Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:34
Behavioral task
behavioral1
Sample
07886342d86b22b062ac91f6f660fbf0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
07886342d86b22b062ac91f6f660fbf0_NeikiAnalytics.exe
-
Size
361KB
-
MD5
07886342d86b22b062ac91f6f660fbf0
-
SHA1
26dba4a66dcac15e1e98c2c5f2755bac77fa740a
-
SHA256
6d1d545827eefe2dece72713def53d14c8b89e50ee77bf29b1b0cb33e6a5945a
-
SHA512
0fbe868e453f6f3751cb61fba2281ec7998e76abeb271180f43819aed3b2b6377d66b0b9d1d2e7af9c7c402bbd32bb234a20b6b93f5dfb48dee2a83f149a1586
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwu1b26X1wjhtSizjh:R4wFHoSHYHUrAwqzc3
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/228-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/428-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/960-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3820-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2336-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1260-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1964-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-572-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-629-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-646-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-675-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-833-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-836-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-1044-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nbbnnn.exevvpvd.exenhhhbb.exepjvjd.exe5frlflf.exethnnth.exevvdjp.exehbbhht.exedvddd.exebntttn.exelxxfrrr.exehnnnbt.exedvvpv.exelxrrxff.exebthntt.exeflrffxx.exehtnhbb.exebthnnt.exepjppp.exellxxfrr.exehbbhnt.exellxlffx.exejjvdd.exexxxllxr.exetnbhnb.exedvvvp.exexrxxlfr.exejpvdd.exehhhnhh.exetnnhbb.exenthtbb.exevddjp.exetnnbbb.exepppjv.exelxrxlrr.exettbbbh.exexfxfflr.exethnhhh.exejjddj.exennhthb.exevdppp.exefrrxxxx.exevvdpd.exerxrxllf.exennbbbh.exepdddd.exellrxlfx.exetbnnnt.exexrfffll.exe3nnnhh.exevvvjj.exehhbbhh.exejpvvv.exefflrfrf.exettnhbh.exelxrrlll.exebthbhh.exevvddj.exevvvvp.exellrrrrr.exebnhbth.exedvvvj.exevpddd.exebthhhh.exepid process 228 nbbnnn.exe 4608 vvpvd.exe 2400 nhhhbb.exe 5116 pjvjd.exe 4000 5frlflf.exe 4204 thnnth.exe 1404 vvdjp.exe 1316 hbbhht.exe 1984 dvddd.exe 400 bntttn.exe 1240 lxxfrrr.exe 4824 hnnnbt.exe 2928 dvvpv.exe 2996 lxrrxff.exe 4436 bthntt.exe 428 flrffxx.exe 3212 htnhbb.exe 3516 bthnnt.exe 4644 pjppp.exe 1616 llxxfrr.exe 2636 hbbhnt.exe 4468 llxlffx.exe 960 jjvdd.exe 1672 xxxllxr.exe 3820 tnbhnb.exe 2968 dvvvp.exe 2324 xrxxlfr.exe 4948 jpvdd.exe 4060 hhhnhh.exe 1520 tnnhbb.exe 3344 nthtbb.exe 4376 vddjp.exe 1040 tnnbbb.exe 4332 pppjv.exe 2336 lxrxlrr.exe 4972 ttbbbh.exe 2196 xfxfflr.exe 3172 thnhhh.exe 928 jjddj.exe 372 nnhthb.exe 64 vdppp.exe 1428 frrxxxx.exe 224 vvdpd.exe 1012 rxrxllf.exe 4632 nnbbbh.exe 4880 pdddd.exe 8 llrxlfx.exe 2836 tbnnnt.exe 4000 xrfffll.exe 4204 3nnnhh.exe 384 vvvjj.exe 3308 hhbbhh.exe 2104 jpvvv.exe 1624 fflrfrf.exe 1260 ttnhbh.exe 3552 lxrrlll.exe 4636 bthbhh.exe 4088 vvddj.exe 2456 vvvvp.exe 4996 llrrrrr.exe 5112 bnhbth.exe 3960 dvvvj.exe 2996 vpddd.exe 3760 bthhhh.exe -
