Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:28
Behavioral task
behavioral1
Sample
90f1a16711de3f7c32a7fe9460d80510_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
90f1a16711de3f7c32a7fe9460d80510_NeikiAnalytics.exe
-
Size
123KB
-
MD5
90f1a16711de3f7c32a7fe9460d80510
-
SHA1
3287b0c38ad1f97413cbeb062a75e46ce4e1ca16
-
SHA256
3d4862696440eb5b6be9c377d820194295694300e81401056e2a6a309cbc38d3
-
SHA512
79b8a56ce87302c19545840d6bbd25f0a9eb3e7b816bb3af5a65fead7a1394c9a73a65dba3b0133281111769593631049b4be66af46039db20ab0059e7bd0e17
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JgY0nU7:9cm4FmowdHoS49oU7
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1052-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/980-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2056-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/836-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/880-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/620-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2888-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2716-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/696-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-684-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-730-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-814-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-895-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-945-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-985-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-1186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnttbn.exedddvp.exevdpjd.exelffxlff.exexxlfllr.exetnnntn.exenhbbnb.exelfxrlfl.exexxlffxx.exebbbtbb.exevjddv.exevvddj.exefrrlfxr.exehnhbhh.exexxlxlfr.exebnnbnb.exevvvjv.exefflrlll.exe9lxrxrl.exenhhttn.exehthhtn.exepvdpj.exexrrfrlf.exe9flfxxx.exevjpdd.exe5jpdp.exe3rxrlfx.exe7tnhtb.exebhnhbt.exedddpd.exe5flfxxf.exentbtnh.exe3jjdv.exexlfxffl.exelfflxxf.exe5hbbtt.exepjvpj.exefllxfxx.exexfrfffr.exetbtbtt.exebntnbb.exedvdvv.exerxxrllf.exelrxrllf.exe7tnnhh.exedddvp.exevvjjp.exerlrlfff.exe1ffxxrl.exetbnbnh.exevjdpj.exe9jjdj.exeflrfrlf.exenbthnh.exe5hhhtn.exedpjdv.exerlrlxlr.exelxfxrrl.exettnbnn.exeppvpp.exe5dvjp.exe5lfrxrf.exexfxlxrf.exethtnht.exepid process 4008 tnttbn.exe 3268 dddvp.exe 1600 vdpjd.exe 4584 lffxlff.exe 4820 xxlfllr.exe 980 tnnntn.exe 2884 nhbbnb.exe 3048 lfxrlfl.exe 3952 xxlffxx.exe 2100 bbbtbb.exe 3088 vjddv.exe 4528 vvddj.exe 4672 frrlfxr.exe 2172 hnhbhh.exe 2880 xxlxlfr.exe 2056 bnnbnb.exe 1368 vvvjv.exe 836 fflrlll.exe 2368 9lxrxrl.exe 832 nhhttn.exe 4488 hthhtn.exe 880 pvdpj.exe 1436 xrrfrlf.exe 3944 9flfxxx.exe 3612 vjpdd.exe 2004 5jpdp.exe 3108 3rxrlfx.exe 1060 7tnhtb.exe 3120 bhnhbt.exe 1064 dddpd.exe 3376 5flfxxf.exe 4456 ntbtnh.exe 3116 3jjdv.exe 4960 xlfxffl.exe 2240 lfflxxf.exe 1620 5hbbtt.exe 4424 pjvpj.exe 1532 fllxfxx.exe 2136 xfrfffr.exe 4780 tbtbtt.exe 2340 bntnbb.exe 2196 dvdvv.exe 1336 rxxrllf.exe 3136 lrxrllf.exe 632 7tnnhh.exe 4568 dddvp.exe 5108 vvjjp.exe 3496 rlrlfff.exe 3952 1ffxxrl.exe 3368 tbnbnh.exe 620 vjdpj.exe 668 9jjdj.exe 4528 flrfrlf.exe 2488 nbthnh.exe 4192 5hhhtn.exe 4232 dpjdv.exe 1808 rlrlxlr.exe 4336 lxfxrrl.exe 5052 ttnbnn.exe 5116 ppvpp.exe 3648 5dvjp.exe 3704 5lfrxrf.exe 1192 xfxlxrf.exe 5048 thtnht.exe -
