Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:16
Behavioral task
behavioral1
Sample
6b167f41ac43840e0a28b55aafc60290_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6b167f41ac43840e0a28b55aafc60290_NeikiAnalytics.exe
-
Size
162KB
-
MD5
6b167f41ac43840e0a28b55aafc60290
-
SHA1
9bddb7478a121768fcf7baabf113a184289ef225
-
SHA256
6ec008c04ccaea3281fc97d9a4c0bc8316b0061bf8ace6d2aaf694a80b882ac8
-
SHA512
2c16ad48c52410d23e50849e5ae7fc5bc26324a8afd5f4d070e0e0119ed5d56aef2511dc6ac7bd2ea915fb2cd5c1b33d1954219348f8ee75b4195e780c8cd029
-
SSDEEP
3072:xhOmTsF93UYfwC6GIout0fmCiiiXAQ5lpBoGYwNNhu0CzhKPDNuBSF:xcm4FmowdHoSgWrXF5lpKGYV0wh6D9F
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/400-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3820-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3084-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/416-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2560-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-597-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-626-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhnhbb.exetnhbtt.exevppjv.exehhtnnb.exe1pvvv.exexllxfxl.exexfrllff.exe9nbtth.exe9rflrrx.exebnbbbb.exe3lxfxff.exehtbbtn.exejvdvp.exe9xxrrrl.exebtbbhh.exeppppj.exelxfxxxx.exenbhbtt.exejvppj.exerfrrrll.exehhtbht.exejvjpp.exe5xllfff.exe9pvpj.exelrfrllf.exebnbtnh.exe7pdvp.exennnhtt.exejdvpd.exeppjpj.exennbttt.exe9ddvp.exelxrllfx.exexlxlfxr.exehhntht.exevvpjp.exerfrlfll.exetnnbth.exebnntbh.exejdjjj.exerlrrrxx.exexfrfxff.exettbbtb.exevjjjv.exevpvdp.exe3flrlrr.exehntttt.exehtbbtb.exevvppd.exejjppj.exelxlxxll.exebthbnn.exebbhnnt.exedpppj.exejjvjj.exe7lrxrrr.exebbtbbb.exettbnbh.exejvppj.exe7rfrrxx.exerfrrlrl.exenbhbbh.exevvppd.exerrfffxr.exepid process 400 nhnhbb.exe 5000 tnhbtt.exe 2868 vppjv.exe 1424 hhtnnb.exe 1820 1pvvv.exe 440 xllxfxl.exe 1836 xfrllff.exe 4316 9nbtth.exe 3212 9rflrrx.exe 3576 bnbbbb.exe 748 3lxfxff.exe 1016 htbbtn.exe 3284 jvdvp.exe 8 9xxrrrl.exe 4212 btbbhh.exe 3184 ppppj.exe 1752 lxfxxxx.exe 3104 nbhbtt.exe 2172 jvppj.exe 2988 rfrrrll.exe 1100 hhtbht.exe 1412 jvjpp.exe 1032 5xllfff.exe 3192 9pvpj.exe 3128 lrfrllf.exe 3136 bnbtnh.exe 4788 7pdvp.exe 3852 nnnhtt.exe 4828 jdvpd.exe 4932 ppjpj.exe 3288 nnbttt.exe 4772 9ddvp.exe 3176 lxrllfx.exe 3340 xlxlfxr.exe 2932 hhntht.exe 2788 vvpjp.exe 1972 rfrlfll.exe 3084 tnnbth.exe 4560 bnntbh.exe 1864 jdjjj.exe 4324 rlrrrxx.exe 3964 xfrfxff.exe 2672 ttbbtb.exe 3640 vjjjv.exe 1932 vpvdp.exe 4024 3flrlrr.exe 1276 hntttt.exe 1056 htbbtb.exe 3036 vvppd.exe 4440 jjppj.exe 2560 lxlxxll.exe 2996 bthbnn.exe 2340 bbhnnt.exe 3944 dpppj.exe 5052 jjvjj.exe 556 7lrxrrr.exe 3576 bbtbbb.exe 3524 ttbnbh.exe 3052 jvppj.exe 2252 7rfrrxx.exe 3284 rfrrlrl.exe 8 nbhbbh.exe 2692 vvppd.exe 4808 rrfffxr.exe -
Processes:
resource yara_rule behavioral2/memory/3820-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnhbb.exe upx behavioral2/memory/400-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3820-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhbtt.exe upx behavioral2/memory/5000-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppjv.exe upx \??\c:\hhtnnb.exe upx behavioral2/memory/2868-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1424-21-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1pvvv.exe upx \??\c:\xllxfxl.exe upx behavioral2/memory/1820-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xfrllff.exe upx behavioral2/memory/440-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1836-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9nbtth.exe upx C:\9rflrrx.exe upx behavioral2/memory/4316-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3212-46-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnbbbb.exe upx behavioral2/memory/3576-51-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3lxfxff.exe upx C:\htbbtn.exe upx behavioral2/memory/748-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1016-62-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jvdvp.exe upx \??\c:\9xxrrrl.exe upx behavioral2/memory/4212-74-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btbbhh.exe upx C:\ppppj.exe upx C:\lxfxxxx.exe upx behavioral2/memory/3184-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbhbtt.exe upx behavioral2/memory/3104-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvppj.exe upx C:\rfrrrll.exe upx behavioral2/memory/2988-97-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhtbht.exe upx \??\c:\jvjpp.exe upx behavioral2/memory/1412-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5xllfff.exe upx C:\9pvpj.exe upx behavioral2/memory/1032-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3192-117-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lrfrllf.exe upx C:\bnbtnh.exe upx C:\7pdvp.exe upx behavioral2/memory/3136-129-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nnnhtt.exe upx behavioral2/memory/4788-133-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdvpd.exe upx behavioral2/memory/3852-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjpj.exe upx C:\nnbttt.exe upx behavioral2/memory/4932-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9ddvp.exe upx behavioral2/memory/3288-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4772-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3176-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2932-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2788-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3084-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4560-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6b167f41ac43840e0a28b55aafc60290_NeikiAnalytics.exenhnhbb.exetnhbtt.exevppjv.exehhtnnb.exe1pvvv.exexllxfxl.exexfrllff.exe9nbtth.exe9rflrrx.exebnbbbb.exe3lxfxff.exehtbbtn.exejvdvp.exe9xxrrrl.exebtbbhh.exeppppj.exelxfxxxx.exenbhbtt.exejvppj.exerfrrrll.exehhtbht.exedescription