Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 03:53
Behavioral task
behavioral1
Sample
a572d2146f41c7563ade90df220eec30_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a572d2146f41c7563ade90df220eec30_NeikiAnalytics.exe
-
Size
255KB
-
MD5
a572d2146f41c7563ade90df220eec30
-
SHA1
7a39dbf398278411f9fae96fdec4b035afc3086e
-
SHA256
560ce4c13af91e29af8fa5da84f6db4f69aeeca227025949b56b24818c1c1467
-
SHA512
78fa86bdbdb9212f4a4304339b39972b2fa693f2d506054ddf761ab7c9c9d93c4f7def6a75dcd12b20bda0726f78f7769384d586b3fdfcf240741c23b48eb906
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpolTjZXvEQo9dfra:y4wFHoS3eFaKHpKT9XvEhdfra
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4120-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1416-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1756-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1956-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2960-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/732-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/856-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-563-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-663-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-764-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-802-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-856-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lrrrlrr.exebtbbbb.exejvjjd.exethtnbt.exethhhbh.exevpvvv.exedjddp.exexrflxlx.exevvppj.exettnhht.exevjpdv.exetnbthn.exefflrxfr.exebhbhhb.exedpppp.exerrlrrrl.exefflrrxf.exethhbbb.exe3pvjv.exe9lflrlf.exehbtbbh.exeddppv.exe3lffrfl.exedpjjj.exe9xlrrrr.exenttthb.exe7ppjj.exelxxlxxx.exenbbnhh.exebhhhhh.exevjvjj.exerrflxlx.exerflxxrr.exerrxrfxr.exehhnttt.exe5pdpj.exefrxxrrr.exe7xxxrrl.exebthhnt.exerrffrlx.exexfxrlxx.exetntttt.exejvjdd.exellxxxxl.exehhttbh.exelfrrrxr.exetttbhn.exentnttb.exe7vpvd.exexfxxflf.exehttthb.exevvvvd.exedjdjj.exefllxlfl.exebbhhbn.exejdjjj.exe5rllfrl.exe7httbb.exetnnbbb.exeddvvd.exerrxflrx.exehbbhbh.exefrxffxf.exebbbnth.exepid process 3716 lrrrlrr.exe 668 btbbbb.exe 2544 jvjjd.exe 4704 thtnbt.exe 4124 thhhbh.exe 932 vpvvv.exe 1484 djddp.exe 3168 xrflxlx.exe 4360 vvppj.exe 4776 ttnhht.exe 1416 vjpdv.exe 1032 tnbthn.exe 1756 fflrxfr.exe 3292 bhbhhb.exe 4040 dpppp.exe 1212 rrlrrrl.exe 1488 fflrrxf.exe 1760 thhbbb.exe 3712 3pvjv.exe 1956 9lflrlf.exe 3100 hbtbbh.exe 4960 ddppv.exe 2640 3lffrfl.exe 1232 dpjjj.exe 2616 9xlrrrr.exe 3428 nttthb.exe 2572 7ppjj.exe 3796 lxxlxxx.exe 3020 nbbnhh.exe 4660 bhhhhh.exe 2320 vjvjj.exe 1932 rrflxlx.exe 4008 rflxxrr.exe 3276 rrxrfxr.exe 1864 hhnttt.exe 3104 5pdpj.exe 2960 frxxrrr.exe 2008 7xxxrrl.exe 732 bthhnt.exe 4920 rrffrlx.exe 4332 xfxrlxx.exe 2596 tntttt.exe 212 jvjdd.exe 1560 llxxxxl.exe 3808 hhttbh.exe 3016 lfrrrxr.exe 4372 tttbhn.exe 1452 ntnttb.exe 932 7vpvd.exe 4708 xfxxflf.exe 852 httthb.exe 2608 vvvvd.exe 4560 djdjj.exe 2240 fllxlfl.exe 2340 bbhhbn.exe 4512 jdjjj.exe 3992 5rllfrl.exe 3876 7httbb.exe 620 tnnbbb.exe 5060 ddvvd.exe 3292 rrxflrx.exe 4692 hbbhbh.exe 4500 frxffxf.exe 1348 bbbnth.exe -
