Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 05:44
Behavioral task
behavioral1
Sample
bc36cdfaa82ac09aab2051053f3d4cb0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
bc36cdfaa82ac09aab2051053f3d4cb0_NeikiAnalytics.exe
-
Size
103KB
-
MD5
bc36cdfaa82ac09aab2051053f3d4cb0
-
SHA1
d5ee06f154a9e7ee17fc4ba70d6ed55b17370b4e
-
SHA256
2c3f2b7b2c79146ebd57f74f2602c9372f0ee9b28011fc0b0b5ae852f9535570
-
SHA512
d6ffdb43eacfef9d5cb9b3ee5f5a7bf74a9893cb9eb326f36200541b9ff74caecee4e3e6da77fb31ad730b34cb442d4cdd923885d855928085627597d31862a7
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFbUZJjw5Ivov1d3ZdpQm6hN:9hOmTsF93UYfwC6GIoutz5yLpRDN6hN
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3848-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3732-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3076-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1076-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1224-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1732-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1096-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1244-721-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-809-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3dvpp.exefxxxrxl.exexrxrlrl.exetntnhn.exe9nnhhh.exepjdvv.exe5dvpj.exebhnnhh.exenbhtnh.exedpvjd.exedvjpv.exexrxlrlf.exennbbbb.exe7nnnhh.exepddvp.exe9lffxxx.exennbtnn.exejpvpv.exellrxllf.exebbbttt.exepdddd.exerlrrxfl.exettbbbh.exejvpjd.exelfxrlxr.exexffxxxf.exe5tbttb.exe3pvpj.exeppdpj.exeffxrllf.exehtnhhb.exedpppp.exe5fxlrxf.exe5tbnhn.exeddpjv.exe1vppd.exe1ffflxf.exe3ttnhh.exejvvpp.exerrxffll.exebbhntn.exejjjdd.exelfxxrlf.exexrxrllx.exehbtbhn.exevdppj.exejppjd.exexxxrllx.exelfxxrrr.exehbhtbt.exejjjdp.exexrfxxll.exelxxrrll.exeffxxrxr.exenbhhhh.exeddddv.exe3rrfxxr.exelxfllrx.exebnnnhn.exennbtbt.exevpppp.exexrfxllr.exeflffxxx.exebbhtnt.exepid process 4024 3dvpp.exe 4056 fxxxrxl.exe 4700 xrxrlrl.exe 2160 tntnhn.exe 4640 9nnhhh.exe 3824 pjdvv.exe 2616 5dvpj.exe 3304 bhnnhh.exe 4924 nbhtnh.exe 2184 dpvjd.exe 1448 dvjpv.exe 3296 xrxlrlf.exe 1328 nnbbbb.exe 2848 7nnnhh.exe 4568 pddvp.exe 3680 9lffxxx.exe 4632 nnbtnn.exe 1052 jpvpv.exe 1344 llrxllf.exe 2156 bbbttt.exe 2316 pdddd.exe 4468 rlrrxfl.exe 4384 ttbbbh.exe 1700 jvpjd.exe 4992 lfxrlxr.exe 4912 xffxxxf.exe 3580 5tbttb.exe 3048 3pvpj.exe 4972 ppdpj.exe 4964 ffxrllf.exe 3732 htnhhb.exe 3884 dpppp.exe 3664 5fxlrxf.exe 3692 5tbnhn.exe 4020 ddpjv.exe 3772 1vppd.exe 4856 1ffflxf.exe 3652 3ttnhh.exe 3076 jvvpp.exe 1076 rrxffll.exe 464 bbhntn.exe 2900 jjjdd.exe 4744 lfxxrlf.exe 4404 xrxrllx.exe 3404 hbtbhn.exe 4024 vdppj.exe 1508 jppjd.exe 4700 xxxrllx.exe 2880 lfxxrrr.exe 1600 hbhtbt.exe 1172 jjjdp.exe 3560 xrfxxll.exe 3216 lxxrrll.exe 1676 ffxxrxr.exe 3620 nbhhhh.exe 316 ddddv.exe 840 3rrfxxr.exe 916 lxfllrx.exe 4928 bnnnhn.exe 4864 nnbtbt.exe 4580 vpppp.exe 4248 xrfxllr.exe 3056 flffxxx.exe 4960 bbhtnt.exe -
