Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:48
Behavioral task
behavioral1
Sample
dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe
-
Size
381KB
-
MD5
dad2431345d7e61d55a2e4a69e902720
-
SHA1
94881c945d6be30862da879b32c6318adfc9fa48
-
SHA256
6900f28781067588417c16eda6cee5fc1529822817e0d334c923f7527911699a
-
SHA512
d528a2c0384054b586b70a76ff3247277c5f7216f6814f199ad3b7e6019090aa923b3f73910047e5b85a001f96cbf0d63e4513ce268d265f6e681d0fcf39061c
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0IbswYTl:y4wFHoS3eFaKHpNKbbswel
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/920-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1096-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3520-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1028-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/100-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-602-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-622-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-712-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1656-758-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-774-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-799-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-884-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
btbtnn.exelxfflff.exerxxxllx.exelrrlfxr.exe7ddvd.exelrxxffl.exejjpvv.exexrrxrfx.exentnbtb.exe1rxrlff.exetbbbbh.exejjjdd.exenhnhhh.exedjjdv.exerxffxff.exehhnhhn.exedvvpj.exelffxllf.exetntnnh.exenbhnhn.exedvddv.exexrrrxlr.exetnbthb.exentnbbt.exevjdpj.exehbthtt.exedddpv.exefrlxrlf.exevjvvj.exelxffxfx.exethnhbh.exeppvpj.exelxrlffx.exethhbtn.exedvjvj.exejvpdv.exefrxrlfx.exennnnbb.exevjjvp.exevpvpv.exefrfxrrl.exebnbttn.exenhtnnh.exe5pjjj.exerffrxxr.exe9xxrlfr.exehbnhbt.exedppjd.exexllfxxr.exe3xrlfxf.exenbttnh.exejvvpj.exepddpj.exexlrllfx.exebhbhhh.exenhbnhn.exevppvp.exe1ddpd.exerrlxllf.exehbthbh.exedpjpd.exepdjvd.exexrllfxr.exetttnbb.exepid process 1096 btbtnn.exe 1056 lxfflff.exe 4528 rxxxllx.exe 3220 lrrlfxr.exe 1236 7ddvd.exe 4492 lrxxffl.exe 3520 jjpvv.exe 2356 xrrxrfx.exe 4556 ntnbtb.exe 4188 1rxrlff.exe 4120 tbbbbh.exe 1648 jjjdd.exe 3384 nhnhhh.exe 3068 djjdv.exe 4948 rxffxff.exe 1040 hhnhhn.exe 4720 dvvpj.exe 2712 lffxllf.exe 1672 tntnnh.exe 4508 nbhnhn.exe 1028 dvddv.exe 1768 xrrrxlr.exe 3492 tnbthb.exe 4712 ntnbbt.exe 2496 vjdpj.exe 4140 hbthtt.exe 4132 dddpv.exe 2428 frlxrlf.exe 4244 vjvvj.exe 3596 lxffxfx.exe 1164 thnhbh.exe 3364 ppvpj.exe 2060 lxrlffx.exe 1520 thhbtn.exe 4404 dvjvj.exe 4824 jvpdv.exe 4068 frxrlfx.exe 2796 nnnnbb.exe 4812 vjjvp.exe 4528 vpvpv.exe 372 frfxrrl.exe 2744 bnbttn.exe 2616 nhtnnh.exe 4952 5pjjj.exe 4900 rffrxxr.exe 640 9xxrlfr.exe 2452 hbnhbt.exe 1660 dppjd.exe 3856 xllfxxr.exe 100 3xrlfxf.exe 3260 nbttnh.exe 3420 jvvpj.exe 4568 pddpj.exe 1844 xlrllfx.exe 2016 bhbhhh.exe 3068 nhbnhn.exe 2512 vppvp.exe 3708 1ddpd.exe 2564 rrlxllf.exe 4516 hbthbh.exe 4476 dpjpd.exe 4680 pdjvd.exe 1792 xrllfxr.exe 3588 tttnbb.exe -