Processes:
resource yara_rule behavioral2/memory/4120-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrrrlrr.exe upx behavioral2/memory/4120-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/668-12-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btbbbb.exe upx \??\c:\jvjjd.exe upx behavioral2/memory/3716-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2544-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thhhbh.exe upx behavioral2/memory/4124-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvvv.exe upx behavioral2/memory/4704-25-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\thtnbt.exe upx C:\djddp.exe upx behavioral2/memory/932-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrflxlx.exe upx behavioral2/memory/1484-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvppj.exe upx behavioral2/memory/3168-53-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttnhht.exe upx behavioral2/memory/4360-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4776-61-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjpdv.exe upx behavioral2/memory/4776-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbthn.exe upx behavioral2/memory/1416-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fflrxfr.exe upx behavioral2/memory/1032-77-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhbhhb.exe upx behavioral2/memory/1756-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpppp.exe upx behavioral2/memory/3292-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4040-92-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrlrrrl.exe upx C:\fflrrxf.exe upx behavioral2/memory/1212-99-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thhbbb.exe upx behavioral2/memory/1488-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3pvjv.exe upx behavioral2/memory/3712-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9lflrlf.exe upx C:\hbtbbh.exe upx behavioral2/memory/1956-122-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddppv.exe upx behavioral2/memory/4960-133-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3lffrfl.exe upx C:\dpjjj.exe upx behavioral2/memory/2640-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9xlrrrr.exe upx \??\c:\nttthb.exe upx C:\7ppjj.exe upx behavioral2/memory/3428-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2572-161-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbbnhh.exe upx C:\vjvjj.exe upx behavioral2/memory/4660-176-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhhhhh.exe upx behavioral2/memory/3796-165-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxxlxxx.exe upx \??