Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:19
Behavioral task
behavioral1
Sample
412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe
-
Size
58KB
-
MD5
412d25307c415869e0a4625903f6a840
-
SHA1
45ca6c0ba301d802d84c9a7c49e0eb4d458bab4e
-
SHA256
878e3dd98d57968770b3e920fa3521503097750b61321acd45b4f4cfca41b4af
-
SHA512
f7e5109e51115e1d3a220e889f42877e560d4fd0cd11292a5f66ed7fff4b603b167fe8aaf239442f3aa6ab9eaeaa5a6b7875a6c8b236f894ad9dfa4ce2934a40
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNG1mjtREVM5D:khOmTsF93UYfwC6GIoutpY918c6
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1532-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3388-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1956-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1296-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1828-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/600-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/656-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3156-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/684-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3820-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-673-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-752-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-789-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-845-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-876-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-899-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-982-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
thbbbb.exevjvdd.exexlrfxrf.exerlrlffx.exebbtnhh.exepddpj.exe9jjpd.exexrxrlll.exe7xffffx.exennntnn.exe3dvvp.exevjdvp.exedvjdp.exefxrfrrl.exebtbnht.exe7jvpj.exevpddd.exelffrllf.exettnnhh.exetntnbt.exepdddv.exedvddp.exelrxrlfx.exefllfffx.exetnnnhn.exevpjvj.exefrlfffx.exexxrrlfx.exetbbtnn.exevpvpv.exevdjdv.exe9ffxrrl.exe3rllrrx.exehnbtnn.exenhtttt.exexrrrrxx.exe3fllllf.exehthttb.exeddjvd.exe1ppvj.exelflflrx.exelfxxrrr.exethhhhh.exehbthnh.exedvvpj.exerlxrfff.exerxxrrrl.exehtbbhh.exehtbbtt.exeppjjv.exe9ffxrrl.exelllfxxf.exetntnnn.exennhhbh.exedjpjv.exe7pdvp.exerlllfff.exelfllfff.exehnnhbb.exennbtbb.exetntnhh.exe5jddv.exevvvvj.exefxfxrrr.exepid process 1956 thbbbb.exe 3388 vjvdd.exe 1716 xlrfxrf.exe 4932 rlrlffx.exe 4612 bbtnhh.exe 1296 pddpj.exe 3996 9jjpd.exe 3676 xrxrlll.exe 1540 7xffffx.exe 5096 nnntnn.exe 2428 3dvvp.exe 1828 vjdvp.exe 2020 dvjdp.exe 3572 fxrfrrl.exe 2612 btbnht.exe 876 7jvpj.exe 5092 vpddd.exe 4416 lffrllf.exe 600 ttnnhh.exe 3316 tntnbt.exe 4036 pdddv.exe 3424 dvddp.exe 4712 lrxrlfx.exe 4944 fllfffx.exe 1616 tnnnhn.exe 3200 vpjvj.exe 2324 frlfffx.exe 3484 xxrrlfx.exe 3120 tbbtnn.exe 4692 vpvpv.exe 4540 vdjdv.exe 1168 9ffxrrl.exe 1840 3rllrrx.exe 3592 hnbtnn.exe 1528 nhtttt.exe 656 xrrrrxx.exe 4976 3fllllf.exe 3672 hthttb.exe 3884 ddjvd.exe 4024 1ppvj.exe 3660 lflflrx.exe 4492 lfxxrrr.exe 2204 thhhhh.exe 4380 hbthnh.exe 2412 dvvpj.exe 1052 rlxrfff.exe 920 rxxrrrl.exe 4284 htbbhh.exe 32 htbbtt.exe 2196 ppjjv.exe 1440 9ffxrrl.exe 3508 lllfxxf.exe 2528 tntnnn.exe 1832 nnhhbh.exe 3156 djpjv.exe 2028 7pdvp.exe 2132 rlllfff.exe 3596 lfllfff.exe 1828 hnnhbb.exe 1660 nnbtbb.exe 384 tntnhh.exe 3716 5jddv.exe 4424 vvvvj.exe 1888 fxfxrrr.exe -