Processes:
resource yara_rule behavioral2/memory/920-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbtnn.exe upx behavioral2/memory/920-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1096-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxfflff.exe upx behavioral2/memory/1096-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1056-14-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxxxllx.exe upx behavioral2/memory/4528-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrrlfxr.exe upx behavioral2/memory/4528-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1236-31-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7ddvd.exe upx behavioral2/memory/3220-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrxxffl.exe upx behavioral2/memory/1236-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjpvv.exe upx behavioral2/memory/4492-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3520-45-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrxrfx.exe upx C:\ntnbtb.exe upx behavioral2/memory/2356-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1rxrlff.exe upx behavioral2/memory/4556-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbbbbh.exe upx behavioral2/memory/4188-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjdd.exe upx C:\nhnhhh.exe upx C:\djjdv.exe upx C:\rxffxff.exe upx C:\hhnhhn.exe upx C:\dvvpj.exe upx behavioral2/memory/1040-98-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lffxllf.exe upx \??\c:\tntnnh.exe upx \??\c:\nbhnhn.exe upx behavioral2/memory/2712-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4720-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4508-119-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvddv.exe upx C:\xrrrxlr.exe upx behavioral2/memory/1028-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1768-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbthb.exe upx \??\c:\ntnbbt.exe upx behavioral2/memory/3492-135-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjdpj.exe upx behavioral2/memory/2496-148-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbthtt.exe upx C:\dddpv.exe upx \??\c:\frlxrlf.exe upx behavioral2/memory/2428-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjvvj.exe upx C:\lxffxfx.exe upx behavioral2/memory/4244-171-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thnhbh.exe upx behavioral2/memory/1164-178-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppvpj.exe upx