Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:32
Behavioral task
behavioral1
Sample
6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe
-
Size
164KB
-
MD5
6e1b8d80fc75dfc92364fc9fc73bbec0
-
SHA1
bcc4b9b909e233dea2eada661ef6f275929d290c
-
SHA256
90cf4049488b01928353a1532bd34f5912f57d767f95199281104c05d42e339a
-
SHA512
3adaf765b7383d7acd6ae1a51a2915a34418224f08561597f3f10c995779544d0744cef82ce657d9f5b5f7f420c2e156af31f40d70e3f23095ae60ac0800de3d
-
SSDEEP
3072:0hOmTsF93UYfwC6GIoutXEnkeBahPmSBPt7ZY16E:0cm4FmowdHoSet4hPhTlY4E
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2184-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3156-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3128-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-791-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-810-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-887-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1332-944-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-954-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/424-982-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-1047-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxrflrx.exe1nhbtt.exenhhbnh.exejppjv.exedvpvv.exelrllxxx.exennnnhn.exe5tbhtn.exe5pjdv.exehtnhhb.exejvvpj.exexffflll.exefxrrrrx.exedvdpv.exerxxrlll.exeppjjd.exelrxlffx.exehhnhtt.exeddpjv.exerlrrrll.exe1hnnnn.exe9vvvv.exe7fllfrl.exettnnnt.exejdjjj.exexrlffff.exenhtttt.exenbtnnn.exeppppd.exelxlrrfl.exennhhhn.exevjvvv.exepdvvv.exelfxxfxf.exehhnnnt.exeppvpp.exeddjjj.exe1fllrxf.exebbnnnt.exennnnnt.exe9djvp.exefflrxfl.exe9nhhhn.exejjppp.exedpddv.exefrfrlrr.exetbnhth.exevvpjj.exe7rrlfxr.exetntttb.exevvvjp.exepdjjj.exe5rlllrr.exebhnntt.exepppjp.exe9djvd.exefxrrffr.exehhhnnn.exehthntn.exe7djjj.exevjjdp.exe1flfrrl.exe5hhhtb.exennnntt.exepid process 2184 xxrflrx.exe 2308 1nhbtt.exe 3368 nhhbnh.exe 3584 jppjv.exe 1128 dvpvv.exe 4480 lrllxxx.exe 4660 nnnnhn.exe 4892 5tbhtn.exe 4996 5pjdv.exe 3520 htnhhb.exe 1528 jvvpj.exe 3376 xffflll.exe 2756 fxrrrrx.exe 2792 dvdpv.exe 3536 rxxrlll.exe 4856 ppjjd.exe 4780 lrxlffx.exe 4932 hhnhtt.exe 4132 ddpjv.exe 3124 rlrrrll.exe 1740 1hnnnn.exe 1120 9vvvv.exe 5004 7fllfrl.exe 3272 ttnnnt.exe 2152 jdjjj.exe 4580 xrlffff.exe 3288 nhtttt.exe 3900 nbtnnn.exe 2980 ppppd.exe 940 lxlrrfl.exe 1984 nnhhhn.exe 3532 vjvvv.exe 4216 pdvvv.exe 1584 lfxxfxf.exe 1812 hhnnnt.exe 3048 ppvpp.exe 2408 ddjjj.exe 3828 1fllrxf.exe 4372 bbnnnt.exe 4624 nnnnnt.exe 4888 9djvp.exe 4028 fflrxfl.exe 4876 9nhhhn.exe 3144 jjppp.exe 2868 dpddv.exe 3688 frfrlrr.exe 968 tbnhth.exe 2192 vvpjj.exe 1640 7rrlfxr.exe 4072 tntttb.exe 1400 vvvjp.exe 4036 pdjjj.exe 892 5rlllrr.exe 2132 bhnntt.exe 3668 pppjp.exe 3128 9djvd.exe 3752 fxrrffr.exe 3376 hhhnnn.exe 4300 hthntn.exe 1004 7djjj.exe 3536 vjjdp.exe 464 1flfrrl.exe 2552 5hhhtb.exe 5100 nnnntt.exe -
