Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:08
Behavioral task
behavioral1
Sample
5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe
-
Size
198KB
-
MD5
5007621f22b924d5d3f3e30b82802a90
-
SHA1
595291a701377288895ef9a9775940244bf7ab75
-
SHA256
6694dca32c848562263df584ce3fb502d9294b776db439ae7500c56042177bbc
-
SHA512
9e3cf394c47381007f4718f41f271780e1a98466494d68db035fa8fe1d2c9b8e23b925dafd73411e3fdf75f2bdec5bd1ca218812844bbaca3e315e7adbcbdd9a
-
SSDEEP
3072:xhOmTsF93UYfwC6GIout3WVi/8HCpi8rY9AABa1YRMxl1522cJ1uIo:xcm4FmowdHoS3WV28HCddWhRO1Lc9o
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4592-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1504-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1404-41-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1368-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/376-81-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2592-76-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2352-61-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3484-55-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3224-31-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/792-27-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2436-19-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4500-14-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3372-91-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1656-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2356-105-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3736-107-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1216-118-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2964-120-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1816-131-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3196-146-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1908-162-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1844-172-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3572-178-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3796-181-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3700-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/396-193-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5080-198-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3404-202-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1832-209-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3760-211-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5100-220-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3600-224-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4152-241-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1112-246-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1532-250-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1532-254-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1828-280-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4524-285-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4524-288-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1336-292-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3200-296-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2508-304-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1216-310-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