behavioral2/memory/1520-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4404-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4404-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4824-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2796-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4812-212-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exebtbtnn.exelxfflff.exerxxxllx.exelrrlfxr.exe7ddvd.exelrxxffl.exejjpvv.exexrrxrfx.exentnbtb.exe1rxrlff.exetbbbbh.exejjjdd.exenhnhhh.exedjjdv.exerxffxff.exehhnhhn.exedvvpj.exelffxllf.exetntnnh.exenbhnhn.exedvddv.exedescription pid process target process PID 920 wrote to memory of 1096 920 dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe btbtnn.exe PID 920 wrote to memory of 1096 920 dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe btbtnn.exe PID 920 wrote to memory of 1096 920 dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe btbtnn.exe PID 1096 wrote to memory of 1056 1096 btbtnn.exe lxfflff.exe PID 1096 wrote to memory of 1056 1096 btbtnn.exe lxfflff.exe PID 1096 wrote to memory of 1056 1096 btbtnn.exe lxfflff.exe PID 1056 wrote to memory of 4528 1056 lxfflff.exe rxxxllx.exe PID 1056 wrote to memory of 4528 1056 lxfflff.exe rxxxllx.exe PID 1056 wrote to memory of 4528 1056 lxfflff.exe rxxxllx.exe PID 4528 wrote to memory of 3220 4528 rxxxllx.exe lrrlfxr.exe PID 4528 wrote to memory of 3220 4528 rxxxllx.exe lrrlfxr.exe PID 4528 wrote to memory of 3220 4528 rxxxllx.exe lrrlfxr.exe PID 3220 wrote to memory of 1236 3220 lrrlfxr.exe 7ddvd.exe PID 3220 wrote to memory of 1236 3220 lrrlfxr.exe 7ddvd.exe PID 3220 wrote to memory of 1236 3220 lrrlfxr.exe 7ddvd.exe PID 1236 wrote to memory of 4492 1236 7ddvd.exe lrxxffl.exe PID 1236 wrote to memory of 4492 1236 7ddvd.exe lrxxffl.exe PID 1236 wrote to memory of 4492 1236 7ddvd.exe lrxxffl.exe PID 4492 wrote to memory of 3520 4492 lrxxffl.exe jjpvv.exe PID 4492 wrote to memory of 3520 4492 lrxxffl.exe jjpvv.exe PID 4492 wrote to memory of 3520 4492 lrxxffl.exe jjpvv.exe PID 3520 wrote to memory of 2356 3520 jjpvv.exe xrrxrfx.exe PID 3520 wrote to memory of 2356 3520 jjpvv.exe xrrxrfx.exe PID 3520 wrote to memory of 2356 3520 jjpvv.exe xrrxrfx.exe PID 2356 wrote to memory of 4556 2356 xrrxrfx.exe ntnbtb.exe PID 2356 wrote to memory of 4556 2356 xrrxrfx.exe ntnbtb.exe PID 2356 wrote to memory of 4556 2356 xrrxrfx.exe ntnbtb.exe PID 4556 wrote to memory of 4188 4556 ntnbtb.exe 1rxrlff.exe PID 4556 wrote to memory of 4188 4556 ntnbtb.exe 1rxrlff.exe PID 4556 wrote to memory of 4188 4556 ntnbtb.exe 1rxrlff.exe PID 4188 wrote to memory of 4120 4188 1rxrlff.exe tbbbbh.exe PID 4188 wrote to memory of 4120 4188 1rxrlff.exe tbbbbh.exe PID 4188 wrote to memory of 4120 4188 1rxrlff.exe tbbbbh.exe PID 4120 wrote to memory of 1648 4120 tbbbbh.exe jjjdd.exe PID 4120 wrote to memory of 1648 4120 tbbbbh.exe jjjdd.exe PID 4120 wrote to memory of 1648 4120 tbbbbh.exe jjjdd.exe PID 1648 wrote to memory of 3384 1648 jjjdd.exe nhnhhh.exe PID 1648 wrote to memory of 3384 1648 jjjdd.exe nhnhhh.exe PID 