??\c:\frffffx.exec:\frffffx.exe34⤵
- Executes dropped EXE
PID:2388 -
\??\c:\9nbbtt.exec:\9nbbtt.exe35⤵
- Executes dropped EXE
PID:3496 -
\??\c:\ttbbnn.exec:\ttbbnn.exe36⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vdddv.exec:\vdddv.exe37⤵
- Executes dropped EXE
PID:752 -
\??\c:\vpppd.exec:\vpppd.exe38⤵
- Executes dropped EXE
PID:3512 -
\??\c:\llxrlll.exec:\llxrlll.exe39⤵
- Executes dropped EXE
PID:3852 -
\??\c:\rlfrxlx.exec:\rlfrxlx.exe40⤵
- Executes dropped EXE
PID:468 -
\??\c:\bttnnb.exec:\bttnnb.exe41⤵
- Executes dropped EXE
PID:2172 -
\??\c:\hnhhbb.exec:\hnhhbb.exe42⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vjjdv.exec:\vjjdv.exe43⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rllfxrl.exec:\rllfxrl.exe44⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fxrlllf.exec:\fxrlllf.exe45⤵
- Executes dropped EXE
PID:4344 -
\??\c:\bbbttn.exec:\bbbttn.exe46⤵
- Executes dropped EXE
PID:1436 -
\??\c:\tttttt.exec:\tttttt.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\9tbhhb.exec:\9tbhhb.exe48⤵
- Executes dropped EXE
PID:736 -
\??\c:\7vdvd.exec:\7vdvd.exe49⤵
- Executes dropped EXE
PID:4788 -
\??\c:\5xxxrrr.exec:\5xxxrrr.exe50⤵
- Executes dropped EXE
PID:3436 -
\??\c:\xflrlff.exec:\xflrlff.exe51⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hbbhhb.exec:\hbbhhb.exe52⤵
- Executes dropped EXE
PID:2800 -
\??\c:\bbbbtt.exec:\bbbbtt.exe53⤵
- Executes dropped EXE
PID:4780 -
\??\c:\jvjpj.exec:\jvjpj.exe54⤵
- Executes dropped EXE
PID:1556 -
\??\c:\vjjdv.exec:\vjjdv.exe55⤵
- Executes dropped EXE
PID:4312 -
\??\c:\rrfxllf.exec:\rrfxllf.exe56⤵
- Executes dropped EXE
PID:4448 -
\??\c:\5hhhbb.exec:\5hhhbb.exe57⤵
- Executes dropped EXE
PID:532 -
\??\c:\vjdvd.exec:\vjdvd.exe58⤵
- Executes dropped EXE
PID:4668 -
\??\c:\rrrlfff.exec:\rrrlfff.exe59⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hbtbtt.exec:\hbtbtt.exe60⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bhhhtt.exec:\bhhhtt.exe61⤵
- Executes dropped EXE
PID:4928 -
\??\c:\vjjjv.exec:\vjjjv.exe62⤵
- Executes dropped EXE
PID:3220 -
\??\c:\vddjj.exec:\vddjj.exe63⤵
- Executes dropped EXE
PID:4612 -
\??\c:\llxrllf.exec:\llxrllf.exe64⤵
- Executes dropped EXE
PID:4296 -
\??\c:\nhhbbb.exec:\nhhbbb.exe65⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tbhnbh.exec:\tbhnbh.exe66⤵PID:4552
-
\??\c:\vjjdv.exec:\vjjdv.exe67⤵PID:960
-
\??\c:\7vjvv.exec:\7vjvv.exe68⤵PID:4932
-
\??\c:\xxllllr.exec:\xxllllr.exe69⤵PID:3412
-
\??\c:\lxxrrlf.exec:\lxxrrlf.exe70⤵PID:2820
-
\??\c:\1nbbbh.exec:\1nbbbh.exe71⤵PID:2976
-
\??\c:\vvvvp.exec:\vvvvp.exe72⤵PID:4024
-
