Analysis
- max time kernel
150s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
327ec979cc2f6713a9e0f6ed0e0c1710_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
- Target 327ec979cc2f6713a9e0f6ed0e0c1710_NeikiAnalytics.exe
- Size 473KB
- Sample240528-e4gnnsef3v
- SHA256 9df347d86d4702531de2e09d2bb48a6eea7fdce60232a38849d516af04fbd176
- MD5 327ec979cc2f6713a9e0f6ed0e0c1710
- SHA1 26fc03956e5e485e4854e1391324eea70d1e6948
- SHA512 6d58d81ff9b89fbf0de0357f896cb37cffb9a0eac87f702f3f015b0ddd15f44adf322d5bcbb0eaebb4b2be8ba9687ecf3a6118e7b0c299b7873c10aa2c5e82a8
- SSDEEP 6144:lcm7ImGddXmNt251UriZFwT+aZKl7pg1xBG:H7Tc2NYHUrAwT+OKLSjG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4260-0-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4260-6-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1908-8-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1908-14-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2020-20-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2000-28-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4968-26-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2984-33-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2000-22-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4968-35-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2984-41-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2064-40-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2064-50-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1444-48-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1444-55-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/672-61-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/5080-64-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/672-70-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/464-77-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3868-74-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3868-72-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/5080-57-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1072-85-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1072-90-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4872-92-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/464-83-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3080-97-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4872-96-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1604-106-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3080-104-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3480-111-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3480-119-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3140-117-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1604-114-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3140-123-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4900-125-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4388-137-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1900-140-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4388-134-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4900-132-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1900-145-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4456-153-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4512-155-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2004-160-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4512-159-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2004-165-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2600-172-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3452-175-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3452-179-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3340-186-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1424-189-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/964-196-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1424-195-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/964-200-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1300-208-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/412-210-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3608-212-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3608-209-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1300-202-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/412-216-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1908-220-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/624-225-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1908-227-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4320-232-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1908 