Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:04
Behavioral task
behavioral1
Sample
00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe
-
Size
367KB
-
MD5
00ef95e7d5e0bd337ebda82c1ca86eb0
-
SHA1
70374c73eac83d4c58189af94602723a260b58ac
-
SHA256
73ca80b9871f87a5e05a6a444d75debdbb3b6f4b7752e694c794df11baf49684
-
SHA512
cf9a4c30e4fc85cecb58e4c5118def966a2742bc18327fbe593f2abcf658f47a104a107df3b834316b8b5a94d7cb8085f129ea7bf8150a24549195f753882f80
-
SSDEEP
6144:9cm4FmowdHoSdSyEAxyx/ZrTTr4qIMgE81:/4wFHoSQuxy3rTXIM181
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3148-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1092-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/604-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1372-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1880-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2432-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2940-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1084-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-532-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-794-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-834-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjvpv.exenbnbbh.exepdjvp.exentbnhb.exebtbbbb.exe5jjdd.exexlxrlll.exejvjvd.exerlrlxrl.exevjjjd.exenhhtnt.exehhhbbb.exedvvpj.exebtbtnn.exedvjdv.exexlllfff.exevppjd.exe9rrlfxf.exe3hhbtt.exerllxflr.exe9pvpp.exelrxlffr.exenhnnnt.exepjppp.exejvjvp.exe5ffrflx.exebhntnb.exebnhbbb.exevjppv.exefxrrrxx.exenthnnh.exevjjpd.exe9hnnhh.exedvddv.exennbntb.exeddjdd.exerrrrrrr.exennhhnt.exedvvpp.exellrrxxf.exenbtttt.exebtbtbb.exeffrrrll.exenhtnnh.exe7jppp.exethhbbb.exejvvjv.exefrlfxfr.exennbntb.exe3jjjp.exe7djjj.exeffrrrll.exe1nnntb.exevpdvv.exexlrxxrx.exethnnth.exe3pvvp.exelfllflf.exevppvv.exetnhhbh.exejdppv.exe1llllrf.exebthntt.exejvdpv.exepid process 5064 pjvpv.exe 4396 nbnbbh.exe 2900 pdjvp.exe 604 ntbnhb.exe 4296 btbbbb.exe 1092 5jjdd.exe 1664 xlxrlll.exe 1556 jvjvd.exe 1564 rlrlxrl.exe 1372 vjjjd.exe 1548 nhhtnt.exe 4404 hhhbbb.exe 2632 dvvpj.exe 3424 btbtnn.exe 2428 dvjdv.exe 4852 xlllfff.exe 4920 vppjd.exe 1584 9rrlfxf.exe 1088 3hhbtt.exe 4912 rllxflr.exe 3272 9pvpp.exe 4412 lrxlffr.exe 5056 nhnnnt.exe 2036 pjppp.exe 2256 jvjvp.exe 4756 5ffrflx.exe 3264 bhntnb.exe 1880 bnhbbb.exe 4872 vjppv.exe 1696 fxrrrxx.exe 2432 nthnnh.exe 1352 vjjpd.exe 4464 9hnnhh.exe 4536 dvddv.exe 1720 nnbntb.exe 4744 ddjdd.exe 4656 rrrrrrr.exe 3992 nnhhnt.exe 3020 dvvpp.exe 4432 llrrxxf.exe 2272 nbtttt.exe 4384 btbtbb.exe 2180 ffrrrll.exe 884 nhtnnh.exe 2940 7jppp.exe 1580 thhbbb.exe 4296 jvvjv.exe 3936 frlfxfr.exe 4360 nnbntb.exe 396 3jjjp.exe 4344 7djjj.exe 4420 ffrrrll.exe 4416 1nnntb.exe 3932 vpdvv.exe 1936 xlrxxrx.exe 3440 thnnth.exe 1096 3pvvp.exe 1820 lfllflf.exe 4980 vppvv.exe 2632 tnhhbh.exe 2764 jdppv.exe 2428 1llllrf.exe 2868 bthntt.exe 5096 jvdpv.exe -
