Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:06
Behavioral task
behavioral1
Sample
de026e408641aa382458861d7d682100_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
de026e408641aa382458861d7d682100_NeikiAnalytics.exe
-
Size
273KB
-
MD5
de026e408641aa382458861d7d682100
-
SHA1
e23453b651a0d917e0b8436cabf5c608249d61e8
-
SHA256
ec1a857394f54bc01c476cd74b67a53c63887602a7e9b75a06e0eda3caa826f2
-
SHA512
2ebbeecae8bca786de434263b8c223dd021d9e097e0924021f06486b5544ae91003bf31ca38431a22c13bb7914c70d5a81ad421436ae046998e0ccac0d11ef18
-
SSDEEP
6144:Ycm4FmowdHoSgWrXF5lpKGYV0aTk/BO0XJm4UEPOshN/xdKnvP48bmQ:e4wFHoSgWjdpKGATTk/jYIOWN/KnnP/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4880-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/100-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1224-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/712-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3416-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/792-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-622-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/712-695-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-768-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-781-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-837-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-922-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-1039-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rlllfff.exepvddd.exexrrlffx.exehthbhn.exe9djdj.exethhnhn.exexxxfffx.exe1thhnn.exedvppj.exe7xxxrxx.exedjjdv.exerfffxxx.exe9dpjd.exe1lxxrrl.exe5ntntt.exepjdvj.exe5nttnn.exepjppp.exexrxrffx.exetbttbb.exejpvvv.exelxxxrrr.exe1bhbbh.exepvjdd.exe7lrlllr.exebtbbtb.exe5vpjj.exe9htttt.exe5ddvp.exehhnnbh.exe9pjdv.exe9dvvj.exehbhbtt.exevpvpp.exedvjdd.exe7lxrllf.exehnhnbt.exejvvpd.exexlxrllf.exexxlfxrf.exehnbhnn.exevpvpj.exerxlfffr.exennbttb.exe1hhnbt.exefxllfff.exennthhh.exeppvpj.exevpjdj.exelrfxxxx.exe7ttnnt.exedvvpj.exefflfxxf.exethbbtt.exehhbtbb.exedpvpp.exefffxrff.exelxxrlll.exethbbtb.exe7djdd.exedpdvv.exexlfxllf.exenbtnhh.exe9bbbtt.exepid process 2356 rlllfff.exe 100 pvddd.exe 1800 xrrlffx.exe 1204 hthbhn.exe 2848 9djdj.exe 3432 thhnhn.exe 1124 xxxfffx.exe 1076 1thhnn.exe 1324 dvppj.exe 3144 7xxxrxx.exe 1672 djjdv.exe 2008 rfffxxx.exe 1920 9dpjd.exe 5028 1lxxrrl.exe 1224 5ntntt.exe 1152 pjdvj.exe 4752 5nttnn.exe 4608 pjppp.exe 1852 xrxrffx.exe 712 tbttbb.exe 4552 jpvvv.exe 1912 lxxxrrr.exe 4332 1bhbbh.exe 2712 pvjdd.exe 3216 7lrlllr.exe 2268 btbbtb.exe 1444 5vpjj.exe 4984 9htttt.exe 2312 5ddvp.exe 4972 hhnnbh.exe 3416 9pjdv.exe 3700 9dvvj.exe 844 hbhbtt.exe 3828 vpvpp.exe 3548 dvjdd.exe 3244 7lxrllf.exe 2284 hnhnbt.exe 2592 jvvpd.exe 2000 xlxrllf.exe 2180 xxlfxrf.exe 4968 hnbhnn.exe 4860 vpvpj.exe 4512 rxlfffr.exe 4684 nnbttb.exe 3252 1hhnbt.exe 116 fxllfff.exe 3652 nnthhh.exe 4124 ppvpj.exe 732 vpjdj.exe 2540 lrfxxxx.exe 4592 7ttnnt.exe 3044 dvvpj.exe 3432 fflfxxf.exe 1948 thbbtt.exe 1952 hhbtbb.exe 3948 dpvpp.exe 5072 fffxrff.exe 3096 lxxrlll.exe 4852 thbbtb.exe 4996 7djdd.exe 3112 dpdvv.exe 3992 xlfxllf.exe 4436 nbtnhh.exe 4976 9bbbtt.exe -
