Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8fa1684a3b0ad712ded69e85795afa60_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8fa1684a3b0ad712ded69e85795afa60_NeikiAnalytics.exe
-
Size
459KB
-
MD5
8fa1684a3b0ad712ded69e85795afa60
-
SHA1
ef0dbe89994f141f078774796c299d4cfb3d12cb
-
SHA256
3a6cb7595bcbfef689e90edef6f0928c15930011f7ab44181c305bb1487c0b09
-
SHA512
a0df0f3f130bc8aa98eb5675accea7cac2133df0c688a9fb7b2c0794a872c2465c323130a6f71afa842a3de8ed8ea1a5d9841c7dd83108de8e13c82e0e7b0bd3
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1Hmu:d7Tc9Wj16A3StvxP
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3236-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-429-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-434-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-502-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-523-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-527-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-532-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-542-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-548-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-657-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-683-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/680-731-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-793-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-1154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lflrrrr.exehtbbhh.exehbbtnn.exetttnnn.exevjddv.exethnnhh.exebthhnn.exepddvv.exejjjdd.exefflfxxr.exevpdvv.exevjdvp.exexfffrrf.exenhbthh.exe9bbtnt.exedjppj.exexrrlffx.exetttnhb.exebhbhhh.exejddvv.exefxllrrx.exejdjdv.exe1xxrrrr.exenbbbtt.exejjjpj.exe1frrrxf.exe5tbtnt.exerlxxrrl.exeflrlllf.exe3tttnn.exejvvpj.exe7frrllf.exenbbttt.exepjpjj.exepvjdv.exerllfxfx.exehtnhbb.exepdpjj.exepjpdv.exexlfxrlf.exenhnhnn.exe1rxxrrf.exenbbbtn.exejdddv.exefrrxrxr.exebhnnnb.exepvjdp.exexflfllr.exehtthbb.exedjpjj.exexlrlllr.exevjpjd.exerrrlflf.exe3hnnhn.exe3pdvj.exettbnnb.exepvppp.exelffxlrr.exetthttt.exepvjdv.exeflxfxrl.exenhhbbt.exe3bnhnt.exe7vvvp.exepid process 4092 lflrrrr.exe 4068 htbbhh.exe 4472 hbbtnn.exe 3224 tttnnn.exe 2556 vjddv.exe 1792 thnnhh.exe 1412 bthhnn.exe 2124 pddvv.exe 3696 jjjdd.exe 4072 fflfxxr.exe 4612 vpdvv.exe 2248 vjdvp.exe 4928 xfffrrf.exe 912 nhbthh.exe 4528 9bbtnt.exe 3932 djppj.exe 5088 xrrlffx.exe 4544 tttnhb.exe 4040 bhbhhh.exe 4284 jddvv.exe 4044 fxllrrx.exe 684 jdjdv.exe 640 1xxrrrr.exe 2324 nbbbtt.exe 3276 jjjpj.exe 1256 1frrrxf.exe 4464 5tbtnt.exe 1416 rlxxrrl.exe 3744 flrlllf.exe 2752 3tttnn.exe 