Analysis
- max time kernel
150s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5fce457718bd04b1a0aee66b5eeb6c90_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 5fce457718bd04b1a0aee66b5eeb6c90_NeikiAnalytics.exe
- Size 483KB
- Sample240518-avsblabc36
- SHA256 ed24f17068d0920fbaf4eadccc3c3cf4ef616ffb47704347f80f38aee628d73e
- MD5 5fce457718bd04b1a0aee66b5eeb6c90
- SHA1 8f32f3b4b73c86bcad9b7301e35ee19a09bce0df
- SHA512 8c8e3361cd26c8a912e4effca018153b508728ddc06420e963be076318903ecd9c3bd2f77ad736054cef7a3337d90fdb301ec7764a047dee3844d365ba21f4bc
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwu1b26X1wjhtSizjV:q7Tc2NYHUrAwqzcX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/644-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/708-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-852-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1424 xflfxxr.exe 1448 xrxrllf.exe 3540 1tthth.exe 1828 ddvvd.exe 4420 flrllrf.exe 4692 fffflfl.exe 1104 bhtbbh.exe 2948 vdpvd.exe 3544 lfrrrrr.exe 3704 lfffffl.exe 4860 3htthn.exe 4180 vvjdv.exe 4236 3fllfll.exe 5112 bbttbb.exe 764 bbthbb.exe 1972 5ddvj.exe 3740 flrfffr.exe 4820 thnnbt.exe 4152 3dpjv.exe 924 fflfxll.exe 448 7hhbtb.exe 4360 nbhhbb.exe 2424 djpjd.exe 4912 xxxrrrl.exe 2732 nhnnhb.exe 5036 hbtntt.exe 1392 pjpvd.exe 1152 1rxxffl.exe 4404 nbnhnh.exe 1100 jvdjd.exe 3416 vjppp.exe 1724 rrlllll.exe 3420 thttnt.exe 4944 djpdj.exe 4144 rrxrxxf.exe 2896 7lxflll.exe 1852 hnhnnh.exe 3044 vvpjp.exe 4388 xxllrlf.exe 1656 thntbh.exe 3852 vvvvv.exe 544 vvppj.exe 3632 xxrllff.exe 464 bhhbbt.exe 2140 5vvpp.exe 4552 frllflf.exe 3916 thtttn.exe 3284 lxrxxxl.exe 2300 btbntt.exe 864 vppjv.exe 1812 rlxlrrx.exe 2984 ttbttt.exe 2948 bnbthh.exe 1760 jjvpd.exe 4316 llfflll.exe 1072 7ntbhn.exe 2252 xxfxxfx.exe 512 bhhhbh.exe 832 ntbthn.exe 2612 dpjjd.exe 3064 rrxfflf.exe 3920 nnhbhn.exe 3148 djvpj.exe 4908 xlrrfrr.exe -
resource yara_rule behavioral2/memory/644-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-522-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 644 wrote to memory of 1424 644 5fce457718bd04b1a0aee66b5eeb6c90_NeikiAnalytics.exe 84 PID 644 wrote to memory of 1424 644 5fce457718bd04b1a0aee66b5eeb6c90_NeikiAnalytics.exe 84 PID 644 wrote to memory of 1424 644 5fce457718bd04b1a0aee66b5eeb6c90_NeikiAnalytics.exe 84 PID 1424 wrote to memory of 1448 1424 xflfxxr.exe 85 PID 1424 wrote to memory of 1448 1424 xflfxxr.exe 85 PID 1424 wrote to memory of 1448 1424 xflfxxr.exe 85 PID 1448 wrote to memory of 3540 1448 xrxrllf.exe 86 PID 1448 wrote to memory of 3540 1448 xrxrllf.exe 86 PID 1448 wrote to memory of 3540 1448 xrxrllf.exe 86 PID 3540 wrote to memory of 1828 3540 1tthth.exe 87 PID 3540 wrote to memory of 1828 3540 1tthth.exe 87 PID 3540 wrote to memory of 1828 3540 1tthth.exe 87 PID 1828 wrote to memory of 4420 1828 ddvvd.exe 88 PID 1828 wrote to memory of 4420 1828 ddvvd.exe 88 PID 1828 wrote to memory of 4420 1828 ddvvd.exe 88 PID 4420 wrote to memory of 4692 4420 flrllrf.exe 89 PID 4420 wrote to memory of 4692 4420 flrllrf.exe 89 PID 4420 wrote to memory of 4692 4420 flrllrf.exe 89 PID 4692 wrote to memory of 1104 4692 fffflfl.exe 90 PID 4692 wrote to memory of 1104 4692 fffflfl.exe 