Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe
-
Size
473KB
-
MD5
dcd0ea1fc7b348236c10843855911480
-
SHA1
6ff86a43807e7e76d9ca4c000041953baa7d9f41
-
SHA256
e366c7765591178dde6e51f8cd648daa49609f67d5eb479b6b0f20feffbdbf8c
-
SHA512
b3d3737018bc267367405f86dc87409fc813d97dfd5e4fdf32777672b61542f9bc580ad856c674d4588ece76a2449020ea6201d5e2fd00acaa95e24360bf9a80
-
SSDEEP
6144:lcm7ImGddXmNt251UriZFwT+aZKl7pg1xBn:H7Tc2NYHUrAwT+OKLSjn
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4216-7-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2116-6-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3456-15-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4216-14-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3456-20-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3972-22-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3972-26-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4624-34-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/428-35-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4972-43-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4972-48-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/428-42-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/960-49-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/960-55-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2736-56-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2736-60-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3020-62-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3020-72-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1472-75-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2316-78-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2316-85-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4968-91-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1460-88-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1472-70-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4968-95-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3676-97-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3676-102-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2140-104-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2140-109-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3744-112-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3744-116-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2748-118-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2748-124-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1040-140-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1356-147-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1568-219-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2008-230-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3396-242-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1408-254-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4740-262-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1116-388-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/5032-424-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1564-435-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1568-431-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2564-420-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3148-416-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4992-410-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