Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 05:13
Behavioral task
behavioral1
Sample
b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe
-
Size
367KB
-
MD5
b5ec551250661f81976b05fc3b349d70
-
SHA1
64a266ef8803806778bce04eb1ad6f2ff556272d
-
SHA256
8333eb94e1de377d0b8bb58e36a3b559203193c3a3fe4f6e9424189fe56b357f
-
SHA512
f9d2892ec59106e54bd9678a0d998b66be57dc219a6a0fca547a7f7e8ec78819c308066dd55f8372e21733a81976d4881fc411fb771e32f085e7019609792e2f
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSM/x5z:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZ4
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3752-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1156-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1308-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3804-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1700-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2476-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2560-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-613-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-785-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-792-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/724-818-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-967-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-1089-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-1099-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppvvv.exerlrlllf.exe9frrrxx.exehtbbnh.exevpjdj.exexfllffr.exetbhntt.exe5jjjj.exerlrllxf.exebtnhtb.exe5jvvj.exebtbttt.exedppjd.exexxfffxl.exe7thbtt.exe5pdvv.exexffxrlr.exebtbtbb.exe3ppjd.exefrffxff.exexxxrlll.exebnbbbt.exejdjvv.exepdpjd.exexlrrllf.exerlxrlfx.exe1pppj.exenbnbbn.exejpvvp.exexrxxrlf.exexxfxxxx.exenthbnt.exelxlllrx.exe3bbbbb.exedppjp.exe7fllfff.exebbhbhb.exeppddp.exefxfxxxr.exebnnthn.exedddvp.exe5xfxrrl.exetnbhhn.exepvvdj.exelrlxfxr.exenhhnhn.exevvppj.exeffllxff.exehbhbnb.exedpvpj.exerlffxxl.exethtbhn.exevdppj.exeflxxxll.exe1nhhbt.exennnnbn.exe7vpjj.exelxffxxr.exefxllxfr.exehnhttn.exepdvvv.exefffxffx.exenhhbbh.exevpvpd.exepid process 3752 ppvvv.exe 2136 rlrlllf.exe 2460 9frrrxx.exe 1156 htbbnh.exe 4236 vpjdj.exe 3556 xfllffr.exe 536 tbhntt.exe 3480 5jjjj.exe 2836 rlrllxf.exe 3968 btnhtb.exe 2776 5jvvj.exe 1420 btbttt.exe 5108 dppjd.exe 3036 xxfffxl.exe 1308 7thbtt.exe 4088 5pdvv.exe 4116 xffxrlr.exe 5084 btbtbb.exe 384 3ppjd.exe 2996 frffxff.exe 1924 xxxrlll.exe 912 bnbbbt.exe 2952 jdjvv.exe 1808 pdpjd.exe 888 xlrrllf.exe 2788 rlxrlfx.exe 3980 1pppj.exe 1220 nbnbbn.exe 3920 jpvvp.exe 3412 xrxxrlf.exe 1912 xxfxxxx.exe 3256 nthbnt.exe 216 lxlllrx.exe 2120 3bbbbb.exe 4336 dppjp.exe 4324 7fllfff.exe 4312 bbhbhb.exe 4172 ppddp.exe 3216 fxfxxxr.exe 2460 bnnthn.exe 1340 dddvp.exe 5076 5xfxrrl.exe 1488 tnbhhn.exe 3244 pvvdj.exe 3804 lrlxfxr.exe 3696 nhhnhn.exe 4636 vvppj.exe 1124 ffllxff.exe 1276 hbhbnb.exe 4072 dpvpj.exe 5032 rlffxxl.exe 5068 thtbhn.exe 3744 vdppj.exe 2532 flxxxll.exe 3184 1nhhbt.exe 1752 nnnnbn.exe 4416 7vpjj.exe 2528 lxffxxr.exe 3840 fxllxfr.exe 4068 hnhttn.exe 4444 pdvvv.exe 3304 fffxffx.exe 3708 nhhbbh.exe 1624 vpvpd.exe -