3280-318-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1248-324-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4304-329-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3196-336-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1036-342-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1200-344-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1808-353-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/868-390-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3088-428-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1888-432-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4532-465-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2908-480-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1364-556-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4440-603-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2088-623-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1852-669-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3200-717-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4416-733-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3452-749-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3584-848-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3540-960-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdddp.exefxfxllf.exebhbbtt.exebtttnh.exepdddv.exerrffxlf.exe1rllffx.exehbttnh.exe1vpjv.exejvjvd.exerxllflf.exentbbtn.exe9bhbtt.exepdvpj.exepjjjd.exehhbttn.exejpppp.exexrrfrxr.exettnhnb.exedvdpj.exelfllxxr.exehtbbbb.exevpppj.exelrrrllf.exetbbbbb.exenhtnbt.exepvdjv.exerrfrllx.exethhtnh.exeppdpj.exelflxxfx.exejvpjd.exe3ffrlfx.exebhtnhh.exepjjdv.exerrlfxrr.exethhbbb.exeddjdd.exevpvvp.exefxffxff.exehhhhbb.exe9rrfxrf.exefxxxfxx.exebtttnh.exejppjv.exedjppd.exexllxrlf.exenbhbtn.exedvvjv.exe1llfrlx.exebbhnhh.exevpvpp.exejvdvp.exexfffxff.exe1lrxxxr.exe9htnnn.exepdvjv.exexlrxrxx.exe9rrlfxr.exetntntt.exelfxrllx.exehbnttt.exettbbtn.exejddvv.exepid process 4592 pdddp.exe 4500 fxfxllf.exe 2436 bhbbtt.exe 792 btttnh.exe 3224 pdddv.exe 212 rrffxlf.exe 1404 1rllffx.exe 3484 hbttnh.exe 2352 1vpjv.exe 1888 jvjvd.exe 2956 rxllflf.exe 2592 ntbbtn.exe 1368 9bhbtt.exe 376 pdvpj.exe 3372 pjjjd.exe 1656 hhbttn.exe 2356 jpppp.exe 3736 xrrfrxr.exe 1216 ttnhnb.exe 2964 dvdpj.exe 4532 lfllxxr.exe 1816 htbbbb.exe 4416 vpppj.exe 5052 lrrrllf.exe 3196 tbbbbb.exe 1036 nhtnbt.exe 1908 pvdjv.exe 4928 rrfrllx.exe 1844 thhtnh.exe 3572 ppdpj.exe 3796 lflxxfx.exe 3700 jvpjd.exe 396 3ffrlfx.exe 5080 bhtnhh.exe 2224 pjjdv.exe 3404 rrlfxrr.exe 1832 thhbbb.exe 3760 ddjdd.exe 3308 vpvvp.exe 5100 fxffxff.exe 3600 hhhhbb.exe 4044 9rrfxrf.exe 4452 fxxxfxx.exe 1092 btttnh.exe 4500 jppjv.exe 4152 djppd.exe 1112 xllxrlf.exe 208 nbhbtn.exe 1532 dvvjv.exe 1176 1llfrlx.exe 1888 bbhnhh.exe 1304 vpvpp.exe 116 jvdvp.exe 1124 xfffxff.exe 4100 1lrxxxr.exe 732 9htnnn.exe 1828 pdvjv.exe 3944 xlrxrxx.exe 4524 9rrlfxr.exe 1336 tntntt.exe 3200 lfxrllx.exe 3276 hbnttt.exe 4464 ttbbtn.exe 2508 jddvv.exe -
Processes:
resource yara_rule behavioral2/memory/1504-0-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\pdddp.exe upx behavioral2/memory/4592-6-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxfxllf.exe upx behavioral2/memory/1504-12-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bhbbtt.exe upx C:\btttnh.exe upx \??\c:\pdddv.exe upx \??\c:\rrffxlf.exe upx C:\1rllffx.exe upx behavioral2/memory/1404-41-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hbttnh.exe upx \??\c:\1vpjv.exe upx \??\c:\rxllflf.exe upx \??\c:\ntbbtn.exe upx \??\c:\9bhbtt.exe upx \??\c:\pdvpj.exe upx behavioral2/memory/1368-82-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/376-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2592-76-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2352-61-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\jvjvd.exe upx behavioral2/memory/3484-55-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3224-31-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/792-27-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2436-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4500-14-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pjjjd.exe upx C:\hhbttn.exe upx behavioral2/memory/3372-91-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jpppp.exe upx behavioral2/memory/1656-99-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2356-100-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xrrfrxr.exe upx behavioral2/memory/2356-105-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3736-107-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\ttnhnb.exe upx C:\dvdpj.exe upx behavioral2/memory/1216-118-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2964-120-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\lfllxxr.exe upx C:\htbbbb.exe upx behavioral2/memory/1816-131-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vpppj.exe upx C:\lrrrllf.exe upx C:\tbbbbb.exe upx behavioral2/memory/3196-146-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nhtnbt.exe upx C:\pvdjv.exe upx C:\rrfrllx.exe upx behavioral2/memory/1908-162-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\thhtnh.exe upx behavioral2/memory/1844-172-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ppdpj.exe upx C:\lflxxfx.exe upx behavioral2/memory/3572-178-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3796-181-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jvpjd.exe upx behavioral2/memory/3700-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/396-193-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5080-194-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5080-198-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3404-202-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1832-209-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exepdddp.exefxfxllf.exebhbbtt.exebtttnh.exepdddv.exerrffxlf.exe1rllffx.exehbttnh.exe1vpjv.exejvjvd.exerxllflf.exentbbtn.exe9bhbtt.exepdvpj.exepjjjd.exehhbttn.exejpppp.exexrrfrxr.exettnhnb.exedvdpj.exelfllxxr.exedescription pid process target process PID 1504 wrote to memory of 4592 1504 5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe pdddp.exe PID 1504 wrote to memory of 4592 1504 5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe pdddp.exe PID 1504 wrote to memory of 4592 1504 5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe pdddp.exe PID 4592 wrote to memory of 4500 4592 pdddp.exe fxfxllf.exe PID 4592 wrote to memory of 4500 