90 PID 4692 wrote to memory of 1104 4692 fffflfl.exe 90 PID 1104 wrote to memory of 2948 1104 bhtbbh.exe 91 PID 1104 wrote to memory of 2948 1104 bhtbbh.exe 91 PID 1104 wrote to memory of 2948 1104 bhtbbh.exe 91 PID 2948 wrote to memory of 3544 2948 vdpvd.exe 92 PID 2948 wrote to memory of 3544 2948 vdpvd.exe 92 PID 2948 wrote to memory of 3544 2948 vdpvd.exe 92 PID 3544 wrote to memory of 3704 3544 lfrrrrr.exe 93 PID 3544 wrote to memory of 3704 3544 lfrrrrr.exe 93 PID 3544 wrote to memory of 3704 3544 lfrrrrr.exe 93 PID 3704 wrote to memory of 4860 3704 lfffffl.exe 94 PID 3704 wrote to memory of 4860 3704 lfffffl.exe 94 PID 3704 wrote to memory of 4860 3704 lfffffl.exe 94 PID 4860 wrote to memory of 4180 4860 3htthn.exe 95 PID 4860 wrote to memory of 4180 4860 3htthn.exe 95 PID 4860 wrote to memory of 4180 4860 3htthn.exe 95 PID 4180 wrote to memory of 4236 4180 vvjdv.exe 96 PID 4180 wrote to memory of 4236 4180 vvjdv.exe 96 PID 4180 wrote to memory of 4236 4180 vvjdv.exe 96 PID 4236 wrote to memory of 5112 4236 3fllfll.exe 97 PID 4236 wrote to memory of 5112 4236 3fllfll.exe 97 PID 4236 wrote to memory of 5112 4236 3fllfll.exe 97 PID 5112 wrote to memory of 764 5112 bbttbb.exe 98 PID 5112 wrote to memory of 764 5112 bbttbb.exe 98 PID 5112 wrote to memory of 764 5112 bbttbb.exe 98 PID 764 wrote to memory of 1972 764 bbthbb.exe 99 PID 764 wrote to memory of 1972 764 bbthbb.exe 99 PID 764 wrote to memory of 1972 764 bbthbb.exe 99 PID 1972 wrote to memory of 3740 1972 5ddvj.exe 100 PID 1972 wrote to memory of 3740 1972 5ddvj.exe 100 PID 1972 wrote to memory of 3740 1972 5ddvj.exe 100 PID 3740 wrote to memory of 4820 3740 flrfffr.exe 101 PID 3740 wrote to memory of 4820 3740 flrfffr.exe 101 PID 3740 wrote to memory of 4820 3740 flrfffr.exe 101 PID 4820 wrote to memory of 4152 4820 thnnbt.exe 102 PID 4820 wrote to memory of 4152 4820 thnnbt.exe 102 PID 4820 wrote to memory of 4152 4820 thnnbt.exe 102 PID 4152 wrote to memory of 924 4152 3dpjv.exe 103 PID 4152 wrote to memory of 924 4152 3dpjv.exe 103 PID 4152 wrote to memory of 924 4152 3dpjv.exe 103 PID 924 wrote to memory of 448 924 fflfxll.exe 104 PID 924 wrote to memory of 448 924 fflfxll.exe 104 PID 924 wrote to memory of 448 924 fflfxll.exe 104 PID 448 wrote to memory of 4360 448 7hhbtb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fce457718bd04b1a0aee66b5eeb6c90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5fce457718bd04b1a0aee66b5eeb6c90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\xflfxxr.exec:\xflfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\xrxrllf.exec:\xrxrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\1tthth.exec:\1tthth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\ddvvd.exec:\ddvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\flrllrf.exec:\flrllrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\fffflfl.exec:\fffflfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\bhtbbh.exec:\bhtbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\vdpvd.exec:\vdpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\lfffffl.exec:\lfffffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\3htthn.exec:\3htthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