Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 16:46
Behavioral task
behavioral1
Sample
f7291d3e892f10bcfce244e18c8331d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
f7291d3e892f10bcfce244e18c8331d0_NeikiAnalytics.exe
-
Size
498KB
-
MD5
f7291d3e892f10bcfce244e18c8331d0
-
SHA1
44090b900b484cb85214d54d546d5e8790288dd4
-
SHA256
d3cc79ebe88e4ca340ac59fd3f314bedc83ded00ad08f6ddc7044dfa204d7a5c
-
SHA512
af93e6af05df3bccd3798344ad6eee9fdd28009c4e158dc593f3b4f2caf15f2148f3c8cec685a73c47402a4ab9bd060e442390bd4f9d7e2e55807f3c17aa6ced
-
SSDEEP
12288:S4wFHoSyoS3ebeFmFVvlrmwcT4wpteFmFTx2:0KFmFVtrRcFEFmFU
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/5064-6-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4576-20-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/808-36-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1408-74-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1408-72-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3560-68-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3980-65-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/884-56-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3436-93-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2136-102-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2136-108-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3720-106-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/432-113-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3968-98-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3720-115-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4936-129-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/716-136-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4936-135-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/716-142-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4796-144-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4796-149-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1976-156-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4824-171-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4536-198-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4436-196-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1480-231-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/392-235-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4596-254-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2676-255-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3712-269-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2012-274-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4624-279-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1760-296-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4592-306-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1204-316-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1204-320-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1484-315-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1484-311-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3024-310-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3968-301-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3968-297-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3000-291-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/396-287-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