Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 03:29
Behavioral task
behavioral1
Sample
a09c0cc65b89ccbb698eb8424a6a0800_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a09c0cc65b89ccbb698eb8424a6a0800_NeikiAnalytics.exe
-
Size
285KB
-
MD5
a09c0cc65b89ccbb698eb8424a6a0800
-
SHA1
0f1b6829accf2e0bfab048b07e3f7aa4ac5e9a15
-
SHA256
223f3b372db302bc31de571af67d038cd68549ee70d3c9949f2e0c8746e7b8fe
-
SHA512
1f74caf7c62da41913e5b9c456fc839c863556bfa4c0884a9dbf9149344774ef14c317d1a6e107ea0da03d8ea46c86ade7ce4473666de092b2d91e36344e831c
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4t+IDvSXrh5g8hZTyoImC:y4wFHoS3eFp3IDvSbh5nP+oImC
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2708-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1416-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1244-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1244-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1780-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-610-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-639-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-873-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-912-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-964-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-1040-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jpvpp.exebbhbtt.exelxxrlll.exenhhhbb.exexlxrllf.exethnhbb.exejdvdd.exenhhhbh.exeflrlffx.exexrrllff.exepjdpd.exeththbb.exerlrlrrx.exeflfxrlf.exejddpj.exeflfxlrr.exehttnbb.exe5nhbbn.exeddjdj.exexxrllll.exenhbttn.exe3jjdp.exetthnhh.exedppjj.exevjjvp.exe1xffxrr.exe7vpvv.exehnttnh.exebnhtbt.exepppdd.exenhbthb.exepvjvp.exexrlffxx.exetbbntt.exejdpvv.exefxrfffx.exelrlxrrl.exebnbnnt.exe7ddvp.exeffxxrxr.exe7nnhhh.exejvdpp.exexfrrrxx.exellllrxl.exe9htnnb.exefrffxrr.exehhbttn.exejddvd.exexxlrrrx.exehbhbtt.exe7vdvp.exerrxrfxl.exenhbnbt.exejddvj.exefrxrlfx.exehhnhbn.exepvjdv.exefxrffff.exenhbbtt.exevdjjd.exe1fllflf.exetnhhbh.exejdvvv.exe5tbnhn.exepid process 2240 jpvpp.exe 224 bbhbtt.exe 2196 lxxrlll.exe 1600 nhhhbb.exe 912 xlxrllf.exe 1416 thnhbb.exe 4532 jdvdd.exe 4996 nhhhbh.exe 1452 flrlffx.exe 2084 xrrllff.exe 4636 pjdpd.exe 4452 ththbb.exe 2580 rlrlrrx.exe 2704 flfxrlf.exe 3516 jddpj.exe 548 flfxlrr.exe 4528 httnbb.exe 4656 5nhbbn.exe 3864 ddjdj.exe 1432 xxrllll.exe 1652 nhbttn.exe 2164 3jjdp.exe 3672 tthnhh.exe 1920 dppjj.exe 556 vjjvp.exe 3496 1xffxrr.exe 8 7vpvv.exe 4144 hnttnh.exe 4076 bnhtbt.exe 5080 pppdd.exe 2976 nhbthb.exe 3456 pvjvp.exe 1244 xrlffxx.exe 3392 tbbntt.exe 400 jdpvv.exe 4436 fxrfffx.exe 660 lrlxrrl.exe 4304 bnbnnt.exe 4312 7ddvp.exe 2108 ffxxrxr.exe 112 7nnhhh.exe 4740 jvdpp.exe 4372 xfrrrxx.exe 2196 llllrxl.exe 4904 9htnnb.exe 3928 frffxrr.exe 4552 hhbttn.exe 2488 jddvd.exe 872 xxlrrrx.exe 2856 hbhbtt.exe 3344 7vdvp.exe 1452 rrxrfxl.exe 4644 nhbnbt.exe 3748 jddvj.exe 3776 frxrlfx.exe 4812 hhnhbn.exe 3932 pvjdv.exe 1488 fxrffff.exe 4356 nhbbtt.exe 3296 vdjjd.exe 4676 1fllflf.exe 1424 tnhhbh.exe 2748 jdvvv.exe 2752 5tbnhn.exe -
