Analysis
-
max time kernel
150s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 05:13
Behavioral task
behavioral1
Sample
b601dcaac433b95d18b00131a6a60460_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b601dcaac433b95d18b00131a6a60460_NeikiAnalytics.exe
-
Size
75KB
-
MD5
b601dcaac433b95d18b00131a6a60460
-
SHA1
b7e66627da4756b9551b083f8763aaa2a82c762e
-
SHA256
6173646e4a46de34a9fc069ba1a888c683e82e023b722baa8eafa81b6d2c6e2f
-
SHA512
d324e51c18c558da3734af2a8ded0c573e06fccd36a07294e609334dff0f27fcb5020192080e225f4200e0a5433dbd101b93d6d2988f01233f4fff063fb41f30
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE8x:9hOmTsF93UYfwC6GIoutz5yLpOSD7
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3148-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2052-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2072-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/648-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1460-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1256-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3732-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2804-735-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-773-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-786-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-801-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4208-811-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-840-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-931-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-948-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-1237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lflfxxr.exebthhhh.exehhbthh.exe3tnhbb.exedvdvj.exefxrfrrl.exentbbtt.exehbhbhh.exedvvpj.exeffllrrl.exenhbnhb.exevpppj.exefxfxrrr.exetntnnn.exevpppd.exefrrlflf.exenhtnhn.exedjvpp.exe9vvpd.exebhnnnt.exepddvp.exepjvjd.exelrrrfff.exehbttnn.exepdvjp.exerlffllr.exenhnhhb.exe5ddvv.exefxrlxxx.exethbbtt.exejpddp.exexxlfxlx.exefxxxffr.exettnnhh.exe5hbthh.exedpjjj.exehhbttt.exedpddv.exeppvvv.exelrfxffx.exexfffrll.exebnttnn.exejvdvj.exe7nbnht.exexllfxrl.exedvvpp.exefrffflf.exerlllllf.exehntnhh.exejdpjd.exejvjjv.exeffrlflf.exebtnhbb.exethhhtt.exevvddv.exeddvpj.exelxffrrl.exetnhhhh.exe3pvvj.exe9jdvj.exefffxrrr.exenhhbhh.exettttnt.exepdjdj.exepid process 640 lflfxxr.exe 1488 bthhhh.exe 3488 hhbthh.exe 4824 3tnhbb.exe 2456 dvdvj.exe 2052 fxrfrrl.exe 4232 ntbbtt.exe 624 hbhbhh.exe 1824 dvvpj.exe 4272 ffllrrl.exe 2072 nhbnhb.exe 2172 vpppj.exe 3572 fxfxrrr.exe 4912 tntnnn.exe 1196 vpppd.exe 4476 frrlflf.exe 4140 nhtnhn.exe 1812 djvpp.exe 1648 9vvpd.exe 1804 bhnnnt.exe 2312 pddvp.exe 648 pjvjd.exe 5100 lrrrfff.exe 3636 hbttnn.exe 1540 pdvjp.exe 1392 rlffllr.exe 3472 nhnhhb.exe 2860 5ddvv.exe 3340 fxrlxxx.exe 4896 thbbtt.exe 2280 jpddp.exe 3352 xxlfxlx.exe 2192 fxxxffr.exe 388 ttnnhh.exe 1256 5hbthh.exe 1460 dpjjj.exe 3732 