Processes:
resource yara_rule behavioral2/memory/3848-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4024-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3dvpp.exe upx C:\fxxxrxl.exe upx behavioral2/memory/4056-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4024-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxrlrl.exe upx behavioral2/memory/4700-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2160-26-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9nnhhh.exe upx \??\c:\tntnhn.exe upx behavioral2/memory/4640-34-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjdvv.exe upx C:\5dvpj.exe upx behavioral2/memory/3824-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhnnhh.exe upx behavioral2/memory/2616-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3304-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbhtnh.exe upx C:\dpvjd.exe upx C:\dvjpv.exe upx behavioral2/memory/1448-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxlrlf.exe upx C:\nnbbbb.exe upx C:\7nnnhh.exe upx behavioral2/memory/1328-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2848-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pddvp.exe upx C:\9lffxxx.exe upx behavioral2/memory/4568-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnbtnn.exe upx behavioral2/memory/3680-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4632-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpvpv.exe upx C:\llrxllf.exe upx behavioral2/memory/1052-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbbttt.exe upx behavioral2/memory/1344-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2156-120-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdddd.exe upx C:\rlrrxfl.exe upx C:\ttbbbh.exe upx behavioral2/memory/4384-134-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvpjd.exe upx behavioral2/memory/4384-140-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxrlxr.exe upx C:\xffxxxf.exe upx behavioral2/memory/4992-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4912-152-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5tbttb.exe upx behavioral2/memory/3580-160-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3pvpj.exe upx C:\ppdpj.exe upx \??\c:\ffxrllf.exe upx behavioral2/memory/4964-176-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htnhhb.exe upx behavioral2/memory/3732-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpppp.exe upx behavioral2/memory/3772-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3076-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1076-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/464-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4404-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3404-232-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bc36cdfaa82ac09aab2051053f3d4cb0_NeikiAnalytics.exe3dvpp.exefxxxrxl.exexrxrlrl.exetntnhn.exe9nnhhh.exepjdvv.exe5dvpj.exebhnnhh.exenbhtnh.exedpvjd.exedvjpv.exexrxlrlf.exennbbbb.exe7nnnhh.exepddvp.exe9lffxxx.exennbtnn.exejpvpv.exellrxllf.exebbbttt.exepdddd.exedescription