Processes:
resource yara_rule behavioral2/memory/2708-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpvpp.exe upx behavioral2/memory/2708-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2240-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbhbtt.exe upx behavioral2/memory/2240-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxxrlll.exe upx \??\c:\nhhhbb.exe upx behavioral2/memory/1600-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2196-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/224-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxrllf.exe upx behavioral2/memory/912-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1600-31-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\thnhbb.exe upx \??\c:\jdvdd.exe upx behavioral2/memory/1416-39-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhhbh.exe upx C:\flrlffx.exe upx behavioral2/memory/4996-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1452-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrllff.exe upx behavioral2/memory/2084-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjdpd.exe upx behavioral2/memory/2084-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ththbb.exe upx behavioral2/memory/4636-71-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlrlrrx.exe upx behavioral2/memory/2580-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flfxrlf.exe upx behavioral2/memory/2704-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddpj.exe upx C:\flfxlrr.exe upx behavioral2/memory/3516-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/548-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\httnbb.exe upx C:\5nhbbn.exe upx behavioral2/memory/4528-106-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddjdj.exe upx behavioral2/memory/4656-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrllll.exe upx behavioral2/memory/1432-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbttn.exe upx behavioral2/memory/1652-125-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3jjdp.exe upx behavioral2/memory/2164-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3672-137-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dppjj.exe upx behavioral2/memory/3672-144-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjjvp.exe upx behavioral2/memory/2164-139-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tthnhh.exe upx \??\c:\1xffxrr.exe upx behavioral2/memory/3496-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7vpvv.exe upx \??