Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7353ce390b294e4fd9328ebeae1c370_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
c7353ce390b294e4fd9328ebeae1c370_NeikiAnalytics.exe
-
Size
449KB
-
MD5
c7353ce390b294e4fd9328ebeae1c370
-
SHA1
4fb6d558eb1331764ece0ea886dc8d77710a2073
-
SHA256
01505bdeef1418fe04427d597cce60b7db6da1af669bee793ec8ed3e16bac82d
-
SHA512
6eaa2698369c5ff9ebd34eca52bbd6de3bc2efeb051ba61e3aa2fcee407c99c9a1d7bf4f60baa8a07995ac1bca4c084d33003885f6c85e2f7cf7da57accc5b1a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeu:q7Tc2NYHUrAwfMp3CDu
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3844-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbnhnn.exevdjdv.exerrxllrr.exe9xxxlxr.exentnhtt.exellxfxlr.exehhnhbb.exe5pdvv.exexrfllrx.exellflfxr.exehnntbh.exevjddd.exe3xlxrrl.exejvjjv.exehtbttt.exe7vjpp.exerxlfflr.exejdddd.exebttthn.exenbtbhn.exedjjdd.exerxfxxff.exenhhhhh.exe1jvvd.exebnbbht.exexfrfrlr.exebnnhbb.exethnhbb.exebhhhbb.exejjppj.exepjvjp.exetbbbtb.exeppppj.exerfffflr.exebbhthn.exefxlfffx.exehnhhnn.exerllfrxr.exebnbbth.exevddvp.exelffffff.exeffxlrxr.exehthhnt.exedpvpj.exerflrfxf.exeddjpp.exepdpjj.exexlfxlfl.exehbhbnb.exexlrlllr.exebthbtb.exevdjjd.exe7xfxrrr.exethbhhh.exedvjpj.exelxrlflf.exe1lffxfx.exenbtntn.exevpdvp.exe3xlllrr.exehhnnhh.exevpppp.exeddppv.exefxlrlrf.exepid process 1832 bbnhnn.exe 2928 vdjdv.exe 3032 rrxllrr.exe 3056 9xxxlxr.exe 4968 ntnhtt.exe 3092 llxfxlr.exe 1328 hhnhbb.exe 1980 5pdvv.exe 4232 xrfllrx.exe 4088 llflfxr.exe 376 hnntbh.exe 2248 vjddd.exe 980 3xlxrrl.exe 640 jvjjv.exe 2976 htbttt.exe 3532 7vjpp.exe 4500 rxlfflr.exe 4032 jdddd.exe 4924 bttthn.exe 4928 nbtbhn.exe 3504 djjdd.exe 4160 rxfxxff.exe 976 nhhhhh.exe 4884 1jvvd.exe 4060 bnbbht.exe 3492 xfrfrlr.exe 3128 bnnhbb.exe 5092 thnhbb.exe 1340 bhhhbb.exe 1736 jjppj.exe 536 pjvjp.exe 3284 tbbbtb.exe 4196 ppppj.exe 2180 rfffflr.exe 1696 bbhthn.exe 4312 fxlfffx.exe 1392 hnhhnn.exe 1464 rllfrxr.exe 4452 bnbbth.exe 4820 vddvp.exe 3152 lffffff.exe 2264 ffxlrxr.exe 1164 hthhnt.exe 3860 dpvpj.exe 2344 rflrfxf.exe 2984 ddjpp.exe 4232 pdpjj.exe 4088 xlfxlfl.exe 376 hbhbnb.exe 3080 xlrlllr.exe 2584 bthbtb.exe 3868 vdjjd.exe 4980 7xfxrrr.exe 3236 thbhhh.exe 1368 dvjpj.exe 4352 lxrlflf.exe 2164 1lffxfx.exe 3612 nbtntn.exe 1380 vpdvp.exe 3656 3xlllrr.exe 3504 hhnnhh.exe 3156 vpppp.exe 3400 ddppv.exe 3004 fxlrlrf.exe -
Processes:
resource yara_rule behavioral2/memory/3844-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-492-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c7353ce390b294e4fd9328ebeae1c370_NeikiAnalytics.exebbnhnn.exevdjdv.exerrxllrr.exe9xxxlxr.exentnhtt.exellxfxlr.exehhnhbb.exe5pdvv.exexrfllrx.exellflfxr.exehnntbh.exevjddd.exe3xlxrrl.exejvjjv.exehtbttt.exe7vjpp.exerxlfflr.exejdddd.exebttthn.exenbtbhn.exedjjdd.exedescription pid process target process PID 3844 wrote to memory of 1832 3844 c7353ce390b294e4fd9328ebeae1c370_NeikiAnalytics.exe bbnhnn.exe PID 3844 wrote to memory of 1832 3844 c7353ce390b294e4fd9328ebeae1c370_NeikiAnalytics.exe bbnhnn.exe PID 3844 wrote to memory of 1832 3844 c7353ce390b294e4fd9328ebeae1c370_NeikiAnalytics.exe bbnhnn.exe PID 1832 wrote to memory of 2928 1832 bbnhnn.exe vdjdv.exe PID 1832 wrote to memory of 2928 1832 bbnhnn.exe vdjdv.exe PID 1832 wrote to memory of 2928 1832 bbnhnn.exe vdjdv.exe PID 2928 wrote to memory of 3032 2928 vdjdv.exe rrxllrr.exe PID 2928 wrote to memory of 3032 2928 vdjdv.exe rrxllrr.exe PID 2928 wrote to memory of 3032 2928 vdjdv.exe rrxllrr.exe PID 3032 wrote to memory of 3056 3032 rrxllrr.exe 9xxxlxr.exe PID 3032 wrote to memory of 3056 3032 rrxllrr.exe 9xxxlxr.exe PID 3032 wrote to memory of 3056 3032 rrxllrr.exe 9xxxlxr.exe PID 3056 wrote to memory of 4968 3056 9xxxlxr.exe ntnhtt.exe PID 3056 wrote to memory of 4968 3056 9xxxlxr.exe ntnhtt.exe PID 3056 wrote to memory of 4968 3056 9xxxlxr.exe ntnhtt.exe PID 4968 wrote to memory of 3092 4968 ntnhtt.exe llxfxlr.exe PID 4968 wrote to memory of 3092 4968 ntnhtt.exe llxfxlr.exe PID 4968 wrote to memory of 3092 4968 ntnhtt.exe llxfxlr.exe PID 3092 wrote to memory of 1328 3092 llxfxlr.exe hhnhbb.exe PID 3092 wrote to memory of 1328 3092 llxfxlr.exe hhnhbb.exe PID 3092 wrote to memory of 1328 3092 llxfxlr.exe hhnhbb.exe PID 1328 wrote to memory of 1980 1328 hhnhbb.exe 5pdvv.exe PID 1328 wrote to memory of 1980 1328 hhnhbb.exe 5pdvv.exe PID 1328 wrote to memory of 1980 1328 hhnhbb.exe 5pdvv.exe PID 1980 wrote to memory of 4232 1980 5pdvv.exe xrfllrx.exe PID 1980 wrote to memory of 4232 1980 5pdvv.exe xrfllrx.exe PID 1980 wrote to memory of 4232 1980 5pdvv.exe xrfllrx.exe PID 4232 wrote to memory of 4088 4232 xrfllrx.exe llflfxr.exe PID 4232 wrote to memory of 4088 4232 xrfllrx.exe llflfxr.exe PID 4232 wrote to memory of 4088 4232 xrfllrx.exe llflfxr.exe PID 4088 wrote to memory of 376 4088 llflfxr.exe hnntbh.exe PID 4088 wrote to memory of 