Processes:
resource yara_rule behavioral2/memory/4880-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlllfff.exe upx behavioral2/memory/4880-4-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvddd.exe upx behavioral2/memory/2356-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/100-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrlffx.exe upx C:\hthbhn.exe upx behavioral2/memory/1204-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1800-20-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9djdj.exe upx behavioral2/memory/2848-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thhnhn.exe upx behavioral2/memory/3432-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxfffx.exe upx behavioral2/memory/3432-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1124-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1thhnn.exe upx behavioral2/memory/1124-42-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvppj.exe upx behavioral2/memory/1324-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7xxxrxx.exe upx behavioral2/memory/3144-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djjdv.exe upx behavioral2/memory/3144-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1672-62-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rfffxxx.exe upx C:\9dpjd.exe upx behavioral2/memory/2008-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1920-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1lxxrrl.exe upx C:\5ntntt.exe upx \??\c:\pjdvj.exe upx behavioral2/memory/1224-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1152-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5nttnn.exe upx C:\pjppp.exe upx behavioral2/memory/4752-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxrffx.exe upx behavioral2/memory/1852-101-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbttbb.exe upx behavioral2/memory/712-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpvvv.exe upx behavioral2/memory/4552-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxxxrrr.exe upx behavioral2/memory/1912-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1bhbbh.exe upx behavioral2/memory/4332-117-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvjdd.exe upx C:\7lrlllr.exe upx C:\btbbtb.exe upx behavioral2/memory/3216-127-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5vpjj.exe upx C:\9htttt.exe upx behavioral2/memory/1444-136-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5ddvp.exe upx behavioral2/memory/4984-140-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhnnbh.exe upx behavioral2/memory/2312-148-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9pjdv.exe upx behavioral2/memory/3416-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9dvvj.exe upx behavioral2/memory/3700-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/844-162-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
