Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 20:47
Behavioral task
behavioral1
Sample
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe
-
Size
254KB
-
MD5
4cc21ab451f8f8ba1862e95f3977c0e0
-
SHA1
33da8a716a5756c789e17595065f20ee30b236b0
-
SHA256
1f04d652f7389508674478ae21ebbbec3edc2081d328903f1c1bbfcb9cba3c62
-
SHA512
602e42d43df03cf77a19a4bfe2209b91bd2310654196d22b4433d72411f1f8d667b4073c5236dee00dd5ca3b8266da379141ae705b8aaf5ffa23ad9ff0545714
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpolTjZXvEQo9dfrS:y4wFHoS3eFaKHpKT9XvEhdfrS
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3340-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1732-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/688-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1108-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2000-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-621-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-625-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-648-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-734-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-783-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-802-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-818-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-1008-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-1126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppddp.exellxrrfl.exebtthtb.exepdjpp.exe5xlrlrl.exedjjjp.exehbhhth.exexrlfrlx.exehhbbtb.exefxflrrr.exevjdvp.exerrrrxlf.exejpvpj.exexlllrrl.exepdvjv.exeffrlfll.exepvppv.exexrxfrlf.exebtnhtn.exepvjvp.exe9flfxxr.exe1dppd.exexxlrrrr.exetnntnb.exe1vppd.exetnhbnh.exenhtnnn.exeflxrrrr.exehbbthb.exepppvp.exefxffllr.exehbbhnn.exerxrffrf.exettnhbb.exejdpjd.exerxrfxlx.exebntnhn.exevdjpj.exepjdjp.exe1rxrlfx.exehnnnhb.exeflfrllx.exe9bbtnn.exe3bhbbb.exevjddp.exelflrrlr.exebhhhtt.exeddvpp.exefffxrrl.exehnnhbt.exe3pddd.exeflrxrxx.exethhbtt.exepdvpd.exedvvpj.exelfllffx.exehthbtn.exepjvvj.exe5llrlfx.exebhthhh.exejdvvd.exelxffxrf.exe3rllxxl.exehbnhbb.exepid process 3340 ppddp.exe 1736 llxrrfl.exe 1732 btthtb.exe 1220 pdjpp.exe 4668 5xlrlrl.exe 4052 djjjp.exe 2992 hbhhth.exe 4260 xrlfrlx.exe 4760 hhbbtb.exe 812 fxflrrr.exe 4240 vjdvp.exe 3624 rrrrxlf.exe 2032 jpvpj.exe 2132 xlllrrl.exe 2316 pdvjv.exe 688 ffrlfll.exe 3700 pvppv.exe 4732 xrxfrlf.exe 4012 btnhtn.exe 1472 pvjvp.exe 532 9flfxxr.exe 1380 1dppd.exe 452 xxlrrrr.exe 1152 tnntnb.exe 4884 1vppd.exe 1812 tnhbnh.exe 2452 nhtnnn.exe 4928 flxrrrr.exe 3428 hbbthb.exe 1904 pppvp.exe 5096 fxffllr.exe 3240 hbbhnn.exe 3260 rxrffrf.exe 1008 ttnhbb.exe 5004 jdpjd.exe 1940 rxrfxlx.exe 3892 bntnhn.exe 3340 vdjpj.exe 3200 pjdjp.exe 3172 1rxrlfx.exe 2340 hnnnhb.exe 536 flfrllx.exe 4500 9bbtnn.exe 1372 3bhbbb.exe 1412 vjddp.exe 2892 lflrrlr.exe 3052 bhhhtt.exe 3592 ddvpp.exe 4580 fffxrrl.exe 660 hnnhbt.exe 4364 3pddd.exe 3624 flrxrxx.exe 2008 thhbtt.exe 2132 pdvpd.exe 2676 dvvpj.exe 2448 lfllffx.exe 2444 hthbtn.exe 2884 pjvvj.exe 3316 5llrlfx.exe 2472 bhthhh.exe 1108 jdvvd.exe 4084 lxffxrf.exe 2496 3rllxxl.exe 1692 hbnhbb.exe -
