Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 23:58
Behavioral task
behavioral1
Sample
650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe
-
Size
454KB
-
MD5
650aa58f4254f4451e5f3f931e86ab60
-
SHA1
632a0cdb284cb35da65f8a6f1f75bfeb8f98651d
-
SHA256
08d70ebf623d5c5bbce7ace828a8408f57eddd386829efa6cd43793a012fac76
-
SHA512
6d315a1e6332fcabb65697b1406e95526ce997bb30ee77d26ebc7334430e3e63d885558108457d803d8d5edab4cfecfc44e906cac4ac9d1d6da213d33b38d5e8
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNmB:x4wFHoS3eFaKHpv/VycgE81lgQ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2252-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/780-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/836-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3860-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1296-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frxrlfx.exenhbbht.exepdvpd.exefxfffrl.exe9tbttb.exerrflxfr.exe9thbbb.exejvvvv.exedvvjp.exe3xlrrrx.exetntttn.exe1ppvv.exerrlrrxx.exeddjvd.exe9xxrllf.exetntnnh.exevvjdp.exerflfxfx.exe3htbbt.exe1vjjd.exepdddj.exehhtthh.exeddjjj.exejpvvp.exebtnhbt.exethttnn.exe7vjvd.exe1lxrlrl.exettbbbb.exevjppp.exennhhbh.exepdjjj.exerrflfll.exehttnbn.exeppvvv.exellrrlrl.exennbbbh.exejdddv.exepdjdv.exexxlfllx.exenbhbhh.exepjjpj.exejjppv.exenhnnhn.exedjppj.exedvdvp.exeffxrrlf.exehnnbtn.exevjjdd.exellllrrf.exe9tntnb.exejdpjp.exerfffxff.exetnhbtb.exejvvvj.exerxxxxxx.exehnthbb.exejpdvv.exe1dppp.exe1djjj.exelflxlxx.exe9hnntb.exevvvvp.exejpdvp.exepid process 3204 frxrlfx.exe 5040 nhbbht.exe 4628 pdvpd.exe 384 fxfffrl.exe 2352 9tbttb.exe 556 rrflxfr.exe 840 9thbbb.exe 1860 jvvvv.exe 3868 dvvjp.exe 4848 3xlrrrx.exe 2692 tntttn.exe 1944 1ppvv.exe 4788 rrlrrxx.exe 1980 ddjvd.exe 3968 9xxrllf.exe 3428 tntnnh.exe 544 vvjdp.exe 4924 rflfxfx.exe 780 3htbbt.exe 5088 1vjjd.exe 4320 pdddj.exe 3944 hhtthh.exe 3164 ddjjj.exe 3484 jpvvp.exe 1620 btnhbt.exe 2800 thttnn.exe 1744 7vjvd.exe 3208 1lxrlrl.exe 2076 ttbbbb.exe 2100 vjppp.exe 224 nnhhbh.exe 5092 pdjjj.exe 440 rrflfll.exe 4960 httnbn.exe 2584 ppvvv.exe 2452 llrrlrl.exe 1612 nnbbbh.exe 2688 jdddv.exe 2024 pdjdv.exe 836 xxlfllx.exe 4028 nbhbhh.exe 4404 pjjpj.exe 3884 jjppv.exe 2660 nhnnhn.exe 1908 djppj.exe 4996 dvdvp.exe 1944 ffxrrlf.exe 1096 hnnbtn.exe 232 vjjdd.exe 1672 llllrrf.exe 2780 9tntnb.exe 4908 jdpjp.exe 4496 rfffxff.exe 4460 tnhbtb.exe 2120 jvvvj.exe 3040 rxxxxxx.exe 388 hnthbb.exe 2824 jpdvv.exe 3688 1dppp.exe 1624 1djjj.exe 2076 lflxlxx.exe 4372 9hnntb.exe 3676 vvvvp.exe 5040 jpdvp.exe -
Processes:
resource yara_rule behavioral2/memory/2252-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2252-4-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frxrlfx.exe upx behavioral2/memory/3204-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbbht.exe upx behavioral2/memory/5040-13-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvpd.exe upx behavioral2/memory/4628-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/384-25-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxfffrl.exe upx C:\9tbttb.exe upx behavioral2/memory/384-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrflxfr.exe upx behavioral2/memory/2352-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/556-38-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9thbbb.exe upx C:\jvvvv.exe upx behavioral2/memory/840-49-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvvjp.exe upx \??\c:\tntttn.exe upx behavioral2/memory/2692-72-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1ppvv.exe upx behavioral2/memory/4848-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1944-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3868-60-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrlrrxx.exe upx \??\c:\3xlrrrx.exe upx C:\ddjvd.exe upx behavioral2/memory/1980-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4788-83-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9xxrllf.exe upx behavioral2/memory/3968-91-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tntnnh.exe upx \??\c:\vvjdp.exe upx \??\c:\rflfxfx.exe upx behavioral2/memory/4924-107-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3htbbt.exe upx behavioral2/memory/5088-120-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1vjjd.exe upx \??\c:\pdddj.exe upx behavioral2/memory/780-114-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhtthh.exe upx behavioral2/memory/4320-130-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddjjj.exe upx C:\jpvvp.exe upx behavioral2/memory/3164-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3944-132-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnhbt.exe upx behavioral2/memory/3484-149-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thttnn.exe upx C:\7vjvd.exe upx C:\1lxrlrl.exe upx behavioral2/memory/1744-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2076-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3208-171-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ttbbbb.exe upx behavioral2/memory/3428-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjppp.exe upx C:\pdjjj.exe upx behavioral2/memory/2100-184-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnhhbh.exe upx behavioral2/memory/4960-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5092-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2584-204-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exefrxrlfx.exenhbbht.exepdvpd.exefxfffrl.exe9tbttb.exerrflxfr.exe9thbbb.exejvvvv.exedvvjp.exe3xlrrrx.exetntttn.exe1ppvv.exerrlrrxx.exeddjvd.exe9xxrllf.exetntnnh.exevvjdp.exerflfxfx.exe3htbbt.exe1vjjd.exepdddj.exedescription