Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe
-
Size
521KB
-
MD5
56df2e044cc2e01894199443044c9490
-
SHA1
033d2bbdbc4fe319f3cb87042726ece1dcd5f196
-
SHA256
9d77713254e1473c16179cfdb012389040c480bc4de074b36dd5df0daf59d252
-
SHA512
d3cd535300fe1d0dc32601e7db0c774ebd1c2425e32ff84aca79d21c941c9d653840ced88eaf4a01b0b19cbdcbceef374958537ed1655f69479cac99e64cb1be
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H3v:q7Tc2NYHUrAwfMHNnpls489/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4728-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-1108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-1242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-1525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-1655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jpvdd.exelllrxff.exejvjjj.exe1vjdp.exe1tttnt.exerlfxffl.exennttnn.exepdjvv.exehntbbt.exelrlfxxl.exetnnttn.exenntnhh.exejvvpj.exefrrrllf.exethnhbb.exevvddj.exellxfrrr.exepdjvp.exebtnhhh.exe1djvd.exebbbhbh.exejdjdd.exe1vjdd.exe7ddvj.exe1xfxrxr.exehthbtn.exepjddv.exe3frlxxx.exevpdvv.exenhhbbt.exevpjpd.exe7xxrrll.exe5ntnhn.exeddpjp.exerllfxrr.exe9hntnh.exe5dvjp.exe7rrlffx.exebttthb.exejjdvv.exevvjjp.exe9ffxrrl.exeddpdv.exethtttt.exevdjdj.exerxxxrrr.exehbhbhh.exepvjdv.exexlrllll.exehhtbhh.exejjddd.exelxffxxx.exenhnbbh.exepvddv.exexlxrlxx.exebtbttt.exedjpjj.exeddppv.exerfxfxrf.exehhtnhh.exeppvpv.exerxlfrxr.exehhtnhn.exevddjd.exepid process 3508 jpvdd.exe 4692 lllrxff.exe 4488 jvjjj.exe 2480 1vjdp.exe 4228 1tttnt.exe 800 rlfxffl.exe 2960 nnttnn.exe 1928 pdjvv.exe 3732 hntbbt.exe 3836 lrlfxxl.exe 1808 tnnttn.exe 4680 nntnhh.exe 2756 jvvpj.exe 1020 frrrllf.exe 4424 thnhbb.exe 4904 vvddj.exe 2980 llxfrrr.exe 3080 pdjvp.exe 5072 btnhhh.exe 3708 1djvd.exe 1628 bbbhbh.exe 4052 jdjdd.exe 1268 1vjdd.exe 684 7ddvj.exe 4168 1xfxrxr.exe 712 hthbtn.exe 3304 pjddv.exe 2216 3frlxxx.exe 3832 vpdvv.exe 448 nhhbbt.exe 3584 vpjpd.exe 652 7xxrrll.exe 2016 5ntnhn.exe 4896 ddpjp.exe 1448 rllfxrr.exe 4600 9hntnh.exe 2768 5dvjp.exe 4564 7rrlffx.exe 2484 bttthb.exe 4484 jjdvv.exe 756 vvjjp.exe 4692 9ffxrrl.exe 4488 ddpdv.exe 3176 thtttt.exe 3000 vdjdj.exe 3724 rxxxrrr.exe 800 hbhbhh.exe 4676 pvjdv.exe 464 xlrllll.exe 3924 hhtbhh.exe 3732 jjddd.exe 532 lxffxxx.exe 2684 nhnbbh.exe 3884 pvddv.exe 668 xlxrlxx.exe 3648 btbttt.exe 2120 djpjj.exe 3536 ddppv.exe 1052 rfxfxrf.exe 4876 hhtnhh.exe 2980 ppvpv.exe 2088 rxlfrxr.exe 4700 hhtnhn.exe 2328 vddjd.exe -