Processes:
resource yara_rule behavioral2/memory/1532-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thbbbb.exe upx behavioral2/memory/1956-5-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjvdd.exe upx C:\xlrfxrf.exe upx \??\c:\rlrlffx.exe upx behavioral2/memory/1716-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4932-24-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbtnhh.exe upx behavioral2/memory/4612-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3388-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1956-13-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pddpj.exe upx behavioral2/memory/4612-38-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9jjpd.exe upx C:\xrxrlll.exe upx behavioral2/memory/3676-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7xffffx.exe upx behavioral2/memory/3996-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1296-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnntnn.exe upx behavioral2/memory/1540-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5096-63-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3dvvp.exe upx C:\vjdvp.exe upx behavioral2/memory/1828-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjdp.exe upx C:\fxrfrrl.exe upx C:\btbnht.exe upx behavioral2/memory/3572-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7jvpj.exe upx behavioral2/memory/2612-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/876-95-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpddd.exe upx behavioral2/memory/5092-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5092-104-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lffrllf.exe upx C:\ttnnhh.exe upx C:\tntnbt.exe upx behavioral2/memory/600-114-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdddv.exe upx C:\dvddp.exe upx behavioral2/memory/3424-127-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrxrlfx.exe upx behavioral2/memory/4712-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fllfffx.exe upx behavioral2/memory/4944-143-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnnhn.exe upx behavioral2/memory/1616-146-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjvj.exe upx C:\frlfffx.exe upx C:\xxrrlfx.exe upx C:\tbbtnn.exe upx C:\vpvpv.exe upx behavioral2/memory/4692-170-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vdjdv.exe upx behavioral2/memory/4540-176-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9ffxrrl.exe upx behavioral2/memory/1168-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1840-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3592-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/656-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3884-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4024-211-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
