Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:42
Behavioral task
behavioral1
Sample
94515b56584adc8d0dc615a8416b0890_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
94515b56584adc8d0dc615a8416b0890_NeikiAnalytics.exe
-
Size
453KB
-
MD5
94515b56584adc8d0dc615a8416b0890
-
SHA1
c04c3587a592d9040972163d1a4119aae0fe4fd0
-
SHA256
c19deb375727d291dabc10b87eeadac2a0a68186d1f03c2c369b190555675c93
-
SHA512
6e6c91fb80d48f9cf5ebaf497eae849ba1c672a9daa3a1deb50d4719ffbdc64b924d630a74a95f7e470724132fe8938c1115ee026a3a578b62b71a3ef5c128b7
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNmM:x4wFHoS3eFaKHpv/VycgE81lgb
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4396-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/652-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1256-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/900-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1256-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-621-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-639-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
22604.exenbhtnb.exe2648440.exe468488.exeu086262.exe022222.exenthtnn.exe3bhhbb.exepjppp.exenthbbb.exebbbnhb.exehbbthh.exe5rxrxxx.exe622866.exe046666.exe886666.exe644822.exelrxrlff.exexrrrfrr.exe8404226.exevjdpd.exebbhbtn.exe2044282.exedpvjd.exe06604.exedvdvd.exe800426.exe48608.exethhnhb.exetnhtnn.exehnhhhh.exeu400488.exexxxrllf.exe6226644.exevdddp.exepjjdj.exe7rfxlfx.exei286048.exerrlrrxr.exe468488.exe4644226.exe22482.exepjjvj.exe3nnbbt.exeo460682.exehhhbtn.exe84480.exek26086.exenbnbhb.exe642006.exe0664264.exe2048608.exepjdvj.exehnnbth.exe7thbhh.exe828266.exe804804.exe804820.exevdpjv.exedpjvv.exe6626826.exeu822620.exe42488.exedvdvv.exepid process 4312 22604.exe 3216 nbhtnb.exe 4192 2648440.exe 3276 468488.exe 652 u086262.exe 3024 022222.exe 2136 nthtnn.exe 4060 3bhhbb.exe 3696 pjppp.exe 460 nthbbb.exe 1152 bbbnhb.exe 4344 hbbthh.exe 2808 5rxrxxx.exe 4532 622866.exe 920 046666.exe 3880 886666.exe 1076 644822.exe 4668 lrxrlff.exe 1516 xrrrfrr.exe 1168 8404226.exe 3700 vjdpd.exe 3932 bbhbtn.exe 1948 2044282.exe 2912 dpvjd.exe 4276 06604.exe 936 dvdvd.exe 2440 800426.exe 4084 48608.exe 964 thhnhb.exe 4596 tnhtnn.exe 1344 hnhhhh.exe 3792 u400488.exe 1612 xxxrllf.exe 2672 6226644.exe 1256 vdddp.exe 4976 pjjdj.exe 3372 7rfxlfx.exe 3020 i286048.exe 3768 rrlrrxr.exe 748 468488.exe 3096 4644226.exe 3260 22482.exe 3432 pjjvj.exe 4512 3nnbbt.exe 1768 o460682.exe 4900 hhhbtn.exe 1584 84480.exe 3696 k26086.exe 4044 nbnbhb.exe 900 642006.exe 3820 0664264.exe 5004 2048608.exe 3060 pjdvj.exe 1100 hnnbth.exe 4648 7thbhh.exe 452 828266.exe 1016 804804.exe 2344 804820.exe 4436 vdpjv.exe 4848 dpjvv.exe 2968 6626826.exe 832 u822620.exe 3464 42488.exe 4256 dvdvv.exe -
Processes:
resource yara_rule behavioral2/memory/4396-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4396-4-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\22604.exe upx behavioral2/memory/4312-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbhtnb.exe upx behavioral2/memory/4312-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\2648440.exe upx behavioral2/memory/3216-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4192-19-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\468488.exe upx behavioral2/memory/3276-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\u086262.exe upx C:\022222.exe upx behavioral2/memory/3024-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3276-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/652-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nthtnn.exe upx behavioral2/memory/2136-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3bhhbb.exe upx behavioral2/memory/2136-49-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjppp.exe upx behavioral2/memory/3696-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nthbbb.exe upx behavioral2/memory/460-61-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbbnhb.exe upx behavioral2/memory/460-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbbthh.exe upx behavioral2/memory/4344-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1152-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5rxrxxx.exe upx behavioral2/memory/2808-81-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\622866.exe upx behavioral2/memory/4532-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\046666.exe upx C:\886666.exe upx behavioral2/memory/3880-104-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrxrlff.exe upx \??\c:\644822.exe upx behavioral2/memory/4668-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrrfrr.exe upx behavioral2/memory/1516-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1168-122-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\8404226.exe upx C:\vjdpd.exe upx behavioral2/memory/3700-127-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbhbtn.exe upx C:\2044282.exe upx behavioral2/memory/1948-139-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dpvjd.exe upx behavioral2/memory/2912-143-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\06604.exe upx behavioral2/memory/4276-149-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvdvd.exe upx behavioral2/memory/4276-156-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\800426.exe upx C:\48608.exe upx C:\thhnhb.exe upx behavioral2/memory/4084-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/964-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhtnn.exe upx behavioral2/memory/4596-182-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnhhhh.exe upx \??