Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 00:59
Behavioral task
behavioral1
Sample
3bb6e5fb8c78ebcf16f624bd544d71d0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3bb6e5fb8c78ebcf16f624bd544d71d0_NeikiAnalytics.exe
-
Size
92KB
-
MD5
3bb6e5fb8c78ebcf16f624bd544d71d0
-
SHA1
47a83633ec8be8296af9e415cbd6731b57ddbd83
-
SHA256
751e577755fd93e4b876c0d86d97b67a9450a20ad7a65b4005505287a7173674
-
SHA512
f13ec4617ef14c5cfece02564e4d50c0ecd77e6036e81cdd007bd5645e2eda034994c41d7ce66b8193fa689ac33fb6072d19680acb770b449a4fbe65204893c6
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpTAr:8hOmTsF93UYfwC6GIout0fmCiiiXA6mQ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3160-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/324-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2656-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2548-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2260-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2716-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-579-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jvdvv.exexrflffx.exe5frrxxl.exe5tbtnn.exebhbtnt.exejvdvp.exe5jvdd.exeffxlfxl.exe3ffxrrr.exe5bbbtt.exehtnhbt.exedvvpv.exe5jjpj.exeffxrllf.exeffrxrrl.exe3thbtt.exebthhnt.exepddvj.exejdvpv.exe7lrlfff.exexrxxrxr.exehbnhbn.exe3thbtn.exeppppd.exejjjvp.exefxrrfff.exefrllrlr.exebnbnnn.exebhbbbn.exepvjjj.exepjdpj.exeffxrrrr.exerrlfffx.exettttnn.exennnnhh.exe3vvpd.exedddvp.exefxxrlll.exeffxxrrl.exenbhthh.exehhnnbb.exepdjdv.exedppjd.exeddvvp.exexlxxrrl.exexxxrlfx.exe1ntthn.exenttbnt.exedddvp.exedvvvj.exerlrrxff.exelxflxfx.exehthbnn.exebtthhn.exepddvp.exepdvpd.exepjjpp.exerrllxfx.exexflrllf.exebbnhbb.exethbbbn.exenhtbtb.exe1djdv.exedvvpd.exepid process 4928 jvdvv.exe 2384 xrflffx.exe 4324 5frrxxl.exe 4268 5tbtnn.exe 4320 bhbtnt.exe 324 jvdvp.exe 4728 5jvdd.exe 3408 ffxlfxl.exe 2716 3ffxrrr.exe 3252 5bbbtt.exe 2260 htnhbt.exe 3264 dvvpv.exe 1044 5jjpj.exe 3708 ffxrllf.exe 3996 ffrxrrl.exe 5012 3thbtt.exe 1604 bthhnt.exe 1196 pddvj.exe 4028 jdvpv.exe 2216 7lrlfff.exe 3260 xrxxrxr.exe 3512 hbnhbn.exe 2888 3thbtn.exe 412 ppppd.exe 4888 jjjvp.exe 4616 fxrrfff.exe 5108 frllrlr.exe 2688 bnbnnn.exe 1924 bhbbbn.exe 3388 pvjjj.exe 4724 pjdpj.exe 4732 ffxrrrr.exe 2548 rrlfffx.exe 2948 ttttnn.exe 3592 nnnnhh.exe 3092 3vvpd.exe 2500 dddvp.exe 2992 fxxrlll.exe 4796 ffxxrrl.exe 1544 nbhthh.exe 4820 hhnnbb.exe 5044 pdjdv.exe 4516 dppjd.exe 1580 ddvvp.exe 3820 xlxxrrl.exe 2384 xxxrlfx.exe 4324 1ntthn.exe 4268 nttbnt.exe 4892 dddvp.exe 2428 dvvvj.exe 4728 rlrrxff.exe 2192 lxflxfx.exe 684 hthbnn.exe 224 btthhn.exe 1664 pddvp.exe 4064 pdvpd.exe 4992 pjjpp.exe 1864 rrllxfx.exe 4984 xflrllf.exe 3156 bbnhbb.exe 4788 thbbbn.exe 3996 nhtbtb.exe 4484 1djdv.exe 5016 dvvpd.exe -
Processes:
resource yara_rule C:\jvdvv.exe upx behavioral2/memory/3160-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4928-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrflffx.exe upx \??\c:\5frrxxl.exe upx behavioral2/memory/2384-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/324-34-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ffxlfxl.exe upx \??\c:\5jjpj.exe upx C:\ffrxrrl.exe upx behavioral2/memory/3996-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdvpv.exe upx behavioral2/memory/1196-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxxrxr.exe upx \??\c:\hbnhbn.exe upx \??\c:\jjjvp.exe upx \??\c:\frllrlr.exe upx \??\c:\bhbbbn.exe upx C:\pjdpj.exe upx behavioral2/memory/2548-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3592-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3592-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2992-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2192-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4984-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2656-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4364-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1220-377-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4540-386-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4468-428-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4928-455-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/324-465-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3348-462-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2708-425-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2932-412-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2004-389-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2276-358-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3780-355-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3360-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4324-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2720-335-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4664-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4808-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4808-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3220-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4272-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2672-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2656-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4960-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1592-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2900-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1428-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2084-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5056-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3260-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2732-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5016-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4484-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3156-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4992-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4892-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4268-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4324-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2384-202-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3bb6e5fb8c78ebcf16f624bd544d71d0_NeikiAnalytics.exejvdvv.exexrflffx.exe5frrxxl.exe5tbtnn.exebhbtnt.exejvdvp.exe5jvdd.exeffxlfxl.exe3ffxrrr.exe5bbbtt.exehtnhbt.exedvvpv.exe5jjpj.exeffxrllf.exeffrxrrl.exe3thbtt.exebthhnt.exepddvj.exejdvpv.exe7lrlfff.exexrxxrxr.exedescription pid process target process PID 3160 wrote to memory of 4928 3160 3bb6e5fb8c78ebcf16f624bd544d71d0_NeikiAnalytics.exe tthbnt.exe PID 3160 wrote to memory of 4928 3160 3bb6e5fb8c78ebcf16f624bd544d71d0_NeikiAnalytics.exe tthbnt.exe PID 3160 wrote to memory of 4928 3160 3bb6e5fb8c78ebcf16f624bd544d71d0_NeikiAnalytics.exe tthbnt.exe PID 4928 wrote to memory of 2384 4928 jvdvv.exe xxxrlfx.exe PID 4928 wrote to memory of 2384 4928 jvdvv.exe xxxrlfx.exe PID 4928 wrote to memory of 2384 4928 jvdvv.exe xxxrlfx.exe PID 2384 wrote to memory of 4324 2384 xrflffx.exe 1ntthn.exe PID 2384 wrote to memory of 4324 2384 xrflffx.exe 1ntthn.exe PID 2384 wrote to memory of 4324 2384 xrflffx.exe 1ntthn.exe PID 4324 wrote to memory of 4268 4324 5frrxxl.exe 5tbtnn.exe PID 4324 wrote to memory of 4268 4324 5frrxxl.exe 5tbtnn.exe PID 4324 wrote to memory of 4268 4324 5frrxxl.exe 5tbtnn.exe PID 4268 wrote to memory of 4320 4268 5tbtnn.exe bhbtnt.exe PID 4268 wrote to memory of 4320 4268 5tbtnn.exe bhbtnt.exe PID 4268 wrote to memory of 4320 4268 5tbtnn.exe bhbtnt.exe PID 4320 wrote to memory of 324 4320 bhbtnt.exe jvdvp.exe PID 4320 wrote to memory of 324 4320 bhbtnt.exe jvdvp.exe PID 4320 wrote to memory of 324 4320 bhbtnt.exe jvdvp.exe PID 324 wrote to memory of 4728 324 jvdvp.exe 5jvdd.exe PID 324 wrote to memory of 4728 324 jvdvp.exe 5jvdd.exe PID 324 wrote to memory of 4728 324 jvdvp.exe 5jvdd.exe PID 4728 wrote to memory of 3408 4728 5jvdd.exe ffxlfxl.exe PID 4728 wrote to memory of 3408 4728 5jvdd.exe ffxlfxl.exe PID 4728 wrote to memory of 3408 4728 5jvdd.exe ffxlfxl.exe PID 3408 wrote to memory of 2716 3408 ffxlfxl.exe 3ffxrrr.exe PID 3408 wrote to memory of 2716 3408 ffxlfxl.exe 3ffxrrr.exe PID 3408 wrote to memory of 2716 3408 ffxlfxl.exe 3ffxrrr.exe PID 2716 wrote to memory of 3252 2716 3ffxrrr.exe 5bbbtt.exe PID 2716 wrote to memory of 3252 2716 3ffxrrr.exe 5bbbtt.exe PID 2716 wrote to memory of 3252 2716 3ffxrrr.exe 5bbbtt.exe PID 3252 wrote to memory of 2260 3252 5bbbtt.exe htnhbt.exe PID 3252 wrote to memory of 2260 3252 5bbbtt.exe htnhbt.exe PID 3252 wrote to memory of 2260 3252 5bbbtt.exe htnhbt.exe PID 2260 wrote to memory of 3264 2260 htnhbt.exe dvvpv.exe PID 2260 wrote to memory of 3264 2260 