Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 05:29
Behavioral task
behavioral1
Sample
b93706016c764fbd88acf14760156490_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b93706016c764fbd88acf14760156490_NeikiAnalytics.exe
-
Size
455KB
-
MD5
b93706016c764fbd88acf14760156490
-
SHA1
15a0960c4bb46cc26ea24a2b99834bf2af635125
-
SHA256
8601fbe0d1a0c97b1a6f129e999ad252b9a8aa2fc755ac5bb3fe362e8cc27fd2
-
SHA512
f6e3e2cfecc78e96775bcbc597fb5620a067ad080c3025b89f75c9f2c2b217d91bc20a90aab0a26f59f134a46131c4e515b940d4062564d71e60fc430c89638b
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nPYERAAUDCa4NYmU:HFp3lz1XUDCaGYmU
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4788-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/320-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/808-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2840-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4280-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1108-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2856-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-572-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdjvp.exehnnthh.exejjdvp.exelxfxrlf.exenhhnth.exejvdvj.exenhbbhh.exe1ddjj.exelxxllff.exedjvdp.exefffxrrr.exenthntb.exethbtnn.exedjvjv.exe1fxllfr.exebhhnth.exevjvjp.exexflfrlf.exenhbhhn.exerfrxrrf.exevddvj.exelxxrflf.exebhttbb.exevdpjv.exe3xxlfrl.exentntnh.exevpjjj.exexflrxrr.exenhtbbh.exe7jjvp.exexfxfxlf.exebnthnt.exexxlrflx.exetntnhb.exepjdpd.exettbhhn.exevdpvj.exefxrrxxr.exexrfflfl.exehnhbhh.exexrrlxrx.exebnttth.exejpdpd.exerxfrlll.exennhhnt.exejdppp.exe7xfxxff.exennnnht.exepdpjd.exeppppd.exelllxrrl.exehnhbbb.exe3vpjd.exellrfrrf.exe7btnhh.exejvjvp.exelflffrl.exehnntnb.exedddjp.exefxfxlxf.exenhbbbb.exeppddv.exerlxllll.exetnhhbb.exepid process 1508 jdjvp.exe 1420 hnnthh.exe 320 jjdvp.exe 4832 lxfxrlf.exe 4760 nhhnth.exe 2280 jvdvj.exe 4624 nhbbhh.exe 3236 1ddjj.exe 1408 lxxllff.exe 3752 djvdp.exe 1108 fffxrrr.exe 5044 nthntb.exe 3112 thbtnn.exe 4920 djvjv.exe 4392 1fxllfr.exe 2088 bhhnth.exe 4604 vjvjp.exe 4936 xflfrlf.exe 932 nhbhhn.exe 1676 rfrxrrf.exe 3692 vddvj.exe 4300 lxxrflf.exe 1512 bhttbb.exe 2376 vdpjv.exe 4256 3xxlfrl.exe 3260 ntntnh.exe 1604 vpjjj.exe 1160 xflrxrr.exe 4436 nhtbbh.exe 1848 7jjvp.exe 4340 xfxfxlf.exe 1880 bnthnt.exe 452 xxlrflx.exe 4268 tntnhb.exe 4368 pjdpd.exe 4812 ttbhhn.exe 2992 vdpvj.exe 4576 fxrrxxr.exe 888 xrfflfl.exe 808 hnhbhh.exe 1340 xrrlxrx.exe 1148 bnttth.exe 4280 jpdpd.exe 448 rxfrlll.exe 2800 nnhhnt.exe 2020 jdppp.exe 3236 7xfxxff.exe 2292 nnnnht.exe 3544 pdpjd.exe 2252 ppppd.exe 4388 lllxrrl.exe 2660 hnhbbb.exe 4024 3vpjd.exe 544 llrfrrf.exe 4920 7btnhh.exe 4836 jvjvp.exe 3664 lflffrl.exe 1204 hnntnb.exe 2840 dddjp.exe 4936 fxfxlxf.exe 1640 nhbbbb.exe 1544 ppddv.exe 1852 rlxllll.exe 3848 tnhhbb.exe -
Processes:
resource yara_rule behavioral2/memory/4788-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdjvp.exe upx behavioral2/memory/4788-5-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hnnthh.exe upx behavioral2/memory/1508-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1420-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1420-18-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjdvp.exe upx \??\c:\lxfxrlf.exe upx behavioral2/memory/4832-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4760-32-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhhnth.exe upx behavioral2/memory/2280-38-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jvdvj.exe upx behavioral2/memory/320-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2280-44-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhbbhh.exe upx \??\c:\1ddjj.exe upx \??\c:\lxxllff.exe upx behavioral2/memory/3236-55-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\djvdp.exe upx C:\fffxrrr.exe upx behavioral2/memory/3752-66-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nthntb.exe upx \??\c:\thbtnn.exe upx behavioral2/memory/3112-83-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\djvjv.exe upx C:\1fxllfr.exe upx behavioral2/memory/4392-95-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhhnth.exe upx behavioral2/memory/2088-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4920-89-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjvjp.exe upx C:\xflfrlf.exe upx behavioral2/memory/4936-108-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhbhhn.exe upx C:\rfrxrrf.exe upx \??\c:\lxxrflf.exe upx behavioral2/memory/3692-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2376-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2376-148-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ntntnh.exe upx behavioral2/memory/4256-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1160-166-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhtbbh.exe upx behavioral2/memory/4436-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1848-183-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bnthnt.exe upx behavioral2/memory/4368-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/808-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1340-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2020-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3236-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3236-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2292-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2252-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/544-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4836-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2840-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1852-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3848-