4592 pdddp.exe fxfxllf.exe PID 4592 wrote to memory of 4500 4592 pdddp.exe fxfxllf.exe PID 4500 wrote to memory of 2436 4500 fxfxllf.exe bhbbtt.exe PID 4500 wrote to memory of 2436 4500 fxfxllf.exe bhbbtt.exe PID 4500 wrote to memory of 2436 4500 fxfxllf.exe bhbbtt.exe PID 2436 wrote to memory of 792 2436 bhbbtt.exe btttnh.exe PID 2436 wrote to memory of 792 2436 bhbbtt.exe btttnh.exe PID 2436 wrote to memory of 792 2436 bhbbtt.exe btttnh.exe PID 792 wrote to memory of 3224 792 btttnh.exe pdddv.exe PID 792 wrote to memory of 3224 792 btttnh.exe pdddv.exe PID 792 wrote to memory of 3224 792 btttnh.exe pdddv.exe PID 3224 wrote to memory of 212 3224 pdddv.exe rrffxlf.exe PID 3224 wrote to memory of 212 3224 pdddv.exe rrffxlf.exe PID 3224 wrote to memory of 212 3224 pdddv.exe rrffxlf.exe PID 212 wrote to memory of 1404 212 rrffxlf.exe 1rllffx.exe PID 212 wrote to memory of 1404 212 rrffxlf.exe 1rllffx.exe PID 212 wrote to memory of 1404 212 rrffxlf.exe 1rllffx.exe PID 1404 wrote to memory of 3484 1404 1rllffx.exe hbttnh.exe PID 1404 wrote to memory of 3484 1404 1rllffx.exe hbttnh.exe PID 1404 wrote to memory of 3484 1404 1rllffx.exe hbttnh.exe PID 3484 wrote to memory of 2352 3484 hbttnh.exe 1vpjv.exe PID 3484 wrote to memory of 2352 3484 hbttnh.exe 1vpjv.exe PID 3484 wrote to memory of 2352 3484 hbttnh.exe 1vpjv.exe PID 2352 wrote to memory of 1888 2352 1vpjv.exe jvjvd.exe PID 2352 wrote to memory of 1888 2352 1vpjv.exe jvjvd.exe PID 2352 wrote to memory of 1888 2352 1vpjv.exe jvjvd.exe PID 1888 wrote to memory of 2956 1888 jvjvd.exe rxllflf.exe PID 1888 wrote to memory of 2956 1888 jvjvd.exe rxllflf.exe PID 1888 wrote to memory of 2956 1888 jvjvd.exe rxllflf.exe PID 2956 wrote to memory of 2592 2956 rxllflf.exe ntbbtn.exe PID 2956 wrote to memory of 2592 2956 rxllflf.exe ntbbtn.exe PID 2956 wrote to memory of 2592 2956 rxllflf.exe ntbbtn.exe PID 2592 wrote to memory of 1368 2592 ntbbtn.exe 9bhbtt.exe PID 2592 wrote to memory of 1368 2592 ntbbtn.exe 9bhbtt.exe PID 2592 wrote to memory of 1368 2592 ntbbtn.exe 9bhbtt.exe PID 1368 wrote to memory of 376 1368 9bhbtt.exe pdvpj.exe PID 1368 wrote to memory of 376 1368 9bhbtt.exe pdvpj.exe PID 1368 wrote to memory of 376 1368 9bhbtt.exe pdvpj.exe PID 376 wrote to memory of 3372 376 pdvpj.exe pjjjd.exe PID 376 wrote to memory of 3372 376 pdvpj.exe pjjjd.exe PID 376 wrote to memory of 3372 376 pdvpj.exe pjjjd.exe PID 3372 wrote to memory of 1656 3372 pjjjd.exe hhbttn.exe PID 3372 wrote to memory of 1656 3372 pjjjd.exe hhbttn.exe PID 3372 wrote to memory of 1656 3372 pjjjd.exe hhbttn.exe PID 1656 wrote to memory of 2356 1656 hhbttn.exe jpppp.exe PID 1656 wrote to memory of 2356 1656 hhbttn.exe jpppp.exe PID 1656 wrote to memory of 2356 1656 hhbttn.exe jpppp.exe PID 2356 wrote to memory of 3736 2356 jpppp.exe xrrfrxr.exe PID 2356 wrote to memory of 3736 2356 jpppp.exe xrrfrxr.exe PID 2356 wrote to memory of 3736 2356 jpppp.exe xrrfrxr.exe PID 3736 wrote to memory of 1216 3736 xrrfrxr.exe ttnhnb.exe PID 3736 wrote to memory of 1216 3736 xrrfrxr.exe ttnhnb.exe PID 3736 wrote to memory of 1216 3736 xrrfrxr.exe ttnhnb.exe PID 1216 wrote to memory of 2964 1216 ttnhnb.exe dvdpj.exe PID 1216 wrote to memory of 2964 1216 ttnhnb.exe dvdpj.exe PID 1216 wrote