Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 05:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe
-
Size
487KB
-
MD5
b9bbe85413287cb6d1e2e020bd81ea50
-
SHA1
a59abfde525ada15999edb3cd7bde72a3ca8cf7c
-
SHA256
e4df639d014862674de44cec137d91bc785bdc061d5c2a7dcd3ce8c82da6e833
-
SHA512
8dbf912ce5125712bb0c712a0a543ba0d9f01bef147cc5156bc032bafea50c9a0d0a3198a49a80633e9e1bb574ceca26f9bbc746674cc7c89c0c7f89898d2bb5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjdgyPPB1:q7Tc2NYHUrAwqzQ7PPD
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4392-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/900-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-878-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-924-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-955-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5hhbtt.exejjjjj.exellfxffx.exetbbttn.exefllrrlf.exeffxflxx.exehbnbnt.exellxlfxr.exe1fffxxr.exe5vvvv.exetnttbb.exe1pvpp.exe1fxrffr.exeppvdd.exebhnnhh.exerlffxxr.exejdvpd.exe3lrrrrr.exentnhhn.exerlrrrrr.exejjvpp.exexxllxxf.exerrxxxlr.exejjvpv.exefxlrxxf.exevjvdv.exethnbhh.exeppvvj.exexfrrrxx.exenbnthn.exedpdvv.exenhtntb.exeddvpj.exehbbttn.exejdddv.exefxxrllf.exenhbttt.exejvpjd.exellrrlll.exebbbbtn.exe9vdvp.exe7lfxrrl.exe7bbbtb.exe5jjjd.exe3flfxfx.exebnnhbb.exerfrxlxx.exe1nttbh.exe1djjd.exe3jjdd.exefxxrllf.exejddpj.exe7vpjd.exellffxlf.exedjdvp.exedvjjp.exefxxrfxf.exebtbbbb.exejpvpd.exerrrfllr.exejdpjj.exelrlfxxr.exennhhhh.exejvjdd.exepid process 1720 5hhbtt.exe 4328 jjjjj.exe 3848 llfxffx.exe 4340 tbbttn.exe 1140 fllrrlf.exe 900 ffxflxx.exe 1428 hbnbnt.exe 3324 llxlfxr.exe 1844 1fffxxr.exe 1932 5vvvv.exe 5024 tnttbb.exe 4460 1pvpp.exe 4904 1fxrffr.exe 2348 ppvdd.exe 1164 bhnnhh.exe 2244 rlffxxr.exe 5072 jdvpd.exe 2336 3lrrrrr.exe 2724 ntnhhn.exe 452 rlrrrrr.exe 3752 jjvpp.exe 1464 xxllxxf.exe 3200 rrxxxlr.exe 684 jjvpv.exe 436 fxlrxxf.exe 1260 vjvdv.exe 4148 thnbhh.exe 4880 ppvvj.exe 3144 xfrrrxx.exe 1584 nbnthn.exe 1288 dpdvv.exe 3092 nhtntb.exe 2880 ddvpj.exe 2580 hbbttn.exe 5044 jdddv.exe 4308 fxxrllf.exe 2164 nhbttt.exe 2712 jvpjd.exe 2288 llrrlll.exe 5036 bbbbtn.exe 3932 9vdvp.exe 4340 7lfxrrl.exe 4888 7bbbtb.exe 4368 5jjjd.exe 4600 3flfxfx.exe 1648 bnnhbb.exe 3116 rfrxlxx.exe 372 1nttbh.exe 1844 1djjd.exe 552 3jjdd.exe 1136 fxxrllf.exe 60 jddpj.exe 1800 7vpjd.exe 5032 llffxlf.exe 1436 djdvp.exe 2348 dvjjp.exe 2108 fxxrfxf.exe 2244 btbbbb.exe 1432 jpvpd.exe 4144 rrrfllr.exe 2968 jdpjj.exe 5004 lrlfxxr.exe 3496 nnhhhh.exe 400 jvjdd.exe -
