Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 23:13
Behavioral task
behavioral1
Sample
583f4b6f5c6a5efc1d5286617a548020_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
583f4b6f5c6a5efc1d5286617a548020_NeikiAnalytics.exe
-
Size
232KB
-
MD5
583f4b6f5c6a5efc1d5286617a548020
-
SHA1
4fcbf0f6fc9a3c676709f4da3353907db331125b
-
SHA256
8c7a5d1159a401227fcbb1d4fa1f89ce31c9f27b2bbd8280ffa04c382b612186
-
SHA512
36d2ed0f5163a20cd0efb472c26b9338e604696f1501b802918a0b3d42d09b0dcf7a4c5dceeb1c9a700b62fc5578b08ba739fbd6422c821949eee43c03d62234
-
SSDEEP
6144:kcm4FmowdHoSSGpJw4PqhraHcpOmFTHDGYhEf5X2as:y4wFHoSSGpJwGeeFmFTNAp2N
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3420-5-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4900-8-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3432-14-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/756-24-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2856-31-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3652-37-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3268-66-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4840-65-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1872-61-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2652-47-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4168-42-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4620-80-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2148-78-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/644-89-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5104-95-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2824-101-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4856-107-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4148-115-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2428-126-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4556-132-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2216-138-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/216-149-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3228-152-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2820-157-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1012-166-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3472-183-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4504-189-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2688-200-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2896-203-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1944-213-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1732-227-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3432-246-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2228-254-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1620-263-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5016-267-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3496-272-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3936-318-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/340-331-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3364-351-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3592-360-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4588-367-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2568-378-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2512-399