Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:40
Behavioral task
behavioral1
Sample
08b97e41bf9d446f27b6534ec6b1cc70_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
08b97e41bf9d446f27b6534ec6b1cc70_NeikiAnalytics.exe
-
Size
103KB
-
MD5
08b97e41bf9d446f27b6534ec6b1cc70
-
SHA1
f074c42045241ef1c6af19f878fab0ba789424a6
-
SHA256
34ee5d3712831c6cb410521735b3b3754a84a0085b2b4486f9e808e3c14ff708
-
SHA512
cdc0b7231a02b2ad6e7ec7bedd6b6b2175139219a5c463a13d0d4248508c65fecfe6fbe7a22739a9c6b2ee9eaaf81467ba3f32e4e6c066ae7f63ce5cfb12d451
-
SSDEEP
3072:vhOmTsF93UYfwC6GIoutC5Y5mqZRdu5XYejxx2:vcm4FmowdHoSC5Y55RdudYZ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3652-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/824-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2812-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4768-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/424-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3408-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-558-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-576-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-632-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-661-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-664-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dpvjp.exexrlfrrl.exethhhbh.exe5ppdv.exe3rxrlxr.exenhbhth.exepjpvj.exerxlrrxx.exejvvpp.exejjpjd.exetbbtbt.exedddvd.exelxxrllx.exettnnnn.exejdpjp.exenntnnh.exepjvdv.exexllfrrr.exennthtn.exejvvpj.exelllfxxr.exehnbtnh.exejdpvj.exefrrrxxf.exebhbttn.exedpvpj.exexxxxxxx.exettbbhh.exetthhtt.exepppjj.exelrrrfff.exerrflrrx.exexrrrllf.exehtbtth.exenntnbt.exepdjvd.exexxxxlrr.exelxrlllx.exetnhbnn.exennhthb.exevvjpj.exeflxrllf.exexfllxff.exe5lfxllf.exetnnbtt.exebhbnbt.exedvjjv.exe7lflfxl.exethnttt.exehbbnhb.exejdppd.exe1flfrrl.exefxrxxrf.exevppdv.exe3vdvp.exelfxfxfx.exebnbhhn.exedjdvv.exe3xfxxff.exelxxlllf.exebnnbbt.exedvppj.exejpjjj.exexlxfllx.exepid process 4724 dpvjp.exe 668 xrlfrrl.exe 972 thhhbh.exe 1172 5ppdv.exe 220 3rxrlxr.exe 3684 nhbhth.exe 824 pjpvj.exe 4604 rxlrrxx.exe 1368 jvvpp.exe 4228 jjpjd.exe 5032 tbbtbt.exe 3012 dddvd.exe 1152 lxxrllx.exe 4468 ttnnnn.exe 1680 jdpjp.exe 2928 nntnnh.exe 2220 pjvdv.exe 4028 xllfrrr.exe 2204 nnthtn.exe 3660 jvvpj.exe 1468 lllfxxr.exe 4780 hnbtnh.exe 4912 jdpvj.exe 2288 frrrxxf.exe 2872 bhbttn.exe 4092 dpvpj.exe 5028 xxxxxxx.exe 2348 ttbbhh.exe 4132 tthhtt.exe 3956 pppjj.exe 428 lrrrfff.exe 1424 rrflrrx.exe 2812 xrrrllf.exe 4768 htbtth.exe 2696 nntnbt.exe 3500 pdjvd.exe 1812 xxxxlrr.exe 4372 lxrlllx.exe 4376 tnhbnn.exe 4068 nnhthb.exe 2380 vvjpj.exe 668 flxrllf.exe 2576 xfllxff.exe 424 5lfxllf.exe 3996 tnnbtt.exe 1276 bhbnbt.exe 3184 dvjjv.exe 4064 7lflfxl.exe 444 thnttt.exe 2392 hbbnhb.exe 5048 jdppd.exe 3216 1flfrrl.exe 2120 fxrxxrf.exe 3892 vppdv.exe 4408 3vdvp.exe 4564 lfxfxfx.exe 3828 bnbhhn.exe 3908 djdvv.exe 1872 3xfxxff.exe 4464 lxxlllf.exe 5076 bnnbbt.exe 1960 dvppj.exe 3440 jpjjj.exe 4900 xlxfllx.exe -