\c:\u400488.exe upx behavioral2/memory/2672-196-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94515b56584adc8d0dc615a8416b0890_NeikiAnalytics.exe22604.exenbhtnb.exe2648440.exe468488.exeu086262.exe022222.exenthtnn.exe3bhhbb.exepjppp.exenthbbb.exebbbnhb.exehbbthh.exe5rxrxxx.exe622866.exe046666.exe886666.exe644822.exelrxrlff.exexrrrfrr.exe8404226.exevjdpd.exedescription pid process target process PID 4396 wrote to memory of 4312 4396 94515b56584adc8d0dc615a8416b0890_NeikiAnalytics.exe 22604.exe PID 4396 wrote to memory of 4312 4396 94515b56584adc8d0dc615a8416b0890_NeikiAnalytics.exe 22604.exe PID 4396 wrote to memory of 4312 4396 94515b56584adc8d0dc615a8416b0890_NeikiAnalytics.exe 22604.exe PID 4312 wrote to memory of 3216 4312 22604.exe nbhtnb.exe PID 4312 wrote to memory of 3216 4312 22604.exe nbhtnb.exe PID 4312 wrote to memory of 3216 4312 22604.exe nbhtnb.exe PID 3216 wrote to memory of 4192 3216 nbhtnb.exe 2648440.exe PID 3216 wrote to memory of 4192 3216 nbhtnb.exe 2648440.exe PID 3216 wrote to memory of 4192 3216 nbhtnb.exe 2648440.exe PID 4192 wrote to memory of 3276 4192 2648440.exe 468488.exe PID 4192 wrote to memory of 3276 4192 2648440.exe 468488.exe PID 4192 wrote to memory of 3276 4192 2648440.exe 468488.exe PID 3276 wrote to memory of 652 3276 468488.exe u086262.exe PID 3276 wrote to memory of 652 3276 468488.exe u086262.exe PID 3276 wrote to memory of 652 3276 468488.exe u086262.exe PID 652 wrote to memory of 3024 652 u086262.exe 022222.exe PID 652 wrote to memory of 3024 652 u086262.exe 022222.exe PID 652 wrote to memory of 3024 652 u086262.exe 022222.exe PID 3024 wrote to memory of 2136 3024 022222.exe nthtnn.exe PID 3024 wrote to memory of 2136 3024 022222.exe nthtnn.exe PID 3024 wrote to memory of 2136 3024 022222.exe nthtnn.exe PID 2136 wrote to memory of 4060 2136 nthtnn.exe 3bhhbb.exe PID 2136 wrote to memory of 4060 2136 nthtnn.exe 3bhhbb.exe PID 2136 wrote to memory of 4060 2136 nthtnn.exe 3bhhbb.exe PID 4060 wrote to memory of 3696 4060 3bhhbb.exe pjppp.exe PID 4060 wrote to memory of 3696 4060 3bhhbb.exe pjppp.exe PID 4060 wrote to memory of 3696 4060 3bhhbb.exe pjppp.exe PID 3696 wrote to memory of 460 3696 pjppp.exe nthbbb.exe PID 3696 wrote to memory of 460 3696 pjppp.exe nthbbb.exe PID 3696 wrote to memory of 460 3696 pjppp.exe nthbbb.exe PID 460 wrote to memory of 1152 460 nthbbb.exe bbbnhb.exe PID 460 wrote to memory of 1152 460 nthbbb.exe bbbnhb.exe PID 460 wrote to memory of 1152 460 nthbbb.exe bbbnhb.exe PID 1152 wrote to memory of 4344 1152 bbbnhb.exe hbbthh.exe PID 1152 wrote to memory of 4344 1152 bbbnhb.exe hbbthh.exe PID 1152 wrote to memory of 4344 1152 bbbnhb.exe hbbthh.exe PID 4344 wrote to memory of 2808 4344 hbbthh.exe 5rxrxxx.exe PID 4344 wrote to memory of 2808 4344 hbbthh.exe 5rxrxxx.exe PID 4344 wrote to memory of 2808 4344 hbbthh.exe 5rxrxxx.exe PID 2808 wrote to memory of 4532 2808 5rxrxxx.exe 