Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:43
Behavioral task
behavioral1
Sample
94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe
-
Size
455KB
-
MD5
94b9e9268a0eec746e9359e10b027c30
-
SHA1
36c8053a4ed5803d6aa7c30505181083bd571673
-
SHA256
1ca56d7536a4aa32a0ab5e93cbaca60dd37ae922e17e992ea0eb94c9b8c8ade7
-
SHA512
b12288d6bd872eaae520ef4763ae42dec1e5e96af9ed9b536bbfa6dd75a628c2a296e435688cdd1ffe87dbfb30ae1d575c2cfa44e6a5601d70ad39bb43791cdc
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nPYERAAUDCa4NYmF:HFp3lz1XUDCaGYmF
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4356-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1712-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/472-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/952-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1028-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3816-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/792-756-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-812-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-886-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-1031-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-1088-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ddjpv.exefrfxrrl.exefrrlfxr.exethbtnh.exepvvdv.exevjdvp.exerrrfxfx.exehnnbtn.exenntnnh.exevdpdp.exerrxlrlf.exelrxlxrl.exenttnht.exejdvpp.exerfrllfr.exerllfxrl.exe3tnhbb.exenntntn.exejjjvv.exexfxlxrl.exerflxrrl.exebhtnhn.exe7dpdd.exedpjpj.exelfrlllf.exebtttnn.exetntnnh.exeddddp.exevjvvp.exelxrlxrf.exebnnhbb.exetntnhb.exejvjdp.exexflfxxx.exelrfrllf.exebnnthh.exevdjjv.exepjpjp.exe9rlxrxr.exenhbtnh.exenbbnbt.exepdpdd.exefxxrfxr.exebthtbt.exehttntt.exedvvvp.exerrrxxlr.exelfrlfxr.exethnbhh.exejpdjj.exejpppj.exe3xxrrrl.exehbhhtn.exehhtnnn.exedjvpj.exedppdv.exexrlxrrl.exentnhbb.exe5thbtn.exepjjvv.exe9flxrlf.exexflxrrl.exebbbttn.exebhhbbt.exepid process 4332 ddjpv.exe 952 frfxrrl.exe 2832 frrlfxr.exe 220 thbtnh.exe 2232 pvvdv.exe 1992 vjdvp.exe 4064 rrrfxfx.exe 472 hnnbtn.exe 1176 nntnnh.exe 2016 vdpdp.exe 4472 rrxlrlf.exe 2300 lrxlxrl.exe 1344 nttnht.exe 4504 jdvpp.exe 3624 rfrllfr.exe 1472 rllfxrl.exe 2400 3tnhbb.exe 1688 nntntn.exe 2084 jjjvv.exe 832 xfxlxrl.exe 3148 rflxrrl.exe 3668 bhtnhn.exe 2808 7dpdd.exe 1480 dpjpj.exe 556 lfrlllf.exe 2316 btttnn.exe 1120 tntnnh.exe 452 ddddp.exe 1648 vjvvp.exe 4552 lxrlxrf.exe 2032 bnnhbb.exe 4208 tntnhb.exe 2180 jvjdp.exe 2876 xflfxxx.exe 3456 lrfrllf.exe 1996 bnnthh.exe 552 vdjjv.exe 3992 pjpjp.exe 1652 9rlxrxr.exe 3504 nhbtnh.exe 1952 nbbnbt.exe 2724 pdpdd.exe 2100 fxxrfxr.exe 1932 bthtbt.exe 5060 httntt.exe 2796 dvvvp.exe 4380 rrrxxlr.exe 4616 lfrlfxr.exe 4476 thnbhh.exe 1816 jpdjj.exe 2924 jpppj.exe 4856 3xxrrrl.exe 4440 hbhhtn.exe 2800 hhtnnn.exe 3496 djvpj.exe 860 dppdv.exe 2472 xrlxrrl.exe 2812 ntnhbb.exe 1604 5thbtn.exe 3512 pjjvv.exe 1712 9flxrlf.exe 3912 xflxrrl.exe 2408 bbbttn.exe 4724 bhhbbt.exe -
