Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 05:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe
-
Size
459KB
-
MD5
82b5b28bf10b2ab7ae51ccd0092a2450
-
SHA1
9f61740d4f5283742cf89d05e8417458d1f018e3
-
SHA256
65b81e8cef99e610763010f25351ff6503e786dc43047a23fe32cdbd2d1a6ff1
-
SHA512
4b803662c0b5e4eee384a7c3fa5645f477431f26076cb988ffe8bcc560df0b613afe4e71328c3c7b5c7852ecc5df95eccf54d1cb65297284f4f11e5d6c564fa2
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1Hmp:d7Tc9Wj16A3Stvxc
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1224-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-355-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-364-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-424-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-431-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-447-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-463-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-464-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-526-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-559-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-576-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-632-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-667-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-745-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-768-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-1100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-1252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-1262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jvpjd.exe1xrlxrl.exeppdvp.exe7llfrrl.exevvppp.exelxxrfxr.exehnbnhb.exerxllrxl.exehthtnh.exenbnbtn.exejvpdj.exennbbtn.exepvddv.exellfxlfr.exehttnhb.exeddddj.exetnnbth.exetbbtnn.exedjppv.exexlrfrlf.exebbhnhb.exepjvvd.exe7bbthh.exe7lfxrrf.exetbhbtt.exejjdvv.exefxlrlrl.exelrrxxlf.exetbnttt.exefxxrlll.exehhhbtt.exevdpjd.exe3lrlxfx.exethbtnn.exexfflfxf.exethtbbn.exevjpvv.exexxfxfxf.exerrrlfff.exe5tbtnn.exeppjdv.exerrxxrfx.exennthtn.exedjpjd.exerlflxrf.exethnbbt.exe1jddv.exerxxrllf.exe3ttnhh.exe9pjvp.exe3llxllf.exehnttnh.exedvdvv.exepdjdd.exerrrlffr.exenthhnt.exepvdpj.exeffrlffl.exe5rlrfrf.exebnbbtn.exe3vpjj.exe1rlfrlf.exenbbbtt.exepjddp.exepid process 4824 jvpjd.exe 4068 1xrlxrl.exe 3796 ppdvp.exe 2912 7llfrrl.exe 2916 vvppp.exe 372 lxxrfxr.exe 4900 hnbnhb.exe 3584 rxllrxl.exe 4008 hthtnh.exe 1688 nbnbtn.exe 3296 jvpdj.exe 1268 nnbbtn.exe 2976 pvddv.exe 1060 llfxlfr.exe 1544 httnhb.exe 2584 ddddj.exe 216 tnnbth.exe 1872 tbbtnn.exe 3380 djppv.exe 