Processes:
resource yara_rule behavioral2/memory/4916-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ppddp.exe upx behavioral2/memory/3340-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llxrrfl.exe upx behavioral2/memory/1736-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1732-19-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btthtb.exe upx C:\pdjpp.exe upx behavioral2/memory/1220-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5xlrlrl.exe upx behavioral2/memory/4916-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4668-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djjjp.exe upx behavioral2/memory/4668-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhhth.exe upx behavioral2/memory/4260-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2992-48-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrlfrlx.exe upx C:\hhbbtb.exe upx behavioral2/memory/4260-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxflrrr.exe upx behavioral2/memory/4760-59-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjdvp.exe upx behavioral2/memory/812-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrrxlf.exe upx behavioral2/memory/4240-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3624-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpvpj.exe upx C:\xlllrrl.exe upx behavioral2/memory/2032-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvjv.exe upx behavioral2/memory/2132-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffrlfll.exe upx behavioral2/memory/2316-95-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvppv.exe upx behavioral2/memory/688-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxfrlf.exe upx behavioral2/memory/3700-106-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnhtn.exe upx behavioral2/memory/4732-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4012-118-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvjvp.exe upx \??\c:\9flfxxr.exe upx C:\1dppd.exe upx behavioral2/memory/1380-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/532-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1380-135-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlrrrr.exe upx behavioral2/memory/452-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnntnb.exe upx behavioral2/memory/1152-145-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1vppd.exe upx \??\c:\tnhbnh.exe upx \??