Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 20:00
Behavioral task
behavioral1
Sample
3f7f31fe204792dc34209ef4ba297940_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3f7f31fe204792dc34209ef4ba297940_NeikiAnalytics.exe
-
Size
255KB
-
MD5
3f7f31fe204792dc34209ef4ba297940
-
SHA1
9e3897c64f15c5bc4ec33fcc3244dd896d54490a
-
SHA256
fbd835ca303e8e6a08a8d853f6d7c4700ba0b97006541eb520fbacda787138d0
-
SHA512
ecc752748a69b01af16db9c19109c494485ba2035940c27c868830c69e2327b4b36eb939d59127bc01b9f7cd1ac937451aeb61cb6f6cc1356737739206dadd3a
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpolTjZXvEQo9dfr1:y4wFHoS3eFaKHpKT9XvEhdfr1
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/5016-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5564-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6020-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5404-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5368-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5212-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5532-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5332-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5608-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5360-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6008-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5956-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5844-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5836-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2812-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1244-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2648-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5668-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1956-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5428-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5540-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1256-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-610-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5216-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5596-672-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-715-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-765-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-813-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-938-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2812-986-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
flxfflx.exetnhtbt.exehbtnhh.exefxfxrrl.exexxrlffl.exebbbtht.exe5ddvv.exelfrrrll.exenbbnhb.exe7rxrffl.exefffrllx.exehbbttb.exelxxrllf.exetnhbbh.exerxxfrxf.exe1hhbnh.exejjvpp.exerlrlfxr.exe3ttnhh.exepdvpj.exefxrrllf.exelflfffl.exetnnnhh.exelxrfxrl.exehhhbbb.exevdddv.exejjpvj.exe9llfrrl.exehhbtht.exe3jjvd.exe9dvjp.exetbnhtb.exedppjd.exejppvd.exexrrfxfr.exe7bbthb.exe9nnbnn.exelfrffxx.exe7xrrllx.exe1jjvp.exepjpdj.exe7lfrfxr.exenbhthb.exebhthnh.exejppdj.exedpjvv.exe5llffxr.exe3flfxrr.exe5hbnhb.exetbnnhb.exepdjvp.exedvpdd.exerfxlrlx.exehntnbt.exetbntht.exepdpjv.exevdjvj.exe9llxfxr.exe7lrfxfr.exe1btnhb.exebtnbtn.exe5dvjp.exevvpdp.exeflrfrlx.exepid