3152 xlrfrlf.exe 1564 bbhnhb.exe 5064 pjvvd.exe 5100 7bbthh.exe 1280 7lfxrrf.exe 4268 tbhbtt.exe 4896 jjdvv.exe 3716 fxlrlrl.exe 3312 lrrxxlf.exe 3228 tbnttt.exe 1044 fxxrlll.exe 5056 hhhbtt.exe 2480 vdpjd.exe 4408 3lrlxfx.exe 1216 thbtnn.exe 3216 xfflfxf.exe 4812 thtbbn.exe 1296 vjpvv.exe 4664 xxfxfxf.exe 2460 rrrlfff.exe 4452 5tbtnn.exe 2356 ppjdv.exe 2828 rrxxrfx.exe 2208 nnthtn.exe 1552 djpjd.exe 4340 rlflxrf.exe 2556 thnbbt.exe 2852 1jddv.exe 2732 rxxrllf.exe 1476 3ttnhh.exe 2776 9pjvp.exe 1268 3llxllf.exe 3472 hnttnh.exe 1460 dvdvv.exe 2512 pdjdd.exe 1672 rrrlffr.exe 3544 nthhnt.exe 3780 pvdpj.exe 3420 ffrlffl.exe 4612 5rlrfrf.exe 2040 bnbbtn.exe 744 3vpjj.exe 3540 1rlfrlf.exe 5036 nbbbtt.exe 984 pjddp.exe -
Processes:
resource yara_rule behavioral2/memory/1224-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-359-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-414-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-424-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exejvpjd.exe1xrlxrl.exeppdvp.exe7llfrrl.exevvppp.exelxxrfxr.exehnbnhb.exerxllrxl.exehthtnh.exenbnbtn.exejvpdj.exennbbtn.exepvddv.exellfxlfr.exehttnhb.exeddddj.exetnnbth.exetbbtnn.exedjppv.exexlrfrlf.exebbhnhb.exedescription pid process target process PID 1224 wrote to memory of 4824 1224 82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe jvpjd.exe PID 1224 wrote to memory of 4824 1224 82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe jvpjd.exe PID 1224 wrote to memory of 4824 1224 82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe jvpjd.exe PID 4824 wrote to memory of 4068 4824 jvpjd.exe 1xrlxrl.exe PID 4824 wrote to memory of 4068 4824 jvpjd.exe 1xrlxrl.exe PID 4824 wrote to memory of 4068 4824 jvpjd.exe 1xrlxrl.exe PID 4068 wrote to memory of 3796 4068 1xrlxrl.exe ppdvp.exe PID 4068 wrote to memory of 3796 4068 1xrlxrl.exe ppdvp.exe PID 4068 wrote to memory of 3796 4068 1xrlxrl.exe ppdvp.exe PID 3796 wrote to memory of 2912 3796 ppdvp.exe 7llfrrl.exe PID 3796 wrote to memory of 2912 3796 ppdvp.exe 7llfrrl.exe PID 3796 wrote to memory of 2912 3796 ppdvp.exe 7llfrrl.exe PID 2912 wrote to memory of 2916 2912 7llfrrl.exe vvppp.exe PID 2912 wrote to memory of 2916 2912 7llfrrl.exe vvppp.exe PID 2912 wrote to memory of 2916 2912 7llfrrl.exe vvppp.exe PID 2916 wrote to memory of 372 2916 vvppp.exe lxxrfxr.exe PID 2916 wrote to memory of 372 2916 vvppp.exe lxxrfxr.exe PID 2916 wrote to memory of 372 2916 vvppp.exe lxxrfxr.exe PID 372 wrote to memory of 4900 372 lxxrfxr.exe hnbnhb.exe PID 372 wrote to