Processes:
resource yara_rule behavioral2/memory/4728-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/800-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-654-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
56df2e044cc2e01894199443044c9490_NeikiAnalytics.exejpvdd.exelllrxff.exejvjjj.exe1vjdp.exe1tttnt.exerlfxffl.exennttnn.exepdjvv.exehntbbt.exelrlfxxl.exetnnttn.exenntnhh.exejvvpj.exefrrrllf.exethnhbb.exevvddj.exellxfrrr.exepdjvp.exebtnhhh.exe1djvd.exebbbhbh.exedescription pid process target process PID 4728 wrote to memory of 3508 4728 56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe jpvdd.exe PID 4728 wrote to memory of 3508 4728 56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe jpvdd.exe PID 4728 wrote to memory of 3508 4728 56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe jpvdd.exe PID 3508 wrote to memory of 4692 3508 jpvdd.exe lllrxff.exe PID 3508 wrote to memory of 4692 3508 jpvdd.exe lllrxff.exe PID 3508 wrote to memory of 4692 3508 jpvdd.exe lllrxff.exe PID 4692 wrote to memory of 4488 4692 lllrxff.exe jvjjj.exe PID 4692 wrote to memory of 4488 4692 lllrxff.exe jvjjj.exe PID 4692 wrote to memory of 4488 4692 lllrxff.exe jvjjj.exe PID 4488 wrote to memory of 2480 4488 jvjjj.exe 1vjdp.exe PID 4488 wrote to memory of 2480 4488 jvjjj.exe 1vjdp.exe PID 4488 wrote to memory of 2480 4488 jvjjj.exe 1vjdp.exe PID 2480 wrote to memory of 4228 2480 1vjdp.exe 1tttnt.exe PID 2480 wrote to memory of 4228 2480 1vjdp.exe 1tttnt.exe PID 2480 wrote to memory of 4228 2480 1vjdp.exe 1tttnt.exe PID 4228 wrote to memory of 800 4228 1tttnt.exe rlfxffl.exe PID 4228 wrote to memory of 800 4228 1tttnt.exe rlfxffl.exe PID 4228 wrote to memory of 800 4228 1tttnt.exe rlfxffl.exe PID 800 wrote to memory of 2960 800 rlfxffl.exe nnttnn.exe PID 800 wrote to memory of 2960 800 rlfxffl.exe nnttnn.exe PID 800 wrote to memory of 2960 800 rlfxffl.exe nnttnn.exe PID 2960 wrote to memory of 1928 2960 nnttnn.exe pdjvv.exe PID 2960 wrote to memory of 1928 2960 nnttnn.exe pdjvv.exe PID 2960 wrote to memory of 1928 2960 nnttnn.exe pdjvv.exe PID 1928 wrote to memory of 3732 1928 pdjvv.exe hntbbt.exe PID 1928 wrote to memory of 3732 1928 pdjvv.exe hntbbt.exe PID 1928 wrote to memory of 3732 1928 pdjvv.exe hntbbt.exe PID 3732 wrote to memory of 3836 3732 hntbbt.exe lrlfxxl.exe PID 3732 wrote to memory of 3836 3732 hntbbt.exe lrlfxxl.exe PID 3732 wrote to memory of 3836 3732 hntbbt.exe