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2376-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/540-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/540-322-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b93706016c764fbd88acf14760156490_NeikiAnalytics.exejdjvp.exehnnthh.exejjdvp.exelxfxrlf.exenhhnth.exejvdvj.exenhbbhh.exe1ddjj.exelxxllff.exedjvdp.exefffxrrr.exenthntb.exethbtnn.exedjvjv.exe1fxllfr.exebhhnth.exevjvjp.exexflfrlf.exenhbhhn.exerfrxrrf.exevddvj.exedescription pid process target process PID 4788 wrote to memory of 1508 4788 b93706016c764fbd88acf14760156490_NeikiAnalytics.exe jdjvp.exe PID 4788 wrote to memory of 1508 4788 b93706016c764fbd88acf14760156490_NeikiAnalytics.exe jdjvp.exe PID 4788 wrote to memory of 1508 4788 b93706016c764fbd88acf14760156490_NeikiAnalytics.exe jdjvp.exe PID 1508 wrote to memory of 1420 1508 jdjvp.exe hnnthh.exe PID 1508 wrote to memory of 1420 1508 jdjvp.exe hnnthh.exe PID 1508 wrote to memory of 1420 1508 jdjvp.exe hnnthh.exe PID 1420 wrote to memory of 320 1420 hnnthh.exe jjdvp.exe PID 1420 wrote to memory of 320 1420 hnnthh.exe jjdvp.exe PID 1420 wrote to memory of 320 1420 hnnthh.exe jjdvp.exe PID 320 wrote to memory of 4832 320 jjdvp.exe lxfxrlf.exe PID 320 wrote to memory of 4832 320 jjdvp.exe lxfxrlf.exe PID 320 wrote to memory of 4832 320 jjdvp.exe lxfxrlf.exe PID 4832 wrote to memory of 4760 4832 lxfxrlf.exe nhhnth.exe PID 4832 wrote to memory of 4760 4832 lxfxrlf.exe nhhnth.exe PID 4832 wrote to memory of 4760 4832 lxfxrlf.exe nhhnth.exe PID 4760 wrote to memory of 2280 4760 nhhnth.exe vdvjv.exe PID 4760 wrote to memory of 2280 4760 nhhnth.exe vdvjv.exe PID 4760 wrote to memory of 2280 4760 nhhnth.exe vdvjv.exe PID 2280 wrote to memory of 4624 2280 jvdvj.exe nhbbhh.exe PID 2280 wrote to memory of 4624 2280 jvdvj.exe nhbbhh.exe PID 2280 wrote to memory of 4624 2280 jvdvj.exe nhbbhh.exe PID 4624 wrote to memory of 3236 4624 nhbbhh.exe 1ddjj.exe PID 4624 wrote to memory of 3236 4624 nhbbhh.exe 1ddjj.exe PID 4624 wrote to memory of 3236 4624 nhbbhh.exe 1ddjj.exe PID 3236 wrote to memory of 1408 3236 1ddjj.exe lxxllff.exe PID 3236 wrote to memory of 1408 3236 1ddjj.exe lxxllff.exe PID 3236 wrote to memory of 1408 3236 1ddjj.exe lxxllff.exe PID 1408 wrote to memory of 3752 1408 lxxllff.exe djvdp.exe PID 1408 wrote to memory of 3752 1408 lxxllff.exe djvdp.exe PID 1408 wrote to memory of 3752 1408 lxxllff.exe djvdp.exe PID 3752 wrote to memory of 1108 3752 djvdp.exe fffxrrr.exe PID 3752 wrote to memory of 1108 3752 djvdp.exe fffxrrr.exe PID 3752 wrote to memory of 1108 3752 djvdp.exe fffxrrr.exe PID 1108 wrote to memory of 5044 1108 fffxrrr.exe nthntb.exe PID 1108 wrote to memory of 5044 1108 fffxrrr.exe nthntb.exe PID 1108 wrote to memory of 5044 1108 fffxrrr.exe nthntb.exe PID 5044 wrote to memory of 3112 5044 nthntb.exe thbtnn.exe PID 5044 wrote to memory