memory of 4900 372 lxxrfxr.exe hnbnhb.exe PID 372 wrote to memory of 4900 372 lxxrfxr.exe hnbnhb.exe PID 4900 wrote to memory of 3584 4900 hnbnhb.exe rxllrxl.exe PID 4900 wrote to memory of 3584 4900 hnbnhb.exe rxllrxl.exe PID 4900 wrote to memory of 3584 4900 hnbnhb.exe rxllrxl.exe PID 3584 wrote to memory of 4008 3584 rxllrxl.exe hthtnh.exe PID 3584 wrote to memory of 4008 3584 rxllrxl.exe hthtnh.exe PID 3584 wrote to memory of 4008 3584 rxllrxl.exe hthtnh.exe PID 4008 wrote to memory of 1688 4008 hthtnh.exe nbnbtn.exe PID 4008 wrote to memory of 1688 4008 hthtnh.exe nbnbtn.exe PID 4008 wrote to memory of 1688 4008 hthtnh.exe nbnbtn.exe PID 1688 wrote to memory of 3296 1688 nbnbtn.exe jvpdj.exe PID 1688 wrote to memory of 3296 1688 nbnbtn.exe jvpdj.exe PID 1688 wrote to memory of 3296 1688 nbnbtn.exe jvpdj.exe PID 3296 wrote to memory of 1268 3296 jvpdj.exe nnbbtn.exe PID 3296 wrote to memory of 1268 3296 jvpdj.exe nnbbtn.exe PID 3296 wrote to memory of 1268 3296 jvpdj.exe nnbbtn.exe PID 1268 wrote to memory of 2976 1268 nnbbtn.exe pvddv.exe PID 1268 wrote to memory of 2976 1268 nnbbtn.exe pvddv.exe PID 1268 wrote to memory of 2976 1268 nnbbtn.exe pvddv.exe PID 2976 wrote to memory of 1060 2976 pvddv.exe llfxlfr.exe PID 2976 wrote to memory of 1060 2976 pvddv.exe llfxlfr.exe PID 2976 wrote to memory of 1060 2976 pvddv.exe llfxlfr.exe PID 1060 wrote to memory of 1544 1060 llfxlfr.exe httnhb.exe PID 1060 wrote to memory of 1544 1060 llfxlfr.exe httnhb.exe PID 1060 wrote to memory of 1544 1060 llfxlfr.exe httnhb.exe PID 1544 wrote to memory of 2584 1544 httnhb.exe ddddj.exe PID 1544 wrote to memory of 2584 1544 httnhb.exe ddddj.exe PID 1544 wrote to memory of 2584 1544 httnhb.exe ddddj.exe PID 2584 wrote to memory of 216 2584 ddddj.exe tnnbth.exe PID 2584 wrote to memory of 216 2584 ddddj.exe tnnbth.exe PID 2584 wrote to memory of 216 2584 ddddj.exe tnnbth.exe PID 216 wrote to memory of 1872 216 tnnbth.exe tbbtnn.exe PID 216 wrote to memory of 1872 216 tnnbth.exe tbbtnn.exe PID 216 wrote to memory of 1872 216 tnnbth.exe tbbtnn.exe PID 1872 wrote to memory of 3380 1872 tbbtnn.exe djppv.exe PID 1872 wrote to memory of 3380 1872 tbbtnn.exe djppv.exe PID 1872 wrote to memory of 3380 1872 tbbtnn.exe djppv.exe PID 3380 wrote to memory of 3152 3380 djppv.exe xlrfrlf.exe PID 3380 wrote to memory of 3152 3380 djppv.exe xlrfrlf.exe PID 3380 wrote to memory of 3152 3380 djppv.exe xlrfrlf.exe PID 3152 wrote to memory of 1564 3152 xlrfrlf.exe bbhnhb.exe PID 3152 wrote to memory of 1564 3152 xlrfrlf.exe bbhnhb.exe PID 