Processes:
resource yara_rule behavioral2/memory/3376-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppvvv.exe upx behavioral2/memory/3752-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3376-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9frrrxx.exe upx \??\c:\htbbnh.exe upx behavioral2/memory/2460-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2136-15-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlrlllf.exe upx \??\c:\vpjdj.exe upx behavioral2/memory/1156-29-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xfllffr.exe upx behavioral2/memory/4236-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbhntt.exe upx C:\5jjjj.exe upx behavioral2/memory/536-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3480-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrllxf.exe upx behavioral2/memory/2836-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnhtb.exe upx behavioral2/memory/3968-61-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5jvvj.exe upx behavioral2/memory/2776-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbttt.exe upx behavioral2/memory/1420-73-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dppjd.exe upx behavioral2/memory/5108-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxfffxl.exe upx behavioral2/memory/3036-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7thbtt.exe upx behavioral2/memory/1308-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5pdvv.exe upx behavioral2/memory/4088-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xffxrlr.exe upx C:\btbtbb.exe upx behavioral2/memory/4116-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3ppjd.exe upx behavioral2/memory/2996-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/384-119-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\frffxff.exe upx behavioral2/memory/5084-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxrlll.exe upx behavioral2/memory/1924-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnbbbt.exe upx C:\jdjvv.exe upx behavioral2/memory/912-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2952-138-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdpjd.exe upx \??\c:\xlrrllf.exe upx \??\c:\rlxrlfx.exe upx behavioral2/memory/2788-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/888-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1pppj.exe upx behavioral2/memory/3980-161-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbnbbn.exe upx \??\c:\jpvvp.exe upx \??\c:\xrxxrlf.exe upx C:\xxfxxxx.exe upx \??