Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe
-
Size
286KB
-
MD5
d5a445f47c5188c1d2757cf4538d1c60
-
SHA1
3611d54e5162938ebbfe00d18daced18fbd47d88
-
SHA256
2e93cdf3fd341c06be696ffcc16f75f7bc15b8edc7d0d50b350afe4a514667c4
-
SHA512
aa555c931143bf7c1dec3e34cd82a8680f6e7c0b04f5a583c28aca8b00a2d8e26a287c8fef17808b784ff0a91fdce5e261bde9ee701156b8142082e3cd0cabf5
-
SSDEEP
3072:ThOm2sI93UufdC67cipfmCiiiXAQ5lpBoGYwNNhu0CzhKP6:Tcm7ImGddXlWrXF5lpKGYV0wh66
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
Processes:
resource yara_rule behavioral2/memory/3256-6-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4572-8-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1188-19-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4568-21-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3540-31-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/992-37-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2276-45-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1540-50-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1412-57-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2636-63-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4592-71-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/6084-77-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/916-87-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/6068-97-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1996-100-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4676-109-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3832-112-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3732-118-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1848-134-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5316-160-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5660-168-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5504-166-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3528-183-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2360-192-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2800-199-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1360-206-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3288-207-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3288-211-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5960-218-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1432-228-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4980-232-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4348-237-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4728-246-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2632-256-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3304-260-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5744-261-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1284-266-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3764-271-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2224-279-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2260-280-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/956-290-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3680-294-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3016-301-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5224-308-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/408-321-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/852-336