Processes:
resource yara_rule C:\ddjpv.exe upx behavioral2/memory/4356-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4332-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frfxrrl.exe upx behavioral2/memory/2832-18-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\thbtnh.exe upx behavioral2/memory/220-23-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvvdv.exe upx behavioral2/memory/2232-28-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hnnbtn.exe upx C:\nntnnh.exe upx C:\vdpdp.exe upx \??\c:\rrxlrlf.exe upx \??\c:\rllfxrl.exe upx \??\c:\nntntn.exe upx \??\c:\xfxlxrl.exe upx behavioral2/memory/2808-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2032-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3992-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4440-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2408-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1712-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1604-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/860-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2924-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2796-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1932-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1952-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1652-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/552-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1996-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3456-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2876-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2180-192-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tntnhb.exe upx behavioral2/memory/4552-180-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bnnhbb.exe upx behavioral2/memory/1648-173-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxrlxrf.exe upx behavioral2/memory/452-168-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjvvp.exe upx behavioral2/memory/4960-320-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddddp.exe upx \??\c:\tntnnh.exe upx \??\c:\btttnn.exe upx behavioral2/memory/1480-147-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfrlllf.exe upx \??\c:\dpjpj.exe upx \??\c:\7dpdd.exe upx behavioral2/memory/3148-130-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhtnhn.exe upx \??\c:\rflxrrl.exe upx behavioral2/memory/1688-117-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjjvv.exe upx behavioral2/memory/2400-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1472-102-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3tnhbb.exe upx behavioral2/memory/4504-91-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rfrllfr.exe upx behavioral2/memory/1344-85-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdvpp.exe