Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 18:24
Behavioral task
behavioral1
Sample
29e64eaa89f08969ebb4beb6b0e5ee90_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
29e64eaa89f08969ebb4beb6b0e5ee90_NeikiAnalytics.exe
-
Size
92KB
-
MD5
29e64eaa89f08969ebb4beb6b0e5ee90
-
SHA1
d30190720075228a5dd5f286fa5e360ac9c4465d
-
SHA256
ed32ca0e726134659aa2ab03308cdae6adda7735809fec14f178818226eec8fa
-
SHA512
ac2017d9cc538e01502b6ab9bbeb14707ad8cff44779ca4d581d4b6799cf67b671d3c7e544ec30caf5e141b4e1dd39912362e84dafe503d62ae0a6d7ba869eba
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWprC8:8hOmTsF93UYfwC6GIout0fmCiiiXA6md
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1620-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2548-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/100-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2744-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2508-622-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2768-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-806-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-809-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-893-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvpjp.exexfxrffl.exerxrlrrx.exetnhbtt.exethhnhn.exe1pddd.exefrrlffx.exenbntnb.exehthhtt.exevppjd.exexrrxrrx.exetnbbtt.exevvjdp.exelflffll.exehbhbbb.exejdpjp.exevpdvv.exeffxxxxx.exebtnhhn.exehbttbb.exevpdpj.exexlrlffr.exenbhhhh.exebthnht.exe3vpjd.exelllrrrf.exetnbnnt.exebntnhh.exedvpjv.exexrfrlll.exerrlfllr.exedpvvj.exexxfxrlf.exebtbhbb.exe3jpvp.exevvddd.exelxxxxxf.exenhnnnn.exe9hhbtb.exevppjd.exe5vjdd.exerrlxlff.exebhttnn.exehbhbbb.exejdppp.exelflrllf.exe7hnnnn.exe9ddpv.exe5dppj.exefflfffx.exe1llxrfx.exenbtbtt.exennnhtn.exedpdjd.exeffllfll.exerrlfrrl.exe1tbbbh.exe9htnnn.exejdjvp.exe3flflfl.exeflxxlrl.exehthhnn.exevpvvv.exejdjjd.exepid process 1612 vvpjp.exe 4468 xfxrffl.exe 1440 rxrlrrx.exe 400 tnhbtt.exe 1404 thhnhn.exe 2420 1pddd.exe 3572 frrlffx.exe 2548 nbntnb.exe 3188 hthhtt.exe 4920 vppjd.exe 3944 xrrxrrx.exe 2908 tnbbtt.exe 1980 vvjdp.exe 2372 lflffll.exe 1488 hbhbbb.exe 1560 jdpjp.exe 3508 vpdvv.exe 4884 ffxxxxx.exe 1060 btnhhn.exe 4880 hbttbb.exe 440 vpdpj.exe 3088 xlrlffr.exe 4116 nbhhhh.exe 2452 bthnht.exe 2588 3vpjd.exe 3688 lllrrrf.exe 4640 tnbnnt.exe 2392 bntnhh.exe 1816 dvpjv.exe 4360 xrfrlll.exe 3680 rrlfllr.exe 1428 dpvvj.exe 2488 xxfxrlf.exe 4568 btbhbb.exe 2748 3jpvp.exe 4552 vvddd.exe 2720 lxxxxxf.exe 4876 nhnnnn.exe 3556 9hhbtb.exe 4492 vppjd.exe 1132 5vjdd.exe 2232 rrlxlff.exe 2276 bhttnn.exe 1668 hbhbbb.exe 2616 jdppp.exe 4500 lflrllf.exe 748 7hnnnn.exe 2348 9ddpv.exe 1724 5dppj.exe 1440 fflfffx.exe 4604 1llxrfx.exe 3024 nbtbtt.exe 2992 nnnhtn.exe 2448 dpdjd.exe 1584 ffllfll.exe 4324 rrlfrrl.exe 4580 1tbbbh.exe 1064 9htnnn.exe 5000 jdjvp.exe 2620 3flflfl.exe 100 flxxlrl.exe 2908 hthhnn.exe 1980 vpvvv.exe 1484 jdjjd.exe -