1224-283-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1224-277-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3956-265-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3712-264-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2676-259-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4596-250-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2972-249-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3636-245-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3636-241-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1340-240-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2992-225-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3916-220-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/532-214-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/116-211-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4436-208-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4456-191-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4456-184-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/60-182-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4824-174-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4220-169-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4972-160-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jvpjv.exenhnbnn.exeppjjd.exerffxlfx.exehtnhtt.exedjpdp.exejvdpd.exefrlxrfx.exe1nnbnh.exejvdvv.exevdjvj.exexrrlffx.exe3fxrllf.exenbthnh.exebnbthb.exe7ppjp.exe9rlxlfr.exebnnnhb.exe3ppdv.exevpdpj.exelrxlxrl.exe9ddvv.exelrrlrlr.exevddvp.exerrxrfrl.exe7hbthb.exelfrfffl.exe9xxrrll.exenbnbth.exeddjpv.exebtnhnt.exe3pvpp.exeffllrlf.exenbhtnh.exepjvvd.exe3ntnhb.exebbtnhb.exevdvdp.exethtnnt.exe1vddv.exebhtntn.exevdjdp.exelffxrrl.exetnbnhh.exejpdpd.exexrfxrrl.exe7nntth.exejdvpj.exerrrlllx.exenbnnnb.exedvddv.exelrxfrfx.exelxlxfxf.exexxxrrll.exedvjjd.exerfxxlrr.exehtnbbh.exepddvp.exelffxrfx.exe5bhnhh.exejpdpp.exelxfxfrr.exehtbbnt.exeppjvj.exepid process 1256 jvpjv.exe 3068 nhnbnn.exe 4576 ppjjd.exe 808 rffxlfx.exe 3636 htnhtt.exe 2164 djpdp.exe 884 jvdpd.exe 3980 frlxrfx.exe 3560 1nnbnh.exe 1408 jvdvv.exe 396 vdjvj.exe 3080 xrrlffx.exe 3436 3fxrllf.exe 3968 nbthnh.exe 2136 bnbthb.exe 3720 7ppjp.exe 432 9rlxlfr.exe 2724 bnnnhb.exe 4936 3ppdv.exe 716 vpdpj.exe 4796 lrxlxrl.exe 1976 9ddvv.exe 4972 lrrlrlr.exe 4220 vddvp.exe 4824 rrxrfrl.exe 60 7hbthb.exe 4456 lfrfffl.exe 4536 9xxrrll.exe 4436 nbnbth.exe 116 ddjpv.exe 532 btnhnt.exe 3916 3pvpp.exe 2992 ffllrlf.exe 1480 nbhtnh.exe 392 pjvvd.exe 1340 3ntnhb.exe 3636 bbtnhb.exe 2972 vdvdp.exe 4596 thtnnt.exe 2676 1vddv.exe 3956 bhtntn.exe 3712 vdjdp.exe 2012 lffxrrl.exe 4624 tnbnhh.exe 1224 jpdpd.exe 396 xrfxrrl.exe 3000 7nntth.exe 1760 jdvpj.exe 3968 rrrlllx.exe 4592 nbnnnb.exe 3024 dvddv.exe 1484 lrxfrfx.exe 1204 lxlxfxf.exe 1548 xxxrrll.exe 2440 dvjjd.exe 2584 rfxxlrr.exe 4848 htnbbh.exe 4972 pddvp.exe 4636 lffxrfx.exe 4944 5bhnhh.exe 412 jpdpp.exe 60 lxfxfrr.exe 2232 htbbnt.exe 4968 ppjvj.exe -
Processes:
resource yara_rule behavioral2/memory/5064-0-0x0000000000400000-0x0000000000484000-memory.dmp upx C:\jvpjv.exe upx behavioral2/memory/5064-6-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1256-8-0x0000000000400000-0x0000000000484000-memory.dmp upx C:\ppjjd.exe upx behavioral2/memory/4576-20-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\rffxlfx.exe upx \??\c:\htnhtt.exe upx behavioral2/memory/808-36-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\djpdp.exe upx \??\c:\jvdpd.exe upx \??\c:\frlxrfx.exe upx \??\c:\jvdvv.exe upx \??\c:\vdjvj.exe upx behavioral2/memory/1408-74-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1408-72-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3560-68-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3980-65-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\1nnbnh.exe upx behavioral2/memory/884-56-0x0000000000400000-0x0000000000484000-memory.dmp upx C:\xrrlffx.exe upx behavioral2/memory/3080-80-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\3fxrllf.exe upx behavioral2/memory/3436-87-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3436-93-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\nbthnh.exe upx behavioral2/memory/2136-102-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\7ppjp.exe upx behavioral2/memory/2136-108-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3720-106-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/432-113-0x0000000000400000-0x0000000000484000-memory.dmp upx C:\9rlxlfr.exe upx behavioral2/memory/3968-96-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\bnbthb.exe upx behavioral2/memory/3968-98-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3720-115-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2724-122-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4936-129-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/716-136-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4936-135-0x0000000000400000-0x0000000000484000-memory.dmp upx C:\lrxlxrl.exe upx behavioral2/memory/716-142-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4796-144-0x0000000000400000-0x0000000000484000-memory.dmp upx C:\9ddvv.exe upx behavioral2/memory/4796-149-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1976-156-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4220-164-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4824-171-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\7hbthb.exe upx \??\c:\lfrfffl.exe upx \??\c:\nbnbth.exe upx behavioral2/memory/4536-198-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4436-196-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\ddjpv.exe upx \??\c:\3pvpp.exe upx behavioral2/memory/1480-231-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/392-229-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/392-235-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4596-254-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2676-255-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2012-270-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3712-269-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2012-274-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4624-279-0x0000000000400000-0x0000000000484000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f7291d3e892f10bcfce244e18c8331d0_NeikiAnalytics.exejvpjv.exenhnbnn.exeppjjd.exerffxlfx.exehtnhtt.exedjpdp.exejvdpd.exefrlxrfx.exe1nnbnh.exejvdvv.exevdjvj.exexrrlffx.exe3fxrllf.exenbthnh.exebnbthb.exe7ppjp.exe9rlxlfr.exebnnnhb.exe3ppdv.exevpdpj.exelrxlxrl.exedescription pid process target process PID 5064 wrote to memory of 1256 5064 f7291d3e892f10bcfce244e18c8331d0_NeikiAnalytics.exe