Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:30
Behavioral task
behavioral1
Sample
d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe
-
Size
169KB
-
MD5
d76caef928f4fa7d016bc20307422a90
-
SHA1
b8f4916bce06a246d223637e93716058fbcafc7a
-
SHA256
710ad4424f50f3202514b48546416bc3e7c8c619985eb778fbf0157281b79fb0
-
SHA512
e75b7d41100b827f87ffb7255a6e4b77d6895e84e567c2d16d6a3ea162a95a3385e62b5d312dd7bc770a02dc03ee4d184cf54d5b84fe0a1ac6e0da4346e3ce18
-
SSDEEP
1536:HvQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7FK4O8A1o4XEc3YtxD8/Ai2A:HhOmTsF93UYfwC6GIoutX8Ki3c3YT8Vf
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2276-1-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3628-7-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3480-13-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2920-18-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2092-24-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4744-34-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/372-38-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1488-48-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2652-49-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1724-55-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2328-60-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4468-71-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4748-94-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3348-92-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2728-104-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2040-107-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4888-118-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4364-127-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4804-133-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4500-143-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1688-156-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2384-158-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2324-164-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5096-169-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1252-181-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2440-191-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4672-195-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5068-201-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4384-205-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3128-215-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2860-219-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5008-227-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3928-233-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1964-237-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3804-242-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5028-249-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2016-256-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5112-273-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1736-282-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4588-295-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4364-308-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4300-310-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3556-323-