Processes:
resource yara_rule behavioral2/memory/1620-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvpjp.exe upx behavioral2/memory/1620-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1612-7-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xfxrffl.exe upx C:\rxrlrrx.exe upx C:\tnhbtt.exe upx behavioral2/memory/400-22-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\thhnhn.exe upx behavioral2/memory/1440-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4468-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1pddd.exe upx behavioral2/memory/1404-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frrlffx.exe upx C:\nbntnb.exe upx behavioral2/memory/3572-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2420-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2548-44-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hthhtt.exe upx C:\vppjd.exe upx behavioral2/memory/3188-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4920-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4920-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrxrrx.exe upx C:\tnbbtt.exe upx behavioral2/memory/3944-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjdp.exe upx behavioral2/memory/2908-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflffll.exe upx behavioral2/memory/2372-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhbbb.exe upx behavioral2/memory/2372-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdpjp.exe upx behavioral2/memory/1488-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpdvv.exe upx behavioral2/memory/3508-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffxxxxx.exe upx behavioral2/memory/4884-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnhhn.exe upx \??\c:\hbttbb.exe upx C:\vpdpj.exe upx behavioral2/memory/4880-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrlffr.exe upx behavioral2/memory/440-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3088-111-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbhhhh.exe upx behavioral2/memory/4116-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthnht.exe upx behavioral2/memory/2452-120-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3vpjd.exe upx C:\lllrrrf.exe upx \??\c:\tnbnnt.exe upx behavioral2/memory/4640-134-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bntnhh.exe upx behavioral2/memory/2392-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvpjv.exe upx \??\c:\xrfrlll.exe upx behavioral2/memory/4360-148-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrlfllr.exe upx behavioral2/memory/1428-156-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dpvvj.exe upx behavioral2/memory/2488-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4568-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4552-169-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
