Analysis
-
max time kernel
149s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:20
Behavioral task
behavioral1
Sample
8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe
-
Size
75KB
-
MD5
8f4765d19a8bc2bd27d23992e35db1d0
-
SHA1
b3719a7ec66afd0e41e5ded8bf3db4760c0e3407
-
SHA256
63d94b1795b36dc50ebba563bef06e2bf27b3e4480aee1fc153c56a3af574184
-
SHA512
038eb960044088092df48d752edc6fe8f490f953e89f52cd66d09992e4f7fdeaffbdc6a1763839982f3e1721f78595a864b48ff223db13e5e10c3e1754dea79b
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE8Z:9hOmTsF93UYfwC6GIoutz5yLpOSDT
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4960-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/428-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/892-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/808-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3804-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1956-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-654-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-662-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-724-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frxxxxx.exefllffff.exedvddd.exepdjdp.exelffxlll.exefxrrrrr.exennttnn.exehnnhbb.exepdvpp.exerlxxfff.exexrxrxrx.exenttbtt.exe9vdvp.exe7rxrlll.exexrlflll.exehhnhbb.exevjpjd.exelxlfffx.exefffxrlf.exehbbbtt.exe7jvvd.exe9jddv.exejvvpj.exexfrrlrl.exettbbbb.exebtbttt.exepjpjd.exepjppv.exeffrrrrx.exenbhbtn.exenhbhhh.exepvdpp.exevppjd.exelfrfllr.exellffxxf.exe5nnhhh.exe5hnnhh.exepdjjj.exefllfxfx.exehbntht.exedjjjd.exepdjdv.exerffxrll.exelfxrrll.exebbhbbb.exepjpjd.exejvpjd.exerlrllff.exe3llrfff.exe3hnnbb.exepjpjj.exevpjdv.exexlrrxxr.exefrxrrrl.exehhnhnn.exenbtbnn.exedvvvj.exedjppj.exeflrrllf.exe3ttnhh.exe1hhhbh.exejvpjp.exe5pppj.exexxxrlll.exepid process 1284 frxxxxx.exe 1152 fllffff.exe 4092 dvddd.exe 4480 pdjdp.exe 3596 lffxlll.exe 2440 fxrrrrr.exe 2568 nnttnn.exe 2380 hnnhbb.exe 3116 pdvpp.exe 912 rlxxfff.exe 4872 xrxrxrx.exe 4716 nttbtt.exe 428 9vdvp.exe 892 7rxrlll.exe 2572 xrlflll.exe 2988 hhnhbb.exe 2960 vjpjd.exe 3912 lxlfffx.exe 4004 fffxrlf.exe 2848 hbbbtt.exe 3664 7jvvd.exe 4048 9jddv.exe 4076 jvvpj.exe 1588 xfrrlrl.exe 876 ttbbbb.exe 1384 btbttt.exe 4832 pjpjd.exe 3932 pjppv.exe 5100 ffrrrrx.exe 4704 nbhbtn.exe 2756 nhbhhh.exe 1164 pvdpp.exe 2024 vppjd.exe 808 lfrfllr.exe 1160 llffxxf.exe 3848 5nnhhh.exe 4204 5hnnhh.exe 5104 pdjjj.exe 4904 fllfxfx.exe 1068 hbntht.exe 404 djjjd.exe 8 pdjdv.exe 1728 rffxrll.exe 4348 lfxrrll.exe 4624 bbhbbb.exe 5112 pjpjd.exe 3600 jvpjd.exe 1388 rlrllff.exe 4480 3llrfff.exe 4120 3hnnbb.exe 400 pjpjj.exe 3836 vpjdv.exe 436 xlrrxxr.exe 2020 frxrrrl.exe 912 hhnhnn.exe 3300 nbtbnn.exe 4872 dvvvj.exe 3188 djppj.exe 3576 flrrllf.exe 4532 3ttnhh.exe 2368 1hhhbh.exe 3256 jvpjp.exe 4540 5pppj.exe 560 xxxrlll.exe -