/708-406-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1608-402-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/856-400-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/432-396-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1040-390-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4700-384-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3264-380-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2464-374-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4948-371-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2724-359-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2848-350-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/5036-346-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1916-344-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1988-338-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3076-315-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1412-313-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4576-306-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ddjjj.exerxfffll.exerfrlflr.exerxfxllx.exenbhbtn.exevjjjj.exerxxrlfx.exehnhbtt.exerxxfxrf.exepjppj.exerlfffff.exennttth.exelxfxrrl.exexfrrflx.exevjpjj.exedjppv.exebtnbhh.exefflllrr.exejpvdj.exeffxxxxx.exetnnnhh.exedjppp.exedpdvv.exehtnhhb.exenbnbht.exedjvdd.exerflrrxf.exelflllll.exenhhhbb.exe1vpjv.exe3lfffll.exe3xfllll.exetbnnhb.exevjvdd.exejpdvp.exerlllflf.exe5nbtnt.exetttnnn.exe7jjjj.exefllfffx.exebbbbtt.exetnnbbh.exejjppp.exefxfxxlr.exe7bhhht.exeddppp.exefrxxrrr.exeffxrffl.exe3tbthb.exeddjjp.exevdddv.exefxlfrff.exebtnhnt.exe7vddv.exejdpjd.exerrrrlxx.exennnntt.exe3nhhbh.exepjpjj.exefxrlfff.exerrxrrrr.exe5hnnhn.exe1pjdd.exerrxrrrr.exepid process 4216 ddjjj.exe 3456 rxfffll.exe 3972 rfrlflr.exe 4624 rxfxllx.exe 428 nbhbtn.exe 4972 vjjjj.exe 960 rxxrlfx.exe 2736 hnhbtt.exe 3020 rxxfxrf.exe 1472 pjppj.exe 2316 rlfffff.exe 1460 nnttth.exe 4968 lxfxrrl.exe 3676 xfrrflx.exe 2140 vjpjj.exe 3744 djppv.exe 2748 btnbhh.exe 392 fflllrr.exe 4000 jpvdj.exe 1040 ffxxxxx.exe 1356 tnnnhh.exe 4960 djppp.exe 856 dpdvv.exe 1808 htnhhb.exe 4804 nbnbht.exe 4220 djvdd.exe 4992 rflrrxf.exe 3408 lflllll.exe 4488 nhhhbb.exe 636 1vpjv.exe 2032 3lfffll.exe 1568 3xfllll.exe 4072 tbnnhb.exe 2900 vjvdd.exe 2008 jpdvp.exe 3732 rlllflf.exe 2772 5nbtnt.exe 3396 tttnnn.exe 216 7jjjj.exe 220 fllfffx.exe 1408 bbbbtt.exe 2608 tnnbbh.exe 4740 jjppp.exe 4468 fxfxxlr.exe 1256 7bhhht.exe 4784 ddppp.exe 5064 frxxrrr.exe 1200 ffxrffl.exe 3296 3tbthb.exe 4748 ddjjp.exe 4624 vdddv.exe 2232 fxlfrff.exe 1740 btnhnt.exe 4576 7vddv.exe 2892 jdpjd.exe 1412 rrrrlxx.exe 3076 nnnntt.exe 2852 3nhhbh.exe 4920 pjpjj.exe 3120 fxrlfff.exe 3080 rrxrrrr.exe 2316 5hnnhn.exe 1460 1pjdd.exe 4996 rrxrrrr.exe -
Processes:
resource yara_rule behavioral2/memory/4216-7-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2116-6-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3456-15-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4216-14-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3456-20-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3972-26-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4624-29-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4624-34-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/428-35-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4972