Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe
-
Size
306KB
-
MD5
13268a522e90b7c18b456f6e581501d0
-
SHA1
98778a9155e915f5dac8dd51046f59d9519d08c2
-
SHA256
635432c5c18e9d664f893d93a0f3b16b567bd5124d55be19e0e163d06a4c80d4
-
SHA512
e4ca8ede98fd1ea8ad0481591dd92ad9fb854a8f1a85463c662343331fd86555c2dd9b74fc38d94964c6d9c739ddae650ebb4ba6277435896668fa1c06b38fd2
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAQ5lpBoG74Abtud+3SomfOTr00A:Pcm7ImGddXtWrXF5lpKGsAbA+3pB09
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/968-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-328-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1124-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-425-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-437-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-454-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-467-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-474-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-481-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-491-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-501-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-534-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-555-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-583-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-609-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-648-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-746-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-926-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-1396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvjjd.exefrflxll.exexlxrrxr.exelfllfll.exebhhhbh.exeddvpd.exelrlrflr.exejdjjj.exe9jpjj.exehtbbtt.exe7jpjj.exehhttbb.exe5vvpj.exe7pdvv.exerxlfxxr.exenbnhbb.exe9htntt.exetnhbth.exedpppj.exe5thtnb.exe3lrlfff.exehhthth.exe5jjjp.exetthhtb.exerrlxxxl.exehtbthh.exefrffllf.exepdvvv.exenhbbtt.exetnhhnt.exedjvvv.exejpddd.exetnbbbt.exentbtnb.exefxllfll.exe5tthtb.exevjvdd.exexrxxrxx.exehthhnh.exejdvvv.exelxxrlxf.exexrfxrxl.exedjpjj.exedpjjd.exevpvvv.exelrffxrx.exehbhnnb.exedjddj.exexlrrlfl.exehntbht.exexlfxxxx.exe7tthnh.exevvjjd.exe9xrrxrr.exethbbnn.exevdjdd.exerrrlxrf.exe7nnnhn.exeppddj.exerrffflr.exeffrffxx.exevdddd.exevjppd.exe7frlfxl.exepid process 3544 vvjjd.exe 4380 frflxll.exe 4448 xlxrrxr.exe 4940 lfllfll.exe 4452 bhhhbh.exe 380 ddvpd.exe 2372 lrlrflr.exe 1608 jdjjj.exe 1996 9jpjj.exe 1152 htbbtt.exe 2364 7jpjj.exe 3116 hhttbb.exe 4856 5vvpj.exe 1472 7pdvv.exe 540 rxlfxxr.exe 1344 nbnhbb.exe 2396 9htntt.exe 1620 tnhbth.exe 