Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:01
Behavioral task
behavioral1
Sample
000ae4b8c49b21970a9b4672d9958e90_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
000ae4b8c49b21970a9b4672d9958e90_NeikiAnalytics.exe
-
Size
273KB
-
MD5
000ae4b8c49b21970a9b4672d9958e90
-
SHA1
4d6bf17391e1ba62c00d59535958b7b1045c6ae9
-
SHA256
f5af9ad320bc44cafbcdc76122723500784213d6a39b34a835d32c9af6631c50
-
SHA512
66af7b888ed71958f044d26bfc5fec6260d9c04ce8223efc74db82100418a6b3ea9dcf4458ebb9ad2d13a832c5afe2cebb039879d4abc200d40ecc15f410e71b
-
SSDEEP
6144:Ycm4FmowdHoSgWrXF5lpKGYV0aTk/BO0XJm4UEPOshN/xdKnvP48bmm:e4wFHoSgWjdpKGATTk/jYIOWN/KnnPn
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4040-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3248-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3756-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1956-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1224-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3388-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/696-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/676-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-576-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbnhnn.exelfrffrl.exennbbtb.exejdppp.exefxllxfx.exelffffll.exehtbbtn.exejpjjd.exelxffxxf.exetbbtnh.exe7lfxlfx.exevddvp.exelfxxrrf.exetbtttt.exedppjp.exebbnnnh.exe1rxrllf.exe5htttb.exethhhtn.exejvppp.exelflflll.exehthhbb.exepppjp.exerlflxrl.exennnnbt.exedvpvj.exetnttbb.exevvdjd.exelfrlfff.exe9hhbtt.exevppjd.exedvjpj.exehbbnbn.exevjpjp.exefrxrlrl.exe7lfxflf.exebnbttt.exenbnhhh.exeddvpp.exe5rffxxl.exerxffxrr.exe1ntnhh.exe5dpjj.exedpvvp.exeffllrrr.exetbtnnn.exehthhhh.exedpvdv.exe5rfffll.exehtnttt.exe7nbbtt.exepvjpv.exexxxxrrl.exetnhbhh.exennhhhn.exeppvpj.exerlrlllf.exerlllffx.exehbnttb.exevdvvd.exerrxxxfx.exeffffxxx.exehtbbnn.exepvjdd.exepid process 4608 hbnhnn.exe 64 lfrffrl.exe 2436 nnbbtb.exe 3604 jdppp.exe 744 fxllxfx.exe 3248 lffffll.exe 3624 htbbtn.exe 1880 jpjjd.exe 4248 lxffxxf.exe 2324 tbbtnh.exe 4488 7lfxlfx.exe 1892 vddvp.exe 964 lfxxrrf.exe 3384 tbtttt.exe 5028 dppjp.exe 3504 bbnnnh.exe 3756 1rxrllf.exe 4756 5htttb.exe 332 thhhtn.exe 676 jvppp.exe 912 lflflll.exe 2608 hthhbb.exe 3240 pppjp.exe 2472 rlflxrl.exe 1636 nnnnbt.exe 4800 dvpvj.exe 2772 tnttbb.exe 2936 vvdjd.exe 4200 lfrlfff.exe 3640 9hhbtt.exe 4036 vppjd.exe 4940 dvjpj.exe 836 hbbnbn.exe 1956 vjpjp.exe 2012 frxrlrl.exe 408 7lfxflf.exe 4196 bnbttt.exe 1768 nbnhhh.exe 4184 ddvpp.exe 3648 5rffxxl.exe 3864 rxffxrr.exe 2824 1ntnhh.exe 4452 5dpjj.exe 4408 dpvvp.exe 4040 ffllrrr.exe 4804 tbtnnn.exe 3672 hthhhh.exe 5084 dpvdv.exe 2296 5rfffll.exe 1316 htnttt.exe 2724 7nbbtt.exe 4884 pvjpv.exe 1432 xxxxrrl.exe 404 tnhbhh.exe 1188 nnhhhn.exe 3204 ppvpj.exe 3592 rlrlllf.exe 2712 rlllffx.exe 2328 hbnttb.exe 3172 vdvvd.exe 3188 rrxxxfx.exe 4680 ffffxxx.exe 4536 htbbnn.exe 3464 pvjdd.exe -
