Analysis
-
max time kernel
63s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe
-
Size
476KB
-
MD5
6308bab32af438b0c71090b1abdd94c0
-
SHA1
a1b8803b66de2bc3ae44edf6794d629e467e47ae
-
SHA256
2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9
-
SHA512
589dd30f485d59dbaeb3217f26f05828aabec9466317822002da7770dab76ae194b3c715c368d5763278cb013fdebcb4adf770189b6c00a5244e9ba15753b9c8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwT+aZKlumArSPBXuGsY:q7Tc2NYHUrAwT+OKomA+5u4
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3016-6-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3520-14-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2796-22-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2796-32-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1696-195-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3148-257-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1316-306-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/780-334-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1344-485-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3460-483-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4472-479-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3028-475-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3212-469-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3080-464-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3796-457-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1312-448-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2652-446-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2176-442-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3292-436-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4336-434-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1112-430-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4032-424-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2324-422-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1348-412-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4036-406-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3924-404-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3848-398-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1892-390-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4064-386-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3144-377-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3052-375-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3444-371-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4740-365-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1888-361-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/448-357-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4956-352-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3596-346-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2232-344-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4408-340-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4396-329-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2644-322-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4304-316-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1696-314-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3836-310-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3620-300-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2752-298-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/5116-294-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3460-288-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3400-286-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/464-282