1504 dpppj.exe 1704 5thtnb.exe 4936 3lrlfff.exe 3836 hhthth.exe 4944 5jjjp.exe 2332 tthhtb.exe 4564 rrlxxxl.exe 3552 htbthh.exe 4568 frffllf.exe 376 pdvvv.exe 3672 nhbbtt.exe 2316 tnhhnt.exe 3816 djvvv.exe 4880 jpddd.exe 3032 tnbbbt.exe 4896 ntbtnb.exe 4744 fxllfll.exe 2168 5tthtb.exe 2804 vjvdd.exe 968 xrxxrxx.exe 3668 hthhnh.exe 5104 jdvvv.exe 2488 lxxrlxf.exe 4836 xrfxrxl.exe 2536 djpjj.exe 3220 dpjjd.exe 916 vpvvv.exe 3184 lrffxrx.exe 4316 hbhnnb.exe 5028 djddj.exe 4688 xlrrlfl.exe 4068 hntbht.exe 1128 xlfxxxx.exe 1112 7tthnh.exe 5108 vvjjd.exe 556 9xrrxrr.exe 1388 thbbnn.exe 2908 vdjdd.exe 3460 rrrlxrf.exe 2776 7nnnhn.exe 4544 ppddj.exe 1752 rrffflr.exe 4388 ffrffxx.exe 4696 vdddd.exe 4244 vjppd.exe 1556 7frlfxl.exe -
Processes:
resource yara_rule behavioral2/memory/968-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-425-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-437-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-454-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-467-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-474-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exevvjjd.exefrflxll.exexlxrrxr.exelfllfll.exebhhhbh.exeddvpd.exelrlrflr.exejdjjj.exe9jpjj.exehtbbtt.exe7jpjj.exehhttbb.exe5vvpj.exe7pdvv.exerxlfxxr.exenbnhbb.exe9htntt.exetnhbth.exedpppj.exe5thtnb.exe3lrlfff.exedescription pid process target process PID 968 wrote to memory of 3544 968 13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe vvjjd.exe PID 968 wrote to memory of 3544 968 13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe vvjjd.exe PID 968 wrote to memory of 3544 968 13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe vvjjd.exe PID 3544 wrote to memory of 4380 3544 vvjjd.exe frflxll.exe PID 3544 wrote to memory of 4380 3544 vvjjd.exe frflxll.exe PID 3544 wrote to memory of 4380 3544 vvjjd.exe frflxll.exe PID 4380 wrote to memory of 4448 4380 frflxll.exe xlxrrxr.exe PID 4380 wrote to memory of 4448 4380 frflxll.exe xlxrrxr.exe PID 4380 wrote to memory of 4448 4380 frflxll.exe xlxrrxr.exe PID 4448 wrote to memory of 4940 4448 xlxrrxr.exe lfllfll.exe PID 4448 wrote to memory of 4940 4448 xlxrrxr.exe lfllfll.exe PID 4448 wrote to memory of 4940 4448 xlxrrxr.exe lfllfll.exe PID 4940 wrote to memory of 4452 4940 lfllfll.exe bhhhbh.exe PID 4940 wrote to memory of 4452 4940 lfllfll.exe bhhhbh.exe PID 4940 wrote to memory of 4452 4940 lfllfll.exe bhhhbh.exe PID 4452 wrote to memory of 380 4452 bhhhbh.exe ddvpd.exe PID 4452 wrote to memory of 380 4452 bhhhbh.exe ddvpd.exe PID 4452 wrote