lrlfxxl.exe PID 3836 wrote to memory of 1808 3836 lrlfxxl.exe tnnttn.exe PID 3836 wrote to memory of 1808 3836 lrlfxxl.exe tnnttn.exe PID 3836 wrote to memory of 1808 3836 lrlfxxl.exe tnnttn.exe PID 1808 wrote to memory of 4680 1808 tnnttn.exe nntnhh.exe PID 1808 wrote to memory of 4680 1808 tnnttn.exe nntnhh.exe PID 1808 wrote to memory of 4680 1808 tnnttn.exe nntnhh.exe PID 4680 wrote to memory of 2756 4680 nntnhh.exe jvvpj.exe PID 4680 wrote to memory of 2756 4680 nntnhh.exe jvvpj.exe PID 4680 wrote to memory of 2756 4680 nntnhh.exe jvvpj.exe PID 2756 wrote to memory of 1020 2756 jvvpj.exe frrrllf.exe PID 2756 wrote to memory of 1020 2756 jvvpj.exe frrrllf.exe PID 2756 wrote to memory of 1020 2756 jvvpj.exe frrrllf.exe PID 1020 wrote to memory of 4424 1020 frrrllf.exe thnhbb.exe PID 1020 wrote to memory of 4424 1020 frrrllf.exe thnhbb.exe PID 1020 wrote to memory of 4424 1020 frrrllf.exe thnhbb.exe PID 4424 wrote to memory of 4904 4424 thnhbb.exe vvddj.exe PID 4424 wrote to memory of 4904 4424 thnhbb.exe vvddj.exe PID 4424 wrote to memory of 4904 4424 thnhbb.exe vvddj.exe PID 4904 wrote to memory of 2980 4904 vvddj.exe llxfrrr.exe PID 4904 wrote to memory of 2980 4904 vvddj.exe llxfrrr.exe PID 4904 wrote to memory of 2980 4904 vvddj.exe llxfrrr.exe PID 2980 wrote to memory of 3080 2980 llxfrrr.exe pdjvp.exe PID 2980 wrote to memory of 3080 2980 llxfrrr.exe pdjvp.exe PID 2980 wrote to memory of 3080 2980 llxfrrr.exe pdjvp.exe PID 3080 wrote to memory of 5072 3080 pdjvp.exe btnhhh.exe PID 3080 wrote to memory of 5072 3080 pdjvp.exe btnhhh.exe PID 3080 wrote to memory of 5072 3080 pdjvp.exe btnhhh.exe PID 5072 wrote to memory of 3708 5072 btnhhh.exe 1djvd.exe PID 5072 wrote to memory of 3708 5072 btnhhh.exe 1djvd.exe PID 5072 wrote to memory of 3708 5072 btnhhh.exe 1djvd.exe PID 3708 wrote to memory of 1628 3708 1djvd.exe bbbhbh.exe PID 3708 wrote to memory of 1628 3708 1djvd.exe bbbhbh.exe PID 3708 wrote to memory of 1628 3708 1djvd.exe bbbhbh.exe PID 1628 wrote to memory of 4052 1628 bbbhbh.exe jdjdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\jpvdd.exec:\jpvdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\lllrxff.exec:\lllrxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\jvjjj.exec:\jvjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\1vjdp.exec:\1vjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\1tttnt.exec:\1tttnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