-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5112-348-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4536-373-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5964-377-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4376-382-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4104-428-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5196-432-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4584-499-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2216-515-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1016-537-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2496-548-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5628-567-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3756-590-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5032-606-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1992-630-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2092-769-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4532-831-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxxxrrr.exexxffxff.exebbhhtb.exe9vjdv.exedjpvd.exe1ntbtt.exe3dvvd.exexfrfffl.exejvjdd.exerffllll.exe1nnhbb.exedpddp.exellfxxll.exenbhbbh.exe3dpjd.exe7xfxrff.exehnhttt.exejjjjp.exexlrrllr.exellfffrl.exehhhhbh.exe3pvvv.exelfllfff.exetnhhbh.exe7ntnnn.exefrrlfff.exefxrlxfx.exejdpjd.exevvjdp.exetbbtht.exevjpdv.exelllxrxf.exe7btbhb.exedpddv.exexxfrxfl.exefrfrxlx.exehnnthb.exedjjvj.exexlfrlff.exebnnnnh.exe5jdpj.exe1rxrllf.exerlxlxfx.exe9bnttb.exejddvp.exerxxxrxx.exe5rfrlfx.exetnnnnn.exe5jpvv.exejddpj.exerlfxlxr.exenhhhhn.exe9vdpj.exedppjd.exerllffrr.exehbnnhh.exejppvj.exepjjvj.exellffrrf.exetnbbnh.exenhthtb.exeppvjj.exe9frfrll.exetnhnbh.exepid process 4572 xxxxrrr.exe 4568 xxffxff.exe 1188 bbhhtb.exe 3540 9vjdv.exe 992 djpvd.exe 2276 1ntbtt.exe 1540 3dvvd.exe 1412 xfrfffl.exe 2636 jvjdd.exe 5736 rffllll.exe 4592 1nnhbb.exe 6084 dpddp.exe 1348 llfxxll.exe 916 nbhbbh.exe 6068 3dpjd.exe 1996 7xfxrff.exe 4676 hnhttt.exe 3832 jjjjp.exe 3732 xlrrllr.exe 5392 llfffrl.exe 1848 hhhhbh.exe 2924 3pvvv.exe 3624 lfllfff.exe 2212 tnhhbh.exe 2288 7ntnnn.exe 5316 frrlfff.exe 5660 fxrlxfx.exe 5504 jdpjd.exe 6112 vvjdp.exe 636 tbbtht.exe 3528 vjpdv.exe 2360 lllxrxf.exe 4780 7btbhb.exe 4960 dpddv.exe 2800 xxfrxfl.exe 1360 frfrxlx.exe 3288 hnnthb.exe 3308 djjvj.exe 1924 xlfrlff.exe 5960 bnnnnh.exe 5532 5jdpj.exe 1432 1rxrllf.exe 4980 rlxlxfx.exe 4124 9bnttb.exe 4348 jddvp.exe 5652 rxxxrxx.exe 4728 5rfrlfx.exe 3244 tnnnnn.exe 4168 5jpvv.exe 2632 jddpj.exe 3304 rlfxlxr.exe 5744 nhhhhn.exe 1284 9vdpj.exe 3764 dppjd.exe 4480 rllffrr.exe 2224 hbnnhh.exe 2260 jppvj.exe 3048 pjjvj.exe 956 llffrrf.exe 3680 tnbbnh.exe 3532 nhthtb.exe 3016 ppvjj.exe 3792 9frfrll.exe 5688 tnhnbh.exe -
Processes:
resource yara_rule behavioral2/memory/3256-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3256-6-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4572-8-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1188-19-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4568-21-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4568-12-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3540-31-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/992-37-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2276-39-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2276-45-