htnhbt.exe dvvpv.exe PID 2260 wrote to memory of 3264 2260 htnhbt.exe dvvpv.exe PID 3264 wrote to memory of 1044 3264 dvvpv.exe 5jjpj.exe PID 3264 wrote to memory of 1044 3264 dvvpv.exe 5jjpj.exe PID 3264 wrote to memory of 1044 3264 dvvpv.exe 5jjpj.exe PID 1044 wrote to memory of 3708 1044 5jjpj.exe ffxrllf.exe PID 1044 wrote to memory of 3708 1044 5jjpj.exe ffxrllf.exe PID 1044 wrote to memory of 3708 1044 5jjpj.exe ffxrllf.exe PID 3708 wrote to memory of 3996 3708 ffxrllf.exe ffrxrrl.exe PID 3708 wrote to memory of 3996 3708 ffxrllf.exe ffrxrrl.exe PID 3708 wrote to memory of 3996 3708 ffxrllf.exe ffrxrrl.exe PID 3996 wrote to memory of 5012 3996 ffrxrrl.exe 3thbtt.exe PID 3996 wrote to memory of 5012 3996 ffrxrrl.exe 3thbtt.exe PID 3996 wrote to memory of 5012 3996 ffrxrrl.exe 3thbtt.exe PID 5012 wrote to memory of 1604 5012 3thbtt.exe bthhnt.exe PID 5012 wrote to memory of 1604 5012 3thbtt.exe bthhnt.exe PID 5012 wrote to memory of 1604 5012 3thbtt.exe bthhnt.exe PID 1604 wrote to memory of 1196 1604 bthhnt.exe pddvj.exe PID 1604 wrote to memory of 1196 1604 bthhnt.exe pddvj.exe PID 1604 wrote to memory of 1196 1604 bthhnt.exe pddvj.exe PID 1196 wrote to memory of 4028 1196 pddvj.exe jdvpv.exe PID 1196 wrote to memory of 4028 1196 pddvj.exe jdvpv.exe PID 1196 wrote to memory of 4028 1196 pddvj.exe jdvpv.exe PID 4028 wrote to memory of 2216 4028 jdvpv.exe 7lrlfff.exe PID 4028 wrote to memory of 2216 4028 jdvpv.exe 7lrlfff.exe PID 4028 wrote to memory of 2216 4028 jdvpv.exe 7lrlfff.exe PID 2216 wrote to memory of 3260 2216 7lrlfff.exe xrxxrxr.exe PID 2216 wrote to memory of 3260 2216 7lrlfff.exe xrxxrxr.exe PID 2216 wrote to memory of 3260 2216 7lrlfff.exe xrxxrxr.exe PID 3260 wrote to memory of 3512 3260 xrxxrxr.exe hbnhbn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bb6e5fb8c78ebcf16f624bd544d71d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bb6e5fb8c78ebcf16f624bd544d71d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\jvdvv.exec:\jvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\xrflffx.exec:\xrflffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\5frrxxl.exec:\5frrxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\5tbtnn.exec:\5tbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\bhbtnt.exec:\bhbtnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\jvdvp.exec:\jvdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\5jvdd.exec:\5jvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\ffxlfxl.exec:\ffxlfxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\3ffxrrr.exec:\3ffxrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\5bbbtt.exec:\5bbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\htnhbt.exec:\htnhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\dvvpv.exec:\dvvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\5jjpj.exec:\5jjpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