Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:13
Behavioral task
behavioral1
Sample
0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe
-
Size
381KB
-
MD5
0324cd61c19561c3618a73220be611b0
-
SHA1
cf6c73403b1cc8ae1127ad44793618da872bc55d
-
SHA256
420e3d0bc65f5da8b1fd9973cc5e0dcb676f83a459e6713e8a7fb382273b9d30
-
SHA512
55fbbe5d85ba8d9005d2aef7fffd8ba5fa08ddda1f68150b5c18b613c07a80d8efcd8f589060ff05f78f094662dbf2652f06b50229d0b92124e39469385a12c0
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0IbswYTU:y4wFHoS3eFaKHpNKbbsweU
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/804-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3816-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-796-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-748-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3768-716-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-837-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-665-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1964-841-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1780-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-891-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1780-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-930-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/244-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
4200004.exelrfxlff.exe4068260.exehbtttt.exe606608.exe688648.exe26482.exe202862.exehhnbnh.exepjddv.exe268648.exennbbhh.exe3vpdp.exe6684882.exeq80426.exe266082.exe02004.exe7lxrlll.exeu408226.exexfxrlfx.exeu882004.exem2860.exenntnbn.exerxffxll.exe44246.exe286482.exe684006.exexlrllfx.exe4882004.exe066660.exejvvjv.exec686004.exe4464604.exexrxrrll.exe446888.exe204804.exexxxrfxl.exe2608200.exetnnhth.exehbthbt.exe844866.exevpddj.exelflfxfx.exe3vjvv.exerlxxxrl.exeo882664.exerlfxfxr.exe8468020.exerlrrlll.exek20044.exe42042.exehbhhbb.exe3xfrfxf.exeq44826.exepdjdv.exe6468622.exe20042.exe422400.exexlrlflf.exelrxxxrr.exe28820.exehtbnht.exettbthb.exe5rfrrll.exepid process 1212 4200004.exe 4400 lrfxlff.exe 3040 4068260.exe 224 hbtttt.exe 3056 606608.exe 2328 688648.exe 4800 26482.exe 3064 202862.exe 2884 hhnbnh.exe 1468 pjddv.exe 4884 268648.exe 244 nnbbhh.exe 3172 3vpdp.exe 964 6684882.exe 3680 q80426.exe 5032 266082.exe 4476 02004.exe 4628 7lxrlll.exe 4384 u408226.exe 4616 xfxrlfx.exe 1228 u882004.exe 3572 m2860.exe 4940 nntnbn.exe 3120 rxffxll.exe 2880 44246.exe 3588 286482.exe 3312 684006.exe 4932 xlrllfx.exe 4128 4882004.exe 4072 066660.exe 4652 jvvjv.exe 4428 c686004.exe 1944 4464604.exe 5064 xrxrrll.exe 2224 446888.exe 4252 204804.exe 1356 xxxrfxl.exe 2380 2608200.exe 3816 tnnhth.exe 4264 hbthbt.exe 3132 844866.exe 3216 vpddj.exe 4332 lflfxfx.exe 4064 3vjvv.exe 1888 rlxxxrl.exe 4040 o882664.exe 4896 rlfxfxr.exe 3944 8468020.exe 2552 rlrrlll.exe 4872 k20044.exe 3104 42042.exe 4116 hbhhbb.exe 3016 3xfrfxf.exe 3004 q44826.exe 1820 pdjdv.exe 640 6468622.exe 4856 20042.exe 3680 422400.exe 628 xlrlflf.exe 1332 lrxxxrr.exe 4628 28820.exe 4528 htbnht.exe 4864 ttbthb.exe 4588 5rfrrll.exe -