3152 wrote to memory of 1564 3152 xlrfrlf.exe bbhnhb.exe PID 1564 wrote to memory of 5064 1564 bbhnhb.exe pjvvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\82b5b28bf10b2ab7ae51ccd0092a2450_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\jvpjd.exec:\jvpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\1xrlxrl.exec:\1xrlxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\ppdvp.exec:\ppdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\7llfrrl.exec:\7llfrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\vvppp.exec:\vvppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\hnbnhb.exec:\hnbnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\rxllrxl.exec:\rxllrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\hthtnh.exec:\hthtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\nbnbtn.exec:\nbnbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\jvpdj.exec:\jvpdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\nnbbtn.exec:\nnbbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\pvddv.exec:\pvddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\llfxlfr.exec:\llfxlfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\httnhb.exec:\httnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\ddddj.exec:\ddddj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\tnnbth.exec:\tnnbth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\tbbtnn.exec:\tbbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\djppv.exec:\djppv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\xlrfrlf.exec:\xlrfrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\bbhnhb.exec:\bbhnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\pjvvd.exec:\pjvvd.exe23⤵
- Executes dropped EXE
PID:5064 -
\??\c:\7bbthh.exec:\7bbthh.exe24⤵
- Executes dropped EXE
PID:5100 -
\??\c:\7lfxrrf.exec:\7lfxrrf.exe25⤵
- Executes dropped EXE
PID:1280 -
\??\c:\tbhbtt.exec:\tbhbtt.exe26⤵
- Executes dropped EXE
PID:4268 -
\??\c:\jjdvv.exec:\jjdvv.exe27⤵
- Executes dropped EXE
PID:4896 -
\??\c:\fxlrlrl.exec:\fxlrlrl.exe28⤵
- Executes dropped EXE
PID:3716 -
\??\c:\lrrxxlf.exec:\lrrxxlf.exe29⤵
- Executes dropped EXE
PID:3312 -
\??\c:\tbnttt.exec:\tbnttt.exe30⤵
- Executes dropped EXE
PID:3228 -
\??\c:\fxxrlll.exec:\fxxrlll.exe31⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hhhbtt.exec:\hhhbtt.exe32⤵
- Executes dropped EXE
PID:5056 -
\??\c:\vdpjd.exec:\vdpjd.exe33⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3lrlxfx.exec:\3lrlxfx.exe34⤵
- Executes dropped EXE
PID:4408 -
\??\c:\thbtnn.exec:\thbtnn.exe35⤵