376 4088 llflfxr.exe hnntbh.exe PID 4088 wrote to memory of 376 4088 llflfxr.exe hnntbh.exe PID 376 wrote to memory of 2248 376 hnntbh.exe vjddd.exe PID 376 wrote to memory of 2248 376 hnntbh.exe vjddd.exe PID 376 wrote to memory of 2248 376 hnntbh.exe vjddd.exe PID 2248 wrote to memory of 980 2248 vjddd.exe 3xlxrrl.exe PID 2248 wrote to memory of 980 2248 vjddd.exe 3xlxrrl.exe PID 2248 wrote to memory of 980 2248 vjddd.exe 3xlxrrl.exe PID 980 wrote to memory of 640 980 3xlxrrl.exe jvjjv.exe PID 980 wrote to memory of 640 980 3xlxrrl.exe jvjjv.exe PID 980 wrote to memory of 640 980 3xlxrrl.exe jvjjv.exe PID 640 wrote to memory of 2976 640 jvjjv.exe htbttt.exe PID 640 wrote to memory of 2976 640 jvjjv.exe htbttt.exe PID 640 wrote to memory of 2976 640 jvjjv.exe htbttt.exe PID 2976 wrote to memory of 3532 2976 htbttt.exe 7vjpp.exe PID 2976 wrote to memory of 3532 2976 htbttt.exe 7vjpp.exe PID 2976 wrote to memory of 3532 2976 htbttt.exe 7vjpp.exe PID 3532 wrote to memory of 4500 3532 7vjpp.exe rxlfflr.exe PID 3532 wrote to memory of 4500 3532 7vjpp.exe rxlfflr.exe PID 3532 wrote to memory of 4500 3532 7vjpp.exe rxlfflr.exe PID 4500 wrote to memory of 4032 4500 rxlfflr.exe jdddd.exe PID 4500 wrote to memory of 4032 4500 rxlfflr.exe jdddd.exe PID 4500 wrote to memory of 4032 4500 rxlfflr.exe jdddd.exe PID 4032 wrote to memory of 4924 4032 jdddd.exe bttthn.exe PID 4032 wrote to memory of 4924 4032 jdddd.exe bttthn.exe PID 4032 wrote to memory of 4924 4032 jdddd.exe bttthn.exe PID 4924 wrote to memory of 4928 4924 bttthn.exe nbtbhn.exe PID 4924 wrote to memory of 4928 4924 bttthn.exe nbtbhn.exe PID 4924 wrote to memory of 4928 4924 bttthn.exe nbtbhn.exe PID 4928 wrote to memory of 3504 4928 nbtbhn.exe djjdd.exe PID 4928 wrote to memory of 3504 4928 nbtbhn.exe djjdd.exe PID 4928 wrote to memory of 3504 4928 nbtbhn.exe djjdd.exe PID 3504 wrote to memory of 4160 3504 djjdd.exe rxfxxff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7353ce390b294e4fd9328ebeae1c370_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c7353ce390b294e4fd9328ebeae1c370_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\bbnhnn.exec:\bbnhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\vdjdv.exec:\vdjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rrxllrr.exec:\rrxllrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\9xxxlxr.exec:\9xxxlxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\ntnhtt.exec