Processes:
resource yara_rule behavioral2/memory/804-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\4200004.exe upx behavioral2/memory/804-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1212-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrfxlff.exe upx C:\4068260.exe upx behavioral2/memory/4400-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbtttt.exe upx behavioral2/memory/224-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3040-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\606608.exe upx behavioral2/memory/3056-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2328-39-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\26482.exe upx \??\c:\202862.exe upx behavioral2/memory/2884-56-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhnbnh.exe upx behavioral2/memory/2884-62-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjddv.exe upx C:\268648.exe upx behavioral2/memory/4884-70-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3vpdp.exe upx behavioral2/memory/3172-81-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\6684882.exe upx \??\c:\q80426.exe upx C:\266082.exe upx behavioral2/memory/4476-104-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\u882004.exe upx behavioral2/memory/4616-123-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\m2860.exe upx \??\c:\nntnbn.exe upx \??\c:\rxffxll.exe upx behavioral2/memory/2880-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3312-161-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xlrllfx.exe upx behavioral2/memory/4072-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4652-187-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\c686004.exe upx behavioral2/memory/4428-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3816-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3132-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4064-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3944-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3680-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3988-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4356-364-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2624-440-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4800-524-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4440-560-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1028-577-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1564-584-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4048-598-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3460-603-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4920-601-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1780-684-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