Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:04
Behavioral task
behavioral1
Sample
00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe
-
Size
340KB
-
MD5
00f117a2e2fa90cb9bf17d5ac8750ab0
-
SHA1
c5faaac76aa0de59e259e2597c7044d635a7f890
-
SHA256
ff0a439ff1ac00685ad2b01a381213a46beefa68860ae9578cb674a1c485577c
-
SHA512
4c2d8a28ca21ba9031e1e87d406c5c446af683f78342706bc849079fed35b2e237b04bedaab8e12b9c57228d8b51a97015f7acd24c6c2138de186b121631fa44
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNiZ:9cm4FmowdHoS4BtguSPKyHZ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/5060-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2000-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2888-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-561-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/768-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-648-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-697-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hhbtnn.exedvdjj.exefrlllrl.exenbbbbb.exe3ppjj.exepjjvd.exerxxxrrr.exetbtnnh.exexrfxrrl.exe3nnhbb.exehtnhbb.exefrlrxlr.exebnntnn.exepddvd.exehttnnt.exedvdvv.exeflffrfl.exeppjvd.exeflffrxr.exenbtntb.exetbhtbb.exexrlrlxl.exedppjd.exevppdd.exexfffxrl.exe3nnhbh.exe1xrrrfl.exetnnhbn.exerrfffff.exejppdv.exelxxxxrl.exebttnbb.exexrlfffx.exebtbbth.exeffxrxxx.exevdvvv.exerxfxflf.exebbnnnn.exevpvjj.exefrxlfrx.exettnttt.exe3ppjv.exefxlxxrr.exetnbbbh.exeppvjj.exebhtnnh.exeddpjd.exe5frrfrr.exebthbbb.exejjpvv.exelxxrlxl.exebnbtnh.exepvjjv.exehhnnnt.exevvvvv.exeffxlxxr.exenbnbnh.exejpvvv.exepdppj.exelxfxffx.exettbbbh.exevpppj.exepvjvv.exerrlxllf.exepid process 3208 hhbtnn.exe 4268 dvdjj.exe 4196 frlllrl.exe 4620 nbbbbb.exe 2552 3ppjj.exe 2084 pjjvd.exe 4700 rxxxrrr.exe 3772 tbtnnh.exe 3692 xrfxrrl.exe 4028 3nnhbb.exe 1692 htnhbb.exe 1524 frlrxlr.exe 1788 bnntnn.exe 2532 pddvd.exe 4348 httnnt.exe 3996 dvdvv.exe 3212 flffrfl.exe 3704 ppjvd.exe 2616 flffrxr.exe 3252 nbtntb.exe 3640 tbhtbb.exe 376 xrlrlxl.exe 4068 dppjd.exe 708 vppdd.exe 4936 xfffxrl.exe 3956 3nnhbh.exe 4992 1xrrrfl.exe 4056 tnnhbn.exe 1040 rrfffff.exe 940 jppdv.exe 4876 lxxxxrl.exe 468 bttnbb.exe 4236 xrlfffx.exe 2000 btbbth.exe 448 ffxrxxx.exe 1616 vdvvv.exe 1388 rxfxflf.exe 1120 bbnnnn.exe 4808 vpvjj.exe 4316 frxlfrx.exe 2096 ttnttt.exe 3828 3ppjv.exe 1608 fxlxxrr.exe 2876 tnbbbh.exe 2280 ppvjj.exe 4156 bhtnnh.exe 996 ddpjd.exe 3364 5frrfrr.exe 3552 bthbbb.exe 856 jjpvv.exe 2180 lxxrlxl.exe 1980 bnbtnh.exe 1880 pvjjv.exe 3868 hhnnnt.exe 1748 vvvvv.exe 1680 ffxlxxr.exe 5080 nbnbnh.exe 4020 jpvvv.exe 4220 pdppj.exe 4684 lxfxffx.exe 1404 ttbbbh.exe 2868 vpppj.exe 436 pvjvv.exe 4672 rrlxllf.exe -
Processes:
resource yara_rule behavioral2/memory/5060-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhbtnn.exe upx behavioral2/memory/5060-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3208-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvdjj.exe upx behavioral2/memory/4268-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frlllrl.exe upx behavioral2/memory/4196-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbbbbb.exe upx C:\3ppjj.exe upx behavioral2/memory/2552-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjjvd.exe upx behavioral2/memory/2084-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxxxrrr.exe upx behavioral2/memory/4700-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbtnnh.exe upx behavioral2/memory/3772-49-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrfxrrl.exe upx behavioral2/memory/4028-58-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3nnhbb.exe upx behavioral2/memory/4028-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htnhbb.exe upx behavioral2/memory/1692-69-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\frlrxlr.exe upx behavioral2/memory/1524-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnntnn.exe upx behavioral2/memory/1788-77-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pddvd.exe upx behavioral2/memory/2532-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\httnnt.exe upx C:\dvdvv.exe upx behavioral2/memory/3996-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flffrfl.exe upx \??\c:\ppjvd.exe upx behavioral2/memory/3704-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3212-104-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\flffrxr.exe upx behavioral2/memory/3704-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbtntb.exe upx behavioral2/memory/3252-119-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbhtbb.exe upx C:\xrlrlxl.exe upx behavioral2/memory/3640-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/376-130-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dppjd.exe upx C:\vppdd.exe upx C:\xfffxrl.exe upx behavioral2/memory/4936-146-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3nnhbh.exe upx \??\c:\1xrrrfl.exe upx behavioral2/memory/3956-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4992-158-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnhbn.exe upx C:\rrfffff.exe upx C:\jppdv.exe upx behavioral2/memory/1040-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxxxxrl.exe upx behavioral2/memory/468-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/940-183-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bttnbb.exe upx behavioral2/memory/4236-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2000-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1388-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1120-211-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exehhbtnn.exedvdjj.exefrlllrl.exenbbbbb.exe3ppjj.exepjjvd.exerxxxrrr.exetbtnnh.exexrfxrrl.exe3nnhbb.exehtnhbb.exefrlrxlr.exebnntnn.exepddvd.exehttnnt.exedvdvv.exeflffrfl.exeppjvd.exeflffrxr.exenbtntb.exetbhtbb.exedescription