Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:25
Behavioral task
behavioral1
Sample
4291685026a80f0623f1cc3c7b9c2250_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4291685026a80f0623f1cc3c7b9c2250_NeikiAnalytics.exe
-
Size
121KB
-
MD5
4291685026a80f0623f1cc3c7b9c2250
-
SHA1
d105fe77e2bd332da338d84daa111e12ec647646
-
SHA256
e0bd357c1e575942392c526e67f280691b88c9d50c06c32e71eae13757e87515
-
SHA512
74b5545cd6e35871da29d183975914f7975b27ea0e08c9ced2e58f87eff6fc2fe6545a49450980baa7e2df6972ccbd7208a71e96f2935038b04450c97296ad8d
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcka62c+8+dRN1Q:9cm4FmowdHoSZ6lCX0
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4824-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1108-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1240-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3156-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/516-553-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-569-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-715-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-865-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-872-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-941-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-994-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxffllr.exedddpp.exeppdjj.exefrxxrrl.exerrrlfxl.exehnbthn.exebbnntb.exejjjjd.exelxrrlff.exehttntb.exevpjvd.exe1pjdd.exexrlflxf.exetttttb.exejpjpp.exerflrlrr.exenhhthb.exedvppj.exe5rllflf.exefrxrlll.exetntbbb.exevpjdv.exellflfrf.exenbhhhh.exe9hhbbb.exe1fffxxx.exelfrrrxf.exehhhttt.exepvddj.exefxffxrr.exe7hnhbb.exevdppp.exeflrrlrl.exebtnnhh.exebnnhbb.exethbtht.exe5jvvv.exe7fxxxxx.exefrxrlxx.exetnhbbb.exejdvpp.exeddvdd.exerffxrrl.exexxxrrxx.exepjvvv.exe9fxrllf.exerlrlffx.exerfxxrlx.exenhttnt.exe5hnbbb.exepdjjd.exexrfxxrr.exerflllll.exehhhnnn.exepjdpj.exedvvpp.exerrfffff.exe9bhnhn.exebthhbt.exedpvvv.exe9fffxrl.exerlllfll.exennhhnt.exebbnhnn.exepid process 4824 lxffllr.exe 2220 dddpp.exe 644 ppdjj.exe 448 frxxrrl.exe 4396 rrrlfxl.exe 4036 hnbthn.exe 2512 bbnntb.exe 3304 jjjjd.exe 4112 lxrrlff.exe 2460 httntb.exe 4228 vpjvd.exe 3068 1pjdd.exe 1108 xrlflxf.exe 4748 tttttb.exe 3396 jpjpp.exe 4044 rflrlrr.exe 1436 nhhthb.exe 3812 dvppj.exe 3380 5rllflf.exe 4632 frxrlll.exe 4308 tntbbb.exe 2520 vpjdv.exe 832 llflfrf.exe 1240 nbhhhh.exe 916 9hhbbb.exe 4712 1fffxxx.exe 1992 lfrrrxf.exe 4140 hhhttt.exe 2544 pvddj.exe 1776 fxffxrr.exe 2568 7hnhbb.exe 4412 vdppp.exe 4032 flrrlrl.exe 1508 btnnhh.exe 4064 bnnhbb.exe 3628 thbtht.exe 3856 5jvvv.exe 3156 7fxxxxx.exe 3216 frxrlxx.exe 5068 tnhbbb.exe 316 jdvpp.exe 4832 ddvdd.exe 4464 rffxrrl.exe 740 xxxrrxx.exe 2824 pjvvv.exe 548 9fxrllf.exe 4816 rlrlffx.exe 3032 rfxxrlx.exe 2996 nhttnt.exe 4268 5hnbbb.exe 4100 pdjjd.exe 3252 xrfxxrr.exe 1688 rflllll.exe 4332 hhhnnn.exe 400 pjdpj.exe 4960 dvvpp.exe 1136 rrfffff.exe 2524 9bhnhn.exe 2904 bthhbt.exe 5016 dpvvv.exe 4948 9fffxrl.exe 3612 rlllfll.exe 2060 nnhhnt.exe 3400 bbnhnn.exe -