to memory of 380 4452 bhhhbh.exe ddvpd.exe PID 380 wrote to memory of 2372 380 ddvpd.exe lrlrflr.exe PID 380 wrote to memory of 2372 380 ddvpd.exe lrlrflr.exe PID 380 wrote to memory of 2372 380 ddvpd.exe lrlrflr.exe PID 2372 wrote to memory of 1608 2372 lrlrflr.exe jdjjj.exe PID 2372 wrote to memory of 1608 2372 lrlrflr.exe jdjjj.exe PID 2372 wrote to memory of 1608 2372 lrlrflr.exe jdjjj.exe PID 1608 wrote to memory of 1996 1608 jdjjj.exe 9jpjj.exe PID 1608 wrote to memory of 1996 1608 jdjjj.exe 9jpjj.exe PID 1608 wrote to memory of 1996 1608 jdjjj.exe 9jpjj.exe PID 1996 wrote to memory of 1152 1996 9jpjj.exe htbbtt.exe PID 1996 wrote to memory of 1152 1996 9jpjj.exe htbbtt.exe PID 1996 wrote to memory of 1152 1996 9jpjj.exe htbbtt.exe PID 1152 wrote to memory of 2364 1152 htbbtt.exe 7jpjj.exe PID 1152 wrote to memory of 2364 1152 htbbtt.exe 7jpjj.exe PID 1152 wrote to memory of 2364 1152 htbbtt.exe 7jpjj.exe PID 2364 wrote to memory of 3116 2364 7jpjj.exe hhttbb.exe PID 2364 wrote to memory of 3116 2364 7jpjj.exe hhttbb.exe PID 2364 wrote to memory of 3116 2364 7jpjj.exe hhttbb.exe PID 3116 wrote to memory of 4856 3116 hhttbb.exe 5vvpj.exe PID 3116 wrote to memory of 4856 3116 hhttbb.exe 5vvpj.exe PID 3116 wrote to memory of 4856 3116 hhttbb.exe 5vvpj.exe PID 4856 wrote to memory of 1472 4856 5vvpj.exe 7pdvv.exe PID 4856 wrote to memory of 1472 4856 5vvpj.exe 7pdvv.exe PID 4856 wrote to memory of 1472 4856 5vvpj.exe 7pdvv.exe PID 1472 wrote to memory of 540 1472 7pdvv.exe rxlfxxr.exe PID 1472 wrote to memory of 540 1472 7pdvv.exe rxlfxxr.exe PID 1472 wrote to memory of 540 1472 7pdvv.exe rxlfxxr.exe PID 540 wrote to memory of 1344 540 rxlfxxr.exe nbnhbb.exe PID 540 wrote to memory of 1344 540 rxlfxxr.exe nbnhbb.exe PID 540 wrote to memory of 1344 540 rxlfxxr.exe nbnhbb.exe PID 1344 wrote to memory of 2396 1344 nbnhbb.exe 9htntt.exe PID 1344 wrote to memory of 2396 1344 nbnhbb.exe 9htntt.exe PID 1344 wrote to memory of 2396 1344 nbnhbb.exe 9htntt.exe PID 2396 wrote to memory of 1620 2396 9htntt.exe tnhbth.exe PID 2396 wrote to memory of 1620 2396 9htntt.exe tnhbth.exe PID 2396 wrote to memory of 1620 2396 9htntt.exe tnhbth.exe PID 1620 wrote to memory of 1504 1620 tnhbth.exe dpppj.exe PID 1620 wrote to memory of 1504 1620 tnhbth.exe dpppj.exe PID 1620 wrote to memory of 1504 1620 tnhbth.exe dpppj.exe PID 1504 wrote to memory of 1704 1504 dpppj.exe 5thtnb.exe PID 1504 wrote to memory of 1704 1504 dpppj.exe 5thtnb.exe PID 1504 wrote to memory of 1704 1504 dpppj.exe 5thtnb.exe PID 1704 wrote to memory of 4936 1704 5thtnb.exe 3lrlfff.exe PID 1704 wrote to memory of 4936 1704 5thtnb.exe 3lrlfff.exe PID 1704 wrote to memory of 4936 1704 5thtnb.exe 3lrlfff.exe PID 4936 wrote to memory of 3836 4936 3lrlfff.exe hhthth.