Processes:
resource yara_rule behavioral2/memory/4392-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-481-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe5hhbtt.exejjjjj.exellfxffx.exetbbttn.exefllrrlf.exeffxflxx.exehbnbnt.exellxlfxr.exe1fffxxr.exe5vvvv.exetnttbb.exe1pvpp.exe1fxrffr.exeppvdd.exebhnnhh.exerlffxxr.exejdvpd.exe3lrrrrr.exentnhhn.exerlrrrrr.exejjvpp.exedescription pid process target process PID 4392 wrote to memory of 1720 4392 b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe 5hhbtt.exe PID 4392 wrote to memory of 1720 4392 b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe 5hhbtt.exe PID 4392 wrote to memory of 1720 4392 b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe 5hhbtt.exe PID 1720 wrote to memory of 4328 1720 5hhbtt.exe jjjjj.exe PID 1720 wrote to memory of 4328 1720 5hhbtt.exe jjjjj.exe PID 1720 wrote to memory of 4328 1720 5hhbtt.exe jjjjj.exe PID 4328 wrote to memory of 3848 4328 jjjjj.exe llfxffx.exe PID 4328 wrote to memory of 3848 4328 jjjjj.exe llfxffx.exe PID 4328 wrote to memory of 3848 4328 jjjjj.exe llfxffx.exe PID 3848 wrote to memory of 4340 3848 llfxffx.exe tbbttn.exe PID 3848 wrote to memory of 4340 3848 llfxffx.exe tbbttn.exe PID 3848 wrote to memory of 4340 3848 llfxffx.exe tbbttn.exe PID 4340 wrote to memory of 1140 4340 tbbttn.exe fllrrlf.exe PID 4340 wrote to memory of 1140 4340 tbbttn.exe fllrrlf.exe PID 4340 wrote to memory of 1140 4340 tbbttn.exe fllrrlf.exe PID 1140 wrote to memory of 900 1140 fllrrlf.exe ffxflxx.exe PID 1140 wrote to memory of 900 1140 fllrrlf.exe ffxflxx.exe PID 1140 wrote to memory of 900 1140 fllrrlf.exe ffxflxx.exe PID 900 wrote to memory of 1428 900 ffxflxx.exe hbnbnt.exe PID 900 wrote to memory of 1428 900 ffxflxx.exe hbnbnt.exe PID 900 wrote to memory of 1428 900 ffxflxx.exe hbnbnt.exe PID 1428 wrote to memory of 3324 1428 hbnbnt.exe llxlfxr.exe PID 1428 wrote to memory of 3324 1428 hbnbnt.exe llxlfxr.exe PID 1428 wrote to memory of 3324 1428 hbnbnt.exe llxlfxr.exe PID 3324 wrote to memory of 1844 3324 llxlfxr.exe 1fffxxr.exe PID 3324 wrote to memory of 1844 3324 llxlfxr.exe 1fffxxr.exe PID 3324 wrote to memory of 1844 3324 llxlfxr.exe 1fffxxr.exe PID 1844 wrote to memory of 1932 1844 1fffxxr.exe 5vvvv.exe PID 1844 wrote to memory of 1932 1844 1fffxxr.exe 5vvvv.exe PID 1844 wrote to memory of 1932 1844 1fffxxr.exe 5vvvv.exe