Processes:
resource yara_rule behavioral2/memory/5080-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxffllr.exe upx behavioral2/memory/4824-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5080-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddpp.exe upx C:\ppdjj.exe upx behavioral2/memory/2220-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/644-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frxxrrl.exe upx behavioral2/memory/448-25-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrrlfxl.exe upx C:\hnbthn.exe upx behavioral2/memory/4036-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbnntb.exe upx behavioral2/memory/2512-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjjd.exe upx behavioral2/memory/3304-53-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxrrlff.exe upx C:\httntb.exe upx C:\vpjvd.exe upx behavioral2/memory/4228-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1pjdd.exe upx behavioral2/memory/3068-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlflxf.exe upx behavioral2/memory/2460-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tttttb.exe upx behavioral2/memory/1108-81-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpjpp.exe upx behavioral2/memory/4748-88-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rflrlrr.exe upx behavioral2/memory/3396-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhthb.exe upx C:\dvppj.exe upx behavioral2/memory/1436-104-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frxrlll.exe upx \??\c:\5rllflf.exe upx behavioral2/memory/4632-118-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tntbbb.exe upx C:\vpjdv.exe upx C:\llflfrf.exe upx behavioral2/memory/2520-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/832-135-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbhhhh.exe upx C:\9hhbbb.exe upx behavioral2/memory/1240-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/916-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1fffxxx.exe upx behavioral2/memory/4712-152-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfrrrxf.exe upx behavioral2/memory/1992-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhttt.exe upx C:\pvddj.exe upx C:\fxffxrr.exe upx C:\7hnhbb.exe upx C:\vdppp.exe upx behavioral2/memory/2568-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4032-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4064-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3628-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3156-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3216-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5068-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4832-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4464-222-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4291685026a80f0623f1cc3c7b9c2250_NeikiAnalytics.exelxffllr.exedddpp.exeppdjj.exefrxxrrl.exerrrlfxl.exehnbthn.exebbnntb.exejjjjd.exelxrrlff.exehttntb.exevpjvd.exe1pjdd.exexrlflxf.exetttttb.exejpjpp.exerflrlrr.exenhhthb.exedvppj.exe5rllflf.exefrxrlll.exetntbbb.exedescription