:\ntnhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\llxfxlr.exec:\llxfxlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\hhnhbb.exec:\hhnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\5pdvv.exec:\5pdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\xrfllrx.exec:\xrfllrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\llflfxr.exec:\llflfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\hnntbh.exec:\hnntbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\vjddd.exec:\vjddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\3xlxrrl.exec:\3xlxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\jvjjv.exec:\jvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\htbttt.exec:\htbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\7vjpp.exec:\7vjpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\rxlfflr.exec:\rxlfflr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\jdddd.exec:\jdddd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\bttthn.exec:\bttthn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\nbtbhn.exec:\nbtbhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\djjdd.exec:\djjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\rxfxxff.exec:\rxfxxff.exe23⤵
- Executes dropped EXE
PID:4160 -
\??\c:\nhhhhh.exec:\nhhhhh.exe24⤵
- Executes dropped EXE
PID:976 -
\??\c:\1jvvd.exec:\1jvvd.exe25⤵
- Executes dropped EXE
PID:4884 -
\??\c:\bnbbht.exec:\bnbbht.exe26⤵
- Executes dropped EXE
PID:4060 -
\??\c:\xfrfrlr.exec:\xfrfrlr.exe27⤵
- Executes dropped EXE
PID:3492 -
\??\c:\bnnhbb.exec:\bnnhbb.exe28⤵
- Executes dropped EXE
PID:3128 -
\??\c:\thnhbb.exec:\thnhbb.exe29⤵
- Executes dropped EXE
PID:5092 -
\??\c:\bhhhbb.exec:\bhhhbb.exe30⤵
- Executes dropped EXE
PID:1340 -
\??\c:\jjppj.exec:\jjppj.exe31⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pjvjp.exec:\pjvjp.exe32⤵
- Executes dropped EXE
PID:536 -
\??\c:\tbbbtb.exec:\tbbbtb.exe33⤵
- Executes dropped EXE
PID:3284 -
\??\c:\ppppj.exec:\ppppj.exe34⤵
- Executes dropped EXE
PID:4196 -
\??\c:\rfffflr.exec:\rfffflr.exe35⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bbhthn.exec:\bbhthn.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fxlfffx.exec:\fxlfffx.exe37⤵
- Executes dropped EXE
PID:4312 -
\??\c:\hnhhnn.exec:\hnhhnn.exe38⤵
- Executes dropped EXE
PID:1392 -
\??\c:\rllfrxr.exec:\rllfrxr.exe39⤵
- Executes dropped EXE
PID:1464 -
\??\c:\bnbbth.exec:\bnbbth.exe40⤵
- Executes dropped EXE