PID 1932 wrote to memory of 5024 1932 5vvvv.exe tnttbb.exe PID 1932 wrote to memory of 5024 1932 5vvvv.exe tnttbb.exe PID 1932 wrote to memory of 5024 1932 5vvvv.exe tnttbb.exe PID 5024 wrote to memory of 4460 5024 tnttbb.exe 1pvpp.exe PID 5024 wrote to memory of 4460 5024 tnttbb.exe 1pvpp.exe PID 5024 wrote to memory of 4460 5024 tnttbb.exe 1pvpp.exe PID 4460 wrote to memory of 4904 4460 1pvpp.exe 1fxrffr.exe PID 4460 wrote to memory of 4904 4460 1pvpp.exe 1fxrffr.exe PID 4460 wrote to memory of 4904 4460 1pvpp.exe 1fxrffr.exe PID 4904 wrote to memory of 2348 4904 1fxrffr.exe ppvdd.exe PID 4904 wrote to memory of 2348 4904 1fxrffr.exe ppvdd.exe PID 4904 wrote to memory of 2348 4904 1fxrffr.exe ppvdd.exe PID 2348 wrote to memory of 1164 2348 ppvdd.exe bhnnhh.exe PID 2348 wrote to memory of 1164 2348 ppvdd.exe bhnnhh.exe PID 2348 wrote to memory of 1164 2348 ppvdd.exe bhnnhh.exe PID 1164 wrote to memory of 2244 1164 bhnnhh.exe rlffxxr.exe PID 1164 wrote to memory of 2244 1164 bhnnhh.exe rlffxxr.exe PID 1164 wrote to memory of 2244 1164 bhnnhh.exe rlffxxr.exe PID 2244 wrote to memory of 5072 2244 rlffxxr.exe jdvpd.exe PID 2244 wrote to memory of 5072 2244 rlffxxr.exe jdvpd.exe PID 2244 wrote to memory of 5072 2244 rlffxxr.exe jdvpd.exe PID 5072 wrote to memory of 2336 5072 jdvpd.exe 3lrrrrr.exe PID 5072 wrote to memory of 2336 5072 jdvpd.exe 3lrrrrr.exe PID 5072 wrote to memory of 2336 5072 jdvpd.exe 3lrrrrr.exe PID 2336 wrote to memory of 2724 2336 3lrrrrr.exe ntnhhn.exe PID 2336 wrote to memory of 2724 2336 3lrrrrr.exe ntnhhn.exe PID 2336 wrote to memory of 2724 2336 3lrrrrr.exe ntnhhn.exe PID 2724 wrote to memory of 452 2724 ntnhhn.exe rlrrrrr.exe PID 2724 wrote to memory of 452 2724 ntnhhn.exe rlrrrrr.exe PID 2724 wrote to memory of 452 2724 ntnhhn.exe rlrrrrr.exe PID 452 wrote to memory of 3752 452 rlrrrrr.exe jjvpp.exe PID 452 wrote to memory of 3752 452 rlrrrrr.exe jjvpp.exe PID 452 wrote to memory of 3752 452 rlrrrrr.exe jjvpp.exe PID 3752 wrote to memory of 1464 3752 jjvpp.exe xxllxxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b9bbe85413287cb6d1e2e020bd81ea50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\5hhbtt.exec:\5hhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\jjjjj.exec:\jjjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\llfxffx.exec:\llfxffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\tbbttn.exec:\tbbttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