Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:54
Behavioral task
behavioral1
Sample
dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe
-
Size
540KB
-
MD5
dbe9f705a0a0e0548f6f8ccc007aee20
-
SHA1
96ea1d55dc4f9d8a71cbffd2b1dbf22e9c61a96b
-
SHA256
5f53e124d08fb742e1c721a518415d8ea00d7f5b2d26ce8e2bd2bbc1badd9f77
-
SHA512
16393c2b466ea623d469467098e37369cb12d0484b5ef5c7d43c65923035e30d2204fbcc997848273f43bdbbb96a6bf29871a1fc8f4a1186dcf39e6c9e2be1f9
-
SSDEEP
6144:Ucm4FmowdHoSEsIR7DsFhraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNDoDb0:i4wFHoSEsIR7seFaKHpv/VycgE81lg/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2928-6-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4376-13-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/396-26-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3416-31-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3284-42-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3896-48-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/436-54-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5076-66-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4292-76-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4004-103-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4548-114-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3044-120-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2120-135-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1448-183-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/760-192-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4404-191-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3528-201-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4452-205-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2424-231-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2960-285-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4048-289-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2728-300-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4044-308-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3384-312-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2156-319-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4560-323-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/428-342-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4276-338-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1704-354-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1832-330-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3256-358-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4964-281-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3196-273-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2084-269-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4152-255-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4824-249-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3352-246-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3664-241-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2052-236-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3048-181-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3048-175-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2472-170-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4888-163-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