Processes:
resource yara_rule behavioral2/memory/1052-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnttbn.exe upx behavioral2/memory/1052-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4008-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddvp.exe upx C:\vdpjd.exe upx behavioral2/memory/1600-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3268-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3268-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lffxlff.exe upx C:\xxlfllr.exe upx behavioral2/memory/4820-32-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnnntn.exe upx behavioral2/memory/980-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4584-26-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhbbnb.exe upx behavioral2/memory/2884-44-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfxrlfl.exe upx behavioral2/memory/3048-49-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlffxx.exe upx C:\bbbtbb.exe upx behavioral2/memory/3952-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2100-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjddv.exe upx behavioral2/memory/2100-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3088-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvddj.exe upx C:\frrlfxr.exe upx behavioral2/memory/4528-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnhbhh.exe upx behavioral2/memory/4672-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlxlfr.exe upx behavioral2/memory/2172-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2880-95-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnnbnb.exe upx behavioral2/memory/2056-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvjv.exe upx \??\c:\fflrlll.exe upx behavioral2/memory/836-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9lxrxrl.exe upx behavioral2/memory/2368-115-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhttn.exe upx behavioral2/memory/1368-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/832-121-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hthhtn.exe upx C:\pvdpj.exe upx C:\xrrfrlf.exe upx behavioral2/memory/880-135-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9flfxxx.exe upx behavioral2/memory/1436-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjpdd.exe upx behavioral2/memory/3944-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5jpdp.exe upx behavioral2/memory/3612-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3rxrlfx.exe upx behavioral2/memory/2004-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3108-162-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7tnhtb.exe upx C:\bhnhbt.exe upx behavioral2/memory/3120-173-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddpd.exe upx behavioral2/memory/1064-182-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5flfxxf.exe upx C:\ntbtnh.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
