Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 19:59
Behavioral task
behavioral1
Sample
2adc2fa55c17d19c83717613d5f35dd0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2adc2fa55c17d19c83717613d5f35dd0_NeikiAnalytics.exe
-
Size
340KB
-
MD5
2adc2fa55c17d19c83717613d5f35dd0
-
SHA1
2b7ee74c70061b0df1c79a088e28741e9e2ee2c0
-
SHA256
a6bf0feb8d660c5b6139b051aa3ff135283258924572685ccb3d4bd659d22a2c
-
SHA512
c515e1df1f933d985dfc41efa85fe698e5727b89e90215579f434a47decc365ec88b09b7742ecc694ef19eedaa05f0e93a4f9c5c8d5309989426c201bc175224
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNiy:9cm4FmowdHoS4BtguSPKyHy
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3728-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2128-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/596-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-561-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4132-601-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-679-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-690-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-712-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-759-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-971-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-1041-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-1042-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-1129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vjvpv.exepvppj.exe1xxxrxr.exebbhtbb.exejvppj.exejdjjj.exexrfxxxr.exerxxrllf.exebbbttn.exe5dpjj.exejpppp.exexflfxxr.exenbbtnh.exetbnnnh.exejddvp.exe9ffffll.exebthbhb.exettnbnb.exejddpj.exexxrxrfx.exexxrrlfx.exentbnnn.exejpppj.exefxlflfx.exehthbbb.exevdvvp.exe1jjdp.exerxrlffx.exebbtbtt.exehhnntt.exepjvvd.exevpvdd.exexfrrrff.exethnbhh.exepvpdj.exexflffll.exexxrrfxx.exenhbtnh.exepdddd.exejddvv.exerlxrffl.exentnthn.exeddjjd.exedvdpj.exelrfxxrr.exethtnnt.exehbnhbh.exejpvpj.exevvjpv.exe7xrrlrr.exebnnntt.exethnbbb.exe3pjdp.exevjjjd.exefflrlxx.exerlrllll.exe9hnhnt.exe5pjjj.exeddjjp.exexllrxrr.exe7lxrlrl.exebthbbb.exehnbttb.exejdvpj.exepid process 4360 vjvpv.exe 2392 pvppj.exe 2192 1xxxrxr.exe 2028 bbhtbb.exe 5012 jvppj.exe 5108 jdjjj.exe 2952 xrfxxxr.exe 2972 rxxrllf.exe 4304 bbbttn.exe 2936 5dpjj.exe 4916 jpppp.exe 3784 xflfxxr.exe 596 nbbtnh.exe 5100 tbnnnh.exe 1060 jddvp.exe 4424 9ffffll.exe 5060 bthbhb.exe 3100 ttnbnb.exe 2268 jddpj.exe 1400 xxrxrfx.exe 4872 xxrrlfx.exe 400 ntbnnn.exe 2352 jpppj.exe 3404 fxlflfx.exe 2100 hthbbb.exe 4172 vdvvp.exe 1696 1jjdp.exe 4180 rxrlffx.exe 2712 bbtbtt.exe 3212 hhnntt.exe 4864 pjvvd.exe 1088 vpvdd.exe 3912 xfrrrff.exe 3728 thnbhh.exe 2128 pvpdj.exe 452 xflffll.exe 1408 xxrrfxx.exe 1548 nhbtnh.exe 2872 pdddd.exe 4844 jddvv.exe 432 rlxrffl.exe 4620 ntnthn.exe 2688 ddjjd.exe 3932 dvdpj.exe 4716 lrfxxrr.exe 3704 thtnnt.exe 3068 hbnhbh.exe 4916 jpvpj.exe 948 vvjpv.exe 2448 7xrrlrr.exe 1060 bnnntt.exe 2176 thnbbb.exe 3900 3pjdp.exe 3472 vjjjd.exe 2904 fflrlxx.exe 2268 rlrllll.exe 1400 9hnhnt.exe 4640 5pjjj.exe 400 ddjjp.exe 1388 xllrxrr.exe 1796 7lxrlrl.exe 4072 bthbbb.exe 1884 hnbttb.exe 1564 jdvpj.exe -