-43-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4972-48-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/428-42-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/960-49-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/960-55-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2736-56-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2736-60-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3020-72-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1472-75-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2316-78-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1460-82-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2316-85-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4968-91-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1460-88-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1472-70-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4968-95-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3676-102-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2140-109-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3744-116-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2748-124-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1040-140-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1356-147-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1568-219-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2008-230-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3396-242-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1408-254-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4740-262-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1116-388-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/5032-424-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1564-435-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1568-431-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2564-420-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3148-416-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4992-410-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/708-406-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1608-402-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/856-400-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/432-396-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1040-390-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4700-384-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3264-380-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2464-374-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4948-371-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2724-359-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2848-350-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/5036-346-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1916-344-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1988-338-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3076-315-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1412-313-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4576-306-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1740-300-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2232-298-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4624-292-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4748-290-0x0000000000400000-0x00000000004C4000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exeddjjj.exerxfffll.exerfrlflr.exerxfxllx.exenbhbtn.exevjjjj.exerxxrlfx.exehnhbtt.exerxxfxrf.exepjppj.exerlfffff.exennttth.exelxfxrrl.exexfrrflx.exevjpjj.exedjppv.exebtnbhh.exefflllrr.exejpvdj.exeffxxxxx.exetnnnhh.exedescription