Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:37
Behavioral task
behavioral1
Sample
d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe
-
Size
401KB
-
MD5
d8cd9bbc9a907ed2293eafc6fafd3960
-
SHA1
f3e987bcba0917f75fac286c26af12c8c7dd33c8
-
SHA256
68087093d2010d18fe23d1ad209f95da65512e0364262e1d1c7348992a1863b1
-
SHA512
f725118a7da738b758991df15ba4ecaaf68fc51e013ec4feefc05649da8e6ad2aefc074cf8112cbf106ef65294817dc7861457a61103f5c40a8bd80bf3590962
-
SSDEEP
6144:kcm4FmowdHoSph3Ymu8wdHoSM05d34iWRbzami3r:y4wFHoS3zuxHoSTd34iWRhib
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4080-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-698-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-858-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-771-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-688-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-648-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2816-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2052-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/428-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frfxfrf.exe7tnbnh.exe5jdvj.exellllfrr.exennnbnt.exe1ppvp.exejdjdj.exexrxrfxr.exetnhbnh.exejpvjv.exejvdpv.exerxxlrlf.exerllxlll.exehtthtn.exepjjdj.exefxrfxxr.exefffxlfr.exedvdpd.exefrlxrfx.exexfrrflx.exehbtnhh.exepjjvj.exejdjvj.exelxrlxrl.exehbnhtt.exevdjpj.exellxlxlx.exetbthbt.exe1ththb.exeppvjv.exeflxrlxl.exenbnbnh.exejvpdp.exeffrfrlx.exehtbtnn.exehnhtht.exe3dpdd.exerrxrffx.exebnhtnh.exepvvpj.exelfflffl.exefxflfrl.exetbtnhb.exe1vpvp.exe3ppjd.exexlfrxxr.exettnnbb.exetnhnhb.exe1jpjj.exe7xfrrlx.exellfxxxr.exehbttnh.exejddpj.exelxxrrlr.exexxlfxlx.exenhhnbh.exeddddv.exejvddv.exefxrfxrl.exehthttn.exebbnhbb.exejdvpd.exedvpjd.exeflfxffl.exepid process 4996 frfxfrf.exe 1048 7tnbnh.exe 4964 5jdvj.exe 3584 llllfrr.exe 624 nnnbnt.exe 3724 1ppvp.exe 4612 jdjdj.exe 4740 xrxrfxr.exe 428 tnhbnh.exe 3204 jpvjv.exe 3196 jvdpv.exe 2052 rxxlrlf.exe 4172 rllxlll.exe 3884 htthtn.exe 1424 pjjdj.exe 4512 fxrfxxr.exe 2352 fffxlfr.exe 5056 dvdpd.exe 4824 frlxrfx.exe 5040 xfrrflx.exe 1600 hbtnhh.exe 3308 pjjvj.exe 4860 jdjvj.exe 4356 lxrlxrl.exe 3640 hbnhtt.exe 4816 vdjpj.exe 4784 llxlxlx.exe 2752 tbthbt.exe 4368 1ththb.exe 736 ppvjv.exe 2544 flxrlxl.exe 3164 nbnbnh.exe 3140 jvpdp.exe 2832 ffrfrlx.exe 4848 htbtnn.exe 2972 hnhtht.exe 1984 3dpdd.exe 4204 rrxrffx.exe 1172 bnhtnh.exe 1400 pvvpj.exe 2776 lfflffl.exe 4316 fxflfrl.exe 1540 tbtnhb.exe 3204 1vpvp.exe 4812 3ppjd.exe 4704 xlfrxxr.exe 3236 ttnnbb.exe 3208 tnhnhb.exe 3528 1jpjj.exe 2080 7xfrrlx.exe 5084 llfxxxr.exe 4188 hbttnh.exe 1916 jddpj.exe 3692 lxxrrlr.exe 3192 xxlfxlx.exe 4732 nhhnbh.exe 3244 ddddv.exe 4472 jvddv.exe 3308 fxrfxrl.exe 436 hthttn.exe 4516 bbnhbb.exe 3992 jdvpd.exe 4412 dvpjd.exe 1720 flfxffl.exe -
Processes:
resource yara_rule behavioral2/memory/4080-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4080-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4996-8-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7tnbnh.exe upx C:\5jdvj.exe upx behavioral2/memory/4964-19-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llllfrr.exe upx \??\c:\1ppvp.exe upx C:\xrxrfxr.exe upx \??\c:\tnhbnh.exe upx behavioral2/memory/2052-72-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rllxlll.exe upx \??\c:\pjjdj.exe upx behavioral2/memory/4512-102-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvdpd.exe upx \??\c:\xfrrflx.exe upx \??\c:\hbtnhh.exe upx \??\c:\pjjvj.exe upx \??\c:\jdjvj.exe upx \??\c:\lxrlxrl.exe upx \??\c:\llxlxlx.exe upx behavioral2/memory/2752-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4368-172-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1ththb.exe upx \??\c:\flxrlxl.exe upx \??\c:\nbnbnh.exe upx behavioral2/memory/3164-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2832-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4204-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1172-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2776-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4812-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4704-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3192-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/436-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2024-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4196-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1956-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4712-351-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3648-388-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3648-392-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3384-430-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4860-437-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5076-500-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4820-522-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1492-638-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4436-662-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4200-684-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4736-698-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3572-718-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3896-734-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1956-772-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3308-881-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4904-888-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1176-865-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3208-858-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2324-851-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2340-829-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/912-810-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