PID:4452 -
\??\c:\vddvp.exec:\vddvp.exe41⤵
- Executes dropped EXE
PID:4820 -
\??\c:\lffffff.exec:\lffffff.exe42⤵
- Executes dropped EXE
PID:3152 -
\??\c:\ffxlrxr.exec:\ffxlrxr.exe43⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hthhnt.exec:\hthhnt.exe44⤵
- Executes dropped EXE
PID:1164 -
\??\c:\dpvpj.exec:\dpvpj.exe45⤵
- Executes dropped EXE
PID:3860 -
\??\c:\rflrfxf.exec:\rflrfxf.exe46⤵
- Executes dropped EXE
PID:2344 -
\??\c:\ddjpp.exec:\ddjpp.exe47⤵
- Executes dropped EXE
PID:2984 -
\??\c:\pdpjj.exec:\pdpjj.exe48⤵
- Executes dropped EXE
PID:4232 -
\??\c:\xlfxlfl.exec:\xlfxlfl.exe49⤵
- Executes dropped EXE
PID:4088 -
\??\c:\hbhbnb.exec:\hbhbnb.exe50⤵
- Executes dropped EXE
PID:376 -
\??\c:\xlrlllr.exec:\xlrlllr.exe51⤵
- Executes dropped EXE
PID:3080 -
\??\c:\bthbtb.exec:\bthbtb.exe52⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vdjjd.exec:\vdjjd.exe53⤵
- Executes dropped EXE
PID:3868 -
\??\c:\7xfxrrr.exec:\7xfxrrr.exe54⤵
- Executes dropped EXE
PID:4980 -
\??\c:\thbhhh.exec:\thbhhh.exe55⤵
- Executes dropped EXE
PID:3236 -
\??\c:\dvjpj.exec:\dvjpj.exe56⤵
- Executes dropped EXE
PID:1368 -
\??\c:\lxrlflf.exec:\lxrlflf.exe57⤵
- Executes dropped EXE
PID:4352 -
\??\c:\1lffxfx.exec:\1lffxfx.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nbtntn.exec:\nbtntn.exe59⤵
- Executes dropped EXE
PID:3612 -
\??\c:\vpdvp.exec:\vpdvp.exe60⤵
- Executes dropped EXE
PID:1380 -
\??\c:\3xlllrr.exec:\3xlllrr.exe61⤵
- Executes dropped EXE
PID:3656 -
\??\c:\hhnnhh.exec:\hhnnhh.exe62⤵
- Executes dropped EXE
PID:3504 -
\??\c:\vpppp.exec:\vpppp.exe63⤵
- Executes dropped EXE
PID:3156 -
\??\c:\ddppv.exec:\ddppv.exe64⤵
- Executes dropped EXE
PID:3400 -
\??\c:\fxlrlrf.exec:\fxlrlrf.exe65⤵
- Executes dropped EXE
PID:3004 -
\??\c:\5hnnnn.exec:\5hnnnn.exe66⤵PID:1704
-
\??\c:\rlllffr.exec:\rlllffr.exe67⤵PID:4024
-
\??\c:\3bnbbn.exec:\3bnbbn.exe68⤵PID:3924
-
\??\c:\jpjpd.exec:\jpjpd.exe69⤵PID:3008
-
\??\c:\fffxrrr.exec:\fffxrrr.exe70⤵PID:2500
-
\??\c:\hbnthh.exec:\hbnthh.exe71⤵PID:4660
-
\??\c:\xxfxlfr.exec:\xxfxlfr.exe72⤵PID:2864
-
\??\c:\bnbnbt.exec:\bnbnbt.exe73⤵PID:4908
-
\??\c:\pdjvd.exec:\pdjvd.exe74⤵PID:4832
-
\??\c:\ffrfrff.exec:\ffrfrff.exe75⤵PID:4028
-
\??\c:\thnnhb.exec:\thnnhb.exe76⤵PID:4724
-
\??\c:\jjvjd.exec:\jjvjd.exe77⤵PID:1200
-
\??\c:\frllfff.exec:\frllfff.exe78⤵PID:4564
-
\??\c:\bbnthh.exec:\bbnthh.exe79⤵PID:4728
-
\??\c:\xlfxflr.exec:\xlfxflr.exe80⤵PID:4796
-
