Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 02:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe
-
Size
182KB
-
MD5
56b16c3b219c45bc8083d4e4904d6440
-
SHA1
97b452375ba28f4d2e486ecf8b984283da74f56b
-
SHA256
bc1cb1cb60312ae86d0d418783751fb5163221477f2717bc69c8af0e3ffc158c
-
SHA512
6c8d0d99b1c070a6c7b242e38bd6802f73b88a6c4d277108f307991def8e6cd1b22b120be67b202c36f8ce0ef6311a82d9acb193fc73d8a6144196746bd70cf7
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJPhbMqr:PhOm2sI93UufdC67ciJTm5hIU
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1624-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-325-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/652-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-364-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-372-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-452-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-503-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-513-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-590-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-612-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-622-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-636-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-700-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-710-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-720-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-1023-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-1094-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-1254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 844 lxllffx.exe 3220 djjjd.exe 4080 rrxxxxr.exe 3736 rrxxrrr.exe 872 hhhhbb.exe 2852 1bhbtb.exe 2964 3pdjd.exe 2248 djjdj.exe 3400 xfxrlff.exe 4232 bhtttn.exe 3900 5jvdv.exe 1572 ppppj.exe 4764 dvppd.exe 3748 5pjdv.exe 4384 nttnnh.exe 4860 ddpjj.exe 3768 7nnhbb.exe 2476 rxfxxxl.exe 244 dppjj.exe 5056 rrrllff.exe 3396 flllflf.exe 3128 bbnttn.exe 4252 vpddj.exe 4520 ttbbbb.exe 1648 dvpjd.exe 2844 jdjjv.exe 3592 hbhnhh.exe 1376 tntnbb.exe 1616 pdvpj.exe 1772 jjpjd.exe 4972 7frlrrl.exe 4976 thnhbh.exe 3972 dppjj.exe 2232 1pdvp.exe 2128 rfxxrlf.exe 3620 9pddv.exe 3436 9rllffl.exe 4516 hhhbtt.exe 3488 3djdd.exe 4552 jjvvp.exe 2204 thhtht.exe 2288 vdjdd.exe 3076 vjjvj.exe 4456 bbhbtt.exe 2216 ntbbnt.exe 1652 djppv.exe 4140 thnhtn.exe 4544 dpvvp.exe 4624 dvpvj.exe 2464 xrrxrfx.exe 2184 nbttbh.exe 1932 pdddj.exe 4648 lxrlfff.exe 3676 bttnbb.exe 4256 ntbnnn.exe 3912 lllxlxl.exe 2004 tnbntb.exe 4244 pvjjd.exe 3220 rlffxxr.exe 4100 btbtth.exe 3860 ppjjj.exe 3504 rflflxr.exe 3244 nbhhbn.exe 5092 vjvjv.exe -
resource yara_rule behavioral2/memory/1624-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-326-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/652-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-372-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-382-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-465-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-478-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-503-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-513-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-590-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1624 wrote to memory of 844 1624 56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe 80 PID 1624 wrote to memory of 844 1624 56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe 80 PID 1624 wrote to memory of 