Processes:
resource yara_rule behavioral2/memory/4960-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frxxxxx.exe upx C:\fllffff.exe upx behavioral2/memory/1152-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1284-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1284-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvddd.exe upx behavioral2/memory/4092-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4480-26-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdjdp.exe upx \??\c:\lffxlll.exe upx behavioral2/memory/3596-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxrrrrr.exe upx behavioral2/memory/2440-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnttnn.exe upx \??\c:\hnnhbb.exe upx behavioral2/memory/2568-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2380-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvpp.exe upx behavioral2/memory/3116-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxxfff.exe upx behavioral2/memory/912-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxrxrx.exe upx behavioral2/memory/4872-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nttbtt.exe upx behavioral2/memory/4872-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vdvp.exe upx C:\7rxrlll.exe upx behavioral2/memory/428-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/892-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlflll.exe upx behavioral2/memory/2572-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhnhbb.exe upx C:\vjpjd.exe upx C:\lxlfffx.exe upx C:\fffxrlf.exe upx behavioral2/memory/3912-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbbbtt.exe upx C:\7jvvd.exe upx behavioral2/memory/2848-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4004-115-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9jddv.exe upx behavioral2/memory/4048-129-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jvvpj.exe upx C:\xfrrlrl.exe upx behavioral2/memory/3664-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttbbbb.exe upx behavioral2/memory/876-149-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbttt.exe upx behavioral2/memory/1384-157-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjpjd.exe upx C:\pjppv.exe upx C:\ffrrrrx.exe upx behavioral2/memory/3932-167-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbhbtn.exe upx C:\nhbhhh.exe upx C:\pvdpp.exe upx behavioral2/memory/808-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1160-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3848-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4204-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5104-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4904-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/404-218-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exefrxxxxx.exefllffff.exedvddd.exepdjdp.exelffxlll.exefxrrrrr.exennttnn.exehnnhbb.exepdvpp.exerlxxfff.exexrxrxrx.exenttbtt.exe9vdvp.exe7rxrlll.exexrlflll.exehhnhbb.exevjpjd.exelxlfffx.exefffxrlf.exehbbbtt.exe7jvvd.exedescription