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\13268a522e90b7c18b456f6e581501d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\vvjjd.exec:\vvjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\frflxll.exec:\frflxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\xlxrrxr.exec:\xlxrrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\lfllfll.exec:\lfllfll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\bhhhbh.exec:\bhhhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\ddvpd.exec:\ddvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\lrlrflr.exec:\lrlrflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\jdjjj.exec:\jdjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\9jpjj.exec:\9jpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\htbbtt.exec:\htbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\7jpjj.exec:\7jpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\hhttbb.exec:\hhttbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\5vvpj.exec:\5vvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\7pdvv.exec:\7pdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\nbnhbb.exec:\nbnhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\9htntt.exec:\9htntt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\tnhbth.exec:\tnhbth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\dpppj.exec:\dpppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\5thtnb.exec:\5thtnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\3lrlfff.exec:\3lrlfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\hhthth.exec:\hhthth.exe23⤵
- Executes dropped EXE
PID:3836 -
\??\c:\5jjjp.exec:\5jjjp.exe24⤵
- Executes dropped EXE
PID:4944 -
\??\c:\tthhtb.exec:\tthhtb.exe25⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rrlxxxl.exec:\rrlxxxl.exe26⤵
- Executes dropped EXE
PID:4564 -
\??\c:\htbthh.exec:\htbthh.exe27⤵
- Executes dropped EXE
PID:3552 -
\??\c:\frffllf.exec:\frffllf.exe28⤵
- Executes dropped EXE
PID:4568 -
\??\c:\pdvvv.exec:\pdvvv.exe29⤵
- Executes dropped EXE
PID:376 -
\??\c:\nhbbtt.exec:\nhbbtt.exe30⤵
- Executes dropped EXE
PID:3672 -
\??\c:\tnhhnt.exec:\tnhhnt.exe31⤵
- Executes dropped EXE
PID:2316 -
\??\c:\djvvv.exec:\djvvv.exe32⤵
- Executes dropped EXE
PID:3816 -
\??\c:\jpddd.exec:\jpddd.exe33⤵
- Executes dropped EXE
PID:4880 -