3440 jvvpj.exe 4260 7frrllf.exe 3536 nbbttt.exe 3944 pjpjj.exe 2940 pvjdv.exe 4644 rllfxfx.exe 2420 htnhbb.exe 2000 pdpjj.exe 3308 pjpdv.exe 4864 xlfxrlf.exe 3268 nhnhnn.exe 1876 1rxxrrf.exe 2680 nbbbtn.exe 940 jdddv.exe 2584 frrxrxr.exe 4336 bhnnnb.exe 4848 pvjdp.exe 2068 xflfllr.exe 2728 htthbb.exe 3140 djpjj.exe 1628 xlrlllr.exe 4868 vjpjd.exe 4620 rrrlflf.exe 1620 3hnnhn.exe 4972 3pdvj.exe 4884 ttbnnb.exe 4468 pvppp.exe 2712 lffxlrr.exe 4856 tthttt.exe 3132 pvjdv.exe 1532 flxfxrl.exe 4888 nhhbbt.exe 5040 3bnhnt.exe 4284 7vvvp.exe -
Processes:
resource yara_rule behavioral2/memory/3236-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-429-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-434-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-440-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-465-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-475-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-488-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8fa1684a3b0ad712ded69e85795afa60_NeikiAnalytics.exelflrrrr.exehtbbhh.exehbbtnn.exetttnnn.exevjddv.exethnnhh.exebthhnn.exepddvv.exejjjdd.exefflfxxr.exevpdvv.exevjdvp.exexfffrrf.exenhbthh.exe9bbtnt.exedjppj.exexrrlffx.exetttnhb.exebhbhhh.exejddvv.exefxllrrx.exedescription pid process target process PID 3236 wrote to memory of 4092 3236 8fa1684a3b0ad712ded69e85795afa60_NeikiAnalytics.exe lflrrrr.exe PID 3236 wrote to memory of 4092 3236 8fa1684a3b0ad712ded69e85795afa60_NeikiAnalytics.exe lflrrrr.exe PID 3236 wrote to memory of 4092 3236 8fa1684a3b0ad712ded69e85795afa60_NeikiAnalytics.exe lflrrrr.exe PID 4092 wrote to memory of 4068 4092 lflrrrr.exe htbbhh.exe PID 4092 wrote to memory of 4068 4092 lflrrrr.exe htbbhh.exe PID 4092 wrote to memory of 4068 4092 lflrrrr.exe htbbhh.exe PID 4068 wrote to memory of 4472 4068 htbbhh.exe hbbtnn.exe PID 4068 wrote to memory of 4472 4068 htbbhh.exe hbbtnn.exe PID 4068 wrote to memory of 4472 4068 htbbhh.exe hbbtnn.exe PID 4472 wrote to memory of 3224 4472 hbbtnn.exe tttnnn.exe PID 4472 wrote to memory of 3224 4472 hbbtnn.exe tttnnn.exe PID 4472 wrote to memory of 3224 4472 hbbtnn.exe tttnnn.exe PID 3224 wrote to memory of 2556 3224 tttnnn.exe vjddv.exe PID 3224 wrote to memory of 2556 3224 tttnnn.exe vjddv.exe PID 3224 wrote to memory of 2556 3224 tttnnn.exe vjddv.exe PID 2556 wrote to memory of 1792 2556 vjddv.exe thnnhh.exe PID 2556 wrote to memory of 1792 2556 vjddv.exe thnnhh.exe PID 2556 wrote to memory of 1792 2556 vjddv.exe thnnhh.exe PID 1792 wrote to memory of 1412 1792 thnnhh.exe bthhnn.exe PID 1792 