pid process target process PID 5060 wrote to memory of 3208 5060 00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe hhbtnn.exe PID 5060 wrote to memory of 3208 5060 00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe hhbtnn.exe PID 5060 wrote to memory of 3208 5060 00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe hhbtnn.exe PID 3208 wrote to memory of 4268 3208 hhbtnn.exe dvdjj.exe PID 3208 wrote to memory of 4268 3208 hhbtnn.exe dvdjj.exe PID 3208 wrote to memory of 4268 3208 hhbtnn.exe dvdjj.exe PID 4268 wrote to memory of 4196 4268 dvdjj.exe frlllrl.exe PID 4268 wrote to memory of 4196 4268 dvdjj.exe frlllrl.exe PID 4268 wrote to memory of 4196 4268 dvdjj.exe frlllrl.exe PID 4196 wrote to memory of 4620 4196 frlllrl.exe nbbbbb.exe PID 4196 wrote to memory of 4620 4196 frlllrl.exe nbbbbb.exe PID 4196 wrote to memory of 4620 4196 frlllrl.exe nbbbbb.exe PID 4620 wrote to memory of 2552 4620 nbbbbb.exe 3ppjj.exe PID 4620 wrote to memory of 2552 4620 nbbbbb.exe 3ppjj.exe PID 4620 wrote to memory of 2552 4620 nbbbbb.exe 3ppjj.exe PID 2552 wrote to memory of 2084 2552 3ppjj.exe pjjvd.exe PID 2552 wrote to memory of 2084 2552 3ppjj.exe pjjvd.exe PID 2552 wrote to memory of 2084 2552 3ppjj.exe pjjvd.exe PID 2084 wrote to memory of 4700 2084 pjjvd.exe rxxxrrr.exe PID 2084 wrote to memory of 4700 2084 pjjvd.exe rxxxrrr.exe PID 2084 wrote to memory of 4700 2084 pjjvd.exe rxxxrrr.exe PID 4700 wrote to memory of 3772 4700 rxxxrrr.exe tbtnnh.exe PID 4700 wrote to memory of 3772 4700 rxxxrrr.exe tbtnnh.exe PID 4700 wrote to memory of 3772 4700 rxxxrrr.exe tbtnnh.exe PID 3772 wrote to memory of 3692 3772 tbtnnh.exe xrfxrrl.exe PID 3772 wrote to memory of 3692 3772 tbtnnh.exe xrfxrrl.exe PID 3772 wrote to memory of 3692 3772 tbtnnh.exe xrfxrrl.exe PID 3692 wrote to memory of 4028 3692 xrfxrrl.exe 3nnhbb.exe PID 3692 wrote to memory of 4028 3692 xrfxrrl.exe 3nnhbb.exe PID 3692 wrote to memory of 4028 3692 xrfxrrl.exe 3nnhbb.exe PID 4028 wrote to memory of 1692 4028 3nnhbb.exe htnhbb.exe PID 4028 wrote to memory of 1692 4028 3nnhbb.exe htnhbb.exe PID 4028 wrote to memory of 1692 4028 3nnhbb.exe htnhbb.exe PID 1692 wrote to memory of 1524 1692 htnhbb.exe frlrxlr.exe PID 1692 wrote to memory of 1524 1692 htnhbb.exe frlrxlr.exe PID 1692 wrote to memory of 1524 1692 htnhbb.exe frlrxlr.exe PID 1524 wrote to memory of 1788 1524 frlrxlr.exe bnntnn.exe PID 1524 wrote to memory of 1788 1524 frlrxlr.exe bnntnn.exe PID 1524 wrote to memory of 1788 1524 frlrxlr.exe bnntnn.exe PID 1788 wrote to memory of 