\c:\nhtnnn.exe upx C:\flxrrrr.exe upx C:\hbbthb.exe upx behavioral2/memory/3428-170-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pppvp.exe upx behavioral2/memory/3428-174-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxffllr.exe upx C:\hbbhnn.exe upx behavioral2/memory/3240-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3260-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1008-196-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exeppddp.exellxrrfl.exebtthtb.exepdjpp.exe5xlrlrl.exedjjjp.exehbhhth.exexrlfrlx.exehhbbtb.exefxflrrr.exevjdvp.exerrrrxlf.exejpvpj.exexlllrrl.exepdvjv.exeffrlfll.exepvppv.exexrxfrlf.exebtnhtn.exepvjvp.exe9flfxxr.exedescription pid process target process PID 4916 wrote to memory of 3340 4916 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe ppddp.exe PID 4916 wrote to memory of 3340 4916 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe ppddp.exe PID 4916 wrote to memory of 3340 4916 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe ppddp.exe PID 3340 wrote to memory of 1736 3340 ppddp.exe llxrrfl.exe PID 3340 wrote to memory of 1736 3340 ppddp.exe llxrrfl.exe PID 3340 wrote to memory of 1736 3340 ppddp.exe llxrrfl.exe PID 1736 wrote to memory of 1732 1736 llxrrfl.exe btthtb.exe PID 1736 wrote to memory of 1732 1736 llxrrfl.exe btthtb.exe PID 1736 wrote to memory of 1732 1736 llxrrfl.exe btthtb.exe PID 1732 wrote to memory of 1220 1732 btthtb.exe pdjpp.exe PID 1732 wrote to memory of 1220 1732 btthtb.exe pdjpp.exe PID 1732 wrote to memory of 1220 1732 btthtb.exe pdjpp.exe PID 1220 wrote to memory of 4668 1220 pdjpp.exe 5xlrlrl.exe PID 1220 wrote to memory of 4668 1220 pdjpp.exe 5xlrlrl.exe PID 1220 wrote to memory of 4668 1220 pdjpp.exe 5xlrlrl.exe PID 4668 wrote to memory of 4052 4668 5xlrlrl.exe djjjp.exe PID 4668 wrote to memory of 4052 4668 5xlrlrl.exe djjjp.exe PID 4668 wrote to memory of 4052 4668 5xlrlrl.exe djjjp.exe PID 4052 wrote to memory of 2992 4052 djjjp.exe hbhhth.exe PID 4052 wrote to memory of 2992 4052 djjjp.exe hbhhth.exe PID 4052 wrote to memory of 2992 4052 djjjp.exe hbhhth.exe PID 2992 wrote to memory of 4260 2992 hbhhth.exe xrlfrlx.exe PID 2992 wrote to memory of 4260 2992 hbhhth.exe xrlfrlx.exe PID 2992 wrote to memory of 4260 2992 hbhhth.exe xrlfrlx.exe PID 4260 wrote to memory of 4760 4260 xrlfrlx.exe hhbbtb.exe PID 4260 wrote to memory of 4760 4260 xrlfrlx.exe hhbbtb.exe PID 4260 wrote to memory of 4760 4260 xrlfrlx.exe hhbbtb.exe PID 4760 wrote to memory of 812 4760 hhbbtb.exe fxflrrr.exe PID 4760 wrote to memory of 812 4760 hhbbtb.exe fxflrrr.exe PID 4760 wrote to memory of 812 4760 hhbbtb.exe fxflrrr.exe PID 812 wrote to memory of 4240 812 fxflrrr.exe vjdvp.exe PID 812 wrote to memory of 4240 812 fxflrrr.exe vjdvp.exe PID 812 wrote to memory of 4240 812 fxflrrr.exe vjdvp.exe PID 4240 wrote to memory of 3624 4240 vjdvp.exe rrrrxlf.exe PID 4240 wrote to memory of 3624 4240 vjdvp.exe rrrrxlf.exe PID 4240 wrote to memory of 3624 4240 vjdvp.exe rrrrxlf.exe PID 3624 wrote to memory of 2032 3624 