Processes:
resource yara_rule behavioral2/memory/624-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbbnnn.exe upx behavioral2/memory/228-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/624-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvpvd.exe upx C:\nhhhbb.exe upx behavioral2/memory/2400-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4608-15-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjvjd.exe upx behavioral2/memory/5116-21-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5frlflf.exe upx behavioral2/memory/4000-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thnnth.exe upx C:\vvdjp.exe upx behavioral2/memory/1404-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4204-34-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbbhht.exe upx behavioral2/memory/1316-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvddd.exe upx C:\bntttn.exe upx \??\c:\lxxfrrr.exe upx C:\hnnnbt.exe upx behavioral2/memory/400-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4824-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvpv.exe upx behavioral2/memory/2928-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxrrxff.exe upx behavioral2/memory/2996-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthntt.exe upx behavioral2/memory/2996-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4436-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/428-80-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\flrffxx.exe upx C:\htnhbb.exe upx \??\c:\bthnnt.exe upx C:\hbbhnt.exe upx \??\c:\llxlffx.exe upx behavioral2/memory/2636-107-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llxxfrr.exe upx behavioral2/memory/1616-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4644-97-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjppp.exe upx behavioral2/memory/3516-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3212-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjvdd.exe upx behavioral2/memory/960-115-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxllxr.exe upx behavioral2/memory/1672-119-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnbhnb.exe upx behavioral2/memory/3820-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1672-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvvp.exe upx C:\xrxxlfr.exe upx behavioral2/memory/2324-137-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpvdd.exe upx C:\hhhnhh.exe upx behavioral2/memory/4948-143-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnhbb.exe upx \??\c:\nthtbb.exe upx behavioral2/memory/1520-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3344-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vddjp.exe upx behavioral2/memory/1040-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4332-164-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
