Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa7d31d9257c14d8ee133014f4e4f950_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
aa7d31d9257c14d8ee133014f4e4f950_NeikiAnalytics.exe
-
Size
275KB
-
MD5
aa7d31d9257c14d8ee133014f4e4f950
-
SHA1
003d44b87fe0553af83ade1c1969f39e72b6a19a
-
SHA256
3365078b6169eee2d1fd9d01a5dec4313607c27e87528ef925e4d309f2e5865b
-
SHA512
34af5a7130e3b8e95ddecebcc1d3d1d952f53b24722cbebc346b5695762c773760d332b3d41f7666200af5a0abff74ae7c4c8ea813607eb9d80e5d88f6eef0bc
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTF6:8cm7ImGddXmNt251UriZF6
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
Processes:
resource yara_rule behavioral1/memory/2088-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-683-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/784-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-886-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-925-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/680-1074-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2376-1106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-1113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-1168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-1175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-1178-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1368-1233-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5tthtn.exe5btnbn.exejvppv.exellflfrf.exeffrrrxx.exe5xfxxlx.exennhntb.exe7djvv.exerllrfrf.exehbbtbb.exe1pjpd.exevjvpv.exebbnbtb.exenntbnn.exedvvjp.exerllxrrl.exebbbhtn.exevdpdj.exerrfrxlr.exe5nbnht.exevvpvj.exexrrrrxx.exe5bbnhh.exenbtttt.exe7fxlrff.exebnhtbn.exevjdjp.exerlfrrrx.exe3tbbtb.exedpjvd.exexlrxfxf.exehbtbbb.exe3pvpp.exe9vjjj.exexxxxxfr.exe3tnnht.exehthnnt.exe1vpdv.exerlfxllr.exehhtbnh.exebnbbnt.exedpjjj.exerlxxlrf.exefxlxlxl.exebthntn.exehbhhnn.exe1jdpp.exerfrxxfl.exelfxxlrf.exebnnhhn.exejjpdv.exejvdpp.exelxrrrxf.exenhnntb.exe7bnthn.exevjdvv.exejjvjp.exe7xlxfxx.exetntbhn.exehtbbnn.exedvdvv.exevvdjv.exerllrxxl.exe7tntbh.exepid process 2164 5tthtn.exe 2948 5btnbn.exe 1704 jvppv.exe 2572 llflfrf.exe 2736 ffrrrxx.exe 2896 5xfxxlx.exe 2868 nnhntb.exe 2556 7djvv.exe 2464 rllrfrf.exe 2876 hbbtbb.exe 2052 1pjpd.exe 2968 vjvpv.exe 960 bbnbtb.exe 2704 nntbnn.exe 1468 dvvjp.exe 2432 rllxrrl.exe 2864 bbbhtn.exe 1612 vdpdj.exe 3020 rrfrxlr.exe 3036 5nbnht.exe 2304 vvpvj.exe 2064 xrrrrxx.exe 700 5bbnhh.exe 276 nbtttt.exe 2056 7fxlrff.exe 1544 bnhtbn.exe 1168 vjdjp.exe 1904 rlfrrrx.exe 1156 3tbbtb.exe 1768 dpjvd.exe 2204 xlrxfxf.exe 2920 hbtbbb.exe 1732 3pvpp.exe 2216 