Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:47
Behavioral task
behavioral1
Sample
5966d5110f575445a7280c3fb897c7b0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5966d5110f575445a7280c3fb897c7b0_NeikiAnalytics.exe
-
Size
83KB
-
MD5
5966d5110f575445a7280c3fb897c7b0
-
SHA1
48567bebb4c98e7193a666ffb7baf9bdbabae25c
-
SHA256
cfcdb38a610c2aecd42cebb6afc3cc25f6310435a0244599bbe06fb03eab5be7
-
SHA512
b03794c021ba84984a593ddc2d5fdda93dc27267d743dd540b2944882f9b8dc2f1df3056b64b9c9ab81d0498fce8311bc0b44c8ce358af57f75f96c27570d9ae
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TQpCihfj:zhOmTsF93UYfwC6GIoutiTU2HVS64hb
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1492-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1460-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1208-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1956-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1292-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-618-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1780-705-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-709-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lrrrrrr.exellrflfx.exethnnth.exeddjjj.exeflrfrrl.exehntnnn.exeppvvv.exerlxxrrl.exetbhhtt.exejdjjj.exelrxxffl.exe3nbttb.exevdppp.exefxlrxrl.exenhnbtt.exejjjdv.exedddjd.exelxllfll.exehhttnn.exejdjjj.exedvpvv.exefxrrfrl.exevvjjd.exexxffffl.exehtnnhn.exetbbttt.exe5dpjj.exelllflrf.exetthhnt.exeddjvj.exerllffff.exenbnhnt.exevvjjp.exerxxllfr.exe9xlfxff.exebbttht.exevvdvp.exepppvv.exerlfflrx.exehnbbbh.exedpjpv.exerlxlrll.exerxxxffx.exeddppj.exepvjdp.exerfxrlll.exelfxxxxr.exenbhttt.exejdvvv.exevppjj.exefffffxx.exenhbtbt.exe1djdj.exe5rxfxff.exerllfxxr.exebtthht.exevvjdp.exelfllxrl.exexxllffr.exehnbhht.exeppvpv.exevvddp.exefrrlxfr.exebbbtnb.exepid process 556 lrrrrrr.exe 1384 llrflfx.exe 1284 thnnth.exe 1460 ddjjj.exe 1392 flrfrrl.exe 2140 hntnnn.exe 3580 ppvvv.exe 5040 rlxxrrl.exe 3448 tbhhtt.exe 1940 jdjjj.exe 4904 lrxxffl.exe 5112 3nbttb.exe 3536 vdppp.exe 4212 fxlrxrl.exe 3604 nhnbtt.exe 2664 jjjdv.exe 4872 dddjd.exe 3660 lxllfll.exe 2280 hhttnn.exe 3444 jdjjj.exe 3852 dvpvv.exe 224 fxrrfrl.exe 3652 vvjjd.exe 1208 xxffffl.exe 4860 htnnhn.exe 1904 tbbttt.exe 3192 5dpjj.exe 2196 lllflrf.exe 1404 tthhnt.exe 4296 ddjvj.exe 3992 rllffff.exe 4564 nbnhnt.exe 4220 vvjjp.exe 3880 rxxllfr.exe 5116 9xlfxff.exe 2136 bbttht.exe 3188 vvdvp.exe 2524 pppvv.exe 1736 rlfflrx.exe 4476 hnbbbh.exe 2424 dpjpv.exe 5000 rlxlrll.exe 1052 rxxxffx.exe 3088 ddppj.exe 4724 pvjdp.exe 4616 rfxrlll.exe 4376 lfxxxxr.exe 4928 nbhttt.exe 2444 jdvvv.exe 1040 vppjj.exe 1680 fffffxx.exe 1284 nhbtbt.exe 4496 1djdj.exe 2672 5rxfxff.exe 2976 rllfxxr.exe 728 btthht.exe 1032 vvjdp.exe 1784 lfllxrl.exe 2020 xxllffr.exe 4268 hnbhht.exe 4804 ppvpv.exe 3984 vvddp.exe 2916 frrlxfr.exe 3440 bbbtnb.exe -
Processes:
resource yara_rule behavioral2/memory/1492-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrrrrrr.exe upx behavioral2/memory/1492-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/556-7-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llrflfx.exe upx behavioral2/memory/1384-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thnnth.exe upx behavioral2/memory/1284-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1384-20-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddjjj.exe upx behavioral2/memory/1460-23-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flrfrrl.exe upx C:\hntnnn.exe upx behavioral2/memory/1392-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2140-33-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppvvv.exe upx C:\rlxxrrl.exe upx behavioral2/memory/3580-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5040-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbhhtt.exe upx behavioral2/memory/5040-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3448-48-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdjjj.exe upx C:\lrxxffl.exe upx behavioral2/memory/1940-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4904-61-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3nbttb.exe upx behavioral2/memory/5112-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vdppp.exe upx C:\fxlrxrl.exe upx behavioral2/memory/3536-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnbtt.exe upx behavioral2/memory/4212-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjdv.exe upx behavioral2/memory/3604-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddjd.exe upx behavioral2/memory/2664-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4872-88-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxllfll.exe upx behavioral2/memory/3660-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhttnn.exe upx behavioral2/memory/2280-99-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdjjj.exe upx behavioral2/memory/3444-104-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvpvv.exe upx C:\fxrrfrl.exe upx C:\vvjjd.exe upx behavioral2/memory/224-115-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxffffl.exe upx behavioral2/memory/3652-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1208-122-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\htnnhn.exe upx behavioral2/memory/4860-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1208-129-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbbttt.exe upx behavioral2/memory/1904-133-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5dpjj.exe upx C:\lllflrf.exe upx behavioral2/memory/2196-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1404-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3192-143-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tthhnt.exe upx \??