07886342d86b22b062ac91f6f660fbf0_NeikiAnalytics.exenbbnnn.exevvpvd.exenhhhbb.exepjvjd.exe5frlflf.exethnnth.exevvdjp.exehbbhht.exedvddd.exebntttn.exelxxfrrr.exehnnnbt.exedvvpv.exelxrrxff.exebthntt.exeflrffxx.exehtnhbb.exebthnnt.exepjppp.exellxxfrr.exehbbhnt.exedescription pid process target process PID 624 wrote to memory of 228 624 07886342d86b22b062ac91f6f660fbf0_NeikiAnalytics.exe nbbnnn.exe PID 624 wrote to memory of 228 624 07886342d86b22b062ac91f6f660fbf0_NeikiAnalytics.exe nbbnnn.exe PID 624 wrote to memory of 228 624 07886342d86b22b062ac91f6f660fbf0_NeikiAnalytics.exe nbbnnn.exe PID 228 wrote to memory of 4608 228 nbbnnn.exe vvpvd.exe PID 228 wrote to memory of 4608 228 nbbnnn.exe vvpvd.exe PID 228 wrote to memory of 4608 228 nbbnnn.exe vvpvd.exe PID 4608 wrote to memory of 2400 4608 vvpvd.exe nhhhbb.exe PID 4608 wrote to memory of 2400 4608 vvpvd.exe nhhhbb.exe PID 4608 wrote to memory of 2400 4608 vvpvd.exe nhhhbb.exe PID 2400 wrote to memory of 5116 2400 nhhhbb.exe pjvjd.exe PID 2400 wrote to memory of 5116 2400 nhhhbb.exe pjvjd.exe PID 2400 wrote to memory of 5116 2400 nhhhbb.exe pjvjd.exe PID 5116 wrote to memory of 4000 5116 pjvjd.exe 5frlflf.exe PID 5116 wrote to memory of 4000 5116 pjvjd.exe 5frlflf.exe PID 5116 wrote to memory of 4000 5116 pjvjd.exe 5frlflf.exe PID 4000 wrote to memory of 4204 4000 5frlflf.exe thnnth.exe PID 4000 wrote to memory of 4204 4000 5frlflf.exe thnnth.exe PID 4000 wrote to memory of 4204 4000 5frlflf.exe thnnth.exe PID 4204 wrote to memory of 1404 4204 thnnth.exe vvdjp.exe PID 4204 wrote to memory of 1404 4204 thnnth.exe vvdjp.exe PID 4204 wrote to memory of 1404 4204 thnnth.exe vvdjp.exe PID 1404 wrote to memory of 1316 1404 vvdjp.exe hbbhht.exe PID 1404 wrote to memory of 1316 1404 vvdjp.exe hbbhht.exe PID 1404 wrote to memory of 1316 1404 vvdjp.exe hbbhht.exe PID 1316 wrote to memory of 1984 1316 hbbhht.exe dvddd.exe PID 1316 wrote to memory of 1984 1316 hbbhht.exe dvddd.exe PID 1316 wrote to memory of 1984 1316 hbbhht.exe dvddd.exe PID 1984 wrote to memory of 400 1984 dvddd.exe bntttn.exe PID 1984 wrote to memory of 400 1984 dvddd.exe bntttn.exe PID 1984 wrote to memory of 400 1984 dvddd.exe bntttn.exe PID 400 wrote to memory of 1240 400 bntttn.exe lxxfrrr.exe PID 400 wrote to memory of 1240 400 bntttn.exe lxxfrrr.exe PID 400 wrote to memory of 1240 400 bntttn.exe lxxfrrr.exe PID 1240 wrote to memory of 4824 1240 lxxfrrr.exe hnnnbt.exe PID 1240 wrote to memory of 4824 1240 lxxfrrr.exe hnnnbt.exe PID 1240 wrote to memory of 4824 1240 lxxfrrr.exe hnnnbt.exe PID 4824 wrote to memory of 2928 4824 hnnnbt.exe dvvpv.exe