jvpjv.exe PID 5064 wrote to memory of 1256 5064 f7291d3e892f10bcfce244e18c8331d0_NeikiAnalytics.exe jvpjv.exe PID 5064 wrote to memory of 1256 5064 f7291d3e892f10bcfce244e18c8331d0_NeikiAnalytics.exe jvpjv.exe PID 1256 wrote to memory of 3068 1256 jvpjv.exe nhnbnn.exe PID 1256 wrote to memory of 3068 1256 jvpjv.exe nhnbnn.exe PID 1256 wrote to memory of 3068 1256 jvpjv.exe nhnbnn.exe PID 3068 wrote to memory of 4576 3068 nhnbnn.exe ppjjd.exe PID 3068 wrote to memory of 4576 3068 nhnbnn.exe ppjjd.exe PID 3068 wrote to memory of 4576 3068 nhnbnn.exe ppjjd.exe PID 4576 wrote to memory of 808 4576 ppjjd.exe rffxlfx.exe PID 4576 wrote to memory of 808 4576 ppjjd.exe rffxlfx.exe PID 4576 wrote to memory of 808 4576 ppjjd.exe rffxlfx.exe PID 808 wrote to memory of 3636 808 rffxlfx.exe htnhtt.exe PID 808 wrote to memory of 3636 808 rffxlfx.exe htnhtt.exe PID 808 wrote to memory of 3636 808 rffxlfx.exe htnhtt.exe PID 3636 wrote to memory of 2164 3636 htnhtt.exe djpdp.exe PID 3636 wrote to memory of 2164 3636 htnhtt.exe djpdp.exe PID 3636 wrote to memory of 2164 3636 htnhtt.exe djpdp.exe PID 2164 wrote to memory of 884 2164 djpdp.exe jvdpd.exe PID 2164 wrote to memory of 884 2164 djpdp.exe jvdpd.exe PID 2164 wrote to memory of 884 2164 djpdp.exe jvdpd.exe PID 884 wrote to memory of 3980 884 jvdpd.exe frlxrfx.exe PID 884 wrote to memory of 3980 884 jvdpd.exe frlxrfx.exe PID 884 wrote to memory of 3980 884 jvdpd.exe frlxrfx.exe PID 3980 wrote to memory of 3560 3980 frlxrfx.exe 1nnbnh.exe PID 3980 wrote to memory of 3560 3980 frlxrfx.exe 1nnbnh.exe PID 3980 wrote to memory of 3560 3980 frlxrfx.exe 1nnbnh.exe PID 3560 wrote to memory of 1408 3560 1nnbnh.exe jvdvv.exe PID 3560 wrote to memory of 1408 3560 1nnbnh.exe jvdvv.exe PID 3560 wrote to memory of 1408 3560 1nnbnh.exe jvdvv.exe PID 1408 wrote to memory of 396 1408 jvdvv.exe xrfxrrl.exe PID 1408 wrote to memory of 396 1408 jvdvv.exe xrfxrrl.exe PID 1408 wrote to memory of 396 1408 jvdvv.exe xrfxrrl.exe PID 396 wrote to memory of 3080 396 vdjvj.exe xrrlffx.exe PID 396 wrote to memory of 3080 396 vdjvj.exe xrrlffx.exe PID 396 wrote to memory of 3080 396 vdjvj.exe xrrlffx.exe PID 3080 wrote to memory of 3436 3080 xrrlffx.exe 3fxrllf.exe PID 3080 wrote to memory of 3436 3080 xrrlffx.exe 3fxrllf.exe PID 3080 wrote to memory of 3436 3080 xrrlffx.exe 3fxrllf.exe PID 3436 wrote to memory of 3968 3436 3fxrllf.exe nbthnh.exe PID 3436 wrote to memory of 3968 3436 3fxrllf.exe nbthnh.exe PID 3436 wrote to memory of 3968 3436 3fxrllf.exe nbthnh.exe PID 3968 wrote to memory of 2136 3968 nbthnh.exe bnbthb.exe PID 3968 wrote to memory of 2136 3968 nbthnh.exe bnbthb.exe PID 3968 wrote to memory of 2136 3968 nbthnh.exe bnbthb.exe PID 2136 wrote to memory of 3720 2136 bnbthb.exe 7ppjp.exe PID 2136 wrote to memory of 3720 2136 bnbthb.exe 7ppjp.exe PID 2136 wrote to memory of 3720 2136 bnbthb.exe 7ppjp.exe PID 3720 wrote to memory of 432 3720 7ppjp.exe 9rlxlfr.exe PID 3720 wrote to memory of 432 3720 7ppjp.exe 9rlxlfr.exe PID 3720 wrote to memory of 432 3720 7ppjp.exe 9rlxlfr.exe PID 432 wrote to memory of 2724 432 9rlxlfr.exe bnnnhb.exe PID 432 wrote to memory of 2724 432 9rlxlfr.exe bnnnhb.exe PID 432 wrote to memory of 2724 432 9rlxlfr.exe bnnnhb.exe PID 2724 wrote to memory of 4936 2724 bnnnhb.exe 3ppdv.exe PID 2724 wrote