-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2128-431-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4672-441-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1952-451-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4724-470-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3256-480-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4968-502-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4036-528-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4284-562-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1800-563-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2628-609-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5080-622-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1240-649-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4468-692-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1252-696-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2216-756-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3272-783-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2128-854-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1708-918-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1876-934-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4572-945-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2804-978-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9ffrlrr.exebttttb.exenbnhbt.exejpvpj.exevpdvp.exetnbtnn.exethbnhh.exeddvpj.exedppjj.exefxfxxxr.exehbbthh.exejjvpj.exetttnhh.exe5dddd.exehbnbhn.exe3djdd.exe7bnhbb.exexfxfxlf.exetnbtht.exedppjd.exefrlrllx.exethntnb.exejdpjp.exejjvvd.exelfrrffr.exerlxrrrr.exexxllxlf.exebbtnhh.exedvdjj.exebthbbt.exettbttb.exe1jddj.exepdvpp.exexrxxxxx.exepvvvp.exepdjvv.exelxffrrx.exehhtttb.exe1vvdp.exejjvvv.exelfrlxrl.exethtbtt.exevpppp.exexrxrrrx.exenhhhhh.exenbnhhn.exellxrfxl.exefxfffff.exehtbbtb.exevjddv.exefxfxlfx.exexfllllr.exetbhhbb.exevpdvv.exeffffxfl.exebbntnh.exepjpjd.exevvpjv.exellrllrr.exetnnnnh.exejdjdv.exevjjjj.exelflxrrl.exebtbtnn.exepid process 4900 9ffrlrr.exe 3432 bttttb.exe 756 nbnhbt.exe 4184 jpvpj.exe 2856 vpdvp.exe 3652 tnbtnn.exe 4168 thbnhh.exe 2652 ddvpj.exe 1872 dppjj.exe 3268 fxfxxxr.exe 4840 hbbthh.exe 2148 jjvpj.exe 4620 tttnhh.exe 644 5dddd.exe 5104 hbnbhn.exe 2824 3djdd.exe 4856 7bnhbb.exe 4148 xfxfxlf.exe 880 tnbtht.exe 2428 dppjd.exe 4556 frlrllx.exe 2080 thntnb.exe 2216 jdpjp.exe 3228 jjvvd.exe 216 lfrrffr.exe 2820 rlxrrrr.exe 1012 xxllxlf.exe 4692 bbtnhh.exe 2156 dvdjj.exe 3472 bthbbt.exe 4504 ttbttb.exe 412 1jddj.exe 4896 pdvpp.exe 1192 xrxxxxx.exe 2688 pvvvp.exe 2896 pdjvv.exe 1604 lxffrrx.exe 1944 hhtttb.exe 1688 1vvdp.exe 4744 jjvvv.exe 1084 lfrlxrl.exe 1732 thtbtt.exe 4612 vpppp.exe 2972 xrxrrrx.exe 4552 nhhhhh.exe 1336 nbnhhn.exe 1848 llxrfxl.exe 3432 fxfffff.exe 4468 htbbtb.exe 3040 vjddv.exe 2228 fxfxlfx.exe 972 xfllllr.exe 1620 tbhhbb.exe 5016 vpdvv.exe 4460 ffffxfl.exe 3496 bbntnh.exe 4780 pjpjd.exe 3612 vvpjv.exe 1916 llrllrr.exe 3088 tnnnnh.exe 1360 jdjdv.exe 1288 vjjjj.exe 5104 lflxrrl.exe 2824 btbtnn.exe -
Processes:
resource yara_rule behavioral2/memory/3420-0-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\9ffrlrr.exe upx behavioral2/memory/3420-5-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4900-8-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\bttttb.exe upx behavioral2/memory/3432-14-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\nbnhbt.exe upx C:\jpvpj.exe upx behavioral2/memory/756-24-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\vpdvp.exe upx behavioral2/memory/2856-31-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\tnbtnn.exe upx behavioral2/memory/3652-37-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\thbnhh.exe upx \??\c:\ddvpj.exe upx \??\c:\fxfxxxr.exe upx \??\c:\hbbthh.exe upx behavioral2/memory/3268-66-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4840-65-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1872-61-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\dppjj.exe upx behavioral2/memory/2652-47-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4168-42-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\jjvpj.exe upx behavioral2/memory/2148-72-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\tttnhh.exe upx behavioral2/memory/4620-80-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2148-78-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\5dddd.exe upx C:\hbnbhn.exe upx behavioral2/memory/644-89-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\3djdd.exe upx behavioral2/memory/5104-95-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\7bnhbb.exe upx behavioral2/memory/2824-101-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\xfxfxlf.exe upx behavioral2/memory/4148-109-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4856-107-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\tnbtht.exe upx behavioral2/memory/4148-115-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\dppjd.exe upx \??\c:\frlrllx.exe upx behavioral2/memory/2428-126-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\thntnb.exe upx behavioral2/memory/4556-132-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\jdpjp.exe upx behavioral2/memory/2216-138-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\jjvvd.exe upx C:\lfrrffr.exe upx behavioral2/memory/216-149-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\rlxrrrr.exe upx behavioral2/memory/3228-152-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2820-157-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\xxllxlf.exe upx C:\bbtnhh.exe upx behavioral2/memory/1012-166-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\dvdjj.exe upx C:\bthbbt.exe upx C:\ttbttb.exe upx behavioral2/memory/3472-183-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\1jddj.exe upx behavioral2/memory/4504-189-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2688-200-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2896-203-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
583f4b6f5c6a5efc1d5286617a548020_NeikiAnalytics.exe9ffrlrr.exebttttb.exenbnhbt.exejpvpj.exevpdvp.exetnbtnn.exethbnhh.exeddvpj.exedppjj.exefxfxxxr.exehbbthh.exejjvpj.exetttnhh.exe5dddd.exehbnbhn.exe3djdd.exe7bnhbb.exexfxfxlf.exetnbtht.exedppjd.exefrlrllx.exedescription pid process target process PID 3420 wrote to memory of 4900 3420 583f4b6f5c6a5efc1d5286617a548020_NeikiAnalytics.exe 9ffrlrr.exe PID 3420 wrote to memory of 4900 3420 583f4b6f5c6a5efc1d5286617a548020_NeikiAnalytics.exe 9ffrlrr.exe PID 3420 wrote to memory of 4900 3420 