-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3504-278-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2884-272-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3452-268-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/5000-264-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2404-255-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3104-249-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1824-245-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2296-243-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/512-237-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2024-232-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2208-226-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4040-224-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3160-218-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2332-216-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnbhbt.exes2264.exe2840400.exedpddd.exe22204.exeflxllfx.exeo404848.exefxfxrlf.exe68464.exefrlflxl.exejdjdv.exe86642.exexrffxxf.exennhthb.exenhbbhn.exelfxxfxl.exe42646.exes6260.exelrxflxl.exefrrlrll.exe444204.exerxrxrrf.exe664628.exe2848260.exehbhntt.exe62264.exe1jdvj.exe628660.exehtnhbn.exe80224.exe3tbbbb.exe0448848.exebhtbnh.exepppvv.exejpvpv.exepvdpj.exe284488.exerxrxrff.exellxllxx.exe68086.exepppvd.exepjpvp.exeppjdd.exebnhbth.exe68208.exe686684.exettttnh.exexxrllrr.exepjppp.exerfrrxfr.exelrrxxxr.exejjdvp.exe88020.exe4808226.exeddvjp.exe20284.exe0206628.exeflxxlfx.exexflrrfl.exeddjdj.exerlrlffx.exe626600.exe62060.exe2248064.exepid process 3520 tnbhbt.exe 2236 s2264.exe 2796 2840400.exe 3340 dpddd.exe 1976 22204.exe 5024 flxllfx.exe 1012 o404848.exe 4428 fxfxrlf.exe 1332 68464.exe 448 frlflxl.exe 2404 jdjdv.exe 3948 86642.exe 2724 xrffxxf.exe 3280 nnhthb.exe 1344 nhbbhn.exe 3848 lfxxfxl.exe 4740 42646.exe 2272 s6260.exe 3452 lrxflxl.exe 4008 frrlrll.exe 3504 444204.exe 464 rxrxrrf.exe 2600 664628.exe 4472 2848260.exe 4108 hbhntt.exe 3292 62264.exe 4308 1jdvj.exe 2652 628660.exe 1656 htnhbn.exe 1312 80224.exe 1696 3tbbbb.exe 4328 0448848.exe 3688 bhtbnh.exe 3520 pppvv.exe 3152 jpvpv.exe 2332 pvdpj.exe 3160 284488.exe 4040 rxrxrff.exe 2208 llxllxx.exe 2024 68086.exe 2232 pppvd.exe 512 pjpvp.exe 2296 ppjdd.exe 1824 bnhbth.exe 3104 68208.exe 2404 686684.exe 3148 ttttnh.exe 4488 xxrllrr.exe 5000 pjppp.exe 3452 rfrrxfr.exe 2884 lrrxxxr.exe 3504 jjdvp.exe 464 88020.exe 3400 4808226.exe 3460 ddvjp.exe 5116 20284.exe 2752 0206628.exe 3620 flxxlfx.exe 1316 xflrrfl.exe 3836 ddjdj.exe 1696 rlrlffx.exe 4304 626600.exe 2644 62060.exe 2940 2248064.exe -
Processes:
resource yara_rule behavioral2/memory/3016-6-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3520-14-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2796-22-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2796-32-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1696-195-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3148-257-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1316-306-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/780-334-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1344-485-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3460-483-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4472-479-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3028-475-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3212-469-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3080-464-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3796-457-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1312-448-