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1540-50-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1412-57-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2636-63-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4592-71-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/6084-77-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/916-87-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/6068-97-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1996-100-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4676-109-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3832-112-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3732-118-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1848-128-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1848-134-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5316-160-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5660-168-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5504-166-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3528-183-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2360-192-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2800-199-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1360-206-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3288-207-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3288-211-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5960-218-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1432-228-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4980-232-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4348-237-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4728-246-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2632-256-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3304-260-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5744-261-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1284-266-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3764-271-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2224-275-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2224-279-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2260-280-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/956-290-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3680-294-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3016-301-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5224-308-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/408-321-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2980-331-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/852-336-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5112-348-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4536-373-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5964-377-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2636-378-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4376-382-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3620-386-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5248-402-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5584-406-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4104-428-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5196-432-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2620-481-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2128-485-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exexxxxrrr.exexxffxff.exebbhhtb.exe9vjdv.exedjpvd.exe1ntbtt.exe3dvvd.exexfrfffl.exejvjdd.exerffllll.exe1nnhbb.exedpddp.exellfxxll.exenbhbbh.exe3dpjd.exe7xfxrff.exehnhttt.exejjjjp.exexlrrllr.exellfffrl.exehhhhbh.exedescription pid process target process PID 3256 wrote to memory of 4572 3256 d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe xxxxrrr.exe PID 3256 wrote to memory of 4572 3256 d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe xxxxrrr.exe PID 3256 wrote to memory of 4572 3256 d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe xxxxrrr.exe PID 4572 wrote to memory of 4568 4572 xxxxrrr.exe xxffxff.exe PID 4572 wrote to memory of 4568 4572 xxxxrrr.exe xxffxff.exe PID 4572 wrote to memory of 4568 4572 xxxxrrr.exe xxffxff.exe PID 4568 wrote to memory of 1188 4568 xxffxff.exe bbhhtb.exe PID 4568 wrote to memory of 1188 4568 xxffxff.exe bbhhtb.exe PID 4568 wrote to memory of 1188 4568 xxffxff.exe bbhhtb.exe PID 1188 wrote to memory of 3540 1188 bbhhtb.exe 9vjdv.exe PID 1188 wrote to memory of 3540 1188 bbhhtb.exe 9vjdv.exe PID 1188 wrote to memory of 3540 1188 bbhhtb.exe 9vjdv.exe PID 3540 wrote to memory of 992 3540 9vjdv.exe djpvd.exe PID 3540 wrote to memory of 992 3540 9vjdv.exe djpvd.exe PID 3540 wrote to memory of 992 3540 9vjdv.exe djpvd.exe PID 992 wrote to memory of 2276 992 djpvd.exe 1ntbtt.exe PID 992 wrote to memory of 2276 992 djpvd.exe 1ntbtt.exe PID 992 wrote to memory of 2276 992 djpvd.exe 1ntbtt.exe PID 2276 wrote to memory of 1540 2276 1ntbtt.exe 3dvvd.exe PID 2276 wrote to memory of 1540 2276 1ntbtt.exe 3dvvd.exe PID 2276 wrote to memory of 1540 2276 1ntbtt.exe 3dvvd.exe PID 1540 wrote to memory of 1412 1540 3dvvd.exe xfrfffl.exe PID 1540 wrote to memory of 1412 1540 3dvvd.exe xfrfffl.exe PID 1540 wrote to memory of 1412 1540 3dvvd.exe xfrfffl.exe PID 1412 wrote to memory of 2636 1412 xfrfffl.exe jvjdd.exe PID 1412 wrote to memory of 2636 1412 xfrfffl.exe jvjdd.exe PID 1412 wrote to memory of 2636 1412 xfrfffl.exe jvjdd.exe PID 2636 wrote to memory of 5736 2636 jvjdd.exe rffllll.exe PID 2636 wrote to memory of 5736 2636 jvjdd.exe rffllll.exe PID 2636 wrote to memory of 5736 2636 jvjdd.exe rffllll.exe PID 5736 wrote to memory of 4592 5736 rffllll.exe 1nnhbb.exe PID 5736 wrote to memory of 4592 5736 rffllll.exe 1nnhbb.exe PID 5736 wrote to memory of 4592 5736 rffllll.exe 1nnhbb.exe PID 4592 wrote to memory of 6084 4592 1nnhbb.exe dpddp.exe PID 4592 wrote to memory of 6084 4592 1nnhbb.exe dpddp.exe PID 4592 wrote to memory of 6084 4592 1nnhbb.exe dpddp.exe PID 6084 wrote to memory of 1348 6084 dpddp.exe llfxxll.exe PID 6084 wrote to memory of 1348 6084 dpddp.exe llfxxll.exe PID 6084 wrote to memory of 1348 6084 dpddp.exe llfxxll.exe PID 1348 wrote to memory of 916 1348 llfxxll.exe nbhbbh.exe PID 1348 wrote to memory of 916 1348 llfxxll.exe nbhbbh.exe PID 1348 wrote to memory of 916 1348 llfxxll.exe nbhbbh.exe PID 916 wrote to memory of 6068 916 nbhbbh.exe 3dpjd.exe PID 916 wrote to memory of 6068 916 nbhbbh.exe 3dpjd.exe PID 916 wrote to memory of 6068 916 nbhbbh.exe 3dpjd.exe PID 6068 wrote to memory of 1996 6068 3dpjd.exe 7xfxrff.exe PID 6068 wrote to memory of 1996 6068 3dpjd.exe 7xfxrff.exe PID 6068 wrote to memory of 1996 6068 3dpjd.exe 7xfxrff.exe PID 1996 wrote to memory of 4676 1996 7xfxrff.exe hnhttt.exe PID 