583f4b6f5c6a5efc1d5286617a548020_NeikiAnalytics.exe 9ffrlrr.exe PID 4900 wrote to memory of 3432 4900 9ffrlrr.exe bttttb.exe PID 4900 wrote to memory of 3432 4900 9ffrlrr.exe bttttb.exe PID 4900 wrote to memory of 3432 4900 9ffrlrr.exe bttttb.exe PID 3432 wrote to memory of 756 3432 bttttb.exe nbnhbt.exe PID 3432 wrote to memory of 756 3432 bttttb.exe nbnhbt.exe PID 3432 wrote to memory of 756 3432 bttttb.exe nbnhbt.exe PID 756 wrote to memory of 4184 756 nbnhbt.exe jpvpj.exe PID 756 wrote to memory of 4184 756 nbnhbt.exe jpvpj.exe PID 756 wrote to memory of 4184 756 nbnhbt.exe jpvpj.exe PID 4184 wrote to memory of 2856 4184 jpvpj.exe vpdvp.exe PID 4184 wrote to memory of 2856 4184 jpvpj.exe vpdvp.exe PID 4184 wrote to memory of 2856 4184 jpvpj.exe vpdvp.exe PID 2856 wrote to memory of 3652 2856 vpdvp.exe tnbtnn.exe PID 2856 wrote to memory of 3652 2856 vpdvp.exe tnbtnn.exe PID 2856 wrote to memory of 3652 2856 vpdvp.exe tnbtnn.exe PID 3652 wrote to memory of 4168 3652 tnbtnn.exe thbnhh.exe PID 3652 wrote to memory of 4168 3652 tnbtnn.exe thbnhh.exe PID 3652 wrote to memory of 4168 3652 tnbtnn.exe thbnhh.exe PID 4168 wrote to memory of 2652 4168 thbnhh.exe ddvpj.exe PID 4168 wrote to memory of 2652 4168 thbnhh.exe ddvpj.exe PID 4168 wrote to memory of 2652 4168 thbnhh.exe ddvpj.exe PID 2652 wrote to memory of 1872 2652 ddvpj.exe dppjj.exe PID 2652 wrote to memory of 1872 2652 ddvpj.exe dppjj.exe PID 2652 wrote to memory of 1872 2652 ddvpj.exe dppjj.exe PID 1872 wrote to memory of 3268 1872 dppjj.exe fxfxxxr.exe PID 1872 wrote to memory of 3268 1872 dppjj.exe fxfxxxr.exe PID 1872 wrote to memory of 3268 1872 dppjj.exe fxfxxxr.exe PID 3268 wrote to memory of 4840 3268 fxfxxxr.exe hbbthh.exe PID 3268 wrote to memory of 4840 3268 fxfxxxr.exe hbbthh.exe PID 3268 wrote to memory of 4840 3268 fxfxxxr.exe hbbthh.exe PID 4840 wrote to memory of 2148 4840 hbbthh.exe jjvpj.exe PID 4840 wrote to memory of 2148 4840 hbbthh.exe jjvpj.exe PID 4840 wrote to memory of 2148 4840 hbbthh.exe jjvpj.exe PID 2148 wrote to memory of 4620 2148 jjvpj.exe tttnhh.exe PID 2148 wrote to memory of 4620 2148 jjvpj.exe tttnhh.exe PID 2148 wrote to memory of 4620 2148 jjvpj.exe tttnhh.exe PID 4620 wrote to memory of 644 4620 tttnhh.exe 5dddd.exe PID 4620 wrote to memory of 644 4620 tttnhh.exe 5dddd.exe PID 4620 wrote to memory of 644 4620 tttnhh.exe 5dddd.exe PID 644 wrote to memory of 5104 644 5dddd.exe hbnbhn.exe PID 644 wrote to memory of 5104 644 5dddd.exe hbnbhn.exe PID 644 wrote to memory of 5104 644 5dddd.exe hbnbhn.exe PID 5104 wrote to memory of 2824 5104 hbnbhn.exe 3djdd.exe PID 5104 wrote to memory of 2824 5104 hbnbhn.exe 3djdd.exe PID 5104 wrote to memory of 2824 5104 hbnbhn.exe 3djdd.exe PID 2824 wrote to memory of 4856 2824 3djdd.exe 7bnhbb.exe PID 2824 wrote to memory of 4856 2824 3djdd.exe 7bnhbb.exe PID 2824 wrote to memory of 4856 2824 3djdd.exe 7bnhbb.exe PID 4856 wrote to memory of 4148 4856 7bnhbb.exe xfxfxlf.exe PID 4856 wrote to memory of 4148 4856 7bnhbb.exe xfxfxlf.exe PID 4856 wrote to memory of 4148 4856 7bnhbb.exe xfxfxlf.exe PID 4148 wrote to memory of 880 4148 xfxfxlf.exe tnbtht.exe PID 4148 wrote to memory of 880 4148 xfxfxlf.exe tnbtht.exe PID 4148 wrote to memory of 880 4148 xfxfxlf.exe tnbtht.exe PID 880 wrote to memory of 2428 880 tnbtht.exe