Processes:
resource yara_rule behavioral2/memory/4040-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnhnn.exe upx behavioral2/memory/4608-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfrffrl.exe upx C:\nnbbtb.exe upx behavioral2/memory/2436-14-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdppp.exe upx behavioral2/memory/3604-20-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxllxfx.exe upx behavioral2/memory/744-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lffffll.exe upx behavioral2/memory/3248-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htbbtn.exe upx behavioral2/memory/3248-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3624-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpjjd.exe upx C:\lxffxxf.exe upx behavioral2/memory/4248-45-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbbtnh.exe upx C:\7lfxlfx.exe upx behavioral2/memory/2324-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vddvp.exe upx behavioral2/memory/1892-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxxrrf.exe upx C:\tbtttt.exe upx behavioral2/memory/964-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3384-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dppjp.exe upx behavioral2/memory/5028-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbnnnh.exe upx behavioral2/memory/3504-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3504-81-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1rxrllf.exe upx C:\5htttb.exe upx behavioral2/memory/4756-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3756-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thhhtn.exe upx C:\jvppp.exe upx C:\lflflll.exe upx C:\hthhbb.exe upx behavioral2/memory/912-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2608-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pppjp.exe upx C:\rlflxrl.exe upx behavioral2/memory/3240-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2472-121-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nnnnbt.exe upx behavioral2/memory/1636-123-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvpvj.exe upx behavioral2/memory/4800-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvdjd.exe upx \??\c:\lfrlfff.exe upx behavioral2/memory/2936-137-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnttbb.exe upx \??\c:\9hhbtt.exe upx behavioral2/memory/3640-146-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppjd.exe upx behavioral2/memory/4036-150-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjpj.exe upx behavioral2/memory/1956-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2012-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/408-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4196-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4184-174-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