9vjjj.exe 2208 xxxxxfr.exe 2888 3tnnht.exe 3064 hthnnt.exe 2636 1vpdv.exe 1684 rlfxllr.exe 2548 hhtbnh.exe 2732 bnbbnt.exe 2724 dpjjj.exe 2468 rlxxlrf.exe 2856 fxlxlxl.exe 2660 bthntn.exe 2488 hbhhnn.exe 2992 1jdpp.exe 2504 rfrxxfl.exe 1176 lfxxlrf.exe 2692 bnnhhn.exe 2968 jjpdv.exe 2668 jvdpp.exe 2704 lxrrrxf.exe 1468 nhnntb.exe 2976 7bnthn.exe 1728 vjdvv.exe 1624 jjvjp.exe 1708 7xlxfxx.exe 2224 tntbhn.exe 2316 htbbnn.exe 1944 dvdvv.exe 2844 vvdjv.exe 2064 rllrxxl.exe 680 7tntbh.exe -
Processes:
resource yara_rule behavioral1/memory/2088-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-723-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/784-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-828-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-879-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-925-0x0000000000220000-0x000000000024A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aa7d31d9257c14d8ee133014f4e4f950_NeikiAnalytics.exe5tthtn.exe5btnbn.exejvppv.exellflfrf.exeffrrrxx.exe5xfxxlx.exennhntb.exe7djvv.exerllrfrf.exehbbtbb.exe1pjpd.exevjvpv.exebbnbtb.exenntbnn.exedvvjp.exedescription pid process target process PID 2088 wrote to memory of 2164 2088 aa7d31d9257c14d8ee133014f4e4f950_NeikiAnalytics.exe 5tthtn.exe PID 2088 wrote to memory of 2164 2088 aa7d31d9257c14d8ee133014f4e4f950_NeikiAnalytics.exe 5tthtn.exe PID 2088 wrote to memory of 2164 2088 aa7d31d9257c14d8ee133014f4e4f950_NeikiAnalytics.exe 5tthtn.exe PID 2088 wrote to memory of 2164 2088 aa7d31d9257c14d8ee133014f4e4f950_NeikiAnalytics.exe 5tthtn.exe PID 2164 wrote to memory of 2948 2164 5tthtn.exe 5btnbn.exe PID 2164 wrote to memory of 2948 2164 5tthtn.exe 5btnbn.exe PID 2164 wrote to memory of 2948 2164 5tthtn.exe 5btnbn.exe PID 2164 wrote to memory of 2948 2164 5tthtn.exe 5btnbn.exe PID 2948 wrote to memory of 1704 2948 5btnbn.exe jvppv.exe PID 2948 wrote to memory of 1704 2948 5btnbn.exe jvppv.exe PID 2948 wrote to memory of 1704 2948 5btnbn.exe jvppv.exe PID 2948 wrote to memory of 1704 2948 5btnbn.exe jvppv.exe PID 1704 wrote to memory of 2572 1704 jvppv.exe llflfrf.exe PID 1704 wrote to memory of 2572 1704 jvppv.exe llflfrf.exe PID 1704 wrote to memory of 2572 1704 jvppv.exe llflfrf.exe PID 1704 wrote to memory of 2572 1704 jvppv.exe llflfrf.exe PID 2572 wrote to memory of 2736 2572 llflfrf.exe ffrrrxx.exe PID 2572 wrote to memory of 2736 2572 llflfrf.exe ffrrrxx.exe PID 2572 wrote to memory of 2736 2572 llflfrf.exe ffrrrxx.exe PID 2572 wrote to memory of 2736 2572 llflfrf.exe ffrrrxx.exe PID 2736 wrote to memory of 2896 2736 ffrrrxx.exe 