\fllrrlf.exec:\fllrrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\ffxflxx.exec:\ffxflxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\hbnbnt.exec:\hbnbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\llxlfxr.exec:\llxlfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\1fffxxr.exec:\1fffxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\5vvvv.exec:\5vvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\tnttbb.exec:\tnttbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\1pvpp.exec:\1pvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\1fxrffr.exec:\1fxrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\ppvdd.exec:\ppvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\bhnnhh.exec:\bhnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\rlffxxr.exec:\rlffxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\jdvpd.exec:\jdvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\3lrrrrr.exec:\3lrrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\ntnhhn.exec:\ntnhhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\jjvpp.exec:\jjvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\xxllxxf.exec:\xxllxxf.exe23⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rrxxxlr.exec:\rrxxxlr.exe24⤵
- Executes dropped EXE
PID:3200 -
\??\c:\jjvpv.exec:\jjvpv.exe25⤵
- Executes dropped EXE
PID:684 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe26⤵
- Executes dropped EXE
PID:436 -
\??\c:\vjvdv.exec:\vjvdv.exe27⤵
- Executes dropped EXE
PID:1260 -
\??\c:\thnbhh.exec:\thnbhh.exe28⤵
- Executes dropped EXE
PID:4148 -
\??\c:\ppvvj.exec:\ppvvj.exe29⤵
- Executes dropped EXE
PID:4880 -
\??\c:\xfrrrxx.exec:\xfrrrxx.exe30⤵
- Executes dropped EXE
PID:3144 -
\??\c:\nbnthn.exec:\nbnthn.exe31⤵
- Executes dropped EXE
PID:1584 -
\??\c:\dpdvv.exec:\dpdvv.exe32⤵
- Executes dropped EXE
PID:1288 -
\??\c:\nhtntb.exec:\nhtntb.exe33⤵
- Executes dropped EXE
PID:3092 -
\??\c:\ddvpj.exec:\ddvpj.exe34⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hbbttn.exec:\hbbttn.exe35⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jdddv.exec:\jdddv.exe36⤵
- Executes dropped EXE
PID:5044 -
\??\c:\fxxrllf.exec:\fxxrllf.exe37⤵
- Executes dropped EXE
PID:4308 -
\??\c:\nhbttt.exec:\nhbttt.exe38⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jvpjd.exec:\jvpjd.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\llrrlll.exec:\llrrlll.exe40⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bbbbtn.exec:\bbbbtn.exe41⤵