90f1a16711de3f7c32a7fe9460d80510_NeikiAnalytics.exetnttbn.exedddvp.exevdpjd.exelffxlff.exexxlfllr.exetnnntn.exenhbbnb.exelfxrlfl.exexxlffxx.exebbbtbb.exevjddv.exevvddj.exefrrlfxr.exehnhbhh.exexxlxlfr.exebnnbnb.exevvvjv.exefflrlll.exe9lxrxrl.exenhhttn.exehthhtn.exedescription pid process target process PID 1052 wrote to memory of 4008 1052 90f1a16711de3f7c32a7fe9460d80510_NeikiAnalytics.exe tnttbn.exe PID 1052 wrote to memory of 4008 1052 90f1a16711de3f7c32a7fe9460d80510_NeikiAnalytics.exe tnttbn.exe PID 1052 wrote to memory of 4008 1052 90f1a16711de3f7c32a7fe9460d80510_NeikiAnalytics.exe tnttbn.exe PID 4008 wrote to memory of 3268 4008 tnttbn.exe dddvp.exe PID 4008 wrote to memory of 3268 4008 tnttbn.exe dddvp.exe PID 4008 wrote to memory of 3268 4008 tnttbn.exe dddvp.exe PID 3268 wrote to memory of 1600 3268 dddvp.exe vdpjd.exe PID 3268 wrote to memory of 1600 3268 dddvp.exe vdpjd.exe PID 3268 wrote to memory of 1600 3268 dddvp.exe vdpjd.exe PID 1600 wrote to memory of 4584 1600 vdpjd.exe lffxlff.exe PID 1600 wrote to memory of 4584 1600 vdpjd.exe lffxlff.exe PID 1600 wrote to memory of 4584 1600 vdpjd.exe lffxlff.exe PID 4584 wrote to memory of 4820 4584 lffxlff.exe xxlfllr.exe PID 4584 wrote to memory of 4820 4584 lffxlff.exe xxlfllr.exe PID 4584 wrote to memory of 4820 4584 lffxlff.exe xxlfllr.exe PID 4820 wrote to memory of 980 4820 xxlfllr.exe tnnntn.exe PID 4820 wrote to memory of 980 4820 xxlfllr.exe tnnntn.exe PID 4820 wrote to memory of 980 4820 xxlfllr.exe tnnntn.exe PID 980 wrote to memory of 2884 980 tnnntn.exe nhbbnb.exe PID 980 wrote to memory of 2884 980 tnnntn.exe nhbbnb.exe PID 980 wrote to memory of 2884 980 tnnntn.exe nhbbnb.exe PID 2884 wrote to memory of 3048 2884 nhbbnb.exe lfxrlfl.exe PID 2884 wrote to memory of 3048 2884 nhbbnb.exe lfxrlfl.exe PID 2884 wrote to memory of 3048 2884 nhbbnb.exe lfxrlfl.exe PID 3048 wrote to memory of 3952 3048 lfxrlfl.exe xxlffxx.exe PID 3048 wrote to memory of 3952 3048 lfxrlfl.exe xxlffxx.exe PID 3048 wrote to memory of 3952 3048 lfxrlfl.exe xxlffxx.exe PID 3952 wrote to memory of 2100 3952 xxlffxx.exe bbbtbb.exe PID 3952 wrote to memory of 2100 3952 xxlffxx.exe bbbtbb.exe PID 3952 wrote to memory of 2100 3952 xxlffxx.exe bbbtbb.exe PID 2100 wrote to memory of 3088 2100 bbbtbb.exe vjddv.exe PID 2100 wrote to memory of 3088 2100 bbbtbb.exe vjddv.exe PID 2100 wrote to memory of 3088 2100 bbbtbb.exe vjddv.exe PID 3088 wrote to memory of 4528 3088 vjddv.exe vvddj.exe PID 3088 wrote to memory of 4528 3088 vjddv.exe vvddj.exe PID 