de026e408641aa382458861d7d682100_NeikiAnalytics.exerlllfff.exepvddd.exexrrlffx.exehthbhn.exe9djdj.exethhnhn.exexxxfffx.exe1thhnn.exedvppj.exe7xxxrxx.exedjjdv.exerfffxxx.exe9dpjd.exe1lxxrrl.exe5ntntt.exepjdvj.exe5nttnn.exepjppp.exexrxrffx.exetbttbb.exejpvvv.exedescription pid process target process PID 4880 wrote to memory of 2356 4880 de026e408641aa382458861d7d682100_NeikiAnalytics.exe rlllfff.exe PID 4880 wrote to memory of 2356 4880 de026e408641aa382458861d7d682100_NeikiAnalytics.exe rlllfff.exe PID 4880 wrote to memory of 2356 4880 de026e408641aa382458861d7d682100_NeikiAnalytics.exe rlllfff.exe PID 2356 wrote to memory of 100 2356 rlllfff.exe pvddd.exe PID 2356 wrote to memory of 100 2356 rlllfff.exe pvddd.exe PID 2356 wrote to memory of 100 2356 rlllfff.exe pvddd.exe PID 100 wrote to memory of 1800 100 pvddd.exe xrrlffx.exe PID 100 wrote to memory of 1800 100 pvddd.exe xrrlffx.exe PID 100 wrote to memory of 1800 100 pvddd.exe xrrlffx.exe PID 1800 wrote to memory of 1204 1800 xrrlffx.exe hthbhn.exe PID 1800 wrote to memory of 1204 1800 xrrlffx.exe hthbhn.exe PID 1800 wrote to memory of 1204 1800 xrrlffx.exe hthbhn.exe PID 1204 wrote to memory of 2848 1204 hthbhn.exe 9djdj.exe PID 1204 wrote to memory of 2848 1204 hthbhn.exe 9djdj.exe PID 1204 wrote to memory of 2848 1204 hthbhn.exe 9djdj.exe PID 2848 wrote to memory of 3432 2848 9djdj.exe thhnhn.exe PID 2848 wrote to memory of 3432 2848 9djdj.exe thhnhn.exe PID 2848 wrote to memory of 3432 2848 9djdj.exe thhnhn.exe PID 3432 wrote to memory of 1124 3432 thhnhn.exe xxxfffx.exe PID 3432 wrote to memory of 1124 3432 thhnhn.exe xxxfffx.exe PID 3432 wrote to memory of 1124 3432 thhnhn.exe xxxfffx.exe PID 1124 wrote to memory of 1076 1124 xxxfffx.exe 1thhnn.exe PID 1124 wrote to memory of 1076 1124 xxxfffx.exe 1thhnn.exe PID 1124 wrote to memory of 1076 1124 xxxfffx.exe 1thhnn.exe PID 1076 wrote to memory of 1324 1076 1thhnn.exe dvppj.exe PID 1076 wrote to memory of 1324 1076 1thhnn.exe dvppj.exe PID 1076 wrote to memory of 1324 1076 1thhnn.exe dvppj.exe PID 1324 wrote to memory of 3144 1324 dvppj.exe 7xxxrxx.exe PID 1324 wrote to memory of 3144 1324 dvppj.exe 7xxxrxx.exe PID 1324 wrote to memory of 3144 1324 dvppj.exe 7xxxrxx.exe PID 3144 wrote to memory of 1672 3144 7xxxrxx.exe djjdv.exe PID 3144 wrote to memory of 1672 3144 7xxxrxx.exe djjdv.exe PID 3144 wrote to memory of 1672 3144 7xxxrxx.exe djjdv.exe PID 1672 wrote to memory of 2008 1672 djjdv.exe rfffxxx.exe PID 1672 wrote to memory of 2008 1672 djjdv.exe rfffxxx.exe PID 1672 wrote to memory of 2008 1672 djjdv.exe