Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 23:23
Behavioral task
behavioral1
Sample
5ad9b96c1e44ffe851006baaacdc3030_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5ad9b96c1e44ffe851006baaacdc3030_NeikiAnalytics.exe
-
Size
285KB
-
MD5
5ad9b96c1e44ffe851006baaacdc3030
-
SHA1
15095458310e9950dfe916f829082017633ad1e3
-
SHA256
5f95060a7956bc0d5907954b05825be11b957a35ccbe9402ecde383af25fc3f8
-
SHA512
b438708b3ac1da97c1c00f5cf51acf6f84672756cea17e315a0f084d369a0453331a66050283887d5a939bdc56e974bd0686c7959849c877a39a8754991916ea
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4t+IDvSXrh5g8hZTyoImZ:y4wFHoS3eFp3IDvSbh5nP+oImZ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/556-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2564-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/864-788-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-781-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-723-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2564-698-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-553-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3832-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/864-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1712-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9xrfxlf.exe3nhbnn.exejvdpj.exefrrlllf.exelxfrlfx.exe7hhbtt.exevvjdd.exexrfxrrr.exehtbnhb.exe7bthbt.exepjddd.exexxrfrlf.exebtbtnh.exehnnhtt.exejjvvj.exexrfxllf.exe3bnnnt.exetnbhnh.exejddpd.exe3ffxllf.exebnhbbh.exedvdvj.exe7rlffxf.exexrrlrxx.exetbthbt.exevpppp.exelrrlllf.exenntbhh.exennnnnt.exe7jjpj.exefxfllrl.exe9bbnnb.exejjpjj.exerxrxrlf.exefffxrrf.exennnnhh.exedvpjd.exerffxrrf.exe5nnbbb.exenbtbtt.exejjvpj.exexxrlffx.exenhbhbt.exe7tbbbh.exe5vjjp.exe5rxxxxx.exebhnnnn.exe3bthtn.exe3vjdp.exelflxrxr.exelllfrrl.exe3tttnn.exejpvvj.exexrxxrrr.exebbhbth.exethnnnn.exeppvpd.exerflfxrr.exefxrlfxr.exehhnnht.exejvvvj.exepjdjj.exerfllfff.exe1ntnth.exepid process 5052 9xrfxlf.exe 2012 3nhbnn.exe 556 jvdpj.exe 2224 frrlllf.exe 2552 lxfrlfx.exe 1712 7hhbtt.exe 2796 vvjdd.exe 2556 xrfxrrr.exe 864 htbnhb.exe 4660 7bthbt.exe 2824 pjddd.exe 2124 xxrfrlf.exe 2360 btbtnh.exe 2576 hnnhtt.exe 4756 jjvvj.exe 2500 xrfxllf.exe 3252 3bnnnt.exe 3216 tnbhnh.exe 1312 jddpd.exe 1688 3ffxllf.exe 396 bnhbbh.exe 2492 dvdvj.exe 1216 7rlffxf.exe 1844 xrrlrxx.exe 3744 tbthbt.exe 4936 vpppp.exe 2844 lrrlllf.exe 4012 nntbhh.exe 4496 nnnnnt.exe 908 7jjpj.exe 1636 fxfllrl.exe 3300 9bbnnb.exe 1760 jjpjj.exe 2164 rxrxrlf.exe 2096 fffxrrf.exe 2988 nnnnhh.exe 3832 dvpjd.exe 4280 rffxrrf.exe 2548 5nnbbb.exe 3584 nbtbtt.exe 64 jjvpj.exe 1020 xxrlffx.exe 3676 nhbhbt.exe 2064 7tbbbh.exe 2036 5vjjp.exe 1840 5rxxxxx.exe 1792 bhnnnn.exe 4632 3bthtn.exe 3880 3vjdp.exe 3956 lflxrxr.exe 3844 lllfrrl.exe 804 3tttnn.exe 3716 jpvvj.exe 3968 xrxxrrr.exe 3476 bbhbth.exe 4548 thnnnn.exe 3252 ppvpd.exe 2172 rflfxrr.exe 536 fxrlfxr.exe 624 hhnnht.exe 3720 jvvvj.exe 1248 pjdjj.exe 4760 rfllfff.exe 3812 1ntnth.exe -
