Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 23:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe
-
Size
479KB
-
MD5
128b2457e9b1a219b9c84d6841fa84c0
-
SHA1
cfcdd2f6f32980fc9ff54cb5d753b32be73584a4
-
SHA256
d25dd510a4755cd9e20452c3ab1a5f9262352a7c1c8b04bcce67ae163dc87765
-
SHA512
493e514e85a890ddd61a9a1bf2220071ee66e1075680ad3ae8a1a00a8fa2491742be5d86eb7aa97bc26a59291dea152672dc2ba88b4f94f3d8cda0566762e1a1
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1Hm7cs:d7Tc9Wj16A3StvxHs
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1832-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/680-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-353-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-379-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-503-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-514-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-515-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-522-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-535-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-593-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-633-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-637-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-723-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-783-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-799-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-821-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-858-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-920-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-1037-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-1143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-1156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3544 btbbtt.exe 4304 lrrlfll.exe 2884 tthbhb.exe 868 thhbtt.exe 2016 djpjj.exe 2732 llfxxrl.exe 1416 dvppp.exe 1324 nhbnbb.exe 4160 tttbth.exe 680 rfffxxr.exe 3880 rlxfrrl.exe 4764 ddjdd.exe 1384 fflrflx.exe 2992 pppjj.exe 448 xflrxxl.exe 1700 btbbbn.exe 2104 1nhbtt.exe 464 tbhbtt.exe 3448 5rxrlfx.exe 3104 fxfxrlr.exe 2284 nbbtnn.exe 3656 rllfrrl.exe 2960 fxfxllf.exe 2028 dpdvd.exe 4476 thntbb.exe 4572 rrllffx.exe 4592 bttnhb.exe 3956 thtnhb.exe 4416 dpvvv.exe 4600 rxrflxl.exe 4968 9vvvp.exe 2732 rlrrrrr.exe 3324 rlllfff.exe 4812 bntnnn.exe 1324 pdpjd.exe 1560 rrrlxrl.exe 2056 nnbttt.exe 1288 1ddvv.exe 1300 rlrlflf.exe 3948 tnbbtt.exe 4184 jjppp.exe 3992 ffrllll.exe 2752 tnttbt.exe 2500 pvjvp.exe 1752 jdjdd.exe 448 xffrfrr.exe 3604 5vvpj.exe 2924 dvvpp.exe 3092 llfxlfx.exe 1248 bnnbnb.exe 1780 pvdpj.exe 3124 xlrllll.exe 3340 5hbttt.exe 1260 ppvpp.exe 3656 jpdvd.exe 1544 xxxxlff.exe 3540 tnnhnn.exe 3356 pdddv.exe 4736 xxfxxrx.exe 2432 lfllxxr.exe 2312 5hhbtt.exe 2276 jddvp.exe 2884 3flfxxr.exe 2608 9nnhtt.exe -
resource yara_rule behavioral2/memory/1832-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/680-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-353-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-379-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-434-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-447-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-463-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-482-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-503-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-514-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-515-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 3544 1832 128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe 90 PID 1832 wrote to memory of 3544 1832 128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe 90 PID 1832 wrote to memory of 3544 1832 128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe 90 PID 3544 wrote to memory of 4304 3544 btbbtt.exe 91 PID 3544 wrote to memory of 4304 3544 btbbtt.exe 91 PID 3544 wrote to memory of 4304 3544 btbbtt.exe 91 PID 4304 wrote to memory of 2884 4304 lrrlfll.exe 92 PID 4304 wrote to memory of 2884 4304 lrrlfll.exe 92 PID 4304 wrote to memory of 2884 4304 lrrlfll.exe 92 PID 2884 wrote to memory of 868 2884 tthbhb.exe 93 PID 2884 wrote to memory of 868 2884 tthbhb.exe 93 PID 2884 wrote to memory of 868 2884 tthbhb.exe 93 PID 868 wrote to memory of 2016 868 thhbtt.exe 94 PID 868 wrote to memory of 2016 868 thhbtt.exe 94 PID 868 wrote to memory of 2016 868 thhbtt.exe 94 PID 2016 wrote to memory of 2732 2016 djpjj.exe 95 PID 2016 wrote to memory of 2732 2016 djpjj.exe 95 PID 2016 wrote to memory of 2732 2016 djpjj.exe 95 PID 2732 wrote to memory of 1416 2732 llfxxrl.exe 96 PID 2732 wrote to memory of 1416 2732 llfxxrl.exe 96 PID 2732 wrote to memory of 1416 2732 llfxxrl.exe 96 PID 1416 wrote to memory of 1324 1416 dvppp.exe 97 PID 1416 wrote to memory of 1324 1416 dvppp.exe 97 PID 1416 wrote to memory of 1324 1416 dvppp.exe 97 PID 1324 wrote to memory of 4160 1324 nhbnbb.exe 99 PID 1324 wrote to memory of 4160 1324 nhbnbb.exe 99 PID 1324 wrote to memory of 4160 1324 nhbnbb.exe 99 PID 4160 wrote to memory of 680 4160 tttbth.exe 100 PID 4160 wrote to memory of 680 4160 tttbth.exe 100 PID 4160 wrote to memory of 680 4160 tttbth.exe 100 PID 680 wrote to memory of 3880 680 rfffxxr.exe 102 PID 680 wrote to memory of 3880 680 rfffxxr.exe 102 PID 680 wrote to memory of 3880 680 rfffxxr.exe 102 PID 3880 wrote to memory of 4764 3880 rlxfrrl.exe 103 PID 3880 wrote to memory of 4764 3880 rlxfrrl.exe 103 PID 3880 wrote to memory of 4764 3880 rlxfrrl.exe 103 PID 4764 wrote to memory of 1384 4764 ddjdd.exe 104 PID 4764 wrote to memory of 1384 4764 ddjdd.exe 104 PID 4764 wrote to memory of 1384 4764 ddjdd.exe 104 PID 1384 wrote to memory of 2992 1384 fflrflx.exe 105 PID 1384 wrote to memory of 2992 1384 fflrflx.exe 105 PID 1384 wrote to memory of 2992 1384 fflrflx.exe 105 PID 2992 wrote to memory of 448 2992 pppjj.exe 107 PID 2992 wrote to memory of 448 2992 pppjj.exe 107 PID 2992 wrote to memory of 448 2992 pppjj.exe 107 PID 448 wrote to memory of 1700 448 xflrxxl.exe 108 PID 448 wrote to memory of 1700 448 xflrxxl.exe 108 PID 448 wrote to memory of 1700 448 xflrxxl.exe 108 PID 1700 wrote to memory of 2104 1700 btbbbn.exe 109 PID 1700 wrote to memory of 2104 1700 btbbbn.exe 109 PID 1700 wrote to memory of 2104 1700 btbbbn.exe 109 PID 2104 wrote to memory of 464 2104 1nhbtt.exe 110 PID 2104 wrote to memory of 464 2104 1nhbtt.exe 110 PID 2104 wrote to memory of 464 2104 1nhbtt.exe 110 PID 464 wrote to memory of 3448 464 tbhbtt.exe 111 PID 464 wrote to memory of 3448 464 tbhbtt.exe 111 PID 464 wrote to memory of 3448 464 tbhbtt.exe 111 PID 3448 wrote to memory of 3104 3448 5rxrlfx.exe 112 PID 3448 wrote to memory of 3104 3448 5rxrlfx.exe 112 PID 3448 wrote to memory of 3104 3448 5rxrlfx.exe 112 PID 3104 wrote to memory of 2284 3104 fxfxrlr.exe 113 PID 3104 wrote to memory of 2284 3104 fxfxrlr.exe 113 PID 3104 wrote to memory of 2284 3104 fxfxrlr.exe 113 PID 2284 wrote to memory of 3656 2284 nbbtnn.