Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 23:37
Behavioral task
behavioral1
Sample
26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe
-
Size
149KB
-
MD5
26661faea8740ed592e68d921dff59f0
-
SHA1
6329907014582ba2d8940ff2412baf3f793bb132
-
SHA256
b3a32c071d8022b13c4dd0f5be97b7041340b244df58d383c8cd47c5a1ee2793
-
SHA512
a77666aa969edd9000fde56a4c234169816ce30ff485132550a1e92b4b32971218b6cf8da114ef8ee91f7698a88cd307b76d0c61dcb801cd6b38faf22d00d644
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4tb:kcm4FmowdHoSphraHcpOFltH4tb
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3176-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1828-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2056-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/848-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1308-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-656-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-680-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-708-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-839-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-891-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-969-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-1003-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lrlffff.exehhttnn.exedvpjd.exelxxlffx.exebthhnn.exetnbtnn.exejpdjd.exexfrxxxr.exeppjvp.exexlfrrlf.exevpddj.exexxxrffr.exehtttnn.exenthbtt.exelflfxfx.exetnnhhb.exejddvv.exe3fffffx.exetbntbb.exepjddj.exevvjdp.exebhntht.exevdjdv.exeflfrxxx.exe7ntbhh.exe3vdpj.exenbnnhh.exebtttht.exexrffxrr.exellflffx.exetnbbbb.exerrffrfl.exenbnhhn.exe9vddj.exefffxxfx.exexxrxxxl.exehnbhnn.exepjppv.exefrrxxfx.exenttthh.exedjdpj.exelrrrlrf.exe7htntt.exejddjv.exe3lrlxrf.exe5ttnhb.exevppjv.exelffxrrl.exerrlxxrf.exenbhhbh.exejdjdv.exelfffxxf.exelrxlfrl.exe5hhtnh.exevdjjv.exejvvpd.exexxxfrlx.exenhhhbb.exe9ddvp.exedjdvj.exerflfxxr.exebtthbt.exevvpjp.exedpppj.exepid process 1828 lrlffff.exe 2812 hhttnn.exe 3204 dvpjd.exe 1824 lxxlffx.exe 3328 bthhnn.exe 1904 tnbtnn.exe 1164 jpdjd.exe 4476 xfrxxxr.exe 2132 ppjvp.exe 1976 xlfrrlf.exe 368 vpddj.exe 4560 xxxrffr.exe 940 htttnn.exe 760 nthbtt.exe 4692 lflfxfx.exe 528 tnnhhb.exe 4780 jddvv.exe 1560 3fffffx.exe 1172 tbntbb.exe 3000 pjddj.exe 392 vvjdp.exe 5044 bhntht.exe 2056 vdjdv.exe 3368 flfrxxx.exe 848 7ntbhh.exe 3708 3vdpj.exe 2492 nbnnhh.exe 2848 btttht.exe 4752 xrffxrr.exe 2916 llflffx.exe 4880 tnbbbb.exe 3144 rrffrfl.exe 2208 nbnhhn.exe 2240 9vddj.exe 4928 fffxxfx.exe 3120 xxrxxxl.exe 228 hnbhnn.exe 4428 pjppv.exe 4964 frrxxfx.exe 4544 nttthh.exe 1804 djdpj.exe 2304 lrrrlrf.exe 4492 7htntt.exe 2488 jddjv.exe 932 3lrlxrf.exe 1144 5ttnhb.exe 744 vppjv.exe 544 lffxrrl.exe 1356 rrlxxrf.exe 4476 nbhhbh.exe 2132 jdjdv.exe 1944 lfffxxf.exe 1340 lrxlfrl.exe 3140 5hhtnh.exe 3644 vdjjv.exe 4560 jvvpd.exe 4472 xxxfrlx.exe 760 nhhhbb.exe 5088 9ddvp.exe 1200 djdvj.exe 1592 rflfxxr.exe 4136 btthbt.exe 4564 vvpjp.exe 2828 dpppj.exe -
