Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 05:23
Behavioral task
behavioral1
Sample
047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9_NeikiAnalytics.exe
-
Size
497KB
-
MD5
203c7d849bcedf90f3a80f7042ec0650
-
SHA1
844e7da681f46ef55df70154f31bfd8a1c1d46c1
-
SHA256
047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9
-
SHA512
6b64c75e7aef5b6fa751cc4a824a6da5dcdef37700d81a20a2c170155cb5d40fe3b398c0ec562ae039af1e5bbaca68f4c19acdca471968c91ef811e90d8c43d2
-
SSDEEP
12288:S4wFHoSyoS3ebeFmFVvlrmwcT4wpteFmFTxj:0KFmFVtrRcFEFmF5
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2184-5-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3340-35-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3340-42-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5072-62-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4208-96-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4200-102-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4104-117-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4604-115-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1444-130-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3516-137-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3152-156-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2364-163-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3748-162-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3456-182-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1744-194-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4860-201-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2488-213-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/720-220-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3688-230-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1132-228-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1132-234-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/988-244-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3216-243-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/988-249-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3460-269-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3840-268-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3460-273-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4964-278-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1388-283-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4928-289-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1824-303-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3244-309-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4068-318-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1224-313-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1824-299-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3908-298-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2596-293-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4836-263-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4348-258-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2960-253-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2960-248-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1912-241-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2064-226-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1344-207-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1344-198-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2884-188