000ae4b8c49b21970a9b4672d9958e90_NeikiAnalytics.exehbnhnn.exelfrffrl.exennbbtb.exejdppp.exefxllxfx.exelffffll.exehtbbtn.exejpjjd.exelxffxxf.exetbbtnh.exe7lfxlfx.exevddvp.exelfxxrrf.exetbtttt.exedppjp.exebbnnnh.exe1rxrllf.exe5htttb.exethhhtn.exejvppp.exelflflll.exedescription pid process target process PID 4040 wrote to memory of 4608 4040 000ae4b8c49b21970a9b4672d9958e90_NeikiAnalytics.exe hbnhnn.exe PID 4040 wrote to memory of 4608 4040 000ae4b8c49b21970a9b4672d9958e90_NeikiAnalytics.exe hbnhnn.exe PID 4040 wrote to memory of 4608 4040 000ae4b8c49b21970a9b4672d9958e90_NeikiAnalytics.exe hbnhnn.exe PID 4608 wrote to memory of 64 4608 hbnhnn.exe lfrffrl.exe PID 4608 wrote to memory of 64 4608 hbnhnn.exe lfrffrl.exe PID 4608 wrote to memory of 64 4608 hbnhnn.exe lfrffrl.exe PID 64 wrote to memory of 2436 64 lfrffrl.exe nnbbtb.exe PID 64 wrote to memory of 2436 64 lfrffrl.exe nnbbtb.exe PID 64 wrote to memory of 2436 64 lfrffrl.exe nnbbtb.exe PID 2436 wrote to memory of 3604 2436 nnbbtb.exe jdppp.exe PID 2436 wrote to memory of 3604 2436 nnbbtb.exe jdppp.exe PID 2436 wrote to memory of 3604 2436 nnbbtb.exe jdppp.exe PID 3604 wrote to memory of 744 3604 jdppp.exe fxllxfx.exe PID 3604 wrote to memory of 744 3604 jdppp.exe fxllxfx.exe PID 3604 wrote to memory of 744 3604 jdppp.exe fxllxfx.exe PID 744 wrote to memory of 3248 744 fxllxfx.exe lffffll.exe PID 744 wrote to memory of 3248 744 fxllxfx.exe lffffll.exe PID 744 wrote to memory of 3248 744 fxllxfx.exe lffffll.exe PID 3248 wrote to memory of 3624 3248 lffffll.exe htbbtn.exe PID 3248 wrote to memory of 3624 3248 lffffll.exe htbbtn.exe PID 3248 wrote to memory of 3624 3248 lffffll.exe htbbtn.exe PID 3624 wrote to memory of 1880 3624 htbbtn.exe jpjjd.exe PID 3624 wrote to memory of 1880 3624 htbbtn.exe jpjjd.exe PID 3624 wrote to memory of 1880 3624 htbbtn.exe jpjjd.exe PID 1880 wrote to memory of 4248 1880 jpjjd.exe lxffxxf.exe PID 1880 wrote to memory of 4248 1880 jpjjd.exe lxffxxf.exe PID 1880 wrote to memory of 4248 1880 jpjjd.exe lxffxxf.exe PID 4248 wrote to memory of 2324 4248 lxffxxf.exe tbbtnh.exe PID 4248 wrote to memory of 2324 4248 lxffxxf.exe tbbtnh.exe PID 4248 wrote to memory of 2324 4248 lxffxxf.exe tbbtnh.exe PID 2324 wrote to memory of 4488 2324 tbbtnh.exe 7lfxlfx.exe PID 2324 wrote to memory of 4488 2324 tbbtnh.exe 7lfxlfx.exe PID 2324 wrote to memory of 4488 2324 tbbtnh.exe 7lfxlfx.exe PID 4488 wrote to memory of 1892 4488 7lfxlfx.exe vddvp.exe PID 4488 wrote to memory of 1892 4488 7lfxlfx.exe vddvp.exe PID 4488 wrote to memory of 1892 4488 7lfxlfx.exe vddvp.exe PID 1892 wrote to memory of 964 1892 vddvp.exe lfxxrrf.exe PID 1892 wrote to memory of 964 1892 vddvp.exe lfxxrrf.exe PID 1892 wrote to memory of 964 1892 vddvp.exe lfxxrrf.exe PID 964 wrote to memory of 3384 964 