Processes:
resource yara_rule behavioral2/memory/3652-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpvjp.exe upx behavioral2/memory/3652-5-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrlfrrl.exe upx behavioral2/memory/4724-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thhhbh.exe upx behavioral2/memory/668-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/972-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ppdv.exe upx behavioral2/memory/972-24-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3rxrlxr.exe upx C:\nhbhth.exe upx behavioral2/memory/220-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3684-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjpvj.exe upx C:\rxlrrxx.exe upx behavioral2/memory/824-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvvpp.exe upx behavioral2/memory/4604-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1368-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjpjd.exe upx behavioral2/memory/1368-59-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbbtbt.exe upx behavioral2/memory/4228-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddvd.exe upx behavioral2/memory/5032-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxxrllx.exe upx C:\ttnnnn.exe upx behavioral2/memory/4468-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdpjp.exe upx behavioral2/memory/1680-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1152-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nntnnh.exe upx C:\pjvdv.exe upx behavioral2/memory/2928-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2220-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xllfrrr.exe upx behavioral2/memory/2220-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4028-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnthtn.exe upx behavioral2/memory/2204-118-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvvpj.exe upx C:\lllfxxr.exe upx behavioral2/memory/3660-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1468-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnbtnh.exe upx behavioral2/memory/4780-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4912-138-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdpvj.exe upx behavioral2/memory/2288-145-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\frrrxxf.exe upx C:\bhbttn.exe upx behavioral2/memory/4092-157-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxxxxx.exe upx behavioral2/memory/2872-155-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dpvpj.exe upx C:\ttbbhh.exe upx C:\tthhtt.exe upx behavioral2/memory/2348-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5028-166-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pppjj.exe upx C:\lrrrfff.exe upx behavioral2/memory/428-184-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrflrrx.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