-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3456-176-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2364-168-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3084-149-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3516-143-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1444-136-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1824-129-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1824-122-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3408-108-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4200-93-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4664-88-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2020-81-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3812-75-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3728-69-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4344-55-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4344-49-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4492-48-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3372-33-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4700-27-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xflxfrr.exethbtbt.exevvpdj.exebhtnnt.exeddpjp.exelrxxlxr.exebtthth.exeppvvj.exelxfffxf.exerrrrrrl.exepddvv.exefllxlxr.exe1tnhhh.exe3dpjj.exexxrrlrr.exe7tbnhh.exedvdvp.exellxxffl.exenbtnbh.exerxlrrrx.exetbhhnn.exejjvdv.exe7xrlfrf.exennnhbb.exenhbhtb.exe7vdpj.exerflfxrl.exenntbbb.exerffxllx.exejjvdp.exedpjdv.exelrfrffr.exenthhbb.exepdvvp.exefffxxxr.exerxxxlll.exettthht.exejjjjd.exehntnbh.exe1flxrxx.exethnnht.exexrxrfrx.exehtnbbb.exexrllrxl.exe5pddj.exedjpdp.exehbtttt.exedvddj.exeffffxxx.exetnbhhh.exelflxxfx.exejjvjj.exellllrrx.exetntbnn.exejvjdd.exe3rfxrfl.exerllxlll.exetttnnn.exejvjpd.exerrllxxr.exexxlfrrl.exenntbhb.exe3pjdd.exe3pjdd.exepid process 3688 xflxfrr.exe 2252 thbtbt.exe 4700 vvpdj.exe 3372 bhtnnt.exe 3340 ddpjp.exe 4492 lrxxlxr.exe 4344 btthth.exe 5072 ppvvj.exe 3728 lxfffxf.exe 3812 rrrrrrl.exe 2020 pddvv.exe 4664 fllxlxr.exe 4208 1tnhhh.exe 4200 3dpjj.exe 3408 xxrrlrr.exe 4604 7tbnhh.exe 4104 dvdvp.exe 1824 llxxffl.exe 1444 nbtnbh.exe 3516 rxlrrrx.exe 3084 tbhhnn.exe 3152 jjvdv.exe 3748 7xrlfrf.exe 2364 nnnhbb.exe 1420 nhbhtb.exe 3456 7vdpj.exe 2884 rflfxrl.exe 1744 nntbbb.exe 4860 rffxllx.exe 1344 jjvdp.exe 2488 dpjdv.exe 720 lrfrffr.exe 2064 nthhbb.exe 3688 pdvvp.exe 1132 fffxxxr.exe 1912 rxxxlll.exe 3216 ttthht.exe 988 jjjjd.exe 2960 hntnbh.exe 4348 1flxrxx.exe 4836 thnnht.exe 3840 xrxrfrx.exe 3460 htnbbb.exe 4964 xrllrxl.exe 1388 5pddj.exe 4928 djpdp.exe 2596 hbtttt.exe 3908 dvddj.exe 1824 ffffxxx.exe 3244 tnbhhh.exe 1224 lflxxfx.exe 4068 jjvjj.exe 4420 llllrrx.exe 1568 tntbnn.exe 4376 jvjdd.exe 1420 3rfxrfl.exe 4824 rllxlll.exe 4524 tttnnn.exe 1372 jvjpd.exe 4244 rrllxxr.exe 1116 xxlfrrl.exe 4272 nntbhb.exe 2024 3pjdd.exe 3720 3pjdd.exe -
Processes:
resource yara_rule behavioral2/memory/2184-0-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2184-5-0x0000000000400000-0x0000000000484000-memory.dmp upx C:\thbtbt.exe upx C:\vvpdj.exe upx behavioral2/memory/3372-28-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3340-35-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3340-42-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\btthth.exe upx C:\lxfffxf.exe upx