Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 20:06
Behavioral task
behavioral1
Sample
412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe
-
Size
58KB
-
MD5
412d25307c415869e0a4625903f6a840
-
SHA1
45ca6c0ba301d802d84c9a7c49e0eb4d458bab4e
-
SHA256
878e3dd98d57968770b3e920fa3521503097750b61321acd45b4f4cfca41b4af
-
SHA512
f7e5109e51115e1d3a220e889f42877e560d4fd0cd11292a5f66ed7fff4b603b167fe8aaf239442f3aa6ab9eaeaa5a6b7875a6c8b236f894ad9dfa4ce2934a40
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNG1mjtREVM5D:khOmTsF93UYfwC6GIoutpY918c6
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4488-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2336-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/864-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2000-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2732-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2000-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/696-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-583-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-602-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-641-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-675-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdjvv.exerlllflf.exe5nbttt.exevjddd.exebtnnbh.exeffrfrrr.exe3nbnhn.exedjvdp.exe7frxxfr.exetbbttb.exevpdpd.exelfxffxl.exenbhbnn.exejdpjd.exefxllllf.exetnbtnb.exenthnnn.exejddjv.exexrlfxxr.exehbtthh.exe3fxfxxr.exerfrxlff.exe9nnnhb.exe9vppv.exe9lrflfl.exehnthbt.exeddjdp.exexrfrfxl.exebhtbhh.exejvjvd.exevjpjd.exerfrxlfl.exehnnnbb.exevvjdv.exepdjjj.exehtttth.exeppvdp.exeppvvj.exelxlrllr.exebbhtth.exeppvjv.exe7vdvj.exelrlfxxr.exe3vvvv.exevjddv.exetnbttt.exe1jpdj.exerflrrrr.exe1tntth.exedddjd.exeddjjd.exexlffffx.exennhhtt.exeppddd.exerfxxlll.exenhtnnn.exedpvpv.exe3vdjj.exeffxrlrf.exentnhtt.exe5pjdv.exevjvjd.exefxxrrrr.exexrfxrrx.exepid process 2920 pdjvv.exe 2492 rlllflf.exe 3908 5nbttt.exe 1136 vjddd.exe 3564 btnnbh.exe 2880 ffrfrrr.exe 3612 3nbnhn.exe 4908 djvdp.exe 2336 7frxxfr.exe 3268 tbbttb.exe 2380 vpdpd.exe 2908 lfxffxl.exe 4564 nbhbnn.exe 1624 jdpjd.exe 228 fxllllf.exe 2248 tnbtnb.exe 4264 nthnnn.exe 2764 jddjv.exe 5096 xrlfxxr.exe 4924 hbtthh.exe 1476 3fxfxxr.exe 3500 rfrxlff.exe 4888 9nnnhb.exe 864 9vppv.exe 1696 9lrflfl.exe 2000 hnthbt.exe 4632 ddjdp.exe 4932 xrfrfxl.exe 4660 bhtbhh.exe 1708 jvjvd.exe 4372 vjpjd.exe 3024 rfrxlfl.exe 2368 hnnnbb.exe 3080 vvjdv.exe 4452 pdjjj.exe 3200 htttth.exe 412 ppvdp.exe 3316 ppvvj.exe 3752 lxlrllr.exe 2464 bbhtth.exe 4324 ppvjv.exe 3776 7vdvj.exe 1848 lrlfxxr.exe 3344 3vvvv.exe 1724 vjddv.exe 4344 tnbttt.exe 3536 1jpdj.exe 1448 rflrrrr.exe 2352 1tntth.exe 3716 dddjd.exe 4708 ddjjd.exe 4704 xlffffx.exe 3516 nnhhtt.exe 5080 ppddd.exe 2732 rfxxlll.exe 2908 nhtnnn.exe 1612 dpvpv.exe 3788 3vdjj.exe 3276 ffxrlrf.exe 4352 ntnhtt.exe 3232 5pjdv.exe 1912 vjvjd.exe 4588 fxxrrrr.exe 4952 xrfxrrx.exe -