1656-800-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1020-771-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3152-699-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2616-688-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1636-655-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exefrfxfrf.exe7tnbnh.exe5jdvj.exellllfrr.exennnbnt.exe1ppvp.exejdjdj.exexrxrfxr.exetnhbnh.exejpvjv.exejvdpv.exerxxlrlf.exerllxlll.exehtthtn.exepjjdj.exefxrfxxr.exefffxlfr.exedvdpd.exefrlxrfx.exexfrrflx.exehbtnhh.exedescription pid process target process PID 4080 wrote to memory of 4996 4080 d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe frfxfrf.exe PID 4080 wrote to memory of 4996 4080 d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe frfxfrf.exe PID 4080 wrote to memory of 4996 4080 d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe frfxfrf.exe PID 4996 wrote to memory of 1048 4996 frfxfrf.exe 7tnbnh.exe PID 4996 wrote to memory of 1048 4996 frfxfrf.exe 7tnbnh.exe PID 4996 wrote to memory of 1048 4996 frfxfrf.exe 7tnbnh.exe PID 1048 wrote to memory of 4964 1048 7tnbnh.exe 5jdvj.exe PID 1048 wrote to memory of 4964 1048 7tnbnh.exe 5jdvj.exe PID 1048 wrote to memory of 4964 1048 7tnbnh.exe 5jdvj.exe PID 4964 wrote to memory of 3584 4964 5jdvj.exe llllfrr.exe PID 4964 wrote to memory of 3584 4964 5jdvj.exe llllfrr.exe PID 4964 wrote to memory of 3584 4964 5jdvj.exe llllfrr.exe PID 3584 wrote to memory of 624 3584 llllfrr.exe nnnbnt.exe PID 3584 wrote to memory of 624 3584 llllfrr.exe nnnbnt.exe PID 3584 wrote to memory of 624 3584 llllfrr.exe nnnbnt.exe PID 624 wrote to memory of 3724 624 nnnbnt.exe 1ppvp.exe PID 624 wrote to memory of 3724 624 nnnbnt.exe 1ppvp.exe PID 624 wrote to memory of 3724 624 nnnbnt.exe 1ppvp.exe PID 3724 wrote to memory of 4612 3724 1ppvp.exe jdjdj.exe PID 3724 wrote to memory of 4612 3724 1ppvp.exe jdjdj.exe PID 3724 wrote to memory of 4612 3724 1ppvp.exe jdjdj.exe PID 4612 wrote to memory of 4740 4612 jdjdj.exe xrxrfxr.exe PID 4612 wrote to memory of 4740 4612 jdjdj.exe xrxrfxr.exe PID 4612 wrote to memory of 4740 4612 jdjdj.exe xrxrfxr.exe PID 4740 wrote to memory of 428 4740 xrxrfxr.exe tnhbnh.exe PID 4740 wrote to memory of 428 4740 xrxrfxr.exe tnhbnh.exe PID 4740 wrote to memory of 428 4740 xrxrfxr.exe tnhbnh.exe PID 428 wrote to memory of 3204 428 tnhbnh.exe jpvjv.exe PID 428 wrote to memory of 3204 428 tnhbnh.exe jpvjv.exe PID 428 wrote to memory of 3204 428 tnhbnh.exe jpvjv.exe PID 3204 wrote to memory of 3196 3204 jpvjv.exe jvdpv.exe PID 3204 wrote to memory of 3196 3204 jpvjv.exe jvdpv.exe PID 3204 wrote to memory of 3196 3204 jpvjv.exe jvdpv.exe PID 3196 wrote to memory of 2052 3196 jvdpv.exe rxxlrlf.exe PID 3196 wrote to memory of 2052 3196 jvdpv.exe rxxlrlf.exe PID 3196 wrote to memory of 2052 3196 jvdpv.exe rxxlrlf.exe PID 2052 wrote