Processes:
resource yara_rule C:\3nhbnn.exe upx C:\jvdpj.exe upx \??\c:\frrlllf.exe upx behavioral2/memory/556-23-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxfrlfx.exe upx behavioral2/memory/2796-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/864-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2124-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4756-93-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3bnnnt.exe upx C:\tnbhnh.exe upx \??\c:\jddpd.exe upx \??\c:\7rlffxf.exe upx \??\c:\vpppp.exe upx \??\c:\lrrlllf.exe upx behavioral2/memory/2844-167-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7jjpj.exe upx \??\c:\9bbnnb.exe upx behavioral2/memory/2988-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2064-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4632-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3880-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3956-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3476-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/536-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3812-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2564-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1616-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4864-344-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3436-354-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4968-398-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1956-403-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1456-420-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3184-427-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2204-450-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1932-458-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4424-462-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2596-472-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4868-482-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2228-489-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4924-516-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2096-611-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4688-617-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4204-625-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2064-645-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/64-765-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2156-828-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2644-818-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2012-805-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/756-795-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/864-788-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4436-781-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4688-749-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/912-733-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1692-723-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2564-698-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1420-670-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2548-629-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4528-607-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4932-594-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2088-566-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/748-553-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5056-540-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3232-536-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5ad9b96c1e44ffe851006baaacdc3030_NeikiAnalytics.exe9xrfxlf.exe3nhbnn.exejvdpj.exefrrlllf.exelxfrlfx.exe7hhbtt.exevvjdd.exexrfxrrr.exehtbnhb.exe7bthbt.exepjddd.exexxrfrlf.exebtbtnh.exehnnhtt.exejjvvj.exexrfxllf.exe3bnnnt.exetnbhnh.exejddpd.exe3ffxllf.exebnhbbh.exedescription pid process target process PID 4204 wrote to memory of 5052 4204 5ad9b96c1e44ffe851006baaacdc3030_NeikiAnalytics.exe 9xrfxlf.exe PID 4204 wrote to memory of 5052 4204 5ad9b96c1e44ffe851006baaacdc3030_NeikiAnalytics.exe 9xrfxlf.exe PID 4204 wrote to memory of 5052 4204 5ad9b96c1e44ffe851006baaacdc3030_NeikiAnalytics.exe 9xrfxlf.exe PID 5052 wrote to memory of 2012 5052 9xrfxlf.exe 3nhbnn.exe PID 5052 wrote to memory of 2012 5052 9xrfxlf.exe 3nhbnn.exe PID 5052 wrote to memory of 2012 5052 9xrfxlf.exe 3nhbnn.exe PID 2012 wrote to memory of 556 2012 3nhbnn.exe pjjjv.exe PID 2012 wrote to memory of 556 2012 3nhbnn.exe pjjjv.exe PID 2012 wrote to memory of 556 2012 3nhbnn.exe pjjjv.exe PID 556 wrote to memory of 2224 556 jvdpj.exe frrlllf.exe PID 556 wrote to memory of 2224 556 jvdpj.exe frrlllf.exe PID 556 wrote to memory of 2224 556 jvdpj.exe frrlllf.exe PID 2224 wrote to memory of 2552 2224 frrlllf.exe lxfrlfx.exe PID 2224 wrote to memory of 2552 2224 frrlllf.exe lxfrlfx.exe PID 2224 wrote to memory of 2552 2224 frrlllf.exe lxfrlfx.exe PID 2552 wrote to memory of 1712 2552 lxfrlfx.exe 7hhbtt.exe PID 2552 wrote to memory of 1712 2552 lxfrlfx.exe 7hhbtt.exe PID 2552 wrote to memory of 1712 2552 lxfrlfx.exe 7hhbtt.exe PID 1712 wrote to memory of 2796 1712 7hhbtt.exe vvjdd.exe PID 1712 wrote to memory of 2796 1712 7hhbtt.exe vvjdd.exe PID 1712 wrote to memory of 2796 1712 7hhbtt.exe vvjdd.exe PID 2796 wrote to memory of 2556 2796 vvjdd.exe xrfxrrr.exe PID 2796 wrote to memory of 2556 2796 vvjdd.exe xrfxrrr.exe PID 2796 wrote to memory of 2556 2796 vvjdd.exe xrfxrrr.exe PID 2556 wrote to memory of 864 2556 xrfxrrr.exe htbnhb.exe PID 2556 wrote to memory of 864 2556 xrfxrrr.exe htbnhb.exe PID 2556 wrote to memory of 864 2556 xrfxrrr.exe htbnhb.exe PID 864 wrote to memory of 4660 864 htbnhb.exe 7bthbt.exe PID 864 wrote to memory of 4660 864 htbnhb.exe 7bthbt.exe PID 864 wrote to memory of 4660 864 htbnhb.exe 7bthbt.exe PID 4660 wrote to memory of 2824 4660 7bthbt.exe pjddd.exe PID 4660 wrote