wrote to memory of 1412 1792 thnnhh.exe bthhnn.exe PID 1792 wrote to memory of 1412 1792 thnnhh.exe bthhnn.exe PID 1412 wrote to memory of 2124 1412 bthhnn.exe pddvv.exe PID 1412 wrote to memory of 2124 1412 bthhnn.exe pddvv.exe PID 1412 wrote to memory of 2124 1412 bthhnn.exe pddvv.exe PID 2124 wrote to memory of 3696 2124 pddvv.exe jjjdd.exe PID 2124 wrote to memory of 3696 2124 pddvv.exe jjjdd.exe PID 2124 wrote to memory of 3696 2124 pddvv.exe jjjdd.exe PID 3696 wrote to memory of 4072 3696 jjjdd.exe fflfxxr.exe PID 3696 wrote to memory of 4072 3696 jjjdd.exe fflfxxr.exe PID 3696 wrote to memory of 4072 3696 jjjdd.exe fflfxxr.exe PID 4072 wrote to memory of 4612 4072 fflfxxr.exe vpdvv.exe PID 4072 wrote to memory of 4612 4072 fflfxxr.exe vpdvv.exe PID 4072 wrote to memory of 4612 4072 fflfxxr.exe vpdvv.exe PID 4612 wrote to memory of 2248 4612 vpdvv.exe vjdvp.exe PID 4612 wrote to memory of 2248 4612 vpdvv.exe vjdvp.exe PID 4612 wrote to memory of 2248 4612 vpdvv.exe vjdvp.exe PID 2248 wrote to memory of 4928 2248 vjdvp.exe xfffrrf.exe PID 2248 wrote to memory of 4928 2248 vjdvp.exe xfffrrf.exe PID 2248 wrote to memory of 4928 2248 vjdvp.exe xfffrrf.exe PID 4928 wrote to memory of 912 4928 xfffrrf.exe nhbthh.exe PID 4928 wrote to memory of 912 4928 xfffrrf.exe nhbthh.exe PID 4928 wrote to memory of 912 4928 xfffrrf.exe nhbthh.exe PID 912 wrote to memory of 4528 912 nhbthh.exe 9bbtnt.exe PID 912 wrote to memory of 4528 912 nhbthh.exe 9bbtnt.exe PID 912 wrote to memory of 4528 912 nhbthh.exe 9bbtnt.exe PID 4528 wrote to memory of 3932 4528 9bbtnt.exe djppj.exe PID 4528 wrote to memory of 3932 4528 9bbtnt.exe djppj.exe PID 4528 wrote to memory of 3932 4528 9bbtnt.exe djppj.exe PID 3932 wrote to memory of 5088 3932 djppj.exe xrrlffx.exe PID 3932 wrote to memory of 5088 3932 djppj.exe xrrlffx.exe PID 3932 wrote to memory of 5088 3932 djppj.exe xrrlffx.exe PID 5088 wrote to memory of 4544 5088 xrrlffx.exe tttnhb.exe PID 5088 wrote to memory of 4544 5088 xrrlffx.exe tttnhb.exe PID 5088 wrote to memory of 4544 5088 xrrlffx.exe tttnhb.exe PID 4544 wrote to memory of 4040 4544 tttnhb.exe bhbhhh.exe PID 4544 wrote to memory of 4040 4544 tttnhb.exe bhbhhh.exe PID 4544 wrote to memory of 4040 4544 tttnhb.exe bhbhhh.exe PID 4040 wrote to memory of 4284 4040 bhbhhh.exe jddvv.exe PID 4040 wrote to memory of 4284 4040 bhbhhh.exe jddvv.exe PID 4040 wrote to memory of 4284 4040 bhbhhh.exe jddvv.exe PID 4284 wrote to memory of 4044 4284 jddvv.exe fxllrrx.exe PID 4284 wrote to memory of 4044 4284 jddvv.exe fxllrrx.exe PID 4284 wrote to memory