dvjjp.exe 2020 frrrrrr.exe 2000 bthbhh.exe 4968 9dvpp.exe 2984 xllfxrl.exe 2064 pdjjj.exe 1444 xxfxlll.exe 5080 btnbhb.exe 672 bnhbbb.exe 3868 pjvjv.exe 464 xllfxrr.exe 1072 vjjdd.exe 4872 9rrrrrr.exe 3080 hbhbnn.exe 1604 jdjdd.exe 3480 rlfllrx.exe 3140 vjppp.exe 4900 httbht.exe 4388 vvjjv.exe 1900 vpddv.exe 4456 hnntnt.exe 4512 vppjj.exe 2004 dvdvv.exe 2600 3ttnhb.exe 3452 vpdvj.exe 3340 dpdvv.exe 1424 5xxrffx.exe 964 bttnhh.exe 1300 dvdvp.exe 3608 vvddv.exe 1908 hbnbbt.exe 624 dvvpj.exe 4320 jvvpd.exe 2444 dvjdj.exe 3920 nhnhbb.exe 4452 5pvdv.exe 3280 vpdjd.exe 216 bhnhhh.exe 5048 rflfxxr.exe 2344 jpjjj.exe 4544 jjdjp.exe 4848 pjjdd.exe 4024 flrrxxr.exe 3472 pddvp.exe 1604 xxxffxf.exe 3480 ttttbb.exe 5096 pjpjp.exe 628 nbbttb.exe 3740 ppddp.exe 2276 pjpjd.exe 2220 rllfrrl.exe 2248 htbtnn.exe 3968 jvdvp.exe 2600 fxrlffx.exe 3972 bbbtnn.exe 1228 jjjdp.exe 1712 ddjjd.exe 3976 frlffxx.exe 1300 bbbhhh.exe 4504 jdjjj.exe 4640 frrfxrl.exe 4772 thnbtt.exe 4984 fxrxrxl.exe 3884 tntnnh.exe -
resource yara_rule behavioral2/memory/4260-0-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4260-6-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1908-8-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1908-14-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2020-12-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2020-20-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2000-28-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4968-26-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2984-33-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2000-22-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4968-35-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2984-41-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2064-50-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1444-48-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1444-55-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/672-61-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/5080-64-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/672-70-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/464-77-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3868-74-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3868-72-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/5080-57-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1072-85-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1072-90-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4872-92-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/464-83-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4872-96-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1604-106-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3080-104-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3480-111-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3480-119-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3140-117-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1604-114-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3140-123-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4388-137-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4388-134-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4900-132-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1900-145-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4456-153-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4512-155-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4512-159-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