- Executes dropped EXE
PID:5036 -
\??\c:\9vdvp.exec:\9vdvp.exe42⤵
- Executes dropped EXE
PID:3932 -
\??\c:\7lfxrrl.exec:\7lfxrrl.exe43⤵
- Executes dropped EXE
PID:4340 -
\??\c:\7bbbtb.exec:\7bbbtb.exe44⤵
- Executes dropped EXE
PID:4888 -
\??\c:\5jjjd.exec:\5jjjd.exe45⤵
- Executes dropped EXE
PID:4368 -
\??\c:\3flfxfx.exec:\3flfxfx.exe46⤵
- Executes dropped EXE
PID:4600 -
\??\c:\bnnhbb.exec:\bnnhbb.exe47⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rfrxlxx.exec:\rfrxlxx.exe48⤵
- Executes dropped EXE
PID:3116 -
\??\c:\1nttbh.exec:\1nttbh.exe49⤵
- Executes dropped EXE
PID:372 -
\??\c:\1djjd.exec:\1djjd.exe50⤵
- Executes dropped EXE
PID:1844 -
\??\c:\3jjdd.exec:\3jjdd.exe51⤵
- Executes dropped EXE
PID:552 -
\??\c:\fxxrllf.exec:\fxxrllf.exe52⤵
- Executes dropped EXE
PID:1136 -
\??\c:\jddpj.exec:\jddpj.exe53⤵
- Executes dropped EXE
PID:60 -
\??\c:\7vpjd.exec:\7vpjd.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\llffxlf.exec:\llffxlf.exe55⤵
- Executes dropped EXE
PID:5032 -
\??\c:\djdvp.exec:\djdvp.exe56⤵
- Executes dropped EXE
PID:1436 -
\??\c:\dvjjp.exec:\dvjjp.exe57⤵
- Executes dropped EXE
PID:2348 -
\??\c:\fxxrfxf.exec:\fxxrfxf.exe58⤵
- Executes dropped EXE
PID:2108 -
\??\c:\btbbbb.exec:\btbbbb.exe59⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jpvpd.exec:\jpvpd.exe60⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rrrfllr.exec:\rrrfllr.exe61⤵
- Executes dropped EXE
PID:4144 -
\??\c:\jdpjj.exec:\jdpjj.exe62⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lrlfxxr.exec:\lrlfxxr.exe63⤵
- Executes dropped EXE
PID:5004 -
\??\c:\nnhhhh.exec:\nnhhhh.exe64⤵
- Executes dropped EXE
PID:3496 -
\??\c:\jvjdd.exec:\jvjdd.exe65⤵
- Executes dropped EXE
PID:400 -
\??\c:\xlllfxr.exec:\xlllfxr.exe66⤵PID:1356
-
\??\c:\hnnbnb.exec:\hnnbnb.exe67⤵PID:444
-
\??\c:\vpjjd.exec:\vpjjd.exe68⤵PID:5064
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe69⤵PID:388
-
\??\c:\nbhntt.exec:\nbhntt.exe70⤵PID:3656
-
\??\c:\tttttt.exec:\tttttt.exe71⤵PID:4216
-
\??\c:\jvjdv.exec:\jvjdv.exe72⤵PID:4604
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe73⤵PID:3780
-
\??\c:\bthhhn.exec:\bthhhn.exe74⤵PID:1584
-
\??\c:\pppjd.exec:\pppjd.exe75⤵PID:3928
-
\??\c:\rrxrllf.exec:\rrxrllf.exe76⤵PID:1424
-
\??\c:\tbthth.exec:\tbthth.exe77⤵PID:4824
-
\??\c:\5hnhbt.exec:\5hnhbt.exe78⤵PID:4424
-
\??\c:\vjvjp.exec:\vjvjp.exe79⤵PID:1144
-
\??\c:\rxrfrlx.exec:\rxrfrlx.exe80⤵PID:2712