hhbttt.exe 4564 dpddv.exe 3400 ppvvv.exe 2208 lrfxffx.exe 3740 xfffrll.exe 4328 bnttnn.exe 3024 jvdvj.exe 468 7nbnht.exe 1652 xllfxrl.exe 4080 dvvpp.exe 4384 frffflf.exe 3964 rlllllf.exe 5072 hntnhh.exe 640 jdpjd.exe 3760 jvjjv.exe 3336 ffrlflf.exe 2544 btnhbb.exe 4156 thhhtt.exe 4668 vvddv.exe 2580 ddvpj.exe 4848 lxffrrl.exe 628 tnhhhh.exe 2776 3pvvj.exe 4804 9jdvj.exe 32 fffxrrr.exe 2796 nhhbhh.exe 3968 ttttnt.exe 4272 pdjdj.exe -
Processes:
resource yara_rule behavioral2/memory/3148-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflfxxr.exe upx behavioral2/memory/3148-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthhhh.exe upx behavioral2/memory/640-13-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhbthh.exe upx C:\3tnhbb.exe upx \??\c:\dvdvj.exe upx \??\c:\fxrfrrl.exe upx behavioral2/memory/2456-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4824-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3488-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1488-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2052-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2052-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ntbbtt.exe upx C:\hbhbhh.exe upx behavioral2/memory/624-51-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvpj.exe upx behavioral2/memory/1824-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4232-49-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffllrrl.exe upx C:\nhbnhb.exe upx behavioral2/memory/4272-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpppj.exe upx behavioral2/memory/2072-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxfxrrr.exe upx behavioral2/memory/2172-77-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tntnnn.exe upx behavioral2/memory/3572-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpppd.exe upx behavioral2/memory/4912-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frrlflf.exe upx behavioral2/memory/4476-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtnhn.exe upx behavioral2/memory/4476-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djvpp.exe upx C:\9vvpd.exe upx behavioral2/memory/1812-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhnnnt.exe upx behavioral2/memory/1648-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1804-125-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pddvp.exe upx behavioral2/memory/2312-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvjd.exe upx C:\lrrrfff.exe upx behavioral2/memory/648-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5100-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3636-143-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbttnn.exe upx C:\pdvjp.exe upx C:\rlffllr.exe upx C:\nhnhhb.exe upx behavioral2/memory/1392-159-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ddvv.exe upx C:\fxrlxxx.exe upx behavioral2/memory/3340-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thbbtt.exe upx behavioral2/memory/4896-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpddp.exe upx \??