Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 22:27
Behavioral task
behavioral1
Sample
4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe
-
Size
377KB
-
MD5
4be88a026ee47c31eff2af36841ac3e0
-
SHA1
84e4e91c84329949ee391be72b031318b7884473
-
SHA256
3f296e1123ddf547e990523a12274705d7307fcbfa55887892e65e0320221717
-
SHA512
32cb35d6750f31dd2f85475eccb92843bfec10f5ea4f29f2638b5187446c09d9c887c80e17468edf65d7af9160a5bc995a42d5a311a73d293a85d11673758fc0
-
SSDEEP
6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7N:/4wFHoSA4KofHfHTXQLzgvnzHPowYbv0
Malware Config
Signatures
-
Detect Blackmoon payload 61 IoCs
Processes:
resource yara_rule behavioral1/memory/2344-9-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2760-122-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2760-131-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/848-184-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2008-213-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2904-329-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2572-344-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2660-394-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1860-423-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1316-439-0x00000000003A0000-0x0000000000400000-memory.dmp family_blackmoon behavioral1/memory/748-487-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/928-502-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/564-529-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2036-562-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2888-585-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1152-574-0x0000000000250000-0x00000000002B0000-memory.dmp family_blackmoon behavioral1/memory/1676-570-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/572-555-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/768-548-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/332-509-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/924-494-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2052-479-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2100-472-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1984-465-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1316-432-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2732-431-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2484-416-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2268-401-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1856-387-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2476-366-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2444-365-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1672-336-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1028-322-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2344-315-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2188-307-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1136-297-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/572-288-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/340-278-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/952-269-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1404-260-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/544-250-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/808-239-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/644-229-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2100-203-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/3064-193-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1348-175-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/792-150-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1824-121-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2936-111-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2936-108-0x0000000000560000-0x00000000005C0000-memory.dmp