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1552-322-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5072-333-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/736-341-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2224-345-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3060-350-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1040-390-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1348-406-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/760-426-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2868-442-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/116-457-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4548-464-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4672-516-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2092-539-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1444-559-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1424-570-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4996-582-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2892-601-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/232-650-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4324-661-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4236-935-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4996-971-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1vdvj.exelrrrfrl.exebnnhbh.exebbhbnn.exejdjdv.exe7thhbb.exe9thbbb.exe5pdvv.exepvvjd.exe5xxxxfx.exenhbttt.exexxxxlxl.exe9xfxrrl.exebhtnnh.exevddvv.exepppvv.exefxrrllf.exe7jddv.exefrrlfff.exenbhhnb.exe9bbhbh.exerfrllll.exe5frlllr.exe5bntnn.exedjppv.exe1ffxrrr.exe3hhnhh.exejvddv.exevppjv.exelffxlfx.exebhnhhb.exe3tnnhh.exerlrlllf.exe9lrrrff.exeflxxrrr.exe7bttnt.exevjddv.exerrrlfxr.exe9xrxxfl.exebbhhhh.exefrrllff.exefrrrlxx.exe5xxrllf.exetbnhht.exejpvpv.exerflfxxr.exerxffxxx.exentbhbb.exehtnhtt.exe1vvdv.exellfxlxx.exexrrlffx.exebhttnn.exehtnbtn.exe3dddj.exejjjdp.exelflfxxr.exexllrlll.exehntbhn.exentbhhh.exejpvvv.exerlxrrrx.exerrrlrxx.exenhhbtt.exepid process 3628 1vdvj.exe 3480 lrrrfrl.exe 2920 bnnhbh.exe 2092 bbhbnn.exe 4744 jdjdv.exe 372 7thhbb.exe 1488 9thbbb.exe 2652 5pdvv.exe 1724 pvvjd.exe 2328 5xxxxfx.exe 2016 nhbttt.exe 4468 xxxxlxl.exe 4908 9xfxrrl.exe 4064 bhtnnh.exe 3348 vddvv.exe 4748 pppvv.exe 2728 fxrrllf.exe 2040 7jddv.exe 4244 frrlfff.exe 4888 nbhhnb.exe 4364 9bbhbh.exe 4804 rfrllll.exe 3144 5frlllr.exe 4500 5bntnn.exe 4676 djppv.exe 1688 1ffxrrr.exe 2384 3hhnhh.exe 2324 jvddv.exe 5096 vppjv.exe 3060 lffxlfx.exe 1252 bhnhhb.exe 5000 3tnnhh.exe 2440 rlrlllf.exe 4672 9lrrrff.exe 5068 flxxrrr.exe 4384 7bttnt.exe 2268 vjddv.exe 712 rrrlfxr.exe 3128 9xrxxfl.exe 2860 bbhhhh.exe 992 frrllff.exe 4456 frrrlxx.exe 5008 5xxrllf.exe 3928 tbnhht.exe 1964 jpvpv.exe 4460 rflfxxr.exe 3804 rxffxxx.exe 1924 ntbhbb.exe 5028 htnhtt.exe 1424 1vvdv.exe 2016 llfxlxx.exe 4468 xrrlffx.exe 2156 bhttnn.exe 4140 htnbtn.exe 3652 3dddj.exe 5112 jjjdp.exe 2180 lflfxxr.exe 4928 xllrlll.exe 1736 hntbhn.exe 4976 ntbhhh.exe 1440 jpvvv.exe 4588 rlxrrrx.exe 4888 rrrlrxx.exe 4692 nhhbtt.exe -
Processes:
resource yara_rule behavioral2/memory/2276-1-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\1vdvj.exe upx behavioral2/memory/3628-7-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\lrrrfrl.exe upx C:\bnnhbh.exe upx behavioral2/memory/3480-13-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2920-18-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\bbhbnn.exe upx behavioral2/memory/2092-24-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\jdjdv.exe upx behavioral2/memory/4744-28-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\7thhbb.exe upx behavioral2/memory/4744-34-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/372-38-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\9thbbb.exe upx C:\5pdvv.exe upx behavioral2/memory/1488-48-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\pvvjd.exe upx behavioral2/memory/2652-49-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1724-55-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\5xxxxfx.exe upx behavioral2/memory/2328-60-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\nhbttt.exe upx C:\xxxxlxl.exe upx behavioral2/memory/4468-71-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\9xfxrrl.exe upx C:\bhtnnh.exe upx C:\vddvv.exe upx behavioral2/memory/4748-94-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\fxrrllf.exe upx \??\c:\pppvv.exe upx behavioral2/memory/3348-92-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2728-99-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2728-104-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\7jddv.exe upx behavioral2/memory/2040-107-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\frrlfff.exe upx C:\nbhhnb.exe upx behavioral2/memory/4888-118-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\9bbhbh.exe upx C:\rfrllll.exe upx behavioral2/memory/4364-127-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4804-133-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\5frlllr.exe upx C:\5bntnn.exe upx C:\djppv.exe upx behavioral2/memory/4500-143-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\1ffxrrr.exe upx C:\3hhnhh.exe upx behavioral2/memory/1688-156-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2384-158-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\jvddv.exe upx behavioral2/memory/2324-164-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\vppjv.exe upx \??\c:\lffxlfx.exe upx behavioral2/memory/5096-169-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\bhnhhb.exe upx behavioral2/memory/1252-181-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\3tnnhh.exe upx behavioral2/memory/5000-186-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2440-191-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4672-195-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/5068-201-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4384-205-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe1vdvj.exelrrrfrl.exebnnhbh.exebbhbnn.exejdjdv.exe7thhbb.exe9thbbb.exe5pdvv.exepvvjd.exe5xxxxfx.exenhbttt.exexxxxlxl.exe9xfxrrl.exebhtnnh.exevddvv.exepppvv.exefxrrllf.exe7jddv.exefrrlfff.exenbhhnb.exe9bbhbh.exedescription pid process target process PID 2276 wrote to memory of 3628 2276 d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe 1vdvj.exe PID 2276 wrote to memory of 3628 2276 d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe 1vdvj.exe PID 2276 wrote to memory of 3628 2276 d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe 1vdvj.exe PID 3628 wrote to memory of 3480 3628 1vdvj.exe lrrrfrl.exe PID 3628 wrote to memory of 3480 3628 1vdvj.exe lrrrfrl.exe PID 3628 wrote to memory of 3480 3628 1vdvj.exe lrrrfrl.exe PID 3480 wrote to memory of 2920 3480 lrrrfrl.exe bnnhbh.exe PID 3480 wrote to memory of 2920 3480 lrrrfrl.exe bnnhbh.exe PID 3480 wrote to memory of 2920 3480 lrrrfrl.exe bnnhbh.exe PID 2920 wrote to memory of 2092 2920 bnnhbh.exe bbhbnn.exe PID 2920 wrote to memory of 2092 2920 bnnhbh.exe bbhbnn.exe PID 2920 wrote to memory of 2092 2920 bnnhbh.exe bbhbnn.exe PID 2092 wrote to memory of 4744 2092 bbhbnn.exe jdjdv.exe PID 2092 wrote to memory of 4744 2092 bbhbnn.exe jdjdv.exe PID 2092 wrote to memory of 4744 2092 bbhbnn.exe jdjdv.exe PID 4744 wrote to memory of 372 4744 jdjdv.exe 7thhbb.exe PID 4744 wrote to memory of 372 4744 jdjdv.exe 7thhbb.exe PID 4744 wrote to memory of 372 4744 jdjdv.exe 7thhbb.exe PID 372 wrote to memory of 1488 372 7thhbb.exe 9thbbb.exe PID 372 wrote to memory of 1488 372 7thhbb.exe 9thbbb.exe PID 372 wrote to memory of 1488 372 7thhbb.exe 9thbbb.exe PID 1488 wrote to memory of 2652 1488 9thbbb.exe 5pdvv.exe PID 1488 wrote to memory of 2652 1488 9thbbb.exe 5pdvv.exe PID 1488 wrote to memory of 2652 1488 9thbbb.exe 5pdvv.exe PID 2652 wrote to memory of 1724 2652 5pdvv.exe pvvjd.exe PID 2652 wrote to memory of 1724 2652 5pdvv.exe pvvjd.exe PID 2652 wrote to memory of 1724 2652 5pdvv.exe pvvjd.exe PID 1724 wrote to memory of 2328 1724 pvvjd.exe 5xxxxfx.exe PID 1724 wrote to memory of 2328 1724 pvvjd.exe 5xxxxfx.exe PID 1724 wrote to memory of 2328 1724 pvvjd.exe 5xxxxfx.exe PID 2328 wrote to memory of 2016 2328 5xxxxfx.exe nhbttt.exe PID 2328 wrote to memory of 2016 2328 5xxxxfx.exe nhbttt.exe PID 2328 wrote to memory of 2016 2328 5xxxxfx.exe nhbttt.exe PID 2016 wrote to memory of 4468 2016 nhbttt.exe xxxxlxl.exe PID 2016 wrote to memory of 4468 2016 nhbttt.exe xxxxlxl.exe PID 2016 wrote to memory of 4468 2016 nhbttt.exe xxxxlxl.exe PID 4468 wrote to memory of 4908 4468 xxxxlxl.exe 9xfxrrl.exe PID 4468 wrote to memory of 4908 4468 xxxxlxl.exe 9xfxrrl.exe PID 4468 wrote to memory of 4908 4468 xxxxlxl.exe 9xfxrrl.exe PID 4908 wrote to memory of 4064 4908 9xfxrrl.exe bhtnnh.exe PID 4908 wrote to memory of 4064 4908 9xfxrrl.exe bhtnnh.exe PID 4908 wrote to memory of 4064 4908 9xfxrrl.exe bhtnnh.exe PID 4064 wrote to memory of 3348 4064 bhtnnh.exe vddvv.exe PID 4064 wrote to memory of 3348 4064 bhtnnh.exe vddvv.exe PID 4064 wrote to memory of 3348 4064 bhtnnh.exe vddvv.exe PID 3348 wrote to memory of 4748 3348 vddvv.exe pppvv.exe PID 3348 wrote to memory of 4748 3348 vddvv.exe pppvv.exe PID 3348 wrote to memory of 4748 3348 vddvv.exe pppvv.exe PID 4748 wrote to memory of 2728 4748 pppvv.exe fxrrllf.exe PID 4748 wrote to memory of 2728 4748 pppvv.exe fxrrllf.exe PID 4748 wrote to memory of 2728 4748 pppvv.exe fxrrllf.exe PID 2728 wrote to memory of 2040 2728 fxrrllf.exe 7jddv.exe PID 2728 wrote to memory of 2040 2728 fxrrllf.exe 7jddv.exe PID 2728 wrote to memory of 2040 2728 fxrrllf.exe 7jddv.exe PID 2040 wrote to memory of 4244 2040 7jddv.exe frrlfff.exe PID 2040 wrote to memory of 4244 2040 7jddv.exe frrlfff.exe PID 2040 wrote to memory of 4244 2040 7jddv.exe frrlfff.exe PID 4244 wrote