pid process target process PID 3820 wrote to memory of 400 3820 6b167f41ac43840e0a28b55aafc60290_NeikiAnalytics.exe nhnhbb.exe PID 3820 wrote to memory of 400 3820 6b167f41ac43840e0a28b55aafc60290_NeikiAnalytics.exe nhnhbb.exe PID 3820 wrote to memory of 400 3820 6b167f41ac43840e0a28b55aafc60290_NeikiAnalytics.exe nhnhbb.exe PID 400 wrote to memory of 5000 400 nhnhbb.exe tnhbtt.exe PID 400 wrote to memory of 5000 400 nhnhbb.exe tnhbtt.exe PID 400 wrote to memory of 5000 400 nhnhbb.exe tnhbtt.exe PID 5000 wrote to memory of 2868 5000 tnhbtt.exe vppjv.exe PID 5000 wrote to memory of 2868 5000 tnhbtt.exe vppjv.exe PID 5000 wrote to memory of 2868 5000 tnhbtt.exe vppjv.exe PID 2868 wrote to memory of 1424 2868 vppjv.exe hhtnnb.exe PID 2868 wrote to memory of 1424 2868 vppjv.exe hhtnnb.exe PID 2868 wrote to memory of 1424 2868 vppjv.exe hhtnnb.exe PID 1424 wrote to memory of 1820 1424 hhtnnb.exe 1pvvv.exe PID 1424 wrote to memory of 1820 1424 hhtnnb.exe 1pvvv.exe PID 1424 wrote to memory of 1820 1424 hhtnnb.exe 1pvvv.exe PID 1820 wrote to memory of 440 1820 1pvvv.exe xllxfxl.exe PID 1820 wrote to memory of 440 1820 1pvvv.exe xllxfxl.exe PID 1820 wrote to memory of 440 1820 1pvvv.exe xllxfxl.exe PID 440 wrote to memory of 1836 440 xllxfxl.exe xfrllff.exe PID 440 wrote to memory of 1836 440 xllxfxl.exe xfrllff.exe PID 440 wrote to memory of 1836 440 xllxfxl.exe xfrllff.exe PID 1836 wrote to memory of 4316 1836 xfrllff.exe 9nbtth.exe PID 1836 wrote to memory of 4316 1836 xfrllff.exe 9nbtth.exe PID 1836 wrote to memory of 4316 1836 xfrllff.exe 9nbtth.exe PID 4316 wrote to memory of 3212 4316 9nbtth.exe 9rflrrx.exe PID 4316 wrote to memory of 3212 4316 9nbtth.exe 9rflrrx.exe PID 4316 wrote to memory of 3212 4316 9nbtth.exe 9rflrrx.exe PID 3212 wrote to memory of 3576 3212 9rflrrx.exe bnbbbb.exe PID 3212 wrote to memory of 3576 3212 9rflrrx.exe bnbbbb.exe PID 3212 wrote to memory of 3576 3212 9rflrrx.exe bnbbbb.exe PID 3576 wrote to memory of 748 3576 bnbbbb.exe 3lxfxff.exe PID 3576 wrote to memory of 748 3576 bnbbbb.exe 3lxfxff.exe PID 3576 wrote to memory of 748 3576 bnbbbb.exe 3lxfxff.exe PID 748 wrote to memory of 1016 748 3lxfxff.exe htbbtn.exe PID 748 wrote to memory of 1016 748 3lxfxff.exe htbbtn.exe PID 748 wrote to memory of 1016 748 3lxfxff.exe htbbtn.exe PID 1016 wrote to memory of 3284 1016 htbbtn.exe jvdvp.exe PID 1016 wrote to memory of 3284 1016 htbbtn.exe jvdvp.exe PID 1016 wrote to memory of 3284 1016 htbbtn.exe jvdvp.exe PID 3284 wrote to memory of 8 3284 jvdvp.exe 9xxrrrl.exe PID 3284 wrote to memory of 8 3284 