Processes:
resource yara_rule behavioral2/memory/4488-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjvv.exe upx behavioral2/memory/4488-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlllflf.exe upx behavioral2/memory/2920-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5nbttt.exe upx behavioral2/memory/2492-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjddd.exe upx behavioral2/memory/3908-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1136-25-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btnnbh.exe upx behavioral2/memory/3564-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffrfrrr.exe upx C:\3nbnhn.exe upx behavioral2/memory/2880-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3612-45-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djvdp.exe upx behavioral2/memory/4908-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7frxxfr.exe upx C:\tbbttb.exe upx behavioral2/memory/2336-56-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vpdpd.exe upx C:\lfxffxl.exe upx behavioral2/memory/2908-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbhbnn.exe upx behavioral2/memory/2908-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdpjd.exe upx behavioral2/memory/4564-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxllllf.exe upx behavioral2/memory/228-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbtnb.exe upx behavioral2/memory/2248-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nthnnn.exe upx behavioral2/memory/2248-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddjv.exe upx C:\xrlfxxr.exe upx behavioral2/memory/2764-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbtthh.exe upx behavioral2/memory/5096-114-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3fxfxxr.exe upx behavioral2/memory/4924-121-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrxlff.exe upx behavioral2/memory/3500-132-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9nnnhb.exe upx behavioral2/memory/4888-133-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vppv.exe upx behavioral2/memory/864-140-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9lrflfl.exe upx C:\hnthbt.exe upx C:\ddjdp.exe upx behavioral2/memory/2000-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrfrfxl.exe upx behavioral2/memory/4932-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhtbhh.exe upx behavioral2/memory/4660-168-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvjvd.exe upx behavioral2/memory/1708-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjpjd.exe upx behavioral2/memory/1708-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4372-183-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrxlfl.exe upx behavioral2/memory/2368-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4452-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3200-204-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