\??\c:\pppdv.exec:\pppdv.exe73⤵PID:5060
-
\??\c:\9lxrrxx.exec:\9lxrrxx.exe74⤵PID:4568
-
\??\c:\frxxrrl.exec:\frxxrrl.exe75⤵PID:2072
-
\??\c:\bhnttn.exec:\bhnttn.exe76⤵PID:4732
-
\??\c:\thbbbb.exec:\thbbbb.exe77⤵PID:724
-
\??\c:\3bhbbb.exec:\3bhbbb.exe78⤵PID:3020
-
\??\c:\9jppj.exec:\9jppj.exe79⤵PID:2508
-
\??\c:\5jpdd.exec:\5jpdd.exe80⤵PID:872
-
\??\c:\frxflfr.exec:\frxflfr.exe81⤵PID:4736
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe82⤵PID:4264
-
\??\c:\nthhhh.exec:\nthhhh.exe83⤵PID:3716
-
\??\c:\bbbhhh.exec:\bbbhhh.exe84⤵PID:3616
-
\??\c:\tnnnht.exec:\tnnnht.exe85⤵PID:4560
-
\??\c:\5jpjv.exec:\5jpjv.exe86⤵PID:2996
-
\??\c:\vppjp.exec:\vppjp.exe87⤵PID:2400
-
\??\c:\rxxrfff.exec:\rxxrfff.exe88⤵PID:2028
-
\??\c:\btbnnh.exec:\btbnnh.exe89⤵PID:3764
-
\??\c:\thtnhh.exec:\thtnhh.exe90⤵PID:3852
-
\??\c:\pddjj.exec:\pddjj.exe91⤵PID:468
-
\??\c:\1vdpv.exec:\1vdpv.exe92⤵PID:1424
-
\??\c:\xfxxffr.exec:\xfxxffr.exe93⤵PID:2452
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe94⤵PID:2920
-
\??\c:\9bhbht.exec:\9bhbht.exe95⤵PID:2460
-
\??\c:\hbbtnn.exec:\hbbtnn.exe96⤵PID:4508
-
\??\c:\thbhth.exec:\thbhth.exe97⤵PID:3700
-
\??\c:\7pvpp.exec:\7pvpp.exe98⤵PID:1972
-
\??\c:\vjvpp.exec:\vjvpp.exe99⤵PID:2600
-
\??\c:\3lxrllf.exec:\3lxrllf.exe100⤵PID:456
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe101⤵PID:2784
-
\??\c:\3btnhh.exec:\3btnhh.exe102⤵PID:4924
-
\??\c:\tnhhbb.exec:\tnhhbb.exe103⤵PID:3820
-
\??\c:\vjvdv.exec:\vjvdv.exe104⤵PID:4400
-
\??\c:\jddvp.exec:\jddvp.exe105⤵PID:4584
-
\??\c:\llfxrrr.exec:\llfxrrr.exe106⤵PID:2144
-
\??\c:\rrllrrx.exec:\rrllrrx.exe107⤵PID:1204
-
\??\c:\nnnnnb.exec:\nnnnnb.exe108⤵PID:532
-
\??\c:\7ttnnn.exec:\7ttnnn.exe109⤵PID:4668
-
\??\c:\hbhhbh.exec:\hbhhbh.exe110⤵PID:2160
-
\??\c:\7vppd.exec:\7vppd.exe111⤵PID:5000
-
\??\c:\jdjdv.exec:\jdjdv.exe112⤵PID:1584
-
\??\c:\5xffffl.exec:\5xffffl.exe113⤵PID:5012
-
\??\c:\lflfffx.exec:\lflfffx.exe114⤵PID:4672
-
\??\c:\hhbhnt.exec:\hhbhnt.exe115⤵PID:1264
-
\??\c:\htbtnh.exec:\htbtnh.exe116⤵PID:2360
-
\??\c:\dvvvj.exec:\dvvvj.exe117⤵PID:1680
-
\??\c:\3dvvp.exec:\3dvvp.exe118⤵PID:2668
-
\??\c:\rrrxxrr.exec:\rrrxxrr.exe119⤵PID:2648
-
\??\c:\frlrxfl.exec:\frlrxfl.exe120⤵PID:452
-
\??\c:\frrrllf.exec:\frrrllf.exe121⤵PID:4540
-
\??\c:\hnhbbt.exec:\hnhbbt.exe122⤵PID:2772
-
\??\c:\bntnnn.exec:\bntnnn.exe123⤵PID:2336
-
\??\c:\3dvpd.exec:\3dvpd.exe124⤵PID:4420
-
\??\c:\vjddd.exec:\vjddd.exe125⤵PID:1976
-
\??\c:\9pjdv.exec:\9pjdv.exe126⤵PID:4024
-
\??\c:\1rfxrrl.exec:\1rfxrrl.exe127⤵PID:5060
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe128⤵PID:4568
-
\??\c:\bntnnn.exec:\bntnnn.exe129⤵PID:1216
