Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:56
Behavioral task
behavioral1
Sample
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe
-
Size
254KB
-
MD5
4cc21ab451f8f8ba1862e95f3977c0e0
-
SHA1
33da8a716a5756c789e17595065f20ee30b236b0
-
SHA256
1f04d652f7389508674478ae21ebbbec3edc2081d328903f1c1bbfcb9cba3c62
-
SHA512
602e42d43df03cf77a19a4bfe2209b91bd2310654196d22b4433d72411f1f8d667b4073c5236dee00dd5ca3b8266da379141ae705b8aaf5ffa23ad9ff0545714
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpolTjZXvEQo9dfrS:y4wFHoS3eFaKHpKT9XvEhdfrS
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1240-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5272-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5376-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5636-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5892-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5256-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5716-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/508-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/648-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5676-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3832-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-849-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-816-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-673-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/928-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5308-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6136-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2656-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5228-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2212-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5764-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5800-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5644-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/732-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3732-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2000-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrfxfrf.exebnnbbb.exedppjv.exellxxxxl.exe9flffff.exevpjdv.exejjjpj.exerrrxxxf.exebbhbtn.exevjpdv.exelxflffx.exefrrrlrx.exennhnth.exevddvd.exerflxflr.exebnbbtb.exepvvvd.exelxrxxfl.exetnhnhh.exe5vvvd.exelxfxrxf.exefrxrlxl.exebnhbbn.exejjdjv.exeffxffrx.exehthhnt.exenhthhh.exedvjjd.exedpvdj.exelrlllrx.exehbnhbn.exeddpvp.exexfffrrf.exebhbhbh.exedvjdj.exeffrlflf.exexlfrlxr.exehnbbnn.exejjvpd.exexrxffrf.exebbbtth.exethnnhh.exepjvvd.exelllxrlx.exexflfffx.exehhbnbn.exejvvvv.exe7pddv.exefxrllrf.exebtthbn.exennbntn.exepjppj.exexxfxflx.exenbnntb.exepjvjj.exerrxxxll.exebnnttt.exedvjpj.exelfllrrr.exebbnntt.exedvdvp.exexxllrxf.exebbhttn.exe9pddv.exepid process 1240 rrfxfrf.exe 1488 bnnbbb.exe 3576 dppjv.exe 2312 llxxxxl.exe 2000 9flffff.exe 2840 vpjdv.exe 660 jjjpj.exe 3732 rrrxxxf.exe 4232 bbhbtn.exe 5856 vjpdv.exe 732 lxflffx.exe 2864 frrrlrx.exe 3480 