Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a614fbf88a36a9ad358bcbbc0f70c20_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9a614fbf88a36a9ad358bcbbc0f70c20_NeikiAnalytics.exe
-
Size
282KB
-
MD5
9a614fbf88a36a9ad358bcbbc0f70c20
-
SHA1
5b89ad75ea06c1212c9c8a5b671dae7172db4509
-
SHA256
c0cf208f3ac94ed5ce60354b987501b5965d4ac3bd96bd99e913710b02e377b4
-
SHA512
680937e7af90bfa922537064687f2481c30cbd198ebf4d73dddc03ac9960147703c739b22ef99fb4f10d800c6e61a150157b077a4266de6945d1dcbbf3b4bb72
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTF5n:8cm7ImGddXmNt251UriZF5n
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3148-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-760-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-912-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-1007-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-1029-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffrlrrr.exetnnnnh.exepvvvp.exerlxrlff.exetnbbbh.exethtbbt.exepjpjp.exebntnnt.exefxrrxrf.exepvppv.exerxxxffl.exe3nbtht.exelflllfx.exetntbbh.exepjvpj.exerxrlllf.exenthnnb.exefffxflr.exehnnhth.exe9rlxrff.exetnnnnb.exeppjdv.exejjvvv.exejpvjd.exexrrllfx.exelxllllx.exennnnhh.exehhnnnb.exedvdvp.exeflfxrlx.exexxlrrrr.exerfllfff.exeddjjj.exexrxxxff.exepdpvd.exelfxrfrf.exethhtnn.exedpdvp.exefrlllrl.exetbthbn.exeflxfrfr.exethbhnb.exevppvj.exerrflfff.exehbhhhh.exejdpvd.exerxfllll.exexflfxxx.exebttnnb.exevjjpv.exefxfrxxr.exethnntt.exevjvpj.exexlllfxl.exenhthnb.exepvdjp.exe9rlllll.exebtbbhh.exefrflfrf.exennthht.exehnbntn.exevjdvp.exexflrfrf.exebnbbbn.exepid process 1372 ffrlrrr.exe 3328 tnnnnh.exe 864 pvvvp.exe 1280 rlxrlff.exe 3988 tnbbbh.exe 2692 thtbbt.exe 3548 pjpjp.exe 2368 bntnnt.exe 2012 fxrrxrf.exe 5112 pvppv.exe 3616 rxxxffl.exe 216 3nbtht.exe 2092 lflllfx.exe 3468 tntbbh.exe 2024 pjvpj.exe 4220 rxrlllf.exe 1904 nthnnb.exe 4192 fffxflr.exe 2184 hnnhth.exe 968 9rlxrff.exe 2620 tnnnnb.exe 1656 ppjdv.exe 1464 jjvvv.exe 4544 jpvjd.exe 1180 xrrllfx.exe 1756 lxllllx.exe 2452 nnnnhh.exe 3464 hhnnnb.exe 3764 dvdvp.exe 2148 flfxrlx.exe 652 xxlrrrr.exe 384 rfllfff.exe 1612 ddjjj.exe 4788 xrxxxff.exe 2672 pdpvd.exe 3640 lfxrfrf.exe 3328 thhtnn.exe 2256 dpdvp.exe 3116 frlllrl.exe 3076 tbthbn.exe 4852 flxfrfr.exe 5004 thbhnb.exe 1772 vppvj.exe 3156 rrflfff.exe 2712 hbhhhh.exe 1020 jdpvd.exe 3548 rxfllll.exe 1392 xflfxxx.exe 4092 bttnnb.exe 4008 vjjpv.exe 3336 fxfrxxr.exe 1972 thnntt.exe 1880 vjvpj.exe 208 xlllfxl.exe 2860 nhthnb.exe 3712 pvdjp.exe 3468 9rlllll.exe 3236 btbbhh.exe 1192 frflfrf.exe 2876 nnthht.exe 4412 hnbntn.exe 4564 vjdvp.exe 1504 xflrfrf.exe 1484 bnbbbn.exe -