Processes:
resource yara_rule behavioral2/memory/4636-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvppj.exe upx C:\1xxxrxr.exe upx \??\c:\bbhtbb.exe upx \??\c:\jvppj.exe upx \??\c:\rxxrllf.exe upx \??\c:\bbbttn.exe upx \??\c:\jpppp.exe upx \??\c:\bthbhb.exe upx \??\c:\jddpj.exe upx \??\c:\xxrrlfx.exe upx behavioral2/memory/3728-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1548-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4640-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2268-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2904-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3472-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4916-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3068-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3932-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4844-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2872-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1408-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/452-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2128-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3912-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1088-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4864-186-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vpvdd.exe upx \??\c:\pjvvd.exe upx behavioral2/memory/2712-175-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhnntt.exe upx behavioral2/memory/4180-169-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbtbtt.exe upx behavioral2/memory/1696-164-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxrlffx.exe upx \??\c:\1jjdp.exe upx \??\c:\vdvvp.exe upx behavioral2/memory/3404-147-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hthbbb.exe upx behavioral2/memory/2352-141-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxlflfx.exe upx behavioral2/memory/400-135-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jpppj.exe upx behavioral2/memory/4872-129-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ntbnnn.exe upx behavioral2/memory/1400-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2268-117-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xxrxrfx.exe upx behavioral2/memory/5060-107-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ttnbnb.exe upx behavioral2/memory/4424-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1060-94-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9ffffll.exe upx behavioral2/memory/5100-88-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jddvp.exe upx behavioral2/memory/596-82-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbnnnh.exe upx \??