pid process target process PID 5080 wrote to memory of 4824 5080 4291685026a80f0623f1cc3c7b9c2250_NeikiAnalytics.exe lxffllr.exe PID 5080 wrote to memory of 4824 5080 4291685026a80f0623f1cc3c7b9c2250_NeikiAnalytics.exe lxffllr.exe PID 5080 wrote to memory of 4824 5080 4291685026a80f0623f1cc3c7b9c2250_NeikiAnalytics.exe lxffllr.exe PID 4824 wrote to memory of 2220 4824 lxffllr.exe dddpp.exe PID 4824 wrote to memory of 2220 4824 lxffllr.exe dddpp.exe PID 4824 wrote to memory of 2220 4824 lxffllr.exe dddpp.exe PID 2220 wrote to memory of 644 2220 dddpp.exe ppdjj.exe PID 2220 wrote to memory of 644 2220 dddpp.exe ppdjj.exe PID 2220 wrote to memory of 644 2220 dddpp.exe ppdjj.exe PID 644 wrote to memory of 448 644 ppdjj.exe frxxrrl.exe PID 644 wrote to memory of 448 644 ppdjj.exe frxxrrl.exe PID 644 wrote to memory of 448 644 ppdjj.exe frxxrrl.exe PID 448 wrote to memory of 4396 448 frxxrrl.exe rrrlfxl.exe PID 448 wrote to memory of 4396 448 frxxrrl.exe rrrlfxl.exe PID 448 wrote to memory of 4396 448 frxxrrl.exe rrrlfxl.exe PID 4396 wrote to memory of 4036 4396 rrrlfxl.exe hnbthn.exe PID 4396 wrote to memory of 4036 4396 rrrlfxl.exe hnbthn.exe PID 4396 wrote to memory of 4036 4396 rrrlfxl.exe hnbthn.exe PID 4036 wrote to memory of 2512 4036 hnbthn.exe bbnntb.exe PID 4036 wrote to memory of 2512 4036 hnbthn.exe bbnntb.exe PID 4036 wrote to memory of 2512 4036 hnbthn.exe bbnntb.exe PID 2512 wrote to memory of 3304 2512 bbnntb.exe jjjjd.exe PID 2512 wrote to memory of 3304 2512 bbnntb.exe jjjjd.exe PID 2512 wrote to memory of 3304 2512 bbnntb.exe jjjjd.exe PID 3304 wrote to memory of 4112 3304 jjjjd.exe lxrrlff.exe PID 3304 wrote to memory of 4112 3304 jjjjd.exe lxrrlff.exe PID 3304 wrote to memory of 4112 3304 jjjjd.exe lxrrlff.exe PID 4112 wrote to memory of 2460 4112 lxrrlff.exe httntb.exe PID 4112 wrote to memory of 2460 4112 lxrrlff.exe httntb.exe PID 4112 wrote to memory of 2460 4112 lxrrlff.exe httntb.exe PID 2460 wrote to memory of 4228 2460 httntb.exe vpjvd.exe PID 2460 wrote to memory of 4228 2460 httntb.exe vpjvd.exe PID 2460 wrote to memory of 4228 2460 httntb.exe vpjvd.exe PID 4228 wrote to memory of 3068 4228 vpjvd.exe 1pjdd.exe PID 4228 wrote to memory of 3068 4228 vpjvd.exe 1pjdd.exe PID 4228 wrote to memory of 3068 4228 vpjvd.exe 1pjdd.exe PID 3068 wrote to memory of 1108 3068 1pjdd.exe xrlflxf.exe PID 3068 wrote to memory of 1108 3068 1pjdd.exe xrlflxf.exe PID 3068 wrote to memory of 1108 3068 1pjdd.exe xrlflxf.exe PID 1108 wrote to memory of 