PID 4824 wrote to memory of 2928 4824 hnnnbt.exe dvvpv.exe PID 4824 wrote to memory of 2928 4824 hnnnbt.exe dvvpv.exe PID 2928 wrote to memory of 2996 2928 dvvpv.exe lxrrxff.exe PID 2928 wrote to memory of 2996 2928 dvvpv.exe lxrrxff.exe PID 2928 wrote to memory of 2996 2928 dvvpv.exe lxrrxff.exe PID 2996 wrote to memory of 4436 2996 lxrrxff.exe bthntt.exe PID 2996 wrote to memory of 4436 2996 lxrrxff.exe bthntt.exe PID 2996 wrote to memory of 4436 2996 lxrrxff.exe bthntt.exe PID 4436 wrote to memory of 428 4436 bthntt.exe flrffxx.exe PID 4436 wrote to memory of 428 4436 bthntt.exe flrffxx.exe PID 4436 wrote to memory of 428 4436 bthntt.exe flrffxx.exe PID 428 wrote to memory of 3212 428 flrffxx.exe htnhbb.exe PID 428 wrote to memory of 3212 428 flrffxx.exe htnhbb.exe PID 428 wrote to memory of 3212 428 flrffxx.exe htnhbb.exe PID 3212 wrote to memory of 3516 3212 htnhbb.exe bthnnt.exe PID 3212 wrote to memory of 3516 3212 htnhbb.exe bthnnt.exe PID 3212 wrote to memory of 3516 3212 htnhbb.exe bthnnt.exe PID 3516 wrote to memory of 4644 3516 bthnnt.exe pjppp.exe PID 3516 wrote to memory of 4644 3516 bthnnt.exe pjppp.exe PID 3516 wrote to memory of 4644 3516 bthnnt.exe pjppp.exe PID 4644 wrote to memory of 1616 4644 pjppp.exe llxxfrr.exe PID 4644 wrote to memory of 1616 4644 pjppp.exe llxxfrr.exe PID 4644 wrote to memory of 1616 4644 pjppp.exe llxxfrr.exe PID 1616 wrote to memory of 2636 1616 llxxfrr.exe hbbhnt.exe PID 1616 wrote to memory of 2636 1616 llxxfrr.exe hbbhnt.exe PID 1616 wrote to memory of 2636 1616 llxxfrr.exe hbbhnt.exe PID 2636 wrote to memory of 4468 2636 hbbhnt.exe llxlffx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07886342d86b22b062ac91f6f660fbf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\07886342d86b22b062ac91f6f660fbf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\nbbnnn.exec:\nbbnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\vvpvd.exec:\vvpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\nhhhbb.exec:\nhhhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\pjvjd.exec:\pjvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\5frlflf.exec:\5frlflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\thnnth.exec:\thnnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\vvdjp.exec:\vvdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\hbbhht.exec:\hbbhht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\dvddd.exec:\dvddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\bntttn.exec:\bntttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\lxxfrrr.exec:\lxxfrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\hnnnbt.exec:\hnnnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\dvvpv.exec:\dvvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\lxrrxff.exec:\lxrrxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\bthntt.exec:\bthntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\flrffxx.exec:\flrffxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\htnhbb.exec:\htnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\bthnnt.exec:\bthnnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\pjppp.exec:\pjppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\llxxfrr.exec:\llxxfrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\hbbhnt.exec:\hbbhnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\llxlffx.exec:\llxlffx.exe23⤵
- Executes dropped EXE
PID:4468 -
\??\c:\jjvdd.exec:\jjvdd.exe24⤵
- Executes dropped EXE
PID:960 -
\??\c:\xxxllxr.exec:\xxxllxr.exe25⤵
- Executes dropped EXE
PID:1672 -
\??\c:\tnbhnb.exec:\tnbhnb.exe26⤵
- Executes dropped EXE
PID:3820 -
\??\c:\dvvvp.exec:\dvvvp.exe27⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xrxxlfr.exec:\xrxxlfr.exe28⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jpvdd.exec:\jpvdd.exe29⤵
- Executes dropped EXE
PID:4948 -
\??\c:\hhhnhh.exec:\hhhnhh.exe30⤵
- Executes dropped EXE
PID:4060 -
\??\c:\tnnhbb.exec:\tnnhbb.exe31⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nthtbb.exec:\nthtbb.exe32⤵
- Executes dropped EXE
PID:3344 -
\??\c:\vddjp.exec:\vddjp.exe33⤵
- Executes dropped EXE
PID:4376 -
\??\c:\tnnbbb.exec:\tnnbbb.exe34⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pppjv.exec:\pppjv.exe35⤵
- Executes dropped EXE
PID:4332 -
\??\c:\lxrxlrr.exec:\lxrxlrr.exe36⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ttbbbh.exec:\ttbbbh.exe37⤵
- Executes dropped EXE
PID:4972 -
\??\c:\xfxfflr.exec:\xfxfflr.exe38⤵
- Executes dropped EXE
PID:2196 -
\??\c:\thnhhh.exec:\thnhhh.exe39⤵
- Executes dropped EXE
PID:3172 -
\??\c:\jjddj.exec:\jjddj.exe40⤵
- Executes dropped EXE
PID:928 -
\??\c:\nnhthb.exec:\nnhthb.exe41⤵
- Executes dropped EXE
PID:372 -
\??\c:\vdppp.exec:\vdppp.exe42⤵
- Executes dropped EXE
PID:64 -
\??\c:\frrxxxx.exec:\frrxxxx.exe43⤵
- Executes dropped EXE
PID:1428 -
\??\c:\vvdpd.exec:\vvdpd.exe44⤵
- Executes dropped EXE
PID:224 -
\??\c:\rxrxllf.exec:\rxrxllf.exe45⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nnbbbh.exec:\nnbbbh.exe46⤵
- Executes dropped EXE
PID:4632 -
\??\c:\pdddd.exec:\pdddd.exe47⤵
- Executes dropped EXE
PID:4880 -
\??\c:\llrxlfx.exec:\llrxlfx.exe48⤵
- Executes dropped EXE
PID:8 -
\??\c:\tbnnnt.exec:\tbnnnt.exe49⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xrfffll.exec:\xrfffll.exe50⤵
- Executes dropped EXE
PID:4000 -
\??\c:\3nnnhh.exec:\3nnnhh.exe51⤵
- Executes dropped EXE
PID:4204 -
\??\c:\vvvjj.exec:\vvvjj.exe52⤵
- Executes dropped EXE
PID:384 -
\??\c:\hhbbhh.exec:\hhbbhh.exe53⤵
- Executes dropped EXE
PID:3308 -
\??\c:\jpvvv.exec:\jpvvv.exe54⤵
- Executes dropped EXE
PID:2104 -
\??\c:\fflrfrf.exec:\fflrfrf.exe55⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ttnhbh.exec:\ttnhbh.exe56⤵
- Executes dropped EXE
PID:1260 -