lfxxrrf.exe tbtttt.exe PID 964 wrote to memory of 3384 964 lfxxrrf.exe tbtttt.exe PID 964 wrote to memory of 3384 964 lfxxrrf.exe tbtttt.exe PID 3384 wrote to memory of 5028 3384 tbtttt.exe dppjp.exe PID 3384 wrote to memory of 5028 3384 tbtttt.exe dppjp.exe PID 3384 wrote to memory of 5028 3384 tbtttt.exe dppjp.exe PID 5028 wrote to memory of 3504 5028 dppjp.exe bbnnnh.exe PID 5028 wrote to memory of 3504 5028 dppjp.exe bbnnnh.exe PID 5028 wrote to memory of 3504 5028 dppjp.exe bbnnnh.exe PID 3504 wrote to memory of 3756 3504 bbnnnh.exe 1rxrllf.exe PID 3504 wrote to memory of 3756 3504 bbnnnh.exe 1rxrllf.exe PID 3504 wrote to memory of 3756 3504 bbnnnh.exe 1rxrllf.exe PID 3756 wrote to memory of 4756 3756 1rxrllf.exe 5htttb.exe PID 3756 wrote to memory of 4756 3756 1rxrllf.exe 5htttb.exe PID 3756 wrote to memory of 4756 3756 1rxrllf.exe 5htttb.exe PID 4756 wrote to memory of 332 4756 5htttb.exe thhhtn.exe PID 4756 wrote to memory of 332 4756 5htttb.exe thhhtn.exe PID 4756 wrote to memory of 332 4756 5htttb.exe thhhtn.exe PID 332 wrote to memory of 676 332 thhhtn.exe jvppp.exe PID 332 wrote to memory of 676 332 thhhtn.exe jvppp.exe PID 332 wrote to memory of 676 332 thhhtn.exe jvppp.exe PID 676 wrote to memory of 912 676 jvppp.exe lflflll.exe PID 676 wrote to memory of 912 676 jvppp.exe lflflll.exe PID 676 wrote to memory of 912 676 jvppp.exe lflflll.exe PID 912 wrote to memory of 2608 912 lflflll.exe hthhbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\000ae4b8c49b21970a9b4672d9958e90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\000ae4b8c49b21970a9b4672d9958e90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\hbnhnn.exec:\hbnhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\lfrffrl.exec:\lfrffrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\nnbbtb.exec:\nnbbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jdppp.exec:\jdppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\fxllxfx.exec:\fxllxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\lffffll.exec:\lffffll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\htbbtn.exec:\htbbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\jpjjd.exec:\jpjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\lxffxxf.exec:\lxffxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\tbbtnh.exec:\tbbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\7lfxlfx.exec:\7lfxlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\vddvp.exec:\vddvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\lfxxrrf.exec:\lfxxrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\tbtttt.exec:\tbtttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\dppjp.exec:\dppjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\bbnnnh.exec:\bbnnnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\1rxrllf.exec:\1rxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\5htttb.exec:\5htttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\thhhtn.exec:\thhhtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\jvppp.exec:\jvppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\lflflll.exec:\lflflll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\hthhbb.exec:\hthhbb.exe23⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pppjp.exec:\pppjp.exe24⤵