\c:\nbbtnh.exe upx behavioral2/memory/4916-71-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xflfxxr.exe upx \??\c:\5dpjj.exe upx behavioral2/memory/2972-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2952-49-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2adc2fa55c17d19c83717613d5f35dd0_NeikiAnalytics.exevjvpv.exepvppj.exe1xxxrxr.exebbhtbb.exejvppj.exejdjjj.exexrfxxxr.exerxxrllf.exebbbttn.exe5dpjj.exejpppp.exexflfxxr.exenbbtnh.exetbnnnh.exejddvp.exe9ffffll.exebthbhb.exettnbnb.exejddpj.exexxrxrfx.exexxrrlfx.exedescription pid process target process PID 4636 wrote to memory of 4360 4636 2adc2fa55c17d19c83717613d5f35dd0_NeikiAnalytics.exe vjvpv.exe PID 4636 wrote to memory of 4360 4636 2adc2fa55c17d19c83717613d5f35dd0_NeikiAnalytics.exe vjvpv.exe PID 4636 wrote to memory of 4360 4636 2adc2fa55c17d19c83717613d5f35dd0_NeikiAnalytics.exe vjvpv.exe PID 4360 wrote to memory of 2392 4360 vjvpv.exe pvppj.exe PID 4360 wrote to memory of 2392 4360 vjvpv.exe pvppj.exe PID 4360 wrote to memory of 2392 4360 vjvpv.exe pvppj.exe PID 2392 wrote to memory of 2192 2392 pvppj.exe 1xxxrxr.exe PID 2392 wrote to memory of 2192 2392 pvppj.exe 1xxxrxr.exe PID 2392 wrote to memory of 2192 2392 pvppj.exe 1xxxrxr.exe PID 2192 wrote to memory of 2028 2192 1xxxrxr.exe bbhtbb.exe PID 2192 wrote to memory of 2028 2192 1xxxrxr.exe bbhtbb.exe PID 2192 wrote to memory of 2028 2192 1xxxrxr.exe bbhtbb.exe PID 2028 wrote to memory of 5012 2028 bbhtbb.exe jvppj.exe PID 2028 wrote to memory of 5012 2028 bbhtbb.exe jvppj.exe PID 2028 wrote to memory of 5012 2028 bbhtbb.exe jvppj.exe PID 5012 wrote to memory of 5108 5012 jvppj.exe jdjjj.exe PID 5012 wrote to memory of 5108 5012 jvppj.exe jdjjj.exe PID 5012 wrote to memory of 5108 5012 jvppj.exe jdjjj.exe PID 5108 wrote to memory of 2952 5108 jdjjj.exe xrfxxxr.exe PID 5108 wrote to memory of 2952 5108 jdjjj.exe xrfxxxr.exe PID 5108 wrote to memory of 2952 5108 jdjjj.exe xrfxxxr.exe PID 2952 wrote to memory of 2972 2952 xrfxxxr.exe rxxrllf.exe PID 2952 wrote to memory of 2972 2952 xrfxxxr.exe rxxrllf.exe PID 2952 wrote to memory of 2972 2952 xrfxxxr.exe rxxrllf.exe PID 2972 wrote to memory of 4304 2972 rxxrllf.exe bbbttn.exe PID 2972 wrote to memory of 4304 2972 rxxrllf.exe bbbttn.exe PID 2972 wrote to memory of 4304 2972 rxxrllf.exe bbbttn.exe PID 4304 wrote to memory of 2936 4304 bbbttn.exe 5dpjj.exe PID 4304 wrote to memory of 2936 4304 bbbttn.exe 5dpjj.exe PID 4304 wrote to memory of 2936 4304 bbbttn.exe 5dpjj.exe PID 2936 wrote to memory of 4916 2936 5dpjj.exe jpppp.exe PID 2936 wrote to memory of 4916 2936 5dpjj.exe jpppp.exe PID 2936 wrote to memory of 4916 2936 5dpjj.exe jpppp.exe PID 4916 wrote to memory of 3784 4916 jpppp.exe xflfxxr.exe PID 4916 wrote to memory of 3784 4916 jpppp.exe xflfxxr.exe PID 4916 wrote to memory of 3784 4916 jpppp.exe xflfxxr.exe PID 3784 wrote to memory of 596 