\c:\xxlfxlx.exe upx behavioral2/memory/3352-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2192-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1460-202-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b601dcaac433b95d18b00131a6a60460_NeikiAnalytics.exelflfxxr.exebthhhh.exehhbthh.exe3tnhbb.exedvdvj.exefxrfrrl.exentbbtt.exehbhbhh.exedvvpj.exeffllrrl.exenhbnhb.exevpppj.exefxfxrrr.exetntnnn.exevpppd.exefrrlflf.exenhtnhn.exedjvpp.exe9vvpd.exebhnnnt.exepddvp.exedescription pid process target process PID 3148 wrote to memory of 640 3148 b601dcaac433b95d18b00131a6a60460_NeikiAnalytics.exe lflfxxr.exe PID 3148 wrote to memory of 640 3148 b601dcaac433b95d18b00131a6a60460_NeikiAnalytics.exe lflfxxr.exe PID 3148 wrote to memory of 640 3148 b601dcaac433b95d18b00131a6a60460_NeikiAnalytics.exe lflfxxr.exe PID 640 wrote to memory of 1488 640 lflfxxr.exe bthhhh.exe PID 640 wrote to memory of 1488 640 lflfxxr.exe bthhhh.exe PID 640 wrote to memory of 1488 640 lflfxxr.exe bthhhh.exe PID 1488 wrote to memory of 3488 1488 bthhhh.exe hhbthh.exe PID 1488 wrote to memory of 3488 1488 bthhhh.exe hhbthh.exe PID 1488 wrote to memory of 3488 1488 bthhhh.exe hhbthh.exe PID 3488 wrote to memory of 4824 3488 hhbthh.exe 3tnhbb.exe PID 3488 wrote to memory of 4824 3488 hhbthh.exe 3tnhbb.exe PID 3488 wrote to memory of 4824 3488 hhbthh.exe 3tnhbb.exe PID 4824 wrote to memory of 2456 4824 3tnhbb.exe dvdvj.exe PID 4824 wrote to memory of 2456 4824 3tnhbb.exe dvdvj.exe PID 4824 wrote to memory of 2456 4824 3tnhbb.exe dvdvj.exe PID 2456 wrote to memory of 2052 2456 dvdvj.exe fxrfrrl.exe PID 2456 wrote to memory of 2052 2456 dvdvj.exe fxrfrrl.exe PID 2456 wrote to memory of 2052 2456 dvdvj.exe fxrfrrl.exe PID 2052 wrote to memory of 4232 2052 fxrfrrl.exe ntbbtt.exe PID 2052 wrote to memory of 4232 2052 fxrfrrl.exe ntbbtt.exe PID 2052 wrote to memory of 4232 2052 fxrfrrl.exe ntbbtt.exe PID 4232 wrote to memory of 624 4232 ntbbtt.exe hbhbhh.exe PID 4232 wrote to memory of 624 4232 ntbbtt.exe hbhbhh.exe PID 4232 wrote to memory of 624 4232 ntbbtt.exe hbhbhh.exe PID 624 wrote to memory of 1824 624 hbhbhh.exe dvvpj.exe PID 624 wrote to memory of 1824 624 hbhbhh.exe dvvpj.exe PID 624 wrote to memory of 1824 624 hbhbhh.exe dvvpj.exe PID 1824 wrote to memory of 4272 1824 dvvpj.exe ffllrrl.exe PID 1824 wrote to memory of 4272 1824 dvvpj.exe ffllrrl.exe PID 1824 wrote to memory of 4272 1824 dvvpj.exe ffllrrl.exe PID 4272 wrote to memory of 2072 4272 ffllrrl.exe nhbnhb.exe PID 4272 wrote to memory of 2072 4272 ffllrrl.exe nhbnhb.exe PID 4272 wrote to memory of 2072 4272 ffllrrl.exe nhbnhb.exe PID 2072 wrote to memory of 2172 2072 nhbnhb.exe vpppj.exe PID 2072 wrote to memory of 2172 2072 nhbnhb.exe