Processes:
resource yara_rule behavioral2/memory/3176-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrlffff.exe upx behavioral2/memory/3176-5-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhttnn.exe upx behavioral2/memory/1828-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvpjd.exe upx behavioral2/memory/3204-22-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthhnn.exe upx behavioral2/memory/1824-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxxlffx.exe upx behavioral2/memory/3204-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3328-33-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbtnn.exe upx behavioral2/memory/1904-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpdjd.exe upx behavioral2/memory/1164-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1904-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xfrxxxr.exe upx C:\ppjvp.exe upx C:\xlfrrlf.exe upx behavioral2/memory/2132-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpddj.exe upx behavioral2/memory/1976-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxrffr.exe upx behavioral2/memory/4560-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htttnn.exe upx \??\c:\nthbtt.exe upx behavioral2/memory/760-81-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflfxfx.exe upx behavioral2/memory/4692-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnhhb.exe upx behavioral2/memory/4692-93-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddvv.exe upx \??\c:\3fffffx.exe upx behavioral2/memory/1560-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbntbb.exe upx C:\pjddj.exe upx behavioral2/memory/528-99-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vvjdp.exe upx behavioral2/memory/3000-121-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhntht.exe upx C:\vdjdv.exe upx C:\flfrxxx.exe upx behavioral2/memory/2056-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3368-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7ntbhh.exe upx behavioral2/memory/848-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3vdpj.exe upx behavioral2/memory/3708-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbnnhh.exe upx behavioral2/memory/2492-156-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btttht.exe upx \??\c:\xrffxrr.exe upx behavioral2/memory/2848-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4752-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llflffx.exe upx behavioral2/memory/2916-175-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbbbb.exe upx \??