4748 1108 xrlflxf.exe tttttb.exe PID 1108 wrote to memory of 4748 1108 xrlflxf.exe tttttb.exe PID 1108 wrote to memory of 4748 1108 xrlflxf.exe tttttb.exe PID 4748 wrote to memory of 3396 4748 tttttb.exe jpjpp.exe PID 4748 wrote to memory of 3396 4748 tttttb.exe jpjpp.exe PID 4748 wrote to memory of 3396 4748 tttttb.exe jpjpp.exe PID 3396 wrote to memory of 4044 3396 jpjpp.exe rflrlrr.exe PID 3396 wrote to memory of 4044 3396 jpjpp.exe rflrlrr.exe PID 3396 wrote to memory of 4044 3396 jpjpp.exe rflrlrr.exe PID 4044 wrote to memory of 1436 4044 rflrlrr.exe nhhthb.exe PID 4044 wrote to memory of 1436 4044 rflrlrr.exe nhhthb.exe PID 4044 wrote to memory of 1436 4044 rflrlrr.exe nhhthb.exe PID 1436 wrote to memory of 3812 1436 nhhthb.exe dvppj.exe PID 1436 wrote to memory of 3812 1436 nhhthb.exe dvppj.exe PID 1436 wrote to memory of 3812 1436 nhhthb.exe dvppj.exe PID 3812 wrote to memory of 3380 3812 dvppj.exe 5rllflf.exe PID 3812 wrote to memory of 3380 3812 dvppj.exe 5rllflf.exe PID 3812 wrote to memory of 3380 3812 dvppj.exe 5rllflf.exe PID 3380 wrote to memory of 4632 3380 5rllflf.exe frxrlll.exe PID 3380 wrote to memory of 4632 3380 5rllflf.exe frxrlll.exe PID 3380 wrote to memory of 4632 3380 5rllflf.exe frxrlll.exe PID 4632 wrote to memory of 4308 4632 frxrlll.exe tntbbb.exe PID 4632 wrote to memory of 4308 4632 frxrlll.exe tntbbb.exe PID 4632 wrote to memory of 4308 4632 frxrlll.exe tntbbb.exe PID 4308 wrote to memory of 2520 4308 tntbbb.exe vpjdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4291685026a80f0623f1cc3c7b9c2250_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4291685026a80f0623f1cc3c7b9c2250_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\lxffllr.exec:\lxffllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\dddpp.exec:\dddpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\ppdjj.exec:\ppdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\frxxrrl.exec:\frxxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\rrrlfxl.exec:\rrrlfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\hnbthn.exec:\hnbthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\bbnntb.exec:\bbnntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\jjjjd.exec:\jjjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\lxrrlff.exec:\lxrrlff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\httntb.exec:\httntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\vpjvd.exec:\vpjvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\1pjdd.exec:\1pjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\xrlflxf.exec:\xrlflxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\tttttb.exec:\tttttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\jpjpp.exec:\jpjpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\rflrlrr.exec:\rflrlrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\nhhthb.exec:\nhhthb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\dvppj.exec:\dvppj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\5rllflf.exec:\5rllflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\frxrlll.exec:\frxrlll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\tntbbb.exec:\tntbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\vpjdv.exec:\vpjdv.exe23⤵