3596-150-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2892-134-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/820-128-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4552-92-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2988-81-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4744-19-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2496-12-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4376-380-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4188-384-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4732-420-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4568-424-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3856-446-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3324-452-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4352-466-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2472-485-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4116-504-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4116-508-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4476-512-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4468-513-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1196-529-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2736-641-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrrlrfx.exe7llxlfx.exettbnbt.exe1ppjv.exejdpdp.exe9rlxrlx.exehtbbnt.exejdvpj.exenhbtbn.exejjvjd.exelxxlxrf.exennhtnn.exepjjvv.exefrfxlxl.exe9nnnhh.exeppppd.exexrlfxrl.exebhhbnb.exedjvdd.exexllfrlf.exepdjdv.exelrffxxx.exepdvvp.exejpvpd.exelfxlrlr.exehbhhht.exevdpjj.exexxxllfl.exexllfxrl.exehbtnhh.exejpjvp.exettthhb.exebbhtht.exe9lxxrxf.exenbbnbn.exehhhbtt.exeddvpv.exe3llfxll.exebtttnb.exehbbtnn.exeddjvd.exexfxxlxl.exelllfllr.exe3tbtnh.exe5jdvv.exepjppp.exerfxlfxr.exehbbtnh.exe5ttnhh.exeppppj.exerlfxlxr.exe3hthbt.exenthbtt.exevdpdp.exeflrfxlf.exehtbttt.exebhbthb.exe3jdvd.exelflfffx.exerxfrfxl.exe1ntnhh.exedpvpj.exerffrrff.exe9rlxlfx.exepid process 2496 rrrlrfx.exe 4376 7llxlfx.exe 4744 ttbnbt.exe 396 1ppjv.exe 3416 jdpdp.exe 3600 9rlxrlx.exe 3284 htbbnt.exe 3896 jdvpj.exe 436 nhbtbn.exe 3120 jjvjd.exe 5076 lxxlxrf.exe 4292 nnhtnn.exe 2988 pjjvv.exe 5092 frfxlxl.exe 4552 9nnnhh.exe 2028 ppppd.exe 4004 xrlfxrl.exe 1528 bhhbnb.exe 4548 djvdd.exe 3044 xllfrlf.exe 820 pdjdv.exe 2892 lrffxxx.exe 2120 pdvvp.exe 4716 jpvpd.exe 3596 lfxlrlr.exe 1812 hbhhht.exe 4888 vdpjj.exe 3192 xxxllfl.exe 2472 xllfxrl.exe 3048 hbtnhh.exe 1448 jpjvp.exe 4404 ttthhb.exe 760 bbhtht.exe 2292 9lxxrxf.exe 3528 nbbnbn.exe 2896 hhhbtt.exe 4452 ddvpv.exe 1788 3llfxll.exe 2732 btttnb.exe 3808 hbbtnn.exe 5052 ddjvd.exe 4408 xfxxlxl.exe 1196 lllfllr.exe 2424 3tbtnh.exe 2052 5jdvv.exe 3664 pjppp.exe 4860 rfxlfxr.exe 3352 hbbtnh.exe 4824 5ttnhh.exe 4152 ppppj.exe 3120 rlfxlxr.exe 3648 3hthbt.exe 2492 nthbtt.exe 2084 vdpdp.exe 3196 flrfxlf.exe 2040 htbttt.exe 4936 bhbthb.exe 4964 3jdvd.exe 2960 lflfffx.exe 4048 rxfrfxl.exe 1768 1ntnhh.exe 2728 dpvpj.exe 3720 rffrrff.exe 4044 9rlxlfx.exe -
Processes:
resource yara_rule behavioral2/memory/2928-0-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\rrrlrfx.exe upx behavioral2/memory/2928-6-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\7llxlfx.exe upx behavioral2/memory/4376-13-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\ttbnbt.exe upx \??\c:\1ppjv.exe upx behavioral2/memory/396-26-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\jdpdp.exe upx behavioral2/memory/3416-31-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\htbbnt.exe upx behavioral2/memory/3284-42-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\9rlxrlx.exe upx behavioral2/memory/3896-48-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\jdvpj.exe upx \??\c:\nhbtbn.exe upx behavioral2/memory/436-54-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3120-60-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\jjvjd.exe upx C:\nnhtnn.exe upx behavioral2/memory/5076-66-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\lxxlxrf.exe upx \??\c:\pjjvv.exe upx behavioral2/memory/4292-76-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\ppppd.exe upx \??\c:\xrlfxrl.exe upx \??\c:\bhhbnb.exe upx behavioral2/memory/4004-103-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\djvdd.exe upx C:\xllfrlf.exe upx behavioral2/memory/4548-114-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\pdjdv.exe upx behavioral2/memory/820-122-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3044-120-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2120-135-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\lfxlrlr.exe upx \??\c:\hbhhht.exe upx \??\c:\vdpjj.exe upx behavioral2/memory/4888-157-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\hbtnhh.exe upx behavioral2/memory/1448-183-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\ttthhb.exe upx \??\c:\jpjvp.exe upx behavioral2/memory/760-192-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4404-191-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3528-201-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4452-205-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2052-232-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2424-231-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3120-256-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2960-285-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4048-289-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1768-293-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4044-304-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2728-300-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4044-308-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3384-312-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2156-319-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4560-323-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3192-331-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4060-343-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/428-342-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4276-338-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1704-350-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exerrrlrfx.exe7llxlfx.exettbnbt.exe1ppjv.exejdpdp.exe9rlxrlx.exehtbbnt.exejdvpj.exenhbtbn.exejjvjd.exelxxlxrf.exennhtnn.exepjjvv.exefrfxlxl.exe9nnnhh.exeppppd.exexrlfxrl.exebhhbnb.exedjvdd.exexllfrlf.exepdjdv.exedescription pid process target process PID 2928 wrote to memory of 2496 2928 dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe rrrlrfx.exe PID 2928 wrote to memory of 2496 2928 dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe rrrlrfx.exe PID 2928 wrote to memory of 2496 2928 dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe rrrlrfx.exe PID 2496 wrote to memory of 4376 2496 rrrlrfx.exe 7llxlfx.exe PID 2496 wrote to memory of 4376 2496 rrrlrfx.exe 7llxlfx.exe PID 2496 wrote to memory of 4376 2496 rrrlrfx.exe 7llxlfx.exe PID 4376 wrote to memory of 4744 4376 7llxlfx.exe ttbnbt.exe PID 4376 wrote to memory of 4744 4376 7llxlfx.exe ttbnbt.exe PID 4376 wrote to memory of 4744 4376 7llxlfx.exe ttbnbt.exe PID 4744 wrote to memory of 396 4744 ttbnbt.exe 1ppjv.exe PID 4744 wrote to memory of 396 4744 ttbnbt.exe 1ppjv.exe PID 4744 wrote to memory of 396 4744 ttbnbt.exe 1ppjv.exe PID 396 wrote to memory of 3416 396 1ppjv.exe jdpdp.exe PID 396 wrote to memory of 3416 396 1ppjv.exe jdpdp.exe PID 396 wrote to memory of 3416 396 1ppjv.exe jdpdp.exe PID 3416 wrote to memory of 3600 3416 jdpdp.exe 9rlxrlx.exe PID 3416 wrote to memory of 3600 3416 jdpdp.exe 9rlxrlx.exe PID 3416 wrote to memory of 3600 3416 jdpdp.exe 9rlxrlx.exe PID 3600 wrote to memory of 3284 3600 9rlxrlx.exe htbbnt.exe PID 3600 wrote to memory of 3284 3600 9rlxrlx.exe htbbnt.exe PID 3600 wrote to memory of 3284 3600 9rlxrlx.exe htbbnt.exe PID 3284 wrote to memory of 3896 3284 htbbnt.exe jdvpj.exe PID 3284 wrote to memory of 3896 3284 htbbnt.exe jdvpj.exe PID 3284 wrote to memory of 3896 3284 htbbnt.exe jdvpj.exe PID 3896 wrote to memory of 436 3896 jdvpj.exe nhbtbn.exe PID 3896 wrote to memory of 436 3896 jdvpj.exe nhbtbn.exe PID 3896 wrote to memory of 436 3896 jdvpj.exe nhbtbn.exe PID 436 wrote to memory of 3120 436 nhbtbn.exe rlfxlxr.exe PID 436 wrote to memory of 3120 436 nhbtbn.exe rlfxlxr.exe PID 436 wrote to memory of 3120 436 nhbtbn.exe rlfxlxr.exe PID 3120 wrote to memory of 5076 3120 jjvjd.exe lxxlxrf.exe PID 3120 wrote to memory of 5076 3120 jjvjd.exe lxxlxrf.exe PID 3120 wrote to memory of 5076 3120 jjvjd.exe lxxlxrf.exe PID 5076 wrote to memory of 4292 5076 lxxlxrf.exe nnhtnn.exe PID 5076 wrote to memory of 4292 5076 lxxlxrf.exe nnhtnn.exe PID 5076 wrote to memory of 4292 5076 lxxlxrf.exe nnhtnn.exe PID 4292 wrote to memory of 2988 4292 nnhtnn.exe pjjvv.exe PID 4292 wrote to memory of 2988 4292 nnhtnn.exe pjjvv.exe PID 4292 wrote to memory of 2988 4292 nnhtnn.exe pjjvv.exe PID 2988 wrote to memory of 5092 2988 pjjvv.exe frfxlxl.exe PID 2988 wrote to memory of 5092 2988 pjjvv.exe frfxlxl.exe PID 2988 wrote to memory of 5092 2988 pjjvv.exe frfxlxl.exe PID 5092 wrote to memory of 4552 5092 frfxlxl.exe 9nnnhh.exe PID 5092 wrote to memory of 4552 5092 frfxlxl.exe 9nnnhh.exe PID 5092 wrote to memory of 4552 5092 frfxlxl.exe 9nnnhh.exe PID 4552 wrote to memory of 2028 4552 9nnnhh.exe ppppd.exe PID 4552 wrote to memory of 2028 4552 9nnnhh.exe ppppd.exe PID 4552 wrote to memory of 2028 4552 9nnnhh.exe ppppd.exe PID 2028 wrote to memory of 4004 2028 ppppd.exe xrlfxrl.exe PID 2028 wrote to memory of 4004 2028 ppppd.exe xrlfxrl.exe PID 2028 wrote to memory of 4004 2028 ppppd.exe xrlfxrl.exe PID 4004 wrote to memory of 1528 4004 xrlfxrl.exe bhhbnb.exe PID 4004 wrote to memory of 1528 4004 xrlfxrl.exe bhhbnb.exe PID 4004 wrote to memory of 1528 4004 xrlfxrl.exe bhhbnb.exe PID 1528 wrote to memory of 4548 1528 bhhbnb.exe djvdd.exe PID 1528 