\c:\rrffrfl.exe upx behavioral2/memory/4880-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3144-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2208-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2240-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4928-197-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exelrlffff.exehhttnn.exedvpjd.exelxxlffx.exebthhnn.exetnbtnn.exejpdjd.exexfrxxxr.exeppjvp.exexlfrrlf.exevpddj.exexxxrffr.exehtttnn.exenthbtt.exelflfxfx.exetnnhhb.exejddvv.exe3fffffx.exetbntbb.exepjddj.exevvjdp.exedescription pid process target process PID 3176 wrote to memory of 1828 3176 26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe lrlffff.exe PID 3176 wrote to memory of 1828 3176 26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe lrlffff.exe PID 3176 wrote to memory of 1828 3176 26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe lrlffff.exe PID 1828 wrote to memory of 2812 1828 lrlffff.exe hhttnn.exe PID 1828 wrote to memory of 2812 1828 lrlffff.exe hhttnn.exe PID 1828 wrote to memory of 2812 1828 lrlffff.exe hhttnn.exe PID 2812 wrote to memory of 3204 2812 hhttnn.exe dvpjd.exe PID 2812 wrote to memory of 3204 2812 hhttnn.exe dvpjd.exe PID 2812 wrote to memory of 3204 2812 hhttnn.exe dvpjd.exe PID 3204 wrote to memory of 1824 3204 dvpjd.exe lxxlffx.exe PID 3204 wrote to memory of 1824 3204 dvpjd.exe lxxlffx.exe PID 3204 wrote to memory of 1824 3204 dvpjd.exe lxxlffx.exe PID 1824 wrote to memory of 3328 1824 lxxlffx.exe bthhnn.exe PID 1824 wrote to memory of 3328 1824 lxxlffx.exe bthhnn.exe PID 1824 wrote to memory of 3328 1824 lxxlffx.exe bthhnn.exe PID 3328 wrote to memory of 1904 3328 bthhnn.exe tnbtnn.exe PID 3328 wrote to memory of 1904 3328 bthhnn.exe tnbtnn.exe PID 3328 wrote to memory of 1904 3328 bthhnn.exe tnbtnn.exe PID 1904 wrote to memory of 1164 1904 tnbtnn.exe jpdjd.exe PID 1904 wrote to memory of 1164 1904 tnbtnn.exe jpdjd.exe PID 1904 wrote to memory of 1164 1904 tnbtnn.exe jpdjd.exe PID 1164 wrote to memory of 4476 1164 jpdjd.exe xfrxxxr.exe PID 1164 wrote to memory of 4476 1164 jpdjd.exe xfrxxxr.exe PID 1164 wrote to memory of 4476 1164 jpdjd.exe xfrxxxr.exe PID 4476 wrote to memory of 2132 4476 xfrxxxr.exe ppjvp.exe PID 4476 wrote to memory of 2132 4476 xfrxxxr.exe ppjvp.exe PID 4476 wrote to memory of 2132 4476 xfrxxxr.exe ppjvp.exe PID 2132 wrote to memory of 1976 2132 ppjvp.exe xlfrrlf.exe PID 2132 wrote to memory of 1976 2132 ppjvp.exe xlfrrlf.exe PID 2132 wrote to memory of 1976 2132 ppjvp.exe xlfrrlf.exe PID 1976 wrote to memory of 368 1976 xlfrrlf.exe vpddj.exe PID 1976 wrote to memory of 368 1976 xlfrrlf.exe vpddj.exe PID 1976 wrote to memory of 368 1976 xlfrrlf.exe vpddj.exe PID 368 wrote to memory of 4560 368 vpddj.exe xxxrffr.exe PID 368 wrote to memory of 4560 368 vpddj.exe xxxrffr.exe PID 368 wrote to memory of 4560 368 vpddj.exe xxxrffr.exe PID 4560 wrote to memory of 940 4560 xxxrffr.exe htttnn.exe PID 4560 wrote to memory