rfffxxx.exe PID 2008 wrote to memory of 1920 2008 rfffxxx.exe 9dpjd.exe PID 2008 wrote to memory of 1920 2008 rfffxxx.exe 9dpjd.exe PID 2008 wrote to memory of 1920 2008 rfffxxx.exe 9dpjd.exe PID 1920 wrote to memory of 5028 1920 9dpjd.exe 1lxxrrl.exe PID 1920 wrote to memory of 5028 1920 9dpjd.exe 1lxxrrl.exe PID 1920 wrote to memory of 5028 1920 9dpjd.exe 1lxxrrl.exe PID 5028 wrote to memory of 1224 5028 1lxxrrl.exe 5ntntt.exe PID 5028 wrote to memory of 1224 5028 1lxxrrl.exe 5ntntt.exe PID 5028 wrote to memory of 1224 5028 1lxxrrl.exe 5ntntt.exe PID 1224 wrote to memory of 1152 1224 5ntntt.exe pjdvj.exe PID 1224 wrote to memory of 1152 1224 5ntntt.exe pjdvj.exe PID 1224 wrote to memory of 1152 1224 5ntntt.exe pjdvj.exe PID 1152 wrote to memory of 4752 1152 pjdvj.exe 5nttnn.exe PID 1152 wrote to memory of 4752 1152 pjdvj.exe 5nttnn.exe PID 1152 wrote to memory of 4752 1152 pjdvj.exe 5nttnn.exe PID 4752 wrote to memory of 4608 4752 5nttnn.exe pjppp.exe PID 4752 wrote to memory of 4608 4752 5nttnn.exe pjppp.exe PID 4752 wrote to memory of 4608 4752 5nttnn.exe pjppp.exe PID 4608 wrote to memory of 1852 4608 pjppp.exe xrxrffx.exe PID 4608 wrote to memory of 1852 4608 pjppp.exe xrxrffx.exe PID 4608 wrote to memory of 1852 4608 pjppp.exe xrxrffx.exe PID 1852 wrote to memory of 712 1852 xrxrffx.exe tbttbb.exe PID 1852 wrote to memory of 712 1852 xrxrffx.exe tbttbb.exe PID 1852 wrote to memory of 712 1852 xrxrffx.exe tbttbb.exe PID 712 wrote to memory of 4552 712 tbttbb.exe jpvvv.exe PID 712 wrote to memory of 4552 712 tbttbb.exe jpvvv.exe PID 712 wrote to memory of 4552 712 tbttbb.exe jpvvv.exe PID 4552 wrote to memory of 1912 4552 jpvvv.exe lxxxrrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de026e408641aa382458861d7d682100_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\de026e408641aa382458861d7d682100_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\rlllfff.exec:\rlllfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pvddd.exec:\pvddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\xrrlffx.exec:\xrrlffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\hthbhn.exec:\hthbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\9djdj.exec:\9djdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\thhnhn.exec:\thhnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\xxxfffx.exec:\xxxfffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\1thhnn.exec:\1thhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\dvppj.exec:\dvppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\7xxxrxx.exec:\7xxxrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\djjdv.exec:\djjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\rfffxxx.exec:\rfffxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\9dpjd.exec:\9dpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\1lxxrrl.exec:\1lxxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\5ntntt.exec:\5ntntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\pjdvj.exec:\pjdvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\5nttnn.exec:\5nttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\pjppp.exec:\pjppp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\xrxrffx.exec:\xrxrffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\tbttbb.exec:\tbttbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\jpvvv.exec:\jpvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe23⤵
- Executes dropped EXE
PID:1912 -
\??\c:\1bhbbh.exec:\1bhbbh.exe24⤵
- Executes dropped EXE
PID:4332 -
\??\c:\pvjdd.exec:\pvjdd.exe25⤵
- Executes dropped EXE
PID:2712 -
\??\c:\7lrlllr.exec:\7lrlllr.exe26⤵
- Executes dropped EXE
PID:3216 -
\??\c:\btbbtb.exec:\btbbtb.exe27⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5vpjj.exec:\5vpjj.exe28⤵
- Executes dropped EXE
PID:1444 -
\??\c:\9htttt.exec:\9htttt.exe29⤵
- Executes dropped EXE
PID:4984 -
\??\c:\5ddvp.exec:\5ddvp.exe30⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hhnnbh.exec:\hhnnbh.exe31⤵
- Executes dropped EXE
PID:4972 -
\??\c:\9pjdv.exec:\9pjdv.exe32⤵
- Executes dropped EXE
PID:3416 -
\??\c:\9dvvj.exec:\9dvvj.exe33⤵
- Executes dropped EXE
PID:3700 -
\??\c:\hbhbtt.exec:\hbhbtt.exe34⤵
- Executes dropped EXE
PID:844 -
\??\c:\vpvpp.exec:\vpvpp.exe35⤵
- Executes dropped EXE
PID:3828 -
\??\c:\dvjdd.exec:\dvjdd.exe36⤵
- Executes dropped EXE
PID:3548 -
\??\c:\7lxrllf.exec:\7lxrllf.exe37⤵
- Executes dropped EXE
PID:3244 -
\??\c:\hnhnbt.exec:\hnhnbt.exe38⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jvvpd.exec:\jvvpd.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xlxrllf.exec:\xlxrllf.exe40⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xxlfxrf.exec:\xxlfxrf.exe41⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hnbhnn.exec:\hnbhnn.exe42⤵
- Executes dropped EXE
PID:4968 -
\??\c:\vpvpj.exec:\vpvpj.exe43⤵
- Executes dropped EXE
PID:4860 -
\??\c:\rxlfffr.exec:\rxlfffr.exe44⤵
- Executes dropped EXE
PID:4512 -
\??\c:\nnbttb.exec:\nnbttb.exe45⤵
- Executes dropped EXE
PID:4684 -
\??\c:\1hhnbt.exec:\1hhnbt.exe46⤵
- Executes dropped EXE
PID:3252 -
\??\c:\fxllfff.exec:\fxllfff.exe47⤵
- Executes dropped EXE
PID:116 -
\??\c:\nnthhh.exec:\nnthhh.exe48⤵
- Executes dropped EXE
PID:3652 -
\??\c:\ppvpj.exec:\ppvpj.exe49⤵
- Executes dropped EXE
PID:4124 -
\??\c:\vpjdj.exec:\vpjdj.exe50⤵
- Executes dropped EXE
PID:732 -
\??\c:\lrfxxxx.exec:\lrfxxxx.exe51⤵
- Executes dropped EXE
PID:2540 -
\??\c:\7ttnnt.exec:\7ttnnt.exe52⤵
- Executes dropped EXE
PID:4592 -
\??\c:\dvvpj.exec:\dvvpj.exe53⤵
- Executes dropped EXE
PID:3044 -
\??\c:\fflfxxf.exec:\fflfxxf.exe54⤵
- Executes dropped EXE
PID:3432 -
\??\c:\thbbtt.exec:\thbbtt.exe55⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hhbtbb.exec:\hhbtbb.exe56⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dpvpp.exec:\dpvpp.exe57⤵