1648 wrote to memory of 3384 1648 jjjdd.exe nhnhhh.exe PID 3384 wrote to memory of 3068 3384 nhnhhh.exe djjdv.exe PID 3384 wrote to memory of 3068 3384 nhnhhh.exe djjdv.exe PID 3384 wrote to memory of 3068 3384 nhnhhh.exe djjdv.exe PID 3068 wrote to memory of 4948 3068 djjdv.exe rxffxff.exe PID 3068 wrote to memory of 4948 3068 djjdv.exe rxffxff.exe PID 3068 wrote to memory of 4948 3068 djjdv.exe rxffxff.exe PID 4948 wrote to memory of 1040 4948 rxffxff.exe hhnhhn.exe PID 4948 wrote to memory of 1040 4948 rxffxff.exe hhnhhn.exe PID 4948 wrote to memory of 1040 4948 rxffxff.exe hhnhhn.exe PID 1040 wrote to memory of 4720 1040 hhnhhn.exe dvvpj.exe PID 1040 wrote to memory of 4720 1040 hhnhhn.exe dvvpj.exe PID 1040 wrote to memory of 4720 1040 hhnhhn.exe dvvpj.exe PID 4720 wrote to memory of 2712 4720 dvvpj.exe lffxllf.exe PID 4720 wrote to memory of 2712 4720 dvvpj.exe lffxllf.exe PID 4720 wrote to memory of 2712 4720 dvvpj.exe lffxllf.exe PID 2712 wrote to memory of 1672 2712 lffxllf.exe tntnnh.exe PID 2712 wrote to memory of 1672 2712 lffxllf.exe tntnnh.exe PID 2712 wrote to memory of 1672 2712 lffxllf.exe tntnnh.exe PID 1672 wrote to memory of 4508 1672 tntnnh.exe nbhnhn.exe PID 1672 wrote to memory of 4508 1672 tntnnh.exe nbhnhn.exe PID 1672 wrote to memory of 4508 1672 tntnnh.exe nbhnhn.exe PID 4508 wrote to memory of 1028 4508 nbhnhn.exe dvddv.exe PID 4508 wrote to memory of 1028 4508 nbhnhn.exe dvddv.exe PID 4508 wrote to memory of 1028 4508 nbhnhn.exe dvddv.exe PID 1028 wrote to memory of 1768 1028 dvddv.exe xrrrxlr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\btbtnn.exec:\btbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\lxfflff.exec:\lxfflff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\rxxxllx.exec:\rxxxllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\7ddvd.exec:\7ddvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\lrxxffl.exec:\lrxxffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\jjpvv.exec:\jjpvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\xrrxrfx.exec:\xrrxrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ntnbtb.exec:\ntnbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\1rxrlff.exec:\1rxrlff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\tbbbbh.exec:\tbbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\jjjdd.exec:\jjjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\nhnhhh.exec:\nhnhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\djjdv.exec:\djjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\rxffxff.exec:\rxffxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\hhnhhn.exec:\hhnhhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\dvvpj.exec:\dvvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\lffxllf.exec:\lffxllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\tntnnh.exec:\tntnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\nbhnhn.exec:\nbhnhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\dvddv.exec:\dvddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\xrrrxlr.exec:\xrrrxlr.exe23⤵