Processes:
resource yara_rule behavioral2/memory/3156-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xxrflrx.exe upx behavioral2/memory/2184-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1nhbtt.exe upx \??\c:\jppjv.exe upx \??\c:\lrllxxx.exe upx \??\c:\nnnnhn.exe upx \??\c:\5tbhtn.exe upx \??\c:\5pjdv.exe upx behavioral2/memory/4660-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4892-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4996-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htnhhb.exe upx behavioral2/memory/4480-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1128-31-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvpvv.exe upx behavioral2/memory/3368-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3584-23-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhhbnh.exe upx behavioral2/memory/2308-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3156-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvvpj.exe upx behavioral2/memory/1528-66-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xffflll.exe upx C:\fxrrrrx.exe upx C:\dvdpv.exe upx behavioral2/memory/2756-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxxrlll.exe upx behavioral2/memory/2792-86-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ppjjd.exe upx behavioral2/memory/3536-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrxlffx.exe upx behavioral2/memory/4856-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4780-102-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhnhtt.exe upx C:\ddpjv.exe upx C:\rlrrrll.exe upx behavioral2/memory/3124-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1hnnnn.exe upx behavioral2/memory/3124-121-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9vvvv.exe upx behavioral2/memory/1120-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7fllfrl.exe upx behavioral2/memory/1740-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttnnnt.exe upx C:\jdjjj.exe upx behavioral2/memory/3272-144-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlffff.exe upx C:\nhtttt.exe upx behavioral2/memory/3288-157-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbtnnn.exe upx behavioral2/memory/3900-162-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ppppd.exe upx \??\c:\lxlrrfl.exe upx behavioral2/memory/940-175-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnhhhn.exe upx behavioral2/memory/2980-170-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjvvv.exe upx