1692-706-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1624-749-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4464-796-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1780-815-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1468-748-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4860-717-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3768-716-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2264-837-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4152-665-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe4200004.exelrfxlff.exe4068260.exehbtttt.exe606608.exe688648.exe26482.exe202862.exehhnbnh.exepjddv.exe268648.exennbbhh.exe3vpdp.exe6684882.exeq80426.exe266082.exe02004.exe7lxrlll.exeu408226.exexfxrlfx.exeu882004.exedescription pid process target process PID 804 wrote to memory of 1212 804 0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe 4200004.exe PID 804 wrote to memory of 1212 804 0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe 4200004.exe PID 804 wrote to memory of 1212 804 0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe 4200004.exe PID 1212 wrote to memory of 4400 1212 4200004.exe lrfxlff.exe PID 1212 wrote to memory of 4400 1212 4200004.exe lrfxlff.exe PID 1212 wrote to memory of 4400 1212 4200004.exe lrfxlff.exe PID 4400 wrote to memory of 3040 4400 lrfxlff.exe 4068260.exe PID 4400 wrote to memory of 3040 4400 lrfxlff.exe 4068260.exe PID 4400 wrote to memory of 3040 4400 lrfxlff.exe 4068260.exe PID 3040 wrote to memory of 224 3040 4068260.exe hbtttt.exe PID 3040 wrote to memory of 224 3040 4068260.exe hbtttt.exe PID 3040 wrote to memory of 224 3040 4068260.exe hbtttt.exe PID 224 wrote to memory of 3056 224 hbtttt.exe 606608.exe PID 224 wrote to memory of 3056 224 hbtttt.exe 606608.exe PID 224 wrote to memory of 3056 224 hbtttt.exe 606608.exe PID 3056 wrote to memory of 2328 3056 606608.exe 688648.exe PID 3056 wrote to memory of 2328 3056 606608.exe 688648.exe PID 3056 wrote to memory of 2328 3056 606608.exe 688648.exe PID 2328 wrote to memory of 4800 2328 688648.exe 26482.exe PID 2328 wrote to memory of 4800 2328 688648.exe 26482.exe PID 2328 wrote to memory of 4800 2328 688648.exe 26482.exe PID 4800 wrote to memory of 3064 4800 26482.exe 202862.exe PID 4800 wrote to memory of 3064 4800 26482.exe 202862.exe PID 4800 wrote to memory of 3064 4800 26482.exe 202862.exe PID 3064 wrote to memory of 2884 3064 202862.exe hhnbnh.exe PID 3064 wrote to memory of 2884 3064 202862.exe hhnbnh.exe PID 3064 wrote to memory of 2884 3064 202862.exe hhnbnh.exe PID 2884 wrote to memory of 1468 2884 hhnbnh.exe BackgroundTransferHost.exe PID 2884 wrote to memory of 1468 2884 hhnbnh.exe BackgroundTransferHost.exe PID 2884 wrote to memory of 1468 2884 hhnbnh.exe BackgroundTransferHost.exe PID 1468 wrote to memory of 4884 1468 pjddv.exe 268648.exe PID 1468 wrote to memory of 4884 1468 