process 5016 flxfflx.exe 4260 tnhtbt.exe 5036 hbtnhh.exe 3616 fxfxrrl.exe 1408 xxrlffl.exe 1032 bbbtht.exe 920 5ddvv.exe 1232 lfrrrll.exe 4228 nbbnhb.exe 5564 7rxrffl.exe 6020 fffrllx.exe 5404 hbbttb.exe 3652 lxxrllf.exe 5368 tnhbbh.exe 5212 rxxfrxf.exe 4976 1hhbnh.exe 4720 jjvpp.exe 3144 rlrlfxr.exe 3288 3ttnhh.exe 1356 pdvpj.exe 5148 fxrrllf.exe 5304 lflfffl.exe 5532 tnnnhh.exe 5416 lxrfxrl.exe 5332 hhhbbb.exe 1472 vdddv.exe 5608 jjpvj.exe 3496 9llfrrl.exe 4904 hhbtht.exe 5580 3jjvd.exe 4616 9dvjp.exe 4572 tbnhtb.exe 5360 dppjd.exe 2456 jppvd.exe 2384 xrrfxfr.exe 6008 7bbthb.exe 4940 9nnbnn.exe 5048 lfrffxx.exe 5956 7xrrllx.exe 5044 1jjvp.exe 5844 pjpdj.exe 5836 7lfrfxr.exe 2060 nbhthb.exe 1988 bhthnh.exe 1892 jppdj.exe 4168 dpjvv.exe 5804 5llffxr.exe 4360 3flfxrr.exe 4008 5hbnhb.exe 4820 tbnnhb.exe 1488 pdjvp.exe 2812 dvpdd.exe 1244 rfxlrlx.exe 2744 hntnbt.exe 3964 tbntht.exe 1056 pdpjv.exe 2648 vdjvj.exe 5668 9llxfxr.exe 5108 7lrfxfr.exe 1956 1btnhb.exe 4980 btnbtn.exe 1084 5dvjp.exe 4924 vvpdp.exe 4908 flrfrlx.exe -
Processes:
resource yara_rule behavioral2/memory/512-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flxfflx.exe upx C:\tnhtbt.exe upx behavioral2/memory/5016-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4260-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/512-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbtnhh.exe upx behavioral2/memory/5036-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxfxrrl.exe upx behavioral2/memory/3616-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5036-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrlffl.exe upx behavioral2/memory/1408-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbbtht.exe upx behavioral2/memory/1408-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ddvv.exe upx behavioral2/memory/1032-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/920-46-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfrrrll.exe upx behavioral2/memory/1232-55-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbbnhb.exe upx C:\7rxrffl.exe upx behavioral2/memory/4228-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5564-63-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fffrllx.exe upx behavioral2/memory/6020-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbbttb.exe upx behavioral2/memory/6020-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5404-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxxrllf.exe upx C:\tnhbbh.exe upx behavioral2/memory/3652-86-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxxfrxf.exe upx behavioral2/memory/5368-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1hhbnh.exe upx behavioral2/memory/5212-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4976-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjvpp.exe upx \??