behavioral2/memory/5072-62-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2020-76-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4208-96-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4200-102-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4604-110-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4104-117-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\dvdvp.exe upx behavioral2/memory/4604-115-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\llxxffl.exe upx behavioral2/memory/1444-130-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3516-137-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3152-150-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3152-156-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2364-163-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3748-162-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1420-170-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\7vdpj.exe upx C:\rflfxrl.exe upx behavioral2/memory/3456-182-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\rffxllx.exe upx behavioral2/memory/1744-194-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4860-201-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\jjvdp.exe upx behavioral2/memory/2488-213-0x0000000000400000-0x0000000000484000-memory.dmp upx \??\c:\lrfrffr.exe upx behavioral2/memory/720-215-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/720-220-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3688-230-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1132-228-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1132-234-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1912-235-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/988-244-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3216-243-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/988-249-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4836-261-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3460-269-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3840-268-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3460-273-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1388-279-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4964-278-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1388-283-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4928-284-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4928-289-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3244-304-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1824-303-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3244-309-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4068-318-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4068-314-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1224-313-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1224-307-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1824-299-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3908-298-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3908-294-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2596-293-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2596-287-0x0000000000400000-0x0000000000484000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9_NeikiAnalytics.exexflxfrr.exethbtbt.exevvpdj.exebhtnnt.exeddpjp.exelrxxlxr.exebtthth.exeppvvj.exelxfffxf.exerrrrrrl.exepddvv.exefllxlxr.exe1tnhhh.exe3dpjj.exexxrrlrr.exe7tbnhh.exedvdvp.exellxxffl.exenbtnbh.exerxlrrrx.exetbhhnn.exedescription