412d25307c415869e0a4625903f6a840_NeikiAnalytics.exepdjvv.exerlllflf.exe5nbttt.exevjddd.exebtnnbh.exeffrfrrr.exe3nbnhn.exedjvdp.exe7frxxfr.exetbbttb.exevpdpd.exelfxffxl.exenbhbnn.exejdpjd.exefxllllf.exetnbtnb.exenthnnn.exejddjv.exexrlfxxr.exehbtthh.exe3fxfxxr.exedescription pid process target process PID 4488 wrote to memory of 2920 4488 412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe pdjvv.exe PID 4488 wrote to memory of 2920 4488 412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe pdjvv.exe PID 4488 wrote to memory of 2920 4488 412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe pdjvv.exe PID 2920 wrote to memory of 2492 2920 pdjvv.exe rlllflf.exe PID 2920 wrote to memory of 2492 2920 pdjvv.exe rlllflf.exe PID 2920 wrote to memory of 2492 2920 pdjvv.exe rlllflf.exe PID 2492 wrote to memory of 3908 2492 rlllflf.exe 5nbttt.exe PID 2492 wrote to memory of 3908 2492 rlllflf.exe 5nbttt.exe PID 2492 wrote to memory of 3908 2492 rlllflf.exe 5nbttt.exe PID 3908 wrote to memory of 1136 3908 5nbttt.exe vjddd.exe PID 3908 wrote to memory of 1136 3908 5nbttt.exe vjddd.exe PID 3908 wrote to memory of 1136 3908 5nbttt.exe vjddd.exe PID 1136 wrote to memory of 3564 1136 vjddd.exe btnnbh.exe PID 1136 wrote to memory of 3564 1136 vjddd.exe btnnbh.exe PID 1136 wrote to memory of 3564 1136 vjddd.exe btnnbh.exe PID 3564 wrote to memory of 2880 3564 btnnbh.exe ffrfrrr.exe PID 3564 wrote to memory of 2880 3564 btnnbh.exe ffrfrrr.exe PID 3564 wrote to memory of 2880 3564 btnnbh.exe ffrfrrr.exe PID 2880 wrote to memory of 3612 2880 ffrfrrr.exe 3nbnhn.exe PID 2880 wrote to memory of 3612 2880 ffrfrrr.exe 3nbnhn.exe PID 2880 wrote to memory of 3612 2880 ffrfrrr.exe 3nbnhn.exe PID 3612 wrote to memory of 4908 3612 3nbnhn.exe djvdp.exe PID 3612 wrote to memory of 4908 3612 3nbnhn.exe djvdp.exe PID 3612 wrote to memory of 4908 3612 3nbnhn.exe djvdp.exe PID 4908 wrote to memory of 2336 4908 djvdp.exe 7frxxfr.exe PID 4908 wrote to memory of 2336 4908 djvdp.exe 7frxxfr.exe PID 4908 wrote to memory of 2336 4908 djvdp.exe 7frxxfr.exe PID 2336 wrote to memory of 3268 2336 7frxxfr.exe tbbttb.exe PID 2336 wrote to memory of 3268 2336 7frxxfr.exe tbbttb.exe PID 2336 wrote to memory of 3268 2336 7frxxfr.exe tbbttb.exe PID 3268 wrote to memory of 2380 3268 tbbttb.exe vpdpd.exe PID 3268 wrote to memory of 2380 3268 tbbttb.exe vpdpd.exe PID 3268 wrote to memory of 2380 3268 tbbttb.exe vpdpd.exe PID 2380 wrote to memory of 2908 2380 vpdpd.exe lfxffxl.exe PID 2380 wrote to memory of 2908 2380 vpdpd.exe lfxffxl.exe PID 2380 wrote to memory of 2908 2380 vpdpd.exe lfxffxl.exe PID 2908 wrote to memory