upx behavioral2/memory/2300-79-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nttnht.exe upx behavioral2/memory/4472-73-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exeddjpv.exefrfxrrl.exefrrlfxr.exethbtnh.exepvvdv.exevjdvp.exerrrfxfx.exehnnbtn.exenntnnh.exevdpdp.exerrxlrlf.exelrxlxrl.exenttnht.exejdvpp.exerfrllfr.exerllfxrl.exe3tnhbb.exenntntn.exejjjvv.exexfxlxrl.exerflxrrl.exedescription pid process target process PID 4356 wrote to memory of 4332 4356 94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe ddjpv.exe PID 4356 wrote to memory of 4332 4356 94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe ddjpv.exe PID 4356 wrote to memory of 4332 4356 94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe ddjpv.exe PID 4332 wrote to memory of 952 4332 ddjpv.exe frfxrrl.exe PID 4332 wrote to memory of 952 4332 ddjpv.exe frfxrrl.exe PID 4332 wrote to memory of 952 4332 ddjpv.exe frfxrrl.exe PID 952 wrote to memory of 2832 952 frfxrrl.exe frrlfxr.exe PID 952 wrote to memory of 2832 952 frfxrrl.exe frrlfxr.exe PID 952 wrote to memory of 2832 952 frfxrrl.exe frrlfxr.exe PID 2832 wrote to memory of 220 2832 frrlfxr.exe thbtnh.exe PID 2832 wrote to memory of 220 2832 frrlfxr.exe thbtnh.exe PID 2832 wrote to memory of 220 2832 frrlfxr.exe thbtnh.exe PID 220 wrote to memory of 2232 220 thbtnh.exe pvvdv.exe PID 220 wrote to memory of 2232 220 thbtnh.exe pvvdv.exe PID 220 wrote to memory of 2232 220 thbtnh.exe pvvdv.exe PID 2232 wrote to memory of 1992 2232 pvvdv.exe vjdvp.exe PID 2232 wrote to memory of 1992 2232 pvvdv.exe vjdvp.exe PID 2232 wrote to memory of 1992 2232 pvvdv.exe vjdvp.exe PID 1992 wrote to memory of 4064 1992 vjdvp.exe rrrfxfx.exe PID 1992 wrote to memory of 4064 1992 vjdvp.exe rrrfxfx.exe PID 1992 wrote to memory of 4064 1992 vjdvp.exe rrrfxfx.exe PID 4064 wrote to memory of 472 4064 rrrfxfx.exe hnnbtn.exe PID 4064 wrote to memory of 472 4064 rrrfxfx.exe hnnbtn.exe PID 4064 wrote to memory of 472 4064 rrrfxfx.exe hnnbtn.exe PID 472 wrote to memory of 1176 472 hnnbtn.exe nntnnh.exe PID 472 wrote to memory of 1176 472 hnnbtn.exe nntnnh.exe PID 472 wrote to memory of 1176 472 hnnbtn.exe nntnnh.exe PID 1176 wrote to memory of 2016 1176 nntnnh.exe vdpdp.exe PID 1176 wrote to memory of 2016 1176 nntnnh.exe vdpdp.exe PID 1176 wrote to memory of 2016 1176 nntnnh.exe vdpdp.exe PID 2016 wrote to memory of 4472 2016 vdpdp.exe rrxlrlf.exe PID 2016 wrote to memory of 4472 2016 vdpdp.exe rrxlrlf.exe PID 2016 wrote to memory of 4472 2016 vdpdp.exe rrxlrlf.exe PID 4472 wrote to memory of 2300 4472 rrxlrlf.exe lrxlxrl.exe PID 4472 wrote to memory of 2300 4472 rrxlrlf.exe lrxlxrl.exe PID 4472 wrote to memory of 2300 4472 rrxlrlf.exe lrxlxrl.exe PID 2300 wrote to memory of 1344 2300 lrxlxrl.exe nttnht.exe PID 2300 wrote to memory of 1344 2300 lrxlxrl.exe nttnht.exe PID 2300 wrote to memory