pid process target process PID 2252 wrote to memory of 3204 2252 650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe frxrlfx.exe PID 2252 wrote to memory of 3204 2252 650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe frxrlfx.exe PID 2252 wrote to memory of 3204 2252 650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe frxrlfx.exe PID 3204 wrote to memory of 5040 3204 frxrlfx.exe nhbbht.exe PID 3204 wrote to memory of 5040 3204 frxrlfx.exe nhbbht.exe PID 3204 wrote to memory of 5040 3204 frxrlfx.exe nhbbht.exe PID 5040 wrote to memory of 4628 5040 nhbbht.exe pdvpd.exe PID 5040 wrote to memory of 4628 5040 nhbbht.exe pdvpd.exe PID 5040 wrote to memory of 4628 5040 nhbbht.exe pdvpd.exe PID 4628 wrote to memory of 384 4628 pdvpd.exe fxfffrl.exe PID 4628 wrote to memory of 384 4628 pdvpd.exe fxfffrl.exe PID 4628 wrote to memory of 384 4628 pdvpd.exe fxfffrl.exe PID 384 wrote to memory of 2352 384 fxfffrl.exe 9tbttb.exe PID 384 wrote to memory of 2352 384 fxfffrl.exe 9tbttb.exe PID 384 wrote to memory of 2352 384 fxfffrl.exe 9tbttb.exe PID 2352 wrote to memory of 556 2352 9tbttb.exe rrflxfr.exe PID 2352 wrote to memory of 556 2352 9tbttb.exe rrflxfr.exe PID 2352 wrote to memory of 556 2352 9tbttb.exe rrflxfr.exe PID 556 wrote to memory of 840 556 rrflxfr.exe 9thbbb.exe PID 556 wrote to memory of 840 556 rrflxfr.exe 9thbbb.exe PID 556 wrote to memory of 840 556 rrflxfr.exe 9thbbb.exe PID 840 wrote to memory of 1860 840 9thbbb.exe jvvvv.exe PID 840 wrote to memory of 1860 840 9thbbb.exe jvvvv.exe PID 840 wrote to memory of 1860 840 9thbbb.exe jvvvv.exe PID 1860 wrote to memory of 3868 1860 jvvvv.exe dvvjp.exe PID 1860 wrote to memory of 3868 1860 jvvvv.exe dvvjp.exe PID 1860 wrote to memory of 3868 1860 jvvvv.exe dvvjp.exe PID 3868 wrote to memory of 4848 3868 dvvjp.exe 3xlrrrx.exe PID 3868 wrote to memory of 4848 3868 dvvjp.exe 3xlrrrx.exe PID 3868 wrote to memory of 4848 3868 dvvjp.exe 3xlrrrx.exe PID 4848 wrote to memory of 2692 4848 3xlrrrx.exe tntttn.exe PID 4848 wrote to memory of 2692 4848 3xlrrrx.exe tntttn.exe PID 4848 wrote to memory of 2692 4848 3xlrrrx.exe tntttn.exe PID 2692 wrote to memory of 1944 2692 tntttn.exe ffxrrlf.exe PID 2692 wrote to memory of 1944 2692 tntttn.exe ffxrrlf.exe PID 2692 wrote to memory of 1944 2692 tntttn.exe ffxrrlf.exe PID 1944 wrote to memory of 4788 1944 1ppvv.exe rrlrrxx.exe PID 1944 wrote to memory of 4788 1944 1ppvv.exe rrlrrxx.exe PID 1944 wrote to memory of 4788 1944 1ppvv.exe rrlrrxx.exe PID 4788 wrote to memory of 1980 4788 rrlrrxx.exe ddjvd.exe PID 4788 wrote to memory of 1980 4788 rrlrrxx.exe ddjvd.exe PID 4788 wrote to memory of 1980 4788 rrlrrxx.exe ddjvd.exe PID 1980 wrote to memory