of 940 4560 xxxrffr.exe htttnn.exe PID 4560 wrote to memory of 940 4560 xxxrffr.exe htttnn.exe PID 940 wrote to memory of 760 940 htttnn.exe nthbtt.exe PID 940 wrote to memory of 760 940 htttnn.exe nthbtt.exe PID 940 wrote to memory of 760 940 htttnn.exe nthbtt.exe PID 760 wrote to memory of 4692 760 nthbtt.exe lflfxfx.exe PID 760 wrote to memory of 4692 760 nthbtt.exe lflfxfx.exe PID 760 wrote to memory of 4692 760 nthbtt.exe lflfxfx.exe PID 4692 wrote to memory of 528 4692 lflfxfx.exe tnnhhb.exe PID 4692 wrote to memory of 528 4692 lflfxfx.exe tnnhhb.exe PID 4692 wrote to memory of 528 4692 lflfxfx.exe tnnhhb.exe PID 528 wrote to memory of 4780 528 tnnhhb.exe jddvv.exe PID 528 wrote to memory of 4780 528 tnnhhb.exe jddvv.exe PID 528 wrote to memory of 4780 528 tnnhhb.exe jddvv.exe PID 4780 wrote to memory of 1560 4780 jddvv.exe 3fffffx.exe PID 4780 wrote to memory of 1560 4780 jddvv.exe 3fffffx.exe PID 4780 wrote to memory of 1560 4780 jddvv.exe 3fffffx.exe PID 1560 wrote to memory of 1172 1560 3fffffx.exe tbntbb.exe PID 1560 wrote to memory of 1172 1560 3fffffx.exe tbntbb.exe PID 1560 wrote to memory of 1172 1560 3fffffx.exe tbntbb.exe PID 1172 wrote to memory of 3000 1172 tbntbb.exe pjddj.exe PID 1172 wrote to memory of 3000 1172 tbntbb.exe pjddj.exe PID 1172 wrote to memory of 3000 1172 tbntbb.exe pjddj.exe PID 3000 wrote to memory of 392 3000 pjddj.exe vvjdp.exe PID 3000 wrote to memory of 392 3000 pjddj.exe vvjdp.exe PID 3000 wrote to memory of 392 3000 pjddj.exe vvjdp.exe PID 392 wrote to memory of 5044 392 vvjdp.exe bhntht.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\lrlffff.exec:\lrlffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\hhttnn.exec:\hhttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\dvpjd.exec:\dvpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\lxxlffx.exec:\lxxlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\bthhnn.exec:\bthhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\tnbtnn.exec:\tnbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\jpdjd.exec:\jpdjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\xfrxxxr.exec:\xfrxxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\ppjvp.exec:\ppjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\xlfrrlf.exec:\xlfrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\vpddj.exec:\vpddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\xxxrffr.exec:\xxxrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\htttnn.exec:\htttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\nthbtt.exec:\nthbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\lflfxfx.exec:\lflfxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\tnnhhb.exec:\tnnhhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\jddvv.exec:\jddvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\3fffffx.exec:\3fffffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\tbntbb.exec:\tbntbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\pjddj.exec:\pjddj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\vvjdp.exec:\vvjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\bhntht.exec:\bhntht.exe23⤵