\??\c:\tnbbbt.exec:\tnbbbt.exe34⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ntbtnb.exec:\ntbtnb.exe35⤵
- Executes dropped EXE
PID:4896 -
\??\c:\fxllfll.exec:\fxllfll.exe36⤵
- Executes dropped EXE
PID:4744 -
\??\c:\5tthtb.exec:\5tthtb.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vjvdd.exec:\vjvdd.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe39⤵
- Executes dropped EXE
PID:968 -
\??\c:\hthhnh.exec:\hthhnh.exe40⤵
- Executes dropped EXE
PID:3668 -
\??\c:\jdvvv.exec:\jdvvv.exe41⤵
- Executes dropped EXE
PID:5104 -
\??\c:\lxxrlxf.exec:\lxxrlxf.exe42⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xrfxrxl.exec:\xrfxrxl.exe43⤵
- Executes dropped EXE
PID:4836 -
\??\c:\djpjj.exec:\djpjj.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dpjjd.exec:\dpjjd.exe45⤵
- Executes dropped EXE
PID:3220 -
\??\c:\vpvvv.exec:\vpvvv.exe46⤵
- Executes dropped EXE
PID:916 -
\??\c:\lrffxrx.exec:\lrffxrx.exe47⤵
- Executes dropped EXE
PID:3184 -
\??\c:\hbhnnb.exec:\hbhnnb.exe48⤵
- Executes dropped EXE
PID:4316 -
\??\c:\djddj.exec:\djddj.exe49⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xlrrlfl.exec:\xlrrlfl.exe50⤵
- Executes dropped EXE
PID:4688 -
\??\c:\hntbht.exec:\hntbht.exe51⤵
- Executes dropped EXE
PID:4068 -
\??\c:\xlfxxxx.exec:\xlfxxxx.exe52⤵
- Executes dropped EXE
PID:1128 -
\??\c:\7tthnh.exec:\7tthnh.exe53⤵
- Executes dropped EXE
PID:1112 -
\??\c:\vvjjd.exec:\vvjjd.exe54⤵
- Executes dropped EXE
PID:5108 -
\??\c:\9xrrxrr.exec:\9xrrxrr.exe55⤵
- Executes dropped EXE
PID:556 -
\??\c:\thbbnn.exec:\thbbnn.exe56⤵
- Executes dropped EXE
PID:1388 -
\??\c:\vdjdd.exec:\vdjdd.exe57⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rrrlxrf.exec:\rrrlxrf.exe58⤵
- Executes dropped EXE
PID:3460 -
\??\c:\7nnnhn.exec:\7nnnhn.exe59⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ppddj.exec:\ppddj.exe60⤵
- Executes dropped EXE
PID:4544 -
\??\c:\rrffflr.exec:\rrffflr.exe61⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ffrffxx.exec:\ffrffxx.exe62⤵
- Executes dropped EXE
PID:4388 -
\??\c:\vdddd.exec:\vdddd.exe63⤵
- Executes dropped EXE
PID:4696 -
\??\c:\vjppd.exec:\vjppd.exe64⤵
- Executes dropped EXE
PID:4244 -
\??\c:\7frlfxl.exec:\7frlfxl.exe65⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bnbhhb.exec:\bnbhhb.exe66⤵PID:5036
-
\??\c:\ppjvv.exec:\ppjvv.exe67⤵PID:2020
-
\??\c:\rxxxrxx.exec:\rxxxrxx.exe68⤵PID:4364
-
\??\c:\lxlxlff.exec:\lxlxlff.exe69⤵PID:4872
-
\??\c:\nbbnnb.exec:\nbbnnb.exe70⤵PID:3500
-
\??\c:\jjvvv.exec:\jjvvv.exe71⤵PID:5040
-
\??\c:\rlllxrf.exec:\rlllxrf.exe72⤵PID:4704
-
\??\c:\ntbhbt.exec:\ntbhbt.exe73⤵PID:1124
-