\??\c:\lxrrlll.exec:\lxrrlll.exe57⤵
- Executes dropped EXE
PID:3552 -
\??\c:\bthbhh.exec:\bthbhh.exe58⤵
- Executes dropped EXE
PID:4636 -
\??\c:\vvddj.exec:\vvddj.exe59⤵
- Executes dropped EXE
PID:4088 -
\??\c:\vvvvp.exec:\vvvvp.exe60⤵
- Executes dropped EXE
PID:2456 -
\??\c:\llrrrrr.exec:\llrrrrr.exe61⤵
- Executes dropped EXE
PID:4996 -
\??\c:\bnhbth.exec:\bnhbth.exe62⤵
- Executes dropped EXE
PID:5112 -
\??\c:\dvvvj.exec:\dvvvj.exe63⤵
- Executes dropped EXE
PID:3960 -
\??\c:\vpddd.exec:\vpddd.exe64⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bthhhh.exec:\bthhhh.exe65⤵
- Executes dropped EXE
PID:3760 -
\??\c:\bbhttt.exec:\bbhttt.exe66⤵PID:4124
-
\??\c:\vvvvd.exec:\vvvvd.exe67⤵PID:3004
-
\??\c:\1frllrr.exec:\1frllrr.exe68⤵PID:4064
-
\??\c:\tbhhnt.exec:\tbhhnt.exe69⤵PID:2536
-
\??\c:\nhbbtb.exec:\nhbbtb.exe70⤵PID:2844
-
\??\c:\jvdjj.exec:\jvdjj.exe71⤵PID:988
-
\??\c:\lffffff.exec:\lffffff.exe72⤵PID:1616
-
\??\c:\5tbhbb.exec:\5tbhbb.exe73⤵PID:2208
-
\??\c:\1bbttb.exec:\1bbttb.exe74⤵PID:1768
-
\??\c:\ddjvj.exec:\ddjvj.exe75⤵PID:2788
-
\??\c:\flrrrxx.exec:\flrrrxx.exe76⤵PID:1748
-
\??\c:\tnttht.exec:\tnttht.exe77⤵PID:1480
-
\??\c:\9bbbnt.exec:\9bbbnt.exe78⤵PID:5060
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe79⤵PID:748
-
\??\c:\nhnnnn.exec:\nhnnnn.exe80⤵PID:3464
-
\??\c:\bnttbn.exec:\bnttbn.exe81⤵PID:4484
-
\??\c:\djppp.exec:\djppp.exe82⤵PID:1520
-
\??\c:\ffxxxrr.exec:\ffxxxrr.exe83⤵PID:1892
-
\??\c:\flrlxrf.exec:\flrlxrf.exe84⤵PID:2308
-
\??\c:\7ttbbn.exec:\7ttbbn.exe85⤵PID:1964
-
\??\c:\ppvjj.exec:\ppvjj.exe86⤵PID:2008
-
\??\c:\1lxrffr.exec:\1lxrffr.exe87⤵PID:4924
-
\??\c:\bntnnb.exec:\bntnnb.exe88⤵PID:2016
-
\??\c:\vjdvj.exec:\vjdvj.exe89⤵PID:3240
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe90⤵PID:1140
-
\??\c:\hbnnth.exec:\hbnnth.exe91⤵PID:4256
-
\??\c:\djjpp.exec:\djjpp.exe92⤵PID:4344
-
\??\c:\ntnnnh.exec:\ntnnnh.exe93⤵PID:1800
-
\??\c:\vpvdj.exec:\vpvdj.exe94⤵PID:4408
-
\??\c:\xfxxlxr.exec:\xfxxlxr.exe95⤵PID:1976
-
\??\c:\nthbbt.exec:\nthbbt.exe96⤵PID:2588
-
\??\c:\1ppjv.exec:\1ppjv.exe97⤵PID:4416
-
\??\c:\nhhbtb.exec:\nhhbtb.exe98⤵PID:3068
-
\??\c:\vpjdp.exec:\vpjdp.exe99⤵PID:1368
-
\??\c:\pjppp.exec:\pjppp.exe100⤵PID:1528
-
\??\c:\fxfrrfr.exec:\fxfrrfr.exe101⤵PID:1464
-
\??\c:\hntttb.exec:\hntttb.exe102⤵PID:2824
-
\??\c:\vppvj.exec:\vppvj.exe103⤵PID:3008
-
\??\c:\rflxfrx.exec:\rflxfrx.exe104⤵PID:1624
-
\??\c:\fxllrxr.exec:\fxllrxr.exe105⤵PID:1764
-
\??\c:\nnnhnt.exec:\nnnhnt.exe106⤵PID:4616
-
\??\c:\pvvvd.exec:\pvvvd.exe107⤵PID:1392
-
\??\c:\hhbbbb.exec:\hhbbbb.exe108⤵PID:4664
-
\??\c:\nbnhhh.exec:\nbnhhh.exe109⤵PID:4048
-
\??\c:\pdppp.exec:\pdppp.exe110⤵PID:4640
-
\??\c:\tntnnb.exec:\tntnnb.exe111⤵PID:5032
-
\??\c:\fxlxrxr.exec:\fxlxrxr.exe112⤵PID:3668
-
\??\c:\hnbnhn.exec:\hnbnhn.exe113⤵PID:5040
-
\??\c:\dvdvd.exec:\dvdvd.exe114⤵PID:2648
-
\??\c:\fffxrrr.exec:\fffxrrr.exe115⤵PID:4500
