Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 00:00
Behavioral task
behavioral1
Sample
5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe
-
Size
380KB
-
MD5
5b92f2427a5f93964fe212e9de9e57c0
-
SHA1
fb2db1205ec31fa018bca8bf442fb0079d243d30
-
SHA256
0d9407c8ca4f9e784de928b19a0e5db1ca585c4eba052cc4731ddb42dc88a446
-
SHA512
4e156955cd9b959aea88c505626f915521e817b2debbea7ba0b061bc542796be084e8d3722bc98dff3979208788b9e89183d063971648f8f08ec8aff1fb1226c
-
SSDEEP
6144:Ocm4FmowdHoSsm4FIc1/cm4FmowdHoSsiNlcJcmHYC9/jvvfwL+TLPfSRcm4FVoM:w4wFHoSl4h4wFHoS24yTgL+zfu4/FHoE
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2692-7-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2468-16-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4872-138-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1108-236-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3100-260-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3008-280-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3496-421-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1880-437-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3680-433-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2700-427-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2320-423-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3660-417-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4124-413-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4308-407-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1900-405-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1852-401-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2096-397-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1892-391-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3532-387-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2984-385-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4852-381-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2788-377-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3156-371-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4900-367-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4088-365-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3220-361-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/536-357-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3472-353-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2084-349-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1908-347-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4628-341-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1104-336-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1476-330-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2280-328-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3620-322-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3304-320-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1768-316-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3412-310-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/228-308-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2404-302-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3864-300-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1316-296-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3868-290-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1516-288-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3836-284-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2096-276-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3532-270-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2764-268-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1580-262-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1180-256-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4728-250-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3860-248-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5048-242-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3604-240-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1188-230-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4304-226-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1720-224-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2084-218-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3792-216-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4592-212-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1620-206-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1476-203-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/400-200-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4164-188-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2468 