\c:\rrflxlx.exe upx behavioral2/memory/4008-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3104-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2960-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2008-212-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a572d2146f41c7563ade90df220eec30_NeikiAnalytics.exelrrrlrr.exebtbbbb.exejvjjd.exethtnbt.exethhhbh.exevpvvv.exedjddp.exexrflxlx.exevvppj.exettnhht.exevjpdv.exetnbthn.exefflrxfr.exebhbhhb.exedpppp.exerrlrrrl.exefflrrxf.exethhbbb.exe3pvjv.exe9lflrlf.exehbtbbh.exedescription pid process target process PID 4120 wrote to memory of 3716 4120 a572d2146f41c7563ade90df220eec30_NeikiAnalytics.exe lrrrlrr.exe PID 4120 wrote to memory of 3716 4120 a572d2146f41c7563ade90df220eec30_NeikiAnalytics.exe lrrrlrr.exe PID 4120 wrote to memory of 3716 4120 a572d2146f41c7563ade90df220eec30_NeikiAnalytics.exe lrrrlrr.exe PID 3716 wrote to memory of 668 3716 lrrrlrr.exe btbbbb.exe PID 3716 wrote to memory of 668 3716 lrrrlrr.exe btbbbb.exe PID 3716 wrote to memory of 668 3716 lrrrlrr.exe btbbbb.exe PID 668 wrote to memory of 2544 668 btbbbb.exe jvjjd.exe PID 668 wrote to memory of 2544 668 btbbbb.exe jvjjd.exe PID 668 wrote to memory of 2544 668 btbbbb.exe jvjjd.exe PID 2544 wrote to memory of 4704 2544 jvjjd.exe thtnbt.exe PID 2544 wrote to memory of 4704 2544 jvjjd.exe thtnbt.exe PID 2544 wrote to memory of 4704 2544 jvjjd.exe thtnbt.exe PID 4704 wrote to memory of 4124 4704 thtnbt.exe thhhbh.exe PID 4704 wrote to memory of 4124 4704 thtnbt.exe thhhbh.exe PID 4704 wrote to memory of 4124 4704 thtnbt.exe thhhbh.exe PID 4124 wrote to memory of 932 4124 thhhbh.exe vpvvv.exe PID 4124 wrote to memory of 932 4124 thhhbh.exe vpvvv.exe PID 4124 wrote to memory of 932 4124 thhhbh.exe vpvvv.exe PID 932 wrote to memory of 1484 932 vpvvv.exe djddp.exe PID 932 wrote to memory of 1484 932 vpvvv.exe djddp.exe PID 932 wrote to memory of 1484 932 vpvvv.exe djddp.exe PID 1484 wrote to memory of 3168 1484 djddp.exe xrflxlx.exe PID 1484 wrote to memory of 3168 1484 djddp.exe xrflxlx.exe PID 1484 wrote to memory of 3168 1484 djddp.exe xrflxlx.exe PID 3168 wrote to memory of 4360 3168 xrflxlx.exe vvppj.exe PID 3168 wrote to memory of 4360 3168 xrflxlx.exe vvppj.exe PID 3168 wrote to memory of 4360 3168 xrflxlx.exe vvppj.exe PID 4360 wrote to memory of 4776 4360 vvppj.exe ttnhht.exe PID 4360 wrote to memory of 4776 4360 vvppj.exe ttnhht.exe PID 4360 wrote to memory of 4776 4360 vvppj.exe ttnhht.exe PID 4776 wrote to memory of 1416 4776 ttnhht.exe vjpdv.exe PID 4776 wrote to memory of 1416 4776 ttnhht.exe vjpdv.exe PID 4776 wrote to memory of 1416 4776 ttnhht.exe vjpdv.exe PID 1416 wrote to memory of 1032 1416 vjpdv.exe tnbthn.exe PID 1416 wrote to memory of 1032 1416 vjpdv.exe tnbthn.exe PID 1416 wrote to memory of 1032 1416 vjpdv.exe tnbthn.exe PID 1032 wrote to memory of 1756 1032 tnbthn.exe fflrxfr.exe PID 1032 wrote to memory of 1756 1032 tnbthn.exe