\ffxrllf.exec:\ffxrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\ffrxrrl.exec:\ffrxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\3thbtt.exec:\3thbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\bthhnt.exec:\bthhnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\pddvj.exec:\pddvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\jdvpv.exec:\jdvpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\7lrlfff.exec:\7lrlfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\hbnhbn.exec:\hbnhbn.exe23⤵
- Executes dropped EXE
PID:3512 -
\??\c:\3thbtn.exec:\3thbtn.exe24⤵
- Executes dropped EXE
PID:2888 -
\??\c:\ppppd.exec:\ppppd.exe25⤵
- Executes dropped EXE
PID:412 -
\??\c:\jjjvp.exec:\jjjvp.exe26⤵
- Executes dropped EXE
PID:4888 -
\??\c:\fxrrfff.exec:\fxrrfff.exe27⤵
- Executes dropped EXE
PID:4616 -
\??\c:\frllrlr.exec:\frllrlr.exe28⤵
- Executes dropped EXE
PID:5108 -
\??\c:\bnbnnn.exec:\bnbnnn.exe29⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bhbbbn.exec:\bhbbbn.exe30⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pvjjj.exec:\pvjjj.exe31⤵
- Executes dropped EXE
PID:3388 -
\??\c:\pjdpj.exec:\pjdpj.exe32⤵
- Executes dropped EXE
PID:4724 -
\??\c:\ffxrrrr.exec:\ffxrrrr.exe33⤵
- Executes dropped EXE
PID:4732 -
\??\c:\rrlfffx.exec:\rrlfffx.exe34⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ttttnn.exec:\ttttnn.exe35⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nnnnhh.exec:\nnnnhh.exe36⤵
- Executes dropped EXE
PID:3592 -
\??\c:\3vvpd.exec:\3vvpd.exe37⤵
- Executes dropped EXE
PID:3092 -
\??\c:\dddvp.exec:\dddvp.exe38⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fxxrlll.exec:\fxxrlll.exe39⤵
- Executes dropped EXE
PID:2992 -
\??\c:\ffxxrrl.exec:\ffxxrrl.exe40⤵
- Executes dropped EXE
PID:4796 -
\??\c:\nbhthh.exec:\nbhthh.exe41⤵
- Executes dropped EXE
PID:1544 -
\??\c:\hhnnbb.exec:\hhnnbb.exe42⤵
- Executes dropped EXE
PID:4820 -
\??\c:\pdjdv.exec:\pdjdv.exe43⤵
- Executes dropped EXE
PID:5044 -
\??\c:\dppjd.exec:\dppjd.exe44⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ddvvp.exec:\ddvvp.exe45⤵
- Executes dropped EXE
PID:1580 -
\??\c:\xlxxrrl.exec:\xlxxrrl.exe46⤵
- Executes dropped EXE
PID:3820 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1ntthn.exec:\1ntthn.exe48⤵
- Executes dropped EXE
PID:4324 -
\??\c:\nttbnt.exec:\nttbnt.exe49⤵
- Executes dropped EXE
PID:4268 -
\??\c:\dddvp.exec:\dddvp.exe50⤵
- Executes dropped EXE
PID:4892 -
\??\c:\dvvvj.exec:\dvvvj.exe51⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rlrrxff.exec:\rlrrxff.exe52⤵
- Executes dropped EXE
PID:4728 -
\??\c:\lxflxfx.exec:\lxflxfx.exe53⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hthbnn.exec:\hthbnn.exe54⤵
- Executes dropped EXE
PID:684 -
\??\c:\btthhn.exec:\btthhn.exe55⤵
- Executes dropped EXE
PID:224 -
\??\c:\pddvp.exec:\pddvp.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\pdvpd.exec:\pdvpd.exe57⤵