thhbbb.exe 1720 dvvvv.exe 232 rxllrrr.exe 536 xxxlfrr.exe 1108 bhnhbb.exe 672 ppppp.exe 5048 pdjdv.exe 4716 ffrrrrr.exe 2956 xllllll.exe 4424 hhbbbt.exe 3088 dpddd.exe 852 5ppjd.exe 380 llflrlx.exe 3972 9tbbbb.exe 788 9nnnhn.exe 3772 vjvvp.exe 3008 rflfflr.exe 1216 lfrllxx.exe 3516 ttbbbn.exe 1000 ttbtbn.exe 4872 vdjdv.exe 3136 rflrrrr.exe 3564 rlrlffx.exe 2340 tbhbtt.exe 3312 vpddj.exe 1604 vjjjd.exe 2540 rrrlfff.exe 1560 nhnnnn.exe 2244 hhttnn.exe 4164 pjdpd.exe 400 lflllxx.exe 1476 bbhntt.exe 1620 ntbtbt.exe 4592 jvdpd.exe 3792 xrfrxrr.exe 2084 ntttnn.exe 1720 tnbthh.exe 4304 1jpjj.exe 1188 9xrfxrf.exe 1108 7lrlffx.exe 3604 btttbt.exe 5048 vdjdv.exe 3860 9rffrrr.exe 4728 lfxrxxf.exe 1180 tnnbtn.exe 3100 pddvp.exe 1580 9xxrlfl.exe 2764 llrlxxr.exe 3532 bhttnt.exe 2096 5vjjp.exe 3008 dpdvv.exe 3836 fxfxxxr.exe 1516 nthhhh.exe 3868 5vjdv.exe 1316 vppjd.exe 3864 rlxlxxx.exe 2404 7hnnhh.exe 228 btbtbb.exe 3412 jvvvj.exe 1768 rfrlrlr.exe 3304 hhnhhb.exe 3620 htbnnn.exe 2280 5jjdv.exe 1476 rrxxlfx.exe -
resource yara_rule behavioral2/memory/2692-0-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x00090000000235bb-3.dat upx behavioral2/memory/2692-7-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2468-8-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x00070000000235c2-11.dat upx behavioral2/files/0x00070000000235c3-12.dat upx behavioral2/memory/2468-16-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x00070000000235c6-38.dat upx behavioral2/files/0x00070000000235ca-62.dat upx behavioral2/files/0x00070000000235cc-74.dat upx behavioral2/files/0x00070000000235d4-122.dat upx behavioral2/memory/4872-138-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x00070000000235dc-168.dat upx behavioral2/files/0x00070000000235e0-194.dat upx behavioral2/memory/1108-236-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3100-260-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3008-280-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3496-421-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1880-437-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3680-433-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2700-427-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2320-423-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3660-417-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4124-413-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4308-407-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1900-405-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1852-401-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2096-397-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1892-391-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3532-387-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2984-385-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4852-381-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2788-377-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3156-371-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4900-367-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4088-365-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3220-361-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/536-357-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3472-353-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2084-349-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1908-347-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4628-341-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1104