\rlfxffl.exec:\rlfxffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\nnttnn.exec:\nnttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\pdjvv.exec:\pdjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\hntbbt.exec:\hntbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\lrlfxxl.exec:\lrlfxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\tnnttn.exec:\tnnttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\nntnhh.exec:\nntnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\jvvpj.exec:\jvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\frrrllf.exec:\frrrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\thnhbb.exec:\thnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\vvddj.exec:\vvddj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\llxfrrr.exec:\llxfrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\pdjvp.exec:\pdjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\btnhhh.exec:\btnhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\1djvd.exec:\1djvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\bbbhbh.exec:\bbbhbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\jdjdd.exec:\jdjdd.exe23⤵
- Executes dropped EXE
PID:4052 -
\??\c:\1vjdd.exec:\1vjdd.exe24⤵
- Executes dropped EXE
PID:1268 -
\??\c:\7ddvj.exec:\7ddvj.exe25⤵
- Executes dropped EXE
PID:684 -
\??\c:\1xfxrxr.exec:\1xfxrxr.exe26⤵
- Executes dropped EXE
PID:4168 -
\??\c:\hthbtn.exec:\hthbtn.exe27⤵
- Executes dropped EXE
PID:712 -
\??\c:\pjddv.exec:\pjddv.exe28⤵
- Executes dropped EXE
PID:3304 -
\??\c:\3frlxxx.exec:\3frlxxx.exe29⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vpdvv.exec:\vpdvv.exe30⤵
- Executes dropped EXE
PID:3832 -
\??\c:\nhhbbt.exec:\nhhbbt.exe31⤵
- Executes dropped EXE
PID:448 -
\??\c:\vpjpd.exec:\vpjpd.exe32⤵
- Executes dropped EXE
PID:3584 -
\??\c:\7xxrrll.exec:\7xxrrll.exe33⤵
- Executes dropped EXE
PID:652 -
\??\c:\5ntnhn.exec:\5ntnhn.exe34⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ddpjp.exec:\ddpjp.exe35⤵
- Executes dropped EXE
PID:4896 -
\??\c:\rllfxrr.exec:\rllfxrr.exe36⤵
- Executes dropped EXE
PID:1448 -
\??\c:\9hntnh.exec:\9hntnh.exe37⤵
- Executes dropped EXE
PID:4600 -
\??\c:\5dvjp.exec:\5dvjp.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7rrlffx.exec:\7rrlffx.exe39⤵
- Executes dropped EXE
PID:4564 -
\??\c:\bttthb.exec:\bttthb.exe40⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jjdvv.exec:\jjdvv.exe41⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vvjjp.exec:\vvjjp.exe42⤵
- Executes dropped EXE
PID:756 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe43⤵
- Executes dropped EXE
PID:4692 -
\??\c:\ddpdv.exec:\ddpdv.exe44⤵
- Executes dropped EXE
PID:4488 -
\??\c:\thtttt.exec:\thtttt.exe45⤵
- Executes dropped EXE
PID:3176 -
\??\c:\vdjdj.exec:\vdjdj.exe46⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe47⤵
- Executes dropped EXE
PID:3724 -
\??\c:\hbhbhh.exec:\hbhbhh.exe48⤵
- Executes dropped EXE
PID:800 -
\??\c:\pvjdv.exec:\pvjdv.exe49⤵
- Executes dropped EXE
PID:4676 -
\??\c:\xlrllll.exec:\xlrllll.exe50⤵
- Executes dropped EXE
PID:464 -
\??\c:\hhtbhh.exec:\hhtbhh.exe51⤵
- Executes dropped EXE
PID:3924 -
\??\c:\jjddd.exec:\jjddd.exe52⤵
- Executes dropped EXE
PID:3732 -
\??\c:\lxffxxx.exec:\lxffxxx.exe53⤵
- Executes dropped EXE
PID:532 -
\??\c:\nhnbbh.exec:\nhnbbh.exe54⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pvddv.exec:\pvddv.exe55⤵
- Executes dropped EXE
PID:3884 -
\??\c:\xlxrlxx.exec:\xlxrlxx.exe56⤵
- Executes dropped EXE
PID:668 -
\??\c:\btbttt.exec:\btbttt.exe57⤵
- Executes dropped EXE
PID:3648 -
\??\c:\djpjj.exec:\djpjj.exe58⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ddppv.exec:\ddppv.exe59⤵
- Executes dropped EXE
PID:3536 -
\??\c:\rfxfxrf.exec:\rfxfxrf.exe60⤵
- Executes dropped EXE
PID:1052 -
\??\c:\hhtnhh.exec:\hhtnhh.exe61⤵
- Executes dropped EXE
PID:4876 -
\??\c:\ppvpv.exec:\ppvpv.exe62⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rxlfrxr.exec:\rxlfrxr.exe63⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hhtnhn.exec:\hhtnhn.exe64⤵
- Executes dropped EXE
PID:4700 -
\??\c:\vddjd.exec:\vddjd.exe65⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lrffxxr.exec:\lrffxxr.exe66⤵PID:1180
-
\??\c:\frrrlll.exec:\frrrlll.exe67⤵PID:3096
-
\??\c:\bnbttt.exec:\bnbttt.exe68⤵PID:2212
-
\??\c:\1dpjv.exec:\1dpjv.exe69⤵PID:1368
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe70⤵PID:1820
-
\??\c:\hnhhhh.exec:\hnhhhh.exe71⤵PID:4116
-
\??\c:\hntnnn.exec:\hntnnn.exe72⤵PID:2460
-
\??\c:\vpvpj.exec:\vpvpj.exe73⤵PID:2248
-
\??\c:\rrxlffx.exec:\rrxlffx.exe74⤵PID:1776
-
\??\c:\7bbtnh.exec:\7bbtnh.exe75⤵PID:2744
-
\??\c:\btbtnh.exec:\btbtnh.exe76⤵PID:4132
-
\??\c:\pvjdp.exec:\pvjdp.exe77⤵PID:2304
-
\??\c:\rlfrrrr.exec:\rlfrrrr.exe78⤵PID:4792
-
\??\c:\7nttnt.exec:\7nttnt.exe79⤵PID:2216
-
\??\c:\jpjjv.exec:\jpjjv.exe80⤵PID:2376
-
\??\c:\9xrlxxf.exec:\9xrlxxf.exe81⤵PID:448