Processes:
resource yara_rule behavioral2/memory/3148-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvpv.exe upx behavioral2/memory/3148-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5064-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbnbbh.exe upx behavioral2/memory/4396-13-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjvp.exe upx behavioral2/memory/2900-20-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ntbnhb.exe upx behavioral2/memory/4296-31-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btbbbb.exe upx \??\c:\5jjdd.exe upx behavioral2/memory/1092-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxrlll.exe upx behavioral2/memory/1664-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/604-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvjvd.exe upx C:\rlrlxrl.exe upx behavioral2/memory/1556-52-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjjjd.exe upx behavioral2/memory/1372-59-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhhtnt.exe upx behavioral2/memory/1372-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhbbb.exe upx behavioral2/memory/4404-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvpj.exe upx C:\btbtnn.exe upx behavioral2/memory/3424-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjdv.exe upx behavioral2/memory/2428-89-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xlllfff.exe upx behavioral2/memory/4852-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppjd.exe upx C:\9rrlfxf.exe upx behavioral2/memory/4920-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3hhbtt.exe upx \??\c:\rllxflr.exe upx C:\9pvpp.exe upx C:\lrxlffr.exe upx behavioral2/memory/4912-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4412-129-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhnnnt.exe upx \??\c:\pjppp.exe upx behavioral2/memory/2036-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvjvp.exe upx behavioral2/memory/2036-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ffrflx.exe upx \??\c:\bhntnb.exe upx behavioral2/memory/4756-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2256-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3264-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnhbbb.exe upx C:\vjppv.exe upx behavioral2/memory/1880-170-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxrrrxx.exe upx \??