pid process target process PID 3848 wrote to memory of 4024 3848 bc36cdfaa82ac09aab2051053f3d4cb0_NeikiAnalytics.exe 3dvpp.exe PID 3848 wrote to memory of 4024 3848 bc36cdfaa82ac09aab2051053f3d4cb0_NeikiAnalytics.exe 3dvpp.exe PID 3848 wrote to memory of 4024 3848 bc36cdfaa82ac09aab2051053f3d4cb0_NeikiAnalytics.exe 3dvpp.exe PID 4024 wrote to memory of 4056 4024 3dvpp.exe fxxxrxl.exe PID 4024 wrote to memory of 4056 4024 3dvpp.exe fxxxrxl.exe PID 4024 wrote to memory of 4056 4024 3dvpp.exe fxxxrxl.exe PID 4056 wrote to memory of 4700 4056 fxxxrxl.exe xrxrlrl.exe PID 4056 wrote to memory of 4700 4056 fxxxrxl.exe xrxrlrl.exe PID 4056 wrote to memory of 4700 4056 fxxxrxl.exe xrxrlrl.exe PID 4700 wrote to memory of 2160 4700 xrxrlrl.exe tntnhn.exe PID 4700 wrote to memory of 2160 4700 xrxrlrl.exe tntnhn.exe PID 4700 wrote to memory of 2160 4700 xrxrlrl.exe tntnhn.exe PID 2160 wrote to memory of 4640 2160 tntnhn.exe 9nnhhh.exe PID 2160 wrote to memory of 4640 2160 tntnhn.exe 9nnhhh.exe PID 2160 wrote to memory of 4640 2160 tntnhn.exe 9nnhhh.exe PID 4640 wrote to memory of 3824 4640 9nnhhh.exe pjdvv.exe PID 4640 wrote to memory of 3824 4640 9nnhhh.exe pjdvv.exe PID 4640 wrote to memory of 3824 4640 9nnhhh.exe pjdvv.exe PID 3824 wrote to memory of 2616 3824 pjdvv.exe 5dvpj.exe PID 3824 wrote to memory of 2616 3824 pjdvv.exe 5dvpj.exe PID 3824 wrote to memory of 2616 3824 pjdvv.exe 5dvpj.exe PID 2616 wrote to memory of 3304 2616 5dvpj.exe bhnnhh.exe PID 2616 wrote to memory of 3304 2616 5dvpj.exe bhnnhh.exe PID 2616 wrote to memory of 3304 2616 5dvpj.exe bhnnhh.exe PID 3304 wrote to memory of 4924 3304 bhnnhh.exe nbhtnh.exe PID 3304 wrote to memory of 4924 3304 bhnnhh.exe nbhtnh.exe PID 3304 wrote to memory of 4924 3304 bhnnhh.exe nbhtnh.exe PID 4924 wrote to memory of 2184 4924 nbhtnh.exe dpvjd.exe PID 4924 wrote to memory of 2184 4924 nbhtnh.exe dpvjd.exe PID 4924 wrote to memory of 2184 4924 nbhtnh.exe dpvjd.exe PID 2184 wrote to memory of 1448 2184 dpvjd.exe dvjpv.exe PID 2184 wrote to memory of 1448 2184 dpvjd.exe dvjpv.exe PID 2184 wrote to memory of 1448 2184 dpvjd.exe dvjpv.exe PID 1448 wrote to memory of 3296 1448 dvjpv.exe xrxlrlf.exe PID 1448 wrote to memory of 3296 1448 dvjpv.exe xrxlrlf.exe PID 1448 wrote to memory of 3296 1448 dvjpv.exe xrxlrlf.exe PID 3296 wrote to memory of 1328 3296 xrxlrlf.exe nnbbbb.exe PID 3296 wrote to memory of 1328 3296 xrxlrlf.exe nnbbbb.exe PID 3296 wrote to memory of 1328 3296 xrxlrlf.exe nnbbbb.exe PID 1328 wrote to memory of 2848 1328 nnbbbb.exe 7nnnhh.exe