pid process target process PID 2184 wrote to memory of 3688 2184 047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9_NeikiAnalytics.exe xflxfrr.exe PID 2184 wrote to memory of 3688 2184 047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9_NeikiAnalytics.exe xflxfrr.exe PID 2184 wrote to memory of 3688 2184 047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9_NeikiAnalytics.exe xflxfrr.exe PID 3688 wrote to memory of 2252 3688 xflxfrr.exe thbtbt.exe PID 3688 wrote to memory of 2252 3688 xflxfrr.exe thbtbt.exe PID 3688 wrote to memory of 2252 3688 xflxfrr.exe thbtbt.exe PID 2252 wrote to memory of 4700 2252 thbtbt.exe vvpdj.exe PID 2252 wrote to memory of 4700 2252 thbtbt.exe vvpdj.exe PID 2252 wrote to memory of 4700 2252 thbtbt.exe vvpdj.exe PID 4700 wrote to memory of 3372 4700 vvpdj.exe bhtnnt.exe PID 4700 wrote to memory of 3372 4700 vvpdj.exe bhtnnt.exe PID 4700 wrote to memory of 3372 4700 vvpdj.exe bhtnnt.exe PID 3372 wrote to memory of 3340 3372 bhtnnt.exe ddpjp.exe PID 3372 wrote to memory of 3340 3372 bhtnnt.exe ddpjp.exe PID 3372 wrote to memory of 3340 3372 bhtnnt.exe ddpjp.exe PID 3340 wrote to memory of 4492 3340 ddpjp.exe lrxxlxr.exe PID 3340 wrote to memory of 4492 3340 ddpjp.exe lrxxlxr.exe PID 3340 wrote to memory of 4492 3340 ddpjp.exe lrxxlxr.exe PID 4492 wrote to memory of 4344 4492 lrxxlxr.exe btthth.exe PID 4492 wrote to memory of 4344 4492 lrxxlxr.exe btthth.exe PID 4492 wrote to memory of 4344 4492 lrxxlxr.exe btthth.exe PID 4344 wrote to memory of 5072 4344 btthth.exe ppvvj.exe PID 4344 wrote to memory of 5072 4344 btthth.exe ppvvj.exe PID 4344 wrote to memory of 5072 4344 btthth.exe ppvvj.exe PID 5072 wrote to memory of 3728 5072 ppvvj.exe lxfffxf.exe PID 5072 wrote to memory of 3728 5072 ppvvj.exe lxfffxf.exe PID 5072 wrote to memory of 3728 5072 ppvvj.exe lxfffxf.exe PID 3728 wrote to memory of 3812 3728 lxfffxf.exe rrrrrrl.exe PID 3728 wrote to memory of 3812 3728 lxfffxf.exe rrrrrrl.exe PID 3728 wrote to memory of 3812 3728 lxfffxf.exe rrrrrrl.exe PID 3812 wrote to memory of 2020 3812 rrrrrrl.exe pddvv.exe PID 3812 wrote to memory of 2020 3812 rrrrrrl.exe pddvv.exe PID 3812 wrote to memory of 2020 3812 rrrrrrl.exe pddvv.exe PID 2020 wrote to memory of 4664 2020 pddvv.exe fllxlxr.exe PID 2020 wrote to memory of 4664 2020 pddvv.exe fllxlxr.exe PID 2020 wrote to memory of 4664 2020 pddvv.exe fllxlxr.exe PID 4664 wrote to memory of 4208 4664 fllxlxr.exe 1tnhhh.exe PID 4664 wrote to memory of 4208 4664 fllxlxr.exe 1tnhhh.exe PID 4664 wrote to memory of 4208 4664 fllxlxr.exe 1tnhhh.exe PID 4208 wrote to memory of 4200 4208 1tnhhh.exe 3dpjj.exe PID 4208 wrote to memory of 4200 4208 1tnhhh.exe 3dpjj.exe PID 4208 wrote to memory of 4200 4208 1tnhhh.exe 3dpjj.exe PID 4200 wrote to memory of 3408 4200 3dpjj.exe xxrrlrr.exe PID 4200 wrote to memory of 3408 4200 3dpjj.exe xxrrlrr.exe PID 4200 wrote to memory of 3408 4200 3dpjj.exe xxrrlrr.exe PID 3408 wrote to memory of 4604 3408 xxrrlrr.exe 7tbnhh.exe PID 3408 wrote to memory of 4604 3408 xxrrlrr.exe 7tbnhh.exe PID 3408 wrote to memory of 4604 3408 xxrrlrr.exe 7tbnhh.exe PID 4604 wrote to memory of 4104 4604 7tbnhh.exe dvdvp.exe PID 4604 wrote to memory of 4104 4604 7tbnhh.exe dvdvp.exe PID 4604 wrote to memory of 4104 4604 7tbnhh.exe dvdvp.exe PID 4104 wrote to memory of 1824 4104 dvdvp.exe llxxffl.exe PID 4104 wrote to memory of 1824 