pjddv.exe 268648.exe PID 1468 wrote to memory of 4884 1468 pjddv.exe 268648.exe PID 4884 wrote to memory of 244 4884 268648.exe nnbbhh.exe PID 4884 wrote to memory of 244 4884 268648.exe nnbbhh.exe PID 4884 wrote to memory of 244 4884 268648.exe nnbbhh.exe PID 244 wrote to memory of 3172 244 nnbbhh.exe 3vpdp.exe PID 244 wrote to memory of 3172 244 nnbbhh.exe 3vpdp.exe PID 244 wrote to memory of 3172 244 nnbbhh.exe 3vpdp.exe PID 3172 wrote to memory of 964 3172 3vpdp.exe xfxllxr.exe PID 3172 wrote to memory of 964 3172 3vpdp.exe xfxllxr.exe PID 3172 wrote to memory of 964 3172 3vpdp.exe xfxllxr.exe PID 964 wrote to memory of 3680 964 6684882.exe q80426.exe PID 964 wrote to memory of 3680 964 6684882.exe q80426.exe PID 964 wrote to memory of 3680 964 6684882.exe q80426.exe PID 3680 wrote to memory of 5032 3680 q80426.exe 266082.exe PID 3680 wrote to memory of 5032 3680 q80426.exe 266082.exe PID 3680 wrote to memory of 5032 3680 q80426.exe 266082.exe PID 5032 wrote to memory of 4476 5032 266082.exe 02004.exe PID 5032 wrote to memory of 4476 5032 266082.exe 02004.exe PID 5032 wrote to memory of 4476 5032 266082.exe 02004.exe PID 4476 wrote to memory of 4628 4476 02004.exe 7lxrlll.exe PID 4476 wrote to memory of 4628 4476 02004.exe 7lxrlll.exe PID 4476 wrote to memory of 4628 4476 02004.exe 7lxrlll.exe PID 4628 wrote to memory of 4384 4628 7lxrlll.exe u408226.exe PID 4628 wrote to memory of 4384 4628 7lxrlll.exe u408226.exe PID 4628 wrote to memory of 4384 4628 7lxrlll.exe u408226.exe PID 4384 wrote to memory of 4616 4384 u408226.exe xfxrlfx.exe PID 4384 wrote to memory of 4616 4384 u408226.exe xfxrlfx.exe PID 4384 wrote to memory of 4616 4384 u408226.exe xfxrlfx.exe PID 4616 wrote to memory of 1228 4616 xfxrlfx.exe u882004.exe PID 4616 wrote to memory of 1228 4616 xfxrlfx.exe u882004.exe PID 4616 wrote to memory of 1228 4616 xfxrlfx.exe u882004.exe PID 1228 wrote to memory of 3572 1228 u882004.exe m2860.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0324cd61c19561c3618a73220be611b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\4200004.exec:\4200004.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\lrfxlff.exec:\lrfxlff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\4068260.exec:\4068260.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\hbtttt.exec:\hbtttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\606608.exec:\606608.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\688648.exec:\688648.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\26482.exec:\26482.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\202862.exec:\202862.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hhnbnh.exec:\hhnbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\pjddv.exec:\pjddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\268648.exec:\268648.