-
\??\c:\rflxrfx.exec:\rflxrfx.exe82⤵PID:3676
-
\??\c:\tbbnnn.exec:\tbbnnn.exe83⤵PID:2016
-
\??\c:\ddjdp.exec:\ddjdp.exe84⤵PID:1584
-
\??\c:\9fxrllf.exec:\9fxrllf.exe85⤵PID:4088
-
\??\c:\bttnhb.exec:\bttnhb.exe86⤵PID:64
-
\??\c:\vvvvp.exec:\vvvvp.exe87⤵PID:2548
-
\??\c:\5fxlfxr.exec:\5fxlfxr.exe88⤵PID:2204
-
\??\c:\rfffxrf.exec:\rfffxrf.exe89⤵PID:4892
-
\??\c:\nhttnh.exec:\nhttnh.exe90⤵PID:4488
-
\??\c:\7vjvj.exec:\7vjvj.exe91⤵PID:1612
-
\??\c:\xffrlfx.exec:\xffrlfx.exe92⤵PID:2456
-
\??\c:\htnhtt.exec:\htnhtt.exe93⤵PID:4540
-
\??\c:\3bbnhn.exec:\3bbnhn.exe94⤵PID:3968
-
\??\c:\fxlrflx.exec:\fxlrflx.exe95⤵PID:3292
-
\??\c:\ppvpp.exec:\ppvpp.exe96⤵PID:4708
-
\??\c:\7nnbtn.exec:\7nnbtn.exe97⤵PID:2880
-
\??\c:\ttbttt.exec:\ttbttt.exe98⤵PID:4080
-
\??\c:\jvjdv.exec:\jvjdv.exe99⤵PID:4612
-
\??\c:\rfllrrx.exec:\rfllrrx.exe100⤵PID:3784
-
\??\c:\hhhbhn.exec:\hhhbhn.exe101⤵PID:2756
-
\??\c:\jdppp.exec:\jdppp.exe102⤵PID:4180
-
\??\c:\ffllflf.exec:\ffllflf.exe103⤵PID:1224
-
\??\c:\llrfrll.exec:\llrfrll.exe104⤵PID:3684
-
\??\c:\hnnhbb.exec:\hnnhbb.exe105⤵PID:2784
-
\??\c:\dpppj.exec:\dpppj.exe106⤵PID:4316
-
\??\c:\5flfffl.exec:\5flfffl.exe107⤵PID:2320
-
\??\c:\3tnhbt.exec:\3tnhbt.exe108⤵PID:2424
-
\??\c:\vddjj.exec:\vddjj.exe109⤵PID:4688
-
\??\c:\llxxllr.exec:\llxxllr.exe110⤵PID:848
-
\??\c:\hhbhbb.exec:\hhbhbb.exe111⤵PID:3944
-
\??\c:\vdddd.exec:\vdddd.exe112⤵PID:1896
-
\??\c:\rxrxxfr.exec:\rxrxxfr.exe113⤵PID:3588
-
\??\c:\btbnhn.exec:\btbnhn.exe114⤵PID:3400
-
\??\c:\9vdpj.exec:\9vdpj.exe115⤵PID:1368
-
\??\c:\xrlflfx.exec:\xrlflfx.exe116⤵PID:1820
-
\??\c:\bthhnt.exec:\bthhnt.exe117⤵PID:4788
-
\??\c:\jpjdv.exec:\jpjdv.exe118⤵PID:852
-
\??\c:\lflrrrr.exec:\lflrrrr.exe119⤵PID:4672
-
\??\c:\bbbtnh.exec:\bbbtnh.exe120⤵PID:4984
-
\??\c:\vjpjd.exec:\vjpjd.exe121⤵PID:712
-
\??\c:\7lfxrrf.exec:\7lfxrrf.exe122⤵PID:1108
-
\??\c:\hhbnht.exec:\hhbnht.exe123⤵PID:3528
-
\??\c:\7nbbbb.exec:\7nbbbb.exe124⤵PID:4632
-
\??\c:\1djjd.exec:\1djjd.exe125⤵PID:4136
-
\??\c:\llffxxr.exec:\llffxxr.exe126⤵PID:2376
-
\??\c:\bnhbtt.exec:\bnhbtt.exe127⤵PID:448
-
\??\c:\dvdvp.exec:\dvdvp.exe128⤵PID:3676
-
\??\c:\rllffff.exec:\rllffff.exe129⤵PID:4980
-
\??\c:\xrllrrf.exec:\xrllrrf.exe130⤵PID:4420
-
\??\c:\tbhbtt.exec:\tbhbtt.exe131⤵PID:4600
-
\??\c:\djdjp.exec:\djdjp.exe132⤵PID:5076
-
\??\c:\5lllfll.exec:\5lllfll.exe133⤵PID:2844
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe134⤵PID:4692
-