rrrrxlf.exe jpvpj.exe PID 3624 wrote to memory of 2032 3624 rrrrxlf.exe jpvpj.exe PID 3624 wrote to memory of 2032 3624 rrrrxlf.exe jpvpj.exe PID 2032 wrote to memory of 2132 2032 jpvpj.exe xlllrrl.exe PID 2032 wrote to memory of 2132 2032 jpvpj.exe xlllrrl.exe PID 2032 wrote to memory of 2132 2032 jpvpj.exe xlllrrl.exe PID 2132 wrote to memory of 2316 2132 xlllrrl.exe pdvjv.exe PID 2132 wrote to memory of 2316 2132 xlllrrl.exe pdvjv.exe PID 2132 wrote to memory of 2316 2132 xlllrrl.exe pdvjv.exe PID 2316 wrote to memory of 688 2316 pdvjv.exe ffrlfll.exe PID 2316 wrote to memory of 688 2316 pdvjv.exe ffrlfll.exe PID 2316 wrote to memory of 688 2316 pdvjv.exe ffrlfll.exe PID 688 wrote to memory of 3700 688 ffrlfll.exe pvppv.exe PID 688 wrote to memory of 3700 688 ffrlfll.exe pvppv.exe PID 688 wrote to memory of 3700 688 ffrlfll.exe pvppv.exe PID 3700 wrote to memory of 4732 3700 pvppv.exe xrxfrlf.exe PID 3700 wrote to memory of 4732 3700 pvppv.exe xrxfrlf.exe PID 3700 wrote to memory of 4732 3700 pvppv.exe xrxfrlf.exe PID 4732 wrote to memory of 4012 4732 xrxfrlf.exe btnhtn.exe PID 4732 wrote to memory of 4012 4732 xrxfrlf.exe btnhtn.exe PID 4732 wrote to memory of 4012 4732 xrxfrlf.exe btnhtn.exe PID 4012 wrote to memory of 1472 4012 btnhtn.exe pvjvp.exe PID 4012 wrote to memory of 1472 4012 btnhtn.exe pvjvp.exe PID 4012 wrote to memory of 1472 4012 btnhtn.exe pvjvp.exe PID 1472 wrote to memory of 532 1472 pvjvp.exe 9flfxxr.exe PID 1472 wrote to memory of 532 1472 pvjvp.exe 9flfxxr.exe PID 1472 wrote to memory of 532 1472 pvjvp.exe 9flfxxr.exe PID 532 wrote to memory of 1380 532 9flfxxr.exe 1dppd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\ppddp.exec:\ppddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\llxrrfl.exec:\llxrrfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\btthtb.exec:\btthtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\pdjpp.exec:\pdjpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\5xlrlrl.exec:\5xlrlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\djjjp.exec:\djjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\hbhhth.exec:\hbhhth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\xrlfrlx.exec:\xrlfrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\hhbbtb.exec:\hhbbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\fxflrrr.exec:\fxflrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\vjdvp.exec:\vjdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\rrrrxlf.exec:\rrrrxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\jpvpj.exec:\jpvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\xlllrrl.exec:\xlllrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\pdvjv.exec:\pdvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\ffrlfll.exec:\ffrlfll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\pvppv.exec:\pvppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\xrxfrlf.exec:\xrxfrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\btnhtn.exec:\btnhtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\pvjvp.exec:\pvjvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\9flfxxr.exec:\9flfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\1dppd.exec:\1dppd.exe23⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xxlrrrr.exec:\xxlrrrr.exe24⤵
- Executes dropped EXE
PID:452 -
\??\c:\tnntnb.exec:\tnntnb.exe25⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1vppd.exec:\1vppd.exe26⤵
- Executes dropped EXE
PID:4884 -
\??\c:\tnhbnh.exec:\tnhbnh.exe27⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nhtnnn.exec:\nhtnnn.exe28⤵
- Executes dropped EXE
PID:2452 -
\??\c:\flxrrrr.exec:\flxrrrr.exe29⤵
- Executes dropped EXE
PID:4928 -
\??\c:\hbbthb.exec:\hbbthb.exe30⤵
- Executes dropped EXE
PID:3428 -
\??\c:\pppvp.exec:\pppvp.exe31⤵
- Executes dropped EXE
PID:1904 -
\??\c:\fxffllr.exec:\fxffllr.exe32⤵
- Executes dropped EXE
PID:5096 -
\??\c:\hbbhnn.exec:\hbbhnn.exe33⤵
- Executes dropped EXE
PID:3240 -
\??\c:\rxrffrf.exec:\rxrffrf.exe34⤵
- Executes dropped EXE
PID:3260 -
\??\c:\ttnhbb.exec:\ttnhbb.exe35⤵
- Executes dropped EXE
PID:1008 -
\??\c:\jdpjd.exec:\jdpjd.exe36⤵
- Executes dropped EXE
PID:5004 -
\??\c:\rxrfxlx.exec:\rxrfxlx.exe37⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bntnhn.exec:\bntnhn.exe38⤵
- Executes dropped EXE
PID:3892 -
\??\c:\vdjpj.exec:\vdjpj.exe39⤵
- Executes dropped EXE
PID:3340 -
\??\c:\pjdjp.exec:\pjdjp.exe40⤵
- Executes dropped EXE
PID:3200 -
\??\c:\1rxrlfx.exec:\1rxrlfx.exe41⤵
- Executes dropped EXE
PID:3172 -
\??\c:\hnnnhb.exec:\hnnnhb.exe42⤵
- Executes dropped EXE
PID:2340 -
\??\c:\flfrllx.exec:\flfrllx.exe43⤵
- Executes dropped EXE
PID:536 -
\??\c:\9bbtnn.exec:\9bbtnn.exe44⤵
- Executes dropped EXE
PID:4500 -
\??\c:\3bhbbb.exec:\3bhbbb.exe45⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vjddp.exec:\vjddp.exe46⤵
- Executes dropped EXE
PID:1412 -
\??\c:\lflrrlr.exec:\lflrrlr.exe47⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bhhhtt.exec:\bhhhtt.exe48⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ddvpp.exec:\ddvpp.exe49⤵
- Executes dropped EXE
PID:3592 -
\??\c:\fffxrrl.exec:\fffxrrl.exe50⤵
- Executes dropped EXE
PID:4580 -
\??\c:\hnnhbt.exec:\hnnhbt.exe51⤵
- Executes dropped EXE
PID:660 -
\??\c:\3pddd.exec:\3pddd.exe52⤵
- Executes dropped EXE
PID:4364 -
\??\c:\flrxrxx.exec:\flrxrxx.exe53⤵
- Executes dropped EXE
PID:3624 -
\??\c:\thhbtt.exec:\thhbtt.exe54⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pdvpd.exec:\pdvpd.exe55⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dvvpj.exec:\dvvpj.exe56⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lfllffx.exec:\lfllffx.exe57⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hthbtn.exec:\hthbtn.exe58⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pjvvj.exec:\pjvvj.exe59⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5llrlfx.exec:\5llrlfx.exe60⤵