\c:\hnttnh.exe upx behavioral2/memory/4144-167-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnhtbt.exe upx behavioral2/memory/4076-171-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pppdd.exe upx behavioral2/memory/5080-179-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbthb.exe upx C:\pvjvp.exe upx behavioral2/memory/1244-195-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a09c0cc65b89ccbb698eb8424a6a0800_NeikiAnalytics.exejpvpp.exebbhbtt.exelxxrlll.exenhhhbb.exexlxrllf.exethnhbb.exejdvdd.exenhhhbh.exeflrlffx.exexrrllff.exepjdpd.exeththbb.exerlrlrrx.exeflfxrlf.exejddpj.exeflfxlrr.exehttnbb.exe5nhbbn.exeddjdj.exexxrllll.exenhbttn.exedescription pid process target process PID 2708 wrote to memory of 2240 2708 a09c0cc65b89ccbb698eb8424a6a0800_NeikiAnalytics.exe jpvpp.exe PID 2708 wrote to memory of 2240 2708 a09c0cc65b89ccbb698eb8424a6a0800_NeikiAnalytics.exe jpvpp.exe PID 2708 wrote to memory of 2240 2708 a09c0cc65b89ccbb698eb8424a6a0800_NeikiAnalytics.exe jpvpp.exe PID 2240 wrote to memory of 224 2240 jpvpp.exe bbhbtt.exe PID 2240 wrote to memory of 224 2240 jpvpp.exe bbhbtt.exe PID 2240 wrote to memory of 224 2240 jpvpp.exe bbhbtt.exe PID 224 wrote to memory of 2196 224 bbhbtt.exe lxxrlll.exe PID 224 wrote to memory of 2196 224 bbhbtt.exe lxxrlll.exe PID 224 wrote to memory of 2196 224 bbhbtt.exe lxxrlll.exe PID 2196 wrote to memory of 1600 2196 lxxrlll.exe nhhhbb.exe PID 2196 wrote to memory of 1600 2196 lxxrlll.exe nhhhbb.exe PID 2196 wrote to memory of 1600 2196 lxxrlll.exe nhhhbb.exe PID 1600 wrote to memory of 912 1600 nhhhbb.exe xlxrllf.exe PID 1600 wrote to memory of 912 1600 nhhhbb.exe xlxrllf.exe PID 1600 wrote to memory of 912 1600 nhhhbb.exe xlxrllf.exe PID 912 wrote to memory of 1416 912 xlxrllf.exe thnhbb.exe PID 912 wrote to memory of 1416 912 xlxrllf.exe thnhbb.exe PID 912 wrote to memory of 1416 912 xlxrllf.exe thnhbb.exe PID 1416 wrote to memory of 4532 1416 thnhbb.exe jdvdd.exe PID 1416 wrote to memory of 4532 1416 thnhbb.exe jdvdd.exe PID 1416 wrote to memory of 4532 1416 thnhbb.exe jdvdd.exe PID 4532 wrote to memory of 4996 4532 jdvdd.exe nhhhbh.exe PID 4532 wrote to memory of 4996 4532 jdvdd.exe nhhhbh.exe PID 4532 wrote to memory of 4996 4532 jdvdd.exe nhhhbh.exe PID 4996 wrote to memory of 1452 4996 nhhhbh.exe flrlffx.exe PID 4996 wrote to memory of 1452 4996 nhhhbh.exe flrlffx.exe PID 4996 wrote to memory of 1452 4996 nhhhbh.exe flrlffx.exe PID 1452 wrote to memory of 2084 1452 flrlffx.exe xrrllff.exe PID 1452 wrote to memory of 2084 1452 flrlffx.exe xrrllff.exe PID 1452 wrote to memory of 2084 1452 flrlffx.exe xrrllff.exe PID 2084 wrote to memory of 4636 2084 xrrllff.exe pjdpd.exe PID 2084 wrote to memory of 4636 2084 xrrllff.exe pjdpd.exe PID 2084 wrote to memory of 4636 2084 xrrllff.exe pjdpd.exe PID 4636 wrote to memory of 4452 4636 pjdpd.exe ththbb.exe PID 4636 wrote to memory of 4452 4636 pjdpd.exe ththbb.exe PID 4636 wrote to memory of 4452 4636 pjdpd.exe ththbb.exe PID 4452 wrote to memory of 2580 4452 ththbb.exe rlrlrrx.exe PID 4452 wrote to memory