dppjd.exe PID 880 wrote to memory of 2428 880 tnbtht.exe dppjd.exe PID 880 wrote to memory of 2428 880 tnbtht.exe dppjd.exe PID 2428 wrote to memory of 4556 2428 dppjd.exe frlrllx.exe PID 2428 wrote to memory of 4556 2428 dppjd.exe frlrllx.exe PID 2428 wrote to memory of 4556 2428 dppjd.exe frlrllx.exe PID 4556 wrote to memory of 2080 4556 frlrllx.exe thntnb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\583f4b6f5c6a5efc1d5286617a548020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\583f4b6f5c6a5efc1d5286617a548020_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\9ffrlrr.exec:\9ffrlrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\bttttb.exec:\bttttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\nbnhbt.exec:\nbnhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\jpvpj.exec:\jpvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\vpdvp.exec:\vpdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\tnbtnn.exec:\tnbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\thbnhh.exec:\thbnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\ddvpj.exec:\ddvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\dppjj.exec:\dppjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\hbbthh.exec:\hbbthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\jjvpj.exec:\jjvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\tttnhh.exec:\tttnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\5dddd.exec:\5dddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\hbnbhn.exec:\hbnbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\3djdd.exec:\3djdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\7bnhbb.exec:\7bnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\xfxfxlf.exec:\xfxfxlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\tnbtht.exec:\tnbtht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\dppjd.exec:\dppjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\frlrllx.exec:\frlrllx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\thntnb.exec:\thntnb.exe23⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jdpjp.exec:\jdpjp.exe24⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jjvvd.exec:\jjvvd.exe25⤵
- Executes dropped EXE
PID:3228 -
\??\c:\lfrrffr.exec:\lfrrffr.exe26⤵
- Executes dropped EXE
PID:216 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe27⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xxllxlf.exec:\xxllxlf.exe28⤵
- Executes dropped EXE
PID:1012 -
\??\c:\bbtnhh.exec:\bbtnhh.exe29⤵
- Executes dropped EXE
PID:4692 -
\??\c:\dvdjj.exec:\dvdjj.exe30⤵
- Executes dropped EXE
PID:2156 -
\??\c:\bthbbt.exec:\bthbbt.exe31⤵
- Executes dropped EXE
PID:3472 -
\??\c:\ttbttb.exec:\ttbttb.exe32⤵
- Executes dropped EXE
PID:4504 -
\??\c:\1jddj.exec:\1jddj.exe33⤵
- Executes dropped EXE
PID:412 -
\??\c:\pdvpp.exec:\pdvpp.exe34⤵
- Executes dropped EXE
PID:4896 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe35⤵
- Executes dropped EXE
PID:1192 -
\??\c:\pvvvp.exec:\pvvvp.exe36⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pdjvv.exec:\pdjvv.exe37⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lxffrrx.exec:\lxffrrx.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hhtttb.exec:\hhtttb.exe39⤵
- Executes dropped EXE
PID:1944 -
\??\c:\1vvdp.exec:\1vvdp.exe40⤵