to memory of 2824 4660 7bthbt.exe pjddd.exe PID 4660 wrote to memory of 2824 4660 7bthbt.exe pjddd.exe PID 2824 wrote to memory of 2124 2824 pjddd.exe xxrfrlf.exe PID 2824 wrote to memory of 2124 2824 pjddd.exe xxrfrlf.exe PID 2824 wrote to memory of 2124 2824 pjddd.exe xxrfrlf.exe PID 2124 wrote to memory of 2360 2124 xxrfrlf.exe btbtnh.exe PID 2124 wrote to memory of 2360 2124 xxrfrlf.exe btbtnh.exe PID 2124 wrote to memory of 2360 2124 xxrfrlf.exe btbtnh.exe PID 2360 wrote to memory of 2576 2360 btbtnh.exe hnnhtt.exe PID 2360 wrote to memory of 2576 2360 btbtnh.exe hnnhtt.exe PID 2360 wrote to memory of 2576 2360 btbtnh.exe hnnhtt.exe PID 2576 wrote to memory of 4756 2576 hnnhtt.exe jjvvj.exe PID 2576 wrote to memory of 4756 2576 hnnhtt.exe jjvvj.exe PID 2576 wrote to memory of 4756 2576 hnnhtt.exe jjvvj.exe PID 4756 wrote to memory of 2500 4756 jjvvj.exe xrfxllf.exe PID 4756 wrote to memory of 2500 4756 jjvvj.exe xrfxllf.exe PID 4756 wrote to memory of 2500 4756 jjvvj.exe xrfxllf.exe PID 2500 wrote to memory of 3252 2500 xrfxllf.exe 3bnnnt.exe PID 2500 wrote to memory of 3252 2500 xrfxllf.exe 3bnnnt.exe PID 2500 wrote to memory of 3252 2500 xrfxllf.exe 3bnnnt.exe PID 3252 wrote to memory of 3216 3252 3bnnnt.exe tnbhnh.exe PID 3252 wrote to memory of 3216 3252 3bnnnt.exe tnbhnh.exe PID 3252 wrote to memory of 3216 3252 3bnnnt.exe tnbhnh.exe PID 3216 wrote to memory of 1312 3216 tnbhnh.exe jddpd.exe PID 3216 wrote to memory of 1312 3216 tnbhnh.exe jddpd.exe PID 3216 wrote to memory of 1312 3216 tnbhnh.exe jddpd.exe PID 1312 wrote to memory of 1688 1312 jddpd.exe 3ffxllf.exe PID 1312 wrote to memory of 1688 1312 jddpd.exe 3ffxllf.exe PID 1312 wrote to memory of 1688 1312 jddpd.exe 3ffxllf.exe PID 1688 wrote to memory of 396 1688 3ffxllf.exe pdvjv.exe PID 1688 wrote to memory of 396 1688 3ffxllf.exe pdvjv.exe PID 1688 wrote to memory of 396 1688 3ffxllf.exe pdvjv.exe PID 396 wrote to memory of 2492 396 bnhbbh.exe dvdvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ad9b96c1e44ffe851006baaacdc3030_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5ad9b96c1e44ffe851006baaacdc3030_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\9xrfxlf.exec:\9xrfxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\3nhbnn.exec:\3nhbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\jvdpj.exec:\jvdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\frrlllf.exec:\frrlllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\lxfrlfx.exec:\lxfrlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\7hhbtt.exec:\7hhbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\vvjdd.exec:\vvjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\htbnhb.exec:\htbnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\7bthbt.exec:\7bthbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\pjddd.exec:\pjddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xxrfrlf.exec:\xxrfrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\btbtnh.exec:\btbtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\hnnhtt.exec:\hnnhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\jjvvj.exec:\jjvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\xrfxllf.exec:\xrfxllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\3bnnnt.exec:\3bnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\tnbhnh.exec:\tnbhnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\jddpd.exec:\jddpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\3ffxllf.exec:\3ffxllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\bnhbbh.exec:\bnhbbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\dvdvj.exec:\dvdvj.exe23⤵
- Executes dropped EXE
PID:2492 -
\??\c:\7rlffxf.exec:\7rlffxf.exe24⤵
- Executes dropped EXE
PID:1216 -
\??\c:\xrrlrxx.exec:\xrrlrxx.exe25⤵
- Executes dropped EXE
PID:1844 -
\??\c:\tbthbt.exec:\tbthbt.exe26⤵
- Executes dropped EXE
PID:3744 -
\??\c:\vpppp.exec:\vpppp.exe27⤵
- Executes dropped EXE
PID:4936 -
\??\c:\lrrlllf.exec:\lrrlllf.exe28⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nntbhh.exec:\nntbhh.exe29⤵
- Executes dropped EXE
PID:4012 -
\??\c:\nnnnnt.exec:\nnnnnt.exe30⤵
- Executes dropped EXE
PID:4496 -
\??\c:\7jjpj.exec:\7jjpj.exe31⤵
- Executes dropped EXE
PID:908 -
\??\c:\fxfllrl.exec:\fxfllrl.exe32⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9bbnnb.exec:\9bbnnb.exe33⤵
- Executes dropped EXE
PID:3300 -
\??\c:\jjpjj.exec:\jjpjj.exe34⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rxrxrlf.exec:\rxrxrlf.exe35⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fffxrrf.exec:\fffxrrf.exe36⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nnnnhh.exec:\nnnnhh.exe37⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dvpjd.exec:\dvpjd.exe38⤵
- Executes dropped EXE
PID:3832 -
\??\c:\rffxrrf.exec:\rffxrrf.exe39⤵
- Executes dropped EXE
PID:4280 -
\??\c:\5nnbbb.exec:\5nnbbb.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nbtbtt.exec:\nbtbtt.exe41⤵
- Executes dropped EXE
PID:3584 -
\??\c:\jjvpj.exec:\jjvpj.exe42⤵
- Executes dropped EXE
PID:64 -
\??\c:\xxrlffx.exec:\xxrlffx.exe43⤵
- Executes dropped EXE
PID:1020 -
\??\c:\nhbhbt.exec:\nhbhbt.exe44⤵
- Executes dropped EXE
PID:3676 -
\??\c:\7tbbbh.exec:\7tbbbh.exe45⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5vjjp.exec:\5vjjp.exe46⤵
- Executes dropped EXE
PID:2036 -
\??\c:\5rxxxxx.exec:\5rxxxxx.exe47⤵
- Executes dropped EXE
PID:1840 -
\??\c:\bhnnnn.exec:\bhnnnn.exe48⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3bthtn.exec:\3bthtn.exe49⤵
- Executes dropped EXE
PID:4632 -
\??\c:\3vjdp.exec:\3vjdp.exe50⤵
- Executes dropped EXE
PID:3880 -
\??\c:\lflxrxr.exec:\lflxrxr.exe51⤵
- Executes dropped EXE
PID:3956 -
\??\c:\lllfrrl.exec:\lllfrrl.exe52⤵
- Executes dropped EXE
PID:3844 -
\??\c:\3tttnn.exec:\3tttnn.exe53⤵
- Executes dropped EXE
PID:804 -
\??\c:\jpvvj.exec:\jpvvj.exe54⤵