08b97e41bf9d446f27b6534ec6b1cc70_NeikiAnalytics.exedpvjp.exexrlfrrl.exethhhbh.exe5ppdv.exe3rxrlxr.exenhbhth.exepjpvj.exerxlrrxx.exejvvpp.exejjpjd.exetbbtbt.exedddvd.exelxxrllx.exettnnnn.exejdpjp.exenntnnh.exepjvdv.exexllfrrr.exennthtn.exejvvpj.exelllfxxr.exedescription pid process target process PID 3652 wrote to memory of 4724 3652 08b97e41bf9d446f27b6534ec6b1cc70_NeikiAnalytics.exe dpvjp.exe PID 3652 wrote to memory of 4724 3652 08b97e41bf9d446f27b6534ec6b1cc70_NeikiAnalytics.exe dpvjp.exe PID 3652 wrote to memory of 4724 3652 08b97e41bf9d446f27b6534ec6b1cc70_NeikiAnalytics.exe dpvjp.exe PID 4724 wrote to memory of 668 4724 dpvjp.exe xrlfrrl.exe PID 4724 wrote to memory of 668 4724 dpvjp.exe xrlfrrl.exe PID 4724 wrote to memory of 668 4724 dpvjp.exe xrlfrrl.exe PID 668 wrote to memory of 972 668 xrlfrrl.exe thhhbh.exe PID 668 wrote to memory of 972 668 xrlfrrl.exe thhhbh.exe PID 668 wrote to memory of 972 668 xrlfrrl.exe thhhbh.exe PID 972 wrote to memory of 1172 972 thhhbh.exe 5ppdv.exe PID 972 wrote to memory of 1172 972 thhhbh.exe 5ppdv.exe PID 972 wrote to memory of 1172 972 thhhbh.exe 5ppdv.exe PID 1172 wrote to memory of 220 1172 5ppdv.exe 3rxrlxr.exe PID 1172 wrote to memory of 220 1172 5ppdv.exe 3rxrlxr.exe PID 1172 wrote to memory of 220 1172 5ppdv.exe 3rxrlxr.exe PID 220 wrote to memory of 3684 220 3rxrlxr.exe nhbhth.exe PID 220 wrote to memory of 3684 220 3rxrlxr.exe nhbhth.exe PID 220 wrote to memory of 3684 220 3rxrlxr.exe nhbhth.exe PID 3684 wrote to memory of 824 3684 nhbhth.exe pjpvj.exe PID 3684 wrote to memory of 824 3684 nhbhth.exe pjpvj.exe PID 3684 wrote to memory of 824 3684 nhbhth.exe pjpvj.exe PID 824 wrote to memory of 4604 824 pjpvj.exe rxlrrxx.exe PID 824 wrote to memory of 4604 824 pjpvj.exe rxlrrxx.exe PID 824 wrote to memory of 4604 824 pjpvj.exe rxlrrxx.exe PID 4604 wrote to memory of 1368 4604 rxlrrxx.exe jvvpp.exe PID 4604 wrote to memory of 1368 4604 rxlrrxx.exe jvvpp.exe PID 4604 wrote to memory of 1368 4604 rxlrrxx.exe jvvpp.exe PID 1368 wrote to memory of 4228 1368 jvvpp.exe jjpjd.exe PID 1368 wrote to memory of 4228 1368 jvvpp.exe jjpjd.exe PID 1368 wrote to memory of 4228 1368 jvvpp.exe jjpjd.exe PID 4228 wrote to memory of 5032 4228 jjpjd.exe tbbtbt.exe PID 4228 wrote to memory of 5032 4228 jjpjd.exe tbbtbt.exe PID 4228 wrote to memory of 5032 4228 jjpjd.exe tbbtbt.exe PID 5032 wrote to memory of 3012 5032 tbbtbt.exe dddvd.exe PID 5032 wrote to memory of 3012 5032 tbbtbt.exe dddvd.exe PID 5032 wrote to memory of 3012 5032 tbbtbt.exe dddvd.exe PID 3012 wrote to memory of 1152 3012 dddvd.exe lxxrllx.exe PID 3012 wrote to memory of 1152 3012 dddvd.exe lxxrllx.exe PID 3012 wrote to