family_blackmoon behavioral1/memory/2488-100-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2468-90-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2448-79-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2448-80-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2260-71-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2620-61-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2620-60-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2552-51-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1812-40-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2836-29-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2276-20-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxrfrfr.exe9ffrrrr.exerrlrflr.exebthntb.exepvvjp.exettbbnt.exejdddj.exefffxlfx.exetnhtbh.exepjdpv.exelxfrfrl.exehbtbhh.exe1pddd.exejvvvv.exefrrxlrl.exebntntt.exe3jvdp.exe7xxfrlf.exerrlrffr.exetntnhn.exe9dvdp.exedvpvj.exe1fxflfx.exefrffrrl.exeppdjp.exe1pddd.exelxlfrff.exevvjvd.exexlxflrr.exebbhhth.exevpjvj.exedvjpv.exe3htnnn.exehhhhtb.exejvvjv.exerlxlrrf.exerlflrrx.exenhbhnt.exepjdjv.exefrxflxf.exefrfffxf.exehhbbhh.exevpdjp.exedvpvp.exerlffllf.exehhtbnt.exehntthh.exevjdjp.exelxrxflf.exetttbhn.exedvvdd.exelfrrxfr.exexxrrxxl.exehbhnbh.exe9dvdj.exedvpvd.exe5frrxxf.exe5fxlxrf.exebhbhhb.exe1vvdp.exexlrrrrx.exerxffrxr.exehhbbth.exejjvdv.exepid process 2276 xxrfrfr.exe 2836 9ffrrrr.exe 1812 rrlrflr.exe 2552 bthntb.exe 2620 pvvjp.exe 2260 ttbbnt.exe 2448 jdddj.exe 2468 fffxlfx.exe 2488 tnhtbh.exe 2936 pjdpv.exe 1824 lxfrfrl.exe 2760 hbtbhh.exe 1528 1pddd.exe 792 jvvvv.exe 1316 frrxlrl.exe 2756 bntntt.exe 1348 3jvdp.exe 848 7xxfrlf.exe 3064 rrlrffr.exe 2100 tntnhn.exe 2008 9dvdp.exe 748 dvpvj.exe 644 1fxflfx.exe 808 frffrrl.exe 352 ppdjp.exe 544 1pddd.exe 1404 lxlfrff.exe 952 vvjvd.exe 340 xlxflrr.exe 572 bbhhth.exe 1136 vpjvj.exe 2188 dvjpv.exe 2344 3htnnn.exe 1028 hhhhtb.exe 2904 jvvjv.exe 1672 rlxlrrf.exe 2572 rlflrrx.exe 2788 nhbhnt.exe 2784 pjdjv.exe 2444 frxflxf.exe 2476 frfffxf.exe 2544 hhbbhh.exe 1856 vpdjp.exe 2660 dvpvp.exe 2268 rlffllf.exe 948 hhtbnt.exe 2484 hntthh.exe 1860 vjdjp.exe 2732 lxrxflf.exe 1316 tttbhn.exe 1444 dvvdd.exe 1392 lfrrxfr.exe 2960 xxrrxxl.exe 1984 hbhnbh.exe 2100 9dvdj.exe 2052 dvpvd.exe 748 5frrxxf.exe 924 5fxlxrf.exe 928 bhbhhb.exe 332 1vvdp.exe 756 xlrrrrx.exe 1404 rxffrxr.exe 564 hhbbth.exe 2280 jjvdv.exe -
Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
Processes:
resource yara_rule C:\xxrfrfr.exe molebox \??\c:\pvvjp.exe molebox \??\c:\ttbbnt.exe molebox \??\c:\jdddj.exe molebox \??\c:\fffxlfx.exe molebox \??\c:\lxfrfrl.exe molebox \??\c:\frrxlrl.exe molebox C:\bntntt.exe molebox \??\c:\3jvdp.exe molebox \??\c:\frffrrl.exe molebox C:\ppdjp.exe molebox C:\1pddd.exe molebox \??\c:\lxlfrff.exe molebox C:\vvjvd.exe molebox C:\bbhhth.exe molebox \??\c:\dvjpv.exe molebox C:\3htnnn.exe molebox \??\c:\vpjvj.exe molebox \??\c:\xlxflrr.exe molebox \??\c:\1fxflfx.exe molebox \??\c:\dvpvj.exe molebox \??\c:\9dvdp.exe molebox \??\c:\tntnhn.exe molebox \??\c:\rrlrffr.exe molebox \??\c:\7xxfrlf.exe molebox \??\c:\jvvvv.exe molebox \??\c:\hbtbhh.exe molebox \??\c:\pjdpv.exe molebox \??\c:\tnhtbh.exe molebox \??\c:\bthntb.exe molebox \??\c:\rrlrflr.exe molebox \??\c:\9ffrrrr.exe molebox -