fflrxfr.exe PID 1032 wrote to memory of 1756 1032 tnbthn.exe fflrxfr.exe PID 1756 wrote to memory of 3292 1756 fflrxfr.exe bhbhhb.exe PID 1756 wrote to memory of 3292 1756 fflrxfr.exe bhbhhb.exe PID 1756 wrote to memory of 3292 1756 fflrxfr.exe bhbhhb.exe PID 3292 wrote to memory of 4040 3292 bhbhhb.exe dpppp.exe PID 3292 wrote to memory of 4040 3292 bhbhhb.exe dpppp.exe PID 3292 wrote to memory of 4040 3292 bhbhhb.exe dpppp.exe PID 4040 wrote to memory of 1212 4040 dpppp.exe rrlrrrl.exe PID 4040 wrote to memory of 1212 4040 dpppp.exe rrlrrrl.exe PID 4040 wrote to memory of 1212 4040 dpppp.exe rrlrrrl.exe PID 1212 wrote to memory of 1488 1212 rrlrrrl.exe fflrrxf.exe PID 1212 wrote to memory of 1488 1212 rrlrrrl.exe fflrrxf.exe PID 1212 wrote to memory of 1488 1212 rrlrrrl.exe fflrrxf.exe PID 1488 wrote to memory of 1760 1488 fflrrxf.exe thhbbb.exe PID 1488 wrote to memory of 1760 1488 fflrrxf.exe thhbbb.exe PID 1488 wrote to memory of 1760 1488 fflrrxf.exe thhbbb.exe PID 1760 wrote to memory of 3712 1760 thhbbb.exe 3pvjv.exe PID 1760 wrote to memory of 3712 1760 thhbbb.exe 3pvjv.exe PID 1760 wrote to memory of 3712 1760 thhbbb.exe 3pvjv.exe PID 3712 wrote to memory of 1956 3712 3pvjv.exe 9lflrlf.exe PID 3712 wrote to memory of 1956 3712 3pvjv.exe 9lflrlf.exe PID 3712 wrote to memory of 1956 3712 3pvjv.exe 9lflrlf.exe PID 1956 wrote to memory of 3100 1956 9lflrlf.exe hbtbbh.exe PID 1956 wrote to memory of 3100 1956 9lflrlf.exe hbtbbh.exe PID 1956 wrote to memory of 3100 1956 9lflrlf.exe hbtbbh.exe PID 3100 wrote to memory of 4960 3100 hbtbbh.exe ddppv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a572d2146f41c7563ade90df220eec30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a572d2146f41c7563ade90df220eec30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\lrrrlrr.exec:\lrrrlrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\btbbbb.exec:\btbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\jvjjd.exec:\jvjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\thtnbt.exec:\thtnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\thhhbh.exec:\thhhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\vpvvv.exec:\vpvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\djddp.exec:\djddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\xrflxlx.exec:\xrflxlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\vvppj.exec:\vvppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\ttnhht.exec:\ttnhht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\vjpdv.exec:\vjpdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\tnbthn.exec:\tnbthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\fflrxfr.exec:\fflrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\bhbhhb.exec:\bhbhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\dpppp.exec:\dpppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\rrlrrrl.