memory of 1152 3012 dddvd.exe lxxrllx.exe PID 1152 wrote to memory of 4468 1152 lxxrllx.exe ttnnnn.exe PID 1152 wrote to memory of 4468 1152 lxxrllx.exe ttnnnn.exe PID 1152 wrote to memory of 4468 1152 lxxrllx.exe ttnnnn.exe PID 4468 wrote to memory of 1680 4468 ttnnnn.exe jdpjp.exe PID 4468 wrote to memory of 1680 4468 ttnnnn.exe jdpjp.exe PID 4468 wrote to memory of 1680 4468 ttnnnn.exe jdpjp.exe PID 1680 wrote to memory of 2928 1680 jdpjp.exe nntnnh.exe PID 1680 wrote to memory of 2928 1680 jdpjp.exe nntnnh.exe PID 1680 wrote to memory of 2928 1680 jdpjp.exe nntnnh.exe PID 2928 wrote to memory of 2220 2928 nntnnh.exe pjvdv.exe PID 2928 wrote to memory of 2220 2928 nntnnh.exe pjvdv.exe PID 2928 wrote to memory of 2220 2928 nntnnh.exe pjvdv.exe PID 2220 wrote to memory of 4028 2220 pjvdv.exe xllfrrr.exe PID 2220 wrote to memory of 4028 2220 pjvdv.exe xllfrrr.exe PID 2220 wrote to memory of 4028 2220 pjvdv.exe xllfrrr.exe PID 4028 wrote to memory of 2204 4028 xllfrrr.exe nnthtn.exe PID 4028 wrote to memory of 2204 4028 xllfrrr.exe nnthtn.exe PID 4028 wrote to memory of 2204 4028 xllfrrr.exe nnthtn.exe PID 2204 wrote to memory of 3660 2204 nnthtn.exe jvvpj.exe PID 2204 wrote to memory of 3660 2204 nnthtn.exe jvvpj.exe PID 2204 wrote to memory of 3660 2204 nnthtn.exe jvvpj.exe PID 3660 wrote to memory of 1468 3660 jvvpj.exe lllfxxr.exe PID 3660 wrote to memory of 1468 3660 jvvpj.exe lllfxxr.exe PID 3660 wrote to memory of 1468 3660 jvvpj.exe lllfxxr.exe PID 1468 wrote to memory of 4780 1468 lllfxxr.exe hnbtnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08b97e41bf9d446f27b6534ec6b1cc70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\08b97e41bf9d446f27b6534ec6b1cc70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\dpvjp.exec:\dpvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\thhhbh.exec:\thhhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\5ppdv.exec:\5ppdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\3rxrlxr.exec:\3rxrlxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\nhbhth.exec:\nhbhth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\pjpvj.exec:\pjpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\rxlrrxx.exec:\rxlrrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\jvvpp.exec:\jvvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\jjpjd.exec:\jjpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\tbbtbt.exec:\tbbtbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\dddvd.exec:\dddvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\lxxrllx.exec:\lxxrllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\ttnnnn.exec:\ttnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\jdpjp.exec:\jdpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\nntnnh.exec:\nntnnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\pjvdv.exec:\pjvdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\xllfrrr.exec:\xllfrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\nnthtn.exec:\nnthtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\jvvpj.exec:\jvvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\lllfxxr.exec:\lllfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\hnbtnh.exec:\hnbtnh.exe23⤵