2004-165-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2600-172-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3452-175-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3452-179-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3340-186-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1424-189-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/964-196-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1424-195-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/964-200-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1300-208-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/412-210-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3608-212-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3608-209-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/412-216-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1908-220-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/624-225-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1908-227-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/624-231-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4320-236-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2444-241-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3920-242-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3920-246-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4452-247-0x0000000000400000-0x00000000004C4000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4260 wrote to memory of 1908 4260 327ec979cc2f6713a9e0f6ed0e0c1710_NeikiAnalytics.exe 83 PID 4260 wrote to memory of 1908 4260 327ec979cc2f6713a9e0f6ed0e0c1710_NeikiAnalytics.exe 83 PID 4260 wrote to memory of 1908 4260 327ec979cc2f6713a9e0f6ed0e0c1710_NeikiAnalytics.exe 83 PID 1908 wrote to memory of 2020 1908 dvjjp.exe 84 PID 1908 wrote to memory of 2020 1908 dvjjp.exe 84 PID 1908 wrote to memory of 2020 1908 dvjjp.exe 84 PID 2020 wrote to memory of 2000 2020 frrrrrr.exe 85 PID 2020 wrote to memory of 2000 2020 frrrrrr.exe 85 PID 2020 wrote to memory of 2000 2020 frrrrrr.exe 85 PID 2000 wrote to memory of 4968 2000 bthbhh.exe 86 PID 2000 wrote to memory of 4968 2000 bthbhh.exe 86 PID 2000 wrote to memory of 4968 2000 bthbhh.exe 86 PID 4968 wrote to memory of 2984 4968 9dvpp.exe 87 PID 4968 wrote to memory of 2984 4968 9dvpp.exe 87 PID 4968 wrote to memory of 2984 4968 9dvpp.exe 87 PID 2984 wrote to memory of 2064 2984 xllfxrl.exe 88 PID 2984 wrote to memory of 2064 2984 xllfxrl.exe 88 PID 2984 wrote to memory of 2064 2984 xllfxrl.exe 88 PID 2064 wrote to memory of 1444 2064 pdjjj.exe 90 PID 2064 wrote to memory of 1444 2064 pdjjj.exe 90 PID 2064 wrote to memory of 1444 2064 pdjjj.exe 90 PID 1444 wrote to memory of 5080 1444 xxfxlll.exe 91 PID 1444 wrote to memory of 5080 1444 xxfxlll.exe 91 PID 1444 wrote to memory of 5080 1444 xxfxlll.exe 91 PID 5080 wrote to memory of 672 5080 btnbhb.exe 92 PID 5080 wrote to memory of 672 5080 btnbhb.exe 92 PID 5080 wrote to memory of 672 5080 btnbhb.exe 92 PID 672 wrote to memory of 3868 672 bnhbbb.exe 94 PID 672 wrote to memory of 3868 672 bnhbbb.exe 94 PID 672 wrote to memory of 3868 672 bnhbbb.exe 94 PID 3868 wrote to memory of 464 3868 pjvjv.exe 95 PID 3868 wrote to memory of 464 3868 pjvjv.exe 95 PID 3868 wrote to memory of 464 3868 pjvjv.exe 95 PID 464 wrote to memory of 1072 464 xllfxrr.exe 96 PID 464 wrote to memory of 1072 464 xllfxrr.exe 96 PID 464 wrote to memory of 1072 464 xllfxrr.exe 96 PID 1072 wrote to memory of 4872 1072 vjjdd.exe 97 PID 1072 wrote to memory of 4872 1072 vjjdd.exe 97 PID 1072 wrote to memory of 4872 1072 vjjdd.exe 97 PID 4872 wrote to memory of 3080 4872 9rrrrrr.exe 98 PID 4872 wrote to memory of 3080 4872 9rrrrrr.exe 98 PID 4872 wrote to memory of 3080 4872 9rrrrrr.exe 98 PID 3080 wrote to memory of 1604 3080 hbhbnn.exe 100 PID 3080 wrote to memory of 1604 3080 hbhbnn.exe 100 PID 3080 wrote to memory of 1604 3080 hbhbnn.exe 100 PID 1604 wrote to memory of 3480 1604 jdjdd.exe 101 PID 1604 wrote to memory of 3480 1604 jdjdd.exe 101 PID 1604 wrote to memory of 3480 1604 jdjdd.exe 101 PID 3480 