29e64eaa89f08969ebb4beb6b0e5ee90_NeikiAnalytics.exevvpjp.exexfxrffl.exerxrlrrx.exetnhbtt.exethhnhn.exe1pddd.exefrrlffx.exenbntnb.exehthhtt.exevppjd.exexrrxrrx.exetnbbtt.exevvjdp.exelflffll.exehbhbbb.exejdpjp.exevpdvv.exeffxxxxx.exebtnhhn.exehbttbb.exevpdpj.exedescription pid process target process PID 1620 wrote to memory of 1612 1620 29e64eaa89f08969ebb4beb6b0e5ee90_NeikiAnalytics.exe vvpjp.exe PID 1620 wrote to memory of 1612 1620 29e64eaa89f08969ebb4beb6b0e5ee90_NeikiAnalytics.exe vvpjp.exe PID 1620 wrote to memory of 1612 1620 29e64eaa89f08969ebb4beb6b0e5ee90_NeikiAnalytics.exe vvpjp.exe PID 1612 wrote to memory of 4468 1612 vvpjp.exe xfxrffl.exe PID 1612 wrote to memory of 4468 1612 vvpjp.exe xfxrffl.exe PID 1612 wrote to memory of 4468 1612 vvpjp.exe xfxrffl.exe PID 4468 wrote to memory of 1440 4468 xfxrffl.exe rxrlrrx.exe PID 4468 wrote to memory of 1440 4468 xfxrffl.exe rxrlrrx.exe PID 4468 wrote to memory of 1440 4468 xfxrffl.exe rxrlrrx.exe PID 1440 wrote to memory of 400 1440 rxrlrrx.exe tnhbtt.exe PID 1440 wrote to memory of 400 1440 rxrlrrx.exe tnhbtt.exe PID 1440 wrote to memory of 400 1440 rxrlrrx.exe tnhbtt.exe PID 400 wrote to memory of 1404 400 tnhbtt.exe thhnhn.exe PID 400 wrote to memory of 1404 400 tnhbtt.exe thhnhn.exe PID 400 wrote to memory of 1404 400 tnhbtt.exe thhnhn.exe PID 1404 wrote to memory of 2420 1404 thhnhn.exe 1pddd.exe PID 1404 wrote to memory of 2420 1404 thhnhn.exe 1pddd.exe PID 1404 wrote to memory of 2420 1404 thhnhn.exe 1pddd.exe PID 2420 wrote to memory of 3572 2420 1pddd.exe frrlffx.exe PID 2420 wrote to memory of 3572 2420 1pddd.exe frrlffx.exe PID 2420 wrote to memory of 3572 2420 1pddd.exe frrlffx.exe PID 3572 wrote to memory of 2548 3572 frrlffx.exe nbntnb.exe PID 3572 wrote to memory of 2548 3572 frrlffx.exe nbntnb.exe PID 3572 wrote to memory of 2548 3572 frrlffx.exe nbntnb.exe PID 2548 wrote to memory of 3188 2548 nbntnb.exe hthhtt.exe PID 2548 wrote to memory of 3188 2548 nbntnb.exe hthhtt.exe PID 2548 wrote to memory of 3188 2548 nbntnb.exe hthhtt.exe PID 3188 wrote to memory of 4920 3188 hthhtt.exe vppjd.exe PID 3188 wrote to memory of 4920 3188 hthhtt.exe vppjd.exe PID 3188 wrote to memory of 4920 3188 hthhtt.exe vppjd.exe PID 4920 wrote to memory of 3944 4920 vppjd.exe xrrxrrx.exe PID 4920 wrote to memory of 3944 4920 vppjd.exe xrrxrrx.exe PID 4920 wrote to memory of 3944 4920 vppjd.exe xrrxrrx.exe PID 3944 wrote to memory of 2908 3944 xrrxrrx.exe tnbbtt.exe PID 3944 wrote to memory of 2908 3944 xrrxrrx.exe tnbbtt.exe PID 3944 wrote to memory of 2908 3944 xrrxrrx.exe tnbbtt.exe PID 2908 wrote to memory of 1980 2908 tnbbtt.exe vvjdp.exe PID 2908 wrote to memory of 1980 2908 tnbbtt.exe vvjdp.exe PID 2908 wrote to memory of 1980 2908 tnbbtt.exe vvjdp.exe PID 1980 wrote to