- Executes dropped EXE
PID:3716 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe55⤵
- Executes dropped EXE
PID:3968 -
\??\c:\bbhbth.exec:\bbhbth.exe56⤵
- Executes dropped EXE
PID:3476 -
\??\c:\thnnnn.exec:\thnnnn.exe57⤵
- Executes dropped EXE
PID:4548 -
\??\c:\ppvpd.exec:\ppvpd.exe58⤵
- Executes dropped EXE
PID:3252 -
\??\c:\rflfxrr.exec:\rflfxrr.exe59⤵
- Executes dropped EXE
PID:2172 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\hhnnht.exec:\hhnnht.exe61⤵
- Executes dropped EXE
PID:624 -
\??\c:\jvvvj.exec:\jvvvj.exe62⤵
- Executes dropped EXE
PID:3720 -
\??\c:\pjdjj.exec:\pjdjj.exe63⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rfllfff.exec:\rfllfff.exe64⤵
- Executes dropped EXE
PID:4760 -
\??\c:\1ntnth.exec:\1ntnth.exe65⤵
- Executes dropped EXE
PID:3812 -
\??\c:\tnhbnn.exec:\tnhbnn.exe66⤵PID:4308
-
\??\c:\pppdp.exec:\pppdp.exe67⤵PID:2564
-
\??\c:\lxfrrlf.exec:\lxfrrlf.exe68⤵PID:2588
-
\??\c:\3lrlffl.exec:\3lrlffl.exe69⤵PID:1656
-
\??\c:\tbthbt.exec:\tbthbt.exe70⤵PID:1540
-
\??\c:\hhtnhh.exec:\hhtnhh.exe71⤵PID:1616
-
\??\c:\vvdvd.exec:\vvdvd.exe72⤵PID:4860
-
\??\c:\5rrllll.exec:\5rrllll.exe73⤵PID:3492
-
\??\c:\fllxfff.exec:\fllxfff.exe74⤵PID:1468
-
\??\c:\ddjdd.exec:\ddjdd.exe75⤵PID:1636
-
\??\c:\xfxffrr.exec:\xfxffrr.exe76⤵PID:5068
-
\??\c:\xrxlxlr.exec:\xrxlxlr.exe77⤵PID:4864
-
\??\c:\1tbbhn.exec:\1tbbhn.exe78⤵PID:4604
-
\??\c:\jjppp.exec:\jjppp.exe79⤵PID:2096
-
\??\c:\3lrfxrl.exec:\3lrfxrl.exe80⤵PID:3436
-
\??\c:\xrllfll.exec:\xrllfll.exe81⤵PID:4356
-
\??\c:\3tnbnh.exec:\3tnbnh.exe82⤵PID:3832
-
\??\c:\dvvvp.exec:\dvvvp.exe83⤵PID:4280
-
\??\c:\vjjjd.exec:\vjjjd.exe84⤵PID:4948
-
\??\c:\7flfxxr.exec:\7flfxxr.exe85⤵PID:556
-
\??\c:\llrflxl.exec:\llrflxl.exe86⤵PID:2580
-
\??\c:\hbhbbn.exec:\hbhbbn.exe87⤵PID:2732
-
\??\c:\bbhbtt.exec:\bbhbtt.exe88⤵PID:1508
-
\??\c:\ppdpp.exec:\ppdpp.exe89⤵PID:3780
-
\??\c:\3ppjv.exec:\3ppjv.exe90⤵PID:1900
-
\??\c:\frrrfrf.exec:\frrrfrf.exe91⤵PID:2064
-
\??\c:\lflllrx.exec:\lflllrx.exe92⤵PID:2036
-
\??\c:\nnttnt.exec:\nnttnt.exe93⤵PID:4968
-
\??\c:\1nbtnh.exec:\1nbtnh.exe94⤵PID:1948
-
\??\c:\3dvpj.exec:\3dvpj.exe95⤵PID:1956
-
\??\c:\xrxlxxr.exec:\xrxlxxr.exe96⤵PID:5056
-
\??\c:\ffxrflx.exec:\ffxrflx.exe97⤵PID:32
-
\??\c:\nbnttt.exec:\nbnttt.exe98⤵PID:1836
-
\??\c:\vppjp.exec:\vppjp.exe99⤵PID:4112
-
\??\c:\frxxxff.exec:\frxxxff.exe100⤵PID:1456
-
\??\c:\1ffxlrr.exec:\1ffxlrr.exe101⤵PID:4572
-
\??\c:\5nhhnt.exec:\5nhhnt.exe102⤵PID:3184
-
\??\c:\ppvdj.exec:\ppvdj.exe103⤵PID:212
-
\??\c:\djjdv.exec:\djjdv.exe104⤵PID:1688
-
\??\c:\lrrflxx.exec:\lrrflxx.exe105⤵PID:1800
-
\??\c:\xlrffff.exec:\xlrffff.exe106⤵PID:4504
-
\??\c:\btnnhb.exec:\btnnhb.exe107⤵PID:3356
-
\??\c:\bbhbhh.exec:\bbhbhh.exe108⤵PID:2204
-
\??\c:\vvpjd.exec:\vvpjd.exe109⤵PID:2588
-
\??\c:\rlrfxrx.exec:\rlrfxrx.exe110⤵PID:1932
-
\??\c:\lrrxlfx.exec:\lrrxlfx.exe111⤵PID:4424
-
\??\c:\hbbtbb.exec:\hbbtbb.exe112⤵PID:4860
-
\??\c:\djjjj.exec:\djjjj.exe113⤵PID:1632
-