of 1344 2300 lrxlxrl.exe nttnht.exe PID 1344 wrote to memory of 4504 1344 nttnht.exe jdvpp.exe PID 1344 wrote to memory of 4504 1344 nttnht.exe jdvpp.exe PID 1344 wrote to memory of 4504 1344 nttnht.exe jdvpp.exe PID 4504 wrote to memory of 3624 4504 jdvpp.exe rfrllfr.exe PID 4504 wrote to memory of 3624 4504 jdvpp.exe rfrllfr.exe PID 4504 wrote to memory of 3624 4504 jdvpp.exe rfrllfr.exe PID 3624 wrote to memory of 1472 3624 rfrllfr.exe rllfxrl.exe PID 3624 wrote to memory of 1472 3624 rfrllfr.exe rllfxrl.exe PID 3624 wrote to memory of 1472 3624 rfrllfr.exe rllfxrl.exe PID 1472 wrote to memory of 2400 1472 rllfxrl.exe 3tnhbb.exe PID 1472 wrote to memory of 2400 1472 rllfxrl.exe 3tnhbb.exe PID 1472 wrote to memory of 2400 1472 rllfxrl.exe 3tnhbb.exe PID 2400 wrote to memory of 1688 2400 3tnhbb.exe nntntn.exe PID 2400 wrote to memory of 1688 2400 3tnhbb.exe nntntn.exe PID 2400 wrote to memory of 1688 2400 3tnhbb.exe nntntn.exe PID 1688 wrote to memory of 2084 1688 nntntn.exe jjjvv.exe PID 1688 wrote to memory of 2084 1688 nntntn.exe jjjvv.exe PID 1688 wrote to memory of 2084 1688 nntntn.exe jjjvv.exe PID 2084 wrote to memory of 832 2084 jjjvv.exe xfxlxrl.exe PID 2084 wrote to memory of 832 2084 jjjvv.exe xfxlxrl.exe PID 2084 wrote to memory of 832 2084 jjjvv.exe xfxlxrl.exe PID 832 wrote to memory of 3148 832 xfxlxrl.exe rflxrrl.exe PID 832 wrote to memory of 3148 832 xfxlxrl.exe rflxrrl.exe PID 832 wrote to memory of 3148 832 xfxlxrl.exe rflxrrl.exe PID 3148 wrote to memory of 3668 3148 rflxrrl.exe bhtnhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\ddjpv.exec:\ddjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\frfxrrl.exec:\frfxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\frrlfxr.exec:\frrlfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\thbtnh.exec:\thbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\pvvdv.exec:\pvvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\vjdvp.exec:\vjdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\rrrfxfx.exec:\rrrfxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\hnnbtn.exec:\hnnbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\nntnnh.exec:\nntnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\vdpdp.exec:\vdpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\rrxlrlf.exec:\rrxlrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\lrxlxrl.exec:\lrxlxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\nttnht.exec:\nttnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\jdvpp.exec:\jdvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\rfrllfr.exec:\rfrllfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\rllfxrl.exec:\rllfxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\3tnhbb.exec:\3tnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\nntntn.exec:\nntntn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\jjjvv.exec:\jjjvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\xfxlxrl.exec:\xfxlxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\rflxrrl.exec:\rflxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\bhtnhn.exec:\bhtnhn.exe23⤵