- Executes dropped EXE
PID:5044 -
\??\c:\vdjdv.exec:\vdjdv.exe24⤵
- Executes dropped EXE
PID:2056 -
\??\c:\flfrxxx.exec:\flfrxxx.exe25⤵
- Executes dropped EXE
PID:3368 -
\??\c:\7ntbhh.exec:\7ntbhh.exe26⤵
- Executes dropped EXE
PID:848 -
\??\c:\3vdpj.exec:\3vdpj.exe27⤵
- Executes dropped EXE
PID:3708 -
\??\c:\nbnnhh.exec:\nbnnhh.exe28⤵
- Executes dropped EXE
PID:2492 -
\??\c:\btttht.exec:\btttht.exe29⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrffxrr.exec:\xrffxrr.exe30⤵
- Executes dropped EXE
PID:4752 -
\??\c:\llflffx.exec:\llflffx.exe31⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tnbbbb.exec:\tnbbbb.exe32⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rrffrfl.exec:\rrffrfl.exe33⤵
- Executes dropped EXE
PID:3144 -
\??\c:\nbnhhn.exec:\nbnhhn.exe34⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9vddj.exec:\9vddj.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fffxxfx.exec:\fffxxfx.exe36⤵
- Executes dropped EXE
PID:4928 -
\??\c:\xxrxxxl.exec:\xxrxxxl.exe37⤵
- Executes dropped EXE
PID:3120 -
\??\c:\hnbhnn.exec:\hnbhnn.exe38⤵
- Executes dropped EXE
PID:228 -
\??\c:\pjppv.exec:\pjppv.exe39⤵
- Executes dropped EXE
PID:4428 -
\??\c:\frrxxfx.exec:\frrxxfx.exe40⤵
- Executes dropped EXE
PID:4964 -
\??\c:\nttthh.exec:\nttthh.exe41⤵
- Executes dropped EXE
PID:4544 -
\??\c:\djdpj.exec:\djdpj.exe42⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lrrrlrf.exec:\lrrrlrf.exe43⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7htntt.exec:\7htntt.exe44⤵
- Executes dropped EXE
PID:4492 -
\??\c:\jddjv.exec:\jddjv.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3lrlxrf.exec:\3lrlxrf.exe46⤵
- Executes dropped EXE
PID:932 -
\??\c:\5ttnhb.exec:\5ttnhb.exe47⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vppjv.exec:\vppjv.exe48⤵
- Executes dropped EXE
PID:744 -
\??\c:\lffxrrl.exec:\lffxrrl.exe49⤵
- Executes dropped EXE
PID:544 -
\??\c:\rrlxxrf.exec:\rrlxxrf.exe50⤵
- Executes dropped EXE
PID:1356 -
\??\c:\nbhhbh.exec:\nbhhbh.exe51⤵
- Executes dropped EXE
PID:4476 -
\??\c:\jdjdv.exec:\jdjdv.exe52⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lfffxxf.exec:\lfffxxf.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\lrxlfrl.exec:\lrxlfrl.exe54⤵
- Executes dropped EXE
PID:1340 -
\??\c:\5hhtnh.exec:\5hhtnh.exe55⤵
- Executes dropped EXE
PID:3140 -
\??\c:\vdjjv.exec:\vdjjv.exe56⤵
- Executes dropped EXE
PID:3644 -
\??\c:\jvvpd.exec:\jvvpd.exe57⤵
- Executes dropped EXE
PID:4560 -
\??\c:\xxxfrlx.exec:\xxxfrlx.exe58⤵
- Executes dropped EXE
PID:4472 -