- Executes dropped EXE
PID:4780 -
\??\c:\jdpvj.exec:\jdpvj.exe24⤵
- Executes dropped EXE
PID:4912 -
\??\c:\frrrxxf.exec:\frrrxxf.exe25⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bhbttn.exec:\bhbttn.exe26⤵
- Executes dropped EXE
PID:2872 -
\??\c:\dpvpj.exec:\dpvpj.exe27⤵
- Executes dropped EXE
PID:4092 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe28⤵
- Executes dropped EXE
PID:5028 -
\??\c:\ttbbhh.exec:\ttbbhh.exe29⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tthhtt.exec:\tthhtt.exe30⤵
- Executes dropped EXE
PID:4132 -
\??\c:\pppjj.exec:\pppjj.exe31⤵
- Executes dropped EXE
PID:3956 -
\??\c:\lrrrfff.exec:\lrrrfff.exe32⤵
- Executes dropped EXE
PID:428 -
\??\c:\rrflrrx.exec:\rrflrrx.exe33⤵
- Executes dropped EXE
PID:1424 -
\??\c:\xrrrllf.exec:\xrrrllf.exe34⤵
- Executes dropped EXE
PID:2812 -
\??\c:\htbtth.exec:\htbtth.exe35⤵
- Executes dropped EXE
PID:4768 -
\??\c:\nntnbt.exec:\nntnbt.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pdjvd.exec:\pdjvd.exe37⤵
- Executes dropped EXE
PID:3500 -
\??\c:\xxxxlrr.exec:\xxxxlrr.exe38⤵
- Executes dropped EXE
PID:1812 -
\??\c:\lxrlllx.exec:\lxrlllx.exe39⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tnhbnn.exec:\tnhbnn.exe40⤵
- Executes dropped EXE
PID:4376 -
\??\c:\nnhthb.exec:\nnhthb.exe41⤵
- Executes dropped EXE
PID:4068 -
\??\c:\vvjpj.exec:\vvjpj.exe42⤵
- Executes dropped EXE
PID:2380 -
\??\c:\flxrllf.exec:\flxrllf.exe43⤵
- Executes dropped EXE
PID:668 -
\??\c:\xfllxff.exec:\xfllxff.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\5lfxllf.exec:\5lfxllf.exe45⤵
- Executes dropped EXE
PID:424 -
\??\c:\tnnbtt.exec:\tnnbtt.exe46⤵
- Executes dropped EXE
PID:3996 -
\??\c:\bhbnbt.exec:\bhbnbt.exe47⤵
- Executes dropped EXE
PID:1276 -
\??\c:\dvjjv.exec:\dvjjv.exe48⤵
- Executes dropped EXE
PID:3184 -
\??\c:\7lflfxl.exec:\7lflfxl.exe49⤵
- Executes dropped EXE
PID:4064 -
\??\c:\thnttt.exec:\thnttt.exe50⤵
- Executes dropped EXE
PID:444 -
\??\c:\hbbnhb.exec:\hbbnhb.exe51⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jdppd.exec:\jdppd.exe52⤵
- Executes dropped EXE
PID:5048 -
\??\c:\1flfrrl.exec:\1flfrrl.exe53⤵
- Executes dropped EXE
PID:3216 -
\??\c:\fxrxxrf.exec:\fxrxxrf.exe54⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vppdv.exec:\vppdv.exe55⤵
- Executes dropped EXE
PID:3892 -
\??\c:\3vdvp.exec:\3vdvp.exe56⤵
- Executes dropped EXE
PID:4408 -
\??\c:\lfxfxfx.exec:\lfxfxfx.exe57⤵
- Executes dropped EXE
PID:4564 -
\??\c:\bnbhhn.exec:\bnbhhn.exe58⤵
- Executes dropped EXE