wrote to memory of 4548 1528 bhhbnb.exe djvdd.exe PID 1528 wrote to memory of 4548 1528 bhhbnb.exe djvdd.exe PID 4548 wrote to memory of 3044 4548 djvdd.exe xllfrlf.exe PID 4548 wrote to memory of 3044 4548 djvdd.exe xllfrlf.exe PID 4548 wrote to memory of 3044 4548 djvdd.exe xllfrlf.exe PID 3044 wrote to memory of 820 3044 xllfrlf.exe pdjdv.exe PID 3044 wrote to memory of 820 3044 xllfrlf.exe pdjdv.exe PID 3044 wrote to memory of 820 3044 xllfrlf.exe pdjdv.exe PID 820 wrote to memory of 2892 820 pdjdv.exe lrffxxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rrrlrfx.exec:\rrrlrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\7llxlfx.exec:\7llxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\ttbnbt.exec:\ttbnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\1ppjv.exec:\1ppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\jdpdp.exec:\jdpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\9rlxrlx.exec:\9rlxrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\htbbnt.exec:\htbbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\jdvpj.exec:\jdvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\nhbtbn.exec:\nhbtbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\jjvjd.exec:\jjvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\lxxlxrf.exec:\lxxlxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\nnhtnn.exec:\nnhtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\pjjvv.exec:\pjjvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\frfxlxl.exec:\frfxlxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\9nnnhh.exec:\9nnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\ppppd.exec:\ppppd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\bhhbnb.exec:\bhhbnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\djvdd.exec:\djvdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\xllfrlf.exec:\xllfrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\pdjdv.exec:\pdjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\lrffxxx.exec:\lrffxxx.exe23⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pdvvp.exec:\pdvvp.exe24⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jpvpd.exec:\jpvpd.exe25⤵
- Executes dropped EXE
PID:4716 -
\??\c:\lfxlrlr.exec:\lfxlrlr.exe26⤵
- Executes dropped EXE
PID:3596 -
\??\c:\hbhhht.exec:\hbhhht.exe27⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vdpjj.exec:\vdpjj.exe28⤵
- Executes dropped EXE
PID:4888 -
\??\c:\xxxllfl.exec:\xxxllfl.exe29⤵
- Executes dropped EXE
PID:3192 -
\??\c:\xllfxrl.exec:\xllfxrl.exe30⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hbtnhh.exec:\hbtnhh.exe31⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jpjvp.exec:\jpjvp.exe32⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ttthhb.exec:\ttthhb.exe33⤵
- Executes dropped EXE
PID:4404 -
\??\c:\bbhtht.exec:\bbhtht.exe34⤵
- Executes dropped EXE
PID:760 -
\??\c:\9lxxrxf.exec:\9lxxrxf.exe35⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nbbnbn.exec:\nbbnbn.exe36⤵
- Executes dropped EXE
PID:3528 -
\??\c:\hhhbtt.exec:\hhhbtt.exe37⤵
- Executes dropped EXE
PID:2896 -
\??\c:\ddvpv.exec:\ddvpv.exe38⤵
- Executes dropped EXE
PID:4452 -
\??\c:\3llfxll.exec:\3llfxll.exe39⤵
- Executes dropped EXE
PID:1788 -
\??\c:\btttnb.exec:\btttnb.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hbbtnn.exec:\hbbtnn.exe41⤵