- Executes dropped EXE
PID:4064 -
\??\c:\pjjpp.exec:\pjjpp.exe58⤵
- Executes dropped EXE
PID:4992 -
\??\c:\rrllxfx.exec:\rrllxfx.exe59⤵
- Executes dropped EXE
PID:1864 -
\??\c:\xflrllf.exec:\xflrllf.exe60⤵
- Executes dropped EXE
PID:4984 -
\??\c:\bbnhbb.exec:\bbnhbb.exe61⤵
- Executes dropped EXE
PID:3156 -
\??\c:\thbbbn.exec:\thbbbn.exe62⤵
- Executes dropped EXE
PID:4788 -
\??\c:\nhtbtb.exec:\nhtbtb.exe63⤵
- Executes dropped EXE
PID:3996 -
\??\c:\1djdv.exec:\1djdv.exe64⤵
- Executes dropped EXE
PID:4484 -
\??\c:\dvvpd.exec:\dvvpd.exe65⤵
- Executes dropped EXE
PID:5016 -
\??\c:\7lfxxxr.exec:\7lfxxxr.exe66⤵PID:2732
-
\??\c:\3lxxrxr.exec:\3lxxrxr.exe67⤵PID:3328
-
\??\c:\hnhhbb.exec:\hnhhbb.exe68⤵PID:4540
-
\??\c:\3nbtbb.exec:\3nbtbb.exe69⤵PID:3260
-
\??\c:\dvppj.exec:\dvppj.exe70⤵PID:3512
-
\??\c:\jvdvv.exec:\jvdvv.exe71⤵PID:5056
-
\??\c:\dddvp.exec:\dddvp.exe72⤵PID:4116
-
\??\c:\rrlfxrr.exec:\rrlfxrr.exe73⤵PID:2964
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe74⤵PID:1124
-
\??\c:\nhttbn.exec:\nhttbn.exe75⤵PID:2084
-
\??\c:\7nnnhh.exec:\7nnnhh.exe76⤵PID:4172
-
\??\c:\dvddv.exec:\dvddv.exe77⤵PID:1428
-
\??\c:\vvvpj.exec:\vvvpj.exe78⤵PID:2900
-
\??\c:\xllflrr.exec:\xllflrr.exe79⤵PID:552
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe80⤵PID:1592
-
\??\c:\xlrrlxx.exec:\xlrrlxx.exe81⤵PID:4960
-
\??\c:\nbthhh.exec:\nbthhh.exe82⤵PID:2656
-
\??\c:\7htnbb.exec:\7htnbb.exe83⤵PID:524
-
\??\c:\vpddp.exec:\vpddp.exe84⤵PID:1204
-
\??\c:\vjppp.exec:\vjppp.exe85⤵PID:1940
-
\??\c:\llffxxf.exec:\llffxxf.exe86⤵PID:2164
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe87⤵PID:2672
-
\??\c:\bbthtt.exec:\bbthtt.exe88⤵PID:5112
-
\??\c:\thnhhh.exec:\thnhhh.exe89⤵PID:4272
-
\??\c:\btthtt.exec:\btthtt.exe90⤵PID:3372
-
\??\c:\dvvpp.exec:\dvvpp.exe91⤵PID:3220
-
\??\c:\djdjd.exec:\djdjd.exe92⤵PID:2500
-
\??\c:\fllfffx.exec:\fllfffx.exe93⤵PID:4544
-
\??\c:\flrrrff.exec:\flrrrff.exe94⤵PID:3184
-
\??\c:\nbhbbn.exec:\nbhbbn.exe95⤵PID:4808
-
\??\c:\nhnnnn.exec:\nhnnnn.exe96⤵PID:4664
-
\??\c:\hhnhbb.exec:\hhnhbb.exe97⤵PID:4364
-
\??\c:\dpjvj.exec:\dpjvj.exe98⤵PID:2780
-
\??\c:\vvpdv.exec:\vvpdv.exe99⤵PID:2120
-
\??\c:\dpjvj.exec:\dpjvj.exe100⤵PID:2720
-
\??\c:\9xxllfx.exec:\9xxllfx.exe101⤵PID:2384
-
\??\c:\rrflxrr.exec:\rrflxrr.exe102⤵PID:4324
-
\??\c:\bhnhbb.exec:\bhnhbb.exe103⤵PID:2340
-
\??\c:\hbhttn.exec:\hbhttn.exe104⤵PID:3360
-
\??\c:\pjpjd.exec:\pjpjd.exe105⤵PID:4284
-
\??\c:\dpppj.exec:\dpppj.exe106⤵PID:2220
-
\??\c:\lfxrffx.exec:\lfxrffx.exe107⤵PID:1672
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe108⤵PID:3780
-
\??\c:\thtthh.exec:\thtthh.exe109⤵PID:4968
-
\??\c:\tttnhh.exec:\tttnhh.exe110⤵PID:2276
-
\??\c:\djvvp.exec:\djvvp.exe111⤵PID:3968
-
\??\c:\3jjdj.exec:\3jjdj.exe112⤵PID:2800
-
\??\c:\1jpjj.exec:\1jpjj.exe113⤵PID:1864
-
\??\c:\fflfrrf.exec:\fflfrrf.exe114⤵PID:1044
-