nnhnth.exe 1980 vddvd.exe 3612 rflxflr.exe 3760 bnbbtb.exe 4332 pvvvd.exe 5272 lxrxxfl.exe 4792 tnhnhh.exe 4696 5vvvd.exe 716 lxfxrxf.exe 1852 frxrlxl.exe 5644 bnhbbn.exe 5800 jjdjv.exe 804 ffxffrx.exe 5764 hthhnt.exe 2372 nhthhh.exe 2212 dvjjd.exe 5376 dpvdj.exe 5084 lrlllrx.exe 5228 hbnhbn.exe 5636 ddpvp.exe 3204 xfffrrf.exe 1888 bhbhbh.exe 2316 dvjdj.exe 1148 ffrlflf.exe 5892 xlfrlxr.exe 2208 hnbbnn.exe 2656 jjvpd.exe 5500 xrxffrf.exe 1724 bbbtth.exe 2892 thnnhh.exe 3280 pjvvd.exe 4580 lllxrlx.exe 3696 xflfffx.exe 3968 hhbnbn.exe 4608 jvvvv.exe 4352 7pddv.exe 3160 fxrllrf.exe 5256 btthbn.exe 3252 nnbntn.exe 876 pjppj.exe 3588 xxfxflx.exe 2468 nbnntb.exe 1420 pjvjj.exe 2032 rrxxxll.exe 5716 bnnttt.exe 1588 dvjpj.exe 5436 lfllrrr.exe 5732 bbnntt.exe 3716 dvdvp.exe 3556 xxllrxf.exe 508 bbhttn.exe 5632 9pddv.exe -
Processes:
resource yara_rule behavioral2/memory/4776-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrfxfrf.exe upx behavioral2/memory/1488-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1240-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1488-18-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dppjv.exe upx C:\llxxxxl.exe upx behavioral2/memory/3576-25-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9flffff.exe upx \??\c:\jjjpj.exe upx C:\rrrxxxf.exe upx \??\c:\bbhbtn.exe upx C:\vjpdv.exe upx \??\c:\lxflffx.exe upx \??\c:\frrrlrx.exe upx behavioral2/memory/2864-77-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nnhnth.exe upx behavioral2/memory/3480-83-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvvvd.exe upx behavioral2/memory/5272-106-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxfxrxf.exe upx \??\c:\frxrlxl.exe upx \??\c:\jjdjv.exe upx \??\c:\ffxffrx.exe upx C:\hthhnt.exe upx behavioral2/memory/2372-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2212-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5376-178-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbnhbn.exe upx behavioral2/memory/5636-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5892-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2892-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4608-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3160-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5256-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2032-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5716-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1588-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/508-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4468-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4556-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2668-353-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1508-378-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4172-400-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/648-429-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2076-435-