- Executes dropped EXE
PID:1688 -
\??\c:\jjvvv.exec:\jjvvv.exe41⤵
- Executes dropped EXE
PID:4744 -
\??\c:\lfrlxrl.exec:\lfrlxrl.exe42⤵
- Executes dropped EXE
PID:1084 -
\??\c:\thtbtt.exec:\thtbtt.exe43⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vpppp.exec:\vpppp.exe44⤵
- Executes dropped EXE
PID:4612 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe45⤵
- Executes dropped EXE
PID:2972 -
\??\c:\nhhhhh.exec:\nhhhhh.exe46⤵
- Executes dropped EXE
PID:4552 -
\??\c:\nbnhhn.exec:\nbnhhn.exe47⤵
- Executes dropped EXE
PID:1336 -
\??\c:\llxrfxl.exec:\llxrfxl.exe48⤵
- Executes dropped EXE
PID:1848 -
\??\c:\fxfffff.exec:\fxfffff.exe49⤵
- Executes dropped EXE
PID:3432 -
\??\c:\htbbtb.exec:\htbbtb.exe50⤵
- Executes dropped EXE
PID:4468 -
\??\c:\vjddv.exec:\vjddv.exe51⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fxfxlfx.exec:\fxfxlfx.exe52⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xfllllr.exec:\xfllllr.exe53⤵
- Executes dropped EXE
PID:972 -
\??\c:\tbhhbb.exec:\tbhhbb.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vpdvv.exec:\vpdvv.exe55⤵
- Executes dropped EXE
PID:5016 -
\??\c:\ffffxfl.exec:\ffffxfl.exe56⤵
- Executes dropped EXE
PID:4460 -
\??\c:\bbntnh.exec:\bbntnh.exe57⤵
- Executes dropped EXE
PID:3496 -
\??\c:\pjpjd.exec:\pjpjd.exe58⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vvpjv.exec:\vvpjv.exe59⤵
- Executes dropped EXE
PID:3612 -
\??\c:\llrllrr.exec:\llrllrr.exe60⤵
- Executes dropped EXE
PID:1916 -
\??\c:\tnnnnh.exec:\tnnnnh.exe61⤵
- Executes dropped EXE
PID:3088 -
\??\c:\jdjdv.exec:\jdjdv.exe62⤵
- Executes dropped EXE
PID:1360 -
\??\c:\vjjjj.exec:\vjjjj.exe63⤵
- Executes dropped EXE
PID:1288 -
\??\c:\lflxrrl.exec:\lflxrrl.exe64⤵
- Executes dropped EXE
PID:5104 -
\??\c:\btbtnn.exec:\btbtnn.exe65⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9jpjj.exec:\9jpjj.exe66⤵PID:4436
-
\??\c:\hnhhtb.exec:\hnhhtb.exe67⤵PID:2552
-
\??\c:\dvpjj.exec:\dvpjj.exe68⤵PID:2520
-
\??\c:\xxfxxff.exec:\xxfxxff.exe69⤵PID:4880
-
\??\c:\tbnhhn.exec:\tbnhhn.exe70⤵PID:800
-
\??\c:\tnthtb.exec:\tnthtb.exe71⤵PID:2424
-
\??\c:\1vjjj.exec:\1vjjj.exe72⤵PID:3936
-
\??\c:\frrlfxx.exec:\frrlfxx.exe73⤵PID:2080
-
\??\c:\thnhnh.exec:\thnhnh.exe74⤵PID:4784
-
\??\c:\thbtnn.exec:\thbtnn.exe75⤵PID:340
-
\??\c:\dddvv.exec:\dddvv.exe76⤵PID:224
-
\??\c:\vvdvp.exec:\vvdvp.exe77⤵PID:1576
-
\??\c:\lxrfxlf.exec:\lxrfxlf.exe78⤵PID:632
-
\??\c:\1vdjd.exec:\1vdjd.exe79⤵PID:1188
-
\??\c:\fxrfffx.exec:\fxrfffx.exe80⤵PID:1012
-
\??\c:\7xlfxxf.exec:\7xlfxxf.exe81⤵PID:1456
-
\??\c:\nbnhbb.exec:\nbnhbb.exe82⤵PID:3364
-
\??\c:\vppjv.exec:\vppjv.exe83⤵PID:2156
-
\??\c:\9fllxxx.exec:\9fllxxx.exe84⤵PID:3592
-
\??\c:\hhnhht.exec:\hhnhht.exe85⤵PID:4044
-
\??\c:\ttttnt.exec:\ttttnt.exe86⤵PID:4588
-
\??\c:\vpdvp.exec:\vpdvp.exe87⤵PID:1192
-
\??\c:\fllxfxx.exec:\fllxfxx.exe88⤵PID:4140
-
\??\c:\5ntnhn.exec:\5ntnhn.exe89⤵PID:4444
-
\??\c:\ththtn.exec:\ththtn.exe90⤵PID:2568
-
\??\c:\pjjpp.exec:\pjjpp.exe91⤵PID:1876
-
\??\c:\frrlfff.exec:\frrlfff.exe92⤵PID:3260
-
\??\c:\hnbhbh.exec:\hnbhbh.exe93⤵PID:3424
-
\??\c:\5ntttb.exec:\5ntttb.exe94⤵PID:4420
-
\??\c:\ppdpp.exec:\ppdpp.exe95⤵PID:3420
-
\??\c:\9fflfff.exec:\9fflfff.exe96⤵PID:4552
-
\??\c:\hnttbb.exec:\hnttbb.exe97⤵PID:2512
-
\??\c:\thhbtb.exec:\thhbtb.exe98⤵PID:4536
-