jvdvp.exe 9xxrrrl.exe PID 3284 wrote to memory of 8 3284 jvdvp.exe 9xxrrrl.exe PID 8 wrote to memory of 4212 8 9xxrrrl.exe btbbhh.exe PID 8 wrote to memory of 4212 8 9xxrrrl.exe btbbhh.exe PID 8 wrote to memory of 4212 8 9xxrrrl.exe btbbhh.exe PID 4212 wrote to memory of 3184 4212 btbbhh.exe ppppj.exe PID 4212 wrote to memory of 3184 4212 btbbhh.exe ppppj.exe PID 4212 wrote to memory of 3184 4212 btbbhh.exe ppppj.exe PID 3184 wrote to memory of 1752 3184 ppppj.exe lxfxxxx.exe PID 3184 wrote to memory of 1752 3184 ppppj.exe lxfxxxx.exe PID 3184 wrote to memory of 1752 3184 ppppj.exe lxfxxxx.exe PID 1752 wrote to memory of 3104 1752 lxfxxxx.exe nbhbtt.exe PID 1752 wrote to memory of 3104 1752 lxfxxxx.exe nbhbtt.exe PID 1752 wrote to memory of 3104 1752 lxfxxxx.exe nbhbtt.exe PID 3104 wrote to memory of 2172 3104 nbhbtt.exe jvppj.exe PID 3104 wrote to memory of 2172 3104 nbhbtt.exe jvppj.exe PID 3104 wrote to memory of 2172 3104 nbhbtt.exe jvppj.exe PID 2172 wrote to memory of 2988 2172 jvppj.exe rfrrrll.exe PID 2172 wrote to memory of 2988 2172 jvppj.exe rfrrrll.exe PID 2172 wrote to memory of 2988 2172 jvppj.exe rfrrrll.exe PID 2988 wrote to memory of 1100 2988 rfrrrll.exe hhtbht.exe PID 2988 wrote to memory of 1100 2988 rfrrrll.exe hhtbht.exe PID 2988 wrote to memory of 1100 2988 rfrrrll.exe hhtbht.exe PID 1100 wrote to memory of 1412 1100 hhtbht.exe jvjpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b167f41ac43840e0a28b55aafc60290_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6b167f41ac43840e0a28b55aafc60290_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\nhnhbb.exec:\nhnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\tnhbtt.exec:\tnhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\vppjv.exec:\vppjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\hhtnnb.exec:\hhtnnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\1pvvv.exec:\1pvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\xllxfxl.exec:\xllxfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\xfrllff.exec:\xfrllff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\9nbtth.exec:\9nbtth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\9rflrrx.exec:\9rflrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\bnbbbb.exec:\bnbbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\3lxfxff.exec:\3lxfxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\htbbtn.exec:\htbbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\jvdvp.exec:\jvdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\9xxrrrl.exec:\9xxrrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\btbbhh.exec:\btbbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\ppppj.exec:\ppppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\nbhbtt.exec:\nbhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\jvppj.exec:\jvppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\rfrrrll.exec:\rfrrrll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\hhtbht.exec:\hhtbht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\jvjpp.exec:\jvjpp.exe23⤵