5xfxxlx.exe PID 2736 wrote to memory of 2896 2736 ffrrrxx.exe 5xfxxlx.exe PID 2736 wrote to memory of 2896 2736 ffrrrxx.exe 5xfxxlx.exe PID 2736 wrote to memory of 2896 2736 ffrrrxx.exe 5xfxxlx.exe PID 2896 wrote to memory of 2868 2896 5xfxxlx.exe nnhntb.exe PID 2896 wrote to memory of 2868 2896 5xfxxlx.exe nnhntb.exe PID 2896 wrote to memory of 2868 2896 5xfxxlx.exe nnhntb.exe PID 2896 wrote to memory of 2868 2896 5xfxxlx.exe nnhntb.exe PID 2868 wrote to memory of 2556 2868 nnhntb.exe 7djvv.exe PID 2868 wrote to memory of 2556 2868 nnhntb.exe 7djvv.exe PID 2868 wrote to memory of 2556 2868 nnhntb.exe 7djvv.exe PID 2868 wrote to memory of 2556 2868 nnhntb.exe 7djvv.exe PID 2556 wrote to memory of 2464 2556 7djvv.exe rllrfrf.exe PID 2556 wrote to memory of 2464 2556 7djvv.exe rllrfrf.exe PID 2556 wrote to memory of 2464 2556 7djvv.exe rllrfrf.exe PID 2556 wrote to memory of 2464 2556 7djvv.exe rllrfrf.exe PID 2464 wrote to memory of 2876 2464 rllrfrf.exe hbbtbb.exe PID 2464 wrote to memory of 2876 2464 rllrfrf.exe hbbtbb.exe PID 2464 wrote to memory of 2876 2464 rllrfrf.exe hbbtbb.exe PID 2464 wrote to memory of 2876 2464 rllrfrf.exe hbbtbb.exe PID 2876 wrote to memory of 2052 2876 hbbtbb.exe 1pjpd.exe PID 2876 wrote to memory of 2052 2876 hbbtbb.exe 1pjpd.exe PID 2876 wrote to memory of 2052 2876 hbbtbb.exe 1pjpd.exe PID 2876 wrote to memory of 2052 2876 hbbtbb.exe 1pjpd.exe PID 2052 wrote to memory of 2968 2052 1pjpd.exe vjvpv.exe PID 2052 wrote to memory of 2968 2052 1pjpd.exe vjvpv.exe PID 2052 wrote to memory of 2968 2052 1pjpd.exe vjvpv.exe PID 2052 wrote to memory of 2968 2052 1pjpd.exe vjvpv.exe PID 2968 wrote to memory of 960 2968 vjvpv.exe bbnbtb.exe PID 2968 wrote to memory of 960 2968 vjvpv.exe bbnbtb.exe PID 2968 wrote to memory of 960 2968 vjvpv.exe bbnbtb.exe PID 2968 wrote to memory of 960 2968 vjvpv.exe bbnbtb.exe PID 960 wrote to memory of 2704 960 bbnbtb.exe nntbnn.exe PID 960 wrote to memory of 2704 960 bbnbtb.exe nntbnn.exe PID 960 wrote to memory of 2704 960 bbnbtb.exe nntbnn.exe PID 960 wrote to memory of 2704 960 bbnbtb.exe nntbnn.exe PID 2704 wrote to memory of 1468 2704 nntbnn.exe dvvjp.exe PID 2704 wrote to memory of 1468 2704 nntbnn.exe dvvjp.exe PID 2704 wrote to memory of 1468 2704 nntbnn.exe dvvjp.exe PID 2704 wrote to memory of 1468 2704 nntbnn.exe dvvjp.exe PID 1468 wrote to memory of 2432 1468 dvvjp.exe rllxrrl.exe PID 1468 wrote to memory of 2432 1468 dvvjp.exe rllxrrl.exe PID 1468 wrote to memory of 2432 1468 dvvjp.exe rllxrrl.exe PID 1468 wrote to memory of 2432 1468 dvvjp.exe rllxrrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa7d31d9257c14d8ee133014f4e4f950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\aa7d31d9257c14d8ee133014f4e4f950_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\5tthtn.exec:\5tthtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\5btnbn.exec:\5btnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\jvppv.exec:\jvppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\llflfrf.exec:\llflfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\5xfxxlx.exec:\5xfxxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\nnhntb.exec:\nnhntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\7djvv.exec:\7djvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\rllrfrf.exec:\rllrfrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\hbbtbb.exec:\hbbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\1pjpd.exec:\1pjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\vjvpv.exec:\vjvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\bbnbtb.exec:\bbnbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\nntbnn.exec:\nntbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\dvvjp.exec:\dvvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\rllxrrl.exec:\rllxrrl.exe17⤵
- Executes dropped EXE
PID:2432 -
\??\c:\bbbhtn.exec:\bbbhtn.exe18⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vdpdj.exec:\vdpdj.exe19⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rrfrxlr.exec:\rrfrxlr.exe20⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5nbnht.exec:\5nbnht.exe21⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vvpvj.exec:\vvpvj.exe22⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe23⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5bbnhh.exec:\5bbnhh.exe24⤵
- Executes dropped EXE
PID:700 -
\??\c:\nbtttt.exec:\nbtttt.exe25⤵
- Executes dropped EXE
PID:276 -
\??\c:\7fxlrff.exec:\7fxlrff.exe26⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bnhtbn.exec:\bnhtbn.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vjdjp.exec:\vjdjp.exe28⤵
- Executes dropped EXE
PID:1168 -
\??\c:\rlfrrrx.exec:\rlfrrrx.exe29⤵
- Executes dropped EXE
PID:1904 -
\??\c:\3tbbtb.exec:\3tbbtb.exe30⤵
- Executes dropped EXE
PID:1156 -
\??\c:\dpjvd.exec:\dpjvd.exe31⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xlrxfxf.exec:\xlrxfxf.exe32⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hbtbbb.exec:\hbtbbb.exe33⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3pvpp.exec:\3pvpp.exe34⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9vjjj.exec:\9vjjj.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xxxxxfr.exec:\xxxxxfr.exe36⤵