\??\c:\tbhhbh.exec:\tbhhbh.exe81⤵PID:4324
-
\??\c:\pvjdv.exec:\pvjdv.exe82⤵PID:1392
-
\??\c:\xrrxlrx.exec:\xrrxlrx.exe83⤵PID:2988
-
\??\c:\bhbbht.exec:\bhbbht.exe84⤵PID:5008
-
\??\c:\7jppj.exec:\7jppj.exe85⤵PID:1212
-
\??\c:\jvpjv.exec:\jvpjv.exe86⤵PID:3832
-
\??\c:\lxllfxr.exec:\lxllfxr.exe87⤵PID:3108
-
\??\c:\btthth.exec:\btthth.exe88⤵PID:2264
-
\??\c:\vppdv.exec:\vppdv.exe89⤵PID:1164
-
\??\c:\rrffxlf.exec:\rrffxlf.exe90⤵PID:3960
-
\??\c:\tnhbht.exec:\tnhbht.exe91⤵PID:1980
-
\??\c:\pvpvd.exec:\pvpvd.exe92⤵PID:4344
-
\??\c:\lffrlrl.exec:\lffrlrl.exe93⤵PID:3220
-
\??\c:\9tthbn.exec:\9tthbn.exe94⤵PID:2756
-
\??\c:\dvpjp.exec:\dvpjp.exe95⤵PID:1352
-
\??\c:\flxrrll.exec:\flxrrll.exe96⤵PID:4740
-
\??\c:\httnhh.exec:\httnhh.exe97⤵PID:1144
-
\??\c:\nnnhbt.exec:\nnnhbt.exe98⤵PID:2584
-
\??\c:\pddvv.exec:\pddvv.exe99⤵PID:3868
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe100⤵PID:1552
-
\??\c:\xfrlfxr.exec:\xfrlfxr.exe101⤵PID:4124
-
\??\c:\htnhbb.exec:\htnhbb.exe102⤵PID:4500
-
\??\c:\vdjjd.exec:\vdjjd.exe103⤵PID:2808
-
\??\c:\3rrlxxr.exec:\3rrlxxr.exe104⤵PID:2360
-
\??\c:\ntnbhh.exec:\ntnbhh.exe105⤵PID:2672
-
\??\c:\dppvv.exec:\dppvv.exe106⤵PID:3980
-
\??\c:\rrfxllf.exec:\rrfxllf.exe107⤵PID:3228
-
\??\c:\hbtthh.exec:\hbtthh.exe108⤵PID:4160
-
\??\c:\nbhtnn.exec:\nbhtnn.exe109⤵PID:3872
-
\??\c:\pjdvv.exec:\pjdvv.exe110⤵PID:2228
-
\??\c:\lrxrfll.exec:\lrxrfll.exe111⤵PID:1356
-
\??\c:\nbnhhb.exec:\nbnhhb.exe112⤵PID:2880
-
\??\c:\jddvj.exec:\jddvj.exe113⤵PID:4800
-
\??\c:\3jjvj.exec:\3jjvj.exe114⤵PID:4660
-
\??\c:\xflxlfx.exec:\xflxlfx.exe115⤵PID:2864
-
\??\c:\1nhbtb.exec:\1nhbtb.exe116⤵PID:1372
-
\??\c:\jvdjv.exec:\jvdjv.exe117⤵PID:1828
-
\??\c:\ppdpp.exec:\ppdpp.exe118⤵PID:2908
-
\??\c:\xxrlffx.exec:\xxrlffx.exe119⤵PID:2372
-
\??\c:\hhnnht.exec:\hhnnht.exe120⤵PID:3952
-
\??\c:\jddvp.exec:\jddvp.exe121⤵PID:4728
-
\??\c:\llrrrxf.exec:\llrrrxf.exe122⤵PID:3808
-
\??\c:\bhnnhb.exec:\bhnnhb.exe123⤵PID:4592
-
\??\c:\ppdvd.exec:\ppdvd.exe124⤵PID:1784
-
\??\c:\xllrfll.exec:\xllrfll.exe125⤵PID:828
-
\??\c:\rflfffl.exec:\rflfffl.exe126⤵PID:4452
-
\??\c:\hbhtht.exec:\hbhtht.exe127⤵PID:3408
-
\??\c:\pjppj.exec:\pjppj.exe128⤵PID:3832
-
\??\c:\ffrllll.exec:\ffrllll.exe129⤵PID:4300
-
\??\c:\7bhbhh.exec:\7bhbhh.exe130⤵PID:2316
-
\??\c:\vvvpv.exec:\vvvpv.exe131⤵PID:1332
-
\??\c:\thnnbb.exec:\thnnbb.exe132⤵PID:2092
-
\??\c:\dvvdv.exec:\dvvdv.exe133⤵PID:3772
-
\??\c:\lrxrrrf.exec:\lrxrrrf.exe134⤵PID:3944
-