of 4564 2908 lfxffxl.exe nbhbnn.exe PID 2908 wrote to memory of 4564 2908 lfxffxl.exe nbhbnn.exe PID 2908 wrote to memory of 4564 2908 lfxffxl.exe nbhbnn.exe PID 4564 wrote to memory of 1624 4564 nbhbnn.exe jdpjd.exe PID 4564 wrote to memory of 1624 4564 nbhbnn.exe jdpjd.exe PID 4564 wrote to memory of 1624 4564 nbhbnn.exe jdpjd.exe PID 1624 wrote to memory of 228 1624 jdpjd.exe fxllllf.exe PID 1624 wrote to memory of 228 1624 jdpjd.exe fxllllf.exe PID 1624 wrote to memory of 228 1624 jdpjd.exe fxllllf.exe PID 228 wrote to memory of 2248 228 fxllllf.exe tnbtnb.exe PID 228 wrote to memory of 2248 228 fxllllf.exe tnbtnb.exe PID 228 wrote to memory of 2248 228 fxllllf.exe tnbtnb.exe PID 2248 wrote to memory of 4264 2248 tnbtnb.exe nthnnn.exe PID 2248 wrote to memory of 4264 2248 tnbtnb.exe nthnnn.exe PID 2248 wrote to memory of 4264 2248 tnbtnb.exe nthnnn.exe PID 4264 wrote to memory of 2764 4264 nthnnn.exe jddjv.exe PID 4264 wrote to memory of 2764 4264 nthnnn.exe jddjv.exe PID 4264 wrote to memory of 2764 4264 nthnnn.exe jddjv.exe PID 2764 wrote to memory of 5096 2764 jddjv.exe xrlfxxr.exe PID 2764 wrote to memory of 5096 2764 jddjv.exe xrlfxxr.exe PID 2764 wrote to memory of 5096 2764 jddjv.exe xrlfxxr.exe PID 5096 wrote to memory of 4924 5096 xrlfxxr.exe hbtthh.exe PID 5096 wrote to memory of 4924 5096 xrlfxxr.exe hbtthh.exe PID 5096 wrote to memory of 4924 5096 xrlfxxr.exe hbtthh.exe PID 4924 wrote to memory of 1476 4924 hbtthh.exe 3fxfxxr.exe PID 4924 wrote to memory of 1476 4924 hbtthh.exe 3fxfxxr.exe PID 4924 wrote to memory of 1476 4924 hbtthh.exe 3fxfxxr.exe PID 1476 wrote to memory of 3500 1476 3fxfxxr.exe rfrxlff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\pdjvv.exec:\pdjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rlllflf.exec:\rlllflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\5nbttt.exec:\5nbttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\vjddd.exec:\vjddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\btnnbh.exec:\btnnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\ffrfrrr.exec:\ffrfrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\3nbnhn.exec:\3nbnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\djvdp.exec:\djvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\7frxxfr.exec:\7frxxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\tbbttb.exec:\tbbttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\vpdpd.exec:\vpdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\lfxffxl.exec:\lfxffxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\nbhbnn.exec:\nbhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\jdpjd.exec:\jdpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\fxllllf.exec:\fxllllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\tnbtnb.exec:\tnbtnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\nthnnn.exec:\nthnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\jddjv.exec:\jddjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\hbtthh.exec:\hbtthh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\3fxfxxr.exec:\3fxfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\rfrxlff.exec:\rfrxlff.exe23⤵