-
\??\c:\nhhhhh.exec:\nhhhhh.exe81⤵PID:3848
-
\??\c:\vjvvp.exec:\vjvvp.exe82⤵PID:3804
-
\??\c:\rlxrllf.exec:\rlxrllf.exe83⤵PID:2228
-
\??\c:\bhhtnb.exec:\bhhtnb.exe84⤵PID:2192
-
\??\c:\jddjp.exec:\jddjp.exe85⤵PID:2184
-
\??\c:\xlxrlff.exec:\xlxrlff.exe86⤵PID:2696
-
\??\c:\7nnnnn.exec:\7nnnnn.exe87⤵PID:1576
-
\??\c:\3jvpp.exec:\3jvpp.exe88⤵PID:2168
-
\??\c:\rlxxrlf.exec:\rlxxrlf.exe89⤵PID:2380
-
\??\c:\ntbtnt.exec:\ntbtnt.exe90⤵PID:4988
-
\??\c:\jdvvp.exec:\jdvvp.exe91⤵PID:3060
-
\??\c:\jjpjd.exec:\jjpjd.exe92⤵PID:432
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe93⤵PID:60
-
\??\c:\bnhhbb.exec:\bnhhbb.exe94⤵PID:4576
-
\??\c:\1ddvp.exec:\1ddvp.exe95⤵PID:4484
-
\??\c:\xrllfxx.exec:\xrllfxx.exe96⤵PID:2008
-
\??\c:\bhbbnt.exec:\bhbbnt.exe97⤵PID:1392
-
\??\c:\dvpvd.exec:\dvpvd.exe98⤵PID:4776
-
\??\c:\rfxfrff.exec:\rfxfrff.exe99⤵PID:3976
-
\??\c:\7nbtbb.exec:\7nbtbb.exe100⤵PID:4072
-
\??\c:\vjvpv.exec:\vjvpv.exe101⤵PID:3008
-
\??\c:\djddd.exec:\djddd.exe102⤵PID:2388
-
\??\c:\5ffxxxr.exec:\5ffxxxr.exe103⤵PID:2968
-
\??\c:\bbnhhh.exec:\bbnhhh.exe104⤵PID:3796
-
\??\c:\dddvd.exec:\dddvd.exe105⤵PID:3680
-
\??\c:\xrfrlxr.exec:\xrfrlxr.exe106⤵PID:3492
-
\??\c:\bbbhbb.exec:\bbbhbb.exe107⤵PID:400
-
\??\c:\flxfffr.exec:\flxfffr.exe108⤵PID:3864
-
\??\c:\bhttnn.exec:\bhttnn.exe109⤵PID:444
-
\??\c:\djpvp.exec:\djpvp.exe110⤵PID:5064
-
\??\c:\rxffllf.exec:\rxffllf.exe111⤵PID:4592
-
\??\c:\hbhnnt.exec:\hbhnnt.exe112⤵PID:3660
-
\??\c:\dddvv.exec:\dddvv.exe113⤵PID:4476
-
\??\c:\frxrrrx.exec:\frxrrrx.exe114⤵PID:3576
-
\??\c:\hthhhb.exec:\hthhhb.exe115⤵PID:2752
-
\??\c:\vjppp.exec:\vjppp.exe116⤵PID:212
-
\??\c:\7lrlfxx.exec:\7lrlfxx.exe117⤵PID:2584
-
\??\c:\ntnhbt.exec:\ntnhbt.exe118⤵PID:2576
-
\??\c:\jjvvd.exec:\jjvvd.exe119⤵PID:2676
-
\??\c:\5hbbtt.exec:\5hbbtt.exe120⤵PID:1096
-
\??\c:\3jpdj.exec:\3jpdj.exe121⤵PID:3056
-
\??\c:\9rxrrrl.exec:\9rxrrrl.exe122⤵PID:3088
-
\??\c:\nnhhhh.exec:\nnhhhh.exe123⤵PID:4560
-
\??\c:\hhtnnn.exec:\hhtnnn.exe124⤵PID:3804
-
\??\c:\llfxfrx.exec:\llfxfrx.exe125⤵PID:1140
-
\??\c:\5rxxxxx.exec:\5rxxxxx.exe126⤵PID:2076
-
\??\c:\nnhhhh.exec:\nnhhhh.exe127⤵PID:2000
-
\??\c:\vdvjj.exec:\vdvjj.exe128⤵PID:1872
-
\??\c:\rflxffx.exec:\rflxffx.exe129⤵PID:1740
-
\??\c:\nbtnhh.exec:\nbtnhh.exe130⤵PID:4864
-
\??\c:\hbtnhh.exec:\hbtnhh.exe131⤵PID:1512
-
\??\c:\rlflxrx.exec:\rlflxrx.exe132⤵PID:552
-
\??\c:\frlfxxr.exec:\frlfxxr.exe133⤵PID:1664
-
\??\c:\thnhhh.exec:\thnhhh.exe134⤵PID:4472
-