-336-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1476-330-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2280-328-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3620-322-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3304-320-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1768-316-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3412-310-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/228-308-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2404-302-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3864-300-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1316-296-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3868-290-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1516-288-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3836-284-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2096-276-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3532-270-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2764-268-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1580-262-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1180-256-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4728-250-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3860-248-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/5048-242-0x0000000000400000-0x0000000000472000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2468 2692 5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe 206 PID 2692 wrote to memory of 2468 2692 5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe 206 PID 2692 wrote to memory of 2468 2692 5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe 206 PID 2468 wrote to memory of 1720 2468 thhbbb.exe 126 PID 2468 wrote to memory of 1720 2468 thhbbb.exe 126 PID 2468 wrote to memory of 1720 2468 thhbbb.exe 126 PID 1720 wrote to memory of 232 1720 dvvvv.exe 92 PID 1720 wrote to memory of 232 1720 dvvvv.exe 92 PID 1720 wrote to memory of 232 1720 dvvvv.exe 92 PID 232 wrote to memory of 536 232 rxllrrr.exe 160 PID 232 wrote to memory of 536 232 rxllrrr.exe 160 PID 232 wrote to memory of 536 232 rxllrrr.exe 160 PID 536 wrote to memory of 1108 536 xxxlfrr.exe 129 PID 536 wrote to memory of 1108 536 xxxlfrr.exe 129 PID 536 wrote to memory of 1108 536 xxxlfrr.exe 129 PID 1108 wrote to memory of 672 1108 bhnhbb.exe 190 PID 1108 wrote to memory of 672 1108 bhnhbb.exe 190 PID 1108 wrote to memory of 672 1108 bhnhbb.exe 190 PID 672 wrote to memory of 5048 672 ppppp.exe 96 PID 672 wrote to memory of 5048 672 ppppp.exe 96 PID 672 wrote to memory of 5048 672 ppppp.exe 96 PID 5048 wrote to memory of 4716 5048 pdjdv.exe 97 PID 5048 wrote to memory of 4716 5048 pdjdv.exe 97 PID 5048 wrote to memory of 4716 5048 pdjdv.exe 97 PID 4716 wrote to memory of 2956 4716 ffrrrrr.exe 98 PID 4716 wrote to memory of 2956 4716 ffrrrrr.exe 98 PID 4716 wrote to memory of 2956 4716 ffrrrrr.exe 98 PID 2956 wrote to memory of 4424 2956 xllllll.exe 99 PID 2956 wrote to memory of 4424 2956 xllllll.exe 99 PID 2956 wrote to memory of 4424 2956 xllllll.exe 99 PID 4424 wrote to memory of 3088 4424 hhbbbt.exe 100 PID 4424 wrote to memory of 3088 4424 hhbbbt.exe 100 PID 4424 wrote to memory of 3088 4424 hhbbbt.exe 100 PID 3088 wrote to memory of 852 3088 dpddd.exe 101 PID 3088 wrote to memory of 852 3088 dpddd.exe 101 PID 3088 wrote to memory of 852 3088 dpddd.exe 101 PID 852 wrote to memory of 380 852 5ppjd.exe 102 PID 852 wrote to memory of 380 852 5ppjd.exe 102 PID 852 wrote to memory of 380 852 5ppjd.exe 102 PID 380 wrote to memory of 3972 380 llflrlx.exe 103 PID 380 wrote to memory of 3972 380 llflrlx.exe 103 PID 380 wrote to memory of 3972 380 llflrlx.exe 103 PID 3972 wrote to memory of 788 3972 9tbbbb.exe 104 PID 3972 wrote to memory of 788 3972 9tbbbb.exe 104 PID 3972 wrote to memory of 788 3972 9tbbbb.exe 104 PID 788 wrote to memory of 3772 788 9nnnhn.exe 105 PID 788 wrote to memory of 3772 788 9nnnhn.exe 105 PID 788 wrote to memory of 3772 788 9nnnhn.exe 105 PID 3772 wrote to memory of 3008 3772 vjvvp.exe 106 PID 3772 wrote to memory of 3008 