\c:\rlrlfxr.exe upx behavioral2/memory/3144-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3ttnhh.exe upx behavioral2/memory/3288-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvpj.exe upx behavioral2/memory/1356-122-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxrrllf.exe upx \??\c:\lflfffl.exe upx C:\tnnnhh.exe upx behavioral2/memory/5532-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxrfxrl.exe upx C:\hhhbbb.exe upx behavioral2/memory/5332-149-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vdddv.exe upx behavioral2/memory/1472-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjpvj.exe upx behavioral2/memory/5608-162-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9llfrrl.exe upx behavioral2/memory/3496-168-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhbtht.exe upx \??\c:\3jjvd.exe upx C:\9dvjp.exe upx C:\tbnhtb.exe upx behavioral2/memory/4616-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4572-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5360-196-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3f7f31fe204792dc34209ef4ba297940_NeikiAnalytics.exeflxfflx.exetnhtbt.exehbtnhh.exefxfxrrl.exexxrlffl.exebbbtht.exe5ddvv.exelfrrrll.exenbbnhb.exe7rxrffl.exefffrllx.exehbbttb.exelxxrllf.exetnhbbh.exerxxfrxf.exe1hhbnh.exejjvpp.exerlrlfxr.exe3ttnhh.exepdvpj.exefxrrllf.exedescription pid process target process PID 512 wrote to memory of 5016 512 3f7f31fe204792dc34209ef4ba297940_NeikiAnalytics.exe flxfflx.exe PID 512 wrote to memory of 5016 512 3f7f31fe204792dc34209ef4ba297940_NeikiAnalytics.exe flxfflx.exe PID 512 wrote to memory of 5016 512 3f7f31fe204792dc34209ef4ba297940_NeikiAnalytics.exe flxfflx.exe PID 5016 wrote to memory of 4260 5016 flxfflx.exe tnhtbt.exe PID 5016 wrote to memory of 4260 5016 flxfflx.exe tnhtbt.exe PID 5016 wrote to memory of 4260 5016 flxfflx.exe tnhtbt.exe PID 4260 wrote to memory of 5036 4260 tnhtbt.exe hbtnhh.exe PID 4260 wrote to memory of 5036 4260 tnhtbt.exe hbtnhh.exe PID 4260 wrote to memory of 5036 4260 tnhtbt.exe hbtnhh.exe PID 5036 wrote to memory of 3616 5036 hbtnhh.exe fxfxrrl.exe PID 5036 wrote to memory of 3616 5036 hbtnhh.exe fxfxrrl.exe PID 5036 wrote to memory of 3616 5036 hbtnhh.exe fxfxrrl.exe PID 3616 wrote to memory of 1408 3616 fxfxrrl.exe xxrlffl.exe PID 3616 wrote to memory of 1408 3616 fxfxrrl.exe xxrlffl.exe PID 3616 wrote to memory of 1408 3616 fxfxrrl.exe xxrlffl.exe PID 1408 wrote to memory of 1032 1408 xxrlffl.exe bbbtht.exe PID 1408 wrote to memory of 1032 1408 xxrlffl.exe bbbtht.exe PID 1408 wrote to memory of 1032 1408 xxrlffl.exe bbbtht.exe PID 1032 wrote to memory of 920 1032 bbbtht.exe 5ddvv.exe PID 1032 wrote to memory of 920 1032 bbbtht.exe 5ddvv.exe PID 1032 wrote to memory of 920 1032 bbbtht.exe 5ddvv.exe PID 920 wrote to memory of 1232 920 5ddvv.exe lfrrrll.exe PID 920 wrote to memory of 1232 920 5ddvv.exe lfrrrll.exe PID 920 wrote to memory of 1232 920 5ddvv.exe lfrrrll.exe PID 1232 wrote to memory of 4228 1232 lfrrrll.exe nbbnhb.exe PID 1232 wrote to memory of 4228 