of 3968 1980 ddjvd.exe 9xxrllf.exe PID 1980 wrote to memory of 3968 1980 ddjvd.exe 9xxrllf.exe PID 1980 wrote to memory of 3968 1980 ddjvd.exe 9xxrllf.exe PID 3968 wrote to memory of 3428 3968 9xxrllf.exe tntnnh.exe PID 3968 wrote to memory of 3428 3968 9xxrllf.exe tntnnh.exe PID 3968 wrote to memory of 3428 3968 9xxrllf.exe tntnnh.exe PID 3428 wrote to memory of 544 3428 tntnnh.exe vvjdp.exe PID 3428 wrote to memory of 544 3428 tntnnh.exe vvjdp.exe PID 3428 wrote to memory of 544 3428 tntnnh.exe vvjdp.exe PID 544 wrote to memory of 4924 544 vvjdp.exe rflfxfx.exe PID 544 wrote to memory of 4924 544 vvjdp.exe rflfxfx.exe PID 544 wrote to memory of 4924 544 vvjdp.exe rflfxfx.exe PID 4924 wrote to memory of 780 4924 rflfxfx.exe 3htbbt.exe PID 4924 wrote to memory of 780 4924 rflfxfx.exe 3htbbt.exe PID 4924 wrote to memory of 780 4924 rflfxfx.exe 3htbbt.exe PID 780 wrote to memory of 5088 780 3htbbt.exe 1vjjd.exe PID 780 wrote to memory of 5088 780 3htbbt.exe 1vjjd.exe PID 780 wrote to memory of 5088 780 3htbbt.exe 1vjjd.exe PID 5088 wrote to memory of 4320 5088 1vjjd.exe pdddj.exe PID 5088 wrote to memory of 4320 5088 1vjjd.exe pdddj.exe PID 5088 wrote to memory of 4320 5088 1vjjd.exe pdddj.exe PID 4320 wrote to memory of 3944 4320 pdddj.exe hhtthh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\frxrlfx.exec:\frxrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\nhbbht.exec:\nhbbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\pdvpd.exec:\pdvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\fxfffrl.exec:\fxfffrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\9tbttb.exec:\9tbttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rrflxfr.exec:\rrflxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\9thbbb.exec:\9thbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\jvvvv.exec:\jvvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\dvvjp.exec:\dvvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\3xlrrrx.exec:\3xlrrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\tntttn.exec:\tntttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\1ppvv.exec:\1ppvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\rrlrrxx.exec:\rrlrrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\ddjvd.exec:\ddjvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\9xxrllf.exec:\9xxrllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\tntnnh.exec:\tntnnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\vvjdp.exec:\vvjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\rflfxfx.exec:\rflfxfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\3htbbt.exec:\3htbbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\1vjjd.exec:\1vjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\pdddj.exec:\pdddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\hhtthh.exec:\hhtthh.exe23⤵
