Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 03:13
Behavioral task
behavioral1
Sample
152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe
-
Size
169KB
-
MD5
152ce54299cea73d2dad55769b74a770
-
SHA1
d1c60b3fea941a80511458832b2aad5e5411f49b
-
SHA256
4f63a80b019bab3517d8412ecfdf7a1c8489589459726c46de10309b57eeef89
-
SHA512
4f1b5237e86fde7897be60c80b68b3c673668297e55eb57e91f7b0bebdc3e2413dc636b3fb3b56169b53eadd14c8591a7793a49321592ee7baa8fa0bf299d072
-
SSDEEP
1536:HvQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7FK4O8A1o4XEc3YtxD8/Ai2T:HhOmTsF93UYfwC6GIoutX8Ki3c3YT8Vk
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2112-6-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4684-8-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1268-14-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3652-27-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4208-33-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3712-37-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1236-25-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1124-49-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1824-51-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4624-55-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4044-63-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/396-72-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2184-78-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4852-85-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3112-92-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3980-93-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4668-99-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3100-114-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4316-127-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4424-133-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4332-139-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3876-141-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2200-155-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1404-159-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4984-167-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4696-175-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1836-181-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4432-187-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1412-191-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/436-198-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/208-220-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1204-234-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/732-237-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3176-241-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3152-245-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1124-253-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1952-255-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4976-258-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2860-266-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1464-271-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4940-293-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2688-297-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2232-318-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/452-324-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3216-331-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/8-335-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