Processes:
resource yara_rule behavioral2/memory/3148-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-512-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9a614fbf88a36a9ad358bcbbc0f70c20_NeikiAnalytics.exeffrlrrr.exetnnnnh.exepvvvp.exerlxrlff.exetnbbbh.exethtbbt.exepjpjp.exebntnnt.exefxrrxrf.exepvppv.exerxxxffl.exe3nbtht.exelflllfx.exetntbbh.exepjvpj.exerxrlllf.exenthnnb.exefffxflr.exehnnhth.exe9rlxrff.exetnnnnb.exedescription pid process target process PID 3148 wrote to memory of 1372 3148 9a614fbf88a36a9ad358bcbbc0f70c20_NeikiAnalytics.exe ffrlrrr.exe PID 3148 wrote to memory of 1372 3148 9a614fbf88a36a9ad358bcbbc0f70c20_NeikiAnalytics.exe ffrlrrr.exe PID 3148 wrote to memory of 1372 3148 9a614fbf88a36a9ad358bcbbc0f70c20_NeikiAnalytics.exe ffrlrrr.exe PID 1372 wrote to memory of 3328 1372 ffrlrrr.exe tnnnnh.exe PID 1372 wrote to memory of 3328 1372 ffrlrrr.exe tnnnnh.exe PID 1372 wrote to memory of 3328 1372 ffrlrrr.exe tnnnnh.exe PID 3328 wrote to memory of 864 3328 tnnnnh.exe pvvvp.exe PID 3328 wrote to memory of 864 3328 tnnnnh.exe pvvvp.exe PID 3328 wrote to memory of 864 3328 tnnnnh.exe pvvvp.exe PID 864 wrote to memory of 1280 864 pvvvp.exe rlxrlff.exe PID 864 wrote to memory of 1280 864 pvvvp.exe rlxrlff.exe PID 864 wrote to memory of 1280 864 pvvvp.exe rlxrlff.exe PID 1280 wrote to memory of 3988 1280 rlxrlff.exe tnbbbh.exe PID 1280 wrote to memory of 3988 1280 rlxrlff.exe tnbbbh.exe PID 1280 wrote to memory of 3988 1280 rlxrlff.exe tnbbbh.exe PID 3988 wrote to memory of 2692 3988 tnbbbh.exe thtbbt.exe PID 3988 wrote to memory of 2692 3988 tnbbbh.exe thtbbt.exe PID 3988 wrote to memory of 2692 3988 tnbbbh.exe thtbbt.exe PID 2692 wrote to memory of 3548 2692 thtbbt.exe pjpjp.exe PID 2692 wrote to memory of 3548 2692 thtbbt.exe pjpjp.exe PID 2692 wrote to memory of 3548 2692 thtbbt.exe pjpjp.exe PID 3548 wrote to memory of 2368 3548 pjpjp.exe bntnnt.exe PID 3548 wrote to memory of 2368 3548 pjpjp.exe bntnnt.exe PID 3548 wrote to memory of 2368 3548 pjpjp.exe bntnnt.exe PID 2368 wrote to memory of 2012 2368 bntnnt.exe fxrrxrf.exe PID 2368 wrote to memory of 2012 2368 bntnnt.exe fxrrxrf.exe PID 2368 wrote to memory of 2012 2368 bntnnt.exe fxrrxrf.exe PID 2012 wrote to memory of 5112 2012 fxrrxrf.exe pvppv.exe PID 2012 wrote to memory of 5112 2012 fxrrxrf.exe pvppv.exe PID 2012 wrote to memory of 5112 2012 fxrrxrf.exe pvppv.exe PID 5112 wrote to memory of 3616 5112 pvppv.exe rxxxffl.exe PID 5112 wrote to memory of 3616 5112 pvppv.exe rxxxffl.exe PID 5112 wrote to memory of 3616 5112 pvppv.exe rxxxffl.exe PID 3616 wrote to memory of 216 3616 