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\nnbbhh.exec:\nnbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\3vpdp.exec:\3vpdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\6684882.exec:\6684882.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\q80426.exec:\q80426.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\266082.exec:\266082.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\02004.exec:\02004.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\7lxrlll.exec:\7lxrlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\u408226.exec:\u408226.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\u882004.exec:\u882004.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\m2860.exec:\m2860.exe23⤵
- Executes dropped EXE
PID:3572 -
\??\c:\nntnbn.exec:\nntnbn.exe24⤵
- Executes dropped EXE
PID:4940 -
\??\c:\rxffxll.exec:\rxffxll.exe25⤵
- Executes dropped EXE
PID:3120 -
\??\c:\44246.exec:\44246.exe26⤵
- Executes dropped EXE
PID:2880 -
\??\c:\286482.exec:\286482.exe27⤵
- Executes dropped EXE
PID:3588 -
\??\c:\684006.exec:\684006.exe28⤵
- Executes dropped EXE
PID:3312 -
\??\c:\xlrllfx.exec:\xlrllfx.exe29⤵
- Executes dropped EXE
PID:4932 -
\??\c:\4882004.exec:\4882004.exe30⤵
- Executes dropped EXE
PID:4128 -
\??\c:\066660.exec:\066660.exe31⤵
- Executes dropped EXE
PID:4072 -
\??\c:\jvvjv.exec:\jvvjv.exe32⤵
- Executes dropped EXE
PID:4652 -
\??\c:\c686004.exec:\c686004.exe33⤵
- Executes dropped EXE
PID:4428 -
\??\c:\4464604.exec:\4464604.exe34⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xrxrrll.exec:\xrxrrll.exe35⤵
- Executes dropped EXE
PID:5064 -
\??\c:\446888.exec:\446888.exe36⤵
- Executes dropped EXE
PID:2224 -
\??\c:\204804.exec:\204804.exe37⤵
- Executes dropped EXE
PID:4252 -
\??\c:\xxxrfxl.exec:\xxxrfxl.exe38⤵
- Executes dropped EXE
PID:1356 -
\??\c:\2608200.exec:\2608200.exe39⤵
- Executes dropped EXE
PID:2380 -
\??\c:\tnnhth.exec:\tnnhth.exe40⤵
- Executes dropped EXE
PID:3816 -
\??\c:\hbthbt.exec:\hbthbt.exe41⤵
- Executes dropped EXE
PID:4264 -
\??\c:\844866.exec:\844866.exe42⤵
- Executes dropped EXE
PID:3132 -
\??\c:\vpddj.exec:\vpddj.exe43⤵
- Executes dropped EXE
PID:3216 -
\??\c:\lflfxfx.exec:\lflfxfx.exe44⤵
- Executes dropped EXE
PID:4332 -
\??\c:\3vjvv.exec:\3vjvv.exe45⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rlxxxrl.exec:\rlxxxrl.exe46⤵
- Executes dropped EXE
PID:1888 -
\??\c:\o882664.exec:\o882664.exe47⤵
- Executes dropped EXE
PID:4040 -
\??\c:\rlfxfxr.exec:\rlfxfxr.exe48⤵
- Executes dropped EXE
PID:4896 -
\??\c:\8468020.exec:\8468020.exe49⤵
- Executes dropped EXE
PID:3944 -
\??\c:\rlrrlll.exec:\rlrrlll.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\k20044.exec:\k20044.exe51⤵
- Executes dropped EXE
PID:4872 -
\??\c:\42042.exec:\42042.exe52⤵
- Executes dropped EXE
PID:3104 -
\??\c:\hbhhbb.exec:\hbhhbb.exe53⤵
- Executes dropped EXE
PID:4116 -
\??\c:\3xfrfxf.exec:\3xfrfxf.exe54⤵
- Executes dropped EXE
PID:3016 -