of 3112 5044 nthntb.exe thbtnn.exe PID 5044 wrote to memory of 3112 5044 nthntb.exe thbtnn.exe PID 3112 wrote to memory of 4920 3112 thbtnn.exe djvjv.exe PID 3112 wrote to memory of 4920 3112 thbtnn.exe djvjv.exe PID 3112 wrote to memory of 4920 3112 thbtnn.exe djvjv.exe PID 4920 wrote to memory of 4392 4920 djvjv.exe 1fxllfr.exe PID 4920 wrote to memory of 4392 4920 djvjv.exe 1fxllfr.exe PID 4920 wrote to memory of 4392 4920 djvjv.exe 1fxllfr.exe PID 4392 wrote to memory of 2088 4392 1fxllfr.exe bhhnth.exe PID 4392 wrote to memory of 2088 4392 1fxllfr.exe bhhnth.exe PID 4392 wrote to memory of 2088 4392 1fxllfr.exe bhhnth.exe PID 2088 wrote to memory of 4604 2088 bhhnth.exe vjvjp.exe PID 2088 wrote to memory of 4604 2088 bhhnth.exe vjvjp.exe PID 2088 wrote to memory of 4604 2088 bhhnth.exe vjvjp.exe PID 4604 wrote to memory of 4936 4604 vjvjp.exe xflfrlf.exe PID 4604 wrote to memory of 4936 4604 vjvjp.exe xflfrlf.exe PID 4604 wrote to memory of 4936 4604 vjvjp.exe xflfrlf.exe PID 4936 wrote to memory of 932 4936 xflfrlf.exe nhbhhn.exe PID 4936 wrote to memory of 932 4936 xflfrlf.exe nhbhhn.exe PID 4936 wrote to memory of 932 4936 xflfrlf.exe nhbhhn.exe PID 932 wrote to memory of 1676 932 nhbhhn.exe rfrxrrf.exe PID 932 wrote to memory of 1676 932 nhbhhn.exe rfrxrrf.exe PID 932 wrote to memory of 1676 932 nhbhhn.exe rfrxrrf.exe PID 1676 wrote to memory of 3692 1676 rfrxrrf.exe vddvj.exe PID 1676 wrote to memory of 3692 1676 rfrxrrf.exe vddvj.exe PID 1676 wrote to memory of 3692 1676 rfrxrrf.exe vddvj.exe PID 3692 wrote to memory of 4300 3692 vddvj.exe lxxrflf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b93706016c764fbd88acf14760156490_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b93706016c764fbd88acf14760156490_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\jdjvp.exec:\jdjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\hnnthh.exec:\hnnthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\jjdvp.exec:\jjdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\nhhnth.exec:\nhhnth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\jvdvj.exec:\jvdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\nhbbhh.exec:\nhbbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\1ddjj.exec:\1ddjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\lxxllff.exec:\lxxllff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\djvdp.exec:\djvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\fffxrrr.exec:\fffxrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\nthntb.exec:\nthntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\thbtnn.exec:\thbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\djvjv.exec:\djvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\1fxllfr.exec:\1fxllfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\bhhnth.exec:\bhhnth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\vjvjp.exec:\vjvjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\xflfrlf.exec:\xflfrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\nhbhhn.exec:\nhbhhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\rfrxrrf.exec:\rfrxrrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\vddvj.exec:\vddvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\lxxrflf.exec:\lxxrflf.exe23⤵