\c:\ddjvj.exe upx C:\rllffff.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5966d5110f575445a7280c3fb897c7b0_NeikiAnalytics.exelrrrrrr.exellrflfx.exethnnth.exeddjjj.exeflrfrrl.exehntnnn.exeppvvv.exerlxxrrl.exetbhhtt.exejdjjj.exelrxxffl.exe3nbttb.exevdppp.exefxlrxrl.exenhnbtt.exejjjdv.exedddjd.exelxllfll.exehhttnn.exejdjjj.exedvpvv.exedescription pid process target process PID 1492 wrote to memory of 556 1492 5966d5110f575445a7280c3fb897c7b0_NeikiAnalytics.exe lrrrrrr.exe PID 1492 wrote to memory of 556 1492 5966d5110f575445a7280c3fb897c7b0_NeikiAnalytics.exe lrrrrrr.exe PID 1492 wrote to memory of 556 1492 5966d5110f575445a7280c3fb897c7b0_NeikiAnalytics.exe lrrrrrr.exe PID 556 wrote to memory of 1384 556 lrrrrrr.exe llrflfx.exe PID 556 wrote to memory of 1384 556 lrrrrrr.exe llrflfx.exe PID 556 wrote to memory of 1384 556 lrrrrrr.exe llrflfx.exe PID 1384 wrote to memory of 1284 1384 llrflfx.exe thnnth.exe PID 1384 wrote to memory of 1284 1384 llrflfx.exe thnnth.exe PID 1384 wrote to memory of 1284 1384 llrflfx.exe thnnth.exe PID 1284 wrote to memory of 1460 1284 thnnth.exe ddjjj.exe PID 1284 wrote to memory of 1460 1284 thnnth.exe ddjjj.exe PID 1284 wrote to memory of 1460 1284 thnnth.exe ddjjj.exe PID 1460 wrote to memory of 1392 1460 ddjjj.exe flrfrrl.exe PID 1460 wrote to memory of 1392 1460 ddjjj.exe flrfrrl.exe PID 1460 wrote to memory of 1392 1460 ddjjj.exe flrfrrl.exe PID 1392 wrote to memory of 2140 1392 flrfrrl.exe hntnnn.exe PID 1392 wrote to memory of 2140 1392 flrfrrl.exe hntnnn.exe PID 1392 wrote to memory of 2140 1392 flrfrrl.exe hntnnn.exe PID 2140 wrote to memory of 3580 2140 hntnnn.exe ppvvv.exe PID 2140 wrote to memory of 3580 2140 hntnnn.exe ppvvv.exe PID 2140 wrote to memory of 3580 2140 hntnnn.exe ppvvv.exe PID 3580 wrote to memory of 5040 3580 ppvvv.exe rlxxrrl.exe PID 3580 wrote to memory of 5040 3580 ppvvv.exe rlxxrrl.exe PID 3580 wrote to memory of 5040 3580 ppvvv.exe rlxxrrl.exe PID 5040 wrote to memory of 3448 5040 rlxxrrl.exe tbhhtt.exe PID 5040 wrote to memory of 3448 5040 rlxxrrl.exe tbhhtt.exe PID 5040 wrote to memory of 3448 5040 rlxxrrl.exe tbhhtt.exe PID 3448 wrote to memory of 1940 3448 tbhhtt.exe jdjjj.exe PID 3448 wrote to memory of 1940 3448 tbhhtt.exe jdjjj.exe PID 3448 wrote to memory of 1940 3448 tbhhtt.exe jdjjj.exe PID 1940 wrote to memory of 4904 1940 jdjjj.exe lrxxffl.exe PID 1940 wrote to memory of 4904 1940 jdjjj.exe lrxxffl.exe PID 1940 wrote to memory of 4904 1940 jdjjj.exe lrxxffl.exe PID 4904 wrote to memory of 5112 4904 lrxxffl.exe 3nbttb.exe PID 4904 wrote to memory of 5112 4904 lrxxffl.exe 3nbttb.exe PID 4904 wrote to memory of 5112 4904 lrxxffl.exe 3nbttb.exe PID 5112 wrote to memory of 3536 5112 3nbttb.exe vdppp.exe PID 5112 wrote to memory of 3536 5112 3nbttb.exe vdppp.exe PID 5112 wrote to memory of 3536 5112 3nbttb.exe vdppp.exe PID 3536 