- Executes dropped EXE
PID:1216 -
\??\c:\xfflfxf.exec:\xfflfxf.exe36⤵
- Executes dropped EXE
PID:3216 -
\??\c:\thtbbn.exec:\thtbbn.exe37⤵
- Executes dropped EXE
PID:4812 -
\??\c:\vjpvv.exec:\vjpvv.exe38⤵
- Executes dropped EXE
PID:1296 -
\??\c:\xxfxfxf.exec:\xxfxfxf.exe39⤵
- Executes dropped EXE
PID:4664 -
\??\c:\rrrlfff.exec:\rrrlfff.exe40⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5tbtnn.exec:\5tbtnn.exe41⤵
- Executes dropped EXE
PID:4452 -
\??\c:\ppjdv.exec:\ppjdv.exe42⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rrxxrfx.exec:\rrxxrfx.exe43⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nnthtn.exec:\nnthtn.exe44⤵
- Executes dropped EXE
PID:2208 -
\??\c:\djpjd.exec:\djpjd.exe45⤵
- Executes dropped EXE
PID:1552 -
\??\c:\rlflxrf.exec:\rlflxrf.exe46⤵
- Executes dropped EXE
PID:4340 -
\??\c:\thnbbt.exec:\thnbbt.exe47⤵
- Executes dropped EXE
PID:2556 -
\??\c:\1jddv.exec:\1jddv.exe48⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rxxrllf.exec:\rxxrllf.exe49⤵
- Executes dropped EXE
PID:2732 -
\??\c:\3ttnhh.exec:\3ttnhh.exe50⤵
- Executes dropped EXE
PID:1476 -
\??\c:\9pjvp.exec:\9pjvp.exe51⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3llxllf.exec:\3llxllf.exe52⤵
- Executes dropped EXE
PID:1268 -
\??\c:\hnttnh.exec:\hnttnh.exe53⤵
- Executes dropped EXE
PID:3472 -
\??\c:\dvdvv.exec:\dvdvv.exe54⤵
- Executes dropped EXE
PID:1460 -
\??\c:\pdjdd.exec:\pdjdd.exe55⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rrrlffr.exec:\rrrlffr.exe56⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nthhnt.exec:\nthhnt.exe57⤵
- Executes dropped EXE
PID:3544 -
\??\c:\pvdpj.exec:\pvdpj.exe58⤵
- Executes dropped EXE
PID:3780 -
\??\c:\ffrlffl.exec:\ffrlffl.exe59⤵
- Executes dropped EXE
PID:3420 -
\??\c:\5rlrfrf.exec:\5rlrfrf.exe60⤵
- Executes dropped EXE
PID:4612 -
\??\c:\bnbbtn.exec:\bnbbtn.exe61⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3vpjj.exec:\3vpjj.exe62⤵
- Executes dropped EXE
PID:744 -
\??\c:\1rlfrlf.exec:\1rlfrlf.exe63⤵
- Executes dropped EXE
PID:3540 -
\??\c:\nbbbtt.exec:\nbbbtt.exe64⤵
- Executes dropped EXE
PID:5036 -
\??\c:\pjddp.exec:\pjddp.exe65⤵
- Executes dropped EXE
PID:984 -
\??\c:\xrffffx.exec:\xrffffx.exe66⤵PID:3128
-
\??\c:\nnhhbb.exec:\nnhhbb.exe67⤵PID:3060
-
\??\c:\vpjdp.exec:\vpjdp.exe68⤵PID:436
-
\??\c:\llffllf.exec:\llffllf.exe69⤵PID:4460
-
\??\c:\nttnbb.exec:\nttnbb.exe70⤵PID:3712
-
\??\c:\9tthtt.exec:\9tthtt.exe71⤵PID:4700
-
\??\c:\7jjjv.exec:\7jjjv.exe72⤵PID:1424
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe73⤵PID:3636
-