pid process target process PID 2116 wrote to memory of 4216 2116 dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe ddjjj.exe PID 2116 wrote to memory of 4216 2116 dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe ddjjj.exe PID 2116 wrote to memory of 4216 2116 dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe ddjjj.exe PID 4216 wrote to memory of 3456 4216 ddjjj.exe rxfffll.exe PID 4216 wrote to memory of 3456 4216 ddjjj.exe rxfffll.exe PID 4216 wrote to memory of 3456 4216 ddjjj.exe rxfffll.exe PID 3456 wrote to memory of 3972 3456 rxfffll.exe rfrlflr.exe PID 3456 wrote to memory of 3972 3456 rxfffll.exe rfrlflr.exe PID 3456 wrote to memory of 3972 3456 rxfffll.exe rfrlflr.exe PID 3972 wrote to memory of 4624 3972 rfrlflr.exe rxfxllx.exe PID 3972 wrote to memory of 4624 3972 rfrlflr.exe rxfxllx.exe PID 3972 wrote to memory of 4624 3972 rfrlflr.exe rxfxllx.exe PID 4624 wrote to memory of 428 4624 rxfxllx.exe nbhbtn.exe PID 4624 wrote to memory of 428 4624 rxfxllx.exe nbhbtn.exe PID 4624 wrote to memory of 428 4624 rxfxllx.exe nbhbtn.exe PID 428 wrote to memory of 4972 428 nbhbtn.exe vjjjj.exe PID 428 wrote to memory of 4972 428 nbhbtn.exe vjjjj.exe PID 428 wrote to memory of 4972 428 nbhbtn.exe vjjjj.exe PID 4972 wrote to memory of 960 4972 vjjjj.exe rxxrlfx.exe PID 4972 wrote to memory of 960 4972 vjjjj.exe rxxrlfx.exe PID 4972 wrote to memory of 960 4972 vjjjj.exe rxxrlfx.exe PID 960 wrote to memory of 2736 960 rxxrlfx.exe hnhbtt.exe PID 960 wrote to memory of 2736 960 rxxrlfx.exe hnhbtt.exe PID 960 wrote to memory of 2736 960 rxxrlfx.exe hnhbtt.exe PID 2736 wrote to memory of 3020 2736 hnhbtt.exe rxxfxrf.exe PID 2736 wrote to memory of 3020 2736 hnhbtt.exe rxxfxrf.exe PID 2736 wrote to memory of 3020 2736 hnhbtt.exe rxxfxrf.exe PID 3020 wrote to memory of 1472 3020 rxxfxrf.exe pjppj.exe PID 3020 wrote to memory of 1472 3020 rxxfxrf.exe pjppj.exe PID 3020 wrote to memory of 1472 3020 rxxfxrf.exe pjppj.exe PID 1472 wrote to memory of 2316 1472 pjppj.exe rlfffff.exe PID 1472 wrote to memory of 2316 1472 pjppj.exe rlfffff.exe PID 1472 wrote to memory of 2316 1472 pjppj.exe rlfffff.exe PID 2316 wrote to memory of 1460 2316 rlfffff.exe 1pjdd.exe PID 2316 wrote to memory of 1460 2316 rlfffff.exe 1pjdd.exe PID 2316 wrote to memory of 1460 2316 rlfffff.exe 1pjdd.exe PID 1460 wrote to memory of 4968 1460 nnttth.exe lxfxrrl.exe PID 1460 wrote to memory of 4968 1460 nnttth.exe lxfxrrl.exe PID 1460 wrote to memory of 4968 1460 nnttth.exe lxfxrrl.exe PID 4968 wrote to memory of 3676 4968 lxfxrrl.exe xfrrflx.exe PID 4968 wrote to memory of 3676 4968 lxfxrrl.exe xfrrflx.exe PID 4968 wrote to memory of 3676 4968 lxfxrrl.exe xfrrflx.exe PID 3676 wrote to memory of 2140 3676 xfrrflx.exe htbttt.exe PID 3676 wrote to memory of 2140 3676 xfrrflx.exe htbttt.exe PID 3676 wrote to memory of 2140 3676 xfrrflx.exe htbttt.exe PID 2140 wrote to memory of 3744 2140 vjpjj.exe djppv.exe PID 2140 wrote to memory of 3744 2140 vjpjj.exe djppv.exe PID 2140 wrote to memory of 3744 2140 vjpjj.exe djppv.exe PID 