412d25307c415869e0a4625903f6a840_NeikiAnalytics.exethbbbb.exevjvdd.exexlrfxrf.exerlrlffx.exebbtnhh.exepddpj.exe9jjpd.exexrxrlll.exe7xffffx.exennntnn.exe3dvvp.exevjdvp.exedvjdp.exefxrfrrl.exebtbnht.exe7jvpj.exevpddd.exelffrllf.exettnnhh.exetntnbt.exepdddv.exedescription pid process target process PID 1532 wrote to memory of 1956 1532 412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe thbbbb.exe PID 1532 wrote to memory of 1956 1532 412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe thbbbb.exe PID 1532 wrote to memory of 1956 1532 412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe thbbbb.exe PID 1956 wrote to memory of 3388 1956 thbbbb.exe vjvdd.exe PID 1956 wrote to memory of 3388 1956 thbbbb.exe vjvdd.exe PID 1956 wrote to memory of 3388 1956 thbbbb.exe vjvdd.exe PID 3388 wrote to memory of 1716 3388 vjvdd.exe xlrfxrf.exe PID 3388 wrote to memory of 1716 3388 vjvdd.exe xlrfxrf.exe PID 3388 wrote to memory of 1716 3388 vjvdd.exe xlrfxrf.exe PID 1716 wrote to memory of 4932 1716 xlrfxrf.exe rlrlffx.exe PID 1716 wrote to memory of 4932 1716 xlrfxrf.exe rlrlffx.exe PID 1716 wrote to memory of 4932 1716 xlrfxrf.exe rlrlffx.exe PID 4932 wrote to memory of 4612 4932 rlrlffx.exe bbtnhh.exe PID 4932 wrote to memory of 4612 4932 rlrlffx.exe bbtnhh.exe PID 4932 wrote to memory of 4612 4932 rlrlffx.exe bbtnhh.exe PID 4612 wrote to memory of 1296 4612 bbtnhh.exe pddpj.exe PID 4612 wrote to memory of 1296 4612 bbtnhh.exe pddpj.exe PID 4612 wrote to memory of 1296 4612 bbtnhh.exe pddpj.exe PID 1296 wrote to memory of 3996 1296 pddpj.exe 9jjpd.exe PID 1296 wrote to memory of 3996 1296 pddpj.exe 9jjpd.exe PID 1296 wrote to memory of 3996 1296 pddpj.exe 9jjpd.exe PID 3996 wrote to memory of 3676 3996 9jjpd.exe xrxrlll.exe PID 3996 wrote to memory of 3676 3996 9jjpd.exe xrxrlll.exe PID 3996 wrote to memory of 3676 3996 9jjpd.exe xrxrlll.exe PID 3676 wrote to memory of 1540 3676 xrxrlll.exe 7xffffx.exe PID 3676 wrote to memory of 1540 3676 xrxrlll.exe 7xffffx.exe PID 3676 wrote to memory of 1540 3676 xrxrlll.exe 7xffffx.exe PID 1540 wrote to memory of 5096 1540 7xffffx.exe nnntnn.exe PID 1540 wrote to memory of 5096 1540 7xffffx.exe nnntnn.exe PID 1540 wrote to memory of 5096 1540 7xffffx.exe nnntnn.exe PID 5096 wrote to memory of 2428 5096 nnntnn.exe 3dvvp.exe PID 5096 wrote to memory of 2428 5096 nnntnn.exe 3dvvp.exe PID 5096 wrote to memory of 2428 5096 nnntnn.exe 3dvvp.exe PID 2428 wrote to memory of 1828 2428 3dvvp.exe vjdvp.exe PID 2428 wrote to memory of 1828 2428 3dvvp.exe vjdvp.exe PID 2428 