of 2580 4452 ththbb.exe rlrlrrx.exe PID 4452 wrote to memory of 2580 4452 ththbb.exe rlrlrrx.exe PID 2580 wrote to memory of 2704 2580 rlrlrrx.exe flfxrlf.exe PID 2580 wrote to memory of 2704 2580 rlrlrrx.exe flfxrlf.exe PID 2580 wrote to memory of 2704 2580 rlrlrrx.exe flfxrlf.exe PID 2704 wrote to memory of 3516 2704 flfxrlf.exe jddpj.exe PID 2704 wrote to memory of 3516 2704 flfxrlf.exe jddpj.exe PID 2704 wrote to memory of 3516 2704 flfxrlf.exe jddpj.exe PID 3516 wrote to memory of 548 3516 jddpj.exe flfxlrr.exe PID 3516 wrote to memory of 548 3516 jddpj.exe flfxlrr.exe PID 3516 wrote to memory of 548 3516 jddpj.exe flfxlrr.exe PID 548 wrote to memory of 4528 548 flfxlrr.exe httnbb.exe PID 548 wrote to memory of 4528 548 flfxlrr.exe httnbb.exe PID 548 wrote to memory of 4528 548 flfxlrr.exe httnbb.exe PID 4528 wrote to memory of 4656 4528 httnbb.exe 5nhbbn.exe PID 4528 wrote to memory of 4656 4528 httnbb.exe 5nhbbn.exe PID 4528 wrote to memory of 4656 4528 httnbb.exe 5nhbbn.exe PID 4656 wrote to memory of 3864 4656 5nhbbn.exe ddjdj.exe PID 4656 wrote to memory of 3864 4656 5nhbbn.exe ddjdj.exe PID 4656 wrote to memory of 3864 4656 5nhbbn.exe ddjdj.exe PID 3864 wrote to memory of 1432 3864 ddjdj.exe xxrllll.exe PID 3864 wrote to memory of 1432 3864 ddjdj.exe xxrllll.exe PID 3864 wrote to memory of 1432 3864 ddjdj.exe xxrllll.exe PID 1432 wrote to memory of 1652 1432 xxrllll.exe nhbttn.exe PID 1432 wrote to memory of 1652 1432 xxrllll.exe nhbttn.exe PID 1432 wrote to memory of 1652 1432 xxrllll.exe nhbttn.exe PID 1652 wrote to memory of 2164 1652 nhbttn.exe 3jjdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a09c0cc65b89ccbb698eb8424a6a0800_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a09c0cc65b89ccbb698eb8424a6a0800_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\jpvpp.exec:\jpvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\bbhbtt.exec:\bbhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\lxxrlll.exec:\lxxrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\nhhhbb.exec:\nhhhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\xlxrllf.exec:\xlxrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\thnhbb.exec:\thnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\jdvdd.exec:\jdvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\nhhhbh.exec:\nhhhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\flrlffx.exec:\flrlffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\xrrllff.exec:\xrrllff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\pjdpd.exec:\pjdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\ththbb.exec:\ththbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\flfxrlf.exec:\flfxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jddpj.exec:\jddpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\flfxlrr.exec:\flfxlrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