3088 wrote to memory of 4528 3088 vjddv.exe vvddj.exe PID 4528 wrote to memory of 4672 4528 vvddj.exe frrlfxr.exe PID 4528 wrote to memory of 4672 4528 vvddj.exe frrlfxr.exe PID 4528 wrote to memory of 4672 4528 vvddj.exe frrlfxr.exe PID 4672 wrote to memory of 2172 4672 frrlfxr.exe hnhbhh.exe PID 4672 wrote to memory of 2172 4672 frrlfxr.exe hnhbhh.exe PID 4672 wrote to memory of 2172 4672 frrlfxr.exe hnhbhh.exe PID 2172 wrote to memory of 2880 2172 hnhbhh.exe xxlxlfr.exe PID 2172 wrote to memory of 2880 2172 hnhbhh.exe xxlxlfr.exe PID 2172 wrote to memory of 2880 2172 hnhbhh.exe xxlxlfr.exe PID 2880 wrote to memory of 2056 2880 xxlxlfr.exe bnnbnb.exe PID 2880 wrote to memory of 2056 2880 xxlxlfr.exe bnnbnb.exe PID 2880 wrote to memory of 2056 2880 xxlxlfr.exe bnnbnb.exe PID 2056 wrote to memory of 1368 2056 bnnbnb.exe vvvjv.exe PID 2056 wrote to memory of 1368 2056 bnnbnb.exe vvvjv.exe PID 2056 wrote to memory of 1368 2056 bnnbnb.exe vvvjv.exe PID 1368 wrote to memory of 836 1368 vvvjv.exe fflrlll.exe PID 1368 wrote to memory of 836 1368 vvvjv.exe fflrlll.exe PID 1368 wrote to memory of 836 1368 vvvjv.exe fflrlll.exe PID 836 wrote to memory of 2368 836 fflrlll.exe 9lxrxrl.exe PID 836 wrote to memory of 2368 836 fflrlll.exe 9lxrxrl.exe PID 836 wrote to memory of 2368 836 fflrlll.exe 9lxrxrl.exe PID 2368 wrote to memory of 832 2368 9lxrxrl.exe nhhttn.exe PID 2368 wrote to memory of 832 2368 9lxrxrl.exe nhhttn.exe PID 2368 wrote to memory of 832 2368 9lxrxrl.exe nhhttn.exe PID 832 wrote to memory of 4488 832 nhhttn.exe hthhtn.exe PID 832 wrote to memory of 4488 832 nhhttn.exe hthhtn.exe PID 832 wrote to memory of 4488 832 nhhttn.exe hthhtn.exe PID 4488 wrote to memory of 880 4488 hthhtn.exe pvdpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90f1a16711de3f7c32a7fe9460d80510_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\90f1a16711de3f7c32a7fe9460d80510_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\tnttbn.exec:\tnttbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\dddvp.exec:\dddvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\vdpjd.exec:\vdpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\lffxlff.exec:\lffxlff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\xxlfllr.exec:\xxlfllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\tnnntn.exec:\tnnntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\nhbbnb.exec:\nhbbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\lfxrlfl.exec:\lfxrlfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\xxlffxx.exec:\xxlffxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\bbbtbb.exec:\bbbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\vjddv.exec:\vjddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\vvddj.exec:\vvddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\frrlfxr.exec:\frrlfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\hnhbhh.exec:\hnhbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\xxlxlfr.exec:\xxlxlfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\bnnbnb.exec:\bnnbnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\vvvjv.exec:\vvvjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\fflrlll.exec:\fflrlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\9lxrxrl.exec:\9lxrxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\nhhttn.exec:\nhhttn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\hthhtn.exec:\hthhtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\pvdpj.exec:\pvdpj.exe23⤵
- Executes dropped EXE
PID:880 -
\??\c:\xrrfrlf.exec:\xrrfrlf.exe24⤵
- Executes dropped EXE
PID:1436 -
\??\c:\9flfxxx.exec:\9flfxxx.exe25⤵
- Executes dropped EXE
PID:3944 -
\??\c:\vjpdd.exec:\vjpdd.exe26⤵
- Executes dropped EXE
PID:3612 -
\??\c:\5jpdp.exec:\5jpdp.exe27⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3rxrlfx.exec:\3rxrlfx.exe28⤵
- Executes dropped EXE
PID:3108 -
\??\c:\7tnhtb.exec:\7tnhtb.exe29⤵
- Executes dropped EXE
PID:1060 -
\??\c:\bhnhbt.exec:\bhnhbt.exe30⤵
- Executes dropped EXE
PID:3120 -
\??\c:\dddpd.exec:\dddpd.exe31⤵
- Executes dropped EXE
PID:1064 -
\??\c:\5flfxxf.exec:\5flfxxf.exe32⤵
- Executes dropped EXE
PID:3376 -
\??\c:\ntbtnh.exec:\ntbtnh.exe33⤵
- Executes dropped EXE
PID:4456 -
\??\c:\3jjdv.exec:\3jjdv.exe34⤵
- Executes dropped EXE
PID:3116 -
\??\c:\xlfxffl.exec:\xlfxffl.exe35⤵
- Executes dropped EXE
PID:4960 -
\??\c:\lfflxxf.exec:\lfflxxf.exe36⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5hbbtt.exec:\5hbbtt.exe37⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pjvpj.exec:\pjvpj.exe38⤵
- Executes dropped EXE
PID:4424 -
\??\c:\fllxfxx.exec:\fllxfxx.exe39⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xfrfffr.exec:\xfrfffr.exe40⤵
- Executes dropped EXE
PID:2136 -
\??\c:\tbtbtt.exec:\tbtbtt.exe41⤵
- Executes dropped EXE
PID:4780 -
\??\c:\bntnbb.exec:\bntnbb.exe42⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dvdvv.exec:\dvdvv.exe43⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rxxrllf.exec:\rxxrllf.exe44⤵
- Executes dropped EXE
PID:1336 -
\??\c:\lrxrllf.exec:\lrxrllf.exe45⤵
- Executes dropped EXE
PID:3136 -
\??\c:\7tnnhh.exec:\7tnnhh.exe46⤵
- Executes dropped EXE
PID:632 -
\??\c:\dddvp.exec:\dddvp.exe47⤵
- Executes dropped EXE
PID:4568 -
\??\c:\vvjjp.exec:\vvjjp.exe48⤵
- Executes dropped EXE
PID:5108 -
\??\c:\rlrlfff.exec:\rlrlfff.exe49⤵
- Executes dropped EXE
PID:3496 -
\??\c:\1ffxxrl.exec:\1ffxxrl.exe50⤵
- Executes dropped EXE
PID:3952 -
\??\c:\tbnbnh.exec:\tbnbnh.exe51⤵
- Executes dropped EXE
PID:3368 -
\??\c:\vjdpj.exec:\vjdpj.exe52⤵
- Executes dropped EXE
PID:620 -
\??\c:\9jjdj.exec:\9jjdj.exe53⤵
- Executes dropped EXE
PID:668 -
\??\c:\flrfrlf.exec:\flrfrlf.exe54⤵
- Executes dropped EXE
PID:4528 -
\??\c:\nbthnh.exec:\nbthnh.exe55⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5hhhtn.exec:\5hhhtn.exe56⤵