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2652-446-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2176-442-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3292-436-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4336-434-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1112-430-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4032-424-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2324-422-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1348-412-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4036-406-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3924-404-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3848-398-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1892-390-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4064-386-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3144-377-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3052-375-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3444-371-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4740-365-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1888-361-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/448-357-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4956-352-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3596-346-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2232-344-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4408-340-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4396-329-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2644-322-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4304-316-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1696-314-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3836-310-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3620-300-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2752-298-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/5116-294-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3460-288-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3400-286-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/464-282-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3504-278-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2884-272-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3452-268-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/5000-264-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2404-255-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3104-249-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1824-245-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2296-243-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/512-237-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2024-232-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2208-226-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4040-224-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3160-218-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2332-216-0x0000000000400000-0x00000000004C4000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exetnbhbt.exes2264.exe2840400.exedpddd.exe22204.exeflxllfx.exeo404848.exefxfxrlf.exe68464.exefrlflxl.exejdjdv.exe86642.exexrffxxf.exennhthb.exenhbbhn.exelfxxfxl.exe42646.exes6260.exelrxflxl.exefrrlrll.exe444204.exedescription pid process target process PID 3016 wrote to memory of 3520 3016 2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe tnbhbt.exe PID 3016 wrote to memory of 3520 3016 2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe tnbhbt.exe PID 3016 wrote to memory of 3520 3016 