844 1624 56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe 80 PID 844 wrote to memory of 3220 844 lxllffx.exe 81 PID 844 wrote to memory of 3220 844 lxllffx.exe 81 PID 844 wrote to memory of 3220 844 lxllffx.exe 81 PID 3220 wrote to memory of 4080 3220 djjjd.exe 82 PID 3220 wrote to memory of 4080 3220 djjjd.exe 82 PID 3220 wrote to memory of 4080 3220 djjjd.exe 82 PID 4080 wrote to memory of 3736 4080 rrxxxxr.exe 83 PID 4080 wrote to memory of 3736 4080 rrxxxxr.exe 83 PID 4080 wrote to memory of 3736 4080 rrxxxxr.exe 83 PID 3736 wrote to memory of 872 3736 rrxxrrr.exe 84 PID 3736 wrote to memory of 872 3736 rrxxrrr.exe 84 PID 3736 wrote to memory of 872 3736 rrxxrrr.exe 84 PID 872 wrote to memory of 2852 872 hhhhbb.exe 85 PID 872 wrote to memory of 2852 872 hhhhbb.exe 85 PID 872 wrote to memory of 2852 872 hhhhbb.exe 85 PID 2852 wrote to memory of 2964 2852 1bhbtb.exe 86 PID 2852 wrote to memory of 2964 2852 1bhbtb.exe 86 PID 2852 wrote to memory of 2964 2852 1bhbtb.exe 86 PID 2964 wrote to memory of 2248 2964 3pdjd.exe 87 PID 2964 wrote to memory of 2248 2964 3pdjd.exe 87 PID 2964 wrote to memory of 2248 2964 3pdjd.exe 87 PID 2248 wrote to memory of 3400 2248 djjdj.exe 88 PID 2248 wrote to memory of 3400 2248 djjdj.exe 88 PID 2248 wrote to memory of 3400 2248 djjdj.exe 88 PID 3400 wrote to memory of 4232 3400 xfxrlff.exe 89 PID 3400 wrote to memory of 4232 3400 xfxrlff.exe 89 PID 3400 wrote to memory of 4232 3400 xfxrlff.exe 89 PID 4232 wrote to memory of 3900 4232 bhtttn.exe 90 PID 4232 wrote to memory of 3900 4232 bhtttn.exe 90 PID 4232 wrote to memory of 3900 4232 bhtttn.exe 90 PID 3900 wrote to memory of 1572 3900 5jvdv.exe 91 PID 3900 wrote to memory of 1572 3900 5jvdv.exe 91 PID 3900 wrote to memory of 1572 3900 5jvdv.exe 91 PID 1572 wrote to memory of 4764 1572 ppppj.exe 92 PID 1572 wrote to memory of 4764 1572 ppppj.exe 92 PID 1572 wrote to memory of 4764 1572 ppppj.exe 92 PID 4764 wrote to memory of 3748 4764 dvppd.exe 93 PID 4764 wrote to memory of 3748 4764 dvppd.exe 93 PID 4764 wrote to memory of 3748 4764 dvppd.exe 93 PID 3748 wrote to memory of 4384 3748 5pjdv.exe 94 PID 3748 wrote to memory of 4384 3748 5pjdv.exe 94 PID 3748 wrote to memory of 4384 3748 5pjdv.exe 94 PID 4384 wrote to memory of 4860 4384 nttnnh.exe 95 PID 4384 wrote to memory of 4860 4384 nttnnh.exe 95 PID 4384 wrote to memory of 4860 4384 nttnnh.exe 95 PID 4860 wrote to memory of 3768 4860 ddpjj.exe 96 PID 4860 wrote to memory of 3768 4860 ddpjj.exe 96 PID 4860 wrote to memory of 3768 4860 ddpjj.exe 96 PID 3768 wrote to memory of 2476 3768 7nnhbb.exe 97 PID 3768 wrote to memory of 2476 3768 7nnhbb.exe 97 PID 3768 wrote to memory of 2476 3768 7nnhbb.exe 97 PID 2476 wrote to memory of 244 2476 rxfxxxl.exe 98 PID 2476 wrote to memory of 244 2476 rxfxxxl.exe 98 PID 2476 wrote to memory of 244 2476 rxfxxxl.exe 98 PID 244 wrote to memory of 5056 244 dppjj.exe 99 PID 244 wrote to memory of 5056 244 dppjj.exe 99 PID 244 wrote to memory of 5056 244 dppjj.exe 99 PID 5056 wrote to memory of 3396 5056 rrrllff.exe 100 PID 5056 wrote to memory of 3396 5056 rrrllff.exe 100 PID 5056 wrote to memory of 3396 5056 rrrllff.exe 100 PID 3396 wrote to memory of 3128 3396 flllflf.