to memory of 4888 4244 frrlfff.exe nbhhnb.exe PID 4244 wrote to memory of 4888 4244 frrlfff.exe nbhhnb.exe PID 4244 wrote to memory of 4888 4244 frrlfff.exe nbhhnb.exe PID 4888 wrote to memory of 4364 4888 nbhhnb.exe 9bbhbh.exe PID 4888 wrote to memory of 4364 4888 nbhhnb.exe 9bbhbh.exe PID 4888 wrote to memory of 4364 4888 nbhhnb.exe 9bbhbh.exe PID 4364 wrote to memory of 4804 4364 9bbhbh.exe rfrllll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\1vdvj.exec:\1vdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\lrrrfrl.exec:\lrrrfrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\bnnhbh.exec:\bnnhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\bbhbnn.exec:\bbhbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\jdjdv.exec:\jdjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\7thhbb.exec:\7thhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\9thbbb.exec:\9thbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\5pdvv.exec:\5pdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pvvjd.exec:\pvvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\5xxxxfx.exec:\5xxxxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\nhbttt.exec:\nhbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\xxxxlxl.exec:\xxxxlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\9xfxrrl.exec:\9xfxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\bhtnnh.exec:\bhtnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\vddvv.exec:\vddvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\pppvv.exec:\pppvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\fxrrllf.exec:\fxrrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\7jddv.exec:\7jddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\frrlfff.exec:\frrlfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\nbhhnb.exec:\nbhhnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\9bbhbh.exec:\9bbhbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\rfrllll.exec:\rfrllll.exe23⤵
- Executes dropped EXE
PID:4804 -
\??\c:\5frlllr.exec:\5frlllr.exe24⤵
- Executes dropped EXE
PID:3144 -
\??\c:\5bntnn.exec:\5bntnn.exe25⤵
- Executes dropped EXE
PID:4500 -
\??\c:\djppv.exec:\djppv.exe26⤵
- Executes dropped EXE
PID:4676 -
\??\c:\1ffxrrr.exec:\1ffxrrr.exe27⤵
- Executes dropped EXE
PID:1688 -
\??\c:\3hhnhh.exec:\3hhnhh.exe28⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jvddv.exec:\jvddv.exe29⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vppjv.exec:\vppjv.exe30⤵
- Executes dropped EXE
PID:5096 -
\??\c:\lffxlfx.exec:\lffxlfx.exe31⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bhnhhb.exec:\bhnhhb.exe32⤵
- Executes dropped EXE
PID:1252 -
\??\c:\3tnnhh.exec:\3tnnhh.exe33⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rlrlllf.exec:\rlrlllf.exe34⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9lrrrff.exec:\9lrrrff.exe35⤵
- Executes dropped EXE
PID:4672 -
\??\c:\flxxrrr.exec:\flxxrrr.exe36⤵
- Executes dropped EXE
PID:5068 -
\??\c:\7bttnt.exec:\7bttnt.exe37⤵
- Executes dropped EXE
PID:4384 -
\??\c:\vjddv.exec:\vjddv.exe38⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rrrlfxr.exec:\rrrlfxr.exe39⤵
- Executes dropped EXE
PID:712 -
\??\c:\9xrxxfl.exec:\9xrxxfl.exe40⤵
- Executes dropped EXE
PID:3128 -