exec:\rrlrrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\fflrrxf.exec:\fflrrxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\thhbbb.exec:\thhbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\3pvjv.exec:\3pvjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\9lflrlf.exec:\9lflrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\hbtbbh.exec:\hbtbbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\ddppv.exec:\ddppv.exe23⤵
- Executes dropped EXE
PID:4960 -
\??\c:\3lffrfl.exec:\3lffrfl.exe24⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dpjjj.exec:\dpjjj.exe25⤵
- Executes dropped EXE
PID:1232 -
\??\c:\9xlrrrr.exec:\9xlrrrr.exe26⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nttthb.exec:\nttthb.exe27⤵
- Executes dropped EXE
PID:3428 -
\??\c:\7ppjj.exec:\7ppjj.exe28⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lxxlxxx.exec:\lxxlxxx.exe29⤵
- Executes dropped EXE
PID:3796 -
\??\c:\nbbnhh.exec:\nbbnhh.exe30⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bhhhhh.exec:\bhhhhh.exe31⤵
- Executes dropped EXE
PID:4660 -
\??\c:\vjvjj.exec:\vjvjj.exe32⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rrflxlx.exec:\rrflxlx.exe33⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rflxxrr.exec:\rflxxrr.exe34⤵
- Executes dropped EXE
PID:4008 -
\??\c:\rrxrfxr.exec:\rrxrfxr.exe35⤵
- Executes dropped EXE
PID:3276 -
\??\c:\hhnttt.exec:\hhnttt.exe36⤵
- Executes dropped EXE
PID:1864 -
\??\c:\5pdpj.exec:\5pdpj.exe37⤵
- Executes dropped EXE
PID:3104 -
\??\c:\frxxrrr.exec:\frxxrrr.exe38⤵
- Executes dropped EXE
PID:2960 -
\??\c:\7xxxrrl.exec:\7xxxrrl.exe39⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bthhnt.exec:\bthhnt.exe40⤵
- Executes dropped EXE
PID:732 -
\??\c:\rrffrlx.exec:\rrffrlx.exe41⤵
- Executes dropped EXE
PID:4920 -
\??\c:\xfxrlxx.exec:\xfxrlxx.exe42⤵
- Executes dropped EXE
PID:4332 -
\??\c:\tntttt.exec:\tntttt.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jvjdd.exec:\jvjdd.exe44⤵
- Executes dropped EXE
PID:212 -
\??\c:\llxxxxl.exec:\llxxxxl.exe45⤵
- Executes dropped EXE
PID:1560 -
\??\c:\hhttbh.exec:\hhttbh.exe46⤵
- Executes dropped EXE
PID:3808 -
\??\c:\lfrrrxr.exec:\lfrrrxr.exe47⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tttbhn.exec:\tttbhn.exe48⤵
- Executes dropped EXE
PID:4372 -
\??\c:\ntnttb.exec:\ntnttb.exe49⤵
- Executes dropped EXE
PID:1452 -
\??\c:\7vpvd.exec:\7vpvd.exe50⤵
- Executes dropped EXE
PID:932 -
\??\c:\xfxxflf.exec:\xfxxflf.exe51⤵
- Executes dropped EXE
PID:4708 -
\??\c:\httthb.exec:\httthb.exe52⤵
- Executes dropped EXE
PID:852 -
\??\c:\vvvvd.exec:\vvvvd.exe53⤵
- Executes dropped EXE
PID:2608 -
\??\c:\djdjj.exec:\djdjj.exe54⤵
- Executes dropped EXE
PID:4560 -
\??\c:\fllxlfl.exec:\fllxlfl.exe55⤵
- Executes dropped EXE
PID:2240 -
\??\c:\bbhhbn.exec:\bbhhbn.exe56⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jdjjj.exec:\jdjjj.exe57⤵