2532 1788 bnntnn.exe pddvd.exe PID 1788 wrote to memory of 2532 1788 bnntnn.exe pddvd.exe PID 1788 wrote to memory of 2532 1788 bnntnn.exe pddvd.exe PID 2532 wrote to memory of 4348 2532 pddvd.exe httnnt.exe PID 2532 wrote to memory of 4348 2532 pddvd.exe httnnt.exe PID 2532 wrote to memory of 4348 2532 pddvd.exe httnnt.exe PID 4348 wrote to memory of 3996 4348 httnnt.exe dvdvv.exe PID 4348 wrote to memory of 3996 4348 httnnt.exe dvdvv.exe PID 4348 wrote to memory of 3996 4348 httnnt.exe dvdvv.exe PID 3996 wrote to memory of 3212 3996 dvdvv.exe flffrfl.exe PID 3996 wrote to memory of 3212 3996 dvdvv.exe flffrfl.exe PID 3996 wrote to memory of 3212 3996 dvdvv.exe flffrfl.exe PID 3212 wrote to memory of 3704 3212 flffrfl.exe ppjvd.exe PID 3212 wrote to memory of 3704 3212 flffrfl.exe ppjvd.exe PID 3212 wrote to memory of 3704 3212 flffrfl.exe ppjvd.exe PID 3704 wrote to memory of 2616 3704 ppjvd.exe flffrxr.exe PID 3704 wrote to memory of 2616 3704 ppjvd.exe flffrxr.exe PID 3704 wrote to memory of 2616 3704 ppjvd.exe flffrxr.exe PID 2616 wrote to memory of 3252 2616 flffrxr.exe nbtntb.exe PID 2616 wrote to memory of 3252 2616 flffrxr.exe nbtntb.exe PID 2616 wrote to memory of 3252 2616 flffrxr.exe nbtntb.exe PID 3252 wrote to memory of 3640 3252 nbtntb.exe tbhtbb.exe PID 3252 wrote to memory of 3640 3252 nbtntb.exe tbhtbb.exe PID 3252 wrote to memory of 3640 3252 nbtntb.exe tbhtbb.exe PID 3640 wrote to memory of 376 3640 tbhtbb.exe xrlrlxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\hhbtnn.exec:\hhbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\dvdjj.exec:\dvdjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\frlllrl.exec:\frlllrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\nbbbbb.exec:\nbbbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\3ppjj.exec:\3ppjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\pjjvd.exec:\pjjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\tbtnnh.exec:\tbtnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\3nnhbb.exec:\3nnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\htnhbb.exec:\htnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\frlrxlr.exec:\frlrxlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\bnntnn.exec:\bnntnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\pddvd.exec:\pddvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\httnnt.exec:\httnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\dvdvv.exec:\dvdvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\flffrfl.exec:\flffrfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\ppjvd.exec:\ppjvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\flffrxr.exec:\flffrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nbtntb.exec:\nbtntb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\tbhtbb.exec:\tbhtbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\xrlrlxl.exec:\xrlrlxl.exe23⤵