622866.exe PID 2808 wrote to memory of 4532 2808 5rxrxxx.exe 622866.exe PID 2808 wrote to memory of 4532 2808 5rxrxxx.exe 622866.exe PID 4532 wrote to memory of 920 4532 622866.exe 046666.exe PID 4532 wrote to memory of 920 4532 622866.exe 046666.exe PID 4532 wrote to memory of 920 4532 622866.exe 046666.exe PID 920 wrote to memory of 3880 920 046666.exe 886666.exe PID 920 wrote to memory of 3880 920 046666.exe 886666.exe PID 920 wrote to memory of 3880 920 046666.exe 886666.exe PID 3880 wrote to memory of 1076 3880 886666.exe 644822.exe PID 3880 wrote to memory of 1076 3880 886666.exe 644822.exe PID 3880 wrote to memory of 1076 3880 886666.exe 644822.exe PID 1076 wrote to memory of 4668 1076 644822.exe lrxrlff.exe PID 1076 wrote to memory of 4668 1076 644822.exe lrxrlff.exe PID 1076 wrote to memory of 4668 1076 644822.exe lrxrlff.exe PID 4668 wrote to memory of 1516 4668 lrxrlff.exe xrrrfrr.exe PID 4668 wrote to memory of 1516 4668 lrxrlff.exe xrrrfrr.exe PID 4668 wrote to memory of 1516 4668 lrxrlff.exe xrrrfrr.exe PID 1516 wrote to memory of 1168 1516 xrrrfrr.exe 8404226.exe PID 1516 wrote to memory of 1168 1516 xrrrfrr.exe 8404226.exe PID 1516 wrote to memory of 1168 1516 xrrrfrr.exe 8404226.exe PID 1168 wrote to memory of 3700 1168 8404226.exe vjdpd.exe PID 1168 wrote to memory of 3700 1168 8404226.exe vjdpd.exe PID 1168 wrote to memory of 3700 1168 8404226.exe vjdpd.exe PID 3700 wrote to memory of 3932 3700 vjdpd.exe bbhbtn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94515b56584adc8d0dc615a8416b0890_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\94515b56584adc8d0dc615a8416b0890_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\22604.exec:\22604.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\nbhtnb.exec:\nbhtnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\2648440.exec:\2648440.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\468488.exec:\468488.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\u086262.exec:\u086262.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\022222.exec:\022222.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\nthtnn.exec:\nthtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\3bhhbb.exec:\3bhhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\pjppp.exec:\pjppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\nthbbb.exec:\nthbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\bbbnhb.exec:\bbbnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\hbbthh.exec:\hbbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\5rxrxxx.exec:\5rxrxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\622866.exec:\622866.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\046666.exec:\046666.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\886666.exec:\886666.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\644822.exec:\644822.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\lrxrlff.exec:\lrxrlff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\xrrrfrr.exec:\xrrrfrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\8404226.exec:\8404226.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\vjdpd.exec:\vjdpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\bbhbtn.exec:\bbhbtn.exe23⤵