- Executes dropped EXE
PID:2520 -
\??\c:\llflfrf.exec:\llflfrf.exe24⤵
- Executes dropped EXE
PID:832 -
\??\c:\nbhhhh.exec:\nbhhhh.exe25⤵
- Executes dropped EXE
PID:1240 -
\??\c:\9hhbbb.exec:\9hhbbb.exe26⤵
- Executes dropped EXE
PID:916 -
\??\c:\1fffxxx.exec:\1fffxxx.exe27⤵
- Executes dropped EXE
PID:4712 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe28⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hhhttt.exec:\hhhttt.exe29⤵
- Executes dropped EXE
PID:4140 -
\??\c:\pvddj.exec:\pvddj.exe30⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fxffxrr.exec:\fxffxrr.exe31⤵
- Executes dropped EXE
PID:1776 -
\??\c:\7hnhbb.exec:\7hnhbb.exe32⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vdppp.exec:\vdppp.exe33⤵
- Executes dropped EXE
PID:4412 -
\??\c:\flrrlrl.exec:\flrrlrl.exe34⤵
- Executes dropped EXE
PID:4032 -
\??\c:\btnnhh.exec:\btnnhh.exe35⤵
- Executes dropped EXE
PID:1508 -
\??\c:\bnnhbb.exec:\bnnhbb.exe36⤵
- Executes dropped EXE
PID:4064 -
\??\c:\thbtht.exec:\thbtht.exe37⤵
- Executes dropped EXE
PID:3628 -
\??\c:\5jvvv.exec:\5jvvv.exe38⤵
- Executes dropped EXE
PID:3856 -
\??\c:\7fxxxxx.exec:\7fxxxxx.exe39⤵
- Executes dropped EXE
PID:3156 -
\??\c:\frxrlxx.exec:\frxrlxx.exe40⤵
- Executes dropped EXE
PID:3216 -
\??\c:\tnhbbb.exec:\tnhbbb.exe41⤵
- Executes dropped EXE
PID:5068 -
\??\c:\jdvpp.exec:\jdvpp.exe42⤵
- Executes dropped EXE
PID:316 -
\??\c:\ddvdd.exec:\ddvdd.exe43⤵
- Executes dropped EXE
PID:4832 -
\??\c:\rffxrrl.exec:\rffxrrl.exe44⤵
- Executes dropped EXE
PID:4464 -
\??\c:\xxxrrxx.exec:\xxxrrxx.exe45⤵
- Executes dropped EXE
PID:740 -
\??\c:\pjvvv.exec:\pjvvv.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9fxrllf.exec:\9fxrllf.exe47⤵
- Executes dropped EXE
PID:548 -
\??\c:\rlrlffx.exec:\rlrlffx.exe48⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rfxxrlx.exec:\rfxxrlx.exe49⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nhttnt.exec:\nhttnt.exe50⤵
- Executes dropped EXE
PID:2996 -
\??\c:\5hnbbb.exec:\5hnbbb.exe51⤵
- Executes dropped EXE
PID:4268 -
\??\c:\pdjjd.exec:\pdjjd.exe52⤵
- Executes dropped EXE
PID:4100 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe53⤵
- Executes dropped EXE
PID:3252 -
\??\c:\rflllll.exec:\rflllll.exe54⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hhhnnn.exec:\hhhnnn.exe55⤵
- Executes dropped EXE
PID:4332 -
\??\c:\pjdpj.exec:\pjdpj.exe56⤵
- Executes dropped EXE
PID:400 -
\??\c:\dvvpp.exec:\dvvpp.exe57⤵
- Executes dropped EXE
PID:4960 -
\??\c:\rrfffff.exec:\rrfffff.exe58⤵