- Executes dropped EXE
PID:4300 -
\??\c:\bhttbb.exec:\bhttbb.exe24⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vdpjv.exec:\vdpjv.exe25⤵
- Executes dropped EXE
PID:2376 -
\??\c:\3xxlfrl.exec:\3xxlfrl.exe26⤵
- Executes dropped EXE
PID:4256 -
\??\c:\ntntnh.exec:\ntntnh.exe27⤵
- Executes dropped EXE
PID:3260 -
\??\c:\vpjjj.exec:\vpjjj.exe28⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xflrxrr.exec:\xflrxrr.exe29⤵
- Executes dropped EXE
PID:1160 -
\??\c:\nhtbbh.exec:\nhtbbh.exe30⤵
- Executes dropped EXE
PID:4436 -
\??\c:\7jjvp.exec:\7jjvp.exe31⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xfxfxlf.exec:\xfxfxlf.exe32⤵
- Executes dropped EXE
PID:4340 -
\??\c:\bnthnt.exec:\bnthnt.exe33⤵
- Executes dropped EXE
PID:1880 -
\??\c:\xxlrflx.exec:\xxlrflx.exe34⤵
- Executes dropped EXE
PID:452 -
\??\c:\tntnhb.exec:\tntnhb.exe35⤵
- Executes dropped EXE
PID:4268 -
\??\c:\pjdpd.exec:\pjdpd.exe36⤵
- Executes dropped EXE
PID:4368 -
\??\c:\ttbhhn.exec:\ttbhhn.exe37⤵
- Executes dropped EXE
PID:4812 -
\??\c:\vdpvj.exec:\vdpvj.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\fxrrxxr.exec:\fxrrxxr.exe39⤵
- Executes dropped EXE
PID:4576 -
\??\c:\xrfflfl.exec:\xrfflfl.exe40⤵
- Executes dropped EXE
PID:888 -
\??\c:\hnhbhh.exec:\hnhbhh.exe41⤵
- Executes dropped EXE
PID:808 -
\??\c:\xrrlxrx.exec:\xrrlxrx.exe42⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bnttth.exec:\bnttth.exe43⤵
- Executes dropped EXE
PID:1148 -
\??\c:\jpdpd.exec:\jpdpd.exe44⤵
- Executes dropped EXE
PID:4280 -
\??\c:\rxfrlll.exec:\rxfrlll.exe45⤵
- Executes dropped EXE
PID:448 -
\??\c:\nnhhnt.exec:\nnhhnt.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jdppp.exec:\jdppp.exe47⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7xfxxff.exec:\7xfxxff.exe48⤵
- Executes dropped EXE
PID:3236 -
\??\c:\nnnnht.exec:\nnnnht.exe49⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pdpjd.exec:\pdpjd.exe50⤵
- Executes dropped EXE
PID:3544 -
\??\c:\ppppd.exec:\ppppd.exe51⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lllxrrl.exec:\lllxrrl.exe52⤵
- Executes dropped EXE
PID:4388 -
\??\c:\hnhbbb.exec:\hnhbbb.exe53⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3vpjd.exec:\3vpjd.exe54⤵
- Executes dropped EXE
PID:4024 -
\??\c:\llrfrrf.exec:\llrfrrf.exe55⤵
- Executes dropped EXE
PID:544 -
\??\c:\7btnhh.exec:\7btnhh.exe56⤵
- Executes dropped EXE
PID:4920 -
\??\c:\jvjvp.exec:\jvjvp.exe57⤵
- Executes dropped EXE
PID:4836 -