1832-401-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4044-418-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2860-425-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3168-432-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/544-470-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3028-474-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2312-493-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1032-545-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3084-616-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3140-618-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3140-621-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2760-653-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4928-705-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1472-777-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4592-830-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1352-838-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1412-914-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1704-1048-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nbbhtt.exedpvdp.exe7bthbn.exejddjv.exejddpd.exelrxrxlf.exepvvjv.exe5xfxxxf.exehtnnbt.exenbbnbn.exefxfxrrf.exenbtnbb.exepjpdj.exentthth.exepvjdp.exennttbh.exe7pddp.exe3rrfrlx.exebhbthb.exeppppv.exetnnhnn.exetbhhbt.exerfrlffl.exe7bbthb.exeddvjd.exelffxlfx.exethnnhb.exe5xlfllx.exehnnhbt.exevjdpd.exe9fxrfxl.exehhnbnb.exeddjpp.exejdvpj.exelrxlxlf.exettthbn.exebnnhbh.exeddvjv.exerxxlxrl.exefflrffx.exehtbntn.exejppdv.exe1vdvj.exe5frxlfr.exexrlfxlf.exe5nbtbt.exepjjdd.exexrrfrlf.exehtnnbt.exehnthtn.exe9dvpd.exelxxrfrx.exehhtnbt.exe7hnhbb.exe1jjdj.exeflrlxrf.exebtbbnh.exexrlfxrl.exexfffrrf.exenhhbnn.exenbhbnh.exedpvjv.exe3xrrfxl.exentntnn.exepid process 4684 nbbhtt.exe 1268 dpvdp.exe 3652 7bthbn.exe 1236 jddjv.exe 4208 jddpd.exe 3712 lrxrxlf.exe 1124 pvvjv.exe 1824 5xfxxxf.exe 4624 htnnbt.exe 4044 nbbnbn.exe 396 fxfxrrf.exe 2184 nbtnbb.exe 4852 pjpdj.exe 3112 ntthth.exe 3980 pvjdp.exe 4668 nnttbh.exe 3488 7pddp.exe 3100 3rrfrlx.exe 2240 bhbthb.exe 4316 ppppv.exe 4424 tnnhnn.exe 4332 tbhhbt.exe 3876 rfrlffl.exe 540 7bbthb.exe 2200 ddvjd.exe 1404 lffxlfx.exe 4984 thnnhb.exe 4696 5xlfllx.exe 1836 hnnhbt.exe 4432 vjdpd.exe 1412 9fxrfxl.exe 3532 hhnbnb.exe 436 ddjpp.exe 1284 jdvpj.exe 1416 lrxlxlf.exe 1472 ttthbn.exe 2620 bnnhbh.exe 4812 ddvjv.exe 208 rxxlxrl.exe 2280 fflrffx.exe 2628 htbntn.exe 2732 jppdv.exe 1204 1vdvj.exe 732 5frxlfr.exe 3176 xrlfxlf.exe 3152 5nbtbt.exe 3712 pjjdd.exe 1124 xrrfrlf.exe 1952 htnnbt.exe 4976 hnthtn.exe 2860 9dvpd.exe 1896 lxxrfrx.exe 1464 hhtnbt.exe 2072 7hnhbb.exe 1920 1jjdj.exe 4852 flrlxrf.exe 3672 btbbnh.exe 1516 xrlfxrl.exe 4940 xfffrrf.exe 2688 nhhbnn.exe 1308 nbhbnh.exe 552 dpvjv.exe 1852 3xrrfxl.exe 2068 ntntnn.exe -
Processes:
resource yara_rule behavioral2/memory/2112-0-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\nbbhtt.exe upx behavioral2/memory/2112-6-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4684-8-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\dpvdp.exe upx C:\7bthbn.exe upx behavioral2/memory/1268-14-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\jddjv.exe upx behavioral2/memory/3652-27-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4208-33-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\lrxrxlf.exe upx behavioral2/memory/3712-37-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\jddpd.exe upx