- Executes dropped EXE
PID:1412 -
\??\c:\5xllfff.exec:\5xllfff.exe24⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9pvpj.exec:\9pvpj.exe25⤵
- Executes dropped EXE
PID:3192 -
\??\c:\lrfrllf.exec:\lrfrllf.exe26⤵
- Executes dropped EXE
PID:3128 -
\??\c:\bnbtnh.exec:\bnbtnh.exe27⤵
- Executes dropped EXE
PID:3136 -
\??\c:\7pdvp.exec:\7pdvp.exe28⤵
- Executes dropped EXE
PID:4788 -
\??\c:\nnnhtt.exec:\nnnhtt.exe29⤵
- Executes dropped EXE
PID:3852 -
\??\c:\jdvpd.exec:\jdvpd.exe30⤵
- Executes dropped EXE
PID:4828 -
\??\c:\ppjpj.exec:\ppjpj.exe31⤵
- Executes dropped EXE
PID:4932 -
\??\c:\nnbttt.exec:\nnbttt.exe32⤵
- Executes dropped EXE
PID:3288 -
\??\c:\9ddvp.exec:\9ddvp.exe33⤵
- Executes dropped EXE
PID:4772 -
\??\c:\lxrllfx.exec:\lxrllfx.exe34⤵
- Executes dropped EXE
PID:3176 -
\??\c:\xlxlfxr.exec:\xlxlfxr.exe35⤵
- Executes dropped EXE
PID:3340 -
\??\c:\hhntht.exec:\hhntht.exe36⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vvpjp.exec:\vvpjp.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rfrlfll.exec:\rfrlfll.exe38⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tnnbth.exec:\tnnbth.exe39⤵
- Executes dropped EXE
PID:3084 -
\??\c:\bnntbh.exec:\bnntbh.exe40⤵
- Executes dropped EXE
PID:4560 -
\??\c:\jdjjj.exec:\jdjjj.exe41⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe42⤵
- Executes dropped EXE
PID:4324 -
\??\c:\xfrfxff.exec:\xfrfxff.exe43⤵
- Executes dropped EXE
PID:3964 -
\??\c:\ttbbtb.exec:\ttbbtb.exe44⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vjjjv.exec:\vjjjv.exe45⤵
- Executes dropped EXE
PID:3640 -
\??\c:\vpvdp.exec:\vpvdp.exe46⤵
- Executes dropped EXE
PID:1932 -
\??\c:\3flrlrr.exec:\3flrlrr.exe47⤵
- Executes dropped EXE
PID:4024 -
\??\c:\hntttt.exec:\hntttt.exe48⤵
- Executes dropped EXE
PID:1276 -
\??\c:\htbbtb.exec:\htbbtb.exe49⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vvppd.exec:\vvppd.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jjppj.exec:\jjppj.exe51⤵
- Executes dropped EXE
PID:4440 -
\??\c:\lxlxxll.exec:\lxlxxll.exe52⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bthbnn.exec:\bthbnn.exe53⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bbhnnt.exec:\bbhnnt.exe54⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dpppj.exec:\dpppj.exe55⤵
- Executes dropped EXE
PID:3944 -
\??\c:\jjvjj.exec:\jjvjj.exe56⤵
- Executes dropped EXE
PID:5052 -
\??\c:\7lrxrrr.exec:\7lrxrrr.exe57⤵
- Executes dropped EXE
PID:556 -
\??\c:\bbtbbb.exec:\bbtbbb.exe58⤵
- Executes dropped EXE
PID:3576 -
\??\c:\ttbnbh.exec:\ttbnbh.exe59⤵
- Executes dropped EXE
PID:3524 -