to memory of 4172 2052 rxxlrlf.exe rllxlll.exe PID 2052 wrote to memory of 4172 2052 rxxlrlf.exe rllxlll.exe PID 2052 wrote to memory of 4172 2052 rxxlrlf.exe rllxlll.exe PID 4172 wrote to memory of 3884 4172 rllxlll.exe xxxrrrr.exe PID 4172 wrote to memory of 3884 4172 rllxlll.exe xxxrrrr.exe PID 4172 wrote to memory of 3884 4172 rllxlll.exe xxxrrrr.exe PID 3884 wrote to memory of 1424 3884 htthtn.exe pjjdj.exe PID 3884 wrote to memory of 1424 3884 htthtn.exe pjjdj.exe PID 3884 wrote to memory of 1424 3884 htthtn.exe pjjdj.exe PID 1424 wrote to memory of 4512 1424 pjjdj.exe fxrfxxr.exe PID 1424 wrote to memory of 4512 1424 pjjdj.exe fxrfxxr.exe PID 1424 wrote to memory of 4512 1424 pjjdj.exe fxrfxxr.exe PID 4512 wrote to memory of 2352 4512 fxrfxxr.exe vddvp.exe PID 4512 wrote to memory of 2352 4512 fxrfxxr.exe vddvp.exe PID 4512 wrote to memory of 2352 4512 fxrfxxr.exe vddvp.exe PID 2352 wrote to memory of 5056 2352 fffxlfr.exe dvdpd.exe PID 2352 wrote to memory of 5056 2352 fffxlfr.exe dvdpd.exe PID 2352 wrote to memory of 5056 2352 fffxlfr.exe dvdpd.exe PID 5056 wrote to memory of 4824 5056 dvdpd.exe frlxrfx.exe PID 5056 wrote to memory of 4824 5056 dvdpd.exe frlxrfx.exe PID 5056 wrote to memory of 4824 5056 dvdpd.exe frlxrfx.exe PID 4824 wrote to memory of 5040 4824 frlxrfx.exe ffxrlfx.exe PID 4824 wrote to memory of 5040 4824 frlxrfx.exe ffxrlfx.exe PID 4824 wrote to memory of 5040 4824 frlxrfx.exe ffxrlfx.exe PID 5040 wrote to memory of 1600 5040 xfrrflx.exe hbtnhh.exe PID 5040 wrote to memory of 1600 5040 xfrrflx.exe hbtnhh.exe PID 5040 wrote to memory of 1600 5040 xfrrflx.exe hbtnhh.exe PID 1600 wrote to memory of 3308 1600 hbtnhh.exe pjjvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d8cd9bbc9a907ed2293eafc6fafd3960_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\frfxfrf.exec:\frfxfrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\7tnbnh.exec:\7tnbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\5jdvj.exec:\5jdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\llllfrr.exec:\llllfrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\nnnbnt.exec:\nnnbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\1ppvp.exec:\1ppvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\jdjdj.exec:\jdjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\xrxrfxr.exec:\xrxrfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\tnhbnh.exec:\tnhbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\jpvjv.exec:\jpvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\jvdpv.exec:\jvdpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\rxxlrlf.exec:\rxxlrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\rllxlll.exec:\rllxlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\htthtn.exec:\htthtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\pjjdj.exec:\pjjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