of 4044 4284 jddvv.exe fxllrrx.exe PID 4044 wrote to memory of 684 4044 fxllrrx.exe jdjdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fa1684a3b0ad712ded69e85795afa60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8fa1684a3b0ad712ded69e85795afa60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\lflrrrr.exec:\lflrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\htbbhh.exec:\htbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\hbbtnn.exec:\hbbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\tttnnn.exec:\tttnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\vjddv.exec:\vjddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\thnnhh.exec:\thnnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\bthhnn.exec:\bthhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\pddvv.exec:\pddvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\jjjdd.exec:\jjjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\fflfxxr.exec:\fflfxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\vpdvv.exec:\vpdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\vjdvp.exec:\vjdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\xfffrrf.exec:\xfffrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\nhbthh.exec:\nhbthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\9bbtnt.exec:\9bbtnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\djppj.exec:\djppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\xrrlffx.exec:\xrrlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\tttnhb.exec:\tttnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\bhbhhh.exec:\bhbhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\jddvv.exec:\jddvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\fxllrrx.exec:\fxllrrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\jdjdv.exec:\jdjdv.exe23⤵
- Executes dropped EXE
PID:684 -
\??\c:\1xxrrrr.exec:\1xxrrrr.exe24⤵
- Executes dropped EXE
PID:640 -
\??\c:\nbbbtt.exec:\nbbbtt.exe25⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jjjpj.exec:\jjjpj.exe26⤵
- Executes dropped EXE
PID:3276 -
\??\c:\1frrrxf.exec:\1frrrxf.exe27⤵
- Executes dropped EXE
PID:1256 -
\??\c:\5tbtnt.exec:\5tbtnt.exe28⤵
- Executes dropped EXE
PID:4464 -
\??\c:\rlxxrrl.exec:\rlxxrrl.exe29⤵
- Executes dropped EXE
PID:1416 -
\??\c:\flrlllf.exec:\flrlllf.exe30⤵
- Executes dropped EXE
PID:3744 -
\??\c:\3tttnn.exec:\3tttnn.exe31⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jvvpj.exec:\jvvpj.exe32⤵
- Executes dropped EXE
PID:3440 -
\??\c:\7frrllf.exec:\7frrllf.exe33⤵
- Executes dropped EXE
PID:4260 -