1996 wrote to memory of 4676 1996 7xfxrff.exe hnhttt.exe PID 1996 wrote to memory of 4676 1996 7xfxrff.exe hnhttt.exe PID 4676 wrote to memory of 3832 4676 hnhttt.exe jjjjp.exe PID 4676 wrote to memory of 3832 4676 hnhttt.exe jjjjp.exe PID 4676 wrote to memory of 3832 4676 hnhttt.exe jjjjp.exe PID 3832 wrote to memory of 3732 3832 jjjjp.exe xlrrllr.exe PID 3832 wrote to memory of 3732 3832 jjjjp.exe xlrrllr.exe PID 3832 wrote to memory of 3732 3832 jjjjp.exe xlrrllr.exe PID 3732 wrote to memory of 5392 3732 xlrrllr.exe llfffrl.exe PID 3732 wrote to memory of 5392 3732 xlrrllr.exe llfffrl.exe PID 3732 wrote to memory of 5392 3732 xlrrllr.exe llfffrl.exe PID 5392 wrote to memory of 1848 5392 llfffrl.exe hhhhbh.exe PID 5392 wrote to memory of 1848 5392 llfffrl.exe hhhhbh.exe PID 5392 wrote to memory of 1848 5392 llfffrl.exe hhhhbh.exe PID 1848 wrote to memory of 2924 1848 hhhhbh.exe 3pvvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\xxffxff.exec:\xxffxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\bbhhtb.exec:\bbhhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\9vjdv.exec:\9vjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\djpvd.exec:\djpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\1ntbtt.exec:\1ntbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\3dvvd.exec:\3dvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\xfrfffl.exec:\xfrfffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\jvjdd.exec:\jvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rffllll.exec:\rffllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
\??\c:\1nnhbb.exec:\1nnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\dpddp.exec:\dpddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
\??\c:\llfxxll.exec:\llfxxll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\nbhbbh.exec:\nbhbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\3dpjd.exec:\3dpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
\??\c:\7xfxrff.exec:\7xfxrff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\hnhttt.exec:\hnhttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\jjjjp.exec:\jjjjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\xlrrllr.exec:\xlrrllr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\llfffrl.exec:\llfffrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
\??\c:\hhhhbh.exec:\hhhhbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\3pvvv.exec:\3pvvv.exe23⤵
- Executes dropped EXE
PID:2924 -
\??\c:\lfllfff.exec:\lfllfff.exe24⤵
- Executes dropped EXE
PID:3624 -
\??\c:\tnhhbh.exec:\tnhhbh.exe25⤵
- Executes dropped EXE
PID:2212 -
\??\c:\7ntnnn.exec:\7ntnnn.exe26⤵
- Executes dropped EXE
PID:2288 -
\??\c:\frrlfff.exec:\frrlfff.exe27⤵
- Executes dropped EXE
PID:5316 -
\??\c:\fxrlxfx.exec:\fxrlxfx.exe28⤵
- Executes dropped EXE
PID:5660 -
\??\c:\jdpjd.exec:\jdpjd.exe29⤵
- Executes dropped EXE
PID:5504 -
\??\c:\vvjdp.exec:\vvjdp.exe30⤵
- Executes dropped EXE
PID:6112 -
\??\c:\tbbtht.exec:\tbbtht.exe31⤵
- Executes dropped EXE
PID:636 -
\??\c:\vjpdv.exec:\vjpdv.exe32⤵
- Executes dropped EXE
PID:3528 -
\??\c:\lllxrxf.exec:\lllxrxf.exe33⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7btbhb.exec:\7btbhb.exe34⤵
- Executes dropped EXE
PID:4780 -
\??\c:\dpddv.exec:\dpddv.exe35⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xxfrxfl.exec:\xxfrxfl.exe36⤵