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\128b2457e9b1a219b9c84d6841fa84c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\btbbtt.exec:\btbbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\lrrlfll.exec:\lrrlfll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\tthbhb.exec:\tthbhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\thhbtt.exec:\thhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\djpjj.exec:\djpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\llfxxrl.exec:\llfxxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\dvppp.exec:\dvppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\nhbnbb.exec:\nhbnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\tttbth.exec:\tttbth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\rfffxxr.exec:\rfffxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\ddjdd.exec:\ddjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\fflrflx.exec:\fflrflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\pppjj.exec:\pppjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\xflrxxl.exec:\xflrxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\btbbbn.exec:\btbbbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\1nhbtt.exec:\1nhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\tbhbtt.exec:\tbhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\5rxrlfx.exec:\5rxrlfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\fxfxrlr.exec:\fxfxrlr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\nbbtnn.exec:\nbbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\rllfrrl.exec:\rllfrrl.exe23⤵
- Executes dropped EXE
PID:3656 -
\??\c:\fxfxllf.exec:\fxfxllf.exe24⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dpdvd.exec:\dpdvd.exe25⤵
- Executes dropped EXE
PID:2028 -
\??\c:\thntbb.exec:\thntbb.exe26⤵
- Executes dropped EXE
PID:4476 -
\??\c:\rrllffx.exec:\rrllffx.exe27⤵
- Executes dropped EXE
PID:4572 -
\??\c:\bttnhb.exec:\bttnhb.exe28⤵
- Executes dropped EXE
PID:4592 -
\??\c:\thtnhb.exec:\thtnhb.exe29⤵
- Executes dropped EXE
PID:3956 -
\??\c:\dpvvv.exec:\dpvvv.exe30⤵
- Executes dropped EXE
PID:4416 -
\??\c:\rxrflxl.exec:\rxrflxl.exe31⤵
- Executes dropped EXE
PID:4600 -
\??\c:\9vvvp.exec:\9vvvp.exe32⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe33⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rlllfff.exec:\rlllfff.exe34⤵
- Executes dropped EXE
PID:3324 -
\??\c:\bntnnn.exec:\bntnnn.exe35⤵
- Executes dropped EXE
PID:4812 -
\??\c:\pdpjd.exec:\pdpjd.exe36⤵
- Executes dropped EXE
PID:1324 -
\??\c:\rrrlxrl.exec:\rrrlxrl.exe37⤵
- Executes dropped EXE
PID:1560 -
\??\c:\nnbttt.exec:\nnbttt.exe38⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1ddvv.exec:\1ddvv.exe39⤵
- Executes dropped EXE
PID:1288 -
\??\c:\rlrlflf.exec:\rlrlflf.exe40⤵
- Executes dropped EXE
PID:1300 -
\??\c:\tnbbtt.exec:\tnbbtt.exe41⤵
- Executes dropped EXE
PID:3948 -
\??\c:\jjppp.exec:\jjppp.exe42⤵
- Executes dropped EXE
PID:4184 -
\??\c:\ffrllll.exec:\ffrllll.exe43⤵
- Executes dropped EXE
PID:3992 -
\??\c:\tnttbt.exec:\tnttbt.exe44⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pvjvp.exec:\pvjvp.exe45⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jdjdd.exec:\jdjdd.exe46⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xffrfrr.exec:\xffrfrr.exe47⤵
- Executes dropped EXE
PID:448 -
\??\c:\5vvpj.exec:\5vvpj.exe48⤵
- Executes dropped EXE
PID:3604 -
\??\c:\dvvpp.exec:\dvvpp.exe49⤵
- Executes dropped EXE
PID:2924 -
\??\c:\llfxlfx.exec:\llfxlfx.exe50⤵
- Executes dropped EXE
PID:3092 -
\??\c:\bnnbnb.exec:\bnnbnb.exe51⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pvdpj.exec:\pvdpj.exe52⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xlrllll.exec:\xlrllll.exe53⤵