- Executes dropped EXE
PID:4192 -
\??\c:\dpjdv.exec:\dpjdv.exe57⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rlrlxlr.exec:\rlrlxlr.exe58⤵
- Executes dropped EXE
PID:1808 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe59⤵
- Executes dropped EXE
PID:4336 -
\??\c:\ttnbnn.exec:\ttnbnn.exe60⤵
- Executes dropped EXE
PID:5052 -
\??\c:\ppvpp.exec:\ppvpp.exe61⤵
- Executes dropped EXE
PID:5116 -
\??\c:\5dvjp.exec:\5dvjp.exe62⤵
- Executes dropped EXE
PID:3648 -
\??\c:\5lfrxrf.exec:\5lfrxrf.exe63⤵
- Executes dropped EXE
PID:3704 -
\??\c:\xfxlxrf.exec:\xfxlxrf.exe64⤵
- Executes dropped EXE
PID:1192 -
\??\c:\thtnht.exec:\thtnht.exe65⤵
- Executes dropped EXE
PID:5048 -
\??\c:\pppjd.exec:\pppjd.exe66⤵PID:2248
-
\??\c:\pjpdv.exec:\pjpdv.exe67⤵PID:1212
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe68⤵PID:2820
-
\??\c:\1lfrfxl.exec:\1lfrfxl.exe69⤵PID:4416
-
\??\c:\hbthbt.exec:\hbthbt.exe70⤵PID:2304
-
\??\c:\hhbtnb.exec:\hhbtnb.exe71⤵PID:904
-
\??\c:\dpjvj.exec:\dpjvj.exe72⤵PID:4372
-
\??\c:\pvvjv.exec:\pvvjv.exe73⤵PID:392
-
\??\c:\lxxrlff.exec:\lxxrlff.exe74⤵PID:3108
-
\??\c:\3rrrfxr.exec:\3rrrfxr.exe75⤵PID:764
-
\??\c:\9btnbt.exec:\9btnbt.exe76⤵PID:3792
-
\??\c:\7pjvj.exec:\7pjvj.exe77⤵PID:1988
-
\??\c:\pvvjd.exec:\pvvjd.exe78⤵PID:3120
-
\??\c:\9rfxxxf.exec:\9rfxxxf.exe79⤵PID:3976
-
\??\c:\9fxrfxl.exec:\9fxrfxl.exe80⤵PID:5060
-
\??\c:\nbtnhb.exec:\nbtnhb.exe81⤵PID:3176
-
\??\c:\xflfxrl.exec:\xflfxrl.exe82⤵PID:4268
-
\??\c:\xlllffr.exec:\xlllffr.exe83⤵PID:4168
-
\??\c:\bbhhbb.exec:\bbhhbb.exe84⤵PID:3844
-
\??\c:\dpjjd.exec:\dpjjd.exe85⤵PID:100
-
\??\c:\dpppv.exec:\dpppv.exe86⤵PID:1588
-
\??\c:\lrllxrf.exec:\lrllxrf.exe87⤵PID:696
-
\??\c:\bnhtnh.exec:\bnhtnh.exe88⤵PID:2712
-
\??\c:\1bhthn.exec:\1bhthn.exe89⤵PID:4212
-
\??\c:\3jvpd.exec:\3jvpd.exe90⤵PID:4796
-
\??\c:\frxlxlr.exec:\frxlxlr.exe91⤵PID:4492
-
\??\c:\tnhhbt.exec:\tnhhbt.exe92⤵PID:4136
-
\??\c:\nbnttn.exec:\nbnttn.exe93⤵PID:4624
-
\??\c:\pvvpd.exec:\pvvpd.exe94⤵PID:4184
-
\??\c:\vjjvv.exec:\vjjvv.exe95⤵PID:1336
-
\??\c:\ffxxllf.exec:\ffxxllf.exe96⤵PID:1840
-
\??\c:\tnhbtn.exec:\tnhbtn.exe97⤵PID:2888
-
\??\c:\nttntt.exec:\nttntt.exe98⤵PID:4568
-
\??\c:\vpjdj.exec:\vpjdj.exe99⤵PID:3488
-
\??\c:\vdjdd.exec:\vdjdd.exe100⤵PID:1576
-
\??\c:\rflxlrr.exec:\rflxlrr.exe101⤵PID:3952
-
\??\c:\rllffxx.exec:\rllffxx.exe102⤵PID:3368
-
\??\c:\bnhbtt.exec:\bnhbtt.exe103⤵PID:620
-
\??\c:\9jvvd.exec:\9jvvd.exe104⤵PID:1516
-
\??\c:\1jppj.exec:\1jppj.exe105⤵PID:2824
-
\??\c:\vjjdp.exec:\vjjdp.exe106⤵PID:1892
-
\??\c:\rlrrlxr.exec:\rlrrlxr.exe107⤵PID:1580
-
\??\c:\lxlxlxr.exec:\lxlxlxr.exe108⤵PID:2652
-
\??\c:\btbtbb.exec:\btbtbb.exe109⤵PID:2880
-
\??\c:\htthbt.exec:\htthbt.exe110⤵PID:3676
-
\??\c:\vdjdd.exec:\vdjdd.exe111⤵PID:1368
-
\??\c:\7rfffrl.exec:\7rfffrl.exe112⤵PID:3296
-
\??\c:\rxrllfr.exec:\rxrllfr.exe113⤵PID:3172
-
\??\c:\thnnbb.exec:\thnnbb.exe114⤵PID:1044
-
\??\c:\vjvvp.exec:\vjvvp.exe115⤵PID:1948