1232 lfrrrll.exe nbbnhb.exe PID 1232 wrote to memory of 4228 1232 lfrrrll.exe nbbnhb.exe PID 4228 wrote to memory of 5564 4228 nbbnhb.exe 7rxrffl.exe PID 4228 wrote to memory of 5564 4228 nbbnhb.exe 7rxrffl.exe PID 4228 wrote to memory of 5564 4228 nbbnhb.exe 7rxrffl.exe PID 5564 wrote to memory of 6020 5564 7rxrffl.exe fffrllx.exe PID 5564 wrote to memory of 6020 5564 7rxrffl.exe fffrllx.exe PID 5564 wrote to memory of 6020 5564 7rxrffl.exe fffrllx.exe PID 6020 wrote to memory of 5404 6020 fffrllx.exe hbbttb.exe PID 6020 wrote to memory of 5404 6020 fffrllx.exe hbbttb.exe PID 6020 wrote to memory of 5404 6020 fffrllx.exe hbbttb.exe PID 5404 wrote to memory of 3652 5404 hbbttb.exe lxxrllf.exe PID 5404 wrote to memory of 3652 5404 hbbttb.exe lxxrllf.exe PID 5404 wrote to memory of 3652 5404 hbbttb.exe lxxrllf.exe PID 3652 wrote to memory of 5368 3652 lxxrllf.exe tnhbbh.exe PID 3652 wrote to memory of 5368 3652 lxxrllf.exe tnhbbh.exe PID 3652 wrote to memory of 5368 3652 lxxrllf.exe tnhbbh.exe PID 5368 wrote to memory of 5212 5368 tnhbbh.exe rxxfrxf.exe PID 5368 wrote to memory of 5212 5368 tnhbbh.exe rxxfrxf.exe PID 5368 wrote to memory of 5212 5368 tnhbbh.exe rxxfrxf.exe PID 5212 wrote to memory of 4976 5212 rxxfrxf.exe 1hhbnh.exe PID 5212 wrote to memory of 4976 5212 rxxfrxf.exe 1hhbnh.exe PID 5212 wrote to memory of 4976 5212 rxxfrxf.exe 1hhbnh.exe PID 4976 wrote to memory of 4720 4976 1hhbnh.exe jjvpp.exe PID 4976 wrote to memory of 4720 4976 1hhbnh.exe jjvpp.exe PID 4976 wrote to memory of 4720 4976 1hhbnh.exe jjvpp.exe PID 4720 wrote to memory of 3144 4720 jjvpp.exe rlrlfxr.exe PID 4720 wrote to memory of 3144 4720 jjvpp.exe rlrlfxr.exe PID 4720 wrote to memory of 3144 4720 jjvpp.exe rlrlfxr.exe PID 3144 wrote to memory of 3288 3144 rlrlfxr.exe 3ttnhh.exe PID 3144 wrote to memory of 3288 3144 rlrlfxr.exe 3ttnhh.exe PID 3144 wrote to memory of 3288 3144 rlrlfxr.exe 3ttnhh.exe PID 3288 wrote to memory of 1356 3288 3ttnhh.exe pdvpj.exe PID 3288 wrote to memory of 1356 3288 3ttnhh.exe pdvpj.exe PID 3288 wrote to memory of 1356 3288 3ttnhh.exe pdvpj.exe PID 1356 wrote to memory of 5148 1356 pdvpj.exe fxrrllf.exe PID 1356 wrote to memory of 5148 1356 pdvpj.exe fxrrllf.exe PID 1356 wrote to memory of 5148 1356 pdvpj.exe fxrrllf.exe PID 5148 wrote to memory of 5304 5148 fxrrllf.exe lflfffl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f7f31fe204792dc34209ef4ba297940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3f7f31fe204792dc34209ef4ba297940_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\flxfflx.exec:\flxfflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\tnhtbt.exec:\tnhtbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\hbtnhh.exec:\hbtnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\xxrlffl.exec:\xxrlffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\bbbtht.exec:\bbbtht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\5ddvv.exec:\5ddvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\lfrrrll.exec:\lfrrrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\nbbnhb.exec:\nbbnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\7rxrffl.exec:\7rxrffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