rxxxffl.exe 3nbtht.exe PID 3616 wrote to memory of 216 3616 rxxxffl.exe 3nbtht.exe PID 3616 wrote to memory of 216 3616 rxxxffl.exe 3nbtht.exe PID 216 wrote to memory of 2092 216 3nbtht.exe lflllfx.exe PID 216 wrote to memory of 2092 216 3nbtht.exe lflllfx.exe PID 216 wrote to memory of 2092 216 3nbtht.exe lflllfx.exe PID 2092 wrote to memory of 3468 2092 lflllfx.exe tntbbh.exe PID 2092 wrote to memory of 3468 2092 lflllfx.exe tntbbh.exe PID 2092 wrote to memory of 3468 2092 lflllfx.exe tntbbh.exe PID 3468 wrote to memory of 2024 3468 tntbbh.exe pjvpj.exe PID 3468 wrote to memory of 2024 3468 tntbbh.exe pjvpj.exe PID 3468 wrote to memory of 2024 3468 tntbbh.exe pjvpj.exe PID 2024 wrote to memory of 4220 2024 pjvpj.exe rxrlllf.exe PID 2024 wrote to memory of 4220 2024 pjvpj.exe rxrlllf.exe PID 2024 wrote to memory of 4220 2024 pjvpj.exe rxrlllf.exe PID 4220 wrote to memory of 1904 4220 rxrlllf.exe nthnnb.exe PID 4220 wrote to memory of 1904 4220 rxrlllf.exe nthnnb.exe PID 4220 wrote to memory of 1904 4220 rxrlllf.exe nthnnb.exe PID 1904 wrote to memory of 4192 1904 nthnnb.exe fffxflr.exe PID 1904 wrote to memory of 4192 1904 nthnnb.exe fffxflr.exe PID 1904 wrote to memory of 4192 1904 nthnnb.exe fffxflr.exe PID 4192 wrote to memory of 2184 4192 fffxflr.exe hnnhth.exe PID 4192 wrote to memory of 2184 4192 fffxflr.exe hnnhth.exe PID 4192 wrote to memory of 2184 4192 fffxflr.exe hnnhth.exe PID 2184 wrote to memory of 968 2184 hnnhth.exe 9rlxrff.exe PID 2184 wrote to memory of 968 2184 hnnhth.exe 9rlxrff.exe PID 2184 wrote to memory of 968 2184 hnnhth.exe 9rlxrff.exe PID 968 wrote to memory of 2620 968 9rlxrff.exe tnnnnb.exe PID 968 wrote to memory of 2620 968 9rlxrff.exe tnnnnb.exe PID 968 wrote to memory of 2620 968 9rlxrff.exe tnnnnb.exe PID 2620 wrote to memory of 1656 2620 tnnnnb.exe ppjdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a614fbf88a36a9ad358bcbbc0f70c20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9a614fbf88a36a9ad358bcbbc0f70c20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrlrrr.exec:\ffrlrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnnnh.exec:\tnnnnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvvvp.exec:\pvvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxrlff.exec:\rlxrlff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbbbh.exec:\tnbbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thtbbt.exec:\thtbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpjp.exec:\pjpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bntnnt.exec:\bntnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrrxrf.exec:\fxrrxrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvppv.exec:\pvppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxxxffl.exec:\rxxxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nbtht.exec:\3nbtht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflllfx.exec:\lflllfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tntbbh.exec:\tntbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvpj.exec:\pjvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrlllf.exec:\rxrlllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nthnnb.exec:\nthnnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffxflr.exec:\fffxflr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnnhth.exec:\hnnhth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9rlxrff.exec:\9rlxrff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnnnb.exec:\tnnnnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjdv.exec:\ppjdv.exe23⤵
- Executes dropped EXE
-
\??\c:\jjvvv.exec:\jjvvv.exe24⤵
- Executes dropped EXE
-
\??\c:\jpvjd.exec:\jpvjd.exe25⤵
- Executes dropped EXE
-
\??\c:\xrrllfx.exec:\xrrllfx.exe26⤵
- Executes dropped EXE
-
\??\c:\lxllllx.exec:\lxllllx.exe27⤵
- Executes dropped EXE
-
\??\c:\nnnnhh.exec:\nnnnhh.exe28⤵
- Executes dropped EXE
-
\??\c:\hhnnnb.exec:\hhnnnb.exe29⤵
- Executes dropped EXE
-
\??\c:\dvdvp.exec:\dvdvp.exe30⤵
- Executes dropped EXE
-
\??\c:\flfxrlx.exec:\flfxrlx.exe31⤵
- Executes dropped EXE
-
\??\c:\xxlrrrr.exec:\xxlrrrr.exe32⤵
- Executes dropped EXE
-
\??\c:\rfllfff.exec:\rfllfff.exe33⤵
- Executes dropped EXE
-
\??\c:\ddjjj.exec:\ddjjj.exe34⤵
- Executes dropped EXE
-
\??\c:\xrxxxff.exec:\xrxxxff.exe35⤵
- Executes dropped EXE
-
\??\c:\btntbn.exec:\btntbn.exe36⤵
-
\??\c:\pdpvd.exec:\pdpvd.exe37⤵
- Executes dropped EXE
-
\??\c:\lfxrfrf.exec:\lfxrfrf.exe38⤵
- Executes dropped EXE
-
\??\c:\thhtnn.exec:\thhtnn.exe39⤵
- Executes dropped EXE
-
\??\c:\dpdvp.exec:\dpdvp.exe40⤵
- Executes dropped EXE
-
\??\c:\frlllrl.exec:\frlllrl.exe41⤵
- Executes dropped EXE
-
\??\c:\tbthbn.exec:\tbthbn.exe42⤵
- Executes dropped EXE
-
\??\c:\flxfrfr.exec:\flxfrfr.exe43⤵
- Executes dropped EXE
-
\??\c:\thbhnb.exec:\thbhnb.exe44⤵
- Executes dropped EXE
-
\??\c:\vppvj.exec:\vppvj.exe45⤵
- Executes dropped EXE
-
\??\c:\rrflfff.exec:\rrflfff.exe46⤵
- Executes dropped EXE
-
\??\c:\hbhhhh.exec:\hbhhhh.exe47⤵
- Executes dropped EXE
-
\??\c:\jdpvd.exec:\jdpvd.exe48⤵
- Executes dropped EXE
-
\??\c:\rxfllll.exec:\rxfllll.exe49⤵
- Executes dropped EXE
-
\??\c:\xflfxxx.exec:\xflfxxx.exe50⤵
- Executes dropped EXE
-
\??\c:\bttnnb.exec:\bttnnb.exe51⤵
- Executes dropped EXE
-
\??\c:\vjjpv.exec:\vjjpv.exe52⤵