\??\c:\jvppp.exec:\jvppp.exe135⤵PID:4460
-
\??\c:\fxlllrx.exec:\fxlllrx.exe136⤵PID:4688
-
\??\c:\nbnhhh.exec:\nbnhhh.exe137⤵PID:3540
-
\??\c:\jppjd.exec:\jppjd.exe138⤵PID:4348
-
\??\c:\tntnhb.exec:\tntnhb.exe139⤵PID:1508
-
\??\c:\bnbtbh.exec:\bnbtbh.exe140⤵PID:2108
-
\??\c:\vpjdp.exec:\vpjdp.exe141⤵PID:3892
-
\??\c:\xxffrxx.exec:\xxffrxx.exe142⤵PID:1112
-
\??\c:\bthttn.exec:\bthttn.exe143⤵PID:1528
-
\??\c:\jjdvp.exec:\jjdvp.exe144⤵PID:3432
-
\??\c:\rflfffx.exec:\rflfffx.exe145⤵PID:2092
-
\??\c:\nbbttn.exec:\nbbttn.exe146⤵PID:3476
-
\??\c:\vvjpd.exec:\vvjpd.exe147⤵PID:3016
-
\??\c:\1xxlfff.exec:\1xxlfff.exe148⤵PID:4292
-
\??\c:\9bbbtb.exec:\9bbbtb.exe149⤵PID:3124
-
\??\c:\pdpjj.exec:\pdpjj.exe150⤵PID:1260
-
\??\c:\rxlfrll.exec:\rxlfrll.exe151⤵PID:3352
-
\??\c:\nnhbtn.exec:\nnhbtn.exe152⤵PID:5000
-
\??\c:\jdjdv.exec:\jdjdv.exe153⤵PID:3024
-
\??\c:\5xrlxxx.exec:\5xrlxxx.exe154⤵PID:4476
-
\??\c:\jjvjd.exec:\jjvjd.exe155⤵PID:2752
-
\??\c:\5pdvd.exec:\5pdvd.exe156⤵PID:212
-
\??\c:\9bhtbn.exec:\9bhtbn.exe157⤵PID:2880
-
\??\c:\pdddv.exec:\pdddv.exe158⤵PID:4720
-
\??\c:\xrlxfxf.exec:\xrlxfxf.exe159⤵PID:4372
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe160⤵PID:4220
-
\??\c:\hbbbbb.exec:\hbbbbb.exe161⤵PID:940
-
\??\c:\pdjjd.exec:\pdjjd.exe162⤵PID:2460
-
\??\c:\fxxxlfx.exec:\fxxxlfx.exe163⤵PID:1232
-
\??\c:\llfxfxr.exec:\llfxfxr.exe164⤵PID:3552
-
\??\c:\bttnhh.exec:\bttnhh.exe165⤵PID:4672
-
\??\c:\jpddd.exec:\jpddd.exe166⤵PID:4540
-
\??\c:\llflllx.exec:\llflllx.exe167⤵PID:1648
-
\??\c:\nnbthb.exec:\nnbthb.exe168⤵PID:1872
-
\??\c:\jvvjd.exec:\jvvjd.exe169⤵PID:4364
-
\??\c:\ddjjj.exec:\ddjjj.exe170⤵PID:1348
-
\??\c:\7lrlrrl.exec:\7lrlrrl.exe171⤵PID:1136
-
\??\c:\nnhnhn.exec:\nnhnhn.exe172⤵PID:1388
-
\??\c:\jjpjp.exec:\jjpjp.exe173⤵PID:4904
-
\??\c:\7xxrrrx.exec:\7xxrrrx.exe174⤵PID:3444
-
\??\c:\3rxxxff.exec:\3rxxxff.exe175⤵PID:4524
-
\??\c:\ttnbnh.exec:\ttnbnh.exe176⤵PID:1436
-
\??\c:\vvddd.exec:\vvddd.exe177⤵PID:4544
-
\??\c:\7rrrlrl.exec:\7rrrlrl.exe178⤵PID:4776
-
\??\c:\fllfxxr.exec:\fllfxxr.exe179⤵PID:728
-
\??\c:\tnhbbb.exec:\tnhbbb.exe180⤵PID:2336
-
\??\c:\jpppd.exec:\jpppd.exe181⤵PID:632
-
\??\c:\xxrrxlr.exec:\xxrrxlr.exe182⤵PID:4844
-
\??\c:\lfxrxxr.exec:\lfxrxxr.exe183⤵PID:4704
-
\??\c:\7hnhhb.exec:\7hnhhb.exe184⤵PID:5004
-
\??\c:\pjjdv.exec:\pjjdv.exe185⤵PID:3752
-
\??\c:\fffxxxr.exec:\fffxxxr.exe186⤵PID:400
-
\??\c:\3rllrlx.exec:\3rllrlx.exe187⤵PID:3864
-
\??\c:\hhhtnh.exec:\hhhtnh.exe188⤵PID:2984
-