\fxrfxxr.exec:\fxrfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\fffxlfr.exec:\fffxlfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\dvdpd.exec:\dvdpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\frlxrfx.exec:\frlxrfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\xfrrflx.exec:\xfrrflx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\hbtnhh.exec:\hbtnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\pjjvj.exec:\pjjvj.exe23⤵
- Executes dropped EXE
PID:3308 -
\??\c:\jdjvj.exec:\jdjvj.exe24⤵
- Executes dropped EXE
PID:4860 -
\??\c:\lxrlxrl.exec:\lxrlxrl.exe25⤵
- Executes dropped EXE
PID:4356 -
\??\c:\hbnhtt.exec:\hbnhtt.exe26⤵
- Executes dropped EXE
PID:3640 -
\??\c:\vdjpj.exec:\vdjpj.exe27⤵
- Executes dropped EXE
PID:4816 -
\??\c:\llxlxlx.exec:\llxlxlx.exe28⤵
- Executes dropped EXE
PID:4784 -
\??\c:\tbthbt.exec:\tbthbt.exe29⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1ththb.exec:\1ththb.exe30⤵
- Executes dropped EXE
PID:4368 -
\??\c:\ppvjv.exec:\ppvjv.exe31⤵
- Executes dropped EXE
PID:736 -
\??\c:\flxrlxl.exec:\flxrlxl.exe32⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nbnbnh.exec:\nbnbnh.exe33⤵
- Executes dropped EXE
PID:3164 -
\??\c:\jvpdp.exec:\jvpdp.exe34⤵
- Executes dropped EXE
PID:3140 -
\??\c:\ffrfrlx.exec:\ffrfrlx.exe35⤵
- Executes dropped EXE
PID:2832 -
\??\c:\htbtnn.exec:\htbtnn.exe36⤵
- Executes dropped EXE
PID:4848 -
\??\c:\hnhtht.exec:\hnhtht.exe37⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3dpdd.exec:\3dpdd.exe38⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rrxrffx.exec:\rrxrffx.exe39⤵
- Executes dropped EXE
PID:4204 -
\??\c:\bnhtnh.exec:\bnhtnh.exe40⤵
- Executes dropped EXE
PID:1172 -
\??\c:\pvvpj.exec:\pvvpj.exe41⤵
- Executes dropped EXE
PID:1400 -
\??\c:\lfflffl.exec:\lfflffl.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\fxflfrl.exec:\fxflfrl.exe43⤵
- Executes dropped EXE
PID:4316 -
\??\c:\tbtnhb.exec:\tbtnhb.exe44⤵
- Executes dropped EXE
PID:1540 -
\??\c:\1vpvp.exec:\1vpvp.exe45⤵
- Executes dropped EXE
PID:3204 -
\??\c:\3ppjd.exec:\3ppjd.exe46⤵
- Executes dropped EXE
PID:4812 -
\??\c:\xlfrxxr.exec:\xlfrxxr.exe47⤵
- Executes dropped EXE
PID:4704 -
\??\c:\ttnnbb.exec:\ttnnbb.exe48⤵
- Executes dropped EXE
PID:3236 -
\??\c:\tnhnhb.exec:\tnhnhb.exe49⤵
- Executes dropped EXE
PID:3208 -
\??\c:\1jpjj.exec:\1jpjj.exe50⤵
- Executes dropped EXE
PID:3528 -
\??\c:\7xfrrlx.exec:\7xfrrlx.exe51⤵
- Executes dropped EXE
PID:2080 -
\??\c:\llfxxxr.exec:\llfxxxr.exe52⤵
- Executes dropped EXE
PID:5084 -
\??\c:\hbttnh.exec:\hbttnh.exe53⤵
- Executes dropped EXE
PID:4188 -
\??\c:\jddpj.exec:\jddpj.exe54⤵
- Executes dropped EXE
PID:1916 -
\??\c:\lxxrrlr.exec:\lxxrrlr.exe55⤵
- Executes dropped EXE
PID:3692 -
\??\c:\xxlfxlx.exec:\xxlfxlx.exe56⤵
- Executes dropped EXE
PID:3192 -
\??\c:\nhhnbh.exec:\nhhnbh.exe57⤵
- Executes dropped EXE
PID:4732 -