\??\c:\lflffrl.exec:\lflffrl.exe58⤵
- Executes dropped EXE
PID:3664 -
\??\c:\hnntnb.exec:\hnntnb.exe59⤵
- Executes dropped EXE
PID:1204 -
\??\c:\dddjp.exec:\dddjp.exe60⤵
- Executes dropped EXE
PID:2840 -
\??\c:\fxfxlxf.exec:\fxfxlxf.exe61⤵
- Executes dropped EXE
PID:4936 -
\??\c:\nhbbbb.exec:\nhbbbb.exe62⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ppddv.exec:\ppddv.exe63⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rlxllll.exec:\rlxllll.exe64⤵
- Executes dropped EXE
PID:1852 -
\??\c:\tnhhbb.exec:\tnhhbb.exe65⤵
- Executes dropped EXE
PID:3848 -
\??\c:\vjvvv.exec:\vjvvv.exe66⤵PID:2868
-
\??\c:\flrlrfl.exec:\flrlrfl.exe67⤵PID:2376
-
\??\c:\hntbbn.exec:\hntbbn.exe68⤵PID:2100
-
\??\c:\jvvdj.exec:\jvvdj.exe69⤵PID:540
-
\??\c:\rlrlrlx.exec:\rlrlrlx.exe70⤵PID:3724
-
\??\c:\nnnntn.exec:\nnnntn.exe71⤵PID:4288
-
\??\c:\pvpjd.exec:\pvpjd.exe72⤵PID:3836
-
\??\c:\lllxrxx.exec:\lllxrxx.exe73⤵PID:4028
-
\??\c:\hntnbt.exec:\hntnbt.exe74⤵PID:2124
-
\??\c:\nhtnbt.exec:\nhtnbt.exe75⤵PID:4340
-
\??\c:\vppvp.exec:\vppvp.exe76⤵PID:3840
-
\??\c:\xxrlfff.exec:\xxrlfff.exe77⤵PID:4484
-
\??\c:\pjvvj.exec:\pjvvj.exe78⤵PID:1388
-
\??\c:\lrrrllr.exec:\lrrrllr.exe79⤵PID:3152
-
\??\c:\3bhntt.exec:\3bhntt.exe80⤵PID:5108
-
\??\c:\5httbh.exec:\5httbh.exe81⤵PID:4040
-
\??\c:\pdjjv.exec:\pdjjv.exe82⤵PID:2904
-
\??\c:\lfxrllf.exec:\lfxrllf.exe83⤵PID:4236
-
\??\c:\hbbbbb.exec:\hbbbbb.exe84⤵PID:3032
-
\??\c:\thbtnt.exec:\thbtnt.exe85⤵PID:1164
-
\??\c:\jpdjp.exec:\jpdjp.exe86⤵PID:3012
-
\??\c:\1rrfrrf.exec:\1rrfrrf.exe87⤵PID:1148
-
\??\c:\hhnnhn.exec:\hhnnhn.exe88⤵PID:980
-
\??\c:\vdvjv.exec:\vdvjv.exe89⤵PID:2280
-
\??\c:\rrlffrl.exec:\rrlffrl.exe90⤵PID:4736
-
\??\c:\tbhtbt.exec:\tbhtbt.exe91⤵PID:2044
-
\??\c:\1pvpj.exec:\1pvpj.exe92⤵PID:4868
-
\??\c:\hbbttt.exec:\hbbttt.exe93⤵PID:1504
-
\??\c:\bhtnnh.exec:\bhtnnh.exe94⤵PID:1632
-
\??\c:\vdddv.exec:\vdddv.exe95⤵PID:3000
-
\??\c:\5tnhtb.exec:\5tnhtb.exe96⤵PID:4876
-
\??\c:\pjvpd.exec:\pjvpd.exe97⤵PID:3044
-
\??\c:\llfxfff.exec:\llfxfff.exe98⤵PID:2660
-
\??\c:\tbbtnb.exec:\tbbtnb.exe99⤵PID:1408
-
\??\c:\vpjvp.exec:\vpjvp.exe100⤵PID:4516
-
\??\c:\1dddj.exec:\1dddj.exe101⤵PID:4392
-
\??\c:\5rlllrr.exec:\5rlllrr.exe102⤵PID:1792
-
\??\c:\ttntnn.exec:\ttntnn.exe103⤵PID:4656
-
\??\c:\vdpjj.exec:\vdpjj.exe104⤵PID:2856
-
\??\c:\rrfrflx.exec:\rrfrflx.exe105⤵PID:4476
-
\??\c:\hhbtnn.exec:\hhbtnn.exe106⤵PID:3100
-
\??\c:\lxxxlxx.exec:\lxxxlxx.exe107⤵PID:1640
-
\??\c:\bbbbbh.exec:\bbbbbh.exe108⤵PID:4520
-
\??\c:\vjvvj.exec:\vjvvj.exe109⤵PID:8
-
\??\c:\rrlxlfr.exec:\rrlxlfr.exe110⤵PID:4996
-
\??\c:\hbnbbn.exec:\hbnbbn.exe111⤵PID:2868
-
\??\c:\dppjd.exec:\dppjd.exe112⤵PID:4256
-
\??\c:\jvdjv.exec:\jvdjv.exe113⤵PID:2100
-
\??\c:\lxlxfxl.exec:\lxlxfxl.exe114⤵PID:668
-
\??\c:\ttbbtt.exec:\ttbbtt.exe115⤵PID:3724
-
\??\c:\5pjdv.exec:\5pjdv.exe116⤵PID:4436
-
\??\c:\xrlrllf.exec:\xrlrllf.exe117⤵PID:4900