behavioral2/memory/3532-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4216-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1812-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3048-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4372-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4888-220-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exexxrflrx.exe1nhbtt.exenhhbnh.exejppjv.exedvpvv.exelrllxxx.exennnnhn.exe5tbhtn.exe5pjdv.exehtnhhb.exejvvpj.exexffflll.exefxrrrrx.exedvdpv.exerxxrlll.exeppjjd.exelrxlffx.exehhnhtt.exeddpjv.exerlrrrll.exe1hnnnn.exedescription pid process target process PID 3156 wrote to memory of 2184 3156 6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe xxrflrx.exe PID 3156 wrote to memory of 2184 3156 6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe xxrflrx.exe PID 3156 wrote to memory of 2184 3156 6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe xxrflrx.exe PID 2184 wrote to memory of 2308 2184 xxrflrx.exe 1nhbtt.exe PID 2184 wrote to memory of 2308 2184 xxrflrx.exe 1nhbtt.exe PID 2184 wrote to memory of 2308 2184 xxrflrx.exe 1nhbtt.exe PID 2308 wrote to memory of 3368 2308 1nhbtt.exe nhhbnh.exe PID 2308 wrote to memory of 3368 2308 1nhbtt.exe nhhbnh.exe PID 2308 wrote to memory of 3368 2308 1nhbtt.exe nhhbnh.exe PID 3368 wrote to memory of 3584 3368 nhhbnh.exe jppjv.exe PID 3368 wrote to memory of 3584 3368 nhhbnh.exe jppjv.exe PID 3368 wrote to memory of 3584 3368 nhhbnh.exe jppjv.exe PID 3584 wrote to memory of 1128 3584 jppjv.exe dvpvv.exe PID 3584 wrote to memory of 1128 3584 jppjv.exe dvpvv.exe PID 3584 wrote to memory of 1128 3584 jppjv.exe dvpvv.exe PID 1128 wrote to memory of 4480 1128 dvpvv.exe lrllxxx.exe PID 1128 wrote to memory of 4480 1128 dvpvv.exe lrllxxx.exe PID 1128 wrote to memory of 4480 1128 dvpvv.exe lrllxxx.exe PID 4480 wrote to memory of 4660 4480 lrllxxx.exe nnnnhn.exe PID 4480 wrote to memory of 4660 4480 lrllxxx.exe nnnnhn.exe PID 4480 wrote to memory of 4660 4480 lrllxxx.exe nnnnhn.exe PID 4660 wrote to memory of 4892 4660 nnnnhn.exe 5tbhtn.exe PID 4660 wrote to memory of 4892 4660 nnnnhn.exe 5tbhtn.exe PID 4660 wrote to memory of 4892 4660 nnnnhn.exe 5tbhtn.exe PID 4892 wrote to memory of 4996 4892 5tbhtn.exe 5pjdv.exe PID 4892 wrote to memory of 4996 4892 5tbhtn.exe 5pjdv.exe PID 4892 wrote to memory of 4996 4892 5tbhtn.exe 5pjdv.exe PID 4996 wrote to memory of 3520 4996 5pjdv.exe htnhhb.exe PID 4996 wrote to memory of 3520 4996 5pjdv.exe htnhhb.exe PID 4996 wrote to memory of 3520 4996 5pjdv.exe htnhhb.exe PID 3520 wrote to memory of 1528 3520 htnhhb.exe jvvpj.exe PID 3520 wrote to memory of 1528 3520 htnhhb.exe jvvpj.exe PID 3520 wrote to memory of 1528 3520 htnhhb.exe jvvpj.exe PID 1528 wrote to memory of 3376 1528 jvvpj.exe xffflll.exe PID 1528 wrote to memory of 3376 1528 jvvpj.exe xffflll.exe PID 1528 wrote to memory of 3376 1528 jvvpj.exe xffflll.exe PID 3376 wrote to memory of 2756 3376 xffflll.exe fxrrrrx.exe PID 3376 wrote to memory of 2756 3376 xffflll.exe fxrrrrx.exe