Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 03:51
Behavioral task
behavioral1
Sample
a4f5360a0b6d03f1d37663a48a2c5050_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a4f5360a0b6d03f1d37663a48a2c5050_NeikiAnalytics.exe
-
Size
327KB
-
MD5
a4f5360a0b6d03f1d37663a48a2c5050
-
SHA1
7f2f7546fa559b3c2b45fff3febf3055d4768058
-
SHA256
ee53314f21144865f362128ec1f658e793a5c05849a18aa7dcb22ee747f9572a
-
SHA512
f44b6de68f7592b8d61b5ff47a9163180e0b71f6e354f23d49cf1015bedcae01b266f0d9c23837f462fe04792aa196ce6010c745073e5ddd81b31fb21c1e1cd3
-
SSDEEP
6144:9cm4FmowdHoS4BftapTs8Hoo+6MjTVhRD3:/4wFHoS4d0G8HoljTVhRD3
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4444-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2668-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/588-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-572-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/820-634-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-767-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjjdv.exefxffrrf.exevjvvp.exerlfrlxr.exettnhnt.exenbtnhh.exepjpvj.exelxrfxfl.exebhthhb.exejjddj.exefxxrrrl.exejdppv.exejvvvj.exerlfxrrf.exellrlffx.exejjpdj.exerxrlxxr.exevvjdp.exexxxrlfr.exe5djdd.exexflllrl.exerflllff.exetnnnhn.exefflfxxx.exennhbtt.exe5rfxxfr.exethhbnb.exepdddj.exethnnbb.exelfrrfff.exefxlxlrl.exexrfllxx.exehnnbbt.exe7jjjv.exerfrrlrl.exellrxxrl.exevjvdd.exexrfrrfl.exefffxxrl.exebtbtnn.exe3dpdp.exe5rxxxff.exehhnbbb.exejdddv.exe7ffxlrl.exehtbthn.exedjvvd.exerxlrflx.exethtbbt.exepdddd.exefllrrrl.exenbbbbb.exevpddd.exexlxrrrr.exeffxrllf.exeppjpp.exerfffxfx.exerrxxxxx.exebbhhhn.exejvdvv.exefflllrl.exenhhbbb.exenbhbbb.exejvvpp.exepid process 4444 jjjdv.exe 4196 fxffrrf.exe 3780 vjvvp.exe 3292 rlfrlxr.exe 4360 ttnhnt.exe 3032 nbtnhh.exe 512 pjpvj.exe 2920 lxrfxfl.exe 2720 bhthhb.exe 3496 jjddj.exe 3752 fxxrrrl.exe 1548 jdppv.exe 2244 jvvvj.exe 1132 rlfxrrf.exe 4896 llrlffx.exe 4276 jjpdj.exe 4204 rxrlxxr.exe 3632 vvjdp.exe 1532 xxxrlfr.exe 4476 5djdd.exe 2912 xflllrl.exe 4932 rflllff.exe 4416 tnnnhn.exe 2332 fflfxxx.exe 392 nnhbtt.exe 1308 5rfxxfr.exe 4076 thhbnb.exe 4252 pdddj.exe 3708 thnnbb.exe 4080 lfrrfff.exe 2800 fxlxlrl.exe 4344 xrfllxx.exe 464 hnnbbt.exe 5088 7jjjv.exe 3412 rfrrlrl.exe 2844 llrxxrl.exe 4536 vjvdd.exe 3824 xrfrrfl.exe 4324 fffxxrl.exe 4332 btbtnn.exe 4812 3dpdp.exe 2440 5rxxxff.exe 4956 hhnbbb.exe 3780 jdddv.exe 336 7ffxlrl.exe 3460 htbthn.exe 4232 djvvd.exe 4872 rxlrflx.exe 1736 thtbbt.exe 2920 pdddd.exe 3256 fllrrrl.exe 4028 nbbbbb.exe 5000 vpddd.exe 3868 xlxrrrr.exe 1524 ffxrllf.exe 3304 ppjpp.exe 4136 rfffxfx.exe 4464 rrxxxxx.exe 4356 bbhhhn.exe 4276 jvdvv.exe 2616 fflllrl.exe 676 nhhbbb.exe 2668 nbhbbb.exe 1844 jvvpp.exe -
Processes:
resource yara_rule behavioral2/memory/3208-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjdv.exe upx behavioral2/memory/4444-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3208-7-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxffrrf.exe upx behavioral2/memory/4196-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjvvp.exe upx behavioral2/memory/4196-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlfrlxr.exe upx behavioral2/memory/3292-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3780-21-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttnhnt.exe upx C:\nbtnhh.exe upx behavioral2/memory/4360-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjpvj.exe upx behavioral2/memory/512-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxrfxfl.exe upx behavioral2/memory/512-49-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhthhb.exe upx behavioral2/memory/2920-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjddj.exe upx behavioral2/memory/2720-57-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxxrrrl.exe upx C:\jdppv.exe upx behavioral2/memory/1548-74-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jvvvj.exe upx behavioral2/memory/2244-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlfxrrf.exe upx behavioral2/memory/1132-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3752-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llrlffx.exe upx behavioral2/memory/1132-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjpdj.exe upx behavioral2/memory/4896-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4276-97-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxrlxxr.exe upx C:\vvjdp.exe upx behavioral2/memory/4204-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxrlfr.exe upx behavioral2/memory/3632-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1532-115-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5djdd.exe upx behavioral2/memory/1532-119-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xflllrl.exe upx C:\rflllff.exe upx C:\tnnnhn.exe upx \??\c:\fflfxxx.exe upx behavioral2/memory/2332-142-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnhbtt.exe upx C:\5rfxxfr.exe upx C:\thhbnb.exe upx \??\c:\pdddj.exe upx behavioral2/memory/4076-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4252-167-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thnnbb.exe upx C:\lfrrfff.exe upx C:\fxlxlrl.exe upx C:\xrfllxx.exe upx behavioral2/memory/2800-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/464-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4344-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5088-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2844-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4332-213-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a4f5360a0b6d03f1d37663a48a2c5050_NeikiAnalytics.exejjjdv.exefxffrrf.exevjvvp.exerlfrlxr.exettnhnt.exenbtnhh.exepjpvj.exelxrfxfl.exebhthhb.exejjddj.exefxxrrrl.exejdppv.exejvvvj.exerlfxrrf.exellrlffx.exejjpdj.exerxrlxxr.exevvjdp.exexxxrlfr.exe5djdd.exexflllrl.exedescription