- Executes dropped EXE
PID:2800 -
\??\c:\frfrxlx.exec:\frfrxlx.exe37⤵
- Executes dropped EXE
PID:1360 -
\??\c:\hnnthb.exec:\hnnthb.exe38⤵
- Executes dropped EXE
PID:3288 -
\??\c:\djjvj.exec:\djjvj.exe39⤵
- Executes dropped EXE
PID:3308 -
\??\c:\xlfrlff.exec:\xlfrlff.exe40⤵
- Executes dropped EXE
PID:1924 -
\??\c:\bnnnnh.exec:\bnnnnh.exe41⤵
- Executes dropped EXE
PID:5960 -
\??\c:\5jdpj.exec:\5jdpj.exe42⤵
- Executes dropped EXE
PID:5532 -
\??\c:\1rxrllf.exec:\1rxrllf.exe43⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rlxlxfx.exec:\rlxlxfx.exe44⤵
- Executes dropped EXE
PID:4980 -
\??\c:\9bnttb.exec:\9bnttb.exe45⤵
- Executes dropped EXE
PID:4124 -
\??\c:\jddvp.exec:\jddvp.exe46⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe47⤵
- Executes dropped EXE
PID:5652 -
\??\c:\5rfrlfx.exec:\5rfrlfx.exe48⤵
- Executes dropped EXE
PID:4728 -
\??\c:\tnnnnn.exec:\tnnnnn.exe49⤵
- Executes dropped EXE
PID:3244 -
\??\c:\5jpvv.exec:\5jpvv.exe50⤵
- Executes dropped EXE
PID:4168 -
\??\c:\jddpj.exec:\jddpj.exe51⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rlfxlxr.exec:\rlfxlxr.exe52⤵
- Executes dropped EXE
PID:3304 -
\??\c:\nhhhhn.exec:\nhhhhn.exe53⤵
- Executes dropped EXE
PID:5744 -
\??\c:\9vdpj.exec:\9vdpj.exe54⤵
- Executes dropped EXE
PID:1284 -
\??\c:\dppjd.exec:\dppjd.exe55⤵
- Executes dropped EXE
PID:3764 -
\??\c:\rllffrr.exec:\rllffrr.exe56⤵
- Executes dropped EXE
PID:4480 -
\??\c:\hbnnhh.exec:\hbnnhh.exe57⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jppvj.exec:\jppvj.exe58⤵
- Executes dropped EXE
PID:2260 -
\??\c:\pjjvj.exec:\pjjvj.exe59⤵
- Executes dropped EXE
PID:3048 -
\??\c:\llffrrf.exec:\llffrrf.exe60⤵
- Executes dropped EXE
PID:956 -
\??\c:\tnbbnh.exec:\tnbbnh.exe61⤵
- Executes dropped EXE
PID:3680 -
\??\c:\nhthtb.exec:\nhthtb.exe62⤵
- Executes dropped EXE
PID:3532 -
\??\c:\ppvjj.exec:\ppvjj.exe63⤵
- Executes dropped EXE
PID:3016 -
\??\c:\9frfrll.exec:\9frfrll.exe64⤵
- Executes dropped EXE
PID:3792 -
\??\c:\tnhnbh.exec:\tnhnbh.exe65⤵
- Executes dropped EXE
PID:5688 -
\??\c:\nhnhtn.exec:\nhnhtn.exe66⤵PID:5224
-
\??\c:\djddd.exec:\djddd.exe67⤵PID:1972
-
\??\c:\5jpjj.exec:\5jpjj.exe68⤵PID:3356
-
\??\c:\lflrlfr.exec:\lflrlfr.exe69⤵PID:408
-
\??\c:\hhbbtn.exec:\hhbbtn.exe70⤵PID:4532
-
\??\c:\3bthtn.exec:\3bthtn.exe71⤵PID:4496
-
\??\c:\pddvp.exec:\pddvp.exe72⤵PID:4500
-
\??\c:\xrxrlll.exec:\xrxrlll.exe73⤵PID:2980
-
\??\c:\rffxxrr.exec:\rffxxrr.exe74⤵PID:852
-
\??\c:\3tthhh.exec:\3tthhh.exe75⤵PID:912
-
\??\c:\jdvvp.exec:\jdvvp.exe76⤵PID:5032
-
\??\c:\rrxrlll.exec:\rrxrlll.exe77⤵PID:4904
-
\??\c:\7xxxrrr.exec:\7xxxrrr.exe78⤵PID:5112
-
\??\c:\bnnbtn.exec:\bnnbtn.exe79⤵PID:2652
-
\??\c:\jpjpj.exec:\jpjpj.exe80⤵PID:456
-
\??\c:\bhnbtt.exec:\bhnbtt.exe81⤵PID:4232
-
\??\c:\5jdvv.exec:\5jdvv.exe82⤵PID:2676
-
\??\c:\rlfrfff.exec:\rlfrfff.exe83⤵PID:1532
-
\??\c:\1bhbht.exec:\1bhbht.exe84⤵PID:1992
-
\??\c:\7vdvp.exec:\7vdvp.exe85⤵PID:4536
-
\??\c:\5lrfffl.exec:\5lrfffl.exe86⤵PID:5964
-
\??\c:\lxflxlf.exec:\lxflxlf.exe87⤵PID:2636
-
\??\c:\nbbbtn.exec:\nbbbtn.exe88⤵PID:4376
-
\??\c:\1pjvp.exec:\1pjvp.exe89⤵PID:3620
-
\??\c:\frxlxxr.exec:\frxlxxr.exe90⤵PID:1640
-
\??\c:\thnhhh.exec:\thnhhh.exe91⤵PID:1036
-
\??\c:\vvvvp.exec:\vvvvp.exe92⤵PID:5620
-
\??\c:\dvjjv.exec:\dvjjv.exe93⤵PID:4412
-
\??\c:\xrxxxff.exec:\xrxxxff.exe94⤵PID:5248
-
\??\c:\lflffrr.exec:\lflffrr.exe95⤵PID:5584
-