\??\c:\bbhhhh.exec:\bbhhhh.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\frrllff.exec:\frrllff.exe42⤵
- Executes dropped EXE
PID:992 -
\??\c:\frrrlxx.exec:\frrrlxx.exe43⤵
- Executes dropped EXE
PID:4456 -
\??\c:\5xxrllf.exec:\5xxrllf.exe44⤵
- Executes dropped EXE
PID:5008 -
\??\c:\tbnhht.exec:\tbnhht.exe45⤵
- Executes dropped EXE
PID:3928 -
\??\c:\jpvpv.exec:\jpvpv.exe46⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rflfxxr.exec:\rflfxxr.exe47⤵
- Executes dropped EXE
PID:4460 -
\??\c:\rxffxxx.exec:\rxffxxx.exe48⤵
- Executes dropped EXE
PID:3804 -
\??\c:\ntbhbb.exec:\ntbhbb.exe49⤵
- Executes dropped EXE
PID:1924 -
\??\c:\htnhtt.exec:\htnhtt.exe50⤵
- Executes dropped EXE
PID:5028 -
\??\c:\1vvdv.exec:\1vvdv.exe51⤵
- Executes dropped EXE
PID:1424 -
\??\c:\llfxlxx.exec:\llfxlxx.exe52⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xrrlffx.exec:\xrrlffx.exe53⤵
- Executes dropped EXE
PID:4468 -
\??\c:\bhttnn.exec:\bhttnn.exe54⤵
- Executes dropped EXE
PID:2156 -
\??\c:\htnbtn.exec:\htnbtn.exe55⤵
- Executes dropped EXE
PID:4140 -
\??\c:\3dddj.exec:\3dddj.exe56⤵
- Executes dropped EXE
PID:3652 -
\??\c:\jjjdp.exec:\jjjdp.exe57⤵
- Executes dropped EXE
PID:5112 -
\??\c:\lflfxxr.exec:\lflfxxr.exe58⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xllrlll.exec:\xllrlll.exe59⤵
- Executes dropped EXE
PID:4928 -
\??\c:\hntbhn.exec:\hntbhn.exe60⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ntbhhh.exec:\ntbhhh.exe61⤵
- Executes dropped EXE
PID:4976 -
\??\c:\jpvvv.exec:\jpvvv.exe62⤵
- Executes dropped EXE
PID:1440 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe63⤵
- Executes dropped EXE
PID:4588 -
\??\c:\rrrlrxx.exec:\rrrlrxx.exe64⤵
- Executes dropped EXE
PID:4888 -
\??\c:\nhhbtt.exec:\nhhbtt.exe65⤵
- Executes dropped EXE
PID:4692 -
\??\c:\bttnbb.exec:\bttnbb.exe66⤵PID:4716
-
\??\c:\pjpjv.exec:\pjpjv.exe67⤵PID:4364
-
\??\c:\1jppp.exec:\1jppp.exe68⤵PID:4300
-
\??\c:\llffrrf.exec:\llffrrf.exe69⤵PID:4852
-
\??\c:\xlxfffl.exec:\xlxfffl.exe70⤵PID:1524
-
\??\c:\thtbhh.exec:\thtbhh.exe71⤵PID:1552
-
\??\c:\5nhbtt.exec:\5nhbtt.exe72⤵PID:3556
-
\??\c:\ppvvv.exec:\ppvvv.exe73⤵PID:2832
-
\??\c:\pdjjd.exec:\pdjjd.exe74⤵PID:5072
-
\??\c:\rlrxrll.exec:\rlrxrll.exe75⤵PID:220
-
\??\c:\nbntbb.exec:\nbntbb.exe76⤵PID:736
-
\??\c:\tnnhtt.exec:\tnnhtt.exe77⤵PID:2224
-
\??\c:\jddvj.exec:\jddvj.exe78⤵PID:3332
-
\??\c:\xrllfff.exec:\xrllfff.exe79⤵PID:3060
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe80⤵PID:4224
-
\??\c:\7ntttt.exec:\7ntttt.exe81⤵PID:1804
-
\??\c:\bttnhh.exec:\bttnhh.exe82⤵PID:4072
-
\??\c:\frfxlff.exec:\frfxlff.exe83⤵PID:4612
-
\??\c:\xxffflf.exec:\xxffflf.exe84⤵PID:4332
-
\??\c:\ntbthh.exec:\ntbthh.exe85⤵PID:2204
-
\??\c:\btnhnn.exec:\btnhnn.exe86⤵PID:3648
-
\??\c:\jvdvv.exec:\jvdvv.exe87⤵PID:872
-
\??\c:\lfxrrlf.exec:\lfxrrlf.exe88⤵PID:3808
-
\??\c:\lflrxxx.exec:\lflrxxx.exe89⤵PID:4256
-
\??\c:\nbhbtt.exec:\nbhbtt.exe90⤵PID:2092
-
\??\c:\nntnhb.exec:\nntnhb.exe91⤵PID:1040
-
\??\c:\vdddv.exec:\vdddv.exe92⤵PID:3124
-
\??\c:\3lfxrrl.exec:\3lfxrrl.exe93⤵PID:1748
-
\??\c:\nnnhth.exec:\nnnhth.exe94⤵PID:1488
-
\??\c:\3dvjv.exec:\3dvjv.exe95⤵PID:2652
-
\??\c:\ddvvj.exec:\ddvvj.exe96⤵PID:1348
-
\??\c:\lrlrfxx.exec:\lrlrfxx.exe97⤵PID:3804
-
\??\c:\1lxffxr.exec:\1lxffxr.exe98⤵PID:4912
-