- Executes dropped EXE
PID:1768 -
\??\c:\tnbthb.exec:\tnbthb.exe24⤵
- Executes dropped EXE
PID:3492 -
\??\c:\ntnbbt.exec:\ntnbbt.exe25⤵
- Executes dropped EXE
PID:4712 -
\??\c:\vjdpj.exec:\vjdpj.exe26⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hbthtt.exec:\hbthtt.exe27⤵
- Executes dropped EXE
PID:4140 -
\??\c:\dddpv.exec:\dddpv.exe28⤵
- Executes dropped EXE
PID:4132 -
\??\c:\frlxrlf.exec:\frlxrlf.exe29⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vjvvj.exec:\vjvvj.exe30⤵
- Executes dropped EXE
PID:4244 -
\??\c:\lxffxfx.exec:\lxffxfx.exe31⤵
- Executes dropped EXE
PID:3596 -
\??\c:\thnhbh.exec:\thnhbh.exe32⤵
- Executes dropped EXE
PID:1164 -
\??\c:\ppvpj.exec:\ppvpj.exe33⤵
- Executes dropped EXE
PID:3364 -
\??\c:\lxrlffx.exec:\lxrlffx.exe34⤵
- Executes dropped EXE
PID:2060 -
\??\c:\thhbtn.exec:\thhbtn.exe35⤵
- Executes dropped EXE
PID:1520 -
\??\c:\dvjvj.exec:\dvjvj.exe36⤵
- Executes dropped EXE
PID:4404 -
\??\c:\jvpdv.exec:\jvpdv.exe37⤵
- Executes dropped EXE
PID:4824 -
\??\c:\frxrlfx.exec:\frxrlfx.exe38⤵
- Executes dropped EXE
PID:4068 -
\??\c:\nnnnbb.exec:\nnnnbb.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vjjvp.exec:\vjjvp.exe40⤵
- Executes dropped EXE
PID:4812 -
\??\c:\vpvpv.exec:\vpvpv.exe41⤵
- Executes dropped EXE
PID:4528 -
\??\c:\frfxrrl.exec:\frfxrrl.exe42⤵
- Executes dropped EXE
PID:372 -
\??\c:\bnbttn.exec:\bnbttn.exe43⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nhtnnh.exec:\nhtnnh.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\5pjjj.exec:\5pjjj.exe45⤵
- Executes dropped EXE
PID:4952 -
\??\c:\rffrxxr.exec:\rffrxxr.exe46⤵
- Executes dropped EXE
PID:4900 -
\??\c:\9xxrlfr.exec:\9xxrlfr.exe47⤵
- Executes dropped EXE
PID:640 -
\??\c:\hbnhbt.exec:\hbnhbt.exe48⤵
- Executes dropped EXE
PID:2452 -
\??\c:\dppjd.exec:\dppjd.exe49⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xllfxxr.exec:\xllfxxr.exe50⤵
- Executes dropped EXE
PID:3856 -
\??\c:\3xrlfxf.exec:\3xrlfxf.exe51⤵
- Executes dropped EXE
PID:100 -
\??\c:\nbttnh.exec:\nbttnh.exe52⤵
- Executes dropped EXE
PID:3260 -
\??\c:\jvvpj.exec:\jvvpj.exe53⤵
- Executes dropped EXE
PID:3420 -
\??\c:\pddpj.exec:\pddpj.exe54⤵
- Executes dropped EXE
PID:4568 -
\??\c:\xlrllfx.exec:\xlrllfx.exe55⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bhbhhh.exec:\bhbhhh.exe56⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nhbnhn.exec:\nhbnhn.exe57⤵
- Executes dropped EXE
PID:3068 -
\??\c:\vppvp.exec:\vppvp.exe58⤵
- Executes dropped EXE
PID:2512 -
\??\c:\1ddpd.exec:\1ddpd.exe59⤵
- Executes dropped EXE
PID:3708 -