- Executes dropped EXE
PID:3668 -
\??\c:\7dpdd.exec:\7dpdd.exe24⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dpjpj.exec:\dpjpj.exe25⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lfrlllf.exec:\lfrlllf.exe26⤵
- Executes dropped EXE
PID:556 -
\??\c:\btttnn.exec:\btttnn.exe27⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tntnnh.exec:\tntnnh.exe28⤵
- Executes dropped EXE
PID:1120 -
\??\c:\ddddp.exec:\ddddp.exe29⤵
- Executes dropped EXE
PID:452 -
\??\c:\vjvvp.exec:\vjvvp.exe30⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lxrlxrf.exec:\lxrlxrf.exe31⤵
- Executes dropped EXE
PID:4552 -
\??\c:\bnnhbb.exec:\bnnhbb.exe32⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tntnhb.exec:\tntnhb.exe33⤵
- Executes dropped EXE
PID:4208 -
\??\c:\jvjdp.exec:\jvjdp.exe34⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xflfxxx.exec:\xflfxxx.exe35⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lrfrllf.exec:\lrfrllf.exe36⤵
- Executes dropped EXE
PID:3456 -
\??\c:\bnnthh.exec:\bnnthh.exe37⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vdjjv.exec:\vdjjv.exe38⤵
- Executes dropped EXE
PID:552 -
\??\c:\pjpjp.exec:\pjpjp.exe39⤵
- Executes dropped EXE
PID:3992 -
\??\c:\9rlxrxr.exec:\9rlxrxr.exe40⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nhbtnh.exec:\nhbtnh.exe41⤵
- Executes dropped EXE
PID:3504 -
\??\c:\nbbnbt.exec:\nbbnbt.exe42⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pdpdd.exec:\pdpdd.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxxrfxr.exec:\fxxrfxr.exe44⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bthtbt.exec:\bthtbt.exe45⤵
- Executes dropped EXE
PID:1932 -
\??\c:\httntt.exec:\httntt.exe46⤵
- Executes dropped EXE
PID:5060 -
\??\c:\dvvvp.exec:\dvvvp.exe47⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rrrxxlr.exec:\rrrxxlr.exe48⤵
- Executes dropped EXE
PID:4380 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe49⤵
- Executes dropped EXE
PID:4616 -
\??\c:\thnbhh.exec:\thnbhh.exe50⤵
- Executes dropped EXE
PID:4476 -
\??\c:\jpdjj.exec:\jpdjj.exe51⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jpppj.exec:\jpppj.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\3xxrrrl.exec:\3xxrrrl.exe53⤵
- Executes dropped EXE
PID:4856 -
\??\c:\hbhhtn.exec:\hbhhtn.exe54⤵
- Executes dropped EXE
PID:4440 -
\??\c:\hhtnnn.exec:\hhtnnn.exe55⤵
- Executes dropped EXE
PID:2800 -
\??\c:\djvpj.exec:\djvpj.exe56⤵
- Executes dropped EXE
PID:3496 -
\??\c:\dppdv.exec:\dppdv.exe57⤵
- Executes dropped EXE
PID:860 -
\??\c:\xrlxrrl.exec:\xrlxrrl.exe58⤵
- Executes dropped EXE
PID:2472 -