\??\c:\nbnhnn.exec:\nbnhnn.exe74⤵PID:452
-
\??\c:\vdvdp.exec:\vdvdp.exe75⤵PID:2684
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe76⤵PID:2292
-
\??\c:\lxfxllx.exec:\lxfxllx.exe77⤵PID:4076
-
\??\c:\nbhthb.exec:\nbhthb.exe78⤵PID:3816
-
\??\c:\jjddp.exec:\jjddp.exe79⤵PID:728
-
\??\c:\xxlffll.exec:\xxlffll.exe80⤵PID:2928
-
\??\c:\ttnbtn.exec:\ttnbtn.exe81⤵PID:3168
-
\??\c:\tbbbtt.exec:\tbbbtt.exe82⤵PID:4736
-
\??\c:\7pppp.exec:\7pppp.exe83⤵PID:2804
-
\??\c:\lrxrfff.exec:\lrxrfff.exe84⤵PID:2116
-
\??\c:\tbbbtt.exec:\tbbbtt.exe85⤵PID:3544
-
\??\c:\bhhtnb.exec:\bhhtnb.exe86⤵PID:4996
-
\??\c:\djpjj.exec:\djpjj.exe87⤵PID:1560
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe88⤵PID:3192
-
\??\c:\xfxrlll.exec:\xfxrlll.exe89⤵PID:5004
-
\??\c:\5thhnt.exec:\5thhnt.exe90⤵PID:3732
-
\??\c:\dvvpp.exec:\dvvpp.exe91⤵PID:2956
-
\??\c:\lllrrxf.exec:\lllrrxf.exe92⤵PID:2524
-
\??\c:\nhbthn.exec:\nhbthn.exe93⤵PID:3896
-
\??\c:\5vpjd.exec:\5vpjd.exe94⤵PID:3180
-
\??\c:\rxfrfrf.exec:\rxfrfrf.exe95⤵PID:2728
-
\??\c:\llxfxff.exec:\llxfxff.exe96⤵PID:4432
-
\??\c:\btnhnt.exec:\btnhnt.exe97⤵PID:2732
-
\??\c:\dvvpj.exec:\dvvpj.exe98⤵PID:1692
-
\??\c:\rflllxx.exec:\rflllxx.exe99⤵PID:1620
-
\??\c:\5lllxxr.exec:\5lllxxr.exe100⤵PID:4692
-
\??\c:\1tnbbt.exec:\1tnbbt.exe101⤵PID:4728
-
\??\c:\jjdvv.exec:\jjdvv.exe102⤵PID:4816
-
\??\c:\3xrlxxr.exec:\3xrlxxr.exe103⤵PID:644
-
\??\c:\3fxxllx.exec:\3fxxllx.exe104⤵PID:948
-
\??\c:\vdppd.exec:\vdppd.exe105⤵PID:3836
-
\??\c:\3lflllx.exec:\3lflllx.exe106⤵PID:4004
-
\??\c:\7bhnnt.exec:\7bhnnt.exe107⤵PID:4308
-
\??\c:\lxlffrx.exec:\lxlffrx.exe108⤵PID:368
-
\??\c:\7hbbhn.exec:\7hbbhn.exe109⤵PID:3864
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe110⤵PID:592
-
\??\c:\xrfffll.exec:\xrfffll.exe111⤵PID:3884
-
\??\c:\ttbnbt.exec:\ttbnbt.exe112⤵PID:1116
-
\??\c:\xrllfff.exec:\xrllfff.exe113⤵PID:2228
-
\??\c:\1thbbh.exec:\1thbbh.exe114⤵PID:628
-
\??\c:\pdvvd.exec:\pdvvd.exe115⤵PID:2292
-
\??\c:\rfxrxlx.exec:\rfxrxlx.exe116⤵PID:740
-
\??\c:\dvddj.exec:\dvddj.exe117⤵PID:3640
-
\??\c:\pvjjj.exec:\pvjjj.exe118⤵PID:3432
-
\??\c:\3rrlxxr.exec:\3rrlxxr.exe119⤵PID:2676
-
\??\c:\xflfrxr.exec:\xflfrxr.exe120⤵PID:4412
-
\??\c:\hbhttt.exec:\hbhttt.exe121⤵PID:4736
-
\??\c:\7jjjd.exec:\7jjjd.exe122⤵PID:4556
-
\??\c:\fxxxrrx.exec:\fxxxrrx.exe123⤵PID:4380
-
\??\c:\htbbbb.exec:\htbbbb.exe124⤵PID:5104
-
\??\c:\vpddp.exec:\vpddp.exe125⤵PID:184
-
\??\c:\rflllrr.exec:\rflllrr.exe126⤵PID:4292
-
\??\c:\jdpdv.exec:\jdpdv.exe127⤵PID:60
-
\??\c:\lfrrfrl.exec:\lfrrfrl.exe128⤵PID:4908
-
\??\c:\bnttnn.exec:\bnttnn.exe129⤵PID:2420
-