3784 xflfxxr.exe nbbtnh.exe PID 3784 wrote to memory of 596 3784 xflfxxr.exe nbbtnh.exe PID 3784 wrote to memory of 596 3784 xflfxxr.exe nbbtnh.exe PID 596 wrote to memory of 5100 596 nbbtnh.exe tbnnnh.exe PID 596 wrote to memory of 5100 596 nbbtnh.exe tbnnnh.exe PID 596 wrote to memory of 5100 596 nbbtnh.exe tbnnnh.exe PID 5100 wrote to memory of 1060 5100 tbnnnh.exe jddvp.exe PID 5100 wrote to memory of 1060 5100 tbnnnh.exe jddvp.exe PID 5100 wrote to memory of 1060 5100 tbnnnh.exe jddvp.exe PID 1060 wrote to memory of 4424 1060 jddvp.exe 9ffffll.exe PID 1060 wrote to memory of 4424 1060 jddvp.exe 9ffffll.exe PID 1060 wrote to memory of 4424 1060 jddvp.exe 9ffffll.exe PID 4424 wrote to memory of 5060 4424 9ffffll.exe bthbhb.exe PID 4424 wrote to memory of 5060 4424 9ffffll.exe bthbhb.exe PID 4424 wrote to memory of 5060 4424 9ffffll.exe bthbhb.exe PID 5060 wrote to memory of 3100 5060 bthbhb.exe ttnbnb.exe PID 5060 wrote to memory of 3100 5060 bthbhb.exe ttnbnb.exe PID 5060 wrote to memory of 3100 5060 bthbhb.exe ttnbnb.exe PID 3100 wrote to memory of 2268 3100 ttnbnb.exe jddpj.exe PID 3100 wrote to memory of 2268 3100 ttnbnb.exe jddpj.exe PID 3100 wrote to memory of 2268 3100 ttnbnb.exe jddpj.exe PID 2268 wrote to memory of 1400 2268 jddpj.exe xxrxrfx.exe PID 2268 wrote to memory of 1400 2268 jddpj.exe xxrxrfx.exe PID 2268 wrote to memory of 1400 2268 jddpj.exe xxrxrfx.exe PID 1400 wrote to memory of 4872 1400 xxrxrfx.exe xxrrlfx.exe PID 1400 wrote to memory of 4872 1400 xxrxrfx.exe xxrrlfx.exe PID 1400 wrote to memory of 4872 1400 xxrxrfx.exe xxrrlfx.exe PID 4872 wrote to memory of 400 4872 xxrrlfx.exe ntbnnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2adc2fa55c17d19c83717613d5f35dd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2adc2fa55c17d19c83717613d5f35dd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\vjvpv.exec:\vjvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\pvppj.exec:\pvppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\1xxxrxr.exec:\1xxxrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\bbhtbb.exec:\bbhtbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\jvppj.exec:\jvppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\jdjjj.exec:\jdjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\xrfxxxr.exec:\xrfxxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\rxxrllf.exec:\rxxrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\bbbttn.exec:\bbbttn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\5dpjj.exec:\5dpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\jpppp.exec:\jpppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\xflfxxr.exec:\xflfxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\nbbtnh.exec:\nbbtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\tbnnnh.exec:\tbnnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\jddvp.exec:\jddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\9ffffll.exec:\9ffffll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\bthbhb.exec:\bthbhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\ttnbnb.exec:\ttnbnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\jddpj.exec:\jddpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\xxrxrfx.exec:\xxrxrfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\xxrrlfx.exec:\xxrrlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\ntbnnn.exec:\ntbnnn.exe23⤵
- Executes dropped EXE
PID:400 -
\??\c:\jpppj.exec:\jpppj.exe24⤵
- Executes dropped EXE
PID:2352 -
\??\c:\fxlflfx.exec:\fxlflfx.exe25⤵
- Executes dropped EXE
PID:3404 -
\??\c:\hthbbb.exec:\hthbbb.exe26⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vdvvp.exec:\vdvvp.exe27⤵
- Executes dropped EXE
PID:4172 -
\??\c:\1jjdp.exec:\1jjdp.exe28⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rxrlffx.exec:\rxrlffx.exe29⤵
- Executes dropped EXE
PID:4180 -
\??\c:\bbtbtt.exec:\bbtbtt.exe30⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hhnntt.exec:\hhnntt.exe31⤵
- Executes dropped EXE
PID:3212 -
\??\c:\pjvvd.exec:\pjvvd.exe32⤵
- Executes dropped EXE
PID:4864 -
\??\c:\vpvdd.exec:\vpvdd.exe33⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xfrrrff.exec:\xfrrrff.exe34⤵
- Executes dropped EXE
PID:3912 -
\??\c:\thnbhh.exec:\thnbhh.exe35⤵
- Executes dropped EXE
PID:3728 -
\??\c:\pvpdj.exec:\pvpdj.exe36⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xflffll.exec:\xflffll.exe37⤵
- Executes dropped EXE
PID:452 -
\??\c:\xxrrfxx.exec:\xxrrfxx.exe38⤵
- Executes dropped EXE
PID:1408 -
\??\c:\nhbtnh.exec:\nhbtnh.exe39⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pdddd.exec:\pdddd.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jddvv.exec:\jddvv.exe41⤵
- Executes dropped EXE
PID:4844 -
\??\c:\rlxrffl.exec:\rlxrffl.exe42⤵
- Executes dropped EXE
PID:432 -
\??\c:\ntnthn.exec:\ntnthn.exe43⤵
- Executes dropped EXE
PID:4620 -
\??\c:\ddjjd.exec:\ddjjd.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dvdpj.exec:\dvdpj.exe45⤵
- Executes dropped EXE
PID:3932 -
\??\c:\lrfxxrr.exec:\lrfxxrr.exe46⤵
- Executes dropped EXE
PID:4716 -
\??\c:\thtnnt.exec:\thtnnt.exe47⤵
- Executes dropped EXE
PID:3704 -
\??\c:\hbnhbh.exec:\hbnhbh.exe48⤵
- Executes dropped EXE
PID:3068 -
\??\c:\jpvpj.exec:\jpvpj.exe49⤵
- Executes dropped EXE
PID:4916 -
\??\c:\vvjpv.exec:\vvjpv.exe50⤵
- Executes dropped EXE
PID:948 -
\??\c:\7xrrlrr.exec:\7xrrlrr.exe51⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bnnntt.exec:\bnnntt.exe52⤵
- Executes dropped EXE
PID:1060 -
\??\c:\thnbbb.exec:\thnbbb.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3pjdp.exec:\3pjdp.exe54⤵
- Executes dropped EXE
PID:3900 -
\??\c:\vjjjd.exec:\vjjjd.exe55⤵
- Executes dropped EXE
PID:3472 -