- Executes dropped EXE
PID:376 -
\??\c:\dppjd.exec:\dppjd.exe24⤵
- Executes dropped EXE
PID:4068 -
\??\c:\vppdd.exec:\vppdd.exe25⤵
- Executes dropped EXE
PID:708 -
\??\c:\xfffxrl.exec:\xfffxrl.exe26⤵
- Executes dropped EXE
PID:4936 -
\??\c:\3nnhbh.exec:\3nnhbh.exe27⤵
- Executes dropped EXE
PID:3956 -
\??\c:\1xrrrfl.exec:\1xrrrfl.exe28⤵
- Executes dropped EXE
PID:4992 -
\??\c:\tnnhbn.exec:\tnnhbn.exe29⤵
- Executes dropped EXE
PID:4056 -
\??\c:\rrfffff.exec:\rrfffff.exe30⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jppdv.exec:\jppdv.exe31⤵
- Executes dropped EXE
PID:940 -
\??\c:\lxxxxrl.exec:\lxxxxrl.exe32⤵
- Executes dropped EXE
PID:4876 -
\??\c:\bttnbb.exec:\bttnbb.exe33⤵
- Executes dropped EXE
PID:468 -
\??\c:\xrlfffx.exec:\xrlfffx.exe34⤵
- Executes dropped EXE
PID:4236 -
\??\c:\btbbth.exec:\btbbth.exe35⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ffxrxxx.exec:\ffxrxxx.exe36⤵
- Executes dropped EXE
PID:448 -
\??\c:\vdvvv.exec:\vdvvv.exe37⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rxfxflf.exec:\rxfxflf.exe38⤵
- Executes dropped EXE
PID:1388 -
\??\c:\bbnnnn.exec:\bbnnnn.exe39⤵
- Executes dropped EXE
PID:1120 -
\??\c:\vpvjj.exec:\vpvjj.exe40⤵
- Executes dropped EXE
PID:4808 -
\??\c:\frxlfrx.exec:\frxlfrx.exe41⤵
- Executes dropped EXE
PID:4316 -
\??\c:\ttnttt.exec:\ttnttt.exe42⤵
- Executes dropped EXE
PID:2096 -
\??\c:\3ppjv.exec:\3ppjv.exe43⤵
- Executes dropped EXE
PID:3828 -
\??\c:\fxlxxrr.exec:\fxlxxrr.exe44⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tnbbbh.exec:\tnbbbh.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ppvjj.exec:\ppvjj.exe46⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bhtnnh.exec:\bhtnnh.exe47⤵
- Executes dropped EXE
PID:4156 -
\??\c:\ddpjd.exec:\ddpjd.exe48⤵
- Executes dropped EXE
PID:996 -
\??\c:\5frrfrr.exec:\5frrfrr.exe49⤵
- Executes dropped EXE
PID:3364 -
\??\c:\bthbbb.exec:\bthbbb.exe50⤵
- Executes dropped EXE
PID:3552 -
\??\c:\jjpvv.exec:\jjpvv.exe51⤵
- Executes dropped EXE
PID:856 -
\??\c:\lxxrlxl.exec:\lxxrlxl.exe52⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bnbtnh.exec:\bnbtnh.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pvjjv.exec:\pvjjv.exe54⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hhnnnt.exec:\hhnnnt.exe55⤵
- Executes dropped EXE
PID:3868 -
\??\c:\vvvvv.exec:\vvvvv.exe56⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ffxlxxr.exec:\ffxlxxr.exe57⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nbnbnh.exec:\nbnbnh.exe58⤵
- Executes dropped EXE
PID:5080 -
\??\c:\jpvvv.exec:\jpvvv.exe59⤵
- Executes dropped EXE
PID:4020 -
\??\c:\pdppj.exec:\pdppj.exe60⤵
- Executes dropped EXE
PID:4220 -