PID:3828 -
\??\c:\djdvv.exec:\djdvv.exe59⤵
- Executes dropped EXE
PID:3908 -
\??\c:\3xfxxff.exec:\3xfxxff.exe60⤵
- Executes dropped EXE
PID:1872 -
\??\c:\lxxlllf.exec:\lxxlllf.exe61⤵
- Executes dropped EXE
PID:4464 -
\??\c:\bnnbbt.exec:\bnnbbt.exe62⤵
- Executes dropped EXE
PID:5076 -
\??\c:\dvppj.exec:\dvppj.exe63⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jpjjj.exec:\jpjjj.exe64⤵
- Executes dropped EXE
PID:3440 -
\??\c:\xlxfllx.exec:\xlxfllx.exe65⤵
- Executes dropped EXE
PID:4900 -
\??\c:\nntbbb.exec:\nntbbb.exe66⤵PID:1980
-
\??\c:\jdpjv.exec:\jdpjv.exe67⤵PID:4168
-
\??\c:\5pvpp.exec:\5pvpp.exe68⤵PID:2408
-
\??\c:\xrxxlff.exec:\xrxxlff.exe69⤵PID:4440
-
\??\c:\rfxxflr.exec:\rfxxflr.exe70⤵PID:536
-
\??\c:\1bnttb.exec:\1bnttb.exe71⤵PID:4876
-
\??\c:\jvjvd.exec:\jvjvd.exe72⤵PID:2872
-
\??\c:\lfxrllf.exec:\lfxrllf.exe73⤵PID:4868
-
\??\c:\lxfxlfx.exec:\lxfxlfx.exe74⤵PID:5028
-
\??\c:\jddvp.exec:\jddvp.exe75⤵PID:764
-
\??\c:\vjjjd.exec:\vjjjd.exe76⤵PID:3624
-
\??\c:\lfxrfrl.exec:\lfxrfrl.exe77⤵PID:3172
-
\??\c:\tnhbbb.exec:\tnhbbb.exe78⤵PID:3096
-
\??\c:\5hnhtt.exec:\5hnhtt.exe79⤵PID:3180
-
\??\c:\ddpjp.exec:\ddpjp.exe80⤵PID:4504
-
\??\c:\jdpdj.exec:\jdpdj.exe81⤵PID:1908
-
\??\c:\rfllfff.exec:\rfllfff.exe82⤵PID:2420
-
\??\c:\hhtthh.exec:\hhtthh.exe83⤵PID:1300
-
\??\c:\hhhhhh.exec:\hhhhhh.exe84⤵PID:964
-
\??\c:\7pvvv.exec:\7pvvv.exe85⤵PID:4728
-
\??\c:\pvdjd.exec:\pvdjd.exe86⤵PID:3652
-
\??\c:\frlfxxf.exec:\frlfxxf.exe87⤵PID:3124
-
\??\c:\xfrxlrl.exec:\xfrxlrl.exe88⤵PID:3220
-
\??\c:\bnhbnt.exec:\bnhbnt.exe89⤵PID:972
-
\??\c:\pjpdd.exec:\pjpdd.exe90⤵PID:3004
-
\??\c:\xflxlfx.exec:\xflxlfx.exe91⤵PID:5044
-
\??\c:\rffllff.exec:\rffllff.exe92⤵PID:3056
-
\??\c:\ttnthn.exec:\ttnthn.exe93⤵PID:4964
-
\??\c:\bhnnhb.exec:\bhnnhb.exe94⤵PID:2448
-
\??\c:\jvvvd.exec:\jvvvd.exe95⤵PID:4320
-
\??\c:\lrrrllx.exec:\lrrrllx.exe96⤵PID:4064
-
\??\c:\frrlrrr.exec:\frrlrrr.exe97⤵PID:3740
-
\??\c:\3hnntt.exec:\3hnntt.exe98⤵PID:3404
-
\??\c:\nnthbn.exec:\nnthbn.exe99⤵PID:2948
-
\??\c:\pjddv.exec:\pjddv.exe100⤵PID:5048
-
\??\c:\vppdp.exec:\vppdp.exe101⤵PID:1372
-
\??\c:\lrrrlff.exec:\lrrrlff.exe102⤵PID:2988
-
\??\c:\nbnnnn.exec:\nbnnnn.exe103⤵PID:1880
-
\??\c:\bbnhnn.exec:\bbnhnn.exe104⤵PID:2200
-
\??\c:\pjvvv.exec:\pjvvv.exe105⤵PID:4316
-
\??\c:\dpdvp.exec:\dpdvp.exe106⤵PID:4564
-
\??\c:\fxrrllf.exec:\fxrrllf.exe107⤵PID:3828
-
\??\c:\ffxxxll.exec:\ffxxxll.exe108⤵PID:3908
-
\??\c:\tttttt.exec:\tttttt.exe109⤵PID:4480
-
\??\c:\jpvpp.exec:\jpvpp.exe110⤵PID:3792
-
\??\c:\pjddv.exec:\pjddv.exe111⤵PID:1724
-
\??\c:\rflxrxr.exec:\rflxrxr.exe112⤵PID:3028
-
\??\c:\xrrlllx.exec:\xrrlllx.exe113⤵PID:2368
-
\??\c:\bbtttn.exec:\bbtttn.exe114⤵PID:4188
-
\??\c:\1thbbb.exec:\1thbbb.exe115⤵PID:2360
-
\??\c:\djjvv.exec:\djjvv.exe116⤵PID:4912
-
\??\c:\dvpjp.exec:\dvpjp.exe117⤵PID:2288
-
\??\c:\5xxrrrr.exec:\5xxrrrr.exe118⤵PID:1524
-