\??\c:\fflrlxx.exec:\fflrlxx.exe56⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rlrllll.exec:\rlrllll.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\9hnhnt.exec:\9hnhnt.exe58⤵
- Executes dropped EXE
PID:1400 -
\??\c:\5pjjj.exec:\5pjjj.exe59⤵
- Executes dropped EXE
PID:4640 -
\??\c:\ddjjp.exec:\ddjjp.exe60⤵
- Executes dropped EXE
PID:400 -
\??\c:\xllrxrr.exec:\xllrxrr.exe61⤵
- Executes dropped EXE
PID:1388 -
\??\c:\7lxrlrl.exec:\7lxrlrl.exe62⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bthbbb.exec:\bthbbb.exe63⤵
- Executes dropped EXE
PID:4072 -
\??\c:\hnbttb.exec:\hnbttb.exe64⤵
- Executes dropped EXE
PID:1884 -
\??\c:\jdvpj.exec:\jdvpj.exe65⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rllfrrf.exec:\rllfrrf.exe66⤵PID:2296
-
\??\c:\rfrrlrl.exec:\rfrrlrl.exe67⤵PID:3488
-
\??\c:\bthhtt.exec:\bthhtt.exe68⤵PID:2084
-
\??\c:\7vjdv.exec:\7vjdv.exe69⤵PID:632
-
\??\c:\lxxxxrf.exec:\lxxxxrf.exe70⤵PID:3088
-
\??\c:\xfrrlll.exec:\xfrrlll.exe71⤵PID:3196
-
\??\c:\htnnhn.exec:\htnnhn.exe72⤵PID:5056
-
\??\c:\rlffxff.exec:\rlffxff.exe73⤵PID:1472
-
\??\c:\hbnhbn.exec:\hbnhbn.exe74⤵PID:1408
-
\??\c:\dpvpj.exec:\dpvpj.exe75⤵PID:4528
-
\??\c:\xfffxxf.exec:\xfffxxf.exe76⤵PID:4784
-
\??\c:\flxffff.exec:\flxffff.exe77⤵PID:4632
-
\??\c:\bbbnnb.exec:\bbbnnb.exe78⤵PID:432
-
\??\c:\1djjd.exec:\1djjd.exe79⤵PID:1592
-
\??\c:\5ffllrl.exec:\5ffllrl.exe80⤵PID:2360
-
\??\c:\bhtttt.exec:\bhtttt.exe81⤵PID:1908
-
\??\c:\jjvpp.exec:\jjvpp.exe82⤵PID:3384
-
\??\c:\vvddv.exec:\vvddv.exe83⤵PID:3704
-
\??\c:\rlrxrrl.exec:\rlrxrrl.exe84⤵PID:3784
-
\??\c:\hhnhhh.exec:\hhnhhh.exe85⤵PID:4552
-
\??\c:\thhbtb.exec:\thhbtb.exe86⤵PID:4488
-
\??\c:\1vdvv.exec:\1vdvv.exe87⤵PID:2604
-
\??\c:\9fffxfx.exec:\9fffxfx.exe88⤵PID:4304
-
\??\c:\7tbbhh.exec:\7tbbhh.exe89⤵PID:4616
-
\??\c:\nnthhn.exec:\nnthhn.exe90⤵PID:4080
-
\??\c:\vvddp.exec:\vvddp.exe91⤵PID:4004
-
\??\c:\jvjjd.exec:\jvjjd.exe92⤵PID:4804
-
\??\c:\llrrxxf.exec:\llrrxxf.exe93⤵PID:3928
-
\??\c:\thnnnn.exec:\thnnnn.exe94⤵PID:3224
-
\??\c:\jdpjp.exec:\jdpjp.exe95⤵PID:4216
-
\??\c:\7rxrrrl.exec:\7rxrrrl.exe96⤵PID:2852
-
\??\c:\ppppj.exec:\ppppj.exe97⤵PID:380
-
\??\c:\lfflfxx.exec:\lfflfxx.exe98⤵PID:4340
-
\??\c:\bnbbbb.exec:\bnbbbb.exe99⤵PID:3548
-
\??\c:\thtnhh.exec:\thtnhh.exe100⤵PID:1768
-
\??\c:\jpvvv.exec:\jpvvv.exe101⤵PID:1796
-
\??\c:\5frlffx.exec:\5frlffx.exe102⤵PID:4020
-
\??\c:\lflffff.exec:\lflffff.exe103⤵PID:3552
-
\??\c:\bhhbtt.exec:\bhhbtt.exe104⤵PID:1440
-
\??\c:\7jddv.exec:\7jddv.exe105⤵PID:1696
-
\??\c:\lxfxrll.exec:\lxfxrll.exe106⤵PID:2472
-
\??\c:\rfxxxrr.exec:\rfxxxrr.exe107⤵PID:4732
-
\??\c:\hbbhbh.exec:\hbbhbh.exe108⤵PID:1420
-
\??\c:\pjjdv.exec:\pjjdv.exe109⤵PID:3996
-
\??\c:\jvvvp.exec:\jvvvp.exe110⤵PID:3608
-
\??\c:\3lllfll.exec:\3lllfll.exe111⤵PID:2980
-
\??\c:\hbtttn.exec:\hbtttn.exe112⤵PID:2124
-
\??\c:\3nnnhn.exec:\3nnnhn.exe113⤵PID:748
-
\??\c:\vppjd.exec:\vppjd.exe114⤵PID:2220
-
\??\c:\rlrlllr.exec:\rlrlllr.exe115⤵PID:1432
-