\??\c:\nhhhbb.exec:\nhhhbb.exe59⤵
- Executes dropped EXE
PID:760 -
\??\c:\9ddvp.exec:\9ddvp.exe60⤵
- Executes dropped EXE
PID:5088 -
\??\c:\djdvj.exec:\djdvj.exe61⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rflfxxr.exec:\rflfxxr.exe62⤵
- Executes dropped EXE
PID:1592 -
\??\c:\btthbt.exec:\btthbt.exe63⤵
- Executes dropped EXE
PID:4136 -
\??\c:\vvpjp.exec:\vvpjp.exe64⤵
- Executes dropped EXE
PID:4564 -
\??\c:\dpppj.exec:\dpppj.exe65⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xfflxlx.exec:\xfflxlx.exe66⤵PID:1172
-
\??\c:\tbhhhn.exec:\tbhhhn.exe67⤵PID:1372
-
\??\c:\pjpjd.exec:\pjpjd.exe68⤵PID:876
-
\??\c:\lxlffff.exec:\lxlffff.exe69⤵PID:2808
-
\??\c:\lrrrlff.exec:\lrrrlff.exe70⤵PID:5016
-
\??\c:\nbbtnh.exec:\nbbtnh.exe71⤵PID:1636
-
\??\c:\djjdv.exec:\djjdv.exe72⤵PID:3368
-
\??\c:\xrrfxxl.exec:\xrrfxxl.exe73⤵PID:2156
-
\??\c:\ntbbhh.exec:\ntbbhh.exe74⤵PID:740
-
\??\c:\bttnnn.exec:\bttnnn.exe75⤵PID:2300
-
\??\c:\pvvjp.exec:\pvvjp.exe76⤵PID:2932
-
\??\c:\7ppvv.exec:\7ppvv.exe77⤵PID:4584
-
\??\c:\fffxlrr.exec:\fffxlrr.exe78⤵PID:3996
-
\??\c:\btbbbh.exec:\btbbbh.exe79⤵PID:3672
-
\??\c:\hhbttb.exec:\hhbttb.exe80⤵PID:1972
-
\??\c:\7dvvp.exec:\7dvvp.exe81⤵PID:3108
-
\??\c:\7rxrrrr.exec:\7rxrrrr.exe82⤵PID:4124
-
\??\c:\nhtbhn.exec:\nhtbhn.exe83⤵PID:3196
-
\??\c:\bbttth.exec:\bbttth.exe84⤵PID:3584
-
\??\c:\jjjpv.exec:\jjjpv.exe85⤵PID:3344
-
\??\c:\lrffxrl.exec:\lrffxrl.exe86⤵PID:2272
-
\??\c:\bnhbbt.exec:\bnhbbt.exe87⤵PID:4344
-
\??\c:\bhbtnb.exec:\bhbtnb.exe88⤵PID:4360
-
\??\c:\jjdvp.exec:\jjdvp.exe89⤵PID:3084
-
\??\c:\ttbtnt.exec:\ttbtnt.exe90⤵PID:3464
-
\??\c:\vddvp.exec:\vddvp.exe91⤵PID:3400
-
\??\c:\rfrlllf.exec:\rfrlllf.exe92⤵PID:4512
-
\??\c:\5lrllfx.exec:\5lrllfx.exe93⤵PID:1312
-
\??\c:\nbbbnb.exec:\nbbbnb.exe94⤵PID:4492
-
\??\c:\pjjjv.exec:\pjjjv.exe95⤵PID:532
-
\??\c:\frfxrrl.exec:\frfxrrl.exe96⤵PID:4520
-
\??\c:\rrfrxlf.exec:\rrfrxlf.exe97⤵PID:1076
-
\??\c:\tthhbh.exec:\tthhbh.exe98⤵PID:2628
-
\??\c:\7vvvp.exec:\7vvvp.exe99⤵PID:2168
-
\??\c:\jpjdv.exec:\jpjdv.exe100⤵PID:4772
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe101⤵PID:5060
-
\??\c:\ntbhhn.exec:\ntbhhn.exe102⤵PID:2340
-
\??\c:\vjvvv.exec:\vjvvv.exe103⤵PID:4968
-
\??\c:\9xffrxx.exec:\9xffrxx.exe104⤵PID:2856
-
\??\c:\bbtnhb.exec:\bbtnhb.exe105⤵PID:4652
-
\??\c:\pvppd.exec:\pvppd.exe106⤵PID:640
-
\??\c:\1lxrlll.exec:\1lxrlll.exe107⤵PID:3676
-
\??\c:\rfrrfxl.exec:\rfrrfxl.exe108⤵PID:1052
-
\??\c:\tntntb.exec:\tntntb.exe109⤵PID:1640
-
\??\c:\jjvvj.exec:\jjvvj.exe110⤵PID:3496
-
\??\c:\3vvpp.exec:\3vvpp.exe111⤵PID:528
-
\??\c:\frrxlrx.exec:\frrxlrx.exe112⤵PID:1308
-
\??\c:\bbttbb.exec:\bbttbb.exe113⤵PID:4056
-
\??\c:\pvddj.exec:\pvddj.exe114⤵PID:2280
-
\??\c:\fxfffff.exec:\fxfffff.exe115⤵PID:4328
-
\??\c:\hhbbtb.exec:\hhbbtb.exe116⤵PID:3856
-
\??\c:\5ntnnn.exec:\5ntnnn.exe117⤵PID:852
-