\??\c:\hbnhhb.exec:\hbnhhb.exe119⤵PID:3304
-
\??\c:\9hhhbh.exec:\9hhhbh.exe120⤵PID:4152
-
\??\c:\jjvpp.exec:\jjvpp.exe121⤵PID:3836
-
\??\c:\vpvjv.exec:\vpvjv.exe122⤵PID:3624
-
\??\c:\xlllfff.exec:\xlllfff.exe123⤵PID:1660
-
\??\c:\xxrlrlf.exec:\xxrlrlf.exe124⤵PID:1328
-
\??\c:\thtnnb.exec:\thtnnb.exe125⤵PID:2084
-
\??\c:\dddvj.exec:\dddvj.exe126⤵PID:2400
-
\??\c:\djpvv.exec:\djpvv.exe127⤵PID:4540
-
\??\c:\xllrfff.exec:\xllrfff.exe128⤵PID:1228
-
\??\c:\llrrfrr.exec:\llrrfrr.exe129⤵PID:4832
-
\??\c:\ntnhbt.exec:\ntnhbt.exe130⤵PID:4376
-
\??\c:\dvvvd.exec:\dvvvd.exe131⤵PID:4348
-
\??\c:\vjvpj.exec:\vjvpj.exe132⤵PID:4836
-
\??\c:\nnnnnt.exec:\nnnnnt.exe133⤵PID:972
-
\??\c:\djppj.exec:\djppj.exe134⤵PID:1172
-
\??\c:\djjdj.exec:\djjdj.exe135⤵PID:5044
-
\??\c:\fxrllll.exec:\fxrllll.exe136⤵PID:3684
-
\??\c:\nbttnb.exec:\nbttnb.exe137⤵PID:3408
-
\??\c:\xffxrrx.exec:\xffxrrx.exe138⤵PID:4920
-
\??\c:\rfrxxxr.exec:\rfrxxxr.exe139⤵PID:4064
-
\??\c:\hbtnhh.exec:\hbtnhh.exe140⤵PID:3740
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe141⤵PID:3404
-
\??\c:\rffxrlx.exec:\rffxrlx.exe142⤵PID:2948
-
\??\c:\hntntt.exec:\hntntt.exe143⤵PID:2440
-
\??\c:\ddpjd.exec:\ddpjd.exe144⤵PID:2120
-
\??\c:\pdvvv.exec:\pdvvv.exe145⤵PID:4088
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe146⤵PID:4516
-
\??\c:\bbtntn.exec:\bbtntn.exe147⤵PID:1968
-
\??\c:\jpvvp.exec:\jpvvp.exe148⤵PID:4652
-
\??\c:\pvvjp.exec:\pvvjp.exe149⤵PID:2188
-
\??\c:\rrrxlfl.exec:\rrrxlfl.exe150⤵PID:2964
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe151⤵PID:4480
-
\??\c:\hbhnth.exec:\hbhnth.exe152⤵PID:3792
-
\??\c:\pjvjd.exec:\pjvjd.exe153⤵PID:1724
-
\??\c:\pjdjd.exec:\pjdjd.exe154⤵PID:3028
-
\??\c:\lfrlfll.exec:\lfrlfll.exe155⤵PID:1980
-
\??\c:\1bttbn.exec:\1bttbn.exe156⤵PID:3928
-
\??\c:\pppjv.exec:\pppjv.exe157⤵PID:2160
-
\??\c:\nhnnhn.exec:\nhnnhn.exe158⤵PID:4876
-
\??\c:\nhbthn.exec:\nhbthn.exe159⤵PID:3968
-
\??\c:\jdvjd.exec:\jdvjd.exe160⤵PID:4580
-
\??\c:\fxfxffr.exec:\fxfxffr.exe161⤵PID:3304
-
\??\c:\tbbhbh.exec:\tbbhbh.exe162⤵PID:4152
-
\??\c:\1vpdv.exec:\1vpdv.exe163⤵PID:3836
-
\??\c:\xffflrf.exec:\xffflrf.exe164⤵PID:3624
-
\??\c:\nnnnbt.exec:\nnnnbt.exe165⤵PID:1660
-
\??\c:\jpddp.exec:\jpddp.exe166⤵PID:4276
-
\??\c:\lrrlflf.exec:\lrrlflf.exe167⤵PID:1908
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe168⤵PID:4388
-
\??\c:\ththbt.exec:\ththbt.exe169⤵PID:3692
-
\??\c:\htttnt.exec:\htttnt.exe170⤵PID:3964
-
\??\c:\xlrrlll.exec:\xlrrlll.exe171⤵PID:2468
-
\??\c:\rfllfff.exec:\rfllfff.exe172⤵PID:4572
-
\??\c:\7bnhnn.exec:\7bnhnn.exe173⤵PID:2836
-
\??\c:\tbbhnh.exec:\tbbhnh.exe174⤵PID:2744
-
\??\c:\pvvdd.exec:\pvvdd.exe175⤵PID:4424
-
\??\c:\lrxxffr.exec:\lrxxffr.exe176⤵PID:3056
-
\??\c:\bbthnh.exec:\bbthnh.exe177⤵PID:1028
-
\??\c:\dvjvd.exec:\dvjvd.exe178⤵PID:2012
-
\??\c:\jdvjd.exec:\jdvjd.exe179⤵PID:3328