\??\c:\fffrllx.exec:\fffrllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
\??\c:\hbbttb.exec:\hbbttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
\??\c:\lxxrllf.exec:\lxxrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\tnhbbh.exec:\tnhbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
\??\c:\rxxfrxf.exec:\rxxfrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
\??\c:\1hhbnh.exec:\1hhbnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\jjvpp.exec:\jjvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\3ttnhh.exec:\3ttnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\pdvpj.exec:\pdvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\fxrrllf.exec:\fxrrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
\??\c:\lflfffl.exec:\lflfffl.exe23⤵
- Executes dropped EXE
PID:5304 -
\??\c:\tnnnhh.exec:\tnnnhh.exe24⤵
- Executes dropped EXE
PID:5532 -
\??\c:\lxrfxrl.exec:\lxrfxrl.exe25⤵
- Executes dropped EXE
PID:5416 -
\??\c:\hhhbbb.exec:\hhhbbb.exe26⤵
- Executes dropped EXE
PID:5332 -
\??\c:\vdddv.exec:\vdddv.exe27⤵
- Executes dropped EXE
PID:1472 -
\??\c:\jjpvj.exec:\jjpvj.exe28⤵
- Executes dropped EXE
PID:5608 -
\??\c:\9llfrrl.exec:\9llfrrl.exe29⤵
- Executes dropped EXE
PID:3496 -
\??\c:\hhbtht.exec:\hhbtht.exe30⤵
- Executes dropped EXE
PID:4904 -
\??\c:\3jjvd.exec:\3jjvd.exe31⤵
- Executes dropped EXE
PID:5580 -
\??\c:\9dvjp.exec:\9dvjp.exe32⤵
- Executes dropped EXE
PID:4616 -
\??\c:\tbnhtb.exec:\tbnhtb.exe33⤵
- Executes dropped EXE
PID:4572 -
\??\c:\dppjd.exec:\dppjd.exe34⤵
- Executes dropped EXE
PID:5360 -
\??\c:\jppvd.exec:\jppvd.exe35⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xrrfxfr.exec:\xrrfxfr.exe36⤵
- Executes dropped EXE
PID:2384 -
\??\c:\7bbthb.exec:\7bbthb.exe37⤵
- Executes dropped EXE
PID:6008 -
\??\c:\9nnbnn.exec:\9nnbnn.exe38⤵
- Executes dropped EXE
PID:4940 -
\??\c:\lfrffxx.exec:\lfrffxx.exe39⤵
- Executes dropped EXE
PID:5048 -
\??\c:\7xrrllx.exec:\7xrrllx.exe40⤵
- Executes dropped EXE
PID:5956 -
\??\c:\1jjvp.exec:\1jjvp.exe41⤵
- Executes dropped EXE
PID:5044 -
\??\c:\pjpdj.exec:\pjpdj.exe42⤵
- Executes dropped EXE
PID:5844 -
\??\c:\7lfrfxr.exec:\7lfrfxr.exe43⤵
- Executes dropped EXE
PID:5836 -
\??\c:\nbhthb.exec:\nbhthb.exe44⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bhthnh.exec:\bhthnh.exe45⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jppdj.exec:\jppdj.exe46⤵
- Executes dropped EXE
PID:1892 -
\??\c:\dpjvv.exec:\dpjvv.exe47⤵
- Executes dropped EXE
PID:4168 -
\??\c:\5llffxr.exec:\5llffxr.exe48⤵
- Executes dropped EXE
PID:5804 -
\??\c:\3flfxrr.exec:\3flfxrr.exe49⤵
- Executes dropped EXE
PID:4360 -
\??\c:\5hbnhb.exec:\5hbnhb.exe50⤵
- Executes dropped EXE
PID:4008 -
\??\c:\tbnnhb.exec:\tbnnhb.exe51⤵
- Executes dropped EXE
PID:4820 -