\??\c:\nbbttt.exec:\nbbttt.exe34⤵
- Executes dropped EXE
PID:3536 -
\??\c:\pjpjj.exec:\pjpjj.exe35⤵
- Executes dropped EXE
PID:3944 -
\??\c:\pvjdv.exec:\pvjdv.exe36⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rllfxfx.exec:\rllfxfx.exe37⤵
- Executes dropped EXE
PID:4644 -
\??\c:\htnhbb.exec:\htnhbb.exe38⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pdpjj.exec:\pdpjj.exe39⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pjpdv.exec:\pjpdv.exe40⤵
- Executes dropped EXE
PID:3308 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe41⤵
- Executes dropped EXE
PID:4864 -
\??\c:\nhnhnn.exec:\nhnhnn.exe42⤵
- Executes dropped EXE
PID:3268 -
\??\c:\1rxxrrf.exec:\1rxxrrf.exe43⤵
- Executes dropped EXE
PID:1876 -
\??\c:\nbbbtn.exec:\nbbbtn.exe44⤵
- Executes dropped EXE
PID:2680 -
\??\c:\jdddv.exec:\jdddv.exe45⤵
- Executes dropped EXE
PID:940 -
\??\c:\frrxrxr.exec:\frrxrxr.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bhnnnb.exec:\bhnnnb.exe47⤵
- Executes dropped EXE
PID:4336 -
\??\c:\pvjdp.exec:\pvjdp.exe48⤵
- Executes dropped EXE
PID:4848 -
\??\c:\xflfllr.exec:\xflfllr.exe49⤵
- Executes dropped EXE
PID:2068 -
\??\c:\htthbb.exec:\htthbb.exe50⤵
- Executes dropped EXE
PID:2728 -
\??\c:\djpjj.exec:\djpjj.exe51⤵
- Executes dropped EXE
PID:3140 -
\??\c:\xlrlllr.exec:\xlrlllr.exe52⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vjpjd.exec:\vjpjd.exe53⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rrrlflf.exec:\rrrlflf.exe54⤵
- Executes dropped EXE
PID:4620 -
\??\c:\3hnnhn.exec:\3hnnhn.exe55⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3pdvj.exec:\3pdvj.exe56⤵
- Executes dropped EXE
PID:4972 -
\??\c:\ttbnnb.exec:\ttbnnb.exe57⤵
- Executes dropped EXE
PID:4884 -
\??\c:\pvppp.exec:\pvppp.exe58⤵
- Executes dropped EXE
PID:4468 -
\??\c:\lffxlrr.exec:\lffxlrr.exe59⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tthttt.exec:\tthttt.exe60⤵
- Executes dropped EXE
PID:4856 -
\??\c:\pvjdv.exec:\pvjdv.exe61⤵
- Executes dropped EXE
PID:3132 -
\??\c:\flxfxrl.exec:\flxfxrl.exe62⤵
- Executes dropped EXE
PID:1532 -
\??\c:\nhhbbt.exec:\nhhbbt.exe63⤵
- Executes dropped EXE
PID:4888 -
\??\c:\3bnhnt.exec:\3bnhnt.exe64⤵
- Executes dropped EXE
PID:5040 -
\??\c:\7vvvp.exec:\7vvvp.exe65⤵
- Executes dropped EXE
PID:4284 -
\??\c:\lrxrffx.exec:\lrxrffx.exe66⤵PID:4036
-
\??\c:\nhnnnh.exec:\nhnnnh.exe67⤵PID:4232
-
\??\c:\pjjdj.exec:\pjjdj.exe68⤵PID:4404
-
\??\c:\xxxxffl.exec:\xxxxffl.exe69⤵PID:936
-
\??\c:\thbbbn.exec:\thbbbn.exe70⤵PID:3668
-
\??\c:\pjvvv.exec:\pjvvv.exe71⤵PID:4064
-
\??\c:\rxfrrxl.exec:\rxfrrxl.exe72⤵PID:2196