wrote to memory of 4212 3536 vdppp.exe fxlrxrl.exe PID 3536 wrote to memory of 4212 3536 vdppp.exe fxlrxrl.exe PID 3536 wrote to memory of 4212 3536 vdppp.exe fxlrxrl.exe PID 4212 wrote to memory of 3604 4212 fxlrxrl.exe nhnbtt.exe PID 4212 wrote to memory of 3604 4212 fxlrxrl.exe nhnbtt.exe PID 4212 wrote to memory of 3604 4212 fxlrxrl.exe nhnbtt.exe PID 3604 wrote to memory of 2664 3604 nhnbtt.exe jjjdv.exe PID 3604 wrote to memory of 2664 3604 nhnbtt.exe jjjdv.exe PID 3604 wrote to memory of 2664 3604 nhnbtt.exe jjjdv.exe PID 2664 wrote to memory of 4872 2664 jjjdv.exe dddjd.exe PID 2664 wrote to memory of 4872 2664 jjjdv.exe dddjd.exe PID 2664 wrote to memory of 4872 2664 jjjdv.exe dddjd.exe PID 4872 wrote to memory of 3660 4872 dddjd.exe lxllfll.exe PID 4872 wrote to memory of 3660 4872 dddjd.exe lxllfll.exe PID 4872 wrote to memory of 3660 4872 dddjd.exe lxllfll.exe PID 3660 wrote to memory of 2280 3660 lxllfll.exe hhttnn.exe PID 3660 wrote to memory of 2280 3660 lxllfll.exe hhttnn.exe PID 3660 wrote to memory of 2280 3660 lxllfll.exe hhttnn.exe PID 2280 wrote to memory of 3444 2280 hhttnn.exe jdjjj.exe PID 2280 wrote to memory of 3444 2280 hhttnn.exe jdjjj.exe PID 2280 wrote to memory of 3444 2280 hhttnn.exe jdjjj.exe PID 3444 wrote to memory of 3852 3444 jdjjj.exe dvpvv.exe PID 3444 wrote to memory of 3852 3444 jdjjj.exe dvpvv.exe PID 3444 wrote to memory of 3852 3444 jdjjj.exe dvpvv.exe PID 3852 wrote to memory of 224 3852 dvpvv.exe fxrrfrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5966d5110f575445a7280c3fb897c7b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5966d5110f575445a7280c3fb897c7b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\llrflfx.exec:\llrflfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\thnnth.exec:\thnnth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\ddjjj.exec:\ddjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\flrfrrl.exec:\flrfrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\hntnnn.exec:\hntnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\ppvvv.exec:\ppvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\rlxxrrl.exec:\rlxxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\tbhhtt.exec:\tbhhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\jdjjj.exec:\jdjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\lrxxffl.exec:\lrxxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\3nbttb.exec:\3nbttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\vdppp.exec:\vdppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\fxlrxrl.exec:\fxlrxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\nhnbtt.exec:\nhnbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\jjjdv.exec:\jjjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\dddjd.exec:\dddjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\lxllfll.exec:\lxllfll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\hhttnn.exec:\hhttnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\jdjjj.exec:\jdjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\dvpvv.exec:\dvpvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\fxrrfrl.exec:\fxrrfrl.exe23⤵