\??\c:\jvppj.exec:\jvppj.exe60⤵
- Executes dropped EXE
PID:3052 -
\??\c:\7rfrrxx.exec:\7rfrrxx.exe61⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rfrrlrl.exec:\rfrrlrl.exe62⤵
- Executes dropped EXE
PID:3284 -
\??\c:\nbhbbh.exec:\nbhbbh.exe63⤵
- Executes dropped EXE
PID:8 -
\??\c:\vvppd.exec:\vvppd.exe64⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rrfffxr.exec:\rrfffxr.exe65⤵
- Executes dropped EXE
PID:4808 -
\??\c:\7btttt.exec:\7btttt.exe66⤵PID:3184
-
\??\c:\nhnhbn.exec:\nhnhbn.exe67⤵PID:3508
-
\??\c:\rfffrxf.exec:\rfffrxf.exe68⤵PID:5056
-
\??\c:\hhhntt.exec:\hhhntt.exe69⤵PID:3724
-
\??\c:\dvjjd.exec:\dvjjd.exe70⤵PID:2968
-
\??\c:\ffxfxrx.exec:\ffxfxrx.exe71⤵PID:4924
-
\??\c:\lflxlfl.exec:\lflxlfl.exe72⤵PID:5004
-
\??\c:\nbthbn.exec:\nbthbn.exe73⤵PID:3572
-
\??\c:\jpjvd.exec:\jpjvd.exe74⤵PID:1792
-
\??\c:\vjvvv.exec:\vjvvv.exe75⤵PID:1716
-
\??\c:\llffrxr.exec:\llffrxr.exe76⤵PID:1592
-
\??\c:\nhtbbb.exec:\nhtbbb.exe77⤵PID:3460
-
\??\c:\ntnnbb.exec:\ntnnbb.exe78⤵PID:3136
-
\??\c:\ppjpv.exec:\ppjpv.exe79⤵PID:4788
-
\??\c:\rrfxxff.exec:\rrfxxff.exe80⤵PID:3464
-
\??\c:\llxxxfr.exec:\llxxxfr.exe81⤵PID:416
-
\??\c:\tttttt.exec:\tttttt.exe82⤵PID:2444
-
\??\c:\vvvvv.exec:\vvvvv.exe83⤵PID:4836
-
\??\c:\ppvvv.exec:\ppvvv.exe84⤵PID:2708
-
\??\c:\fflfxrx.exec:\fflfxrx.exe85⤵PID:4644
-
\??\c:\bthhnn.exec:\bthhnn.exe86⤵PID:1976
-
\??\c:\nhbnhh.exec:\nhbnhh.exe87⤵PID:4684
-
\??\c:\djpdj.exec:\djpdj.exe88⤵PID:4036
-
\??\c:\3xxxxfx.exec:\3xxxxfx.exe89⤵PID:1204
-
\??\c:\bbhbbb.exec:\bbhbbb.exe90⤵PID:3996
-
\??\c:\ntbhnn.exec:\ntbhnn.exe91⤵PID:3488
-
\??\c:\pjvvd.exec:\pjvvd.exe92⤵PID:1920
-
\??\c:\3rffxff.exec:\3rffxff.exe93⤵PID:3096
-
\??\c:\llxlllx.exec:\llxlllx.exe94⤵PID:5092
-
\??\c:\thhhhh.exec:\thhhhh.exe95⤵PID:1804
-
\??\c:\1ttttt.exec:\1ttttt.exe96⤵PID:3692
-
\??\c:\vdddv.exec:\vdddv.exe97⤵PID:208
-
\??\c:\dvvvp.exec:\dvvvp.exe98⤵PID:3964
-
\??\c:\rrxflrf.exec:\rrxflrf.exe99⤵PID:3756
-
\??\c:\jjvvv.exec:\jjvvv.exe100⤵PID:2344
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe101⤵PID:1224
-
\??\c:\bthhbb.exec:\bthhbb.exe102⤵PID:1424
-
\??\c:\nbhhhh.exec:\nbhhhh.exe103⤵PID:816
-
\??\c:\pvddd.exec:\pvddd.exe104⤵PID:5012
-
\??\c:\vpvpp.exec:\vpvpp.exe105⤵PID:940
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe106⤵PID:2560
-
\??\c:\nhnhhh.exec:\nhnhhh.exe107⤵PID:548
-
\??\c:\tnhbnn.exec:\tnhbnn.exe108⤵PID:4888
-
\??\c:\jdjjv.exec:\jdjjv.exe109⤵PID:2516
-
\??\c:\rlrrxll.exec:\rlrrxll.exe110⤵PID:748
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe111⤵PID:5028
-
\??\c:\nbhtbh.exec:\nbhtbh.exe112⤵PID:3284
-
\??\c:\btbbtb.exec:\btbbtb.exe113⤵PID:5084
-
\??\c:\5dppp.exec:\5dppp.exe114⤵PID:2692
-
\??\c:\vdjjj.exec:\vdjjj.exe115⤵PID:3780
-
\??\c:\fffxrrl.exec:\fffxrrl.exe116⤵PID:664
-
\??\c:\thnhbn.exec:\thnhbn.exe117⤵PID:1708
-