- Executes dropped EXE
-
\??\c:\fxfrxxr.exec:\fxfrxxr.exe53⤵
- Executes dropped EXE
-
\??\c:\thnntt.exec:\thnntt.exe54⤵
- Executes dropped EXE
-
\??\c:\vjvpj.exec:\vjvpj.exe55⤵
- Executes dropped EXE
-
\??\c:\xlllfxl.exec:\xlllfxl.exe56⤵
- Executes dropped EXE
-
\??\c:\nhthnb.exec:\nhthnb.exe57⤵
- Executes dropped EXE
-
\??\c:\pvdjp.exec:\pvdjp.exe58⤵
- Executes dropped EXE
-
\??\c:\9rlllll.exec:\9rlllll.exe59⤵
- Executes dropped EXE
-
\??\c:\btbbhh.exec:\btbbhh.exe60⤵
- Executes dropped EXE
-
\??\c:\frflfrf.exec:\frflfrf.exe61⤵
- Executes dropped EXE
-
\??\c:\nnthht.exec:\nnthht.exe62⤵
- Executes dropped EXE
-
\??\c:\hnbntn.exec:\hnbntn.exe63⤵
- Executes dropped EXE
-
\??\c:\vjdvp.exec:\vjdvp.exe64⤵
- Executes dropped EXE
-
\??\c:\xflrfrf.exec:\xflrfrf.exe65⤵
- Executes dropped EXE
-
\??\c:\bnbbbn.exec:\bnbbbn.exe66⤵
- Executes dropped EXE
-
\??\c:\5dddd.exec:\5dddd.exe67⤵
-
\??\c:\fxrfxrr.exec:\fxrfxrr.exe68⤵
-
\??\c:\tthntn.exec:\tthntn.exe69⤵
-
\??\c:\vvpvv.exec:\vvpvv.exe70⤵
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe71⤵
-
\??\c:\hhhnbt.exec:\hhhnbt.exe72⤵
-
\??\c:\vvvpp.exec:\vvvpp.exe73⤵
-
\??\c:\3nhbtt.exec:\3nhbtt.exe74⤵
-
\??\c:\vdvvv.exec:\vdvvv.exe75⤵
-
\??\c:\xrxfllx.exec:\xrxfllx.exe76⤵
-
\??\c:\1tnhnn.exec:\1tnhnn.exe77⤵
-
\??\c:\jppvj.exec:\jppvj.exe78⤵
-
\??\c:\lrrxxlx.exec:\lrrxxlx.exe79⤵
-
\??\c:\nbhtnb.exec:\nbhtnb.exe80⤵
-
\??\c:\jpdpd.exec:\jpdpd.exe81⤵
-
\??\c:\vjpdd.exec:\vjpdd.exe82⤵
-
\??\c:\frlrfrx.exec:\frlrfrx.exe83⤵
-
\??\c:\hnhtbn.exec:\hnhtbn.exe84⤵
-
\??\c:\ppvjd.exec:\ppvjd.exe85⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe86⤵
-
\??\c:\lrlrlrl.exec:\lrlrlrl.exe87⤵
-
\??\c:\hbnnhn.exec:\hbnnhn.exe88⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe89⤵
-
\??\c:\dpdvv.exec:\dpdvv.exe90⤵
-
\??\c:\rlffxxx.exec:\rlffxxx.exe91⤵
-
\??\c:\tttttt.exec:\tttttt.exe92⤵
-
\??\c:\jvjpv.exec:\jvjpv.exe93⤵
-
\??\c:\xfrxlrr.exec:\xfrxlrr.exe94⤵
-
\??\c:\fxflffx.exec:\fxflffx.exe95⤵
-
\??\c:\thbntb.exec:\thbntb.exe96⤵
-
\??\c:\vpppp.exec:\vpppp.exe97⤵
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe98⤵
-
\??\c:\htnhnh.exec:\htnhnh.exe99⤵
-
\??\c:\btnnnn.exec:\btnnnn.exe100⤵
-
\??\c:\jdjjd.exec:\jdjjd.exe101⤵
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe102⤵
-
\??\c:\ttntbn.exec:\ttntbn.exe103⤵
-
\??\c:\bhtnhb.exec:\bhtnhb.exe104⤵
-
\??\c:\rxfxfxx.exec:\rxfxfxx.exe105⤵
-
\??\c:\ntbtht.exec:\ntbtht.exe106⤵
-
\??\c:\jvvvp.exec:\jvvvp.exe107⤵
-
\??\c:\rllrxlx.exec:\rllrxlx.exe108⤵
-
\??\c:\rrflrlx.exec:\rrflrlx.exe109⤵
-
\??\c:\hbhhht.exec:\hbhhht.exe110⤵
-
\??\c:\vpdpv.exec:\vpdpv.exe111⤵