\??\c:\xrrllff.exec:\xrrllff.exe130⤵PID:2524
-
\??\c:\jvdpv.exec:\jvdpv.exe131⤵PID:4948
-
\??\c:\thhbtt.exec:\thhbtt.exe132⤵PID:3180
-
\??\c:\vjppj.exec:\vjppj.exe133⤵PID:800
-
\??\c:\flrrfff.exec:\flrrfff.exe134⤵PID:4432
-
\??\c:\btbbnh.exec:\btbbnh.exe135⤵PID:2404
-
\??\c:\thntnn.exec:\thntnn.exe136⤵PID:2608
-
\??\c:\pddpj.exec:\pddpj.exe137⤵PID:2828
-
\??\c:\9xlffff.exec:\9xlffff.exe138⤵PID:1620
-
\??\c:\hnbhtb.exec:\hnbhtb.exe139⤵PID:4544
-
\??\c:\pdpvj.exec:\pdpvj.exe140⤵PID:4728
-
\??\c:\fflrrll.exec:\fflrrll.exe141⤵PID:4348
-
\??\c:\xffrxxx.exec:\xffrxxx.exe142⤵PID:5100
-
\??\c:\nntnhh.exec:\nntnhh.exe143⤵PID:1528
-
\??\c:\tnnnbb.exec:\tnnnbb.exe144⤵PID:5036
-
\??\c:\7vjdv.exec:\7vjdv.exe145⤵PID:2456
-
\??\c:\9xxrrfx.exec:\9xxrrfx.exe146⤵PID:4840
-
\??\c:\bnttnn.exec:\bnttnn.exe147⤵PID:4872
-
\??\c:\7nnhbb.exec:\7nnhbb.exe148⤵PID:3864
-
\??\c:\pvppj.exec:\pvppj.exe149⤵PID:592
-
\??\c:\xrllflf.exec:\xrllflf.exe150⤵PID:2232
-
\??\c:\hhttnt.exec:\hhttnt.exe151⤵PID:1116
-
\??\c:\vpppj.exec:\vpppj.exe152⤵PID:2228
-
\??\c:\jjpvv.exec:\jjpvv.exe153⤵PID:2316
-
\??\c:\rxxrlrl.exec:\rxxrlrl.exe154⤵PID:4428
-
\??\c:\btnhhh.exec:\btnhhh.exe155⤵PID:740
-
\??\c:\9nbtnb.exec:\9nbtnb.exe156⤵PID:4300
-
\??\c:\djjdv.exec:\djjdv.exe157⤵PID:4744
-
\??\c:\lfrlfff.exec:\lfrlfff.exe158⤵PID:1488
-
\??\c:\dvvvv.exec:\dvvvv.exe159⤵PID:2804
-
\??\c:\jjvjj.exec:\jjvjj.exe160⤵PID:2912
-
\??\c:\llrrrrx.exec:\llrrrrx.exe161⤵PID:1900
-
\??\c:\bbhtbt.exec:\bbhtbt.exe162⤵PID:2536
-
\??\c:\1bhbbh.exec:\1bhbbh.exe163⤵PID:4928
-
\??\c:\dpvpj.exec:\dpvpj.exe164⤵PID:2604
-
\??\c:\1lxxlfr.exec:\1lxxlfr.exe165⤵PID:60
-
\??\c:\thhbtn.exec:\thhbtn.exe166⤵PID:4908
-
\??\c:\jvddd.exec:\jvddd.exe167⤵PID:3896
-
\??\c:\jvdvd.exec:\jvdvd.exe168⤵PID:3204
-
\??\c:\flxfxff.exec:\flxfxff.exe169⤵PID:4948
-
\??\c:\thnhhn.exec:\thnhhn.exe170⤵PID:2728
-
\??\c:\vvpdd.exec:\vvpdd.exe171⤵PID:4432
-
\??\c:\xflxlll.exec:\xflxlll.exe172⤵PID:3460
-
\??\c:\fxfxfff.exec:\fxfxfff.exe173⤵PID:2256
-
\??\c:\bhhbtt.exec:\bhhbtt.exe174⤵PID:4844
-
\??\c:\dpdvv.exec:\dpdvv.exe175⤵PID:1192
-
\??\c:\llrlffx.exec:\llrlffx.exe176⤵PID:4388
-
\??\c:\fxrrllf.exec:\fxrrllf.exe177⤵PID:4936
-
\??\c:\nbthbn.exec:\nbthbn.exe178⤵PID:948
-
\??\c:\vppjp.exec:\vppjp.exe179⤵PID:2328
-
\??\c:\lxllxll.exec:\lxllxll.exe180⤵PID:4340
-
\??\c:\3lxrllf.exec:\3lxrllf.exe181⤵PID:2664
-
\??\c:\btbtbt.exec:\btbtbt.exe182⤵PID:4056
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe183⤵PID:4568
-
\??\c:\rxxffxr.exec:\rxxffxr.exe184⤵PID:4616
-
\??\c:\bbtnnn.exec:\bbtnnn.exe185⤵PID:4204
-
\??\c:\jdddd.exec:\jdddd.exe186⤵PID:4532