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5676-445-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2060-478-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2892-497-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5128-550-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1192-554-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3832-570-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3260-580-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1992-658-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5616-665-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5084-669-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5636-680-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1372-702-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1884-728-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3160-741-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2580-778-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3248-806-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2428-836-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3740-849-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exerrfxfrf.exebnnbbb.exedppjv.exellxxxxl.exe9flffff.exevpjdv.exejjjpj.exerrrxxxf.exebbhbtn.exevjpdv.exelxflffx.exefrrrlrx.exennhnth.exevddvd.exerflxflr.exebnbbtb.exepvvvd.exelxrxxfl.exetnhnhh.exe5vvvd.exelxfxrxf.exedescription pid process target process PID 4776 wrote to memory of 1240 4776 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe rxlfrrl.exe PID 4776 wrote to memory of 1240 4776 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe rxlfrrl.exe PID 4776 wrote to memory of 1240 4776 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe rxlfrrl.exe PID 1240 wrote to memory of 1488 1240 rrfxfrf.exe bnnbbb.exe PID 1240 wrote to memory of 1488 1240 rrfxfrf.exe bnnbbb.exe PID 1240 wrote to memory of 1488 1240 rrfxfrf.exe bnnbbb.exe PID 1488 wrote to memory of 3576 1488 bnnbbb.exe hbnhhh.exe PID 1488 wrote to memory of 3576 1488 bnnbbb.exe hbnhhh.exe PID 1488 wrote to memory of 3576 1488 bnnbbb.exe hbnhhh.exe PID 3576 wrote to memory of 2312 3576 dppjv.exe 1llllll.exe PID 3576 wrote to memory of 2312 3576 dppjv.exe 1llllll.exe PID 3576 wrote to memory of 2312 3576 dppjv.exe 1llllll.exe PID 2312 wrote to memory of 2000 2312 llxxxxl.exe 9flffff.exe PID 2312 wrote to memory of 2000 2312 llxxxxl.exe 9flffff.exe PID 2312 wrote to memory of 2000 2312 llxxxxl.exe 9flffff.exe PID 2000 wrote to memory of 2840 2000 9flffff.exe 7vdvp.exe PID 2000 wrote to memory of 2840 2000 9flffff.exe 7vdvp.exe PID 2000 wrote to memory of 2840 2000 9flffff.exe 7vdvp.exe PID 2840 wrote to memory of 660 2840 vpjdv.exe PID 2840 wrote to memory of 660 2840 vpjdv.exe PID 2840 wrote to memory of 660 2840 vpjdv.exe PID 660 wrote to memory of 3732 660 jjjpj.exe rrrxxxf.exe PID 660 wrote to memory of 3732 660 jjjpj.exe rrrxxxf.exe PID 660 wrote to memory of 3732 660 jjjpj.exe rrrxxxf.exe PID 3732 wrote to