\??\c:\pdjvp.exec:\pdjvp.exe52⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dvpdd.exec:\dvpdd.exe53⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rfxlrlx.exec:\rfxlrlx.exe54⤵
- Executes dropped EXE
PID:1244 -
\??\c:\hntnbt.exec:\hntnbt.exe55⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tbntht.exec:\tbntht.exe56⤵
- Executes dropped EXE
PID:3964 -
\??\c:\pdpjv.exec:\pdpjv.exe57⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vdjvj.exec:\vdjvj.exe58⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9llxfxr.exec:\9llxfxr.exe59⤵
- Executes dropped EXE
PID:5668 -
\??\c:\7lrfxfr.exec:\7lrfxfr.exe60⤵
- Executes dropped EXE
PID:5108 -
\??\c:\1btnhb.exec:\1btnhb.exe61⤵
- Executes dropped EXE
PID:1956 -
\??\c:\btnbtn.exec:\btnbtn.exe62⤵
- Executes dropped EXE
PID:4980 -
\??\c:\5dvjp.exec:\5dvjp.exe63⤵
- Executes dropped EXE
PID:1084 -
\??\c:\vvpdp.exec:\vvpdp.exe64⤵
- Executes dropped EXE
PID:4924 -
\??\c:\flrfrlx.exec:\flrfrlx.exe65⤵
- Executes dropped EXE
PID:4908 -
\??\c:\3hbthb.exec:\3hbthb.exe66⤵PID:3100
-
\??\c:\nhthth.exec:\nhthth.exe67⤵PID:4968
-
\??\c:\ddjvd.exec:\ddjvd.exe68⤵PID:5380
-
\??\c:\rfrrxll.exec:\rfrrxll.exe69⤵PID:1072
-
\??\c:\9xxlfxl.exec:\9xxlfxl.exe70⤵PID:4304
-
\??\c:\hnnhtn.exec:\hnnhtn.exe71⤵PID:4308
-
\??\c:\ddvjj.exec:\ddvjj.exe72⤵PID:3864
-
\??\c:\5rllfrf.exec:\5rllfrf.exe73⤵PID:2764
-
\??\c:\thhnth.exec:\thhnth.exe74⤵PID:2860
-
\??\c:\3tnbhb.exec:\3tnbhb.exe75⤵PID:5248
-
\??\c:\pjvjp.exec:\pjvjp.exe76⤵PID:5276
-
\??\c:\dvvpv.exec:\dvvpv.exe77⤵PID:1012
-
\??\c:\fxfrxfr.exec:\fxfrxfr.exe78⤵PID:4972
-
\??\c:\htbthb.exec:\htbthb.exe79⤵PID:4960
-
\??\c:\tthnhb.exec:\tthnhb.exe80⤵PID:4488
-
\??\c:\pjppv.exec:\pjppv.exe81⤵PID:920
-
\??\c:\rlfrfff.exec:\rlfrfff.exe82⤵PID:5428
-
\??\c:\btbtnh.exec:\btbtnh.exe83⤵PID:2468
-
\??\c:\dvvpj.exec:\dvvpj.exe84⤵PID:4412
-
\??\c:\7llxfxl.exec:\7llxfxl.exe85⤵PID:2596
-
\??\c:\llrlxrl.exec:\llrlxrl.exe86⤵PID:5160
-
\??\c:\3hbnbt.exec:\3hbnbt.exe87⤵PID:5032
-
\??\c:\bnnttt.exec:\bnnttt.exe88⤵PID:3956
-
\??\c:\pjdvj.exec:\pjdvj.exe89⤵PID:5404
-
\??\c:\ffrlxrf.exec:\ffrlxrf.exe90⤵PID:4564
-
\??\c:\htnhtn.exec:\htnhtn.exe91⤵PID:4768
-
\??\c:\bbnbtb.exec:\bbnbtb.exe92⤵PID:6024
-
\??\c:\dpjvj.exec:\dpjvj.exe93⤵PID:5136
-
\??\c:\jpjvp.exec:\jpjvp.exe94⤵PID:404
-
\??\c:\xlrfxrr.exec:\xlrfxrr.exe95⤵PID:4452
-
\??\c:\xlrfxrl.exec:\xlrfxrl.exe96⤵PID:3232
-
\??\c:\5bhbnt.exec:\5bhbnt.exe97⤵PID:428
-
\??\c:\thhtbt.exec:\thhtbt.exe98⤵PID:4192
-
\??\c:\dddvd.exec:\dddvd.exe99⤵PID:2724
-
\??\c:\xxxllxr.exec:\xxxllxr.exe100⤵PID:5068
-
\??\c:\9lxrlfx.exec:\9lxrlfx.exe101⤵PID:5460
-
\??\c:\thhbbt.exec:\thhbbt.exe102⤵PID:5616
-
\??\c:\bnhthb.exec:\bnhthb.exe103⤵PID:2436
-
\??\c:\jddvj.exec:\jddvj.exe104⤵PID:1792
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe105⤵PID:4240
-
\??\c:\xlfrlff.exec:\xlfrlff.exe106⤵PID:1556
-
\??\c:\hbbhtn.exec:\hbbhtn.exe107⤵PID:1180
-
\??\c:\9hhbth.exec:\9hhbth.exe108⤵PID:4584
-
\??\c:\pdvjj.exec:\pdvjj.exe109⤵PID:5080
-
\??\c:\rxrrrrx.exec:\rxrrrrx.exe110⤵PID:5540