\??\c:\pdpvv.exec:\pdpvv.exe118⤵PID:876
-
\??\c:\xlfllrx.exec:\xlfllrx.exe119⤵PID:2808
-
\??\c:\hhnhhh.exec:\hhnhhh.exe120⤵PID:2596
-
\??\c:\vdddd.exec:\vdddd.exe121⤵PID:844
-
\??\c:\bntbhn.exec:\bntbhn.exe122⤵PID:3368
-
\??\c:\dvjdj.exec:\dvjdj.exe123⤵PID:2156
-
\??\c:\vvppp.exec:\vvppp.exe124⤵PID:3708
-
\??\c:\fxxrlfr.exec:\fxxrlfr.exe125⤵PID:2300
-
\??\c:\htntnh.exec:\htntnh.exe126⤵PID:4744
-
\??\c:\jpddv.exec:\jpddv.exe127⤵PID:4996
-
\??\c:\jvpjd.exec:\jvpjd.exe128⤵PID:4336
-
\??\c:\rffxlxl.exec:\rffxlxl.exe129⤵PID:3516
-
\??\c:\7bhnbh.exec:\7bhnbh.exe130⤵PID:1788
-
\??\c:\ppjpv.exec:\ppjpv.exe131⤵PID:2916
-
\??\c:\xflrlxl.exec:\xflrlxl.exe132⤵PID:2836
-
\??\c:\nbnbbn.exec:\nbnbbn.exe133⤵PID:3144
-
\??\c:\bbbtht.exec:\bbbtht.exe134⤵PID:4716
-
\??\c:\jdvvv.exec:\jdvvv.exe135⤵PID:2356
-
\??\c:\3rrlfff.exec:\3rrlfff.exe136⤵PID:2176
-
\??\c:\bnntbt.exec:\bnntbt.exe137⤵PID:4928
-
\??\c:\jjdpp.exec:\jjdpp.exe138⤵PID:232
-
\??\c:\ddvdd.exec:\ddvdd.exe139⤵PID:4360
-
\??\c:\xxffllr.exec:\xxffllr.exe140⤵PID:2276
-
\??\c:\ttthbt.exec:\ttthbt.exe141⤵PID:3464
-
\??\c:\frfrlrl.exec:\frfrlrl.exe142⤵PID:1420
-
\??\c:\rxrxxfr.exec:\rxrxxfr.exe143⤵PID:1832
-
\??\c:\htbhhn.exec:\htbhhn.exe144⤵PID:2488
-
\??\c:\7pvpj.exec:\7pvpj.exe145⤵PID:1204
-
\??\c:\flrrrxx.exec:\flrrrxx.exe146⤵PID:1076
-
\??\c:\hbnnnn.exec:\hbnnnn.exe147⤵PID:2628
-
\??\c:\thnhbh.exec:\thnhbh.exe148⤵PID:3844
-
\??\c:\ppvvd.exec:\ppvvd.exe149⤵PID:4664
-
\??\c:\xrrxxxl.exec:\xrrxxxl.exe150⤵PID:2448
-
\??\c:\7hhhhn.exec:\7hhhhn.exe151⤵PID:2832
-
\??\c:\ppjdv.exec:\ppjdv.exe152⤵PID:1248
-
\??\c:\flfxrrf.exec:\flfxrrf.exe153⤵PID:4332
-
\??\c:\nnbbbh.exec:\nnbbbh.exe154⤵PID:3860
-
\??\c:\jvjjj.exec:\jvjjj.exe155⤵PID:3136
-
\??\c:\fxxffxx.exec:\fxxffxx.exe156⤵PID:4472
-
\??\c:\tnbhhn.exec:\tnbhhn.exe157⤵PID:2016
-
\??\c:\dppdv.exec:\dppdv.exe158⤵PID:4692
-
\??\c:\rrxxfxx.exec:\rrxxfxx.exe159⤵PID:4500
-
\??\c:\llxrlll.exec:\llxrlll.exe160⤵PID:1592
-
\??\c:\hnnbnn.exec:\hnnbnn.exe161⤵PID:3788
-
\??\c:\pdjdd.exec:\pdjdd.exe162⤵PID:2212
-
\??\c:\lrrrrxr.exec:\lrrrrxr.exe163⤵PID:636
-
\??\c:\rxxfxrf.exec:\rxxfxrf.exe164⤵PID:3000
-
\??\c:\ddvpv.exec:\ddvpv.exe165⤵PID:652
-
\??\c:\vvvpp.exec:\vvvpp.exe166⤵PID:1252
-
\??\c:\lrrrflr.exec:\lrrrflr.exe167⤵PID:876
-
\??\c:\nntnnb.exec:\nntnnb.exe168⤵PID:2256
-
\??\c:\7pppj.exec:\7pppj.exe169⤵PID:4796
-
\??\c:\pjpjv.exec:\pjpjv.exe170⤵PID:856
-
\??\c:\3flflll.exec:\3flflll.exe171⤵PID:2580
-
\??\c:\xxflfll.exec:\xxflfll.exe172⤵PID:2300
-
\??\c:\hbnhhb.exec:\hbnhhb.exe173⤵PID:4584
-
\??\c:\nbbbhh.exec:\nbbbhh.exe174⤵PID:4004
-
\??\c:\jjppd.exec:\jjppd.exe175⤵PID:4736
-
\??\c:\1ffffff.exec:\1ffffff.exe176⤵PID:3504
-
\??\c:\fflfxxl.exec:\fflfxxl.exe177⤵PID:2916
-
\??\c:\hntnnn.exec:\hntnnn.exe178⤵PID:2208
-
\??\c:\7pvpj.exec:\7pvpj.exe179⤵PID:2272
-
\??\c:\fflllff.exec:\fflllff.exe180⤵PID:4568
-