pid process target process PID 4960 wrote to memory of 1284 4960 8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe frxxxxx.exe PID 4960 wrote to memory of 1284 4960 8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe frxxxxx.exe PID 4960 wrote to memory of 1284 4960 8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe frxxxxx.exe PID 1284 wrote to memory of 1152 1284 frxxxxx.exe fllffff.exe PID 1284 wrote to memory of 1152 1284 frxxxxx.exe fllffff.exe PID 1284 wrote to memory of 1152 1284 frxxxxx.exe fllffff.exe PID 1152 wrote to memory of 4092 1152 fllffff.exe dvddd.exe PID 1152 wrote to memory of 4092 1152 fllffff.exe dvddd.exe PID 1152 wrote to memory of 4092 1152 fllffff.exe dvddd.exe PID 4092 wrote to memory of 4480 4092 dvddd.exe pdjdp.exe PID 4092 wrote to memory of 4480 4092 dvddd.exe pdjdp.exe PID 4092 wrote to memory of 4480 4092 dvddd.exe pdjdp.exe PID 4480 wrote to memory of 3596 4480 pdjdp.exe lffxlll.exe PID 4480 wrote to memory of 3596 4480 pdjdp.exe lffxlll.exe PID 4480 wrote to memory of 3596 4480 pdjdp.exe lffxlll.exe PID 3596 wrote to memory of 2440 3596 lffxlll.exe fxrrrrr.exe PID 3596 wrote to memory of 2440 3596 lffxlll.exe fxrrrrr.exe PID 3596 wrote to memory of 2440 3596 lffxlll.exe fxrrrrr.exe PID 2440 wrote to memory of 2568 2440 fxrrrrr.exe nnttnn.exe PID 2440 wrote to memory of 2568 2440 fxrrrrr.exe nnttnn.exe PID 2440 wrote to memory of 2568 2440 fxrrrrr.exe nnttnn.exe PID 2568 wrote to memory of 2380 2568 nnttnn.exe hnnhbb.exe PID 2568 wrote to memory of 2380 2568 nnttnn.exe hnnhbb.exe PID 2568 wrote to memory of 2380 2568 nnttnn.exe hnnhbb.exe PID 2380 wrote to memory of 3116 2380 hnnhbb.exe pdvpp.exe PID 2380 wrote to memory of 3116 2380 hnnhbb.exe pdvpp.exe PID 2380 wrote to memory of 3116 2380 hnnhbb.exe pdvpp.exe PID 3116 wrote to memory of 912 3116 pdvpp.exe rlxxfff.exe PID 3116 wrote to memory of 912 3116 pdvpp.exe rlxxfff.exe PID 3116 wrote to memory of 912 3116 pdvpp.exe rlxxfff.exe PID 912 wrote to memory of 4872 912 rlxxfff.exe xrxrxrx.exe PID 912 wrote to memory of 4872 912 rlxxfff.exe xrxrxrx.exe PID 912 wrote to memory of 4872 912 rlxxfff.exe xrxrxrx.exe PID 4872 wrote to memory of 4716 4872 xrxrxrx.exe nttbtt.exe PID 4872 wrote to memory of 4716 4872 xrxrxrx.exe nttbtt.exe PID 4872 wrote to memory of 4716 4872 xrxrxrx.exe nttbtt.exe PID 4716 wrote to memory of 428 4716 nttbtt.exe 9vdvp.exe PID 4716 wrote to memory of 428 4716 nttbtt.exe 9vdvp.exe PID 4716 wrote to memory of 428 4716 nttbtt.exe 