\??\c:\rrlxllf.exec:\rrlxllf.exe60⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hbthbh.exec:\hbthbh.exe61⤵
- Executes dropped EXE
PID:4516 -
\??\c:\dpjpd.exec:\dpjpd.exe62⤵
- Executes dropped EXE
PID:4476 -
\??\c:\pdjvd.exec:\pdjvd.exe63⤵
- Executes dropped EXE
PID:4680 -
\??\c:\xrllfxr.exec:\xrllfxr.exe64⤵
- Executes dropped EXE
PID:1792 -
\??\c:\tttnbb.exec:\tttnbb.exe65⤵
- Executes dropped EXE
PID:3588 -
\??\c:\nnhbtb.exec:\nnhbtb.exe66⤵PID:744
-
\??\c:\9dvpd.exec:\9dvpd.exe67⤵PID:3092
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe68⤵PID:1768
-
\??\c:\thhbnh.exec:\thhbnh.exe69⤵PID:3500
-
\??\c:\hbnhnb.exec:\hbnhnb.exe70⤵PID:4480
-
\??\c:\djpjd.exec:\djpjd.exe71⤵PID:3472
-
\??\c:\fxrxrrl.exec:\fxrxrrl.exe72⤵PID:3576
-
\??\c:\tnbhbb.exec:\tnbhbb.exe73⤵PID:3060
-
\??\c:\jjpjj.exec:\jjpjj.exe74⤵PID:4268
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe75⤵PID:2328
-
\??\c:\xffrfxr.exec:\xffrfxr.exe76⤵PID:2552
-
\??\c:\nbbbnt.exec:\nbbbnt.exe77⤵PID:3256
-
\??\c:\dppjd.exec:\dppjd.exe78⤵PID:1004
-
\??\c:\pdpjp.exec:\pdpjp.exe79⤵PID:4024
-
\??\c:\xfllfxl.exec:\xfllfxl.exe80⤵PID:2064
-
\??\c:\hbbbth.exec:\hbbbth.exe81⤵PID:5096
-
\??\c:\pvdpj.exec:\pvdpj.exe82⤵PID:5044
-
\??\c:\vdpjv.exec:\vdpjv.exe83⤵PID:4400
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe84⤵PID:1256
-
\??\c:\tnhbnn.exec:\tnhbnn.exe85⤵PID:4656
-
\??\c:\7ntnht.exec:\7ntnht.exe86⤵PID:2676
-
\??\c:\dpjvd.exec:\dpjvd.exe87⤵PID:1452
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe88⤵PID:3696
-
\??\c:\fllffff.exec:\fllffff.exe89⤵PID:4908
-
\??\c:\vpdvv.exec:\vpdvv.exe90⤵PID:372
-
\??\c:\xrlffrl.exec:\xrlffrl.exe91⤵PID:5000
-
\??\c:\tbhbtn.exec:\tbhbtn.exe92⤵PID:5056
-
\??\c:\hnnhtt.exec:\hnnhtt.exe93⤵PID:3812
-
\??\c:\pddpj.exec:\pddpj.exe94⤵PID:2192
-
\??\c:\xffllrl.exec:\xffllrl.exe95⤵PID:3520
-
\??\c:\fflrxlf.exec:\fflrxlf.exe96⤵PID:2456
-
\??\c:\btbbtb.exec:\btbbtb.exe97⤵PID:4556
-
\??\c:\ddppv.exec:\ddppv.exe98⤵PID:2080
-
\??\c:\jdvpv.exec:\jdvpv.exe99⤵PID:4724
-
\??\c:\frfxrxx.exec:\frfxrxx.exe100⤵PID:4220
-
\??\c:\bhnhbb.exec:\bhnhbb.exe101⤵PID:3296
-
\??\c:\pjvpd.exec:\pjvpd.exe102⤵PID:3980
-
\??\c:\dpjdv.exec:\dpjdv.exe103⤵PID:5116
-
\??\c:\5llffxx.exec:\5llffxx.exe104⤵PID:2384
-
\??\c:\lrffxxx.exec:\lrffxxx.exe105⤵PID:3184
-
\??\c:\thhhbb.exec:\thhhbb.exe106⤵PID:2808
-
\??\c:\djppp.exec:\djppp.exe107⤵PID:5048
-
\??\c:\vjjdv.exec:\vjjdv.exe108⤵PID:764
-
\??\c:\lxfxrll.exec:\lxfxrll.exe109⤵PID:4476
-
\??\c:\btbbtn.exec:\btbbtn.exe110⤵PID:3924
-
\??\c:\jdvdv.exec:\jdvdv.exe111⤵PID:1564
-
\??\c:\vvddd.exec:\vvddd.exe112⤵PID:924
-
\??\c:\ffllfxr.exec:\ffllfxr.exe113⤵PID:436
-
\??\c:\tntnhh.exec:\tntnhh.exe114⤵PID:3804
-
\??\c:\djdvp.exec:\djdvp.exe115⤵PID:2504
-
\??\c:\jdvpd.exec:\jdvpd.exe116⤵PID:1996
-
\??\c:\xxlrrll.exec:\xxlrrll.exe117⤵PID:2428
-
\??\c:\nhnnhh.exec:\nhnnhh.exe118⤵PID:2952
-
\??\c:\vpvpv.exec:\vpvpv.exe119⤵PID:3256