- Executes dropped EXE
PID:3316 -
\??\c:\bhthhh.exec:\bhthhh.exe61⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jdvvd.exec:\jdvvd.exe62⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lxffxrf.exec:\lxffxrf.exe63⤵
- Executes dropped EXE
PID:4084 -
\??\c:\3rllxxl.exec:\3rllxxl.exe64⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hbnhbb.exec:\hbnhbb.exe65⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vjdvp.exec:\vjdvp.exe66⤵PID:3640
-
\??\c:\flxrxrf.exec:\flxrxrf.exe67⤵PID:4584
-
\??\c:\hhnhbt.exec:\hhnhbt.exe68⤵PID:3352
-
\??\c:\rxffrxr.exec:\rxffrxr.exe69⤵PID:4884
-
\??\c:\btbnht.exec:\btbnht.exe70⤵PID:5036
-
\??\c:\jpjjd.exec:\jpjjd.exe71⤵PID:4208
-
\??\c:\vpvvp.exec:\vpvvp.exe72⤵PID:3308
-
\??\c:\xrrllxr.exec:\xrrllxr.exe73⤵PID:4784
-
\??\c:\7nbbtt.exec:\7nbbtt.exe74⤵PID:2000
-
\??\c:\pddjj.exec:\pddjj.exe75⤵PID:1120
-
\??\c:\pjddp.exec:\pjddp.exe76⤵PID:1984
-
\??\c:\jpjvp.exec:\jpjvp.exe77⤵PID:2400
-
\??\c:\frxrxlr.exec:\frxrxlr.exe78⤵PID:3260
-
\??\c:\3ntthb.exec:\3ntthb.exe79⤵PID:3028
-
\??\c:\nnnbht.exec:\nnnbht.exe80⤵PID:3784
-
\??\c:\vpdjv.exec:\vpdjv.exe81⤵PID:3720
-
\??\c:\frlrlrx.exec:\frlrlrx.exe82⤵PID:236
-
\??\c:\tthbnn.exec:\tthbnn.exe83⤵PID:2580
-
\??\c:\dvvvv.exec:\dvvvv.exe84⤵PID:3972
-
\??\c:\rrrlxxl.exec:\rrrlxxl.exe85⤵PID:3628
-
\??\c:\bnnhbt.exec:\bnnhbt.exe86⤵PID:1836
-
\??\c:\vvdjd.exec:\vvdjd.exe87⤵PID:972
-
\??\c:\9xxxxff.exec:\9xxxxff.exe88⤵PID:3504
-
\??\c:\hntbbt.exec:\hntbbt.exe89⤵PID:4500
-
\??\c:\3tbbtb.exec:\3tbbtb.exe90⤵PID:1684
-
\??\c:\vvpjv.exec:\vvpjv.exe91⤵PID:3336
-
\??\c:\lxrlflx.exec:\lxrlflx.exe92⤵PID:3364
-
\??\c:\fxlllxr.exec:\fxlllxr.exe93⤵PID:2680
-
\??\c:\nnbhnt.exec:\nnbhnt.exe94⤵PID:1428
-
\??\c:\jpdvp.exec:\jpdvp.exe95⤵PID:3076
-
\??\c:\rlxxfrr.exec:\rlxxfrr.exe96⤵PID:3184
-
\??\c:\rrrrfrl.exec:\rrrrfrl.exe97⤵PID:2616
-
\??\c:\tnbnbb.exec:\tnbnbb.exe98⤵PID:440
-
\??\c:\jdjvv.exec:\jdjvv.exe99⤵PID:1004
-
\??\c:\5fxxxxx.exec:\5fxxxxx.exe100⤵PID:3880
-
\??\c:\3fffrlf.exec:\3fffrlf.exe101⤵PID:3600
-
\??\c:\bhbbtt.exec:\bhbbtt.exe102⤵PID:2548
-
\??\c:\ppvjv.exec:\ppvjv.exe103⤵PID:4740
-
\??\c:\pvpjd.exec:\pvpjd.exe104⤵PID:4600
-
\??\c:\xxrrfll.exec:\xxrrfll.exe105⤵PID:3536
-
\??\c:\hbhhhh.exec:\hbhhhh.exe106⤵PID:1920
-
\??\c:\pddpv.exec:\pddpv.exe107⤵PID:2052
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe108⤵PID:1152
-
\??\c:\bnnhbt.exec:\bnnhbt.exe109⤵PID:944
-
\??\c:\jvjdd.exec:\jvjdd.exe110⤵PID:4380
-
\??\c:\rrrlffx.exec:\rrrlffx.exe111⤵PID:2844
-
\??\c:\3frrlfr.exec:\3frrlfr.exe112⤵PID:960
-
\??\c:\pvdvp.exec:\pvdvp.exe113⤵PID:3308
-
\??\c:\tnbnbt.exec:\tnbnbt.exe114⤵PID:4784
-
\??\c:\thhhbt.exec:\thhhbt.exe115⤵PID:2000
-
\??\c:\9jjdv.exec:\9jjdv.exe116⤵PID:4716