9vdvp.exe PID 428 wrote to memory of 892 428 9vdvp.exe 7rxrlll.exe PID 428 wrote to memory of 892 428 9vdvp.exe 7rxrlll.exe PID 428 wrote to memory of 892 428 9vdvp.exe 7rxrlll.exe PID 892 wrote to memory of 2572 892 7rxrlll.exe xrlflll.exe PID 892 wrote to memory of 2572 892 7rxrlll.exe xrlflll.exe PID 892 wrote to memory of 2572 892 7rxrlll.exe xrlflll.exe PID 2572 wrote to memory of 2988 2572 xrlflll.exe hhnhbb.exe PID 2572 wrote to memory of 2988 2572 xrlflll.exe hhnhbb.exe PID 2572 wrote to memory of 2988 2572 xrlflll.exe hhnhbb.exe PID 2988 wrote to memory of 2960 2988 hhnhbb.exe vjpjd.exe PID 2988 wrote to memory of 2960 2988 hhnhbb.exe vjpjd.exe PID 2988 wrote to memory of 2960 2988 hhnhbb.exe vjpjd.exe PID 2960 wrote to memory of 3912 2960 vjpjd.exe lxlfffx.exe PID 2960 wrote to memory of 3912 2960 vjpjd.exe lxlfffx.exe PID 2960 wrote to memory of 3912 2960 vjpjd.exe lxlfffx.exe PID 3912 wrote to memory of 4004 3912 lxlfffx.exe fffxrlf.exe PID 3912 wrote to memory of 4004 3912 lxlfffx.exe fffxrlf.exe PID 3912 wrote to memory of 4004 3912 lxlfffx.exe fffxrlf.exe PID 4004 wrote to memory of 2848 4004 fffxrlf.exe hbbbtt.exe PID 4004 wrote to memory of 2848 4004 fffxrlf.exe hbbbtt.exe PID 4004 wrote to memory of 2848 4004 fffxrlf.exe hbbbtt.exe PID 2848 wrote to memory of 3664 2848 hbbbtt.exe 7jvvd.exe PID 2848 wrote to memory of 3664 2848 hbbbtt.exe 7jvvd.exe PID 2848 wrote to memory of 3664 2848 hbbbtt.exe 7jvvd.exe PID 3664 wrote to memory of 4048 3664 7jvvd.exe 9jddv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\frxxxxx.exec:\frxxxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\fllffff.exec:\fllffff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\dvddd.exec:\dvddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\pdjdp.exec:\pdjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\lffxlll.exec:\lffxlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\nnttnn.exec:\nnttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hnnhbb.exec:\hnnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\pdvpp.exec:\pdvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\rlxxfff.exec:\rlxxfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\nttbtt.exec:\nttbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\9vdvp.exec:\9vdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\7rxrlll.exec:\7rxrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\xrlflll.exec:\xrlflll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\hhnhbb.exec:\hhnhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\vjpjd.exec:\vjpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\lxlfffx.exec:\lxlfffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\fffxrlf.exec:\fffxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\hbbbtt.exec:\hbbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\7jvvd.exec:\7jvvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\9jddv.exec:\9jddv.exe23⤵