\c:\nthnnh.exe upx behavioral2/memory/2432-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1696-175-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjjpd.exe upx behavioral2/memory/4464-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4536-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4656-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3992-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3020-215-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exepjvpv.exenbnbbh.exepdjvp.exentbnhb.exebtbbbb.exe5jjdd.exexlxrlll.exejvjvd.exerlrlxrl.exevjjjd.exenhhtnt.exehhhbbb.exedvvpj.exebtbtnn.exedvjdv.exexlllfff.exevppjd.exe9rrlfxf.exe3hhbtt.exerllxflr.exe9pvpp.exedescription pid process target process PID 3148 wrote to memory of 5064 3148 00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe pjvpv.exe PID 3148 wrote to memory of 5064 3148 00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe pjvpv.exe PID 3148 wrote to memory of 5064 3148 00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe pjvpv.exe PID 5064 wrote to memory of 4396 5064 pjvpv.exe nbnbbh.exe PID 5064 wrote to memory of 4396 5064 pjvpv.exe nbnbbh.exe PID 5064 wrote to memory of 4396 5064 pjvpv.exe nbnbbh.exe PID 4396 wrote to memory of 2900 4396 nbnbbh.exe pdjvp.exe PID 4396 wrote to memory of 2900 4396 nbnbbh.exe pdjvp.exe PID 4396 wrote to memory of 2900 4396 nbnbbh.exe pdjvp.exe PID 2900 wrote to memory of 604 2900 pdjvp.exe ntbnhb.exe PID 2900 wrote to memory of 604 2900 pdjvp.exe ntbnhb.exe PID 2900 wrote to memory of 604 2900 pdjvp.exe ntbnhb.exe PID 604 wrote to memory of 4296 604 ntbnhb.exe btbbbb.exe PID 604 wrote to memory of 4296 604 ntbnhb.exe btbbbb.exe PID 604 wrote to memory of 4296 604 ntbnhb.exe btbbbb.exe PID 4296 wrote to memory of 1092 4296 btbbbb.exe 5jjdd.exe PID 4296 wrote to memory of 1092 4296 btbbbb.exe 5jjdd.exe PID 4296 wrote to memory of 1092 4296 btbbbb.exe 5jjdd.exe PID 1092 wrote to memory of 1664 1092 5jjdd.exe xlxrlll.exe PID 1092 wrote to memory of 1664 1092 5jjdd.exe xlxrlll.exe PID 1092 wrote to memory of 1664 1092 5jjdd.exe xlxrlll.exe PID 1664 wrote to memory of 1556 1664 xlxrlll.exe jvjvd.exe PID 1664 wrote to memory of 1556 1664 xlxrlll.exe jvjvd.exe PID 1664 wrote to memory of 1556 1664 xlxrlll.exe jvjvd.exe PID 1556 wrote to memory of 1564 1556 jvjvd.exe rlrlxrl.exe PID 1556 wrote to memory of 1564 1556 jvjvd.exe rlrlxrl.exe PID 1556 wrote to memory of 1564 1556 jvjvd.exe rlrlxrl.exe PID 1564 wrote to memory of 1372 1564 rlrlxrl.exe vjjjd.exe PID 1564 wrote to memory of 1372 1564 rlrlxrl.exe vjjjd.exe PID 1564 wrote to memory of 1372 1564 rlrlxrl.exe vjjjd.exe PID 1372 wrote to memory of 1548 1372 vjjjd.exe nhhtnt.exe PID 1372 wrote to memory of 1548 1372 vjjjd.exe nhhtnt.exe PID 1372 wrote to memory of 1548 1372 vjjjd.exe nhhtnt.exe PID 1548 wrote to memory of 4404 1548 nhhtnt.exe hhhbbb.exe PID 1548 wrote to memory of 4404 1548 nhhtnt.exe hhhbbb.exe PID 1548 wrote to memory of 4404 1548 nhhtnt.exe hhhbbb.exe PID 4404 wrote to memory of 2632 4404 hhhbbb.exe dvvpj.exe PID 4404 wrote to memory of 2632 4404 hhhbbb.exe dvvpj.exe PID 4404 wrote to memory of 2632 4404 hhhbbb.exe dvvpj.exe PID 2632 wrote to