- Executes dropped EXE
PID:1136 -
\??\c:\9bhnhn.exec:\9bhnhn.exe59⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bthhbt.exec:\bthhbt.exe60⤵
- Executes dropped EXE
PID:2904 -
\??\c:\dpvvv.exec:\dpvvv.exe61⤵
- Executes dropped EXE
PID:5016 -
\??\c:\9fffxrl.exec:\9fffxrl.exe62⤵
- Executes dropped EXE
PID:4948 -
\??\c:\rlllfll.exec:\rlllfll.exe63⤵
- Executes dropped EXE
PID:3612 -
\??\c:\nnhhnt.exec:\nnhhnt.exe64⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bbnhnn.exec:\bbnhnn.exe65⤵
- Executes dropped EXE
PID:3400 -
\??\c:\jvvdj.exec:\jvvdj.exe66⤵PID:4060
-
\??\c:\rflrrlr.exec:\rflrrlr.exe67⤵PID:1980
-
\??\c:\rllffff.exec:\rllffff.exe68⤵PID:1072
-
\??\c:\ttbhhn.exec:\ttbhhn.exe69⤵PID:4312
-
\??\c:\nnthhn.exec:\nnthhn.exe70⤵PID:3000
-
\??\c:\7pppp.exec:\7pppp.exe71⤵PID:1576
-
\??\c:\ffrrxrl.exec:\ffrrxrl.exe72⤵PID:1828
-
\??\c:\btbntb.exec:\btbntb.exe73⤵PID:2916
-
\??\c:\httbnb.exec:\httbnb.exe74⤵PID:1908
-
\??\c:\pjjjp.exec:\pjjjp.exe75⤵PID:5000
-
\??\c:\5rlxxff.exec:\5rlxxff.exe76⤵PID:1412
-
\??\c:\tnbbtt.exec:\tnbbtt.exe77⤵PID:1696
-
\??\c:\3nbhbn.exec:\3nbhbn.exe78⤵PID:4000
-
\??\c:\dvvpp.exec:\dvvpp.exe79⤵PID:748
-
\??\c:\xxrrrrl.exec:\xxrrrrl.exe80⤵PID:5064
-
\??\c:\xrfxffl.exec:\xrfxffl.exe81⤵PID:4092
-
\??\c:\nnbthh.exec:\nnbthh.exe82⤵PID:4364
-
\??\c:\3vdjd.exec:\3vdjd.exe83⤵PID:2544
-
\??\c:\frxxxfl.exec:\frxxxfl.exe84⤵PID:4536
-
\??\c:\xxfffll.exec:\xxfffll.exe85⤵PID:4752
-
\??\c:\htbbnh.exec:\htbbnh.exe86⤵PID:2768
-
\??\c:\ddjjj.exec:\ddjjj.exe87⤵PID:5076
-
\??\c:\djpjj.exec:\djpjj.exe88⤵PID:3872
-
\??\c:\llrrlrl.exec:\llrrlrl.exe89⤵PID:4220
-
\??\c:\hhtthn.exec:\hhtthn.exe90⤵PID:1548
-
\??\c:\jdvpj.exec:\jdvpj.exe91⤵PID:4264
-
\??\c:\pvvpp.exec:\pvvpp.exe92⤵PID:2800
-
\??\c:\rfllfxx.exec:\rfllfxx.exe93⤵PID:4132
-
\??\c:\frfxxff.exec:\frfxxff.exe94⤵PID:1708
-
\??\c:\nnbbtt.exec:\nnbbtt.exe95⤵PID:3216
-
\??\c:\nbhhbb.exec:\nbhhbb.exe96⤵PID:5068
-
\??\c:\jvpdv.exec:\jvpdv.exe97⤵PID:3852
-
\??\c:\rlllfff.exec:\rlllfff.exe98⤵PID:1532
-
\??\c:\9rxfxfr.exec:\9rxfxfr.exe99⤵PID:2812
-
\??\c:\5bbttb.exec:\5bbttb.exe100⤵PID:4156
-
\??\c:\9vpjd.exec:\9vpjd.exe101⤵PID:4744
-
\??\c:\vpdvv.exec:\vpdvv.exe102⤵PID:2376
-
\??\c:\lrrrlll.exec:\lrrrlll.exe103⤵PID:1720
-
\??\c:\xxlrflx.exec:\xxlrflx.exe104⤵PID:3520
-
\??\c:\hnhbhn.exec:\hnhbhn.exe105⤵PID:412
-
\??\c:\9jvpd.exec:\9jvpd.exe106⤵PID:4268
-
\??\c:\lrxlfxx.exec:\lrxlfxx.exe107⤵PID:5044
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe108⤵PID:1352
-
\??\c:\bbttnn.exec:\bbttnn.exe109⤵PID:2900
-
\??\c:\hbhnhh.exec:\hbhnhh.exe110⤵PID:2420
-
\??\c:\ppdvv.exec:\ppdvv.exe111⤵PID:4644
-
\??\c:\ffrxflx.exec:\ffrxflx.exe112⤵PID:4200
-
\??\c:\5rlfffx.exec:\5rlfffx.exe113⤵PID:3436
-
\??\c:\bnnhbb.exec:\bnnhbb.exe114⤵PID:1580
-
\??\c:\pvvpj.exec:\pvvpj.exe115⤵PID:2456
-
\??\c:\vdpjd.exec:\vdpjd.exe116⤵PID:5088
-
\??\c:\xfxrlrl.exec:\xfxrlrl.exe117⤵PID:1912