wrote to memory of 1828 2428 3dvvp.exe vjdvp.exe PID 1828 wrote to memory of 2020 1828 vjdvp.exe dvjdp.exe PID 1828 wrote to memory of 2020 1828 vjdvp.exe dvjdp.exe PID 1828 wrote to memory of 2020 1828 vjdvp.exe dvjdp.exe PID 2020 wrote to memory of 3572 2020 dvjdp.exe fxrfrrl.exe PID 2020 wrote to memory of 3572 2020 dvjdp.exe fxrfrrl.exe PID 2020 wrote to memory of 3572 2020 dvjdp.exe fxrfrrl.exe PID 3572 wrote to memory of 2612 3572 fxrfrrl.exe btbnht.exe PID 3572 wrote to memory of 2612 3572 fxrfrrl.exe btbnht.exe PID 3572 wrote to memory of 2612 3572 fxrfrrl.exe btbnht.exe PID 2612 wrote to memory of 876 2612 btbnht.exe 7jvpj.exe PID 2612 wrote to memory of 876 2612 btbnht.exe 7jvpj.exe PID 2612 wrote to memory of 876 2612 btbnht.exe 7jvpj.exe PID 876 wrote to memory of 5092 876 7jvpj.exe vpddd.exe PID 876 wrote to memory of 5092 876 7jvpj.exe vpddd.exe PID 876 wrote to memory of 5092 876 7jvpj.exe vpddd.exe PID 5092 wrote to memory of 4416 5092 vpddd.exe lffrllf.exe PID 5092 wrote to memory of 4416 5092 vpddd.exe lffrllf.exe PID 5092 wrote to memory of 4416 5092 vpddd.exe lffrllf.exe PID 4416 wrote to memory of 600 4416 lffrllf.exe ttnnhh.exe PID 4416 wrote to memory of 600 4416 lffrllf.exe ttnnhh.exe PID 4416 wrote to memory of 600 4416 lffrllf.exe ttnnhh.exe PID 600 wrote to memory of 3316 600 ttnnhh.exe tntnbt.exe PID 600 wrote to memory of 3316 600 ttnnhh.exe tntnbt.exe PID 600 wrote to memory of 3316 600 ttnnhh.exe tntnbt.exe PID 3316 wrote to memory of 4036 3316 tntnbt.exe pdddv.exe PID 3316 wrote to memory of 4036 3316 tntnbt.exe pdddv.exe PID 3316 wrote to memory of 4036 3316 tntnbt.exe pdddv.exe PID 4036 wrote to memory of 3424 4036 pdddv.exe dvddp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\412d25307c415869e0a4625903f6a840_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\thbbbb.exec:\thbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\vjvdd.exec:\vjvdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\xlrfxrf.exec:\xlrfxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\rlrlffx.exec:\rlrlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\bbtnhh.exec:\bbtnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\pddpj.exec:\pddpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\9jjpd.exec:\9jjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\xrxrlll.exec:\xrxrlll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\7xffffx.exec:\7xffffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\nnntnn.exec:\nnntnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\3dvvp.exec:\3dvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\vjdvp.exec:\vjdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\dvjdp.exec:\dvjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\fxrfrrl.exec:\fxrfrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\btbnht.exec:\btbnht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