4104 dvdvp.exe llxxffl.exe PID 4104 wrote to memory of 1824 4104 dvdvp.exe llxxffl.exe PID 1824 wrote to memory of 1444 1824 llxxffl.exe nbtnbh.exe PID 1824 wrote to memory of 1444 1824 llxxffl.exe nbtnbh.exe PID 1824 wrote to memory of 1444 1824 llxxffl.exe nbtnbh.exe PID 1444 wrote to memory of 3516 1444 nbtnbh.exe rxlrrrx.exe PID 1444 wrote to memory of 3516 1444 nbtnbh.exe rxlrrrx.exe PID 1444 wrote to memory of 3516 1444 nbtnbh.exe rxlrrrx.exe PID 3516 wrote to memory of 3084 3516 rxlrrrx.exe tbhhnn.exe PID 3516 wrote to memory of 3084 3516 rxlrrrx.exe tbhhnn.exe PID 3516 wrote to memory of 3084 3516 rxlrrrx.exe tbhhnn.exe PID 3084 wrote to memory of 3152 3084 tbhhnn.exe jjvdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4122939805\zmstage.exeC:\Users\Admin\AppData\Local\Temp\4122939805\zmstage.exe1⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\047665fb6bd95566a89ad675188d0e074456feed05ff46c6c7f527bd6b3edac9_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\xflxfrr.exec:\xflxfrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\thbtbt.exec:\thbtbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\vvpdj.exec:\vvpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\bhtnnt.exec:\bhtnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\ddpjp.exec:\ddpjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\lrxxlxr.exec:\lrxxlxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\btthth.exec:\btthth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\ppvvj.exec:\ppvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\lxfffxf.exec:\lxfffxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\rrrrrrl.exec:\rrrrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\pddvv.exec:\pddvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\fllxlxr.exec:\fllxlxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\1tnhhh.exec:\1tnhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\3dpjj.exec:\3dpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\xxrrlrr.exec:\xxrrlrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\7tbnhh.exec:\7tbnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\dvdvp.exec:\dvdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\llxxffl.exec:\llxxffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\nbtnbh.exec:\nbtnbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\rxlrrrx.exec:\rxlrrrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\tbhhnn.exec:\tbhhnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\jjvdv.exec:\jjvdv.exe23⤵
- Executes dropped EXE
PID:3152 -
\??\c:\7xrlfrf.exec:\7xrlfrf.exe24⤵
- Executes dropped EXE
PID:3748 -
\??\c:\nnnhbb.exec:\nnnhbb.exe25⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nhbhtb.exec:\nhbhtb.exe26⤵
- Executes dropped EXE
PID:1420 -
\??\c:\7vdpj.exec:\7vdpj.exe27⤵
- Executes dropped EXE
PID:3456 -
\??\c:\rflfxrl.exec:\rflfxrl.exe28⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nntbbb.exec:\nntbbb.exe29⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rffxllx.exec:\rffxllx.exe30⤵
- Executes dropped EXE
PID:4860 -
\??\c:\jjvdp.exec:\jjvdp.exe31⤵
- Executes dropped EXE
PID:1344 -
\??\c:\dpjdv.exec:\dpjdv.exe32⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lrfrffr.exec:\lrfrffr.exe33⤵
- Executes dropped EXE
PID:720 -
\??\c:\nthhbb.exec:\nthhbb.exe34⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pdvvp.exec:\pdvvp.exe35⤵