-
\??\c:\9ttnnh.exec:\9ttnnh.exe73⤵PID:2792
-
\??\c:\jvvjv.exec:\jvvjv.exe74⤵PID:3728
-
\??\c:\5dvvv.exec:\5dvvv.exe75⤵PID:3128
-
\??\c:\bhtbtb.exec:\bhtbtb.exe76⤵PID:1896
-
\??\c:\vpppj.exec:\vpppj.exe77⤵PID:1524
-
\??\c:\rffxrrl.exec:\rffxrrl.exe78⤵PID:4480
-
\??\c:\hbntbb.exec:\hbntbb.exe79⤵PID:3672
-
\??\c:\jjjdd.exec:\jjjdd.exe80⤵PID:4048
-
\??\c:\9ddvp.exec:\9ddvp.exe81⤵PID:532
-
\??\c:\rfllffx.exec:\rfllffx.exe82⤵PID:2940
-
\??\c:\nbnnnn.exec:\nbnnnn.exe83⤵PID:3984
-
\??\c:\jjjdp.exec:\jjjdp.exe84⤵PID:1172
-
\??\c:\jddvv.exec:\jddvv.exe85⤵PID:4092
-
\??\c:\rlrxxff.exec:\rlrxxff.exe86⤵PID:220
-
\??\c:\hbhbbb.exec:\hbhbbb.exe87⤵PID:396
-
\??\c:\ddjvv.exec:\ddjvv.exe88⤵PID:3692
-
\??\c:\dvjdv.exec:\dvjdv.exe89⤵PID:748
-
\??\c:\xlrfxxf.exec:\xlrfxxf.exe90⤵PID:440
-
\??\c:\tntnhb.exec:\tntnhb.exe91⤵PID:2372
-
\??\c:\bnbnhn.exec:\bnbnhn.exe92⤵PID:3528
-
\??\c:\vvpjd.exec:\vvpjd.exe93⤵PID:2316
-
\??\c:\flrllrr.exec:\flrllrr.exe94⤵PID:4848
-
\??\c:\hhnnhh.exec:\hhnnhh.exe95⤵PID:3764
-
\??\c:\hhnhtt.exec:\hhnhtt.exe96⤵PID:1536
-
\??\c:\jjjdv.exec:\jjjdv.exe97⤵PID:2644
-
\??\c:\frxlfff.exec:\frxlfff.exe98⤵PID:3780
-
\??\c:\hhnhhh.exec:\hhnhhh.exe99⤵PID:4700
-
\??\c:\bhnhbb.exec:\bhnhbb.exe100⤵PID:3232
-
\??\c:\ddjpv.exec:\ddjpv.exe101⤵PID:4436
-
\??\c:\rflxrrl.exec:\rflxrrl.exe102⤵PID:1520
-
\??\c:\lffxrrl.exec:\lffxrrl.exe103⤵PID:5016
-
\??\c:\thnhbb.exec:\thnhbb.exe104⤵PID:4908
-
\??\c:\pddpj.exec:\pddpj.exe105⤵PID:4856
-
\??\c:\1lxrrrr.exec:\1lxrrrr.exe106⤵PID:4604
-
\??\c:\lflrllf.exec:\lflrllf.exe107⤵PID:4932
-
\??\c:\5nnnnn.exec:\5nnnnn.exe108⤵PID:1264
-
\??\c:\tnhhnn.exec:\tnhhnn.exe109⤵PID:3916
-
\??\c:\jvpvp.exec:\jvpvp.exe110⤵PID:1716
-
\??\c:\rlxfxlr.exec:\rlxfxlr.exe111⤵PID:684
-
\??\c:\lflffff.exec:\lflffff.exe112⤵PID:4272
-
\??\c:\5ttttt.exec:\5ttttt.exe113⤵PID:3052
-
\??\c:\vjpdv.exec:\vjpdv.exe114⤵PID:936
-
\??\c:\5jjdp.exec:\5jjdp.exe115⤵PID:3668
-
\??\c:\llflllx.exec:\llflllx.exe116⤵PID:4064
-
\??\c:\hbhhbb.exec:\hbhhbb.exe117⤵PID:2716
-
\??\c:\btbnnh.exec:\btbnnh.exe118⤵PID:4788
-
\??\c:\9jppj.exec:\9jppj.exe119⤵PID:1920
-
\??\c:\rxffxff.exec:\rxffxff.exe120⤵PID:1896
-
\??\c:\7ttnnh.exec:\7ttnnh.exe121⤵PID:4492
-
\??\c:\jdpvj.exec:\jdpvj.exe122⤵PID:4904
-
\??\c:\7vvjd.exec:\7vvjd.exe123⤵PID:4344
-
\??\c:\xffxxxx.exec:\xffxxxx.exe124⤵PID:2376
-
\??\c:\7hnbbb.exec:\7hnbbb.exe125⤵PID:2420
-
\??\c:\bnbbtn.exec:\bnbbtn.exe126⤵PID:4552
-
\??\c:\pdddd.exec:\pdddd.exe127⤵PID:4536
-
\??\c:\xfrllll.exec:\xfrllll.exe128⤵PID:2948
-
\??\c:\thtbbb.exec:\thtbbb.exe129⤵PID:748
-
\??\c:\thttnn.exec:\thttnn.exe130⤵PID:440