pid process target process PID 3208 wrote to memory of 4444 3208 a4f5360a0b6d03f1d37663a48a2c5050_NeikiAnalytics.exe jjjdv.exe PID 3208 wrote to memory of 4444 3208 a4f5360a0b6d03f1d37663a48a2c5050_NeikiAnalytics.exe jjjdv.exe PID 3208 wrote to memory of 4444 3208 a4f5360a0b6d03f1d37663a48a2c5050_NeikiAnalytics.exe jjjdv.exe PID 4444 wrote to memory of 4196 4444 jjjdv.exe fxffrrf.exe PID 4444 wrote to memory of 4196 4444 jjjdv.exe fxffrrf.exe PID 4444 wrote to memory of 4196 4444 jjjdv.exe fxffrrf.exe PID 4196 wrote to memory of 3780 4196 fxffrrf.exe vjvvp.exe PID 4196 wrote to memory of 3780 4196 fxffrrf.exe vjvvp.exe PID 4196 wrote to memory of 3780 4196 fxffrrf.exe vjvvp.exe PID 3780 wrote to memory of 3292 3780 vjvvp.exe rlfrlxr.exe PID 3780 wrote to memory of 3292 3780 vjvvp.exe rlfrlxr.exe PID 3780 wrote to memory of 3292 3780 vjvvp.exe rlfrlxr.exe PID 3292 wrote to memory of 4360 3292 rlfrlxr.exe ttnhnt.exe PID 3292 wrote to memory of 4360 3292 rlfrlxr.exe ttnhnt.exe PID 3292 wrote to memory of 4360 3292 rlfrlxr.exe ttnhnt.exe PID 4360 wrote to memory of 3032 4360 ttnhnt.exe nbtnhh.exe PID 4360 wrote to memory of 3032 4360 ttnhnt.exe nbtnhh.exe PID 4360 wrote to memory of 3032 4360 ttnhnt.exe nbtnhh.exe PID 3032 wrote to memory of 512 3032 nbtnhh.exe pjpvj.exe PID 3032 wrote to memory of 512 3032 nbtnhh.exe pjpvj.exe PID 3032 wrote to memory of 512 3032 nbtnhh.exe pjpvj.exe PID 512 wrote to memory of 2920 512 pjpvj.exe lxrfxfl.exe PID 512 wrote to memory of 2920 512 pjpvj.exe lxrfxfl.exe PID 512 wrote to memory of 2920 512 pjpvj.exe lxrfxfl.exe PID 2920 wrote to memory of 2720 2920 lxrfxfl.exe bhthhb.exe PID 2920 wrote to memory of 2720 2920 lxrfxfl.exe bhthhb.exe PID 2920 wrote to memory of 2720 2920 lxrfxfl.exe bhthhb.exe PID 2720 wrote to memory of 3496 2720 bhthhb.exe jjddj.exe PID 2720 wrote to memory of 3496 2720 bhthhb.exe jjddj.exe PID 2720 wrote to memory of 3496 2720 bhthhb.exe jjddj.exe PID 3496 wrote to memory of 3752 3496 jjddj.exe fxxrrrl.exe PID 3496 wrote to memory of 3752 3496 jjddj.exe fxxrrrl.exe PID 3496 wrote to memory of 3752 3496 jjddj.exe fxxrrrl.exe PID 3752 wrote to memory of 1548 3752 fxxrrrl.exe jdppv.exe PID 3752 wrote to memory of 1548 3752 fxxrrrl.exe jdppv.exe PID 3752 wrote to memory of 1548 3752 fxxrrrl.exe jdppv.exe PID 1548 wrote to memory of 2244 1548 jdppv.exe jvvvj.exe PID 1548 wrote to memory of 2244 1548 jdppv.exe jvvvj.exe PID 1548 wrote to memory of 2244 1548 jdppv.exe jvvvj.exe PID 2244 wrote to memory of 1132 2244 jvvvj.exe rlfxrrf.exe PID 2244 wrote to memory of 1132 2244 jvvvj.exe rlfxrrf.exe PID 2244 wrote to memory of 1132 