\??\c:\ddddv.exec:\ddddv.exe58⤵
- Executes dropped EXE
PID:3244 -
\??\c:\jvddv.exec:\jvddv.exe59⤵
- Executes dropped EXE
PID:4472 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe60⤵
- Executes dropped EXE
PID:3308 -
\??\c:\hthttn.exec:\hthttn.exe61⤵
- Executes dropped EXE
PID:436 -
\??\c:\bbnhbb.exec:\bbnhbb.exe62⤵
- Executes dropped EXE
PID:4516 -
\??\c:\jdvpd.exec:\jdvpd.exe63⤵
- Executes dropped EXE
PID:3992 -
\??\c:\dvpjd.exec:\dvpjd.exe64⤵
- Executes dropped EXE
PID:4412 -
\??\c:\flfxffl.exec:\flfxffl.exe65⤵
- Executes dropped EXE
PID:1720 -
\??\c:\thnhnh.exec:\thnhnh.exe66⤵PID:2024
-
\??\c:\ttnhnh.exec:\ttnhnh.exe67⤵PID:1128
-
\??\c:\vjjvp.exec:\vjjvp.exe68⤵PID:4196
-
\??\c:\xlxxfrx.exec:\xlxxfrx.exe69⤵PID:4676
-
\??\c:\7rrrlff.exec:\7rrrlff.exe70⤵PID:4744
-
\??\c:\nnntnt.exec:\nnntnt.exe71⤵PID:1956
-
\??\c:\pdjvv.exec:\pdjvv.exe72⤵PID:1996
-
\??\c:\vjpjv.exec:\vjpjv.exe73⤵PID:4684
-
\??\c:\fxxrllf.exec:\fxxrllf.exe74⤵PID:1492
-
\??\c:\htbhbb.exec:\htbhbb.exe75⤵PID:2736
-
\??\c:\rflrffl.exec:\rflrffl.exe76⤵PID:3956
-
\??\c:\nbnthb.exec:\nbnthb.exe77⤵PID:4712
-
\??\c:\bbhthb.exec:\bbhthb.exe78⤵PID:4828
-
\??\c:\pjdvv.exec:\pjdvv.exe79⤵PID:3496
-
\??\c:\pdjdp.exec:\pdjdp.exe80⤵PID:4596
-
\??\c:\lxfrlll.exec:\lxfrlll.exe81⤵PID:1328
-
\??\c:\htthtn.exec:\htthtn.exe82⤵PID:4436
-
\??\c:\jddvv.exec:\jddvv.exe83⤵PID:4324
-
\??\c:\pdjdv.exec:\pdjdv.exe84⤵PID:2464
-
\??\c:\rxxlxrl.exec:\rxxlxrl.exe85⤵PID:2816
-
\??\c:\frxlxrf.exec:\frxlxrf.exe86⤵PID:3196
-
\??\c:\nthbbb.exec:\nthbbb.exe87⤵PID:2872
-
\??\c:\pppdp.exec:\pppdp.exe88⤵PID:3824
-
\??\c:\dvpdp.exec:\dvpdp.exe89⤵PID:3648
-
\??\c:\5xrlffx.exec:\5xrlffx.exe90⤵PID:3820
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe91⤵PID:4856
-
\??\c:\hnhhbn.exec:\hnhhbn.exe92⤵PID:1584
-
\??\c:\nhhbtt.exec:\nhhbtt.exe93⤵PID:2608
-
\??\c:\dpvjp.exec:\dpvjp.exe94⤵PID:1424
-
\??\c:\3lfxfxl.exec:\3lfxfxl.exe95⤵PID:2060
-
\??\c:\rffrfxr.exec:\rffrfxr.exe96⤵PID:1456
-
\??\c:\thtnbn.exec:\thtnbn.exe97⤵PID:1916
-
\??\c:\ttnbnb.exec:\ttnbnb.exe98⤵PID:2276
-
\??\c:\jvvdj.exec:\jvvdj.exe99⤵PID:1840
-
\??\c:\jdjdp.exec:\jdjdp.exe100⤵PID:5116
-
\??\c:\lxrlxrx.exec:\lxrlxrx.exe101⤵PID:3384
-
\??\c:\lllxxrf.exec:\lllxxrf.exe102⤵PID:4488
-
\??\c:\nhnhtn.exec:\nhnhtn.exe103⤵PID:4860
-
\??\c:\dpvpp.exec:\dpvpp.exe104⤵PID:3568
-
\??\c:\dvdvp.exec:\dvdvp.exe105⤵PID:332
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe106⤵PID:968
-
\??\c:\7lrrrxx.exec:\7lrrrxx.exe107⤵PID:2076
-
\??\c:\nnbthh.exec:\nnbthh.exe108⤵PID:3948
-
\??\c:\tbhhtn.exec:\tbhhtn.exe109⤵PID:4832
-
\??\c:\7vpjv.exec:\7vpjv.exe110⤵PID:2024
-
\??\c:\frfrrll.exec:\frfrrll.exe111⤵PID:3216
-
\??\c:\xlrrllf.exec:\xlrrllf.exe112⤵PID:1004
-
\??\c:\ntbbtn.exec:\ntbbtn.exe113⤵PID:4492
-
\??\c:\pppdp.exec:\pppdp.exe114⤵PID:4508
-
\??\c:\7jvjv.exec:\7jvjv.exe115⤵PID:888
-
\??\c:\fflxfxl.exec:\fflxfxl.exe116⤵PID:4352
-