wrote to memory of 3140 3480 rlfllrx.exe 102 PID 3480 wrote to memory of 3140 3480 rlfllrx.exe 102 PID 3480 wrote to memory of 3140 3480 rlfllrx.exe 102 PID 3140 wrote to memory of 4900 3140 vjppp.exe 103 PID 3140 wrote to memory of 4900 3140 vjppp.exe 103 PID 3140 wrote to memory of 4900 3140 vjppp.exe 103 PID 4900 wrote to memory of 4388 4900 httbht.exe 104 PID 4900 wrote to memory of 4388 4900 httbht.exe 104 PID 4900 wrote to memory of 4388 4900 httbht.exe 104 PID 4388 wrote to memory of 1900 4388 vvjjv.exe 105 PID 4388 wrote to memory of 1900 4388 vvjjv.exe 105 PID 4388 wrote to memory of 1900 4388 vvjjv.exe 105 PID 1900 wrote to memory of 4456 1900 vpddv.exe 106 PID 1900 wrote to memory of 4456 1900 vpddv.exe 106 PID 1900 wrote to memory of 4456 1900 vpddv.exe 106 PID 4456 wrote to memory of 4512 4456 hnntnt.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\327ec979cc2f6713a9e0f6ed0e0c1710_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\327ec979cc2f6713a9e0f6ed0e0c1710_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\dvjjp.exec:\dvjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\frrrrrr.exec:\frrrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\bthbhh.exec:\bthbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\9dvpp.exec:\9dvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\xllfxrl.exec:\xllfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\pdjjj.exec:\pdjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\xxfxlll.exec:\xxfxlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\btnbhb.exec:\btnbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\bnhbbb.exec:\bnhbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\pjvjv.exec:\pjvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\xllfxrr.exec:\xllfxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\vjjdd.exec:\vjjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\9rrrrrr.exec:\9rrrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\hbhbnn.exec:\hbhbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\jdjdd.exec:\jdjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\rlfllrx.exec:\rlfllrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\vjppp.exec:\vjppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\httbht.exec:\httbht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\vvjjv.exec:\vvjjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\vpddv.exec:\vpddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\hnntnt.exec:\hnntnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\vppjj.exec:\vppjj.exe23⤵
- Executes dropped EXE
PID:4512 -
\??\c:\dvdvv.exec:\dvdvv.exe24⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3ttnhb.exec:\3ttnhb.exe25⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vpdvj.exec:\vpdvj.exe26⤵
- Executes dropped EXE
PID:3452 -
\??\c:\dpdvv.exec:\dpdvv.exe27⤵
- Executes dropped EXE
PID:3340 -
\??\c:\5xxrffx.exec:\5xxrffx.exe28⤵
- Executes dropped EXE
PID:1424 -
\??\c:\bttnhh.exec:\bttnhh.exe29⤵
- Executes dropped EXE
PID:964 -
\??\c:\dvdvp.exec:\dvdvp.exe30⤵
- Executes dropped EXE
PID:1300 -
\??\c:\vvddv.exec:\vvddv.exe31⤵
- Executes dropped EXE
PID:3608 -
\??\c:\frxlffr.exec:\frxlffr.exe32⤵PID:412
-
\??\c:\hbnbbt.exec:\hbnbbt.exe33⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvvpj.exec:\dvvpj.exe34⤵
- Executes dropped EXE
PID:624 -
\??\c:\jvvpd.exec:\jvvpd.exe35⤵
- Executes dropped EXE
PID:4320 -
\??\c:\dvjdj.exec:\dvjdj.exe36⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nhnhbb.exec:\nhnhbb.exe37⤵
- Executes dropped EXE
PID:3920 -
\??\c:\5pvdv.exec:\5pvdv.exe38⤵
- Executes dropped EXE
PID:4452 -
\??\c:\vpdjd.exec:\vpdjd.exe39⤵
- Executes dropped EXE
PID:3280 -
\??\c:\bhnhhh.exec:\bhnhhh.exe40⤵
- Executes dropped EXE
PID:216 -
\??\c:\rflfxxr.exec:\rflfxxr.exe41⤵
- Executes dropped EXE
PID:5048 -
\??\c:\jpjjj.exec:\jpjjj.exe42⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jjdjp.exec:\jjdjp.exe43⤵
- Executes dropped EXE
PID:4544 -
\??\c:\pjjdd.exec:\pjjdd.exe44⤵
- Executes dropped EXE
PID:4848 -
\??\c:\flrrxxr.exec:\flrrxxr.exe45⤵
- Executes dropped EXE