\??\c:\3nhbtb.exec:\3nhbtb.exe99⤵PID:4900
-
\??\c:\tnbttt.exec:\tnbttt.exe100⤵PID:4432
-
\??\c:\jdjdd.exec:\jdjdd.exe101⤵PID:5080
-
\??\c:\xfllffx.exec:\xfllffx.exe102⤵PID:4468
-
\??\c:\5lxxxxf.exec:\5lxxxxf.exe103⤵PID:760
-
\??\c:\bnhnbb.exec:\bnhnbb.exe104⤵PID:1016
-
\??\c:\3jjjp.exec:\3jjjp.exe105⤵PID:3652
-
\??\c:\dvjjp.exec:\dvjjp.exe106⤵PID:3796
-
\??\c:\lfffxfr.exec:\lfffxfr.exe107⤵PID:4824
-
\??\c:\rllxrfx.exec:\rllxrfx.exe108⤵PID:2868
-
\??\c:\btbtnn.exec:\btbtnn.exe109⤵PID:2040
-
\??\c:\pdddd.exec:\pdddd.exe110⤵PID:4624
-
\??\c:\ppjdv.exec:\ppjdv.exe111⤵PID:1700
-
\??\c:\fxxfrff.exec:\fxxfrff.exe112⤵PID:116
-
\??\c:\rlrllff.exec:\rlrllff.exe113⤵PID:4440
-
\??\c:\bbbbtt.exec:\bbbbtt.exe114⤵PID:4548
-
\??\c:\djvdd.exec:\djvdd.exe115⤵PID:3944
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe116⤵PID:4364
-
\??\c:\fxlllff.exec:\fxlllff.exe117⤵PID:1604
-
\??\c:\bbbbbt.exec:\bbbbbt.exe118⤵PID:1128
-
\??\c:\btbtnn.exec:\btbtnn.exe119⤵PID:3372
-
\??\c:\vvdvv.exec:\vvdvv.exe120⤵PID:3556
-
\??\c:\7dpjv.exec:\7dpjv.exe121⤵PID:1752
-
\??\c:\rllxlll.exec:\rllxlll.exe122⤵PID:5072
-
\??\c:\xrlffff.exec:\xrlffff.exe123⤵PID:1228
-
\??\c:\nnbbnh.exec:\nnbbnh.exe124⤵PID:736
-
\??\c:\5bttnn.exec:\5bttnn.exe125⤵PID:2224
-
\??\c:\ddvvp.exec:\ddvvp.exe126⤵PID:640
-
\??\c:\dpvvp.exec:\dpvvp.exe127⤵PID:3820
-
\??\c:\xrxrlll.exec:\xrxrlll.exe128⤵PID:3968
-
\??\c:\fxxrxxx.exec:\fxxrxxx.exe129⤵PID:1844
-
\??\c:\nnnttt.exec:\nnnttt.exe130⤵PID:3768
-
\??\c:\vpdvp.exec:\vpdvp.exe131⤵PID:4672
-
\??\c:\xlrrfff.exec:\xlrrfff.exe132⤵PID:4392
-
\??\c:\1bhhbt.exec:\1bhhbt.exe133⤵PID:4920
-
\??\c:\nhbbtn.exec:\nhbbtn.exe134⤵PID:3452
-
\??\c:\vjvpj.exec:\vjvpj.exe135⤵PID:4444
-
\??\c:\5frrlrr.exec:\5frrlrr.exe136⤵PID:3580
-
\??\c:\7fxrxxx.exec:\7fxrxxx.exe137⤵PID:2920
-
\??\c:\hbnhnb.exec:\hbnhnb.exe138⤵PID:1612
-
\??\c:\hnbhhh.exec:\hnbhhh.exe139⤵PID:2092
-
\??\c:\9vdvv.exec:\9vdvv.exe140⤵PID:1040
-
\??\c:\lffffrf.exec:\lffffrf.exe141⤵PID:1548
-
\??\c:\rrflllf.exec:\rrflllf.exe142⤵PID:1748
-
\??\c:\bnhnht.exec:\bnhnht.exe143⤵PID:1488
-
\??\c:\ppvvp.exec:\ppvvp.exe144⤵PID:4524
-
\??\c:\vjvpj.exec:\vjvpj.exe145⤵PID:1444
-
\??\c:\frrlfxx.exec:\frrlfxx.exe146⤵PID:2744
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe147⤵PID:1424
-
\??\c:\bhnthb.exec:\bhnthb.exe148⤵PID:3248
-
\??\c:\bbhhtb.exec:\bbhhtb.exe149⤵PID:5064
-
\??\c:\jdpjd.exec:\jdpjd.exe150⤵PID:1388
-
\??\c:\jpvjj.exec:\jpvjj.exe151⤵PID:4892
-
\??\c:\lfrrffx.exec:\lfrrffx.exe152⤵PID:4996
-
\??\c:\lflllrr.exec:\lflllrr.exe153⤵PID:4748
-
\??\c:\7nhbtt.exec:\7nhbtt.exe154⤵PID:3652
-
\??\c:\5tnhbt.exec:\5tnhbt.exe155⤵PID:4928
-
\??\c:\ddppv.exec:\ddppv.exe156⤵PID:3308
-
\??\c:\jjvpj.exec:\jjvpj.exe157⤵PID:2892
-
\??\c:\lrrrllx.exec:\lrrrllx.exe158⤵PID:1440
-
\??\c:\9fxrrll.exec:\9fxrrll.exe159⤵PID:1652
-
\??\c:\3bnhnn.exec:\3bnhnn.exe160⤵PID:244
-
\??\c:\9tbbbn.exec:\9tbbbn.exe161⤵PID:1156
-
\??\c:\ddvpd.exec:\ddvpd.exe162⤵PID:1136
-
\??\c:\xlrrffx.exec:\xlrrffx.exe163⤵PID:4852
-
\??\c:\frxrfxl.exec:\frxrfxl.exe164⤵PID:4676
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe165⤵PID:4040
-
\??\c:\bnnhbt.exec:\bnnhbt.exe166⤵PID:3988
-
\??\c:\hbbbnn.exec:\hbbbnn.exe167⤵PID:2024
-
\??\c:\dvdvd.exec:\dvdvd.exe168⤵PID:2284
-
\??\c:\frrlllf.exec:\frrlllf.exe169⤵PID:4372
-