-
\??\c:\dvddd.exec:\dvddd.exe130⤵PID:5008
-
\??\c:\djdpp.exec:\djdpp.exe131⤵PID:4920
-
\??\c:\3xlfxxr.exec:\3xlfxxr.exe132⤵PID:2456
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe133⤵PID:1948
-
\??\c:\thnnhh.exec:\thnnhh.exe134⤵PID:2124
-
\??\c:\5nttnh.exec:\5nttnh.exe135⤵PID:4736
-
\??\c:\pddvp.exec:\pddvp.exe136⤵PID:4264
-
\??\c:\lxxrffx.exec:\lxxrffx.exe137⤵PID:3204
-
\??\c:\rrxrlll.exec:\rrxrlll.exe138⤵PID:1920
-
\??\c:\nnnbbn.exec:\nnnbbn.exe139⤵PID:4812
-
\??\c:\vdvvd.exec:\vdvvd.exe140⤵PID:752
-
\??\c:\vdjjp.exec:\vdjjp.exe141⤵PID:2028
-
\??\c:\lllfllr.exec:\lllfllr.exe142⤵PID:4892
-
\??\c:\3rrlffx.exec:\3rrlffx.exe143⤵PID:3112
-
\??\c:\9tttnn.exec:\9tttnn.exe144⤵PID:3520
-
\??\c:\hhbtnt.exec:\hhbtnt.exe145⤵PID:3908
-
\??\c:\jvdvd.exec:\jvdvd.exe146⤵PID:3944
-
\??\c:\ppjjj.exec:\ppjjj.exe147⤵PID:4416
-
\??\c:\rrfxxxl.exec:\rrfxxxl.exe148⤵PID:4340
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe149⤵PID:4764
-
\??\c:\vjjdp.exec:\vjjdp.exe150⤵PID:1016
-
\??\c:\5rlfxrl.exec:\5rlfxrl.exe151⤵PID:736
-
\??\c:\rflrxrl.exec:\rflrxrl.exe152⤵PID:1448
-
\??\c:\nttnhh.exec:\nttnhh.exe153⤵PID:3912
-
\??\c:\hnbhbb.exec:\hnbhbb.exe154⤵PID:4484
-
\??\c:\5pvpj.exec:\5pvpj.exe155⤵PID:3756
-
\??\c:\rxxlffx.exec:\rxxlffx.exe156⤵PID:4216
-
\??\c:\5fxrllf.exec:\5fxrllf.exe157⤵PID:3180
-
\??\c:\hbbbth.exec:\hbbbth.exe158⤵PID:4400
-
\??\c:\nthtnn.exec:\nthtnn.exe159⤵PID:808
-
\??\c:\3vddv.exec:\3vddv.exe160⤵PID:760
-
\??\c:\dpdvp.exec:\dpdvp.exe161⤵PID:2216
-
\??\c:\xfrxllr.exec:\xfrxllr.exe162⤵PID:1700
-
\??\c:\xrffxll.exec:\xrffxll.exe163⤵PID:912
-
\??\c:\tnttbb.exec:\tnttbb.exe164⤵PID:1608
-
\??\c:\htntht.exec:\htntht.exe165⤵PID:4928
-
\??\c:\ddpvv.exec:\ddpvv.exe166⤵PID:3220
-
\??\c:\jjpjj.exec:\jjpjj.exe167⤵PID:4612
-
\??\c:\lffxrrx.exec:\lffxrrx.exe168⤵PID:3796
-
\??\c:\lxrrrll.exec:\lxrrrll.exe169⤵PID:1528
-
\??\c:\tbtnnh.exec:\tbtnnh.exe170⤵PID:3816
-
\??\c:\9hhbbb.exec:\9hhbbb.exe171⤵PID:3860
-
\??\c:\bbbtbb.exec:\bbbtbb.exe172⤵PID:3636
-
\??\c:\ppjdv.exec:\ppjdv.exe173⤵PID:3632
-
\??\c:\1pjjj.exec:\1pjjj.exe174⤵PID:3848
-
\??\c:\1rxxffr.exec:\1rxxffr.exe175⤵PID:4992
-
\??\c:\9rrxfrr.exec:\9rrxfrr.exe176⤵PID:3416
-
\??\c:\bnttnt.exec:\bnttnt.exe177⤵PID:2484
-
\??\c:\hnbhhn.exec:\hnbhhn.exe178⤵PID:2428
-
\??\c:\vvpvp.exec:\vvpvp.exe179⤵PID:732
-
\??\c:\dvppj.exec:\dvppj.exe180⤵PID:1636
-
\??\c:\rflrflx.exec:\rflrflx.exe181⤵PID:4844
-
\??\c:\xrlrlxr.exec:\xrlrlxr.exe182⤵PID:1452
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe183⤵PID:212
-
\??\c:\thnbtn.exec:\thnbtn.exe184⤵PID:1128
-
\??\c:\ttbhth.exec:\ttbhth.exe185⤵PID:4848