- Executes dropped EXE
PID:4512 -
\??\c:\5rllfrl.exec:\5rllfrl.exe58⤵
- Executes dropped EXE
PID:3992 -
\??\c:\7httbb.exec:\7httbb.exe59⤵
- Executes dropped EXE
PID:3876 -
\??\c:\tnnbbb.exec:\tnnbbb.exe60⤵
- Executes dropped EXE
PID:620 -
\??\c:\ddvvd.exec:\ddvvd.exe61⤵
- Executes dropped EXE
PID:5060 -
\??\c:\rrxflrx.exec:\rrxflrx.exe62⤵
- Executes dropped EXE
PID:3292 -
\??\c:\hbbhbh.exec:\hbbhbh.exe63⤵
- Executes dropped EXE
PID:4692 -
\??\c:\frxffxf.exec:\frxffxf.exe64⤵
- Executes dropped EXE
PID:4500 -
\??\c:\bbbnth.exec:\bbbnth.exe65⤵
- Executes dropped EXE
PID:1348 -
\??\c:\5dppp.exec:\5dppp.exe66⤵PID:1488
-
\??\c:\ppppj.exec:\ppppj.exe67⤵PID:1860
-
\??\c:\ffllrrx.exec:\ffllrrx.exe68⤵PID:1184
-
\??\c:\hntbbh.exec:\hntbbh.exe69⤵PID:1196
-
\??\c:\pvpjv.exec:\pvpjv.exe70⤵PID:4108
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe71⤵PID:1492
-
\??\c:\9bbtnn.exec:\9bbtnn.exe72⤵PID:4960
-
\??\c:\vvddd.exec:\vvddd.exe73⤵PID:2204
-
\??\c:\3jjjd.exec:\3jjjd.exe74⤵PID:1232
-
\??\c:\fxxrlll.exec:\fxxrlll.exe75⤵PID:4856
-
\??\c:\9bnbhn.exec:\9bnbhn.exe76⤵PID:4696
-
\??\c:\dvdvv.exec:\dvdvv.exe77⤵PID:2484
-
\??\c:\hnbttt.exec:\hnbttt.exe78⤵PID:4964
-
\??\c:\vpvvv.exec:\vpvvv.exe79⤵PID:856
-
\??\c:\dvdjp.exec:\dvdjp.exe80⤵PID:1868
-
\??\c:\lrxffll.exec:\lrxffll.exe81⤵PID:4684
-
\??\c:\7hhhhn.exec:\7hhhhn.exe82⤵PID:4392
-
\??\c:\hhtbbn.exec:\hhtbbn.exe83⤵PID:2120
-
\??\c:\pddvp.exec:\pddvp.exe84⤵PID:3276
-
\??\c:\7xrrrxr.exec:\7xrrrxr.exe85⤵PID:1716
-
\??\c:\xxrrflx.exec:\xxrrflx.exe86⤵PID:3104
-
\??\c:\htnntb.exec:\htnntb.exe87⤵PID:4872
-
\??\c:\btnnnn.exec:\btnnnn.exe88⤵PID:2960
-
\??\c:\jpvdd.exec:\jpvdd.exe89⤵PID:2556
-
\??\c:\lrlrflx.exec:\lrlrflx.exe90⤵PID:456
-
\??\c:\bbhnnt.exec:\bbhnnt.exe91⤵PID:860
-
\??\c:\vjpjj.exec:\vjpjj.exe92⤵PID:3196
-
\??\c:\ffrlllf.exec:\ffrlllf.exe93⤵PID:4592
-
\??\c:\hbbhhn.exec:\hbbhhn.exe94⤵PID:2360
-
\??\c:\ttbhbh.exec:\ttbhbh.exe95⤵PID:1656
-
\??\c:\vvjjd.exec:\vvjjd.exe96⤵PID:1324
-
\??\c:\llxxxff.exec:\llxxxff.exe97⤵PID:3772
-
\??\c:\thhhnn.exec:\thhhnn.exe98⤵PID:2872
-
\??\c:\dppvd.exec:\dppvd.exe99⤵PID:3776
-
\??\c:\lxxxfll.exec:\lxxxfll.exe100⤵PID:1804
-
\??\c:\tnbbbh.exec:\tnbbbh.exe101⤵PID:3348
-
\??\c:\hnthbn.exec:\hnthbn.exe102⤵PID:2264
-
\??\c:\djddj.exec:\djddj.exe103⤵PID:4776
-
\??\c:\9pvvd.exec:\9pvvd.exe104⤵PID:2568
-
\??\c:\9lxxrff.exec:\9lxxrff.exe105⤵PID:1416
-
\??\c:\bhbhbh.exec:\bhbhbh.exe106⤵PID:4368
-
\??\c:\bbhnnt.exec:\bbhnnt.exe107⤵PID:4588
-
\??\c:\9jvdd.exec:\9jvdd.exe108⤵PID:1264
-
\??\c:\7vpjv.exec:\7vpjv.exe109⤵PID:1796
-
\??\c:\3xllllr.exec:\3xllllr.exe110⤵PID:2504
-
\??\c:\nhhnth.exec:\nhhnth.exe111⤵PID:4820
-
\??\c:\hnhhhb.exec:\hnhhhb.exe112⤵PID:1860
-
\??\c:\dpdvj.exec:\dpdvj.exe113⤵PID:4784
-
\??\c:\pjddd.exec:\pjddd.exe114⤵PID:2160
-
\??\c:\ppjjd.exec:\ppjjd.exe115⤵PID:2088
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe116⤵PID:3520
-