\c:\nthbnt.exe upx behavioral2/memory/3256-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1912-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1220-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3980-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/216-197-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exeppvvv.exerlrlllf.exe9frrrxx.exehtbbnh.exevpjdj.exexfllffr.exetbhntt.exe5jjjj.exerlrllxf.exebtnhtb.exe5jvvj.exebtbttt.exedppjd.exexxfffxl.exe7thbtt.exe5pdvv.exexffxrlr.exebtbtbb.exe3ppjd.exefrffxff.exexxxrlll.exedescription pid process target process PID 3376 wrote to memory of 3752 3376 b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe ppvvv.exe PID 3376 wrote to memory of 3752 3376 b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe ppvvv.exe PID 3376 wrote to memory of 3752 3376 b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe ppvvv.exe PID 3752 wrote to memory of 2136 3752 ppvvv.exe rlrlllf.exe PID 3752 wrote to memory of 2136 3752 ppvvv.exe rlrlllf.exe PID 3752 wrote to memory of 2136 3752 ppvvv.exe rlrlllf.exe PID 2136 wrote to memory of 2460 2136 rlrlllf.exe 9frrrxx.exe PID 2136 wrote to memory of 2460 2136 rlrlllf.exe 9frrrxx.exe PID 2136 wrote to memory of 2460 2136 rlrlllf.exe 9frrrxx.exe PID 2460 wrote to memory of 1156 2460 9frrrxx.exe htbbnh.exe PID 2460 wrote to memory of 1156 2460 9frrrxx.exe htbbnh.exe PID 2460 wrote to memory of 1156 2460 9frrrxx.exe htbbnh.exe PID 1156 wrote to memory of 4236 1156 htbbnh.exe vpjdj.exe PID 1156 wrote to memory of 4236 1156 htbbnh.exe vpjdj.exe PID 1156 wrote to memory of 4236 1156 htbbnh.exe vpjdj.exe PID 4236 wrote to memory of 3556 4236 vpjdj.exe xfllffr.exe PID 4236 wrote to memory of 3556 4236 vpjdj.exe xfllffr.exe PID 4236 wrote to memory of 3556 4236 vpjdj.exe xfllffr.exe PID 3556 wrote to memory of 536 3556 xfllffr.exe tbhntt.exe PID 3556 wrote to memory of 536 3556 xfllffr.exe tbhntt.exe PID 3556 wrote to memory of 536 3556 xfllffr.exe tbhntt.exe PID 536 wrote to memory of 3480 536 tbhntt.exe 5jjjj.exe PID 536 wrote to memory of 3480 536 tbhntt.exe 5jjjj.exe PID 536 wrote to memory of 3480 536 tbhntt.exe 5jjjj.exe PID 3480 wrote to memory of 2836 3480 5jjjj.exe rlrllxf.exe PID 3480 wrote to memory of 2836 3480 5jjjj.exe rlrllxf.exe PID 3480 wrote to memory of 2836 3480 5jjjj.exe rlrllxf.exe PID 2836 wrote to memory of 3968 2836 rlrllxf.exe btnhtb.exe PID 2836 wrote to memory of 3968 2836 rlrllxf.exe btnhtb.exe PID 2836 wrote to memory of 3968 2836 rlrllxf.exe btnhtb.exe PID 3968 wrote to memory of 2776 3968 btnhtb.exe 5jvvj.exe PID 3968 wrote to memory of 2776 3968 btnhtb.exe 5jvvj.exe PID 3968 wrote to memory of 2776 3968 btnhtb.exe 5jvvj.exe PID 2776 wrote to memory of 1420 2776 5jvvj.exe btbttt.exe PID 2776 wrote to memory of 1420 2776 5jvvj.exe btbttt.exe PID 2776 wrote to memory of 1420 2776 5jvvj.exe btbttt.exe PID 1420 wrote to memory of 5108 1420 