2244 jvvvj.exe rlfxrrf.exe PID 1132 wrote to memory of 4896 1132 rlfxrrf.exe llrlffx.exe PID 1132 wrote to memory of 4896 1132 rlfxrrf.exe llrlffx.exe PID 1132 wrote to memory of 4896 1132 rlfxrrf.exe llrlffx.exe PID 4896 wrote to memory of 4276 4896 llrlffx.exe jjpdj.exe PID 4896 wrote to memory of 4276 4896 llrlffx.exe jjpdj.exe PID 4896 wrote to memory of 4276 4896 llrlffx.exe jjpdj.exe PID 4276 wrote to memory of 4204 4276 jjpdj.exe rxrlxxr.exe PID 4276 wrote to memory of 4204 4276 jjpdj.exe rxrlxxr.exe PID 4276 wrote to memory of 4204 4276 jjpdj.exe rxrlxxr.exe PID 4204 wrote to memory of 3632 4204 rxrlxxr.exe vvjdp.exe PID 4204 wrote to memory of 3632 4204 rxrlxxr.exe vvjdp.exe PID 4204 wrote to memory of 3632 4204 rxrlxxr.exe vvjdp.exe PID 3632 wrote to memory of 1532 3632 vvjdp.exe xxxrlfr.exe PID 3632 wrote to memory of 1532 3632 vvjdp.exe xxxrlfr.exe PID 3632 wrote to memory of 1532 3632 vvjdp.exe xxxrlfr.exe PID 1532 wrote to memory of 4476 1532 xxxrlfr.exe 5djdd.exe PID 1532 wrote to memory of 4476 1532 xxxrlfr.exe 5djdd.exe PID 1532 wrote to memory of 4476 1532 xxxrlfr.exe 5djdd.exe PID 4476 wrote to memory of 2912 4476 5djdd.exe xflllrl.exe PID 4476 wrote to memory of 2912 4476 5djdd.exe xflllrl.exe PID 4476 wrote to memory of 2912 4476 5djdd.exe xflllrl.exe PID 2912 wrote to memory of 4932 2912 xflllrl.exe rflllff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4f5360a0b6d03f1d37663a48a2c5050_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a4f5360a0b6d03f1d37663a48a2c5050_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\jjjdv.exec:\jjjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\fxffrrf.exec:\fxffrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\vjvvp.exec:\vjvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\rlfrlxr.exec:\rlfrlxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\ttnhnt.exec:\ttnhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\nbtnhh.exec:\nbtnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\pjpvj.exec:\pjpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\lxrfxfl.exec:\lxrfxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\bhthhb.exec:\bhthhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jjddj.exec:\jjddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\jdppv.exec:\jdppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\jvvvj.exec:\jvvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\rlfxrrf.exec:\rlfxrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\llrlffx.exec:\llrlffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\jjpdj.exec:\jjpdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\rxrlxxr.exec:\rxrlxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\vvjdp.exec:\vvjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\xxxrlfr.exec:\xxxrlfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\5djdd.exec:\5djdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\xflllrl.exec:\xflllrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rflllff.exec:\rflllff.exe23⤵