behavioral2/memory/1236-25-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3652-18-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\pvvjv.exe upx C:\5xfxxxf.exe upx behavioral2/memory/1124-49-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1824-51-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\htnnbt.exe upx behavioral2/memory/4624-55-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\nbbnbn.exe upx behavioral2/memory/4044-63-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\fxfxrrf.exe upx C:\nbtnbb.exe upx behavioral2/memory/396-72-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\pjpdj.exe upx behavioral2/memory/2184-78-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4852-80-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\ntthth.exe upx behavioral2/memory/4852-85-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\pvjdp.exe upx behavioral2/memory/3112-92-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3980-93-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\nnttbh.exe upx behavioral2/memory/4668-99-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\7pddp.exe upx C:\3rrfrlx.exe upx C:\bhbthb.exe upx behavioral2/memory/3100-114-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2240-116-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\ppppv.exe upx behavioral2/memory/4316-122-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\tnnhnn.exe upx behavioral2/memory/4316-127-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4424-133-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\tbhhbt.exe upx behavioral2/memory/4332-139-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\rfrlffl.exe upx behavioral2/memory/3876-141-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\7bbthb.exe upx C:\ddvjd.exe upx C:\lffxlfx.exe upx behavioral2/memory/2200-155-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1404-159-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\thnnhb.exe upx behavioral2/memory/4984-167-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\5xlfllx.exe upx \??\c:\hnnhbt.exe upx behavioral2/memory/4696-175-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\vjdpd.exe upx behavioral2/memory/1836-181-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\9fxrfxl.exe upx behavioral2/memory/4432-187-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exenbbhtt.exedpvdp.exe7bthbn.exejddjv.exejddpd.exelrxrxlf.exepvvjv.exe5xfxxxf.exehtnnbt.exenbbnbn.exefxfxrrf.exenbtnbb.exepjpdj.exentthth.exepvjdp.exennttbh.exe7pddp.exe3rrfrlx.exebhbthb.exeppppv.exetnnhnn.exedescription pid process target process PID 2112 wrote to memory of 4684 2112 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe nbbhtt.exe PID 2112 wrote to memory of 4684 2112 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe nbbhtt.exe PID 2112 wrote to memory of 4684 2112 152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe nbbhtt.exe PID 4684 wrote to memory of 1268 4684 nbbhtt.exe dpvdp.exe PID 4684 wrote to memory of 1268 4684 nbbhtt.exe dpvdp.exe PID 4684 wrote to memory of 1268 4684 nbbhtt.exe dpvdp.exe PID 1268 wrote to memory of 3652 1268 dpvdp.exe 7bthbn.exe PID 1268 wrote to memory of 3652 1268 dpvdp.exe 7bthbn.exe PID 1268 wrote to memory of 3652 1268 dpvdp.exe 7bthbn.exe PID 3652 wrote to memory of 1236 3652 7bthbn.exe jddjv.exe PID 3652 wrote to memory of 1236 3652 7bthbn.exe jddjv.exe PID 3652 wrote to memory of 1236 3652 7bthbn.exe jddjv.exe