- Executes dropped EXE
PID:3808 -
\??\c:\ddjvd.exec:\ddjvd.exe42⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xfxxlxl.exec:\xfxxlxl.exe43⤵
- Executes dropped EXE
PID:4408 -
\??\c:\lllfllr.exec:\lllfllr.exe44⤵
- Executes dropped EXE
PID:1196 -
\??\c:\3tbtnh.exec:\3tbtnh.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5jdvv.exec:\5jdvv.exe46⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pjppp.exec:\pjppp.exe47⤵
- Executes dropped EXE
PID:3664 -
\??\c:\rfxlfxr.exec:\rfxlfxr.exe48⤵
- Executes dropped EXE
PID:4860 -
\??\c:\hbbtnh.exec:\hbbtnh.exe49⤵
- Executes dropped EXE
PID:3352 -
\??\c:\5ttnhh.exec:\5ttnhh.exe50⤵
- Executes dropped EXE
PID:4824 -
\??\c:\ppppj.exec:\ppppj.exe51⤵
- Executes dropped EXE
PID:4152 -
\??\c:\rlfxlxr.exec:\rlfxlxr.exe52⤵
- Executes dropped EXE
PID:3120 -
\??\c:\3hthbt.exec:\3hthbt.exe53⤵
- Executes dropped EXE
PID:3648 -
\??\c:\nthbtt.exec:\nthbtt.exe54⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vdpdp.exec:\vdpdp.exe55⤵
- Executes dropped EXE
PID:2084 -
\??\c:\flrfxlf.exec:\flrfxlf.exe56⤵
- Executes dropped EXE
PID:3196 -
\??\c:\htbttt.exec:\htbttt.exe57⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bhbthb.exec:\bhbthb.exe58⤵
- Executes dropped EXE
PID:4936 -
\??\c:\3jdvd.exec:\3jdvd.exe59⤵
- Executes dropped EXE
PID:4964 -
\??\c:\lflfffx.exec:\lflfffx.exe60⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rxfrfxl.exec:\rxfrfxl.exe61⤵
- Executes dropped EXE
PID:4048 -
\??\c:\1ntnhh.exec:\1ntnhh.exe62⤵
- Executes dropped EXE
PID:1768 -
\??\c:\dpvpj.exec:\dpvpj.exe63⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rffrrff.exec:\rffrrff.exe64⤵
- Executes dropped EXE
PID:3720 -
\??\c:\9rlxlfx.exec:\9rlxlfx.exe65⤵
- Executes dropped EXE
PID:4044 -
\??\c:\bnhtnh.exec:\bnhtnh.exe66⤵PID:3384
-
\??\c:\dvpvj.exec:\dvpvj.exe67⤵PID:2380
-
\??\c:\vdjdv.exec:\vdjdv.exe68⤵PID:2156
-
\??\c:\llfxlxl.exec:\llfxlxl.exe69⤵PID:4560
-
\??\c:\tnnntt.exec:\tnnntt.exe70⤵PID:1632
-
\??\c:\vppjd.exec:\vppjd.exe71⤵PID:1832
-
\??\c:\jjdpj.exec:\jjdpj.exe72⤵PID:3192
-
\??\c:\3rllffx.exec:\3rllffx.exe73⤵PID:4276
-
\??\c:\nhnhbt.exec:\nhnhbt.exe74⤵PID:428
-
\??\c:\bthbhh.exec:\bthbhh.exe75⤵PID:4060
-
\??\c:\vdvvj.exec:\vdvvj.exe76⤵PID:800
-
\??\c:\llrlrrx.exec:\llrlrrx.exe77⤵PID:1704
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe78⤵PID:5044
-
\??\c:\3bttnt.exec:\3bttnt.exe79⤵PID:3256
-
\??\c:\vpjvj.exec:\vpjvj.exe80⤵PID:4960
-
\??\c:\dvpdv.exec:\dvpdv.exe81⤵PID:4696
-
\??\c:\lffrlfr.exec:\lffrlfr.exe82⤵PID:4572
-
\??\c:\tbnnhb.exec:\tbnnhb.exe83⤵PID:1040
-
\??\c:\pdjvp.exec:\pdjvp.exe84⤵PID:4452
-
\??\c:\flfrfxr.exec:\flfrfxr.exe85⤵PID:4376
-
\??\c:\htntbn.exec:\htntbn.exe86⤵PID:3576
-
\??\c:\bhhtnh.exec:\bhhtnh.exe87⤵PID:4188
-
\??\c:\jjpjd.exec:\jjpjd.exe88⤵PID:5052
-
\??\c:\1xrflff.exec:\1xrflff.exe89⤵PID:216
-
\??\c:\bhbthh.exec:\bhbthh.exe90⤵PID:3820
-
\??\c:\9jvjv.exec:\9jvjv.exe91⤵PID:2424
-
\??\c:\5vjjp.exec:\5vjjp.exe92⤵PID:3236
-
\??\c:\3lrrlrl.exec:\3lrrlrl.exe93⤵PID:2124
-
\??\c:\1dppj.exec:\1dppj.exe94⤵PID:992
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe95⤵PID:4488
-
\??\c:\9tnbtn.exec:\9tnbtn.exe96⤵PID:4108
-
\??\c:\5vpdd.exec:\5vpdd.exe97⤵PID:2608
-
\??\c:\lrlfrrx.exec:\lrlfrrx.exe98⤵PID:4732
-