2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe tnbhbt.exe PID 3520 wrote to memory of 2236 3520 tnbhbt.exe s2264.exe PID 3520 wrote to memory of 2236 3520 tnbhbt.exe s2264.exe PID 3520 wrote to memory of 2236 3520 tnbhbt.exe s2264.exe PID 2236 wrote to memory of 2796 2236 s2264.exe 2840400.exe PID 2236 wrote to memory of 2796 2236 s2264.exe 2840400.exe PID 2236 wrote to memory of 2796 2236 s2264.exe 2840400.exe PID 2796 wrote to memory of 3340 2796 2840400.exe dpddd.exe PID 2796 wrote to memory of 3340 2796 2840400.exe dpddd.exe PID 2796 wrote to memory of 3340 2796 2840400.exe dpddd.exe PID 3340 wrote to memory of 1976 3340 dpddd.exe 22204.exe PID 3340 wrote to memory of 1976 3340 dpddd.exe 22204.exe PID 3340 wrote to memory of 1976 3340 dpddd.exe 22204.exe PID 1976 wrote to memory of 5024 1976 22204.exe flxllfx.exe PID 1976 wrote to memory of 5024 1976 22204.exe flxllfx.exe PID 1976 wrote to memory of 5024 1976 22204.exe flxllfx.exe PID 5024 wrote to memory of 1012 5024 flxllfx.exe o404848.exe PID 5024 wrote to memory of 1012 5024 flxllfx.exe o404848.exe PID 5024 wrote to memory of 1012 5024 flxllfx.exe o404848.exe PID 1012 wrote to memory of 4428 1012 o404848.exe fxfxrlf.exe PID 1012 wrote to memory of 4428 1012 o404848.exe fxfxrlf.exe PID 1012 wrote to memory of 4428 1012 o404848.exe fxfxrlf.exe PID 4428 wrote to memory of 1332 4428 fxfxrlf.exe 68464.exe PID 4428 wrote to memory of 1332 4428 fxfxrlf.exe 68464.exe PID 4428 wrote to memory of 1332 4428 fxfxrlf.exe 68464.exe PID 1332 wrote to memory of 448 1332 68464.exe frlflxl.exe PID 1332 wrote to memory of 448 1332 68464.exe frlflxl.exe PID 1332 wrote to memory of 448 1332 68464.exe frlflxl.exe PID 448 wrote to memory of 2404 448 frlflxl.exe 686684.exe PID 448 wrote to memory of 2404 448 frlflxl.exe 686684.exe PID 448 wrote to memory of 2404 448 frlflxl.exe 686684.exe PID 2404 wrote to memory of 3948 2404 jdjdv.exe 86642.exe PID 2404 wrote to memory of 3948 2404 jdjdv.exe 86642.exe PID 2404 wrote to memory of 3948 2404 jdjdv.exe 86642.exe PID 3948 wrote to memory of 2724 3948 86642.exe xrffxxf.exe PID 3948 wrote to memory of 2724 3948 86642.exe xrffxxf.exe PID 3948 wrote to memory of 2724 3948 86642.exe xrffxxf.exe PID 2724 wrote to memory of 3280 2724 xrffxxf.exe nnhthb.exe PID 2724 wrote to memory of 3280 2724 xrffxxf.exe nnhthb.exe PID 2724 wrote to memory of 3280 2724 xrffxxf.exe nnhthb.exe PID 3280 wrote to memory of 1344 3280 nnhthb.exe nhbbhn.exe PID 3280 wrote to memory of 1344 3280 nnhthb.exe nhbbhn.exe PID 3280 wrote to memory of 1344 3280 nnhthb.exe nhbbhn.exe PID 1344 wrote to memory of 3848 1344 nhbbhn.exe djvvd.exe PID 1344 wrote to memory of 3848 1344 nhbbhn.exe djvvd.exe PID 1344 wrote to memory of 3848 1344 nhbbhn.exe djvvd.exe PID 3848 wrote to memory of 4740 3848 lfxxfxl.exe 42646.exe PID 3848 wrote to memory of 4740 3848 lfxxfxl.exe 42646.exe PID 3848 wrote to memory of 4740 3848 lfxxfxl.exe 42646.exe PID 4740 wrote to memory of 2272 4740 42646.exe s6260.exe PID 4740 wrote to memory of 2272 4740 42646.exe s6260.exe PID 4740 wrote to memory of 2272 4740 42646.exe s6260.exe PID 2272 wrote to memory of 3452 2272 s6260.exe lrxflxl.exe PID 2272 wrote to memory of 3452 2272 s6260.exe lrxflxl.exe PID 2272 wrote to memory of 3452 2272 s6260.exe lrxflxl.exe PID 3452 wrote to memory of 4008 3452 lrxflxl.exe frrlrll.exe PID 3452 wrote to memory of 4008 3452 lrxflxl.exe frrlrll.exe PID 3452 wrote to memory of 4008 3452 lrxflxl.exe frrlrll.exe PID 4008 wrote to memory of 3504 4008 frrlrll.exe 444204.exe PID 4008 wrote to memory of 3504 4008 frrlrll.exe 444204.exe PID 4008 wrote to memory of 3504 4008 frrlrll.exe 444204.exe PID 3504 wrote to memory of 464 3504 444204.exe 88020.