- Executes dropped EXE
PID:3500 -
\??\c:\9nnnhb.exec:\9nnnhb.exe24⤵
- Executes dropped EXE
PID:4888 -
\??\c:\9vppv.exec:\9vppv.exe25⤵
- Executes dropped EXE
PID:864 -
\??\c:\9lrflfl.exec:\9lrflfl.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hnthbt.exec:\hnthbt.exe27⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ddjdp.exec:\ddjdp.exe28⤵
- Executes dropped EXE
PID:4632 -
\??\c:\xrfrfxl.exec:\xrfrfxl.exe29⤵
- Executes dropped EXE
PID:4932 -
\??\c:\bhtbhh.exec:\bhtbhh.exe30⤵
- Executes dropped EXE
PID:4660 -
\??\c:\jvjvd.exec:\jvjvd.exe31⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vjpjd.exec:\vjpjd.exe32⤵
- Executes dropped EXE
PID:4372 -
\??\c:\rfrxlfl.exec:\rfrxlfl.exe33⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hnnnbb.exec:\hnnnbb.exe34⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vvjdv.exec:\vvjdv.exe35⤵
- Executes dropped EXE
PID:3080 -
\??\c:\pdjjj.exec:\pdjjj.exe36⤵
- Executes dropped EXE
PID:4452 -
\??\c:\htttth.exec:\htttth.exe37⤵
- Executes dropped EXE
PID:3200 -
\??\c:\ppvdp.exec:\ppvdp.exe38⤵
- Executes dropped EXE
PID:412 -
\??\c:\ppvvj.exec:\ppvvj.exe39⤵
- Executes dropped EXE
PID:3316 -
\??\c:\lxlrllr.exec:\lxlrllr.exe40⤵
- Executes dropped EXE
PID:3752 -
\??\c:\bbhtth.exec:\bbhtth.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ppvjv.exec:\ppvjv.exe42⤵
- Executes dropped EXE
PID:4324 -
\??\c:\7vdvj.exec:\7vdvj.exe43⤵
- Executes dropped EXE
PID:3776 -
\??\c:\lrlfxxr.exec:\lrlfxxr.exe44⤵
- Executes dropped EXE
PID:1848 -
\??\c:\3vvvv.exec:\3vvvv.exe45⤵
- Executes dropped EXE
PID:3344 -
\??\c:\vjddv.exec:\vjddv.exe46⤵
- Executes dropped EXE
PID:1724 -
\??\c:\tnbttt.exec:\tnbttt.exe47⤵
- Executes dropped EXE
PID:4344 -
\??\c:\1jpdj.exec:\1jpdj.exe48⤵
- Executes dropped EXE
PID:3536 -
\??\c:\rflrrrr.exec:\rflrrrr.exe49⤵
- Executes dropped EXE
PID:1448 -
\??\c:\1tntth.exec:\1tntth.exe50⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dddjd.exec:\dddjd.exe51⤵
- Executes dropped EXE
PID:3716 -
\??\c:\ddjjd.exec:\ddjjd.exe52⤵
- Executes dropped EXE
PID:4708 -
\??\c:\xlffffx.exec:\xlffffx.exe53⤵
- Executes dropped EXE
PID:4704 -
\??\c:\nnhhtt.exec:\nnhhtt.exe54⤵
- Executes dropped EXE
PID:3516 -
\??\c:\ppddd.exec:\ppddd.exe55⤵
- Executes dropped EXE
PID:5080 -
\??\c:\rfxxlll.exec:\rfxxlll.exe56⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhtnnn.exec:\nhtnnn.exe57⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dpvpv.exec:\dpvpv.exe58⤵
- Executes dropped EXE