\7jvpj.exec:\7jvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\vpddd.exec:\vpddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\lffrllf.exec:\lffrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\ttnnhh.exec:\ttnnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\tntnbt.exec:\tntnbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\pdddv.exec:\pdddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\dvddp.exec:\dvddp.exe23⤵
- Executes dropped EXE
PID:3424 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe24⤵
- Executes dropped EXE
PID:4712 -
\??\c:\fllfffx.exec:\fllfffx.exe25⤵
- Executes dropped EXE
PID:4944 -
\??\c:\tnnnhn.exec:\tnnnhn.exe26⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vpjvj.exec:\vpjvj.exe27⤵
- Executes dropped EXE
PID:3200 -
\??\c:\frlfffx.exec:\frlfffx.exe28⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xxrrlfx.exec:\xxrrlfx.exe29⤵
- Executes dropped EXE
PID:3484 -
\??\c:\tbbtnn.exec:\tbbtnn.exe30⤵
- Executes dropped EXE
PID:3120 -
\??\c:\vpvpv.exec:\vpvpv.exe31⤵
- Executes dropped EXE
PID:4692 -
\??\c:\vdjdv.exec:\vdjdv.exe32⤵
- Executes dropped EXE
PID:4540 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe33⤵
- Executes dropped EXE
PID:1168 -
\??\c:\3rllrrx.exec:\3rllrrx.exe34⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hnbtnn.exec:\hnbtnn.exe35⤵
- Executes dropped EXE
PID:3592 -
\??\c:\nhtttt.exec:\nhtttt.exe36⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe37⤵
- Executes dropped EXE
PID:656 -
\??\c:\3fllllf.exec:\3fllllf.exe38⤵
- Executes dropped EXE
PID:4976 -
\??\c:\hthttb.exec:\hthttb.exe39⤵
- Executes dropped EXE
PID:3672 -
\??\c:\ddjvd.exec:\ddjvd.exe40⤵
- Executes dropped EXE
PID:3884 -
\??\c:\1ppvj.exec:\1ppvj.exe41⤵
- Executes dropped EXE
PID:4024 -
\??\c:\lflflrx.exec:\lflflrx.exe42⤵
- Executes dropped EXE
PID:3660 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe43⤵
- Executes dropped EXE
PID:4492 -
\??\c:\thhhhh.exec:\thhhhh.exe44⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hbthnh.exec:\hbthnh.exe45⤵
- Executes dropped EXE
PID:4380 -
\??\c:\dvvpj.exec:\dvvpj.exe46⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rlxrfff.exec:\rlxrfff.exe47⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe48⤵
- Executes dropped EXE
PID:920 -
\??\c:\htbbhh.exec:\htbbhh.exe49⤵
- Executes dropped EXE
PID:4284 -
\??\c:\htbbtt.exec:\htbbtt.exe50⤵
- Executes dropped EXE
PID:32 -
\??\c:\ppjjv.exec:\ppjjv.exe51⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe52⤵
- Executes dropped EXE
PID:1440 -
\??\c:\lllfxxf.exec:\lllfxxf.exe53⤵
- Executes dropped EXE
PID:3508 -
\??\c:\tntnnn.exec:\tntnnn.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\nnhhbh.exec:\nnhhbh.exe55⤵
- Executes dropped EXE
PID:1832 -
\??\c:\djpjv.exec:\djpjv.exe56⤵
- Executes dropped EXE
PID:3156 -