\??\c:\jvpdd.exec:\jvpdd.exe99⤵PID:3464
-
\??\c:\xffxlll.exec:\xffxlll.exe100⤵PID:2076
-
\??\c:\hhbbbb.exec:\hhbbbb.exe101⤵PID:4284
-
\??\c:\5btttt.exec:\5btttt.exe102⤵PID:1800
-
\??\c:\vjdpp.exec:\vjdpp.exe103⤵PID:1620
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe104⤵PID:4532
-
\??\c:\5rfffff.exec:\5rfffff.exe105⤵PID:3060
-
\??\c:\ntnnbt.exec:\ntnnbt.exe106⤵PID:400
-
\??\c:\ddjjd.exec:\ddjjd.exe107⤵PID:2128
-
\??\c:\7xxxxxx.exec:\7xxxxxx.exe108⤵PID:2384
-
\??\c:\lffxffx.exec:\lffxffx.exe109⤵PID:2256
-
\??\c:\hbtnnn.exec:\hbtnnn.exe110⤵PID:4672
-
\??\c:\jjvpj.exec:\jjvpj.exe111⤵PID:3600
-
\??\c:\ffxrrxx.exec:\ffxrrxx.exe112⤵PID:1752
-
\??\c:\rrlllll.exec:\rrlllll.exe113⤵PID:1952
-
\??\c:\pdppp.exec:\pdppp.exe114⤵PID:2824
-
\??\c:\nhtnnh.exec:\nhtnnh.exe115⤵PID:3896
-
\??\c:\ddppp.exec:\ddppp.exe116⤵PID:2816
-
\??\c:\rlxrfff.exec:\rlxrfff.exe117⤵PID:2520
-
\??\c:\9htnbb.exec:\9htnbb.exe118⤵PID:4880
-
\??\c:\djppp.exec:\djppp.exe119⤵PID:4724
-
\??\c:\1dvpp.exec:\1dvpp.exe120⤵PID:2548
-
\??\c:\bbbthn.exec:\bbbthn.exe121⤵PID:4208
-
\??\c:\tttnhh.exec:\tttnhh.exe122⤵PID:3256
-
\??\c:\rxflfff.exec:\rxflfff.exe123⤵PID:208
-
\??\c:\bnnbht.exec:\bnnbht.exe124⤵PID:3976
-
\??\c:\7hbbth.exec:\7hbbth.exe125⤵PID:3544
-
\??\c:\jjjdd.exec:\jjjdd.exe126⤵PID:2440
-
\??\c:\9ddjj.exec:\9ddjj.exe127⤵PID:1708
-
\??\c:\fxllllr.exec:\fxllllr.exe128⤵PID:3320
-
\??\c:\3lrlflx.exec:\3lrlflx.exe129⤵PID:4968
-
\??\c:\7nhnnn.exec:\7nhnnn.exe130⤵PID:452
-
\??\c:\pvpdd.exec:\pvpdd.exe131⤵PID:1240
-
\??\c:\fxrrlrl.exec:\fxrrlrl.exe132⤵PID:3096
-
\??\c:\tnbttt.exec:\tnbttt.exe133⤵PID:5000
-
\??\c:\hhnhbb.exec:\hhnhbb.exe134⤵PID:4912
-
\??\c:\dvdvv.exec:\dvdvv.exe135⤵PID:4892
-
\??\c:\rlffffx.exec:\rlffffx.exe136⤵PID:4580
-
\??\c:\nnntnn.exec:\nnntnn.exe137⤵PID:4036
-
\??\c:\hhhbnh.exec:\hhhbnh.exe138⤵PID:4440
-
\??\c:\dppvp.exec:\dppvp.exe139⤵PID:1732
-
\??\c:\fxxrffr.exec:\fxxrffr.exe140⤵PID:1344
-
\??\c:\btbnnt.exec:\btbnnt.exe141⤵PID:444
-
\??\c:\hthbtt.exec:\hthbtt.exe142⤵PID:5056
-
\??\c:\jvppj.exec:\jvppj.exe143⤵PID:1336
-
\??\c:\dpvpd.exec:\dpvpd.exe144⤵PID:756
-
\??\c:\rlfxxrl.exec:\rlfxxrl.exe145⤵PID:1784
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe146⤵PID:3464
-
\??\c:\tthhnh.exec:\tthhnh.exe147⤵PID:2076
-
\??\c:\dvddp.exec:\dvddp.exe148⤵PID:4284
-
\??\c:\5vvvv.exec:\5vvvv.exe149⤵PID:1800
-
\??\c:\lflfllf.exec:\lflfllf.exe150⤵PID:4952
-
\??\c:\hbtttb.exec:\hbtttb.exe151⤵PID:1716
-
\??\c:\vppjj.exec:\vppjj.exe152⤵PID:4676
-
\??\c:\jdppv.exec:\jdppv.exe153⤵PID:1596
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe154⤵PID:4620
-
\??\c:\ffxxlll.exec:\ffxxlll.exe155⤵PID:2376
-
\??\c:\9ttnhh.exec:\9ttnhh.exe156⤵PID:840
-
\??\c:\jvjdv.exec:\jvjdv.exe157⤵PID:1288
-
\??\c:\ddddd.exec:\ddddd.exe158⤵PID:5104
-
\??\c:\1rxxrxx.exec:\1rxxrxx.exe159⤵PID:4632
-
\??\c:\rlffxlx.exec:\rlffxlx.exe160⤵PID:4708
-
\??\c:\9nhbtb.exec:\9nhbtb.exe161⤵PID:2552
-
\??\c:\jdvvp.exec:\jdvvp.exe162⤵PID:2428
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe163⤵PID:2628
-
\??\c:\llllrlf.exec:\llllrlf.exe164⤵PID:1348
-
\??\c:\nhbtnn.exec:\nhbtnn.exe165⤵PID:4928
-
\??\c:\9ntbnn.exec:\9ntbnn.exe166⤵PID:2080
-
\??\c:\jdvjd.exec:\jdvjd.exe167⤵PID:5080
-
\??\c:\3lrlxxx.exec:\3lrlxxx.exe168⤵PID:340
-
\??\c:\tnnnhn.exec:\tnnnhn.exe169⤵PID:372
-