- Executes dropped EXE
PID:4932 -
\??\c:\tnnnhn.exec:\tnnnhn.exe24⤵
- Executes dropped EXE
PID:4416 -
\??\c:\fflfxxx.exec:\fflfxxx.exe25⤵
- Executes dropped EXE
PID:2332 -
\??\c:\nnhbtt.exec:\nnhbtt.exe26⤵
- Executes dropped EXE
PID:392 -
\??\c:\5rfxxfr.exec:\5rfxxfr.exe27⤵
- Executes dropped EXE
PID:1308 -
\??\c:\thhbnb.exec:\thhbnb.exe28⤵
- Executes dropped EXE
PID:4076 -
\??\c:\pdddj.exec:\pdddj.exe29⤵
- Executes dropped EXE
PID:4252 -
\??\c:\thnnbb.exec:\thnnbb.exe30⤵
- Executes dropped EXE
PID:3708 -
\??\c:\lfrrfff.exec:\lfrrfff.exe31⤵
- Executes dropped EXE
PID:4080 -
\??\c:\fxlxlrl.exec:\fxlxlrl.exe32⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xrfllxx.exec:\xrfllxx.exe33⤵
- Executes dropped EXE
PID:4344 -
\??\c:\hnnbbt.exec:\hnnbbt.exe34⤵
- Executes dropped EXE
PID:464 -
\??\c:\7jjjv.exec:\7jjjv.exe35⤵
- Executes dropped EXE
PID:5088 -
\??\c:\rfrrlrl.exec:\rfrrlrl.exe36⤵
- Executes dropped EXE
PID:3412 -
\??\c:\llrxxrl.exec:\llrxxrl.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vjvdd.exec:\vjvdd.exe38⤵
- Executes dropped EXE
PID:4536 -
\??\c:\xrfrrfl.exec:\xrfrrfl.exe39⤵
- Executes dropped EXE
PID:3824 -
\??\c:\fffxxrl.exec:\fffxxrl.exe40⤵
- Executes dropped EXE
PID:4324 -
\??\c:\btbtnn.exec:\btbtnn.exe41⤵
- Executes dropped EXE
PID:4332 -
\??\c:\3dpdp.exec:\3dpdp.exe42⤵
- Executes dropped EXE
PID:4812 -
\??\c:\5rxxxff.exec:\5rxxxff.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hhnbbb.exec:\hhnbbb.exe44⤵
- Executes dropped EXE
PID:4956 -
\??\c:\jdddv.exec:\jdddv.exe45⤵
- Executes dropped EXE
PID:3780 -
\??\c:\7ffxlrl.exec:\7ffxlrl.exe46⤵
- Executes dropped EXE
PID:336 -
\??\c:\htbthn.exec:\htbthn.exe47⤵
- Executes dropped EXE
PID:3460 -
\??\c:\djvvd.exec:\djvvd.exe48⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rxlrflx.exec:\rxlrflx.exe49⤵
- Executes dropped EXE
PID:4872 -
\??\c:\thtbbt.exec:\thtbbt.exe50⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pdddd.exec:\pdddd.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\fllrrrl.exec:\fllrrrl.exe52⤵
- Executes dropped EXE
PID:3256 -
\??\c:\nbbbbb.exec:\nbbbbb.exe53⤵
- Executes dropped EXE
PID:4028 -
\??\c:\vpddd.exec:\vpddd.exe54⤵
- Executes dropped EXE
PID:5000 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe55⤵
- Executes dropped EXE
PID:3868 -
\??\c:\ffxrllf.exec:\ffxrllf.exe56⤵
- Executes dropped EXE
PID:1524 -
\??\c:\ppjpp.exec:\ppjpp.exe57⤵
- Executes dropped EXE
PID:3304 -
\??\c:\rfffxfx.exec:\rfffxfx.exe58⤵
- Executes dropped EXE
PID:4136 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe59⤵
- Executes dropped EXE
PID:4464 -