PID 3376 wrote to memory of 2756 3376 xffflll.exe fxrrrrx.exe PID 2756 wrote to memory of 2792 2756 fxrrrrx.exe dvdpv.exe PID 2756 wrote to memory of 2792 2756 fxrrrrx.exe dvdpv.exe PID 2756 wrote to memory of 2792 2756 fxrrrrx.exe dvdpv.exe PID 2792 wrote to memory of 3536 2792 dvdpv.exe rxxrlll.exe PID 2792 wrote to memory of 3536 2792 dvdpv.exe rxxrlll.exe PID 2792 wrote to memory of 3536 2792 dvdpv.exe rxxrlll.exe PID 3536 wrote to memory of 4856 3536 rxxrlll.exe ppjjd.exe PID 3536 wrote to memory of 4856 3536 rxxrlll.exe ppjjd.exe PID 3536 wrote to memory of 4856 3536 rxxrlll.exe ppjjd.exe PID 4856 wrote to memory of 4780 4856 ppjjd.exe lrxlffx.exe PID 4856 wrote to memory of 4780 4856 ppjjd.exe lrxlffx.exe PID 4856 wrote to memory of 4780 4856 ppjjd.exe lrxlffx.exe PID 4780 wrote to memory of 4932 4780 lrxlffx.exe hhnhtt.exe PID 4780 wrote to memory of 4932 4780 lrxlffx.exe hhnhtt.exe PID 4780 wrote to memory of 4932 4780 lrxlffx.exe hhnhtt.exe PID 4932 wrote to memory of 4132 4932 hhnhtt.exe ddpjv.exe PID 4932 wrote to memory of 4132 4932 hhnhtt.exe ddpjv.exe PID 4932 wrote to memory of 4132 4932 hhnhtt.exe ddpjv.exe PID 4132 wrote to memory of 3124 4132 ddpjv.exe rlrrrll.exe PID 4132 wrote to memory of 3124 4132 ddpjv.exe rlrrrll.exe PID 4132 wrote to memory of 3124 4132 ddpjv.exe rlrrrll.exe PID 3124 wrote to memory of 1740 3124 rlrrrll.exe 1hnnnn.exe PID 3124 wrote to memory of 1740 3124 rlrrrll.exe 1hnnnn.exe PID 3124 wrote to memory of 1740 3124 rlrrrll.exe 1hnnnn.exe PID 1740 wrote to memory of 1120 1740 1hnnnn.exe 9vvvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\xxrflrx.exec:\xxrflrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\1nhbtt.exec:\1nhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\nhhbnh.exec:\nhhbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\jppjv.exec:\jppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\dvpvv.exec:\dvpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\lrllxxx.exec:\lrllxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\nnnnhn.exec:\nnnnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\5tbhtn.exec:\5tbhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\5pjdv.exec:\5pjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\htnhhb.exec:\htnhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\jvvpj.exec:\jvvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\xffflll.exec:\xffflll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\dvdpv.exec:\dvdpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rxxrlll.exec:\rxxrlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\ppjjd.exec:\ppjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\lrxlffx.exec:\lrxlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\hhnhtt.exec:\hhnhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\ddpjv.exec:\ddpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\rlrrrll.exec:\rlrrrll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\1hnnnn.exec:\1hnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\9vvvv.exec:\9vvvv.exe23⤵