\??\c:\jdpjj.exec:\jdpjj.exe189⤵PID:4236
-
\??\c:\xxffrll.exec:\xxffrll.exe190⤵PID:5104
-
\??\c:\3rrrlll.exec:\3rrrlll.exe191⤵PID:4224
-
\??\c:\thhnbt.exec:\thhnbt.exe192⤵PID:4380
-
\??\c:\3djpj.exec:\3djpj.exe193⤵PID:3764
-
\??\c:\ffrflfl.exec:\ffrflfl.exe194⤵PID:4216
-
\??\c:\hbtttn.exec:\hbtttn.exe195⤵PID:3576
-
\??\c:\btnhhb.exec:\btnhhb.exe196⤵PID:1424
-
\??\c:\jpppj.exec:\jpppj.exe197⤵PID:1800
-
\??\c:\9xxrrrl.exec:\9xxrrrl.exe198⤵PID:736
-
\??\c:\hbhhbb.exec:\hbhhbb.exe199⤵PID:3948
-
\??\c:\9nhhbb.exec:\9nhhbb.exe200⤵PID:4824
-
\??\c:\jvjjd.exec:\jvjjd.exe201⤵PID:3508
-
\??\c:\fflfffx.exec:\fflfffx.exe202⤵PID:2712
-
\??\c:\tttnnn.exec:\tttnnn.exe203⤵PID:180
-
\??\c:\tnbttt.exec:\tnbttt.exe204⤵PID:4744
-
\??\c:\vddvp.exec:\vddvp.exe205⤵PID:3456
-
\??\c:\xrxrlff.exec:\xrxrlff.exe206⤵PID:4888
-
\??\c:\nhhbtt.exec:\nhhbtt.exe207⤵PID:1140
-
\??\c:\jpddj.exec:\jpddj.exe208⤵PID:3340
-
\??\c:\jdjdd.exec:\jdjdd.exe209⤵PID:2076
-
\??\c:\7lrrxxr.exec:\7lrrxxr.exe210⤵PID:4992
-
\??\c:\hthbnn.exec:\hthbnn.exe211⤵PID:1740
-
\??\c:\1ddvv.exec:\1ddvv.exe212⤵PID:4864
-
\??\c:\xxlxrrx.exec:\xxlxrrx.exe213⤵PID:2884
-
\??\c:\hhnbtt.exec:\hhnbtt.exe214⤵PID:4504
-
\??\c:\7jvpp.exec:\7jvpp.exe215⤵PID:2020
-
\??\c:\vjjjp.exec:\vjjjp.exe216⤵PID:3172
-
\??\c:\lfllffx.exec:\lfllffx.exe217⤵PID:2504
-
\??\c:\hhnhbb.exec:\hhnhbb.exe218⤵PID:5084
-
\??\c:\tbnhbh.exec:\tbnhbh.exe219⤵PID:880
-
\??\c:\ppvvv.exec:\ppvvv.exe220⤵PID:1620
-
\??\c:\frxrrrr.exec:\frxrrrr.exe221⤵PID:1392
-
\??\c:\btbbbn.exec:\btbbbn.exe222⤵PID:1432
-
\??\c:\bntnnn.exec:\bntnnn.exe223⤵PID:1172
-
\??\c:\pddvp.exec:\pddvp.exe224⤵PID:3920
-
\??\c:\lxxrxxr.exec:\lxxrxxr.exe225⤵PID:2384
-
\??\c:\7httbn.exec:\7httbn.exe226⤵PID:1544
-
\??\c:\pvjdv.exec:\pvjdv.exe227⤵PID:4840
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe228⤵PID:4568
-
\??\c:\rxrlxxl.exec:\rxrlxxl.exe229⤵PID:3936
-
\??\c:\nnhnnt.exec:\nnhnnt.exe230⤵PID:400
-
\??\c:\jpvdv.exec:\jpvdv.exe231⤵PID:3620
-
\??\c:\3xrrxxr.exec:\3xrrxxr.exe232⤵PID:5056
-
\??\c:\7bhhbh.exec:\7bhhbh.exe233⤵PID:4048
-
\??\c:\7vddd.exec:\7vddd.exe234⤵PID:2024
-
\??\c:\vpvpp.exec:\vpvpp.exe235⤵PID:4444
-
\??\c:\fflxrfx.exec:\fflxrfx.exe236⤵PID:3660
-
\??\c:\tbhnnn.exec:\tbhnnn.exe237⤵PID:4476
-
\??\c:\vpvvd.exec:\vpvvd.exe238⤵PID:4264
-
\??\c:\xfllxll.exec:\xfllxll.exe239⤵PID:1720
-
\??\c:\nnbbht.exec:\nnbbht.exe240⤵PID:1364
-
\??\c:\djjdd.exec:\djjdd.exe241⤵PID:5080
-
\??\c:\lrfffxr.exec:\lrfffxr.exe242⤵PID:2256