-
\??\c:\rlffrlf.exec:\rlffrlf.exe117⤵PID:3104
-
\??\c:\bbbthb.exec:\bbbthb.exe118⤵PID:2596
-
\??\c:\vjjdv.exec:\vjjdv.exe119⤵PID:1492
-
\??\c:\9rxrffx.exec:\9rxrffx.exe120⤵PID:4964
-
\??\c:\llxxrrl.exec:\llxxrrl.exe121⤵PID:5028
-
\??\c:\bnhbnn.exec:\bnhbnn.exe122⤵PID:3720
-
\??\c:\thtnnt.exec:\thtnnt.exe123⤵PID:236
-
\??\c:\htnhhh.exec:\htnhhh.exe124⤵PID:2580
-
\??\c:\dpjjv.exec:\dpjjv.exe125⤵PID:2336
-
\??\c:\rrfrrlf.exec:\rrfrrlf.exe126⤵PID:3628
-
\??\c:\9bhbtn.exec:\9bhbtn.exe127⤵PID:1836
-
\??\c:\7jpjd.exec:\7jpjd.exe128⤵PID:1408
-
\??\c:\dpdjv.exec:\dpdjv.exe129⤵PID:212
-
\??\c:\flrlfxx.exec:\flrlfxx.exe130⤵PID:1916
-
\??\c:\nthbbh.exec:\nthbbh.exe131⤵PID:732
-
\??\c:\nbbhht.exec:\nbbhht.exe132⤵PID:4944
-
\??\c:\rflxrxx.exec:\rflxrxx.exe133⤵PID:5020
-
\??\c:\1nhhbb.exec:\1nhhbb.exe134⤵PID:3052
-
\??\c:\tnbbht.exec:\tnbbht.exe135⤵PID:872
-
\??\c:\djpdd.exec:\djpdd.exe136⤵PID:4580
-
\??\c:\lflxrrl.exec:\lflxrrl.exe137⤵PID:3288
-
\??\c:\xrrrrfl.exec:\xrrrrfl.exe138⤵PID:2032
-
\??\c:\7nhbbb.exec:\7nhbbb.exe139⤵PID:3212
-
\??\c:\jdjvj.exec:\jdjvj.exe140⤵PID:1484
-
\??\c:\fflfxfr.exec:\fflfxfr.exe141⤵PID:4764
-
\??\c:\lfllxxr.exec:\lfllxxr.exe142⤵PID:3908
-
\??\c:\bhnhhh.exec:\bhnhhh.exe143⤵PID:4732
-
\??\c:\djvpj.exec:\djvpj.exe144⤵PID:4608
-
\??\c:\ddjdd.exec:\ddjdd.exe145⤵PID:532
-
\??\c:\frrfxlf.exec:\frrfxlf.exe146⤵PID:452
-
\??\c:\llffrlx.exec:\llffrlx.exe147⤵PID:2880
-
\??\c:\htnhbb.exec:\htnhbb.exe148⤵PID:1764
-
\??\c:\9bhtnn.exec:\9bhtnn.exe149⤵PID:4888
-
\??\c:\dpvpd.exec:\dpvpd.exe150⤵PID:4188
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe151⤵PID:2452
-
\??\c:\rfrrlxr.exec:\rfrrlxr.exe152⤵PID:100
-
\??\c:\bhbnhn.exec:\bhbnhn.exe153⤵PID:3516
-
\??\c:\jdddd.exec:\jdddd.exe154⤵PID:4104
-
\??\c:\3vjdd.exec:\3vjdd.exe155⤵PID:1120
-
\??\c:\rrxflrr.exec:\rrxflrr.exe156⤵PID:4720
-
\??\c:\lrlfrlx.exec:\lrlfrlx.exe157⤵PID:3224
-
\??\c:\hbhhbb.exec:\hbhhbb.exe158⤵PID:3164
-
\??\c:\dpdvp.exec:\dpdvp.exe159⤵PID:1008
-
\??\c:\pjpjd.exec:\pjpjd.exe160⤵PID:2212
-
\??\c:\5rlxlxx.exec:\5rlxlxx.exe161⤵PID:3784
-
\??\c:\htbbtb.exec:\htbbtb.exe162⤵PID:1168
-
\??\c:\9nbbtt.exec:\9nbbtt.exe163⤵PID:1568
-
\??\c:\jdjvv.exec:\jdjvv.exe164⤵PID:4976
-
\??\c:\ddpdd.exec:\ddpdd.exe165⤵PID:2340
-
\??\c:\xlxflxf.exec:\xlxflxf.exe166⤵PID:1476
-
\??\c:\nnbbtn.exec:\nnbbtn.exe167⤵PID:2332
-
\??\c:\tnbbtt.exec:\tnbbtt.exe168⤵PID:4052
-
\??\c:\pvjdj.exec:\pvjdj.exe169⤵PID:3188
-
\??\c:\jjjdv.exec:\jjjdv.exe170⤵PID:3952
-
\??\c:\frxlrfr.exec:\frxlrfr.exe171⤵PID:2064
-
\??\c:\bnnhhn.exec:\bnnhhn.exe172⤵PID:1412
-
\??\c:\pjpdd.exec:\pjpdd.exe173⤵PID:1180
-
\??\c:\3xfxffr.exec:\3xfxffr.exe174⤵PID:3052
-
\??\c:\9bnhnn.exec:\9bnhnn.exe175⤵PID:1840
-
\??\c:\vjjdd.exec:\vjjdd.exe176⤵PID:1888
-
\??\c:\pvppj.exec:\pvppj.exe177⤵PID:4752
-
\??\c:\flxfxrl.exec:\flxfxrl.exe178⤵PID:4452
-
\??\c:\llxlflf.exec:\llxlflf.exe179⤵PID:4168