3744 wrote to memory of 2748 3744 djppv.exe btnbhh.exe PID 3744 wrote to memory of 2748 3744 djppv.exe btnbhh.exe PID 3744 wrote to memory of 2748 3744 djppv.exe btnbhh.exe PID 2748 wrote to memory of 392 2748 btnbhh.exe fflllrr.exe PID 2748 wrote to memory of 392 2748 btnbhh.exe fflllrr.exe PID 2748 wrote to memory of 392 2748 btnbhh.exe fflllrr.exe PID 392 wrote to memory of 4000 392 fflllrr.exe jpvdj.exe PID 392 wrote to memory of 4000 392 fflllrr.exe jpvdj.exe PID 392 wrote to memory of 4000 392 fflllrr.exe jpvdj.exe PID 4000 wrote to memory of 1040 4000 jpvdj.exe nbhhbb.exe PID 4000 wrote to memory of 1040 4000 jpvdj.exe nbhhbb.exe PID 4000 wrote to memory of 1040 4000 jpvdj.exe nbhhbb.exe PID 1040 wrote to memory of 1356 1040 ffxxxxx.exe tnnnhh.exe PID 1040 wrote to memory of 1356 1040 ffxxxxx.exe tnnnhh.exe PID 1040 wrote to memory of 1356 1040 ffxxxxx.exe tnnnhh.exe PID 1356 wrote to memory of 4960 1356 tnnnhh.exe djppp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\ddjjj.exec:\ddjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\rxfffll.exec:\rxfffll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\rfrlflr.exec:\rfrlflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\rxfxllx.exec:\rxfxllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\nbhbtn.exec:\nbhbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\vjjjj.exec:\vjjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\hnhbtt.exec:\hnhbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\rxxfxrf.exec:\rxxfxrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\pjppj.exec:\pjppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\rlfffff.exec:\rlfffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\nnttth.exec:\nnttth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\xfrrflx.exec:\xfrrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\vjpjj.exec:\vjpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\djppv.exec:\djppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\btnbhh.exec:\btnbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\fflllrr.exec:\fflllrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\jpvdj.exec:\jpvdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\ffxxxxx.exec:\ffxxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\tnnnhh.exec:\tnnnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\djppp.exec:\djppp.exe23⤵
- Executes dropped EXE
PID:4960 -
\??\c:\dpdvv.exec:\dpdvv.exe24⤵
- Executes dropped EXE
PID:856 -
\??\c:\htnhhb.exec:\htnhhb.exe25⤵
- Executes dropped EXE
PID:1808 -
\??\c:\nbnbht.exec:\nbnbht.exe26⤵
- Executes dropped EXE
PID:4804 -
\??\c:\djvdd.exec:\djvdd.exe27⤵
- Executes dropped EXE
PID:4220 -
\??\c:\rflrrxf.exec:\rflrrxf.exe28⤵
- Executes dropped EXE
PID:4992 -
\??\c:\lflllll.exec:\lflllll.exe29⤵
- Executes dropped EXE
PID:3408 -
\??\c:\nhhhbb.exec:\nhhhbb.exe30⤵
- Executes dropped EXE
PID:4488 -
\??\c:\1vpjv.exec:\1vpjv.exe31⤵
- Executes dropped EXE
PID:636 -
\??\c:\3lfffll.exec:\3lfffll.exe32⤵
- Executes dropped EXE
PID:2032 -
\??\c:\3xfllll.exec:\3xfllll.exe33⤵
- Executes dropped EXE
PID:1568 -
\??\c:\tbnnhb.exec:\tbnnhb.exe34⤵
- Executes dropped EXE
PID:4072 -
\??\c:\vjvdd.exec:\vjvdd.exe35⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jpdvp.exec:\jpdvp.exe36⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rlllflf.exec:\rlllflf.exe37⤵