\??\c:\q44826.exec:\q44826.exe55⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pdjdv.exec:\pdjdv.exe56⤵
- Executes dropped EXE
PID:1820 -
\??\c:\6468622.exec:\6468622.exe57⤵
- Executes dropped EXE
PID:640 -
\??\c:\20042.exec:\20042.exe58⤵
- Executes dropped EXE
PID:4856 -
\??\c:\422400.exec:\422400.exe59⤵
- Executes dropped EXE
PID:3680 -
\??\c:\xlrlflf.exec:\xlrlflf.exe60⤵
- Executes dropped EXE
PID:628 -
\??\c:\lrxxxrr.exec:\lrxxxrr.exe61⤵
- Executes dropped EXE
PID:1332 -
\??\c:\28820.exec:\28820.exe62⤵
- Executes dropped EXE
PID:4628 -
\??\c:\htbnht.exec:\htbnht.exe63⤵
- Executes dropped EXE
PID:4528 -
\??\c:\ttbthb.exec:\ttbthb.exe64⤵
- Executes dropped EXE
PID:4864 -
\??\c:\5rfrrll.exec:\5rfrrll.exe65⤵
- Executes dropped EXE
PID:4588 -
\??\c:\lxxrllf.exec:\lxxrllf.exe66⤵PID:3436
-
\??\c:\2882048.exec:\2882048.exe67⤵PID:2696
-
\??\c:\ddvjd.exec:\ddvjd.exe68⤵PID:588
-
\??\c:\k80264.exec:\k80264.exe69⤵PID:4176
-
\??\c:\24604.exec:\24604.exe70⤵PID:4656
-
\??\c:\fxrlffx.exec:\fxrlffx.exe71⤵PID:396
-
\??\c:\642000.exec:\642000.exe72⤵PID:2376
-
\??\c:\280426.exec:\280426.exe73⤵PID:4848
-
\??\c:\m2664.exec:\m2664.exe74⤵PID:3356
-
\??\c:\hnthbt.exec:\hnthbt.exe75⤵PID:3988
-
\??\c:\rxlfxrx.exec:\rxlfxrx.exe76⤵PID:4080
-
\??\c:\06204.exec:\06204.exe77⤵PID:1032
-
\??\c:\622082.exec:\622082.exe78⤵PID:2308
-
\??\c:\200822.exec:\200822.exe79⤵PID:3412
-
\??\c:\bttnbt.exec:\bttnbt.exe80⤵PID:400
-
\??\c:\dvddj.exec:\dvddj.exe81⤵PID:3904
-
\??\c:\jvdpd.exec:\jvdpd.exe82⤵PID:548
-
\??\c:\thnhbt.exec:\thnhbt.exe83⤵PID:4252
-
\??\c:\pvvpv.exec:\pvvpv.exe84⤵PID:4356
-
\??\c:\3vpdv.exec:\3vpdv.exe85⤵PID:2380
-
\??\c:\vpjvj.exec:\vpjvj.exe86⤵PID:4776
-
\??\c:\vjvpp.exec:\vjvpp.exe87⤵PID:4612
-
\??\c:\vpjdv.exec:\vpjdv.exe88⤵PID:2868
-
\??\c:\frfxxxx.exec:\frfxxxx.exe89⤵PID:2688
-
\??\c:\2868028.exec:\2868028.exe90⤵PID:2576
-
\??\c:\7lrrlll.exec:\7lrrlll.exe91⤵PID:920
-
\??\c:\2626666.exec:\2626666.exe92⤵PID:1260
-
\??\c:\btnhnt.exec:\btnhnt.exe93⤵PID:792
-
\??\c:\2804260.exec:\2804260.exe94⤵PID:4772
-
\??\c:\42862.exec:\42862.exe95⤵PID:3160
-
\??\c:\40648.exec:\40648.exe96⤵PID:1520
-
\??\c:\hbbttb.exec:\hbbttb.exe97⤵PID:2612
-
\??\c:\42044.exec:\42044.exe98⤵PID:4872
-
\??\c:\048888.exec:\048888.exe99⤵PID:4936
-
\??\c:\frrxfrx.exec:\frrxfrx.exe100⤵PID:1168
-
\??\c:\428282.exec:\428282.exe101⤵PID:1780
-
\??\c:\66420.exec:\66420.exe102⤵PID:2812
-
\??\c:\3ttbtt.exec:\3ttbtt.exe103⤵PID:2748
-
\??\c:\frxlxxx.exec:\frxlxxx.exe104⤵PID:5056
-
\??\c:\rrfxxxf.exec:\rrfxxxf.exe105⤵PID:4832
-
\??\c:\frffxxr.exec:\frffxxr.exe106⤵PID:4528
-
\??\c:\40266.exec:\40266.exe107⤵PID:2624
-
\??\c:\7jjvp.exec:\7jjvp.exe108⤵PID:4460
-
\??\c:\4208888.exec:\4208888.exe109⤵PID:1692
-
\??\c:\6444888.exec:\6444888.exe110⤵PID:1564
-
\??\c:\2804222.exec:\2804222.exe111⤵PID:2844
-
\??\c:\8006204.exec:\8006204.exe112⤵PID:2548
-
\??\c:\6644408.exec:\6644408.exe113⤵PID:3184
-
\??\c:\ntbnbt.exec:\ntbnbt.exe114⤵PID:3472
-