to memory of 4936 2724 bnnnhb.exe 3ppdv.exe PID 2724 wrote to memory of 4936 2724 bnnnhb.exe 3ppdv.exe PID 4936 wrote to memory of 716 4936 3ppdv.exe jvvvv.exe PID 4936 wrote to memory of 716 4936 3ppdv.exe jvvvv.exe PID 4936 wrote to memory of 716 4936 3ppdv.exe jvvvv.exe PID 716 wrote to memory of 4796 716 vpdpj.exe xxlfxrr.exe PID 716 wrote to memory of 4796 716 vpdpj.exe xxlfxrr.exe PID 716 wrote to memory of 4796 716 vpdpj.exe xxlfxrr.exe PID 4796 wrote to memory of 1976 4796 lrxlxrl.exe xxlxffl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7291d3e892f10bcfce244e18c8331d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f7291d3e892f10bcfce244e18c8331d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\jvpjv.exec:\jvpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\nhnbnn.exec:\nhnbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\ppjjd.exec:\ppjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\rffxlfx.exec:\rffxlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\htnhtt.exec:\htnhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\djpdp.exec:\djpdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\jvdpd.exec:\jvdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\frlxrfx.exec:\frlxrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\1nnbnh.exec:\1nnbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\jvdvv.exec:\jvdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\vdjvj.exec:\vdjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\xrrlffx.exec:\xrrlffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\3fxrllf.exec:\3fxrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\nbthnh.exec:\nbthnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\bnbthb.exec:\bnbthb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\7ppjp.exec:\7ppjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\9rlxlfr.exec:\9rlxlfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\bnnnhb.exec:\bnnnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\3ppdv.exec:\3ppdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\vpdpj.exec:\vpdpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\lrxlxrl.exec:\lrxlxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\9ddvv.exec:\9ddvv.exe23⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lrrlrlr.exec:\lrrlrlr.exe24⤵
- Executes dropped EXE
PID:4972 -
\??\c:\vddvp.exec:\vddvp.exe25⤵
- Executes dropped EXE
PID:4220 -
\??\c:\rrxrfrl.exec:\rrxrfrl.exe26⤵
- Executes dropped EXE
PID:4824 -
\??\c:\7hbthb.exec:\7hbthb.exe27⤵
- Executes dropped EXE
PID:60 -
\??\c:\lfrfffl.exec:\lfrfffl.exe28⤵
- Executes dropped EXE
PID:4456 -
\??\c:\9xxrrll.exec:\9xxrrll.exe29⤵
- Executes dropped EXE
PID:4536 -
\??\c:\nbnbth.exec:\nbnbth.exe30⤵
- Executes dropped EXE
PID:4436 -
\??\c:\ddjpv.exec:\ddjpv.exe31⤵
- Executes dropped EXE
PID:116 -
\??\c:\btnhnt.exec:\btnhnt.exe32⤵
- Executes dropped EXE
PID:532 -
\??\c:\3pvpp.exec:\3pvpp.exe33⤵
- Executes dropped EXE
PID:3916 -
\??\c:\ffllrlf.exec:\ffllrlf.exe34⤵
- Executes dropped EXE
PID:2992 -
\??\c:\nbhtnh.exec:\nbhtnh.exe35⤵
- Executes dropped EXE
PID:1480 -
\??\c:\pjvvd.exec:\pjvvd.exe36⤵
- Executes dropped EXE
PID:392 -
\??\c:\3ntnhb.exec:\3ntnhb.exe37⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bbtnhb.exec:\bbtnhb.exe38⤵
- Executes dropped EXE
PID:3636 -