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbhbt.exec:\tnbhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\s2264.exec:\s2264.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\2840400.exec:\2840400.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpddd.exec:\dpddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\22204.exec:\22204.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flxllfx.exec:\flxllfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\o404848.exec:\o404848.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\68464.exec:\68464.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frlflxl.exec:\frlflxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjdv.exec:\jdjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\86642.exec:\86642.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrffxxf.exec:\xrffxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhthb.exec:\nnhthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbbhn.exec:\nhbbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxxfxl.exec:\lfxxfxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\42646.exec:\42646.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\s6260.exec:\s6260.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxflxl.exec:\lrxflxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrlrll.exec:\frrlrll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\444204.exec:\444204.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrxrrf.exec:\rxrxrrf.exe23⤵
- Executes dropped EXE
-
\??\c:\664628.exec:\664628.exe24⤵
- Executes dropped EXE
-
\??\c:\2848260.exec:\2848260.exe25⤵
- Executes dropped EXE
-
\??\c:\hbhntt.exec:\hbhntt.exe26⤵
- Executes dropped EXE
-
\??\c:\62264.exec:\62264.exe27⤵
- Executes dropped EXE
-
\??\c:\1jdvj.exec:\1jdvj.exe28⤵
- Executes dropped EXE
-
\??\c:\628660.exec:\628660.exe29⤵
- Executes dropped EXE
-
\??\c:\htnhbn.exec:\htnhbn.exe30⤵
- Executes dropped EXE
-
\??\c:\80224.exec:\80224.exe31⤵
- Executes dropped EXE
-
\??\c:\3tbbbb.exec:\3tbbbb.exe32⤵
- Executes dropped EXE
-
\??\c:\0448848.exec:\0448848.exe33⤵
- Executes dropped EXE
-
\??\c:\bhtbnh.exec:\bhtbnh.exe34⤵
- Executes dropped EXE
-
\??\c:\pppvv.exec:\pppvv.exe35⤵
- Executes dropped EXE
-
\??\c:\jpvpv.exec:\jpvpv.exe36⤵
- Executes dropped EXE
-
\??\c:\pvdpj.exec:\pvdpj.exe37⤵
- Executes dropped EXE
-
\??\c:\284488.exec:\284488.exe38⤵
- Executes dropped EXE
-
\??\c:\rxrxrff.exec:\rxrxrff.exe39⤵
- Executes dropped EXE
-
\??\c:\llxllxx.exec:\llxllxx.exe40⤵
- Executes dropped EXE
-
\??\c:\68086.exec:\68086.exe41⤵
- Executes dropped EXE
-
\??\c:\pppvd.exec:\pppvd.exe42⤵
- Executes dropped EXE
-
\??\c:\pjpvp.exec:\pjpvp.exe43⤵
- Executes dropped EXE
-
\??\c:\ppjdd.exec:\ppjdd.exe44⤵
- Executes dropped EXE
-
\??\c:\bnhbth.exec:\bnhbth.exe45⤵
- Executes dropped EXE
-
\??\c:\68208.exec:\68208.exe46⤵
- Executes dropped EXE
-
\??\c:\686684.exec:\686684.exe47⤵
- Executes dropped EXE
-
\??\c:\ttttnh.exec:\ttttnh.exe48⤵
- Executes dropped EXE
-
\??\c:\xxrllrr.exec:\xxrllrr.exe49⤵
- Executes dropped EXE
-
\??\c:\pjppp.exec:\pjppp.exe50⤵
- Executes dropped EXE
-
\??\c:\rfrrxfr.exec:\rfrrxfr.exe51⤵
- Executes dropped EXE
-
\??\c:\lrrxxxr.exec:\lrrxxxr.exe52⤵
- Executes dropped EXE
-
\??\c:\jjdvp.exec:\jjdvp.exe53⤵
- Executes dropped EXE
-
\??\c:\88020.exec:\88020.exe54⤵
- Executes dropped EXE
-
\??\c:\4808226.exec:\4808226.exe55⤵
- Executes dropped EXE
-
\??\c:\ddvjp.exec:\ddvjp.exe56⤵
- Executes dropped EXE