- Executes dropped EXE
PID:3948 -
\??\c:\fffxrff.exec:\fffxrff.exe58⤵
- Executes dropped EXE
PID:5072 -
\??\c:\lxxrlll.exec:\lxxrlll.exe59⤵
- Executes dropped EXE
PID:3096 -
\??\c:\thbbtb.exec:\thbbtb.exe60⤵
- Executes dropped EXE
PID:4852 -
\??\c:\7djdd.exec:\7djdd.exe61⤵
- Executes dropped EXE
PID:4996 -
\??\c:\dpdvv.exec:\dpdvv.exe62⤵
- Executes dropped EXE
PID:3112 -
\??\c:\xlfxllf.exec:\xlfxllf.exe63⤵
- Executes dropped EXE
PID:3992 -
\??\c:\nbtnhh.exec:\nbtnhh.exe64⤵
- Executes dropped EXE
PID:4436 -
\??\c:\9bbbtt.exec:\9bbbtt.exe65⤵
- Executes dropped EXE
PID:4976 -
\??\c:\3ddvj.exec:\3ddvj.exe66⤵PID:1224
-
\??\c:\dvdvp.exec:\dvdvp.exe67⤵PID:548
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe68⤵PID:2192
-
\??\c:\1bhtnn.exec:\1bhtnn.exe69⤵PID:3408
-
\??\c:\tnhhhh.exec:\tnhhhh.exe70⤵PID:792
-
\??\c:\vvjdp.exec:\vvjdp.exe71⤵PID:5116
-
\??\c:\lxfxffx.exec:\lxfxffx.exe72⤵PID:1272
-
\??\c:\3bbhhh.exec:\3bbhhh.exe73⤵PID:3020
-
\??\c:\dvjjd.exec:\dvjjd.exe74⤵PID:4688
-
\??\c:\rfllffx.exec:\rfllffx.exe75⤵PID:4052
-
\??\c:\frlffxf.exec:\frlffxf.exe76⤵PID:3376
-
\??\c:\hbnbhn.exec:\hbnbhn.exe77⤵PID:1408
-
\??\c:\xlfxllf.exec:\xlfxllf.exe78⤵PID:2260
-
\??\c:\btnhbt.exec:\btnhbt.exe79⤵PID:540
-
\??\c:\thnhtt.exec:\thnhtt.exe80⤵PID:2060
-
\??\c:\djjdp.exec:\djjdp.exe81⤵PID:4960
-
\??\c:\pvvpj.exec:\pvvpj.exe82⤵PID:1744
-
\??\c:\9xfxrlf.exec:\9xfxrlf.exe83⤵PID:448
-
\??\c:\hntnhb.exec:\hntnhb.exe84⤵PID:2040
-
\??\c:\ddjdv.exec:\ddjdv.exe85⤵PID:2792
-
\??\c:\vvdpj.exec:\vvdpj.exe86⤵PID:760
-
\??\c:\rxflffx.exec:\rxflffx.exe87⤵PID:4908
-
\??\c:\ntttnn.exec:\ntttnn.exe88⤵PID:1536
-
\??\c:\thnnbb.exec:\thnnbb.exe89⤵PID:4280
-
\??\c:\3dddv.exec:\3dddv.exe90⤵PID:3928
-
\??\c:\1tnbnn.exec:\1tnbnn.exe91⤵PID:3548
-
\??\c:\7nttbb.exec:\7nttbb.exe92⤵PID:2324
-
\??\c:\vvjdj.exec:\vvjdj.exe93⤵PID:1200
-
\??\c:\rffxrrr.exec:\rffxrrr.exe94⤵PID:4784
-
\??\c:\xrffxxx.exec:\xrffxxx.exe95⤵PID:968
-
\??\c:\htbttn.exec:\htbttn.exe96⤵PID:2180
-
\??\c:\tbbnnb.exec:\tbbnnb.exe97⤵PID:932
-
\??\c:\dvjdp.exec:\dvjdp.exe98⤵PID:4348
-
\??\c:\fxxfxxx.exec:\fxxfxxx.exe99⤵PID:4880
-
\??\c:\bbttnn.exec:\bbttnn.exe100⤵PID:1796
-
\??\c:\nhhhtt.exec:\nhhhtt.exe101⤵PID:3976
-
\??\c:\vpjdp.exec:\vpjdp.exe102⤵PID:232
-
\??\c:\rrrrrll.exec:\rrrrrll.exe103⤵PID:2156
-
\??\c:\bntttt.exec:\bntttt.exe104⤵PID:3560
-
\??\c:\djvvp.exec:\djvvp.exe105⤵PID:1204
-
\??\c:\llrrlrx.exec:\llrrlrx.exe106⤵PID:4396
-
\??\c:\rxxxlxl.exec:\rxxxlxl.exe107⤵PID:2848
-
\??\c:\bttnnh.exec:\bttnnh.exe108⤵PID:1368
-
\??\c:\nhhhtt.exec:\nhhhtt.exe109⤵PID:4452
-
\??\c:\ppdjj.exec:\ppdjj.exe110⤵PID:3432
-
\??\c:\rlrlfll.exec:\rlrlfll.exe111⤵PID:1396
-
\??\c:\lflfffx.exec:\lflfffx.exe112⤵PID:3948
-
\??\c:\thtnnn.exec:\thtnnn.exe113⤵PID:1164
-
\??\c:\tthbbb.exec:\tthbbb.exe114⤵PID:2008
-
\??\c:\dvvpv.exec:\dvvpv.exe115⤵PID:1352