-
\??\c:\tttnnn.exec:\tttnnn.exe118⤵PID:3328
-
\??\c:\vjppv.exec:\vjppv.exe119⤵PID:1048
-
\??\c:\5vppv.exec:\5vppv.exe120⤵PID:1880
-
\??\c:\rxxxxrr.exec:\rxxxxrr.exe121⤵PID:5116
-
\??\c:\hhbbtt.exec:\hhbbtt.exe122⤵PID:4368
-
\??\c:\dvdvv.exec:\dvdvv.exe123⤵PID:1388
-
\??\c:\xxrlffx.exec:\xxrlffx.exe124⤵PID:2992
-
\??\c:\hthhht.exec:\hthhht.exe125⤵PID:5108
-
\??\c:\ttbnhh.exec:\ttbnhh.exe126⤵PID:4040
-
\??\c:\vvdvd.exec:\vvdvd.exe127⤵PID:3984
-
\??\c:\9lllxrr.exec:\9lllxrr.exe128⤵PID:3032
-
\??\c:\thnntb.exec:\thnntb.exe129⤵PID:1164
-
\??\c:\jvdvd.exec:\jvdvd.exe130⤵PID:3092
-
\??\c:\rflllrr.exec:\rflllrr.exe131⤵PID:2068
-
\??\c:\xfxffxr.exec:\xfxffxr.exe132⤵PID:4736
-
\??\c:\nhnhhh.exec:\nhnhhh.exe133⤵PID:2020
-
\??\c:\7ddvv.exec:\7ddvv.exe134⤵PID:3980
-
\??\c:\jjvpv.exec:\jjvpv.exe135⤵PID:3544
-
\??\c:\xxffxrl.exec:\xxffxrl.exe136⤵PID:4740
-
\??\c:\hbhbbt.exec:\hbhbbt.exe137⤵PID:724
-
\??\c:\ddpjp.exec:\ddpjp.exe138⤵PID:3112
-
\??\c:\pjddv.exec:\pjddv.exe139⤵PID:544
-
\??\c:\xrfrfxx.exec:\xrfrfxx.exe140⤵PID:4836
-
\??\c:\ntnhnh.exec:\ntnhnh.exe141⤵PID:4604
-
\??\c:\vvpjd.exec:\vvpjd.exe142⤵PID:4884
-
\??\c:\jddvp.exec:\jddvp.exe143⤵PID:932
-
\??\c:\1lllfrl.exec:\1lllfrl.exe144⤵PID:2600
-
\??\c:\nnbthh.exec:\nnbthh.exe145⤵PID:4152
-
\??\c:\dpvpj.exec:\dpvpj.exe146⤵PID:3708
-
\??\c:\pjpjp.exec:\pjpjp.exe147⤵PID:4524
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe148⤵PID:1172
-
\??\c:\hnbbtt.exec:\hnbbtt.exe149⤵PID:3540
-
\??\c:\7vvpd.exec:\7vvpd.exe150⤵PID:5056
-
\??\c:\xrxfrlf.exec:\xrxfrlf.exe151⤵PID:2232
-
\??\c:\htntth.exec:\htntth.exe152⤵PID:2312
-
\??\c:\djjjj.exec:\djjjj.exe153⤵PID:3140
-
\??\c:\pjvjj.exec:\pjvjj.exe154⤵PID:1660
-
\??\c:\lllrrrr.exec:\lllrrrr.exe155⤵PID:2296
-
\??\c:\hhnnnn.exec:\hhnnnn.exe156⤵PID:5048
-
\??\c:\vpvpj.exec:\vpvpj.exe157⤵PID:3128
-
\??\c:\lxrlfff.exec:\lxrlfff.exe158⤵PID:60
-
\??\c:\frllflr.exec:\frllflr.exe159⤵PID:5116
-
\??\c:\hnhbtt.exec:\hnhbtt.exe160⤵PID:720
-
\??\c:\jjpjj.exec:\jjpjj.exe161⤵PID:3396
-
\??\c:\pjjdd.exec:\pjjdd.exe162⤵PID:1364
-
\??\c:\3frrlrx.exec:\3frrlrx.exe163⤵PID:2516
-
\??\c:\5ntntt.exec:\5ntntt.exe164⤵PID:2904
-
\??\c:\9hnbth.exec:\9hnbth.exe165⤵PID:4236
-
\??\c:\vjpjj.exec:\vjpjj.exe166⤵PID:4804
-
\??\c:\dpjdv.exec:\dpjdv.exe167⤵PID:1340
-
\??\c:\rffrlrr.exec:\rffrlrr.exe168⤵PID:1148
-
\??\c:\hntbtn.exec:\hntbtn.exe169⤵PID:1180
-
\??\c:\vppvv.exec:\vppvv.exe170⤵PID:3976
-
\??\c:\ddvpv.exec:\ddvpv.exe171⤵PID:1224
-
\??\c:\lfxlxlf.exec:\lfxlxlf.exe172⤵PID:4976
-
\??\c:\bthtbt.exec:\bthtbt.exe173⤵PID:1540
-
\??\c:\pvvjd.exec:\pvvjd.exe174⤵PID:2368
-
\??\c:\dpdjd.exec:\dpdjd.exe175⤵PID:4716
-
\??\c:\llrfrfx.exec:\llrfrfx.exe176⤵PID:432
-
\??\c:\5tnntn.exec:\5tnntn.exe177⤵PID:1792
-
\??\c:\pdjpd.exec:\pdjpd.exe178⤵PID:4036
-
\??\c:\llxllrl.exec:\llxllrl.exe179⤵PID:2424
-
\??\c:\5nntht.exec:\5nntht.exe180⤵PID:1548
-