Processes:
resource yara_rule behavioral1/memory/2344-0-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\xxrfrfr.exe upx behavioral1/memory/2344-9-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2276-11-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2344-8-0x0000000000460000-0x00000000004C0000-memory.dmp upx behavioral1/memory/2344-7-0x0000000000460000-0x00000000004C0000-memory.dmp upx \??\c:\pvvjp.exe upx behavioral1/memory/2260-62-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\ttbbnt.exe upx \??\c:\jdddj.exe upx behavioral1/memory/2448-72-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\fffxlfx.exe upx behavioral1/memory/2936-102-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\lxfrfrl.exe upx behavioral1/memory/2760-122-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2760-131-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\frrxlrl.exe upx C:\bntntt.exe upx \??\c:\3jvdp.exe upx behavioral1/memory/848-184-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2100-195-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2008-213-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\frffrrl.exe upx C:\ppdjp.exe upx C:\1pddd.exe upx \??\c:\lxlfrff.exe upx C:\vvjvd.exe upx C:\bbhhth.exe upx \??\c:\dvjpv.exe upx behavioral1/memory/2904-329-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2572-344-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2788-347-0x0000000001CB0000-0x0000000001D10000-memory.dmp upx behavioral1/memory/2444-358-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2544-373-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1856-380-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2660-394-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/948-402-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1860-423-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1316-439-0x00000000003A0000-0x0000000000400000-memory.dmp upx behavioral1/memory/748-480-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/748-487-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/928-495-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/928-502-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1404-516-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/564-529-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2036-562-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2148-586-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2888-585-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1152-571-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1676-570-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1676-565-0x0000000000220000-0x0000000000280000-memory.dmp upx behavioral1/memory/572-555-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/768-548-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/332-509-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/928-501-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/924-494-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2052-479-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2100-472-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1984-465-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1984-458-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1316-432-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2732-431-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2732-424-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2484-416-0x0000000000400000-0x0000000000460000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exexxrfrfr.exe9ffrrrr.exerrlrflr.exebthntb.exepvvjp.exettbbnt.exejdddj.exefffxlfx.exetnhtbh.exepjdpv.exelxfrfrl.exehbtbhh.exe1pddd.exejvvvv.exefrrxlrl.exedescription