-
\??\c:\7lfxlll.exec:\7lfxlll.exe116⤵PID:3112
-
\??\c:\fxrlllr.exec:\fxrlllr.exe117⤵PID:2924
-
\??\c:\hhbbbb.exec:\hhbbbb.exe118⤵PID:492
-
\??\c:\hnnhbb.exec:\hnnhbb.exe119⤵PID:4876
-
\??\c:\dvpjd.exec:\dvpjd.exe120⤵PID:4508
-
\??\c:\3pddp.exec:\3pddp.exe121⤵PID:4232
-
\??\c:\rrxffff.exec:\rrxffff.exe122⤵PID:1888
-
\??\c:\lflxrxx.exec:\lflxrxx.exe123⤵PID:3348
-
\??\c:\3bhbth.exec:\3bhbth.exe124⤵PID:1272
-
\??\c:\9pdvv.exec:\9pdvv.exe125⤵PID:396
-
\??\c:\fffxrrr.exec:\fffxrrr.exe126⤵PID:4552
-
\??\c:\llllfll.exec:\llllfll.exe127⤵PID:1156
-
\??\c:\hnhbtn.exec:\hnhbtn.exe128⤵PID:5056
-
\??\c:\1djdv.exec:\1djdv.exe129⤵PID:4872
-
\??\c:\dvvpj.exec:\dvvpj.exe130⤵PID:2268
-
\??\c:\rrfxxxl.exec:\rrfxxxl.exe131⤵PID:3592
-
\??\c:\hbbtnh.exec:\hbbtnh.exe132⤵PID:3400
-
\??\c:\vppjd.exec:\vppjd.exe133⤵PID:448
-
\??\c:\lxrfffx.exec:\lxrfffx.exe134⤵PID:2040
-
\??\c:\llxlfrr.exec:\llxlfrr.exe135⤵PID:1704
-
\??\c:\tbhbbb.exec:\tbhbbb.exe136⤵PID:3700
-
\??\c:\hbhbbb.exec:\hbhbbb.exe137⤵PID:2492
-
\??\c:\1vpjv.exec:\1vpjv.exe138⤵PID:3828
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe139⤵PID:436
-
\??\c:\ffffxxr.exec:\ffffxxr.exe140⤵PID:2380
-
\??\c:\5bhhbh.exec:\5bhhbh.exe141⤵PID:636
-
\??\c:\hbhnhh.exec:\hbhnhh.exe142⤵PID:4532
-
\??\c:\pjjdv.exec:\pjjdv.exe143⤵PID:4788
-
\??\c:\jjvpp.exec:\jjvpp.exe144⤵PID:4364
-
\??\c:\xlxrffx.exec:\xlxrffx.exe145⤵PID:2876
-
\??\c:\nhnnht.exec:\nhnnht.exe146⤵PID:632
-
\??\c:\1ttttt.exec:\1ttttt.exe147⤵PID:1440
-
\??\c:\vpvvp.exec:\vpvvp.exe148⤵PID:4512
-
\??\c:\djjjj.exec:\djjjj.exe149⤵PID:2356
-
\??\c:\3xflxxr.exec:\3xflxxr.exe150⤵PID:4120
-
\??\c:\ffrrllf.exec:\ffrrllf.exe151⤵PID:752
-
\??\c:\nhbhbn.exec:\nhbhbn.exe152⤵PID:3516
-
\??\c:\1nnhtt.exec:\1nnhtt.exe153⤵PID:1000
-
\??\c:\pdjdv.exec:\pdjdv.exe154⤵PID:4208
-
\??\c:\vjvpd.exec:\vjvpd.exe155⤵PID:2540
-
\??\c:\rfffxff.exec:\rfffxff.exe156⤵PID:884
-
\??\c:\btbbtt.exec:\btbbtt.exe157⤵PID:4592
-
\??\c:\bnnhbb.exec:\bnnhbb.exe158⤵PID:3044
-
\??\c:\vpjpj.exec:\vpjpj.exe159⤵PID:1984
-
\??\c:\pdjdv.exec:\pdjdv.exe160⤵PID:4624
-
\??\c:\lxrflrl.exec:\lxrflrl.exe161⤵PID:1952
-
\??\c:\bttnhh.exec:\bttnhh.exe162⤵PID:2940
-
\??\c:\bbhhbh.exec:\bbhhbh.exe163⤵PID:3096
-
\??\c:\pvddv.exec:\pvddv.exe164⤵PID:3680
-
\??\c:\pdpdp.exec:\pdpdp.exe165⤵PID:2232
-
\??\c:\fflffff.exec:\fflffff.exe166⤵PID:2512
-
\??\c:\nnhhhh.exec:\nnhhhh.exe167⤵PID:3692
-
\??\c:\bbbthh.exec:\bbbthh.exe168⤵PID:4752
-
\??\c:\vjpdv.exec:\vjpdv.exe169⤵PID:1648
-
\??\c:\vvpjd.exec:\vvpjd.exe170⤵PID:2328
-
\??\c:\fxlfrrl.exec:\fxlfrrl.exe171⤵PID:2240
-
\??\c:\rlllfff.exec:\rlllfff.exe172⤵PID:1852
-
\??\c:\btbhbb.exec:\btbhbb.exe173⤵PID:4140
-
\??\c:\pdpjj.exec:\pdpjj.exe174⤵PID:3020
-
\??\c:\dvjdd.exec:\dvjdd.exe175⤵PID:4820
-
\??\c:\flfxllf.exec:\flfxllf.exe176⤵PID:464
-
\??\c:\rfflfff.exec:\rfflfff.exe177⤵PID:1276
-
\??\c:\3ttbhh.exec:\3ttbhh.exe178⤵PID:1912
-