- Executes dropped EXE
PID:3688 -
\??\c:\fffxxxr.exec:\fffxxxr.exe36⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rxxxlll.exec:\rxxxlll.exe37⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ttthht.exec:\ttthht.exe38⤵
- Executes dropped EXE
PID:3216 -
\??\c:\jjjjd.exec:\jjjjd.exe39⤵
- Executes dropped EXE
PID:988 -
\??\c:\hntnbh.exec:\hntnbh.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\1flxrxx.exec:\1flxrxx.exe41⤵
- Executes dropped EXE
PID:4348 -
\??\c:\thnnht.exec:\thnnht.exe42⤵
- Executes dropped EXE
PID:4836 -
\??\c:\xrxrfrx.exec:\xrxrfrx.exe43⤵
- Executes dropped EXE
PID:3840 -
\??\c:\htnbbb.exec:\htnbbb.exe44⤵
- Executes dropped EXE
PID:3460 -
\??\c:\xrllrxl.exec:\xrllrxl.exe45⤵
- Executes dropped EXE
PID:4964 -
\??\c:\5pddj.exec:\5pddj.exe46⤵
- Executes dropped EXE
PID:1388 -
\??\c:\djpdp.exec:\djpdp.exe47⤵
- Executes dropped EXE
PID:4928 -
\??\c:\hbtttt.exec:\hbtttt.exe48⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dvddj.exec:\dvddj.exe49⤵
- Executes dropped EXE
PID:3908 -
\??\c:\ffffxxx.exec:\ffffxxx.exe50⤵
- Executes dropped EXE
PID:1824 -
\??\c:\tnbhhh.exec:\tnbhhh.exe51⤵
- Executes dropped EXE
PID:3244 -
\??\c:\lflxxfx.exec:\lflxxfx.exe52⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jjvjj.exec:\jjvjj.exe53⤵
- Executes dropped EXE
PID:4068 -
\??\c:\llllrrx.exec:\llllrrx.exe54⤵
- Executes dropped EXE
PID:4420 -
\??\c:\tntbnn.exec:\tntbnn.exe55⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jvjdd.exec:\jvjdd.exe56⤵
- Executes dropped EXE
PID:4376 -
\??\c:\3rfxrfl.exec:\3rfxrfl.exe57⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rllxlll.exec:\rllxlll.exe58⤵
- Executes dropped EXE
PID:4824 -
\??\c:\tttnnn.exec:\tttnnn.exe59⤵
- Executes dropped EXE
PID:4524 -
\??\c:\jvjpd.exec:\jvjpd.exe60⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rrllxxr.exec:\rrllxxr.exe61⤵
- Executes dropped EXE
PID:4244 -
\??\c:\xxlfrrl.exec:\xxlfrrl.exe62⤵
- Executes dropped EXE
PID:1116 -
\??\c:\nntbhb.exec:\nntbhb.exe63⤵
- Executes dropped EXE
PID:4272 -
\??\c:\3pjdd.exec:\3pjdd.exe64⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3pjdd.exec:\3pjdd.exe65⤵
- Executes dropped EXE
PID:3720 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe66⤵PID:720
-
\??\c:\nnnhbb.exec:\nnnhbb.exe67⤵PID:2360
-
\??\c:\vjvvp.exec:\vjvvp.exe68⤵PID:2396
-
\??\c:\fxlrfll.exec:\fxlrfll.exe69⤵PID:5064
-
\??\c:\7xxrrrl.exec:\7xxrrrl.exe70⤵PID:1140
-
\??\c:\hhthtt.exec:\hhthtt.exe71⤵PID:3216
-
\??\c:\dddvj.exec:\dddvj.exe72⤵PID:5080
-
\??\c:\llxxrrf.exec:\llxxrrf.exe73⤵PID:4352
-
\??\c:\bnnnnb.exec:\bnnnnb.exe74⤵PID:1336
-
\??\c:\dvvpv.exec:\dvvpv.exe75⤵PID:3524
-
\??\c:\xlfrlrl.exec:\xlfrlrl.exe76⤵PID:3460
-
\??\c:\htntbn.exec:\htntbn.exe77⤵PID:4964
-
\??\c:\vvjdd.exec:\vvjdd.exe78⤵PID:4052
-
\??\c:\dvdvp.exec:\dvdvp.exe79⤵PID:3752
-
\??\c:\fflffxr.exec:\fflffxr.exe80⤵PID:5004
-
\??\c:\bbnbth.exec:\bbnbth.exe81⤵PID:3908
-
\??\c:\dvddp.exec:\dvddp.exe82⤵PID:4576
-
\??\c:\lffrlll.exec:\lffrlll.exe83⤵PID:1044
-
\??\c:\3rrrlrl.exec:\3rrrlrl.exe84⤵PID:1224
-
\??\c:\nnbtth.exec:\nnbtth.exe85⤵PID:1020
-
\??\c:\1dpvp.exec:\1dpvp.exe86⤵PID:1936
-
\??\c:\xfxxlxf.exec:\xfxxlxf.exe87⤵PID:1972
-
\??\c:\7bhbbb.exec:\7bhbbb.exe88⤵PID:1568
-
\??\c:\9nnhhh.exec:\9nnhhh.exe89⤵PID:636
-
\??\c:\pdjdd.exec:\pdjdd.exe90⤵PID:1832
-
\??\c:\fllfrxf.exec:\fllfrxf.exe91⤵PID:4476
-
\??\c:\5htntn.exec:\5htntn.exe92⤵PID:1288