-
\??\c:\lxfrrlr.exec:\lxfrrlr.exe111⤵PID:5700
-
\??\c:\hbnbnt.exec:\hbnbnt.exe112⤵PID:3636
-
\??\c:\vpdjd.exec:\vpdjd.exe113⤵PID:1216
-
\??\c:\3jpjv.exec:\3jpjv.exe114⤵PID:2956
-
\??\c:\xxxlxrl.exec:\xxxlxrl.exe115⤵PID:1256
-
\??\c:\ppvjv.exec:\ppvjv.exe116⤵PID:1456
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe117⤵PID:2384
-
\??\c:\hhbnbb.exec:\hhbnbb.exe118⤵PID:4548
-
\??\c:\htthtn.exec:\htthtn.exe119⤵PID:2376
-
\??\c:\jpjdp.exec:\jpjdp.exe120⤵PID:6136
-
\??\c:\pdpdv.exec:\pdpdv.exe121⤵PID:976
-
\??\c:\lrlxlfr.exec:\lrlxlfr.exe122⤵PID:2776
-
\??\c:\xflfxxx.exec:\xflfxxx.exe123⤵PID:5956
-
\??\c:\thbbtn.exec:\thbbtn.exe124⤵PID:4516
-
\??\c:\5ttnnh.exec:\5ttnnh.exe125⤵PID:4800
-
\??\c:\3jjvj.exec:\3jjvj.exe126⤵PID:3016
-
\??\c:\jpjvp.exec:\jpjvp.exe127⤵PID:4448
-
\??\c:\rffrlfx.exec:\rffrlfx.exe128⤵PID:5192
-
\??\c:\7xxlxrf.exec:\7xxlxrf.exe129⤵PID:5008
-
\??\c:\tnbhtb.exec:\tnbhtb.exe130⤵PID:4484
-
\??\c:\9bttbh.exec:\9bttbh.exe131⤵PID:4364
-
\??\c:\pdpdv.exec:\pdpdv.exe132⤵PID:2812
-
\??\c:\ppdvp.exec:\ppdvp.exe133⤵PID:6028
-
\??\c:\3rlfrll.exec:\3rlfrll.exe134⤵PID:3576
-
\??\c:\xllxrxr.exec:\xllxrxr.exe135⤵PID:5088
-
\??\c:\1btnhb.exec:\1btnhb.exe136⤵PID:3004
-
\??\c:\htnbnb.exec:\htnbnb.exe137⤵PID:5668
-
\??\c:\jjjdp.exec:\jjjdp.exe138⤵PID:4864
-
\??\c:\3lfxrrr.exec:\3lfxrrr.exe139⤵PID:1956
-
\??\c:\httnnh.exec:\httnnh.exe140⤵PID:5064
-
\??\c:\pjvvj.exec:\pjvvj.exe141⤵PID:4780
-
\??\c:\ppdvp.exec:\ppdvp.exe142⤵PID:5784
-
\??\c:\7xrflfr.exec:\7xrflfr.exe143⤵PID:4908
-
\??\c:\1fxrfxl.exec:\1fxrfxl.exe144⤵PID:448
-
\??\c:\9tthtn.exec:\9tthtn.exe145⤵PID:1172
-
\??\c:\thhthh.exec:\thhthh.exe146⤵PID:2016
-
\??\c:\jddvp.exec:\jddvp.exe147⤵PID:4312
-
\??\c:\jjjvd.exec:\jjjvd.exe148⤵PID:2428
-
\??\c:\rxlxrlx.exec:\rxlxrlx.exe149⤵PID:4308
-
\??\c:\frfrfxf.exec:\frfrfxf.exe150⤵PID:4260
-
\??\c:\thhtnh.exec:\thhtnh.exe151⤵PID:4420
-
\??\c:\btbnbt.exec:\btbnbt.exe152⤵PID:2860
-
\??\c:\jdpdv.exec:\jdpdv.exe153⤵PID:5328
-
\??\c:\rfxlfxl.exec:\rfxlfxl.exe154⤵PID:3616
-
\??\c:\llxrlfx.exec:\llxrlfx.exe155⤵PID:2876
-
\??\c:\tbhtnh.exec:\tbhtnh.exe156⤵PID:1252
-
\??\c:\9tnbhb.exec:\9tnbhb.exe157⤵PID:1392
-
\??\c:\djpdp.exec:\djpdp.exe158⤵PID:4852
-
\??\c:\frxrflf.exec:\frxrflf.exe159⤵PID:5312
-
\??\c:\rrfrfxl.exec:\rrfrfxl.exe160⤵PID:1232
-
\??\c:\tnbnbt.exec:\tnbnbt.exe161⤵PID:1036
-
\??\c:\bhhnbn.exec:\bhhnbn.exe162⤵PID:3936
-
\??\c:\7dddj.exec:\7dddj.exe163⤵PID:2092
-
\??\c:\rflffrx.exec:\rflffrx.exe164⤵PID:3944
-
\??\c:\bntnbt.exec:\bntnbt.exe165⤵PID:1668
-
\??\c:\bntnbt.exec:\bntnbt.exe166⤵PID:4912
-
\??\c:\hhtnnh.exec:\hhtnnh.exe167⤵PID:5216
-
\??\c:\jdpjv.exec:\jdpjv.exe168⤵PID:2028
-
\??\c:\xfflxxf.exec:\xfflxxf.exe169⤵PID:5140
-
\??\c:\hhnnbt.exec:\hhnnbt.exe170⤵PID:5220
-
\??\c:\nbbthb.exec:\nbbthb.exe171⤵PID:376
-
\??\c:\pjppd.exec:\pjppd.exe172⤵PID:1952
-
\??\c:\jpvjp.exec:\jpvjp.exe173⤵PID:4452
-
\??\c:\fxrlrlr.exec:\fxrlrlr.exe174⤵PID:3144
-
\??\c:\rffrlxl.exec:\rffrlxl.exe175⤵PID:3392
-