\??\c:\ntnhbb.exec:\ntnhbb.exe59⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5thbtn.exec:\5thbtn.exe60⤵
- Executes dropped EXE
PID:1604 -
\??\c:\pjjvv.exec:\pjjvv.exe61⤵
- Executes dropped EXE
PID:3512 -
\??\c:\9flxrlf.exec:\9flxrlf.exe62⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xflxrrl.exec:\xflxrrl.exe63⤵
- Executes dropped EXE
PID:3912 -
\??\c:\bbbttn.exec:\bbbttn.exe64⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bhhbbt.exec:\bhhbbt.exe65⤵
- Executes dropped EXE
PID:4724 -
\??\c:\dvdvp.exec:\dvdvp.exe66⤵PID:3200
-
\??\c:\xffxrlf.exec:\xffxrlf.exe67⤵PID:4564
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe68⤵PID:4900
-
\??\c:\bnhbtn.exec:\bnhbtn.exe69⤵PID:4948
-
\??\c:\tbhbtn.exec:\tbhbtn.exe70⤵PID:3568
-
\??\c:\jvjdv.exec:\jvjdv.exe71⤵PID:4832
-
\??\c:\7lxrllf.exec:\7lxrllf.exe72⤵PID:4960
-
\??\c:\bnhbtn.exec:\bnhbtn.exe73⤵PID:4432
-
\??\c:\nnbtnn.exec:\nnbtnn.exe74⤵PID:3744
-
\??\c:\pjdvp.exec:\pjdvp.exe75⤵PID:4852
-
\??\c:\rlfxllx.exec:\rlfxllx.exe76⤵PID:3052
-
\??\c:\ntnnhb.exec:\ntnnhb.exe77⤵PID:404
-
\??\c:\bthbtn.exec:\bthbtn.exe78⤵PID:1592
-
\??\c:\dvjdp.exec:\dvjdp.exe79⤵PID:4464
-
\??\c:\3rlfxrl.exec:\3rlfxrl.exe80⤵PID:2504
-
\??\c:\nhnbtt.exec:\nhnbtt.exe81⤵PID:4628
-
\??\c:\nthbtt.exec:\nthbtt.exe82⤵PID:944
-
\??\c:\pjpjd.exec:\pjpjd.exe83⤵PID:5084
-
\??\c:\lffxrrx.exec:\lffxrrx.exe84⤵PID:3736
-
\??\c:\vppjd.exec:\vppjd.exe85⤵PID:2876
-
\??\c:\jpvpv.exec:\jpvpv.exe86⤵PID:4056
-
\??\c:\fflfxxr.exec:\fflfxxr.exe87⤵PID:2756
-
\??\c:\hntnbb.exec:\hntnbb.exe88⤵PID:1028
-
\??\c:\jjjdj.exec:\jjjdj.exe89⤵PID:3032
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe90⤵PID:60
-
\??\c:\hhnbtn.exec:\hhnbtn.exe91⤵PID:612
-
\??\c:\5vvvd.exec:\5vvvd.exe92⤵PID:4176
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe93⤵PID:3976
-
\??\c:\bnnhtt.exec:\bnnhtt.exe94⤵PID:1932
-
\??\c:\dppdv.exec:\dppdv.exe95⤵PID:3192
-
\??\c:\1ppjj.exec:\1ppjj.exe96⤵PID:2424
-
\??\c:\9lfrllf.exec:\9lfrllf.exe97⤵PID:1844
-
\??\c:\hnnhtn.exec:\hnnhtn.exe98⤵PID:2248
-
\??\c:\vjjdp.exec:\vjjdp.exe99⤵PID:1572
-
\??\c:\vppdv.exec:\vppdv.exe100⤵PID:4524
-
\??\c:\thbtnh.exec:\thbtnh.exe101⤵PID:1364
-
\??\c:\5vvpp.exec:\5vvpp.exe102⤵PID:4320
-
\??\c:\3rfxfff.exec:\3rfxfff.exe103⤵PID:2240
-
\??\c:\9llfrlr.exec:\9llfrlr.exe104⤵PID:1692
-
\??\c:\hhtnhn.exec:\hhtnhn.exe105⤵PID:3232
-
\??\c:\pdjjp.exec:\pdjjp.exe106⤵PID:1848
-
\??\c:\rrxxrrl.exec:\rrxxrrl.exe107⤵PID:220
-
\??\c:\9lflxfx.exec:\9lflxfx.exe108⤵PID:2088
-
\??\c:\1tnhbt.exec:\1tnhbt.exe109⤵PID:456
-
\??\c:\jpdvj.exec:\jpdvj.exe110⤵PID:3816
-
\??\c:\xflfrrl.exec:\xflfrrl.exe111⤵PID:752
-
\??\c:\lxrrlfx.exec:\lxrrlfx.exe112⤵PID:3712
-
\??\c:\thbnbt.exec:\thbnbt.exe113⤵PID:3068
-
\??\c:\vpjdv.exec:\vpjdv.exe114⤵PID:4876
-
\??\c:\lxxlxrr.exec:\lxxlxrr.exe115⤵PID:2300
-
\??\c:\fffxllf.exec:\fffxllf.exe116⤵PID:996
-
\??\c:\3nnntt.exec:\3nnntt.exe117⤵PID:2632
-