- Executes dropped EXE
PID:4048 -
\??\c:\jvvpj.exec:\jvvpj.exe24⤵
- Executes dropped EXE
PID:4076 -
\??\c:\xfrrlrl.exec:\xfrrlrl.exe25⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ttbbbb.exec:\ttbbbb.exe26⤵
- Executes dropped EXE
PID:876 -
\??\c:\btbttt.exec:\btbttt.exe27⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pjpjd.exec:\pjpjd.exe28⤵
- Executes dropped EXE
PID:4832 -
\??\c:\pjppv.exec:\pjppv.exe29⤵
- Executes dropped EXE
PID:3932 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe30⤵
- Executes dropped EXE
PID:5100 -
\??\c:\nbhbtn.exec:\nbhbtn.exe31⤵
- Executes dropped EXE
PID:4704 -
\??\c:\nhbhhh.exec:\nhbhhh.exe32⤵
- Executes dropped EXE
PID:2756 -
\??\c:\pvdpp.exec:\pvdpp.exe33⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vppjd.exec:\vppjd.exe34⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lfrfllr.exec:\lfrfllr.exe35⤵
- Executes dropped EXE
PID:808 -
\??\c:\llffxxf.exec:\llffxxf.exe36⤵
- Executes dropped EXE
PID:1160 -
\??\c:\5nnhhh.exec:\5nnhhh.exe37⤵
- Executes dropped EXE
PID:3848 -
\??\c:\5hnnhh.exec:\5hnnhh.exe38⤵
- Executes dropped EXE
PID:4204 -
\??\c:\pdjjj.exec:\pdjjj.exe39⤵
- Executes dropped EXE
PID:5104 -
\??\c:\fllfxfx.exec:\fllfxfx.exe40⤵
- Executes dropped EXE
PID:4904 -
\??\c:\hbntht.exec:\hbntht.exe41⤵
- Executes dropped EXE
PID:1068 -
\??\c:\djjjd.exec:\djjjd.exe42⤵
- Executes dropped EXE
PID:404 -
\??\c:\pdjdv.exec:\pdjdv.exe43⤵
- Executes dropped EXE
PID:8 -
\??\c:\rffxrll.exec:\rffxrll.exe44⤵
- Executes dropped EXE
PID:1728 -
\??\c:\lfxrrll.exec:\lfxrrll.exe45⤵
- Executes dropped EXE
PID:4348 -
\??\c:\bbhbbb.exec:\bbhbbb.exe46⤵
- Executes dropped EXE
PID:4624 -
\??\c:\pjpjd.exec:\pjpjd.exe47⤵
- Executes dropped EXE
PID:5112 -
\??\c:\jvpjd.exec:\jvpjd.exe48⤵
- Executes dropped EXE
PID:3600 -
\??\c:\rlrllff.exec:\rlrllff.exe49⤵
- Executes dropped EXE
PID:1388 -
\??\c:\3llrfff.exec:\3llrfff.exe50⤵
- Executes dropped EXE
PID:4480 -
\??\c:\3hnnbb.exec:\3hnnbb.exe51⤵
- Executes dropped EXE
PID:4120 -
\??\c:\pjpjj.exec:\pjpjj.exe52⤵
- Executes dropped EXE
PID:400 -
\??\c:\vpjdv.exec:\vpjdv.exe53⤵
- Executes dropped EXE
PID:3836 -
\??\c:\xlrrxxr.exec:\xlrrxxr.exe54⤵
- Executes dropped EXE
PID:436 -
\??\c:\frxrrrl.exec:\frxrrrl.exe55⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hhnhnn.exec:\hhnhnn.exe56⤵
- Executes dropped EXE
PID:912 -
\??\c:\nbtbnn.exec:\nbtbnn.exe57⤵
- Executes dropped EXE
PID:3300 -
\??\c:\dvvvj.exec:\dvvvj.exe58⤵
- Executes dropped EXE
PID:4872 -
\??\c:\djppj.exec:\djppj.exe59⤵
- Executes dropped EXE
PID:3188 -
\??\c:\flrrllf.exec:\flrrllf.exe60⤵
- Executes dropped EXE
PID:3576 -
\??\c:\3ttnhh.exec:\3ttnhh.exe61⤵