memory of 3424 2632 dvvpj.exe btbtnn.exe PID 2632 wrote to memory of 3424 2632 dvvpj.exe btbtnn.exe PID 2632 wrote to memory of 3424 2632 dvvpj.exe btbtnn.exe PID 3424 wrote to memory of 2428 3424 btbtnn.exe dvjdv.exe PID 3424 wrote to memory of 2428 3424 btbtnn.exe dvjdv.exe PID 3424 wrote to memory of 2428 3424 btbtnn.exe dvjdv.exe PID 2428 wrote to memory of 4852 2428 dvjdv.exe xlllfff.exe PID 2428 wrote to memory of 4852 2428 dvjdv.exe xlllfff.exe PID 2428 wrote to memory of 4852 2428 dvjdv.exe xlllfff.exe PID 4852 wrote to memory of 4920 4852 xlllfff.exe vppjd.exe PID 4852 wrote to memory of 4920 4852 xlllfff.exe vppjd.exe PID 4852 wrote to memory of 4920 4852 xlllfff.exe vppjd.exe PID 4920 wrote to memory of 1584 4920 vppjd.exe 9rrlfxf.exe PID 4920 wrote to memory of 1584 4920 vppjd.exe 9rrlfxf.exe PID 4920 wrote to memory of 1584 4920 vppjd.exe 9rrlfxf.exe PID 1584 wrote to memory of 1088 1584 9rrlfxf.exe 3hhbtt.exe PID 1584 wrote to memory of 1088 1584 9rrlfxf.exe 3hhbtt.exe PID 1584 wrote to memory of 1088 1584 9rrlfxf.exe 3hhbtt.exe PID 1088 wrote to memory of 4912 1088 3hhbtt.exe rllxflr.exe PID 1088 wrote to memory of 4912 1088 3hhbtt.exe rllxflr.exe PID 1088 wrote to memory of 4912 1088 3hhbtt.exe rllxflr.exe PID 4912 wrote to memory of 3272 4912 rllxflr.exe 9pvpp.exe PID 4912 wrote to memory of 3272 4912 rllxflr.exe 9pvpp.exe PID 4912 wrote to memory of 3272 4912 rllxflr.exe 9pvpp.exe PID 3272 wrote to memory of 4412 3272 9pvpp.exe lrxlffr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\pjvpv.exec:\pjvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\nbnbbh.exec:\nbnbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\pdjvp.exec:\pdjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\ntbnhb.exec:\ntbnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\btbbbb.exec:\btbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\5jjdd.exec:\5jjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\xlxrlll.exec:\xlxrlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\jvjvd.exec:\jvjvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\rlrlxrl.exec:\rlrlxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\vjjjd.exec:\vjjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\nhhtnt.exec:\nhhtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\hhhbbb.exec:\hhhbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\dvvpj.exec:\dvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\btbtnn.exec:\btbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\dvjdv.exec:\dvjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\xlllfff.exec:\xlllfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\vppjd.exec:\vppjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\9rrlfxf.exec:\9rrlfxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\3hhbtt.exec:\3hhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\rllxflr.exec:\rllxflr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\9pvpp.exec:\9pvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\lrxlffr.exec:\lrxlffr.exe23⤵