\??\c:\bhnbnh.exec:\bhnbnh.exe74⤵PID:3312
-
\??\c:\jpjjv.exec:\jpjjv.exe75⤵PID:3056
-
\??\c:\7vdvj.exec:\7vdvj.exe76⤵PID:668
-
\??\c:\7xxrrrl.exec:\7xxrrrl.exe77⤵PID:1004
-
\??\c:\thnhbt.exec:\thnhbt.exe78⤵PID:992
-
\??\c:\btbttn.exec:\btbttn.exe79⤵PID:4400
-
\??\c:\xxxxrfx.exec:\xxxxrfx.exe80⤵PID:2060
-
\??\c:\hnbthn.exec:\hnbthn.exe81⤵PID:1224
-
\??\c:\9pvjd.exec:\9pvjd.exe82⤵PID:4016
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe83⤵PID:4068
-
\??\c:\bhhbtb.exec:\bhhbtb.exe84⤵PID:2376
-
\??\c:\1jjdd.exec:\1jjdd.exe85⤵PID:4288
-
\??\c:\vvdpj.exec:\vvdpj.exe86⤵PID:2916
-
\??\c:\bbhbbt.exec:\bbhbbt.exe87⤵PID:3480
-
\??\c:\jvjdd.exec:\jvjdd.exe88⤵PID:2192
-
\??\c:\lrrlfrl.exec:\lrrlfrl.exe89⤵PID:4012
-
\??\c:\rflrxrl.exec:\rflrxrl.exe90⤵PID:4584
-
\??\c:\htnbbn.exec:\htnbbn.exe91⤵PID:3584
-
\??\c:\jvdvv.exec:\jvdvv.exe92⤵PID:4008
-
\??\c:\3lfrlfr.exec:\3lfrlfr.exe93⤵PID:4884
-
\??\c:\bnthbt.exec:\bnthbt.exe94⤵PID:3856
-
\??\c:\jdddv.exec:\jdddv.exe95⤵PID:1440
-
\??\c:\dddpj.exec:\dddpj.exe96⤵PID:4748
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe97⤵PID:3260
-
\??\c:\bbhbnn.exec:\bbhbnn.exe98⤵PID:2888
-
\??\c:\tthbhh.exec:\tthbhh.exe99⤵PID:1176
-
\??\c:\pppvv.exec:\pppvv.exe100⤵PID:4144
-
\??\c:\9xrrrrr.exec:\9xrrrrr.exe101⤵PID:4720
-
\??\c:\frfxrlr.exec:\frfxrlr.exe102⤵PID:5048
-
\??\c:\hbbbbt.exec:\hbbbbt.exe103⤵PID:3776
-
\??\c:\vjjdv.exec:\vjjdv.exe104⤵PID:764
-
\??\c:\jddjj.exec:\jddjj.exe105⤵PID:916
-
\??\c:\lfxrxrf.exec:\lfxrxrf.exe106⤵PID:3092
-
\??\c:\hhbnhb.exec:\hhbnhb.exe107⤵PID:4792
-
\??\c:\jpvpj.exec:\jpvpj.exe108⤵PID:4864
-
\??\c:\dvdvp.exec:\dvdvp.exe109⤵PID:5036
-
\??\c:\lllfxxr.exec:\lllfxxr.exe110⤵PID:5064
-
\??\c:\5hnhnh.exec:\5hnhnh.exe111⤵PID:3352
-
\??\c:\nbnntn.exec:\nbnntn.exe112⤵PID:2404
-
\??\c:\pjjdp.exec:\pjjdp.exe113⤵PID:5024
-
\??\c:\ffxrlff.exec:\ffxrlff.exe114⤵PID:1424
-
\??\c:\btbtbt.exec:\btbtbt.exe115⤵PID:2500
-
\??\c:\dvpjd.exec:\dvpjd.exe116⤵PID:3312
-
\??\c:\vvjdd.exec:\vvjdd.exe117⤵PID:3228
-
\??\c:\rfflfrl.exec:\rfflfrl.exe118⤵PID:4876
-
\??\c:\hbnntt.exec:\hbnntt.exe119⤵PID:4592
-
\??\c:\thtbtn.exec:\thtbtn.exe120⤵PID:3408
-
\??\c:\jvdvp.exec:\jvdvp.exe121⤵PID:1396
-
\??\c:\llllrrl.exec:\llllrrl.exe122⤵PID:2060
-
\??\c:\bttthh.exec:\bttthh.exe123⤵PID:1224
-
\??\c:\jjdvp.exec:\jjdvp.exe124⤵PID:4660
-
\??\c:\3ppjj.exec:\3ppjj.exe125⤵PID:3732
-
\??\c:\rlfrflr.exec:\rlfrflr.exe126⤵PID:4912
-
\??\c:\bbbbtt.exec:\bbbbtt.exe127⤵PID:3592
-
\??\c:\5jppv.exec:\5jppv.exe128⤵PID:2916
-
\??\c:\ffrrlrr.exec:\ffrrlrr.exe129⤵PID:2580
-
\??\c:\htttnn.exec:\htttnn.exe130⤵PID:640
-