\??\c:\hbhbtt.exec:\hbhbtt.exe181⤵PID:4964
-
\??\c:\bbnhnt.exec:\bbnhnt.exe182⤵PID:4544
-
\??\c:\dvvpp.exec:\dvvpp.exe183⤵PID:4848
-
\??\c:\vvvvp.exec:\vvvvp.exe184⤵PID:4688
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe185⤵PID:4948
-
\??\c:\jpjpp.exec:\jpjpp.exe186⤵PID:532
-
\??\c:\pvvjd.exec:\pvvjd.exe187⤵PID:3092
-
\??\c:\9ffxxxr.exec:\9ffxxxr.exe188⤵PID:544
-
\??\c:\tbtntt.exec:\tbtntt.exe189⤵PID:1008
-
\??\c:\7rxxflr.exec:\7rxxflr.exe190⤵PID:5036
-
\??\c:\dvvpj.exec:\dvvpj.exe191⤵PID:4672
-
\??\c:\tntnnn.exec:\tntnnn.exe192⤵PID:2448
-
\??\c:\hhhnhh.exec:\hhhnhh.exe193⤵PID:4740
-
\??\c:\9vdvv.exec:\9vdvv.exe194⤵PID:1248
-
\??\c:\flrfxll.exec:\flrfxll.exe195⤵PID:3696
-
\??\c:\nntttb.exec:\nntttb.exe196⤵PID:3600
-
\??\c:\nntnhh.exec:\nntnhh.exe197⤵PID:4548
-
\??\c:\jvppd.exec:\jvppd.exe198⤵PID:4232
-
\??\c:\hhtntb.exec:\hhtntb.exe199⤵PID:5096
-
\??\c:\vpddj.exec:\vpddj.exe200⤵PID:4680
-
\??\c:\3dvdv.exec:\3dvdv.exe201⤵PID:4508
-
\??\c:\ddppj.exec:\ddppj.exe202⤵PID:1184
-
\??\c:\lffxxxr.exec:\lffxxxr.exe203⤵PID:1544
-
\??\c:\xrxrffl.exec:\xrxrffl.exe204⤵PID:2280
-
\??\c:\ntbbtb.exec:\ntbbtb.exe205⤵PID:3856
-
\??\c:\jdvvp.exec:\jdvvp.exe206⤵PID:3624
-
\??\c:\rrxffxf.exec:\rrxffxf.exe207⤵PID:3960
-
\??\c:\lrfffxx.exec:\lrfffxx.exe208⤵PID:3528
-
\??\c:\hbhbbb.exec:\hbhbbb.exe209⤵PID:1636
-
\??\c:\vpppp.exec:\vpppp.exe210⤵PID:3304
-
\??\c:\dpjdp.exec:\dpjdp.exe211⤵PID:4400
-
\??\c:\xxxlxlr.exec:\xxxlxlr.exe212⤵PID:3996
-
\??\c:\rrrrlfx.exec:\rrrrlfx.exe213⤵PID:4752
-
\??\c:\9nnhnt.exec:\9nnhnt.exe214⤵PID:4456
-
\??\c:\dpvdp.exec:\dpvdp.exe215⤵PID:1892
-
\??\c:\1jvvj.exec:\1jvvj.exe216⤵PID:2348
-
\??\c:\rfrfflf.exec:\rfrfflf.exe217⤵PID:3520
-
\??\c:\fxlffxf.exec:\fxlffxf.exe218⤵PID:324
-
\??\c:\7hhtnt.exec:\7hhtnt.exe219⤵PID:868
-
\??\c:\jpdpj.exec:\jpdpj.exe220⤵PID:4360
-
\??\c:\vvjdp.exec:\vvjdp.exe221⤵PID:2484
-
\??\c:\pvppp.exec:\pvppp.exe222⤵PID:1984
-
\??\c:\1fxrfrf.exec:\1fxrfrf.exe223⤵PID:2136
-
\??\c:\nhnttb.exec:\nhnttb.exe224⤵PID:4688
-
\??\c:\tbtbtn.exec:\tbtbtn.exe225⤵PID:4948
-
\??\c:\djdpd.exec:\djdpd.exe226⤵PID:532
-
\??\c:\lfrllfl.exec:\lfrllfl.exe227⤵PID:2332
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe228⤵PID:2672
-
\??\c:\3bthtn.exec:\3bthtn.exe229⤵PID:3988
-
\??\c:\bbttbb.exec:\bbttbb.exe230⤵PID:1352
-
\??\c:\jjjjd.exec:\jjjjd.exe231⤵PID:4672
-
\??\c:\dpjdv.exec:\dpjdv.exe232⤵PID:3524
-
\??\c:\7llfxxf.exec:\7llfxxf.exe233⤵PID:4496
-
\??\c:\xlrrxxr.exec:\xlrrxxr.exe234⤵PID:3228
-
\??\c:\5bbhnb.exec:\5bbhnb.exe235⤵PID:4560
-
\??\c:\pvjjd.exec:\pvjjd.exe236⤵PID:4460
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe237⤵PID:4548
-
\??\c:\nbnbtn.exec:\nbnbtn.exe238⤵PID:1924
-
\??\c:\vvpvv.exec:\vvpvv.exe239⤵PID:3948
-
\??\c:\dppvv.exec:\dppvv.exe240⤵PID:4680
-
\??\c:\rrlrllf.exec:\rrlrllf.exe241⤵PID:4508
-
\??\c:\bbtbbb.exec:\bbtbbb.exe242⤵PID:1184