- Executes dropped EXE
PID:3944 -
\??\c:\ddjjj.exec:\ddjjj.exe24⤵
- Executes dropped EXE
PID:3164 -
\??\c:\jpvvp.exec:\jpvvp.exe25⤵
- Executes dropped EXE
PID:3484 -
\??\c:\btnhbt.exec:\btnhbt.exe26⤵
- Executes dropped EXE
PID:1620 -
\??\c:\thttnn.exec:\thttnn.exe27⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7vjvd.exec:\7vjvd.exe28⤵
- Executes dropped EXE
PID:1744 -
\??\c:\1lxrlrl.exec:\1lxrlrl.exe29⤵
- Executes dropped EXE
PID:3208 -
\??\c:\ttbbbb.exec:\ttbbbb.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vjppp.exec:\vjppp.exe31⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nnhhbh.exec:\nnhhbh.exe32⤵
- Executes dropped EXE
PID:224 -
\??\c:\pdjjj.exec:\pdjjj.exe33⤵
- Executes dropped EXE
PID:5092 -
\??\c:\rrflfll.exec:\rrflfll.exe34⤵
- Executes dropped EXE
PID:440 -
\??\c:\httnbn.exec:\httnbn.exe35⤵
- Executes dropped EXE
PID:4960 -
\??\c:\ppvvv.exec:\ppvvv.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\llrrlrl.exec:\llrrlrl.exe37⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nnbbbh.exec:\nnbbbh.exe38⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jdddv.exec:\jdddv.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pdjdv.exec:\pdjdv.exe40⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xxlfllx.exec:\xxlfllx.exe41⤵
- Executes dropped EXE
PID:836 -
\??\c:\nbhbhh.exec:\nbhbhh.exe42⤵
- Executes dropped EXE
PID:4028 -
\??\c:\pjjpj.exec:\pjjpj.exe43⤵
- Executes dropped EXE
PID:4404 -
\??\c:\jjppv.exec:\jjppv.exe44⤵
- Executes dropped EXE
PID:3884 -
\??\c:\nhnnhn.exec:\nhnnhn.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\djppj.exec:\djppj.exe46⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvdvp.exec:\dvdvp.exe47⤵
- Executes dropped EXE
PID:4996 -
\??\c:\ffxrrlf.exec:\ffxrrlf.exe48⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hnnbtn.exec:\hnnbtn.exe49⤵
- Executes dropped EXE
PID:1096 -
\??\c:\vjjdd.exec:\vjjdd.exe50⤵
- Executes dropped EXE
PID:232 -
\??\c:\llllrrf.exec:\llllrrf.exe51⤵
- Executes dropped EXE
PID:1672 -
\??\c:\9tntnb.exec:\9tntnb.exe52⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jdpjp.exec:\jdpjp.exe53⤵
- Executes dropped EXE
PID:4908 -
\??\c:\rfffxff.exec:\rfffxff.exe54⤵
- Executes dropped EXE
PID:4496 -
\??\c:\tnhbtb.exec:\tnhbtb.exe55⤵
- Executes dropped EXE
PID:4460 -
\??\c:\jvvvj.exec:\jvvvj.exe56⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe57⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hnthbb.exec:\hnthbb.exe58⤵
- Executes dropped EXE
PID:388 -
\??\c:\jpdvv.exec:\jpdvv.exe59⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1dppp.exec:\1dppp.exe60⤵
- Executes dropped EXE
PID:3688 -