- Executes dropped EXE
PID:3240 -
\??\c:\rlflxrl.exec:\rlflxrl.exe25⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nnnnbt.exec:\nnnnbt.exe26⤵
- Executes dropped EXE
PID:1636 -
\??\c:\dvpvj.exec:\dvpvj.exe27⤵
- Executes dropped EXE
PID:4800 -
\??\c:\tnttbb.exec:\tnttbb.exe28⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vvdjd.exec:\vvdjd.exe29⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lfrlfff.exec:\lfrlfff.exe30⤵
- Executes dropped EXE
PID:4200 -
\??\c:\9hhbtt.exec:\9hhbtt.exe31⤵
- Executes dropped EXE
PID:3640 -
\??\c:\vppjd.exec:\vppjd.exe32⤵
- Executes dropped EXE
PID:4036 -
\??\c:\dvjpj.exec:\dvjpj.exe33⤵
- Executes dropped EXE
PID:4940 -
\??\c:\hbbnbn.exec:\hbbnbn.exe34⤵
- Executes dropped EXE
PID:836 -
\??\c:\vjpjp.exec:\vjpjp.exe35⤵
- Executes dropped EXE
PID:1956 -
\??\c:\frxrlrl.exec:\frxrlrl.exe36⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7lfxflf.exec:\7lfxflf.exe37⤵
- Executes dropped EXE
PID:408 -
\??\c:\bnbttt.exec:\bnbttt.exe38⤵
- Executes dropped EXE
PID:4196 -
\??\c:\nbnhhh.exec:\nbnhhh.exe39⤵
- Executes dropped EXE
PID:1768 -
\??\c:\ddvpp.exec:\ddvpp.exe40⤵
- Executes dropped EXE
PID:4184 -
\??\c:\5rffxxl.exec:\5rffxxl.exe41⤵
- Executes dropped EXE
PID:3648 -
\??\c:\rxffxrr.exec:\rxffxrr.exe42⤵
- Executes dropped EXE
PID:3864 -
\??\c:\1ntnhh.exec:\1ntnhh.exe43⤵
- Executes dropped EXE
PID:2824 -
\??\c:\5dpjj.exec:\5dpjj.exe44⤵
- Executes dropped EXE
PID:4452 -
\??\c:\dpvvp.exec:\dpvvp.exe45⤵
- Executes dropped EXE
PID:4408 -
\??\c:\ffllrrr.exec:\ffllrrr.exe46⤵
- Executes dropped EXE
PID:4040 -
\??\c:\tbtnnn.exec:\tbtnnn.exe47⤵
- Executes dropped EXE
PID:4804 -
\??\c:\hthhhh.exec:\hthhhh.exe48⤵
- Executes dropped EXE
PID:3672 -
\??\c:\dpvdv.exec:\dpvdv.exe49⤵
- Executes dropped EXE
PID:5084 -
\??\c:\5rfffll.exec:\5rfffll.exe50⤵
- Executes dropped EXE
PID:2296 -
\??\c:\htnttt.exec:\htnttt.exe51⤵
- Executes dropped EXE
PID:1316 -
\??\c:\7nbbtt.exec:\7nbbtt.exe52⤵
- Executes dropped EXE
PID:2724 -
\??\c:\pvjpv.exec:\pvjpv.exe53⤵
- Executes dropped EXE
PID:4884 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe54⤵
- Executes dropped EXE
PID:1432 -
\??\c:\tnhbhh.exec:\tnhbhh.exe55⤵
- Executes dropped EXE
PID:404 -
\??\c:\nnhhhn.exec:\nnhhhn.exe56⤵
- Executes dropped EXE
PID:1188 -
\??\c:\ppvpj.exec:\ppvpj.exe57⤵
- Executes dropped EXE
PID:3204 -
\??\c:\rlrlllf.exec:\rlrlllf.exe58⤵
- Executes dropped EXE
PID:3592 -