\??\c:\dvvvv.exec:\dvvvv.exe114⤵PID:3732
-
\??\c:\llxxxrr.exec:\llxxxrr.exe115⤵PID:2596
-
\??\c:\ntthht.exec:\ntthht.exe116⤵PID:1760
-
\??\c:\btthhb.exec:\btthhb.exe117⤵PID:2860
-
\??\c:\pvdvp.exec:\pvdvp.exe118⤵PID:4868
-
\??\c:\ppvpp.exec:\ppvpp.exe119⤵PID:4048
-
\??\c:\rlrxxff.exec:\rlrxxff.exe120⤵PID:2228
-
\??\c:\fxfxfrx.exec:\fxfxfrx.exe121⤵PID:4360
-
\??\c:\pdjvd.exec:\pdjvd.exe122⤵PID:1360
-
\??\c:\rxrfrfr.exec:\rxrfrfr.exe123⤵PID:4892
-
\??\c:\rlxxxff.exec:\rlxxxff.exe124⤵PID:4204
-
\??\c:\nhhttn.exec:\nhhttn.exe125⤵PID:2548
-
\??\c:\thhbbb.exec:\thhbbb.exe126⤵PID:4392
-
\??\c:\ppjvj.exec:\ppjvj.exe127⤵PID:3536
-
\??\c:\xffxrrl.exec:\xffxrrl.exe128⤵PID:4924
-
\??\c:\flrrrrx.exec:\flrrrrx.exe129⤵PID:4676
-
\??\c:\nhttnt.exec:\nhttnt.exe130⤵PID:3316
-
\??\c:\vppjj.exec:\vppjj.exe131⤵PID:1900
-
\??\c:\5dppj.exec:\5dppj.exe132⤵PID:2032
-
\??\c:\rrxrxrx.exec:\rrxrxrx.exe133⤵PID:4872
-
\??\c:\rllfxxr.exec:\rllfxxr.exe134⤵PID:3232
-
\??\c:\9tnhbb.exec:\9tnhbb.exe135⤵PID:5056
-
\??\c:\jdpjp.exec:\jdpjp.exe136⤵PID:1768
-
\??\c:\jjvdd.exec:\jjvdd.exe137⤵PID:1420
-
\??\c:\llllllr.exec:\llllllr.exe138⤵PID:748
-
\??\c:\xrffrxf.exec:\xrffrxf.exe139⤵PID:5028
-
\??\c:\bhhbnb.exec:\bhhbnb.exe140⤵PID:1812
-
\??\c:\bhtbhn.exec:\bhtbhn.exe141⤵PID:2172
-
\??\c:\pdvjv.exec:\pdvjv.exe142⤵PID:396
-
\??\c:\rfllxfx.exec:\rfllxfx.exe143⤵PID:2088
-
\??\c:\fxlllxx.exec:\fxlllxx.exe144⤵PID:4760
-
\??\c:\tnnntt.exec:\tnnntt.exe145⤵PID:3592
-
\??\c:\bbhhbb.exec:\bbhhbb.exe146⤵PID:2204
-
\??\c:\jdppj.exec:\jdppj.exe147⤵PID:4440
-
\??\c:\dppjj.exec:\dppjj.exe148⤵PID:1932
-
\??\c:\rrlfflf.exec:\rrlfflf.exe149⤵PID:3388
-
\??\c:\rflfxxr.exec:\rflfxxr.exe150⤵PID:4328
-
\??\c:\hhtnnt.exec:\hhtnnt.exe151⤵PID:4284
-
\??\c:\nttnbh.exec:\nttnbh.exe152⤵PID:4932
-
\??\c:\dpppj.exec:\dpppj.exe153⤵PID:1636
-
\??\c:\pdjdv.exec:\pdjdv.exe154⤵PID:5068
-
\??\c:\lrxxxrl.exec:\lrxxxrl.exe155⤵PID:2304
-
\??\c:\bbbttn.exec:\bbbttn.exe156⤵PID:4528
-
\??\c:\tthhbb.exec:\tthhbb.exe157⤵PID:2096
-
\??\c:\pjpvv.exec:\pjpvv.exe158⤵PID:2700
-
\??\c:\pvjdj.exec:\pvjdj.exe159⤵PID:4688
-
\??\c:\xlrlffx.exec:\xlrlffx.exe160⤵PID:760
-
\??\c:\tbhbtt.exec:\tbhbtt.exe161⤵PID:4204
-
\??\c:\ppjjp.exec:\ppjjp.exe162⤵PID:2548
-
\??\c:\jddvp.exec:\jddvp.exe163⤵PID:4392
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe164⤵PID:3536
-
\??\c:\rlffflr.exec:\rlffflr.exe165⤵PID:3168
-
\??\c:\nbttbn.exec:\nbttbn.exe166⤵PID:3892
-
\??\c:\ddvpj.exec:\ddvpj.exe167⤵PID:2064
-
\??\c:\djddv.exec:\djddv.exe168⤵PID:2392
-
\??\c:\rlxxrxx.exec:\rlxxrxx.exe169⤵PID:3208
-
\??\c:\7nhhnn.exec:\7nhhnn.exe170⤵PID:4236
-
\??\c:\bttttt.exec:\bttttt.exe171⤵PID:4100
-
\??\c:\9pvpj.exec:\9pvpj.exe172⤵PID:3232
-
\??\c:\vjppj.exec:\vjppj.exe173⤵PID:5056
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe174⤵PID:1768
-
\??\c:\lllfflx.exec:\lllfflx.exe175⤵PID:1420
-
\??\c:\hhhtnh.exec:\hhhtnh.exe176⤵PID:748
-
\??\c:\9hhhtt.exec:\9hhhtt.exe177⤵PID:3184
-