- Executes dropped EXE
PID:1120 -
\??\c:\7fllfrl.exec:\7fllfrl.exe24⤵
- Executes dropped EXE
PID:5004 -
\??\c:\ttnnnt.exec:\ttnnnt.exe25⤵
- Executes dropped EXE
PID:3272 -
\??\c:\jdjjj.exec:\jdjjj.exe26⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xrlffff.exec:\xrlffff.exe27⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nhtttt.exec:\nhtttt.exe28⤵
- Executes dropped EXE
PID:3288 -
\??\c:\nbtnnn.exec:\nbtnnn.exe29⤵
- Executes dropped EXE
PID:3900 -
\??\c:\ppppd.exec:\ppppd.exe30⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lxlrrfl.exec:\lxlrrfl.exe31⤵
- Executes dropped EXE
PID:940 -
\??\c:\nnhhhn.exec:\nnhhhn.exe32⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vjvvv.exec:\vjvvv.exe33⤵
- Executes dropped EXE
PID:3532 -
\??\c:\pdvvv.exec:\pdvvv.exe34⤵
- Executes dropped EXE
PID:4216 -
\??\c:\lfxxfxf.exec:\lfxxfxf.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hhnnnt.exec:\hhnnnt.exe36⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ppvpp.exec:\ppvpp.exe37⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ddjjj.exec:\ddjjj.exe38⤵
- Executes dropped EXE
PID:2408 -
\??\c:\1fllrxf.exec:\1fllrxf.exe39⤵
- Executes dropped EXE
PID:3828 -
\??\c:\bbnnnt.exec:\bbnnnt.exe40⤵
- Executes dropped EXE
PID:4372 -
\??\c:\nnnnnt.exec:\nnnnnt.exe41⤵
- Executes dropped EXE
PID:4624 -
\??\c:\9djvp.exec:\9djvp.exe42⤵
- Executes dropped EXE
PID:4888 -
\??\c:\fflrxfl.exec:\fflrxfl.exe43⤵
- Executes dropped EXE
PID:4028 -
\??\c:\9nhhhn.exec:\9nhhhn.exe44⤵
- Executes dropped EXE
PID:4876 -
\??\c:\jjppp.exec:\jjppp.exe45⤵
- Executes dropped EXE
PID:3144 -
\??\c:\dpddv.exec:\dpddv.exe46⤵
- Executes dropped EXE
PID:2868 -
\??\c:\frfrlrr.exec:\frfrlrr.exe47⤵
- Executes dropped EXE
PID:3688 -
\??\c:\tbnhth.exec:\tbnhth.exe48⤵
- Executes dropped EXE
PID:968 -
\??\c:\vvpjj.exec:\vvpjj.exe49⤵
- Executes dropped EXE
PID:2192 -
\??\c:\7rrlfxr.exec:\7rrlfxr.exe50⤵
- Executes dropped EXE
PID:1640 -
\??\c:\tntttb.exec:\tntttb.exe51⤵
- Executes dropped EXE
PID:4072 -
\??\c:\vvvjp.exec:\vvvjp.exe52⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pdjjj.exec:\pdjjj.exe53⤵
- Executes dropped EXE
PID:4036 -
\??\c:\5rlllrr.exec:\5rlllrr.exe54⤵
- Executes dropped EXE
PID:892 -
\??\c:\bhnntt.exec:\bhnntt.exe55⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pppjp.exec:\pppjp.exe56⤵
- Executes dropped EXE
PID:3668 -
\??\c:\9djvd.exec:\9djvd.exe57⤵
- Executes dropped EXE
PID:3128 -
\??\c:\fxrrffr.exec:\fxrrffr.exe58⤵
- Executes dropped EXE
PID:3752 -
\??\c:\hhhnnn.exec:\hhhnnn.exe59⤵