PID:4024 -
\??\c:\pddvp.exec:\pddvp.exe46⤵
- Executes dropped EXE
PID:3472 -
\??\c:\xxxffxf.exec:\xxxffxf.exe47⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ttttbb.exec:\ttttbb.exe48⤵
- Executes dropped EXE
PID:3480 -
\??\c:\pjpjp.exec:\pjpjp.exe49⤵
- Executes dropped EXE
PID:5096 -
\??\c:\nbbttb.exec:\nbbttb.exe50⤵
- Executes dropped EXE
PID:628 -
\??\c:\ppddp.exec:\ppddp.exe51⤵
- Executes dropped EXE
PID:3740 -
\??\c:\pjpjd.exec:\pjpjd.exe52⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rllfrrl.exec:\rllfrrl.exe53⤵
- Executes dropped EXE
PID:2220 -
\??\c:\htbtnn.exec:\htbtnn.exe54⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jvdvp.exec:\jvdvp.exe55⤵
- Executes dropped EXE
PID:3968 -
\??\c:\fxrlffx.exec:\fxrlffx.exe56⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bbbtnn.exec:\bbbtnn.exe57⤵
- Executes dropped EXE
PID:3972 -
\??\c:\jjjdp.exec:\jjjdp.exe58⤵
- Executes dropped EXE
PID:1228 -
\??\c:\ddjjd.exec:\ddjjd.exe59⤵
- Executes dropped EXE
PID:1712 -
\??\c:\frlffxx.exec:\frlffxx.exe60⤵
- Executes dropped EXE
PID:3976 -
\??\c:\bbbhhh.exec:\bbbhhh.exe61⤵
- Executes dropped EXE
PID:1300 -
\??\c:\jdjjj.exec:\jdjjj.exe62⤵
- Executes dropped EXE
PID:4504 -
\??\c:\frrfxrl.exec:\frrfxrl.exe63⤵
- Executes dropped EXE
PID:4640 -
\??\c:\thnbtt.exec:\thnbtt.exe64⤵
- Executes dropped EXE
PID:4772 -
\??\c:\fxrxrxl.exec:\fxrxrxl.exe65⤵
- Executes dropped EXE
PID:4984 -
\??\c:\tntnnh.exec:\tntnnh.exe66⤵
- Executes dropped EXE
PID:3884 -
\??\c:\vjjpv.exec:\vjjpv.exe67⤵PID:3468
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe68⤵PID:2844
-
\??\c:\rxlfflx.exec:\rxlfflx.exe69⤵PID:2148
-
\??\c:\ntnhtt.exec:\ntnhtt.exe70⤵PID:3920
-
\??\c:\5dpjv.exec:\5dpjv.exe71⤵PID:3392
-
\??\c:\fxxrffr.exec:\fxxrffr.exe72⤵PID:2864
-
\??\c:\thhtnt.exec:\thhtnt.exe73⤵PID:1092
-
\??\c:\dddvp.exec:\dddvp.exe74⤵PID:2456
-
\??\c:\lxxrllf.exec:\lxxrllf.exe75⤵PID:3724
-
\??\c:\thnhhb.exec:\thnhhb.exe76⤵PID:3000
-
\??\c:\5ppjv.exec:\5ppjv.exe77⤵PID:3872
-
\??\c:\5ffrlrl.exec:\5ffrlrl.exe78⤵PID:4024
-
\??\c:\thhhbh.exec:\thhhbh.exe79⤵PID:1456
-
\??\c:\pvjdv.exec:\pvjdv.exe80⤵PID:2108
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe81⤵PID:4384
-
\??\c:\nnbbhb.exec:\nnbbhb.exe82⤵PID:2396
-
\??\c:\llxrxrx.exec:\llxrxrx.exe83⤵PID:5028
-
\??\c:\pdjjd.exec:\pdjjd.exe84⤵PID:4372
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe85⤵PID:4840
-
\??\c:\hhnhbt.exec:\hhnhbt.exe86⤵PID:3504
-
\??\c:\jjpdv.exec:\jjpdv.exe87⤵PID:2248
-
\??\c:\xllfxrf.exec:\xllfxrf.exe88⤵PID:528
-
\??\c:\tnttnn.exec:\tnttnn.exe89⤵PID:2856
-
\??\c:\1tnhbt.exec:\1tnhbt.exe90⤵PID:3452
-
\??\c:\7pvvp.exec:\7pvvp.exe91⤵PID:1988
-
\??\c:\7llfllx.exec:\7llfllx.exe92⤵PID:4672
-
\??\c:\htbbtn.exec:\htbbtn.exe93⤵PID:4328
-
\??\c:\1hbtnn.exec:\1hbtnn.exe94⤵PID:1672
-
\??\c:\jvpvp.exec:\jvpvp.exe95⤵PID:3344
-
\??\c:\lflfxxr.exec:\lflfxxr.exe96⤵PID:3312
-
\??\c:\bbbbhb.exec:\bbbbhb.exe97⤵PID:3060
-
\??\c:\tnnhbb.exec:\tnnhbb.exe98⤵PID:4540
-
\??\c:\vvppj.exec:\vvppj.exe99⤵PID:3468
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe100⤵PID:4780
-
\??\c:\nhntnt.exec:\nhntnt.exe101⤵PID:1112
-
\??\c:\1vjdv.exec:\1vjdv.exe102⤵PID:3732
-
\??\c:\3xfxlll.exec:\3xfxlll.exe103⤵PID:1268
-
\??\c:\5hnnnn.exec:\5hnnnn.exe104⤵PID:1092
-
\??\c:\djppj.exec:\djppj.exe105⤵PID:2456
-
\??\c:\jvdvp.exec:\jvdvp.exe106⤵PID:2336
-
\??\c:\llrlxxr.exec:\llrlxxr.exe107⤵PID:4988
-
\??\c:\bttnnn.exec:\bttnnn.exe108⤵PID:3636
-
\??\c:\dvjdd.exec:\dvjdd.exe109⤵PID:4024
-
\??\c:\jjvvp.exec:\jjvvp.exe110⤵PID:2592
-
\??\c:\3lrrrrx.exec:\3lrrrrx.exe111⤵PID:3980
-
\??\c:\1tbbbt.exec:\1tbbbt.exe112⤵PID:3888
-
\??\c:\htbtnn.exec:\htbtnn.exe113⤵PID:4432
-
\??\c:\jvvvv.exec:\jvvvv.exe114⤵PID:4116
-
\??\c:\rllfxxr.exec:\rllfxxr.exe115⤵PID:116
-
\??\c:\tttnnh.exec:\tttnnh.exe116⤵PID:1952
-
\??\c:\pjpjd.exec:\pjpjd.exe117⤵PID:1488
-
\??\c:\7vvpd.exec:\7vvpd.exe118⤵PID:2004
-
\??\c:\rffxrlf.exec:\rffxrlf.exe119⤵PID:3504
-
\??\c:\nnttnn.exec:\nnttnn.exe120⤵PID:3180
-
\??\c:\vddvj.exec:\vddvj.exe121⤵PID:1896
-
\??\c:\dvvvj.exec:\dvvvj.exe122⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-