- Executes dropped EXE
PID:3124 -
\??\c:\5hbttt.exec:\5hbttt.exe54⤵
- Executes dropped EXE
PID:3340 -
\??\c:\ppvpp.exec:\ppvpp.exe55⤵
- Executes dropped EXE
PID:1260 -
\??\c:\jpdvd.exec:\jpdvd.exe56⤵
- Executes dropped EXE
PID:3656 -
\??\c:\xxxxlff.exec:\xxxxlff.exe57⤵
- Executes dropped EXE
PID:1544 -
\??\c:\tnnhnn.exec:\tnnhnn.exe58⤵
- Executes dropped EXE
PID:3540 -
\??\c:\pdddv.exec:\pdddv.exe59⤵
- Executes dropped EXE
PID:3356 -
\??\c:\xxfxxrx.exec:\xxfxxrx.exe60⤵
- Executes dropped EXE
PID:4736 -
\??\c:\lfllxxr.exec:\lfllxxr.exe61⤵
- Executes dropped EXE
PID:2432 -
\??\c:\5hhbtt.exec:\5hhbtt.exe62⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jddvp.exec:\jddvp.exe63⤵
- Executes dropped EXE
PID:2276 -
\??\c:\3flfxxr.exec:\3flfxxr.exe64⤵
- Executes dropped EXE
PID:2884 -
\??\c:\9nnhtt.exec:\9nnhtt.exe65⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1ddvd.exec:\1ddvd.exe66⤵PID:1528
-
\??\c:\dpjdv.exec:\dpjdv.exe67⤵PID:2620
-
\??\c:\frflfxx.exec:\frflfxx.exe68⤵PID:736
-
\??\c:\9hnnhh.exec:\9hnnhh.exe69⤵PID:2252
-
\??\c:\3ppdv.exec:\3ppdv.exe70⤵PID:4752
-
\??\c:\lxfrrlf.exec:\lxfrrlf.exe71⤵PID:1096
-
\??\c:\frffxxx.exec:\frffxxx.exe72⤵PID:396
-
\??\c:\bbbbbb.exec:\bbbbbb.exe73⤵PID:3108
-
\??\c:\1djpp.exec:\1djpp.exe74⤵PID:2272
-
\??\c:\xrfxflr.exec:\xrfxflr.exe75⤵PID:3272
-
\??\c:\thbtbt.exec:\thbtbt.exe76⤵PID:4296
-
\??\c:\5tbntn.exec:\5tbntn.exe77⤵PID:2844
-
\??\c:\llrlffx.exec:\llrlffx.exe78⤵PID:1208
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe79⤵PID:5084
-
\??\c:\httnhn.exec:\httnhn.exe80⤵PID:4520
-
\??\c:\7vdvj.exec:\7vdvj.exe81⤵PID:4436
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe82⤵PID:1752
-
\??\c:\9nnhbb.exec:\9nnhbb.exe83⤵PID:1444
-
\??\c:\vjvdj.exec:\vjvdj.exe84⤵PID:3604
-
\??\c:\rxlffff.exec:\rxlffff.exe85⤵PID:3504
-
\??\c:\nhnhth.exec:\nhnhth.exe86⤵PID:1248
-
\??\c:\jpdvv.exec:\jpdvv.exe87⤵PID:2288
-
\??\c:\rlllfxx.exec:\rlllfxx.exe88⤵PID:4508
-
\??\c:\nthbtt.exec:\nthbtt.exe89⤵PID:3340
-
\??\c:\bbnbbt.exec:\bbnbbt.exe90⤵PID:1260
-
\??\c:\jpvpd.exec:\jpvpd.exe91⤵PID:3656
-
\??\c:\rlxrllf.exec:\rlxrllf.exe92⤵PID:1544
-
\??\c:\vjjvp.exec:\vjjvp.exe93⤵PID:2308
-
\??\c:\5xlfrrl.exec:\5xlfrrl.exe94⤵PID:744
-
\??\c:\hnntnt.exec:\hnntnt.exe95⤵PID:3152
-
\??\c:\jppdp.exec:\jppdp.exe96⤵PID:2824
-
\??\c:\xlrlllf.exec:\xlrlllf.exe97⤵PID:3956
-
\??\c:\bbbbhn.exec:\bbbbhn.exe98⤵PID:3712
-
\??\c:\7vdvv.exec:\7vdvv.exe99⤵PID:4600
-
\??\c:\3lrfxxr.exec:\3lrfxxr.exe100⤵PID:4156
-
\??\c:\3nbhtn.exec:\3nbhtn.exe101⤵PID:2604
-
\??\c:\jvjdv.exec:\jvjdv.exe102⤵PID:5100
-
\??\c:\xrlflfx.exec:\xrlflfx.exe103⤵PID:3784
-
\??\c:\1nhnbb.exec:\1nhnbb.exe104⤵PID:4992
-
\??\c:\dvdpv.exec:\dvdpv.exe105⤵PID:4708
-
\??\c:\3ffxrrl.exec:\3ffxrrl.exe106⤵PID:676
-
\??\c:\nthtnh.exec:\nthtnh.exe107⤵PID:5076
-
\??\c:\ppvdd.exec:\ppvdd.exe108⤵PID:3880
-
\??\c:\jppdp.exec:\jppdp.exe109⤵PID:552
-
\??\c:\llxxllx.exec:\llxxllx.exe110⤵PID:1300
-
\??\c:\tbbbnb.exec:\tbbbnb.exe111⤵PID:4140
-
\??\c:\vpvpp.exec:\vpvpp.exe112⤵PID:4392
-
\??\c:\rflffxx.exec:\rflffxx.exe113⤵PID:2636
-
\??\c:\nhtnnn.exec:\nhtnnn.exe114⤵PID:5092
-
\??\c:\9jvdj.exec:\9jvdj.exe115⤵PID:1728
-
\??\c:\frxrxrr.exec:\frxrxrr.exe116⤵PID:448
-
\??\c:\hnnttt.exec:\hnnttt.exe117⤵PID:4728
-
\??\c:\xfrfrll.exec:\xfrfrll.exe118⤵PID:464
-
\??\c:\thntnn.exec:\thntnn.exe119⤵PID:4732
-
\??\c:\lxflrfx.exec:\lxflrfx.exe120⤵PID:3264
-
\??\c:\nbntth.exec:\nbntth.exe121⤵PID:4996
-
\??\c:\vpdpp.exec:\vpdpp.exe122⤵PID:3124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-