\??\c:\flxfxxl.exec:\flxfxxl.exe115⤵PID:3156
-
\??\c:\tttnhh.exec:\tttnhh.exe116⤵PID:4788
-
\??\c:\hhnnbh.exec:\hhnnbh.exe117⤵PID:812
-
\??\c:\vjppj.exec:\vjppj.exe118⤵PID:1220
-
\??\c:\1djjp.exec:\1djjp.exe119⤵PID:688
-
\??\c:\dvppj.exec:\dvppj.exe120⤵PID:3980
-
\??\c:\xllxrlx.exec:\xllxrlx.exe121⤵PID:3328
-
\??\c:\rrxxxll.exec:\rrxxxll.exe122⤵PID:4540
-
\??\c:\9pvpv.exec:\9pvpv.exe123⤵PID:2004
-
\??\c:\ddjjd.exec:\ddjjd.exe124⤵PID:2576
-
\??\c:\9fxrllf.exec:\9fxrllf.exe125⤵PID:1612
-
\??\c:\xrrrlrl.exec:\xrrrlrl.exe126⤵PID:4192
-
\??\c:\htttbh.exec:\htttbh.exe127⤵PID:1112
-
\??\c:\htbbtn.exec:\htbbtn.exe128⤵PID:4752
-
\??\c:\dppjj.exec:\dppjj.exe129⤵PID:1124
-
\??\c:\dppjv.exec:\dppjv.exe130⤵PID:2084
-
\??\c:\lffxrlf.exec:\lffxrlf.exe131⤵PID:4172
-
\??\c:\5ffxrxr.exec:\5ffxrxr.exe132⤵PID:1428
-
\??\c:\1hhhtn.exec:\1hhhtn.exe133⤵PID:2900
-
\??\c:\hthbth.exec:\hthbth.exe134⤵PID:1924
-
\??\c:\pjjvj.exec:\pjjvj.exe135⤵PID:2932
-
\??\c:\ppvpj.exec:\ppvpj.exe136⤵PID:2160
-
\??\c:\dppjd.exec:\dppjd.exe137⤵PID:4308
-
\??\c:\rllfxrl.exec:\rllfxrl.exe138⤵PID:4508
-
\??\c:\lrrlllf.exec:\lrrlllf.exe139⤵PID:2200
-
\??\c:\btnthn.exec:\btnthn.exe140⤵PID:460
-
\??\c:\nthhbb.exec:\nthhbb.exe141⤵PID:2708
-
\??\c:\pjvvv.exec:\pjvvv.exe142⤵PID:4468
-
\??\c:\vpjpp.exec:\vpjpp.exe143⤵PID:3504
-
\??\c:\1rrrrrr.exec:\1rrrrrr.exe144⤵PID:2400
-
\??\c:\xxlfffx.exec:\xxlfffx.exe145⤵PID:116
-
\??\c:\thnttn.exec:\thnttn.exe146⤵PID:1096
-
\??\c:\1bhhbb.exec:\1bhhbb.exe147⤵PID:2972
-
\??\c:\hbthtn.exec:\hbthtn.exe148⤵PID:4544
-
\??\c:\vpvpd.exec:\vpvpd.exe149⤵PID:2920
-
\??\c:\vpjdj.exec:\vpjdj.exe150⤵PID:1544
-
\??\c:\fxxrfrl.exec:\fxxrfrl.exe151⤵PID:5044
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe152⤵PID:4340
-
\??\c:\llrrxxl.exec:\llrrxxl.exe153⤵PID:4516
-
\??\c:\tttttt.exec:\tttttt.exe154⤵PID:1580
-
\??\c:\tthbnt.exec:\tthbnt.exe155⤵PID:4928
-
\??\c:\jjvpv.exec:\jjvpv.exe156⤵PID:1748
-
\??\c:\djvvj.exec:\djvvj.exe157⤵PID:1424
-
\??\c:\rrrfrlx.exec:\rrrfrlx.exe158⤵PID:3348
-
\??\c:\7fxxxxx.exec:\7fxxxxx.exe159⤵PID:324
-
\??\c:\1ttnbb.exec:\1ttnbb.exe160⤵PID:4844
-
\??\c:\hnnhhh.exec:\hnnhhh.exe161⤵PID:684
-
\??\c:\djjdd.exec:\djjdd.exe162⤵PID:1664
-
\??\c:\vjjdp.exec:\vjjdp.exe163⤵PID:4968
-
\??\c:\jdjdv.exec:\jdjdv.exe164⤵PID:2276
-
\??\c:\frfrfxf.exec:\frfrfxf.exe165⤵PID:4992
-
\??\c:\xrllfff.exec:\xrllfff.exe166⤵PID:2440
-
\??\c:\nbhhtb.exec:\nbhhtb.exe167⤵PID:4160
-
\??\c:\9tbhtn.exec:\9tbhtn.exe168⤵PID:4372
-
\??\c:\ttnhtn.exec:\ttnhtn.exe169⤵PID:3336
-
\??\c:\ppddp.exec:\ppddp.exe170⤵PID:4920
-
\??\c:\ppdvj.exec:\ppdvj.exe171⤵PID:4432
-
\??\c:\xxxlxrf.exec:\xxxlxrf.exe172⤵PID:4028
-
\??\c:\rxfxrrf.exec:\rxfxrrf.exe173⤵PID:2036
-
\??\c:\3nnhbt.exec:\3nnhbt.exe174⤵PID:2008
-
\??\c:\pjjdj.exec:\pjjdj.exe175⤵PID:2604
-
\??\c:\pjdvj.exec:\pjdvj.exe176⤵PID:3604
-
\??\c:\5flfffx.exec:\5flfffx.exe177⤵PID:4472
-
\??\c:\tnhhtt.exec:\tnhhtt.exe178⤵PID:3760
-