\??\c:\thtbtt.exec:\thtbtt.exe176⤵PID:4192
-
\??\c:\pvvpd.exec:\pvvpd.exe177⤵PID:2724
-
\??\c:\pjvpv.exec:\pjvpv.exe178⤵PID:5068
-
\??\c:\xxrlxrf.exec:\xxrlxrf.exe179⤵PID:4100
-
\??\c:\lflfrlx.exec:\lflfrlx.exe180⤵PID:5596
-
\??\c:\bnhbnh.exec:\bnhbnh.exe181⤵PID:3472
-
\??\c:\dpdpp.exec:\dpdpp.exe182⤵PID:4280
-
\??\c:\vjdpd.exec:\vjdpd.exe183⤵PID:4632
-
\??\c:\llffrlr.exec:\llffrlr.exe184⤵PID:4368
-
\??\c:\frrxlfr.exec:\frrxlfr.exe185⤵PID:6096
-
\??\c:\htbtnn.exec:\htbtnn.exe186⤵PID:4584
-
\??\c:\hhhhtn.exec:\hhhhtn.exe187⤵PID:6000
-
\??\c:\vppdp.exec:\vppdp.exe188⤵PID:3148
-
\??\c:\frxrrff.exec:\frxrrff.exe189⤵PID:4004
-
\??\c:\lrrlfxx.exec:\lrrlfxx.exe190⤵PID:5648
-
\??\c:\hthbtn.exec:\hthbtn.exe191⤵PID:3292
-
\??\c:\hhnbhh.exec:\hhnbhh.exe192⤵PID:5644
-
\??\c:\3jpjd.exec:\3jpjd.exe193⤵PID:4332
-
\??\c:\vjjvp.exec:\vjjvp.exe194⤵PID:2076
-
\??\c:\frrlxrf.exec:\frrlxrf.exe195⤵PID:1376
-
\??\c:\lflfrlf.exec:\lflfrlf.exe196⤵PID:2460
-
\??\c:\nbtnbt.exec:\nbtnbt.exe197⤵PID:4548
-
\??\c:\ppppd.exec:\ppppd.exe198⤵PID:5308
-
\??\c:\dvjvp.exec:\dvjvp.exe199⤵PID:6136
-
\??\c:\ffrrfxl.exec:\ffrrfxl.exe200⤵PID:976
-
\??\c:\flrrfxl.exec:\flrrfxl.exe201⤵PID:2776
-
\??\c:\nnhbbb.exec:\nnhbbb.exe202⤵PID:5956
-
\??\c:\vjdpv.exec:\vjdpv.exe203⤵PID:4804
-
\??\c:\3djdv.exec:\3djdv.exe204⤵PID:3800
-
\??\c:\7rllxxl.exec:\7rllxxl.exe205⤵PID:5208
-
\??\c:\frrfxrf.exec:\frrfxrf.exe206⤵PID:4856
-
\??\c:\nhthtn.exec:\nhthtn.exe207⤵PID:944
-
\??\c:\hhthtn.exec:\hhthtn.exe208⤵PID:432
-
\??\c:\jvpdp.exec:\jvpdp.exe209⤵PID:1244
-
\??\c:\dvjjv.exec:\dvjjv.exe210⤵PID:2020
-
\??\c:\xffxlxr.exec:\xffxlxr.exe211⤵PID:1932
-
\??\c:\nbthbb.exec:\nbthbb.exe212⤵PID:5088
-
\??\c:\jdjdj.exec:\jdjdj.exe213⤵PID:764
-
\??\c:\vdjjv.exec:\vdjjv.exe214⤵PID:4872
-
\??\c:\7fxllff.exec:\7fxllff.exe215⤵PID:5636
-
\??\c:\1lfxlfr.exec:\1lfxlfr.exe216⤵PID:4784
-
\??\c:\bnnbhb.exec:\bnnbhb.exe217⤵PID:3152
-
\??\c:\nbhtnh.exec:\nbhtnh.exe218⤵PID:5784
-
\??\c:\pjvdd.exec:\pjvdd.exe219⤵PID:4908
-
\??\c:\jvdvj.exec:\jvdvj.exe220⤵PID:448
-
\??\c:\xxrlllr.exec:\xxrlllr.exe221⤵PID:2824
-
\??\c:\tbhbnn.exec:\tbhbnn.exe222⤵PID:1072
-
\??\c:\7nhbnh.exec:\7nhbnh.exe223⤵PID:3352
-
\??\c:\pvpdj.exec:\pvpdj.exe224⤵PID:4732
-
\??\c:\lrrxxlr.exec:\lrrxxlr.exe225⤵PID:4496
-
\??\c:\rxrfrlx.exec:\rxrfrlx.exe226⤵PID:5256
-
\??\c:\nbtnbt.exec:\nbtnbt.exe227⤵PID:4124
-
\??\c:\dpjvj.exec:\dpjvj.exe228⤵PID:4148
-
\??\c:\vdvpd.exec:\vdvpd.exe229⤵PID:1012
-
\??\c:\3frlxxr.exec:\3frlxxr.exe230⤵PID:1220
-
\??\c:\xrxlrll.exec:\xrxlrll.exe231⤵PID:452
-
\??\c:\hnnhbt.exec:\hnnhbt.exe232⤵PID:5028
-
\??\c:\1thtnh.exec:\1thtnh.exe233⤵PID:2760
-
\??\c:\jdpjv.exec:\jdpjv.exe234⤵PID:4948
-
\??\c:\jdvjd.exec:\jdvjd.exe235⤵PID:5560
-
\??\c:\rlrfllx.exec:\rlrfllx.exe236⤵PID:3844
-
\??\c:\5llxlfr.exec:\5llxlfr.exe237⤵PID:2416
-
\??\c:\hhnbhb.exec:\hhnbhb.exe238⤵PID:5132
-
\??\c:\dvpjj.exec:\dvpjj.exe239⤵PID:3508
-
\??\c:\jppdv.exec:\jppdv.exe240⤵PID:3944
-
\??\c:\9xxlrrx.exec:\9xxlrrx.exe241⤵PID:3644
-
\??\c:\xlfrfxr.exec:\xlfrfxr.exe242⤵PID:5216