- Executes dropped EXE
PID:3732 -
\??\c:\5nbtnt.exec:\5nbtnt.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tttnnn.exec:\tttnnn.exe39⤵
- Executes dropped EXE
PID:3396 -
\??\c:\7jjjj.exec:\7jjjj.exe40⤵
- Executes dropped EXE
PID:216 -
\??\c:\fllfffx.exec:\fllfffx.exe41⤵
- Executes dropped EXE
PID:220 -
\??\c:\bbbbtt.exec:\bbbbtt.exe42⤵
- Executes dropped EXE
PID:1408 -
\??\c:\tnnbbh.exec:\tnnbbh.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jjppp.exec:\jjppp.exe44⤵
- Executes dropped EXE
PID:4740 -
\??\c:\5xxxrrr.exec:\5xxxrrr.exe45⤵PID:2972
-
\??\c:\fxfxxlr.exec:\fxfxxlr.exe46⤵
- Executes dropped EXE
PID:4468 -
\??\c:\7bhhht.exec:\7bhhht.exe47⤵
- Executes dropped EXE
PID:1256 -
\??\c:\ddppp.exec:\ddppp.exe48⤵
- Executes dropped EXE
PID:4784 -
\??\c:\frxxrrr.exec:\frxxrrr.exe49⤵
- Executes dropped EXE
PID:5064 -
\??\c:\ffxrffl.exec:\ffxrffl.exe50⤵
- Executes dropped EXE
PID:1200 -
\??\c:\3tbthb.exec:\3tbthb.exe51⤵
- Executes dropped EXE
PID:3296 -
\??\c:\ddjjp.exec:\ddjjp.exe52⤵
- Executes dropped EXE
PID:4748 -
\??\c:\vdddv.exec:\vdddv.exe53⤵
- Executes dropped EXE
PID:4624 -
\??\c:\fxlfrff.exec:\fxlfrff.exe54⤵
- Executes dropped EXE
PID:2232 -
\??\c:\btnhnt.exec:\btnhnt.exe55⤵
- Executes dropped EXE
PID:1740 -
\??\c:\7vddv.exec:\7vddv.exe56⤵
- Executes dropped EXE
PID:4576 -
\??\c:\jdpjd.exec:\jdpjd.exe57⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rrrrlxx.exec:\rrrrlxx.exe58⤵
- Executes dropped EXE
PID:1412 -
\??\c:\nnnntt.exec:\nnnntt.exe59⤵
- Executes dropped EXE
PID:3076 -
\??\c:\3nhhbh.exec:\3nhhbh.exe60⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pjpjj.exec:\pjpjj.exe61⤵
- Executes dropped EXE
PID:4920 -
\??\c:\fxrlfff.exec:\fxrlfff.exe62⤵
- Executes dropped EXE
PID:3120 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe63⤵
- Executes dropped EXE
PID:3080 -
\??\c:\5hnnhn.exec:\5hnnhn.exe64⤵
- Executes dropped EXE
PID:2316 -
\??\c:\1pjdd.exec:\1pjdd.exe65⤵
- Executes dropped EXE
PID:1460 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe66⤵
- Executes dropped EXE
PID:4996 -
\??\c:\xfxxxfx.exec:\xfxxxfx.exe67⤵PID:1988
-
\??\c:\htbttt.exec:\htbttt.exe68⤵PID:1916
-
\??\c:\3djdd.exec:\3djdd.exe69⤵PID:5036
-
\??\c:\pvvdp.exec:\pvvdp.exe70⤵PID:2848
-
\??\c:\xrffllf.exec:\xrffllf.exe71⤵PID:1016
-
\??\c:\btttnn.exec:\btttnn.exe72⤵PID:2724
-
\??\c:\htbttt.exec:\htbttt.exe73⤵PID:2140
-
\??\c:\djppv.exec:\djppv.exe74⤵PID:1064
-
\??\c:\xfrllll.exec:\xfrllll.exe75⤵PID:4792
-
\??\c:\7lrlllf.exec:\7lrlllf.exe76⤵PID:4948
-
\??\c:\bbhbbn.exec:\bbhbbn.exe77⤵PID:2464
-
\??\c:\ddjjj.exec:\ddjjj.exe78⤵PID:3264
-
\??\c:\lfxrrll.exec:\lfxrrll.exe79⤵PID:4700
-
\??\c:\rlxxxlf.exec:\rlxxxlf.exe80⤵PID:1116
-
\??\c:\nbhhbb.exec:\nbhhbb.exe81⤵PID:1040
-
\??\c:\vvvpp.exec:\vvvpp.exe82⤵PID:432
-
\??\c:\1jjdv.exec:\1jjdv.exe83⤵PID:856
-
\??\c:\fxrllrf.exec:\fxrllrf.exe84⤵PID:1608
-
\??\c:\tbnhhh.exec:\tbnhhh.exe85⤵PID:708
-
\??\c:\nbnbbn.exec:\nbnbbn.exe86⤵PID:4992
-
\??\c:\pvjjd.exec:\pvjjd.exe87⤵PID:3148
-
\??\c:\rrrxlll.exec:\rrrxlll.exe88⤵PID:2564
-
\??\c:\bbtnnn.exec:\bbtnnn.exe89⤵PID:5032
-
\??\c:\htnhbh.exec:\htnhbh.exe90⤵PID:4124
-
\??\c:\vdjjj.exec:\vdjjj.exe91⤵PID:1568
-
\??\c:\ffrrrrl.exec:\ffrrrrl.exe92⤵PID:1564
-
\??\c:\lxrllll.exec:\lxrllll.exe93⤵PID:1252
-
\??\c:\thbbbb.exec:\thbbbb.exe94⤵PID:2060
-
\??\c:\7pvvd.exec:\7pvvd.exe95⤵PID:4588
-
\??\c:\lfllfll.exec:\lfllfll.exe96⤵PID:4328