\??\c:\7pdvp.exec:\7pdvp.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rlllfff.exec:\rlllfff.exe58⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lfllfff.exec:\lfllfff.exe59⤵
- Executes dropped EXE
PID:3596 -
\??\c:\hnnhbb.exec:\hnnhbb.exe60⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nnbtbb.exec:\nnbtbb.exe61⤵
- Executes dropped EXE
PID:1660 -
\??\c:\tntnhh.exec:\tntnhh.exe62⤵
- Executes dropped EXE
PID:384 -
\??\c:\5jddv.exec:\5jddv.exe63⤵
- Executes dropped EXE
PID:3716 -
\??\c:\vvvvj.exec:\vvvvj.exe64⤵
- Executes dropped EXE
PID:4424 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe65⤵
- Executes dropped EXE
PID:1888 -
\??\c:\tnnhbb.exec:\tnnhbb.exe66⤵PID:1844
-
\??\c:\nhnhbb.exec:\nhnhbb.exe67⤵PID:2836
-
\??\c:\jvvjd.exec:\jvvjd.exe68⤵PID:2668
-
\??\c:\7pdvp.exec:\7pdvp.exe69⤵PID:4268
-
\??\c:\fxffrff.exec:\fxffrff.exe70⤵PID:2776
-
\??\c:\llffrrr.exec:\llffrrr.exe71⤵PID:1124
-
\??\c:\nnnbtt.exec:\nnnbtt.exe72⤵PID:3700
-
\??\c:\5ntnhh.exec:\5ntnhh.exe73⤵PID:1912
-
\??\c:\vpdvv.exec:\vpdvv.exe74⤵PID:2060
-
\??\c:\lfrlrlr.exec:\lfrlrlr.exe75⤵PID:2592
-
\??\c:\lffxfff.exec:\lffxfff.exe76⤵PID:2052
-
\??\c:\nhhhhh.exec:\nhhhhh.exe77⤵PID:2652
-
\??\c:\thbttn.exec:\thbttn.exe78⤵PID:3932
-
\??\c:\jjddj.exec:\jjddj.exe79⤵PID:1744
-
\??\c:\dpvpj.exec:\dpvpj.exe80⤵PID:2828
-
\??\c:\xlxrlll.exec:\xlxrlll.exe81⤵PID:2772
-
\??\c:\1fffrrf.exec:\1fffrrf.exe82⤵PID:2252
-
\??\c:\httnhn.exec:\httnhn.exe83⤵PID:5100
-
\??\c:\nhhbtt.exec:\nhhbtt.exe84⤵PID:816
-
\??\c:\vvpjd.exec:\vvpjd.exe85⤵PID:2088
-
\??\c:\jvdvv.exec:\jvdvv.exe86⤵PID:684
-
\??\c:\lrlfxll.exec:\lrlfxll.exe87⤵PID:4732
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe88⤵PID:3164
-
\??\c:\9hhhbh.exec:\9hhhbh.exe89⤵PID:1972
-
\??\c:\nhnhhh.exec:\nhnhhh.exe90⤵PID:3936
-
\??\c:\hbbtnn.exec:\hbbtnn.exe91⤵PID:1824
-
\??\c:\ppppd.exec:\ppppd.exe92⤵PID:3060
-
\??\c:\1vvdp.exec:\1vvdp.exe93⤵PID:4764
-
\??\c:\9xrllll.exec:\9xrllll.exe94⤵PID:4252
-
\??\c:\9fffxxx.exec:\9fffxxx.exe95⤵PID:1504
-
\??\c:\nntnnn.exec:\nntnnn.exe96⤵PID:2520
-
\??\c:\vddvp.exec:\vddvp.exe97⤵PID:4404
-
\??\c:\lrxxrlx.exec:\lrxxrlx.exe98⤵PID:320
-
\??\c:\bhnbht.exec:\bhnbht.exe99⤵PID:5080
-
\??\c:\bnthbb.exec:\bnthbb.exe100⤵PID:3296
-
\??\c:\3djpp.exec:\3djpp.exe101⤵PID:3292
-
\??\c:\dvdvp.exec:\dvdvp.exe102⤵PID:1716
-
\??\c:\xrxrllf.exec:\xrxrllf.exe103⤵PID:4508
-
\??\c:\tnhbbb.exec:\tnhbbb.exe104⤵PID:4996
-
\??\c:\dvvpp.exec:\dvvpp.exe105⤵PID:4612
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe106⤵PID:2040
-
\??\c:\bttnnn.exec:\bttnnn.exe107⤵PID:5016
-
\??\c:\hbbbbh.exec:\hbbbbh.exe108⤵PID:3996
-
\??\c:\jvvpj.exec:\jvvpj.exe109⤵PID:1560
-
\??\c:\rlrlxxf.exec:\rlrlxxf.exe110⤵PID:2428
-
\??\c:\htnthh.exec:\htnthh.exe111⤵PID:1488
-
\??\c:\bttnhh.exec:\bttnhh.exe112⤵PID:1136
-
\??\c:\vpvpj.exec:\vpvpj.exe113⤵PID:4432
-
\??\c:\flxlxxr.exec:\flxlxxr.exe114⤵PID:2020
-
\??\c:\fxfxrrf.exec:\fxfxrrf.exe115⤵PID:3452
-