PID 1328 wrote to memory of 2848 1328 nnbbbb.exe 7nnnhh.exe PID 1328 wrote to memory of 2848 1328 nnbbbb.exe 7nnnhh.exe PID 2848 wrote to memory of 4568 2848 7nnnhh.exe pddvp.exe PID 2848 wrote to memory of 4568 2848 7nnnhh.exe pddvp.exe PID 2848 wrote to memory of 4568 2848 7nnnhh.exe pddvp.exe PID 4568 wrote to memory of 3680 4568 pddvp.exe 9lffxxx.exe PID 4568 wrote to memory of 3680 4568 pddvp.exe 9lffxxx.exe PID 4568 wrote to memory of 3680 4568 pddvp.exe 9lffxxx.exe PID 3680 wrote to memory of 4632 3680 9lffxxx.exe nnbtnn.exe PID 3680 wrote to memory of 4632 3680 9lffxxx.exe nnbtnn.exe PID 3680 wrote to memory of 4632 3680 9lffxxx.exe nnbtnn.exe PID 4632 wrote to memory of 1052 4632 nnbtnn.exe jpvpv.exe PID 4632 wrote to memory of 1052 4632 nnbtnn.exe jpvpv.exe PID 4632 wrote to memory of 1052 4632 nnbtnn.exe jpvpv.exe PID 1052 wrote to memory of 1344 1052 jpvpv.exe llrxllf.exe PID 1052 wrote to memory of 1344 1052 jpvpv.exe llrxllf.exe PID 1052 wrote to memory of 1344 1052 jpvpv.exe llrxllf.exe PID 1344 wrote to memory of 2156 1344 llrxllf.exe bbbttt.exe PID 1344 wrote to memory of 2156 1344 llrxllf.exe bbbttt.exe PID 1344 wrote to memory of 2156 1344 llrxllf.exe bbbttt.exe PID 2156 wrote to memory of 2316 2156 bbbttt.exe pdddd.exe PID 2156 wrote to memory of 2316 2156 bbbttt.exe pdddd.exe PID 2156 wrote to memory of 2316 2156 bbbttt.exe pdddd.exe PID 2316 wrote to memory of 4468 2316 pdddd.exe rlrrxfl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc36cdfaa82ac09aab2051053f3d4cb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bc36cdfaa82ac09aab2051053f3d4cb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\3dvpp.exec:\3dvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\fxxxrxl.exec:\fxxxrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\xrxrlrl.exec:\xrxrlrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\tntnhn.exec:\tntnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\9nnhhh.exec:\9nnhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\pjdvv.exec:\pjdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\5dvpj.exec:\5dvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\bhnnhh.exec:\bhnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\nbhtnh.exec:\nbhtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\dpvjd.exec:\dpvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\dvjpv.exec:\dvjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\xrxlrlf.exec:\xrxlrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\nnbbbb.exec:\nnbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\7nnnhh.exec:\7nnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\pddvp.exec:\pddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\9lffxxx.exec:\9lffxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\nnbtnn.exec:\nnbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\jpvpv.exec:\jpvpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\llrxllf.exec:\llrxllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\bbbttt.exec:\bbbttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\pdddd.exec:\pdddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe23⤵