-
\??\c:\9lllfll.exec:\9lllfll.exe97⤵PID:2752
-
\??\c:\bbbttn.exec:\bbbttn.exe98⤵PID:2196
-
\??\c:\pvvpj.exec:\pvvpj.exe99⤵PID:2936
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe100⤵PID:2844
-
\??\c:\3rllllx.exec:\3rllllx.exe101⤵PID:4380
-
\??\c:\1hbttt.exec:\1hbttt.exe102⤵PID:4740
-
\??\c:\jjjjj.exec:\jjjjj.exe103⤵PID:4076
-
\??\c:\vpddv.exec:\vpddv.exe104⤵PID:4468
-
\??\c:\lxflllr.exec:\lxflllr.exe105⤵PID:3008
-
\??\c:\nhnnhn.exec:\nhnnhn.exe106⤵PID:4448
-
\??\c:\vvvvp.exec:\vvvvp.exe107⤵PID:4724
-
\??\c:\flrrrxr.exec:\flrrrxr.exe108⤵PID:1636
-
\??\c:\thnnnt.exec:\thnnnt.exe109⤵PID:640
-
\??\c:\tnbbhn.exec:\tnbbhn.exe110⤵PID:4624
-
\??\c:\pjjjj.exec:\pjjjj.exe111⤵PID:4332
-
\??\c:\5ffxxxx.exec:\5ffxxxx.exe112⤵PID:3500
-
\??\c:\xrrllrr.exec:\xrrllrr.exe113⤵PID:4484
-
\??\c:\bttttb.exec:\bttttb.exe114⤵PID:3968
-
\??\c:\jdjpp.exec:\jdjpp.exe115⤵PID:1848
-
\??\c:\xflllrr.exec:\xflllrr.exe116⤵PID:1272
-
\??\c:\xfrlxxl.exec:\xfrlxxl.exe117⤵PID:4920
-
\??\c:\tnhhnt.exec:\tnhhnt.exe118⤵PID:4664
-
\??\c:\ddjjd.exec:\ddjjd.exe119⤵PID:4004
-
\??\c:\pjvvp.exec:\pjvvp.exe120⤵PID:4816
-
\??\c:\flllllr.exec:\flllllr.exe121⤵PID:3532
-
\??\c:\tbnhnt.exec:\tbnhnt.exe122⤵PID:444
-
\??\c:\ntbbhh.exec:\ntbbhh.exe123⤵PID:4996
-
\??\c:\9vddv.exec:\9vddv.exe124⤵PID:3116
-
\??\c:\ddddj.exec:\ddddj.exe125⤵PID:2848
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe126⤵PID:1396
-
\??\c:\5ffffff.exec:\5ffffff.exe127⤵PID:4912
-
\??\c:\1tbtth.exec:\1tbtth.exe128⤵PID:2680
-
\??\c:\ppdvp.exec:\ppdvp.exe129⤵PID:1452
-
\??\c:\llrlxff.exec:\llrlxff.exe130⤵PID:868
-
\??\c:\nnnttt.exec:\nnnttt.exe131⤵PID:4252
-
\??\c:\hhttnn.exec:\hhttnn.exe132⤵PID:1592
-
\??\c:\xrrlrxl.exec:\xrrlrxl.exe133⤵PID:4892
-
\??\c:\rrrrlll.exec:\rrrrlll.exe134⤵PID:2956
-
\??\c:\9bbbbb.exec:\9bbbbb.exe135⤵PID:5020
-
\??\c:\pdjjj.exec:\pdjjj.exe136⤵PID:708
-
\??\c:\xxlrffr.exec:\xxlrffr.exe137⤵PID:4056
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe138⤵PID:3148
-
\??\c:\1nntth.exec:\1nntth.exe139⤵PID:2180
-
\??\c:\dpvpj.exec:\dpvpj.exe140⤵PID:2516
-
\??\c:\fllfxxx.exec:\fllfxxx.exe141⤵PID:4072
-
\??\c:\1hhbbb.exec:\1hhbbb.exe142⤵PID:4016
-
\??\c:\tthhtt.exec:\tthhtt.exe143⤵PID:4668
-
\??\c:\ppddd.exec:\ppddd.exe144⤵PID:3776
-
\??\c:\9llllrr.exec:\9llllrr.exe145⤵PID:220
-
\??\c:\hbthnt.exec:\hbthnt.exe146⤵PID:4304
-
\??\c:\vpddv.exec:\vpddv.exe147⤵PID:4444
-
\??\c:\7jpvv.exec:\7jpvv.exe148⤵PID:608
-
\??\c:\tbnnnt.exec:\tbnnnt.exe149⤵PID:4260
-
\??\c:\jpvvd.exec:\jpvvd.exe150⤵PID:4836
-
\??\c:\jdppj.exec:\jdppj.exe151⤵PID:4744
-
\??\c:\llllllr.exec:\llllllr.exe152⤵PID:3008
-
\??\c:\nnnnnb.exec:\nnnnnb.exe153⤵PID:3456
-
\??\c:\ddjjj.exec:\ddjjj.exe154⤵PID:3296
-
\??\c:\3djjj.exec:\3djjj.exe155⤵PID:332
-
\??\c:\ffrrlll.exec:\ffrrlll.exe156⤵PID:3004
-
\??\c:\bnthhn.exec:\bnthhn.exe157⤵PID:1740
-
\??\c:\7pddj.exec:\7pddj.exe158⤵PID:4044
-
\??\c:\pjvdd.exec:\pjvdd.exe159⤵PID:4776
-
\??\c:\lxrrlfl.exec:\lxrrlfl.exe160⤵PID:2204
-
\??\c:\hnbbbh.exec:\hnbbbh.exe161⤵PID:1848
-
\??\c:\1tbbbb.exec:\1tbbbb.exe162⤵PID:1680
-
\??\c:\9jjdd.exec:\9jjdd.exe163⤵PID:4532
-
\??\c:\rflfxfx.exec:\rflfxfx.exe164⤵PID:4348
-
\??\c:\5nnnnt.exec:\5nnnnt.exe165⤵PID:4160
-
\??\c:\tthhbh.exec:\tthhbh.exe166⤵PID:2316
-
\??\c:\vvppp.exec:\vvppp.exe167⤵PID:3868
-
\??\c:\rrxrflr.exec:\rrxrflr.exe168⤵PID:1360
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe169⤵PID:2900