btbttt.exe dppjd.exe PID 1420 wrote to memory of 5108 1420 btbttt.exe dppjd.exe PID 1420 wrote to memory of 5108 1420 btbttt.exe dppjd.exe PID 5108 wrote to memory of 3036 5108 dppjd.exe xxfffxl.exe PID 5108 wrote to memory of 3036 5108 dppjd.exe xxfffxl.exe PID 5108 wrote to memory of 3036 5108 dppjd.exe xxfffxl.exe PID 3036 wrote to memory of 1308 3036 xxfffxl.exe 7thbtt.exe PID 3036 wrote to memory of 1308 3036 xxfffxl.exe 7thbtt.exe PID 3036 wrote to memory of 1308 3036 xxfffxl.exe 7thbtt.exe PID 1308 wrote to memory of 4088 1308 7thbtt.exe 5pdvv.exe PID 1308 wrote to memory of 4088 1308 7thbtt.exe 5pdvv.exe PID 1308 wrote to memory of 4088 1308 7thbtt.exe 5pdvv.exe PID 4088 wrote to memory of 4116 4088 5pdvv.exe xffxrlr.exe PID 4088 wrote to memory of 4116 4088 5pdvv.exe xffxrlr.exe PID 4088 wrote to memory of 4116 4088 5pdvv.exe xffxrlr.exe PID 4116 wrote to memory of 5084 4116 xffxrlr.exe btbtbb.exe PID 4116 wrote to memory of 5084 4116 xffxrlr.exe btbtbb.exe PID 4116 wrote to memory of 5084 4116 xffxrlr.exe btbtbb.exe PID 5084 wrote to memory of 384 5084 btbtbb.exe 3ppjd.exe PID 5084 wrote to memory of 384 5084 btbtbb.exe 3ppjd.exe PID 5084 wrote to memory of 384 5084 btbtbb.exe 3ppjd.exe PID 384 wrote to memory of 2996 384 3ppjd.exe frffxff.exe PID 384 wrote to memory of 2996 384 3ppjd.exe frffxff.exe PID 384 wrote to memory of 2996 384 3ppjd.exe frffxff.exe PID 2996 wrote to memory of 1924 2996 frffxff.exe xxxrlll.exe PID 2996 wrote to memory of 1924 2996 frffxff.exe xxxrlll.exe PID 2996 wrote to memory of 1924 2996 frffxff.exe xxxrlll.exe PID 1924 wrote to memory of 912 1924 xxxrlll.exe bnbbbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b5ec551250661f81976b05fc3b349d70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\ppvvv.exec:\ppvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\rlrlllf.exec:\rlrlllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\9frrrxx.exec:\9frrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\htbbnh.exec:\htbbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\vpjdj.exec:\vpjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\xfllffr.exec:\xfllffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\tbhntt.exec:\tbhntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\5jjjj.exec:\5jjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\rlrllxf.exec:\rlrllxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\btnhtb.exec:\btnhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\5jvvj.exec:\5jvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\btbttt.exec:\btbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\dppjd.exec:\dppjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\xxfffxl.exec:\xxfffxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\7thbtt.exec:\7thbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\5pdvv.exec:\5pdvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\xffxrlr.exec:\xffxrlr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\btbtbb.exec:\btbtbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\3ppjd.exec:\3ppjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\frffxff.exec:\frffxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\xxxrlll.exec:\xxxrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\bnbbbt.exec:\bnbbbt.exe23⤵
- Executes dropped EXE
PID:912 -
\??\c:\jdjvv.exec:\jdjvv.exe24⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pdpjd.exec:\pdpjd.exe25⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xlrrllf.exec:\xlrrllf.exe26⤵
- Executes dropped EXE
PID:888 -
\??\c:\rlxrlfx.exec:\rlxrlfx.exe27⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1pppj.exec:\1pppj.exe28⤵
- Executes dropped EXE
PID:3980 -
\??\c:\nbnbbn.exec:\nbnbbn.exe29⤵
- Executes dropped EXE
PID:1220 -
\??\c:\jpvvp.exec:\jpvvp.exe30⤵
- Executes dropped EXE
PID:3920 -
\??\c:\xrxxrlf.exec:\xrxxrlf.exe31⤵
- Executes dropped EXE
PID:3412 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe32⤵
- Executes dropped EXE
PID:1912 -
\??\c:\nthbnt.exec:\nthbnt.exe33⤵
- Executes dropped EXE
PID:3256 -
\??\c:\lxlllrx.exec:\lxlllrx.exe34⤵
- Executes dropped EXE
PID:216 -
\??\c:\3bbbbb.exec:\3bbbbb.exe35⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dppjp.exec:\dppjp.exe36⤵
- Executes dropped EXE
PID:4336 -
\??\c:\7fllfff.exec:\7fllfff.exe37⤵
- Executes dropped EXE
PID:4324 -
\??\c:\bbhbhb.exec:\bbhbhb.exe38⤵
- Executes dropped EXE
PID:4312 -
\??\c:\ppddp.exec:\ppddp.exe39⤵
- Executes dropped EXE
PID:4172 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe40⤵
- Executes dropped EXE
PID:3216 -
\??\c:\bnnthn.exec:\bnnthn.exe41⤵
- Executes dropped EXE
PID:2460 -
\??\c:\dddvp.exec:\dddvp.exe42⤵
- Executes dropped EXE
PID:1340 -
\??\c:\5xfxrrl.exec:\5xfxrrl.exe43⤵
- Executes dropped EXE
PID:5076 -
\??\c:\tnbhhn.exec:\tnbhhn.exe44⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pvvdj.exec:\pvvdj.exe45⤵
- Executes dropped EXE
PID:3244 -
\??\c:\lrlxfxr.exec:\lrlxfxr.exe46⤵
- Executes dropped EXE
PID:3804 -
\??\c:\nhhnhn.exec:\nhhnhn.exe47⤵
- Executes dropped EXE
PID:3696 -
\??\c:\vvppj.exec:\vvppj.exe48⤵
- Executes dropped EXE
PID:4636 -
\??\c:\ffllxff.exec:\ffllxff.exe49⤵
- Executes dropped EXE
PID:1124 -
\??\c:\hbhbnb.exec:\hbhbnb.exe50⤵
- Executes dropped EXE
PID:1276 -
\??\c:\dpvpj.exec:\dpvpj.exe51⤵
- Executes dropped EXE
PID:4072 -
\??\c:\rlffxxl.exec:\rlffxxl.exe52⤵
- Executes dropped EXE
PID:5032 -
\??\c:\thtbhn.exec:\thtbhn.exe53⤵
- Executes dropped EXE
PID:5068 -
\??\c:\vdppj.exec:\vdppj.exe54⤵
- Executes dropped EXE
PID:3744 -
\??\c:\flxxxll.exec:\flxxxll.exe55⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1nhhbt.exec:\1nhhbt.exe56⤵
- Executes dropped EXE
PID:3184 -