to memory of 2964 1216 ttnhnb.exe dvdpj.exe PID 2964 wrote to memory of 4532 2964 dvdpj.exe lfllxxr.exe PID 2964 wrote to memory of 4532 2964 dvdpj.exe lfllxxr.exe PID 2964 wrote to memory of 4532 2964 dvdpj.exe lfllxxr.exe PID 4532 wrote to memory of 1816 4532 lfllxxr.exe htbbbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5007621f22b924d5d3f3e30b82802a90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\pdddp.exec:\pdddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\fxfxllf.exec:\fxfxllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\bhbbtt.exec:\bhbbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\btttnh.exec:\btttnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\pdddv.exec:\pdddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\rrffxlf.exec:\rrffxlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\1rllffx.exec:\1rllffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\hbttnh.exec:\hbttnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\1vpjv.exec:\1vpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\jvjvd.exec:\jvjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\rxllflf.exec:\rxllflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\ntbbtn.exec:\ntbbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\9bhbtt.exec:\9bhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\pdvpj.exec:\pdvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\pjjjd.exec:\pjjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\hhbttn.exec:\hhbttn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\jpppp.exec:\jpppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\xrrfrxr.exec:\xrrfrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\ttnhnb.exec:\ttnhnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\dvdpj.exec:\dvdpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\lfllxxr.exec:\lfllxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\htbbbb.exec:\htbbbb.exe23⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vpppj.exec:\vpppj.exe24⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lrrrllf.exec:\lrrrllf.exe25⤵
- Executes dropped EXE
PID:5052 -
\??\c:\tbbbbb.exec:\tbbbbb.exe26⤵
- Executes dropped EXE
PID:3196 -
\??\c:\nhtnbt.exec:\nhtnbt.exe27⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pvdjv.exec:\pvdjv.exe28⤵
- Executes dropped EXE
PID:1908 -
\??\c:\rrfrllx.exec:\rrfrllx.exe29⤵
- Executes dropped EXE
PID:4928 -
\??\c:\thhtnh.exec:\thhtnh.exe30⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ppdpj.exec:\ppdpj.exe31⤵
- Executes dropped EXE
PID:3572 -
\??\c:\lflxxfx.exec:\lflxxfx.exe32⤵
- Executes dropped EXE
PID:3796 -
\??\c:\jvpjd.exec:\jvpjd.exe33⤵
- Executes dropped EXE
PID:3700 -
\??\c:\3ffrlfx.exec:\3ffrlfx.exe34⤵
- Executes dropped EXE
PID:396 -
\??\c:\bhtnhh.exec:\bhtnhh.exe35⤵
- Executes dropped EXE
PID:5080 -
\??\c:\pjjdv.exec:\pjjdv.exe36⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rrlfxrr.exec:\rrlfxrr.exe37⤵
- Executes dropped EXE
PID:3404 -
\??\c:\thhbbb.exec:\thhbbb.exe38⤵
- Executes dropped EXE
PID:1832 -
\??\c:\ddjdd.exec:\ddjdd.exe39⤵
- Executes dropped EXE
PID:3760 -
\??\c:\vpvvp.exec:\vpvvp.exe40⤵
- Executes dropped EXE
PID:3308 -
\??\c:\fxffxff.exec:\fxffxff.exe41⤵
- Executes dropped EXE