-
\??\c:\pvvpj.exec:\pvvpj.exe116⤵PID:1224
-
\??\c:\xrfxfff.exec:\xrfxfff.exe117⤵PID:2420
-
\??\c:\fflfflf.exec:\fflfflf.exe118⤵PID:3616
-
\??\c:\htbhnb.exec:\htbhnb.exe119⤵PID:1732
-
\??\c:\3hbttn.exec:\3hbttn.exe120⤵PID:4172
-
\??\c:\pjjdv.exec:\pjjdv.exe121⤵PID:2784
-
\??\c:\frlfxrl.exec:\frlfxrl.exe122⤵PID:736
-
\??\c:\lxffrxl.exec:\lxffrxl.exe123⤵PID:3232
-
\??\c:\bhhhbb.exec:\bhhhbb.exe124⤵PID:4408
-
\??\c:\ddjjd.exec:\ddjjd.exe125⤵PID:3108
-
\??\c:\ppjdp.exec:\ppjdp.exe126⤵PID:376
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe127⤵PID:3284
-
\??\c:\fxfxlfl.exec:\fxfxlfl.exe128⤵PID:2084
-
\??\c:\nbbtnn.exec:\nbbtnn.exe129⤵PID:4496
-
\??\c:\bthbbt.exec:\bthbbt.exe130⤵PID:3192
-
\??\c:\xxxrllf.exec:\xxxrllf.exe131⤵PID:4536
-
\??\c:\tnttnn.exec:\tnttnn.exe132⤵PID:3116
-
\??\c:\bntnhn.exec:\bntnhn.exe133⤵PID:1920
-
\??\c:\dvpjd.exec:\dvpjd.exe134⤵PID:2524
-
\??\c:\1pvjd.exec:\1pvjd.exe135⤵PID:4036
-
\??\c:\flrfxrl.exec:\flrfxrl.exe136⤵PID:2864
-
\??\c:\lxffxxx.exec:\lxffxxx.exe137⤵PID:1520
-
\??\c:\httnnn.exec:\httnnn.exe138⤵PID:208
-
\??\c:\thnntb.exec:\thnntb.exe139⤵PID:4848
-
\??\c:\tbbnnh.exec:\tbbnnh.exe140⤵PID:3248
-
\??\c:\3jvvp.exec:\3jvvp.exe141⤵PID:4740
-
\??\c:\vdjdp.exec:\vdjdp.exe142⤵PID:1688
-
\??\c:\rxfxrxx.exec:\rxfxrxx.exe143⤵PID:4988
-
\??\c:\rrffxxr.exec:\rrffxxr.exe144⤵PID:2196
-
\??\c:\nhhhhh.exec:\nhhhhh.exe145⤵PID:1408
-
\??\c:\jpvpd.exec:\jpvpd.exe146⤵PID:3136
-
\??\c:\dvpdd.exec:\dvpdd.exe147⤵PID:2080
-
\??\c:\rrrxlll.exec:\rrrxlll.exe148⤵PID:4764
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe149⤵PID:3496
-
\??\c:\bhbtnt.exec:\bhbtnt.exe150⤵PID:1660
-
\??\c:\7htbhh.exec:\7htbhh.exe151⤵PID:672
-
\??\c:\jdddv.exec:\jdddv.exe152⤵PID:2100
-
\??\c:\frrfrfx.exec:\frrfrfx.exe153⤵PID:3368
-
\??\c:\1xfxffr.exec:\1xfxffr.exe154⤵PID:4672
-
\??\c:\httnhb.exec:\httnhb.exe155⤵PID:2568
-
\??\c:\3thbnn.exec:\3thbnn.exe156⤵PID:2156
-
\??\c:\jvvpj.exec:\jvvpj.exe157⤵PID:4220
-
\??\c:\vjvpv.exec:\vjvpv.exe158⤵PID:4004
-
\??\c:\flrlfxr.exec:\flrlfxr.exe159⤵PID:1224
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe160⤵PID:4632
-
\??\c:\hnbbtn.exec:\hnbbtn.exe161⤵PID:2820
-
\??\c:\hbhbhn.exec:\hbhbhn.exe162⤵PID:2180
-
\??\c:\tbhhbt.exec:\tbhhbt.exe163⤵PID:2716
-
\??\c:\vppvj.exec:\vppvj.exe164⤵PID:4020
-
\??\c:\pddvp.exec:\pddvp.exe165⤵PID:4204
-
\??\c:\rrrrlff.exec:\rrrrlff.exe166⤵PID:2776
-
\??\c:\fxffxlf.exec:\fxffxlf.exe167⤵PID:3232
-
\??\c:\nhhhhn.exec:\nhhhhn.exe168⤵PID:4408
-
\??\c:\bttttt.exec:\bttttt.exe169⤵PID:3108
-
\??\c:\tnnhbt.exec:\tnnhbt.exe170⤵PID:544
-
\??\c:\1jppj.exec:\1jppj.exe171⤵PID:3284
-
\??\c:\pjdvv.exec:\pjdvv.exe172⤵PID:2084
-
\??\c:\lxfrlll.exec:\lxfrlll.exe173⤵PID:4660
-
\??\c:\7xxrlll.exec:\7xxrlll.exe174⤵PID:984
-
\??\c:\jjpjj.exec:\jjpjj.exe175⤵PID:2848
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe176⤵PID:3552
-
\??\c:\5lxlfxr.exec:\5lxlfxr.exe177⤵PID:4556
-
\??\c:\9tbtbb.exec:\9tbtbb.exe178⤵PID:4332