\??\c:\448204.exec:\448204.exe115⤵PID:3492
-
\??\c:\ppvpd.exec:\ppvpd.exe116⤵PID:4932
-
\??\c:\2044088.exec:\2044088.exe117⤵PID:4128
-
\??\c:\2604866.exec:\2604866.exe118⤵PID:4652
-
\??\c:\4648480.exec:\4648480.exe119⤵PID:2808
-
\??\c:\4260482.exec:\4260482.exe120⤵PID:4428
-
\??\c:\4604224.exec:\4604224.exe121⤵PID:2588
-
\??\c:\06820.exec:\06820.exe122⤵PID:2604
-
\??\c:\22880.exec:\22880.exe123⤵PID:2224
-
\??\c:\dvvjp.exec:\dvvjp.exe124⤵PID:3592
-
\??\c:\8448226.exec:\8448226.exe125⤵PID:4956
-
\??\c:\86860.exec:\86860.exe126⤵PID:1356
-
\??\c:\466488.exec:\466488.exe127⤵PID:3424
-
\??\c:\lfxffff.exec:\lfxffff.exe128⤵PID:2380
-
\??\c:\ppvpd.exec:\ppvpd.exe129⤵PID:1284
-
\??\c:\9bhhbb.exec:\9bhhbb.exe130⤵PID:5064
-
\??\c:\0406666.exec:\0406666.exe131⤵PID:4764
-
\??\c:\22006.exec:\22006.exe132⤵PID:2688
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe133⤵PID:3228
-
\??\c:\28448.exec:\28448.exe134⤵PID:4800
-
\??\c:\bbnnhh.exec:\bbnnhh.exe135⤵PID:1888
-
\??\c:\thnhbb.exec:\thnhbb.exe136⤵PID:904
-
\??\c:\662666.exec:\662666.exe137⤵PID:2124
-
\??\c:\vdjvp.exec:\vdjvp.exe138⤵PID:4464
-
\??\c:\nbbtnh.exec:\nbbtnh.exe139⤵PID:3884
-
\??\c:\7xfxrrf.exec:\7xfxrrf.exe140⤵PID:4572
-
\??\c:\i880448.exec:\i880448.exe141⤵PID:4884
-
\??\c:\68080.exec:\68080.exe142⤵PID:2288
-
\??\c:\k84060.exec:\k84060.exe143⤵PID:1780
-
\??\c:\042862.exec:\042862.exe144⤵PID:2812
-
\??\c:\628644.exec:\628644.exe145⤵PID:4440
-
\??\c:\nbtnhn.exec:\nbtnhn.exe146⤵PID:5116
-
\??\c:\jjdvp.exec:\jjdvp.exe147⤵PID:316
-
\??\c:\82424.exec:\82424.exe148⤵PID:2440
-
\??\c:\k66448.exec:\k66448.exe149⤵PID:392
-
\??\c:\1nnhhh.exec:\1nnhhh.exe150⤵PID:1028
-
\??\c:\e00866.exec:\e00866.exe151⤵PID:1564
-
\??\c:\o282004.exec:\o282004.exe152⤵PID:4212
-
\??\c:\lfxxlrf.exec:\lfxxlrf.exe153⤵PID:3312
-
\??\c:\4068086.exec:\4068086.exe154⤵PID:2852
-
\??\c:\vjdjv.exec:\vjdjv.exe155⤵PID:4048
-
\??\c:\xlxrrxx.exec:\xlxrrxx.exe156⤵PID:3460
-
\??\c:\42488.exec:\42488.exe157⤵PID:4920
-
\??\c:\jvvvp.exec:\jvvvp.exe158⤵PID:4080
-
\??\c:\pdppv.exec:\pdppv.exe159⤵PID:3140
-
\??\c:\djdvp.exec:\djdvp.exe160⤵PID:2432
-
\??\c:\5tthbt.exec:\5tthbt.exe161⤵PID:2732
-
\??\c:\tbbnbt.exec:\tbbnbt.exe162⤵PID:4420
-
\??\c:\8028884.exec:\8028884.exe163⤵PID:2084
-
\??\c:\3nbhnh.exec:\3nbhnh.exe164⤵PID:4524
-
\??\c:\604888.exec:\604888.exe165⤵PID:4972
-
\??\c:\vvvpd.exec:\vvvpd.exe166⤵PID:3980
-
\??\c:\jjvdv.exec:\jjvdv.exe167⤵PID:1312
-
\??\c:\bbhbnt.exec:\bbhbnt.exe168⤵PID:1284
-
\??\c:\048066.exec:\048066.exe169⤵PID:5064
-
\??\c:\600826.exec:\600826.exe170⤵PID:4512
-
\??\c:\08200.exec:\08200.exe171⤵PID:2688
-
\??\c:\c008664.exec:\c008664.exe172⤵PID:3228
-
\??\c:\m0608.exec:\m0608.exe173⤵PID:4604
-
\??\c:\206000.exec:\206000.exe174⤵PID:1696
-
\??\c:\04020.exec:\04020.exe175⤵PID:2884
-
\??\c:\7xxrrxr.exec:\7xxrrxr.exe176⤵PID:4152
-
\??\c:\thnbbh.exec:\thnbbh.exe177⤵PID:2540
-
\??\c:\xlrfrff.exec:\xlrfrff.exe178⤵PID:4368
-