\??\c:\vdvdp.exec:\vdvdp.exe39⤵
- Executes dropped EXE
PID:2972 -
\??\c:\thtnnt.exec:\thtnnt.exe40⤵
- Executes dropped EXE
PID:4596 -
\??\c:\1vddv.exec:\1vddv.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bhtntn.exec:\bhtntn.exe42⤵
- Executes dropped EXE
PID:3956 -
\??\c:\vdjdp.exec:\vdjdp.exe43⤵
- Executes dropped EXE
PID:3712 -
\??\c:\lffxrrl.exec:\lffxrrl.exe44⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tnbnhh.exec:\tnbnhh.exe45⤵
- Executes dropped EXE
PID:4624 -
\??\c:\jpdpd.exec:\jpdpd.exe46⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe47⤵
- Executes dropped EXE
PID:396 -
\??\c:\7nntth.exec:\7nntth.exe48⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jdvpj.exec:\jdvpj.exe49⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rrrlllx.exec:\rrrlllx.exe50⤵
- Executes dropped EXE
PID:3968 -
\??\c:\nbnnnb.exec:\nbnnnb.exe51⤵
- Executes dropped EXE
PID:4592 -
\??\c:\dvddv.exec:\dvddv.exe52⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lrxfrfx.exec:\lrxfrfx.exe53⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lxlxfxf.exec:\lxlxfxf.exe54⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xxxrrll.exec:\xxxrrll.exe55⤵
- Executes dropped EXE
PID:1548 -
\??\c:\dvjjd.exec:\dvjjd.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rfxxlrr.exec:\rfxxlrr.exe57⤵
- Executes dropped EXE
PID:2584 -
\??\c:\htnbbh.exec:\htnbbh.exe58⤵
- Executes dropped EXE
PID:4848 -
\??\c:\pddvp.exec:\pddvp.exe59⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lffxrfx.exec:\lffxrfx.exe60⤵
- Executes dropped EXE
PID:4636 -
\??\c:\5bhnhh.exec:\5bhnhh.exe61⤵
- Executes dropped EXE
PID:4944 -
\??\c:\jpdpp.exec:\jpdpp.exe62⤵
- Executes dropped EXE
PID:412 -
\??\c:\lxfxfrr.exec:\lxfxfrr.exe63⤵
- Executes dropped EXE
PID:60 -
\??\c:\htbbnt.exec:\htbbnt.exe64⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ppjvj.exec:\ppjvj.exe65⤵
- Executes dropped EXE
PID:4968 -
\??\c:\lflfffx.exec:\lflfffx.exe66⤵PID:4820
-
\??\c:\nnnnbh.exec:\nnnnbh.exe67⤵PID:2400
-
\??\c:\jdjpp.exec:\jdjpp.exe68⤵PID:2296
-
\??\c:\dvjdv.exec:\dvjdv.exe69⤵PID:4380
-
\??\c:\9nnnhh.exec:\9nnnhh.exe70⤵PID:3324
-
\??\c:\vvjvp.exec:\vvjvp.exe71⤵PID:4028
-
\??\c:\llfxxxl.exec:\llfxxxl.exe72⤵PID:4264
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe73⤵PID:392
-
\??\c:\5tnbnn.exec:\5tnbnn.exe74⤵PID:400
-
\??\c:\jjjdv.exec:\jjjdv.exe75⤵PID:4876
-
\??\c:\5vvpd.exec:\5vvpd.exe76⤵PID:2236
-
\??\c:\xflfxrl.exec:\xflfxrl.exe77⤵PID:216
-
\??\c:\nhtntt.exec:\nhtntt.exe78⤵PID:3012
-
\??\c:\thnhbb.exec:\thnhbb.exe79⤵PID:3792
-
\??\c:\pdpjv.exec:\pdpjv.exe80⤵PID:720
-
\??\c:\xxlfffl.exec:\xxlfffl.exe81⤵PID:4232
-
\??\c:\thtnnn.exec:\thtnnn.exe82⤵PID:2924
-
\??\c:\5btnhh.exec:\5btnhh.exe83⤵PID:636
-
\??\c:\3vppj.exec:\3vppj.exe84⤵PID:2860
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe85⤵PID:3436
-
\??\c:\tbnhhn.exec:\tbnhhn.exe86⤵PID:4404
-
\??\c:\9nnhbb.exec:\9nnhbb.exe87⤵PID:1028
-
\??\c:\3dpjd.exec:\3dpjd.exe88⤵PID:3044
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe89⤵PID:4528
-
\??\c:\flxflxf.exec:\flxflxf.exe90⤵PID:3528
-
\??\c:\1ttttb.exec:\1ttttb.exe91⤵PID:3532
-
\??\c:\jjvpj.exec:\jjvpj.exe92⤵PID:4168
-
\??\c:\xxfxffx.exec:\xxfxffx.exe93⤵PID:548
-
\??\c:\fllxrrr.exec:\fllxrrr.exe94⤵PID:4736
-
\??\c:\tnhhbt.exec:\tnhhbt.exe95⤵PID:3348
-
\??\c:\jjjdp.exec:\jjjdp.exe96⤵PID:3800