\??\c:\lxfxffx.exec:\lxfxffx.exe61⤵
- Executes dropped EXE
PID:4684 -
\??\c:\ttbbbh.exec:\ttbbbh.exe62⤵
- Executes dropped EXE
PID:1404 -
\??\c:\vpppj.exec:\vpppj.exe63⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pvjvv.exec:\pvjvv.exe64⤵
- Executes dropped EXE
PID:436 -
\??\c:\rrlxllf.exec:\rrlxllf.exe65⤵
- Executes dropped EXE
PID:4672 -
\??\c:\jpjvd.exec:\jpjvd.exe66⤵PID:2328
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe67⤵PID:4524
-
\??\c:\1nbbbh.exec:\1nbbbh.exe68⤵PID:4520
-
\??\c:\ppvvv.exec:\ppvvv.exe69⤵PID:4924
-
\??\c:\lxrlflf.exec:\lxrlflf.exe70⤵PID:4796
-
\??\c:\hthbbt.exec:\hthbbt.exe71⤵PID:1384
-
\??\c:\jvvvj.exec:\jvvvj.exe72⤵PID:376
-
\??\c:\rxxrrxl.exec:\rxxrrxl.exe73⤵PID:2884
-
\??\c:\nbhhbb.exec:\nbhhbb.exe74⤵PID:3196
-
\??\c:\nttnhh.exec:\nttnhh.exe75⤵PID:1084
-
\??\c:\5dppd.exec:\5dppd.exe76⤵PID:2336
-
\??\c:\rrfrflx.exec:\rrfrflx.exe77⤵PID:3956
-
\??\c:\ttbnbb.exec:\ttbnbb.exe78⤵PID:4252
-
\??\c:\vpddv.exec:\vpddv.exe79⤵PID:980
-
\??\c:\xlxxlrr.exec:\xlxxlrr.exe80⤵PID:4900
-
\??\c:\httnnn.exec:\httnnn.exe81⤵PID:2928
-
\??\c:\dvjdj.exec:\dvjdj.exe82⤵PID:4080
-
\??\c:\lfllfff.exec:\lfllfff.exe83⤵PID:3112
-
\??\c:\nnnhbb.exec:\nnnhbb.exe84⤵PID:2888
-
\??\c:\jdppd.exec:\jdppd.exe85⤵PID:3100
-
\??\c:\lrrlflx.exec:\lrrlflx.exe86⤵PID:2000
-
\??\c:\hhhnnb.exec:\hhhnnb.exe87⤵PID:448
-
\??\c:\3rxxfrx.exec:\3rxxfrx.exe88⤵PID:1616
-
\??\c:\tntbbt.exec:\tntbbt.exe89⤵PID:4980
-
\??\c:\7jjjp.exec:\7jjjp.exe90⤵PID:1120
-
\??\c:\ddvvv.exec:\ddvvv.exe91⤵PID:3244
-
\??\c:\flxrllf.exec:\flxrllf.exe92⤵PID:4436
-
\??\c:\bbhbhh.exec:\bbhbhh.exe93⤵PID:3776
-
\??\c:\vvppd.exec:\vvppd.exe94⤵PID:2228
-
\??\c:\dpvpj.exec:\dpvpj.exe95⤵PID:1608
-
\??\c:\xflxrrx.exec:\xflxrrx.exe96⤵PID:2876
-
\??\c:\3bbtnh.exec:\3bbtnh.exe97⤵PID:3292
-
\??\c:\pdjjj.exec:\pdjjj.exe98⤵PID:2552
-
\??\c:\vjdpd.exec:\vjdpd.exe99⤵PID:3808
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe100⤵PID:3032
-
\??\c:\bbhhbb.exec:\bbhhbb.exe101⤵PID:4584
-
\??\c:\pvvpv.exec:\pvvpv.exe102⤵PID:2180
-
\??\c:\jjvpj.exec:\jjvpj.exe103⤵PID:1980
-
\??\c:\lrlrlfr.exec:\lrlrlfr.exe104⤵PID:4408
-
\??\c:\tnhnnt.exec:\tnhnnt.exe105⤵PID:5012
-
\??\c:\7jvvp.exec:\7jvvp.exe106⤵PID:2244
-
\??\c:\vpvpv.exec:\vpvpv.exe107⤵PID:2652
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe108⤵PID:3132
-
\??\c:\hbnnnn.exec:\hbnnnn.exe109⤵PID:3420
-
\??\c:\hbnnnt.exec:\hbnnnt.exe110⤵PID:4692
-
\??\c:\1jjdv.exec:\1jjdv.exe111⤵PID:4356
-
\??\c:\tnbnht.exec:\tnbnht.exe112⤵PID:3180
-
\??\c:\3nhhht.exec:\3nhhht.exe113⤵PID:436
-
\??\c:\vvvvj.exec:\vvvvj.exe114⤵PID:2668
-
\??\c:\xfxffll.exec:\xfxffll.exe115⤵PID:432
-
\??\c:\nnbtnn.exec:\nnbtnn.exe116⤵PID:3252
-
\??\c:\bbtttt.exec:\bbtttt.exe117⤵PID:2168
-
\??\c:\pvjjj.exec:\pvjjj.exe118⤵PID:652
-
\??\c:\lxrfrxx.exec:\lxrfrxx.exe119⤵PID:4352