- Executes dropped EXE
PID:224 -
\??\c:\vvjjd.exec:\vvjjd.exe24⤵
- Executes dropped EXE
PID:3652 -
\??\c:\xxffffl.exec:\xxffffl.exe25⤵
- Executes dropped EXE
PID:1208 -
\??\c:\htnnhn.exec:\htnnhn.exe26⤵
- Executes dropped EXE
PID:4860 -
\??\c:\tbbttt.exec:\tbbttt.exe27⤵
- Executes dropped EXE
PID:1904 -
\??\c:\5dpjj.exec:\5dpjj.exe28⤵
- Executes dropped EXE
PID:3192 -
\??\c:\lllflrf.exec:\lllflrf.exe29⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tthhnt.exec:\tthhnt.exe30⤵
- Executes dropped EXE
PID:1404 -
\??\c:\ddjvj.exec:\ddjvj.exe31⤵
- Executes dropped EXE
PID:4296 -
\??\c:\rllffff.exec:\rllffff.exe32⤵
- Executes dropped EXE
PID:3992 -
\??\c:\nbnhnt.exec:\nbnhnt.exe33⤵
- Executes dropped EXE
PID:4564 -
\??\c:\vvjjp.exec:\vvjjp.exe34⤵
- Executes dropped EXE
PID:4220 -
\??\c:\rxxllfr.exec:\rxxllfr.exe35⤵
- Executes dropped EXE
PID:3880 -
\??\c:\9xlfxff.exec:\9xlfxff.exe36⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bbttht.exec:\bbttht.exe37⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vvdvp.exec:\vvdvp.exe38⤵
- Executes dropped EXE
PID:3188 -
\??\c:\pppvv.exec:\pppvv.exe39⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rlfflrx.exec:\rlfflrx.exe40⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hnbbbh.exec:\hnbbbh.exe41⤵
- Executes dropped EXE
PID:4476 -
\??\c:\dpjpv.exec:\dpjpv.exe42⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rlxlrll.exec:\rlxlrll.exe43⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rxxxffx.exec:\rxxxffx.exe44⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ddppj.exec:\ddppj.exe45⤵
- Executes dropped EXE
PID:3088 -
\??\c:\pvjdp.exec:\pvjdp.exe46⤵
- Executes dropped EXE
PID:4724 -
\??\c:\rfxrlll.exec:\rfxrlll.exe47⤵
- Executes dropped EXE
PID:4616 -
\??\c:\lfxxxxr.exec:\lfxxxxr.exe48⤵
- Executes dropped EXE
PID:4376 -
\??\c:\nbhttt.exec:\nbhttt.exe49⤵
- Executes dropped EXE
PID:4928 -
\??\c:\jdvvv.exec:\jdvvv.exe50⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vppjj.exec:\vppjj.exe51⤵
- Executes dropped EXE
PID:1040 -
\??\c:\fffffxx.exec:\fffffxx.exe52⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nhbtbt.exec:\nhbtbt.exe53⤵
- Executes dropped EXE
PID:1284 -
\??\c:\1djdj.exec:\1djdj.exe54⤵
- Executes dropped EXE
PID:4496 -
\??\c:\5rxfxff.exec:\5rxfxff.exe55⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rllfxxr.exec:\rllfxxr.exe56⤵
- Executes dropped EXE
PID:2976 -
\??\c:\btthht.exec:\btthht.exe57⤵
- Executes dropped EXE
PID:728 -
\??\c:\vvjdp.exec:\vvjdp.exe58⤵
- Executes dropped EXE
PID:1032 -