- Executes dropped EXE
PID:2208 -
\??\c:\3tnnht.exec:\3tnnht.exe37⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hthnnt.exec:\hthnnt.exe38⤵
- Executes dropped EXE
PID:3064 -
\??\c:\1vpdv.exec:\1vpdv.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rlfxllr.exec:\rlfxllr.exe40⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hhtbnh.exec:\hhtbnh.exe41⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bnbbnt.exec:\bnbbnt.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\dpjjj.exec:\dpjjj.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe44⤵
- Executes dropped EXE
PID:2468 -
\??\c:\fxlxlxl.exec:\fxlxlxl.exe45⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bthntn.exec:\bthntn.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbhhnn.exec:\hbhhnn.exe47⤵
- Executes dropped EXE
PID:2488 -
\??\c:\1jdpp.exec:\1jdpp.exe48⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rfrxxfl.exec:\rfrxxfl.exe49⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe50⤵
- Executes dropped EXE
PID:1176 -
\??\c:\bnnhhn.exec:\bnnhhn.exe51⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jjpdv.exec:\jjpdv.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jvdpp.exec:\jvdpp.exe53⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lxrrrxf.exec:\lxrrrxf.exe54⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nhnntb.exec:\nhnntb.exe55⤵
- Executes dropped EXE
PID:1468 -
\??\c:\7bnthn.exec:\7bnthn.exe56⤵
- Executes dropped EXE
PID:2976 -
\??\c:\vjdvv.exec:\vjdvv.exe57⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jjvjp.exec:\jjvjp.exe58⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7xlxfxx.exec:\7xlxfxx.exe59⤵
- Executes dropped EXE
PID:1708 -
\??\c:\tntbhn.exec:\tntbhn.exe60⤵
- Executes dropped EXE
PID:2224 -
\??\c:\htbbnn.exec:\htbbnn.exe61⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dvdvv.exec:\dvdvv.exe62⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vvdjv.exec:\vvdjv.exe63⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rllrxxl.exec:\rllrxxl.exe64⤵
- Executes dropped EXE
PID:2064 -
\??\c:\7tntbh.exec:\7tntbh.exe65⤵
- Executes dropped EXE
PID:680 -
\??\c:\bntnnn.exec:\bntnnn.exe66⤵PID:2540
-
\??\c:\pjvjv.exec:\pjvjv.exe67⤵PID:2336
-
\??\c:\vppvp.exec:\vppvp.exe68⤵PID:1496
-
\??\c:\lfxflff.exec:\lfxflff.exe69⤵PID:764
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe70⤵PID:1920
-
\??\c:\7bbtnt.exec:\7bbtnt.exe71⤵PID:1948
-
\??\c:\dvpvp.exec:\dvpvp.exe72⤵PID:1816
-
\??\c:\ddpdj.exec:\ddpdj.exe73⤵PID:1156
-