\??\c:\nnnnbn.exec:\nnnnbn.exe57⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7vpjj.exec:\7vpjj.exe58⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lxffxxr.exec:\lxffxxr.exe59⤵
- Executes dropped EXE
PID:2528 -
\??\c:\fxllxfr.exec:\fxllxfr.exe60⤵
- Executes dropped EXE
PID:3840 -
\??\c:\hnhttn.exec:\hnhttn.exe61⤵
- Executes dropped EXE
PID:4068 -
\??\c:\pdvvv.exec:\pdvvv.exe62⤵
- Executes dropped EXE
PID:4444 -
\??\c:\fffxffx.exec:\fffxffx.exe63⤵
- Executes dropped EXE
PID:3304 -
\??\c:\nhhbbh.exec:\nhhbbh.exe64⤵
- Executes dropped EXE
PID:3708 -
\??\c:\vpvpd.exec:\vpvpd.exe65⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fxrxrrl.exec:\fxrxrrl.exe66⤵PID:2640
-
\??\c:\hbnhbb.exec:\hbnhbb.exe67⤵PID:4504
-
\??\c:\nthbtt.exec:\nthbtt.exe68⤵PID:724
-
\??\c:\pvdvv.exec:\pvdvv.exe69⤵PID:2700
-
\??\c:\lfffrrr.exec:\lfffrrr.exe70⤵PID:4604
-
\??\c:\nnnttt.exec:\nnnttt.exe71⤵PID:740
-
\??\c:\pppjj.exec:\pppjj.exe72⤵PID:844
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe73⤵PID:1700
-
\??\c:\fxrrfxr.exec:\fxrrfxr.exe74⤵PID:3268
-
\??\c:\ppvpj.exec:\ppvpj.exe75⤵PID:3560
-
\??\c:\pjpdd.exec:\pjpdd.exe76⤵PID:4056
-
\??\c:\rffxxrl.exec:\rffxxrl.exe77⤵PID:4724
-
\??\c:\btbthh.exec:\btbthh.exe78⤵PID:2540
-
\??\c:\5ppjj.exec:\5ppjj.exe79⤵PID:972
-
\??\c:\flxxrfx.exec:\flxxrfx.exe80⤵PID:1336
-
\??\c:\tnbbhh.exec:\tnbbhh.exe81⤵PID:5036
-
\??\c:\bnnhbn.exec:\bnnhbn.exe82⤵PID:232
-
\??\c:\7vpvd.exec:\7vpvd.exe83⤵PID:2040
-
\??\c:\rrxfrrx.exec:\rrxfrrx.exe84⤵PID:4780
-
\??\c:\tnbhbn.exec:\tnbhbn.exe85⤵PID:4816
-
\??\c:\ddjpj.exec:\ddjpj.exe86⤵PID:4248
-
\??\c:\rlrxfrr.exec:\rlrxfrr.exe87⤵PID:732
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe88⤵PID:3216
-
\??\c:\bthnnt.exec:\bthnnt.exe89⤵PID:2460
-
\??\c:\3pdvd.exec:\3pdvd.exe90⤵PID:3572
-
\??\c:\dvvvj.exec:\dvvvj.exe91⤵PID:5076
-
\??\c:\xxfxfrl.exec:\xxfxfrl.exe92⤵PID:1488
-
\??\c:\9ntnhh.exec:\9ntnhh.exe93⤵PID:920
-
\??\c:\9vvpv.exec:\9vvpv.exe94⤵PID:2476
-
\??\c:\3llrrrl.exec:\3llrrrl.exe95⤵PID:4836
-
\??\c:\ffxrlfl.exec:\ffxrlfl.exe96⤵PID:4636
-
\??\c:\5bnbth.exec:\5bnbth.exe97⤵PID:1356
-
\??\c:\5pjvp.exec:\5pjvp.exe98⤵PID:2004
-
\??\c:\5pjdj.exec:\5pjdj.exe99⤵PID:2956
-
\??\c:\xfrlffl.exec:\xfrlffl.exe100⤵PID:2412
-
\??\c:\5bbttt.exec:\5bbttt.exe101⤵PID:1520
-
\??\c:\ttbtnb.exec:\ttbtnb.exe102⤵PID:4756
-
\??\c:\5ddjd.exec:\5ddjd.exe103⤵PID:3648
-
\??\c:\rrlfrfr.exec:\rrlfrfr.exe104⤵PID:3068
-
\??\c:\lffxrlf.exec:\lffxrlf.exe105⤵PID:3944
-
\??\c:\nbbtnn.exec:\nbbtnn.exe106⤵PID:5040
-
\??\c:\jdvpj.exec:\jdvpj.exe107⤵PID:4344
-
\??\c:\xxfrllx.exec:\xxfrllx.exe108⤵PID:4444
-
\??\c:\fxxlffx.exec:\fxxlffx.exe109⤵PID:2560
-
\??\c:\ththhn.exec:\ththhn.exe110⤵PID:4832
-
\??\c:\5vvpj.exec:\5vvpj.exe111⤵PID:4504
-
\??\c:\frrxllf.exec:\frrxllf.exe112⤵PID:2720
-
\??\c:\nhtnbt.exec:\nhtnbt.exe113⤵PID:4580
-
\??\c:\nbbtht.exec:\nbbtht.exe114⤵PID:740
-
\??\c:\jdjdd.exec:\jdjdd.exe115⤵PID:4584