memory of 2372 1980 vvjdp.exe lflffll.exe PID 1980 wrote to memory of 2372 1980 vvjdp.exe lflffll.exe PID 1980 wrote to memory of 2372 1980 vvjdp.exe lflffll.exe PID 2372 wrote to memory of 1488 2372 lflffll.exe hbhbbb.exe PID 2372 wrote to memory of 1488 2372 lflffll.exe hbhbbb.exe PID 2372 wrote to memory of 1488 2372 lflffll.exe hbhbbb.exe PID 1488 wrote to memory of 1560 1488 hbhbbb.exe jdpjp.exe PID 1488 wrote to memory of 1560 1488 hbhbbb.exe jdpjp.exe PID 1488 wrote to memory of 1560 1488 hbhbbb.exe jdpjp.exe PID 1560 wrote to memory of 3508 1560 jdpjp.exe vpdvv.exe PID 1560 wrote to memory of 3508 1560 jdpjp.exe vpdvv.exe PID 1560 wrote to memory of 3508 1560 jdpjp.exe vpdvv.exe PID 3508 wrote to memory of 4884 3508 vpdvv.exe ffxxxxx.exe PID 3508 wrote to memory of 4884 3508 vpdvv.exe ffxxxxx.exe PID 3508 wrote to memory of 4884 3508 vpdvv.exe ffxxxxx.exe PID 4884 wrote to memory of 1060 4884 ffxxxxx.exe btnhhn.exe PID 4884 wrote to memory of 1060 4884 ffxxxxx.exe btnhhn.exe PID 4884 wrote to memory of 1060 4884 ffxxxxx.exe btnhhn.exe PID 1060 wrote to memory of 4880 1060 btnhhn.exe hbttbb.exe PID 1060 wrote to memory of 4880 1060 btnhhn.exe hbttbb.exe PID 1060 wrote to memory of 4880 1060 btnhhn.exe hbttbb.exe PID 4880 wrote to memory of 440 4880 hbttbb.exe vpdpj.exe PID 4880 wrote to memory of 440 4880 hbttbb.exe vpdpj.exe PID 4880 wrote to memory of 440 4880 hbttbb.exe vpdpj.exe PID 440 wrote to memory of 3088 440 vpdpj.exe xlrlffr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29e64eaa89f08969ebb4beb6b0e5ee90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\29e64eaa89f08969ebb4beb6b0e5ee90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\vvpjp.exec:\vvpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\xfxrffl.exec:\xfxrffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\rxrlrrx.exec:\rxrlrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\tnhbtt.exec:\tnhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\thhnhn.exec:\thhnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\1pddd.exec:\1pddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\frrlffx.exec:\frrlffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\nbntnb.exec:\nbntnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hthhtt.exec:\hthhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\vppjd.exec:\vppjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\xrrxrrx.exec:\xrrxrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\tnbbtt.exec:\tnbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vvjdp.exec:\vvjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\lflffll.exec:\lflffll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\hbhbbb.exec:\hbhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\jdpjp.exec:\jdpjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\vpdvv.exec:\vpdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\ffxxxxx.exec:\ffxxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\btnhhn.exec:\btnhhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\hbttbb.exec:\hbttbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\vpdpj.exec:\vpdpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\xlrlffr.exec:\xlrlffr.exe23⤵