-
\??\c:\hbbhbh.exec:\hbbhbh.exe118⤵PID:1984
-
\??\c:\thhhhn.exec:\thhhhn.exe119⤵PID:3348
-
\??\c:\thnthh.exec:\thnthh.exe120⤵PID:4676
-
\??\c:\bhbthb.exec:\bhbthb.exe121⤵PID:3960
-
\??\c:\pdjdd.exec:\pdjdd.exe122⤵PID:4308
-
\??\c:\xxxrrxr.exec:\xxxrrxr.exe123⤵PID:4012
-
\??\c:\bhnntb.exec:\bhnntb.exe124⤵PID:2916
-
\??\c:\nbhbnn.exec:\nbhbnn.exe125⤵PID:464
-
\??\c:\dvvvp.exec:\dvvvp.exe126⤵PID:1240
-
\??\c:\flllffx.exec:\flllffx.exe127⤵PID:3264
-
\??\c:\fxflrrf.exec:\fxflrrf.exe128⤵PID:4712
-
\??\c:\hhbbtt.exec:\hhbbtt.exe129⤵PID:3844
-
\??\c:\vjpjj.exec:\vjpjj.exe130⤵PID:1368
-
\??\c:\vpppj.exec:\vpppj.exe131⤵PID:3584
-
\??\c:\ffffrxf.exec:\ffffrxf.exe132⤵PID:4280
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe133⤵PID:1480
-
\??\c:\pdjdd.exec:\pdjdd.exe134⤵PID:4072
-
\??\c:\pjjjj.exec:\pjjjj.exe135⤵PID:2768
-
\??\c:\lxlfffl.exec:\lxlfffl.exe136⤵PID:1508
-
\??\c:\tnnhbb.exec:\tnnhbb.exe137⤵PID:4264
-
\??\c:\nnbbht.exec:\nnbbht.exe138⤵PID:3156
-
\??\c:\djjjd.exec:\djjjd.exe139⤵PID:4984
-
\??\c:\vvdpp.exec:\vvdpp.exe140⤵PID:1708
-
\??\c:\fffxrrr.exec:\fffxrrr.exe141⤵PID:3216
-
\??\c:\tnttnn.exec:\tnttnn.exe142⤵PID:4468
-
\??\c:\jdjjj.exec:\jdjjj.exe143⤵PID:4596
-
\??\c:\5vppj.exec:\5vppj.exe144⤵PID:516
-
\??\c:\fxrlxrr.exec:\fxrlxrr.exe145⤵PID:948
-
\??\c:\nnhhbt.exec:\nnhhbt.exe146⤵PID:2664
-
\??\c:\9ddvv.exec:\9ddvv.exe147⤵PID:3240
-
\??\c:\lxffflr.exec:\lxffflr.exe148⤵PID:804
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe149⤵PID:2868
-
\??\c:\hbhnhn.exec:\hbhnhn.exe150⤵PID:4840
-
\??\c:\vdvvp.exec:\vdvvp.exe151⤵PID:2584
-
\??\c:\ffrrrxx.exec:\ffrrrxx.exe152⤵PID:1888
-
\??\c:\5rrrfll.exec:\5rrrfll.exe153⤵PID:3520
-
\??\c:\bttnnh.exec:\bttnnh.exe154⤵PID:4700
-
\??\c:\jvjjv.exec:\jvjjv.exe155⤵PID:2480
-
\??\c:\7lrxrxr.exec:\7lrxrxr.exe156⤵PID:4228
-
\??\c:\bhnhbb.exec:\bhnhbb.exe157⤵PID:2184
-
\??\c:\jdvvp.exec:\jdvvp.exe158⤵PID:2884
-
\??\c:\jdvjd.exec:\jdvjd.exe159⤵PID:4644
-
\??\c:\fxlfxll.exec:\fxlfxll.exe160⤵PID:4748
-
\??\c:\llffxfl.exec:\llffxfl.exe161⤵PID:5060
-
\??\c:\nnhhbb.exec:\nnhhbb.exe162⤵PID:3564
-
\??\c:\thnnnn.exec:\thnnnn.exe163⤵PID:4136
-
\??\c:\9pjjj.exec:\9pjjj.exe164⤵PID:1044
-
\??\c:\pjjdv.exec:\pjjdv.exe165⤵PID:1556
-
\??\c:\llrlfxf.exec:\llrlfxf.exe166⤵PID:4568
-
\??\c:\lrxfxrf.exec:\lrxfxrf.exe167⤵PID:1940
-
\??\c:\hhhhhn.exec:\hhhhhn.exe168⤵PID:2916
-
\??\c:\nhhnnt.exec:\nhhnnt.exe169⤵PID:2820
-
\??\c:\3pdvj.exec:\3pdvj.exe170⤵PID:976
-
\??\c:\jvvpj.exec:\jvvpj.exe171⤵PID:1000
-
\??\c:\llxxrrx.exec:\llxxrrx.exe172⤵PID:4712
-
\??\c:\lfllffr.exec:\lfllffr.exe173⤵PID:4764
-
\??\c:\nnbtnt.exec:\nnbtnt.exe174⤵PID:2544
-
\??\c:\thnnnn.exec:\thnnnn.exe175⤵PID:996
-
\??\c:\7dddv.exec:\7dddv.exe176⤵PID:3992
-
\??\c:\1llfxff.exec:\1llfxff.exe177⤵PID:4772
-
\??\c:\nhnhbb.exec:\nhnhbb.exe178⤵PID:5076
-
\??\c:\vjpvv.exec:\vjpvv.exe179⤵PID:3948