pid process target process PID 2344 wrote to memory of 2276 2344 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe xxrfrfr.exe PID 2344 wrote to memory of 2276 2344 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe xxrfrfr.exe PID 2344 wrote to memory of 2276 2344 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe xxrfrfr.exe PID 2344 wrote to memory of 2276 2344 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe xxrfrfr.exe PID 2276 wrote to memory of 2836 2276 xxrfrfr.exe 9ffrrrr.exe PID 2276 wrote to memory of 2836 2276 xxrfrfr.exe 9ffrrrr.exe PID 2276 wrote to memory of 2836 2276 xxrfrfr.exe 9ffrrrr.exe PID 2276 wrote to memory of 2836 2276 xxrfrfr.exe 9ffrrrr.exe PID 2836 wrote to memory of 1812 2836 9ffrrrr.exe rrlrflr.exe PID 2836 wrote to memory of 1812 2836 9ffrrrr.exe rrlrflr.exe PID 2836 wrote to memory of 1812 2836 9ffrrrr.exe rrlrflr.exe PID 2836 wrote to memory of 1812 2836 9ffrrrr.exe rrlrflr.exe PID 1812 wrote to memory of 2552 1812 rrlrflr.exe bthntb.exe PID 1812 wrote to memory of 2552 1812 rrlrflr.exe bthntb.exe PID 1812 wrote to memory of 2552 1812 rrlrflr.exe bthntb.exe PID 1812 wrote to memory of 2552 1812 rrlrflr.exe bthntb.exe PID 2552 wrote to memory of 2620 2552 bthntb.exe xxrfxll.exe PID 2552 wrote to memory of 2620 2552 bthntb.exe xxrfxll.exe PID 2552 wrote to memory of 2620 2552 bthntb.exe xxrfxll.exe PID 2552 wrote to memory of 2620 2552 bthntb.exe xxrfxll.exe PID 2620 wrote to memory of 2260 2620 pvvjp.exe ttbbnt.exe PID 2620 wrote to memory of 2260 2620 pvvjp.exe ttbbnt.exe PID 2620 wrote to memory of 2260 2620 pvvjp.exe ttbbnt.exe PID 2620 wrote to memory of 2260 2620 pvvjp.exe ttbbnt.exe PID 2260 wrote to memory of 2448 2260 ttbbnt.exe jdddj.exe PID 2260 wrote to memory of 2448 2260 ttbbnt.exe jdddj.exe PID 2260 wrote to memory of 2448 2260 ttbbnt.exe jdddj.exe PID 2260 wrote to memory of 2448 2260 ttbbnt.exe jdddj.exe PID 2448 wrote to memory of 2468 2448 jdddj.exe fffxlfx.exe PID 2448 wrote to memory of 2468 2448 jdddj.exe fffxlfx.exe PID 2448 wrote to memory of 2468 2448 jdddj.exe fffxlfx.exe PID 2448 wrote to memory of 2468 2448 jdddj.exe fffxlfx.exe PID 2468 wrote to memory of 2488 2468 fffxlfx.exe tnhtbh.exe PID 2468 wrote to memory of 2488 2468 fffxlfx.exe tnhtbh.exe PID 2468 wrote to memory of 2488 2468 fffxlfx.exe tnhtbh.exe PID 2468 wrote to memory of 2488 2468 fffxlfx.exe tnhtbh.exe PID 2488 wrote to memory of 2936 2488 tnhtbh.exe pjdpv.exe PID 2488 wrote to memory of 2936 2488 tnhtbh.exe pjdpv.exe PID 2488 wrote to memory of 2936 2488 tnhtbh.exe pjdpv.exe PID 2488 wrote to memory of 2936 2488 tnhtbh.exe pjdpv.exe PID 2936 wrote to memory of 1824 2936 pjdpv.exe lxfrfrl.exe PID 2936 wrote to memory of 1824 2936 pjdpv.exe lxfrfrl.exe PID 2936 wrote to memory of 1824 2936 pjdpv.exe lxfrfrl.exe PID 2936 wrote to memory of 1824 2936 pjdpv.exe lxfrfrl.exe PID 1824 wrote to memory of 2760 1824 lxfrfrl.exe hbtbhh.exe PID 1824 