\??\c:\nnhhtn.exec:\nnhhtn.exe181⤵PID:1840
-
\??\c:\vpvvd.exec:\vpvvd.exe182⤵PID:3532
-
\??\c:\lxxrrxr.exec:\lxxrrxr.exe183⤵PID:4300
-
\??\c:\nbbtnt.exec:\nbbtnt.exe184⤵PID:3708
-
\??\c:\ddvpj.exec:\ddvpj.exe185⤵PID:4524
-
\??\c:\xfrlxfr.exec:\xfrlxfr.exe186⤵PID:1172
-
\??\c:\bhtbth.exec:\bhtbth.exe187⤵PID:3260
-
\??\c:\djpjd.exec:\djpjd.exe188⤵PID:5056
-
\??\c:\vvjdj.exec:\vvjdj.exe189⤵PID:668
-
\??\c:\rlxlrlr.exec:\rlxlrlr.exe190⤵PID:2312
-
\??\c:\thbbtn.exec:\thbbtn.exe191⤵PID:4972
-
\??\c:\nhthbn.exec:\nhthbn.exe192⤵PID:1396
-
\??\c:\jjppj.exec:\jjppj.exe193⤵PID:3400
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe194⤵PID:2324
-
\??\c:\btbbtt.exec:\btbbtt.exe195⤵PID:4484
-
\??\c:\ntbttt.exec:\ntbttt.exe196⤵PID:60
-
\??\c:\3djdv.exec:\3djdv.exe197⤵PID:5116
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe198⤵PID:392
-
\??\c:\tttnbh.exec:\tttnbh.exe199⤵PID:3956
-
\??\c:\tthhth.exec:\tthhth.exe200⤵PID:400
-
\??\c:\vvjvv.exec:\vvjvv.exe201⤵PID:3636
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe202⤵PID:4580
-
\??\c:\5rrrlll.exec:\5rrrlll.exe203⤵PID:4588
-
\??\c:\tntnnh.exec:\tntnnh.exe204⤵PID:3012
-
\??\c:\vpvvv.exec:\vpvvv.exe205⤵PID:2800
-
\??\c:\dvdvp.exec:\dvdvp.exe206⤵PID:636
-
\??\c:\7rxxxxx.exec:\7rxxxxx.exe207⤵PID:1920
-
\??\c:\htbbbb.exec:\htbbbb.exe208⤵PID:3020
-
\??\c:\tttbtb.exec:\tttbtb.exe209⤵PID:3544
-
\??\c:\djpjj.exec:\djpjj.exe210⤵PID:1416
-
\??\c:\9llxrlx.exec:\9llxrlx.exe211⤵PID:724
-
\??\c:\bhtbtt.exec:\bhtbtt.exe212⤵PID:544
-
\??\c:\ttnhhb.exec:\ttnhhb.exe213⤵PID:2016
-
\??\c:\pvpdv.exec:\pvpdv.exe214⤵PID:1444
-
\??\c:\pvdvp.exec:\pvdvp.exe215⤵PID:988
-
\??\c:\3lfxrfr.exec:\3lfxrfr.exe216⤵PID:2856
-
\??\c:\tntntt.exec:\tntntt.exe217⤵PID:1640
-
\??\c:\vvpjd.exec:\vvpjd.exe218⤵PID:1840
-
\??\c:\ddjdv.exec:\ddjdv.exe219⤵PID:1352
-
\??\c:\5ffxllf.exec:\5ffxllf.exe220⤵PID:412
-
\??\c:\bbbtnn.exec:\bbbtnn.exe221⤵PID:4052
-
\??\c:\5nnnhh.exec:\5nnnhh.exe222⤵PID:2100
-
\??\c:\vvvvv.exec:\vvvvv.exe223⤵PID:3676
-
\??\c:\lxrfxlf.exec:\lxrfxlf.exe224⤵PID:408
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe225⤵PID:4436
-
\??\c:\bbbbhh.exec:\bbbbhh.exe226⤵PID:2312
-
\??\c:\ddddj.exec:\ddddj.exe227⤵PID:4292
-
\??\c:\vppjv.exec:\vppjv.exe228⤵PID:2244
-
\??\c:\5lfxrxr.exec:\5lfxrxr.exe229⤵PID:884
-
\??\c:\btbtnh.exec:\btbtnh.exe230⤵PID:2056
-
\??\c:\bhhbnh.exec:\bhhbnh.exe231⤵PID:2844
-
\??\c:\5ddvj.exec:\5ddvj.exe232⤵PID:2852
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe233⤵PID:4348
-
\??\c:\1thtbb.exec:\1thtbb.exe234⤵PID:4268
-
\??\c:\hnbttt.exec:\hnbttt.exe235⤵PID:2716
-
\??\c:\pdvpv.exec:\pdvpv.exe236⤵PID:4728
-
\??\c:\xffxrxr.exec:\xffxrxr.exe237⤵PID:1976
-
\??\c:\rlfllff.exec:\rlfllff.exe238⤵PID:4712
-
\??\c:\ttnnhn.exec:\ttnnhn.exe239⤵PID:1364
-
\??\c:\5rlxllx.exec:\5rlxllx.exe240⤵PID:2044
-
\??\c:\ppvjj.exec:\ppvjj.exe241⤵PID:2676
-
\??\c:\7nhtnn.exec:\7nhtnn.exe242⤵PID:3236