\??\c:\flllfrl.exec:\flllfrl.exe117⤵PID:5004
-
\??\c:\tbhttb.exec:\tbhttb.exe118⤵PID:2204
-
\??\c:\pddvd.exec:\pddvd.exe119⤵PID:1232
-
\??\c:\5lxxlrf.exec:\5lxxlrf.exe120⤵PID:3764
-
\??\c:\thbntn.exec:\thbntn.exe121⤵PID:1480
-
\??\c:\jddjj.exec:\jddjj.exe122⤵PID:2032
-
\??\c:\bttbtt.exec:\bttbtt.exe123⤵PID:3020
-
\??\c:\ntbhtb.exec:\ntbhtb.exe124⤵PID:1728
-
\??\c:\tnnhbh.exec:\tnnhbh.exe125⤵PID:3548
-
\??\c:\vpvvv.exec:\vpvvv.exe126⤵PID:4008
-
\??\c:\3flrrfl.exec:\3flrrfl.exe127⤵PID:3600
-
\??\c:\btnbnn.exec:\btnbnn.exe128⤵PID:4176
-
\??\c:\vjdvj.exec:\vjdvj.exe129⤵PID:2200
-
\??\c:\xlffxff.exec:\xlffxff.exe130⤵PID:4832
-
\??\c:\tthhnn.exec:\tthhnn.exe131⤵PID:2288
-
\??\c:\3vvvv.exec:\3vvvv.exe132⤵PID:4516
-
\??\c:\5frrxrf.exec:\5frrxrf.exe133⤵PID:1456
-
\??\c:\bnnhtb.exec:\bnnhtb.exe134⤵PID:4352
-
\??\c:\ppjdd.exec:\ppjdd.exe135⤵PID:3468
-
\??\c:\rfllfll.exec:\rfllfll.exe136⤵PID:3196
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe137⤵PID:2596
-
\??\c:\vdppj.exec:\vdppj.exe138⤵PID:2908
-
\??\c:\lrrlrxl.exec:\lrrlrxl.exe139⤵PID:3068
-
\??\c:\djjpp.exec:\djjpp.exe140⤵PID:4456
-
\??\c:\lxfffff.exec:\lxfffff.exe141⤵PID:2380
-
\??\c:\5tbtnn.exec:\5tbtnn.exe142⤵PID:2872
-
\??\c:\dvvpp.exec:\dvvpp.exe143⤵PID:3372
-
\??\c:\rffxllf.exec:\rffxllf.exe144⤵PID:852
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe145⤵PID:2696
-
\??\c:\bbntbt.exec:\bbntbt.exe146⤵PID:4264
-
\??\c:\1ddpp.exec:\1ddpp.exe147⤵PID:2012
-
\??\c:\xrlxlrr.exec:\xrlxlrr.exe148⤵PID:264
-
\??\c:\hbnhtb.exec:\hbnhtb.exe149⤵PID:4688
-
\??\c:\thhthh.exec:\thhthh.exe150⤵PID:3292
-
\??\c:\vjdvp.exec:\vjdvp.exe151⤵PID:4624
-
\??\c:\rfllllf.exec:\rfllllf.exe152⤵PID:1584
-
\??\c:\rffffff.exec:\rffffff.exe153⤵PID:1796
-
\??\c:\btttnt.exec:\btttnt.exe154⤵PID:1488
-
\??\c:\pvvdv.exec:\pvvdv.exe155⤵PID:1184
-
\??\c:\fxllrrx.exec:\fxllrrx.exe156⤵PID:3220
-
\??\c:\frllflf.exec:\frllflf.exe157⤵PID:3844
-
\??\c:\tnnnhn.exec:\tnnnhn.exe158⤵PID:1492
-
\??\c:\vpvvp.exec:\vpvvp.exe159⤵PID:4960
-
\??\c:\flxrrrl.exec:\flxrrrl.exe160⤵PID:2616
-
\??\c:\rllfxxr.exec:\rllfxxr.exe161⤵PID:2396
-
\??\c:\nnhhtn.exec:\nnhhtn.exe162⤵PID:5068
-
\??\c:\1vppv.exec:\1vppv.exe163⤵PID:1648
-
\??\c:\pppdd.exec:\pppdd.exe164⤵PID:4628
-
\??\c:\fflrrfr.exec:\fflrrfr.exe165⤵PID:3704
-
\??\c:\bbbtbh.exec:\bbbtbh.exe166⤵PID:1340
-
\??\c:\pjvvv.exec:\pjvvv.exe167⤵PID:2320
-
\??\c:\pvdvd.exec:\pvdvd.exe168⤵PID:4620
-
\??\c:\tnbnbb.exec:\tnbnbb.exe169⤵PID:2156
-
\??\c:\nhhhbh.exec:\nhhhbh.exe170⤵PID:2832
-
\??\c:\7pdjp.exec:\7pdjp.exe171⤵PID:3104
-
\??\c:\rfrxflr.exec:\rfrxflr.exe172⤵PID:2592
-
\??\c:\9bnhbh.exec:\9bnhbh.exe173⤵PID:4328
-
\??\c:\bbhhnn.exec:\bbhhnn.exe174⤵PID:4596
-
\??\c:\dvpjj.exec:\dvpjj.exe175⤵PID:4352
-
\??\c:\flllxlf.exec:\flllxlf.exe176⤵PID:768
-
\??\c:\hbtttn.exec:\hbtttn.exe177⤵PID:4472
-
\??\c:\vpppj.exec:\vpppj.exe178⤵PID:2908
-
\??\c:\frrrxrr.exec:\frrrxrr.exe179⤵PID:4372
-