wrote to memory of 2760 1824 lxfrfrl.exe hbtbhh.exe PID 1824 wrote to memory of 2760 1824 lxfrfrl.exe hbtbhh.exe PID 1824 wrote to memory of 2760 1824 lxfrfrl.exe hbtbhh.exe PID 2760 wrote to memory of 1528 2760 hbtbhh.exe 1pddd.exe PID 2760 wrote to memory of 1528 2760 hbtbhh.exe 1pddd.exe PID 2760 wrote to memory of 1528 2760 hbtbhh.exe 1pddd.exe PID 2760 wrote to memory of 1528 2760 hbtbhh.exe 1pddd.exe PID 1528 wrote to memory of 792 1528 1pddd.exe jvvvv.exe PID 1528 wrote to memory of 792 1528 1pddd.exe jvvvv.exe PID 1528 wrote to memory of 792 1528 1pddd.exe jvvvv.exe PID 1528 wrote to memory of 792 1528 1pddd.exe jvvvv.exe PID 792 wrote to memory of 1316 792 jvvvv.exe tttbhn.exe PID 792 wrote to memory of 1316 792 jvvvv.exe tttbhn.exe PID 792 wrote to memory of 1316 792 jvvvv.exe tttbhn.exe PID 792 wrote to memory of 1316 792 jvvvv.exe tttbhn.exe PID 1316 wrote to memory of 2756 1316 frrxlrl.exe bntntt.exe PID 1316 wrote to memory of 2756 1316 frrxlrl.exe bntntt.exe PID 1316 wrote to memory of 2756 1316 frrxlrl.exe bntntt.exe PID 1316 wrote to memory of 2756 1316 frrxlrl.exe bntntt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\xxrfrfr.exec:\xxrfrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\9ffrrrr.exec:\9ffrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rrlrflr.exec:\rrlrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\bthntb.exec:\bthntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\pvvjp.exec:\pvvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ttbbnt.exec:\ttbbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\jdddj.exec:\jdddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\fffxlfx.exec:\fffxlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\tnhtbh.exec:\tnhtbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\pjdpv.exec:\pjdpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lxfrfrl.exec:\lxfrfrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\hbtbhh.exec:\hbtbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\1pddd.exec:\1pddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\jvvvv.exec:\jvvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\frrxlrl.exec:\frrxlrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\bntntt.exec:\bntntt.exe17⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3jvdp.exec:\3jvdp.exe18⤵
- Executes dropped EXE
PID:1348 -
\??\c:\7xxfrlf.exec:\7xxfrlf.exe19⤵
- Executes dropped EXE
PID:848 -
\??\c:\rrlrffr.exec:\rrlrffr.exe20⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tntnhn.exec:\tntnhn.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\9dvdp.exec:\9dvdp.exe22⤵
- Executes dropped EXE
PID:2008 -
\??\c:\dvpvj.exec:\dvpvj.exe23⤵
- Executes dropped EXE
PID:748 -
\??\c:\1fxflfx.exec:\1fxflfx.exe24⤵
- Executes dropped EXE
PID:644 -
\??\c:\frffrrl.exec:\frffrrl.exe25⤵
- Executes dropped EXE
PID:808 -
\??\c:\ppdjp.exec:\ppdjp.exe26⤵
- Executes dropped EXE
PID:352 -
\??\c:\1pddd.exec:\1pddd.exe27⤵
- Executes dropped EXE
PID:544 -
\??\c:\lxlfrff.exec:\lxlfrff.exe28⤵
- Executes dropped EXE
PID:1404 -
\??\c:\vvjvd.exec:\vvjvd.exe29⤵
- Executes dropped EXE
PID:952 -
\??\c:\xlxflrr.exec:\xlxflrr.exe30⤵
- Executes dropped EXE
PID:340 -
\??\c:\bbhhth.exec:\bbhhth.exe31⤵
- Executes dropped EXE
PID:572 -
\??\c:\vpjvj.exec:\vpjvj.exe32⤵
- Executes dropped EXE
PID:1136 -
\??\c:\dvjpv.exec:\dvjpv.exe33⤵
- Executes dropped EXE
PID:2188 -