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe180⤵PID:2768
-
\??\c:\nbbbht.exec:\nbbbht.exe181⤵PID:1548
-
\??\c:\jjjjd.exec:\jjjjd.exe182⤵PID:4064
-
\??\c:\pdpjj.exec:\pdpjj.exe183⤵PID:2800
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe184⤵PID:2472
-
\??\c:\rllfxrl.exec:\rllfxrl.exe185⤵PID:3308
-
\??\c:\7htbnh.exec:\7htbnh.exe186⤵PID:880
-
\??\c:\9dppv.exec:\9dppv.exe187⤵PID:5068
-
\??\c:\lfllllr.exec:\lfllllr.exe188⤵PID:1204
-
\??\c:\nttttt.exec:\nttttt.exe189⤵PID:4824
-
\??\c:\vpjjd.exec:\vpjjd.exe190⤵PID:2824
-
\??\c:\rllfxrl.exec:\rllfxrl.exe191⤵PID:3276
-
\??\c:\tnhhbn.exec:\tnhhbn.exe192⤵PID:548
-
\??\c:\hbbbtb.exec:\hbbbtb.exe193⤵PID:2992
-
\??\c:\jpvpp.exec:\jpvpp.exe194⤵PID:4204
-
\??\c:\xlxrffx.exec:\xlxrffx.exe195⤵PID:804
-
\??\c:\lfxrllf.exec:\lfxrllf.exe196⤵PID:2512
-
\??\c:\nbhbtt.exec:\nbhbtt.exe197⤵PID:1468
-
\??\c:\jdddj.exec:\jdddj.exe198⤵PID:1296
-
\??\c:\fxfxffl.exec:\fxfxffl.exe199⤵PID:1544
-
\??\c:\xrllfff.exec:\xrllfff.exe200⤵PID:3520
-
\??\c:\tnttbb.exec:\tnttbb.exe201⤵PID:4960
-
\??\c:\nttttt.exec:\nttttt.exe202⤵PID:2480
-
\??\c:\3dvpp.exec:\3dvpp.exe203⤵PID:2128
-
\??\c:\dvvvp.exec:\dvvvp.exe204⤵PID:936
-
\??\c:\ddppp.exec:\ddppp.exe205⤵PID:3196
-
\??\c:\xrrlffx.exec:\xrrlffx.exe206⤵PID:2320
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe207⤵PID:2456
-
\??\c:\nnnnnh.exec:\nnnnnh.exe208⤵PID:4060
-
\??\c:\nthhhb.exec:\nthhhb.exe209⤵PID:1044
-
\??\c:\9thbhh.exec:\9thbhh.exe210⤵PID:1784
-
\??\c:\jvjdj.exec:\jvjdj.exe211⤵PID:696
-
\??\c:\9pppp.exec:\9pppp.exe212⤵PID:2400
-
\??\c:\5xxrllf.exec:\5xxrllf.exe213⤵PID:1412
-
\??\c:\rffxxxx.exec:\rffxxxx.exe214⤵PID:3868
-
\??\c:\tthntb.exec:\tthntb.exe215⤵PID:1992
-
\??\c:\bnhhbb.exec:\bnhhbb.exe216⤵PID:8
-
\??\c:\vddpj.exec:\vddpj.exe217⤵PID:1380
-
\??\c:\pdddv.exec:\pdddv.exe218⤵PID:4364
-
\??\c:\frxxxxx.exec:\frxxxxx.exe219⤵PID:996
-
\??\c:\rrffxxr.exec:\rrffxxr.exe220⤵PID:1480
-
\??\c:\fxffrrf.exec:\fxffrrf.exe221⤵PID:4728
-
\??\c:\7nnnnt.exec:\7nnnnt.exe222⤵PID:3872
-
\??\c:\nhnnbh.exec:\nhnnbh.exe223⤵PID:3556
-
\??\c:\vdvdd.exec:\vdvdd.exe224⤵PID:1976
-
\??\c:\vpvpp.exec:\vpvpp.exe225⤵PID:4232
-
\??\c:\xrlffff.exec:\xrlffff.exe226⤵PID:1508
-
\??\c:\fxfxfff.exec:\fxfxfff.exe227⤵PID:440
-
\??\c:\tbnhhb.exec:\tbnhhb.exe228⤵PID:1536
-
\??\c:\vjddp.exec:\vjddp.exe229⤵PID:4668
-
\??\c:\djpjd.exec:\djpjd.exe230⤵PID:4056
-
\??\c:\frlfxxr.exec:\frlfxxr.exe231⤵PID:4468
-
\??\c:\rrxxxxr.exec:\rrxxxxr.exe232⤵PID:4472
-
\??\c:\7hnnnn.exec:\7hnnnn.exe233⤵PID:516
-
\??\c:\tnntnb.exec:\tnntnb.exe234⤵PID:1160
-
\??\c:\dddvp.exec:\dddvp.exe235⤵PID:644
-
\??\c:\frrlllf.exec:\frrlllf.exe236⤵PID:1720
-
\??\c:\xflrrll.exec:\xflrrll.exe237⤵PID:1208
-
\??\c:\bbtttt.exec:\bbtttt.exe238⤵PID:2712
-
\??\c:\1thtnb.exec:\1thtnb.exe239⤵PID:2808
-
\??\c:\1hbthn.exec:\1hbthn.exe240⤵PID:4584
-
\??\c:\7vvpj.exec:\7vvpj.exe241⤵PID:2304
-
\??\c:\pjjdp.exec:\pjjdp.exe242⤵PID:4384