memory of 4232 3732 rrrxxxf.exe bbhbtn.exe PID 3732 wrote to memory of 4232 3732 rrrxxxf.exe bbhbtn.exe PID 3732 wrote to memory of 4232 3732 rrrxxxf.exe bbhbtn.exe PID 4232 wrote to memory of 5856 4232 bbhbtn.exe vvdjd.exe PID 4232 wrote to memory of 5856 4232 bbhbtn.exe vvdjd.exe PID 4232 wrote to memory of 5856 4232 bbhbtn.exe vvdjd.exe PID 5856 wrote to memory of 732 5856 vjpdv.exe lxflffx.exe PID 5856 wrote to memory of 732 5856 vjpdv.exe lxflffx.exe PID 5856 wrote to memory of 732 5856 vjpdv.exe lxflffx.exe PID 732 wrote to memory of 2864 732 lxflffx.exe PID 732 wrote to memory of 2864 732 lxflffx.exe PID 732 wrote to memory of 2864 732 lxflffx.exe PID 2864 wrote to memory of 3480 2864 frrrlrx.exe nnhnth.exe PID 2864 wrote to memory of 3480 2864 frrrlrx.exe nnhnth.exe PID 2864 wrote to memory of 3480 2864 frrrlrx.exe nnhnth.exe PID 3480 wrote to memory of 1980 3480 nnhnth.exe vddvd.exe PID 3480 wrote to memory of 1980 3480 nnhnth.exe vddvd.exe PID 3480 wrote to memory of 1980 3480 nnhnth.exe vddvd.exe PID 1980 wrote to memory of 3612 1980 vddvd.exe PID 1980 wrote to memory of 3612 1980 vddvd.exe PID 1980 wrote to memory of 3612 1980 vddvd.exe PID 3612 wrote to memory of 3760 3612 rflxflr.exe bnbbtb.exe PID 3612 wrote to memory of 3760 3612 rflxflr.exe bnbbtb.exe PID 3612 wrote to memory of 3760 3612 rflxflr.exe bnbbtb.exe PID 3760 wrote to memory of 4332 3760 bnbbtb.exe pvvvd.exe PID 3760 wrote to memory of 4332 3760 bnbbtb.exe pvvvd.exe PID 3760 wrote to memory of 4332 3760 bnbbtb.exe pvvvd.exe PID 4332 wrote to memory of 5272 4332 pvvvd.exe lxrxxfl.exe PID 4332 wrote to memory of 5272 4332 pvvvd.exe lxrxxfl.exe PID 4332 wrote to memory of 5272 4332 pvvvd.exe lxrxxfl.exe PID 5272 wrote to memory of 4792 5272 lxrxxfl.exe tnhnhh.exe PID 5272 wrote to memory of 4792 5272 lxrxxfl.exe tnhnhh.exe PID 5272 wrote to memory of 4792 5272 lxrxxfl.exe tnhnhh.exe PID 4792 wrote to memory of 4696 4792 tnhnhh.exe 5vvvd.exe PID 4792 wrote to memory of 4696 4792 tnhnhh.exe 5vvvd.exe PID 4792 wrote to memory of 4696 4792 tnhnhh.exe 5vvvd.exe PID 4696 wrote to memory of 716 4696 5vvvd.exe 5pjjp.exe PID 4696 wrote to memory of 716 4696 5vvvd.exe 5pjjp.exe PID 4696 wrote to memory of 716 4696 5vvvd.exe 5pjjp.exe PID 716 wrote to memory of 1852 716 lxfxrxf.exe 7rxrlll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\rrfxfrf.exec:\rrfxfrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\bnnbbb.exec:\bnnbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\dppjv.exec:\dppjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\llxxxxl.exec:\llxxxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\9flffff.exec:\9flffff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\vpjdv.exec:\vpjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\jjjpj.exec:\jjjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\rrrxxxf.exec:\rrrxxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\bbhbtn.exec:\bbhbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\vjpdv.exec:\vjpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