\vvjdv.exec:\vvjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\3fllfll.exec:\3fllfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\bbttbb.exec:\bbttbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\bbthbb.exec:\bbthbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\5ddvj.exec:\5ddvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\flrfffr.exec:\flrfffr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\thnnbt.exec:\thnnbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\3dpjv.exec:\3dpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\fflfxll.exec:\fflfxll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\7hhbtb.exec:\7hhbtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\nbhhbb.exec:\nbhhbb.exe23⤵
- Executes dropped EXE
PID:4360 -
\??\c:\djpjd.exec:\djpjd.exe24⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe25⤵
- Executes dropped EXE
PID:4912 -
\??\c:\nhnnhb.exec:\nhnnhb.exe26⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hbtntt.exec:\hbtntt.exe27⤵
- Executes dropped EXE
PID:5036 -
\??\c:\pjpvd.exec:\pjpvd.exe28⤵
- Executes dropped EXE
PID:1392 -
\??\c:\1rxxffl.exec:\1rxxffl.exe29⤵
- Executes dropped EXE
PID:1152 -
\??\c:\nbnhnh.exec:\nbnhnh.exe30⤵
- Executes dropped EXE
PID:4404 -
\??\c:\jvdjd.exec:\jvdjd.exe31⤵
- Executes dropped EXE
PID:1100 -
\??\c:\vjppp.exec:\vjppp.exe32⤵
- Executes dropped EXE
PID:3416 -
\??\c:\rrlllll.exec:\rrlllll.exe33⤵
- Executes dropped EXE
PID:1724 -
\??\c:\thttnt.exec:\thttnt.exe34⤵
- Executes dropped EXE
PID:3420 -
\??\c:\djpdj.exec:\djpdj.exe35⤵
- Executes dropped EXE
PID:4944 -
\??\c:\rrxrxxf.exec:\rrxrxxf.exe36⤵
- Executes dropped EXE
PID:4144 -
\??\c:\7lxflll.exec:\7lxflll.exe37⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hnhnnh.exec:\hnhnnh.exe38⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vvpjp.exec:\vvpjp.exe39⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xxllrlf.exec:\xxllrlf.exe40⤵
- Executes dropped EXE
PID:4388 -
\??\c:\thntbh.exec:\thntbh.exe41⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vvvvv.exec:\vvvvv.exe42⤵
- Executes dropped EXE
PID:3852 -
\??\c:\vvppj.exec:\vvppj.exe43⤵
- Executes dropped EXE
PID:544 -
\??\c:\xxrllff.exec:\xxrllff.exe44⤵
- Executes dropped EXE
PID:3632 -
\??\c:\bhhbbt.exec:\bhhbbt.exe45⤵
- Executes dropped EXE
PID:464 -
\??\c:\5vvpp.exec:\5vvpp.exe46⤵
- Executes dropped EXE
PID:2140 -
\??\c:\frllflf.exec:\frllflf.exe47⤵
- Executes dropped EXE
PID:4552 -
\??\c:\thtttn.exec:\thtttn.exe48⤵
- Executes dropped EXE
PID:3916 -
\??\c:\dpjvd.exec:\dpjvd.exe49⤵PID:1420
-
\??\c:\lxrxxxl.exec:\lxrxxxl.exe50⤵
- Executes dropped EXE
PID:3284 -
\??\c:\btbntt.exec:\btbntt.exe51⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vppjv.exec:\vppjv.exe52⤵
- Executes dropped EXE
PID:864 -
\??\c:\rlxlrrx.exec:\rlxlrrx.exe53⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ttbttt.exec:\ttbttt.exe54⤵
- Executes dropped EXE
PID:2984 -
\??\c:\bnbthh.exec:\bnbthh.exe55⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jjvpd.exec:\jjvpd.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\llfflll.exec:\llfflll.exe57⤵
- Executes dropped EXE
PID:4316 -
\??\c:\7ntbhn.exec:\7ntbhn.exe58⤵
- Executes dropped EXE