PID:5100 -
\??\c:\hhhhbb.exec:\hhhhbb.exe42⤵
- Executes dropped EXE
PID:3600 -
\??\c:\9rrfxrf.exec:\9rrfxrf.exe43⤵
- Executes dropped EXE
PID:4044 -
\??\c:\fxxxfxx.exec:\fxxxfxx.exe44⤵
- Executes dropped EXE
PID:4452 -
\??\c:\btttnh.exec:\btttnh.exe45⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jppjv.exec:\jppjv.exe46⤵
- Executes dropped EXE
PID:4500 -
\??\c:\djppd.exec:\djppd.exe47⤵
- Executes dropped EXE
PID:4152 -
\??\c:\xllxrlf.exec:\xllxrlf.exe48⤵
- Executes dropped EXE
PID:1112 -
\??\c:\nbhbtn.exec:\nbhbtn.exe49⤵
- Executes dropped EXE
PID:208 -
\??\c:\dvvjv.exec:\dvvjv.exe50⤵
- Executes dropped EXE
PID:1532 -
\??\c:\1llfrlx.exec:\1llfrlx.exe51⤵
- Executes dropped EXE
PID:1176 -
\??\c:\bbhnhh.exec:\bbhnhh.exe52⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vpvpp.exec:\vpvpp.exe53⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jvdvp.exec:\jvdvp.exe54⤵
- Executes dropped EXE
PID:116 -
\??\c:\xfffxff.exec:\xfffxff.exe55⤵
- Executes dropped EXE
PID:1124 -
\??\c:\1lrxxxr.exec:\1lrxxxr.exe56⤵
- Executes dropped EXE
PID:4100 -
\??\c:\9htnnn.exec:\9htnnn.exe57⤵
- Executes dropped EXE
PID:732 -
\??\c:\pdvjv.exec:\pdvjv.exe58⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xlrxrxx.exec:\xlrxrxx.exe59⤵
- Executes dropped EXE
PID:3944 -
\??\c:\9rrlfxr.exec:\9rrlfxr.exe60⤵
- Executes dropped EXE
PID:4524 -
\??\c:\tntntt.exec:\tntntt.exe61⤵
- Executes dropped EXE
PID:1336 -
\??\c:\lfxrllx.exec:\lfxrllx.exe62⤵
- Executes dropped EXE
PID:3200 -
\??\c:\hbnttt.exec:\hbnttt.exe63⤵
- Executes dropped EXE
PID:3276 -
\??\c:\ttbbtn.exec:\ttbbtn.exe64⤵
- Executes dropped EXE
PID:4464 -
\??\c:\jddvv.exec:\jddvv.exe65⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3jvvp.exec:\3jvvp.exe66⤵PID:1216
-
\??\c:\xrrrllf.exec:\xrrrllf.exe67⤵PID:4000
-
\??\c:\hbntbb.exec:\hbntbb.exe68⤵PID:4032
-
\??\c:\pjvpv.exec:\pjvpv.exe69⤵PID:3280
-
\??\c:\pddvj.exec:\pddvj.exe70⤵PID:1248
-
\??\c:\3lrlxrr.exec:\3lrlxrr.exe71⤵PID:1132
-
\??\c:\bbtnnt.exec:\bbtnnt.exe72⤵PID:4304
-
\??\c:\nbnhhb.exec:\nbnhhb.exe73⤵PID:5052
-
\??\c:\tbbnht.exec:\tbbnht.exe74⤵PID:3196
-
\??\c:\vpdvj.exec:\vpdvj.exe75⤵PID:1036
-
\??\c:\jppjd.exec:\jppjd.exe76⤵PID:1200
-
\??\c:\xrlfrlx.exec:\xrlfrlx.exe77⤵PID:4928
-
\??\c:\ntbbtn.exec:\ntbbtn.exe78⤵PID:1808
-
\??\c:\pjddp.exec:\pjddp.exe79⤵PID:2500
-
\??\c:\xlrrrll.exec:\xlrrrll.exe80⤵PID:4476
-
\??\c:\bhnntt.exec:\bhnntt.exe81⤵PID:2360
-
\??\c:\bbnhhb.exec:\bbnhhb.exe82⤵PID:5112
-
\??\c:\pppvp.exec:\pppvp.exe83⤵PID:3900
-
\??\c:\5lxxffl.exec:\5lxxffl.exe84⤵PID:3408
-
\??\c:\btttnh.exec:\btttnh.exe85⤵PID:3964
-
\??\c:\tbbthh.exec:\tbbthh.exe86⤵PID:1932
-
\??\c:\5vvvp.exec:\5vvvp.exe87⤵PID:3056
-
\??\c:\hnbthh.exec:\hnbthh.exe88⤵PID:3760
-
\??\c:\btbbtt.exec:\btbbtt.exe89⤵PID:4696
-
\??\c:\dpjvd.exec:\dpjvd.exe90⤵PID:868
-
\??\c:\9lrlxxr.exec:\9lrlxxr.exe91⤵PID:4748
-
\??\c:\tttttn.exec:\tttttn.exe92⤵PID:960
-
\??\c:\jdjvp.exec:\jdjvp.exe93⤵PID:4320
-
\??\c:\xrrrrll.exec:\xrrrrll.exe94⤵PID:1852
-
\??\c:\xlfxllx.exec:\xlfxllx.exe95⤵PID:1092
-
\??\c:\nnnhtb.exec:\nnnhtb.exe96⤵PID:1332
-
\??\c:\vjvpd.exec:\vjvpd.exe97⤵PID:1636
-
\??\c:\xrrfrrl.exec:\xrrfrrl.exe98⤵PID:2404
-
\??\c:\bnhbnn.exec:\bnhbnn.exe99⤵PID:1516
-
\??\c:\hhhbbt.exec:\hhhbbt.exe100⤵PID:1320
-