\??\c:\bbhhhn.exec:\bbhhhn.exe60⤵
- Executes dropped EXE
PID:4356 -
\??\c:\jvdvv.exec:\jvdvv.exe61⤵
- Executes dropped EXE
PID:4276 -
\??\c:\fflllrl.exec:\fflllrl.exe62⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nhhbbb.exec:\nhhbbb.exe63⤵
- Executes dropped EXE
PID:676 -
\??\c:\nbhbbb.exec:\nbhbbb.exe64⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jvvpp.exec:\jvvpp.exe65⤵
- Executes dropped EXE
PID:1844 -
\??\c:\1flllrl.exec:\1flllrl.exe66⤵PID:1488
-
\??\c:\9hhhhh.exec:\9hhhhh.exe67⤵PID:376
-
\??\c:\jjdvp.exec:\jjdvp.exe68⤵PID:2696
-
\??\c:\ffxfxxx.exec:\ffxfxxx.exe69⤵PID:116
-
\??\c:\bnhbbn.exec:\bnhbbn.exe70⤵PID:2992
-
\??\c:\ddppd.exec:\ddppd.exe71⤵PID:2884
-
\??\c:\flllxrl.exec:\flllxrl.exe72⤵PID:4836
-
\??\c:\htnnnn.exec:\htnnnn.exe73⤵PID:3200
-
\??\c:\ppppp.exec:\ppppp.exe74⤵PID:4228
-
\??\c:\1pddj.exec:\1pddj.exe75⤵PID:5100
-
\??\c:\xrllxxf.exec:\xrllxxf.exe76⤵PID:2572
-
\??\c:\jjjjj.exec:\jjjjj.exe77⤵PID:3584
-
\??\c:\jvdvp.exec:\jvdvp.exe78⤵PID:1500
-
\??\c:\9xxrrrr.exec:\9xxrrrr.exe79⤵PID:636
-
\??\c:\7thbbh.exec:\7thbbh.exe80⤵PID:2288
-
\??\c:\9hnnhn.exec:\9hnnhn.exe81⤵PID:3556
-
\??\c:\pjvpd.exec:\pjvpd.exe82⤵PID:2744
-
\??\c:\vpvpj.exec:\vpvpj.exe83⤵PID:1920
-
\??\c:\fxffrrr.exec:\fxffrrr.exe84⤵PID:1388
-
\??\c:\bnnnhh.exec:\bnnnhh.exe85⤵PID:4704
-
\??\c:\btbbtt.exec:\btbbtt.exe86⤵PID:1212
-
\??\c:\ppddd.exec:\ppddd.exe87⤵PID:4316
-
\??\c:\rrllfff.exec:\rrllfff.exe88⤵PID:3828
-
\??\c:\xlrfxlx.exec:\xlrfxlx.exe89⤵PID:3776
-
\??\c:\ttbttt.exec:\ttbttt.exe90⤵PID:2120
-
\??\c:\pjvpv.exec:\pjvpv.exe91⤵PID:1640
-
\??\c:\pdppp.exec:\pdppp.exe92⤵PID:2208
-
\??\c:\lfrfxrl.exec:\lfrfxrl.exe93⤵PID:4360
-
\??\c:\lllllrr.exec:\lllllrr.exe94⤵PID:1444
-
\??\c:\bbhbbb.exec:\bbhbbb.exe95⤵PID:4456
-
\??\c:\pjjdd.exec:\pjjdd.exe96⤵PID:3960
-
\??\c:\jdddj.exec:\jdddj.exe97⤵PID:2920
-
\??\c:\5fffxxx.exec:\5fffxxx.exe98⤵PID:4652
-
\??\c:\bbnnbb.exec:\bbnnbb.exe99⤵PID:3456
-
\??\c:\nhtntt.exec:\nhtntt.exe100⤵PID:3868
-
\??\c:\jdpdd.exec:\jdpdd.exe101⤵PID:5104
-
\??\c:\ppddv.exec:\ppddv.exe102⤵PID:4136
-
\??\c:\xxllrrx.exec:\xxllrrx.exe103⤵PID:4480
-
\??\c:\5frrxfl.exec:\5frrxfl.exe104⤵PID:4972
-
\??\c:\nnhhbb.exec:\nnhhbb.exe105⤵PID:4816
-
\??\c:\jddvp.exec:\jddvp.exe106⤵PID:4052
-
\??\c:\xfffxxr.exec:\xfffxxr.exe107⤵PID:2668
-
\??\c:\nhbttb.exec:\nhbttb.exe108⤵PID:4256
-
\??\c:\vjppj.exec:\vjppj.exe109⤵PID:224
-
\??\c:\rllfrrl.exec:\rllfrrl.exe110⤵PID:376
-
\??\c:\lfllxxx.exec:\lfllxxx.exe111⤵PID:4068
-
\??\c:\nhnhbb.exec:\nhnhbb.exe112⤵PID:3508
-
\??\c:\jvppj.exec:\jvppj.exe113⤵PID:4468
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe114⤵PID:4804
-
\??\c:\nnnhnn.exec:\nnnhnn.exe115⤵PID:1624
-
\??\c:\ddvvd.exec:\ddvvd.exe116⤵PID:4076
-
\??\c:\bnbthn.exec:\bnbthn.exe117⤵PID:3140
-
\??\c:\bntnnh.exec:\bntnnh.exe118⤵PID:4220
-
\??\c:\dddvd.exec:\dddvd.exe119⤵PID:1040