-
\??\c:\hnntbt.exec:\hnntbt.exe116⤵PID:2596
-
\??\c:\djddv.exec:\djddv.exe117⤵PID:3928
-
\??\c:\1rxxrrl.exec:\1rxxrrl.exe118⤵PID:4732
-
\??\c:\hbnhhh.exec:\hbnhhh.exe119⤵PID:1440
-
\??\c:\9djjj.exec:\9djjj.exe120⤵PID:1548
-
\??\c:\flrxlrf.exec:\flrxlrf.exe121⤵PID:4864
-
\??\c:\tnnnnn.exec:\tnnnnn.exe122⤵PID:4812
-
\??\c:\pjjdv.exec:\pjjdv.exe123⤵PID:4828
-
\??\c:\rrlxllf.exec:\rrlxllf.exe124⤵PID:1876
-
\??\c:\tnbhtb.exec:\tnbhtb.exe125⤵PID:1748
-
\??\c:\dpddd.exec:\dpddd.exe126⤵PID:2968
-
\??\c:\xxlfllx.exec:\xxlfllx.exe127⤵PID:1912
-
\??\c:\nnhbbh.exec:\nnhbbh.exe128⤵PID:3644
-
\??\c:\ntbttn.exec:\ntbttn.exe129⤵PID:4448
-
\??\c:\lfrrxlr.exec:\lfrrxlr.exe130⤵PID:4940
-
\??\c:\hnhtth.exec:\hnhtth.exe131⤵PID:1520
-
\??\c:\hnnbtb.exec:\hnnbtb.exe132⤵PID:4928
-
\??\c:\djjpj.exec:\djjpj.exe133⤵PID:2308
-
\??\c:\fxflrxx.exec:\fxflrxx.exe134⤵PID:2412
-
\??\c:\bntttb.exec:\bntttb.exe135⤵PID:3784
-
\??\c:\dpjdd.exec:\dpjdd.exe136⤵PID:4924
-
\??\c:\9lflfxx.exec:\9lflfxx.exe137⤵PID:3208
-
\??\c:\hbhnnn.exec:\hbhnnn.exe138⤵PID:3240
-
\??\c:\dvvpp.exec:\dvvpp.exe139⤵PID:3736
-
\??\c:\xlfxxxx.exec:\xlfxxxx.exe140⤵PID:4360
-
\??\c:\frfrlrl.exec:\frfrlrl.exe141⤵PID:4344
-
\??\c:\tbttnn.exec:\tbttnn.exe142⤵PID:224
-
\??\c:\ddjdj.exec:\ddjdj.exe143⤵PID:5100
-
\??\c:\flfffff.exec:\flfffff.exe144⤵PID:3028
-
\??\c:\tnhhbb.exec:\tnhhbb.exe145⤵PID:1436
-
\??\c:\jddvj.exec:\jddvj.exe146⤵PID:1708
-
\??\c:\rlrlffx.exec:\rlrlffx.exe147⤵PID:2764
-
\??\c:\nbthth.exec:\nbthth.exe148⤵PID:4956
-
\??\c:\jjvdj.exec:\jjvdj.exe149⤵PID:1984
-
\??\c:\9jjvp.exec:\9jjvp.exe150⤵PID:3912
-
\??\c:\lrxllfx.exec:\lrxllfx.exe151⤵PID:3560
-
\??\c:\ttbbbt.exec:\ttbbbt.exe152⤵PID:1240
-
\??\c:\jvvpj.exec:\jvvpj.exe153⤵PID:4824
-
\??\c:\5pddp.exec:\5pddp.exe154⤵PID:2456
-
\??\c:\frrxlxr.exec:\frrxlxr.exe155⤵PID:3276
-
\??\c:\bnnbht.exec:\bnnbht.exe156⤵PID:1524
-
\??\c:\vvjdp.exec:\vvjdp.exe157⤵PID:5032
-
\??\c:\lfllrfl.exec:\lfllrfl.exe158⤵PID:3668
-
\??\c:\nbbbth.exec:\nbbbth.exe159⤵PID:648
-
\??\c:\nhnhhh.exec:\nhnhhh.exe160⤵PID:1108
-
\??\c:\vjpjv.exec:\vjpjv.exe161⤵PID:3212
-
\??\c:\5rxfrll.exec:\5rxfrll.exe162⤵PID:2420
-
\??\c:\hnbbnb.exec:\hnbbnb.exe163⤵PID:3352
-
\??\c:\pppjv.exec:\pppjv.exe164⤵PID:988
-
\??\c:\lffffff.exec:\lffffff.exe165⤵PID:1112
-
\??\c:\bthhbt.exec:\bthhbt.exe166⤵PID:2976
-
\??\c:\pjjjd.exec:\pjjjd.exe167⤵PID:1884
-
\??\c:\llrlrff.exec:\llrlrff.exe168⤵PID:1768
-
\??\c:\nhbhhb.exec:\nhbhhb.exe169⤵PID:4252
-
\??\c:\pjvpv.exec:\pjvpv.exe170⤵PID:632
-
\??\c:\pdjjd.exec:\pdjjd.exe171⤵PID:2344
-
\??\c:\lfrlflx.exec:\lfrlflx.exe172⤵PID:1480
-
\??\c:\tttnht.exec:\tttnht.exe173⤵PID:2324
-
\??\c:\vddjj.exec:\vddjj.exe174⤵PID:748
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe175⤵PID:4484
-
\??\c:\thnnnh.exec:\thnnnh.exe176⤵PID:3356
-
\??\c:\jjppj.exec:\jjppj.exe177⤵PID:4376
-
\??\c:\jvddp.exec:\jvddp.exe178⤵PID:1892
-