3772 vjvvp.exe 106 PID 3772 wrote to memory of 3008 3772 vjvvp.exe 106 PID 3008 wrote to memory of 1216 3008 rflfflr.exe 107 PID 3008 wrote to memory of 1216 3008 rflfflr.exe 107 PID 3008 wrote to memory of 1216 3008 rflfflr.exe 107 PID 1216 wrote to memory of 3516 1216 lfrllxx.exe 108 PID 1216 wrote to memory of 3516 1216 lfrllxx.exe 108 PID 1216 wrote to memory of 3516 1216 lfrllxx.exe 108 PID 3516 wrote to memory of 1000 3516 ttbbbn.exe 241 PID 3516 wrote to memory of 1000 3516 ttbbbn.exe 241 PID 3516 wrote to memory of 1000 3516 ttbbbn.exe 241 PID 1000 wrote to memory of 4872 1000 ttbtbn.exe 110 PID 1000 wrote to memory of 4872 1000 ttbtbn.exe 110 PID 1000 wrote to memory of 4872 1000 ttbtbn.exe 110 PID 4872 wrote to memory of 3136 4872 vdjdv.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5b92f2427a5f93964fe212e9de9e57c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\thhbbb.exec:\thhbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\dvvvv.exec:\dvvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\rxllrrr.exec:\rxllrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\xxxlfrr.exec:\xxxlfrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\bhnhbb.exec:\bhnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\ppppp.exec:\ppppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\pdjdv.exec:\pdjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\ffrrrrr.exec:\ffrrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\xllllll.exec:\xllllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\hhbbbt.exec:\hhbbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\dpddd.exec:\dpddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\5ppjd.exec:\5ppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\llflrlx.exec:\llflrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\9tbbbb.exec:\9tbbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\9nnnhn.exec:\9nnnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\vjvvp.exec:\vjvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\rflfflr.exec:\rflfflr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\lfrllxx.exec:\lfrllxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\ttbbbn.exec:\ttbbbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\ttbtbn.exec:\ttbtbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\vdjdv.exec:\vdjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\rflrrrr.exec:\rflrrrr.exe23⤵
- Executes dropped EXE
PID:3136 -
\??\c:\rlrlffx.exec:\rlrlffx.exe24⤵
- Executes dropped EXE
PID:3564 -
\??\c:\tbhbtt.exec:\tbhbtt.exe25⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vpddj.exec:\vpddj.exe26⤵
- Executes dropped EXE
PID:3312 -
\??\c:\vjjjd.exec:\vjjjd.exe27⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rrrlfff.exec:\rrrlfff.exe28⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nhnnnn.exec:\nhnnnn.exe29⤵
- Executes dropped EXE
PID:1560 -
\??\c:\hhttnn.exec:\hhttnn.exe30⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pjdpd.exec:\pjdpd.exe31⤵
- Executes dropped EXE
PID:4164 -
\??\c:\lflllxx.exec:\lflllxx.exe32⤵
- Executes dropped EXE
PID:400 -
\??\c:\bbhntt.exec:\bbhntt.exe33⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ntbtbt.exec:\ntbtbt.exe34⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jvdpd.exec:\jvdpd.exe35⤵
- Executes dropped EXE
PID:4592 -
\??\c:\xrfrxrr.exec:\xrfrxrr.exe36⤵
- Executes dropped EXE
PID:3792 -
\??\c:\ntttnn.exec:\ntttnn.exe37⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tnbthh.exec:\tnbthh.exe38⤵
- Executes dropped EXE
PID:1720 -
\??\c:\1jpjj.exec:\1jpjj.exe39⤵
- Executes dropped EXE
PID:4304 -
\??\c:\9xrfxrf.exec:\9xrfxrf.exe40⤵
- Executes dropped EXE
PID:1188 -
\??\c:\7lrlffx.exec:\7lrlffx.exe41⤵
- Executes dropped EXE
PID:1108 -
\??\c:\btttbt.exec:\btttbt.exe42⤵
- Executes dropped EXE
PID:3604 -
\??\c:\vdjdv.exec:\vdjdv.exe43⤵
- Executes dropped EXE
PID:5048 -
\??\c:\9rffrrr.exec:\9rffrrr.exe44⤵
- Executes dropped EXE
PID:3860 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe45⤵
- Executes dropped EXE
PID:4728 -