\httnbb.exec:\httnbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\5nhbbn.exec:\5nhbbn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\ddjdj.exec:\ddjdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\xxrllll.exec:\xxrllll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\nhbttn.exec:\nhbttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\3jjdp.exec:\3jjdp.exe23⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tthnhh.exec:\tthnhh.exe24⤵
- Executes dropped EXE
PID:3672 -
\??\c:\dppjj.exec:\dppjj.exe25⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vjjvp.exec:\vjjvp.exe26⤵
- Executes dropped EXE
PID:556 -
\??\c:\1xffxrr.exec:\1xffxrr.exe27⤵
- Executes dropped EXE
PID:3496 -
\??\c:\7vpvv.exec:\7vpvv.exe28⤵
- Executes dropped EXE
PID:8 -
\??\c:\hnttnh.exec:\hnttnh.exe29⤵
- Executes dropped EXE
PID:4144 -
\??\c:\bnhtbt.exec:\bnhtbt.exe30⤵
- Executes dropped EXE
PID:4076 -
\??\c:\pppdd.exec:\pppdd.exe31⤵
- Executes dropped EXE
PID:5080 -
\??\c:\nhbthb.exec:\nhbthb.exe32⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pvjvp.exec:\pvjvp.exe33⤵
- Executes dropped EXE
PID:3456 -
\??\c:\xrlffxx.exec:\xrlffxx.exe34⤵
- Executes dropped EXE
PID:1244 -
\??\c:\tbbntt.exec:\tbbntt.exe35⤵
- Executes dropped EXE
PID:3392 -
\??\c:\jdpvv.exec:\jdpvv.exe36⤵
- Executes dropped EXE
PID:400 -
\??\c:\fxrfffx.exec:\fxrfffx.exe37⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lrlxrrl.exec:\lrlxrrl.exe38⤵
- Executes dropped EXE
PID:660 -
\??\c:\bnbnnt.exec:\bnbnnt.exe39⤵
- Executes dropped EXE
PID:4304 -
\??\c:\7ddvp.exec:\7ddvp.exe40⤵
- Executes dropped EXE
PID:4312 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe41⤵
- Executes dropped EXE
PID:2108 -
\??\c:\7nnhhh.exec:\7nnhhh.exe42⤵
- Executes dropped EXE
PID:112 -
\??\c:\jvdpp.exec:\jvdpp.exe43⤵
- Executes dropped EXE
PID:4740 -
\??\c:\xfrrrxx.exec:\xfrrrxx.exe44⤵
- Executes dropped EXE
PID:4372 -
\??\c:\llllrxl.exec:\llllrxl.exe45⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9htnnb.exec:\9htnnb.exe46⤵
- Executes dropped EXE
PID:4904 -
\??\c:\frffxrr.exec:\frffxrr.exe47⤵
- Executes dropped EXE
PID:3928 -
\??\c:\hhbttn.exec:\hhbttn.exe48⤵
- Executes dropped EXE
PID:4552 -
\??\c:\jddvd.exec:\jddvd.exe49⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xxlrrrx.exec:\xxlrrrx.exe50⤵
- Executes dropped EXE
PID:872 -
\??\c:\hbhbtt.exec:\hbhbtt.exe51⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7vdvp.exec:\7vdvp.exe52⤵
- Executes dropped EXE
PID:3344 -
\??\c:\rrxrfxl.exec:\rrxrfxl.exe53⤵
- Executes dropped EXE
PID:1452 -
\??\c:\nhbnbt.exec:\nhbnbt.exe54⤵
- Executes dropped EXE
PID:4644 -
\??\c:\jddvj.exec:\jddvj.exe55⤵
- Executes dropped EXE
PID:3748 -
\??\c:\frxrlfx.exec:\frxrlfx.exe56⤵
- Executes dropped EXE
PID:3776 -
\??\c:\hhnhbn.exec:\hhnhbn.exe57⤵
- Executes dropped EXE
PID:4812 -