\??\c:\3htnnn.exec:\3htnnn.exe34⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hhhhtb.exec:\hhhhtb.exe35⤵
- Executes dropped EXE
PID:1028 -
\??\c:\jvvjv.exec:\jvvjv.exe36⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rlxlrrf.exec:\rlxlrrf.exe37⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rlflrrx.exec:\rlflrrx.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nhbhnt.exec:\nhbhnt.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pjdjv.exec:\pjdjv.exe40⤵
- Executes dropped EXE
PID:2784 -
\??\c:\frxflxf.exec:\frxflxf.exe41⤵
- Executes dropped EXE
PID:2444 -
\??\c:\frfffxf.exec:\frfffxf.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hhbbhh.exec:\hhbbhh.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vpdjp.exec:\vpdjp.exe44⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dvpvp.exec:\dvpvp.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rlffllf.exec:\rlffllf.exe46⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hhtbnt.exec:\hhtbnt.exe47⤵
- Executes dropped EXE
PID:948 -
\??\c:\hntthh.exec:\hntthh.exe48⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vjdjp.exec:\vjdjp.exe49⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lxrxflf.exec:\lxrxflf.exe50⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tttbhn.exec:\tttbhn.exe51⤵
- Executes dropped EXE
PID:1316 -
\??\c:\dvvdd.exec:\dvvdd.exe52⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe53⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe54⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hbhnbh.exec:\hbhnbh.exe55⤵
- Executes dropped EXE
PID:1984 -
\??\c:\9dvdj.exec:\9dvdj.exe56⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dvpvd.exec:\dvpvd.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5frrxxf.exec:\5frrxxf.exe58⤵
- Executes dropped EXE
PID:748 -
\??\c:\5fxlxrf.exec:\5fxlxrf.exe59⤵
- Executes dropped EXE
PID:924 -
\??\c:\bhbhhb.exec:\bhbhhb.exe60⤵
- Executes dropped EXE
PID:928 -
\??\c:\1vvdp.exec:\1vvdp.exe61⤵
- Executes dropped EXE
PID:332 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe62⤵
- Executes dropped EXE
PID:756 -
\??\c:\rxffrxr.exec:\rxffrxr.exe63⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hhbbth.exec:\hhbbth.exe64⤵
- Executes dropped EXE
PID:564 -
\??\c:\jjvdv.exec:\jjvdv.exe65⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vpdjv.exec:\vpdjv.exe66⤵PID:1412
-
\??\c:\frlrrxl.exec:\frlrrxl.exe67⤵PID:768
-
\??\c:\7xrrxxf.exec:\7xrrxxf.exe68⤵PID:572
-
\??\c:\tbbntb.exec:\tbbntb.exe69⤵PID:2036
-
\??\c:\9pvvd.exec:\9pvvd.exe70⤵PID:1676
-
\??\c:\pvjjp.exec:\pvjjp.exe71⤵PID:1152
-
\??\c:\xlxxlff.exec:\xlxxlff.exe72⤵PID:2888
-
\??\c:\nnntbh.exec:\nnntbh.exe73⤵PID:2148
-
\??\c:\7hbnhb.exec:\7hbnhb.exe74⤵PID:2776
-
\??\c:\pdpvd.exec:\pdpvd.exe75⤵PID:1672
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe76⤵PID:2552
-
\??\c:\rflrffl.exec:\rflrffl.exe77⤵PID:2788
-
\??\c:\tnbhtt.exec:\tnbhtt.exe78⤵PID:2784
-
\??\c:\vpvdj.exec:\vpvdj.exe79⤵PID:2408
-
\??\c:\vpjjv.exec:\vpjjv.exe80⤵PID:2468
-
\??\c:\3frrxxf.exec:\3frrxxf.exe81⤵PID:2644
-
\??\c:\bntbhh.exec:\bntbhh.exe82⤵PID:2984
-
\??\c:\nhtbnb.exec:\nhtbnb.exe83⤵PID:2660
-
\??\c:\ppvdj.exec:\ppvdj.exe84⤵PID:2308
-
\??\c:\7pppv.exec:\7pppv.exe85⤵PID:2992
-
\??\c:\fxrlrxf.exec:\fxrlrxf.exe86⤵PID:2668
-
\??\c:\bhnbtb.exec:\bhnbtb.exe87⤵PID:2376
-
\??\c:\7thhnn.exec:\7thhnn.exe88⤵PID:1260
-
\??\c:\dvjpd.exec:\dvjpd.exe89⤵PID:2756
-
\??\c:\vpjjv.exec:\vpjjv.exe90⤵PID:2064
-
\??\c:\rlrxlrl.exec:\rlrxlrl.exe91⤵PID:848