-
\??\c:\20284.exec:\20284.exe57⤵
- Executes dropped EXE
-
\??\c:\0206628.exec:\0206628.exe58⤵
- Executes dropped EXE
-
\??\c:\flxxlfx.exec:\flxxlfx.exe59⤵
- Executes dropped EXE
-
\??\c:\xflrrfl.exec:\xflrrfl.exe60⤵
- Executes dropped EXE
-
\??\c:\ddjdj.exec:\ddjdj.exe61⤵
- Executes dropped EXE
-
\??\c:\rlrlffx.exec:\rlrlffx.exe62⤵
- Executes dropped EXE
-
\??\c:\626600.exec:\626600.exe63⤵
- Executes dropped EXE
-
\??\c:\62060.exec:\62060.exe64⤵
- Executes dropped EXE
-
\??\c:\2248064.exec:\2248064.exe65⤵
- Executes dropped EXE
-
\??\c:\xxrllfx.exec:\xxrllfx.exe66⤵
-
\??\c:\0444282.exec:\0444282.exe67⤵
-
\??\c:\i848226.exec:\i848226.exe68⤵
-
\??\c:\2082484.exec:\2082484.exe69⤵
-
\??\c:\rflfxxr.exec:\rflfxxr.exe70⤵
-
\??\c:\7pvvd.exec:\7pvvd.exe71⤵
-
\??\c:\bhtbhn.exec:\bhtbhn.exe72⤵
-
\??\c:\8626442.exec:\8626442.exe73⤵
-
\??\c:\ffrrrxx.exec:\ffrrrxx.exe74⤵
-
\??\c:\002400.exec:\002400.exe75⤵
-
\??\c:\pdvjd.exec:\pdvjd.exe76⤵
-
\??\c:\02488.exec:\02488.exe77⤵
-
\??\c:\lflrxlf.exec:\lflrxlf.exe78⤵
-
\??\c:\frfffrx.exec:\frfffrx.exe79⤵
-
\??\c:\ththbb.exec:\ththbb.exe80⤵
-
\??\c:\frrxxfr.exec:\frrxxfr.exe81⤵
-
\??\c:\86488.exec:\86488.exe82⤵
-
\??\c:\llffrxl.exec:\llffrxl.exe83⤵
-
\??\c:\6026008.exec:\6026008.exe84⤵
-
\??\c:\djvvd.exec:\djvvd.exe85⤵
-
\??\c:\nntnhh.exec:\nntnhh.exe86⤵
-
\??\c:\xxflxrf.exec:\xxflxrf.exe87⤵
-
\??\c:\400600.exec:\400600.exe88⤵
-
\??\c:\xxrfrxf.exec:\xxrfrxf.exe89⤵
-
\??\c:\0804822.exec:\0804822.exe90⤵
-
\??\c:\lxxlfrl.exec:\lxxlfrl.exe91⤵
-
\??\c:\dpddj.exec:\dpddj.exe92⤵
-
\??\c:\s2440.exec:\s2440.exe93⤵
-
\??\c:\82446.exec:\82446.exe94⤵
-
\??\c:\00802.exec:\00802.exe95⤵
-
\??\c:\vjdpj.exec:\vjdpj.exe96⤵
-
\??\c:\u648260.exec:\u648260.exe97⤵
-
\??\c:\422844.exec:\422844.exe98⤵
-
\??\c:\c446460.exec:\c446460.exe99⤵
-
\??\c:\pjjvd.exec:\pjjvd.exe100⤵
-
\??\c:\m4600.exec:\m4600.exe101⤵
-
\??\c:\82882.exec:\82882.exe102⤵
-
\??\c:\64864.exec:\64864.exe103⤵
-
\??\c:\48480.exec:\48480.exe104⤵
-
\??\c:\486062.exec:\486062.exe105⤵
-
\??\c:\tbhhbt.exec:\tbhhbt.exe106⤵
-
\??\c:\i226080.exec:\i226080.exe107⤵
-
\??\c:\1pjdp.exec:\1pjdp.exe108⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe109⤵
-
\??\c:\jpdpv.exec:\jpdpv.exe110⤵
-
\??\c:\vddvj.exec:\vddvj.exe111⤵
-
\??\c:\8426442.exec:\8426442.exe112⤵
-
\??\c:\1lrlxrf.exec:\1lrlxrf.exe113⤵
-
\??\c:\hhhhhn.exec:\hhhhhn.exe114⤵
-
\??\c:\ppppv.exec:\ppppv.exe115⤵
-
\??\c:\6442264.exec:\6442264.exe116⤵
-
\??\c:\tbbbtb.exec:\tbbbtb.exe117⤵
-
\??\c:\djppj.exec:\djppj.exe118⤵
-
\??\c:\fxxffxr.exec:\fxxffxr.exe119⤵
-
\??\c:\6886420.exec:\6886420.exe120⤵
-
\??\c:\206482.exec:\206482.exe121⤵
-
\??\c:\60824.exec:\60824.exe122⤵
-
\??\c:\0064482.exec:\0064482.exe123⤵
-
\??\c:\24820.exec:\24820.exe124⤵
-
\??\c:\dvjdp.exec:\dvjdp.exe125⤵
-
\??\c:\06420.exec:\06420.exe126⤵
-
\??\c:\vpjjd.exec:\vpjjd.exe127⤵
-
\??\c:\3ttnhh.exec:\3ttnhh.exe128⤵
-
\??\c:\7nntnh.exec:\7nntnh.exe129⤵
-
\??\c:\44042.exec:\44042.exe130⤵
-
\??\c:\hnnhtt.exec:\hnnhtt.exe131⤵
-
\??\c:\lxfrxrr.exec:\lxfrxrr.exe132⤵
-
\??\c:\2886486.exec:\2886486.exe133⤵
-
\??\c:\426082.exec:\426082.exe134⤵
-
\??\c:\420042.exec:\420042.exe135⤵
-
\??\c:\8404840.exec:\8404840.exe136⤵
-
\??\c:\bnhbtn.exec:\bnhbtn.exe137⤵
-
\??\c:\dvdpp.exec:\dvdpp.exe138⤵
-
\??\c:\08026.exec:\08026.exe139⤵
-
\??\c:\i808028.exec:\i808028.exe140⤵
-
\??\c:\00026.exec:\00026.exe141⤵
-
\??\c:\k80242.exec:\k80242.exe142⤵
-
\??\c:\vpppd.exec:\vpppd.exe143⤵
-
\??\c:\288024.exec:\288024.exe144⤵
-
\??\c:\8666226.exec:\8666226.exe145⤵
-
\??\c:\e82802.exec:\e82802.exe146⤵
-
\??\c:\pppvj.exec:\pppvj.exe147⤵
-
\??\c:\42826.exec:\42826.exe148⤵