vpppj.exe PID 2072 wrote to memory of 2172 2072 nhbnhb.exe vpppj.exe PID 2172 wrote to memory of 3572 2172 vpppj.exe fxfxrrr.exe PID 2172 wrote to memory of 3572 2172 vpppj.exe fxfxrrr.exe PID 2172 wrote to memory of 3572 2172 vpppj.exe fxfxrrr.exe PID 3572 wrote to memory of 4912 3572 fxfxrrr.exe tntnnn.exe PID 3572 wrote to memory of 4912 3572 fxfxrrr.exe tntnnn.exe PID 3572 wrote to memory of 4912 3572 fxfxrrr.exe tntnnn.exe PID 4912 wrote to memory of 1196 4912 tntnnn.exe vpppd.exe PID 4912 wrote to memory of 1196 4912 tntnnn.exe vpppd.exe PID 4912 wrote to memory of 1196 4912 tntnnn.exe vpppd.exe PID 1196 wrote to memory of 4476 1196 vpppd.exe frrlflf.exe PID 1196 wrote to memory of 4476 1196 vpppd.exe frrlflf.exe PID 1196 wrote to memory of 4476 1196 vpppd.exe frrlflf.exe PID 4476 wrote to memory of 4140 4476 frrlflf.exe nhtnhn.exe PID 4476 wrote to memory of 4140 4476 frrlflf.exe nhtnhn.exe PID 4476 wrote to memory of 4140 4476 frrlflf.exe nhtnhn.exe PID 4140 wrote to memory of 1812 4140 nhtnhn.exe djvpp.exe PID 4140 wrote to memory of 1812 4140 nhtnhn.exe djvpp.exe PID 4140 wrote to memory of 1812 4140 nhtnhn.exe djvpp.exe PID 1812 wrote to memory of 1648 1812 djvpp.exe 9vvpd.exe PID 1812 wrote to memory of 1648 1812 djvpp.exe 9vvpd.exe PID 1812 wrote to memory of 1648 1812 djvpp.exe 9vvpd.exe PID 1648 wrote to memory of 1804 1648 9vvpd.exe bhnnnt.exe PID 1648 wrote to memory of 1804 1648 9vvpd.exe bhnnnt.exe PID 1648 wrote to memory of 1804 1648 9vvpd.exe bhnnnt.exe PID 1804 wrote to memory of 2312 1804 bhnnnt.exe pddvp.exe PID 1804 wrote to memory of 2312 1804 bhnnnt.exe pddvp.exe PID 1804 wrote to memory of 2312 1804 bhnnnt.exe pddvp.exe PID 2312 wrote to memory of 648 2312 pddvp.exe pjvjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b601dcaac433b95d18b00131a6a60460_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b601dcaac433b95d18b00131a6a60460_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\lflfxxr.exec:\lflfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\bthhhh.exec:\bthhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\hhbthh.exec:\hhbthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\3tnhbb.exec:\3tnhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\dvdvj.exec:\dvdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\fxrfrrl.exec:\fxrfrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\ntbbtt.exec:\ntbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\hbhbhh.exec:\hbhbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\dvvpj.exec:\dvvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\ffllrrl.exec:\ffllrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\nhbnhb.exec:\nhbnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vpppj.exec:\vpppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\tntnnn.exec:\tntnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\vpppd.exec:\vpppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\frrlflf.exec:\frrlflf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\nhtnhn.exec:\nhtnhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\djvpp.exec:\djvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\9vvpd.exec:\9vvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\bhnnnt.exec:\bhnnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\pddvp.exec:\pddvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\pjvjd.exec:\pjvjd.exe23⤵
- Executes dropped EXE
PID:648 -
\??\c:\lrrrfff.exec:\lrrrfff.exe24⤵
- Executes dropped EXE
PID:5100 -
\??\c:\hbttnn.exec:\hbttnn.exe25⤵
- Executes dropped EXE
PID:3636 -
\??\c:\pdvjp.exec:\pdvjp.exe26⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rlffllr.exec:\rlffllr.exe27⤵
- Executes dropped EXE
PID:1392 -
\??\c:\nhnhhb.exec:\nhnhhb.exe28⤵
- Executes dropped EXE
PID:3472 -
\??\c:\5ddvv.exec:\5ddvv.exe29⤵
- Executes dropped EXE
PID:2860 -
\??\c:\fxrlxxx.exec:\fxrlxxx.exe30⤵
- Executes dropped EXE
PID:3340 -
\??\c:\thbbtt.exec:\thbbtt.exe31⤵
- Executes dropped EXE
PID:4896 -
\??\c:\jpddp.exec:\jpddp.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xxlfxlx.exec:\xxlfxlx.exe33⤵
- Executes dropped EXE
PID:3352 -
\??\c:\fxxxffr.exec:\fxxxffr.exe34⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ttnnhh.exec:\ttnnhh.exe35⤵
- Executes dropped EXE
PID:388 -
\??\c:\5hbthh.exec:\5hbthh.exe36⤵
- Executes dropped EXE
PID:1256 -
\??\c:\dpjjj.exec:\dpjjj.exe37⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hhbttt.exec:\hhbttt.exe38⤵
- Executes dropped EXE
PID:3732 -
\??\c:\dpddv.exec:\dpddv.exe39⤵
- Executes dropped EXE
PID:4564 -
\??\c:\ppvvv.exec:\ppvvv.exe40⤵
- Executes dropped EXE
PID:3400 -
\??\c:\lrfxffx.exec:\lrfxffx.exe41⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xfffrll.exec:\xfffrll.exe42⤵
- Executes dropped EXE
PID:3740 -
\??\c:\bnttnn.exec:\bnttnn.exe43⤵
- Executes dropped EXE
PID:4328 -
\??\c:\jvdvj.exec:\jvdvj.exe44⤵
- Executes dropped EXE
PID:3024 -
\??\c:\7nbnht.exec:\7nbnht.exe45⤵
- Executes dropped EXE
PID:468 -
\??\c:\xllfxrl.exec:\xllfxrl.exe46⤵
- Executes dropped EXE
PID:1652 -
\??\c:\dvvpp.exec:\dvvpp.exe47⤵
- Executes dropped EXE
PID:4080 -
\??\c:\frffflf.exec:\frffflf.exe48⤵
- Executes dropped EXE
PID:4384 -
\??\c:\rlllllf.exec:\rlllllf.exe49⤵
- Executes dropped EXE
PID:3964 -
\??\c:\hntnhh.exec:\hntnhh.exe50⤵
- Executes dropped EXE
PID:5072 -
\??\c:\jdpjd.exec:\jdpjd.exe51⤵
- Executes dropped EXE
PID:640 -
\??\c:\jvjjv.exec:\jvjjv.exe52⤵
- Executes dropped EXE
PID:3760 -
\??\c:\ffrlflf.exec:\ffrlflf.exe53⤵
- Executes dropped EXE
PID:3336 -
\??\c:\btnhbb.exec:\btnhbb.exe54⤵
- Executes dropped EXE
PID:2544 -
\??\c:\thhhtt.exec:\thhhtt.exe55⤵
- Executes dropped EXE
PID:4156 -
\??\c:\vvddv.exec:\vvddv.exe56⤵
- Executes dropped EXE
PID:4668 -