\??\c:\pvjdv.exec:\pvjdv.exe58⤵
- Executes dropped EXE
PID:3932 -
\??\c:\fxrffff.exec:\fxrffff.exe59⤵
- Executes dropped EXE
PID:1488 -
\??\c:\nhbbtt.exec:\nhbbtt.exe60⤵
- Executes dropped EXE
PID:4356 -
\??\c:\vdjjd.exec:\vdjjd.exe61⤵
- Executes dropped EXE
PID:3296 -
\??\c:\1fllflf.exec:\1fllflf.exe62⤵
- Executes dropped EXE
PID:4676 -
\??\c:\tnhhbh.exec:\tnhhbh.exe63⤵
- Executes dropped EXE
PID:1424 -
\??\c:\jdvvv.exec:\jdvvv.exe64⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5tbnhn.exec:\5tbnhn.exe65⤵
- Executes dropped EXE
PID:2752 -
\??\c:\hnttnn.exec:\hnttnn.exe66⤵PID:4516
-
\??\c:\dpvpv.exec:\dpvpv.exe67⤵PID:3864
-
\??\c:\7ffxrrx.exec:\7ffxrrx.exe68⤵PID:1000
-
\??\c:\tthhbb.exec:\tthhbb.exe69⤵PID:3664
-
\??\c:\pjjvj.exec:\pjjvj.exe70⤵PID:3564
-
\??\c:\pjjpv.exec:\pjjpv.exe71⤵PID:2104
-
\??\c:\1fxrxfr.exec:\1fxrxfr.exe72⤵PID:4808
-
\??\c:\ntbtnn.exec:\ntbtnn.exe73⤵PID:5040
-
\??\c:\jvpjd.exec:\jvpjd.exe74⤵PID:1032
-
\??\c:\9rfxlll.exec:\9rfxlll.exe75⤵PID:3112
-
\??\c:\tnhbbt.exec:\tnhbbt.exe76⤵PID:3496
-
\??\c:\1pppj.exec:\1pppj.exe77⤵PID:1016
-
\??\c:\9ddvv.exec:\9ddvv.exe78⤵PID:2744
-
\??\c:\ffffxxx.exec:\ffffxxx.exe79⤵PID:4960
-
\??\c:\bnhtth.exec:\bnhtth.exe80⤵PID:2524
-
\??\c:\pjjdv.exec:\pjjdv.exe81⤵PID:3204
-
\??\c:\jddvv.exec:\jddvv.exe82⤵PID:2976
-
\??\c:\lxflfff.exec:\lxflfff.exe83⤵PID:1092
-
\??\c:\ttnhtb.exec:\ttnhtb.exe84⤵PID:1512
-
\??\c:\vpvvj.exec:\vpvvj.exe85⤵PID:1244
-
\??\c:\rlrllff.exec:\rlrllff.exe86⤵PID:4196
-
\??\c:\7hhbbb.exec:\7hhbbb.exe87⤵PID:3540
-
\??\c:\hnnbtn.exec:\hnnbtn.exe88⤵PID:116
-
\??\c:\djvdj.exec:\djvdj.exe89⤵PID:4484
-
\??\c:\5rfxfll.exec:\5rfxfll.exe90⤵PID:2428
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe91⤵PID:736
-
\??\c:\5jdjp.exec:\5jdjp.exe92⤵PID:1572
-
\??\c:\jdvpj.exec:\jdvpj.exe93⤵PID:4980
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe94⤵PID:1660
-
\??\c:\9tbtnn.exec:\9tbtnn.exe95⤵PID:912
-
\??\c:\pvvjd.exec:\pvvjd.exe96⤵PID:3256
-
\??\c:\lffxxxx.exec:\lffxxxx.exe97⤵PID:2068
-
\??\c:\flrrfxr.exec:\flrrfxr.exe98⤵PID:1780
-
\??\c:\ttnnbn.exec:\ttnnbn.exe99⤵PID:1400
-
\??\c:\djpvj.exec:\djpvj.exe100⤵PID:2848
-
\??\c:\flllxfr.exec:\flllxfr.exe101⤵PID:808
-
\??\c:\rrxrrlr.exec:\rrxrrlr.exe102⤵PID:3776
-
\??\c:\tbtbnh.exec:\tbtbnh.exe103⤵PID:2580
-
\??\c:\jdddv.exec:\jdddv.exe104⤵PID:4148
-
\??\c:\3jdjv.exec:\3jdjv.exe105⤵PID:3516
-
\??\c:\xrffflr.exec:\xrffflr.exe106⤵PID:4620
-
\??\c:\hbhbbb.exec:\hbhbbb.exe107⤵PID:4184
-
\??\c:\nhbbbb.exec:\nhbbbb.exe108⤵PID:3240
-
\??\c:\pjjjp.exec:\pjjjp.exe109⤵PID:5108
-
\??\c:\fflfrrf.exec:\fflfrrf.exe110⤵PID:3232
-
\??\c:\hnnbbb.exec:\hnnbbb.exe111⤵PID:452
-
\??\c:\dvvjd.exec:\dvvjd.exe112⤵PID:448
-
\??\c:\lxfxlrl.exec:\lxfxlrl.exe113⤵PID:5008
-
\??\c:\flrlllf.exec:\flrlllf.exe114⤵PID:1104
-
\??\c:\hnhhbb.exec:\hnhhbb.exe115⤵PID:1008
-
\??\c:\dvvvp.exec:\dvvvp.exe116⤵PID:4424
-
\??\c:\dpvvv.exec:\dpvvv.exe117⤵PID:4004