\??\c:\lxflffx.exec:\lxflffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\frrrlrx.exec:\frrrlrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nnhnth.exec:\nnhnth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\vddvd.exec:\vddvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\rflxflr.exec:\rflxflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\bnbbtb.exec:\bnbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\pvvvd.exec:\pvvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\lxrxxfl.exec:\lxrxxfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
\??\c:\tnhnhh.exec:\tnhnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\5vvvd.exec:\5vvvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\lxfxrxf.exec:\lxfxrxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\frxrlxl.exec:\frxrlxl.exe23⤵
- Executes dropped EXE
PID:1852 -
\??\c:\bnhbbn.exec:\bnhbbn.exe24⤵
- Executes dropped EXE
PID:5644 -
\??\c:\jjdjv.exec:\jjdjv.exe25⤵
- Executes dropped EXE
PID:5800 -
\??\c:\ffxffrx.exec:\ffxffrx.exe26⤵
- Executes dropped EXE
PID:804 -
\??\c:\hthhnt.exec:\hthhnt.exe27⤵
- Executes dropped EXE
PID:5764 -
\??\c:\nhthhh.exec:\nhthhh.exe28⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dvjjd.exec:\dvjjd.exe29⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dpvdj.exec:\dpvdj.exe30⤵
- Executes dropped EXE
PID:5376 -
\??\c:\lrlllrx.exec:\lrlllrx.exe31⤵
- Executes dropped EXE
PID:5084 -
\??\c:\hbnhbn.exec:\hbnhbn.exe32⤵
- Executes dropped EXE
PID:5228 -
\??\c:\ddpvp.exec:\ddpvp.exe33⤵
- Executes dropped EXE
PID:5636 -
\??\c:\xfffrrf.exec:\xfffrrf.exe34⤵
- Executes dropped EXE
PID:3204 -
\??\c:\bhbhbh.exec:\bhbhbh.exe35⤵
- Executes dropped EXE
PID:1888 -
\??\c:\dvjdj.exec:\dvjdj.exe36⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ffrlflf.exec:\ffrlflf.exe37⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xlfrlxr.exec:\xlfrlxr.exe38⤵
- Executes dropped EXE
PID:5892 -
\??\c:\hnbbnn.exec:\hnbbnn.exe39⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jjvpd.exec:\jjvpd.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xrxffrf.exec:\xrxffrf.exe41⤵
- Executes dropped EXE
PID:5500 -
\??\c:\bbbtth.exec:\bbbtth.exe42⤵
- Executes dropped EXE
PID:1724 -
\??\c:\thnnhh.exec:\thnnhh.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pjvvd.exec:\pjvvd.exe44⤵
- Executes dropped EXE
PID:3280 -
\??\c:\lllxrlx.exec:\lllxrlx.exe45⤵
- Executes dropped EXE
PID:4580 -
\??\c:\xflfffx.exec:\xflfffx.exe46⤵
- Executes dropped EXE
PID:3696 -
\??\c:\hhbnbn.exec:\hhbnbn.exe47⤵
- Executes dropped EXE
PID:3968 -
\??\c:\jvvvv.exec:\jvvvv.exe48⤵
- Executes dropped EXE
PID:4608 -
\??\c:\7pddv.exec:\7pddv.exe49⤵
- Executes dropped EXE
PID:4352 -
\??\c:\fxrllrf.exec:\fxrllrf.exe50⤵
- Executes dropped EXE
PID:3160 -
\??\c:\btthbn.exec:\btthbn.exe51⤵
- Executes dropped EXE
PID:5256 -
\??\c:\nnbntn.exec:\nnbntn.exe52⤵