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe120⤵PID:1004
-
\??\c:\ffxrlll.exec:\ffxrlll.exe121⤵PID:464
-
\??\c:\nhnnhh.exec:\nhnnhh.exe122⤵PID:2772
-
\??\c:\btnttn.exec:\btnttn.exe123⤵PID:5096
-
\??\c:\vjdvv.exec:\vjdvv.exe124⤵PID:5044
-
\??\c:\1flfxrf.exec:\1flfxrf.exe125⤵PID:2368
-
\??\c:\rlxrllr.exec:\rlxrllr.exe126⤵PID:4404
-
\??\c:\tnttnh.exec:\tnttnh.exe127⤵PID:752
-
\??\c:\dvppj.exec:\dvppj.exe128⤵PID:1408
-
\??\c:\ffrxrlr.exec:\ffrxrlr.exe129⤵PID:1056
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe130⤵PID:624
-
\??\c:\thbhbb.exec:\thbhbb.exe131⤵PID:4192
-
\??\c:\vdjvd.exec:\vdjvd.exe132⤵PID:372
-
\??\c:\vdvjd.exec:\vdvjd.exe133⤵PID:2852
-
\??\c:\1flrlfx.exec:\1flrlfx.exe134⤵PID:668
-
\??\c:\hbnhnh.exec:\hbnhnh.exe135⤵PID:3812
-
\??\c:\pjpjv.exec:\pjpjv.exe136⤵PID:4464
-
\??\c:\9jjdv.exec:\9jjdv.exe137⤵PID:4828
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe138⤵PID:2112
-
\??\c:\tnhhbn.exec:\tnhhbn.exe139⤵PID:3104
-
\??\c:\5thbnn.exec:\5thbnn.exe140⤵PID:5060
-
\??\c:\vjvvp.exec:\vjvvp.exe141⤵PID:4724
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe142⤵PID:3416
-
\??\c:\frxrlfl.exec:\frxrlfl.exe143⤵PID:2188
-
\??\c:\nbhbtn.exec:\nbhbtn.exe144⤵PID:1060
-
\??\c:\vjvjp.exec:\vjvjp.exe145⤵PID:3068
-
\??\c:\rlrllrf.exec:\rlrllrf.exe146⤵PID:4948
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe147⤵PID:3244
-
\??\c:\ttnntt.exec:\ttnntt.exe148⤵PID:1672
-
\??\c:\jjvpv.exec:\jjvpv.exe149⤵PID:3212
-
\??\c:\vvdpp.exec:\vvdpp.exe150⤵PID:3140
-
\??\c:\xxxrlff.exec:\xxxrlff.exe151⤵PID:2584
-
\??\c:\htttnh.exec:\htttnh.exe152⤵PID:5064
-
\??\c:\vjddv.exec:\vjddv.exe153⤵PID:1564
-
\??\c:\3djvp.exec:\3djvp.exe154⤵PID:924
-
\??\c:\xrllffx.exec:\xrllffx.exe155⤵PID:4224
-
\??\c:\5ttnhh.exec:\5ttnhh.exe156⤵PID:4992
-
\??\c:\tntnhh.exec:\tntnhh.exe157⤵PID:2500
-
\??\c:\lrxlfxf.exec:\lrxlfxf.exe158⤵PID:3548
-
\??\c:\5tbtnn.exec:\5tbtnn.exe159⤵PID:2980
-
\??\c:\nhbbtt.exec:\nhbbtt.exe160⤵PID:4864
-
\??\c:\5vjdv.exec:\5vjdv.exe161⤵PID:4592
-
\??\c:\rfffffx.exec:\rfffffx.exe162⤵PID:992
-
\??\c:\hbbbbt.exec:\hbbbbt.exe163⤵PID:232
-
\??\c:\bnnhtt.exec:\bnnhtt.exe164⤵PID:4388
-
\??\c:\ddjjd.exec:\ddjjd.exe165⤵PID:5096
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe166⤵PID:5044
-
\??\c:\rxrxxrr.exec:\rxrxxrr.exe167⤵PID:4824
-
\??\c:\nhhhbb.exec:\nhhhbb.exe168⤵PID:2968
-
\??\c:\3hbthn.exec:\3hbthn.exe169⤵PID:2676
-
\??\c:\pvvvp.exec:\pvvvp.exe170⤵PID:4528
-
\??\c:\ffrrxrf.exec:\ffrrxrf.exe171⤵PID:3696
-
\??\c:\rxrlxlr.exec:\rxrlxlr.exe172⤵PID:2744
-
\??\c:\5bthbb.exec:\5bthbb.exe173⤵PID:4804
-
\??\c:\jpdvv.exec:\jpdvv.exe174⤵PID:4040
-
\??\c:\1ddpj.exec:\1ddpj.exe175⤵PID:4008
-
\??\c:\fllxffr.exec:\fllxffr.exe176⤵PID:4464
-
\??\c:\tthbbt.exec:\tthbbt.exe177⤵PID:2052
-
\??\c:\nbbtnh.exec:\nbbtnh.exe178⤵PID:2112
-
\??\c:\dpdjd.exec:\dpdjd.exe179⤵PID:100