\??\c:\rlllffx.exec:\rlllffx.exe59⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hbnttb.exec:\hbnttb.exe60⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vdvvd.exec:\vdvvd.exe61⤵
- Executes dropped EXE
PID:3172 -
\??\c:\rrxxxfx.exec:\rrxxxfx.exe62⤵
- Executes dropped EXE
PID:3188 -
\??\c:\ffffxxx.exec:\ffffxxx.exe63⤵
- Executes dropped EXE
PID:4680 -
\??\c:\htbbnn.exec:\htbbnn.exe64⤵
- Executes dropped EXE
PID:4536 -
\??\c:\pvjdd.exec:\pvjdd.exe65⤵
- Executes dropped EXE
PID:3464 -
\??\c:\rrrrlrf.exec:\rrrrlrf.exe66⤵PID:2880
-
\??\c:\3nnnnn.exec:\3nnnnn.exe67⤵PID:3016
-
\??\c:\jdddd.exec:\jdddd.exe68⤵PID:3208
-
\??\c:\jpppv.exec:\jpppv.exe69⤵PID:5044
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe70⤵PID:3256
-
\??\c:\bnhhtb.exec:\bnhhtb.exe71⤵PID:3104
-
\??\c:\1nnnnt.exec:\1nnnnt.exe72⤵PID:3192
-
\??\c:\pppvd.exec:\pppvd.exe73⤵PID:976
-
\??\c:\3rxrllf.exec:\3rxrllf.exe74⤵PID:1908
-
\??\c:\hhnnnn.exec:\hhnnnn.exe75⤵PID:748
-
\??\c:\jjjjd.exec:\jjjjd.exe76⤵PID:1168
-
\??\c:\dpjjv.exec:\dpjjv.exe77⤵PID:376
-
\??\c:\lrffxxx.exec:\lrffxxx.exe78⤵PID:3240
-
\??\c:\9bnnhh.exec:\9bnnhh.exe79⤵PID:2480
-
\??\c:\vjpjd.exec:\vjpjd.exe80⤵PID:4480
-
\??\c:\frxfxxf.exec:\frxfxxf.exe81⤵PID:1224
-
\??\c:\fxxlxxf.exec:\fxxlxxf.exe82⤵PID:3388
-
\??\c:\hbbthh.exec:\hbbthh.exe83⤵PID:4800
-
\??\c:\pvpdv.exec:\pvpdv.exe84⤵PID:2772
-
\??\c:\7rlllrx.exec:\7rlllrx.exe85⤵PID:4784
-
\??\c:\tntttb.exec:\tntttb.exe86⤵PID:2032
-
\??\c:\nnttbn.exec:\nnttbn.exe87⤵PID:3528
-
\??\c:\dvppd.exec:\dvppd.exe88⤵PID:5072
-
\??\c:\7lxffll.exec:\7lxffll.exe89⤵PID:3996
-
\??\c:\frffllr.exec:\frffllr.exe90⤵PID:4036
-
\??\c:\3ntthn.exec:\3ntthn.exe91⤵PID:2212
-
\??\c:\jvpvj.exec:\jvpvj.exe92⤵PID:1548
-
\??\c:\djpjp.exec:\djpjp.exe93⤵PID:1032
-
\??\c:\dvppj.exec:\dvppj.exe94⤵PID:2168
-
\??\c:\9llffff.exec:\9llffff.exe95⤵PID:2624
-
\??\c:\hhbtnn.exec:\hhbtnn.exe96⤵PID:4688
-
\??\c:\9vjpv.exec:\9vjpv.exe97⤵PID:2852
-
\??\c:\jdddd.exec:\jdddd.exe98⤵PID:3712
-
\??\c:\rfrfxfx.exec:\rfrfxfx.exe99⤵PID:4592
-
\??\c:\hbhbhh.exec:\hbhbhh.exe100⤵PID:4452
-
\??\c:\hnbhbb.exec:\hnbhbb.exe101⤵PID:4124
-
\??\c:\1ppjj.exec:\1ppjj.exe102⤵PID:1812
-
\??\c:\xllfflf.exec:\xllfflf.exe103⤵PID:3280
-
\??\c:\1lrrlrr.exec:\1lrrlrr.exe104⤵PID:2296
-
\??\c:\nnnnnn.exec:\nnnnnn.exe105⤵PID:1232
-
\??\c:\tnbttt.exec:\tnbttt.exe106⤵PID:1696
-
\??\c:\vppvp.exec:\vppvp.exe107⤵PID:2236
-
\??\c:\frxfxff.exec:\frxfxff.exe108⤵PID:980
-
\??\c:\nhbbht.exec:\nhbbht.exe109⤵PID:3624
-
\??\c:\tthbbb.exec:\tthbbb.exe110⤵PID:2580
-
\??\c:\jvpjd.exec:\jvpjd.exe111⤵PID:4668
-
\??\c:\5rlllll.exec:\5rlllll.exe112⤵PID:2324
-
\??\c:\9ttttt.exec:\9ttttt.exe113⤵PID:2856
-
\??\c:\thhhhh.exec:\thhhhh.exe114⤵PID:696
-
\??\c:\jppjd.exec:\jppjd.exe115⤵PID:4536
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe116⤵PID:3384
-
\??\c:\nnnnnn.exec:\nnnnnn.exe117⤵PID:396
-