\??\c:\bntnnn.exec:\bntnnn.exe135⤵PID:2180
-
\??\c:\pjpjj.exec:\pjpjj.exe136⤵PID:3596
-
\??\c:\9lxrrxx.exec:\9lxrrxx.exe137⤵PID:4228
-
\??\c:\bntnnn.exec:\bntnnn.exe138⤵PID:3696
-
\??\c:\3nhhbh.exec:\3nhhbh.exe139⤵PID:3360
-
\??\c:\xxxfrrx.exec:\xxxfrrx.exe140⤵PID:4676
-
\??\c:\bbttbn.exec:\bbttbn.exe141⤵PID:2804
-
\??\c:\nbbbtb.exec:\nbbbtb.exe142⤵PID:2464
-
\??\c:\dddvp.exec:\dddvp.exe143⤵PID:4708
-
\??\c:\lfxlflf.exec:\lfxlflf.exe144⤵PID:2792
-
\??\c:\bhbnnh.exec:\bhbnnh.exe145⤵PID:2112
-
\??\c:\pvdpj.exec:\pvdpj.exe146⤵PID:3784
-
\??\c:\rlffxxl.exec:\rlffxxl.exe147⤵PID:5000
-
\??\c:\tttnbt.exec:\tttnbt.exe148⤵PID:4180
-
\??\c:\djvjv.exec:\djvjv.exe149⤵PID:3536
-
\??\c:\rrrfrlf.exec:\rrrfrlf.exe150⤵PID:5068
-
\??\c:\tbhtbh.exec:\tbhtbh.exe151⤵PID:436
-
\??\c:\nnhtbn.exec:\nnhtbn.exe152⤵PID:4828
-
\??\c:\ddvdp.exec:\ddvdp.exe153⤵PID:2276
-
\??\c:\flxlfrr.exec:\flxlfrr.exe154⤵PID:1136
-
\??\c:\bbtnnn.exec:\bbtnnn.exe155⤵PID:1036
-
\??\c:\jvpdd.exec:\jvpdd.exe156⤵PID:624
-
\??\c:\fllxlfr.exec:\fllxlfr.exe157⤵PID:3708
-
\??\c:\nnnbtb.exec:\nnnbtb.exe158⤵PID:1896
-
\??\c:\nhhbtn.exec:\nhhbtn.exe159⤵PID:3588
-
\??\c:\pjdpj.exec:\pjdpj.exe160⤵PID:3400
-
\??\c:\xfxrxll.exec:\xfxrxll.exe161⤵PID:4360
-
\??\c:\djdvp.exec:\djdvp.exe162⤵PID:4116
-
\??\c:\1jpjd.exec:\1jpjd.exe163⤵PID:2920
-
\??\c:\xxrlffx.exec:\xxrlffx.exe164⤵PID:1040
-
\??\c:\tbbtnh.exec:\tbbtnh.exe165⤵PID:4988
-
\??\c:\1jdjv.exec:\1jdjv.exe166⤵PID:2052
-
\??\c:\lfxllfr.exec:\lfxllfr.exe167⤵PID:1776
-
\??\c:\thhbnh.exec:\thhbnh.exe168⤵PID:916
-
\??\c:\jdpjd.exec:\jdpjd.exe169⤵PID:3252
-
\??\c:\rrlrfll.exec:\rrlrfll.exe170⤵PID:4596
-
\??\c:\bbthbh.exec:\bbthbh.exe171⤵PID:2868
-
\??\c:\pjppd.exec:\pjppd.exe172⤵PID:4792
-
\??\c:\vjpdj.exec:\vjpdj.exe173⤵PID:3584
-
\??\c:\7ffxfff.exec:\7ffxfff.exe174⤵PID:4872
-
\??\c:\hhbbbb.exec:\hhbbbb.exe175⤵PID:3540
-
\??\c:\pjjpv.exec:\pjjpv.exe176⤵PID:4000
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe177⤵PID:2812
-
\??\c:\1ntnhb.exec:\1ntnhb.exe178⤵PID:3764
-
\??\c:\5tttnh.exec:\5tttnh.exe179⤵PID:64
-
\??\c:\jvvpj.exec:\jvvpj.exe180⤵PID:4224
-
\??\c:\lflfxfx.exec:\lflfxfx.exe181⤵PID:3468
-
\??\c:\hbthhb.exec:\hbthhb.exe182⤵PID:1164
-
\??\c:\tnhbhh.exec:\tnhbhh.exe183⤵PID:4164
-
\??\c:\1jvjp.exec:\1jvjp.exe184⤵PID:2476
-
\??\c:\xllfxfx.exec:\xllfxfx.exe185⤵PID:2456
-
\??\c:\nnhbtt.exec:\nnhbtt.exe186⤵PID:2236
-
\??\c:\9hnnhh.exec:\9hnnhh.exe187⤵PID:3968
-
\??\c:\rrxrfff.exec:\rrxrfff.exe188⤵PID:464
-