-
\??\c:\rlxxffr.exec:\rlxxffr.exe118⤵PID:3996
-
\??\c:\tntnnh.exec:\tntnnh.exe119⤵PID:3496
-
\??\c:\fffrlxr.exec:\fffrlxr.exe120⤵PID:4384
-
\??\c:\3jdvp.exec:\3jdvp.exe121⤵PID:4960
-
\??\c:\7pvjd.exec:\7pvjd.exe122⤵PID:3124
-
\??\c:\rrxrrrl.exec:\rrxrrrl.exe123⤵PID:1136
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe124⤵PID:3456
-
\??\c:\nhnnhh.exec:\nhnnhh.exe125⤵PID:4900
-
\??\c:\djppd.exec:\djppd.exe126⤵PID:656
-
\??\c:\rrxrlxx.exec:\rrxrlxx.exe127⤵PID:3660
-
\??\c:\frrfxxr.exec:\frrfxxr.exe128⤵PID:4396
-
\??\c:\1nnhbh.exec:\1nnhbh.exe129⤵PID:1020
-
\??\c:\jvpvd.exec:\jvpvd.exe130⤵PID:4584
-
\??\c:\dvvpp.exec:\dvvpp.exe131⤵PID:2708
-
\??\c:\lrxxrxx.exec:\lrxxrxx.exe132⤵PID:2108
-
\??\c:\bhbtnn.exec:\bhbtnn.exe133⤵PID:1584
-
\??\c:\vppdv.exec:\vppdv.exe134⤵PID:896
-
\??\c:\jdpdj.exec:\jdpdj.exe135⤵PID:5036
-
\??\c:\xrfrffl.exec:\xrfrffl.exe136⤵PID:404
-
\??\c:\nthbth.exec:\nthbth.exe137⤵PID:4548
-
\??\c:\jjppj.exec:\jjppj.exe138⤵PID:4996
-
\??\c:\xxfxfxr.exec:\xxfxfxr.exe139⤵PID:1708
-
\??\c:\nntntt.exec:\nntntt.exe140⤵PID:872
-
\??\c:\vvppp.exec:\vvppp.exe141⤵PID:3228
-
\??\c:\xxfllrr.exec:\xxfllrr.exe142⤵PID:4504
-
\??\c:\vdjjd.exec:\vdjjd.exe143⤵PID:4280
-
\??\c:\pdddv.exec:\pdddv.exe144⤵PID:1372
-
\??\c:\llxrrlf.exec:\llxrrlf.exe145⤵PID:808
-
\??\c:\bbnnhh.exec:\bbnnhh.exe146⤵PID:4168
-
\??\c:\vvdvp.exec:\vvdvp.exe147⤵PID:1824
-
\??\c:\7flfrrx.exec:\7flfrrx.exe148⤵PID:2552
-
\??\c:\lrrxrff.exec:\lrrxrff.exe149⤵PID:3788
-
\??\c:\htbtnh.exec:\htbtnh.exe150⤵PID:4620
-
\??\c:\ddppd.exec:\ddppd.exe151⤵PID:4184
-
\??\c:\frlrfff.exec:\frlrfff.exe152⤵PID:2752
-
\??\c:\5bhtth.exec:\5bhtth.exe153⤵PID:3144
-
\??\c:\ppvvv.exec:\ppvvv.exe154⤵PID:3424
-
\??\c:\xflxrrl.exec:\xflxrrl.exe155⤵PID:452
-
\??\c:\bhthbt.exec:\bhthbt.exe156⤵PID:448
-
\??\c:\vvjjd.exec:\vvjjd.exe157⤵PID:1748
-
\??\c:\lfxflrx.exec:\lfxflrx.exe158⤵PID:4324
-
\??\c:\7lxxlxx.exec:\7lxxlxx.exe159⤵PID:1760
-
\??\c:\hbntbn.exec:\hbntbn.exe160⤵PID:4856
-
\??\c:\pjvdd.exec:\pjvdd.exe161⤵PID:3112
-
\??\c:\lrxrrfl.exec:\lrxrrfl.exe162⤵PID:4816
-
\??\c:\3flflff.exec:\3flflff.exe163⤵PID:1936
-
\??\c:\3htttb.exec:\3htttb.exe164⤵PID:864
-
\??\c:\jjvpj.exec:\jjvpj.exe165⤵PID:4384
-
\??\c:\dvdvv.exec:\dvdvv.exe166⤵PID:2756
-
\??\c:\rxrffrx.exec:\rxrffrx.exe167⤵PID:3052
-
\??\c:\nttbnt.exec:\nttbnt.exe168⤵PID:3908
-
\??\c:\vpddj.exec:\vpddj.exe169⤵PID:4968
-
\??\c:\dpjjd.exec:\dpjjd.exe170⤵PID:3984
-
\??\c:\9lxxxfl.exec:\9lxxxfl.exe171⤵PID:4436
-
\??\c:\htbbbb.exec:\htbbbb.exe172⤵PID:3212
-
\??\c:\nnnntt.exec:\nnnntt.exe173⤵PID:4780
-
\??\c:\pdjvp.exec:\pdjvp.exe174⤵PID:576
-
\??\c:\rfllrrf.exec:\rfllrrf.exe175⤵PID:1144
-
\??\c:\lrlllrr.exec:\lrlllrr.exe176⤵PID:1844
-
\??\c:\hnhbbb.exec:\hnhbbb.exe177⤵PID:3844
-
\??\c:\pdjjj.exec:\pdjjj.exe178⤵PID:896
-
\??\c:\frfffrr.exec:\frfffrr.exe179⤵PID:4100
-
\??\c:\xfffxfx.exec:\xfffxfx.exe180⤵PID:2296