-
\??\c:\flxrlxl.exec:\flxrlxl.exe92⤵PID:2860
-
\??\c:\btnhbb.exec:\btnhbb.exe93⤵PID:2108
-
\??\c:\5pdpp.exec:\5pdpp.exe94⤵PID:528
-
\??\c:\7frrrrf.exec:\7frrrrf.exe95⤵PID:1432
-
\??\c:\5fxrxxx.exec:\5fxrxxx.exe96⤵PID:584
-
\??\c:\5bbntb.exec:\5bbntb.exe97⤵PID:2300
-
\??\c:\hnhbhh.exec:\hnhbhh.exe98⤵PID:924
-
\??\c:\pvdvv.exec:\pvdvv.exe99⤵PID:1016
-
\??\c:\xxxrflf.exec:\xxxrflf.exe100⤵PID:1968
-
\??\c:\xxxrlxl.exec:\xxxrlxl.exe101⤵PID:1764
-
\??\c:\bthnth.exec:\bthnth.exe102⤵PID:1096
-
\??\c:\7hhhnt.exec:\7hhhnt.exe103⤵PID:2556
-
\??\c:\9dddp.exec:\9dddp.exe104⤵PID:2040
-
\??\c:\vppvv.exec:\vppvv.exe105⤵PID:340
-
\??\c:\fxxflxl.exec:\fxxflxl.exe106⤵PID:2248
-
\??\c:\ffllrxr.exec:\ffllrxr.exe107⤵PID:1136
-
\??\c:\bhbnbn.exec:\bhbnbn.exe108⤵PID:1876
-
\??\c:\htbtbb.exec:\htbtbb.exe109⤵PID:2188
-
\??\c:\dpvpd.exec:\dpvpd.exe110⤵PID:1112
-
\??\c:\5lrlxfx.exec:\5lrlxfx.exe111⤵PID:1664
-
\??\c:\fllllfx.exec:\fllllfx.exe112⤵PID:2356
-
\??\c:\ttbthb.exec:\ttbthb.exe113⤵PID:2396
-
\??\c:\9btbhh.exec:\9btbhh.exe114⤵PID:1612
-
\??\c:\3dvvj.exec:\3dvvj.exe115⤵PID:2632
-
\??\c:\5jjdj.exec:\5jjdj.exe116⤵PID:1240
-
\??\c:\rxxlfxx.exec:\rxxlfxx.exe117⤵PID:2932
-
\??\c:\llxlxfr.exec:\llxlxfr.exe118⤵PID:2692
-
\??\c:\bbtthn.exec:\bbtthn.exe119⤵PID:2944
-
\??\c:\nnnhtn.exec:\nnnhtn.exe120⤵PID:2448
-
\??\c:\3jvjv.exec:\3jvjv.exe121⤵PID:2784
-
\??\c:\xlxrrxl.exec:\xlxrrxl.exe122⤵PID:2424
-
\??\c:\3rxrrrx.exec:\3rxrrrx.exe123⤵PID:1640
-
\??\c:\hhnhnn.exec:\hhnhnn.exe124⤵PID:1728
-
\??\c:\tnttnn.exec:\tnttnn.exe125⤵PID:2636
-
\??\c:\pdjpv.exec:\pdjpv.exe126⤵PID:2936
-
\??\c:\lrlfllr.exec:\lrlfllr.exe127⤵PID:2348
-
\??\c:\lxlrlfl.exec:\lxlrlfl.exe128⤵PID:2900
-
\??\c:\7hbntb.exec:\7hbntb.exe129⤵PID:1992
-
\??\c:\bnbhhb.exec:\bnbhhb.exe130⤵PID:2484
-
\??\c:\7pddj.exec:\7pddj.exe131⤵PID:2724
-
\??\c:\jddvd.exec:\jddvd.exe132⤵PID:2708
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe133⤵PID:2740
-
\??\c:\3rfrrxf.exec:\3rfrrxf.exe134⤵PID:2472
-
\??\c:\5nthbn.exec:\5nthbn.exe135⤵PID:2304
-
\??\c:\5thbht.exec:\5thbht.exe136⤵PID:2128
-
\??\c:\5ppdp.exec:\5ppdp.exe137⤵PID:2432
-
\??\c:\flllflr.exec:\flllflr.exe138⤵PID:1716
-
\??\c:\lllxfxl.exec:\lllxfxl.exe139⤵PID:2600
-
\??\c:\5xrrfxf.exec:\5xrrfxf.exe140⤵PID:2108
-
\??\c:\9nnnnn.exec:\9nnnnn.exe141⤵PID:2008
-
\??\c:\vpdpv.exec:\vpdpv.exe142⤵PID:1432
-
\??\c:\ddjvd.exec:\ddjvd.exe143⤵PID:584
-
\??\c:\xxlllrx.exec:\xxlllrx.exe144⤵PID:2300
-
\??\c:\xrlxxfx.exec:\xrlxxfx.exe145⤵PID:924
-
\??\c:\bhhhtb.exec:\bhhhtb.exe146⤵PID:1016
-
\??\c:\9hntbn.exec:\9hntbn.exe147⤵PID:1968
-
\??\c:\dpjpv.exec:\dpjpv.exe148⤵PID:1764
-
\??\c:\vpppd.exec:\vpppd.exe149⤵PID:1880
-
\??\c:\llffxxr.exec:\llffxxr.exe150⤵PID:3012
-
\??\c:\5xxlrxl.exec:\5xxlrxl.exe151⤵PID:3052
-
\??\c:\5hhntb.exec:\5hhntb.exe152⤵PID:3000
-
\??\c:\nbnbhb.exec:\nbnbhb.exe153⤵PID:2620
-
\??\c:\vpjjp.exec:\vpjjp.exe154⤵PID:2312
-
\??\c:\vpddv.exec:\vpddv.exe155⤵PID:1644
-
\??\c:\frrxrrl.exec:\frrxrrl.exe156⤵PID:1584
-
\??\c:\thttth.exec:\thttth.exe157⤵PID:1236
-
\??\c:\bntbbb.exec:\bntbbb.exe158⤵PID:2428
-
\??\c:\jjjvj.exec:\jjjvj.exe159⤵PID:2888
-
\??\c:\dvpdd.exec:\dvpdd.exe160⤵PID:936
-
\??\c:\lrffrxl.exec:\lrffrxl.exe161⤵PID:1680
-
\??\c:\hhtbhh.exec:\hhtbhh.exe162⤵PID:2772
-
\??\c:\jvppv.exec:\jvppv.exe163⤵PID:1672
-
\??\c:\9dpvv.exec:\9dpvv.exe164⤵PID:1296
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe165⤵PID:1704
-
\??\c:\flxrxrx.exec:\flxrxrx.exe166⤵PID:2588
-