-
\??\c:\xxrrlxx.exec:\xxrrlxx.exe120⤵PID:1160
-
\??\c:\bthhnn.exec:\bthhnn.exe121⤵PID:3508
-
\??\c:\9jdjd.exec:\9jdjd.exe122⤵PID:3348
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe123⤵PID:1600
-
\??\c:\htnhtn.exec:\htnhtn.exe124⤵PID:4720
-
\??\c:\vdppd.exec:\vdppd.exe125⤵PID:3852
-
\??\c:\ppdvv.exec:\ppdvv.exe126⤵PID:3052
-
\??\c:\7rxrxrf.exec:\7rxrxrf.exe127⤵PID:4824
-
\??\c:\nhbthh.exec:\nhbthh.exe128⤵PID:3112
-
\??\c:\1djjj.exec:\1djjj.exe129⤵PID:2888
-
\??\c:\rrxrrll.exec:\rrxrrll.exe130⤵PID:848
-
\??\c:\lrrxfrr.exec:\lrrxfrr.exe131⤵PID:3412
-
\??\c:\rflxlrl.exec:\rflxlrl.exe132⤵PID:3264
-
\??\c:\nhnnht.exec:\nhnnht.exe133⤵PID:2580
-
\??\c:\llrllrr.exec:\llrllrr.exe134⤵PID:4332
-
\??\c:\tbbtnt.exec:\tbbtnt.exe135⤵PID:1564
-
\??\c:\dpvpp.exec:\dpvpp.exe136⤵PID:3480
-
\??\c:\pjppp.exec:\pjppp.exe137⤵PID:2096
-
\??\c:\lflllll.exec:\lflllll.exe138⤵PID:1716
-
\??\c:\bntttt.exec:\bntttt.exe139⤵PID:4528
-
\??\c:\vpvvv.exec:\vpvvv.exe140⤵PID:4620
-
\??\c:\ffllxll.exec:\ffllxll.exe141⤵PID:752
-
\??\c:\nbnnnn.exec:\nbnnnn.exe142⤵PID:588
-
\??\c:\dpddd.exec:\dpddd.exe143⤵PID:1928
-
\??\c:\3lrlfxx.exec:\3lrlfxx.exe144⤵PID:2924
-
\??\c:\rfrrlll.exec:\rfrrlll.exe145⤵PID:3772
-
\??\c:\pjvpj.exec:\pjvpj.exe146⤵PID:4160
-
\??\c:\llxxrrr.exec:\llxxrrr.exe147⤵PID:4028
-
\??\c:\bhtbbb.exec:\bhtbbb.exe148⤵PID:4004
-
\??\c:\vdpjp.exec:\vdpjp.exe149⤵PID:3868
-
\??\c:\1lrrxxr.exec:\1lrrxxr.exe150⤵PID:2184
-
\??\c:\ppjjj.exec:\ppjjj.exe151⤵PID:1016
-
\??\c:\xxllrrf.exec:\xxllrrf.exe152⤵PID:3844
-
\??\c:\hthbbb.exec:\hthbbb.exe153⤵PID:2532
-
\??\c:\jpvpp.exec:\jpvpp.exe154⤵PID:3080
-
\??\c:\rxrflrx.exec:\rxrflrx.exe155⤵PID:3224
-
\??\c:\ttbhhb.exec:\ttbhhb.exe156⤵PID:4376
-
\??\c:\7dvpp.exec:\7dvpp.exe157⤵PID:4396
-
\??\c:\fflfxxr.exec:\fflfxxr.exe158⤵PID:436
-
\??\c:\bttttt.exec:\bttttt.exe159⤵PID:4476
-
\??\c:\jdpjp.exec:\jdpjp.exe160⤵PID:2144
-
\??\c:\xlxxlll.exec:\xlxxlll.exe161⤵PID:3736
-
\??\c:\jdppv.exec:\jdppv.exe162⤵PID:1384
-
\??\c:\xlxxllr.exec:\xlxxllr.exe163⤵PID:2980
-
\??\c:\xfrrrxl.exec:\xfrrrxl.exe164⤵PID:708
-
\??\c:\nhnbbb.exec:\nhnbbb.exe165⤵PID:1168
-
\??\c:\vdvvp.exec:\vdvvp.exe166⤵PID:1084
-
\??\c:\fffxxxr.exec:\fffxxxr.exe167⤵PID:744
-
\??\c:\fxllrrr.exec:\fxllrrr.exe168⤵PID:768
-
\??\c:\tnhhbt.exec:\tnhhbt.exe169⤵PID:2932
-
\??\c:\9pdvv.exec:\9pdvv.exe170⤵PID:3052
-
\??\c:\xrrrxxr.exec:\xrrrxxr.exe171⤵PID:4888
-
\??\c:\hbtttt.exec:\hbtttt.exe172⤵PID:3100
-
\??\c:\pdddd.exec:\pdddd.exe173⤵PID:3468
-
\??\c:\rxlffxf.exec:\rxlffxf.exe174⤵PID:2512
-
\??\c:\ffrffrx.exec:\ffrffrx.exe175⤵PID:4960
-
\??\c:\nhnnhb.exec:\nhnnhb.exe176⤵PID:4980
-
\??\c:\vjdvv.exec:\vjdvv.exe177⤵PID:1120
-
\??\c:\fxrxllr.exec:\fxrxllr.exe178⤵PID:2160
-
\??\c:\hhhbhh.exec:\hhhbhh.exe179⤵PID:1252
-
\??\c:\vvjjj.exec:\vvjjj.exe180⤵PID:1332