- Executes dropped EXE
PID:3088 -
\??\c:\nbhhhh.exec:\nbhhhh.exe24⤵
- Executes dropped EXE
PID:4116 -
\??\c:\bthnht.exec:\bthnht.exe25⤵
- Executes dropped EXE
PID:2452 -
\??\c:\3vpjd.exec:\3vpjd.exe26⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lllrrrf.exec:\lllrrrf.exe27⤵
- Executes dropped EXE
PID:3688 -
\??\c:\tnbnnt.exec:\tnbnnt.exe28⤵
- Executes dropped EXE
PID:4640 -
\??\c:\bntnhh.exec:\bntnhh.exe29⤵
- Executes dropped EXE
PID:2392 -
\??\c:\dvpjv.exec:\dvpjv.exe30⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xrfrlll.exec:\xrfrlll.exe31⤵
- Executes dropped EXE
PID:4360 -
\??\c:\rrlfllr.exec:\rrlfllr.exe32⤵
- Executes dropped EXE
PID:3680 -
\??\c:\dpvvj.exec:\dpvvj.exe33⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe34⤵
- Executes dropped EXE
PID:2488 -
\??\c:\btbhbb.exec:\btbhbb.exe35⤵
- Executes dropped EXE
PID:4568 -
\??\c:\3jpvp.exec:\3jpvp.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vvddd.exec:\vvddd.exe37⤵
- Executes dropped EXE
PID:4552 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nhnnnn.exec:\nhnnnn.exe39⤵
- Executes dropped EXE
PID:4876 -
\??\c:\9hhbtb.exec:\9hhbtb.exe40⤵
- Executes dropped EXE
PID:3556 -
\??\c:\vppjd.exec:\vppjd.exe41⤵
- Executes dropped EXE
PID:4492 -
\??\c:\5vjdd.exec:\5vjdd.exe42⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rrlxlff.exec:\rrlxlff.exe43⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bhttnn.exec:\bhttnn.exe44⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hbhbbb.exec:\hbhbbb.exe45⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jdppp.exec:\jdppp.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lflrllf.exec:\lflrllf.exe47⤵
- Executes dropped EXE
PID:4500 -
\??\c:\7hnnnn.exec:\7hnnnn.exe48⤵
- Executes dropped EXE
PID:748 -
\??\c:\9ddpv.exec:\9ddpv.exe49⤵
- Executes dropped EXE
PID:2348 -
\??\c:\5dppj.exec:\5dppj.exe50⤵
- Executes dropped EXE
PID:1724 -
\??\c:\fflfffx.exec:\fflfffx.exe51⤵
- Executes dropped EXE
PID:1440 -
\??\c:\1llxrfx.exec:\1llxrfx.exe52⤵
- Executes dropped EXE
PID:4604 -
\??\c:\nbtbtt.exec:\nbtbtt.exe53⤵
- Executes dropped EXE
PID:3024 -
\??\c:\nnnhtn.exec:\nnnhtn.exe54⤵
- Executes dropped EXE
PID:2992 -
\??\c:\dpdjd.exec:\dpdjd.exe55⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ffllfll.exec:\ffllfll.exe56⤵
- Executes dropped EXE
PID:1584 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe57⤵
- Executes dropped EXE
PID:4324 -
\??\c:\1tbbbh.exec:\1tbbbh.exe58⤵
- Executes dropped EXE