\??\c:\9rrlxrf.exec:\9rrlxrf.exe117⤵PID:4164
-
\??\c:\5hnhtt.exec:\5hnhtt.exe118⤵PID:1736
-
\??\c:\djjjp.exec:\djjjp.exe119⤵PID:1492
-
\??\c:\7vjvj.exec:\7vjvj.exe120⤵PID:2996
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe121⤵PID:2972
-
\??\c:\fflfffx.exec:\fflfffx.exe122⤵PID:3988
-
\??\c:\9hhbtt.exec:\9hhbtt.exe123⤵PID:5076
-
\??\c:\tbbbtb.exec:\tbbbtb.exe124⤵PID:4980
-
\??\c:\jvvpj.exec:\jvvpj.exe125⤵PID:4424
-
\??\c:\rrxlrrx.exec:\rrxlrrx.exe126⤵PID:1188
-
\??\c:\frrllxx.exec:\frrllxx.exe127⤵PID:912
-
\??\c:\nnnhnn.exec:\nnnhnn.exe128⤵PID:1724
-
\??\c:\bttnhn.exec:\bttnhn.exe129⤵PID:4820
-
\??\c:\vvvjv.exec:\vvvjv.exe130⤵PID:2464
-
\??\c:\9pvdd.exec:\9pvdd.exe131⤵PID:4432
-
\??\c:\frlxlfr.exec:\frlxlfr.exe132⤵PID:908
-
\??\c:\rxrfrfx.exec:\rxrfrfx.exe133⤵PID:4056
-
\??\c:\1nthbt.exec:\1nthbt.exe134⤵PID:3824
-
\??\c:\btttbh.exec:\btttbh.exe135⤵PID:3932
-
\??\c:\vjdjv.exec:\vjdjv.exe136⤵PID:3528
-
\??\c:\lxffxxx.exec:\lxffxxx.exe137⤵PID:4024
-
\??\c:\lflfxxr.exec:\lflfxxr.exe138⤵PID:624
-
\??\c:\thbthh.exec:\thbthh.exe139⤵PID:4320
-
\??\c:\bnbtnn.exec:\bnbtnn.exe140⤵PID:3504
-
\??\c:\1dvjv.exec:\1dvjv.exe141⤵PID:1428
-
\??\c:\5pppj.exec:\5pppj.exe142⤵PID:2060
-
\??\c:\lxlxxxr.exec:\lxlxxxr.exe143⤵PID:4880
-
\??\c:\hhhthb.exec:\hhhthb.exe144⤵PID:1916
-
\??\c:\7bhbht.exec:\7bhbht.exe145⤵PID:3192
-
\??\c:\vjpvp.exec:\vjpvp.exe146⤵PID:2328
-
\??\c:\pppdp.exec:\pppdp.exe147⤵PID:3244
-
\??\c:\7xlxrxr.exec:\7xlxrxr.exe148⤵PID:4172
-
\??\c:\7xfxrlr.exec:\7xfxrlr.exe149⤵PID:976
-
\??\c:\1tnbtn.exec:\1tnbtn.exe150⤵PID:2196
-
\??\c:\tbbnbt.exec:\tbbnbt.exe151⤵PID:1964
-
\??\c:\pdpdd.exec:\pdpdd.exe152⤵PID:4816
-
\??\c:\3xfrlrr.exec:\3xfrlrr.exe153⤵PID:1808
-
\??\c:\lflxlxr.exec:\lflxlxr.exe154⤵PID:1716
-
\??\c:\nhhbbt.exec:\nhhbbt.exe155⤵PID:5000
-
\??\c:\bhnnhh.exec:\bhnnhh.exe156⤵PID:232
-
\??\c:\jdvpv.exec:\jdvpv.exe157⤵PID:2480
-
\??\c:\vvdpd.exec:\vvdpd.exe158⤵PID:5024
-
\??\c:\1rxlxxl.exec:\1rxlxxl.exe159⤵PID:3632
-
\??\c:\hhntnn.exec:\hhntnn.exe160⤵PID:720
-
\??\c:\btthhb.exec:\btthhb.exe161⤵PID:312
-
\??\c:\jppjv.exec:\jppjv.exe162⤵PID:4392
-
\??\c:\djpdv.exec:\djpdv.exe163⤵PID:3164
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe164⤵PID:4280
-
\??\c:\rrrrllf.exec:\rrrrllf.exe165⤵PID:4848
-
\??\c:\3ttnbb.exec:\3ttnbb.exe166⤵PID:2520
-
\??\c:\hbtntn.exec:\hbtntn.exe167⤵PID:1492
-
\??\c:\jppjv.exec:\jppjv.exe168⤵PID:1600
-
\??\c:\rrfxlrr.exec:\rrfxlrr.exe169⤵PID:1948
-
\??\c:\9rlfrlf.exec:\9rlfrlf.exe170⤵PID:1040
-
\??\c:\bnthhb.exec:\bnthhb.exe171⤵PID:4828
-
\??\c:\1nnhtb.exec:\1nnhtb.exe172⤵PID:1636
-
\??\c:\ddddv.exec:\ddddv.exe173⤵PID:1692
-
\??\c:\xrrflfl.exec:\xrrflfl.exe174⤵PID:4436
-
\??\c:\flrrffx.exec:\flrrffx.exe175⤵PID:3592
-
\??\c:\tnnnnt.exec:\tnnnnt.exe176⤵PID:4252
-
\??\c:\btbnbt.exec:\btbnbt.exe177⤵PID:3676
-
\??\c:\vpjdv.exec:\vpjdv.exe178⤵PID:2028
-
\??\c:\rrxlfxl.exec:\rrxlfxl.exe179⤵PID:3196
-