-
\??\c:\jvjjd.exec:\jvjjd.exe187⤵PID:3672
-
\??\c:\xxxxxfx.exec:\xxxxxfx.exe188⤵PID:3636
-
\??\c:\bhnhhh.exec:\bhnhhh.exe189⤵PID:2616
-
\??\c:\jjvpp.exec:\jjvpp.exe190⤵PID:952
-
\??\c:\ddpjd.exec:\ddpjd.exe191⤵PID:3584
-
\??\c:\9xrrrrx.exec:\9xrrrrx.exe192⤵PID:3688
-
\??\c:\hhbthn.exec:\hhbthn.exe193⤵PID:4412
-
\??\c:\9vjpj.exec:\9vjpj.exe194⤵PID:4744
-
\??\c:\3ffrrll.exec:\3ffrrll.exe195⤵PID:1488
-
\??\c:\lxffffl.exec:\lxffffl.exe196⤵PID:4380
-
\??\c:\tbnhnt.exec:\tbnhnt.exe197⤵PID:2912
-
\??\c:\djdvd.exec:\djdvd.exe198⤵PID:184
-
\??\c:\ffrrxrf.exec:\ffrrxrf.exe199⤵PID:2536
-
\??\c:\nnhbbh.exec:\nnhbbh.exe200⤵PID:916
-
\??\c:\djpvj.exec:\djpvj.exe201⤵PID:5028
-
\??\c:\jvvvd.exec:\jvvvd.exe202⤵PID:2420
-
\??\c:\rxrfxrr.exec:\rxrfxrr.exe203⤵PID:2364
-
\??\c:\nnnnbb.exec:\nnnnbb.exe204⤵PID:2524
-
\??\c:\dvddd.exec:\dvddd.exe205⤵PID:1716
-
\??\c:\5xrlllf.exec:\5xrlllf.exe206⤵PID:3356
-
\??\c:\5xxxrxf.exec:\5xxxrxf.exe207⤵PID:2776
-
\??\c:\nbnbnb.exec:\nbnbnb.exe208⤵PID:3536
-
\??\c:\jpvpj.exec:\jpvpj.exe209⤵PID:1752
-
\??\c:\lrxxxfl.exec:\lrxxxfl.exe210⤵PID:2400
-
\??\c:\btnbtt.exec:\btnbtt.exe211⤵PID:2132
-
\??\c:\btttht.exec:\btttht.exe212⤵PID:5100
-
\??\c:\jdddp.exec:\jdddp.exe213⤵PID:4408
-
\??\c:\xlllfff.exec:\xlllfff.exe214⤵PID:4420
-
\??\c:\hnhtbt.exec:\hnhtbt.exe215⤵PID:4376
-
\??\c:\jpppj.exec:\jpppj.exe216⤵PID:2664
-
\??\c:\dvvjv.exec:\dvvjv.exe217⤵PID:4704
-
\??\c:\xllflll.exec:\xllflll.exe218⤵PID:3864
-
\??\c:\bhtnnb.exec:\bhtnnb.exe219⤵PID:2904
-
\??\c:\hthbbt.exec:\hthbbt.exe220⤵PID:452
-
\??\c:\5jpjj.exec:\5jpjj.exe221⤵PID:1116
-
\??\c:\xxxffrx.exec:\xxxffrx.exe222⤵PID:5048
-
\??\c:\tbnbbn.exec:\tbnbbn.exe223⤵PID:2316
-
\??\c:\dvjjv.exec:\dvjjv.exe224⤵PID:4428
-
\??\c:\pdvpj.exec:\pdvpj.exe225⤵PID:740
-
\??\c:\frxlrrr.exec:\frxlrrr.exe226⤵PID:4396
-
\??\c:\thtnnn.exec:\thtnnn.exe227⤵PID:3504
-
\??\c:\vvppj.exec:\vvppj.exe228⤵PID:2488
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe229⤵PID:4744
-
\??\c:\frrrlll.exec:\frrrlll.exe230⤵PID:1488
-
\??\c:\tnhbnh.exec:\tnhbnh.exe231⤵PID:4380
-
\??\c:\dddvj.exec:\dddvj.exe232⤵PID:4292
-
\??\c:\xxlrlff.exec:\xxlrlff.exe233⤵PID:184
-
\??\c:\frxrlfx.exec:\frxrlfx.exe234⤵PID:4692
-
\??\c:\nhhhbb.exec:\nhhhbb.exe235⤵PID:1152
-
\??\c:\vvdvv.exec:\vvdvv.exe236⤵PID:2956
-
\??\c:\rxxffxf.exec:\rxxffxf.exe237⤵PID:3396
-
\??\c:\lxrlffx.exec:\lxrlffx.exe238⤵PID:5028
-
\??\c:\btnttt.exec:\btnttt.exe239⤵PID:1128
-
\??\c:\pjpdj.exec:\pjpdj.exe240⤵PID:4072
-
\??\c:\lrfflxf.exec:\lrfflxf.exe241⤵PID:4948
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe242⤵PID:1716