\??\c:\hbbthb.exec:\hbbthb.exe118⤵PID:4316
-
\??\c:\5ddvj.exec:\5ddvj.exe119⤵PID:5088
-
\??\c:\xxfxxll.exec:\xxfxxll.exe120⤵PID:3568
-
\??\c:\htbhbb.exec:\htbhbb.exe121⤵PID:2232
-
\??\c:\tthbbh.exec:\tthbbh.exe122⤵PID:3220
-
\??\c:\pdpjd.exec:\pdpjd.exe123⤵PID:516
-
\??\c:\ffxlfxr.exec:\ffxlfxr.exe124⤵PID:4960
-
\??\c:\btbbtb.exec:\btbbtb.exe125⤵PID:4432
-
\??\c:\pjdvd.exec:\pjdvd.exe126⤵PID:4904
-
\??\c:\dvpdv.exec:\dvpdv.exe127⤵PID:3572
-
\??\c:\nbtnbt.exec:\nbtnbt.exe128⤵PID:1448
-
\??\c:\ntttth.exec:\ntttth.exe129⤵PID:932
-
\??\c:\jjvpv.exec:\jjvpv.exe130⤵PID:3956
-
\??\c:\9lllllf.exec:\9lllllf.exe131⤵PID:3368
-
\??\c:\lxlrrlf.exec:\lxlrrlf.exe132⤵PID:2504
-
\??\c:\bbtbtt.exec:\bbtbtt.exe133⤵PID:3984
-
\??\c:\dppdv.exec:\dppdv.exe134⤵PID:2180
-
\??\c:\7jjdp.exec:\7jjdp.exe135⤵PID:4872
-
\??\c:\rfllxrf.exec:\rfllxrf.exe136⤵PID:4276
-
\??\c:\bnhbbb.exec:\bnhbbb.exe137⤵PID:4056
-
\??\c:\nhhhnb.exec:\nhhhnb.exe138⤵PID:1960
-
\??\c:\vppjd.exec:\vppjd.exe139⤵PID:1004
-
\??\c:\frlfllr.exec:\frlfllr.exe140⤵PID:2852
-
\??\c:\tnnnbb.exec:\tnnnbb.exe141⤵PID:4596
-
\??\c:\dpvpj.exec:\dpvpj.exe142⤵PID:408
-
\??\c:\pppjd.exec:\pppjd.exe143⤵PID:2168
-
\??\c:\hhtbbt.exec:\hhtbbt.exe144⤵PID:564
-
\??\c:\nbtnbb.exec:\nbtnbb.exe145⤵PID:2280
-
\??\c:\vdpjd.exec:\vdpjd.exe146⤵PID:744
-
\??\c:\7flfrlf.exec:\7flfrlf.exe147⤵PID:2364
-
\??\c:\bhnnbb.exec:\bhnnbb.exe148⤵PID:2424
-
\??\c:\3vvjd.exec:\3vvjd.exe149⤵PID:1596
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe150⤵PID:3432
-
\??\c:\tbhttn.exec:\tbhttn.exe151⤵PID:1572
-
\??\c:\1nbnbb.exec:\1nbnbb.exe152⤵PID:2544
-
\??\c:\dpdvj.exec:\dpdvj.exe153⤵PID:1588
-
\??\c:\rlfrrrr.exec:\rlfrrrr.exe154⤵PID:4580
-
\??\c:\9nhbnn.exec:\9nhbnn.exe155⤵PID:860
-
\??\c:\pvvdd.exec:\pvvdd.exe156⤵PID:3904
-
\??\c:\xxfllrr.exec:\xxfllrr.exe157⤵PID:3840
-
\??\c:\bthbhh.exec:\bthbhh.exe158⤵PID:3500
-
\??\c:\nnttnh.exec:\nnttnh.exe159⤵PID:3948
-
\??\c:\9dddp.exec:\9dddp.exe160⤵PID:4304
-
\??\c:\5xlffff.exec:\5xlffff.exe161⤵PID:1168
-
\??\c:\9rfxlfx.exec:\9rfxlfx.exe162⤵PID:3200
-
\??\c:\ntthbt.exec:\ntthbt.exe163⤵PID:560
-
\??\c:\vpjdp.exec:\vpjdp.exe164⤵PID:4472
-
\??\c:\lxfffxr.exec:\lxfffxr.exe165⤵PID:4824
-
\??\c:\xrxlffx.exec:\xrxlffx.exe166⤵PID:1724
-
\??\c:\9hntbt.exec:\9hntbt.exe167⤵PID:4332
-
\??\c:\dpdvp.exec:\dpdvp.exe168⤵PID:2632
-
\??\c:\rlrlllf.exec:\rlrlllf.exe169⤵PID:4900
-
\??\c:\1thhhh.exec:\1thhhh.exe170⤵PID:4740
-
\??\c:\hhnhbb.exec:\hhnhbb.exe171⤵PID:3644
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe172⤵PID:4120
-
\??\c:\hntnhb.exec:\hntnhb.exe173⤵PID:3384
-
\??\c:\9pdvv.exec:\9pdvv.exe174⤵PID:3612
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe175⤵PID:1556
-
\??\c:\xlllfxl.exec:\xlllfxl.exe176⤵PID:4660
-
\??\c:\jdjdp.exec:\jdjdp.exe177⤵PID:1672
-
\??\c:\vjjdv.exec:\vjjdv.exe178⤵PID:5064
-
\??\c:\httnhh.exec:\httnhh.exe179⤵PID:1704
-
\??\c:\hbhttn.exec:\hbhttn.exe180⤵PID:2316