\??\c:\lfllxrl.exec:\lfllxrl.exe59⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xxllffr.exec:\xxllffr.exe60⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hnbhht.exec:\hnbhht.exe61⤵
- Executes dropped EXE
PID:4268 -
\??\c:\ppvpv.exec:\ppvpv.exe62⤵
- Executes dropped EXE
PID:4804 -
\??\c:\vvddp.exec:\vvddp.exe63⤵
- Executes dropped EXE
PID:3984 -
\??\c:\frrlxfr.exec:\frrlxfr.exe64⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bbbtnb.exec:\bbbtnb.exe65⤵
- Executes dropped EXE
PID:3440 -
\??\c:\7btbbt.exec:\7btbbt.exe66⤵PID:1436
-
\??\c:\pppjd.exec:\pppjd.exe67⤵PID:5112
-
\??\c:\xrffxxx.exec:\xrffxxx.exe68⤵PID:3536
-
\??\c:\nttnhb.exec:\nttnhb.exe69⤵PID:2984
-
\??\c:\dddpp.exec:\dddpp.exe70⤵PID:116
-
\??\c:\vvvvv.exec:\vvvvv.exe71⤵PID:3604
-
\??\c:\5frlflf.exec:\5frlflf.exe72⤵PID:2664
-
\??\c:\lrffrfl.exec:\lrffrfl.exe73⤵PID:4516
-
\??\c:\bhntbb.exec:\bhntbb.exe74⤵PID:2500
-
\??\c:\3pddd.exec:\3pddd.exe75⤵PID:4036
-
\??\c:\5jvjj.exec:\5jvjj.exe76⤵PID:2292
-
\??\c:\lffllrf.exec:\lffllrf.exe77⤵PID:4604
-
\??\c:\btbhhb.exec:\btbhhb.exe78⤵PID:4556
-
\??\c:\7jdpp.exec:\7jdpp.exe79⤵PID:1956
-
\??\c:\jvvdv.exec:\jvvdv.exe80⤵PID:1048
-
\??\c:\fxllfxf.exec:\fxllfxf.exe81⤵PID:4288
-
\??\c:\ntnnbb.exec:\ntnnbb.exe82⤵PID:3628
-
\??\c:\bbtnhh.exec:\bbtnhh.exe83⤵PID:4340
-
\??\c:\vvvpd.exec:\vvvpd.exe84⤵PID:2180
-
\??\c:\dvvvp.exec:\dvvvp.exe85⤵PID:1340
-
\??\c:\rxxlrxx.exec:\rxxlrxx.exe86⤵PID:4100
-
\??\c:\nnbnhb.exec:\nnbnhb.exe87⤵PID:4108
-
\??\c:\dvjdp.exec:\dvjdp.exe88⤵PID:228
-
\??\c:\pjjdv.exec:\pjjdv.exe89⤵PID:4880
-
\??\c:\lfrrlrr.exec:\lfrrlrr.exe90⤵PID:4296
-
\??\c:\hbnnnn.exec:\hbnnnn.exe91⤵PID:4300
-
\??\c:\9hhhhh.exec:\9hhhhh.exe92⤵PID:4688
-
\??\c:\pvjdv.exec:\pvjdv.exe93⤵PID:3844
-
\??\c:\flllrrx.exec:\flllrrx.exe94⤵PID:3388
-
\??\c:\fxlflxx.exec:\fxlflxx.exe95⤵PID:1196
-
\??\c:\ntnnnb.exec:\ntnnnb.exe96⤵PID:392
-
\??\c:\3bhtnh.exec:\3bhtnh.exe97⤵PID:2136
-
\??\c:\pdpvp.exec:\pdpvp.exe98⤵PID:4920
-
\??\c:\rxrlxxl.exec:\rxrlxxl.exe99⤵PID:4388
-
\??\c:\fflllll.exec:\fflllll.exe100⤵PID:1612
-
\??\c:\xrxrfrr.exec:\xrxrfrr.exe101⤵PID:2896
-
\??\c:\1tttnt.exec:\1tttnt.exe102⤵PID:3480
-
\??\c:\jjppd.exec:\jjppd.exe103⤵PID:5000
-
\??\c:\dpvpv.exec:\dpvpv.exe104⤵PID:1052
-
\??\c:\llxrllf.exec:\llxrllf.exe105⤵PID:3088
-
\??\c:\ffffflr.exec:\ffffflr.exe106⤵PID:4724
-
\??\c:\hbhhhb.exec:\hbhhhb.exe107⤵PID:2612
-
\??\c:\nnbttn.exec:\nnbttn.exe108⤵PID:3112
-
\??\c:\hnhhnt.exec:\hnhhnt.exe109⤵PID:3244
-
\??\c:\tbntbh.exec:\tbntbh.exe110⤵PID:5036
-
\??\c:\vjjpd.exec:\vjjpd.exe111⤵PID:944
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe112⤵PID:516
-
\??\c:\nnttnh.exec:\nnttnh.exe113⤵PID:1016
-
\??\c:\bnnhhh.exec:\bnnhhh.exe114⤵PID:4996
-
\??\c:\dvppp.exec:\dvppp.exe115⤵PID:3976
-
\??\c:\lxfflll.exec:\lxfflll.exe116⤵PID:3580
-
\??\c:\1lllfll.exec:\1lllfll.exe117⤵PID:776
-
\??\c:\htnhbt.exec:\htnhbt.exe118⤵PID:4888