- Executes dropped EXE
PID:3376 -
\??\c:\hthntn.exec:\hthntn.exe60⤵
- Executes dropped EXE
PID:4300 -
\??\c:\7djjj.exec:\7djjj.exe61⤵
- Executes dropped EXE
PID:1004 -
\??\c:\vjjdp.exec:\vjjdp.exe62⤵
- Executes dropped EXE
PID:3536 -
\??\c:\1flfrrl.exec:\1flfrrl.exe63⤵
- Executes dropped EXE
PID:464 -
\??\c:\5hhhtb.exec:\5hhhtb.exe64⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nnnntt.exec:\nnnntt.exe65⤵
- Executes dropped EXE
PID:5100 -
\??\c:\rrfffll.exec:\rrfffll.exe66⤵PID:3316
-
\??\c:\5xrrlll.exec:\5xrrlll.exe67⤵PID:748
-
\??\c:\hbhbbb.exec:\hbhbbb.exe68⤵PID:4428
-
\??\c:\nbhhhn.exec:\nbhhhn.exe69⤵PID:3108
-
\??\c:\ppdjv.exec:\ppdjv.exe70⤵PID:4224
-
\??\c:\xrflfxx.exec:\xrflfxx.exe71⤵PID:4620
-
\??\c:\fflllrr.exec:\fflllrr.exe72⤵PID:3616
-
\??\c:\hhhhhb.exec:\hhhhhb.exe73⤵PID:4920
-
\??\c:\bbtnnt.exec:\bbtnnt.exe74⤵PID:2152
-
\??\c:\dvdjp.exec:\dvdjp.exe75⤵PID:1632
-
\??\c:\rfllrxf.exec:\rfllrxf.exe76⤵PID:1152
-
\??\c:\flflrxx.exec:\flflrxx.exe77⤵PID:3036
-
\??\c:\1hbhhn.exec:\1hbhhn.exe78⤵PID:2096
-
\??\c:\nbnnbt.exec:\nbnnbt.exe79⤵PID:1880
-
\??\c:\vdppv.exec:\vdppv.exe80⤵PID:4592
-
\??\c:\7frxflx.exec:\7frxflx.exe81⤵PID:916
-
\??\c:\tnbbtt.exec:\tnbbtt.exe82⤵PID:860
-
\??\c:\7bnnnn.exec:\7bnnnn.exe83⤵PID:4120
-
\??\c:\pjvvj.exec:\pjvvj.exe84⤵PID:4216
-
\??\c:\frxffll.exec:\frxffll.exe85⤵PID:3588
-
\??\c:\5hhnbn.exec:\5hhnbn.exe86⤵PID:1584
-
\??\c:\dvddd.exec:\dvddd.exe87⤵PID:4116
-
\??\c:\dvddd.exec:\dvddd.exe88⤵PID:3048
-
\??\c:\llfffll.exec:\llfffll.exe89⤵PID:4840
-
\??\c:\htbbbh.exec:\htbbbh.exe90⤵PID:4372
-
\??\c:\ppvdj.exec:\ppvdj.exe91⤵PID:2056
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe92⤵PID:1384
-
\??\c:\nnttnh.exec:\nnttnh.exe93⤵PID:4596
-
\??\c:\ntnnbh.exec:\ntnnbh.exe94⤵PID:1824
-
\??\c:\pdpjp.exec:\pdpjp.exe95⤵PID:1112
-
\??\c:\vpppv.exec:\vpppv.exe96⤵PID:4200
-
\??\c:\9rlllff.exec:\9rlllff.exe97⤵PID:3600
-
\??\c:\tbhhnt.exec:\tbhhnt.exe98⤵PID:1640
-
\??\c:\hhhttt.exec:\hhhttt.exe99⤵PID:2820
-
\??\c:\jjjvd.exec:\jjjvd.exe100⤵PID:4380
-
\??\c:\pdpvd.exec:\pdpvd.exe101⤵PID:2596
-
\??\c:\lrfxffx.exec:\lrfxffx.exe102⤵PID:1008
-
\??\c:\llfxxxx.exec:\llfxxxx.exe103⤵PID:2068
-
\??\c:\jpvvj.exec:\jpvvj.exe104⤵PID:3116
-
\??\c:\jpdpv.exec:\jpdpv.exe105⤵PID:1744
-
\??\c:\5xxflxr.exec:\5xxflxr.exe106⤵PID:3764
-
\??\c:\7bttnt.exec:\7bttnt.exe107⤵PID:4680
-
\??\c:\thnttt.exec:\thnttt.exe108⤵PID:428
-
\??\c:\ddjpp.exec:\ddjpp.exe109⤵PID:992
-
\??\c:\jdjdj.exec:\jdjdj.exe110⤵PID:3720
-
\??\c:\9jjdd.exec:\9jjdd.exe111⤵PID:3892
-
\??\c:\5vddj.exec:\5vddj.exe112⤵PID:2552
-
\??\c:\xxffxll.exec:\xxffxll.exe113⤵PID:5100
-
\??\c:\bbtnhb.exec:\bbtnhb.exe114⤵PID:4180
-
\??\c:\nthhhh.exec:\nthhhh.exe115⤵PID:376
-
\??\c:\fxxxllf.exec:\fxxxllf.exe116⤵PID:4712
-
\??\c:\1rxrrxr.exec:\1rxrrxr.exe117⤵PID:1120
-