\??\c:\ppvjd.exec:\ppvjd.exe118⤵PID:3504
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe119⤵PID:3756
-
\??\c:\bttttt.exec:\bttttt.exe120⤵PID:1552
-
\??\c:\hhnnhn.exec:\hhnnhn.exe121⤵PID:3104
-
\??\c:\vvvpj.exec:\vvvpj.exe122⤵PID:1720
-
\??\c:\5fffffx.exec:\5fffffx.exe123⤵PID:976
-
\??\c:\bbhhbh.exec:\bbhhbh.exe124⤵PID:912
-
\??\c:\pjdvp.exec:\pjdvp.exe125⤵PID:2612
-
\??\c:\btbhhh.exec:\btbhhh.exe126⤵PID:2876
-
\??\c:\pvdjp.exec:\pvdjp.exe127⤵PID:1856
-
\??\c:\jdvvj.exec:\jdvvj.exe128⤵PID:872
-
\??\c:\9fxrlrx.exec:\9fxrlrx.exe129⤵PID:2472
-
\??\c:\9tnhbb.exec:\9tnhbb.exe130⤵PID:2848
-
\??\c:\ttbnht.exec:\ttbnht.exe131⤵PID:2444
-
\??\c:\dvjjj.exec:\dvjjj.exe132⤵PID:4892
-
\??\c:\lrflxrr.exec:\lrflxrr.exe133⤵PID:3808
-
\??\c:\tnthth.exec:\tnthth.exe134⤵PID:4800
-
\??\c:\pdjdd.exec:\pdjdd.exe135⤵PID:2936
-
\??\c:\llflffx.exec:\llflffx.exe136⤵PID:4200
-
\??\c:\rrxrlrf.exec:\rrxrlrf.exe137⤵PID:4676
-
\??\c:\bnbhnt.exec:\bnbhnt.exe138⤵PID:3260
-
\??\c:\jddpj.exec:\jddpj.exe139⤵PID:5072
-
\??\c:\3lrlffx.exec:\3lrlffx.exe140⤵PID:4588
-
\??\c:\7ttnnh.exec:\7ttnnh.exe141⤵PID:3304
-
\??\c:\nhhbtn.exec:\nhhbtn.exe142⤵PID:1632
-
\??\c:\5pjdv.exec:\5pjdv.exe143⤵PID:3196
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe144⤵PID:916
-
\??\c:\tnhbtt.exec:\tnhbtt.exe145⤵PID:408
-
\??\c:\vddjd.exec:\vddjd.exe146⤵PID:4996
-
\??\c:\5lrlxxx.exec:\5lrlxxx.exe147⤵PID:4144
-
\??\c:\xrlrffr.exec:\xrlrffr.exe148⤵PID:4692
-
\??\c:\bhbbnn.exec:\bhbbnn.exe149⤵PID:3784
-
\??\c:\5jpjd.exec:\5jpjd.exe150⤵PID:832
-
\??\c:\5ppdp.exec:\5ppdp.exe151⤵PID:64
-
\??\c:\xrlxfff.exec:\xrlxfff.exe152⤵PID:1812
-
\??\c:\btbnnt.exec:\btbnnt.exe153⤵PID:3280
-
\??\c:\tnnhtt.exec:\tnnhtt.exe154⤵PID:2296
-
\??\c:\1jjjj.exec:\1jjjj.exe155⤵PID:1232
-
\??\c:\rxffllr.exec:\rxffllr.exe156⤵PID:5052
-
\??\c:\3tttnn.exec:\3tttnn.exe157⤵PID:2968
-
\??\c:\hhthbb.exec:\hhthbb.exe158⤵PID:2504
-
\??\c:\ppjjd.exec:\ppjjd.exe159⤵PID:4904
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe160⤵PID:4248
-
\??\c:\xlrxrxr.exec:\xlrxrxr.exe161⤵PID:2328
-
\??\c:\7djjj.exec:\7djjj.exe162⤵PID:2428
-
\??\c:\llfrxxx.exec:\llfrxxx.exe163⤵PID:2856
-
\??\c:\xrxxxrl.exec:\xrxxxrl.exe164⤵PID:1084
-
\??\c:\nhhhbt.exec:\nhhhbt.exe165⤵PID:2880
-
\??\c:\3jppp.exec:\3jppp.exe166⤵PID:4872
-
\??\c:\5fxxrff.exec:\5fxxrff.exe167⤵PID:5036
-
\??\c:\htbnbt.exec:\htbnbt.exe168⤵PID:2240
-
\??\c:\1nbnnn.exec:\1nbnnn.exe169⤵PID:4380
-
\??\c:\9ppjj.exec:\9ppjj.exe170⤵PID:3192
-
\??\c:\rxlllll.exec:\rxlllll.exe171⤵PID:676
-
\??\c:\hhtntt.exec:\hhtntt.exe172⤵PID:1508
-
\??\c:\bbbbbh.exec:\bbbbbh.exe173⤵PID:2536
-
\??\c:\5vjdj.exec:\5vjdj.exe174⤵PID:2612
-
\??\c:\1fffxrf.exec:\1fffxrf.exe175⤵PID:2876
-
\??\c:\nntttn.exec:\nntttn.exe176⤵PID:1856
-
\??\c:\pvjdd.exec:\pvjdd.exe177⤵PID:1492
-
\??\c:\1xrlrrr.exec:\1xrlrrr.exe178⤵PID:2720
-
\??\c:\nnbbnt.exec:\nnbbnt.exe179⤵PID:2600
-