- Executes dropped EXE
PID:4532 -
\??\c:\1hhhbh.exec:\1hhhbh.exe62⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jvpjp.exec:\jvpjp.exe63⤵
- Executes dropped EXE
PID:3256 -
\??\c:\5pppj.exec:\5pppj.exe64⤵
- Executes dropped EXE
PID:4540 -
\??\c:\xxxrlll.exec:\xxxrlll.exe65⤵
- Executes dropped EXE
PID:560 -
\??\c:\3fxrllf.exec:\3fxrllf.exe66⤵PID:3956
-
\??\c:\nttttn.exec:\nttttn.exe67⤵PID:2316
-
\??\c:\bbbhhn.exec:\bbbhhn.exe68⤵PID:5024
-
\??\c:\dpjvv.exec:\dpjvv.exe69⤵PID:4644
-
\??\c:\ppddj.exec:\ppddj.exe70⤵PID:3804
-
\??\c:\xfxxxxl.exec:\xfxxxxl.exe71⤵PID:2692
-
\??\c:\lrrfflr.exec:\lrrfflr.exe72⤵PID:1080
-
\??\c:\nbbhhh.exec:\nbbhhh.exe73⤵PID:5060
-
\??\c:\thhbnn.exec:\thhbnn.exe74⤵PID:876
-
\??\c:\djvvj.exec:\djvvj.exe75⤵PID:1832
-
\??\c:\vpppd.exec:\vpppd.exe76⤵PID:2460
-
\??\c:\fxxrrlr.exec:\fxxrrlr.exe77⤵PID:1800
-
\??\c:\fxlrllf.exec:\fxlrllf.exe78⤵PID:3932
-
\??\c:\bbhnnn.exec:\bbhnnn.exe79⤵PID:5100
-
\??\c:\7jvpp.exec:\7jvpp.exe80⤵PID:4036
-
\??\c:\dvpjd.exec:\dvpjd.exe81⤵PID:1372
-
\??\c:\flrrllr.exec:\flrrllr.exe82⤵PID:4892
-
\??\c:\xrxrrll.exec:\xrxrrll.exe83⤵PID:3520
-
\??\c:\flxfxxf.exec:\flxfxxf.exe84⤵PID:1604
-
\??\c:\ttnhbn.exec:\ttnhbn.exe85⤵PID:3740
-
\??\c:\7pjjp.exec:\7pjjp.exe86⤵PID:2900
-
\??\c:\xfrrfff.exec:\xfrrfff.exe87⤵PID:2164
-
\??\c:\btbnhn.exec:\btbnhn.exe88⤵PID:4204
-
\??\c:\hhhhhh.exec:\hhhhhh.exe89⤵PID:4600
-
\??\c:\jdjjj.exec:\jdjjj.exe90⤵PID:1656
-
\??\c:\vvddv.exec:\vvddv.exe91⤵PID:5008
-
\??\c:\xrxrfff.exec:\xrxrfff.exe92⤵PID:3176
-
\??\c:\xxllxrr.exec:\xxllxrr.exe93⤵PID:544
-
\??\c:\tntttt.exec:\tntttt.exe94⤵PID:2456
-
\??\c:\vppvv.exec:\vppvv.exe95⤵PID:4348
-
\??\c:\vvdjj.exec:\vvdjj.exe96⤵PID:4624
-
\??\c:\rllfxxr.exec:\rllfxxr.exe97⤵PID:3140
-
\??\c:\fxxrlll.exec:\fxxrlll.exe98⤵PID:3600
-
\??\c:\dvvvv.exec:\dvvvv.exe99⤵PID:1500
-
\??\c:\1vddd.exec:\1vddd.exe100⤵PID:4620
-
\??\c:\5lxxrll.exec:\5lxxrll.exe101⤵PID:3820
-
\??\c:\5lrlllf.exec:\5lrlllf.exe102⤵PID:3856
-
\??\c:\bttnhh.exec:\bttnhh.exe103⤵PID:3564
-
\??\c:\jdddv.exec:\jdddv.exe104⤵PID:756
-
\??\c:\llfxrrl.exec:\llfxrrl.exe105⤵PID:2324
-
\??\c:\rrfffll.exec:\rrfffll.exe106⤵PID:5036
-
\??\c:\hbhbtb.exec:\hbhbtb.exe107⤵PID:3316
-
\??\c:\jdjdv.exec:\jdjdv.exe108⤵PID:5056
-
\??\c:\7pppv.exec:\7pppv.exe109⤵PID:628
-
\??\c:\pjvvv.exec:\pjvvv.exe110⤵PID:4936
-
\??\c:\flllllf.exec:\flllllf.exe111⤵PID:1536
-
\??\c:\ntttnn.exec:\ntttnn.exe112⤵PID:1044
-
\??\c:\hhnhbb.exec:\hhnhbb.exe113⤵PID:1172
-
\??\c:\tnnnnn.exec:\tnnnnn.exe114⤵PID:1808
-
\??\c:\dddvv.exec:\dddvv.exe115⤵PID:3516
-
\??\c:\flrlrll.exec:\flrlrll.exe116⤵PID:4248
-
\??\c:\lrfxrlf.exec:\lrfxrlf.exe117⤵PID:3868
-
\??\c:\tbnhbb.exec:\tbnhbb.exe118⤵PID:224
-
\??\c:\btbtht.exec:\btbtht.exe119⤵PID:2288
-
\??\c:\dpjjj.exec:\dpjjj.exe120⤵PID:4456
-