- Executes dropped EXE
PID:3252 -
\??\c:\pjppj.exec:\pjppj.exe53⤵
- Executes dropped EXE
PID:876 -
\??\c:\xxfxflx.exec:\xxfxflx.exe54⤵
- Executes dropped EXE
PID:3588 -
\??\c:\nbnntb.exec:\nbnntb.exe55⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pjvjj.exec:\pjvjj.exe56⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rrxxxll.exec:\rrxxxll.exe57⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bnnttt.exec:\bnnttt.exe58⤵
- Executes dropped EXE
PID:5716 -
\??\c:\dvjpj.exec:\dvjpj.exe59⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lfllrrr.exec:\lfllrrr.exe60⤵
- Executes dropped EXE
PID:5436 -
\??\c:\bbnntt.exec:\bbnntt.exe61⤵
- Executes dropped EXE
PID:5732 -
\??\c:\dvdvp.exec:\dvdvp.exe62⤵
- Executes dropped EXE
PID:3716 -
\??\c:\xxllrxf.exec:\xxllrxf.exe63⤵
- Executes dropped EXE
PID:3556 -
\??\c:\bbhttn.exec:\bbhttn.exe64⤵
- Executes dropped EXE
PID:508 -
\??\c:\9pddv.exec:\9pddv.exe65⤵
- Executes dropped EXE
PID:5632 -
\??\c:\fxxrlxl.exec:\fxxrlxl.exe66⤵PID:1192
-
\??\c:\hhntth.exec:\hhntth.exe67⤵PID:3052
-
\??\c:\tbthbt.exec:\tbthbt.exe68⤵PID:1740
-
\??\c:\pjjpj.exec:\pjjpj.exe69⤵PID:4468
-
\??\c:\1xrrlff.exec:\1xrrlff.exe70⤵PID:2964
-
\??\c:\lrfrrxf.exec:\lrfrrxf.exe71⤵PID:4776
-
\??\c:\7bbthb.exec:\7bbthb.exe72⤵PID:1240
-
\??\c:\1pppp.exec:\1pppp.exe73⤵PID:1488
-
\??\c:\frlrflx.exec:\frlrflx.exe74⤵PID:4556
-
\??\c:\bbhbtt.exec:\bbhbtt.exe75⤵PID:5968
-
\??\c:\nnthnn.exec:\nnthnn.exe76⤵PID:2000
-
\??\c:\vdjpd.exec:\vdjpd.exe77⤵PID:2092
-
\??\c:\vdvjj.exec:\vdvjj.exe78⤵PID:3064
-
\??\c:\rllllxr.exec:\rllllxr.exe79⤵PID:2668
-
\??\c:\btbbbb.exec:\btbbbb.exe80⤵PID:4076
-
\??\c:\ppjpd.exec:\ppjpd.exe81⤵PID:6136
-
\??\c:\vvdjd.exec:\vvdjd.exe82⤵PID:5856
-
\??\c:\1llrlll.exec:\1llrlll.exe83⤵PID:1160
-
\??\c:\ththnh.exec:\ththnh.exe84⤵PID:5424
-
\??\c:\bhhhbb.exec:\bhhhbb.exe85⤵PID:5308
-
\??\c:\pvjvd.exec:\pvjvd.exe86⤵PID:1508
-
\??\c:\xffxfxf.exec:\xffxfxf.exe87⤵PID:1928
-
\??\c:\hhnttb.exec:\hhnttb.exe88⤵PID:3612
-
\??\c:\bbhnnt.exec:\bbhnnt.exe89⤵PID:3624
-
\??\c:\ppvpj.exec:\ppvpj.exe90⤵PID:5012
-
\??\c:\rxrxlfl.exec:\rxrxlfl.exe91⤵PID:4712
-
\??\c:\hhtbth.exec:\hhtbth.exe92⤵PID:4172
-
\??\c:\ffrffrr.exec:\ffrffrr.exe93⤵PID:5624
-
\??\c:\ntbbbt.exec:\ntbbbt.exe94⤵PID:4564
-
\??\c:\7pvjd.exec:\7pvjd.exe95⤵PID:3268
-
\??\c:\rlfrfxl.exec:\rlfrfxl.exe96⤵PID:3296
-
\??\c:\bhttht.exec:\bhttht.exe97⤵PID:1992
-
\??\c:\dpvvd.exec:\dpvvd.exe98⤵PID:5788
-
\??\c:\vdvdv.exec:\vdvdv.exe99⤵PID:4544
-
\??\c:\rrrxxxf.exec:\rrrxxxf.exe100⤵PID:5028
-
\??\c:\bbnhhh.exec:\bbnhhh.exe101⤵PID:648
-
\??\c:\vdjjv.exec:\vdjjv.exe102⤵PID:4412
-
\??\c:\jvpjd.exec:\jvpjd.exe103⤵PID:2076
-
\??\c:\xlrfxxx.exec:\xlrfxxx.exe104⤵PID:5100
-
\??\c:\nhnntt.exec:\nhnntt.exe105⤵PID:5676
-
\??\c:\tnthbt.exec:\tnthbt.exe106⤵PID:3344
-
\??\c:\dddjd.exec:\dddjd.exe107⤵PID:4008
-
\??\c:\5rfrrll.exec:\5rfrrll.exe108⤵PID:832
-
\??\c:\bhhhtt.exec:\bhhhtt.exe109⤵PID:1804
-
\??\c:\nbbntn.exec:\nbbntn.exe110⤵PID:3204
-