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\56b16c3b219c45bc8083d4e4904d6440_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\lxllffx.exec:\lxllffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\djjjd.exec:\djjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\rrxxxxr.exec:\rrxxxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\hhhhbb.exec:\hhhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\1bhbtb.exec:\1bhbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\3pdjd.exec:\3pdjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\djjdj.exec:\djjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\xfxrlff.exec:\xfxrlff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\bhtttn.exec:\bhtttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\5jvdv.exec:\5jvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\ppppj.exec:\ppppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\dvppd.exec:\dvppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\5pjdv.exec:\5pjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\nttnnh.exec:\nttnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\ddpjj.exec:\ddpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\7nnhbb.exec:\7nnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\rxfxxxl.exec:\rxfxxxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\dppjj.exec:\dppjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\rrrllff.exec:\rrrllff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\flllflf.exec:\flllflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\bbnttn.exec:\bbnttn.exe23⤵
- Executes dropped EXE
PID:3128 -
\??\c:\vpddj.exec:\vpddj.exe24⤵
- Executes dropped EXE
PID:4252 -
\??\c:\ttbbbb.exec:\ttbbbb.exe25⤵
- Executes dropped EXE
PID:4520 -
\??\c:\dvpjd.exec:\dvpjd.exe26⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jdjjv.exec:\jdjjv.exe27⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hbhnhh.exec:\hbhnhh.exe28⤵
- Executes dropped EXE
PID:3592 -
\??\c:\tntnbb.exec:\tntnbb.exe29⤵
- Executes dropped EXE
PID:1376 -
\??\c:\pdvpj.exec:\pdvpj.exe30⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jjpjd.exec:\jjpjd.exe31⤵
- Executes dropped EXE
PID:1772 -
\??\c:\7frlrrl.exec:\7frlrrl.exe32⤵
- Executes dropped EXE
PID:4972 -
\??\c:\thnhbh.exec:\thnhbh.exe33⤵
- Executes dropped EXE
PID:4976 -
\??\c:\dppjj.exec:\dppjj.exe34⤵
- Executes dropped EXE
PID:3972 -
\??\c:\1pdvp.exec:\1pdvp.exe35⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rfxxrlf.exec:\rfxxrlf.exe36⤵
- Executes dropped EXE
PID:2128 -
\??\c:\9pddv.exec:\9pddv.exe37⤵
- Executes dropped EXE
PID:3620 -
\??\c:\9rllffl.exec:\9rllffl.exe38⤵
- Executes dropped EXE
PID:3436 -
\??\c:\hhhbtt.exec:\hhhbtt.exe39⤵
- Executes dropped EXE
PID:4516 -
\??\c:\3djdd.exec:\3djdd.exe40⤵
- Executes dropped EXE
PID:3488 -
\??\c:\jjvvp.exec:\jjvvp.exe41⤵
- Executes dropped EXE
PID:4552 -
\??\c:\thhtht.exec:\thhtht.exe42⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vdjdd.exec:\vdjdd.exe43⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vjjvj.exec:\vjjvj.exe44⤵
- Executes dropped EXE
PID:3076 -
\??\c:\bbhbtt.exec:\bbhbtt.exe45⤵
- Executes dropped EXE
PID:4456 -
\??\c:\ntbbnt.exec:\ntbbnt.exe46⤵
- Executes dropped EXE
PID:2216 -
\??\c:\djppv.exec:\djppv.exe47⤵
- Executes dropped EXE
PID:1652 -
\??\c:\thnhtn.exec:\thnhtn.exe48⤵
- Executes dropped EXE
PID:4140 -
\??\c:\dpvvp.exec:\dpvvp.exe49⤵
- Executes dropped EXE
PID:4544 -
\??\c:\dvpvj.exec:\dvpvj.exe50⤵
- Executes dropped EXE
PID:4624 -
\??\c:\xrrxrfx.exec:\xrrxrfx.exe51⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nbttbh.exec:\nbttbh.exe52⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pdddj.exec:\pdddj.exe53⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lxrlfff.exec:\lxrlfff.exe54⤵