\??\c:\bhthtn.exec:\bhthtn.exe116⤵PID:384
-
\??\c:\1jjdd.exec:\1jjdd.exe117⤵PID:2304
-
\??\c:\xlfrxxr.exec:\xlfrxxr.exe118⤵PID:1656
-
\??\c:\nbttnt.exec:\nbttnt.exe119⤵PID:1432
-
\??\c:\dpppd.exec:\dpppd.exe120⤵PID:60
-
\??\c:\1jdvv.exec:\1jdvv.exe121⤵PID:3284
-
\??\c:\rllfxxx.exec:\rllfxxx.exe122⤵PID:4436
-
\??\c:\9rllffx.exec:\9rllffx.exe123⤵PID:952
-
\??\c:\ntttnn.exec:\ntttnn.exe124⤵PID:2596
-
\??\c:\vjdvj.exec:\vjdvj.exe125⤵PID:3960
-
\??\c:\thhhbh.exec:\thhhbh.exe126⤵PID:3700
-
\??\c:\hnbttt.exec:\hnbttt.exe127⤵PID:4104
-
\??\c:\ddjjd.exec:\ddjjd.exe128⤵PID:3644
-
\??\c:\1rrlxxr.exec:\1rrlxxr.exe129⤵PID:680
-
\??\c:\frxfxxr.exec:\frxfxxr.exe130⤵PID:4904
-
\??\c:\3httbh.exec:\3httbh.exe131⤵PID:4076
-
\??\c:\pjjdv.exec:\pjjdv.exe132⤵PID:4012
-
\??\c:\frxxllr.exec:\frxxllr.exe133⤵PID:3484
-
\??\c:\xfllfxr.exec:\xfllfxr.exe134⤵PID:4632
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe135⤵PID:3820
-
\??\c:\bhthth.exec:\bhthth.exe136⤵PID:4428
-
\??\c:\vvvvp.exec:\vvvvp.exe137⤵PID:4536
-
\??\c:\5lffxrr.exec:\5lffxrr.exe138⤵PID:4784
-
\??\c:\btbbhh.exec:\btbbhh.exe139⤵PID:4780
-
\??\c:\dvjjd.exec:\dvjjd.exe140⤵PID:2284
-
\??\c:\5jpjd.exec:\5jpjd.exe141⤵PID:2172
-
\??\c:\xlllfff.exec:\xlllfff.exe142⤵PID:4048
-
\??\c:\thhhbb.exec:\thhhbb.exe143⤵PID:1664
-
\??\c:\vddvv.exec:\vddvv.exe144⤵PID:4896
-
\??\c:\lrxrlff.exec:\lrxrlff.exe145⤵PID:980
-
\??\c:\bttnhb.exec:\bttnhb.exe146⤵PID:4796
-
\??\c:\pdpjv.exec:\pdpjv.exe147⤵PID:4368
-
\??\c:\pdddd.exec:\pdddd.exe148⤵PID:4192
-
\??\c:\lffxrll.exec:\lffxrll.exe149⤵PID:4200
-
\??\c:\hbhbtt.exec:\hbhbtt.exe150⤵PID:2108
-
\??\c:\jvdvj.exec:\jvdvj.exe151⤵PID:1148
-
\??\c:\pvvjd.exec:\pvvjd.exe152⤵PID:1924
-
\??\c:\xrrlrrr.exec:\xrrlrrr.exe153⤵PID:2980
-
\??\c:\lxxllll.exec:\lxxllll.exe154⤵PID:3232
-
\??\c:\bntttt.exec:\bntttt.exe155⤵PID:4572
-
\??\c:\nhhttn.exec:\nhhttn.exe156⤵PID:2056
-
\??\c:\dvddd.exec:\dvddd.exe157⤵PID:4612
-
\??\c:\ppdvd.exec:\ppdvd.exe158⤵PID:1436
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe159⤵PID:2264
-
\??\c:\xfrrllf.exec:\xfrrllf.exe160⤵PID:1964
-
\??\c:\nthbtt.exec:\nthbtt.exe161⤵PID:2696
-
\??\c:\bthbbb.exec:\bthbbb.exe162⤵PID:2148
-
\??\c:\jdppj.exec:\jdppj.exe163⤵PID:4760
-
\??\c:\pjddv.exec:\pjddv.exe164⤵PID:3160
-
\??\c:\llrlfff.exec:\llrlfff.exe165⤵PID:3716
-
\??\c:\9rxxrff.exec:\9rxxrff.exe166⤵PID:3476
-
\??\c:\3bbbbh.exec:\3bbbbh.exe167⤵PID:1388
-
\??\c:\xffxxfl.exec:\xffxxfl.exe168⤵PID:1276
-
\??\c:\bbnhhh.exec:\bbnhhh.exe169⤵PID:1844
-
\??\c:\jddvp.exec:\jddvp.exe170⤵PID:600
-
\??\c:\vjpjv.exec:\vjpjv.exe171⤵PID:4332
-
\??\c:\bnhtnn.exec:\bnhtnn.exe172⤵PID:4116
-
\??\c:\pdddv.exec:\pdddv.exe173⤵PID:2540
-
\??\c:\xrrllll.exec:\xrrllll.exe174⤵PID:2160
-
\??\c:\flxlllf.exec:\flxlllf.exe175⤵PID:1384
-
\??\c:\nbttnh.exec:\nbttnh.exe176⤵PID:3948
-
\??\c:\rllfxrl.exec:\rllfxrl.exe177⤵PID:1880
-
\??\c:\1rlrxxx.exec:\1rlrxxx.exe178⤵PID:2652
-