\??\c:\tbhhhh.exec:\tbhhhh.exe118⤵PID:5004
-
\??\c:\1dddd.exec:\1dddd.exe119⤵PID:3616
-
\??\c:\xxfllrr.exec:\xxfllrr.exe120⤵PID:1732
-
\??\c:\llrxrlf.exec:\llrxrlf.exe121⤵PID:2668
-
\??\c:\ntnhhn.exec:\ntnhhn.exe122⤵PID:1948
-
\??\c:\bthntt.exec:\bthntt.exe123⤵PID:2096
-
\??\c:\ddvvv.exec:\ddvvv.exe124⤵PID:1768
-
\??\c:\lfrxflf.exec:\lfrxflf.exe125⤵PID:916
-
\??\c:\xllrxxf.exec:\xllrxxf.exe126⤵PID:860
-
\??\c:\nthnnn.exec:\nthnnn.exe127⤵PID:2128
-
\??\c:\jvppp.exec:\jvppp.exe128⤵PID:1584
-
\??\c:\3vdjp.exec:\3vdjp.exe129⤵PID:3048
-
\??\c:\9rlrrfl.exec:\9rlrrfl.exe130⤵PID:2640
-
\??\c:\5fxxxll.exec:\5fxxxll.exe131⤵PID:4636
-
\??\c:\hhbhnb.exec:\hhbhnb.exe132⤵PID:624
-
\??\c:\nhhnnt.exec:\nhhnnt.exe133⤵PID:1384
-
\??\c:\vvvpp.exec:\vvvpp.exe134⤵PID:4508
-
\??\c:\llrlrlx.exec:\llrlrlx.exe135⤵PID:2504
-
\??\c:\xflfflr.exec:\xflfflr.exe136⤵PID:1240
-
\??\c:\nnhntt.exec:\nnhntt.exe137⤵PID:436
-
\??\c:\5nbbbb.exec:\5nbbbb.exe138⤵PID:4108
-
\??\c:\ppjpp.exec:\ppjpp.exe139⤵PID:5048
-
\??\c:\xxrxlrr.exec:\xxrxlrr.exe140⤵PID:2044
-
\??\c:\lrrflff.exec:\lrrflff.exe141⤵PID:2732
-
\??\c:\hhnbbb.exec:\hhnbbb.exe142⤵PID:4996
-
\??\c:\jpjjv.exec:\jpjjv.exe143⤵PID:3704
-
\??\c:\rfxlxfl.exec:\rfxlxfl.exe144⤵PID:4460
-
\??\c:\rrflxff.exec:\rrflxff.exe145⤵PID:2072
-
\??\c:\bbhntb.exec:\bbhntb.exe146⤵PID:1840
-
\??\c:\hnhhhn.exec:\hnhhhn.exe147⤵PID:4608
-
\??\c:\dvddd.exec:\dvddd.exe148⤵PID:876
-
\??\c:\lrflxrf.exec:\lrflxrf.exe149⤵PID:4020
-
\??\c:\tthnnt.exec:\tthnnt.exe150⤵PID:1004
-
\??\c:\dvjjj.exec:\dvjjj.exe151⤵PID:4612
-
\??\c:\jjddd.exec:\jjddd.exe152⤵PID:1136
-
\??\c:\rlrlxfx.exec:\rlrlxfx.exe153⤵PID:3720
-
\??\c:\rrllrxf.exec:\rrllrxf.exe154⤵PID:552
-
\??\c:\hhhntb.exec:\hhhntb.exe155⤵PID:4932
-
\??\c:\5ttttb.exec:\5ttttb.exe156⤵PID:3124
-
\??\c:\pppvv.exec:\pppvv.exe157⤵PID:2036
-
\??\c:\frrfflr.exec:\frrfflr.exe158⤵PID:3480
-
\??\c:\lrlllll.exec:\lrlllll.exe159⤵PID:376
-
\??\c:\tnthhh.exec:\tnthhh.exe160⤵PID:4712
-
\??\c:\thnnhn.exec:\thnnhn.exe161⤵PID:1120
-
\??\c:\vdvpp.exec:\vdvpp.exe162⤵PID:5004
-
\??\c:\jdvvv.exec:\jdvvv.exe163⤵PID:3884
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe164⤵PID:3896
-
\??\c:\pppvv.exec:\pppvv.exe165⤵PID:2932
-
\??\c:\vppjj.exec:\vppjj.exe166⤵PID:1072
-
\??\c:\vvvvv.exec:\vvvvv.exe167⤵PID:4988
-
\??\c:\5thnhn.exec:\5thnhn.exe168⤵PID:1888
-
\??\c:\rxxrffr.exec:\rxxrffr.exe169⤵PID:3004
-
\??\c:\ttbttt.exec:\ttbttt.exe170⤵PID:4312
-
\??\c:\vppdv.exec:\vppdv.exe171⤵PID:1872
-
\??\c:\rrxrrfx.exec:\rrxrrfx.exe172⤵PID:4552
-
\??\c:\bbntnt.exec:\bbntnt.exe173⤵PID:1584
-
\??\c:\jdjjj.exec:\jdjjj.exe174⤵PID:1692
-
\??\c:\jvddd.exec:\jvddd.exe175⤵PID:2976
-
\??\c:\hbnhbn.exec:\hbnhbn.exe176⤵PID:4636
-
\??\c:\djvpj.exec:\djvpj.exe177⤵PID:3156
-
\??\c:\9jvvv.exec:\9jvvv.exe178⤵PID:3708
-
\??\c:\lfrlfrr.exec:\lfrlfrr.exe179⤵PID:4508