- Executes dropped EXE
PID:4648 -
\??\c:\bttnbb.exec:\bttnbb.exe55⤵
- Executes dropped EXE
PID:3676 -
\??\c:\ntbnnn.exec:\ntbnnn.exe56⤵
- Executes dropped EXE
PID:4256 -
\??\c:\9jppp.exec:\9jppp.exe57⤵PID:4308
-
\??\c:\lllxlxl.exec:\lllxlxl.exe58⤵
- Executes dropped EXE
PID:3912 -
\??\c:\tnbntb.exec:\tnbntb.exe59⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pvjjd.exec:\pvjjd.exe60⤵
- Executes dropped EXE
PID:4244 -
\??\c:\rlffxxr.exec:\rlffxxr.exe61⤵
- Executes dropped EXE
PID:3220 -
\??\c:\btbtth.exec:\btbtth.exe62⤵
- Executes dropped EXE
PID:4100 -
\??\c:\ppjjj.exec:\ppjjj.exe63⤵
- Executes dropped EXE
PID:3860 -
\??\c:\rflflxr.exec:\rflflxr.exe64⤵
- Executes dropped EXE
PID:3504 -
\??\c:\nbhhbn.exec:\nbhhbn.exe65⤵
- Executes dropped EXE
PID:3244 -
\??\c:\vjvjv.exec:\vjvjv.exe66⤵
- Executes dropped EXE
PID:5092 -
\??\c:\pjjjd.exec:\pjjjd.exe67⤵PID:1136
-
\??\c:\rfrlxrf.exec:\rfrlxrf.exe68⤵PID:1072
-
\??\c:\1tnnnn.exec:\1tnnnn.exe69⤵PID:3404
-
\??\c:\vdvpp.exec:\vdvpp.exe70⤵PID:2920
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe71⤵PID:3400
-
\??\c:\bbnnnn.exec:\bbnnnn.exe72⤵PID:2948
-
\??\c:\5rxflxr.exec:\5rxflxr.exe73⤵PID:4388
-
\??\c:\hbhbhh.exec:\hbhbhh.exe74⤵PID:4892
-
\??\c:\dvpdp.exec:\dvpdp.exe75⤵PID:2200
-
\??\c:\dvvpp.exec:\dvvpp.exe76⤵PID:1600
-
\??\c:\flllllr.exec:\flllllr.exe77⤵PID:2144
-
\??\c:\3tnhbb.exec:\3tnhbb.exe78⤵PID:1524
-
\??\c:\pdjpp.exec:\pdjpp.exe79⤵PID:4444
-
\??\c:\rrrrrrx.exec:\rrrrrrx.exe80⤵PID:3668
-
\??\c:\lrrlflx.exec:\lrrlflx.exe81⤵PID:3916
-
\??\c:\bnttnn.exec:\bnttnn.exe82⤵PID:5012
-
\??\c:\dpjvv.exec:\dpjvv.exe83⤵PID:2164
-
\??\c:\lfrxfll.exec:\lfrxfll.exe84⤵PID:652
-
\??\c:\nbhhnt.exec:\nbhhnt.exe85⤵PID:3608
-
\??\c:\vpdvv.exec:\vpdvv.exe86⤵PID:2108
-
\??\c:\fxflflf.exec:\fxflflf.exe87⤵PID:4048
-
\??\c:\bbtnhh.exec:\bbtnhh.exe88⤵PID:1644
-
\??\c:\jpvpj.exec:\jpvpj.exe89⤵PID:2904
-
\??\c:\xlrrrxr.exec:\xlrrrxr.exe90⤵PID:3088
-
\??\c:\nbhhbt.exec:\nbhhbt.exe91⤵PID:1420
-
\??\c:\dvvjd.exec:\dvvjd.exe92⤵PID:368
-
\??\c:\ddddj.exec:\ddddj.exe93⤵PID:320
-
\??\c:\lfxrxxr.exec:\lfxrxxr.exe94⤵PID:4756
-
\??\c:\bbnntb.exec:\bbnntb.exe95⤵PID:3200
-
\??\c:\jjjjd.exec:\jjjjd.exe96⤵PID:4324
-
\??\c:\vvdvp.exec:\vvdvp.exe97⤵PID:2152
-
\??\c:\1rfxflx.exec:\1rfxflx.exe98⤵PID:4760
-
\??\c:\hhbnbt.exec:\hhbnbt.exe99⤵PID:1772
-
\??\c:\vpppp.exec:\vpppp.exe100⤵PID:4300
-
\??\c:\fxrlllf.exec:\fxrlllf.exe101⤵PID:2304
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe102⤵PID:1868
-
\??\c:\btbhhh.exec:\btbhhh.exe103⤵PID:3956
-
\??\c:\vdvpv.exec:\vdvpv.exe104⤵PID:1800
-
\??\c:\lxlxrlf.exec:\lxlxrlf.exe105⤵PID:3116
-
\??\c:\bhbbnh.exec:\bhbbnh.exe106⤵PID:2660
-
\??\c:\pdddd.exec:\pdddd.exe107⤵PID:5060
-
\??\c:\9dddv.exec:\9dddv.exe108⤵PID:4852
-
\??\c:\fffxllf.exec:\fffxllf.exe109⤵PID:2392
-
\??\c:\thtnhh.exec:\thtnhh.exe110⤵PID:1456
-
\??\c:\dddjd.exec:\dddjd.exe111⤵PID:3832
-
\??\c:\pdvjd.exec:\pdvjd.exe112⤵PID:3836
-
\??\c:\5hnnnn.exec:\5hnnnn.exe113⤵PID:5008
-
\??\c:\jjvpp.exec:\jjvpp.exe114⤵PID:2396
-
\??\c:\dpdjj.exec:\dpdjj.exe115⤵PID:4272
-
\??\c:\ffllllf.exec:\ffllllf.exe116⤵PID:916
-
\??\c:\1tbtbb.exec:\1tbtbb.exe117⤵PID:1416
-
\??\c:\1pppj.exec:\1pppj.exe118⤵PID:1768
-
\??\c:\vpjvd.exec:\vpjvd.exe119⤵PID:3132
-
\??\c:\xffrlll.exec:\xffrlll.exe120⤵PID:1440
-
\??\c:\nhhbhb.exec:\nhhbhb.exe121⤵PID:996
-
\??\c:\vvvpv.exec:\vvvpv.exe122⤵PID:2016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-