-
\??\c:\9hnnnt.exec:\9hnnnt.exe170⤵PID:3708
-
\??\c:\pvvvv.exec:\pvvvv.exe171⤵PID:3196
-
\??\c:\ppjjj.exec:\ppjjj.exe172⤵PID:4924
-
\??\c:\1xffffl.exec:\1xffffl.exe173⤵PID:4692
-
\??\c:\hbhhhh.exec:\hbhhhh.exe174⤵PID:1064
-
\??\c:\ppvpp.exec:\ppvpp.exe175⤵PID:4232
-
\??\c:\lxlflxx.exec:\lxlflxx.exe176⤵PID:4792
-
\??\c:\3ffxrxr.exec:\3ffxrxr.exe177⤵PID:3420
-
\??\c:\htbbnn.exec:\htbbnn.exe178⤵PID:1532
-
\??\c:\7vddv.exec:\7vddv.exe179⤵PID:2704
-
\??\c:\9vddd.exec:\9vddd.exe180⤵PID:1592
-
\??\c:\lrlllrl.exec:\lrlllrl.exe181⤵PID:2064
-
\??\c:\nhtnhn.exec:\nhtnhn.exe182⤵PID:1280
-
\??\c:\xflrrxx.exec:\xflrrxx.exe183⤵PID:4736
-
\??\c:\bthbbb.exec:\bthbbb.exe184⤵PID:4156
-
\??\c:\dvjjd.exec:\dvjjd.exe185⤵PID:2304
-
\??\c:\pjpjd.exec:\pjpjd.exe186⤵PID:4032
-
\??\c:\tbtnnt.exec:\tbtnnt.exe187⤵PID:3476
-
\??\c:\nnnnnn.exec:\nnnnnn.exe188⤵PID:2200
-
\??\c:\llrllrr.exec:\llrllrr.exe189⤵PID:1744
-
\??\c:\xrxxxff.exec:\xrxxxff.exe190⤵PID:1240
-
\??\c:\7hhtnh.exec:\7hhtnh.exe191⤵PID:3104
-
\??\c:\vpddv.exec:\vpddv.exe192⤵PID:2196
-
\??\c:\1lxxrxr.exec:\1lxxrxr.exe193⤵PID:4592
-
\??\c:\1btnhh.exec:\1btnhh.exe194⤵PID:1408
-
\??\c:\pjvpj.exec:\pjvpj.exe195⤵PID:2844
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe196⤵PID:4444
-
\??\c:\tnbbbb.exec:\tnbbbb.exe197⤵PID:608
-
\??\c:\hhhbnt.exec:\hhhbnt.exe198⤵PID:4260
-
\??\c:\3dddd.exec:\3dddd.exe199⤵PID:3436
-
\??\c:\bbnnbb.exec:\bbnnbb.exe200⤵PID:2744
-
\??\c:\1bhbbb.exec:\1bhbbb.exe201⤵PID:1256
-
\??\c:\pdjjj.exec:\pdjjj.exe202⤵PID:5064
-
\??\c:\flrrlxx.exec:\flrrlxx.exe203⤵PID:4620
-
\??\c:\ttthhn.exec:\ttthhn.exe204⤵PID:3856
-
\??\c:\pvjvv.exec:\pvjvv.exe205⤵PID:4708
-
\??\c:\vvvdv.exec:\vvvdv.exe206⤵PID:4576
-
\??\c:\xflxxff.exec:\xflxxff.exe207⤵PID:2356
-
\??\c:\bbntbb.exec:\bbntbb.exe208⤵PID:3448
-
\??\c:\vpvpp.exec:\vpvpp.exe209⤵PID:2476
-
\??\c:\vdjjv.exec:\vdjjv.exe210⤵PID:4372
-
\??\c:\llrfxxx.exec:\llrfxxx.exe211⤵PID:4788
-
\??\c:\hthbbn.exec:\hthbbn.exe212⤵PID:4268
-
\??\c:\jdpjd.exec:\jdpjd.exe213⤵PID:2616
-
\??\c:\9pvpp.exec:\9pvpp.exe214⤵PID:1876
-
\??\c:\rrrrfxf.exec:\rrrrfxf.exe215⤵PID:4828
-
\??\c:\thnnhn.exec:\thnnhn.exe216⤵PID:5004
-
\??\c:\dpjjd.exec:\dpjjd.exe217⤵PID:2996
-
\??\c:\vjvvv.exec:\vjvvv.exe218⤵PID:1900
-
\??\c:\llxfllx.exec:\llxfllx.exe219⤵PID:3744
-
\??\c:\hbthhn.exec:\hbthhn.exe220⤵PID:1776
-
\??\c:\9tbtnt.exec:\9tbtnt.exe221⤵PID:2968
-
\??\c:\pdppj.exec:\pdppj.exe222⤵PID:3420
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe223⤵PID:1040
-
\??\c:\lxrflxl.exec:\lxrflxl.exe224⤵PID:4892
-
\??\c:\htbbtb.exec:\htbbtb.exe225⤵PID:1356
-
\??\c:\jdjjj.exec:\jdjjj.exe226⤵PID:844
-
\??\c:\rxrrrxf.exec:\rxrrrxf.exe227⤵PID:3828
-
\??\c:\nhtttb.exec:\nhtttb.exe228⤵PID:2564
-
\??\c:\tttnht.exec:\tttnht.exe229⤵PID:1580
-
\??\c:\dpddp.exec:\dpddp.exe230⤵PID:2336
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe231⤵PID:5060
-
\??\c:\nbhhhh.exec:\nbhhhh.exe232⤵PID:4072
-
\??\c:\bnhhbb.exec:\bnhhbb.exe233⤵PID:3432
-
\??\c:\1rxfxff.exec:\1rxfxff.exe234⤵PID:4456
-
\??\c:\thntbh.exec:\thntbh.exe235⤵PID:680
-
\??\c:\jpddp.exec:\jpddp.exe236⤵PID:2876
-
\??\c:\rxfxxrl.exec:\rxfxxrl.exe237⤵PID:4604
-
\??\c:\htbttb.exec:\htbttb.exe238⤵PID:216
-
\??\c:\pdpjd.exec:\pdpjd.exe239⤵PID:2084
-
\??\c:\pdvvp.exec:\pdvvp.exe240⤵PID:1004
-
\??\c:\3xffxxx.exec:\3xffxxx.exe241⤵PID:4724
-
\??\c:\7tbtnb.exec:\7tbtnb.exe242⤵PID:3436