\??\c:\nnnnhh.exec:\nnnnhh.exe131⤵PID:4188
-
\??\c:\jvdvp.exec:\jvdvp.exe132⤵PID:3212
-
\??\c:\lllffxx.exec:\lllffxx.exe133⤵PID:1552
-
\??\c:\hnnnnn.exec:\hnnnnn.exe134⤵PID:4028
-
\??\c:\nhhhhh.exec:\nhhhhh.exe135⤵PID:3456
-
\??\c:\jpjpp.exec:\jpjpp.exe136⤵PID:100
-
\??\c:\3rlfrrl.exec:\3rlfrrl.exe137⤵PID:1440
-
\??\c:\nhhthh.exec:\nhhthh.exe138⤵PID:4748
-
\??\c:\dvjdv.exec:\dvjdv.exe139⤵PID:3260
-
\??\c:\rlffxxr.exec:\rlffxxr.exe140⤵PID:2888
-
\??\c:\tbbttt.exec:\tbbttt.exe141⤵PID:1176
-
\??\c:\jjdvv.exec:\jjdvv.exe142⤵PID:4144
-
\??\c:\pjppp.exec:\pjppp.exe143⤵PID:4720
-
\??\c:\bnhtbb.exec:\bnhtbb.exe144⤵PID:1708
-
\??\c:\nbnhbt.exec:\nbnhbt.exe145⤵PID:3588
-
\??\c:\jpvpj.exec:\jpvpj.exe146⤵PID:3780
-
\??\c:\vvdpp.exec:\vvdpp.exe147⤵PID:212
-
\??\c:\nbbbbh.exec:\nbbbbh.exe148⤵PID:2560
-
\??\c:\ppjdd.exec:\ppjdd.exe149⤵PID:2716
-
\??\c:\dpddd.exec:\dpddd.exe150⤵PID:2348
-
\??\c:\xxlflll.exec:\xxlflll.exe151⤵PID:3128
-
\??\c:\bhhhhh.exec:\bhhhhh.exe152⤵PID:3680
-
\??\c:\nhtttt.exec:\nhtttt.exe153⤵PID:3784
-
\??\c:\ppvjd.exec:\ppvjd.exe154⤵PID:3256
-
\??\c:\rxfxllf.exec:\rxfxllf.exe155⤵PID:2820
-
\??\c:\3fxxxff.exec:\3fxxxff.exe156⤵PID:3056
-
\??\c:\7ntnht.exec:\7ntnht.exe157⤵PID:3364
-
\??\c:\djddv.exec:\djddv.exe158⤵PID:3952
-
\??\c:\fxfrlrr.exec:\fxfrlrr.exe159⤵PID:3864
-
\??\c:\lllfxxr.exec:\lllfxxr.exe160⤵PID:3408
-
\??\c:\ntbhtb.exec:\ntbhtb.exe161⤵PID:1396
-
\??\c:\7pvdj.exec:\7pvdj.exe162⤵PID:1452
-
\??\c:\pdddd.exec:\pdddd.exe163⤵PID:936
-
\??\c:\bhntth.exec:\bhntth.exe164⤵PID:4660
-
\??\c:\bhtnhb.exec:\bhtnhb.exe165⤵PID:4300
-
\??\c:\vjpjd.exec:\vjpjd.exe166⤵PID:2452
-
\??\c:\7xrlffx.exec:\7xrlffx.exe167⤵PID:2356
-
\??\c:\htbbnb.exec:\htbbnb.exe168⤵PID:4012
-
\??\c:\jpppv.exec:\jpppv.exe169⤵PID:2748
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe170⤵PID:3212
-
\??\c:\xxrrflf.exec:\xxrrflf.exe171⤵PID:4908
-
\??\c:\thhhhb.exec:\thhhhb.exe172⤵PID:4028
-
\??\c:\dddvv.exec:\dddvv.exe173⤵PID:3456
-
\??\c:\vpvjd.exec:\vpvjd.exe174⤵PID:1648
-
\??\c:\xrllflf.exec:\xrllflf.exe175⤵PID:4364
-
\??\c:\7ttnhh.exec:\7ttnhh.exe176⤵PID:3416
-
\??\c:\pvvvj.exec:\pvvvj.exe177⤵PID:3260
-
\??\c:\ffrllrl.exec:\ffrllrl.exe178⤵PID:2888
-
\??\c:\hbnhbb.exec:\hbnhbb.exe179⤵PID:1176
-
\??\c:\nnnhtn.exec:\nnnhtn.exe180⤵PID:4648
-
\??\c:\vjdvv.exec:\vjdvv.exe181⤵PID:3156
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe182⤵PID:1708
-
\??\c:\bnnhtn.exec:\bnnhtn.exe183⤵PID:216
-
\??\c:\nthbtn.exec:\nthbtn.exe184⤵PID:3092
-
\??\c:\djjvp.exec:\djjvp.exe185⤵PID:4792
-
\??\c:\rrfxxrf.exec:\rrfxxrf.exe186⤵PID:4864
-