-
\??\c:\vpjjv.exec:\vpjjv.exe186⤵PID:2848
-
\??\c:\jdjdj.exec:\jdjdj.exe187⤵PID:3596
-
\??\c:\ffffxxr.exec:\ffffxxr.exe188⤵PID:3396
-
\??\c:\tnhtnt.exec:\tnhtnt.exe189⤵PID:2996
-
\??\c:\bbbbtn.exec:\bbbbtn.exe190⤵PID:752
-
\??\c:\dddvd.exec:\dddvd.exe191⤵PID:848
-
\??\c:\9vdpv.exec:\9vdpv.exe192⤵PID:1756
-
\??\c:\1vppj.exec:\1vppj.exe193⤵PID:4336
-
\??\c:\xrllfxr.exec:\xrllfxr.exe194⤵PID:2904
-
\??\c:\rlllfxx.exec:\rlllfxx.exe195⤵PID:2948
-
\??\c:\lfllflf.exec:\lfllflf.exe196⤵PID:4472
-
\??\c:\nbtbhn.exec:\nbtbhn.exe197⤵PID:2860
-
\??\c:\hhbthh.exec:\hhbthh.exe198⤵PID:3552
-
\??\c:\pjvvv.exec:\pjvvv.exe199⤵PID:412
-
\??\c:\vdjdp.exec:\vdjdp.exe200⤵PID:2600
-
\??\c:\1fxrrrr.exec:\1fxrrrr.exe201⤵PID:4640
-
\??\c:\tbbbtb.exec:\tbbbtb.exe202⤵PID:3756
-
\??\c:\jvjpp.exec:\jvjpp.exe203⤵PID:3660
-
\??\c:\3fxrffx.exec:\3fxrffx.exe204⤵PID:4880
-
\??\c:\bntttt.exec:\bntttt.exe205⤵PID:4864
-
\??\c:\tnttnn.exec:\tnttnn.exe206⤵PID:4448
-
\??\c:\vpjdv.exec:\vpjdv.exe207⤵PID:1204
-
\??\c:\jdvpd.exec:\jdvpd.exe208⤵PID:3600
-
\??\c:\xflfxxr.exec:\xflfxxr.exe209⤵PID:1780
-
\??\c:\bbbhht.exec:\bbbhht.exe210⤵PID:4432
-
\??\c:\1ttnbb.exec:\1ttnbb.exe211⤵PID:4948
-
\??\c:\7ddvp.exec:\7ddvp.exe212⤵PID:4140
-
\??\c:\vdvjd.exec:\vdvjd.exe213⤵PID:5012
-
\??\c:\5rlfffx.exec:\5rlfffx.exe214⤵PID:1916
-
\??\c:\hhnbht.exec:\hhnbht.exe215⤵PID:4412
-
\??\c:\3dpjj.exec:\3dpjj.exe216⤵PID:4244
-
\??\c:\dvvpv.exec:\dvvpv.exe217⤵PID:1240
-
\??\c:\fxfxllr.exec:\fxfxllr.exe218⤵PID:1712
-
\??\c:\5lllrrr.exec:\5lllrrr.exe219⤵PID:3976
-
\??\c:\1bbbtt.exec:\1bbbtt.exe220⤵PID:4932
-
\??\c:\ppvpp.exec:\ppvpp.exe221⤵PID:2288
-
\??\c:\pjjdv.exec:\pjjdv.exe222⤵PID:2572
-
\??\c:\rlflfxf.exec:\rlflfxf.exe223⤵PID:2788
-
\??\c:\xlrrlfx.exec:\xlrrlfx.exe224⤵PID:1044
-
\??\c:\nbthth.exec:\nbthth.exe225⤵PID:772
-
\??\c:\bbhbbn.exec:\bbhbbn.exe226⤵PID:640
-
\??\c:\jjdvv.exec:\jjdvv.exe227⤵PID:1732
-
\??\c:\lxxxlll.exec:\lxxxlll.exe228⤵PID:3628
-
\??\c:\1rrllff.exec:\1rrllff.exe229⤵PID:1536
-
\??\c:\btbhbt.exec:\btbhbt.exe230⤵PID:2476
-
\??\c:\nbtbtt.exec:\nbtbtt.exe231⤵PID:1388
-
\??\c:\vjvdj.exec:\vjvdj.exe232⤵PID:2956
-
\??\c:\lxfflrf.exec:\lxfflrf.exe233⤵PID:4736
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe234⤵PID:2380
-
\??\c:\5rrlxrr.exec:\5rrlxrr.exe235⤵PID:4328
-
\??\c:\bnnnbt.exec:\bnnnbt.exe236⤵PID:2400
-
\??\c:\ntnnth.exec:\ntnnth.exe237⤵PID:1856
-
\??\c:\djvvv.exec:\djvvv.exe238⤵PID:2880
-
\??\c:\dppjv.exec:\dppjv.exe239⤵PID:2028
-
\??\c:\frfxrrl.exec:\frfxrrl.exe240⤵PID:1392
-
\??\c:\ffxxrrf.exec:\ffxxrrf.exe241⤵PID:2016
-
\??\c:\tthhnn.exec:\tthhnn.exe242⤵PID:2988