\??\c:\5bhhnt.exec:\5bhhnt.exe116⤵PID:3136
-
\??\c:\tbnnhh.exec:\tbnnhh.exe117⤵PID:4060
-
\??\c:\jdvpv.exec:\jdvpv.exe118⤵PID:3124
-
\??\c:\rlxrlrl.exec:\rlxrlrl.exe119⤵PID:4928
-
\??\c:\7hnhbt.exec:\7hnhbt.exe120⤵PID:4960
-
\??\c:\djdjj.exec:\djdjj.exe121⤵PID:1592
-
\??\c:\7jjdv.exec:\7jjdv.exe122⤵PID:4716
-
\??\c:\9rxrffl.exec:\9rxrffl.exe123⤵PID:5012
-
\??\c:\thhbbt.exec:\thhbbt.exe124⤵PID:3068
-
\??\c:\5hnhhh.exec:\5hnhhh.exe125⤵PID:5080
-
\??\c:\dvddd.exec:\dvddd.exe126⤵PID:4728
-
\??\c:\jddjd.exec:\jddjd.exe127⤵PID:1204
-
\??\c:\rrfxrff.exec:\rrfxrff.exe128⤵PID:2604
-
\??\c:\1ttnnn.exec:\1ttnnn.exe129⤵PID:4304
-
\??\c:\vpvvp.exec:\vpvvp.exe130⤵PID:4616
-
\??\c:\1jpjj.exec:\1jpjj.exe131⤵PID:4080
-
\??\c:\rrllflf.exec:\rrllflf.exe132⤵PID:2924
-
\??\c:\nnhnnb.exec:\nnhnnb.exe133⤵PID:3636
-
\??\c:\jdvpj.exec:\jdvpj.exe134⤵PID:3928
-
\??\c:\llffxxx.exec:\llffxxx.exe135⤵PID:4920
-
\??\c:\rllfllr.exec:\rllfllr.exe136⤵PID:4548
-
\??\c:\tbnnhb.exec:\tbnnhb.exe137⤵PID:1520
-
\??\c:\vppdd.exec:\vppdd.exe138⤵PID:3688
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe139⤵PID:1896
-
\??\c:\nttnhh.exec:\nttnhh.exe140⤵PID:3244
-
\??\c:\ththhb.exec:\ththhb.exe141⤵PID:4572
-
\??\c:\vpjdd.exec:\vpjdd.exe142⤵PID:4020
-
\??\c:\dpjdd.exec:\dpjdd.exe143⤵PID:4828
-
\??\c:\frxrlff.exec:\frxrlff.exe144⤵PID:4408
-
\??\c:\bthbnt.exec:\bthbnt.exe145⤵PID:944
-
\??\c:\tntnbh.exec:\tntnbh.exe146⤵PID:2472
-
\??\c:\jvjdv.exec:\jvjdv.exe147⤵PID:4952
-
\??\c:\rxrlrxl.exec:\rxrlrxl.exe148⤵PID:3588
-
\??\c:\nhhbbb.exec:\nhhbbb.exe149⤵PID:3996
-
\??\c:\3nbtth.exec:\3nbtth.exe150⤵PID:3608
-
\??\c:\7pvpj.exec:\7pvpj.exe151⤵PID:2980
-
\??\c:\9xfffll.exec:\9xfffll.exe152⤵PID:2124
-
\??\c:\nnhhtt.exec:\nnhhtt.exe153⤵PID:3852
-
\??\c:\pdpjj.exec:\pdpjj.exe154⤵PID:2028
-
\??\c:\3jdpv.exec:\3jdpv.exe155⤵PID:4352
-
\??\c:\xfxrllf.exec:\xfxrllf.exe156⤵PID:4632
-
\??\c:\hhbbtt.exec:\hhbbtt.exe157⤵PID:2704
-
\??\c:\pjddd.exec:\pjddd.exe158⤵PID:4132
-
\??\c:\7llffff.exec:\7llffff.exe159⤵PID:4936
-
\??\c:\nnbtbb.exec:\nnbtbb.exe160⤵PID:5000
-
\??\c:\3jpjj.exec:\3jpjj.exe161⤵PID:516
-
\??\c:\frfxrrl.exec:\frfxrrl.exe162⤵PID:3724
-
\??\c:\lrlxxrf.exec:\lrlxxrf.exe163⤵PID:560
-
\??\c:\nhhhhb.exec:\nhhhhb.exe164⤵PID:4832
-
\??\c:\tbntnn.exec:\tbntnn.exe165⤵PID:3176
-
\??\c:\jvjpj.exec:\jvjpj.exe166⤵PID:1260
-
\??\c:\rrrrxll.exec:\rrrrxll.exe167⤵PID:4068
-
\??\c:\ppvpd.exec:\ppvpd.exe168⤵PID:4596
-
\??\c:\5xxrllf.exec:\5xxrllf.exe169⤵PID:2788
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe170⤵PID:4988
-
\??\c:\nbhhbh.exec:\nbhhbh.exe171⤵PID:1044
-
\??\c:\pjjdv.exec:\pjjdv.exe172⤵PID:4920
-
\??\c:\5pjdp.exec:\5pjdp.exe173⤵PID:2852
-
\??\c:\ffxxrff.exec:\ffxxrff.exe174⤵PID:3688
-
\??\c:\tnnhhh.exec:\tnnhhh.exe175⤵PID:2592
-
\??\c:\nthbtt.exec:\nthbtt.exe176⤵PID:4572
-
\??\c:\djpjv.exec:\djpjv.exe177⤵PID:4180
-
\??\c:\vjppj.exec:\vjppj.exe178⤵PID:2732
-
\??\c:\rrxrrxx.exec:\rrxrrxx.exe179⤵PID:1116