\??\c:\tbbtnh.exec:\tbbtnh.exe99⤵PID:4568
-
\??\c:\xlfrfrf.exec:\xlfrfrf.exe100⤵PID:2032
-
\??\c:\tnbthb.exec:\tnbthb.exe101⤵PID:972
-
\??\c:\vvvjd.exec:\vvvjd.exe102⤵PID:3828
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe103⤵PID:4640
-
\??\c:\5bhtht.exec:\5bhtht.exe104⤵PID:3668
-
\??\c:\pjdjp.exec:\pjdjp.exe105⤵PID:1660
-
\??\c:\lffrlff.exec:\lffrlff.exe106⤵PID:3856
-
\??\c:\frlfrlr.exec:\frlfrlr.exe107⤵PID:4124
-
\??\c:\hhbbtt.exec:\hhbbtt.exe108⤵PID:3324
-
\??\c:\djdvj.exec:\djdvj.exe109⤵PID:1844
-
\??\c:\fxxlxrl.exec:\fxxlxrl.exe110⤵PID:868
-
\??\c:\xxxrfxr.exec:\xxxrfxr.exe111⤵PID:4352
-
\??\c:\tbbnbt.exec:\tbbnbt.exe112⤵PID:4624
-
\??\c:\jvpjj.exec:\jvpjj.exe113⤵PID:1812
-
\??\c:\fxlrlfl.exec:\fxlrlfl.exe114⤵PID:4888
-
\??\c:\5hbthb.exec:\5hbthb.exe115⤵PID:4712
-
\??\c:\thnbnh.exec:\thnbnh.exe116⤵PID:3412
-
\??\c:\lxrfxxl.exec:\lxrfxxl.exe117⤵PID:824
-
\??\c:\lrlfxrf.exec:\lrlfxrf.exe118⤵PID:2472
-
\??\c:\thtnbt.exec:\thtnbt.exe119⤵PID:3212
-
\??\c:\djjvd.exec:\djjvd.exe120⤵PID:4236
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe121⤵PID:2760
-
\??\c:\5lffrfr.exec:\5lffrfr.exe122⤵PID:1952
-
\??\c:\bntbnb.exec:\bntbnb.exe123⤵PID:760
-
\??\c:\3jddp.exec:\3jddp.exe124⤵PID:4116
-
\??\c:\3xxlrxl.exec:\3xxlrxl.exe125⤵PID:4476
-
\??\c:\bntnhb.exec:\bntnhb.exe126⤵PID:4468
-
\??\c:\bttnnt.exec:\bttnnt.exe127⤵PID:2996
-
\??\c:\3vdvj.exec:\3vdvj.exe128⤵PID:2356
-
\??\c:\rllrlxx.exec:\rllrlxx.exe129⤵PID:1480
-
\??\c:\lrllffx.exec:\lrllffx.exe130⤵PID:5104
-
\??\c:\jvvjv.exec:\jvvjv.exe131⤵PID:1196
-
\??\c:\ffxrllr.exec:\ffxrllr.exe132⤵PID:1228
-
\??\c:\xrxlxxl.exec:\xrxlxxl.exe133⤵PID:3236
-
\??\c:\hthbth.exec:\hthbth.exe134⤵PID:2124
-
\??\c:\vdpdp.exec:\vdpdp.exe135⤵PID:916
-
\??\c:\rfllrxx.exec:\rfllrxx.exe136⤵PID:4996
-
\??\c:\rrrfxrf.exec:\rrrfxrf.exe137⤵PID:3112
-
\??\c:\bbbnhb.exec:\bbbnhb.exe138⤵PID:3948
-
\??\c:\9pjjv.exec:\9pjjv.exe139⤵PID:3836
-
\??\c:\1ppdd.exec:\1ppdd.exe140⤵PID:1804
-
\??\c:\1fxlxfx.exec:\1fxlxfx.exe141⤵PID:4836
-
\??\c:\vddvj.exec:\vddvj.exe142⤵PID:3660
-
\??\c:\frllrrl.exec:\frllrrl.exe143⤵PID:4372
-
\??\c:\tnbnbh.exec:\tnbnbh.exe144⤵PID:5012
-
\??\c:\5hbnhb.exec:\5hbnhb.exe145⤵PID:5040
-
\??\c:\xfrlfxr.exec:\xfrlfxr.exe146⤵PID:3016
-
\??\c:\bnhtnb.exec:\bnhtnb.exe147⤵PID:4704
-
\??\c:\xllxlfx.exec:\xllxlfx.exe148⤵PID:2728
-
\??\c:\bbthtn.exec:\bbthtn.exe149⤵PID:548
-
\??\c:\jdpjd.exec:\jdpjd.exe150⤵PID:3592
-
\??\c:\vppdp.exec:\vppdp.exe151⤵PID:3224
-
\??\c:\xffrfrl.exec:\xffrfrl.exe152⤵PID:3900
-
\??\c:\bthnbh.exec:\bthnbh.exe153⤵PID:2380
-
\??\c:\bhtthh.exec:\bhtthh.exe154⤵PID:4956
-
\??\c:\jdvjv.exec:\jdvjv.exe155⤵PID:4656
-
\??\c:\7flxrfx.exec:\7flxrfx.exe156⤵PID:2780
-
\??\c:\hnhbtn.exec:\hnhbtn.exe157⤵PID:4924
-
\??\c:\nbbhtn.exec:\nbbhtn.exe158⤵PID:3264
-
\??\c:\vddpv.exec:\vddpv.exe159⤵PID:1636
-
\??\c:\3vvjp.exec:\3vvjp.exe160⤵PID:1856
-
\??\c:\1lffrrf.exec:\1lffrrf.exe161⤵PID:4456
-
\??\c:\hnnbnh.exec:\hnnbnh.exe162⤵PID:3876
-
\??\c:\htbnbt.exec:\htbnbt.exe163⤵PID:4136
-
\??\c:\pvjvj.exec:\pvjvj.exe164⤵PID:4448
-
\??\c:\9fxxrxr.exec:\9fxxrxr.exe165⤵PID:4468
-
\??\c:\rfxlfxl.exec:\rfxlfxl.exe166⤵PID:2700
-
\??\c:\htnbnh.exec:\htnbnh.exe167⤵PID:2736
-
\??\c:\nthnbn.exec:\nthnbn.exe168⤵PID:4832
-
\??\c:\dvpdv.exec:\dvpdv.exe169⤵PID:3400
-
\??\c:\rllfrfl.exec:\rllfrfl.exe170⤵PID:3408
-