\??\c:\vvjdj.exec:\vvjdj.exe178⤵PID:2456
-
\??\c:\dvjdd.exec:\dvjdd.exe179⤵PID:2644
-
\??\c:\9lffrxr.exec:\9lffrxr.exe180⤵PID:2832
-
\??\c:\rrxrrll.exec:\rrxrrll.exe181⤵PID:1216
-
\??\c:\ntbhbt.exec:\ntbhbt.exe182⤵PID:4276
-
\??\c:\tntnnh.exec:\tntnnh.exe183⤵PID:1912
-
\??\c:\7vpdv.exec:\7vpdv.exe184⤵PID:2564
-
\??\c:\vvddj.exec:\vvddj.exe185⤵PID:2316
-
\??\c:\lfrfxrf.exec:\lfrfxrf.exe186⤵PID:1596
-
\??\c:\rrrrffr.exec:\rrrrffr.exe187⤵PID:3940
-
\??\c:\bnnnhn.exec:\bnnnhn.exe188⤵PID:1888
-
\??\c:\7nnhbb.exec:\7nnhbb.exe189⤵PID:2892
-
\??\c:\ddvpp.exec:\ddvpp.exe190⤵PID:3732
-
\??\c:\jvdvv.exec:\jvdvv.exe191⤵PID:1692
-
\??\c:\5lxxrrl.exec:\5lxxrrl.exe192⤵PID:3056
-
\??\c:\fxrrxll.exec:\fxrrxll.exe193⤵PID:5068
-
\??\c:\tnnhnh.exec:\tnnhnh.exe194⤵PID:2568
-
\??\c:\9bbttb.exec:\9bbttb.exe195⤵PID:912
-
\??\c:\pvjdd.exec:\pvjdd.exe196⤵PID:3440
-
\??\c:\dvvvj.exec:\dvvvj.exe197⤵PID:5092
-
\??\c:\rrrlrfl.exec:\rrrlrfl.exe198⤵PID:1724
-
\??\c:\nhtthn.exec:\nhtthn.exe199⤵PID:1156
-
\??\c:\hnbbtb.exec:\hnbbtb.exe200⤵PID:4688
-
\??\c:\dpjjj.exec:\dpjjj.exe201⤵PID:3944
-
\??\c:\3dvpj.exec:\3dvpj.exe202⤵PID:2720
-
\??\c:\flxfxxr.exec:\flxfxxr.exe203⤵PID:4640
-
\??\c:\xxffxlx.exec:\xxffxlx.exe204⤵PID:4352
-
\??\c:\tbbthb.exec:\tbbthb.exe205⤵PID:64
-
\??\c:\hntnth.exec:\hntnth.exe206⤵PID:1160
-
\??\c:\djpvd.exec:\djpvd.exe207⤵PID:4912
-
\??\c:\djddp.exec:\djddp.exe208⤵PID:4556
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe209⤵PID:4436
-
\??\c:\lrxrrlf.exec:\lrxrrlf.exe210⤵PID:3452
-
\??\c:\5nbbtb.exec:\5nbbtb.exe211⤵PID:864
-
\??\c:\ntbttt.exec:\ntbttt.exe212⤵PID:5112
-
\??\c:\ddjdv.exec:\ddjdv.exe213⤵PID:32
-
\??\c:\pjppv.exec:\pjppv.exe214⤵PID:756
-
\??\c:\9lrrlll.exec:\9lrrlll.exe215⤵PID:2992
-
\??\c:\flfrflf.exec:\flfrflf.exe216⤵PID:2360
-
\??\c:\7thbhn.exec:\7thbhn.exe217⤵PID:2012
-
\??\c:\5ntnnn.exec:\5ntnnn.exe218⤵PID:748
-
\??\c:\dpvdv.exec:\dpvdv.exe219⤵PID:220
-
\??\c:\vddjv.exec:\vddjv.exe220⤵PID:1812
-
\??\c:\xflfxxr.exec:\xflfxxr.exe221⤵PID:2644
-
\??\c:\xflfffr.exec:\xflfffr.exe222⤵PID:3356
-
\??\c:\hhttbh.exec:\hhttbh.exe223⤵PID:4276
-
\??\c:\ntbtnn.exec:\ntbtnn.exe224⤵PID:2156
-
\??\c:\7vjdv.exec:\7vjdv.exe225⤵PID:2184
-
\??\c:\pjjvd.exec:\pjjvd.exe226⤵PID:4624
-
\??\c:\jpddj.exec:\jpddj.exe227⤵PID:4808
-
\??\c:\ffxrrxr.exec:\ffxrrxr.exe228⤵PID:3492
-
\??\c:\rrfflrx.exec:\rrfflrx.exe229⤵PID:1888
-
\??\c:\btbtbn.exec:\btbtbn.exe230⤵PID:3852
-
\??\c:\btbbtt.exec:\btbbtt.exe231⤵PID:2800
-
\??\c:\ppvvd.exec:\ppvvd.exe232⤵PID:1564
-
\??\c:\ppdjj.exec:\ppdjj.exe233⤵PID:3736
-
\??\c:\fllfxxx.exec:\fllfxxx.exe234⤵PID:1104
-
\??\c:\fffxxxl.exec:\fffxxxl.exe235⤵PID:1760
-
\??\c:\hnhhnh.exec:\hnhhnh.exe236⤵PID:1404
-
\??\c:\1hnhbb.exec:\1hnhbb.exe237⤵PID:4604
-
\??\c:\ppppp.exec:\ppppp.exe238⤵PID:4212
-
\??\c:\pjddd.exec:\pjddd.exe239⤵PID:4904
-
\??\c:\vdvvp.exec:\vdvvp.exe240⤵PID:1840
-
\??\c:\5fffrxx.exec:\5fffrxx.exe241⤵PID:3436
-
\??\c:\lflllll.exec:\lflllll.exe242⤵PID:4568