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe112⤵
-
\??\c:\htbhbh.exec:\htbhbh.exe113⤵
-
\??\c:\1bnbbb.exec:\1bnbbb.exe114⤵
-
\??\c:\pvjdj.exec:\pvjdj.exe115⤵
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe116⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe117⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe118⤵
-
\??\c:\rfrxlrl.exec:\rfrxlrl.exe119⤵
-
\??\c:\nnttnn.exec:\nnttnn.exe120⤵
-
\??\c:\pdjjv.exec:\pdjjv.exe121⤵
-
\??\c:\fxffxxx.exec:\fxffxxx.exe122⤵
-
\??\c:\btttnt.exec:\btttnt.exe123⤵
-
\??\c:\jdppv.exec:\jdppv.exe124⤵
-
\??\c:\1rfxxrr.exec:\1rfxxrr.exe125⤵
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe126⤵
-
\??\c:\btttnn.exec:\btttnn.exe127⤵
-
\??\c:\pvjvd.exec:\pvjvd.exe128⤵
-
\??\c:\xlxfrff.exec:\xlxfrff.exe129⤵
-
\??\c:\xxlxfrf.exec:\xxlxfrf.exe130⤵
-
\??\c:\jpvvd.exec:\jpvvd.exe131⤵
-
\??\c:\rfxlrfr.exec:\rfxlrfr.exe132⤵
-
\??\c:\btbttt.exec:\btbttt.exe133⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe134⤵
-
\??\c:\fllrrrr.exec:\fllrrrr.exe135⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe136⤵
-
\??\c:\bnhhhh.exec:\bnhhhh.exe137⤵
-
\??\c:\dppjv.exec:\dppjv.exe138⤵
-
\??\c:\7lllrxx.exec:\7lllrxx.exe139⤵
-
\??\c:\hhnhbh.exec:\hhnhbh.exe140⤵
-
\??\c:\djddj.exec:\djddj.exe141⤵
-
\??\c:\jdppj.exec:\jdppj.exe142⤵
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe143⤵
-
\??\c:\djpdp.exec:\djpdp.exe144⤵
-
\??\c:\jpvjj.exec:\jpvjj.exe145⤵
-
\??\c:\hbhhbb.exec:\hbhhbb.exe146⤵
-
\??\c:\dpddv.exec:\dpddv.exe147⤵
-
\??\c:\rllfrfl.exec:\rllfrfl.exe148⤵
-
\??\c:\3lrrllx.exec:\3lrrllx.exe149⤵
-
\??\c:\htttnn.exec:\htttnn.exe150⤵
-
\??\c:\5pppj.exec:\5pppj.exe151⤵
-
\??\c:\ffllffx.exec:\ffllffx.exe152⤵
-
\??\c:\hntttn.exec:\hntttn.exe153⤵
-
\??\c:\dvjpp.exec:\dvjpp.exe154⤵
-
\??\c:\lxffxxx.exec:\lxffxxx.exe155⤵
-
\??\c:\fxlxxff.exec:\fxlxxff.exe156⤵
-
\??\c:\thnhnn.exec:\thnhnn.exe157⤵
-
\??\c:\thhhbt.exec:\thhhbt.exe158⤵
-
\??\c:\jpvvp.exec:\jpvvp.exe159⤵
-
\??\c:\fxlrlxl.exec:\fxlrlxl.exe160⤵
-
\??\c:\xrffxrl.exec:\xrffxrl.exe161⤵
-
\??\c:\ttttbn.exec:\ttttbn.exe162⤵
-
\??\c:\pjdjp.exec:\pjdjp.exe163⤵
-
\??\c:\xxlffrf.exec:\xxlffrf.exe164⤵
-
\??\c:\nhttnb.exec:\nhttnb.exe165⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe166⤵
-
\??\c:\3ddvp.exec:\3ddvp.exe167⤵
-
\??\c:\lxrlllr.exec:\lxrlllr.exe168⤵
-
\??\c:\hnbttt.exec:\hnbttt.exe169⤵
-
\??\c:\hbbbnn.exec:\hbbbnn.exe170⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe171⤵
-
\??\c:\lffllff.exec:\lffllff.exe172⤵
-
\??\c:\ttbtbn.exec:\ttbtbn.exe173⤵
-
\??\c:\thnntt.exec:\thnntt.exe174⤵
-
\??\c:\ppvvd.exec:\ppvvd.exe175⤵
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe176⤵