-
\??\c:\7bbtnn.exec:\7bbtnn.exe180⤵PID:2676
-
\??\c:\5jpjp.exec:\5jpjp.exe181⤵PID:1004
-
\??\c:\rlxxxff.exec:\rlxxxff.exe182⤵PID:3276
-
\??\c:\ffxxxff.exec:\ffxxxff.exe183⤵PID:4764
-
\??\c:\nbbhbb.exec:\nbbhbb.exe184⤵PID:3816
-
\??\c:\ddppp.exec:\ddppp.exe185⤵PID:4740
-
\??\c:\dvvpp.exec:\dvvpp.exe186⤵PID:3536
-
\??\c:\5rxxrrr.exec:\5rxxrrr.exe187⤵PID:1692
-
\??\c:\9thhbb.exec:\9thhbb.exe188⤵PID:3248
-
\??\c:\vvjvv.exec:\vvjvv.exe189⤵PID:1620
-
\??\c:\ddjjd.exec:\ddjjd.exe190⤵PID:3552
-
\??\c:\9xfxrrr.exec:\9xfxrrr.exe191⤵PID:2916
-
\??\c:\nnbbtn.exec:\nnbbtn.exe192⤵PID:4784
-
\??\c:\tthhbb.exec:\tthhbb.exe193⤵PID:816
-
\??\c:\jddvj.exec:\jddvj.exe194⤵PID:4592
-
\??\c:\xlxfxlx.exec:\xlxfxlx.exe195⤵PID:2400
-
\??\c:\nbnnhb.exec:\nbnnhb.exe196⤵PID:4980
-
\??\c:\1ddvd.exec:\1ddvd.exe197⤵PID:5004
-
\??\c:\xlrlllx.exec:\xlrlllx.exe198⤵PID:4916
-
\??\c:\rrxlxxl.exec:\rrxlxxl.exe199⤵PID:3024
-
\??\c:\bthttn.exec:\bthttn.exe200⤵PID:1732
-
\??\c:\vpjdv.exec:\vpjdv.exe201⤵PID:3708
-
\??\c:\dvvpp.exec:\dvvpp.exe202⤵PID:3976
-
\??\c:\xlrxflx.exec:\xlrxflx.exe203⤵PID:536
-
\??\c:\5hntbn.exec:\5hntbn.exe204⤵PID:1572
-
\??\c:\ntnhtt.exec:\ntnhtt.exe205⤵PID:1132
-
\??\c:\jvpvp.exec:\jvpvp.exe206⤵PID:1228
-
\??\c:\rxlxrlf.exec:\rxlxrlf.exe207⤵PID:2992
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe208⤵PID:808
-
\??\c:\3hhbtt.exec:\3hhbtt.exe209⤵PID:3296
-
\??\c:\vvvvv.exec:\vvvvv.exe210⤵PID:3952
-
\??\c:\vpvvj.exec:\vpvvj.exe211⤵PID:2064
-
\??\c:\lrxrfrr.exec:\lrxrfrr.exe212⤵PID:1412
-
\??\c:\bbttnt.exec:\bbttnt.exe213⤵PID:1180
-
\??\c:\hhbhnb.exec:\hhbhnb.exe214⤵PID:3052
-
\??\c:\jppvv.exec:\jppvv.exe215⤵PID:1840
-
\??\c:\frfxxlf.exec:\frfxxlf.exe216⤵PID:4580
-
\??\c:\ntnttb.exec:\ntnttb.exe217⤵PID:336
-
\??\c:\ttbnhb.exec:\ttbnhb.exe218⤵PID:4452
-
\??\c:\vvdpd.exec:\vvdpd.exe219⤵PID:796
-
\??\c:\lllflxr.exec:\lllflxr.exe220⤵PID:3880
-
\??\c:\7nnhbh.exec:\7nnhbh.exe221⤵PID:3576
-
\??\c:\hhbhbb.exec:\hhbhbb.exe222⤵PID:3276
-
\??\c:\jdvpv.exec:\jdvpv.exe223⤵PID:4764
-
\??\c:\llrxllf.exec:\llrxllf.exe224⤵PID:4772
-
\??\c:\5thbhn.exec:\5thbhn.exe225⤵PID:3536
-
\??\c:\hhtntt.exec:\hhtntt.exe226⤵PID:2920
-
\??\c:\1vdjd.exec:\1vdjd.exe227⤵PID:4928
-
\??\c:\dpddd.exec:\dpddd.exe228⤵PID:3760
-
\??\c:\ffrfrrl.exec:\ffrfrrl.exe229⤵PID:3308
-
\??\c:\nbbthn.exec:\nbbthn.exe230⤵PID:4508
-
\??\c:\1bhbnn.exec:\1bhbnn.exe231⤵PID:4104
-
\??\c:\vvjpv.exec:\vvjpv.exe232⤵PID:560
-
\??\c:\1vjdj.exec:\1vjdj.exe233⤵PID:4716
-
\??\c:\xflfxxx.exec:\xflfxxx.exe234⤵PID:3048
-
\??\c:\nhhbbt.exec:\nhhbbt.exe235⤵PID:3164
-
\??\c:\jpvpj.exec:\jpvpj.exe236⤵PID:1752
-
\??\c:\fllrxxf.exec:\fllrxxf.exe237⤵PID:2212
-
\??\c:\fxllrlr.exec:\fxllrlr.exe238⤵PID:4828
-
\??\c:\tbhttt.exec:\tbhttt.exe239⤵PID:3200
-
\??\c:\jdpjp.exec:\jdpjp.exe240⤵PID:1220
-
\??\c:\jppdd.exec:\jppdd.exe241⤵PID:4976
-
\??\c:\fxfxlrx.exec:\fxfxlrx.exe242⤵PID:2128