- Executes dropped EXE
PID:4412 -
\??\c:\nhnnnt.exec:\nhnnnt.exe24⤵
- Executes dropped EXE
PID:5056 -
\??\c:\pjppp.exec:\pjppp.exe25⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jvjvp.exec:\jvjvp.exe26⤵
- Executes dropped EXE
PID:2256 -
\??\c:\5ffrflx.exec:\5ffrflx.exe27⤵
- Executes dropped EXE
PID:4756 -
\??\c:\bhntnb.exec:\bhntnb.exe28⤵
- Executes dropped EXE
PID:3264 -
\??\c:\bnhbbb.exec:\bnhbbb.exe29⤵
- Executes dropped EXE
PID:1880 -
\??\c:\vjppv.exec:\vjppv.exe30⤵
- Executes dropped EXE
PID:4872 -
\??\c:\fxrrrxx.exec:\fxrrrxx.exe31⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nthnnh.exec:\nthnnh.exe32⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vjjpd.exec:\vjjpd.exe33⤵
- Executes dropped EXE
PID:1352 -
\??\c:\9hnnhh.exec:\9hnnhh.exe34⤵
- Executes dropped EXE
PID:4464 -
\??\c:\dvddv.exec:\dvddv.exe35⤵
- Executes dropped EXE
PID:4536 -
\??\c:\nnbntb.exec:\nnbntb.exe36⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ddjdd.exec:\ddjdd.exe37⤵
- Executes dropped EXE
PID:4744 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe38⤵
- Executes dropped EXE
PID:4656 -
\??\c:\nnhhnt.exec:\nnhhnt.exe39⤵
- Executes dropped EXE
PID:3992 -
\??\c:\dvvpp.exec:\dvvpp.exe40⤵
- Executes dropped EXE
PID:3020 -
\??\c:\llrrxxf.exec:\llrrxxf.exe41⤵
- Executes dropped EXE
PID:4432 -
\??\c:\nbtttt.exec:\nbtttt.exe42⤵
- Executes dropped EXE
PID:2272 -
\??\c:\btbtbb.exec:\btbtbb.exe43⤵
- Executes dropped EXE
PID:4384 -
\??\c:\ffrrrll.exec:\ffrrrll.exe44⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nhtnnh.exec:\nhtnnh.exe45⤵
- Executes dropped EXE
PID:884 -
\??\c:\7jppp.exec:\7jppp.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\thhbbb.exec:\thhbbb.exe47⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jvvjv.exec:\jvvjv.exe48⤵
- Executes dropped EXE
PID:4296 -
\??\c:\frlfxfr.exec:\frlfxfr.exe49⤵
- Executes dropped EXE
PID:3936 -
\??\c:\nnbntb.exec:\nnbntb.exe50⤵
- Executes dropped EXE
PID:4360 -
\??\c:\3jjjp.exec:\3jjjp.exe51⤵
- Executes dropped EXE
PID:396 -
\??\c:\7djjj.exec:\7djjj.exe52⤵
- Executes dropped EXE
PID:4344 -
\??\c:\ffrrrll.exec:\ffrrrll.exe53⤵
- Executes dropped EXE
PID:4420 -
\??\c:\1nnntb.exec:\1nnntb.exe54⤵
- Executes dropped EXE
PID:4416 -
\??\c:\vpdvv.exec:\vpdvv.exe55⤵
- Executes dropped EXE
PID:3932 -
\??\c:\xlrxxrx.exec:\xlrxxrx.exe56⤵
- Executes dropped EXE
PID:1936 -
\??\c:\thnnth.exec:\thnnth.exe57⤵
- Executes dropped EXE
PID:3440 -
\??\c:\3pvvp.exec:\3pvvp.exe58⤵
- Executes dropped EXE
PID:1096 -
\??\c:\lfllflf.exec:\lfllflf.exe59⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vppvv.exec:\vppvv.exe60⤵