\??\c:\dvpdp.exec:\dvpdp.exe111⤵PID:6112
-
\??\c:\flflflf.exec:\flflflf.exe112⤵PID:928
-
\??\c:\rrlfxff.exec:\rrlfxff.exe113⤵PID:2080
-
\??\c:\bnbbbh.exec:\bnbbbh.exe114⤵PID:4428
-
\??\c:\5dvpv.exec:\5dvpv.exe115⤵PID:3620
-
\??\c:\5dddd.exec:\5dddd.exe116⤵PID:2060
-
\??\c:\xrrrlll.exec:\xrrrlll.exe117⤵PID:3396
-
\??\c:\lrxxrrl.exec:\lrxxrrl.exe118⤵PID:5152
-
\??\c:\tnhnbb.exec:\tnhnbb.exe119⤵PID:2908
-
\??\c:\7bhbbb.exec:\7bhbbb.exe120⤵PID:1744
-
\??\c:\jvjdd.exec:\jvjdd.exe121⤵PID:2892
-
\??\c:\xffxlxl.exec:\xffxlxl.exe122⤵PID:5948
-
\??\c:\nthhtt.exec:\nthhtt.exe123⤵PID:3180
-
\??\c:\htbhbb.exec:\htbhbb.exe124⤵PID:4528
-
\??\c:\pdvpp.exec:\pdvpp.exe125⤵PID:5040
-
\??\c:\vpvvv.exec:\vpvvv.exe126⤵PID:5020
-
\??\c:\rxxxrlf.exec:\rxxxrlf.exe127⤵PID:364
-
\??\c:\ttbtbb.exec:\ttbtbb.exe128⤵PID:5932
-
\??\c:\9vjpp.exec:\9vjpp.exe129⤵PID:744
-
\??\c:\vpjvp.exec:\vpjvp.exe130⤵PID:5792
-
\??\c:\xxrllfl.exec:\xxrllfl.exe131⤵PID:1404
-
\??\c:\nnbtht.exec:\nnbtht.exe132⤵PID:2300
-
\??\c:\nthbbb.exec:\nthbbb.exe133⤵PID:2496
-
\??\c:\pvvvp.exec:\pvvvp.exe134⤵PID:2360
-
\??\c:\xffxfxl.exec:\xffxfxl.exe135⤵PID:5328
-
\??\c:\fxrfrxx.exec:\fxrfrxx.exe136⤵PID:1668
-
\??\c:\btbnhb.exec:\btbnhb.exe137⤵PID:2236
-
\??\c:\vpvjj.exec:\vpvjj.exe138⤵PID:5128
-
\??\c:\vddvj.exec:\vddvj.exe139⤵PID:1192
-
\??\c:\fflfrrf.exec:\fflfrrf.exe140⤵PID:3052
-
\??\c:\nbhhhh.exec:\nbhhhh.exe141⤵PID:184
-
\??\c:\dvjjd.exec:\dvjjd.exe142⤵PID:4480
-
\??\c:\7pvvp.exec:\7pvvp.exe143⤵PID:1176
-
\??\c:\hbttbb.exec:\hbttbb.exe144⤵PID:3832
-
\??\c:\5pdvd.exec:\5pdvd.exe145⤵PID:1764
-
\??\c:\ppppj.exec:\ppppj.exe146⤵PID:372
-
\??\c:\lxrfrrx.exec:\lxrfrrx.exe147⤵PID:3260
-
\??\c:\frxxrxx.exec:\frxxrxx.exe148⤵PID:5360
-
\??\c:\nnhhnb.exec:\nnhhnb.exe149⤵PID:5916
-
\??\c:\ppdvj.exec:\ppdvj.exe150⤵PID:3248
-
\??\c:\vpvvp.exec:\vpvvp.exe151⤵PID:2668
-
\??\c:\lfrrlxf.exec:\lfrrlxf.exe152⤵PID:1640
-
\??\c:\nhnntt.exec:\nhnntt.exe153⤵PID:4668
-
\??\c:\bhbhtn.exec:\bhbhtn.exe154⤵PID:668
-
\??\c:\1jjpp.exec:\1jjpp.exe155⤵PID:1168
-
\??\c:\jpdvv.exec:\jpdvv.exe156⤵PID:2864
-
\??\c:\xllrffl.exec:\xllrffl.exe157⤵PID:3480
-
\??\c:\bhnhbb.exec:\bhnhbb.exe158⤵PID:1980
-
\??\c:\bbbntb.exec:\bbbntb.exe159⤵PID:940
-
\??\c:\pvppp.exec:\pvppp.exe160⤵PID:3568
-
\??\c:\ppppp.exec:\ppppp.exe161⤵PID:5124
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe162⤵PID:5608
-
\??\c:\fxrrllf.exec:\fxrrllf.exe163⤵PID:5648
-
\??\c:\tnnbtb.exec:\tnnbtb.exe164⤵PID:2664
-
\??\c:\5bhhnt.exec:\5bhhnt.exe165⤵PID:5276
-
\??\c:\pjvvj.exec:\pjvvj.exe166⤵PID:5860
-
\??\c:\jvjjd.exec:\jvjjd.exe167⤵PID:1044
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe168⤵PID:3208
-
\??\c:\ttthtb.exec:\ttthtb.exe169⤵PID:3268
-
\??\c:\hhhtht.exec:\hhhtht.exe170⤵PID:5660
-
\??\c:\9jppp.exec:\9jppp.exe171⤵PID:1992
-
\??\c:\dvddj.exec:\dvddj.exe172⤵PID:5788
-
\??\c:\lfrxxxx.exec:\lfrxxxx.exe173⤵PID:4544
-
\??\c:\xxlfrrf.exec:\xxlfrrf.exe174⤵PID:5616
-
\??\c:\nbthhn.exec:\nbthhn.exe175⤵PID:5084
-
\??\c:\djddj.exec:\djddj.exe176⤵PID:5228