\??\c:\ddvpj.exec:\ddvpj.exe57⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lxffrrl.exec:\lxffrrl.exe58⤵
- Executes dropped EXE
PID:4848 -
\??\c:\tnhhhh.exec:\tnhhhh.exe59⤵
- Executes dropped EXE
PID:628 -
\??\c:\3pvvj.exec:\3pvvj.exe60⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9jdvj.exec:\9jdvj.exe61⤵
- Executes dropped EXE
PID:4804 -
\??\c:\fffxrrr.exec:\fffxrrr.exe62⤵
- Executes dropped EXE
PID:32 -
\??\c:\nhhbhh.exec:\nhhbhh.exe63⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ttttnt.exec:\ttttnt.exe64⤵
- Executes dropped EXE
PID:3968 -
\??\c:\pdjdj.exec:\pdjdj.exe65⤵
- Executes dropped EXE
PID:4272 -
\??\c:\rrxrffx.exec:\rrxrffx.exe66⤵PID:3136
-
\??\c:\rlxxffl.exec:\rlxxffl.exe67⤵PID:2344
-
\??\c:\ttbhbh.exec:\ttbhbh.exe68⤵PID:3160
-
\??\c:\9fxfrrx.exec:\9fxfrrx.exe69⤵PID:1112
-
\??\c:\rlllffr.exec:\rlllffr.exe70⤵PID:2204
-
\??\c:\hnnhbb.exec:\hnnhbb.exe71⤵PID:5088
-
\??\c:\nbnnhn.exec:\nbnnhn.exe72⤵PID:3644
-
\??\c:\vddvp.exec:\vddvp.exe73⤵PID:1892
-
\??\c:\lllfrrl.exec:\lllfrrl.exe74⤵PID:2032
-
\??\c:\bntbbb.exec:\bntbbb.exe75⤵PID:1900
-
\??\c:\3btthh.exec:\3btthh.exe76⤵PID:2940
-
\??\c:\vjpjd.exec:\vjpjd.exe77⤵PID:2808
-
\??\c:\lxfrllf.exec:\lxfrllf.exe78⤵PID:1648
-
\??\c:\3lxrxxf.exec:\3lxrxxf.exe79⤵PID:3588
-
\??\c:\nhbbtt.exec:\nhbbtt.exe80⤵PID:3800
-
\??\c:\tnnhbb.exec:\tnnhbb.exe81⤵PID:2040
-
\??\c:\vjjjd.exec:\vjjjd.exe82⤵PID:1288
-
\??\c:\xxlxrrr.exec:\xxlxrrr.exe83⤵PID:2980
-
\??\c:\tttnht.exec:\tttnht.exe84⤵PID:1340
-
\??\c:\pjppp.exec:\pjppp.exe85⤵PID:4084
-
\??\c:\lxrlxxx.exec:\lxrlxxx.exe86⤵PID:1456
-
\??\c:\flfllff.exec:\flfllff.exe87⤵PID:4436
-
\??\c:\bhbnhh.exec:\bhbnhh.exe88⤵PID:1860
-
\??\c:\ddpjv.exec:\ddpjv.exe89⤵PID:1316
-
\??\c:\djpjj.exec:\djpjj.exe90⤵PID:2292
-
\??\c:\1llfrfx.exec:\1llfrfx.exe91⤵PID:5112
-
\??\c:\lfffrrr.exec:\lfffrrr.exe92⤵PID:2184
-
\??\c:\hhnhhb.exec:\hhnhhb.exe93⤵PID:3440
-
\??\c:\httnhh.exec:\httnhh.exe94⤵PID:688
-
\??\c:\jvvvp.exec:\jvvvp.exe95⤵PID:2316
-
\??\c:\vddvp.exec:\vddvp.exe96⤵PID:2880
-
\??\c:\lfxrxxr.exec:\lfxrxxr.exe97⤵PID:2636
-
\??\c:\nhtnbb.exec:\nhtnbb.exe98⤵PID:3464
-
\??\c:\hhtthb.exec:\hhtthb.exe99⤵PID:1452
-
\??\c:\3pvpp.exec:\3pvpp.exe100⤵PID:1096
-
\??\c:\jjjdd.exec:\jjjdd.exe101⤵PID:4056
-
\??\c:\rxfxffr.exec:\rxfxffr.exe102⤵PID:4592
-
\??\c:\tbhnhh.exec:\tbhnhh.exe103⤵PID:2524
-
\??\c:\nnnhth.exec:\nnnhth.exe104⤵PID:1632
-
\??\c:\vpvvp.exec:\vpvvp.exe105⤵PID:4328
-
\??\c:\rrlfrrr.exec:\rrlfrrr.exe106⤵PID:4416
-
\??\c:\xxxrlrl.exec:\xxxrlrl.exe107⤵PID:4788
-
\??\c:\tnttbt.exec:\tnttbt.exe108⤵PID:4392
-
\??\c:\hbbbnn.exec:\hbbbnn.exe109⤵PID:4380
-
\??\c:\jdvpp.exec:\jdvpp.exe110⤵PID:4740
-
\??\c:\flxrlll.exec:\flxrlll.exe111⤵PID:3148
-
\??\c:\rlrlffx.exec:\rlrlffx.exe112⤵PID:5072
-
\??\c:\ttnhhh.exec:\ttnhhh.exe113⤵PID:4208
-
\??\c:\lrrllfx.exec:\lrrllfx.exe114⤵PID:228
-
\??\c:\fxfxllr.exec:\fxfxllr.exe115⤵PID:4820
-
\??\c:\hbhbhh.exec:\hbhbhh.exe116⤵PID:4424
-