-
\??\c:\fxllrrf.exec:\fxllrrf.exe120⤵PID:928
-
\??\c:\5lxffff.exec:\5lxffff.exe121⤵PID:3548
-
\??\c:\hbnttn.exec:\hbnttn.exe122⤵PID:2888
-
\??\c:\vvdjv.exec:\vvdjv.exe123⤵PID:2800
-
\??\c:\3flllll.exec:\3flllll.exe124⤵PID:2952
-
\??\c:\bnnhhh.exec:\bnnhhh.exe125⤵PID:448
-
\??\c:\jvjjv.exec:\jvjjv.exe126⤵PID:3412
-
\??\c:\xflflrx.exec:\xflflrx.exe127⤵PID:2312
-
\??\c:\xfrlllf.exec:\xfrlllf.exe128⤵PID:2580
-
\??\c:\xrllfxx.exec:\xrllfxx.exe129⤵PID:4544
-
\??\c:\tttttt.exec:\tttttt.exe130⤵PID:4436
-
\??\c:\ddjdp.exec:\ddjdp.exe131⤵PID:4368
-
\??\c:\xrxrllf.exec:\xrxrllf.exe132⤵PID:3712
-
\??\c:\hnhhhn.exec:\hnhhhn.exe133⤵PID:588
-
\??\c:\ntbttt.exec:\ntbttt.exe134⤵PID:2876
-
\??\c:\dvpjj.exec:\dvpjj.exe135⤵PID:2128
-
\??\c:\xxrllxx.exec:\xxrllxx.exe136⤵PID:2084
-
\??\c:\thnnnn.exec:\thnnnn.exe137⤵PID:2892
-
\??\c:\1pdvp.exec:\1pdvp.exe138⤵PID:2008
-
\??\c:\vvvvp.exec:\vvvvp.exe139⤵PID:1736
-
\??\c:\xrrlxxf.exec:\xrrlxxf.exe140⤵PID:2168
-
\??\c:\bntttb.exec:\bntttb.exe141⤵PID:3892
-
\??\c:\jdjdd.exec:\jdjdd.exe142⤵PID:4844
-
\??\c:\xrfxrll.exec:\xrfxrll.exe143⤵PID:908
-
\??\c:\hhhhbh.exec:\hhhhbh.exe144⤵PID:5112
-
\??\c:\ntbhnh.exec:\ntbhnh.exe145⤵PID:2068
-
\??\c:\dvdvv.exec:\dvdvv.exe146⤵PID:4516
-
\??\c:\rxrxlfx.exec:\rxrxlfx.exe147⤵PID:4672
-
\??\c:\bbnhbb.exec:\bbnhbb.exe148⤵PID:4860
-
\??\c:\bbbntt.exec:\bbbntt.exe149⤵PID:4816
-
\??\c:\5vjjj.exec:\5vjjj.exe150⤵PID:3616
-
\??\c:\frlxflf.exec:\frlxflf.exe151⤵PID:3684
-
\??\c:\xxlrlll.exec:\xxlrlll.exe152⤵PID:3312
-
\??\c:\nhntnb.exec:\nhntnb.exe153⤵PID:4920
-
\??\c:\nbnnnn.exec:\nbnnnn.exe154⤵PID:3196
-
\??\c:\pjjjd.exec:\pjjjd.exe155⤵PID:2980
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe156⤵PID:3956
-
\??\c:\ttbtnn.exec:\ttbtnn.exe157⤵PID:4992
-
\??\c:\jpvjj.exec:\jpvjj.exe158⤵PID:4228
-
\??\c:\xrfxfxr.exec:\xrfxfxr.exe159⤵PID:3500
-
\??\c:\bbhhbb.exec:\bbhhbb.exe160⤵PID:3844
-
\??\c:\nhnhhh.exec:\nhnhhh.exe161⤵PID:4044
-
\??\c:\1vvpj.exec:\1vvpj.exe162⤵PID:928
-
\??\c:\jvjdv.exec:\jvjdv.exe163⤵PID:3548
-
\??\c:\lfxxrlr.exec:\lfxxrlr.exe164⤵PID:4344
-
\??\c:\1bhbnt.exec:\1bhbnt.exe165⤵PID:820
-
\??\c:\hhbnhn.exec:\hhbnhn.exe166⤵PID:2256
-
\??\c:\pdddd.exec:\pdddd.exe167⤵PID:1616
-
\??\c:\rfrxxxx.exec:\rfrxxxx.exe168⤵PID:2520
-
\??\c:\lrffxfx.exec:\lrffxfx.exe169⤵PID:1388
-
\??\c:\nhbbtt.exec:\nhbbtt.exe170⤵PID:4940
-
\??\c:\btnhnn.exec:\btnhnn.exe171⤵PID:1212
-
\??\c:\vjddd.exec:\vjddd.exe172⤵PID:4116
-
\??\c:\7xxrlrl.exec:\7xxrlrl.exe173⤵PID:4268
-
\??\c:\fxrrrxx.exec:\fxrrrxx.exe174⤵PID:1112
-
\??\c:\hbhbbb.exec:\hbhbbb.exe175⤵PID:1716
-
\??\c:\1vjjv.exec:\1vjjv.exe176⤵PID:3560
-
\??\c:\vvvvv.exec:\vvvvv.exe177⤵PID:1572
-
\??\c:\5frxlrl.exec:\5frxlrl.exe178⤵PID:4424
-
\??\c:\flrrllf.exec:\flrrllf.exe179⤵PID:3692
-
\??\c:\5hhbtt.exec:\5hhbtt.exe180⤵PID:4456
-
\??\c:\djvvj.exec:\djvvj.exe181⤵PID:3256
-