\??\c:\hnthnh.exec:\hnthnh.exe171⤵PID:4480
-
\??\c:\ntbbnb.exec:\ntbbnb.exe172⤵PID:3896
-
\??\c:\3dppv.exec:\3dppv.exe173⤵PID:3532
-
\??\c:\frfxrfx.exec:\frfxrfx.exe174⤵PID:3640
-
\??\c:\tnttnn.exec:\tnttnn.exe175⤵PID:4996
-
\??\c:\bhthnh.exec:\bhthnh.exe176⤵PID:4920
-
\??\c:\jpdvj.exec:\jpdvj.exe177⤵PID:696
-
\??\c:\fffrfrf.exec:\fffrfrf.exe178⤵PID:3196
-
\??\c:\3fxxlfr.exec:\3fxxlfr.exe179⤵PID:676
-
\??\c:\bbbnbn.exec:\bbbnbn.exe180⤵PID:2288
-
\??\c:\pdjvp.exec:\pdjvp.exe181⤵PID:4424
-
\??\c:\jvjpj.exec:\jvjpj.exe182⤵PID:2228
-
\??\c:\fxfrfrl.exec:\fxfrfrl.exe183⤵PID:2792
-
\??\c:\hhbnbt.exec:\hhbnbt.exe184⤵PID:2984
-
\??\c:\nhhthb.exec:\nhhthb.exe185⤵PID:2008
-
\??\c:\jdvpd.exec:\jdvpd.exe186⤵PID:2212
-
\??\c:\rxfrfxr.exec:\rxfrfxr.exe187⤵PID:3720
-
\??\c:\lfrrrff.exec:\lfrrrff.exe188⤵PID:4648
-
\??\c:\bnhbth.exec:\bnhbth.exe189⤵PID:3416
-
\??\c:\1ddpd.exec:\1ddpd.exe190⤵PID:4352
-
\??\c:\1lfrlfr.exec:\1lfrlfr.exe191⤵PID:3900
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe192⤵PID:1980
-
\??\c:\tntnnh.exec:\tntnnh.exe193⤵PID:4132
-
\??\c:\pvjvj.exec:\pvjvj.exe194⤵PID:3984
-
\??\c:\xlflfxr.exec:\xlflfxr.exe195⤵PID:1236
-
\??\c:\bttnhh.exec:\bttnhh.exe196⤵PID:4300
-
\??\c:\nnhbth.exec:\nnhbth.exe197⤵PID:3940
-
\??\c:\dpdvj.exec:\dpdvj.exe198⤵PID:2744
-
\??\c:\rfxrfrl.exec:\rfxrfrl.exe199⤵PID:5044
-
\??\c:\tntbtn.exec:\tntbtn.exe200⤵PID:1448
-
\??\c:\nbhthb.exec:\nbhthb.exe201⤵PID:4476
-
\??\c:\ddjdj.exec:\ddjdj.exe202⤵PID:4496
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe203⤵PID:2432
-
\??\c:\llllxrl.exec:\llllxrl.exe204⤵PID:2996
-
\??\c:\nnnhtt.exec:\nnnhtt.exe205⤵PID:3580
-
\??\c:\jvpjv.exec:\jvpjv.exe206⤵PID:3808
-
\??\c:\rllffff.exec:\rllffff.exe207⤵PID:4820
-
\??\c:\3hbnbn.exec:\3hbnbn.exe208⤵PID:2648
-
\??\c:\pppjv.exec:\pppjv.exe209⤵PID:1516
-
\??\c:\dpvvj.exec:\dpvvj.exe210⤵PID:2204
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe211⤵PID:4492
-
\??\c:\hnnbnh.exec:\hnnbnh.exe212⤵PID:948
-
\??\c:\pjjvp.exec:\pjjvp.exe213⤵PID:3948
-
\??\c:\xxlxlfr.exec:\xxlxlfr.exe214⤵PID:2916
-
\??\c:\3xxlxrf.exec:\3xxlxrf.exe215⤵PID:972
-
\??\c:\nbtnbb.exec:\nbtnbb.exe216⤵PID:1340
-
\??\c:\pjjdp.exec:\pjjdp.exe217⤵PID:4640
-
\??\c:\fxlffrx.exec:\fxlffrx.exe218⤵PID:4964
-
\??\c:\lfxlrlx.exec:\lfxlrlx.exe219⤵PID:876
-
\??\c:\nbhtht.exec:\nbhtht.exe220⤵PID:5040
-
\??\c:\7nthhb.exec:\7nthhb.exe221⤵PID:3016
-
\??\c:\djjvd.exec:\djjvd.exe222⤵PID:1456
-
\??\c:\rfxxllf.exec:\rfxxllf.exe223⤵PID:3468
-
\??\c:\hbbtnn.exec:\hbbtnn.exe224⤵PID:1508
-
\??\c:\1bbnbt.exec:\1bbnbt.exe225⤵PID:1016
-
\??\c:\1jdpv.exec:\1jdpv.exe226⤵PID:1048
-
\??\c:\lrxlfxr.exec:\lrxlfxr.exe227⤵PID:4276
-
\??\c:\btbnnh.exec:\btbnnh.exe228⤵PID:4884
-
\??\c:\httnbn.exec:\httnbn.exe229⤵PID:684
-
\??\c:\jvpdp.exec:\jvpdp.exe230⤵PID:1280
-
\??\c:\9vpvj.exec:\9vpvj.exe231⤵PID:4400
-
\??\c:\1xxfrfr.exec:\1xxfrfr.exe232⤵PID:4656
-
\??\c:\9tthnt.exec:\9tthnt.exe233⤵PID:3596
-
\??\c:\jvjvj.exec:\jvjvj.exe234⤵PID:3316
-
\??\c:\5vvpv.exec:\5vvpv.exe235⤵PID:3612
-
\??\c:\flrflfr.exec:\flrflfr.exe236⤵PID:4196
-
\??\c:\rfxlrlx.exec:\rfxlrlx.exe237⤵PID:4848
-
\??\c:\nhhtht.exec:\nhhtht.exe238⤵PID:1632
-
\??\c:\3pjvv.exec:\3pjvv.exe239⤵PID:2744
-
\??\c:\9lfrxrl.exec:\9lfrxrl.exe240⤵PID:4572
-
\??\c:\frlxlxr.exec:\frlxlxr.exe241⤵PID:1448
-
\??\c:\btnhtn.exec:\btnhtn.exe242⤵PID:3696