PID:4580 -
\??\c:\9htnnn.exec:\9htnnn.exe59⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jdjvp.exec:\jdjvp.exe60⤵
- Executes dropped EXE
PID:5000 -
\??\c:\3flflfl.exec:\3flflfl.exe61⤵
- Executes dropped EXE
PID:2620 -
\??\c:\flxxlrl.exec:\flxxlrl.exe62⤵
- Executes dropped EXE
PID:100 -
\??\c:\hthhnn.exec:\hthhnn.exe63⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vpvvv.exec:\vpvvv.exe64⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jdjjd.exec:\jdjjd.exe65⤵
- Executes dropped EXE
PID:1484 -
\??\c:\1xrlrlr.exec:\1xrlrlr.exe66⤵PID:4728
-
\??\c:\9bbhnb.exec:\9bbhnb.exe67⤵PID:3188
-
\??\c:\djpjd.exec:\djpjd.exe68⤵PID:812
-
\??\c:\xxlfllf.exec:\xxlfllf.exe69⤵PID:3956
-
\??\c:\7hnnhh.exec:\7hnnhh.exe70⤵PID:1060
-
\??\c:\hnhhbb.exec:\hnhhbb.exe71⤵PID:3912
-
\??\c:\9djpj.exec:\9djpj.exe72⤵PID:5036
-
\??\c:\1vpvj.exec:\1vpvj.exe73⤵PID:2844
-
\??\c:\xfrlllf.exec:\xfrlllf.exe74⤵PID:940
-
\??\c:\ffrxxff.exec:\ffrxxff.exe75⤵PID:4116
-
\??\c:\tbtttn.exec:\tbtttn.exe76⤵PID:2932
-
\??\c:\5pvpp.exec:\5pvpp.exe77⤵PID:780
-
\??\c:\dvvvv.exec:\dvvvv.exe78⤵PID:2768
-
\??\c:\3rxrlll.exec:\3rxrlll.exe79⤵PID:1960
-
\??\c:\xxfffff.exec:\xxfffff.exe80⤵PID:2852
-
\??\c:\bnttnn.exec:\bnttnn.exe81⤵PID:1352
-
\??\c:\djdvj.exec:\djdvj.exe82⤵PID:876
-
\??\c:\jdpjd.exec:\jdpjd.exe83⤵PID:2392
-
\??\c:\7lrlxxx.exec:\7lrlxxx.exe84⤵PID:3844
-
\??\c:\nbtttt.exec:\nbtttt.exe85⤵PID:5064
-
\??\c:\3bbtnn.exec:\3bbtnn.exe86⤵PID:3840
-
\??\c:\jjjdp.exec:\jjjdp.exe87⤵PID:1652
-
\??\c:\xxrrlll.exec:\xxrrlll.exe88⤵PID:4296
-
\??\c:\frrlfxx.exec:\frrlfxx.exe89⤵PID:2524
-
\??\c:\hbbbtn.exec:\hbbbtn.exe90⤵PID:3564
-
\??\c:\jdddj.exec:\jdddj.exe91⤵PID:1468
-
\??\c:\jddvd.exec:\jddvd.exe92⤵PID:2748
-
\??\c:\xxxxxrl.exec:\xxxxxrl.exe93⤵PID:3284
-
\??\c:\rfxxxxr.exec:\rfxxxxr.exe94⤵PID:944
-
\??\c:\thhhbb.exec:\thhhbb.exe95⤵PID:4160
-
\??\c:\3dddd.exec:\3dddd.exe96⤵PID:3556
-
\??\c:\3rflxxx.exec:\3rflxxx.exe97⤵PID:4736
-
\??\c:\tbtnnn.exec:\tbtnnn.exe98⤵PID:3404
-
\??\c:\hntthn.exec:\hntthn.exe99⤵PID:2784
-
\??\c:\jpvvj.exec:\jpvvj.exe100⤵PID:1692
-
\??\c:\jpvjd.exec:\jpvjd.exe101⤵PID:2936
-
\??\c:\lrllfff.exec:\lrllfff.exe102⤵PID:3128
-
\??\c:\fxflffx.exec:\fxflffx.exe103⤵PID:5108
-
\??\c:\nbnttb.exec:\nbnttb.exe104⤵PID:1516
-
\??\c:\pjvvp.exec:\pjvvp.exe105⤵PID:2124
-
\??\c:\pdddp.exec:\pdddp.exe106⤵PID:656
-
\??\c:\xlrrllf.exec:\xlrrllf.exe107⤵PID:640
-
\??\c:\fxrrlll.exec:\fxrrlll.exe108⤵PID:4000
-
\??\c:\tnntnh.exec:\tnntnh.exe109⤵PID:3568
-
\??\c:\tthhbb.exec:\tthhbb.exe110⤵PID:2448
-
\??\c:\jpvvp.exec:\jpvvp.exe111⤵PID:1584
-
\??\c:\fxllxfx.exec:\fxllxfx.exe112⤵PID:2332
-
\??\c:\fxxxxxl.exec:\fxxxxxl.exe113⤵PID:1064
-
\??\c:\lfxrllx.exec:\lfxrllx.exe114⤵PID:1708
-
\??\c:\ntnhtn.exec:\ntnhtn.exe115⤵PID:1540
-
\??\c:\jjdvp.exec:\jjdvp.exe116⤵PID:3064
-
\??\c:\vjdvp.exec:\vjdvp.exe117⤵PID:816
-
\??\c:\3vvdd.exec:\3vvdd.exe118⤵PID:4372