\??\c:\vpvjd.exec:\vpvjd.exe170⤵PID:1576
-
\??\c:\pjvpd.exec:\pjvpd.exe171⤵PID:1996
-
\??\c:\xlfllxx.exec:\xlfllxx.exe172⤵PID:1708
-
\??\c:\thbbtn.exec:\thbbtn.exe173⤵PID:3296
-
\??\c:\vvdpd.exec:\vvdpd.exe174⤵PID:452
-
\??\c:\xxfrlxf.exec:\xxfrlxf.exe175⤵PID:1240
-
\??\c:\btnntn.exec:\btnntn.exe176⤵PID:3096
-
\??\c:\vdjdd.exec:\vdjdd.exe177⤵PID:1860
-
\??\c:\rxxrfxf.exec:\rxxrfxf.exe178⤵PID:912
-
\??\c:\5bhbbn.exec:\5bhbbn.exe179⤵PID:4140
-
\??\c:\vppjd.exec:\vppjd.exe180⤵PID:3956
-
\??\c:\xxlxxxx.exec:\xxlxxxx.exe181⤵PID:2572
-
\??\c:\ttnnnn.exec:\ttnnnn.exe182⤵PID:4440
-
\??\c:\tntttb.exec:\tntttb.exe183⤵PID:1732
-
\??\c:\pvvdv.exec:\pvvdv.exe184⤵PID:1344
-
\??\c:\rllfxxr.exec:\rllfxxr.exe185⤵PID:444
-
\??\c:\5fxlllr.exec:\5fxlllr.exe186⤵PID:4348
-
\??\c:\thtnht.exec:\thtnht.exe187⤵PID:2144
-
\??\c:\vpdvp.exec:\vpdvp.exe188⤵PID:3636
-
\??\c:\jjvdd.exec:\jjvdd.exe189⤵PID:4468
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe190⤵PID:1252
-
\??\c:\nhhtnn.exec:\nhhtnn.exe191⤵PID:3464
-
\??\c:\dvppv.exec:\dvppv.exe192⤵PID:2076
-
\??\c:\rxxffrr.exec:\rxxffrr.exe193⤵PID:2804
-
\??\c:\hbnnhh.exec:\hbnnhh.exe194⤵PID:4460
-
\??\c:\nbntnn.exec:\nbntnn.exe195⤵PID:2004
-
\??\c:\pjvvd.exec:\pjvvd.exe196⤵PID:1716
-
\??\c:\5jjdv.exec:\5jjdv.exe197⤵PID:4676
-
\??\c:\xllfxxx.exec:\xllfxxx.exe198⤵PID:1360
-
\??\c:\bttnhh.exec:\bttnhh.exe199⤵PID:2540
-
\??\c:\tntttt.exec:\tntttt.exe200⤵PID:4232
-
\??\c:\jdppd.exec:\jdppd.exe201⤵PID:840
-
\??\c:\pjpjj.exec:\pjpjj.exe202⤵PID:4436
-
\??\c:\lxfffff.exec:\lxfffff.exe203⤵PID:924
-
\??\c:\bnttnn.exec:\bnttnn.exe204⤵PID:2404
-
\??\c:\vvjdp.exec:\vvjdp.exe205⤵PID:2920
-
\??\c:\9pdvp.exec:\9pdvp.exe206⤵PID:5060
-
\??\c:\rrlfxfx.exec:\rrlfxfx.exe207⤵PID:4716
-
\??\c:\rrxfxxr.exec:\rrxfxxr.exe208⤵PID:1832
-
\??\c:\tnhbbh.exec:\tnhbbh.exe209⤵PID:752
-
\??\c:\dppjj.exec:\dppjj.exe210⤵PID:2216
-
\??\c:\pjpjd.exec:\pjpjd.exe211⤵PID:208
-
\??\c:\fxrxxll.exec:\fxrxxll.exe212⤵PID:3228
-
\??\c:\hbbtbb.exec:\hbbtbb.exe213⤵PID:2620
-
\??\c:\pjdvj.exec:\pjdvj.exe214⤵PID:2936
-
\??\c:\fllrllf.exec:\fllrllf.exe215⤵PID:4692
-
\??\c:\3rxxfll.exec:\3rxxfll.exe216⤵PID:1708
-
\??\c:\hthhhh.exec:\hthhhh.exe217⤵PID:3296
-
\??\c:\btnhnh.exec:\btnhnh.exe218⤵PID:452
-
\??\c:\pvvvv.exec:\pvvvv.exe219⤵PID:3272
-
\??\c:\3jpjp.exec:\3jpjp.exe220⤵PID:3096
-
\??\c:\lrxrllf.exec:\lrxrllf.exe221⤵PID:4892
-
\??\c:\nhtnnn.exec:\nhtnnn.exe222⤵PID:912
-
\??\c:\1hnhbt.exec:\1hnhbt.exe223⤵PID:3736
-
\??\c:\pjvvp.exec:\pjvvp.exe224⤵PID:1840
-
\??\c:\lxxrllf.exec:\lxxrllf.exe225⤵PID:2576
-
\??\c:\9rfxxff.exec:\9rfxxff.exe226⤵PID:4428
-
\??\c:\tnnnnb.exec:\tnnnnb.exe227⤵PID:1228
-
\??\c:\btbbth.exec:\btbbth.exe228⤵PID:3420
-
\??\c:\jpvjd.exec:\jpvjd.exe229⤵PID:3212
-
\??\c:\rrlllll.exec:\rrlllll.exe230⤵PID:3008
-
\??\c:\lfrlrrr.exec:\lfrlrrr.exe231⤵PID:1848
-
\??\c:\tntnnn.exec:\tntnnn.exe232⤵PID:3636
-
\??\c:\ddpjd.exec:\ddpjd.exe233⤵PID:4644
-
\??\c:\jjdvp.exec:\jjdvp.exe234⤵PID:2856
-
\??\c:\5xxrlll.exec:\5xxrlll.exe235⤵PID:3464
-
\??\c:\lrxffxr.exec:\lrxffxr.exe236⤵PID:3268
-
\??\c:\3tbhbb.exec:\3tbhbb.exe237⤵PID:1872
-
\??\c:\nnnnhb.exec:\nnnnhb.exe238⤵PID:4532
-
\??\c:\7pppj.exec:\7pppj.exe239⤵PID:3060
-
\??\c:\1rrrlll.exec:\1rrrlll.exe240⤵PID:3932
-
\??\c:\ttbnnn.exec:\ttbnnn.exe241⤵PID:2128
-
\??\c:\7jpjp.exec:\7jpjp.exe242⤵PID:400