\??\c:\tnnhhh.exec:\tnnhhh.exe117⤵PID:4012
-
\??\c:\dpvvj.exec:\dpvvj.exe118⤵PID:2580
-
\??\c:\vvvpj.exec:\vvvpj.exe119⤵PID:2296
-
\??\c:\fxxrlff.exec:\fxxrlff.exe120⤵PID:4860
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe121⤵PID:5024
-
\??\c:\bntbnt.exec:\bntbnt.exe122⤵PID:4124
-
\??\c:\btbthn.exec:\btbthn.exe123⤵PID:3708
-
\??\c:\pdpjj.exec:\pdpjj.exe124⤵PID:2812
-
\??\c:\jjdvv.exec:\jjdvv.exe125⤵PID:432
-
\??\c:\rlrxffx.exec:\rlrxffx.exe126⤵PID:2020
-
\??\c:\xxfxxrf.exec:\xxfxxrf.exe127⤵PID:2828
-
\??\c:\7thhbt.exec:\7thhbt.exe128⤵PID:4136
-
\??\c:\btbhtt.exec:\btbhtt.exe129⤵PID:5004
-
\??\c:\dppjd.exec:\dppjd.exe130⤵PID:2784
-
\??\c:\pjdvj.exec:\pjdvj.exe131⤵PID:1072
-
\??\c:\rfxlxrr.exec:\rfxlxrr.exe132⤵PID:3600
-
\??\c:\jjvpd.exec:\jjvpd.exe133⤵PID:1028
-
\??\c:\lflffxx.exec:\lflffxx.exe134⤵PID:2608
-
\??\c:\nnbthn.exec:\nnbthn.exe135⤵PID:436
-
\??\c:\pjjdv.exec:\pjjdv.exe136⤵PID:1292
-
\??\c:\rxrrllf.exec:\rxrrllf.exe137⤵PID:456
-
\??\c:\nbhttb.exec:\nbhttb.exe138⤵PID:4356
-
\??\c:\tbntnn.exec:\tbntnn.exe139⤵PID:1416
-
\??\c:\ppvvp.exec:\ppvvp.exe140⤵PID:3088
-
\??\c:\ddjjd.exec:\ddjjd.exe141⤵PID:1540
-
\??\c:\lrxrlrl.exec:\lrxrlrl.exe142⤵PID:1340
-
\??\c:\lfxrlff.exec:\lfxrlff.exe143⤵PID:4908
-
\??\c:\bbhhhh.exec:\bbhhhh.exe144⤵PID:940
-
\??\c:\jdppp.exec:\jdppp.exe145⤵PID:2860
-
\??\c:\vdddv.exec:\vdddv.exe146⤵PID:3632
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe147⤵PID:1316
-
\??\c:\tthbtt.exec:\tthbtt.exe148⤵PID:4040
-
\??\c:\9nbbtt.exec:\9nbbtt.exe149⤵PID:5112
-
\??\c:\vpvjd.exec:\vpvjd.exe150⤵PID:2184
-
\??\c:\dvvvj.exec:\dvvvj.exe151⤵PID:348
-
\??\c:\frllffx.exec:\frllffx.exe152⤵PID:5028
-
\??\c:\7hnhbh.exec:\7hnhbh.exe153⤵PID:2560
-
\??\c:\ddvpp.exec:\ddvpp.exe154⤵PID:1620
-
\??\c:\frllflf.exec:\frllflf.exe155⤵PID:1460
-
\??\c:\xrfffff.exec:\xrfffff.exe156⤵PID:3464
-
\??\c:\tbhbtt.exec:\tbhbtt.exe157⤵PID:1712
-
\??\c:\dvpjj.exec:\dvpjj.exe158⤵PID:2700
-
\??\c:\dvvdp.exec:\dvvdp.exe159⤵PID:1640
-
\??\c:\rlffrrr.exec:\rlffrrr.exe160⤵PID:4148
-
\??\c:\bhtbbb.exec:\bhtbbb.exe161⤵PID:4528
-
\??\c:\hhbbbb.exec:\hhbbbb.exe162⤵PID:1364
-
\??\c:\jdjdv.exec:\jdjdv.exe163⤵PID:1972
-
\??\c:\jdddv.exec:\jdddv.exe164⤵PID:2380
-
\??\c:\3fllxxx.exec:\3fllxxx.exe165⤵PID:1604
-
\??\c:\bnntnh.exec:\bnntnh.exe166⤵PID:4080
-
\??\c:\bntnbb.exec:\bntnbb.exe167⤵PID:4864
-
\??\c:\ppvpv.exec:\ppvpv.exe168⤵PID:3964
-
\??\c:\vjdvj.exec:\vjdvj.exe169⤵PID:4132
-
\??\c:\lfllfxx.exec:\lfllfxx.exe170⤵PID:1536
-
\??\c:\tnnttt.exec:\tnnttt.exe171⤵PID:3468
-
\??\c:\vdddv.exec:\vdddv.exe172⤵PID:2248
-
\??\c:\ppdjd.exec:\ppdjd.exe173⤵PID:3584
-
\??\c:\xxffrrr.exec:\xxffrrr.exe174⤵PID:2276
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe175⤵PID:3912
-
\??\c:\tnnhbb.exec:\tnnhbb.exe176⤵PID:3444
-
\??\c:\djvdd.exec:\djvdd.exe177⤵PID:3868
-
\??\c:\jdvpp.exec:\jdvpp.exe178⤵PID:2776
-
\??\c:\lxffxfx.exec:\lxffxfx.exe179⤵PID:1928