-
\??\c:\vjvpj.exec:\vjvpj.exe93⤵PID:2012
-
\??\c:\xfxffxx.exec:\xfxffxx.exe94⤵PID:396
-
\??\c:\bhtnhn.exec:\bhtnhn.exe95⤵PID:1732
-
\??\c:\bnbbhh.exec:\bnbbhh.exe96⤵PID:4160
-
\??\c:\1vddv.exec:\1vddv.exe97⤵PID:2024
-
\??\c:\xrxxrll.exec:\xrxxrll.exe98⤵PID:4668
-
\??\c:\thtbbt.exec:\thtbbt.exe99⤵PID:4168
-
\??\c:\jpddj.exec:\jpddj.exe100⤵PID:428
-
\??\c:\lflfxff.exec:\lflfxff.exe101⤵PID:3436
-
\??\c:\rrfxxff.exec:\rrfxxff.exe102⤵PID:4392
-
\??\c:\tthhbb.exec:\tthhbb.exe103⤵PID:912
-
\??\c:\vpjjv.exec:\vpjjv.exe104⤵PID:3216
-
\??\c:\xrrfrff.exec:\xrrfrff.exe105⤵PID:4108
-
\??\c:\bnhhth.exec:\bnhhth.exe106⤵PID:4040
-
\??\c:\3tbbtb.exec:\3tbbtb.exe107⤵PID:1336
-
\??\c:\dvjvj.exec:\dvjvj.exe108⤵PID:3492
-
\??\c:\fxrrxxr.exec:\fxrrxxr.exe109⤵PID:3408
-
\??\c:\ttnnhb.exec:\ttnnhb.exe110⤵PID:376
-
\??\c:\jpddd.exec:\jpddd.exe111⤵PID:4928
-
\??\c:\llrfxlf.exec:\llrfxlf.exe112⤵PID:4424
-
\??\c:\tthbhb.exec:\tthbhb.exe113⤵PID:2044
-
\??\c:\djvvd.exec:\djvvd.exe114⤵PID:3716
-
\??\c:\xxxxrff.exec:\xxxxrff.exe115⤵PID:2324
-
\??\c:\ttbthh.exec:\ttbthh.exe116⤵PID:3504
-
\??\c:\9hnhht.exec:\9hnhht.exe117⤵PID:1844
-
\??\c:\dvvjj.exec:\dvvjj.exe118⤵PID:4532
-
\??\c:\xfllfll.exec:\xfllfll.exe119⤵PID:4220
-
\??\c:\7nbhhn.exec:\7nbhhn.exe120⤵PID:4376
-
\??\c:\ntnbnn.exec:\ntnbnn.exe121⤵PID:1568
-
\??\c:\3dvpj.exec:\3dvpj.exe122⤵PID:3808
-
\??\c:\lrxxxlr.exec:\lrxxxlr.exe123⤵PID:1832
-
\??\c:\hbtttt.exec:\hbtttt.exe124⤵PID:4860
-
\??\c:\tthbtt.exec:\tthbtt.exe125⤵PID:4460
-
\??\c:\dddvp.exec:\dddvp.exe126⤵PID:2012
-
\??\c:\frrrxxr.exec:\frrrxxr.exe127⤵PID:444
-
\??\c:\ttbbnh.exec:\ttbbnh.exe128⤵PID:1732
-
\??\c:\jjjjj.exec:\jjjjj.exe129⤵PID:4272
-
\??\c:\7dvvd.exec:\7dvvd.exe130⤵PID:3720
-
\??\c:\fffflrr.exec:\fffflrr.exe131⤵PID:720
-
\??\c:\nbbnbn.exec:\nbbnbn.exe132⤵PID:4936
-
\??\c:\pjddj.exec:\pjddj.exe133⤵PID:5000
-
\??\c:\jdjvv.exec:\jdjvv.exe134⤵PID:2396
-
\??\c:\xfllrll.exec:\xfllrll.exe135⤵PID:5064
-
\??\c:\bbbbtt.exec:\bbbbtt.exe136⤵PID:1640
-
\??\c:\hnhbtt.exec:\hnhbtt.exe137⤵PID:912
-
\??\c:\pvjdp.exec:\pvjdp.exe138⤵PID:4348
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe139⤵PID:2528
-
\??\c:\rxxffll.exec:\rxxffll.exe140⤵PID:4040
-
\??\c:\ntnbnb.exec:\ntnbnb.exe141⤵PID:1336
-
\??\c:\ppvpp.exec:\ppvpp.exe142⤵PID:3172
-
\??\c:\rfrrlfx.exec:\rfrrlfx.exe143⤵PID:4052
-
\??\c:\rffxrrl.exec:\rffxrrl.exe144⤵PID:376
-
\??\c:\nhhbnt.exec:\nhhbnt.exe145⤵PID:2248
-
\??\c:\jjddd.exec:\jjddd.exe146⤵PID:1308
-
\??\c:\ffllfrl.exec:\ffllfrl.exe147⤵PID:4576
-
\??\c:\9xfxlfr.exec:\9xfxlfr.exe148⤵PID:4180
-
\??\c:\djjdp.exec:\djjdp.exe149⤵PID:1312
-
\??\c:\ffffxxr.exec:\ffffxxr.exe150⤵PID:4420
-
\??\c:\ttthhn.exec:\ttthhn.exe151⤵PID:4060
-
\??\c:\ttbtnn.exec:\ttbtnn.exe152⤵PID:1972
-
\??\c:\vvpdp.exec:\vvpdp.exe153⤵PID:2056
-
\??\c:\9ffxllf.exec:\9ffxllf.exe154⤵PID:4988
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe155⤵PID:956
-
\??\c:\3nnhbb.exec:\3nnhbb.exe156⤵PID:1372
-
\??\c:\7vdjv.exec:\7vdjv.exe157⤵PID:5008
-
\??\c:\ffflfrx.exec:\ffflfrx.exe158⤵PID:4244
-
\??\c:\lrrlrrl.exec:\lrrlrrl.exe159⤵PID:1116
-
\??\c:\5ttnhn.exec:\5ttnhn.exe160⤵PID:4340
-
\??\c:\jjvvp.exec:\jjvvp.exe161⤵PID:1732
-
\??\c:\pdddd.exec:\pdddd.exe162⤵PID:4272
-
\??\c:\frflrlr.exec:\frflrlr.exe163⤵PID:996
-
\??\c:\htnhbb.exec:\htnhbb.exe164⤵PID:2360
-
\??\c:\dvdpj.exec:\dvdpj.exe165⤵PID:4936
-
\??\c:\vjjvd.exec:\vjjvd.exe166⤵PID:4680
-
\??\c:\lfxrfxf.exec:\lfxrfxf.exe167⤵PID:1284