\??\c:\xxxfrlx.exec:\xxxfrlx.exe180⤵PID:4304
-
\??\c:\nhbhhb.exec:\nhbhhb.exe181⤵PID:3776
-
\??\c:\pvpjj.exec:\pvpjj.exe182⤵PID:2164
-
\??\c:\9thntn.exec:\9thntn.exe183⤵PID:3372
-
\??\c:\hththb.exec:\hththb.exe184⤵PID:2608
-
\??\c:\djjvp.exec:\djjvp.exe185⤵PID:4048
-
\??\c:\lfllfrl.exec:\lfllfrl.exe186⤵PID:1368
-
\??\c:\nhtnnt.exec:\nhtnnt.exe187⤵PID:2568
-
\??\c:\jvpjv.exec:\jvpjv.exe188⤵PID:3968
-
\??\c:\lffxxff.exec:\lffxxff.exe189⤵PID:3568
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe190⤵PID:4040
-
\??\c:\bbhhtn.exec:\bbhhtn.exe191⤵PID:1212
-
\??\c:\jjpjj.exec:\jjpjj.exe192⤵PID:1600
-
\??\c:\flllllf.exec:\flllllf.exe193⤵PID:4944
-
\??\c:\1nhhnn.exec:\1nhhnn.exe194⤵PID:3516
-
\??\c:\dvvvj.exec:\dvvvj.exe195⤵PID:2304
-
\??\c:\tbhhht.exec:\tbhhht.exe196⤵PID:736
-
\??\c:\jvddv.exec:\jvddv.exe197⤵PID:3208
-
\??\c:\7xfxrll.exec:\7xfxrll.exe198⤵PID:5004
-
\??\c:\bthhnn.exec:\bthhnn.exe199⤵PID:3752
-
\??\c:\dpdvp.exec:\dpdvp.exe200⤵PID:4696
-
\??\c:\xffxrrr.exec:\xffxrrr.exe201⤵PID:2396
-
\??\c:\nhnnnb.exec:\nhnnnb.exe202⤵PID:5068
-
\??\c:\nbttnt.exec:\nbttnt.exe203⤵PID:1648
-
\??\c:\ppddp.exec:\ppddp.exe204⤵PID:4628
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe205⤵PID:3996
-
\??\c:\3tbnnn.exec:\3tbnnn.exe206⤵PID:3268
-
\??\c:\htbthh.exec:\htbthh.exe207⤵PID:800
-
\??\c:\jdjpj.exec:\jdjpj.exe208⤵PID:4796
-
\??\c:\frffxxx.exec:\frffxxx.exe209⤵PID:1864
-
\??\c:\bnnnnt.exec:\bnnnnt.exe210⤵PID:1512
-
\??\c:\pjddv.exec:\pjddv.exe211⤵PID:4084
-
\??\c:\vjpjj.exec:\vjpjj.exe212⤵PID:2288
-
\??\c:\xffxxrr.exec:\xffxxrr.exe213⤵PID:4516
-
\??\c:\7ttnhn.exec:\7ttnhn.exe214⤵PID:4340
-
\??\c:\dpvvp.exec:\dpvvp.exe215⤵PID:3436
-
\??\c:\flfxflr.exec:\flfxflr.exe216⤵PID:4916
-
\??\c:\xffxxxx.exec:\xffxxxx.exe217⤵PID:224
-
\??\c:\tbhtbn.exec:\tbhtbn.exe218⤵PID:1656
-
\??\c:\vvjdp.exec:\vvjdp.exe219⤵PID:3068
-
\??\c:\pjdvj.exec:\pjdvj.exe220⤵PID:1192
-
\??\c:\lxlllll.exec:\lxlllll.exe221⤵PID:1484
-
\??\c:\rxxrflr.exec:\rxxrflr.exe222⤵PID:2532
-
\??\c:\tnnnhn.exec:\tnnnhn.exe223⤵PID:4560
-
\??\c:\ppjjd.exec:\ppjjd.exe224⤵PID:2192
-
\??\c:\1pppp.exec:\1pppp.exe225⤵PID:412
-
\??\c:\lrxxfrx.exec:\lrxxfrx.exe226⤵PID:4140
-
\??\c:\httttt.exec:\httttt.exe227⤵PID:4368
-
\??\c:\htbbbb.exec:\htbbbb.exe228⤵PID:3152
-
\??\c:\dpjpj.exec:\dpjpj.exe229⤵PID:2292
-
\??\c:\xflxrrl.exec:\xflxrrl.exe230⤵PID:2584
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe231⤵PID:3044
-
\??\c:\bthhbb.exec:\bthhbb.exe232⤵PID:4060
-
\??\c:\vpvpj.exec:\vpvpj.exe233⤵PID:452
-
\??\c:\dpjjd.exec:\dpjjd.exe234⤵PID:2448
-
\??\c:\rlrllll.exec:\rlrllll.exe235⤵PID:3520
-
\??\c:\ttbttb.exec:\ttbttb.exe236⤵PID:400
-
\??\c:\vdddd.exec:\vdddd.exe237⤵PID:2692
-
\??\c:\dvpjp.exec:\dvpjp.exe238⤵PID:3764
-
\??\c:\5ffrllf.exec:\5ffrllf.exe239⤵PID:3948
-
\??\c:\nnbnbn.exec:\nnbnbn.exe240⤵PID:3796
-
\??\c:\hbhnnt.exec:\hbhnnt.exe241⤵PID:1896
-
\??\c:\3jjdv.exec:\3jjdv.exe242⤵PID:3740