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe180⤵PID:4660
-
\??\c:\lfffxfx.exec:\lfffxfx.exe181⤵PID:3508
-
\??\c:\nbtnbn.exec:\nbtnbn.exe182⤵PID:2156
-
\??\c:\nhtbtn.exec:\nhtbtn.exe183⤵PID:1844
-
\??\c:\7jjvp.exec:\7jjvp.exe184⤵PID:4956
-
\??\c:\jjdvv.exec:\jjdvv.exe185⤵PID:5056
-
\??\c:\flxfxrr.exec:\flxfxrr.exe186⤵PID:4416
-
\??\c:\frxrffx.exec:\frxrffx.exe187⤵PID:3116
-
\??\c:\3bbnnb.exec:\3bbnnb.exe188⤵PID:4516
-
\??\c:\tnhhhb.exec:\tnhhhb.exe189⤵PID:2656
-
\??\c:\thhhbh.exec:\thhhbh.exe190⤵PID:4652
-
\??\c:\1jdjd.exec:\1jdjd.exe191⤵PID:3908
-
\??\c:\pdpjv.exec:\pdpjv.exe192⤵PID:4464
-
\??\c:\xxlxxxx.exec:\xxlxxxx.exe193⤵PID:2328
-
\??\c:\fxrlfff.exec:\fxrlfff.exe194⤵PID:2720
-
\??\c:\ttnbhh.exec:\ttnbhh.exe195⤵PID:4044
-
\??\c:\htbbbn.exec:\htbbbn.exe196⤵PID:3028
-
\??\c:\pdvvp.exec:\pdvvp.exe197⤵PID:3948
-
\??\c:\1lllrrr.exec:\1lllrrr.exe198⤵PID:4892
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe199⤵PID:4092
-
\??\c:\tthhbt.exec:\tthhbt.exe200⤵PID:4876
-
\??\c:\dppjp.exec:\dppjp.exe201⤵PID:3968
-
\??\c:\pdvjd.exec:\pdvjd.exe202⤵PID:5028
-
\??\c:\frffrlf.exec:\frffrlf.exe203⤵PID:3304
-
\??\c:\xrlxxxl.exec:\xrlxxxl.exe204⤵PID:3096
-
\??\c:\7bbbhh.exec:\7bbbhh.exe205⤵PID:2812
-
\??\c:\vvpjj.exec:\vvpjj.exe206⤵PID:4636
-
\??\c:\jvpjd.exec:\jvpjd.exe207⤵PID:2336
-
\??\c:\rxllxlr.exec:\rxllxlr.exe208⤵PID:2696
-
\??\c:\rrlrlrr.exec:\rrlrlrr.exe209⤵PID:1288
-
\??\c:\bntnhn.exec:\bntnhn.exe210⤵PID:1228
-
\??\c:\hhbhtb.exec:\hhbhtb.exe211⤵PID:4476
-
\??\c:\dppjj.exec:\dppjj.exe212⤵PID:4520
-
\??\c:\vvjjj.exec:\vvjjj.exe213⤵PID:1560
-
\??\c:\ffrfflx.exec:\ffrfflx.exe214⤵PID:4348
-
\??\c:\fxfxrll.exec:\fxfxrll.exe215⤵PID:2836
-
\??\c:\3tnhbb.exec:\3tnhbb.exe216⤵PID:3596
-
\??\c:\bbttnt.exec:\bbttnt.exe217⤵PID:4940
-
\??\c:\dvjpp.exec:\dvjpp.exe218⤵PID:3408
-
\??\c:\pppdv.exec:\pppdv.exe219⤵PID:2012
-
\??\c:\rxxrllf.exec:\rxxrllf.exe220⤵PID:3860
-
\??\c:\thhbbb.exec:\thhbbb.exe221⤵PID:3412
-
\??\c:\thntth.exec:\thntth.exe222⤵PID:3404
-
\??\c:\vpddp.exec:\vpddp.exe223⤵PID:3080
-
\??\c:\rfrfxrf.exec:\rfrfxrf.exe224⤵PID:5020
-
\??\c:\9lfrfrr.exec:\9lfrfrr.exe225⤵PID:4468
-
\??\c:\jjpjd.exec:\jjpjd.exe226⤵PID:372
-
\??\c:\xlrflfl.exec:\xlrflfl.exe227⤵PID:4140
-
\??\c:\bbttnn.exec:\bbttnn.exe228⤵PID:1356
-
\??\c:\nhtnbb.exec:\nhtnbb.exe229⤵PID:4996
-
\??\c:\jpvpp.exec:\jpvpp.exe230⤵PID:4136
-
\??\c:\xflxllf.exec:\xflxllf.exe231⤵PID:3060
-
\??\c:\lflrxxr.exec:\lflrxxr.exe232⤵PID:2964
-
\??\c:\thhnnt.exec:\thhnnt.exe233⤵PID:1960
-
\??\c:\vvdjj.exec:\vvdjj.exe234⤵PID:2720
-
\??\c:\jppjp.exec:\jppjp.exe235⤵PID:4044
-
\??\c:\rlrxrrf.exec:\rlrxrrf.exe236⤵PID:2540
-
\??\c:\fxxflfr.exec:\fxxflfr.exe237⤵PID:900
-
\??\c:\nhbbnh.exec:\nhbbnh.exe238⤵PID:4092
-
\??\c:\3pvjj.exec:\3pvjj.exe239⤵PID:4868
-
\??\c:\lrllxxr.exec:\lrllxxr.exe240⤵PID:1088
-
\??\c:\hbbbhb.exec:\hbbbhb.exe241⤵PID:4768
-
\??\c:\hbtbnn.exec:\hbtbnn.exe242⤵PID:3180