-
\??\c:\htbhbb.exec:\htbhbb.exe180⤵PID:3876
-
\??\c:\jdvpv.exec:\jdvpv.exe181⤵PID:2084
-
\??\c:\3rrlxxr.exec:\3rrlxxr.exe182⤵PID:3996
-
\??\c:\bntnnn.exec:\bntnnn.exe183⤵PID:3196
-
\??\c:\pdppj.exec:\pdppj.exe184⤵PID:1436
-
\??\c:\jvdjj.exec:\jvdjj.exe185⤵PID:2400
-
\??\c:\9lffxff.exec:\9lffxff.exe186⤵PID:3852
-
\??\c:\rllflff.exec:\rllflff.exe187⤵PID:4528
-
\??\c:\bnhbth.exec:\bnhbth.exe188⤵PID:4352
-
\??\c:\jjjpj.exec:\jjjpj.exe189⤵PID:1724
-
\??\c:\ffrrlrl.exec:\ffrrlrl.exe190⤵PID:2704
-
\??\c:\xrxrrll.exec:\xrxrrll.exe191⤵PID:3960
-
\??\c:\tthhtt.exec:\tthhtt.exe192⤵PID:4936
-
\??\c:\frrllll.exec:\frrllll.exe193⤵PID:5000
-
\??\c:\9flfxxr.exec:\9flfxxr.exe194⤵PID:516
-
\??\c:\bhnhbt.exec:\bhnhbt.exe195⤵PID:3068
-
\??\c:\htbnbh.exec:\htbnbh.exe196⤵PID:560
-
\??\c:\pjjvv.exec:\pjjvv.exe197⤵PID:5100
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe198⤵PID:3176
-
\??\c:\frffffx.exec:\frffffx.exe199⤵PID:1260
-
\??\c:\bhttnt.exec:\bhttnt.exe200⤵PID:4300
-
\??\c:\frxrrrr.exec:\frxrrrr.exe201⤵PID:2436
-
\??\c:\bhtnhh.exec:\bhtnhh.exe202⤵PID:5020
-
\??\c:\jdddd.exec:\jdddd.exe203⤵PID:3064
-
\??\c:\ttbttn.exec:\ttbttn.exe204⤵PID:1660
-
\??\c:\ppvpj.exec:\ppvpj.exe205⤵PID:1100
-
\??\c:\ttbtnh.exec:\ttbtnh.exe206⤵PID:4452
-
\??\c:\jjdjj.exec:\jjdjj.exe207⤵PID:3404
-
\??\c:\9ffxrlf.exec:\9ffxrlf.exe208⤵PID:3584
-
\??\c:\fllfrrl.exec:\fllfrrl.exe209⤵PID:4408
-
\??\c:\nbhbbt.exec:\nbhbbt.exe210⤵PID:4436
-
\??\c:\jvdpj.exec:\jvdpj.exe211⤵PID:884
-
\??\c:\1fffrrl.exec:\1fffrrl.exe212⤵PID:1420
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe213⤵PID:2908
-
\??\c:\thnhnh.exec:\thnhnh.exe214⤵PID:2128
-
\??\c:\vvdjj.exec:\vvdjj.exe215⤵PID:5008
-
\??\c:\ppvpv.exec:\ppvpv.exe216⤵PID:4592
-
\??\c:\xfxlxrf.exec:\xfxlxrf.exe217⤵PID:1084
-
\??\c:\bntnhb.exec:\bntnhb.exe218⤵PID:4332
-
\??\c:\tbhbbb.exec:\tbhbbb.exe219⤵PID:2408
-
\??\c:\djvvv.exec:\djvvv.exe220⤵PID:2244
-
\??\c:\dvpjj.exec:\dvpjj.exe221⤵PID:2704
-
\??\c:\9lxrxfl.exec:\9lxrxfl.exe222⤵PID:4960
-
\??\c:\xxffllx.exec:\xxffllx.exe223⤵PID:4716
-
\??\c:\bnbttn.exec:\bnbttn.exe224⤵PID:5000
-
\??\c:\vvvvd.exec:\vvvvd.exe225⤵PID:4628
-
\??\c:\dpppp.exec:\dpppp.exe226⤵PID:3068
-
\??\c:\9xlfllf.exec:\9xlfllf.exe227⤵PID:560
-
\??\c:\fflllrr.exec:\fflllrr.exe228⤵PID:348
-
\??\c:\bthbhh.exec:\bthbhh.exe229⤵PID:4788
-
\??\c:\5pdvd.exec:\5pdvd.exe230⤵PID:4808
-
\??\c:\jvvpj.exec:\jvvpj.exe231⤵PID:4300
-
\??\c:\3rlxrrl.exec:\3rlxrrl.exe232⤵PID:2436
-
\??\c:\3xrlfff.exec:\3xrlfff.exe233⤵PID:5020
-
\??\c:\btbtbb.exec:\btbtbb.exe234⤵PID:3064
-
\??\c:\nhbtnh.exec:\nhbtnh.exe235⤵PID:3548
-
\??\c:\dvvpp.exec:\dvvpp.exe236⤵PID:384
-
\??\c:\vpddj.exec:\vpddj.exe237⤵PID:3816
-
\??\c:\rfllfff.exec:\rfllfff.exe238⤵PID:2552
-
\??\c:\1nnbhn.exec:\1nnbhn.exe239⤵PID:1492
-
\??\c:\hbthht.exec:\hbthht.exe240⤵PID:4732
-
\??\c:\vpvpj.exec:\vpvpj.exe241⤵PID:632
-
\??\c:\pvdvv.exec:\pvdvv.exe242⤵PID:3736