-
\??\c:\bhbnhb.exec:\bhbnhb.exe168⤵PID:4672
-
\??\c:\jdvvv.exec:\jdvvv.exe169⤵PID:4896
-
\??\c:\dvdpj.exec:\dvdpj.exe170⤵PID:4380
-
\??\c:\ffrxfrf.exec:\ffrxfrf.exe171⤵PID:4932
-
\??\c:\3hnnth.exec:\3hnnth.exe172⤵PID:4772
-
\??\c:\vpddd.exec:\vpddd.exe173⤵PID:1196
-
\??\c:\jdvvp.exec:\jdvvp.exe174⤵PID:2908
-
\??\c:\lfxfrfr.exec:\lfxfrfr.exe175⤵PID:3752
-
\??\c:\bntnhb.exec:\bntnhb.exe176⤵PID:2536
-
\??\c:\pjjjj.exec:\pjjjj.exe177⤵PID:2968
-
\??\c:\dpvvj.exec:\dpvvj.exe178⤵PID:1308
-
\??\c:\rxfrlxl.exec:\rxfrlxl.exe179⤵PID:4436
-
\??\c:\tbhbtt.exec:\tbhbtt.exe180⤵PID:2696
-
\??\c:\jdjpj.exec:\jdjpj.exe181⤵PID:632
-
\??\c:\9djdv.exec:\9djdv.exe182⤵PID:524
-
\??\c:\frrrlll.exec:\frrrlll.exe183⤵PID:3764
-
\??\c:\hhbbbb.exec:\hhbbbb.exe184⤵PID:1312
-
\??\c:\vppvp.exec:\vppvp.exe185⤵PID:4420
-
\??\c:\dvvvp.exec:\dvvvp.exe186⤵PID:4888
-
\??\c:\9rffrxr.exec:\9rffrxr.exe187⤵PID:5024
-
\??\c:\nbhtnn.exec:\nbhtnn.exe188⤵PID:3652
-
\??\c:\hbtttt.exec:\hbtttt.exe189⤵PID:5060
-
\??\c:\vjpjv.exec:\vjpjv.exe190⤵PID:4524
-
\??\c:\rxllrlf.exec:\rxllrlf.exe191⤵PID:1372
-
\??\c:\frxxrll.exec:\frxxrll.exe192⤵PID:2488
-
\??\c:\nnhtbt.exec:\nnhtbt.exe193⤵PID:3860
-
\??\c:\vvppp.exec:\vvppp.exe194⤵PID:1432
-
\??\c:\ppvdd.exec:\ppvdd.exe195⤵PID:2252
-
\??\c:\9fllrrr.exec:\9fllrrr.exe196⤵PID:1028
-
\??\c:\1tttbh.exec:\1tttbh.exe197⤵PID:2212
-
\??\c:\jpdjj.exec:\jpdjj.exe198⤵PID:1848
-
\??\c:\xfxxxfl.exec:\xfxxxfl.exe199⤵PID:3936
-
\??\c:\rfxfrxx.exec:\rfxfrxx.exe200⤵PID:3436
-
\??\c:\nbntnn.exec:\nbntnn.exe201⤵PID:216
-
\??\c:\3pjdp.exec:\3pjdp.exe202⤵PID:5072
-
\??\c:\rfffxfx.exec:\rfffxfx.exe203⤵PID:4680
-
\??\c:\frxrlrr.exec:\frxrlrr.exe204⤵PID:3348
-
\??\c:\bnnnhh.exec:\bnnnhh.exe205⤵PID:1640
-
\??\c:\pdvpj.exec:\pdvpj.exe206⤵PID:1864
-
\??\c:\xlrrllr.exec:\xlrrllr.exe207⤵PID:2220
-
\??\c:\hbhnbh.exec:\hbhnbh.exe208⤵PID:4380
-
\??\c:\thbhtn.exec:\thbhtn.exe209⤵PID:1604
-
\??\c:\dvjdd.exec:\dvjdd.exe210⤵PID:1336
-
\??\c:\rlrxxrf.exec:\rlrxxrf.exe211⤵PID:4604
-
\??\c:\rfflxlf.exec:\rfflxlf.exe212⤵PID:1680
-
\??\c:\tbhbtn.exec:\tbhbtn.exe213⤵PID:2908
-
\??\c:\jjddv.exec:\jjddv.exe214⤵PID:4756
-
\??\c:\jdpjj.exec:\jdpjj.exe215⤵PID:3440
-
\??\c:\rfxrxxr.exec:\rfxrxxr.exe216⤵PID:1044
-
\??\c:\nhtbhh.exec:\nhtbhh.exe217⤵PID:2744
-
\??\c:\htnhtn.exec:\htnhtn.exe218⤵PID:1308
-
\??\c:\3djjd.exec:\3djjd.exe219⤵PID:2200
-
\??\c:\vppjd.exec:\vppjd.exe220⤵PID:2696
-
\??\c:\5rfxllx.exec:\5rfxllx.exe221⤵PID:2240
-
\??\c:\hhhtnn.exec:\hhhtnn.exe222⤵PID:1224
-
\??\c:\ddjpp.exec:\ddjpp.exe223⤵PID:1560
-
\??\c:\3jjvp.exec:\3jjvp.exe224⤵PID:1020
-
\??\c:\rxfffff.exec:\rxfffff.exe225⤵PID:212
-
\??\c:\rrxxfxx.exec:\rrxxfxx.exe226⤵PID:2456
-
\??\c:\5hnhbb.exec:\5hnhbb.exe227⤵PID:4376
-
\??\c:\9vjdv.exec:\9vjdv.exe228⤵PID:4220
-
\??\c:\vddvp.exec:\vddvp.exe229⤵PID:4824
-
\??\c:\xxxxrxl.exec:\xxxxrxl.exe230⤵PID:1532
-
\??\c:\1dvvv.exec:\1dvvv.exe231⤵PID:1324
-
\??\c:\jvjdd.exec:\jvjdd.exe232⤵PID:2096
-
\??\c:\9rxlxfr.exec:\9rxlxfr.exe233⤵PID:4860
-
\??\c:\bthttt.exec:\bthttt.exe234⤵PID:2012
-
\??\c:\htbnnh.exec:\htbnnh.exe235⤵PID:5048
-
\??\c:\dvjjp.exec:\dvjjp.exe236⤵PID:1344
-
\??\c:\xxfxxrl.exec:\xxfxxrl.exe237⤵PID:444
-
\??\c:\xfrlllf.exec:\xfrlllf.exe238⤵PID:2184
-
\??\c:\hbntbn.exec:\hbntbn.exe239⤵PID:4668
-
\??\c:\pjvdj.exec:\pjvdj.exe240⤵PID:1132
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe241⤵PID:720
-
\??\c:\7flffrr.exec:\7flffrr.exe242⤵PID:3688