\??\c:\1djjj.exec:\1djjj.exe61⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lflxlxx.exec:\lflxlxx.exe62⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9hnntb.exec:\9hnntb.exe63⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vvvvp.exec:\vvvvp.exe64⤵
- Executes dropped EXE
PID:3676 -
\??\c:\jpdvp.exec:\jpdvp.exe65⤵
- Executes dropped EXE
PID:5040 -
\??\c:\fxffxxx.exec:\fxffxxx.exe66⤵PID:440
-
\??\c:\bbhthh.exec:\bbhthh.exe67⤵PID:3204
-
\??\c:\jvjdv.exec:\jvjdv.exe68⤵PID:3596
-
\??\c:\pvvvv.exec:\pvvvv.exe69⤵PID:2352
-
\??\c:\rlffxlf.exec:\rlffxlf.exe70⤵PID:1788
-
\??\c:\nhhnth.exec:\nhhnth.exe71⤵PID:2688
-
\??\c:\ddjdd.exec:\ddjdd.exe72⤵PID:2024
-
\??\c:\ppvvv.exec:\ppvvv.exe73⤵PID:3336
-
\??\c:\xxxflrx.exec:\xxxflrx.exe74⤵PID:1860
-
\??\c:\hbhbbt.exec:\hbhbbt.exe75⤵PID:4904
-
\??\c:\pvppp.exec:\pvppp.exe76⤵PID:2204
-
\??\c:\fxlllll.exec:\fxlllll.exe77⤵PID:1276
-
\??\c:\5tbbhh.exec:\5tbbhh.exe78⤵PID:2660
-
\??\c:\3httnn.exec:\3httnn.exe79⤵PID:3860
-
\??\c:\jddpp.exec:\jddpp.exe80⤵PID:3980
-
\??\c:\rfrlfll.exec:\rfrlfll.exe81⤵PID:2020
-
\??\c:\nbnhbb.exec:\nbnhbb.exe82⤵PID:1944
-
\??\c:\vddvp.exec:\vddvp.exe83⤵PID:4596
-
\??\c:\jvddv.exec:\jvddv.exe84⤵PID:448
-
\??\c:\fxllrrx.exec:\fxllrrx.exe85⤵PID:1616
-
\??\c:\jdjdv.exec:\jdjdv.exe86⤵PID:2008
-
\??\c:\dvvvj.exec:\dvvvj.exe87⤵PID:2324
-
\??\c:\xlxflfl.exec:\xlxflfl.exe88⤵PID:4600
-
\??\c:\ttthhn.exec:\ttthhn.exe89⤵PID:1436
-
\??\c:\3pppj.exec:\3pppj.exe90⤵PID:4468
-
\??\c:\5jvpj.exec:\5jvpj.exe91⤵PID:4320
-
\??\c:\lxfxxfl.exec:\lxfxxfl.exe92⤵PID:4360
-
\??\c:\htnhbb.exec:\htnhbb.exe93⤵PID:2796
-
\??\c:\1jppd.exec:\1jppd.exe94⤵PID:4820
-
\??\c:\flxrlrx.exec:\flxrlrx.exe95⤵PID:3284
-
\??\c:\xxrrfrl.exec:\xxrrfrl.exe96⤵PID:2080
-
\??\c:\hnhbnn.exec:\hnhbnn.exe97⤵PID:3060
-
\??\c:\dpvpj.exec:\dpvpj.exe98⤵PID:1744
-
\??\c:\fffxrff.exec:\fffxrff.exe99⤵PID:5048
-
\??\c:\lfffxxr.exec:\lfffxxr.exe100⤵PID:3504
-
\??\c:\bbntbt.exec:\bbntbt.exe101⤵PID:4540
-
\??\c:\pvddv.exec:\pvddv.exe102⤵PID:2164
-
\??\c:\lllfxxr.exec:\lllfxxr.exe103⤵PID:3240
-
\??\c:\bnbnbn.exec:\bnbnbn.exe104⤵PID:1216
-
\??\c:\vpvpp.exec:\vpvpp.exe105⤵PID:2984
-
\??\c:\pdppj.exec:\pdppj.exe106⤵PID:512
-
\??\c:\fxlrlll.exec:\fxlrlll.exe107⤵PID:2452
-
\??\c:\hbhbbt.exec:\hbhbbt.exe108⤵PID:3712
-
\??\c:\5jdpp.exec:\5jdpp.exe109⤵PID:1916
-
\??\c:\rflllxr.exec:\rflllxr.exe110⤵PID:3376
-
\??\c:\rflffff.exec:\rflffff.exe111⤵PID:3516
-
\??\c:\pdpjj.exec:\pdpjj.exe112⤵PID:4800
-
\??\c:\vvvpj.exec:\vvvpj.exe113⤵PID:1692
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe114⤵PID:4848
-
\??\c:\hhnhnb.exec:\hhnhnb.exe115⤵PID:2900
-
\??\c:\jvvjd.exec:\jvvjd.exe116⤵PID:2248
-
\??\c:\xllfxxr.exec:\xllfxxr.exe117⤵PID:2328
-
\??\c:\ttbtnn.exec:\ttbtnn.exe118⤵PID:2220
-
\??\c:\htbnbh.exec:\htbnbh.exe119⤵PID:3732
-
\??\c:\ddjjj.exec:\ddjjj.exe120⤵PID:1296
-