-
\??\c:\hnnttn.exec:\hnnttn.exe180⤵PID:2504
-
\??\c:\nnhnnh.exec:\nnhnnh.exe181⤵PID:1240
-
\??\c:\1ppjj.exec:\1ppjj.exe182⤵PID:744
-
\??\c:\jjjvp.exec:\jjjvp.exe183⤵PID:2832
-
\??\c:\fllflxl.exec:\fllflxl.exe184⤵PID:1936
-
\??\c:\nnnhbb.exec:\nnnhbb.exe185⤵PID:1392
-
\??\c:\hhntbn.exec:\hhntbn.exe186⤵PID:2276
-
\??\c:\9ddvj.exec:\9ddvj.exe187⤵PID:4888
-
\??\c:\ffrrxlr.exec:\ffrrxlr.exe188⤵PID:1204
-
\??\c:\bhbbhn.exec:\bhbbhn.exe189⤵PID:3128
-
\??\c:\pjjdd.exec:\pjjdd.exe190⤵PID:3116
-
\??\c:\fffxxff.exec:\fffxxff.exe191⤵PID:1840
-
\??\c:\rflxllf.exec:\rflxllf.exe192⤵PID:1304
-
\??\c:\hhtnnt.exec:\hhtnnt.exe193⤵PID:2400
-
\??\c:\ddvpp.exec:\ddvpp.exe194⤵PID:4020
-
\??\c:\xffllrx.exec:\xffllrx.exe195⤵PID:3668
-
\??\c:\xxllrxx.exec:\xxllrxx.exe196⤵PID:4612
-
\??\c:\tbbtnh.exec:\tbbtnh.exe197⤵PID:2324
-
\??\c:\tthntb.exec:\tthntb.exe198⤵PID:4856
-
\??\c:\5dpvv.exec:\5dpvv.exe199⤵PID:552
-
\??\c:\ddpdv.exec:\ddpdv.exe200⤵PID:1088
-
\??\c:\fllfxrr.exec:\fllfxrr.exe201⤵PID:3124
-
\??\c:\hbbnnn.exec:\hbbnnn.exe202⤵PID:2036
-
\??\c:\jvjjp.exec:\jvjjp.exe203⤵PID:4428
-
\??\c:\jpdjj.exec:\jpdjj.exe204⤵PID:3636
-
\??\c:\rxlrxxx.exec:\rxlrxxx.exe205⤵PID:3272
-
\??\c:\3rxfflf.exec:\3rxfflf.exe206⤵PID:4304
-
\??\c:\hhhnnt.exec:\hhhnnt.exe207⤵PID:4092
-
\??\c:\1jppp.exec:\1jppp.exe208⤵PID:1732
-
\??\c:\vdvvd.exec:\vdvvd.exe209⤵PID:3200
-
\??\c:\xlffrxr.exec:\xlffrxr.exe210⤵PID:2968
-
\??\c:\tnhnnb.exec:\tnhnnb.exe211⤵PID:1880
-
\??\c:\vvjpj.exec:\vvjpj.exe212⤵PID:3740
-
\??\c:\1dppd.exec:\1dppd.exe213⤵PID:3004
-
\??\c:\frfllxf.exec:\frfllxf.exe214⤵PID:2224
-
\??\c:\bnhhhh.exec:\bnhhhh.exe215⤵PID:2448
-
\??\c:\nhtttb.exec:\nhtttb.exe216⤵PID:1584
-
\??\c:\vdvvv.exec:\vdvvv.exe217⤵PID:3444
-
\??\c:\ffllxfr.exec:\ffllxfr.exe218⤵PID:32
-
\??\c:\rlllllr.exec:\rlllllr.exe219⤵PID:4636
-
\??\c:\nttttt.exec:\nttttt.exe220⤵PID:2868
-
\??\c:\vjpjp.exec:\vjpjp.exe221⤵PID:5008
-
\??\c:\jvjjp.exec:\jvjjp.exe222⤵PID:4508
-
\??\c:\flrxrxr.exec:\flrxrxr.exe223⤵PID:2504
-
\??\c:\tnnnhh.exec:\tnnnhh.exe224⤵PID:1240
-
\??\c:\nnnnnt.exec:\nnnnnt.exe225⤵PID:4108
-
\??\c:\jpddj.exec:\jpddj.exe226⤵PID:4568
-
\??\c:\xxrlxlf.exec:\xxrlxlf.exe227⤵PID:2596
-
\??\c:\nhtbht.exec:\nhtbht.exe228⤵PID:2132
-
\??\c:\djppp.exec:\djppp.exe229⤵PID:968
-
\??\c:\ddjpp.exec:\ddjpp.exe230⤵PID:1528
-
\??\c:\xrrrxff.exec:\xrrrxff.exe231⤵PID:2804
-
\??\c:\3flxxxr.exec:\3flxxxr.exe232⤵PID:1332
-
\??\c:\tthntb.exec:\tthntb.exe233⤵PID:3764
-
\??\c:\jjjjj.exec:\jjjjj.exe234⤵PID:1716
-
\??\c:\xflxfxr.exec:\xflxfxr.exe235⤵PID:992
-
\??\c:\nnnhnn.exec:\nnnhnn.exe236⤵PID:1864
-
\??\c:\jjjvv.exec:\jjjvv.exe237⤵PID:3668
-
\??\c:\5frrxfr.exec:\5frrxfr.exe238⤵PID:3720
-
\??\c:\flxxxlf.exec:\flxxxlf.exe239⤵PID:208
-
\??\c:\7nnnbb.exec:\7nnnbb.exe240⤵PID:4856
-
\??\c:\vdddd.exec:\vdddd.exe241⤵PID:5020
-