\??\c:\7ttttt.exec:\7ttttt.exe135⤵PID:4892
-
\??\c:\ppdvp.exec:\ppdvp.exe136⤵PID:5024
-
\??\c:\1tbttn.exec:\1tbttn.exe137⤵PID:1912
-
\??\c:\jppjv.exec:\jppjv.exe138⤵PID:2796
-
\??\c:\nhbbhh.exec:\nhbbhh.exe139⤵PID:5036
-
\??\c:\pjvjp.exec:\pjvjp.exe140⤵PID:464
-
\??\c:\xlxxxlf.exec:\xlxxxlf.exe141⤵PID:3920
-
\??\c:\tbbhbh.exec:\tbbhbh.exe142⤵PID:2920
-
\??\c:\9jdvp.exec:\9jdvp.exe143⤵PID:4012
-
\??\c:\1rffllf.exec:\1rffllf.exe144⤵PID:4868
-
\??\c:\thbtbb.exec:\thbtbb.exe145⤵PID:4920
-
\??\c:\djpjj.exec:\djpjj.exe146⤵PID:3204
-
\??\c:\1ffrrlr.exec:\1ffrrlr.exe147⤵PID:4632
-
\??\c:\tbnnhb.exec:\tbnnhb.exe148⤵PID:3888
-
\??\c:\vjvvj.exec:\vjvvj.exe149⤵PID:4008
-
\??\c:\xfxlfxx.exec:\xfxlfxx.exe150⤵PID:5108
-
\??\c:\nthbht.exec:\nthbht.exe151⤵PID:2628
-
\??\c:\jjppv.exec:\jjppv.exe152⤵PID:3356
-
\??\c:\lrfxrlf.exec:\lrfxrlf.exe153⤵PID:4828
-
\??\c:\hnbbtt.exec:\hnbbtt.exe154⤵PID:3432
-
\??\c:\9tntnt.exec:\9tntnt.exe155⤵PID:1112
-
\??\c:\pdvpd.exec:\pdvpd.exe156⤵PID:4876
-
\??\c:\5ffxrlf.exec:\5ffxrlf.exe157⤵PID:4376
-
\??\c:\9bnbbb.exec:\9bnbbb.exe158⤵PID:1492
-
\??\c:\vvvjd.exec:\vvvjd.exe159⤵PID:320
-
\??\c:\frrxfrx.exec:\frrxfrx.exe160⤵PID:2180
-
\??\c:\tnttnn.exec:\tnttnn.exe161⤵PID:1780
-
\??\c:\djjjp.exec:\djjjp.exe162⤵PID:4956
-
\??\c:\1ffxxff.exec:\1ffxxff.exe163⤵PID:4372
-
\??\c:\xfxrxrr.exec:\xfxrxrr.exe164⤵PID:1360
-
\??\c:\thtttt.exec:\thtttt.exe165⤵PID:380
-
\??\c:\5jjjd.exec:\5jjjd.exe166⤵PID:5008
-
\??\c:\rlllfff.exec:\rlllfff.exe167⤵PID:4392
-
\??\c:\bthbhh.exec:\bthbhh.exe168⤵PID:4056
-
\??\c:\nntttt.exec:\nntttt.exe169⤵PID:3408
-
\??\c:\1vpjj.exec:\1vpjj.exe170⤵PID:2768
-
\??\c:\xffxlrl.exec:\xffxlrl.exe171⤵PID:4300
-
\??\c:\7hhbtt.exec:\7hhbtt.exe172⤵PID:2720
-
\??\c:\pdpdd.exec:\pdpdd.exe173⤵PID:1332
-
\??\c:\rllfxrr.exec:\rllfxrr.exe174⤵PID:4344
-
\??\c:\ntttnn.exec:\ntttnn.exe175⤵PID:3220
-
\??\c:\bnnhtb.exec:\bnnhtb.exe176⤵PID:4016
-
\??\c:\pdpjv.exec:\pdpjv.exe177⤵PID:4892
-
\??\c:\ntthnt.exec:\ntthnt.exe178⤵PID:4904
-
\??\c:\vvvvv.exec:\vvvvv.exe179⤵PID:3928
-
\??\c:\rlfxffl.exec:\rlfxffl.exe180⤵PID:2816
-
\??\c:\xrrfxll.exec:\xrrfxll.exe181⤵PID:464
-
\??\c:\tbbntb.exec:\tbbntb.exe182⤵PID:3920
-
\??\c:\pjdvp.exec:\pjdvp.exe183⤵PID:1996
-
\??\c:\lrxrflr.exec:\lrxrflr.exe184⤵PID:4012
-
\??\c:\tnnnnn.exec:\tnnnnn.exe185⤵PID:4568
-
\??\c:\jppjd.exec:\jppjd.exe186⤵PID:1908
-
\??\c:\lrrrrlr.exec:\lrrrrlr.exe187⤵PID:936
-
\??\c:\ntnbtn.exec:\ntnbtn.exe188⤵PID:4632
-
\??\c:\thhhbb.exec:\thhhbb.exe189⤵PID:3412