-
\??\c:\jjpvp.exec:\jjpvp.exe97⤵PID:3604
-
\??\c:\xrfxllf.exec:\xrfxllf.exe98⤵PID:3036
-
\??\c:\thtnhn.exec:\thtnhn.exe99⤵PID:4656
-
\??\c:\vvjdd.exec:\vvjdd.exe100⤵PID:1160
-
\??\c:\5xxrrrx.exec:\5xxrrrx.exe101⤵PID:3660
-
\??\c:\tbnhbb.exec:\tbnhbb.exe102⤵PID:840
-
\??\c:\vppjd.exec:\vppjd.exe103⤵PID:116
-
\??\c:\frfxffl.exec:\frfxffl.exe104⤵PID:852
-
\??\c:\bhhhbb.exec:\bhhhbb.exe105⤵PID:4728
-
\??\c:\ppvpd.exec:\ppvpd.exe106⤵PID:2516
-
\??\c:\lrrrrrl.exec:\lrrrrrl.exe107⤵PID:1148
-
\??\c:\bbthth.exec:\bbthth.exe108⤵PID:884
-
\??\c:\vvjpd.exec:\vvjpd.exe109⤵PID:3980
-
\??\c:\5xlxxxr.exec:\5xlxxxr.exe110⤵PID:5076
-
\??\c:\nhnhbt.exec:\nhnhbt.exe111⤵PID:2276
-
\??\c:\jdjdv.exec:\jdjdv.exe112⤵PID:2208
-
\??\c:\9fllxxr.exec:\9fllxxr.exe113⤵PID:1360
-
\??\c:\ttttnn.exec:\ttttnn.exe114⤵PID:2824
-
\??\c:\vddpj.exec:\vddpj.exe115⤵PID:4976
-
\??\c:\jdjdv.exec:\jdjdv.exe116⤵PID:3112
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe117⤵PID:1760
-
\??\c:\tntnhb.exec:\tntnhb.exe118⤵PID:3968
-
\??\c:\hbnbbb.exec:\hbnbbb.exe119⤵PID:4332
-
\??\c:\jvvvp.exec:\jvvvp.exe120⤵PID:3080
-
\??\c:\llrlrlx.exec:\llrlrlx.exe121⤵PID:2424
-
\??\c:\llfrlfx.exec:\llfrlfx.exe122⤵PID:1204
-
\??\c:\hbtbbb.exec:\hbtbbb.exe123⤵PID:4884
-
\??\c:\3ddvj.exec:\3ddvj.exe124⤵PID:2600
-
\??\c:\lfxlxrl.exec:\lfxlxrl.exe125⤵PID:1976
-
\??\c:\flrfxrf.exec:\flrfxrf.exe126⤵PID:2996
-
\??\c:\hnbbtt.exec:\hnbbtt.exe127⤵PID:1076
-
\??\c:\djvpj.exec:\djvpj.exe128⤵PID:3448
-
\??\c:\dddjj.exec:\dddjj.exe129⤵PID:1972
-
\??\c:\lxllxlx.exec:\lxllxlx.exe130⤵PID:1036
-
\??\c:\hthbtt.exec:\hthbtt.exe131⤵PID:4456
-
\??\c:\1nhthh.exec:\1nhthh.exe132⤵PID:1556
-
\??\c:\ddppp.exec:\ddppp.exe133⤵PID:1384
-
\??\c:\3rlfxrf.exec:\3rlfxrf.exe134⤵PID:4536
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe135⤵PID:4416
-
\??\c:\9bbtnh.exec:\9bbtnh.exe136⤵PID:1316
-
\??\c:\vjvpj.exec:\vjvpj.exe137⤵PID:1980
-
\??\c:\vjjdv.exec:\vjjdv.exe138⤵PID:3324
-
\??\c:\lllllff.exec:\lllllff.exe139⤵PID:4576
-
\??\c:\thnhhh.exec:\thnhhh.exe140⤵PID:392
-
\??\c:\htbnhn.exec:\htbnhn.exe141⤵PID:2728
-
\??\c:\djjdp.exec:\djjdp.exe142⤵PID:2596
-
\??\c:\vjpjj.exec:\vjpjj.exe143⤵PID:3128
-
\??\c:\rrxxlfx.exec:\rrxxlfx.exe144⤵PID:2360
-
\??\c:\tnhbhh.exec:\tnhbhh.exe145⤵PID:3792
-
\??\c:\nbtthn.exec:\nbtthn.exe146⤵PID:2056
-
\??\c:\djpjv.exec:\djpjv.exe147⤵PID:4232
-
\??\c:\9dvjd.exec:\9dvjd.exe148⤵PID:4080
-
\??\c:\lffrlfx.exec:\lffrlfx.exe149⤵PID:2700
-
\??\c:\9tthbt.exec:\9tthbt.exe150⤵PID:4580
-
\??\c:\1hnbbt.exec:\1hnbbt.exe151⤵PID:680
-
\??\c:\ddjdp.exec:\ddjdp.exe152⤵PID:1352
-
\??\c:\rxxlfrl.exec:\rxxlfrl.exe153⤵PID:4956
-
\??\c:\xxfxfxl.exec:\xxfxfxl.exe154⤵PID:2500
-
\??\c:\ththbb.exec:\ththbb.exe155⤵PID:2856
-
\??\c:\ntnhnn.exec:\ntnhnn.exe156⤵PID:2840
-
\??\c:\pdjdp.exec:\pdjdp.exe157⤵PID:1792
-
\??\c:\5xxlxfr.exec:\5xxlxfr.exe158⤵PID:1956
-
\??\c:\xxfrrfl.exec:\xxfrrfl.exe159⤵PID:4736
-
\??\c:\hbnbtn.exec:\hbnbtn.exe160⤵PID:4520
-
\??\c:\dvvjd.exec:\dvvjd.exe161⤵PID:3348
-
\??\c:\7jdpj.exec:\7jdpj.exe162⤵PID:3540
-
\??\c:\3rrllff.exec:\3rrllff.exe163⤵PID:4544
-
\??\c:\ntbthb.exec:\ntbthb.exe164⤵PID:4628
-
\??\c:\hnthbt.exec:\hnthbt.exe165⤵PID:2516
-
\??\c:\9ddvp.exec:\9ddvp.exe166⤵PID:3324
-
\??\c:\rlfrllx.exec:\rlfrllx.exe167⤵PID:1668
-
\??\c:\5flfxrl.exec:\5flfxrl.exe168⤵PID:3724
-
\??\c:\nhnbtn.exec:\nhnbtn.exe169⤵PID:3956
-