\??\c:\nthnbh.exec:\nthnbh.exe96⤵PID:4756
-
\??\c:\ddpjv.exec:\ddpjv.exe97⤵PID:448
-
\??\c:\pjppj.exec:\pjppj.exe98⤵PID:3652
-
\??\c:\rlllfrr.exec:\rlllfrr.exe99⤵PID:3452
-
\??\c:\fflrllf.exec:\fflrllf.exe100⤵PID:5396
-
\??\c:\hntbth.exec:\hntbth.exe101⤵PID:4104
-
\??\c:\pdppv.exec:\pdppv.exe102⤵PID:5196
-
\??\c:\dpdvv.exec:\dpdvv.exe103⤵PID:5548
-
\??\c:\xrxfrxr.exec:\xrxfrxr.exe104⤵PID:4320
-
\??\c:\xrxxxff.exec:\xrxxxff.exe105⤵PID:8
-
\??\c:\ttttnt.exec:\ttttnt.exe106⤵PID:2212
-
\??\c:\5ddvp.exec:\5ddvp.exe107⤵PID:904
-
\??\c:\1dddv.exec:\1dddv.exe108⤵PID:1544
-
\??\c:\rrxxxll.exec:\rrxxxll.exe109⤵PID:1836
-
\??\c:\tbnnhh.exec:\tbnnhh.exe110⤵PID:1384
-
\??\c:\tbbttt.exec:\tbbttt.exe111⤵PID:4356
-
\??\c:\vpjdv.exec:\vpjdv.exe112⤵PID:728
-
\??\c:\djjdd.exec:\djjdd.exe113⤵PID:6112
-
\??\c:\rllllrr.exec:\rllllrr.exe114⤵PID:1944
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe115⤵PID:1020
-
\??\c:\bbthnb.exec:\bbthnb.exe116⤵PID:936
-
\??\c:\jvvpd.exec:\jvvpd.exe117⤵PID:748
-
\??\c:\7djpv.exec:\7djpv.exe118⤵PID:3128
-
\??\c:\ffrlffr.exec:\ffrlffr.exe119⤵PID:2620
-
\??\c:\7lfxrrr.exec:\7lfxrrr.exe120⤵PID:2128
-
\??\c:\ttttnt.exec:\ttttnt.exe121⤵PID:1124
-
\??\c:\vvpjj.exec:\vvpjj.exe122⤵PID:3120
-
\??\c:\dvjdd.exec:\dvjdd.exe123⤵PID:4620
-
\??\c:\xfflfxr.exec:\xfflfxr.exe124⤵PID:4584
-
\??\c:\xxlxllr.exec:\xxlxllr.exe125⤵PID:2504
-
\??\c:\dpppd.exec:\dpppd.exe126⤵PID:4064
-
\??\c:\djjjj.exec:\djjjj.exe127⤵PID:4388
-
\??\c:\llffflr.exec:\llffflr.exe128⤵PID:5580
-
\??\c:\hhbbhh.exec:\hhbbhh.exe129⤵PID:2216
-
\??\c:\bbnhhn.exec:\bbnhhn.exe130⤵PID:4168
-
\??\c:\dvjdd.exec:\dvjdd.exe131⤵PID:1696
-
\??\c:\1vvvv.exec:\1vvvv.exe132⤵PID:1528
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe133⤵PID:4028
-
\??\c:\rfllllr.exec:\rfllllr.exe134⤵PID:5460
-
\??\c:\thnnnb.exec:\thnnnb.exe135⤵PID:1872
-
\??\c:\djjjd.exec:\djjjd.exe136⤵PID:1016
-
\??\c:\jpppd.exec:\jpppd.exe137⤵PID:1104
-
\??\c:\3lfxxfl.exec:\3lfxxfl.exe138⤵PID:2496
-
\??\c:\1xrflxl.exec:\1xrflxl.exe139⤵PID:3112
-
\??\c:\tntnnh.exec:\tntnnh.exe140⤵PID:3284
-
\??\c:\btbthn.exec:\btbthn.exe141⤵PID:3224
-
\??\c:\vdvvp.exec:\vdvvp.exe142⤵PID:3572
-
\??\c:\lflxrrx.exec:\lflxrrx.exe143⤵PID:4360
-
\??\c:\fffflrx.exec:\fffflrx.exe144⤵PID:5628
-
\??\c:\nbtbnb.exec:\nbtbnb.exe145⤵PID:4744
-
\??\c:\7tbtbt.exec:\7tbtbt.exe146⤵PID:2460
-
\??\c:\3vpjp.exec:\3vpjp.exe147⤵PID:208
-
\??\c:\vpjdv.exec:\vpjdv.exe148⤵PID:1536
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe149⤵PID:320
-
\??\c:\btbhbb.exec:\btbhbb.exe150⤵PID:2168
-
\??\c:\hnnhtt.exec:\hnnhtt.exe151⤵PID:4496
-
\??\c:\dpjvp.exec:\dpjvp.exe152⤵PID:3756
-
\??\c:\pjdvj.exec:\pjdvj.exe153⤵PID:2980
-
\??\c:\5rlxflf.exec:\5rlxflf.exe154⤵PID:852
-
\??\c:\rlrfflf.exec:\rlrfflf.exe155⤵PID:1728
-
\??\c:\hbbbhh.exec:\hbbbhh.exe156⤵PID:5032
-
\??\c:\9hbtnn.exec:\9hbtnn.exe157⤵PID:548
-
\??\c:\pvvjj.exec:\pvvjj.exe158⤵PID:3184
-
\??\c:\ddvdp.exec:\ddvdp.exe159⤵PID:3556
-
\??\c:\xlrxrrl.exec:\xlrxrrl.exe160⤵PID:1004
-
\??\c:\hbnbnb.exec:\hbnbnb.exe161⤵PID:2676
-
\??\c:\nnthtt.exec:\nnthtt.exe162⤵PID:2368
-
\??\c:\nbhbnt.exec:\nbhbnt.exe163⤵PID:1992
-
\??\c:\pvpdp.exec:\pvpdp.exe164⤵PID:3024
-
\??\c:\3xxrxfx.exec:\3xxrxfx.exe165⤵PID:5536
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe166⤵PID:4076
-
\??\c:\tnbtbb.exec:\tnbtbb.exe167⤵PID:4560
-
\??\c:\tbnhbt.exec:\tbnhbt.exe168⤵PID:5036
-