PID:1612 -
\??\c:\3vdjj.exec:\3vdjj.exe59⤵
- Executes dropped EXE
PID:3788 -
\??\c:\ffxrlrf.exec:\ffxrlrf.exe60⤵
- Executes dropped EXE
PID:3276 -
\??\c:\ntnhtt.exec:\ntnhtt.exe61⤵
- Executes dropped EXE
PID:4352 -
\??\c:\5pjdv.exec:\5pjdv.exe62⤵
- Executes dropped EXE
PID:3232 -
\??\c:\vjvjd.exec:\vjvjd.exe63⤵
- Executes dropped EXE
PID:1912 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe64⤵
- Executes dropped EXE
PID:4588 -
\??\c:\xrfxrrx.exec:\xrfxrrx.exe65⤵
- Executes dropped EXE
PID:4952 -
\??\c:\9hhbtb.exec:\9hhbtb.exe66⤵PID:4428
-
\??\c:\pvppj.exec:\pvppj.exe67⤵PID:3592
-
\??\c:\vjjjv.exec:\vjjjv.exe68⤵PID:1476
-
\??\c:\flfxrll.exec:\flfxrll.exe69⤵PID:4860
-
\??\c:\rflxlfl.exec:\rflxlfl.exe70⤵PID:4888
-
\??\c:\hnhhhh.exec:\hnhhhh.exe71⤵PID:5088
-
\??\c:\tnthbh.exec:\tnthbh.exe72⤵PID:748
-
\??\c:\pjdvj.exec:\pjdvj.exe73⤵PID:1696
-
\??\c:\flrrrrr.exec:\flrrrrr.exe74⤵PID:2000
-
\??\c:\hbttnn.exec:\hbttnn.exe75⤵PID:3996
-
\??\c:\vdvpj.exec:\vdvpj.exe76⤵PID:4932
-
\??\c:\ffxlxll.exec:\ffxlxll.exe77⤵PID:2120
-
\??\c:\fxxrrlf.exec:\fxxrrlf.exe78⤵PID:2452
-
\??\c:\7hbbnn.exec:\7hbbnn.exe79⤵PID:2296
-
\??\c:\vpjdp.exec:\vpjdp.exe80⤵PID:3436
-
\??\c:\vjvpv.exec:\vjvpv.exe81⤵PID:3024
-
\??\c:\dvpjv.exec:\dvpjv.exe82⤵PID:1140
-
\??\c:\lxllrxf.exec:\lxllrxf.exe83⤵PID:1956
-
\??\c:\thhhhb.exec:\thhhhb.exe84⤵PID:4744
-
\??\c:\hhbnnt.exec:\hhbnnt.exe85⤵PID:3012
-
\??\c:\ddvpp.exec:\ddvpp.exe86⤵PID:4944
-
\??\c:\pdvpv.exec:\pdvpv.exe87⤵PID:4556
-
\??\c:\fxxxrxf.exec:\fxxxrxf.exe88⤵PID:1908
-
\??\c:\httntt.exec:\httntt.exe89⤵PID:4332
-
\??\c:\jjpjj.exec:\jjpjj.exe90⤵PID:2464
-
\??\c:\xlllllf.exec:\xlllllf.exe91⤵PID:4852
-
\??\c:\nbbhhh.exec:\nbbhhh.exe92⤵PID:3724
-
\??\c:\pjvvp.exec:\pjvvp.exe93⤵PID:2088
-
\??\c:\lrrllrr.exec:\lrrllrr.exe94⤵PID:2936
-
\??\c:\nnnhtt.exec:\nnnhtt.exe95⤵PID:3260
-
\??\c:\jjvvd.exec:\jjvvd.exe96⤵PID:4112
-
\??\c:\vpppp.exec:\vpppp.exe97⤵PID:3888
-
\??\c:\llrllrr.exec:\llrllrr.exe98⤵PID:4020
-
\??\c:\tthtbn.exec:\tthtbn.exe99⤵PID:4796
-
\??\c:\3hhhbt.exec:\3hhhbt.exe100⤵PID:2312
-
\??\c:\ddvjd.exec:\ddvjd.exe101⤵PID:1272
-
\??\c:\frxrrrr.exec:\frxrrrr.exe102⤵PID:2336
-
\??\c:\btbhbb.exec:\btbhbb.exe103⤵PID:2068
-
\??\c:\bnnttb.exec:\bnnttb.exe104⤵PID:2436
-
\??\c:\jdpvj.exec:\jdpvj.exe105⤵PID:4772
-
\??\c:\lxrrfll.exec:\lxrrfll.exe106⤵PID:3296
-
\??\c:\nbhbbb.exec:\nbhbbb.exe107⤵PID:5040
-
\??\c:\ttnbbb.exec:\ttnbbb.exe108⤵PID:3428
-
\??\c:\vjjdv.exec:\vjjdv.exe109⤵PID:228
-
\??\c:\xflfffx.exec:\xflfffx.exe110⤵PID:4348
-
\??\c:\tbbnhb.exec:\tbbnhb.exe111⤵PID:3160
-
\??\c:\7nnnbb.exec:\7nnnbb.exe112⤵PID:4836
-
\??\c:\pjvpd.exec:\pjvpd.exe113⤵PID:4364
-
\??\c:\fxllfff.exec:\fxllfff.exe114⤵PID:4764
-
\??\c:\llffrrr.exec:\llffrrr.exe115⤵PID:1864
-
\??\c:\hthbbb.exec:\hthbbb.exe116⤵PID:3116
-
\??\c:\dpvpj.exec:\dpvpj.exe117⤵PID:4436
-