\??\c:\llffrlf.exec:\llffrlf.exe187⤵PID:2700
-
\??\c:\tntnbh.exec:\tntnbh.exe188⤵PID:4132
-
\??\c:\jdjvv.exec:\jdjvv.exe189⤵PID:2328
-
\??\c:\frrlffx.exec:\frrlffx.exe190⤵PID:3716
-
\??\c:\7rfrxxx.exec:\7rfrxxx.exe191⤵PID:2552
-
\??\c:\3bbtbt.exec:\3bbtbt.exe192⤵PID:3076
-
\??\c:\tbthtn.exec:\tbthtn.exe193⤵PID:5092
-
\??\c:\jpjpd.exec:\jpjpd.exe194⤵PID:3228
-
\??\c:\xlrffxr.exec:\xlrffxr.exe195⤵PID:4408
-
\??\c:\hbnnbb.exec:\hbnnbb.exe196⤵PID:1096
-
\??\c:\bhhbtn.exec:\bhhbtn.exe197⤵PID:4824
-
\??\c:\ppvpj.exec:\ppvpj.exe198⤵PID:2092
-
\??\c:\llfrrrl.exec:\llfrrrl.exe199⤵PID:952
-
\??\c:\bbbnbh.exec:\bbbnbh.exe200⤵PID:2376
-
\??\c:\ppdpd.exec:\ppdpd.exe201⤵PID:4040
-
\??\c:\5ffrlxl.exec:\5ffrlxl.exe202⤵PID:3520
-
\??\c:\rrfxxrr.exec:\rrfxxrr.exe203⤵PID:4580
-
\??\c:\hntnbn.exec:\hntnbn.exe204⤵PID:4444
-
\??\c:\vpvvd.exec:\vpvvd.exe205⤵PID:1500
-
\??\c:\7pddj.exec:\7pddj.exe206⤵PID:4584
-
\??\c:\3rlfrfr.exec:\3rlfrfr.exe207⤵PID:4008
-
\??\c:\thbbtt.exec:\thbbtt.exe208⤵PID:5084
-
\??\c:\pjdvp.exec:\pjdvp.exe209⤵PID:4956
-
\??\c:\3fffxxx.exec:\3fffxxx.exe210⤵PID:1688
-
\??\c:\ttbtnh.exec:\ttbtnh.exe211⤵PID:4540
-
\??\c:\jvdvv.exec:\jvdvv.exe212⤵PID:1476
-
\??\c:\dddvp.exec:\dddvp.exe213⤵PID:3184
-
\??\c:\ttthbb.exec:\ttthbb.exe214⤵PID:1844
-
\??\c:\bhtnbb.exec:\bhtnbb.exe215⤵PID:3472
-
\??\c:\5ddvp.exec:\5ddvp.exe216⤵PID:3108
-
\??\c:\frxfrxx.exec:\frxfrxx.exe217⤵PID:1672
-
\??\c:\7btnbb.exec:\7btnbb.exe218⤵PID:2384
-
\??\c:\1pvjp.exec:\1pvjp.exe219⤵PID:3136
-
\??\c:\jjpjv.exec:\jjpjv.exe220⤵PID:3104
-
\??\c:\fflfrlx.exec:\fflfrlx.exe221⤵PID:5080
-
\??\c:\xllxrlx.exec:\xllxrlx.exe222⤵PID:4596
-
\??\c:\hnnbbt.exec:\hnnbbt.exe223⤵PID:4512
-
\??\c:\vpppj.exec:\vpppj.exe224⤵PID:1160
-
\??\c:\3rlxrlf.exec:\3rlxrlf.exe225⤵PID:4184
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe226⤵PID:1588
-
\??\c:\btthbb.exec:\btthbb.exe227⤵PID:2348
-
\??\c:\7pjdv.exec:\7pjdv.exe228⤵PID:3576
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe229⤵PID:3784
-
\??\c:\bhthth.exec:\bhthth.exe230⤵PID:3660
-
\??\c:\tbttnn.exec:\tbttnn.exe231⤵PID:3636
-
\??\c:\ppvvd.exec:\ppvvd.exe232⤵PID:3116
-
\??\c:\llfxllf.exec:\llfxllf.exe233⤵PID:1920
-
\??\c:\bnbtnh.exec:\bnbtnh.exe234⤵PID:5092
-
\??\c:\jpvpv.exec:\jpvpv.exe235⤵PID:3228
-
\??\c:\vpdpd.exec:\vpdpd.exe236⤵PID:1216
-
\??\c:\frxrfxr.exec:\frxrfxr.exe237⤵PID:4016
-
\??\c:\ntbhbt.exec:\ntbhbt.exe238⤵PID:4824
-
\??\c:\jddvp.exec:\jddvp.exe239⤵PID:1224
-
\??\c:\vdjdv.exec:\vdjdv.exe240⤵PID:936
-
\??\c:\lfffxrf.exec:\lfffxrf.exe241⤵PID:3616
-
\??\c:\btnhtb.exec:\btnhtb.exe242⤵PID:2192