-
\??\c:\nhhhbb.exec:\nhhhbb.exe180⤵PID:4108
-
\??\c:\bbhbht.exec:\bbhbht.exe181⤵PID:4272
-
\??\c:\ddvvj.exec:\ddvvj.exe182⤵PID:3232
-
\??\c:\fxlfrrr.exec:\fxlfrrr.exe183⤵PID:376
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe184⤵PID:3264
-
\??\c:\nttnbn.exec:\nttnbn.exe185⤵PID:2204
-
\??\c:\bntnhh.exec:\bntnhh.exe186⤵PID:4476
-
\??\c:\vpvpj.exec:\vpvpj.exe187⤵PID:1192
-
\??\c:\dppjd.exec:\dppjd.exe188⤵PID:2984
-
\??\c:\ffxxxxf.exec:\ffxxxxf.exe189⤵PID:2032
-
\??\c:\tnhbhh.exec:\tnhbhh.exe190⤵PID:4428
-
\??\c:\tnhhbt.exec:\tnhhbt.exe191⤵PID:2808
-
\??\c:\dpvvp.exec:\dpvvp.exe192⤵PID:396
-
\??\c:\ddddp.exec:\ddddp.exe193⤵PID:1804
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe194⤵PID:920
-
\??\c:\hntnhh.exec:\hntnhh.exe195⤵PID:2016
-
\??\c:\nnnhnn.exec:\nnnhnn.exe196⤵PID:3068
-
\??\c:\vvdvd.exec:\vvdvd.exe197⤵PID:2056
-
\??\c:\pddvp.exec:\pddvp.exe198⤵PID:1532
-
\??\c:\3xxxrrr.exec:\3xxxrrr.exe199⤵PID:1540
-
\??\c:\bbbthh.exec:\bbbthh.exe200⤵PID:1456
-
\??\c:\3hbnhh.exec:\3hbnhh.exe201⤵PID:4436
-
\??\c:\vpdvp.exec:\vpdvp.exe202⤵PID:2804
-
\??\c:\djppp.exec:\djppp.exe203⤵PID:2860
-
\??\c:\fxrlllf.exec:\fxrlllf.exe204⤵PID:3632
-
\??\c:\xlffrlf.exec:\xlffrlf.exe205⤵PID:1316
-
\??\c:\hbtthh.exec:\hbtthh.exe206⤵PID:2460
-
\??\c:\dvpvp.exec:\dvpvp.exe207⤵PID:5112
-
\??\c:\jdjdv.exec:\jdjdv.exe208⤵PID:688
-
\??\c:\lxfxrll.exec:\lxfxrll.exe209⤵PID:2316
-
\??\c:\btnhbt.exec:\btnhbt.exe210⤵PID:2880
-
\??\c:\bhnbth.exec:\bhnbth.exe211⤵PID:2636
-
\??\c:\jvvvv.exec:\jvvvv.exe212⤵PID:1620
-
\??\c:\djdpv.exec:\djdpv.exe213⤵PID:1460
-
\??\c:\7xrlxlf.exec:\7xrlxlf.exe214⤵PID:1096
-
\??\c:\llfxxff.exec:\llfxxff.exe215⤵PID:2208
-
\??\c:\btnhht.exec:\btnhht.exe216⤵PID:4056
-
\??\c:\thtttt.exec:\thtttt.exe217⤵PID:4592
-
\??\c:\pjpjd.exec:\pjpjd.exe218⤵PID:512
-
\??\c:\xfflffx.exec:\xfflffx.exe219⤵PID:3048
-
\??\c:\9fffxxr.exec:\9fffxxr.exe220⤵PID:4416
-
\??\c:\3nbbht.exec:\3nbbht.exe221⤵PID:1784
-
\??\c:\vpppd.exec:\vpppd.exe222⤵PID:2736
-
\??\c:\dvjdp.exec:\dvjdp.exe223⤵PID:996
-
\??\c:\lfrrllf.exec:\lfrrllf.exe224⤵PID:4384
-
\??\c:\xlrlfrl.exec:\xlrlfrl.exe225⤵PID:4132
-
\??\c:\1nttnn.exec:\1nttnn.exe226⤵PID:4208
-
\??\c:\pvddv.exec:\pvddv.exe227⤵PID:1896
-
\??\c:\dvvpp.exec:\dvvpp.exe228⤵PID:4852
-
\??\c:\xrxrffr.exec:\xrxrffr.exe229⤵PID:3584
-
\??\c:\bhttnh.exec:\bhttnh.exe230⤵PID:628
-
\??\c:\bhnnht.exec:\bhnnht.exe231⤵PID:3912
-
\??\c:\dvpjd.exec:\dvpjd.exe232⤵PID:4004
-
\??\c:\lxxrxff.exec:\lxxrxff.exe233⤵PID:3868
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe234⤵PID:2776
-
\??\c:\9bnnhh.exec:\9bnnhh.exe235⤵PID:1436
-
\??\c:\pvjdv.exec:\pvjdv.exe236⤵PID:3428
-
\??\c:\5vdvp.exec:\5vdvp.exe237⤵PID:4728
-
\??\c:\xrrlxll.exec:\xrrlxll.exe238⤵PID:2132
-
\??\c:\tbnbhh.exec:\tbnbhh.exe239⤵PID:4912
-
\??\c:\nhntht.exec:\nhntht.exe240⤵PID:3536
-
\??\c:\vvdvv.exec:\vvdvv.exe241⤵PID:4540
-
\??\c:\3vjjv.exec:\3vjjv.exe242⤵PID:1352