\??\c:\jjjdp.exec:\jjjdp.exe169⤵PID:5184
-
\??\c:\7vdvv.exec:\7vdvv.exe170⤵PID:2936
-
\??\c:\xxxrxxr.exec:\xxxrxxr.exe171⤵PID:5188
-
\??\c:\fxxxxfx.exec:\fxxxxfx.exe172⤵PID:5952
-
\??\c:\hnthbb.exec:\hnthbb.exe173⤵PID:3472
-
\??\c:\5hhbnn.exec:\5hhbnn.exe174⤵PID:1996
-
\??\c:\dpjdv.exec:\dpjdv.exe175⤵PID:4100
-
\??\c:\ddpdv.exec:\ddpdv.exe176⤵PID:3040
-
\??\c:\lllrlff.exec:\lllrlff.exe177⤵PID:4440
-
\??\c:\lffrrfx.exec:\lffrrfx.exe178⤵PID:3912
-
\??\c:\5btnhn.exec:\5btnhn.exe179⤵PID:6080
-
\??\c:\bhbbbh.exec:\bhbbbh.exe180⤵PID:6040
-
\??\c:\vvpdd.exec:\vvpdd.exe181⤵PID:5196
-
\??\c:\vvpjd.exec:\vvpjd.exe182⤵PID:5548
-
\??\c:\7rfxrxl.exec:\7rfxrxl.exe183⤵PID:4320
-
\??\c:\bhnthb.exec:\bhnthb.exe184⤵PID:8
-
\??\c:\tnhbtt.exec:\tnhbtt.exe185⤵PID:5368
-
\??\c:\pppdp.exec:\pppdp.exe186⤵PID:904
-
\??\c:\vdddv.exec:\vdddv.exe187⤵PID:3928
-
\??\c:\7fxxxfx.exec:\7fxxxfx.exe188⤵PID:5268
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe189⤵PID:1384
-
\??\c:\bbbbtt.exec:\bbbbtt.exe190⤵PID:4356
-
\??\c:\nthbtn.exec:\nthbtn.exe191⤵PID:728
-
\??\c:\3pdvp.exec:\3pdvp.exe192⤵PID:636
-
\??\c:\vdpvv.exec:\vdpvv.exe193⤵PID:640
-
\??\c:\lffxrlf.exec:\lffxrlf.exe194⤵PID:5264
-
\??\c:\ffxrllx.exec:\ffxrllx.exe195⤵PID:3824
-
\??\c:\btnhbb.exec:\btnhbb.exe196⤵PID:3128
-
\??\c:\pjjdv.exec:\pjjdv.exe197⤵PID:2800
-
\??\c:\5ppjp.exec:\5ppjp.exe198⤵PID:1792
-
\??\c:\9frxllf.exec:\9frxllf.exe199⤵PID:3120
-
\??\c:\frrfxrl.exec:\frrfxrl.exe200⤵PID:3308
-
\??\c:\3nthbb.exec:\3nthbb.exe201⤵PID:5532
-
\??\c:\jjjvd.exec:\jjjvd.exe202⤵PID:5296
-
\??\c:\pjjdd.exec:\pjjdd.exe203⤵PID:2160
-
\??\c:\lrrrllx.exec:\lrrrllx.exe204⤵PID:2916
-
\??\c:\lflfrlf.exec:\lflfrlf.exe205⤵PID:4700
-
\??\c:\hnnbtn.exec:\hnnbtn.exe206⤵PID:2092
-
\??\c:\bnhtnh.exec:\bnhtnh.exe207⤵PID:64
-
\??\c:\pvpjd.exec:\pvpjd.exe208⤵PID:1120
-
\??\c:\frxlxxr.exec:\frxlxxr.exe209⤵PID:4508
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe210⤵PID:1392
-
\??\c:\hthbth.exec:\hthbth.exe211⤵PID:2480
-
\??\c:\3pvvv.exec:\3pvvv.exe212⤵PID:5684
-
\??\c:\ppjdv.exec:\ppjdv.exe213⤵PID:2224
-
\??\c:\lxfrrfl.exec:\lxfrrfl.exe214⤵PID:1104
-
\??\c:\tttnbt.exec:\tttnbt.exe215⤵PID:2496
-
\??\c:\hhtnhh.exec:\hhtnhh.exe216⤵PID:1240
-
\??\c:\jdpjd.exec:\jdpjd.exe217⤵PID:3284
-
\??\c:\5xxfrrf.exec:\5xxfrrf.exe218⤵PID:3552
-
\??\c:\1tnbnn.exec:\1tnbnn.exe219⤵PID:4660
-
\??\c:\nntnhb.exec:\nntnhb.exe220⤵PID:3704
-
\??\c:\jdvjj.exec:\jdvjj.exe221⤵PID:5628
-
\??\c:\lxrlxxl.exec:\lxrlxxl.exe222⤵PID:4744
-
\??\c:\7ttnnn.exec:\7ttnnn.exe223⤵PID:3056
-
\??\c:\jvvvv.exec:\jvvvv.exe224⤵PID:208
-
\??\c:\ppjpj.exec:\ppjpj.exe225⤵PID:4532
-
\??\c:\rlfxlll.exec:\rlfxlll.exe226⤵PID:320
-
\??\c:\3hbthb.exec:\3hbthb.exe227⤵PID:2168
-
\??\c:\1tbtnn.exec:\1tbtnn.exe228⤵PID:4332
-
\??\c:\3vjjv.exec:\3vjjv.exe229⤵PID:464
-
\??\c:\frrfxlf.exec:\frrfxlf.exe230⤵PID:2980
-
\??\c:\rlxfxfl.exec:\rlxfxfl.exe231⤵PID:852
-
\??\c:\nbtnhh.exec:\nbtnhh.exe232⤵PID:1728
-
\??\c:\dvpjd.exec:\dvpjd.exe233⤵PID:4112
-
\??\c:\vpppp.exec:\vpppp.exe234⤵PID:3540
-
\??\c:\xffxrlf.exec:\xffxrlf.exe235⤵PID:456
-
\??\c:\bnnhtn.exec:\bnnhtn.exe236⤵PID:452
-
\??\c:\7hhbth.exec:\7hhbth.exe237⤵PID:1708
-
\??\c:\pjjpj.exec:\pjjpj.exe238⤵PID:5796
-
\??\c:\5vvjd.exec:\5vvjd.exe239⤵PID:2992
-
\??\c:\9lflfxx.exec:\9lflfxx.exe240⤵PID:4536
-
\??\c:\9bhtnn.exec:\9bhtnn.exe241⤵PID:4308
-
\??\c:\btbtnn.exec:\btbtnn.exe242⤵PID:4076