\??\c:\tnnbtn.exec:\tnnbtn.exe46⤵
- Executes dropped EXE
PID:1180 -
\??\c:\pddvp.exec:\pddvp.exe47⤵
- Executes dropped EXE
PID:3100 -
\??\c:\9xxrlfl.exec:\9xxrlfl.exe48⤵
- Executes dropped EXE
PID:1580 -
\??\c:\llrlxxr.exec:\llrlxxr.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\bhttnt.exec:\bhttnt.exe50⤵
- Executes dropped EXE
PID:3532 -
\??\c:\5vjjp.exec:\5vjjp.exe51⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dpdvv.exec:\dpdvv.exe52⤵
- Executes dropped EXE
PID:3008 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe53⤵
- Executes dropped EXE
PID:3836 -
\??\c:\nthhhh.exec:\nthhhh.exe54⤵
- Executes dropped EXE
PID:1516 -
\??\c:\5vjdv.exec:\5vjdv.exe55⤵
- Executes dropped EXE
PID:3868 -
\??\c:\vppjd.exec:\vppjd.exe56⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rlxlxxx.exec:\rlxlxxx.exe57⤵
- Executes dropped EXE
PID:3864 -
\??\c:\7hnnhh.exec:\7hnnhh.exe58⤵
- Executes dropped EXE
PID:2404 -
\??\c:\btbtbb.exec:\btbtbb.exe59⤵
- Executes dropped EXE
PID:228 -
\??\c:\jvvvj.exec:\jvvvj.exe60⤵
- Executes dropped EXE
PID:3412 -
\??\c:\rfrlrlr.exec:\rfrlrlr.exe61⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hhnhhb.exec:\hhnhhb.exe62⤵
- Executes dropped EXE
PID:3304 -
\??\c:\htbnnn.exec:\htbnnn.exe63⤵
- Executes dropped EXE
PID:3620 -
\??\c:\5jjdv.exec:\5jjdv.exe64⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rrxxlfx.exec:\rrxxlfx.exe65⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xrffxxr.exec:\xrffxxr.exe66⤵PID:1104
-
\??\c:\nhhbnn.exec:\nhhbnn.exe67⤵PID:4964
-
\??\c:\3pjvv.exec:\3pjvv.exe68⤵PID:4628
-
\??\c:\jddjd.exec:\jddjd.exe69⤵PID:1908
-
\??\c:\7rrlrxr.exec:\7rrlrxr.exe70⤵PID:2084
-
\??\c:\1ttbtt.exec:\1ttbtt.exe71⤵PID:3472
-
\??\c:\jvdpd.exec:\jvdpd.exe72⤵PID:536
-
\??\c:\9jjdp.exec:\9jjdp.exe73⤵PID:3220
-
\??\c:\lrrxrrx.exec:\lrrxrrx.exe74⤵PID:4088
-
\??\c:\thtnnn.exec:\thtnnn.exe75⤵PID:4900
-
\??\c:\hbbtnh.exec:\hbbtnh.exe76⤵PID:3156
-
\??\c:\pdjdp.exec:\pdjdp.exe77⤵PID:2788
-
\??\c:\5rrfxrl.exec:\5rrfxrl.exe78⤵PID:4852
-
\??\c:\btbtnn.exec:\btbtnn.exe79⤵PID:2984
-
\??\c:\thhbnn.exec:\thhbnn.exe80⤵PID:3532
-
\??\c:\pjppp.exec:\pjppp.exe81⤵PID:1892
-
\??\c:\lfxlrlx.exec:\lfxlrlx.exe82⤵PID:2096
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe83⤵PID:1852
-
\??\c:\1thbtt.exec:\1thbtt.exe84⤵PID:1900
-
\??\c:\pvddd.exec:\pvddd.exe85⤵PID:4308
-
\??\c:\vjdvj.exec:\vjdvj.exe86⤵PID:4124
-
\??\c:\frrlfxl.exec:\frrlfxl.exe87⤵PID:3660
-
\??\c:\tntnhb.exec:\tntnhb.exe88⤵PID:3496
-
\??\c:\tnhbnh.exec:\tnhbnh.exe89⤵PID:2320
-
\??\c:\vppdv.exec:\vppdv.exe90⤵PID:2700
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe91⤵PID:3680
-
\??\c:\rlfxrll.exec:\rlfxrll.exe92⤵PID:1880
-
\??\c:\tttnnn.exec:\tttnnn.exe93⤵PID:3280
-
\??\c:\dvdpv.exec:\dvdpv.exe94⤵PID:1620
-
\??\c:\dpjjd.exec:\dpjjd.exe95⤵PID:2016
-
\??\c:\xlxllfr.exec:\xlxllfr.exe96⤵PID:4608
-
\??\c:\7tbtnn.exec:\7tbtnn.exe97⤵PID:864
-
\??\c:\pvdvd.exec:\pvdvd.exe98⤵PID:2076
-
\??\c:\pjpjj.exec:\pjpjj.exe99⤵PID:1908
-
\??\c:\xfrllfx.exec:\xfrllfx.exe100⤵PID:4156
-
\??\c:\frlfrlf.exec:\frlfrlf.exe101⤵PID:1720
-
\??\c:\bhthbt.exec:\bhthbt.exe102⤵PID:672
-
\??\c:\jpvpj.exec:\jpvpj.exe103⤵PID:4100
-
\??\c:\pdjdv.exec:\pdjdv.exe104⤵PID:3196
-
\??\c:\xlxrllf.exec:\xlxrllf.exe105⤵PID:1040
-
\??\c:\bhhbtn.exec:\bhhbtn.exe106⤵PID:2160
-
\??\c:\tbhbtn.exec:\tbhbtn.exe107⤵PID:3416
-
\??\c:\vjppp.exec:\vjppp.exe108⤵PID:2788
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe109⤵PID:1392
-
\??\c:\lxxllxr.exec:\lxxllxr.exe110⤵PID:3532
-
\??\c:\nbnnbh.exec:\nbnnbh.exe111⤵PID:3376
-
\??\c:\9djvp.exec:\9djvp.exe112⤵PID:4304
-
\??\c:\pjjvp.exec:\pjjvp.exe113⤵PID:2780
-
\??\c:\xfflfxr.exec:\xfflfxr.exe114⤵PID:3836
-
\??\c:\xlfxrfx.exec:\xlfxrfx.exe115⤵PID:736
-
\??\c:\9htnhb.exec:\9htnhb.exe116⤵PID:3084
-
\??\c:\1dddd.exec:\1dddd.exe117⤵PID:2500
-
\??\c:\xllfrlx.exec:\xllfrlx.exe118⤵PID:2468
-
\??\c:\xflfxrl.exec:\xflfxrl.exe119⤵PID:2476
-
\??\c:\7bttnn.exec:\7bttnn.exe120⤵PID:2352
-
\??\c:\3hhbbb.exec:\3hhbbb.exe121⤵PID:2320
-
\??\c:\dddvj.exec:\dddvj.exe122⤵PID:3260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-