\??\c:\flffxrl.exec:\flffxrl.exe121⤵PID:1984
-
\??\c:\lrxxrll.exec:\lrxxrll.exe122⤵PID:4128
-
\??\c:\xrffllr.exec:\xrffllr.exe123⤵PID:1080
-
\??\c:\nbhhhh.exec:\nbhhhh.exe124⤵PID:3640
-
\??\c:\vppjv.exec:\vppjv.exe125⤵PID:3864
-
\??\c:\lxfxxff.exec:\lxfxxff.exe126⤵PID:1832
-
\??\c:\rlffxxx.exec:\rlffxxx.exe127⤵PID:2460
-
\??\c:\thbtnn.exec:\thbtnn.exe128⤵PID:812
-
\??\c:\ppddd.exec:\ppddd.exe129⤵PID:2492
-
\??\c:\pjdvd.exec:\pjdvd.exe130⤵PID:5100
-
\??\c:\bhnnht.exec:\bhnnht.exe131⤵PID:1672
-
\??\c:\7bbtnn.exec:\7bbtnn.exe132⤵PID:1372
-
\??\c:\vjjdd.exec:\vjjdd.exe133⤵PID:4892
-
\??\c:\9pvvp.exec:\9pvvp.exe134⤵PID:808
-
\??\c:\lrlfffl.exec:\lrlfffl.exe135⤵PID:4612
-
\??\c:\lfxrxfx.exec:\lfxrxfx.exe136⤵PID:1416
-
\??\c:\nthhbb.exec:\nthhbb.exe137⤵PID:1956
-
\??\c:\hnttbt.exec:\hnttbt.exe138⤵PID:4952
-
\??\c:\5jjdj.exec:\5jjdj.exe139⤵PID:2192
-
\??\c:\3ddjd.exec:\3ddjd.exe140⤵PID:1968
-
\??\c:\xlxrrlr.exec:\xlxrrlr.exe141⤵PID:1656
-
\??\c:\xfxxlll.exec:\xfxxlll.exe142⤵PID:3584
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe143⤵PID:2412
-
\??\c:\ntttth.exec:\ntttth.exe144⤵PID:4344
-
\??\c:\htbbbh.exec:\htbbbh.exe145⤵PID:4912
-
\??\c:\jvddv.exec:\jvddv.exe146⤵PID:1140
-
\??\c:\dvpvj.exec:\dvpvj.exe147⤵PID:4436
-
\??\c:\xrrxrxx.exec:\xrrxrxx.exe148⤵PID:4396
-
\??\c:\frlllll.exec:\frlllll.exe149⤵PID:1500
-
\??\c:\lxfrffx.exec:\lxfrffx.exe150⤵PID:4620
-
\??\c:\9hnhnb.exec:\9hnhnb.exe151⤵PID:3820
-
\??\c:\nhtnhh.exec:\nhtnhh.exe152⤵PID:1112
-
\??\c:\dpjjd.exec:\dpjjd.exe153⤵PID:4732
-
\??\c:\dvdvd.exec:\dvdvd.exe154⤵PID:3116
-
\??\c:\frrrxxx.exec:\frrrxxx.exe155⤵PID:912
-
\??\c:\llrfxxl.exec:\llrfxxl.exe156⤵PID:4028
-
\??\c:\1htnth.exec:\1htnth.exe157⤵PID:5056
-
\??\c:\ntbbht.exec:\ntbbht.exe158⤵PID:548
-
\??\c:\3pddj.exec:\3pddj.exe159⤵PID:2148
-
\??\c:\xrrfxxf.exec:\xrrfxxf.exe160⤵PID:3440
-
\??\c:\nnbbbt.exec:\nnbbbt.exe161⤵PID:4824
-
\??\c:\pddvp.exec:\pddvp.exe162⤵PID:4248
-
\??\c:\dppdv.exec:\dppdv.exe163⤵PID:1572
-
\??\c:\lffllrx.exec:\lffllrx.exe164⤵PID:3804
-
\??\c:\rlrxlrr.exec:\rlrxlrr.exe165⤵PID:3816
-
\??\c:\xfxffff.exec:\xfxffff.exe166⤵PID:4128
-
\??\c:\thhbtt.exec:\thhbtt.exe167⤵PID:1408
-
\??\c:\1thbhh.exec:\1thbhh.exe168⤵PID:636
-
\??\c:\vjpjj.exec:\vjpjj.exe169⤵PID:1684
-
\??\c:\frfrfff.exec:\frfrfff.exe170⤵PID:1800
-
\??\c:\ffxfffx.exec:\ffxfffx.exe171⤵PID:812
-
\??\c:\1rxxrrr.exec:\1rxxrrr.exe172⤵PID:1320
-
\??\c:\btnnhh.exec:\btnnhh.exe173⤵PID:1784
-
\??\c:\bhnnnn.exec:\bhnnnn.exe174⤵PID:1672
-
\??\c:\9nnnbb.exec:\9nnnbb.exe175⤵PID:228
-
\??\c:\jddvj.exec:\jddvj.exe176⤵PID:3320
-
\??\c:\vvddv.exec:\vvddv.exe177⤵PID:4568
-
\??\c:\xlrllrr.exec:\xlrllrr.exe178⤵PID:2392
-
\??\c:\lxffxxr.exec:\lxffxxr.exe179⤵PID:2164
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe180⤵PID:4204
-
\??\c:\3bhbtt.exec:\3bhbtt.exe181⤵PID:2700
-