\??\c:\jvjjv.exec:\jvjjv.exe101⤵PID:3728
-
\??\c:\fxxlfff.exec:\fxxlfff.exe102⤵PID:1532
-
\??\c:\rrxrxrx.exec:\rrxrxrx.exe103⤵PID:3088
-
\??\c:\hbthbt.exec:\hbthbt.exe104⤵PID:1888
-
\??\c:\pvdvp.exec:\pvdvp.exe105⤵PID:4704
-
\??\c:\nbtbhn.exec:\nbtbhn.exe106⤵PID:1512
-
\??\c:\3jdvp.exec:\3jdvp.exe107⤵PID:5044
-
\??\c:\vvvpj.exec:\vvvpj.exe108⤵PID:2488
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe109⤵PID:4524
-
\??\c:\bhhbnn.exec:\bhhbnn.exe110⤵PID:2780
-
\??\c:\jjdjd.exec:\jjdjd.exe111⤵PID:3200
-
\??\c:\1jddp.exec:\1jddp.exe112⤵PID:4464
-
\??\c:\rfffrxl.exec:\rfffrxl.exe113⤵PID:400
-
\??\c:\tthnbb.exec:\tthnbb.exe114⤵PID:3296
-
\??\c:\bttnhh.exec:\bttnhh.exe115⤵PID:4532
-
\??\c:\pjjvd.exec:\pjjvd.exe116⤵PID:2640
-
\??\c:\rxfxxrx.exec:\rxfxxrx.exe117⤵PID:3144
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe118⤵PID:4256
-
\??\c:\nhtnhh.exec:\nhtnhh.exe119⤵PID:2908
-
\??\c:\pppjd.exec:\pppjd.exe120⤵PID:3180
-
\??\c:\pvpvv.exec:\pvpvv.exe121⤵PID:4060
-
\??\c:\lrxllxx.exec:\lrxllxx.exe122⤵PID:3452
-
\??\c:\bttnbb.exec:\bttnbb.exe123⤵PID:1968
-
\??\c:\5jpjv.exec:\5jpjv.exe124⤵PID:2040
-
\??\c:\dddpd.exec:\dddpd.exe125⤵PID:324
-
\??\c:\lxxrlff.exec:\lxxrlff.exe126⤵PID:5036
-
\??\c:\bhtnbb.exec:\bhtnbb.exe127⤵PID:556
-
\??\c:\nnhhbt.exec:\nnhhbt.exe128⤵PID:2476
-
\??\c:\djddd.exec:\djddd.exe129⤵PID:3900
-
\??\c:\vpvpv.exec:\vpvpv.exe130⤵PID:2096
-
\??\c:\fxfrlfx.exec:\fxfrlfx.exe131⤵PID:2000
-
\??\c:\ffllllf.exec:\ffllllf.exe132⤵PID:2268
-
\??\c:\htthbt.exec:\htthbt.exe133⤵PID:3308
-
\??\c:\ddjvp.exec:\ddjvp.exe134⤵PID:4696
-
\??\c:\frlxfxr.exec:\frlxfxr.exe135⤵PID:868
-
\??\c:\bbhnbb.exec:\bbhnbb.exe136⤵PID:4484
-
\??\c:\jjjpd.exec:\jjjpd.exe137⤵PID:960
-
\??\c:\jjdvv.exec:\jjdvv.exe138⤵PID:1576
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe139⤵PID:2436
-
\??\c:\7fffrlr.exec:\7fffrlr.exe140⤵PID:792
-
\??\c:\hbnhnh.exec:\hbnhnh.exe141⤵PID:4152
-
\??\c:\pjvvv.exec:\pjvvv.exe142⤵PID:3540
-
\??\c:\vpppj.exec:\vpppj.exe143⤵PID:1496
-
\??\c:\fxffxfx.exec:\fxffxfx.exe144⤵PID:1364
-
\??\c:\fffxxrx.exec:\fffxxrx.exe145⤵PID:772
-
\??\c:\5ttnhh.exec:\5ttnhh.exe146⤵PID:5020
-
\??\c:\tnnhtn.exec:\tnnhtn.exe147⤵PID:3160
-
\??\c:\vpppd.exec:\vpppd.exe148⤵PID:2592
-
\??\c:\pdjdv.exec:\pdjdv.exe149⤵PID:3488
-
\??\c:\frrfxxf.exec:\frrfxxf.exe150⤵PID:1828
-
\??\c:\xrrxxrl.exec:\xrrxxrl.exe151⤵PID:1640
-
\??\c:\9nnnhb.exec:\9nnnhb.exe152⤵PID:2420
-
\??\c:\3djdj.exec:\3djdj.exe153⤵PID:2028
-
\??\c:\5xlffxf.exec:\5xlffxf.exe154⤵PID:4716
-
\??\c:\rrxrllx.exec:\rrxrllx.exe155⤵PID:1916
-
\??\c:\ttnhnn.exec:\ttnhnn.exe156⤵PID:1612
-
\??\c:\pjdvp.exec:\pjdvp.exe157⤵PID:4388
-
\??\c:\3fffrlf.exec:\3fffrlf.exe158⤵PID:4840
-
\??\c:\rxxxrlf.exec:\rxxxrlf.exe159⤵PID:4440
-
\??\c:\thnnnh.exec:\thnnnh.exe160⤵PID:436
-
\??\c:\bttnnn.exec:\bttnnn.exe161⤵PID:1804
-
\??\c:\3ddvp.exec:\3ddvp.exe162⤵PID:2908
-
\??\c:\vvvpp.exec:\vvvpp.exe163⤵PID:5056
-
\??\c:\5lrlxll.exec:\5lrlxll.exe164⤵PID:3612
-
\??\c:\fxxrffx.exec:\fxxrffx.exe165⤵PID:2088
-
\??\c:\tnhbnh.exec:\tnhbnh.exe166⤵PID:3216
-
\??\c:\3ppdv.exec:\3ppdv.exe167⤵PID:1808
-
\??\c:\rrxlxrr.exec:\rrxlxrr.exe168⤵PID:4144
-
\??\c:\lrrlllf.exec:\lrrlllf.exe169⤵PID:3028
-
\??\c:\tnnnhh.exec:\tnnnhh.exe170⤵PID:2052
-
\??\c:\5hhbtt.exec:\5hhbtt.exe171⤵PID:3048
-