\??\c:\bththn.exec:\bththn.exe167⤵PID:2460
-
\??\c:\thhhtt.exec:\thhhtt.exe168⤵PID:2524
-
\??\c:\1vjpp.exec:\1vjpp.exe169⤵PID:1660
-
\??\c:\vpdpv.exec:\vpdpv.exe170⤵PID:2496
-
\??\c:\lllrlrx.exec:\lllrlrx.exe171⤵PID:1732
-
\??\c:\1xrxlfl.exec:\1xrxlfl.exe172⤵PID:2268
-
\??\c:\7nttbh.exec:\7nttbh.exe173⤵PID:2760
-
\??\c:\bthbnn.exec:\bthbnn.exe174⤵PID:1720
-
\??\c:\pjjdp.exec:\pjjdp.exe175⤵PID:2308
-
\??\c:\pdvjp.exec:\pdvjp.exe176⤵PID:2584
-
\??\c:\lxrfflr.exec:\lxrfflr.exe177⤵PID:1116
-
\??\c:\rlfrffr.exec:\rlfrffr.exe178⤵PID:1860
-
\??\c:\nnbhbn.exec:\nnbhbn.exe179⤵PID:2872
-
\??\c:\3thhbb.exec:\3thhbb.exe180⤵PID:1744
-
\??\c:\3jddd.exec:\3jddd.exe181⤵PID:1848
-
\??\c:\3dppp.exec:\3dppp.exe182⤵PID:1444
-
\??\c:\xrxlffr.exec:\xrxlffr.exe183⤵PID:1348
-
\??\c:\fxxlfrr.exec:\fxxlfrr.exe184⤵PID:2960
-
\??\c:\bbthth.exec:\bbthth.exe185⤵PID:2016
-
\??\c:\9tnbtt.exec:\9tnbtt.exe186⤵PID:2056
-
\??\c:\ppjdd.exec:\ppjdd.exe187⤵PID:1040
-
\??\c:\pjdjd.exec:\pjdjd.exe188⤵PID:688
-
\??\c:\lfxxffl.exec:\lfxxffl.exe189⤵PID:568
-
\??\c:\7rfrffr.exec:\7rfrffr.exe190⤵PID:1620
-
\??\c:\nbhhnt.exec:\nbhhnt.exe191⤵PID:1216
-
\??\c:\hnthbn.exec:\hnthbn.exe192⤵PID:928
-
\??\c:\jpvvv.exec:\jpvvv.exe193⤵PID:332
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe194⤵PID:896
-
\??\c:\fffrrlr.exec:\fffrrlr.exe195⤵PID:2504
-
\??\c:\hnbnnh.exec:\hnbnnh.exe196⤵PID:1512
-
\??\c:\bbtbnt.exec:\bbtbnt.exe197⤵PID:2808
-
\??\c:\jjddj.exec:\jjddj.exe198⤵PID:2856
-
\??\c:\9jpdv.exec:\9jpdv.exe199⤵PID:872
-
\??\c:\rrfxrxl.exec:\rrfxrxl.exe200⤵PID:572
-
\??\c:\rflrxrf.exec:\rflrxrf.exe201⤵PID:2516
-
\??\c:\7nbtnb.exec:\7nbtnb.exe202⤵PID:1588
-
\??\c:\jvjdj.exec:\jvjdj.exe203⤵PID:1676
-
\??\c:\ppddd.exec:\ppddd.exe204⤵PID:1556
-
\??\c:\fxxfffl.exec:\fxxfffl.exe205⤵PID:1688
-
\??\c:\frffllx.exec:\frffllx.exe206⤵PID:2176
-
\??\c:\9btbnt.exec:\9btbnt.exe207⤵PID:2776
-
\??\c:\7btthb.exec:\7btthb.exe208⤵PID:2804
-
\??\c:\1dppd.exec:\1dppd.exe209⤵PID:2624
-
\??\c:\pvdvd.exec:\pvdvd.exe210⤵PID:2528
-
\??\c:\rlflrrr.exec:\rlflrrr.exe211⤵PID:3028
-
\??\c:\xflrlfr.exec:\xflrlfr.exe212⤵PID:2648
-
\??\c:\bntbnn.exec:\bntbnn.exe213⤵PID:2388
-
\??\c:\3bnttt.exec:\3bnttt.exe214⤵PID:2940
-
\??\c:\ddppv.exec:\ddppv.exe215⤵PID:1424
-
\??\c:\dvppv.exec:\dvppv.exe216⤵PID:2748
-
\??\c:\rffrfrl.exec:\rffrfrl.exe217⤵PID:1820
-
\??\c:\7fxxllr.exec:\7fxxllr.exe218⤵PID:2204
-
\??\c:\tntbbn.exec:\tntbbn.exe219⤵PID:1748
-
\??\c:\tnhntt.exec:\tnhntt.exe220⤵PID:1628
-
\??\c:\dvpjj.exec:\dvpjj.exe221⤵PID:2660
-
\??\c:\jdvvd.exec:\jdvvd.exe222⤵PID:2716
-
\??\c:\lfllxfr.exec:\lfllxfr.exe223⤵PID:1456
-
\??\c:\fllrlrl.exec:\fllrlrl.exe224⤵PID:940
-
\??\c:\nbhbbt.exec:\nbhbbt.exe225⤵PID:880
-
\??\c:\bhnnth.exec:\bhnnth.exe226⤵PID:2768
-
\??\c:\jdpdd.exec:\jdpdd.exe227⤵PID:620
-
\??\c:\lrfxxfr.exec:\lrfxxfr.exe228⤵PID:1752
-
\??\c:\llflxlf.exec:\llflxlf.exe229⤵PID:2756
-
\??\c:\bnthbn.exec:\bnthbn.exe230⤵PID:1392
-
\??\c:\7btbbh.exec:\7btbbh.exe231⤵PID:2124
-
\??\c:\jdpvp.exec:\jdpvp.exe232⤵PID:2456
-
\??\c:\3jdjj.exec:\3jdjj.exe233⤵PID:484
-
\??\c:\lfffrlf.exec:\lfffrlf.exe234⤵PID:1696
-
\??\c:\lrlfxxf.exec:\lrlfxxf.exe235⤵PID:2108
-
\??\c:\7httbb.exec:\7httbb.exe236⤵PID:780
-
\??\c:\nbthbb.exec:\nbthbb.exe237⤵PID:1632
-
\??\c:\jdvpd.exec:\jdvpd.exe238⤵PID:1352
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe239⤵PID:972
-
\??\c:\rfrffff.exec:\rfrffff.exe240⤵PID:976
-
\??\c:\9xrrxfl.exec:\9xrrxfl.exe241⤵PID:1120
-
\??\c:\nhntnh.exec:\nhntnh.exe242⤵PID:2328