\??\c:\ththbb.exec:\ththbb.exe179⤵PID:412
-
\??\c:\jpvjp.exec:\jpvjp.exe180⤵PID:2284
-
\??\c:\3jvjp.exec:\3jvjp.exe181⤵PID:1784
-
\??\c:\xlxlfxf.exec:\xlxlfxf.exe182⤵PID:4888
-
\??\c:\hbtnht.exec:\hbtnht.exe183⤵PID:3344
-
\??\c:\1frrffx.exec:\1frrffx.exe184⤵PID:4388
-
\??\c:\9flfxxl.exec:\9flfxxl.exe185⤵PID:2084
-
\??\c:\bntnhh.exec:\bntnhh.exe186⤵PID:5116
-
\??\c:\dpvpv.exec:\dpvpv.exe187⤵PID:4492
-
\??\c:\dvvdp.exec:\dvvdp.exe188⤵PID:696
-
\??\c:\frxrrlf.exec:\frxrrlf.exe189⤵PID:5096
-
\??\c:\hthhbb.exec:\hthhbb.exe190⤵PID:4724
-
\??\c:\vppdd.exec:\vppdd.exe191⤵PID:4064
-
\??\c:\9xxfrrr.exec:\9xxfrrr.exe192⤵PID:1376
-
\??\c:\flllxrf.exec:\flllxrf.exe193⤵PID:1204
-
\??\c:\nnhbnh.exec:\nnhbnh.exe194⤵PID:1940
-
\??\c:\htnhth.exec:\htnhth.exe195⤵PID:4380
-
\??\c:\btthnh.exec:\btthnh.exe196⤵PID:1920
-
\??\c:\dppdp.exec:\dppdp.exe197⤵PID:2400
-
\??\c:\1lfxlfr.exec:\1lfxlfr.exe198⤵PID:1824
-
\??\c:\thttbt.exec:\thttbt.exe199⤵PID:1908
-
\??\c:\tnbnbt.exec:\tnbnbt.exe200⤵PID:8
-
\??\c:\vdvvv.exec:\vdvvv.exe201⤵PID:3184
-
\??\c:\1jjdp.exec:\1jjdp.exe202⤵PID:208
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe203⤵PID:2920
-
\??\c:\xffxlfx.exec:\xffxlfx.exe204⤵PID:1368
-
\??\c:\1bbnbn.exec:\1bbnbn.exe205⤵PID:4976
-
\??\c:\3nhthb.exec:\3nhthb.exe206⤵PID:4032
-
\??\c:\5hbnhb.exec:\5hbnhb.exe207⤵PID:472
-
\??\c:\pvpdj.exec:\pvpdj.exe208⤵PID:2120
-
\??\c:\7ppjp.exec:\7ppjp.exe209⤵PID:2100
-
\??\c:\llxrllf.exec:\llxrllf.exe210⤵PID:4224
-
\??\c:\rlllrrx.exec:\rlllrrx.exe211⤵PID:2340
-
\??\c:\9hbtnh.exec:\9hbtnh.exe212⤵PID:2716
-
\??\c:\hhnbbh.exec:\hhnbbh.exe213⤵PID:272
-
\??\c:\pjdvd.exec:\pjdvd.exe214⤵PID:4712
-
\??\c:\rxlrxfr.exec:\rxlrxfr.exe215⤵PID:684
-
\??\c:\rxxxllf.exec:\rxxxllf.exe216⤵PID:1664
-
\??\c:\bbtbtb.exec:\bbtbtb.exe217⤵PID:4968
-
\??\c:\3vppj.exec:\3vppj.exe218⤵PID:1832
-
\??\c:\jpvjd.exec:\jpvjd.exe219⤵PID:1072
-
\??\c:\xxfrrlx.exec:\xxfrrlx.exe220⤵PID:3708
-
\??\c:\frfxffx.exec:\frfxffx.exe221⤵PID:4592
-
\??\c:\nbthtn.exec:\nbthtn.exe222⤵PID:2040
-
\??\c:\tththb.exec:\tththb.exe223⤵PID:644
-
\??\c:\vdvjv.exec:\vdvjv.exe224⤵PID:4788
-
\??\c:\dddpv.exec:\dddpv.exe225⤵PID:812
-
\??\c:\lxrlxrf.exec:\lxrlxrf.exe226⤵PID:4352
-
\??\c:\ffxlfxx.exec:\ffxlfxx.exe227⤵PID:2036
-
\??\c:\bhhbtn.exec:\bhhbtn.exe228⤵PID:2008
-
\??\c:\tbnhtn.exec:\tbnhtn.exe229⤵PID:2604
-
\??\c:\1vvjv.exec:\1vvjv.exe230⤵PID:3604
-
\??\c:\vjddp.exec:\vjddp.exe231⤵PID:4472
-
\??\c:\1xrlxlf.exec:\1xrlxlf.exe232⤵PID:4116
-
\??\c:\llxfxlf.exec:\llxfxlf.exe233⤵PID:2964
-
\??\c:\hhtntn.exec:\hhtntn.exe234⤵PID:1112
-
\??\c:\9bbnbt.exec:\9bbnbt.exe235⤵PID:1584
-
\??\c:\vdvpv.exec:\vdvpv.exe236⤵PID:4908
-
\??\c:\dvpjv.exec:\dvpjv.exe237⤵PID:3804
-
\??\c:\vjjjv.exec:\vjjjv.exe238⤵PID:2304
-
\??\c:\xxrfllx.exec:\xxrfllx.exe239⤵PID:2900
-
\??\c:\5lllfxr.exec:\5lllfxr.exe240⤵PID:2588
-
\??\c:\7nbthn.exec:\7nbthn.exe241⤵PID:5096
-
\??\c:\vvjdv.exec:\vvjdv.exe242⤵PID:2548