\??\c:\bntnnn.exec:\bntnnn.exe179⤵PID:2296
-
\??\c:\vpvvp.exec:\vpvvp.exe180⤵PID:1788
-
\??\c:\lfrlxfx.exec:\lfrlxfx.exe181⤵PID:2212
-
\??\c:\hbtbnb.exec:\hbtbnb.exe182⤵PID:3080
-
\??\c:\ddpdj.exec:\ddpdj.exe183⤵PID:3732
-
\??\c:\pjpjd.exec:\pjpjd.exe184⤵PID:2312
-
\??\c:\9lfxlll.exec:\9lfxlll.exe185⤵PID:1744
-
\??\c:\7tnhbt.exec:\7tnhbt.exe186⤵PID:1664
-
\??\c:\3nbthh.exec:\3nbthh.exe187⤵PID:1588
-
\??\c:\jjvpj.exec:\jjvpj.exe188⤵PID:2792
-
\??\c:\dvvpj.exec:\dvvpj.exe189⤵PID:3076
-
\??\c:\rllfxrl.exec:\rllfxrl.exe190⤵PID:3700
-
\??\c:\bbhbnn.exec:\bbhbnn.exe191⤵PID:2492
-
\??\c:\thhbtn.exec:\thhbtn.exe192⤵PID:3828
-
\??\c:\pjjdp.exec:\pjjdp.exe193⤵PID:436
-
\??\c:\9pvpp.exec:\9pvpp.exe194⤵PID:2380
-
\??\c:\fffrlfx.exec:\fffrlfx.exe195⤵PID:4108
-
\??\c:\lxxrfxr.exec:\lxxrfxr.exe196⤵PID:2592
-
\??\c:\bntnhn.exec:\bntnhn.exe197⤵PID:4788
-
\??\c:\tbbthb.exec:\tbbthb.exe198⤵PID:4364
-
\??\c:\jdvdv.exec:\jdvdv.exe199⤵PID:2876
-
\??\c:\vpjdp.exec:\vpjdp.exe200⤵PID:632
-
\??\c:\rllxlfx.exec:\rllxlfx.exe201⤵PID:4524
-
\??\c:\rflxrrl.exec:\rflxrrl.exe202⤵PID:224
-
\??\c:\5btnnt.exec:\5btnnt.exe203⤵PID:348
-
\??\c:\vpjdv.exec:\vpjdv.exe204⤵PID:3976
-
\??\c:\vvpjj.exec:\vvpjj.exe205⤵PID:116
-
\??\c:\5xfrxrl.exec:\5xfrxrl.exe206⤵PID:3652
-
\??\c:\thtthh.exec:\thtthh.exe207⤵PID:4344
-
\??\c:\hntnbt.exec:\hntnbt.exe208⤵PID:5112
-
\??\c:\dvvpd.exec:\dvvpd.exe209⤵PID:2364
-
\??\c:\jvvjv.exec:\jvvjv.exe210⤵PID:3712
-
\??\c:\frrlxrl.exec:\frrlxrl.exe211⤵PID:1832
-
\??\c:\bntnhh.exec:\bntnhh.exe212⤵PID:3696
-
\??\c:\htntht.exec:\htntht.exe213⤵PID:1948
-
\??\c:\dvdvj.exec:\dvdvj.exe214⤵PID:1420
-
\??\c:\fflfrlf.exec:\fflfrlf.exe215⤵PID:2068
-
\??\c:\fxxxfxl.exec:\fxxxfxl.exe216⤵PID:1164
-
\??\c:\5bbbtn.exec:\5bbbtn.exe217⤵PID:1920
-
\??\c:\1ttnbb.exec:\1ttnbb.exe218⤵PID:3052
-
\??\c:\vddvj.exec:\vddvj.exe219⤵PID:3980
-
\??\c:\flxlfxr.exec:\flxlfxr.exe220⤵PID:1688
-
\??\c:\xffrfxl.exec:\xffrfxl.exe221⤵PID:4876
-
\??\c:\bbbtnh.exec:\bbbtnh.exe222⤵PID:2544
-
\??\c:\ddpjv.exec:\ddpjv.exe223⤵PID:792
-
\??\c:\pjdvp.exec:\pjdvp.exe224⤵PID:4840
-
\??\c:\lrxxllf.exec:\lrxxllf.exe225⤵PID:1852
-
\??\c:\bbntbh.exec:\bbntbh.exe226⤵PID:8
-
\??\c:\bbhhnn.exec:\bbhhnn.exe227⤵PID:1272
-
\??\c:\jvdvj.exec:\jvdvj.exe228⤵PID:4400
-
\??\c:\vvjdp.exec:\vvjdp.exe229⤵PID:3376
-
\??\c:\xlrrxlr.exec:\xlrrxlr.exe230⤵PID:3876
-
\??\c:\nhhhbb.exec:\nhhhbb.exe231⤵PID:1408
-
\??\c:\tntnhh.exec:\tntnhh.exe232⤵PID:4064
-
\??\c:\7ppdp.exec:\7ppdp.exe233⤵PID:2060
-
\??\c:\rfrrlff.exec:\rfrrlff.exe234⤵PID:876
-
\??\c:\fxxfrfl.exec:\fxxfrfl.exe235⤵PID:3780
-
\??\c:\hnbttt.exec:\hnbttt.exe236⤵PID:916
-
\??\c:\tbbbhh.exec:\tbbbhh.exe237⤵PID:4896
-
\??\c:\jjjvv.exec:\jjjvv.exe238⤵PID:3660
-
\??\c:\lfxrffx.exec:\lfxrffx.exe239⤵PID:2572
-
\??\c:\ffxxfxl.exec:\ffxxfxl.exe240⤵PID:1320
-
\??\c:\hnnhhh.exec:\hnnhhh.exe241⤵PID:760
-
\??\c:\dpvvp.exec:\dpvvp.exe242⤵PID:1536