\??\c:\lfxxrxf.exec:\lfxxrxf.exe74⤵PID:2928
-
\??\c:\xllrrrx.exec:\xllrrrx.exe75⤵PID:2200
-
\??\c:\thtttn.exec:\thtttn.exe76⤵PID:2072
-
\??\c:\bbhbhn.exec:\bbhbhn.exe77⤵PID:948
-
\??\c:\pdpvd.exec:\pdpvd.exe78⤵PID:2176
-
\??\c:\7flllll.exec:\7flllll.exe79⤵PID:2216
-
\??\c:\frfflxf.exec:\frfflxf.exe80⤵PID:2536
-
\??\c:\nhthbn.exec:\nhthbn.exe81⤵PID:2268
-
\??\c:\btnnnb.exec:\btnnnb.exe82⤵PID:2552
-
\??\c:\1pdjv.exec:\1pdjv.exe83⤵PID:2636
-
\??\c:\rlrfrrf.exec:\rlrfrrf.exe84⤵PID:2912
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe85⤵PID:2588
-
\??\c:\nhnbnb.exec:\nhnbnb.exe86⤵PID:2568
-
\??\c:\hbtthb.exec:\hbtthb.exe87⤵PID:2860
-
\??\c:\7dvvv.exec:\7dvvv.exe88⤵PID:2472
-
\??\c:\rrxxllr.exec:\rrxxllr.exe89⤵PID:2508
-
\??\c:\9frrrfl.exec:\9frrrfl.exe90⤵PID:2556
-
\??\c:\7hbhnt.exec:\7hbhnt.exe91⤵PID:2464
-
\??\c:\tnbhtt.exec:\tnbhtt.exe92⤵PID:2996
-
\??\c:\jvppj.exec:\jvppj.exe93⤵PID:2740
-
\??\c:\rxlllll.exec:\rxlllll.exe94⤵PID:2876
-
\??\c:\lfxrrxf.exec:\lfxrrxf.exe95⤵PID:2052
-
\??\c:\thbbnn.exec:\thbbnn.exe96⤵PID:2692
-
\??\c:\7hbbnh.exec:\7hbbnh.exe97⤵PID:2820
-
\??\c:\jvppj.exec:\jvppj.exe98⤵PID:2668
-
\??\c:\dvddd.exec:\dvddd.exe99⤵PID:3024
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe100⤵PID:2788
-
\??\c:\hbhnnt.exec:\hbhnnt.exe101⤵PID:1240
-
\??\c:\thhhhh.exec:\thhhhh.exe102⤵PID:1256
-
\??\c:\3djvd.exec:\3djvd.exe103⤵PID:944
-
\??\c:\vdjpv.exec:\vdjpv.exe104⤵PID:1756
-
\??\c:\xllrrlr.exec:\xllrrlr.exe105⤵PID:2308
-
\??\c:\btttbb.exec:\btttbb.exe106⤵PID:3012
-
\??\c:\3btnnn.exec:\3btnnn.exe107⤵PID:1532
-
\??\c:\9pddp.exec:\9pddp.exe108⤵PID:784
-
\??\c:\vjppv.exec:\vjppv.exe109⤵PID:1972
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe110⤵PID:1396
-
\??\c:\3xfxxxx.exec:\3xfxxxx.exe111⤵PID:1808
-
\??\c:\thnhnn.exec:\thnhnn.exe112⤵PID:2324
-
\??\c:\dpddd.exec:\dpddd.exe113⤵PID:1896
-
\??\c:\jdpjv.exec:\jdpjv.exe114⤵PID:920
-
\??\c:\3xlrrrr.exec:\3xlrrrr.exe115⤵PID:1168
-
\??\c:\xlrrfll.exec:\xlrrfll.exe116⤵PID:2112
-
\??\c:\bhbbbt.exec:\bhbbbt.exe117⤵PID:1072
-
\??\c:\pjpvd.exec:\pjpvd.exe118⤵PID:2100
-
\??\c:\1jdjp.exec:\1jdjp.exe119⤵PID:1992
-
\??\c:\ffllxlr.exec:\ffllxlr.exe120⤵PID:2204
-
\??\c:\7rfflfr.exec:\7rfflfr.exe121⤵PID:2524
-
\??\c:\hbhnbt.exec:\hbhnbt.exe122⤵PID:2156
-
\??\c:\bhnttt.exec:\bhnttt.exe123⤵PID:1720
-
\??\c:\pdjpv.exec:\pdjpv.exe124⤵PID:1580
-
\??\c:\lrlxrrr.exec:\lrlxrrr.exe125⤵PID:3052
-
\??\c:\5rlffxx.exec:\5rlffxx.exe126⤵PID:2640
-
\??\c:\thhbtt.exec:\thhbtt.exe127⤵PID:2936
-
\??\c:\nbbtth.exec:\nbbtth.exe128⤵PID:2944
-
\??\c:\9jjjj.exec:\9jjjj.exe129⤵PID:2388
-
\??\c:\3fxflxx.exec:\3fxflxx.exe130⤵PID:2232