- Executes dropped EXE
PID:4980 -
\??\c:\tnhhbh.exec:\tnhhbh.exe61⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jdppv.exec:\jdppv.exe62⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1llllrf.exec:\1llllrf.exe63⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bthntt.exec:\bthntt.exe64⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jvdpv.exec:\jvdpv.exe65⤵
- Executes dropped EXE
PID:5096 -
\??\c:\lfrrfff.exec:\lfrrfff.exe66⤵PID:4920
-
\??\c:\bnthht.exec:\bnthht.exe67⤵PID:1136
-
\??\c:\jjvpj.exec:\jjvpj.exe68⤵PID:8
-
\??\c:\lxxlxlf.exec:\lxxlxlf.exe69⤵PID:2336
-
\??\c:\bnnhtn.exec:\bnnhtn.exe70⤵PID:4468
-
\??\c:\vpjdv.exec:\vpjdv.exe71⤵PID:5084
-
\??\c:\vjvpv.exec:\vjvpv.exe72⤵PID:692
-
\??\c:\ttthtt.exec:\ttthtt.exe73⤵PID:4632
-
\??\c:\jpdjj.exec:\jpdjj.exe74⤵PID:3080
-
\??\c:\hhnhhb.exec:\hhnhhb.exe75⤵PID:1992
-
\??\c:\btnbth.exec:\btnbth.exe76⤵PID:1172
-
\??\c:\7pvvd.exec:\7pvvd.exe77⤵PID:3004
-
\??\c:\fxfxlfx.exec:\fxfxlfx.exe78⤵PID:4144
-
\??\c:\hntnht.exec:\hntnht.exe79⤵PID:4860
-
\??\c:\vjpjj.exec:\vjpjj.exe80⤵PID:1880
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe81⤵PID:1376
-
\??\c:\btbbbb.exec:\btbbbb.exe82⤵PID:4552
-
\??\c:\5jvvp.exec:\5jvvp.exe83⤵PID:2164
-
\??\c:\lxflflx.exec:\lxflflx.exe84⤵PID:2740
-
\??\c:\ttbbhb.exec:\ttbbhb.exe85⤵PID:4988
-
\??\c:\jvjjd.exec:\jvjjd.exe86⤵PID:4440
-
\??\c:\xxlfxrx.exec:\xxlfxrx.exe87⤵PID:3852
-
\??\c:\bthbbb.exec:\bthbbb.exe88⤵PID:1224
-
\??\c:\5pddv.exec:\5pddv.exe89⤵PID:3008
-
\??\c:\3vdvp.exec:\3vdvp.exe90⤵PID:3020
-
\??\c:\5fxrrrl.exec:\5fxrrrl.exe91⤵PID:888
-
\??\c:\9nnhbb.exec:\9nnhbb.exe92⤵PID:5064
-
\??\c:\pvvdj.exec:\pvvdj.exe93⤵PID:2944
-
\??\c:\rrxlxfr.exec:\rrxlxfr.exe94⤵PID:884
-
\??\c:\hhhbtn.exec:\hhhbtn.exe95⤵PID:3648
-
\??\c:\bhtbtb.exec:\bhtbtb.exe96⤵PID:1580
-
\??\c:\vdddv.exec:\vdddv.exe97⤵PID:4296
-
\??\c:\xffxxfx.exec:\xffxxfx.exe98⤵PID:3936
-
\??\c:\hnnhbt.exec:\hnnhbt.exe99⤵PID:2400
-
\??\c:\1dppj.exec:\1dppj.exe100⤵PID:2484
-
\??\c:\pdddd.exec:\pdddd.exe101⤵PID:1084
-
\??\c:\llfxxxx.exec:\llfxxxx.exe102⤵PID:3864
-
\??\c:\nbhhbb.exec:\nbhhbb.exe103⤵PID:4416
-
\??\c:\bnhbbn.exec:\bnhbbn.exe104⤵PID:2004
-
\??\c:\dvdvd.exec:\dvdvd.exe105⤵PID:2692
-
\??\c:\7xxxxxx.exec:\7xxxxxx.exe106⤵PID:3524
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe107⤵PID:3728
-
\??\c:\nnbhhn.exec:\nnbhhn.exe108⤵PID:3304
-
\??\c:\djjjj.exec:\djjjj.exe109⤵PID:1944
-
\??\c:\djjpv.exec:\djjpv.exe110⤵PID:1816
-
\??\c:\7lrrxrx.exec:\7lrrxrx.exe111⤵PID:2596
-
\??\c:\thtttb.exec:\thtttb.exe112⤵PID:1788
-
\??\c:\9vvdd.exec:\9vvdd.exe113⤵PID:1520
-
\??\c:\ddpvj.exec:\ddpvj.exe114⤵PID:2960
-
\??\c:\ffrflfl.exec:\ffrflfl.exe115⤵PID:4548
-
\??\c:\bbnhhh.exec:\bbnhhh.exe116⤵PID:3544
-
\??\c:\jvvpj.exec:\jvvpj.exe117⤵PID:4468
-
\??\c:\xlxfrlx.exec:\xlxfrlx.exe118⤵PID:4736