- Executes dropped EXE
PID:4468 -
\??\c:\ttbbbh.exec:\ttbbbh.exe24⤵
- Executes dropped EXE
PID:4384 -
\??\c:\jvpjd.exec:\jvpjd.exe25⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lfxrlxr.exec:\lfxrlxr.exe26⤵
- Executes dropped EXE
PID:4992 -
\??\c:\xffxxxf.exec:\xffxxxf.exe27⤵
- Executes dropped EXE
PID:4912 -
\??\c:\5tbttb.exec:\5tbttb.exe28⤵
- Executes dropped EXE
PID:3580 -
\??\c:\3pvpj.exec:\3pvpj.exe29⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ppdpj.exec:\ppdpj.exe30⤵
- Executes dropped EXE
PID:4972 -
\??\c:\ffxrllf.exec:\ffxrllf.exe31⤵
- Executes dropped EXE
PID:4964 -
\??\c:\htnhhb.exec:\htnhhb.exe32⤵
- Executes dropped EXE
PID:3732 -
\??\c:\dpppp.exec:\dpppp.exe33⤵
- Executes dropped EXE
PID:3884 -
\??\c:\5fxlrxf.exec:\5fxlrxf.exe34⤵
- Executes dropped EXE
PID:3664 -
\??\c:\5tbnhn.exec:\5tbnhn.exe35⤵
- Executes dropped EXE
PID:3692 -
\??\c:\ddpjv.exec:\ddpjv.exe36⤵
- Executes dropped EXE
PID:4020 -
\??\c:\1vppd.exec:\1vppd.exe37⤵
- Executes dropped EXE
PID:3772 -
\??\c:\1ffflxf.exec:\1ffflxf.exe38⤵
- Executes dropped EXE
PID:4856 -
\??\c:\3ttnhh.exec:\3ttnhh.exe39⤵
- Executes dropped EXE
PID:3652 -
\??\c:\jvvpp.exec:\jvvpp.exe40⤵
- Executes dropped EXE
PID:3076 -
\??\c:\rrxffll.exec:\rrxffll.exe41⤵
- Executes dropped EXE
PID:1076 -
\??\c:\bbhntn.exec:\bbhntn.exe42⤵
- Executes dropped EXE
PID:464 -
\??\c:\jjjdd.exec:\jjjdd.exe43⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lfxxrlf.exec:\lfxxrlf.exe44⤵
- Executes dropped EXE
PID:4744 -
\??\c:\xrxrllx.exec:\xrxrllx.exe45⤵
- Executes dropped EXE
PID:4404 -
\??\c:\hbtbhn.exec:\hbtbhn.exe46⤵
- Executes dropped EXE
PID:3404 -
\??\c:\vdppj.exec:\vdppj.exe47⤵
- Executes dropped EXE
PID:4024 -
\??\c:\jppjd.exec:\jppjd.exe48⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xxxrllx.exec:\xxxrllx.exe49⤵
- Executes dropped EXE
PID:4700 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe50⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hbhtbt.exec:\hbhtbt.exe51⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jjjdp.exec:\jjjdp.exe52⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xrfxxll.exec:\xrfxxll.exe53⤵
- Executes dropped EXE
PID:3560 -
\??\c:\lxxrrll.exec:\lxxrrll.exe54⤵
- Executes dropped EXE
PID:3216 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe55⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nbhhhh.exec:\nbhhhh.exe56⤵
- Executes dropped EXE
PID:3620 -
\??\c:\ddddv.exec:\ddddv.exe57⤵
- Executes dropped EXE
PID:316 -
\??\c:\3rrfxxr.exec:\3rrfxxr.exe58⤵
- Executes dropped EXE