\??\c:\pvpvj.exec:\pvpvj.exe118⤵PID:3116
-
\??\c:\9jppp.exec:\9jppp.exe119⤵PID:4760
-
\??\c:\rfrrlff.exec:\rfrrlff.exe120⤵PID:464
-
\??\c:\xrxrlxr.exec:\xrxrlxr.exe121⤵PID:1164
-
\??\c:\jdppj.exec:\jdppj.exe122⤵PID:3916
-
\??\c:\dpvpp.exec:\dpvpp.exe123⤵PID:1792
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe124⤵PID:1716
-
\??\c:\fxlfxlf.exec:\fxlfxlf.exe125⤵PID:1592
-
\??\c:\htbbbb.exec:\htbbbb.exe126⤵PID:1088
-
\??\c:\ppjjd.exec:\ppjjd.exe127⤵PID:3580
-
\??\c:\rllxrff.exec:\rllxrff.exe128⤵PID:2548
-
\??\c:\thhntb.exec:\thhntb.exe129⤵PID:4468
-
\??\c:\1vvpj.exec:\1vvpj.exe130⤵PID:2188
-
\??\c:\lxffxff.exec:\lxffxff.exe131⤵PID:2444
-
\??\c:\hnhnnt.exec:\hnhnnt.exe132⤵PID:1640
-
\??\c:\pvvpj.exec:\pvvpj.exe133⤵PID:2708
-
\??\c:\frxxxxx.exec:\frxxxxx.exe134⤵PID:4644
-
\??\c:\3dpjd.exec:\3dpjd.exe135⤵PID:3472
-
\??\c:\lrrrrrf.exec:\lrrrrrf.exe136⤵PID:5088
-
\??\c:\vvjpp.exec:\vvjpp.exe137⤵PID:544
-
\??\c:\llllxff.exec:\llllxff.exe138⤵PID:4396
-
\??\c:\3nnhbb.exec:\3nnhbb.exe139⤵PID:3980
-
\??\c:\hhnnhh.exec:\hhnnhh.exe140⤵PID:728
-
\??\c:\djjjv.exec:\djjjv.exe141⤵PID:4936
-
\??\c:\ppjdj.exec:\ppjdj.exe142⤵PID:1920
-
\??\c:\xxffrff.exec:\xxffrff.exe143⤵PID:3096
-
\??\c:\5xlfrrf.exec:\5xlfrrf.exe144⤵PID:5092
-
\??\c:\bbbbbb.exec:\bbbbbb.exe145⤵PID:4324
-
\??\c:\ttnnhh.exec:\ttnnhh.exe146⤵PID:1588
-
\??\c:\1ddpd.exec:\1ddpd.exe147⤵PID:4408
-
\??\c:\vppjd.exec:\vppjd.exe148⤵PID:2912
-
\??\c:\fllfxfr.exec:\fllfxfr.exe149⤵PID:1672
-
\??\c:\tnbhbn.exec:\tnbhbn.exe150⤵PID:1932
-
\??\c:\hbnhnn.exec:\hbnhnn.exe151⤵PID:4748
-
\??\c:\7pvvv.exec:\7pvvv.exe152⤵PID:2904
-
\??\c:\vdddj.exec:\vdddj.exe153⤵PID:3036
-
\??\c:\9xfrfrx.exec:\9xfrfrx.exe154⤵PID:4360
-
\??\c:\3lrrxfx.exec:\3lrrxfx.exe155⤵PID:380
-
\??\c:\btbbnt.exec:\btbbnt.exe156⤵PID:4912
-
\??\c:\bbhnhh.exec:\bbhnhh.exe157⤵PID:4476
-
\??\c:\jpjjj.exec:\jpjjj.exe158⤵PID:4256
-
\??\c:\1rxffll.exec:\1rxffll.exe159⤵PID:2004
-
\??\c:\fxlrrll.exec:\fxlrrll.exe160⤵PID:4268
-
\??\c:\7nnnnt.exec:\7nnnnt.exe161⤵PID:4260
-
\??\c:\nbntnt.exec:\nbntnt.exe162⤵PID:1372
-
\??\c:\dvddd.exec:\dvddd.exe163⤵PID:876
-
\??\c:\frxrrrl.exec:\frxrrrl.exe164⤵PID:2892
-
\??\c:\xfrxxxx.exec:\xfrxxxx.exe165⤵PID:1324
-
\??\c:\hbbbbt.exec:\hbbbbt.exe166⤵PID:3940
-
\??\c:\pvpvj.exec:\pvpvj.exe167⤵PID:3104
-
\??\c:\vvdvv.exec:\vvdvv.exe168⤵PID:2644
-
\??\c:\llffffl.exec:\llffffl.exe169⤵PID:3796
-
\??\c:\fflrrrf.exec:\fflrrrf.exe170⤵PID:4424
-
\??\c:\htbbbh.exec:\htbbbh.exe171⤵PID:4400
-
\??\c:\hbbbtt.exec:\hbbbtt.exe172⤵PID:3168
-
\??\c:\ddpdd.exec:\ddpdd.exe173⤵PID:4864
-
\??\c:\dvpjp.exec:\dvpjp.exe174⤵PID:5064
-
\??\c:\3fffxxx.exec:\3fffxxx.exe175⤵PID:732
-
\??\c:\rlllllr.exec:\rlllllr.exe176⤵PID:3984
-
\??\c:\1thnnt.exec:\1thnnt.exe177⤵PID:5044
-
\??\c:\nhnnnn.exec:\nhnnnn.exe178⤵PID:3464
-
\??\c:\tnttbb.exec:\tnttbb.exe179⤵PID:3216
-