-
\??\c:\nhbnbn.exec:\nhbnbn.exe177⤵
-
\??\c:\hhbbbb.exec:\hhbbbb.exe178⤵
-
\??\c:\djjpd.exec:\djjpd.exe179⤵
-
\??\c:\lrxrrll.exec:\lrxrrll.exe180⤵
-
\??\c:\bttnnn.exec:\bttnnn.exe181⤵
-
\??\c:\tntnnh.exec:\tntnnh.exe182⤵
-
\??\c:\pvvpv.exec:\pvvpv.exe183⤵
-
\??\c:\xrllxlx.exec:\xrllxlx.exe184⤵
-
\??\c:\tttbnn.exec:\tttbnn.exe185⤵
-
\??\c:\xxrrlrf.exec:\xxrrlrf.exe186⤵
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe187⤵
-
\??\c:\bhnhbb.exec:\bhnhbb.exe188⤵
-
\??\c:\5dppp.exec:\5dppp.exe189⤵
-
\??\c:\rlxxflx.exec:\rlxxflx.exe190⤵
-
\??\c:\7xrxxll.exec:\7xrxxll.exe191⤵
-
\??\c:\bttttt.exec:\bttttt.exe192⤵
-
\??\c:\pjdvp.exec:\pjdvp.exe193⤵
-
\??\c:\llxxrxf.exec:\llxxrxf.exe194⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe195⤵
-
\??\c:\htthbb.exec:\htthbb.exe196⤵
-
\??\c:\dddjd.exec:\dddjd.exe197⤵
-
\??\c:\flxxllx.exec:\flxxllx.exe198⤵
-
\??\c:\hhnhbh.exec:\hhnhbh.exe199⤵
-
\??\c:\7tbttt.exec:\7tbttt.exe200⤵
-
\??\c:\ppppj.exec:\ppppj.exe201⤵
-
\??\c:\1rrrxxx.exec:\1rrrxxx.exe202⤵
-
\??\c:\3rflrxf.exec:\3rflrxf.exe203⤵
-
\??\c:\htbhnt.exec:\htbhnt.exe204⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe205⤵
-
\??\c:\lrrfrlf.exec:\lrrfrlf.exe206⤵
-
\??\c:\xlrlfff.exec:\xlrlfff.exe207⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe208⤵
-
\??\c:\dvddv.exec:\dvddv.exe209⤵
-
\??\c:\rxxxxxr.exec:\rxxxxxr.exe210⤵
-
\??\c:\fflxlfl.exec:\fflxlfl.exe211⤵
-
\??\c:\tbttnt.exec:\tbttnt.exe212⤵
-
\??\c:\vppvv.exec:\vppvv.exe213⤵
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe214⤵
-
\??\c:\bbbttt.exec:\bbbttt.exe215⤵
-
\??\c:\flrlxlx.exec:\flrlxlx.exe216⤵
-
\??\c:\xlxxrrl.exec:\xlxxrrl.exe217⤵
-
\??\c:\bthbbb.exec:\bthbbb.exe218⤵
-
\??\c:\vjdjp.exec:\vjdjp.exe219⤵
-
\??\c:\9pjdv.exec:\9pjdv.exe220⤵
-
\??\c:\xlxffrl.exec:\xlxffrl.exe221⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe222⤵
-
\??\c:\httttb.exec:\httttb.exe223⤵
-
\??\c:\ddjpp.exec:\ddjpp.exe224⤵
-
\??\c:\xxxxxxr.exec:\xxxxxxr.exe225⤵
-
\??\c:\nhnhnn.exec:\nhnhnn.exe226⤵
-
\??\c:\nbbthn.exec:\nbbthn.exe227⤵
-
\??\c:\pjppj.exec:\pjppj.exe228⤵
-
\??\c:\9vvpj.exec:\9vvpj.exe229⤵
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe230⤵
-
\??\c:\nhtnhb.exec:\nhtnhb.exe231⤵
-
\??\c:\dppdp.exec:\dppdp.exe232⤵
-
\??\c:\vjvpj.exec:\vjvpj.exe233⤵
-
\??\c:\fxxrllf.exec:\fxxrllf.exe234⤵
-
\??\c:\lxxfllx.exec:\lxxfllx.exe235⤵
-
\??\c:\thttbh.exec:\thttbh.exe236⤵
-
\??\c:\pddvj.exec:\pddvj.exe237⤵
-
\??\c:\fxrllxl.exec:\fxrllxl.exe238⤵
-
\??\c:\xlxflrr.exec:\xlxflrr.exe239⤵
-
\??\c:\thbtnn.exec:\thbtnn.exe240⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe241⤵