\??\c:\llllrff.exec:\llllrff.exe121⤵PID:3824
-
\??\c:\hhntnt.exec:\hhntnt.exe122⤵PID:536
-
\??\c:\vvjvj.exec:\vvjvj.exe123⤵PID:920
-
\??\c:\rfxlxxl.exec:\rfxlxxl.exe124⤵PID:1980
-
\??\c:\bhttnt.exec:\bhttnt.exe125⤵PID:1684
-
\??\c:\vjvpp.exec:\vjvpp.exe126⤵PID:1672
-
\??\c:\vvdvp.exec:\vvdvp.exe127⤵PID:2008
-
\??\c:\bhbbhh.exec:\bhbbhh.exe128⤵PID:2820
-
\??\c:\ttbtnn.exec:\ttbtnn.exe129⤵PID:4600
-
\??\c:\3dvpj.exec:\3dvpj.exe130⤵PID:3460
-
\??\c:\frlfxrr.exec:\frlfxrr.exe131⤵PID:5112
-
\??\c:\7bttnh.exec:\7bttnh.exe132⤵PID:4320
-
\??\c:\5jpjd.exec:\5jpjd.exe133⤵PID:1164
-
\??\c:\vvvvp.exec:\vvvvp.exe134⤵PID:4856
-
\??\c:\rlffxxx.exec:\rlffxxx.exe135⤵PID:2972
-
\??\c:\bbnnnt.exec:\bbnnnt.exe136⤵PID:4664
-
\??\c:\dvjdj.exec:\dvjdj.exe137⤵PID:3536
-
\??\c:\flrrrrf.exec:\flrrrrf.exe138⤵PID:3060
-
\??\c:\tnbbtt.exec:\tnbbtt.exe139⤵PID:1744
-
\??\c:\ddvvp.exec:\ddvvp.exe140⤵PID:2808
-
\??\c:\fllrrrf.exec:\fllrrrf.exe141⤵PID:5060
-
\??\c:\nhnbhn.exec:\nhnbhn.exe142⤵PID:4792
-
\??\c:\pvjvd.exec:\pvjvd.exe143⤵PID:2164
-
\??\c:\ffrrlxr.exec:\ffrrlxr.exe144⤵PID:3240
-
\??\c:\9tbbtn.exec:\9tbbtn.exe145⤵PID:1216
-
\??\c:\9pvpj.exec:\9pvpj.exe146⤵PID:4864
-
\??\c:\lrrfxxx.exec:\lrrfxxx.exe147⤵PID:2352
-
\??\c:\llfrlfr.exec:\llfrlfr.exe148⤵PID:2212
-
\??\c:\9bhbnh.exec:\9bhbnh.exe149⤵PID:3376
-
\??\c:\pjdjj.exec:\pjdjj.exe150⤵PID:4852
-
\??\c:\fxrfxlf.exec:\fxrfxlf.exe151⤵PID:3368
-
\??\c:\5nthbt.exec:\5nthbt.exe152⤵PID:4344
-
\??\c:\nhhtnn.exec:\nhhtnn.exe153⤵PID:4848
-
\??\c:\jvjdv.exec:\jvjdv.exe154⤵PID:2900
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe155⤵PID:2248
-
\??\c:\lllfrrf.exec:\lllfrrf.exe156⤵PID:2524
-
\??\c:\bnthbt.exec:\bnthbt.exe157⤵PID:3748
-
\??\c:\jjvpv.exec:\jjvpv.exe158⤵PID:4604
-
\??\c:\rrfxrll.exec:\rrfxrll.exe159⤵PID:2480
-
\??\c:\frllfff.exec:\frllfff.exe160⤵PID:4788
-
\??\c:\hbbbbb.exec:\hbbbbb.exe161⤵PID:4988
-
\??\c:\jdjvp.exec:\jdjvp.exe162⤵PID:4916
-
\??\c:\frxrxxr.exec:\frxrxxr.exe163⤵PID:3448
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe164⤵PID:1892
-
\??\c:\bnbnhb.exec:\bnbnhb.exe165⤵PID:3908
-
\??\c:\7vvpd.exec:\7vvpd.exe166⤵PID:2324
-
\??\c:\rrrlxrr.exec:\rrrlxrr.exe167⤵PID:4460
-
\??\c:\9llfxlf.exec:\9llfxlf.exe168⤵PID:1028
-
\??\c:\btbtnh.exec:\btbtnh.exe169⤵PID:3612
-
\??\c:\7dvvp.exec:\7dvvp.exe170⤵PID:2084
-
\??\c:\frfxlff.exec:\frfxlff.exe171⤵PID:4452
-
\??\c:\btnhhh.exec:\btnhhh.exe172⤵PID:3664
-
\??\c:\bhnnhh.exec:\bhnnhh.exe173⤵PID:4856
-
\??\c:\jpdvp.exec:\jpdvp.exe174⤵PID:2972
-
\??\c:\rffxxlx.exec:\rffxxlx.exe175⤵PID:1640
-
\??\c:\tnnhtt.exec:\tnnhtt.exe176⤵PID:4064
-
\??\c:\dvvpj.exec:\dvvpj.exe177⤵PID:3156
-
\??\c:\vpjdv.exec:\vpjdv.exe178⤵PID:3504
-
\??\c:\frfxrlf.exec:\frfxrlf.exe179⤵PID:3676
-
\??\c:\hhbnnh.exec:\hhbnnh.exe180⤵PID:5040
-
\??\c:\vjjjv.exec:\vjjjv.exe181⤵PID:2584