-
\??\c:\nhhbbt.exec:\nhhbbt.exe179⤵PID:3440
-
\??\c:\dddpp.exec:\dddpp.exe180⤵PID:696
-
\??\c:\7llffrl.exec:\7llffrl.exe181⤵PID:3268
-
\??\c:\7hhhbt.exec:\7hhhbt.exe182⤵PID:1600
-
\??\c:\bbntbt.exec:\bbntbt.exe183⤵PID:4504
-
\??\c:\pvvpp.exec:\pvvpp.exe184⤵PID:4732
-
\??\c:\ppddv.exec:\ppddv.exe185⤵PID:4464
-
\??\c:\pjddj.exec:\pjddj.exe186⤵PID:2312
-
\??\c:\1xrlffx.exec:\1xrlffx.exe187⤵PID:980
-
\??\c:\frxrrrr.exec:\frxrrrr.exe188⤵PID:2884
-
\??\c:\tttnnt.exec:\tttnnt.exe189⤵PID:3252
-
\??\c:\nhbhbh.exec:\nhbhbh.exe190⤵PID:4452
-
\??\c:\pjdpp.exec:\pjdpp.exe191⤵PID:3620
-
\??\c:\9jjdv.exec:\9jjdv.exe192⤵PID:748
-
\??\c:\xflffxx.exec:\xflffxx.exe193⤵PID:4292
-
\??\c:\xflffff.exec:\xflffff.exe194⤵PID:3048
-
\??\c:\3tbbth.exec:\3tbbth.exe195⤵PID:668
-
\??\c:\9vpvp.exec:\9vpvp.exe196⤵PID:1516
-
\??\c:\vjjdv.exec:\vjjdv.exe197⤵PID:2172
-
\??\c:\rfxrllf.exec:\rfxrllf.exe198⤵PID:4232
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe199⤵PID:4748
-
\??\c:\htbtnn.exec:\htbtnn.exe200⤵PID:1892
-
\??\c:\7tbthh.exec:\7tbthh.exe201⤵PID:2656
-
\??\c:\vpjjd.exec:\vpjjd.exe202⤵PID:836
-
\??\c:\vvjjd.exec:\vvjjd.exe203⤵PID:2956
-
\??\c:\xxfffrl.exec:\xxfffrl.exe204⤵PID:4804
-
\??\c:\bthbbt.exec:\bthbbt.exe205⤵PID:3656
-
\??\c:\hhbtnh.exec:\hhbtnh.exe206⤵PID:4004
-
\??\c:\nhnhnn.exec:\nhnhnn.exe207⤵PID:1124
-
\??\c:\dppjd.exec:\dppjd.exe208⤵PID:4416
-
\??\c:\jpppj.exec:\jpppj.exe209⤵PID:1320
-
\??\c:\7xlflrl.exec:\7xlflrl.exe210⤵PID:1864
-
\??\c:\1llxrxr.exec:\1llxrxr.exe211⤵PID:2316
-
\??\c:\1btnhn.exec:\1btnhn.exe212⤵PID:4172
-
\??\c:\tnnhhh.exec:\tnnhhh.exe213⤵PID:5068
-
\??\c:\vdvdv.exec:\vdvdv.exe214⤵PID:5092
-
\??\c:\jdddd.exec:\jdddd.exe215⤵PID:3960
-
\??\c:\5xlfxlf.exec:\5xlfxlf.exe216⤵PID:2852
-
\??\c:\lflffxf.exec:\lflffxf.exe217⤵PID:1988
-
\??\c:\bthhhh.exec:\bthhhh.exe218⤵PID:2148
-
\??\c:\3hbttt.exec:\3hbttt.exe219⤵PID:3976
-
\??\c:\jpdvv.exec:\jpdvv.exe220⤵PID:4660
-
\??\c:\fxrllxx.exec:\fxrllxx.exe221⤵PID:5032
-
\??\c:\lfxrrlf.exec:\lfxrrlf.exe222⤵PID:3552
-
\??\c:\ttnhhh.exec:\ttnhhh.exe223⤵PID:4320
-
\??\c:\tbbbtn.exec:\tbbbtn.exe224⤵PID:5044
-
\??\c:\vddvv.exec:\vddvv.exe225⤵PID:696
-
\??\c:\dvpvj.exec:\dvpvj.exe226⤵PID:5028
-
\??\c:\xxxlfll.exec:\xxxlfll.exe227⤵PID:1992
-
\??\c:\flrxrrr.exec:\flrxrrr.exe228⤵PID:1688
-
\??\c:\hbtbth.exec:\hbtbth.exe229⤵PID:2344
-
\??\c:\bhhhbt.exec:\bhhhbt.exe230⤵PID:1488
-
\??\c:\jjvvp.exec:\jjvvp.exe231⤵PID:3892
-
\??\c:\dddjv.exec:\dddjv.exe232⤵PID:1528
-
\??\c:\5rrlxxl.exec:\5rrlxxl.exe233⤵PID:1660
-
\??\c:\fxffxxx.exec:\fxffxxx.exe234⤵PID:672
-
\??\c:\hnttnn.exec:\hnttnn.exe235⤵PID:4360
-
\??\c:\thhbhb.exec:\thhbhb.exe236⤵PID:3184
-
\??\c:\7djdd.exec:\7djdd.exe237⤵PID:2652
-
\??\c:\pjvjp.exec:\pjvjp.exe238⤵PID:796
-
\??\c:\lxffxrl.exec:\lxffxrl.exe239⤵PID:3444
-
\??\c:\xffxrrl.exec:\xffxrrl.exe240⤵PID:1892
-
\??\c:\3htbbb.exec:\3htbbb.exe241⤵PID:2672
-
\??\c:\bttnnn.exec:\bttnnn.exe242⤵PID:2368