PID:840 -
\??\c:\lxfllrx.exec:\lxfllrx.exe59⤵
- Executes dropped EXE
PID:916 -
\??\c:\bnnnhn.exec:\bnnnhn.exe60⤵
- Executes dropped EXE
PID:4928 -
\??\c:\nnbtbt.exec:\nnbtbt.exe61⤵
- Executes dropped EXE
PID:4864 -
\??\c:\vpppp.exec:\vpppp.exe62⤵
- Executes dropped EXE
PID:4580 -
\??\c:\xrfxllr.exec:\xrfxllr.exe63⤵
- Executes dropped EXE
PID:4248 -
\??\c:\flffxxx.exec:\flffxxx.exe64⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bbhtnt.exec:\bbhtnt.exe65⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xxfxxxr.exec:\xxfxxxr.exe66⤵PID:4688
-
\??\c:\tbbthh.exec:\tbbthh.exe67⤵PID:1532
-
\??\c:\bhnnbb.exec:\bhnnbb.exe68⤵PID:4336
-
\??\c:\5ddvj.exec:\5ddvj.exe69⤵PID:1344
-
\??\c:\nbhbhh.exec:\nbhbhh.exe70⤵PID:4852
-
\??\c:\jvdvp.exec:\jvdvp.exe71⤵PID:2316
-
\??\c:\frrlfxr.exec:\frrlfxr.exe72⤵PID:4468
-
\??\c:\lrxrlff.exec:\lrxrlff.exe73⤵PID:2972
-
\??\c:\hbbbhn.exec:\hbbbhn.exe74⤵PID:2028
-
\??\c:\rllfxxr.exec:\rllfxxr.exe75⤵PID:3148
-
\??\c:\frrfflf.exec:\frrfflf.exe76⤵PID:4148
-
\??\c:\tnttnb.exec:\tnttnb.exe77⤵PID:2820
-
\??\c:\hbtbtt.exec:\hbtbtt.exe78⤵PID:852
-
\??\c:\pdvvp.exec:\pdvvp.exe79⤵PID:4996
-
\??\c:\rllfxfx.exec:\rllfxfx.exe80⤵PID:4548
-
\??\c:\5bhbhn.exec:\5bhbhn.exe81⤵PID:2376
-
\??\c:\httbbb.exec:\httbbb.exe82⤵PID:4556
-
\??\c:\pjvpv.exec:\pjvpv.exe83⤵PID:1332
-
\??\c:\fxxfxxx.exec:\fxxfxxx.exe84⤵PID:408
-
\??\c:\hbhbtn.exec:\hbhbtn.exe85⤵PID:748
-
\??\c:\nhbbtt.exec:\nhbbtt.exe86⤵PID:1224
-
\??\c:\vvppj.exec:\vvppj.exe87⤵PID:648
-
\??\c:\vvvpj.exec:\vvvpj.exe88⤵PID:2272
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe89⤵PID:2600
-
\??\c:\ttnnbb.exec:\ttnnbb.exe90⤵PID:3380
-
\??\c:\bhttnn.exec:\bhttnn.exe91⤵PID:4380
-
\??\c:\dvjpv.exec:\dvjpv.exe92⤵PID:548
-
\??\c:\5ddvd.exec:\5ddvd.exe93⤵PID:4616
-
\??\c:\xflxxxr.exec:\xflxxxr.exe94⤵PID:1732
-
\??\c:\llxlllr.exec:\llxlllr.exe95⤵PID:2432
-
\??\c:\nbhntt.exec:\nbhntt.exe96⤵PID:3012
-
\??\c:\dpddv.exec:\dpddv.exe97⤵PID:1216
-
\??\c:\pdjjd.exec:\pdjjd.exe98⤵PID:2372
-
\??\c:\7rlfffx.exec:\7rlfffx.exe99⤵PID:1316
-
\??\c:\xlflfff.exec:\xlflfff.exe100⤵PID:2080
-
\??\c:\9htttt.exec:\9htttt.exe101⤵PID:3304
-
\??\c:\nnbnbh.exec:\nnbnbh.exe102⤵PID:5084
-
\??\c:\jvddp.exec:\jvddp.exe103⤵PID:1516
-
\??\c:\ffxxlll.exec:\ffxxlll.exe104⤵PID:4296
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe105⤵PID:2172
-
\??\c:\1ttttb.exec:\1ttttb.exe106⤵PID:412
-
\??\c:\bbhhbh.exec:\bbhhbh.exe107⤵PID:1400
-
\??\c:\jjpvp.exec:\jjpvp.exe108⤵PID:2712
-
\??\c:\ppjdj.exec:\ppjdj.exe109⤵PID:4248
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe110⤵PID:2780
-
\??\c:\bntnhh.exec:\bntnhh.exe111⤵PID:4592
-
\??\c:\thbbbh.exec:\thbbbh.exe112⤵PID:2156
-
\??\c:\pjjvp.exec:\pjjvp.exe113⤵PID:4792
-
\??\c:\vpvpv.exec:\vpvpv.exe114⤵PID:3192
-
\??\c:\xrrrlll.exec:\xrrrlll.exe115⤵PID:1464
-
\??\c:\5frfxxr.exec:\5frfxxr.exe116⤵PID:4980
-