-
\??\c:\ppddj.exec:\ppddj.exe131⤵PID:3160
-
\??\c:\lfffxxx.exec:\lfffxxx.exe132⤵PID:5048
-
\??\c:\dpddv.exec:\dpddv.exe133⤵PID:3180
-
\??\c:\xxrllrr.exec:\xxrllrr.exe134⤵PID:1456
-
\??\c:\ttbbtt.exec:\ttbbtt.exe135⤵PID:760
-
\??\c:\5vpjp.exec:\5vpjp.exe136⤵PID:2636
-
\??\c:\rlxrlll.exec:\rlxrlll.exe137⤵PID:2116
-
\??\c:\lflfxxx.exec:\lflfxxx.exe138⤵PID:2708
-
\??\c:\dpvpp.exec:\dpvpp.exe139⤵PID:4548
-
\??\c:\pvjdd.exec:\pvjdd.exe140⤵PID:1612
-
\??\c:\fxffllr.exec:\fxffllr.exe141⤵PID:3460
-
\??\c:\hhbbhh.exec:\hhbbhh.exe142⤵PID:1520
-
\??\c:\dvdvp.exec:\dvdvp.exe143⤵PID:2036
-
\??\c:\5xlfflf.exec:\5xlfflf.exe144⤵PID:4012
-
\??\c:\nthbbn.exec:\nthbbn.exe145⤵PID:5088
-
\??\c:\nthhtt.exec:\nthhtt.exe146⤵PID:1532
-
\??\c:\fflfxxr.exec:\fflfxxr.exe147⤵PID:4580
-
\??\c:\9lrlfrr.exec:\9lrlfrr.exe148⤵PID:332
-
\??\c:\9ttnbb.exec:\9ttnbb.exe149⤵PID:1976
-
\??\c:\ddvdv.exec:\ddvdv.exe150⤵PID:208
-
\??\c:\fflfxfx.exec:\fflfxfx.exe151⤵PID:684
-
\??\c:\rrxxflx.exec:\rrxxflx.exe152⤵PID:4272
-
\??\c:\hbnnbh.exec:\hbnnbh.exe153⤵PID:4296
-
\??\c:\vjppp.exec:\vjppp.exe154⤵PID:956
-
\??\c:\rrxrlll.exec:\rrxrlll.exe155⤵PID:4524
-
\??\c:\bthbbb.exec:\bthbbb.exe156⤵PID:1372
-
\??\c:\tntnhh.exec:\tntnhh.exe157⤵PID:680
-
\??\c:\pvvvp.exec:\pvvvp.exe158⤵PID:4572
-
\??\c:\flxxxxx.exec:\flxxxxx.exe159⤵PID:2752
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe160⤵PID:1064
-
\??\c:\hbbbth.exec:\hbbbth.exe161⤵PID:4840
-
\??\c:\3jpvd.exec:\3jpvd.exe162⤵PID:2992
-
\??\c:\lxxrlff.exec:\lxxrlff.exe163⤵PID:3236
-
\??\c:\xrllflf.exec:\xrllflf.exe164⤵PID:348
-
\??\c:\nnhbbh.exec:\nnhbbh.exe165⤵PID:4552
-
\??\c:\vvvvp.exec:\vvvvp.exe166⤵PID:2968
-
\??\c:\5lflfll.exec:\5lflfll.exe167⤵PID:4420
-
\??\c:\xrffxfx.exec:\xrffxfx.exe168⤵PID:996
-
\??\c:\ttbttn.exec:\ttbttn.exe169⤵PID:1616
-
\??\c:\ddjjj.exec:\ddjjj.exe170⤵PID:1176
-
\??\c:\fxfxxrl.exec:\fxfxxrl.exe171⤵PID:2112
-
\??\c:\tbbttt.exec:\tbbttt.exe172⤵PID:2404
-
\??\c:\9nnntb.exec:\9nnntb.exe173⤵PID:760
-
\??\c:\pdppv.exec:\pdppv.exe174⤵PID:2248
-
\??\c:\fxlffxx.exec:\fxlffxx.exe175⤵PID:4540
-
\??\c:\tntnnh.exec:\tntnnh.exe176⤵PID:1244
-
\??\c:\jvppp.exec:\jvppp.exe177⤵PID:4436
-
\??\c:\lllffxf.exec:\lllffxf.exe178⤵PID:3212
-
\??\c:\rxxfxff.exec:\rxxfxff.exe179⤵PID:2892
-
\??\c:\nthbtt.exec:\nthbtt.exe180⤵PID:1520
-
\??\c:\1vvpp.exec:\1vvpp.exe181⤵PID:960
-
\??\c:\pppjj.exec:\pppjj.exe182⤵PID:1544
-
\??\c:\xxrfxrl.exec:\xxrfxrl.exe183⤵PID:5088
-
\??\c:\tntbhb.exec:\tntbhb.exe184⤵PID:1532
-
\??\c:\pdjdv.exec:\pdjdv.exe185⤵PID:1264
-
\??\c:\dddpp.exec:\dddpp.exe186⤵PID:332
-
\??\c:\rxxfflr.exec:\rxxfflr.exe187⤵PID:1976