-
\??\c:\5fxrlfx.exec:\5fxrlfx.exe181⤵PID:4400
-
\??\c:\bhhttn.exec:\bhhttn.exe182⤵PID:3368
-
\??\c:\pppdv.exec:\pppdv.exe183⤵PID:5084
-
\??\c:\1vdvp.exec:\1vdvp.exe184⤵PID:5032
-
\??\c:\1rxlfxx.exec:\1rxlfxx.exe185⤵PID:4872
-
\??\c:\htthbt.exec:\htthbt.exe186⤵PID:4668
-
\??\c:\djpdv.exec:\djpdv.exe187⤵PID:4764
-
\??\c:\vvddd.exec:\vvddd.exe188⤵PID:2784
-
\??\c:\rlfxrll.exec:\rlfxrll.exe189⤵PID:2948
-
\??\c:\bthnhh.exec:\bthnhh.exe190⤵PID:2436
-
\??\c:\dddpd.exec:\dddpd.exe191⤵PID:2676
-
\??\c:\vjdvj.exec:\vjdvj.exe192⤵PID:4924
-
\??\c:\fffxlfx.exec:\fffxlfx.exe193⤵PID:2656
-
\??\c:\btnhtb.exec:\btnhtb.exe194⤵PID:2628
-
\??\c:\ntbbnh.exec:\ntbbnh.exe195⤵PID:948
-
\??\c:\pjdvp.exec:\pjdvp.exe196⤵PID:3432
-
\??\c:\flxxxxr.exec:\flxxxxr.exe197⤵PID:2132
-
\??\c:\rlrlxrl.exec:\rlrlxrl.exe198⤵PID:4320
-
\??\c:\thhthb.exec:\thhthb.exe199⤵PID:3380
-
\??\c:\5jjdp.exec:\5jjdp.exe200⤵PID:2240
-
\??\c:\xlrxrrr.exec:\xlrxrrr.exe201⤵PID:3928
-
\??\c:\pdvpd.exec:\pdvpd.exe202⤵PID:748
-
\??\c:\rrrfxrf.exec:\rrrfxrf.exe203⤵PID:4484
-
\??\c:\hhbbtt.exec:\hhbbtt.exe204⤵PID:2408
-
\??\c:\bbbtbt.exec:\bbbtbt.exe205⤵PID:3812
-
\??\c:\jpvpj.exec:\jpvpj.exe206⤵PID:3652
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe207⤵PID:1752
-
\??\c:\3hbttt.exec:\3hbttt.exe208⤵PID:792
-
\??\c:\vdjvv.exec:\vdjvv.exe209⤵PID:4040
-
\??\c:\lrxllxx.exec:\lrxllxx.exe210⤵PID:636
-
\??\c:\thnnbt.exec:\thnnbt.exe211⤵PID:3624
-
\??\c:\lrxlfxl.exec:\lrxlfxl.exe212⤵PID:3496
-
\??\c:\5bnhtt.exec:\5bnhtt.exe213⤵PID:212
-
\??\c:\1rrlxxl.exec:\1rrlxxl.exe214⤵PID:2632
-
\??\c:\fllfxrl.exec:\fllfxrl.exe215⤵PID:3920
-
\??\c:\thhbbt.exec:\thhbbt.exe216⤵PID:2320
-
\??\c:\1fxrfxr.exec:\1fxrfxr.exe217⤵PID:472
-
\??\c:\nnhtnt.exec:\nnhtnt.exe218⤵PID:4172
-
\??\c:\pvdpj.exec:\pvdpj.exe219⤵PID:516
-
\??\c:\fxxlxxr.exec:\fxxlxxr.exe220⤵PID:4432
-
\??\c:\1llxxrl.exec:\1llxxrl.exe221⤵PID:468
-
\??\c:\bhhbnn.exec:\bhhbnn.exe222⤵PID:4600
-
\??\c:\pjjdv.exec:\pjjdv.exe223⤵PID:1480
-
\??\c:\vjpjj.exec:\vjpjj.exe224⤵PID:4272
-
\??\c:\3rrlxrl.exec:\3rrlxrl.exe225⤵PID:1284
-
\??\c:\nbnhbb.exec:\nbnhbb.exe226⤵PID:3956
-
\??\c:\3nntht.exec:\3nntht.exe227⤵PID:4732
-
\??\c:\rrxlfxr.exec:\rrxlfxr.exe228⤵PID:4308
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe229⤵PID:1304
-
\??\c:\nnbtnn.exec:\nnbtnn.exe230⤵PID:4212
-
\??\c:\vppjj.exec:\vppjj.exe231⤵PID:968
-
\??\c:\frlfxxr.exec:\frlfxxr.exe232⤵PID:2864
-
\??\c:\fffxrrl.exec:\fffxrrl.exe233⤵PID:4336
-
\??\c:\nbbtnh.exec:\nbbtnh.exe234⤵PID:1240
-
\??\c:\pvvvd.exec:\pvvvd.exe235⤵PID:4232
-
\??\c:\xlrllll.exec:\xlrllll.exe236⤵PID:2304
-
\??\c:\xffrlfx.exec:\xffrlfx.exe237⤵PID:2364
-
\??\c:\bthbth.exec:\bthbth.exe238⤵PID:4916
-
\??\c:\vpvpv.exec:\vpvpv.exe239⤵PID:948
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe240⤵PID:2832
-
\??\c:\7nhtht.exec:\7nhtht.exe241⤵PID:4772
-
\??\c:\tnbnhh.exec:\tnbnhh.exe242⤵PID:3900