PID:1072 -
\??\c:\xxfxxfx.exec:\xxfxxfx.exe59⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bhhhbh.exec:\bhhhbh.exe60⤵
- Executes dropped EXE
PID:512 -
\??\c:\ntbthn.exec:\ntbthn.exe61⤵
- Executes dropped EXE
PID:832 -
\??\c:\dpjjd.exec:\dpjjd.exe62⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rrxfflf.exec:\rrxfflf.exe63⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nnhbhn.exec:\nnhbhn.exe64⤵
- Executes dropped EXE
PID:3920 -
\??\c:\djvpj.exec:\djvpj.exe65⤵
- Executes dropped EXE
PID:3148 -
\??\c:\xlrrfrr.exec:\xlrrfrr.exe66⤵
- Executes dropped EXE
PID:4908 -
\??\c:\tnbbbb.exec:\tnbbbb.exe67⤵PID:680
-
\??\c:\djvdj.exec:\djvdj.exe68⤵PID:2424
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe69⤵PID:4816
-
\??\c:\bntttt.exec:\bntttt.exe70⤵PID:2732
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe71⤵PID:708
-
\??\c:\bnbbtb.exec:\bnbbtb.exe72⤵PID:4612
-
\??\c:\jvvjd.exec:\jvvjd.exe73⤵PID:4064
-
\??\c:\1rlrfff.exec:\1rlrfff.exe74⤵PID:2696
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe75⤵PID:3128
-
\??\c:\9bntbb.exec:\9bntbb.exe76⤵PID:4052
-
\??\c:\vpdvj.exec:\vpdvj.exe77⤵PID:4684
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe78⤵PID:4332
-
\??\c:\bhbbhb.exec:\bhbbhb.exe79⤵PID:3548
-
\??\c:\djpjd.exec:\djpjd.exe80⤵PID:452
-
\??\c:\lxllflf.exec:\lxllflf.exe81⤵PID:1728
-
\??\c:\fxfffxf.exec:\fxfffxf.exe82⤵PID:5048
-
\??\c:\nnhhnn.exec:\nnhhnn.exe83⤵PID:3852
-
\??\c:\dpppp.exec:\dpppp.exe84⤵PID:3484
-
\??\c:\7rfffxr.exec:\7rfffxr.exe85⤵PID:3452
-
\??\c:\bhhttt.exec:\bhhttt.exe86⤵PID:4512
-
\??\c:\pjppp.exec:\pjppp.exe87⤵PID:4344
-
\??\c:\lrxrfxf.exec:\lrxrfxf.exe88⤵PID:4376
-
\??\c:\ffxxxxr.exec:\ffxxxxr.exe89⤵PID:1684
-
\??\c:\bnbtnn.exec:\bnbtnn.exe90⤵PID:4428
-
\??\c:\dpdvv.exec:\dpdvv.exe91⤵PID:4436
-
\??\c:\fxlffxx.exec:\fxlffxx.exe92⤵PID:1540
-
\??\c:\hbbhhb.exec:\hbbhhb.exe93⤵PID:1424
-
\??\c:\djvjd.exec:\djvjd.exe94⤵PID:2688
-
\??\c:\lflrrxr.exec:\lflrrxr.exe95⤵PID:2536
-
\??\c:\ttttbh.exec:\ttttbh.exe96⤵PID:4992
-
\??\c:\pjvpp.exec:\pjvpp.exe97⤵PID:4672
-
\??\c:\3llxrrl.exec:\3llxrrl.exe98⤵PID:864
-
\??\c:\rlxxffl.exec:\rlxxffl.exe99⤵PID:1088
-
\??\c:\dvvvp.exec:\dvvvp.exe100⤵PID:1872
-
\??\c:\lfffxrr.exec:\lfffxrr.exe101⤵PID:3208
-
\??\c:\3btbbh.exec:\3btbbh.exe102⤵PID:1448
-
\??\c:\5nbtnn.exec:\5nbtnn.exe103⤵PID:5032
-
\??\c:\djdpv.exec:\djdpv.exe104⤵PID:4316
-
\??\c:\9tbtnt.exec:\9tbtnt.exe105⤵PID:4424
-
\??\c:\htbttn.exec:\htbttn.exe106⤵PID:2168
-
\??\c:\vdvvv.exec:\vdvvv.exe107⤵PID:404
-
\??\c:\lxxfxxx.exec:\lxxfxxx.exe108⤵PID:3380
-
\??\c:\vppjd.exec:\vppjd.exe109⤵PID:3048
-
\??\c:\7pppj.exec:\7pppj.exe110⤵PID:2764
-
\??\c:\xrrlrrl.exec:\xrrlrrl.exe111⤵PID:1208
-
\??\c:\ttnntn.exec:\ttnntn.exe112⤵PID:3148
-
\??\c:\jdppp.exec:\jdppp.exe113⤵PID:2000
-
\??\c:\7rlllxf.exec:\7rlllxf.exe114⤵PID:680
-
\??\c:\rrlfllx.exec:\rrlfllx.exe115⤵PID:2424
-
\??\c:\bnnnnn.exec:\bnnnnn.exe116⤵PID:4816
-
\??\c:\djdjp.exec:\djdjp.exe117⤵PID:3708
-
\??\c:\9xxlrxf.exec:\9xxlrxf.exe118⤵PID:2596
-
\??\c:\1hhhbb.exec:\1hhhbb.exe119⤵PID:4404
-
\??\c:\vvddp.exec:\vvddp.exe120⤵PID:1532
-
\??\c:\rfxflxl.exec:\rfxflxl.exe121⤵PID:1100
-
\??\c:\bhhhhh.exec:\bhhhhh.exe122⤵PID:4848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-