\??\c:\ppdjd.exec:\ppdjd.exe179⤵PID:4804
-
\??\c:\i264820.exec:\i264820.exe180⤵PID:4928
-
\??\c:\86624.exec:\86624.exe181⤵PID:4284
-
\??\c:\c886042.exec:\c886042.exe182⤵PID:1780
-
\??\c:\82028.exec:\82028.exe183⤵PID:2992
-
\??\c:\4204664.exec:\4204664.exe184⤵PID:1980
-
\??\c:\422048.exec:\422048.exe185⤵PID:3748
-
\??\c:\844260.exec:\844260.exe186⤵PID:4140
-
\??\c:\3bhtnt.exec:\3bhtnt.exe187⤵PID:2440
-
\??\c:\dvvpd.exec:\dvvpd.exe188⤵PID:392
-
\??\c:\6660882.exec:\6660882.exe189⤵PID:1692
-
\??\c:\260662.exec:\260662.exe190⤵PID:1564
-
\??\c:\28482.exec:\28482.exe191⤵PID:3768
-
\??\c:\dvpjj.exec:\dvpjj.exe192⤵PID:4860
-
\??\c:\426808.exec:\426808.exe193⤵PID:3436
-
\??\c:\i220860.exec:\i220860.exe194⤵PID:4048
-
\??\c:\3pjvj.exec:\3pjvj.exe195⤵PID:4448
-
\??\c:\20044.exec:\20044.exe196⤵PID:4920
-
\??\c:\4620264.exec:\4620264.exe197⤵PID:4424
-
\??\c:\62608.exec:\62608.exe198⤵PID:4608
-
\??\c:\3xfrfxr.exec:\3xfrfxr.exe199⤵PID:4248
-
\??\c:\g8086.exec:\g8086.exe200⤵PID:1432
-
\??\c:\42208.exec:\42208.exe201⤵PID:1468
-
\??\c:\lfrfrlf.exec:\lfrfrlf.exe202⤵PID:1624
-
\??\c:\6046660.exec:\6046660.exe203⤵PID:3212
-
\??\c:\9vvpj.exec:\9vvpj.exe204⤵PID:4276
-
\??\c:\062042.exec:\062042.exe205⤵PID:4852
-
\??\c:\02862.exec:\02862.exe206⤵PID:2604
-
\??\c:\jdjjv.exec:\jdjjv.exe207⤵PID:2476
-
\??\c:\i882048.exec:\i882048.exe208⤵PID:2488
-
\??\c:\s2448.exec:\s2448.exe209⤵PID:5076
-
\??\c:\006644.exec:\006644.exe210⤵PID:4456
-
\??\c:\rxfrfxl.exec:\rxfrfxl.exe211⤵PID:3056
-
\??\c:\4020426.exec:\4020426.exe212⤵PID:2576
-
\??\c:\s0642.exec:\s0642.exe213⤵PID:1904
-
\??\c:\lxxlxrr.exec:\lxxlxrr.exe214⤵PID:1888
-
\??\c:\2448608.exec:\2448608.exe215⤵PID:792
-
\??\c:\0060048.exec:\0060048.exe216⤵PID:4744
-
\??\c:\djjvj.exec:\djjvj.exe217⤵PID:4464
-
\??\c:\fxllxxx.exec:\fxllxxx.exe218⤵PID:3884
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe219⤵PID:4876
-
\??\c:\1thtth.exec:\1thtth.exe220⤵PID:1820
-
\??\c:\xfxrffx.exec:\xfxrffx.exe221⤵PID:1972
-
\??\c:\e00860.exec:\e00860.exe222⤵PID:1756
-
\??\c:\842802.exec:\842802.exe223⤵PID:3120
-
\??\c:\btthtn.exec:\btthtn.exe224⤵PID:1780
-
\??\c:\086082.exec:\086082.exe225⤵PID:4792
-
\??\c:\4604220.exec:\4604220.exe226⤵PID:5116
-
\??\c:\httnhh.exec:\httnhh.exe227⤵PID:316
-
\??\c:\426082.exec:\426082.exe228⤵PID:2904
-
\??\c:\ddpjd.exec:\ddpjd.exe229⤵PID:2440
-
\??\c:\hhthhh.exec:\hhthhh.exe230⤵PID:3588
-
\??\c:\884026.exec:\884026.exe231⤵PID:2264
-
\??\c:\rxfxrrf.exec:\rxfxrrf.exe232⤵PID:1964
-
\??\c:\tbhbnh.exec:\tbhbnh.exe233⤵PID:4020
-
\??\c:\xlxrfrl.exec:\xlxrfrl.exe234⤵PID:384
-
\??\c:\llflfxf.exec:\llflfxf.exe235⤵PID:4656
-
\??\c:\260246.exec:\260246.exe236⤵PID:3472
-
\??\c:\rxrllfx.exec:\rxrllfx.exe237⤵PID:4984
-
\??\c:\vpvpj.exec:\vpvpj.exe238⤵PID:3408
-
\??\c:\8602004.exec:\8602004.exe239⤵PID:3460
-
\??\c:\1dpdd.exec:\1dpdd.exe240⤵PID:3372
-
\??\c:\rffxxrr.exec:\rffxxrr.exe241⤵PID:1168
-
\??\c:\8066006.exec:\8066006.exe242⤵PID:4740