\??\c:\nttttt.exec:\nttttt.exe179⤵PID:3304
-
\??\c:\jdjpj.exec:\jdjpj.exe180⤵PID:2012
-
\??\c:\fffxxff.exec:\fffxxff.exe181⤵PID:2364
-
\??\c:\bbbbtn.exec:\bbbbtn.exe182⤵PID:2296
-
\??\c:\3vppp.exec:\3vppp.exe183⤵PID:2936
-
\??\c:\7vvpd.exec:\7vvpd.exe184⤵PID:4540
-
\??\c:\lrxrlrf.exec:\lrxrlrf.exe185⤵PID:4428
-
\??\c:\jvdvp.exec:\jvdvp.exe186⤵PID:1408
-
\??\c:\dpppj.exec:\dpppj.exe187⤵PID:4784
-
\??\c:\xfffxrl.exec:\xfffxrl.exe188⤵PID:684
-
\??\c:\bbttnb.exec:\bbttnb.exe189⤵PID:2284
-
\??\c:\nbhbtt.exec:\nbhbtt.exe190⤵PID:2172
-
\??\c:\7vvdv.exec:\7vvdv.exe191⤵PID:4048
-
\??\c:\fffxxrr.exec:\fffxxrr.exe192⤵PID:1664
-
\??\c:\djvdd.exec:\djvdd.exe193⤵PID:4896
-
\??\c:\xrrxllf.exec:\xrrxllf.exe194⤵PID:980
-
\??\c:\nbbhbb.exec:\nbbhbb.exe195⤵PID:4504
-
\??\c:\pjjdd.exec:\pjjdd.exe196⤵PID:4396
-
\??\c:\dvvpp.exec:\dvvpp.exe197⤵PID:4400
-
\??\c:\lrxxrfr.exec:\lrxxrfr.exe198⤵PID:1532
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe199⤵PID:4320
-
\??\c:\nnbhhn.exec:\nnbhhn.exe200⤵PID:2956
-
\??\c:\vvpjd.exec:\vvpjd.exe201⤵PID:2276
-
\??\c:\pddvp.exec:\pddvp.exe202⤵PID:3296
-
\??\c:\lfrxrxx.exec:\lfrxrxx.exe203⤵PID:3236
-
\??\c:\7rrlfff.exec:\7rrlfff.exe204⤵PID:2676
-
\??\c:\bhtthh.exec:\bhtthh.exe205⤵PID:2056
-
\??\c:\bnhbnn.exec:\bnhbnn.exe206⤵PID:3508
-
\??\c:\1djdp.exec:\1djdp.exe207⤵PID:4004
-
\??\c:\pjvpp.exec:\pjvpp.exe208⤵PID:2968
-
\??\c:\frxrlfx.exec:\frxrlfx.exe209⤵PID:1964
-
\??\c:\bnnnhh.exec:\bnnnhh.exe210⤵PID:4248
-
\??\c:\tttntt.exec:\tttntt.exe211⤵PID:1660
-
\??\c:\vddvd.exec:\vddvd.exe212⤵PID:4760
-
\??\c:\rffxllf.exec:\rffxllf.exe213⤵PID:2380
-
\??\c:\nbttnn.exec:\nbttnn.exe214⤵PID:4080
-
\??\c:\hhhbnn.exec:\hhhbnn.exe215⤵PID:216
-
\??\c:\3hhbtt.exec:\3hhbtt.exe216⤵PID:2896
-
\??\c:\1djdp.exec:\1djdp.exe217⤵PID:2068
-
\??\c:\ppvvp.exec:\ppvvp.exe218⤵PID:2272
-
\??\c:\fffxlll.exec:\fffxlll.exe219⤵PID:1552
-
\??\c:\thhtnb.exec:\thhtnb.exe220⤵PID:1812
-
\??\c:\9hhbtb.exec:\9hhbtb.exe221⤵PID:3908
-
\??\c:\5djdj.exec:\5djdj.exe222⤵PID:4036
-
\??\c:\pdjdv.exec:\pdjdv.exe223⤵PID:4700
-
\??\c:\rrrlfff.exec:\rrrlfff.exe224⤵PID:4292
-
\??\c:\3bbhht.exec:\3bbhht.exe225⤵PID:968
-
\??\c:\3tbtbt.exec:\3tbtbt.exe226⤵PID:744
-
\??\c:\ddddp.exec:\ddddp.exe227⤵PID:1712
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe228⤵PID:640
-
\??\c:\flrlffr.exec:\flrlffr.exe229⤵PID:2224
-
\??\c:\nhnhhn.exec:\nhnhhn.exe230⤵PID:1352
-
\??\c:\htnhbb.exec:\htnhbb.exe231⤵PID:4012
-
\??\c:\dddvj.exec:\dddvj.exe232⤵PID:2364
-
\??\c:\vvpjp.exec:\vvpjp.exe233⤵PID:2296
-
\??\c:\9llxxrr.exec:\9llxxrr.exe234⤵PID:2936
-
\??\c:\9fflfxr.exec:\9fflfxr.exe235⤵PID:816
-
\??\c:\9hntnt.exec:\9hntnt.exe236⤵PID:4428
-
\??\c:\jdjdd.exec:\jdjdd.exe237⤵PID:2320
-
\??\c:\jdjdv.exec:\jdjdv.exe238⤵PID:1528
-
\??\c:\fxxrlll.exec:\fxxrlll.exe239⤵PID:3164
-
\??\c:\7xlfxxf.exec:\7xlfxxf.exe240⤵PID:2284
-
\??\c:\1ntntn.exec:\1ntntn.exe241⤵PID:3936
-
\??\c:\bhtttb.exec:\bhtttb.exe242⤵PID:1824