- Executes dropped EXE
PID:3932 -
\??\c:\2044282.exec:\2044282.exe24⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dpvjd.exec:\dpvjd.exe25⤵
- Executes dropped EXE
PID:2912 -
\??\c:\06604.exec:\06604.exe26⤵
- Executes dropped EXE
PID:4276 -
\??\c:\dvdvd.exec:\dvdvd.exe27⤵
- Executes dropped EXE
PID:936 -
\??\c:\800426.exec:\800426.exe28⤵
- Executes dropped EXE
PID:2440 -
\??\c:\48608.exec:\48608.exe29⤵
- Executes dropped EXE
PID:4084 -
\??\c:\thhnhb.exec:\thhnhb.exe30⤵
- Executes dropped EXE
PID:964 -
\??\c:\tnhtnn.exec:\tnhtnn.exe31⤵
- Executes dropped EXE
PID:4596 -
\??\c:\hnhhhh.exec:\hnhhhh.exe32⤵
- Executes dropped EXE
PID:1344 -
\??\c:\u400488.exec:\u400488.exe33⤵
- Executes dropped EXE
PID:3792 -
\??\c:\xxxrllf.exec:\xxxrllf.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7rrlfxr.exec:\7rrlfxr.exe35⤵PID:3240
-
\??\c:\6226644.exec:\6226644.exe36⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vdddp.exec:\vdddp.exe37⤵
- Executes dropped EXE
PID:1256 -
\??\c:\pjjdj.exec:\pjjdj.exe38⤵
- Executes dropped EXE
PID:4976 -
\??\c:\7rfxlfx.exec:\7rfxlfx.exe39⤵
- Executes dropped EXE
PID:3372 -
\??\c:\i286048.exec:\i286048.exe40⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe41⤵
- Executes dropped EXE
PID:3768 -
\??\c:\468488.exec:\468488.exe42⤵
- Executes dropped EXE
PID:748 -
\??\c:\4644226.exec:\4644226.exe43⤵
- Executes dropped EXE
PID:3096 -
\??\c:\22482.exec:\22482.exe44⤵
- Executes dropped EXE
PID:3260 -
\??\c:\pjjvj.exec:\pjjvj.exe45⤵
- Executes dropped EXE
PID:3432 -
\??\c:\3nnbbt.exec:\3nnbbt.exe46⤵
- Executes dropped EXE
PID:4512 -
\??\c:\o460682.exec:\o460682.exe47⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hhhbtn.exec:\hhhbtn.exe48⤵
- Executes dropped EXE
PID:4900 -
\??\c:\84480.exec:\84480.exe49⤵
- Executes dropped EXE
PID:1584 -
\??\c:\k26086.exec:\k26086.exe50⤵
- Executes dropped EXE
PID:3696 -
\??\c:\nbnbhb.exec:\nbnbhb.exe51⤵
- Executes dropped EXE
PID:4044 -
\??\c:\642006.exec:\642006.exe52⤵
- Executes dropped EXE
PID:900 -
\??\c:\0664264.exec:\0664264.exe53⤵
- Executes dropped EXE
PID:3820 -
\??\c:\2048608.exec:\2048608.exe54⤵
- Executes dropped EXE
PID:5004 -
\??\c:\pjdvj.exec:\pjdvj.exe55⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hnnbth.exec:\hnnbth.exe56⤵
- Executes dropped EXE
PID:1100 -
\??\c:\7thbhh.exec:\7thbhh.exe57⤵
- Executes dropped EXE
PID:4648 -
\??\c:\828266.exec:\828266.exe58⤵
- Executes dropped EXE
PID:452 -