-
\??\c:\lflflrl.exec:\lflflrl.exe131⤵PID:2768
-
\??\c:\9tbhbb.exec:\9tbhbb.exe132⤵PID:2752
-
\??\c:\bthhnh.exec:\bthhnh.exe133⤵PID:2860
-
\??\c:\jvjjj.exec:\jvjjj.exe134⤵PID:2476
-
\??\c:\3djjp.exec:\3djjp.exe135⤵PID:2660
-
\??\c:\rlrfllx.exec:\rlrfllx.exe136⤵PID:3000
-
\??\c:\lxflrrr.exec:\lxflrrr.exe137⤵PID:2464
-
\??\c:\9thnbb.exec:\9thnbb.exe138⤵PID:2716
-
\??\c:\pdjjd.exec:\pdjjd.exe139⤵PID:892
-
\??\c:\vdppp.exec:\vdppp.exe140⤵PID:2672
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe141⤵PID:2968
-
\??\c:\flrflrx.exec:\flrflrx.exe142⤵PID:2828
-
\??\c:\tnbbbb.exec:\tnbbbb.exe143⤵PID:2824
-
\??\c:\jdpjd.exec:\jdpjd.exe144⤵PID:1232
-
\??\c:\pdvpp.exec:\pdvpp.exe145⤵PID:2228
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe146⤵PID:2864
-
\??\c:\fxlrfff.exec:\fxlrfff.exe147⤵PID:2240
-
\??\c:\httthn.exec:\httthn.exe148⤵PID:3020
-
\??\c:\btthtn.exec:\btthtn.exe149⤵PID:2284
-
\??\c:\jdpjj.exec:\jdpjj.exe150⤵PID:2224
-
\??\c:\fllflrl.exec:\fllflrl.exe151⤵PID:2304
-
\??\c:\rlffrxf.exec:\rlffrxf.exe152⤵PID:1944
-
\??\c:\bbnnbb.exec:\bbnnbb.exe153⤵PID:1020
-
\??\c:\tnbbnt.exec:\tnbbnt.exe154⤵PID:768
-
\??\c:\pvvvp.exec:\pvvvp.exe155⤵PID:680
-
\??\c:\vvvpv.exec:\vvvpv.exe156⤵PID:1304
-
\??\c:\fffrrfr.exec:\fffrrfr.exe157⤵PID:2336
-
\??\c:\ffxrrrx.exec:\ffxrrrx.exe158⤵PID:984
-
\??\c:\bbtnhn.exec:\bbtnhn.exe159⤵PID:764
-
\??\c:\ppjjv.exec:\ppjjv.exe160⤵PID:980
-
\??\c:\vjvdp.exec:\vjvdp.exe161⤵PID:2376
-
\??\c:\9rfxxff.exec:\9rfxxff.exe162⤵PID:2380
-
\??\c:\nnntht.exec:\nnntht.exe163⤵PID:1816
-
\??\c:\nbtntn.exec:\nbtntn.exe164⤵PID:2152
-
\??\c:\rfxxffl.exec:\rfxxffl.exe165⤵PID:2200
-
\??\c:\tbhbbt.exec:\tbhbbt.exe166⤵PID:2656
-
\??\c:\hbhnbh.exec:\hbhnbh.exe167⤵PID:2088
-
\??\c:\pjvdv.exec:\pjvdv.exe168⤵PID:2952
-
\??\c:\9rfxxfx.exec:\9rfxxfx.exe169⤵PID:2948
-
\??\c:\frrrxxf.exec:\frrrxxf.exe170⤵PID:1696
-
\??\c:\3hnhnn.exec:\3hnhnn.exe171⤵PID:2268
-
\??\c:\3hbbhh.exec:\3hbbhh.exe172⤵PID:2552
-
\??\c:\vdvpv.exec:\vdvpv.exe173⤵PID:1596
-
\??\c:\rflllrx.exec:\rflllrx.exe174⤵PID:1880
-
\??\c:\9xlflll.exec:\9xlflll.exe175⤵PID:2452
-
\??\c:\thhtnb.exec:\thhtnb.exe176⤵PID:2124
-
\??\c:\bbhhtt.exec:\bbhhtt.exe177⤵PID:2764
-
\??\c:\jdpjp.exec:\jdpjp.exe178⤵PID:2616
-
\??\c:\xrxffff.exec:\xrxffff.exe179⤵PID:2728
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe180⤵PID:2500
-
\??\c:\nnhbhn.exec:\nnhbhn.exe181⤵PID:1368
-
\??\c:\nnbbhh.exec:\nnbbhh.exe182⤵PID:2992
-
\??\c:\dvjjv.exec:\dvjjv.exe183⤵PID:2460
-
\??\c:\dpddj.exec:\dpddj.exe184⤵PID:3016
-
\??\c:\1xfxxfl.exec:\1xfxxfl.exe185⤵PID:2512
-
\??\c:\tntttb.exec:\tntttb.exe186⤵PID:2852