-
\??\c:\3nnbnn.exec:\3nnbnn.exe149⤵
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe150⤵
-
\??\c:\4226008.exec:\4226008.exe151⤵
-
\??\c:\pppvj.exec:\pppvj.exe152⤵
-
\??\c:\jpvdp.exec:\jpvdp.exe153⤵
-
\??\c:\xxrfrll.exec:\xxrfrll.exe154⤵
-
\??\c:\rrxxlrr.exec:\rrxxlrr.exe155⤵
-
\??\c:\8600408.exec:\8600408.exe156⤵
-
\??\c:\8060886.exec:\8060886.exe157⤵
-
\??\c:\dpvjd.exec:\dpvjd.exe158⤵
-
\??\c:\dpvdv.exec:\dpvdv.exe159⤵
-
\??\c:\6642648.exec:\6642648.exe160⤵
-
\??\c:\4480868.exec:\4480868.exe161⤵
-
\??\c:\082604.exec:\082604.exe162⤵
-
\??\c:\xlrrllx.exec:\xlrrllx.exe163⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe164⤵
-
\??\c:\k84040.exec:\k84040.exe165⤵
-
\??\c:\lfrfxrf.exec:\lfrfxrf.exe166⤵
-
\??\c:\thhbht.exec:\thhbht.exe167⤵
-
\??\c:\86404.exec:\86404.exe168⤵
-
\??\c:\s2468.exec:\s2468.exe169⤵
-
\??\c:\s2282.exec:\s2282.exe170⤵
-
\??\c:\w20228.exec:\w20228.exe171⤵
-
\??\c:\o804448.exec:\o804448.exe172⤵
-
\??\c:\hnhhbb.exec:\hnhhbb.exe173⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe174⤵
-
\??\c:\46806.exec:\46806.exe175⤵
-
\??\c:\84222.exec:\84222.exe176⤵
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe177⤵
-
\??\c:\868804.exec:\868804.exe178⤵
-
\??\c:\i648884.exec:\i648884.exe179⤵
-
\??\c:\82600.exec:\82600.exe180⤵
-
\??\c:\2486822.exec:\2486822.exe181⤵
-
\??\c:\64600.exec:\64600.exe182⤵
-
\??\c:\frrlllf.exec:\frrlllf.exe183⤵
-
\??\c:\3ffxrrr.exec:\3ffxrrr.exe184⤵
-
\??\c:\0008648.exec:\0008648.exe185⤵
-
\??\c:\bthtnh.exec:\bthtnh.exe186⤵
-
\??\c:\vvpvj.exec:\vvpvj.exe187⤵
-
\??\c:\442286.exec:\442286.exe188⤵
-
\??\c:\04826.exec:\04826.exe189⤵
-
\??\c:\640006.exec:\640006.exe190⤵
-
\??\c:\m8426.exec:\m8426.exe191⤵
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe192⤵
-
\??\c:\404628.exec:\404628.exe193⤵
-
\??\c:\frlfxxl.exec:\frlfxxl.exe194⤵
-
\??\c:\5xrlfff.exec:\5xrlfff.exe195⤵
-
\??\c:\w28044.exec:\w28044.exe196⤵
-
\??\c:\lxxlfxl.exec:\lxxlfxl.exe197⤵
-
\??\c:\282082.exec:\282082.exe198⤵
-
\??\c:\68680.exec:\68680.exe199⤵
-
\??\c:\frxrxrr.exec:\frxrxrr.exe200⤵
-
\??\c:\2482840.exec:\2482840.exe201⤵
-
\??\c:\pvjjp.exec:\pvjjp.exe202⤵
-
\??\c:\pdddd.exec:\pdddd.exe203⤵
-
\??\c:\jddvj.exec:\jddvj.exe204⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe205⤵
-
\??\c:\dppjd.exec:\dppjd.exe206⤵
-
\??\c:\82080.exec:\82080.exe207⤵
-
\??\c:\bnthhb.exec:\bnthhb.exe208⤵
-
\??\c:\8284622.exec:\8284622.exe209⤵
-
\??\c:\9dvvp.exec:\9dvvp.exe210⤵
-
\??\c:\844888.exec:\844888.exe211⤵
-
\??\c:\jvppp.exec:\jvppp.exe212⤵
-
\??\c:\xlrfxrl.exec:\xlrfxrl.exe213⤵
-
\??\c:\hbnhbh.exec:\hbnhbh.exe214⤵
-
\??\c:\08682.exec:\08682.exe215⤵
-
\??\c:\lfrfxll.exec:\lfrfxll.exe216⤵
-
\??\c:\004468.exec:\004468.exe217⤵
-
\??\c:\jjjpj.exec:\jjjpj.exe218⤵
-
\??\c:\hbhhhn.exec:\hbhhhn.exe219⤵
-
\??\c:\nnhtbb.exec:\nnhtbb.exe220⤵
-
\??\c:\djjvv.exec:\djjvv.exe221⤵
-
\??\c:\6448882.exec:\6448882.exe222⤵
-
\??\c:\k20464.exec:\k20464.exe223⤵
-
\??\c:\0848666.exec:\0848666.exe224⤵
-
\??\c:\2600226.exec:\2600226.exe225⤵
-
\??\c:\u808860.exec:\u808860.exe226⤵
-
\??\c:\660668.exec:\660668.exe227⤵
-
\??\c:\bnhbnh.exec:\bnhbnh.exe228⤵
-
\??\c:\pppjv.exec:\pppjv.exe229⤵
-
\??\c:\nnnnbb.exec:\nnnnbb.exe230⤵
-
\??\c:\vdvvd.exec:\vdvvd.exe231⤵
-
\??\c:\xxlflxl.exec:\xxlflxl.exe232⤵
-
\??\c:\nhttbb.exec:\nhttbb.exe233⤵
-
\??\c:\pjddj.exec:\pjddj.exe234⤵
-
\??\c:\pvvvj.exec:\pvvvj.exe235⤵
-
\??\c:\bbnhtn.exec:\bbnhtn.exe236⤵
-
\??\c:\xlrrflf.exec:\xlrrflf.exe237⤵
-
\??\c:\8846848.exec:\8846848.exe238⤵
-
\??\c:\606084.exec:\606084.exe239⤵
-
\??\c:\48848.exec:\48848.exe240⤵
-
\??\c:\02004.exec:\02004.exe241⤵