\??\c:\804804.exec:\804804.exe59⤵
- Executes dropped EXE
PID:1016 -
\??\c:\804820.exec:\804820.exe60⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vdpjv.exec:\vdpjv.exe61⤵
- Executes dropped EXE
PID:4436 -
\??\c:\dpjvv.exec:\dpjvv.exe62⤵
- Executes dropped EXE
PID:4848 -
\??\c:\6626826.exec:\6626826.exe63⤵
- Executes dropped EXE
PID:2968 -
\??\c:\u822620.exec:\u822620.exe64⤵
- Executes dropped EXE
PID:832 -
\??\c:\42488.exec:\42488.exe65⤵
- Executes dropped EXE
PID:3464 -
\??\c:\dvdvv.exec:\dvdvv.exe66⤵
- Executes dropped EXE
PID:4256 -
\??\c:\9bbthb.exec:\9bbthb.exe67⤵PID:3960
-
\??\c:\e22422.exec:\e22422.exe68⤵PID:2068
-
\??\c:\46420.exec:\46420.exe69⤵PID:4740
-
\??\c:\868424.exec:\868424.exe70⤵PID:3284
-
\??\c:\vpjjv.exec:\vpjjv.exe71⤵PID:4160
-
\??\c:\4282480.exec:\4282480.exe72⤵PID:5012
-
\??\c:\m4826.exec:\m4826.exe73⤵PID:2276
-
\??\c:\nhbthb.exec:\nhbthb.exe74⤵PID:4936
-
\??\c:\42260.exec:\42260.exe75⤵PID:4672
-
\??\c:\46224.exec:\46224.exe76⤵PID:964
-
\??\c:\e00466.exec:\e00466.exe77⤵PID:3440
-
\??\c:\nhhtnh.exec:\nhhtnh.exe78⤵PID:1320
-
\??\c:\5vpvp.exec:\5vpvp.exe79⤵PID:1344
-
\??\c:\htnbnh.exec:\htnbnh.exe80⤵PID:2324
-
\??\c:\28020.exec:\28020.exe81⤵PID:2700
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe82⤵PID:4396
-
\??\c:\2626648.exec:\2626648.exe83⤵PID:1200
-
\??\c:\o200486.exec:\o200486.exe84⤵PID:3488
-
\??\c:\tbbtnn.exec:\tbbtnn.exe85⤵PID:1096
-
\??\c:\m0262.exec:\m0262.exe86⤵PID:2904
-
\??\c:\00004.exec:\00004.exe87⤵PID:2872
-
\??\c:\86642.exec:\86642.exe88⤵PID:1192
-
\??\c:\4448048.exec:\4448048.exe89⤵PID:2984
-
\??\c:\ddjvp.exec:\ddjvp.exe90⤵PID:4040
-
\??\c:\rffxrll.exec:\rffxrll.exe91⤵PID:4012
-
\??\c:\64804.exec:\64804.exe92⤵PID:3432
-
\??\c:\bntnhh.exec:\bntnhh.exe93⤵PID:3044
-
\??\c:\lfrfxrx.exec:\lfrfxrx.exe94⤵PID:3912
-
\??\c:\o626460.exec:\o626460.exe95⤵PID:4940
-
\??\c:\pdjdp.exec:\pdjdp.exe96⤵PID:2896
-
\??\c:\884482.exec:\884482.exe97⤵PID:5112
-
\??\c:\40048.exec:\40048.exe98⤵PID:3188
-
\??\c:\hbbthh.exec:\hbbthh.exe99⤵PID:3032
-
\??\c:\vjvpp.exec:\vjvpp.exe100⤵PID:2152
-
\??\c:\fxxrffx.exec:\fxxrffx.exe101⤵PID:4444
-
\??\c:\40880.exec:\40880.exe102⤵PID:4472
-
\??\c:\lxlfxxf.exec:\lxlfxxf.exe103⤵PID:4760
-
\??\c:\ntthbt.exec:\ntthbt.exe104⤵PID:2292
-
\??\c:\28042.exec:\28042.exe105⤵PID:1076
-
\??\c:\9lflxfx.exec:\9lflxfx.exe106⤵PID:404
-
\??\c:\604482.exec:\604482.exe107⤵PID:2568
-
\??\c:\3dvvp.exec:\3dvvp.exe108⤵PID:3540
-
\??\c:\fflxlxr.exec:\fflxlxr.exe109⤵PID:3980
-
\??\c:\bnbthh.exec:\bnbthh.exe110⤵PID:2396
-
\??\c:\22482.exec:\22482.exe111⤵PID:2352
-
\??\c:\484646.exec:\484646.exe112⤵PID:4908
-
\??\c:\dpvpj.exec:\dpvpj.exe113⤵PID:2036
-
\??\c:\e22860.exec:\e22860.exe114⤵PID:4980
-
\??\c:\c060482.exec:\c060482.exe115⤵PID:3296
-
\??\c:\20008.exec:\20008.exe116⤵PID:1732
-
\??\c:\8660408.exec:\8660408.exe117⤵PID:4860
-