-
\??\c:\9lllfrl.exec:\9lllfrl.exe119⤵PID:3084
-
\??\c:\bnnnhb.exec:\bnnnhb.exe120⤵PID:4156
-
\??\c:\dddvv.exec:\dddvv.exe121⤵PID:852
-
\??\c:\vpjdd.exec:\vpjdd.exe122⤵PID:2252
-
\??\c:\llfxffl.exec:\llfxffl.exe123⤵PID:3912
-
\??\c:\ddvvv.exec:\ddvvv.exe124⤵PID:1396
-
\??\c:\ttbntn.exec:\ttbntn.exe125⤵PID:5068
-
\??\c:\1dvpj.exec:\1dvpj.exe126⤵PID:1104
-
\??\c:\lrxrlfr.exec:\lrxrlfr.exe127⤵PID:3892
-
\??\c:\bntbtt.exec:\bntbtt.exe128⤵PID:2588
-
\??\c:\ddddv.exec:\ddddv.exe129⤵PID:4632
-
\??\c:\3fffxxr.exec:\3fffxxr.exe130⤵PID:4996
-
\??\c:\lrrrllf.exec:\lrrrllf.exe131⤵PID:4660
-
\??\c:\nhhbtn.exec:\nhhbtn.exe132⤵PID:4024
-
\??\c:\rxrlfrr.exec:\rxrlfrr.exe133⤵PID:3028
-
\??\c:\tttnnb.exec:\tttnnb.exe134⤵PID:840
-
\??\c:\ddvpd.exec:\ddvpd.exe135⤵PID:744
-
\??\c:\ppjvv.exec:\ppjvv.exe136⤵PID:1816
-
\??\c:\frllxxr.exec:\frllxxr.exe137⤵PID:740
-
\??\c:\1tbttt.exec:\1tbttt.exe138⤵PID:3528
-
\??\c:\ttttnn.exec:\ttttnn.exe139⤵PID:4128
-
\??\c:\pdddv.exec:\pdddv.exe140⤵PID:4464
-
\??\c:\rlrfxfx.exec:\rlrfxfx.exe141⤵PID:1664
-
\??\c:\1lxrlfx.exec:\1lxrlfx.exe142⤵PID:4844
-
\??\c:\hnnnhb.exec:\hnnnhb.exe143⤵PID:2008
-
\??\c:\3dpvp.exec:\3dpvp.exe144⤵PID:3704
-
\??\c:\7pvpj.exec:\7pvpj.exe145⤵PID:3444
-
\??\c:\lxrrrll.exec:\lxrrrll.exe146⤵PID:1504
-
\??\c:\rrlfffl.exec:\rrlfffl.exe147⤵PID:1248
-
\??\c:\bnbbbt.exec:\bnbbbt.exe148⤵PID:1528
-
\??\c:\tntnhh.exec:\tntnhh.exe149⤵PID:3676
-
\??\c:\ddjdv.exec:\ddjdv.exe150⤵PID:2404
-
\??\c:\ffxrlxr.exec:\ffxrlxr.exe151⤵PID:4596
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe152⤵PID:680
-
\??\c:\hbhhhn.exec:\hbhhhn.exe153⤵PID:4412
-
\??\c:\7nbbbb.exec:\7nbbbb.exe154⤵PID:4820
-
\??\c:\vvpvd.exec:\vvpvd.exe155⤵PID:3748
-
\??\c:\dvddp.exec:\dvddp.exe156⤵PID:1440
-
\??\c:\fxfffff.exec:\fxfffff.exe157⤵PID:4604
-
\??\c:\lxllflf.exec:\lxllflf.exe158⤵PID:4168
-
\??\c:\tbtttt.exec:\tbtttt.exe159⤵PID:2548
-
\??\c:\nhtnhn.exec:\nhtnhn.exe160⤵PID:1584
-
\??\c:\djjdv.exec:\djjdv.exe161⤵PID:2620
-
\??\c:\xxllxrl.exec:\xxllxrl.exe162⤵PID:1644
-
\??\c:\htbtnh.exec:\htbtnh.exe163⤵PID:1708
-
\??\c:\nnhbtn.exec:\nnhbtn.exe164⤵PID:1540
-
\??\c:\vdvpd.exec:\vdvpd.exe165⤵PID:2372
-
\??\c:\9ddpd.exec:\9ddpd.exe166⤵PID:816
-
\??\c:\rlrlffl.exec:\rlrlffl.exe167⤵PID:4372
-
\??\c:\nhnbbt.exec:\nhnbbt.exe168⤵PID:3084
-
\??\c:\5hhhtn.exec:\5hhhtn.exe169⤵PID:4156
-
\??\c:\ntnhbb.exec:\ntnhbb.exe170⤵PID:440
-
\??\c:\9pdvd.exec:\9pdvd.exe171⤵PID:1712
-
\??\c:\vvvpd.exec:\vvvpd.exe172⤵PID:1496
-
\??\c:\frrrlll.exec:\frrrlll.exe173⤵PID:3016
-
\??\c:\rrffxxr.exec:\rrffxxr.exe174⤵PID:2944
-
\??\c:\1hbbtb.exec:\1hbbtb.exe175⤵PID:2588
-
\??\c:\pjjdp.exec:\pjjdp.exe176⤵PID:4632
-
\??\c:\jpjvj.exec:\jpjvj.exe177⤵PID:3920
-
\??\c:\xxrlffx.exec:\xxrlffx.exe178⤵PID:2704
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe179⤵PID:1352
-
\??\c:\tntnhh.exec:\tntnhh.exe180⤵PID:4260