-
\??\c:\3hhtbn.exec:\3hhtbn.exe187⤵PID:1876
-
\??\c:\pdjdj.exec:\pdjdj.exe188⤵PID:2956
-
\??\c:\3pvjj.exec:\3pvjj.exe189⤵PID:2824
-
\??\c:\rllrxxf.exec:\rllrxxf.exe190⤵PID:1232
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe191⤵PID:2228
-
\??\c:\9bhbhn.exec:\9bhbhn.exe192⤵PID:1712
-
\??\c:\djvvp.exec:\djvvp.exe193⤵PID:2816
-
\??\c:\vvpdv.exec:\vvpdv.exe194⤵PID:2148
-
\??\c:\ffxfrfx.exec:\ffxfrfx.exe195⤵PID:1640
-
\??\c:\3htnth.exec:\3htnth.exe196⤵PID:2316
-
\??\c:\nhttbn.exec:\nhttbn.exe197⤵PID:2320
-
\??\c:\jvpvp.exec:\jvpvp.exe198⤵PID:576
-
\??\c:\7vpvj.exec:\7vpvj.exe199⤵PID:1404
-
\??\c:\llfrxll.exec:\llfrxll.exe200⤵PID:768
-
\??\c:\9lfrffr.exec:\9lfrffr.exe201⤵PID:2540
-
\??\c:\hbbnnb.exec:\hbbnnb.exe202⤵PID:1304
-
\??\c:\ppvdp.exec:\ppvdp.exe203⤵PID:1472
-
\??\c:\dvpvd.exec:\dvpvd.exe204⤵PID:1788
-
\??\c:\rrlxllr.exec:\rrlxllr.exe205⤵PID:1904
-
\??\c:\rrfxflf.exec:\rrfxflf.exe206⤵PID:2104
-
\??\c:\btntnb.exec:\btntnb.exe207⤵PID:2372
-
\??\c:\jjjpv.exec:\jjjpv.exe208⤵PID:2424
-
\??\c:\vvpdp.exec:\vvpdp.exe209⤵PID:1768
-
\??\c:\rllrfxr.exec:\rllrfxr.exe210⤵PID:1460
-
\??\c:\fxlrxxr.exec:\fxlrxxr.exe211⤵PID:2904
-
\??\c:\3hbhth.exec:\3hbhth.exe212⤵PID:1996
-
\??\c:\hhbhhn.exec:\hhbhhn.exe213⤵PID:2348
-
\??\c:\jdppd.exec:\jdppd.exe214⤵PID:2028
-
\??\c:\vpdpp.exec:\vpdpp.exe215⤵PID:2164
-
\??\c:\rrxrflf.exec:\rrxrflf.exe216⤵PID:3056
-
\??\c:\ffxlrfl.exec:\ffxlrfl.exe217⤵PID:3052
-
\??\c:\bbtthh.exec:\bbtthh.exe218⤵PID:1696
-
\??\c:\hhhttt.exec:\hhhttt.exe219⤵PID:2720
-
\??\c:\3pjdj.exec:\3pjdj.exe220⤵PID:2552
-
\??\c:\xrffrrr.exec:\xrffrrr.exe221⤵PID:2548
-
\??\c:\5fxflrx.exec:\5fxflrx.exe222⤵PID:1744
-
\??\c:\hhnbnt.exec:\hhnbnt.exe223⤵PID:2480
-
\??\c:\3ntbnn.exec:\3ntbnn.exe224⤵PID:2736
-
\??\c:\ppddp.exec:\ppddp.exe225⤵PID:2456
-
\??\c:\ppjvp.exec:\ppjvp.exe226⤵PID:2472
-
\??\c:\rllrxxf.exec:\rllrxxf.exe227⤵PID:2556
-
\??\c:\5lxlxfr.exec:\5lxlxfr.exe228⤵PID:2612
-
\??\c:\nhbhth.exec:\nhbhth.exe229⤵PID:2996
-
\??\c:\nhbhtb.exec:\nhbhtb.exe230⤵PID:2652
-
\??\c:\ppdjv.exec:\ppdjv.exe231⤵PID:2700
-
\??\c:\jvvdd.exec:\jvvdd.exe232⤵PID:892
-
\??\c:\rxflxlf.exec:\rxflxlf.exe233⤵PID:960
-
\??\c:\fxlrxlr.exec:\fxlrxlr.exe234⤵PID:2968
-
\??\c:\hbttbb.exec:\hbttbb.exe235⤵PID:2828
-
\??\c:\tnhbnt.exec:\tnhbnt.exe236⤵PID:2496
-
\??\c:\vvpvj.exec:\vvpvj.exe237⤵PID:2484
-
\??\c:\xxflfxl.exec:\xxflfxl.exe238⤵PID:1468
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe239⤵PID:2864
-
\??\c:\5bnbnb.exec:\5bnbnb.exe240⤵PID:3004
-
\??\c:\tnbbth.exec:\tnbbth.exe241⤵PID:1608
-
\??\c:\jjvpv.exec:\jjvpv.exe242⤵PID:2076