-
\??\c:\5nhnnh.exec:\5nhnnh.exe119⤵PID:3984
-
\??\c:\dvjdp.exec:\dvjdp.exe120⤵PID:2916
-
\??\c:\lffxxxx.exec:\lffxxxx.exe121⤵PID:1928
-
\??\c:\hhbbtt.exec:\hhbbtt.exe122⤵PID:2960
-
\??\c:\7bnhhh.exec:\7bnhhh.exe123⤵PID:5112
-
\??\c:\ddddv.exec:\ddddv.exe124⤵PID:4540
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe125⤵PID:4396
-
\??\c:\lllffxr.exec:\lllffxr.exe126⤵PID:2036
-
\??\c:\tnhbbt.exec:\tnhbbt.exe127⤵PID:2604
-
\??\c:\pjpvd.exec:\pjpvd.exe128⤵PID:4452
-
\??\c:\7llxxrx.exec:\7llxxrx.exe129⤵PID:3444
-
\??\c:\lxrxxxr.exec:\lxrxxxr.exe130⤵PID:4732
-
\??\c:\hnnhbh.exec:\hnnhbh.exe131⤵PID:2996
-
\??\c:\pjddd.exec:\pjddd.exe132⤵PID:4604
-
\??\c:\5pvvv.exec:\5pvvv.exe133⤵PID:2352
-
\??\c:\rxfxllf.exec:\rxfxllf.exe134⤵PID:3220
-
\??\c:\btbttb.exec:\btbttb.exe135⤵PID:3484
-
\??\c:\vpdjj.exec:\vpdjj.exe136⤵PID:5016
-
\??\c:\lrfrlrx.exec:\lrfrlrx.exe137⤵PID:1616
-
\??\c:\rrxxfrf.exec:\rrxxfrf.exe138⤵PID:4896
-
\??\c:\hntbbh.exec:\hntbbh.exe139⤵PID:3632
-
\??\c:\xfrlfff.exec:\xfrlfff.exe140⤵PID:3700
-
\??\c:\frxllfr.exec:\frxllfr.exe141⤵PID:3968
-
\??\c:\nnttnn.exec:\nnttnn.exe142⤵PID:3156
-
\??\c:\1lfxrll.exec:\1lfxrll.exe143⤵PID:4880
-
\??\c:\vpdvv.exec:\vpdvv.exe144⤵PID:3592
-
\??\c:\rxrfflx.exec:\rxrfflx.exe145⤵PID:4300
-
\??\c:\btbttn.exec:\btbttn.exe146⤵PID:4688
-
\??\c:\pjdvv.exec:\pjdvv.exe147⤵PID:3880
-
\??\c:\xrxfrfl.exec:\xrxfrfl.exe148⤵PID:4444
-
\??\c:\llxrlll.exec:\llxrlll.exe149⤵PID:4076
-
\??\c:\thhhhh.exec:\thhhhh.exe150⤵PID:3188
-
\??\c:\fllrrrx.exec:\fllrrrx.exe151⤵PID:3644
-
\??\c:\7ttbbb.exec:\7ttbbb.exe152⤵PID:1972
-
\??\c:\flrrrrx.exec:\flrrrrx.exe153⤵PID:644
-
\??\c:\nnnbhh.exec:\nnnbhh.exe154⤵PID:2896
-
\??\c:\djjdj.exec:\djjdj.exe155⤵PID:3480
-
\??\c:\1xllffr.exec:\1xllffr.exe156⤵PID:5000
-
\??\c:\9bbbtt.exec:\9bbbtt.exe157⤵PID:3608
-
\??\c:\nbhhbb.exec:\nbhhbb.exe158⤵PID:1292
-
\??\c:\xllfxlx.exec:\xllfxlx.exe159⤵PID:4520
-
\??\c:\thhbht.exec:\thhbht.exe160⤵PID:388
-
\??\c:\bhntnh.exec:\bhntnh.exe161⤵PID:3244
-
\??\c:\llllllf.exec:\llllllf.exe162⤵PID:5036
-
\??\c:\hnbhbn.exec:\hnbhbn.exe163⤵PID:4356
-
\??\c:\jjdjv.exec:\jjdjv.exe164⤵PID:4224
-
\??\c:\xlrfrxx.exec:\xlrfrxx.exe165⤵PID:2080
-
\??\c:\bhnnhn.exec:\bhnnhn.exe166⤵PID:2976
-
\??\c:\jppvj.exec:\jppvj.exe167⤵PID:1032
-
\??\c:\vpdjv.exec:\vpdjv.exe168⤵PID:3028
-
\??\c:\1ttnnt.exec:\1ttnnt.exe169⤵PID:3624
-
\??\c:\nnnttb.exec:\nnnttb.exe170⤵PID:4904
-
\??\c:\pjppv.exec:\pjppv.exe171⤵PID:3440
-
\??\c:\dpvpj.exec:\dpvpj.exe172⤵PID:2348
-
\??\c:\rlxxfll.exec:\rlxxfll.exe173⤵PID:632
-
\??\c:\7rxxxfr.exec:\7rxxxfr.exe174⤵PID:4212
-
\??\c:\7nbtnt.exec:\7nbtnt.exe175⤵PID:3684
-
\??\c:\hbbtnt.exec:\hbbtnt.exe176⤵PID:1860
-
\??\c:\pvvvp.exec:\pvvvp.exe177⤵PID:4872
-
\??\c:\jjjjp.exec:\jjjjp.exe178⤵PID:4452
-
\??\c:\xfrrffr.exec:\xfrrffr.exe179⤵PID:3444
-
\??\c:\frrflxf.exec:\frrflxf.exe180⤵PID:220
-