-
\??\c:\pjvpj.exec:\pjvpj.exe190⤵PID:3756
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe191⤵PID:2812
-
\??\c:\tbnhhh.exec:\tbnhhh.exe192⤵PID:2628
-
\??\c:\jjdpj.exec:\jjdpj.exe193⤵PID:1628
-
\??\c:\vpjdv.exec:\vpjdv.exe194⤵PID:1612
-
\??\c:\5rlfxxx.exec:\5rlfxxx.exe195⤵PID:4188
-
\??\c:\hbnnbb.exec:\hbnnbb.exe196⤵PID:3164
-
\??\c:\jpdpd.exec:\jpdpd.exe197⤵PID:4816
-
\??\c:\dddjd.exec:\dddjd.exe198⤵PID:808
-
\??\c:\3xxrffx.exec:\3xxrffx.exe199⤵PID:3496
-
\??\c:\hnbnnn.exec:\hnbnnn.exe200⤵PID:3284
-
\??\c:\5pvpp.exec:\5pvpp.exe201⤵PID:4564
-
\??\c:\fxfxlfx.exec:\fxfxlfx.exe202⤵PID:5044
-
\??\c:\htnttt.exec:\htnttt.exe203⤵PID:1844
-
\??\c:\vvjdp.exec:\vvjdp.exe204⤵PID:2520
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe205⤵PID:4648
-
\??\c:\bhhtht.exec:\bhhtht.exe206⤵PID:4324
-
\??\c:\dvpjp.exec:\dvpjp.exe207⤵PID:1392
-
\??\c:\pjpvj.exec:\pjpvj.exe208⤵PID:4372
-
\??\c:\1llfrrr.exec:\1llfrrr.exe209⤵PID:1608
-
\??\c:\nhhhbb.exec:\nhhhbb.exe210⤵PID:4820
-
\??\c:\jvjdv.exec:\jvjdv.exe211⤵PID:3752
-
\??\c:\rlxrxfx.exec:\rlxrxfx.exe212⤵PID:4392
-
\??\c:\5ntthh.exec:\5ntthh.exe213⤵PID:1404
-
\??\c:\vjdpd.exec:\vjdpd.exe214⤵PID:5020
-
\??\c:\fxfrxrf.exec:\fxfrxrf.exe215⤵PID:2316
-
\??\c:\3bnbtn.exec:\3bnbtn.exe216⤵PID:4300
-
\??\c:\vppjd.exec:\vppjd.exe217⤵PID:2984
-
\??\c:\xrffxxr.exec:\xrffxxr.exe218⤵PID:4512
-
\??\c:\tnhhbb.exec:\tnhhbb.exe219⤵PID:4840
-
\??\c:\dpddv.exec:\dpddv.exe220⤵PID:3220
-
\??\c:\llfxrlf.exec:\llfxrlf.exe221⤵PID:1700
-
\??\c:\hhhbtt.exec:\hhhbtt.exe222⤵PID:4892
-
\??\c:\ppdpd.exec:\ppdpd.exe223⤵PID:980
-
\??\c:\lxfxlxl.exec:\lxfxlxl.exe224⤵PID:5036
-
\??\c:\hhnhht.exec:\hhnhht.exe225⤵PID:4360
-
\??\c:\7vvpj.exec:\7vvpj.exe226⤵PID:1764
-
\??\c:\lrrfrrl.exec:\lrrfrrl.exe227⤵PID:2920
-
\??\c:\thhhbt.exec:\thhhbt.exe228⤵PID:4352
-
\??\c:\hnbbnh.exec:\hnbbnh.exe229⤵PID:4032
-
\??\c:\ppjdv.exec:\ppjdv.exe230⤵PID:2884
-
\??\c:\llflxrx.exec:\llflxrx.exe231⤵PID:4964
-
\??\c:\bbhbbt.exec:\bbhbbt.exe232⤵PID:3740
-
\??\c:\9jvvp.exec:\9jvvp.exe233⤵PID:4060
-
\??\c:\dpppd.exec:\dpppd.exe234⤵PID:3908
-
\??\c:\xfrlxff.exec:\xfrlxff.exe235⤵PID:4024
-
\??\c:\3hnbnh.exec:\3hnbnh.exe236⤵PID:740
-
\??\c:\jvpjv.exec:\jvpjv.exe237⤵PID:2500
-
\??\c:\3vpjj.exec:\3vpjj.exe238⤵PID:1136
-
\??\c:\frxrxff.exec:\frxrxff.exe239⤵PID:1612
-
\??\c:\ntnnhn.exec:\ntnnhn.exe240⤵PID:3448
-
\??\c:\dvjdp.exec:\dvjdp.exe241⤵PID:4028
-
\??\c:\lllflfr.exec:\lllflfr.exe242⤵PID:536