\??\c:\tbthnn.exec:\tbthnn.exe117⤵PID:1452
-
\??\c:\btbhbb.exec:\btbhbb.exe118⤵PID:2972
-
\??\c:\tnnhhh.exec:\tnnhhh.exe119⤵PID:4992
-
\??\c:\vpvpj.exec:\vpvpj.exe120⤵PID:4184
-
\??\c:\jdvvp.exec:\jdvvp.exe121⤵PID:2004
-
\??\c:\flxxfrf.exec:\flxxfrf.exe122⤵PID:2820
-
\??\c:\ntnhtn.exec:\ntnhtn.exe123⤵PID:3768
-
\??\c:\ppvvj.exec:\ppvvj.exe124⤵PID:4476
-
\??\c:\pjdvv.exec:\pjdvv.exe125⤵PID:3680
-
\??\c:\ffrrrrl.exec:\ffrrrrl.exe126⤵PID:4252
-
\??\c:\btttnt.exec:\btttnt.exe127⤵PID:528
-
\??\c:\tbtttt.exec:\tbtttt.exe128⤵PID:232
-
\??\c:\vjpjd.exec:\vjpjd.exe129⤵PID:3652
-
\??\c:\7vpjd.exec:\7vpjd.exe130⤵PID:4796
-
\??\c:\rffrlfx.exec:\rffrlfx.exe131⤵PID:4500
-
\??\c:\rfrffff.exec:\rfrffff.exe132⤵PID:1444
-
\??\c:\tbbhtn.exec:\tbbhtn.exe133⤵PID:2312
-
\??\c:\9pppj.exec:\9pppj.exe134⤵PID:2588
-
\??\c:\dddvd.exec:\dddvd.exe135⤵PID:1796
-
\??\c:\1djdv.exec:\1djdv.exe136⤵PID:3036
-
\??\c:\rlxrrxr.exec:\rlxrrxr.exe137⤵PID:1880
-
\??\c:\bbtttt.exec:\bbtttt.exe138⤵PID:4700
-
\??\c:\hbbtnn.exec:\hbbtnn.exe139⤵PID:1216
-
\??\c:\ppjvj.exec:\ppjvj.exe140⤵PID:2372
-
\??\c:\1pjvp.exec:\1pjvp.exe141⤵PID:1096
-
\??\c:\rlfxlrr.exec:\rlfxlrr.exe142⤵PID:1652
-
\??\c:\nbnnnn.exec:\nbnnnn.exe143⤵PID:3620
-
\??\c:\5tbbtb.exec:\5tbbtb.exe144⤵PID:4392
-
\??\c:\jvjvd.exec:\jvjvd.exe145⤵PID:916
-
\??\c:\pjjdv.exec:\pjjdv.exe146⤵PID:4296
-
\??\c:\5flrxrf.exec:\5flrxrf.exe147⤵PID:4004
-
\??\c:\ntbtnh.exec:\ntbtnh.exe148⤵PID:1408
-
\??\c:\tbnhnh.exec:\tbnhnh.exe149⤵PID:1400
-
\??\c:\pjdvp.exec:\pjdvp.exe150⤵PID:1892
-
\??\c:\3rxxxll.exec:\3rxxxll.exe151⤵PID:4248
-
\??\c:\tnnhbb.exec:\tnnhbb.exe152⤵PID:4688
-
\??\c:\tnnhbb.exec:\tnnhbb.exe153⤵PID:2508
-
\??\c:\jddvd.exec:\jddvd.exe154⤵PID:4940
-
\??\c:\pjpjj.exec:\pjpjj.exe155⤵PID:4408
-
\??\c:\lllfxrr.exec:\lllfxrr.exe156⤵PID:1344
-
\??\c:\5lflfrr.exec:\5lflfrr.exe157⤵PID:1940
-
\??\c:\hhbbbb.exec:\hhbbbb.exe158⤵PID:3936
-
\??\c:\nhbtbt.exec:\nhbtbt.exe159⤵PID:4844
-
\??\c:\ppvvp.exec:\ppvvp.exe160⤵PID:1640
-
\??\c:\7fxrrlf.exec:\7fxrrlf.exe161⤵PID:2028
-
\??\c:\lfrrllf.exec:\lfrrllf.exe162⤵PID:4908
-
\??\c:\hthbtb.exec:\hthbtb.exe163⤵PID:1708
-
\??\c:\hhhbbb.exec:\hhhbbb.exe164⤵PID:2836
-
\??\c:\5ddvp.exec:\5ddvp.exe165⤵PID:4548
-
\??\c:\vjppv.exec:\vjppv.exe166⤵PID:4964
-
\??\c:\rlfxfrx.exec:\rlfxfrx.exe167⤵PID:4652
-
\??\c:\lxxxrll.exec:\lxxxrll.exe168⤵PID:1968
-
\??\c:\dpvpj.exec:\dpvpj.exe169⤵PID:1200
-
\??\c:\jppjd.exec:\jppjd.exe170⤵PID:872
-
\??\c:\xrxfxxf.exec:\xrxfxxf.exe171⤵PID:3452
-
\??\c:\htnnnh.exec:\htnnnh.exe172⤵PID:4868
-
\??\c:\vvvpj.exec:\vvvpj.exe173⤵PID:4560
-
\??\c:\rfxffrx.exec:\rfxffrx.exe174⤵PID:4624
-
\??\c:\fffxxrl.exec:\fffxxrl.exe175⤵PID:4596
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe176⤵PID:2948
-
\??\c:\nthhhn.exec:\nthhhn.exe177⤵PID:3604
-
\??\c:\thttnn.exec:\thttnn.exe178⤵PID:2876
-
\??\c:\vpvpj.exec:\vpvpj.exe179⤵PID:1508
-