\??\c:\tnnhhh.exec:\tnnhhh.exe189⤵PID:2084
-
\??\c:\jddjj.exec:\jddjj.exe190⤵PID:3836
-
\??\c:\lflfffx.exec:\lflfffx.exe191⤵PID:4708
-
\??\c:\3nhbtt.exec:\3nhbtt.exe192⤵PID:3364
-
\??\c:\hbhbhh.exec:\hbhbhh.exe193⤵PID:3056
-
\??\c:\9djpp.exec:\9djpp.exe194⤵PID:1020
-
\??\c:\frfxffx.exec:\frfxffx.exe195⤵PID:1124
-
\??\c:\3bhhbb.exec:\3bhhbb.exe196⤵PID:100
-
\??\c:\ddjjp.exec:\ddjjp.exe197⤵PID:3412
-
\??\c:\lxfllrx.exec:\lxfllrx.exe198⤵PID:4668
-
\??\c:\lfxxffl.exec:\lfxxffl.exe199⤵PID:4776
-
\??\c:\tnhbbt.exec:\tnhbbt.exe200⤵PID:3572
-
\??\c:\7dvpp.exec:\7dvpp.exe201⤵PID:2424
-
\??\c:\jddvp.exec:\jddvp.exe202⤵PID:940
-
\??\c:\7fxrrrl.exec:\7fxrrrl.exe203⤵PID:848
-
\??\c:\tthtbh.exec:\tthtbh.exe204⤵PID:3196
-
\??\c:\jvddd.exec:\jvddd.exe205⤵PID:3060
-
\??\c:\pjddd.exec:\pjddd.exe206⤵PID:3164
-
\??\c:\5rrfxfx.exec:\5rrfxfx.exe207⤵PID:3896
-
\??\c:\htbbth.exec:\htbbth.exe208⤵PID:1368
-
\??\c:\vpjjd.exec:\vpjjd.exe209⤵PID:1332
-
\??\c:\rxflxxf.exec:\rxflxxf.exe210⤵PID:4168
-
\??\c:\nhbtnh.exec:\nhbtnh.exe211⤵PID:5108
-
\??\c:\dpjdd.exec:\dpjdd.exe212⤵PID:1616
-
\??\c:\llllfll.exec:\llllfll.exe213⤵PID:852
-
\??\c:\tnbtbt.exec:\tnbtbt.exe214⤵PID:1644
-
\??\c:\hntnnn.exec:\hntnnn.exe215⤵PID:4004
-
\??\c:\pjjjd.exec:\pjjjd.exe216⤵PID:3380
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe217⤵PID:916
-
\??\c:\lfrrxff.exec:\lfrrxff.exe218⤵PID:2872
-
\??\c:\nhhbbb.exec:\nhhbbb.exe219⤵PID:3716
-
\??\c:\vjvpj.exec:\vjvpj.exe220⤵PID:3636
-
\??\c:\1rrllrl.exec:\1rrllrl.exe221⤵PID:2216
-
\??\c:\tttnnb.exec:\tttnnb.exe222⤵PID:4496
-
\??\c:\jpvdv.exec:\jpvdv.exe223⤵PID:448
-
\??\c:\9ffxrxr.exec:\9ffxrxr.exe224⤵PID:4564
-
\??\c:\3ffxrrl.exec:\3ffxrrl.exe225⤵PID:4484
-
\??\c:\nhhbtt.exec:\nhhbtt.exe226⤵PID:3260
-
\??\c:\vjppp.exec:\vjppp.exe227⤵PID:3176
-
\??\c:\3jvdp.exec:\3jvdp.exe228⤵PID:4164
-
\??\c:\fffrlrr.exec:\fffrlrr.exe229⤵PID:3928
-
\??\c:\htbbtt.exec:\htbbtt.exe230⤵PID:2960
-
\??\c:\djvpp.exec:\djvpp.exe231⤵PID:5016
-
\??\c:\xrffflf.exec:\xrffflf.exe232⤵PID:3292
-
\??\c:\9nnhtt.exec:\9nnhtt.exe233⤵PID:4740
-
\??\c:\1vdjd.exec:\1vdjd.exe234⤵PID:2084
-
\??\c:\ppjvp.exec:\ppjvp.exe235⤵PID:3836
-
\??\c:\xlffxrl.exec:\xlffxrl.exe236⤵PID:4708
-
\??\c:\tnbttt.exec:\tnbttt.exe237⤵PID:3364
-
\??\c:\3dddv.exec:\3dddv.exe238⤵PID:3056
-
\??\c:\rfxfxlx.exec:\rfxfxlx.exe239⤵PID:912
-
\??\c:\frfxfxf.exec:\frfxfxf.exe240⤵PID:4904
-
\??\c:\1ttnhh.exec:\1ttnhh.exe241⤵PID:4876
-
\??\c:\vpvpp.exec:\vpvpp.exe242⤵PID:3412