\??\c:\1vddp.exec:\1vddp.exe118⤵PID:1036
-
\??\c:\lfrlxfx.exec:\lfrlxfx.exe119⤵PID:4340
-
\??\c:\bbbbnh.exec:\bbbbnh.exe120⤵PID:4504
-
\??\c:\djjpd.exec:\djjpd.exe121⤵PID:2800
-
\??\c:\3jddd.exec:\3jddd.exe122⤵PID:3060
-
\??\c:\xxxfxrr.exec:\xxxfxrr.exe123⤵PID:1480
-
\??\c:\hbbbbb.exec:\hbbbbb.exe124⤵PID:4532
-
\??\c:\7jjdv.exec:\7jjdv.exe125⤵PID:4932
-
\??\c:\rllfxxf.exec:\rllfxxf.exe126⤵PID:3048
-
\??\c:\5lrlffx.exec:\5lrlffx.exe127⤵PID:3444
-
\??\c:\bhbhbt.exec:\bhbhbt.exe128⤵PID:1820
-
\??\c:\jjjjj.exec:\jjjjj.exe129⤵PID:2288
-
\??\c:\vvpjv.exec:\vvpjv.exe130⤵PID:3080
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe131⤵PID:3720
-
\??\c:\5lxxxfx.exec:\5lxxxfx.exe132⤵PID:368
-
\??\c:\3tbttt.exec:\3tbttt.exe133⤵PID:5016
-
\??\c:\nntthh.exec:\nntthh.exe134⤵PID:4792
-
\??\c:\vvjjv.exec:\vvjjv.exe135⤵PID:732
-
\??\c:\7ffxrrl.exec:\7ffxrrl.exe136⤵PID:1908
-
\??\c:\nttttb.exec:\nttttb.exe137⤵PID:2564
-
\??\c:\5bnnhb.exec:\5bnnhb.exe138⤵PID:316
-
\??\c:\vpjjj.exec:\vpjjj.exe139⤵PID:2992
-
\??\c:\1jpjj.exec:\1jpjj.exe140⤵PID:2056
-
\??\c:\flrrffx.exec:\flrrffx.exe141⤵PID:2088
-
\??\c:\lfxxlrl.exec:\lfxxlrl.exe142⤵PID:1944
-
\??\c:\nthbnh.exec:\nthbnh.exe143⤵PID:3260
-
\??\c:\5pjvv.exec:\5pjvv.exe144⤵PID:4112
-
\??\c:\xlfxflx.exec:\xlfxflx.exe145⤵PID:3612
-
\??\c:\rrlfrfr.exec:\rrlfrfr.exe146⤵PID:696
-
\??\c:\btbbbt.exec:\btbbbt.exe147⤵PID:2312
-
\??\c:\jvpdj.exec:\jvpdj.exe148⤵PID:1660
-
\??\c:\9vvjv.exec:\9vvjv.exe149⤵PID:2068
-
\??\c:\lrrrrlf.exec:\lrrrrlf.exe150⤵PID:896
-
\??\c:\hbhbtn.exec:\hbhbtn.exe151⤵PID:5076
-
\??\c:\hhttnn.exec:\hhttnn.exe152⤵PID:1612
-
\??\c:\9dddv.exec:\9dddv.exe153⤵PID:3676
-
\??\c:\ppdjd.exec:\ppdjd.exe154⤵PID:4264
-
\??\c:\ffflfrr.exec:\ffflfrr.exe155⤵PID:440
-
\??\c:\tbttnt.exec:\tbttnt.exe156⤵PID:4648
-
\??\c:\vjjvv.exec:\vjjvv.exe157⤵PID:4764
-
\??\c:\xxxrrrx.exec:\xxxrrrx.exe158⤵PID:1476
-
\??\c:\5jjjd.exec:\5jjjd.exe159⤵PID:3500
-
\??\c:\7flxrrf.exec:\7flxrrf.exe160⤵PID:4048
-
\??\c:\3xlxlfx.exec:\3xlxlfx.exe161⤵PID:3648
-
\??\c:\hhtbth.exec:\hhtbth.exe162⤵PID:4040
-
\??\c:\7pjjd.exec:\7pjjd.exe163⤵PID:5024
-
\??\c:\rlrflfx.exec:\rlrflfx.exe164⤵PID:4080
-
\??\c:\3htnhh.exec:\3htnhh.exe165⤵PID:1796
-
\??\c:\nbtbnn.exec:\nbtbnn.exe166⤵PID:1676
-
\??\c:\bthhhn.exec:\bthhhn.exe167⤵PID:5112
-
\??\c:\jvddp.exec:\jvddp.exe168⤵PID:1992
-
\??\c:\fflfxrf.exec:\fflfxrf.exe169⤵PID:3204
-
\??\c:\hnhbnh.exec:\hnhbnh.exe170⤵PID:4640
-
\??\c:\7nnnbb.exec:\7nnnbb.exe171⤵PID:2756
-
\??\c:\7dvdv.exec:\7dvdv.exe172⤵PID:1956
-
\??\c:\rlrlllf.exec:\rlrlllf.exe173⤵PID:3248
-
\??\c:\rxrllfx.exec:\rxrllfx.exe174⤵PID:3084
-
\??\c:\hbtnbb.exec:\hbtnbb.exe175⤵PID:4448
-
\??\c:\jdjdv.exec:\jdjdv.exe176⤵PID:32
-
\??\c:\jjpdv.exec:\jjpdv.exe177⤵PID:4892
-
\??\c:\xlxrlll.exec:\xlxrlll.exe178⤵PID:4332
-
\??\c:\lxlllll.exec:\lxlllll.exe179⤵PID:1836
-
\??\c:\hbbntb.exec:\hbbntb.exe180⤵PID:3912