-
\??\c:\7frlxxr.exec:\7frlxxr.exe116⤵PID:3980
-
\??\c:\3jdvp.exec:\3jdvp.exe117⤵PID:3920
-
\??\c:\xllfrrl.exec:\xllfrrl.exe118⤵PID:1968
-
\??\c:\vjdjp.exec:\vjdjp.exe119⤵PID:4056
-
\??\c:\fflxrfl.exec:\fflxrfl.exe120⤵PID:1284
-
\??\c:\tbtbth.exec:\tbtbth.exe121⤵PID:3256
-
\??\c:\5jjpp.exec:\5jjpp.exe122⤵PID:1604
-
\??\c:\rxlrxfr.exec:\rxlrxfr.exe123⤵PID:3788
-
\??\c:\lllxrxl.exec:\lllxrxl.exe124⤵PID:4280
-
\??\c:\nhnnnt.exec:\nhnnnt.exe125⤵PID:232
-
\??\c:\vvjjv.exec:\vvjjv.exe126⤵PID:4524
-
\??\c:\xlrllll.exec:\xlrllll.exe127⤵PID:2464
-
\??\c:\xxflxxx.exec:\xxflxxx.exe128⤵PID:516
-
\??\c:\nhtbnb.exec:\nhtbnb.exe129⤵PID:3764
-
\??\c:\dvjjv.exec:\dvjjv.exe130⤵PID:4196
-
\??\c:\rxlffrl.exec:\rxlffrl.exe131⤵PID:3216
-
\??\c:\1bhtbn.exec:\1bhtbn.exe132⤵PID:4768
-
\??\c:\djdjj.exec:\djdjj.exe133⤵PID:3572
-
\??\c:\ddjpp.exec:\ddjpp.exe134⤵PID:5076
-
\??\c:\lrxffll.exec:\lrxffll.exe135⤵PID:4012
-
\??\c:\nbhbnn.exec:\nbhbnn.exe136⤵PID:3556
-
\??\c:\pjjjp.exec:\pjjjp.exe137⤵PID:2476
-
\??\c:\vjpjj.exec:\vjpjj.exe138⤵PID:2836
-
\??\c:\flrlxxl.exec:\flrlxxl.exe139⤵PID:1124
-
\??\c:\htbntt.exec:\htbntt.exe140⤵PID:1356
-
\??\c:\pppjj.exec:\pppjj.exe141⤵PID:4388
-
\??\c:\dvjvp.exec:\dvjvp.exe142⤵PID:2776
-
\??\c:\llllrlr.exec:\llllrlr.exe143⤵PID:3292
-
\??\c:\nbtnhb.exec:\nbtnhb.exe144⤵PID:3716
-
\??\c:\9hbtnn.exec:\9hbtnn.exe145⤵PID:4756
-
\??\c:\dppjd.exec:\dppjd.exe146⤵PID:4464
-
\??\c:\3lrlxrf.exec:\3lrlxrf.exe147⤵PID:1068
-
\??\c:\9btnht.exec:\9btnht.exe148⤵PID:3944
-
\??\c:\1hbnbb.exec:\1hbnbb.exe149⤵PID:4456
-
\??\c:\jjvvd.exec:\jjvvd.exe150⤵PID:4672
-
\??\c:\xxfflff.exec:\xxfflff.exe151⤵PID:640
-
\??\c:\hnbtnt.exec:\hnbtnt.exe152⤵PID:4932
-
\??\c:\jjvvj.exec:\jjvvj.exe153⤵PID:1952
-
\??\c:\djpjj.exec:\djpjj.exe154⤵PID:2720
-
\??\c:\9lfxlrl.exec:\9lfxlrl.exe155⤵PID:4580
-
\??\c:\thhbtt.exec:\thhbtt.exe156⤵PID:5052
-
\??\c:\thtttt.exec:\thtttt.exe157⤵PID:4584
-
\??\c:\jddvp.exec:\jddvp.exe158⤵PID:3504
-
\??\c:\lrfffrr.exec:\lrfffrr.exe159⤵PID:3920
-
\??\c:\nthbtt.exec:\nthbtt.exe160⤵PID:3412
-
\??\c:\nttttt.exec:\nttttt.exe161⤵PID:2292
-
\??\c:\vpvdv.exec:\vpvdv.exe162⤵PID:2540
-
\??\c:\xlrffrx.exec:\xlrffrx.exe163⤵PID:916
-
\??\c:\httnhh.exec:\httnhh.exe164⤵PID:2120
-
\??\c:\pdvvv.exec:\pdvvv.exe165⤵PID:4532
-
\??\c:\1jvvp.exec:\1jvvp.exe166⤵PID:4124
-
\??\c:\rlrlllx.exec:\rlrlllx.exe167⤵PID:1176
-
\??\c:\nhhbtn.exec:\nhhbtn.exe168⤵PID:2464
-
\??\c:\dpdpp.exec:\dpdpp.exe169⤵PID:516
-
\??\c:\jvvpp.exec:\jvvpp.exe170⤵PID:2136
-
\??\c:\rrrfffl.exec:\rrrfffl.exe171⤵PID:884
-
\??\c:\thnhbt.exec:\thnhbt.exe172⤵PID:3204
-
\??\c:\5vdpp.exec:\5vdpp.exe173⤵PID:3312
-
\??\c:\pjjvd.exec:\pjjvd.exe174⤵PID:744
-
\??\c:\frrxrlf.exec:\frrxrlf.exe175⤵PID:5076
-
\??\c:\5btntt.exec:\5btntt.exe176⤵PID:1016
-
\??\c:\djppv.exec:\djppv.exe177⤵PID:4664
-
\??\c:\frrfllr.exec:\frrfllr.exe178⤵PID:4836
-
\??\c:\7rfxllr.exec:\7rfxllr.exe179⤵PID:4636