-
\??\c:\llxlxrl.exec:\llxlxrl.exe181⤵PID:3712
-
\??\c:\bbhhbh.exec:\bbhhbh.exe182⤵PID:1608
-
\??\c:\vjvvp.exec:\vjvvp.exe183⤵PID:1052
-
\??\c:\vvddv.exec:\vvddv.exe184⤵PID:3364
-
\??\c:\rxrfrfx.exec:\rxrfrfx.exe185⤵PID:4456
-
\??\c:\5bbtnn.exec:\5bbtnn.exe186⤵PID:3032
-
\??\c:\pdjjj.exec:\pdjjj.exe187⤵PID:3984
-
\??\c:\1flflxx.exec:\1flflxx.exe188⤵PID:2180
-
\??\c:\bthbbb.exec:\bthbbb.exe189⤵PID:1980
-
\??\c:\hhttbb.exec:\hhttbb.exe190⤵PID:4408
-
\??\c:\jddvv.exec:\jddvv.exe191⤵PID:5080
-
\??\c:\vdvjv.exec:\vdvjv.exe192⤵PID:2652
-
\??\c:\7jjjj.exec:\7jjjj.exe193⤵PID:3132
-
\??\c:\flfffrr.exec:\flfffrr.exe194⤵PID:2532
-
\??\c:\tnhbnn.exec:\tnhbnn.exe195⤵PID:1028
-
\??\c:\pvddv.exec:\pvddv.exe196⤵PID:2868
-
\??\c:\jdjjv.exec:\jdjjv.exe197⤵PID:4376
-
\??\c:\ffxxflx.exec:\ffxxflx.exe198⤵PID:1520
-
\??\c:\tbnhbb.exec:\tbnhbb.exe199⤵PID:4984
-
\??\c:\vvvvv.exec:\vvvvv.exe200⤵PID:60
-
\??\c:\frflffx.exec:\frflffx.exe201⤵PID:2144
-
\??\c:\rffflxf.exec:\rffflxf.exe202⤵PID:4320
-
\??\c:\ntbtbn.exec:\ntbtbn.exe203⤵PID:4920
-
\??\c:\vvppv.exec:\vvppv.exe204⤵PID:1160
-
\??\c:\xfxfllf.exec:\xfxfllf.exe205⤵PID:4836
-
\??\c:\9xlllrr.exec:\9xlllrr.exe206⤵PID:1688
-
\??\c:\hbbbhh.exec:\hbbbhh.exe207⤵PID:5100
-
\??\c:\vdppj.exec:\vdppj.exe208⤵PID:2964
-
\??\c:\jpvjj.exec:\jpvjj.exe209⤵PID:636
-
\??\c:\rfrffrx.exec:\rfrffrx.exe210⤵PID:940
-
\??\c:\btntnh.exec:\btntnh.exe211⤵PID:560
-
\??\c:\jdjjj.exec:\jdjjj.exe212⤵PID:1532
-
\??\c:\rxrffxr.exec:\rxrffxr.exe213⤵PID:2468
-
\??\c:\tbbhhn.exec:\tbbhhn.exe214⤵PID:2744
-
\??\c:\jvppj.exec:\jvppj.exe215⤵PID:1920
-
\??\c:\3xxxrxf.exec:\3xxxrxf.exe216⤵PID:848
-
\??\c:\lxlfrrf.exec:\lxlfrrf.exe217⤵PID:448
-
\??\c:\5nnnhn.exec:\5nnnhn.exe218⤵PID:2064
-
\??\c:\vdpvv.exec:\vdpvv.exe219⤵PID:4128
-
\??\c:\1xxrrrl.exec:\1xxrrrl.exe220⤵PID:1564
-
\??\c:\tnnnht.exec:\tnnnht.exe221⤵PID:4436
-
\??\c:\9jdpp.exec:\9jdpp.exe222⤵PID:3592
-
\??\c:\lrrrlxl.exec:\lrrrlxl.exe223⤵PID:3780
-
\??\c:\hbtnnn.exec:\hbtnnn.exe224⤵PID:4528
-
\??\c:\vppjd.exec:\vppjd.exe225⤵PID:2876
-
\??\c:\rxffxfx.exec:\rxffxfx.exe226⤵PID:4316
-
\??\c:\bhbttn.exec:\bhbttn.exe227⤵PID:3244
-
\??\c:\pjjdp.exec:\pjjdp.exe228⤵PID:1052
-
\??\c:\jvpjj.exec:\jvpjj.exe229⤵PID:4872
-
\??\c:\lrffxfx.exec:\lrffxfx.exe230⤵PID:4700
-
\??\c:\ntnhnb.exec:\ntnhnb.exe231⤵PID:856
-
\??\c:\pvppj.exec:\pvppj.exe232⤵PID:3984
-
\??\c:\flrlfxr.exec:\flrlfxr.exe233⤵PID:1692
-
\??\c:\tnbtnb.exec:\tnbtnb.exe234⤵PID:2184
-
\??\c:\htbtnn.exec:\htbtnn.exe235⤵PID:2244
-
\??\c:\vvddd.exec:\vvddd.exe236⤵PID:3288
-
\??\c:\fflfxrx.exec:\fflfxrx.exe237⤵PID:4220
-
\??\c:\hnnttb.exec:\hnnttb.exe238⤵PID:4684
-
\??\c:\djjdv.exec:\djjdv.exe239⤵PID:3632
-
\??\c:\flrrxfl.exec:\flrrxfl.exe240⤵PID:3732
-
\??\c:\btbthb.exec:\btbthb.exe241⤵PID:676
-
\??\c:\pjjvp.exec:\pjjvp.exe242⤵PID:4376