\??\c:\5dddd.exec:\5dddd.exe180⤵PID:1988
-
\??\c:\lrxfxll.exec:\lrxfxll.exe181⤵PID:2580
-
\??\c:\lrrfrrr.exec:\lrrfrrr.exe182⤵PID:800
-
\??\c:\bbhnht.exec:\bbhnht.exe183⤵PID:1044
-
\??\c:\bnnhtn.exec:\bnnhtn.exe184⤵PID:2472
-
\??\c:\jjpdp.exec:\jjpdp.exe185⤵PID:1616
-
\??\c:\lrfflrr.exec:\lrfflrr.exe186⤵PID:3260
-
\??\c:\3xrlffx.exec:\3xrlffx.exe187⤵PID:2292
-
\??\c:\bttnhh.exec:\bttnhh.exe188⤵PID:4388
-
\??\c:\bbhhbb.exec:\bbhhbb.exe189⤵PID:4628
-
\??\c:\vdppp.exec:\vdppp.exe190⤵PID:2352
-
\??\c:\rllllll.exec:\rllllll.exe191⤵PID:4436
-
\??\c:\frrxrxr.exec:\frrxrxr.exe192⤵PID:1892
-
\??\c:\thntnn.exec:\thntnn.exe193⤵PID:1052
-
\??\c:\5bhbtt.exec:\5bhbtt.exe194⤵PID:4520
-
\??\c:\dvvpj.exec:\dvvpj.exe195⤵PID:2068
-
\??\c:\pdjjv.exec:\pdjjv.exe196⤵PID:1244
-
\??\c:\xxrllfr.exec:\xxrllfr.exe197⤵PID:1728
-
\??\c:\hhbbtn.exec:\hhbbtn.exe198⤵PID:4852
-
\??\c:\nnhnnn.exec:\nnhnnn.exe199⤵PID:4064
-
\??\c:\vvvpp.exec:\vvvpp.exe200⤵PID:3640
-
\??\c:\vvvpp.exec:\vvvpp.exe201⤵PID:1992
-
\??\c:\5flfrlr.exec:\5flfrlr.exe202⤵PID:4908
-
\??\c:\hnbtnn.exec:\hnbtnn.exe203⤵PID:1392
-
\??\c:\nhhbtt.exec:\nhhbtt.exe204⤵PID:2592
-
\??\c:\hbbttn.exec:\hbbttn.exe205⤵PID:4476
-
\??\c:\3djjv.exec:\3djjv.exe206⤵PID:3692
-
\??\c:\vvpdv.exec:\vvpdv.exe207⤵PID:408
-
\??\c:\rlxlfxx.exec:\rlxlfxx.exe208⤵PID:5116
-
\??\c:\lxxrllf.exec:\lxxrllf.exe209⤵PID:4856
-
\??\c:\hhhhbb.exec:\hhhhbb.exe210⤵PID:1620
-
\??\c:\hbhhbb.exec:\hbhhbb.exe211⤵PID:464
-
\??\c:\ppdvj.exec:\ppdvj.exe212⤵PID:4892
-
\??\c:\vddpd.exec:\vddpd.exe213⤵PID:1444
-
\??\c:\jdvpj.exec:\jdvpj.exe214⤵PID:3016
-
\??\c:\xrxrllf.exec:\xrxrllf.exe215⤵PID:3404
-
\??\c:\xrlfxlx.exec:\xrlfxlx.exe216⤵PID:4056
-
\??\c:\tnhbtt.exec:\tnhbtt.exe217⤵PID:1880
-
\??\c:\hbtnhh.exec:\hbtnhh.exe218⤵PID:5012
-
\??\c:\dvppv.exec:\dvppv.exe219⤵PID:216
-
\??\c:\dvdvp.exec:\dvdvp.exe220⤵PID:1096
-
\??\c:\rlxxffl.exec:\rlxxffl.exe221⤵PID:1044
-
\??\c:\lfxrllf.exec:\lfxrllf.exe222⤵PID:3620
-
\??\c:\nhnhhb.exec:\nhnhhb.exe223⤵PID:4392
-
\??\c:\hntntt.exec:\hntntt.exe224⤵PID:2172
-
\??\c:\pjpdj.exec:\pjpdj.exe225⤵PID:4928
-
\??\c:\ppjdp.exec:\ppjdp.exe226⤵PID:4580
-
\??\c:\9rrrfrr.exec:\9rrrfrr.exe227⤵PID:4628
-
\??\c:\bbthht.exec:\bbthht.exe228⤵PID:2352
-
\??\c:\hnnhtt.exec:\hnnhtt.exe229⤵PID:2436
-
\??\c:\djjdp.exec:\djjdp.exe230⤵PID:1892
-
\??\c:\tttnhh.exec:\tttnhh.exe231⤵PID:1568
-
\??\c:\bnbbtt.exec:\bnbbtt.exe232⤵PID:1052
-
\??\c:\vppjd.exec:\vppjd.exe233⤵PID:4336
-
\??\c:\pjvpj.exec:\pjvpj.exe234⤵PID:2068
-
\??\c:\fxlxffx.exec:\fxlxffx.exe235⤵PID:5016
-
\??\c:\xrxrflf.exec:\xrxrflf.exe236⤵PID:4844
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe237⤵PID:3944
-
\??\c:\btnnbb.exec:\btnnbb.exe238⤵PID:1992
-
\??\c:\7nthnn.exec:\7nthnn.exe239⤵PID:2820
-
\??\c:\jvpjd.exec:\jvpjd.exe240⤵PID:1392
-
\??\c:\jdjdd.exec:\jdjdd.exe241⤵PID:2592
-
\??\c:\7xrfxxf.exec:\7xrfxxf.exe242⤵PID:3672