\??\c:\vjjvp.exec:\vjjvp.exe182⤵PID:404
-
\??\c:\ppppp.exec:\ppppp.exe183⤵PID:5008
-
\??\c:\xxffrfr.exec:\xxffrfr.exe184⤵PID:2308
-
\??\c:\ttthbb.exec:\ttthbb.exe185⤵PID:8
-
\??\c:\nhttbh.exec:\nhttbh.exe186⤵PID:2548
-
\??\c:\jddvv.exec:\jddvv.exe187⤵PID:2124
-
\??\c:\dppjd.exec:\dppjd.exe188⤵PID:4688
-
\??\c:\lfflxff.exec:\lfflxff.exe189⤵PID:4092
-
\??\c:\rllxrrx.exec:\rllxrrx.exe190⤵PID:4324
-
\??\c:\hhhnnb.exec:\hhhnnb.exe191⤵PID:464
-
\??\c:\nhtnnt.exec:\nhtnnt.exe192⤵PID:456
-
\??\c:\jvppj.exec:\jvppj.exe193⤵PID:3564
-
\??\c:\jpppj.exec:\jpppj.exe194⤵PID:3836
-
\??\c:\llxxxxx.exec:\llxxxxx.exe195⤵PID:2972
-
\??\c:\rrfllll.exec:\rrfllll.exe196⤵PID:968
-
\??\c:\htbbbh.exec:\htbbbh.exe197⤵PID:4504
-
\??\c:\hbbtnn.exec:\hbbtnn.exe198⤵PID:4556
-
\??\c:\pjjvp.exec:\pjjvp.exe199⤵PID:1688
-
\??\c:\flrllll.exec:\flrllll.exe200⤵PID:3528
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe201⤵PID:692
-
\??\c:\hhtttt.exec:\hhtttt.exe202⤵PID:3700
-
\??\c:\jpdvv.exec:\jpdvv.exe203⤵PID:1240
-
\??\c:\jjjjd.exec:\jjjjd.exe204⤵PID:4408
-
\??\c:\pvpjd.exec:\pvpjd.exe205⤵PID:3928
-
\??\c:\xxlfxll.exec:\xxlfxll.exe206⤵PID:4572
-
\??\c:\rllfxrl.exec:\rllfxrl.exe207⤵PID:3804
-
\??\c:\3vvpp.exec:\3vvpp.exe208⤵PID:5060
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe209⤵PID:876
-
\??\c:\fxlfffl.exec:\fxlfffl.exe210⤵PID:1408
-
\??\c:\rlrlllr.exec:\rlrlllr.exe211⤵PID:636
-
\??\c:\tnnhbb.exec:\tnnhbb.exe212⤵PID:3776
-
\??\c:\tnnhhh.exec:\tnnhhh.exe213⤵PID:368
-
\??\c:\pdjjd.exec:\pdjjd.exe214⤵PID:812
-
\??\c:\pjjdp.exec:\pjjdp.exe215⤵PID:5092
-
\??\c:\ntthbt.exec:\ntthbt.exe216⤵PID:1324
-
\??\c:\bhnhtt.exec:\bhnhtt.exe217⤵PID:3948
-
\??\c:\pjjdd.exec:\pjjdd.exe218⤵PID:3588
-
\??\c:\vpjdd.exec:\vpjdd.exe219⤵PID:3320
-
\??\c:\rlrxrrl.exec:\rlrxrrl.exe220⤵PID:3184
-
\??\c:\rlfffff.exec:\rlfffff.exe221⤵PID:1416
-
\??\c:\fffxrrr.exec:\fffxrrr.exe222⤵PID:5016
-
\??\c:\hhbbtt.exec:\hhbbtt.exe223⤵PID:4904
-
\??\c:\bhhnhn.exec:\bhhnhn.exe224⤵PID:1068
-
\??\c:\jpdvj.exec:\jpdvj.exe225⤵PID:844
-
\??\c:\dvvpd.exec:\dvvpd.exe226⤵PID:3584
-
\??\c:\9xfxrll.exec:\9xfxrll.exe227⤵PID:2308
-
\??\c:\9fllffl.exec:\9fllffl.exe228⤵PID:8
-
\??\c:\tbhhbb.exec:\tbhhbb.exe229⤵PID:4668
-
\??\c:\jdjdp.exec:\jdjdp.exe230⤵PID:2320
-
\??\c:\vdjdd.exec:\vdjdd.exe231⤵PID:1140
-
\??\c:\lrffxxr.exec:\lrffxxr.exe232⤵PID:816
-
\??\c:\rfffxxx.exec:\rfffxxx.exe233⤵PID:4396
-
\??\c:\llrlfll.exec:\llrlfll.exe234⤵PID:3904
-
\??\c:\5bnttb.exec:\5bnttb.exe235⤵PID:456
-
\??\c:\btnhtb.exec:\btnhtb.exe236⤵PID:1012
-
\??\c:\3ddvp.exec:\3ddvp.exe237⤵PID:436
-
\??\c:\dvvvv.exec:\dvvvv.exe238⤵PID:2324
-
\??\c:\7pvvp.exec:\7pvvp.exe239⤵PID:912
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe240⤵PID:2728
-
\??\c:\lrrrllf.exec:\lrrrllf.exe241⤵PID:3676
-
\??\c:\hbhhbb.exec:\hbhhbb.exe242⤵PID:2724