\??\c:\9nhbtn.exec:\9nhbtn.exe170⤵PID:3312
-
\??\c:\vvvjd.exec:\vvvjd.exe171⤵PID:796
-
\??\c:\flrrfxl.exec:\flrrfxl.exe172⤵PID:3976
-
\??\c:\xrxfxrr.exec:\xrxfxrr.exe173⤵PID:1504
-
\??\c:\bthnbh.exec:\bthnbh.exe174⤵PID:1020
-
\??\c:\jjpdj.exec:\jjpdj.exe175⤵PID:3000
-
\??\c:\xxrlfxl.exec:\xxrlfxl.exe176⤵PID:3108
-
\??\c:\frrflff.exec:\frrflff.exe177⤵PID:4076
-
\??\c:\3btnhb.exec:\3btnhb.exe178⤵PID:4836
-
\??\c:\hhbnhb.exec:\hhbnhb.exe179⤵PID:4332
-
\??\c:\5ppdv.exec:\5ppdv.exe180⤵PID:3080
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe181⤵PID:1828
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe182⤵PID:4156
-
\??\c:\9btnbt.exec:\9btnbt.exe183⤵PID:1548
-
\??\c:\9ddpv.exec:\9ddpv.exe184⤵PID:2584
-
\??\c:\pdvpd.exec:\pdvpd.exe185⤵PID:1512
-
\??\c:\xflxlrf.exec:\xflxlrf.exe186⤵PID:3848
-
\??\c:\rfxrffx.exec:\rfxrffx.exe187⤵PID:4972
-
\??\c:\btbnhn.exec:\btbnhn.exe188⤵PID:1544
-
\??\c:\1ppjv.exec:\1ppjv.exe189⤵PID:2100
-
\??\c:\lfxlxrl.exec:\lfxlxrl.exe190⤵PID:1720
-
\??\c:\rflflff.exec:\rflflff.exe191⤵PID:1248
-
\??\c:\bttnhb.exec:\bttnhb.exe192⤵PID:1420
-
\??\c:\hbnbtn.exec:\hbnbtn.exe193⤵PID:980
-
\??\c:\9rrllfl.exec:\9rrllfl.exe194⤵PID:2460
-
\??\c:\thnbtt.exec:\thnbtt.exe195⤵PID:2124
-
\??\c:\9bthbt.exec:\9bthbt.exe196⤵PID:808
-
\??\c:\djvdp.exec:\djvdp.exe197⤵PID:4760
-
\??\c:\vjpjj.exec:\vjpjj.exe198⤵PID:1980
-
\??\c:\5frfxrr.exec:\5frfxrr.exe199⤵PID:2036
-
\??\c:\tnnnhb.exec:\tnnnhb.exe200⤵PID:3324
-
\??\c:\bhhbbb.exec:\bhhbbb.exe201⤵PID:1288
-
\??\c:\ddppp.exec:\ddppp.exe202⤵PID:3012
-
\??\c:\pjpjv.exec:\pjpjv.exe203⤵PID:3956
-
\??\c:\lrrlfxl.exec:\lrrlfxl.exe204⤵PID:4064
-
\??\c:\5hbhhb.exec:\5hbhhb.exe205⤵PID:448
-
\??\c:\nthbtn.exec:\nthbtn.exe206⤵PID:2256
-
\??\c:\7jdvj.exec:\7jdvj.exe207⤵PID:2056
-
\??\c:\lxffflr.exec:\lxffflr.exe208⤵PID:1504
-
\??\c:\fxxlffx.exec:\fxxlffx.exe209⤵PID:3112
-
\??\c:\nhbnbn.exec:\nhbnbn.exe210⤵PID:636
-
\??\c:\bbbnbt.exec:\bbbnbt.exe211⤵PID:2700
-
\??\c:\jdjvv.exec:\jdjvv.exe212⤵PID:3436
-
\??\c:\jvjvp.exec:\jvjvp.exe213⤵PID:5044
-
\??\c:\xrlfllf.exec:\xrlfllf.exe214⤵PID:3560
-
\??\c:\bhhbtn.exec:\bhhbtn.exe215⤵PID:4412
-
\??\c:\nhhbbn.exec:\nhhbbn.exe216⤵PID:2884
-
\??\c:\dpjdv.exec:\dpjdv.exe217⤵PID:1356
-
\??\c:\lxxfxrx.exec:\lxxfxrx.exe218⤵PID:4420
-
\??\c:\5frfxll.exec:\5frfxll.exe219⤵PID:2440
-
\??\c:\bnnnbt.exec:\bnnnbt.exe220⤵PID:4168
-
\??\c:\pjjvj.exec:\pjjvj.exe221⤵PID:3824
-
\??\c:\jjpjd.exec:\jjpjd.exe222⤵PID:2996
-
\??\c:\7rlxlfx.exec:\7rlxlfx.exe223⤵PID:4648
-
\??\c:\rlxlffr.exec:\rlxlffr.exe224⤵PID:4256
-
\??\c:\thnhbt.exec:\thnhbt.exe225⤵PID:3800
-
\??\c:\hhbtbt.exec:\hhbtbt.exe226⤵PID:4972
-
\??\c:\djjdv.exec:\djjdv.exe227⤵PID:4944
-
\??\c:\xrrfrlx.exec:\xrrfrlx.exe228⤵PID:1036
-
\??\c:\xxlxrfr.exec:\xxlxrfr.exe229⤵PID:4240
-
\??\c:\tntnhn.exec:\tntnhn.exe230⤵PID:1720
-
\??\c:\5jjdp.exec:\5jjdp.exe231⤵PID:4996
-
\??\c:\vvpdp.exec:\vvpdp.exe232⤵PID:1160
-
\??\c:\9fflfrf.exec:\9fflfrf.exe233⤵PID:4388
-
\??\c:\7nhhhh.exec:\7nhhhh.exe234⤵PID:2272
-
\??\c:\1btnbt.exec:\1btnbt.exe235⤵PID:2460
-
\??\c:\jjdvj.exec:\jjdvj.exe236⤵PID:1316
-
\??\c:\lfxlrfr.exec:\lfxlrfr.exe237⤵PID:4628
-
\??\c:\nhhtnh.exec:\nhhtnh.exe238⤵PID:400
-
\??\c:\1nhtnh.exec:\1nhtnh.exe239⤵PID:1148
-
\??\c:\dpjjv.exec:\dpjjv.exe240⤵PID:3980
-
\??\c:\llrfxrl.exec:\llrfxrl.exe241⤵PID:216
-
\??\c:\rfxxxrx.exec:\rfxxxrx.exe242⤵PID:652