\??\c:\224260.exec:\224260.exe118⤵PID:2784
-
\??\c:\vjvvj.exec:\vjvvj.exe119⤵PID:4876
-
\??\c:\tntnbt.exec:\tntnbt.exe120⤵PID:4524
-
\??\c:\u626260.exec:\u626260.exe121⤵PID:3556
-
\??\c:\s8424.exec:\s8424.exe122⤵PID:4328
-
\??\c:\g8622.exec:\g8622.exe123⤵PID:4304
-
\??\c:\262266.exec:\262266.exe124⤵PID:2672
-
\??\c:\xfffxxr.exec:\xfffxxr.exe125⤵PID:1256
-
\??\c:\w22482.exec:\w22482.exe126⤵PID:1504
-
\??\c:\60608.exec:\60608.exe127⤵PID:3052
-
\??\c:\o820048.exec:\o820048.exe128⤵PID:3972
-
\??\c:\vjvdj.exec:\vjvdj.exe129⤵PID:2040
-
\??\c:\644882.exec:\644882.exe130⤵PID:652
-
\??\c:\3nbthb.exec:\3nbthb.exe131⤵PID:3180
-
\??\c:\9hhbtn.exec:\9hhbtn.exe132⤵PID:4884
-
\??\c:\nhthbt.exec:\nhthbt.exe133⤵PID:4104
-
\??\c:\c882464.exec:\c882464.exe134⤵PID:1348
-
\??\c:\thbnbt.exec:\thbnbt.exe135⤵PID:2136
-
\??\c:\8444668.exec:\8444668.exe136⤵PID:4632
-
\??\c:\084262.exec:\084262.exe137⤵PID:3672
-
\??\c:\268826.exec:\268826.exe138⤵PID:4008
-
\??\c:\6268620.exec:\6268620.exe139⤵PID:4992
-
\??\c:\o666486.exec:\o666486.exe140⤵PID:2096
-
\??\c:\7tthtn.exec:\7tthtn.exe141⤵PID:3820
-
\??\c:\c886420.exec:\c886420.exe142⤵PID:4948
-
\??\c:\204426.exec:\204426.exe143⤵PID:4620
-
\??\c:\826080.exec:\826080.exe144⤵PID:920
-
\??\c:\5xrlfxr.exec:\5xrlfxr.exe145⤵PID:1016
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe146⤵PID:3952
-
\??\c:\228862.exec:\228862.exe147⤵PID:2344
-
\??\c:\2048226.exec:\2048226.exe148⤵PID:1524
-
\??\c:\nntthh.exec:\nntthh.exe149⤵PID:1116
-
\??\c:\bttnbb.exec:\bttnbb.exe150⤵PID:3504
-
\??\c:\vjvpv.exec:\vjvpv.exe151⤵PID:4256
-
\??\c:\nnbnbt.exec:\nnbnbt.exe152⤵PID:3960
-
\??\c:\7tthbt.exec:\7tthbt.exe153⤵PID:1252
-
\??\c:\426086.exec:\426086.exe154⤵PID:4220
-
\??\c:\64820.exec:\64820.exe155⤵PID:4140
-
\??\c:\8204040.exec:\8204040.exe156⤵PID:5048
-
\??\c:\vvdvv.exec:\vvdvv.exe157⤵PID:4084
-
\??\c:\644822.exec:\644822.exe158⤵PID:3404
-
\??\c:\4204886.exec:\4204886.exe159⤵PID:1956
-
\??\c:\288826.exec:\288826.exe160⤵PID:1140
-
\??\c:\884426.exec:\884426.exe161⤵PID:2868
-
\??\c:\6248226.exec:\6248226.exe162⤵PID:2716
-
\??\c:\40608.exec:\40608.exe163⤵PID:4524
-
\??\c:\dvjdp.exec:\dvjdp.exe164⤵PID:4560
-
\??\c:\20644.exec:\20644.exe165⤵PID:4580
-
\??\c:\5djvd.exec:\5djvd.exe166⤵PID:1164
-
\??\c:\fxxrllf.exec:\fxxrllf.exe167⤵PID:1200
-
\??\c:\7fllflf.exec:\7fllflf.exe168⤵PID:3656
-
\??\c:\lrrrllf.exec:\lrrrllf.exe169⤵PID:3368
-
\??\c:\c666044.exec:\c666044.exe170⤵PID:2872
-
\??\c:\vpdpj.exec:\vpdpj.exe171⤵PID:3872
-
\??\c:\282082.exec:\282082.exe172⤵PID:652
-
\??\c:\bntnhh.exec:\bntnhh.exe173⤵PID:3620
-
\??\c:\hbhbnh.exec:\hbhbnh.exe174⤵PID:3040
-
\??\c:\nnhtnn.exec:\nnhtnn.exe175⤵PID:4600
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe176⤵PID:4900
-
\??\c:\tbnnhh.exec:\tbnnhh.exe177⤵PID:1980
-
\??\c:\e28480.exec:\e28480.exe178⤵PID:1584
-
\??\c:\440486.exec:\440486.exe179⤵PID:3696