-
\??\c:\tthhhn.exec:\tthhhn.exe181⤵PID:2180
-
\??\c:\jvjjp.exec:\jvjjp.exe182⤵PID:3088
-
\??\c:\5xxxxff.exec:\5xxxxff.exe183⤵PID:3228
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe184⤵PID:468
-
\??\c:\hhbtnt.exec:\hhbtnt.exe185⤵PID:2472
-
\??\c:\jvjvd.exec:\jvjvd.exe186⤵PID:1464
-
\??\c:\pvdjj.exec:\pvdjj.exe187⤵PID:5000
-
\??\c:\frxrlxx.exec:\frxrlxx.exe188⤵PID:2292
-
\??\c:\hhbntb.exec:\hhbntb.exe189⤵PID:4164
-
\??\c:\pjjjj.exec:\pjjjj.exe190⤵PID:5048
-
\??\c:\jddvp.exec:\jddvp.exe191⤵PID:1096
-
\??\c:\flrflxl.exec:\flrflxl.exe192⤵PID:4892
-
\??\c:\tthhth.exec:\tthhth.exe193⤵PID:4516
-
\??\c:\hhhnnt.exec:\hhhnnt.exe194⤵PID:1652
-
\??\c:\jjvdd.exec:\jjvdd.exe195⤵PID:3764
-
\??\c:\pdjdd.exec:\pdjdd.exe196⤵PID:2164
-
\??\c:\rfxxfll.exec:\rfxxfll.exe197⤵PID:3672
-
\??\c:\nnnhhn.exec:\nnnhhn.exe198⤵PID:1856
-
\??\c:\ttbtbb.exec:\ttbtbb.exe199⤵PID:2368
-
\??\c:\vjppp.exec:\vjppp.exe200⤵PID:1008
-
\??\c:\xlrrrfl.exec:\xlrrrfl.exe201⤵PID:1932
-
\??\c:\5xrxxll.exec:\5xrxxll.exe202⤵PID:380
-
\??\c:\7hnnnt.exec:\7hnnnt.exe203⤵PID:3112
-
\??\c:\5pvvd.exec:\5pvvd.exe204⤵PID:4816
-
\??\c:\lllrxff.exec:\lllrxff.exe205⤵PID:2500
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe206⤵PID:4916
-
\??\c:\nhnnbt.exec:\nhnnbt.exe207⤵PID:2020
-
\??\c:\jjdjj.exec:\jjdjj.exe208⤵PID:1092
-
\??\c:\djvjj.exec:\djvjj.exe209⤵PID:1512
-
\??\c:\lflrflf.exec:\lflrflf.exe210⤵PID:1244
-
\??\c:\nnhhnh.exec:\nnhhnh.exe211⤵PID:4144
-
\??\c:\3htttb.exec:\3htttb.exe212⤵PID:4088
-
\??\c:\ppddd.exec:\ppddd.exe213⤵PID:1568
-
\??\c:\1fflllr.exec:\1fflllr.exe214⤵PID:4308
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe215⤵PID:4292
-
\??\c:\bbbhhh.exec:\bbbhhh.exe216⤵PID:4484
-
\??\c:\bhnbtb.exec:\bhnbtb.exe217⤵PID:224
-
\??\c:\pdvpd.exec:\pdvpd.exe218⤵PID:2108
-
\??\c:\xxllrxf.exec:\xxllrxf.exe219⤵PID:1572
-
\??\c:\bnnhnb.exec:\bnnhnb.exe220⤵PID:1600
-
\??\c:\hnhbht.exec:\hnhbht.exe221⤵PID:5024
-
\??\c:\ppjpd.exec:\ppjpd.exe222⤵PID:2872
-
\??\c:\lllrrll.exec:\lllrrll.exe223⤵PID:4996
-
\??\c:\ttnnhb.exec:\ttnnhb.exe224⤵PID:2484
-
\??\c:\7vdvj.exec:\7vdvj.exe225⤵PID:1980
-
\??\c:\flffxxr.exec:\flffxxr.exe226⤵PID:1400
-
\??\c:\llrrrrx.exec:\llrrrrx.exe227⤵PID:3692
-
\??\c:\btbbbb.exec:\btbbbb.exe228⤵PID:4008
-
\??\c:\pvjpp.exec:\pvjpp.exe229⤵PID:2704
-
\??\c:\vjpjv.exec:\vjpjv.exe230⤵PID:1124
-
\??\c:\rrxrffx.exec:\rrxrffx.exe231⤵PID:3192
-
\??\c:\1nbtbb.exec:\1nbtbb.exe232⤵PID:3988
-
\??\c:\jdvdd.exec:\jdvdd.exe233⤵PID:548
-
\??\c:\lrffxxl.exec:\lrffxxl.exe234⤵PID:4936
-
\??\c:\fxxlrxx.exec:\fxxlrxx.exe235⤵PID:1608
-
\??\c:\nnnnnn.exec:\nnnnnn.exe236⤵PID:1096
-
\??\c:\jjvpv.exec:\jjvpv.exe237⤵PID:4892
-
\??\c:\xrrrxxr.exec:\xrrrxxr.exe238⤵PID:4516
-
\??\c:\nhnbnn.exec:\nhnbnn.exe239⤵PID:1652
-
\??\c:\thhntn.exec:\thhntn.exe240⤵PID:2696
-
\??\c:\rlrxllr.exec:\rlrxllr.exe241⤵PID:5008
-
\??\c:\7hnnhn.exec:\7hnnhn.exe242⤵PID:1552