-
\??\c:\frxrxxf.exec:\frxrxxf.exe177⤵PID:1988
-
\??\c:\tbbnhn.exec:\tbbnhn.exe178⤵PID:5636
-
\??\c:\pdppj.exec:\pdppj.exe179⤵PID:5032
-
\??\c:\1jvdd.exec:\1jvdd.exe180⤵PID:1888
-
\??\c:\flxxlrx.exec:\flxxlrx.exe181⤵PID:5400
-
\??\c:\hnbtbn.exec:\hnbtbn.exe182⤵PID:1716
-
\??\c:\hhtttb.exec:\hhtttb.exe183⤵PID:1840
-
\??\c:\vpddd.exec:\vpddd.exe184⤵PID:2820
-
\??\c:\jdpjd.exec:\jdpjd.exe185⤵PID:1372
-
\??\c:\9lrlfrr.exec:\9lrlfrr.exe186⤵PID:2264
-
\??\c:\hntthb.exec:\hntthb.exe187⤵PID:1152
-
\??\c:\tntnnt.exec:\tntnnt.exe188⤵PID:1832
-
\??\c:\pvppj.exec:\pvppj.exe189⤵PID:2172
-
\??\c:\fllflrf.exec:\fllflrf.exe190⤵PID:5160
-
\??\c:\frlffrx.exec:\frlffrx.exe191⤵PID:1872
-
\??\c:\nhtnnn.exec:\nhtnnn.exe192⤵PID:3660
-
\??\c:\1hbbbb.exec:\1hbbbb.exe193⤵PID:1884
-
\??\c:\vppjd.exec:\vppjd.exe194⤵PID:2952
-
\??\c:\vppjv.exec:\vppjv.exe195⤵PID:5504
-
\??\c:\frlxlxx.exec:\frlxlxx.exe196⤵PID:3564
-
\??\c:\rlxrlff.exec:\rlxrlff.exe197⤵PID:3160
-
\??\c:\bnbttt.exec:\bnbttt.exe198⤵PID:2044
-
\??\c:\tntnnn.exec:\tntnnn.exe199⤵PID:3684
-
\??\c:\dddvv.exec:\dddvv.exe200⤵PID:1504
-
\??\c:\7ppjv.exec:\7ppjv.exe201⤵PID:5792
-
\??\c:\rlflfff.exec:\rlflfff.exe202⤵PID:1404
-
\??\c:\bnttnt.exec:\bnttnt.exe203⤵PID:4676
-
\??\c:\bnbnhn.exec:\bnbnhn.exe204⤵PID:3712
-
\??\c:\jdvpp.exec:\jdvpp.exe205⤵PID:3196
-
\??\c:\vvpjp.exec:\vvpjp.exe206⤵PID:2072
-
\??\c:\7lllxfl.exec:\7lllxfl.exe207⤵PID:2976
-
\??\c:\lxfxflf.exec:\lxfxflf.exe208⤵PID:1492
-
\??\c:\9tbbbb.exec:\9tbbbb.exe209⤵PID:2580
-
\??\c:\ppdvd.exec:\ppdvd.exe210⤵PID:2816
-
\??\c:\pdpjj.exec:\pdpjj.exe211⤵PID:2312
-
\??\c:\3xfrxrx.exec:\3xfrxrx.exe212⤵PID:4960
-
\??\c:\bnnnht.exec:\bnnnht.exe213⤵PID:5232
-
\??\c:\hhtntn.exec:\hhtntn.exe214⤵PID:2840
-
\??\c:\jvvjp.exec:\jvvjp.exe215⤵PID:3772
-
\??\c:\pjppp.exec:\pjppp.exe216⤵PID:4796
-
\??\c:\llrllll.exec:\llrllll.exe217⤵PID:4472
-
\??\c:\xfrflfx.exec:\xfrflfx.exe218⤵PID:3248
-
\??\c:\1nbhnn.exec:\1nbhnn.exe219⤵PID:4112
-
\??\c:\pddvv.exec:\pddvv.exe220⤵PID:5364
-
\??\c:\vvdvv.exec:\vvdvv.exe221⤵PID:5112
-
\??\c:\rxrlrrl.exec:\rxrlrrl.exe222⤵PID:1284
-
\??\c:\tthnth.exec:\tthnth.exe223⤵PID:5308
-
\??\c:\thtbnb.exec:\thtbnb.exe224⤵PID:3224
-
\??\c:\pvdjv.exec:\pvdjv.exe225⤵PID:3456
-
\??\c:\vdvjj.exec:\vdvjj.exe226⤵PID:5440
-
\??\c:\lrrflff.exec:\lrrflff.exe227⤵PID:2428
-
\??\c:\nhthtb.exec:\nhthtb.exe228⤵PID:4764
-
\??\c:\ttbhnt.exec:\ttbhnt.exe229⤵PID:5012
-
\??\c:\vvvpd.exec:\vvvpd.exe230⤵PID:3740
-
\??\c:\djpdp.exec:\djpdp.exe231⤵PID:3600
-
\??\c:\9rlffff.exec:\9rlffff.exe232⤵PID:4772
-
\??\c:\nnnhbb.exec:\nnnhbb.exe233⤵PID:4180
-
\??\c:\bhtnnn.exec:\bhtnnn.exe234⤵PID:4992
-
\??\c:\5jjjj.exec:\5jjjj.exe235⤵PID:2336
-
\??\c:\xxxrllr.exec:\xxxrllr.exe236⤵PID:756
-
\??\c:\tntthh.exec:\tntthh.exe237⤵PID:5368
-
\??\c:\tnbbnn.exec:\tnbbnn.exe238⤵PID:5660
-
\??\c:\pjjjj.exec:\pjjjj.exe239⤵PID:1992
-
\??\c:\1djvd.exec:\1djvd.exe240⤵PID:5788
-
\??\c:\xrfllxx.exec:\xrfllxx.exe241⤵PID:2176
-
\??\c:\7xrrxxf.exec:\7xrrxxf.exe242⤵PID:4412