-
\??\c:\bbnnhh.exec:\bbnnhh.exe119⤵PID:5056
-
\??\c:\tnbttt.exec:\tnbttt.exe120⤵PID:3572
-
\??\c:\vddvp.exec:\vddvp.exe121⤵PID:3252
-
\??\c:\llllffx.exec:\llllffx.exe122⤵PID:1728
-
\??\c:\9ffxrxr.exec:\9ffxrxr.exe123⤵PID:2688
-
\??\c:\nnnhhb.exec:\nnnhhb.exe124⤵PID:4860
-
\??\c:\9djjv.exec:\9djjv.exe125⤵PID:3152
-
\??\c:\xrlxffr.exec:\xrlxffr.exe126⤵PID:1376
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe127⤵PID:2572
-
\??\c:\thbtbn.exec:\thbtbn.exe128⤵PID:3288
-
\??\c:\dvpdj.exec:\dvpdj.exe129⤵PID:5080
-
\??\c:\xfxfxxx.exec:\xfxfxxx.exe130⤵PID:4520
-
\??\c:\bbhbbb.exec:\bbhbbb.exe131⤵PID:4048
-
\??\c:\jpvvv.exec:\jpvvv.exe132⤵PID:3556
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe133⤵PID:208
-
\??\c:\1nttnt.exec:\1nttnt.exe134⤵PID:5068
-
\??\c:\vvddj.exec:\vvddj.exe135⤵PID:1432
-
\??\c:\rffrlfl.exec:\rffrlfl.exe136⤵PID:2272
-
\??\c:\nnhhhh.exec:\nnhhhh.exe137⤵PID:4300
-
\??\c:\bbtnhn.exec:\bbtnhn.exe138⤵PID:4076
-
\??\c:\vvddp.exec:\vvddp.exe139⤵PID:2940
-
\??\c:\tntbbb.exec:\tntbbb.exe140⤵PID:604
-
\??\c:\jjddp.exec:\jjddp.exe141⤵PID:516
-
\??\c:\nbnntb.exec:\nbnntb.exe142⤵PID:3448
-
\??\c:\thbbnn.exec:\thbbnn.exe143⤵PID:3708
-
\??\c:\vjvjd.exec:\vjvjd.exe144⤵PID:4276
-
\??\c:\rrlrffl.exec:\rrlrffl.exe145⤵PID:2808
-
\??\c:\1tnnbn.exec:\1tnnbn.exe146⤵PID:2280
-
\??\c:\ddppv.exec:\ddppv.exe147⤵PID:1084
-
\??\c:\xrxllxx.exec:\xrxllxx.exe148⤵PID:3864
-
\??\c:\hbtthh.exec:\hbtthh.exe149⤵PID:3932
-
\??\c:\1tbbhn.exec:\1tbbhn.exe150⤵PID:2004
-
\??\c:\ddppd.exec:\ddppd.exe151⤵PID:2692
-
\??\c:\lxrrxff.exec:\lxrrxff.exe152⤵PID:836
-
\??\c:\ttbbnt.exec:\ttbbnt.exe153⤵PID:5104
-
\??\c:\hhhhht.exec:\hhhhht.exe154⤵PID:760
-
\??\c:\jvjjv.exec:\jvjjv.exe155⤵PID:3520
-
\??\c:\rxxrrxr.exec:\rxxrrxr.exe156⤵PID:1416
-
\??\c:\hbhnhh.exec:\hbhnhh.exe157⤵PID:4852
-
\??\c:\ppppv.exec:\ppppv.exe158⤵PID:1520
-
\??\c:\ddjjd.exec:\ddjjd.exe159⤵PID:4752
-
\??\c:\xfxxffl.exec:\xfxxffl.exe160⤵PID:3272
-
\??\c:\nhnnhh.exec:\nhnnhh.exe161⤵PID:4652
-
\??\c:\ttbbtt.exec:\ttbbtt.exe162⤵PID:4412
-
\??\c:\ddppj.exec:\ddppj.exe163⤵PID:3984
-
\??\c:\rrfflxx.exec:\rrfflxx.exe164⤵PID:3260
-
\??\c:\lrllxfx.exec:\lrllxfx.exe165⤵PID:4612
-
\??\c:\5hbthb.exec:\5hbthb.exe166⤵PID:1172
-
\??\c:\dvjvj.exec:\dvjvj.exe167⤵PID:4272
-
\??\c:\xrllrrf.exec:\xrllrrf.exe168⤵PID:4872
-
\??\c:\xflfffr.exec:\xflfffr.exe169⤵PID:4892
-
\??\c:\hbbttt.exec:\hbbttt.exe170⤵PID:4020
-
\??\c:\vpvpj.exec:\vpvpj.exe171⤵PID:4552
-
\??\c:\vpvpj.exec:\vpvpj.exe172⤵PID:3480
-
\??\c:\xlfrrff.exec:\xlfrrff.exe173⤵PID:4816
-
\??\c:\hhnhbb.exec:\hhnhbb.exe174⤵PID:1720
-
\??\c:\ddjdv.exec:\ddjdv.exe175⤵PID:3996
-
\??\c:\frrlxxr.exec:\frrlxxr.exe176⤵PID:3556
-
\??\c:\bbbbbh.exec:\bbbbbh.exe177⤵PID:4432
-
\??\c:\djpdp.exec:\djpdp.exe178⤵PID:4820
-
\??\c:\7jvdv.exec:\7jvdv.exe179⤵PID:2180
-
\??\c:\ffxlllr.exec:\ffxlllr.exe180⤵PID:2288