\??\c:\rxffrfx.exec:\rxffrfx.exe180⤵PID:4704
-
\??\c:\thhnbn.exec:\thhnbn.exe181⤵PID:4200
-
\??\c:\bhhnbb.exec:\bhhnbb.exe182⤵PID:2616
-
\??\c:\jpvjj.exec:\jpvjj.exe183⤵PID:2240
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe184⤵PID:4736
-
\??\c:\lfffrrl.exec:\lfffrrl.exe185⤵PID:3152
-
\??\c:\ntthbt.exec:\ntthbt.exe186⤵PID:1424
-
\??\c:\hbbnht.exec:\hbbnht.exe187⤵PID:3504
-
\??\c:\vpppj.exec:\vpppj.exe188⤵PID:2524
-
\??\c:\vpjdv.exec:\vpjdv.exe189⤵PID:2060
-
\??\c:\9frfrlf.exec:\9frfrlf.exe190⤵PID:4880
-
\??\c:\rflfxrx.exec:\rflfxrx.exe191⤵PID:3572
-
\??\c:\nnnnhn.exec:\nnnnhn.exe192⤵PID:4760
-
\??\c:\djvjv.exec:\djvjv.exe193⤵PID:1628
-
\??\c:\vvpdp.exec:\vvpdp.exe194⤵PID:4348
-
\??\c:\rlllxll.exec:\rlllxll.exe195⤵PID:3288
-
\??\c:\lrxlxrf.exec:\lrxlxrf.exe196⤵PID:3896
-
\??\c:\tbhbnh.exec:\tbhbnh.exe197⤵PID:1824
-
\??\c:\nbntnn.exec:\nbntnn.exe198⤵PID:684
-
\??\c:\vppdp.exec:\vppdp.exe199⤵PID:968
-
\??\c:\dvppd.exec:\dvppd.exe200⤵PID:1888
-
\??\c:\xfffxff.exec:\xfffxff.exe201⤵PID:4496
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe202⤵PID:4472
-
\??\c:\hthhbh.exec:\hthhbh.exe203⤵PID:3892
-
\??\c:\pdvdp.exec:\pdvdp.exe204⤵PID:4864
-
\??\c:\3vjjv.exec:\3vjjv.exe205⤵PID:3720
-
\??\c:\rxllllf.exec:\rxllllf.exe206⤵PID:1156
-
\??\c:\xxfxfff.exec:\xxfxfff.exe207⤵PID:1020
-
\??\c:\thhbnh.exec:\thhbnh.exe208⤵PID:1956
-
\??\c:\tnnnnh.exec:\tnnnnh.exe209⤵PID:4392
-
\??\c:\vpvpj.exec:\vpvpj.exe210⤵PID:696
-
\??\c:\ffxxxxf.exec:\ffxxxxf.exe211⤵PID:4280
-
\??\c:\fxxlfxx.exec:\fxxlfxx.exe212⤵PID:3920
-
\??\c:\1hnntt.exec:\1hnntt.exe213⤵PID:2416
-
\??\c:\djjdp.exec:\djjdp.exe214⤵PID:4976
-
\??\c:\3jvpp.exec:\3jvpp.exe215⤵PID:1600
-
\??\c:\1xxllff.exec:\1xxllff.exe216⤵PID:4840
-
\??\c:\xrfxrfx.exec:\xrfxrfx.exe217⤵PID:1656
-
\??\c:\bbhhbb.exec:\bbhhbb.exe218⤵PID:4828
-
\??\c:\hntnhh.exec:\hntnhh.exe219⤵PID:4700
-
\??\c:\jjvpd.exec:\jjvpd.exe220⤵PID:912
-
\??\c:\pvjdv.exec:\pvjdv.exe221⤵PID:4436
-
\??\c:\lfrxlll.exec:\lfrxlll.exe222⤵PID:3592
-
\??\c:\bhnhtn.exec:\bhnhtn.exe223⤵PID:2496
-
\??\c:\btthtn.exec:\btthtn.exe224⤵PID:4520
-
\??\c:\pjpdd.exec:\pjpdd.exe225⤵PID:2312
-
\??\c:\3ddpj.exec:\3ddpj.exe226⤵PID:2340
-
\??\c:\lrxrlff.exec:\lrxrlff.exe227⤵PID:2804
-
\??\c:\rflfxxr.exec:\rflfxxr.exe228⤵PID:2156
-
\??\c:\bhhbtn.exec:\bhhbtn.exe229⤵PID:1652
-
\??\c:\vjdpj.exec:\vjdpj.exe230⤵PID:1584
-
\??\c:\vpddd.exec:\vpddd.exe231⤵PID:5084
-
\??\c:\xfffrxr.exec:\xfffrxr.exe232⤵PID:2352
-
\??\c:\5xfrrfl.exec:\5xfrrfl.exe233⤵PID:2324
-
\??\c:\9nbtnn.exec:\9nbtnn.exe234⤵PID:3208
-
\??\c:\bbhbnn.exec:\bbhbnn.exe235⤵PID:2756
-
\??\c:\djpdp.exec:\djpdp.exe236⤵PID:2260
-
\??\c:\rfxlxxr.exec:\rfxlxxr.exe237⤵PID:1176
-
\??\c:\rrrrllf.exec:\rrrrllf.exe238⤵PID:4732
-
\??\c:\nnbbbh.exec:\nnbbbh.exe239⤵PID:4248
-
\??\c:\bnhtnh.exec:\bnhtnh.exe240⤵PID:4488
-
\??\c:\jpdvp.exec:\jpdvp.exe241⤵PID:2668
-
\??\c:\5lffxrr.exec:\5lffxrr.exe242⤵PID:3308