\??\c:\jppjj.exec:\jppjj.exe182⤵PID:5004
-
\??\c:\1xrxxxr.exec:\1xrxxxr.exe183⤵PID:3352
-
\??\c:\hhntht.exec:\hhntht.exe184⤵PID:2376
-
\??\c:\bbbhbh.exec:\bbbhbh.exe185⤵PID:908
-
\??\c:\pdjdd.exec:\pdjdd.exe186⤵PID:2896
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe187⤵PID:2612
-
\??\c:\tttttt.exec:\tttttt.exe188⤵PID:5112
-
\??\c:\nnbbbb.exec:\nnbbbb.exe189⤵PID:2068
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe190⤵PID:2152
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe191⤵PID:2176
-
\??\c:\hnbhbb.exec:\hnbhbb.exe192⤵PID:4224
-
\??\c:\ppdvp.exec:\ppdvp.exe193⤵PID:552
-
\??\c:\dvdvd.exec:\dvdvd.exe194⤵PID:4452
-
\??\c:\xfxlfrr.exec:\xfxlfrr.exe195⤵PID:4932
-
\??\c:\1hbbtt.exec:\1hbbtt.exe196⤵PID:4912
-
\??\c:\pvpvp.exec:\pvpvp.exe197⤵PID:3348
-
\??\c:\jddpd.exec:\jddpd.exe198⤵PID:3508
-
\??\c:\9lrrlrr.exec:\9lrrlrr.exe199⤵PID:1600
-
\??\c:\nnttnt.exec:\nnttnt.exe200⤵PID:1344
-
\??\c:\jvpjv.exec:\jvpjv.exe201⤵PID:4488
-
\??\c:\7jdjv.exec:\7jdjv.exe202⤵PID:3756
-
\??\c:\rrxrllr.exec:\rrxrllr.exe203⤵PID:4984
-
\??\c:\7hnnnt.exec:\7hnnnt.exe204⤵PID:3288
-
\??\c:\tnnhbt.exec:\tnnhbt.exe205⤵PID:3708
-
\??\c:\vjvvd.exec:\vjvvd.exe206⤵PID:4288
-
\??\c:\xxxlfrf.exec:\xxxlfrf.exe207⤵PID:1500
-
\??\c:\nhtnbb.exec:\nhtnbb.exe208⤵PID:2000
-
\??\c:\dpjvp.exec:\dpjvp.exe209⤵PID:2164
-
\??\c:\pjvpv.exec:\pjvpv.exe210⤵PID:2468
-
\??\c:\xfrfxlr.exec:\xfrfxlr.exe211⤵PID:4908
-
\??\c:\nbbhbh.exec:\nbbhbh.exe212⤵PID:1120
-
\??\c:\vvvpj.exec:\vvvpj.exe213⤵PID:4492
-
\??\c:\frrllfx.exec:\frrllfx.exe214⤵PID:4656
-
\??\c:\lfrrflr.exec:\lfrrflr.exe215⤵PID:4680
-
\??\c:\hhbntt.exec:\hhbntt.exe216⤵PID:2096
-
\??\c:\vvvpj.exec:\vvvpj.exe217⤵PID:3828
-
\??\c:\frxxrff.exec:\frxxrff.exe218⤵PID:2552
-
\??\c:\bnbthb.exec:\bnbthb.exe219⤵PID:4296
-
\??\c:\7pvvv.exec:\7pvvv.exe220⤵PID:3780
-
\??\c:\rxxlrrx.exec:\rxxlrrx.exe221⤵PID:4428
-
\??\c:\thnnnt.exec:\thnnnt.exe222⤵PID:4872
-
\??\c:\5ntbbt.exec:\5ntbbt.exe223⤵PID:4232
-
\??\c:\vjjdj.exec:\vjjdj.exe224⤵PID:3068
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe225⤵PID:3960
-
\??\c:\hhtnnn.exec:\hhtnnn.exe226⤵PID:4868
-
\??\c:\pjjvv.exec:\pjjvv.exe227⤵PID:1524
-
\??\c:\vjpjj.exec:\vjpjj.exe228⤵PID:3080
-
\??\c:\rllffff.exec:\rllffff.exe229⤵PID:4364
-
\??\c:\thnhhh.exec:\thnhhh.exe230⤵PID:4264
-
\??\c:\dvvjd.exec:\dvvjd.exe231⤵PID:908
-
\??\c:\rllfxxx.exec:\rllfxxx.exe232⤵PID:1172
-
\??\c:\ffxlxxf.exec:\ffxlxxf.exe233⤵PID:2896
-
\??\c:\vvdpj.exec:\vvdpj.exe234⤵PID:4688
-
\??\c:\3rxxrxx.exec:\3rxxrxx.exe235⤵PID:5012
-
\??\c:\rxrxffr.exec:\rxrxffr.exe236⤵PID:4236
-
\??\c:\hbbbbt.exec:\hbbbbt.exe237⤵PID:4480
-
\??\c:\ppvpj.exec:\ppvpj.exe238⤵PID:4392
-
\??\c:\vpvpj.exec:\vpvpj.exe239⤵PID:4988
-
\??\c:\xxfxxlf.exec:\xxfxxlf.exe240⤵PID:4672
-
\??\c:\hhhhhb.exec:\hhhhhb.exe241⤵PID:3052
-
\??\c:\djjdv.exec:\djjdv.exe242⤵PID:2912