\??\c:\pjjdd.exec:\pjjdd.exe180⤵PID:4652
-
\??\c:\dvvpj.exec:\dvvpj.exe181⤵PID:1896
-
\??\c:\1xfxxlr.exec:\1xfxxlr.exe182⤵PID:2400
-
\??\c:\bhnnbb.exec:\bhnnbb.exe183⤵PID:3520
-
\??\c:\nnbnht.exec:\nnbnht.exe184⤵PID:5088
-
\??\c:\dpdvp.exec:\dpdvp.exe185⤵PID:544
-
\??\c:\vdppd.exec:\vdppd.exe186⤵PID:2648
-
\??\c:\7fffxxr.exec:\7fffxxr.exe187⤵PID:1172
-
\??\c:\frxrllf.exec:\frxrllf.exe188⤵PID:2260
-
\??\c:\nnnnhh.exec:\nnnnhh.exe189⤵PID:4936
-
\??\c:\bhthbb.exec:\bhthbb.exe190⤵PID:5008
-
\??\c:\7pvvv.exec:\7pvvv.exe191⤵PID:1120
-
\??\c:\5vvvv.exec:\5vvvv.exe192⤵PID:3692
-
\??\c:\rxxxrlf.exec:\rxxxrlf.exe193⤵PID:4324
-
\??\c:\5xrffll.exec:\5xrffll.exe194⤵PID:1588
-
\??\c:\tnbnnb.exec:\tnbnnb.exe195⤵PID:400
-
\??\c:\pvvdj.exec:\pvvdj.exe196⤵PID:3756
-
\??\c:\jddpj.exec:\jddpj.exe197⤵PID:5104
-
\??\c:\lllrrxx.exec:\lllrrxx.exe198⤵PID:3836
-
\??\c:\tnnnbn.exec:\tnnnbn.exe199⤵PID:2768
-
\??\c:\nnbbhh.exec:\nnbbhh.exe200⤵PID:4868
-
\??\c:\1bhnth.exec:\1bhnth.exe201⤵PID:5096
-
\??\c:\1ppvp.exec:\1ppvp.exe202⤵PID:436
-
\??\c:\ffxrrlf.exec:\ffxrrlf.exe203⤵PID:548
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe204⤵PID:2108
-
\??\c:\ntbbbt.exec:\ntbbbt.exe205⤵PID:1756
-
\??\c:\btnhhb.exec:\btnhhb.exe206⤵PID:516
-
\??\c:\jvvjv.exec:\jvvjv.exe207⤵PID:3688
-
\??\c:\lfrrfff.exec:\lfrrfff.exe208⤵PID:3672
-
\??\c:\9fllfxl.exec:\9fllfxl.exe209⤵PID:2480
-
\??\c:\tntnbb.exec:\tntnbb.exe210⤵PID:4108
-
\??\c:\9nnhbb.exec:\9nnhbb.exe211⤵PID:4636
-
\??\c:\9ppjd.exec:\9ppjd.exe212⤵PID:3724
-
\??\c:\xfxrrff.exec:\xfxrrff.exe213⤵PID:3296
-
\??\c:\9xffffx.exec:\9xffffx.exe214⤵PID:4760
-
\??\c:\nbhhhh.exec:\nbhhhh.exe215⤵PID:4996
-
\??\c:\bththh.exec:\bththh.exe216⤵PID:1164
-
\??\c:\vpvvv.exec:\vpvvv.exe217⤵PID:3880
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe218⤵PID:3636
-
\??\c:\7fflxfr.exec:\7fflxfr.exe219⤵PID:3460
-
\??\c:\bbttnn.exec:\bbttnn.exe220⤵PID:1088
-
\??\c:\dvddd.exec:\dvddd.exe221⤵PID:5100
-
\??\c:\vvddp.exec:\vvddp.exe222⤵PID:1288
-
\??\c:\xxxrlrr.exec:\xxxrlrr.exe223⤵PID:3852
-
\??\c:\lffllll.exec:\lffllll.exe224⤵PID:2928
-
\??\c:\bhnhhn.exec:\bhnhhn.exe225⤵PID:3876
-
\??\c:\thtttt.exec:\thtttt.exe226⤵PID:3176
-
\??\c:\jvjpj.exec:\jvjpj.exe227⤵PID:4644
-
\??\c:\5ddvd.exec:\5ddvd.exe228⤵PID:2400
-
\??\c:\frxlflf.exec:\frxlflf.exe229⤵PID:3520
-
\??\c:\lxlxrxf.exec:\lxlxrxf.exe230⤵PID:4452
-
\??\c:\tnthnt.exec:\tnthnt.exe231⤵PID:544
-
\??\c:\ntbbtt.exec:\ntbbtt.exe232⤵PID:2648
-
\??\c:\jjjvj.exec:\jjjvj.exe233⤵PID:1172
-
\??\c:\llrxxff.exec:\llrxxff.exe234⤵PID:2260
-
\??\c:\flllxxl.exec:\flllxxl.exe235⤵PID:4936
-
\??\c:\bnbhhn.exec:\bnbhhn.exe236⤵PID:5008
-
\??\c:\hnhtnn.exec:\hnhtnn.exe237⤵PID:208
-
\??\c:\vppjd.exec:\vppjd.exe238⤵PID:32
-
\??\c:\lfrrlxr.exec:\lfrrlxr.exe239⤵PID:2008
-
\??\c:\lllrrxf.exec:\lllrrxf.exe240⤵PID:1832
-
\??\c:\9bhtbb.exec:\9bhtbb.exe241⤵PID:3756
-