\??\c:\xlfrlfr.exec:\xlfrlfr.exe179⤵PID:3716
-
\??\c:\bhnhnn.exec:\bhnhnn.exe180⤵PID:1964
-
\??\c:\vvdjj.exec:\vvdjj.exe181⤵PID:2008
-
\??\c:\rrxfrll.exec:\rrxfrll.exe182⤵PID:3172
-
\??\c:\nbbbnb.exec:\nbbbnb.exe183⤵PID:4572
-
\??\c:\dvjjd.exec:\dvjjd.exe184⤵PID:980
-
\??\c:\bbbtht.exec:\bbbtht.exe185⤵PID:2016
-
\??\c:\pvjjj.exec:\pvjjj.exe186⤵PID:1808
-
\??\c:\frxlxfl.exec:\frxlxfl.exe187⤵PID:4736
-
\??\c:\hhhbbb.exec:\hhhbbb.exe188⤵PID:2776
-
\??\c:\hnhbbn.exec:\hnhbbn.exe189⤵PID:624
-
\??\c:\jdjpj.exec:\jdjpj.exe190⤵PID:4408
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe191⤵PID:224
-
\??\c:\hbbtbn.exec:\hbbtbn.exe192⤵PID:8
-
\??\c:\3tbhnn.exec:\3tbhnn.exe193⤵PID:2380
-
\??\c:\vdjpj.exec:\vdjpj.exe194⤵PID:4216
-
\??\c:\xlxfffl.exec:\xlxfffl.exe195⤵PID:3228
-
\??\c:\tnbthb.exec:\tnbthb.exe196⤵PID:3456
-
\??\c:\3jjvd.exec:\3jjvd.exe197⤵PID:2824
-
\??\c:\rxxrxrr.exec:\rxxrxrr.exe198⤵PID:1676
-
\??\c:\nthhhh.exec:\nthhhh.exe199⤵PID:3064
-
\??\c:\hbnntt.exec:\hbnntt.exe200⤵PID:2396
-
\??\c:\dvppv.exec:\dvppv.exe201⤵PID:828
-
\??\c:\rllllrx.exec:\rllllrx.exe202⤵PID:2428
-
\??\c:\btthnn.exec:\btthnn.exe203⤵PID:1560
-
\??\c:\dvjpd.exec:\dvjpd.exe204⤵PID:4824
-
\??\c:\9rfflxf.exec:\9rfflxf.exe205⤵PID:2456
-
\??\c:\nbhbth.exec:\nbhbth.exe206⤵PID:3276
-
\??\c:\5ddpp.exec:\5ddpp.exe207⤵PID:1524
-
\??\c:\jjdpd.exec:\jjdpd.exe208⤵PID:5032
-
\??\c:\xllflfl.exec:\xllflfl.exe209⤵PID:3668
-
\??\c:\ppdvd.exec:\ppdvd.exe210⤵PID:2280
-
\??\c:\3ppjp.exec:\3ppjp.exe211⤵PID:1432
-
\??\c:\fxfffll.exec:\fxfffll.exe212⤵PID:612
-
\??\c:\ttnntn.exec:\ttnntn.exe213⤵PID:2420
-
\??\c:\ddddj.exec:\ddddj.exe214⤵PID:3352
-
\??\c:\frfrlfx.exec:\frfrlfx.exe215⤵PID:944
-
\??\c:\ntnnth.exec:\ntnnth.exe216⤵PID:1112
-
\??\c:\tthtbh.exec:\tthtbh.exe217⤵PID:2208
-
\??\c:\vpdvj.exec:\vpdvj.exe218⤵PID:2788
-
\??\c:\rrfrxrl.exec:\rrfrxrl.exe219⤵PID:632
-
\??\c:\tnnbnh.exec:\tnnbnh.exe220⤵PID:3980
-
\??\c:\vvjpd.exec:\vvjpd.exe221⤵PID:2560
-
\??\c:\rxffffr.exec:\rxffffr.exe222⤵PID:3232
-
\??\c:\hhtttt.exec:\hhtttt.exe223⤵PID:1968
-
\??\c:\jjvdd.exec:\jjvdd.exe224⤵PID:4652
-
\??\c:\rxrxllx.exec:\rxrxllx.exe225⤵PID:2808
-
\??\c:\tnnntn.exec:\tnnntn.exe226⤵PID:1052
-
\??\c:\jppjp.exec:\jppjp.exe227⤵PID:3612
-
\??\c:\frfxfrf.exec:\frfxfrf.exe228⤵PID:2336
-
\??\c:\5hhthn.exec:\5hhthn.exe229⤵PID:1600
-
\??\c:\bnttnn.exec:\bnttnn.exe230⤵PID:4036
-
\??\c:\frrlllf.exec:\frrlllf.exe231⤵PID:1188
-
\??\c:\frxrxxl.exec:\frxrxxl.exe232⤵PID:628
-
\??\c:\5ttnnn.exec:\5ttnnn.exe233⤵PID:4104
-
\??\c:\ddvpv.exec:\ddvpv.exe234⤵PID:672
-
\??\c:\ffllrxf.exec:\ffllrxf.exe235⤵PID:2248
-
\??\c:\hthbtt.exec:\hthbtt.exe236⤵PID:1720
-
\??\c:\vdjdd.exec:\vdjdd.exe237⤵PID:3208
-
\??\c:\jvvpd.exec:\jvvpd.exe238⤵PID:1872
-
\??\c:\fxxrffx.exec:\fxxrffx.exe239⤵PID:64
-
\??\c:\tnbtbb.exec:\tnbtbb.exe240⤵PID:1428
-
\??\c:\pjvpj.exec:\pjvpj.exe241⤵PID:220
-
\??\c:\lxfrxxl.exec:\lxfrxxl.exe242⤵PID:232