-
\??\c:\hbbtnn.exec:\hbbtnn.exe181⤵PID:2392
-
\??\c:\pvjdd.exec:\pvjdd.exe182⤵PID:3844
-
\??\c:\dvjvp.exec:\dvjvp.exe183⤵PID:4308
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe184⤵PID:4528
-
\??\c:\fxrrxxx.exec:\fxrrxxx.exe185⤵PID:1652
-
\??\c:\rrffxrl.exec:\rrffxrl.exe186⤵PID:4296
-
\??\c:\tbnhtt.exec:\tbnhtt.exe187⤵PID:3564
-
\??\c:\7hhbtn.exec:\7hhbtn.exe188⤵PID:468
-
\??\c:\5pppd.exec:\5pppd.exe189⤵PID:2748
-
\??\c:\ddjdp.exec:\ddjdp.exe190⤵PID:4020
-
\??\c:\rfffxxx.exec:\rfffxxx.exe191⤵PID:4724
-
\??\c:\xrrlfrl.exec:\xrrlfrl.exe192⤵PID:1052
-
\??\c:\5htthh.exec:\5htthh.exe193⤵PID:4572
-
\??\c:\vpvjd.exec:\vpvjd.exe194⤵PID:644
-
\??\c:\vpvpd.exec:\vpvpd.exe195⤵PID:2232
-
\??\c:\1xrfrrl.exec:\1xrfrrl.exe196⤵PID:3404
-
\??\c:\lxxrlxx.exec:\lxxrlxx.exe197⤵PID:3304
-
\??\c:\3nnhbh.exec:\3nnhbh.exe198⤵PID:1668
-
\??\c:\bthtnt.exec:\bthtnt.exe199⤵PID:2508
-
\??\c:\jddvj.exec:\jddvj.exe200⤵PID:4864
-
\??\c:\pvjdv.exec:\pvjdv.exe201⤵PID:3748
-
\??\c:\5vjjd.exec:\5vjjd.exe202⤵PID:2420
-
\??\c:\fffxlfx.exec:\fffxlfx.exe203⤵PID:3276
-
\??\c:\7lrlfxr.exec:\7lrlfxr.exe204⤵PID:920
-
\??\c:\tnnbtb.exec:\tnnbtb.exe205⤵PID:2776
-
\??\c:\nhtbtt.exec:\nhtbtt.exe206⤵PID:1008
-
\??\c:\pdpvp.exec:\pdpvp.exe207⤵PID:2620
-
\??\c:\1pvpj.exec:\1pvpj.exe208⤵PID:2028
-
\??\c:\7xlfxrl.exec:\7xlfxrl.exe209⤵PID:3064
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe210⤵PID:3716
-
\??\c:\hhhnhb.exec:\hhhnhb.exe211⤵PID:1476
-
\??\c:\bbbtbb.exec:\bbbtbb.exe212⤵PID:4788
-
\??\c:\nhnhhb.exec:\nhnhhb.exe213⤵PID:816
-
\??\c:\vjjdv.exec:\vjjdv.exe214⤵PID:4372
-
\??\c:\xxfrfxf.exec:\xxfrfxf.exe215⤵PID:3084
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe216⤵PID:4156
-
\??\c:\tttnhh.exec:\tttnhh.exe217⤵PID:880
-
\??\c:\1ddpp.exec:\1ddpp.exe218⤵PID:1496
-
\??\c:\jvpjv.exec:\jvpjv.exe219⤵PID:432
-
\??\c:\fllfxxr.exec:\fllfxxr.exe220⤵PID:3688
-
\??\c:\3fflxlf.exec:\3fflxlf.exe221⤵PID:4996
-
\??\c:\9tbbnn.exec:\9tbbnn.exe222⤵PID:3224
-
\??\c:\httnnh.exec:\httnnh.exe223⤵PID:4660
-
\??\c:\pvjjd.exec:\pvjjd.exe224⤵PID:876
-
\??\c:\xxxlffx.exec:\xxxlffx.exe225⤵PID:4360
-
\??\c:\bbhhnn.exec:\bbhhnn.exe226⤵PID:744
-
\??\c:\1btnhb.exec:\1btnhb.exe227⤵PID:3680
-
\??\c:\djpjp.exec:\djpjp.exe228⤵PID:5008
-
\??\c:\vjppj.exec:\vjppj.exe229⤵PID:2744
-
\??\c:\fxlfllr.exec:\fxlfllr.exe230⤵PID:2488
-
\??\c:\hnhhnh.exec:\hnhhnh.exe231⤵PID:4740
-
\??\c:\ntnnhh.exec:\ntnnhh.exe232⤵PID:3564
-
\??\c:\jdjdp.exec:\jdjdp.exe233⤵PID:448
-
\??\c:\ddjdv.exec:\ddjdv.exe234⤵PID:3284
-
\??\c:\flrfxlx.exec:\flrfxlx.exe235⤵PID:4020
-
\??\c:\xfxxllf.exec:\xfxxllf.exe236⤵PID:4656
-
\??\c:\tnhhtt.exec:\tnhhtt.exe237⤵PID:1052
-
\??\c:\nhhhnh.exec:\nhhhnh.exe238⤵PID:4572
-
\??\c:\9vvjd.exec:\9vvjd.exe239⤵PID:644
-
\??\c:\fxrllll.exec:\fxrllll.exe240⤵PID:2232
-
\??\c:\frlxrll.exec:\frlxrll.exe241⤵PID:3404
-
\??\c:\tttbbb.exec:\tttbbb.exe242⤵PID:4776