-
\??\c:\3pjvp.exec:\3pjvp.exe180⤵PID:4044
-
\??\c:\604860.exec:\604860.exe181⤵PID:2688
-
\??\c:\pvjvp.exec:\pvjvp.exe182⤵PID:3976
-
\??\c:\0660004.exec:\0660004.exe183⤵PID:4820
-
\??\c:\5nhbnb.exec:\5nhbnb.exe184⤵PID:1460
-
\??\c:\62082.exec:\62082.exe185⤵PID:3880
-
\??\c:\46826.exec:\46826.exe186⤵PID:4492
-
\??\c:\xxrrrrl.exec:\xxrrrrl.exe187⤵PID:4964
-
\??\c:\668820.exec:\668820.exe188⤵PID:3576
-
\??\c:\06260.exec:\06260.exe189⤵PID:2968
-
\??\c:\a6248.exec:\a6248.exe190⤵PID:2564
-
\??\c:\0084640.exec:\0084640.exe191⤵PID:3540
-
\??\c:\040044.exec:\040044.exe192⤵PID:4676
-
\??\c:\vpvjd.exec:\vpvjd.exe193⤵PID:1948
-
\??\c:\pvppj.exec:\pvppj.exe194⤵PID:760
-
\??\c:\446044.exec:\446044.exe195⤵PID:3348
-
\??\c:\g4480.exec:\g4480.exe196⤵PID:3624
-
\??\c:\6400840.exec:\6400840.exe197⤵PID:4716
-
\??\c:\nhnnhh.exec:\nhnnhh.exe198⤵PID:4644
-
\??\c:\840086.exec:\840086.exe199⤵PID:4736
-
\??\c:\e88648.exec:\e88648.exe200⤵PID:3616
-
\??\c:\482688.exec:\482688.exe201⤵PID:2964
-
\??\c:\htnhbt.exec:\htnhbt.exe202⤵PID:5052
-
\??\c:\46466.exec:\46466.exe203⤵PID:4596
-
\??\c:\3vdpp.exec:\3vdpp.exe204⤵PID:2784
-
\??\c:\djjvj.exec:\djjvj.exe205⤵PID:4876
-
\??\c:\7jddv.exec:\7jddv.exe206⤵PID:4324
-
\??\c:\9ttnhb.exec:\9ttnhb.exe207⤵PID:3556
-
\??\c:\48888.exec:\48888.exe208⤵PID:2324
-
\??\c:\jjvpv.exec:\jjvpv.exe209⤵PID:4480
-
\??\c:\tbhtnb.exec:\tbhtnb.exe210⤵PID:4580
-
\??\c:\606088.exec:\606088.exe211⤵PID:1256
-
\??\c:\jdjjd.exec:\jdjjd.exe212⤵PID:1200
-
\??\c:\fxxlrlf.exec:\fxxlrlf.exe213⤵PID:3656
-
\??\c:\i000826.exec:\i000826.exe214⤵PID:3368
-
\??\c:\bttnnn.exec:\bttnnn.exe215⤵PID:2872
-
\??\c:\btnhnh.exec:\btnhnh.exe216⤵PID:748
-
\??\c:\5ffxllf.exec:\5ffxllf.exe217⤵PID:4352
-
\??\c:\2228264.exec:\2228264.exe218⤵PID:4548
-
\??\c:\e20460.exec:\e20460.exe219⤵PID:3044
-
\??\c:\thbtht.exec:\thbtht.exe220⤵PID:3912
-
\??\c:\20428.exec:\20428.exe221⤵PID:4608
-
\??\c:\jjjvj.exec:\jjjvj.exe222⤵PID:3580
-
\??\c:\nbnthn.exec:\nbnthn.exe223⤵PID:3628
-
\??\c:\624884.exec:\624884.exe224⤵PID:460
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe225⤵PID:3188
-
\??\c:\hbtnbt.exec:\hbtnbt.exe226⤵PID:2020
-
\??\c:\4604860.exec:\4604860.exe227⤵PID:3228
-
\??\c:\00048.exec:\00048.exe228⤵PID:4444
-
\??\c:\22486.exec:\22486.exe229⤵PID:1336
-
\??\c:\k84860.exec:\k84860.exe230⤵PID:4760
-
\??\c:\jjdjv.exec:\jjdjv.exe231⤵PID:3848
-
\??\c:\dvdpj.exec:\dvdpj.exe232⤵PID:3952
-
\??\c:\vdjdp.exec:\vdjdp.exe233⤵PID:4692
-
\??\c:\q24422.exec:\q24422.exe234⤵PID:3144
-
\??\c:\tnhbhb.exec:\tnhbhb.exe235⤵PID:1116
-
\??\c:\w86046.exec:\w86046.exe236⤵PID:2024
-
\??\c:\266660.exec:\266660.exe237⤵PID:4724
-
\??\c:\e00082.exec:\e00082.exe238⤵PID:688
-
\??\c:\o064260.exec:\o064260.exe239⤵PID:4740
-
\??\c:\240026.exec:\240026.exe240⤵PID:4252
-
\??\c:\6644884.exec:\6644884.exe241⤵PID:532
-
\??\c:\7lrfxrl.exec:\7lrfxrl.exe242⤵PID:4916