-
\??\c:\tthhbh.exec:\tthhbh.exe181⤵PID:3344
-
\??\c:\jvvvp.exec:\jvvvp.exe182⤵PID:4236
-
\??\c:\vvvpj.exec:\vvvpj.exe183⤵PID:3564
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe184⤵PID:2880
-
\??\c:\btnhnn.exec:\btnhnn.exe185⤵PID:1592
-
\??\c:\3hhtbn.exec:\3hhtbn.exe186⤵PID:2352
-
\??\c:\dvddv.exec:\dvddv.exe187⤵PID:3716
-
\??\c:\vpjvj.exec:\vpjvj.exe188⤵PID:1312
-
\??\c:\fxxlfrf.exec:\fxxlfrf.exe189⤵PID:1728
-
\??\c:\9ffxffl.exec:\9ffxffl.exe190⤵PID:5044
-
\??\c:\3bhhbb.exec:\3bhhbb.exe191⤵PID:5080
-
\??\c:\thbbtt.exec:\thbbtt.exe192⤵PID:1420
-
\??\c:\pdpjv.exec:\pdpjv.exe193⤵PID:4576
-
\??\c:\djvvv.exec:\djvvv.exe194⤵PID:3952
-
\??\c:\9rxrlll.exec:\9rxrlll.exe195⤵PID:1884
-
\??\c:\fflxfxf.exec:\fflxfxf.exe196⤵PID:1048
-
\??\c:\llxxffl.exec:\llxxffl.exe197⤵PID:3164
-
\??\c:\nbthbh.exec:\nbthbh.exe198⤵PID:4428
-
\??\c:\hbbttt.exec:\hbbttt.exe199⤵PID:4764
-
\??\c:\vpddp.exec:\vpddp.exe200⤵PID:4888
-
\??\c:\3ppjj.exec:\3ppjj.exe201⤵PID:3500
-
\??\c:\9xfrfff.exec:\9xfrfff.exe202⤵PID:4484
-
\??\c:\nbbbbb.exec:\nbbbbb.exe203⤵PID:1696
-
\??\c:\9nthbh.exec:\9nthbh.exe204⤵PID:668
-
\??\c:\pvdvd.exec:\pvdvd.exe205⤵PID:3648
-
\??\c:\vppjd.exec:\vppjd.exe206⤵PID:4660
-
\??\c:\rxllxxx.exec:\rxllxxx.exe207⤵PID:1796
-
\??\c:\rxfxxxl.exec:\rxfxxxl.exe208⤵PID:2120
-
\??\c:\nhbhtb.exec:\nhbhtb.exe209⤵PID:3048
-
\??\c:\3hhhbh.exec:\3hhhbh.exe210⤵PID:2712
-
\??\c:\pdddj.exec:\pdddj.exe211⤵PID:2028
-
\??\c:\pjpdv.exec:\pjpdv.exe212⤵PID:3120
-
\??\c:\5xxxrll.exec:\5xxxrll.exe213⤵PID:3880
-
\??\c:\hhtbnn.exec:\hhtbnn.exe214⤵PID:1956
-
\??\c:\btnhnn.exec:\btnhnn.exe215⤵PID:368
-
\??\c:\vvpjd.exec:\vvpjd.exe216⤵PID:2532
-
\??\c:\rrrlxfx.exec:\rrrlxfx.exe217⤵PID:680
-
\??\c:\7xfrfxr.exec:\7xfrfxr.exe218⤵PID:4320
-
\??\c:\btnhtn.exec:\btnhtn.exe219⤵PID:2012
-
\??\c:\btbtnn.exec:\btbtnn.exe220⤵PID:3360
-
\??\c:\vpvvv.exec:\vpvvv.exe221⤵PID:2488
-
\??\c:\vvddj.exec:\vvddj.exe222⤵PID:3124
-
\??\c:\xxxrrfr.exec:\xxxrrfr.exe223⤵PID:3384
-
\??\c:\hhnhbt.exec:\hhnhbt.exe224⤵PID:1136
-
\??\c:\3tnbhh.exec:\3tnbhh.exe225⤵PID:3356
-
\??\c:\pvvpj.exec:\pvvpj.exe226⤵PID:4292
-
\??\c:\bnnhtt.exec:\bnnhtt.exe227⤵PID:4388
-
\??\c:\dvvvv.exec:\dvvvv.exe228⤵PID:2352
-
\??\c:\xlxxxrx.exec:\xlxxxrx.exe229⤵PID:3716
-
\??\c:\nnthbh.exec:\nnthbh.exe230⤵PID:1312
-
\??\c:\3pjdp.exec:\3pjdp.exe231⤵PID:1528
-
\??\c:\pvdvj.exec:\pvdvj.exe232⤵PID:2068
-
\??\c:\llflrxf.exec:\llflrxf.exe233⤵PID:3812
-
\??\c:\nhbthh.exec:\nhbthh.exe234⤵PID:3264
-
\??\c:\1nbttt.exec:\1nbttt.exe235⤵PID:4576
-
\??\c:\1pjvj.exec:\1pjvj.exe236⤵PID:3952
-
\??\c:\vppdp.exec:\vppdp.exe237⤵PID:3292
-
\??\c:\ffxrllf.exec:\ffxrllf.exe238⤵PID:4856
-
\??\c:\xlffxrl.exec:\xlffxrl.exe239⤵PID:5116
-
\??\c:\bhtttb.exec:\bhtttb.exe240⤵PID:2396
-
\??\c:\nnbttn.exec:\nnbttn.exe241⤵PID:4504
-
\??\c:\jjdpd.exec:\jjdpd.exe242⤵PID:2800