PID 1236 wrote to memory of 4208 1236 jddjv.exe jddpd.exe PID 1236 wrote to memory of 4208 1236 jddjv.exe jddpd.exe PID 1236 wrote to memory of 4208 1236 jddjv.exe jddpd.exe PID 4208 wrote to memory of 3712 4208 jddpd.exe lrxrxlf.exe PID 4208 wrote to memory of 3712 4208 jddpd.exe lrxrxlf.exe PID 4208 wrote to memory of 3712 4208 jddpd.exe lrxrxlf.exe PID 3712 wrote to memory of 1124 3712 lrxrxlf.exe pvvjv.exe PID 3712 wrote to memory of 1124 3712 lrxrxlf.exe pvvjv.exe PID 3712 wrote to memory of 1124 3712 lrxrxlf.exe pvvjv.exe PID 1124 wrote to memory of 1824 1124 pvvjv.exe 5xfxxxf.exe PID 1124 wrote to memory of 1824 1124 pvvjv.exe 5xfxxxf.exe PID 1124 wrote to memory of 1824 1124 pvvjv.exe 5xfxxxf.exe PID 1824 wrote to memory of 4624 1824 5xfxxxf.exe htnnbt.exe PID 1824 wrote to memory of 4624 1824 5xfxxxf.exe htnnbt.exe PID 1824 wrote to memory of 4624 1824 5xfxxxf.exe htnnbt.exe PID 4624 wrote to memory of 4044 4624 htnnbt.exe nbbnbn.exe PID 4624 wrote to memory of 4044 4624 htnnbt.exe nbbnbn.exe PID 4624 wrote to memory of 4044 4624 htnnbt.exe nbbnbn.exe PID 4044 wrote to memory of 396 4044 nbbnbn.exe fxfxrrf.exe PID 4044 wrote to memory of 396 4044 nbbnbn.exe fxfxrrf.exe PID 4044 wrote to memory of 396 4044 nbbnbn.exe fxfxrrf.exe PID 396 wrote to memory of 2184 396 fxfxrrf.exe nbtnbb.exe PID 396 wrote to memory of 2184 396 fxfxrrf.exe nbtnbb.exe PID 396 wrote to memory of 2184 396 fxfxrrf.exe nbtnbb.exe PID 2184 wrote to memory of 4852 2184 nbtnbb.exe pjpdj.exe PID 2184 wrote to memory of 4852 2184 nbtnbb.exe pjpdj.exe PID 2184 wrote to memory of 4852 2184 nbtnbb.exe pjpdj.exe PID 4852 wrote to memory of 3112 4852 pjpdj.exe ntthth.exe PID 4852 wrote to memory of 3112 4852 pjpdj.exe ntthth.exe PID 4852 wrote to memory of 3112 4852 pjpdj.exe ntthth.exe PID 3112 wrote to memory of 3980 3112 ntthth.exe pvjdp.exe PID 3112 wrote to memory of 3980 3112 ntthth.exe pvjdp.exe PID 3112 wrote to memory of 3980 3112 ntthth.exe pvjdp.exe PID 3980 wrote to memory of 4668 3980 pvjdp.exe nnttbh.exe PID 3980 wrote to memory of 4668 3980 pvjdp.exe nnttbh.exe PID 3980 wrote to memory of 4668 3980 pvjdp.exe nnttbh.exe PID 4668 wrote to memory of 3488 4668 nnttbh.exe 7pddp.exe PID 4668 wrote to memory of 3488 4668 nnttbh.exe 7pddp.exe PID 4668 wrote to memory of 3488 4668 nnttbh.exe 7pddp.exe PID 3488 wrote to memory of 3100 3488 7pddp.exe 3rrfrlx.exe PID 3488 wrote to memory of 3100 3488 7pddp.exe 3rrfrlx.exe PID 3488 wrote to memory of 3100 3488 7pddp.exe 3rrfrlx.exe PID 3100 wrote to memory of 2240 3100 3rrfrlx.exe bhbthb.exe PID 3100 wrote to memory of 2240 3100 3rrfrlx.exe bhbthb.exe PID 3100 wrote to memory of 2240 3100 3rrfrlx.exe bhbthb.exe PID 2240 wrote to memory of 4316 2240 bhbthb.exe ppppv.exe PID 2240 wrote to memory of 4316 2240 bhbthb.exe ppppv.exe PID 2240 wrote to memory of 4316 2240 bhbthb.exe ppppv.exe PID 4316 wrote to memory of 4424 4316 ppppv.exe tnnhnn.exe PID 4316 wrote to memory of 4424 4316 ppppv.exe tnnhnn.exe PID 4316 wrote to memory of 4424 4316 ppppv.exe tnnhnn.exe PID 4424 wrote to memory of 4332 4424 tnnhnn.exe tbhhbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\152ce54299cea73d2dad55769b74a770_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\nbbhtt.exec:\nbbhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\dpvdp.exec:\dpvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\7bthbn.exec:\7bthbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\jddjv.exec:\jddjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\jddpd.exec:\jddpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\lrxrxlf.exec:\lrxrxlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\pvvjv.exec:\pvvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\5xfxxxf.exec:\5xfxxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\htnnbt.exec:\htnnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\nbbnbn.exec:\nbbnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\fxfxrrf.exec:\fxfxrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\nbtnbb.exec:\nbtnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\pjpdj.exec:\pjpdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\ntthth.exec:\ntthth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\pvjdp.exec:\pvjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\nnttbh.exec:\nnttbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\7pddp.exec:\7pddp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\3rrfrlx.exec:\3rrfrlx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\bhbthb.exec:\bhbthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\ppppv.exec:\ppppv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\tnnhnn.exec:\tnnhnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\tbhhbt.exec:\tbhhbt.exe23⤵
- Executes dropped EXE
PID:4332 -
\??\c:\rfrlffl.exec:\rfrlffl.exe24⤵
- Executes dropped EXE
PID:3876 -
\??\c:\7bbthb.exec:\7bbthb.exe25⤵
- Executes dropped EXE
PID:540 -
\??\c:\ddvjd.exec:\ddvjd.exe26⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lffxlfx.exec:\lffxlfx.exe27⤵
- Executes dropped EXE
PID:1404 -
\??\c:\thnnhb.exec:\thnnhb.exe28⤵
- Executes dropped EXE
PID:4984 -
\??\c:\5xlfllx.exec:\5xlfllx.exe29⤵
- Executes dropped EXE
PID:4696 -
\??\c:\hnnhbt.exec:\hnnhbt.exe30⤵
- Executes dropped EXE
PID:1836 -
\??\c:\vjdpd.exec:\vjdpd.exe31⤵
- Executes dropped EXE
PID:4432 -
\??\c:\9fxrfxl.exec:\9fxrfxl.exe32⤵
- Executes dropped EXE
PID:1412 -
\??\c:\hhnbnb.exec:\hhnbnb.exe33⤵
- Executes dropped EXE
PID:3532 -
\??\c:\ddjpp.exec:\ddjpp.exe34⤵
- Executes dropped EXE
PID:436 -
\??\c:\jdvpj.exec:\jdvpj.exe35⤵
- Executes dropped EXE
PID:1284 -
\??\c:\lrxlxlf.exec:\lrxlxlf.exe36⤵
- Executes dropped EXE
PID:1416 -
\??\c:\ttthbn.exec:\ttthbn.exe37⤵
- Executes dropped EXE
PID:1472 -
\??\c:\bnnhbh.exec:\bnnhbh.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ddvjv.exec:\ddvjv.exe39⤵
- Executes dropped EXE
PID:4812 -
\??\c:\jppdj.exec:\jppdj.exe40⤵PID:4524
-
\??\c:\rxxlxrl.exec:\rxxlxrl.exe41⤵
- Executes dropped EXE
PID:208 -
\??\c:\fflrffx.exec:\fflrffx.exe42⤵
- Executes dropped EXE
PID:2280 -
\??\c:\htbntn.exec:\htbntn.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jppdv.exec:\jppdv.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1vdvj.exec:\1vdvj.exe45⤵
- Executes dropped EXE
PID:1204 -
\??\c:\5frxlfr.exec:\5frxlfr.exe46⤵
- Executes dropped EXE
PID:732 -
\??\c:\xrlfxlf.exec:\xrlfxlf.exe47⤵
- Executes dropped EXE
PID:3176 -
\??\c:\5nbtbt.exec:\5nbtbt.exe48⤵
- Executes dropped EXE
PID:3152 -
\??\c:\pjjdd.exec:\pjjdd.exe49⤵
- Executes dropped EXE
PID:3712 -
\??\c:\xrrfrlf.exec:\xrrfrlf.exe50⤵
- Executes dropped EXE
PID:1124 -
\??\c:\htnnbt.exec:\htnnbt.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hnthtn.exec:\hnthtn.exe52⤵
- Executes dropped EXE
PID:4976 -
\??\c:\9dvpd.exec:\9dvpd.exe53⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lxxrfrx.exec:\lxxrfrx.exe54⤵
- Executes dropped EXE
PID:1896 -