\??\c:\1bhhbt.exec:\1bhhbt.exe180⤵PID:2992
-
\??\c:\lfrllfr.exec:\lfrllfr.exe181⤵PID:740
-
\??\c:\lrxffxx.exec:\lrxffxx.exe182⤵PID:2280
-
\??\c:\ttnthb.exec:\ttnthb.exe183⤵PID:4200
-
\??\c:\9jjdp.exec:\9jjdp.exe184⤵PID:4676
-
\??\c:\pjvvj.exec:\pjvvj.exe185⤵PID:3260
-
\??\c:\frxrlll.exec:\frxrlll.exe186⤵PID:4036
-
\??\c:\tnnhhb.exec:\tnnhhb.exe187⤵PID:4052
-
\??\c:\pjpjv.exec:\pjpjv.exe188⤵PID:1364
-
\??\c:\pdjjd.exec:\pdjjd.exe189⤵PID:1884
-
\??\c:\flxlflf.exec:\flxlflf.exe190⤵PID:1032
-
\??\c:\tnbbhn.exec:\tnbbhn.exe191⤵PID:808
-
\??\c:\pdvpj.exec:\pdvpj.exe192⤵PID:4688
-
\??\c:\xlxxxfx.exec:\xlxxxfx.exe193⤵PID:4996
-
\??\c:\bbnthb.exec:\bbnthb.exe194⤵PID:4144
-
\??\c:\htbtbb.exec:\htbtbb.exe195⤵PID:3712
-
\??\c:\7ppjd.exec:\7ppjd.exe196⤵PID:5000
-
\??\c:\llxrlll.exec:\llxrlll.exe197⤵PID:4032
-
\??\c:\xrxrffx.exec:\xrxrffx.exe198⤵PID:3604
-
\??\c:\bhhhhh.exec:\bhhhhh.exe199⤵PID:2436
-
\??\c:\9nbttt.exec:\9nbttt.exe200⤵PID:1788
-
\??\c:\dpdvv.exec:\dpdvv.exe201⤵PID:2724
-
\??\c:\llrlfff.exec:\llrlfff.exe202⤵PID:1232
-
\??\c:\bttttt.exec:\bttttt.exe203⤵PID:2236
-
\??\c:\vvppj.exec:\vvppj.exe204⤵PID:3752
-
\??\c:\jpjjj.exec:\jpjjj.exe205⤵PID:2660
-
\??\c:\ffllrrl.exec:\ffllrrl.exe206⤵PID:1096
-
\??\c:\1lllffl.exec:\1lllffl.exe207⤵PID:4680
-
\??\c:\hhhhhh.exec:\hhhhhh.exe208⤵PID:2156
-
\??\c:\btnhnn.exec:\btnhnn.exe209⤵PID:4536
-
\??\c:\vvjdv.exec:\vvjdv.exe210⤵PID:2880
-
\??\c:\rflllrl.exec:\rflllrl.exe211⤵PID:4872
-
\??\c:\xxxxxff.exec:\xxxxxff.exe212⤵PID:5036
-
\??\c:\ttnnnt.exec:\ttnnnt.exe213⤵PID:2240
-
\??\c:\vpdvv.exec:\vpdvv.exe214⤵PID:4380
-
\??\c:\ppddj.exec:\ppddj.exe215⤵PID:2084
-
\??\c:\5rxxffr.exec:\5rxxffr.exe216⤵PID:2068
-
\??\c:\thnttn.exec:\thnttn.exe217⤵PID:4988
-
\??\c:\nbhbhh.exec:\nbhbhh.exe218⤵PID:4276
-
\??\c:\vpvvj.exec:\vpvvj.exe219⤵PID:376
-
\??\c:\dpdvj.exec:\dpdvj.exe220⤵PID:2876
-
\??\c:\rxrxffx.exec:\rxrxffx.exe221⤵PID:1756
-
\??\c:\9nbnhn.exec:\9nbnhn.exe222⤵PID:2444
-
\??\c:\tbbtnb.exec:\tbbtnb.exe223⤵PID:1120
-
\??\c:\1pjdp.exec:\1pjdp.exe224⤵PID:4800
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe225⤵PID:2936
-
\??\c:\ffxlfll.exec:\ffxlfll.exe226⤵PID:1056
-
\??\c:\tthhnn.exec:\tthhnn.exe227⤵PID:4312
-
\??\c:\ddpjd.exec:\ddpjd.exe228⤵PID:3260
-
\??\c:\pddvv.exec:\pddvv.exe229⤵PID:4036
-
\??\c:\xrrllll.exec:\xrrllll.exe230⤵PID:4876
-
\??\c:\hbnnnn.exec:\hbnnnn.exe231⤵PID:4980
-
\??\c:\ddppd.exec:\ddppd.exe232⤵PID:2168
-
\??\c:\rlrllfx.exec:\rlrllfx.exe233⤵PID:1032
-
\??\c:\rlrlffx.exec:\rlrlffx.exe234⤵PID:2908
-
\??\c:\ntbbbb.exec:\ntbbbb.exe235⤵PID:2852
-
\??\c:\bnhttb.exec:\bnhttb.exe236⤵PID:2292
-
\??\c:\vpdjv.exec:\vpdjv.exe237⤵PID:4072
-
\??\c:\rlfxrrx.exec:\rlfxrrx.exe238⤵PID:1988
-
\??\c:\btbtnh.exec:\btbtnh.exe239⤵PID:3940
-
\??\c:\5hhnbb.exec:\5hhnbb.exe240⤵PID:4032
-
\??\c:\rlxrllr.exec:\rlxrllr.exe241⤵PID:1316
-
\??\c:\xrrlfff.exec:\xrrlfff.exe242⤵PID:3516