-
\??\c:\pdjjd.exec:\pdjjd.exe180⤵PID:1268
-
\??\c:\llrlffr.exec:\llrlffr.exe181⤵PID:3156
-
\??\c:\xrrrrll.exec:\xrrrrll.exe182⤵PID:1460
-
\??\c:\htbtnn.exec:\htbtnn.exe183⤵PID:4540
-
\??\c:\vvjdv.exec:\vvjdv.exe184⤵PID:5116
-
\??\c:\jjjdp.exec:\jjjdp.exe185⤵PID:2512
-
\??\c:\xllfxxl.exec:\xllfxxl.exe186⤵PID:3184
-
\??\c:\ttbtnn.exec:\ttbtnn.exe187⤵PID:3860
-
\??\c:\jpvpj.exec:\jpvpj.exe188⤵PID:5108
-
\??\c:\vddvp.exec:\vddvp.exe189⤵PID:2296
-
\??\c:\rrfrrxx.exec:\rrfrrxx.exe190⤵PID:3140
-
\??\c:\tttnhb.exec:\tttnhb.exe191⤵PID:3540
-
\??\c:\btbtnb.exec:\btbtnb.exe192⤵PID:1160
-
\??\c:\pjdvp.exec:\pjdvp.exe193⤵PID:4532
-
\??\c:\lffxxrr.exec:\lffxxrr.exe194⤵PID:924
-
\??\c:\rllfllf.exec:\rllfllf.exe195⤵PID:4224
-
\??\c:\hnnthh.exec:\hnnthh.exe196⤵PID:4268
-
\??\c:\vppjj.exec:\vppjj.exe197⤵PID:3228
-
\??\c:\frxlxrx.exec:\frxlxrx.exe198⤵PID:3548
-
\??\c:\xflxrrf.exec:\xflxrrf.exe199⤵PID:3256
-
\??\c:\bhnhht.exec:\bhnhht.exe200⤵PID:4864
-
\??\c:\dpjdv.exec:\dpjdv.exe201⤵PID:2060
-
\??\c:\jdppv.exec:\jdppv.exe202⤵PID:4652
-
\??\c:\xrxlfrl.exec:\xrxlfrl.exe203⤵PID:232
-
\??\c:\rfrllrx.exec:\rfrllrx.exe204⤵PID:4072
-
\??\c:\bnbbhh.exec:\bnbbhh.exe205⤵PID:2368
-
\??\c:\vjjdv.exec:\vjjdv.exe206⤵PID:1656
-
\??\c:\5djjd.exec:\5djjd.exe207⤵PID:3484
-
\??\c:\fxlxrlr.exec:\fxlxrlr.exe208⤵PID:2912
-
\??\c:\ntbbtt.exec:\ntbbtt.exe209⤵PID:4952
-
\??\c:\ntbtnh.exec:\ntbtnh.exe210⤵PID:4492
-
\??\c:\pdjvp.exec:\pdjvp.exe211⤵PID:4960
-
\??\c:\rfffxll.exec:\rfffxll.exe212⤵PID:4028
-
\??\c:\nbnbtn.exec:\nbnbtn.exe213⤵PID:1660
-
\??\c:\1bhbhh.exec:\1bhbhh.exe214⤵PID:4340
-
\??\c:\1ppjd.exec:\1ppjd.exe215⤵PID:2208
-
\??\c:\xllfxxr.exec:\xllfxxr.exe216⤵PID:2776
-
\??\c:\lflfxlf.exec:\lflfxlf.exe217⤵PID:4748
-
\??\c:\nttnbb.exec:\nttnbb.exe218⤵PID:4724
-
\??\c:\jddvj.exec:\jddvj.exe219⤵PID:3416
-
\??\c:\pvddj.exec:\pvddj.exe220⤵PID:3504
-
\??\c:\xrxlffx.exec:\xrxlffx.exe221⤵PID:4396
-
\??\c:\thhhhh.exec:\thhhhh.exe222⤵PID:2384
-
\??\c:\tthbhh.exec:\tthbhh.exe223⤵PID:1544
-
\??\c:\9jjdv.exec:\9jjdv.exe224⤵PID:3184
-
\??\c:\vvpvp.exec:\vvpvp.exe225⤵PID:3860
-
\??\c:\llrllrx.exec:\llrllrx.exe226⤵PID:3212
-
\??\c:\tnnhbt.exec:\tnnhbt.exe227⤵PID:5080
-
\??\c:\vdvvv.exec:\vdvvv.exe228⤵PID:2812
-
\??\c:\pvjdp.exec:\pvjdp.exe229⤵PID:1564
-
\??\c:\fxlffff.exec:\fxlffff.exe230⤵PID:1160
-
\??\c:\tntnbn.exec:\tntnbn.exe231⤵PID:4184
-
\??\c:\hnnbtn.exec:\hnnbtn.exe232⤵PID:924
-
\??\c:\3jpjv.exec:\3jpjv.exe233⤵PID:2404
-
\??\c:\5rxrfxf.exec:\5rxrfxf.exe234⤵PID:2940
-
\??\c:\thhbtb.exec:\thhbtb.exe235⤵PID:2952
-
\??\c:\dvvvp.exec:\dvvvp.exe236⤵PID:3688
-
\??\c:\vdjjv.exec:\vdjjv.exe237⤵PID:1004
-
\??\c:\lxlxfxf.exec:\lxlxfxf.exe238⤵PID:4864
-
\??\c:\nbbtnn.exec:\nbbtnn.exe239⤵PID:4508
-
\??\c:\jddpj.exec:\jddpj.exe240⤵PID:4592
-
\??\c:\ppvpd.exec:\ppvpd.exe241⤵PID:2772
-
\??\c:\frrfrlx.exec:\frrfrlx.exe242⤵PID:4984