\??\c:\hhtnbt.exec:\hhtnbt.exe55⤵
- Executes dropped EXE
PID:1464 -
\??\c:\7hnhbb.exec:\7hnhbb.exe56⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1jjdj.exec:\1jjdj.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\flrlxrf.exec:\flrlxrf.exe58⤵
- Executes dropped EXE
PID:4852 -
\??\c:\btbbnh.exec:\btbbnh.exe59⤵
- Executes dropped EXE
PID:3672 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe60⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xfffrrf.exec:\xfffrrf.exe61⤵
- Executes dropped EXE
PID:4940 -
\??\c:\nhhbnn.exec:\nhhbnn.exe62⤵
- Executes dropped EXE
PID:2688 -
\??\c:\nbhbnh.exec:\nbhbnh.exe63⤵
- Executes dropped EXE
PID:1308 -
\??\c:\dpvjv.exec:\dpvjv.exe64⤵
- Executes dropped EXE
PID:552 -
\??\c:\3xrrfxl.exec:\3xrrfxl.exe65⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ntntnn.exec:\ntntnn.exe66⤵
- Executes dropped EXE
PID:2068 -
\??\c:\htbbhh.exec:\htbbhh.exe67⤵PID:2252
-
\??\c:\9jjvj.exec:\9jjvj.exe68⤵PID:2232
-
\??\c:\rxxlfxr.exec:\rxxlfxr.exe69⤵PID:5104
-
\??\c:\bnbbtb.exec:\bnbbtb.exe70⤵PID:452
-
\??\c:\djjdp.exec:\djjdp.exe71⤵PID:4872
-
\??\c:\vdddv.exec:\vdddv.exe72⤵PID:3216
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe73⤵PID:2268
-
\??\c:\1nnhbb.exec:\1nnhbb.exe74⤵PID:8
-
\??\c:\dpdvd.exec:\dpdvd.exe75⤵PID:1656
-
\??\c:\dpjdp.exec:\dpjdp.exe76⤵PID:4896
-
\??\c:\fxrffxf.exec:\fxrffxf.exe77⤵PID:4440
-
\??\c:\rllfxxl.exec:\rllfxxl.exe78⤵PID:4696
-
\??\c:\1nhnbt.exec:\1nhnbt.exe79⤵PID:2572
-
\??\c:\dppdv.exec:\dppdv.exe80⤵PID:3436
-
\??\c:\1vpjp.exec:\1vpjp.exe81⤵PID:4236
-
\??\c:\xxlfrlf.exec:\xxlfrlf.exe82⤵PID:440
-
\??\c:\7xxrffx.exec:\7xxrffx.exe83⤵PID:3532
-
\??\c:\vppjj.exec:\vppjj.exe84⤵PID:3320
-
\??\c:\dppjv.exec:\dppjv.exe85⤵PID:2876
-
\??\c:\1xxfxfx.exec:\1xxfxfx.exe86⤵PID:1416
-
\??\c:\7tnthb.exec:\7tnthb.exe87⤵PID:4528
-
\??\c:\hthtnh.exec:\hthtnh.exe88⤵PID:4348
-
\??\c:\jddpd.exec:\jddpd.exe89⤵PID:3252
-
\??\c:\pvvvp.exec:\pvvvp.exe90⤵PID:116
-
\??\c:\frfrxlx.exec:\frfrxlx.exe91⤵PID:4600
-
\??\c:\thbtnn.exec:\thbtnn.exe92⤵PID:1236
-
\??\c:\tbbhbt.exec:\tbbhbt.exe93⤵PID:4916
-
\??\c:\jjvpj.exec:\jjvpj.exe94⤵PID:3864
-
\??\c:\9vjjd.exec:\9vjjd.exe95⤵PID:1832
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe96⤵PID:3152
-
\??\c:\tthnbt.exec:\tthnbt.exe97⤵PID:3696
-
\??\c:\bhtnbb.exec:\bhtnbb.exe98⤵PID:3948
-
\??\c:\vjppv.exec:\vjppv.exe99⤵PID:3144
-
\??\c:\djpjd.exec:\djpjd.exe100⤵PID:4044
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe101⤵PID:2860
-
\??\c:\lxrfxrl.exec:\lxrfxrl.exe102⤵PID:1896
-
\??\c:\tnhtnh.exec:\tnhtnh.exe103⤵PID:3168
-
\??\c:\5tnbnh.exec:\5tnbnh.exe104⤵PID:5068
-
\??\c:\vpdpp.exec:\vpdpp.exe105⤵PID:628
-
\??\c:\flxffff.exec:\flxffff.exe106⤵PID:3972
-
\??\c:\fllfxrl.exec:\fllfxrl.exe107⤵PID:2116
-
\??\c:\htbnhb.exec:\htbnhb.exe108⤵PID:3000
-
\??\c:\7dvpd.exec:\7dvpd.exe109⤵PID:4940
-
\??\c:\dvpjv.exec:\dvpjv.exe110⤵PID:3408
-
\??\c:\xxrlrrl.exec:\xxrlrrl.exe111⤵PID:4700
-
\??\c:\9rrlrll.exec:\9rrlrll.exe112⤵PID:1060
-
\??\c:\hnthtn.exec:\hnthtn.exe113⤵PID:816
-
\??\c:\jpjdd.exec:\jpjdd.exe114⤵PID:4840
-
\??\c:\rrrffxl.exec:\rrrffxl.exe115⤵PID:544
-
\??\c:\rlrlxfr.exec:\rlrlxfr.exe116⤵PID:3028
-
\??\c:\hhhbnh.exec:\hhhbnh.exe117⤵PID:3856
-
\??\c:\bbbnbb.exec:\bbbnbb.exe118⤵PID:2296
-
\??\c:\1dpjv.exec:\1dpjv.exe119⤵PID:4848
-
\??\c:\3vjvd.exec:\3vjvd.exe120⤵PID:4172
-
\??\c:\rrlxrlx.exec:\rrlxrlx.exe121⤵PID:2268
-
\??\c:\nnhbnh.exec:\nnhbnh.exe122⤵PID:2312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-