\??\c:\ffxxxxr.exec:\ffxxxxr.exe170⤵PID:4472
-
\??\c:\bbbbbh.exec:\bbbbbh.exe171⤵PID:2852
-
\??\c:\bttnbb.exec:\bttnbb.exe172⤵PID:3552
-
\??\c:\pjdvv.exec:\pjdvv.exe173⤵PID:3764
-
\??\c:\jdjjv.exec:\jdjjv.exe174⤵PID:232
-
\??\c:\9pppj.exec:\9pppj.exe175⤵PID:4332
-
\??\c:\5lrrlll.exec:\5lrrlll.exe176⤵PID:3360
-
\??\c:\htttnn.exec:\htttnn.exe177⤵PID:4324
-
\??\c:\bttnbb.exec:\bttnbb.exe178⤵PID:3128
-
\??\c:\jvjpp.exec:\jvjpp.exe179⤵PID:2936
-
\??\c:\xrrxxfr.exec:\xrrxxfr.exe180⤵PID:3268
-
\??\c:\xfllflf.exec:\xfllflf.exe181⤵PID:1612
-
\??\c:\htnnhh.exec:\htnnhh.exe182⤵PID:4504
-
\??\c:\jdvpj.exec:\jdvpj.exe183⤵PID:2520
-
\??\c:\pjpjj.exec:\pjpjj.exe184⤵PID:4452
-
\??\c:\xlfxrrf.exec:\xlfxrrf.exe185⤵PID:3484
-
\??\c:\3xrlffx.exec:\3xrlffx.exe186⤵PID:2724
-
\??\c:\ttbnht.exec:\ttbnht.exe187⤵PID:4600
-
\??\c:\5bbthh.exec:\5bbthh.exe188⤵PID:3052
-
\??\c:\pjpjj.exec:\pjpjj.exe189⤵PID:2328
-
\??\c:\jdvpj.exec:\jdvpj.exe190⤵PID:4528
-
\??\c:\xlrlffx.exec:\xlrlffx.exe191⤵PID:400
-
\??\c:\rxxfrff.exec:\rxxfrff.exe192⤵PID:2156
-
\??\c:\frrrlfx.exec:\frrrlfx.exe193⤵PID:5100
-
\??\c:\tnhbtt.exec:\tnhbtt.exe194⤵PID:2080
-
\??\c:\tntthh.exec:\tntthh.exe195⤵PID:4124
-
\??\c:\jvjdp.exec:\jvjdp.exe196⤵PID:4988
-
\??\c:\dppjd.exec:\dppjd.exe197⤵PID:3384
-
\??\c:\lxfxllf.exec:\lxfxllf.exe198⤵PID:1736
-
\??\c:\lllllrl.exec:\lllllrl.exe199⤵PID:4928
-
\??\c:\nbthnh.exec:\nbthnh.exe200⤵PID:3308
-
\??\c:\djjvp.exec:\djjvp.exe201⤵PID:4588
-
\??\c:\dvpjd.exec:\dvpjd.exe202⤵PID:116
-
\??\c:\llxxffx.exec:\llxxffx.exe203⤵PID:3636
-
\??\c:\nbhbtt.exec:\nbhbtt.exe204⤵PID:3852
-
\??\c:\7bthbt.exec:\7bthbt.exe205⤵PID:2908
-
\??\c:\pddvj.exec:\pddvj.exe206⤵PID:5004
-
\??\c:\jdpvp.exec:\jdpvp.exe207⤵PID:2760
-
\??\c:\lrfxxrf.exec:\lrfxxrf.exe208⤵PID:2384
-
\??\c:\nnhbth.exec:\nnhbth.exe209⤵PID:220
-
\??\c:\thbtnn.exec:\thbtnn.exe210⤵PID:4980
-
\??\c:\pdjdv.exec:\pdjdv.exe211⤵PID:4668
-
\??\c:\vjjjv.exec:\vjjjv.exe212⤵PID:3084
-
\??\c:\frrllff.exec:\frrllff.exe213⤵PID:4116
-
\??\c:\jjpdp.exec:\jjpdp.exe214⤵PID:3968
-
\??\c:\5xfxxxr.exec:\5xfxxxr.exe215⤵PID:4072
-
\??\c:\fxlrfff.exec:\fxlrfff.exe216⤵PID:2816
-
\??\c:\htnnhb.exec:\htnnhb.exe217⤵PID:2276
-
\??\c:\thhhhh.exec:\thhhhh.exe218⤵PID:4496
-
\??\c:\vvjpd.exec:\vvjpd.exe219⤵PID:3648
-
\??\c:\5djdj.exec:\5djdj.exe220⤵PID:4544
-
\??\c:\rrrrlrx.exec:\rrrrlrx.exe221⤵PID:3808
-
\??\c:\7lffxxr.exec:\7lffxxr.exe222⤵PID:992
-
\??\c:\nhtnhh.exec:\nhtnhh.exe223⤵PID:4728
-
\??\c:\nbtnnn.exec:\nbtnnn.exe224⤵PID:4236
-
\??\c:\jdvpj.exec:\jdvpj.exe225⤵PID:1456
-
\??\c:\dddvp.exec:\dddvp.exe226⤵PID:4360
-
\??\c:\xlfxllf.exec:\xlfxllf.exe227⤵PID:2652
-
\??\c:\rlxlfxr.exec:\rlxlfxr.exe228⤵PID:3484
-
\??\c:\3bnhbh.exec:\3bnhbh.exe229⤵PID:4524
-
\??\c:\bhnhbb.exec:\bhnhbb.exe230⤵PID:4600
-
\??\c:\pdjpv.exec:\pdjpv.exe231⤵PID:2000
-
\??\c:\7dvjv.exec:\7dvjv.exe232⤵PID:2016
-
\??\c:\xxrfxxl.exec:\xxrfxxl.exe233⤵PID:4528
-
\??\c:\1lllflf.exec:\1lllflf.exe234⤵PID:400
-
\??\c:\7ntnhh.exec:\7ntnhh.exe235⤵PID:4036
-
\??\c:\nhhhtn.exec:\nhhhtn.exe236⤵PID:3536
-
\??\c:\pvvvp.exec:\pvvvp.exe237⤵PID:928
-
\??\c:\7jjjj.exec:\7jjjj.exe238⤵PID:4124
-
\??\c:\xlfrffx.exec:\xlfrffx.exe239⤵PID:3796
-
\??\c:\flxrrrl.exec:\flxrrrl.exe240⤵PID:2868
-
\??\c:\nnnnnt.exec:\nnnnnt.exe241⤵PID:1928
-
\??\c:\bntnbb.exec:\bntnbb.exe242⤵PID:2892