-
\??\c:\bnbhbb.exec:\bnbhbb.exe180⤵PID:1988
-
\??\c:\pdddv.exec:\pdddv.exe181⤵PID:1168
-
\??\c:\3ffrfxr.exec:\3ffrfxr.exe182⤵PID:1688
-
\??\c:\5lrfxxr.exec:\5lrfxxr.exe183⤵PID:1420
-
\??\c:\tnnhbt.exec:\tnnhbt.exe184⤵PID:4452
-
\??\c:\pddvj.exec:\pddvj.exe185⤵PID:3552
-
\??\c:\7vdvp.exec:\7vdvp.exe186⤵PID:1308
-
\??\c:\5lfxrlf.exec:\5lfxrlf.exe187⤵PID:812
-
\??\c:\nhnhbt.exec:\nhnhbt.exe188⤵PID:3728
-
\??\c:\dvpjp.exec:\dvpjp.exe189⤵PID:1924
-
\??\c:\rxlxffx.exec:\rxlxffx.exe190⤵PID:4104
-
\??\c:\1xlffrr.exec:\1xlffrr.exe191⤵PID:2700
-
\??\c:\jjddd.exec:\jjddd.exe192⤵PID:3660
-
\??\c:\9pvpj.exec:\9pvpj.exe193⤵PID:740
-
\??\c:\frxrrrl.exec:\frxrrrl.exe194⤵PID:4112
-
\??\c:\nhnhbt.exec:\nhnhbt.exe195⤵PID:3384
-
\??\c:\hnnhhn.exec:\hnnhhn.exe196⤵PID:3980
-
\??\c:\vjpjj.exec:\vjpjj.exe197⤵PID:4732
-
\??\c:\xrlfllx.exec:\xrlfllx.exe198⤵PID:3120
-
\??\c:\bhnnhh.exec:\bhnnhh.exe199⤵PID:1284
-
\??\c:\jdpjd.exec:\jdpjd.exe200⤵PID:4320
-
\??\c:\lfxxlrl.exec:\lfxxlrl.exe201⤵PID:2540
-
\??\c:\tntnhh.exec:\tntnhh.exe202⤵PID:4340
-
\??\c:\7nbbbb.exec:\7nbbbb.exe203⤵PID:4336
-
\??\c:\pvjdd.exec:\pvjdd.exe204⤵PID:4532
-
\??\c:\rlfxflf.exec:\rlfxflf.exe205⤵PID:4328
-
\??\c:\ntbbtb.exec:\ntbbtb.exe206⤵PID:4248
-
\??\c:\tnnbnh.exec:\tnnbnh.exe207⤵PID:436
-
\??\c:\djjpv.exec:\djjpv.exe208⤵PID:5056
-
\??\c:\lllfrxx.exec:\lllfrxx.exe209⤵PID:2916
-
\??\c:\djvvv.exec:\djvvv.exe210⤵PID:944
-
\??\c:\ppvvp.exec:\ppvvp.exe211⤵PID:2348
-
\??\c:\rlrlflf.exec:\rlrlflf.exe212⤵PID:3312
-
\??\c:\lfflffl.exec:\lfflffl.exe213⤵PID:4012
-
\??\c:\htntnn.exec:\htntnn.exe214⤵PID:3556
-
\??\c:\ppvdv.exec:\ppvdv.exe215⤵PID:2132
-
\??\c:\ddjjd.exec:\ddjjd.exe216⤵PID:4664
-
\??\c:\9lffrfx.exec:\9lffrfx.exe217⤵PID:4836
-
\??\c:\9rxxxxf.exec:\9rxxxxf.exe218⤵PID:2004
-
\??\c:\bntnbb.exec:\bntnbb.exe219⤵PID:2456
-
\??\c:\dvvdd.exec:\dvvdd.exe220⤵PID:3248
-
\??\c:\7vvjd.exec:\7vvjd.exe221⤵PID:412
-
\??\c:\lfllxxx.exec:\lfllxxx.exe222⤵PID:3552
-
\??\c:\7frfllr.exec:\7frfllr.exe223⤵PID:2240
-
\??\c:\hbttnn.exec:\hbttnn.exe224⤵PID:812
-
\??\c:\djddp.exec:\djddp.exe225⤵PID:3728
-
\??\c:\3dppp.exec:\3dppp.exe226⤵PID:4672
-
\??\c:\xfxxxll.exec:\xfxxxll.exe227⤵PID:724
-
\??\c:\nhhttt.exec:\nhhttt.exe228⤵PID:5104
-
\??\c:\pppjd.exec:\pppjd.exe229⤵PID:1972
-
\??\c:\ppvdv.exec:\ppvdv.exe230⤵PID:4460
-
\??\c:\rlfxrxr.exec:\rlfxrxr.exe231⤵PID:4112
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe232⤵PID:1804
-
\??\c:\nntttt.exec:\nntttt.exe233⤵PID:3920
-
\??\c:\hntnbb.exec:\hntnbb.exe234⤵PID:4732
-
\??\c:\jjvvp.exec:\jjvvp.exe235⤵PID:3120
-
\??\c:\fxllflx.exec:\fxllflx.exe236⤵PID:1336
-
\??\c:\1nthht.exec:\1nthht.exe237⤵PID:2092
-
\??\c:\nbnbbb.exec:\nbnbbb.exe238⤵PID:916
-
\??\c:\pvjjd.exec:\pvjjd.exe239⤵PID:3288
-
\??\c:\1lrlfff.exec:\1lrlfff.exe240⤵PID:2040
-
\??\c:\tbbbtt.exec:\tbbbtt.exe241⤵PID:2080
-
\??\c:\bhtbbb.exec:\bhtbbb.exe242⤵PID:2464