-
\??\c:\flflxll.exec:\flflxll.exe182⤵PID:2984
-
\??\c:\hbhhnh.exec:\hbhhnh.exe183⤵PID:1612
-
\??\c:\bbbnhh.exec:\bbbnhh.exe184⤵PID:4752
-
\??\c:\1vvvp.exec:\1vvvp.exe185⤵PID:4024
-
\??\c:\3rxrrxr.exec:\3rxrrxr.exe186⤵PID:4288
-
\??\c:\tbthbn.exec:\tbthbn.exe187⤵PID:2024
-
\??\c:\dppjd.exec:\dppjd.exe188⤵PID:4852
-
\??\c:\fxlxlxf.exec:\fxlxlxf.exe189⤵PID:1692
-
\??\c:\htbtnb.exec:\htbtnb.exe190⤵PID:4344
-
\??\c:\vdddp.exec:\vdddp.exe191⤵PID:4872
-
\??\c:\lxlflll.exec:\lxlflll.exe192⤵PID:1476
-
\??\c:\lllfrll.exec:\lllfrll.exe193⤵PID:2220
-
\??\c:\3bbthb.exec:\3bbthb.exe194⤵PID:756
-
\??\c:\pjpjp.exec:\pjpjp.exe195⤵PID:3748
-
\??\c:\llflxfx.exec:\llflxfx.exe196⤵PID:4604
-
\??\c:\rfrrxfx.exec:\rfrrxfx.exe197⤵PID:2480
-
\??\c:\hnnbtn.exec:\hnnbtn.exe198⤵PID:920
-
\??\c:\ddjjd.exec:\ddjjd.exe199⤵PID:1980
-
\??\c:\3lrrllx.exec:\3lrrllx.exe200⤵PID:1684
-
\??\c:\3llllll.exec:\3llllll.exe201⤵PID:4804
-
\??\c:\bntttt.exec:\bntttt.exe202⤵PID:2936
-
\??\c:\pvddp.exec:\pvddp.exe203⤵PID:964
-
\??\c:\rxrxxxx.exec:\rxrxxxx.exe204⤵PID:764
-
\??\c:\3lrxffr.exec:\3lrxffr.exe205⤵PID:4464
-
\??\c:\nhhbtt.exec:\nhhbtt.exe206⤵PID:1028
-
\??\c:\jdjpv.exec:\jdjpv.exe207⤵PID:3612
-
\??\c:\fllffrl.exec:\fllffrl.exe208⤵PID:1164
-
\??\c:\7htnbn.exec:\7htnbn.exe209⤵PID:4452
-
\??\c:\jpdjj.exec:\jpdjj.exe210⤵PID:436
-
\??\c:\rlxfxrr.exec:\rlxfxrr.exe211⤵PID:4856
-
\??\c:\lrrrlll.exec:\lrrrlll.exe212⤵PID:2972
-
\??\c:\bbbnnb.exec:\bbbnnb.exe213⤵PID:3920
-
\??\c:\7jppj.exec:\7jppj.exe214⤵PID:5048
-
\??\c:\lllrrxx.exec:\lllrrxx.exe215⤵PID:3220
-
\??\c:\tbbbbn.exec:\tbbbbn.exe216⤵PID:3992
-
\??\c:\vpdpj.exec:\vpdpj.exe217⤵PID:832
-
\??\c:\jjddp.exec:\jjddp.exe218⤵PID:4764
-
\??\c:\flffrrl.exec:\flffrrl.exe219⤵PID:4628
-
\??\c:\bnbbhn.exec:\bnbbhn.exe220⤵PID:4652
-
\??\c:\ppdpj.exec:\ppdpj.exe221⤵PID:2696
-
\??\c:\rrlfffx.exec:\rrlfffx.exe222⤵PID:4900
-
\??\c:\hhtnhh.exec:\hhtnhh.exe223⤵PID:4936
-
\??\c:\jvjdv.exec:\jvjdv.exe224⤵PID:2388
-
\??\c:\vpvpj.exec:\vpvpj.exe225⤵PID:836
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe226⤵PID:1464
-
\??\c:\bbhbtt.exec:\bbhbtt.exe227⤵PID:624
-
\??\c:\ppddp.exec:\ppddp.exe228⤵PID:5096
-
\??\c:\flrrfxr.exec:\flrrfxr.exe229⤵PID:3368
-
\??\c:\flllxrl.exec:\flllxrl.exe230⤵PID:4648
-
\??\c:\htnnbh.exec:\htnnbh.exe231⤵PID:1588
-
\??\c:\vjppp.exec:\vjppp.exe232⤵PID:4344
-
\??\c:\3rfxrrf.exec:\3rfxrrf.exe233⤵PID:2248
-
\??\c:\nnthnb.exec:\nnthnb.exe234⤵PID:1476
-
\??\c:\bntnhh.exec:\bntnhh.exe235⤵PID:2220
-
\??\c:\3pdjv.exec:\3pdjv.exe236⤵PID:756
-
\??\c:\llrxxrx.exec:\llrxxrx.exe237⤵PID:3748
-
\??\c:\rffxrlf.exec:\rffxrlf.exe238⤵PID:4604
-
\??\c:\tbhntn.exec:\tbhntn.exe239⤵PID:2480
-
\??\c:\jdjjp.exec:\jdjjp.exe240⤵PID:2780
-
\??\c:\3rrlfff.exec:\3rrlfff.exe241⤵PID:4932
-
\??\c:\bbthbn.exec:\bbthbn.exe242⤵PID:1684