-
\??\c:\bbnhhn.exec:\bbnhhn.exe188⤵PID:208
-
\??\c:\jdjpj.exec:\jdjpj.exe189⤵PID:3052
-
\??\c:\5xlfffx.exec:\5xlfffx.exe190⤵PID:2932
-
\??\c:\lfllflf.exec:\lfllflf.exe191⤵PID:4784
-
\??\c:\btbttt.exec:\btbttt.exe192⤵PID:956
-
\??\c:\1ddvv.exec:\1ddvv.exe193⤵PID:2792
-
\??\c:\xrrlffx.exec:\xrrlffx.exe194⤵PID:5060
-
\??\c:\xxllflr.exec:\xxllflr.exe195⤵PID:680
-
\??\c:\hntnnn.exec:\hntnnn.exe196⤵PID:3840
-
\??\c:\dvvvp.exec:\dvvvp.exe197⤵PID:4560
-
\??\c:\fffxrrr.exec:\fffxrrr.exe198⤵PID:4644
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe199⤵PID:968
-
\??\c:\hbtntt.exec:\hbtntt.exe200⤵PID:1536
-
\??\c:\djjjd.exec:\djjjd.exe201⤵PID:4912
-
\??\c:\9jppj.exec:\9jppj.exe202⤵PID:4300
-
\??\c:\rllfxxf.exec:\rllfxxf.exe203⤵PID:4596
-
\??\c:\tntnnn.exec:\tntnnn.exe204⤵PID:348
-
\??\c:\1hhbtt.exec:\1hhbtt.exe205⤵PID:1328
-
\??\c:\jdppj.exec:\jdppj.exe206⤵PID:2160
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe207⤵PID:4336
-
\??\c:\3lrfflf.exec:\3lrfflf.exe208⤵PID:1616
-
\??\c:\hthbbb.exec:\hthbbb.exe209⤵PID:3764
-
\??\c:\5ddvp.exec:\5ddvp.exe210⤵PID:3292
-
\??\c:\5pvpj.exec:\5pvpj.exe211⤵PID:2316
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe212⤵PID:4600
-
\??\c:\ffllfff.exec:\ffllfff.exe213⤵PID:4688
-
\??\c:\ntbbbt.exec:\ntbbbt.exe214⤵PID:4928
-
\??\c:\hbhntn.exec:\hbhntn.exe215⤵PID:3980
-
\??\c:\jjvpp.exec:\jjvpp.exe216⤵PID:3356
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe217⤵PID:4804
-
\??\c:\bnnhbb.exec:\bnnhbb.exe218⤵PID:4468
-
\??\c:\pvjdj.exec:\pvjdj.exe219⤵PID:3500
-
\??\c:\dpjjd.exec:\dpjjd.exe220⤵PID:3088
-
\??\c:\rlrlllf.exec:\rlrlllf.exe221⤵PID:4544
-
\??\c:\hthhbb.exec:\hthhbb.exe222⤵PID:4012
-
\??\c:\vjjvj.exec:\vjjvj.exe223⤵PID:2412
-
\??\c:\llxxxxx.exec:\llxxxxx.exe224⤵PID:3152
-
\??\c:\fffrxfl.exec:\fffrxfl.exe225⤵PID:4428
-
\??\c:\nhnnhn.exec:\nhnnhn.exe226⤵PID:5072
-
\??\c:\pjpjd.exec:\pjpjd.exe227⤵PID:640
-
\??\c:\jjpvj.exec:\jjpvj.exe228⤵PID:3276
-
\??\c:\lxffxxx.exec:\lxffxxx.exe229⤵PID:876
-
\??\c:\nthhnn.exec:\nthhnn.exe230⤵PID:2912
-
\??\c:\3jdvp.exec:\3jdvp.exe231⤵PID:628
-
\??\c:\lxfxfxx.exec:\lxfxfxx.exe232⤵PID:2196
-
\??\c:\5ntbtb.exec:\5ntbtb.exe233⤵PID:1968
-
\??\c:\vvvjj.exec:\vvvjj.exe234⤵PID:2740
-
\??\c:\fxrrlll.exec:\fxrrlll.exe235⤵PID:3392
-
\??\c:\xrfxrxr.exec:\xrfxrxr.exe236⤵PID:3100
-
\??\c:\nbnnhh.exec:\nbnnhh.exe237⤵PID:1760
-
\??\c:\vdppd.exec:\vdppd.exe238⤵PID:3244
-
\??\c:\xrfxlrl.exec:\xrfxlrl.exe239⤵PID:4572
-
\??\c:\rrffffx.exec:\rrffffx.exe240⤵PID:1524
-
\??\c:\hhhhbb.exec:\hhhhbb.exe241⤵PID:4048
-
\??\c:\jddvv.exec:\jddvv.exe242⤵PID:1036