\??\c:\hhbnbh.exec:\hhbnbh.exe181⤵PID:376
-
\??\c:\tnhhhn.exec:\tnhhhn.exe182⤵PID:3888
-
\??\c:\vdvvj.exec:\vdvvj.exe183⤵PID:5076
-
\??\c:\rxfxffr.exec:\rxfxffr.exe184⤵PID:3956
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe185⤵PID:1904
-
\??\c:\ttntbb.exec:\ttntbb.exe186⤵PID:2180
-
\??\c:\dppjp.exec:\dppjp.exe187⤵PID:1748
-
\??\c:\lfffffl.exec:\lfffffl.exe188⤵PID:3632
-
\??\c:\5llllrr.exec:\5llllrr.exe189⤵PID:3700
-
\??\c:\hhhnhh.exec:\hhhnhh.exe190⤵PID:1036
-
\??\c:\dvvpd.exec:\dvvpd.exe191⤵PID:3636
-
\??\c:\lxflxff.exec:\lxflxff.exe192⤵PID:4000
-
\??\c:\rfxxrlx.exec:\rfxxrlx.exe193⤵PID:1520
-
\??\c:\bbbttn.exec:\bbbttn.exe194⤵PID:440
-
\??\c:\pvjdv.exec:\pvjdv.exe195⤵PID:2156
-
\??\c:\vdjdv.exec:\vdjdv.exe196⤵PID:2400
-
\??\c:\9fflfrf.exec:\9fflfrf.exe197⤵PID:3988
-
\??\c:\lxfrrxr.exec:\lxfrrxr.exe198⤵PID:3188
-
\??\c:\9bbbbb.exec:\9bbbbb.exe199⤵PID:3736
-
\??\c:\vddpp.exec:\vddpp.exe200⤵PID:1972
-
\??\c:\rfrlllr.exec:\rfrlllr.exe201⤵PID:644
-
\??\c:\1rrrrrr.exec:\1rrrrrr.exe202⤵PID:2896
-
\??\c:\htbttt.exec:\htbttt.exe203⤵PID:1052
-
\??\c:\vjpvd.exec:\vjpvd.exe204⤵PID:1660
-
\??\c:\rxxrrll.exec:\rxxrrll.exe205⤵PID:4724
-
\??\c:\rrrrlll.exec:\rrrrlll.exe206⤵PID:4376
-
\??\c:\bbnbtn.exec:\bbnbtn.exe207⤵PID:904
-
\??\c:\9jpjj.exec:\9jpjj.exe208⤵PID:388
-
\??\c:\pjdjd.exec:\pjdjd.exe209⤵PID:1364
-
\??\c:\rlxrlll.exec:\rlxrlll.exe210⤵PID:4664
-
\??\c:\7fffrfx.exec:\7fffrfx.exe211⤵PID:1460
-
\??\c:\nthbtt.exec:\nthbtt.exe212⤵PID:1016
-
\??\c:\nnnhbh.exec:\nnnhbh.exe213⤵PID:4892
-
\??\c:\vjjdd.exec:\vjjdd.exe214⤵PID:1032
-
\??\c:\jvddj.exec:\jvddj.exe215⤵PID:3028
-
\??\c:\7fffxll.exec:\7fffxll.exe216⤵PID:3624
-
\??\c:\hbnnnt.exec:\hbnnnt.exe217⤵PID:4904
-
\??\c:\nbbbnt.exec:\nbbbnt.exe218⤵PID:3440
-
\??\c:\jddvp.exec:\jddvp.exe219⤵PID:2348
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe220⤵PID:632
-
\??\c:\rlrfrlr.exec:\rlrfrlr.exe221⤵PID:4212
-
\??\c:\9bnbnh.exec:\9bnbnh.exe222⤵PID:1640
-
\??\c:\pvjvj.exec:\pvjvj.exe223⤵PID:1860
-
\??\c:\fllfxfr.exec:\fllfxfr.exe224⤵PID:4872
-
\??\c:\nbhbhh.exec:\nbhbhh.exe225⤵PID:4452
-
\??\c:\7nbttt.exec:\7nbttt.exe226⤵PID:3444
-
\??\c:\jjvjd.exec:\jjvjd.exe227⤵PID:1956
-
\??\c:\ffrllll.exec:\ffrllll.exe228⤵PID:3788
-
\??\c:\xflflll.exec:\xflflll.exe229⤵PID:4860
-
\??\c:\bnthht.exec:\bnthht.exe230⤵PID:2972
-
\??\c:\pjdpj.exec:\pjdpj.exe231⤵PID:3676
-
\??\c:\rlrlllr.exec:\rlrlllr.exe232⤵PID:4572
-
\??\c:\1ttthh.exec:\1ttthh.exe233⤵PID:4896
-
\??\c:\9tbtnn.exec:\9tbtnn.exe234⤵PID:228
-
\??\c:\ppjdd.exec:\ppjdd.exe235⤵PID:4108
-
\??\c:\rfffxll.exec:\rfffxll.exe236⤵PID:3700
-
\??\c:\xflflll.exec:\xflflll.exe237⤵PID:1544
-
\??\c:\nnhhnh.exec:\nnhhnh.exe238⤵PID:2468
-
\??\c:\htbtnh.exec:\htbtnh.exe239⤵PID:4220
-
\??\c:\jvpjd.exec:\jvpjd.exe240⤵PID:3880
-
\??\c:\1flfrxr.exec:\1flfrxr.exe241⤵PID:5116
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe242⤵PID:3184