\??\c:\dvppd.exec:\dvppd.exe172⤵PID:3408
-
\??\c:\lrxrffr.exec:\lrxrffr.exe173⤵PID:3964
-
\??\c:\1rrrxxr.exec:\1rrrxxr.exe174⤵PID:1076
-
\??\c:\hbtnnt.exec:\hbtnnt.exe175⤵PID:4832
-
\??\c:\vjjjd.exec:\vjjjd.exe176⤵PID:5100
-
\??\c:\jpdvj.exec:\jpdvj.exe177⤵PID:1020
-
\??\c:\xxlfflx.exec:\xxlfflx.exe178⤵PID:4748
-
\??\c:\tbtnbt.exec:\tbtnbt.exe179⤵PID:1424
-
\??\c:\vpppj.exec:\vpppj.exe180⤵PID:2916
-
\??\c:\3lfxrrl.exec:\3lfxrrl.exe181⤵PID:1852
-
\??\c:\9lllflx.exec:\9lllflx.exe182⤵PID:2444
-
\??\c:\hbbnhb.exec:\hbbnhb.exe183⤵PID:4952
-
\??\c:\1pvvp.exec:\1pvvp.exe184⤵PID:3224
-
\??\c:\jjpdv.exec:\jjpdv.exe185⤵PID:100
-
\??\c:\rrrfrfr.exec:\rrrfrfr.exe186⤵PID:2076
-
\??\c:\7hbtnh.exec:\7hbtnh.exe187⤵PID:2636
-
\??\c:\bbhtnn.exec:\bbhtnn.exe188⤵PID:3088
-
\??\c:\7ppjv.exec:\7ppjv.exe189⤵PID:4472
-
\??\c:\vpvpp.exec:\vpvpp.exe190⤵PID:2140
-
\??\c:\frxrrxr.exec:\frxrrxr.exe191⤵PID:4956
-
\??\c:\lfffrrx.exec:\lfffrrx.exe192⤵PID:3788
-
\??\c:\nnhtht.exec:\nnhtht.exe193⤵PID:3584
-
\??\c:\jpjvv.exec:\jpjvv.exe194⤵PID:3288
-
\??\c:\lfrfxfl.exec:\lfrfxfl.exe195⤵PID:2240
-
\??\c:\nhtnhb.exec:\nhtnhb.exe196⤵PID:3200
-
\??\c:\thtnnt.exec:\thtnnt.exe197⤵PID:1388
-
\??\c:\9vppj.exec:\9vppj.exe198⤵PID:4444
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe199⤵PID:1912
-
\??\c:\lxffxxx.exec:\lxffxxx.exe200⤵PID:1728
-
\??\c:\nhnnhb.exec:\nhnnhb.exe201⤵PID:4416
-
\??\c:\nhhbtb.exec:\nhhbtb.exe202⤵PID:4564
-
\??\c:\dddjd.exec:\dddjd.exe203⤵PID:5052
-
\??\c:\fxxffff.exec:\fxxffff.exe204⤵PID:3096
-
\??\c:\llfffff.exec:\llfffff.exe205⤵PID:4324
-
\??\c:\3tnhtt.exec:\3tnhtt.exe206⤵PID:3452
-
\??\c:\dvjjj.exec:\dvjjj.exe207⤵PID:4776
-
\??\c:\dvpjd.exec:\dvpjd.exe208⤵PID:4244
-
\??\c:\llxlxrx.exec:\llxlxrx.exe209⤵PID:2500
-
\??\c:\nthhtt.exec:\nthhtt.exe210⤵PID:4340
-
\??\c:\hbhtnh.exec:\hbhtnh.exe211⤵PID:2476
-
\??\c:\pjvvd.exec:\pjvvd.exe212⤵PID:2224
-
\??\c:\fxxrrlf.exec:\fxxrrlf.exe213⤵PID:2008
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe214⤵PID:4844
-
\??\c:\tnhhbt.exec:\tnhhbt.exe215⤵PID:4556
-
\??\c:\jdpjv.exec:\jdpjv.exe216⤵PID:860
-
\??\c:\jdjdp.exec:\jdjdp.exe217⤵PID:3760
-
\??\c:\xlffxll.exec:\xlffxll.exe218⤵PID:4612
-
\??\c:\9xffffl.exec:\9xffffl.exe219⤵PID:4316
-
\??\c:\nnthth.exec:\nnthth.exe220⤵PID:3996
-
\??\c:\vppjp.exec:\vppjp.exe221⤵PID:2452
-
\??\c:\pvppj.exec:\pvppj.exe222⤵PID:5008
-
\??\c:\rxxllfr.exec:\rxxllfr.exe223⤵PID:4884
-
\??\c:\llrrllf.exec:\llrrllf.exe224⤵PID:1112
-
\??\c:\5nnbth.exec:\5nnbth.exe225⤵PID:5112
-
\??\c:\jdpjv.exec:\jdpjv.exe226⤵PID:2152
-
\??\c:\5jvpj.exec:\5jvpj.exe227⤵PID:3204
-
\??\c:\9llrlxr.exec:\9llrlxr.exe228⤵PID:1992
-
\??\c:\bnnhnn.exec:\bnnhnn.exe229⤵PID:1896
-
\??\c:\bhtnbt.exec:\bhtnbt.exe230⤵PID:2104
-
\??\c:\vpddj.exec:\vpddj.exe231⤵PID:3492
-
\??\c:\jjddd.exec:\jjddd.exe232⤵PID:1368
-
\??\c:\rflfxrf.exec:\rflfxrf.exe233⤵PID:3516
-
\??\c:\nttttt.exec:\nttttt.exe234⤵PID:2012
-
\??\c:\3jvpp.exec:\3jvpp.exe235⤵PID:2720
-
\??\c:\vpdvd.exec:\vpdvd.exe236⤵PID:376
-
\??\c:\frxxxxx.exec:\frxxxxx.exe237⤵PID:3788
-
\??\c:\ttthbh.exec:\ttthbh.exe238⤵PID:3584
-
\??\c:\hhhbtt.exec:\hhhbtt.exe239⤵PID:3288
-
\??\c:\vpjdd.exec:\vpjdd.exe240⤵PID:1212
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe241⤵PID:4756
-
\??\c:\pvjpp.exec:\pvjpp.exe242⤵PID:4360