-
\??\c:\hbhbtt.exec:\hbhbtt.exe181⤵PID:2944
-
\??\c:\vddvj.exec:\vddvj.exe182⤵PID:3268
-
\??\c:\fllxfxr.exec:\fllxfxr.exe183⤵PID:3196
-
\??\c:\bnnnbh.exec:\bnnnbh.exe184⤵PID:1580
-
\??\c:\tbhhnn.exec:\tbhhnn.exe185⤵PID:1448
-
\??\c:\jpdvv.exec:\jpdvv.exe186⤵PID:3328
-
\??\c:\frllrlx.exec:\frllrlx.exe187⤵PID:4052
-
\??\c:\5nttnt.exec:\5nttnt.exe188⤵PID:3116
-
\??\c:\7ntnhh.exec:\7ntnhh.exe189⤵PID:1704
-
\??\c:\ppjdj.exec:\ppjdj.exe190⤵PID:5012
-
\??\c:\rlrrfxr.exec:\rlrrfxr.exe191⤵PID:4416
-
\??\c:\7rrrrxl.exec:\7rrrrxl.exe192⤵PID:3864
-
\??\c:\nbbbbn.exec:\nbbbbn.exe193⤵PID:1548
-
\??\c:\ddddp.exec:\ddddp.exe194⤵PID:2004
-
\??\c:\xrflxrr.exec:\xrflxrr.exe195⤵PID:3088
-
\??\c:\9rxxxrx.exec:\9rxxxrx.exe196⤵PID:836
-
\??\c:\bbnhhn.exec:\bbnhhn.exe197⤵PID:1856
-
\??\c:\7vddd.exec:\7vddd.exe198⤵PID:760
-
\??\c:\ppjjv.exec:\ppjjv.exe199⤵PID:2596
-
\??\c:\frfllrx.exec:\frfllrx.exe200⤵PID:4852
-
\??\c:\ttbbbb.exec:\ttbbbb.exe201⤵PID:4376
-
\??\c:\nhtbbh.exec:\nhtbbh.exe202⤵PID:4752
-
\??\c:\jvvvv.exec:\jvvvv.exe203⤵PID:1360
-
\??\c:\lfrfxfx.exec:\lfrfxfx.exe204⤵PID:4028
-
\??\c:\hbbhht.exec:\hbbhht.exe205⤵PID:4484
-
\??\c:\7vjdd.exec:\7vjdd.exe206⤵PID:3984
-
\??\c:\9jddj.exec:\9jddj.exe207⤵PID:3260
-
\??\c:\nhnbbt.exec:\nhnbbt.exe208⤵PID:4768
-
\??\c:\dpvdv.exec:\dpvdv.exe209⤵PID:5036
-
\??\c:\pvvpv.exec:\pvvpv.exe210⤵PID:4612
-
\??\c:\lfffrrl.exec:\lfffrrl.exe211⤵PID:1172
-
\??\c:\hhnnnt.exec:\hhnnnt.exe212⤵PID:4272
-
\??\c:\dvppd.exec:\dvppd.exe213⤵PID:4872
-
\??\c:\pvdjj.exec:\pvdjj.exe214⤵PID:4892
-
\??\c:\lffxrxl.exec:\lffxrxl.exe215⤵PID:1124
-
\??\c:\hhbbbb.exec:\hhbbbb.exe216⤵PID:3240
-
\??\c:\hnhhbh.exec:\hnhhbh.exe217⤵PID:4440
-
\??\c:\dpdvd.exec:\dpdvd.exe218⤵PID:1104
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe219⤵PID:4048
-
\??\c:\rrlllrr.exec:\rrlllrr.exe220⤵PID:2364
-
\??\c:\pvvvd.exec:\pvvvd.exe221⤵PID:4320
-
\??\c:\rrrrxxf.exec:\rrrrxxf.exe222⤵PID:4268
-
\??\c:\hbtntt.exec:\hbtntt.exe223⤵PID:888
-
\??\c:\pvvpp.exec:\pvvpp.exe224⤵PID:4396
-
\??\c:\rffxrxr.exec:\rffxrxr.exe225⤵PID:2180
-
\??\c:\thtbtn.exec:\thtbtn.exe226⤵PID:2288
-
\??\c:\jvpjd.exec:\jvpjd.exe227⤵PID:884
-
\??\c:\lxfxllf.exec:\lxfxllf.exe228⤵PID:1136
-
\??\c:\5ntttb.exec:\5ntttb.exe229⤵PID:744
-
\??\c:\hnhhhh.exec:\hnhhhh.exe230⤵PID:4296
-
\??\c:\1jvvv.exec:\1jvvv.exe231⤵PID:2132
-
\??\c:\llxxxfr.exec:\llxxxfr.exe232⤵PID:2420
-
\??\c:\1nbbhn.exec:\1nbbhn.exe233⤵PID:4420
-
\??\c:\vdjjd.exec:\vdjjd.exe234⤵PID:4740
-
\??\c:\rxrrlll.exec:\rxrrlll.exe235⤵PID:2032
-
\??\c:\7thhhn.exec:\7thhhn.exe236⤵PID:3040
-
\??\c:\thnbtt.exec:\thnbtt.exe237⤵PID:1936
-
\??\c:\vdjjd.exec:\vdjjd.exe238⤵PID:1640
-
\??\c:\rfxrxxf.exec:\rfxrxxf.exe239⤵PID:4560
-
\??\c:\ttttnt.exec:\ttttnt.exe240⤵PID:4544
-
\??\c:\jpdjj.exec:\jpdjj.exe241⤵PID:3304
-
\??\c:\dvpdd.exec:\dvpdd.exe242⤵PID:836