Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:35
Behavioral task
behavioral1
Sample
d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe
-
Size
62KB
-
MD5
d873afa1c12ff92eb38b063191b50d70
-
SHA1
2aefede21ea7231cc95e2a58739f59451eacb135
-
SHA256
4d5ea2027e761d42bb29d5d49ee647dc9dce3141f1b32acacbc22fe7030e463f
-
SHA512
07babfc56c863b1a616eb2270a27ff556d737cc758ffe84f3539aa9398f0e3b3c9d9e53e4a20d2375ac50f159de18608bcece4b3397cd78dba944bed0c1ceb55
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+EMdH:zhOmTsF93UYfwC6GIoutiTWMdH
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1660-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2404-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1656-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3356-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/112-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3408-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/824-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-571-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-683-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-716-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-788-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-856-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbtnhh.exepjpjp.exerlrlxrl.exe5lrlrlr.exe3bhtnn.exebttnbt.exepjpdj.exejppjv.exe5llfxrr.exentbhhb.exebhnhhh.exevdjjd.exe9fxxxxl.exehnttnh.exetnnhbb.exe3pvjj.exepvpjv.exexrrlflf.exehntnhb.exennhbnh.exeppvpp.exexrrllxr.exelxrfrlx.exebbbhth.exe3djdp.exe1vpjv.exefrlfxrx.exehbhbtn.exe5dpjv.exe1jdpd.exexrllxxx.exetbbhhn.exenhhbtb.exevjdvd.exe5lrlxxl.exetbhbtn.exevddvj.exeflffxxr.exerxffxxx.exenbhbbt.exehttnnn.exepvvpj.exejjjjd.exellfxrrr.exehbnhbb.exe1hnnbh.exedpvvj.exe3rlfrlf.exe5frxrrr.exenhntnt.exebnbtnt.exedvjdp.exe7frlfxl.exexrlfrrl.exehbhttb.exevpddd.exejpppj.exexxfxxxf.exetbttnh.exe1btnbt.exejdvpj.exefrlfxrr.exelfxrlfx.exelffrlfx.exepid process 2020 bbtnhh.exe 2404 pjpjp.exe 1052 rlrlxrl.exe 792 5lrlrlr.exe 3224 3bhtnn.exe 3088 bttnbt.exe 1124 pjpdj.exe 2636 jppjv.exe 4576 5llfxrr.exe 1836 ntbhhb.exe 3160 bhnhhh.exe 3472 vdjjd.exe 3228 9fxxxxl.exe 4216 hnttnh.exe 3172 tnnhbb.exe 2744 3pvjj.exe 1704 pvpjv.exe 1656 xrrlflf.exe 4932 hntnhb.exe 4344 nnhbnh.exe 4464 ppvpp.exe 1032 xrrllxr.exe 5116 lxrfrlx.exe 4000 bbbhth.exe 4388 3djdp.exe 4440 1vpjv.exe 4256 frlfxrx.exe 3356 hbhbtn.exe 1348 5dpjv.exe 1668 1jdpd.exe 3096 xrllxxx.exe 1844 tbbhhn.exe 3572 nhhbtb.exe 4776 vjdvd.exe 1724 5lrlxxl.exe 756 tbhbtn.exe 4996 vddvj.exe 396 flffxxr.exe 3092 rxffxxx.exe 3556 nbhbbt.exe 1044 httnnn.exe 4892 pvvpj.exe 2000 jjjjd.exe 1076 llfxrrr.exe 5016 hbnhbb.exe 4016 1hnnbh.exe 4904 dpvvj.exe 2756 3rlfrlf.exe 960 5frxrrr.exe 2004 nhntnt.exe 1420 bnbtnt.exe 2580 dvjdp.exe 2452 7frlfxl.exe 1332 xrlfrrl.exe 4788 hbhttb.exe 1340 vpddd.exe 1896 jpppj.exe 1124 xxfxxxf.exe 2352 tbttnh.exe 1748 1btnbt.exe 4576 jdvpj.exe 4008 frlfxrr.exe 3492 lfxrlfx.exe 1696 lffrlfx.exe -
Processes:
resource yara_rule behavioral2/memory/1660-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbtnhh.exe upx behavioral2/memory/1660-4-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjpjp.exe upx behavioral2/memory/2020-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2404-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrlxrl.exe upx \??\c:\5lrlrlr.exe upx behavioral2/memory/792-20-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3bhtnn.exe upx behavioral2/memory/3224-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bttnbt.exe upx behavioral2/memory/3088-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjpdj.exe upx behavioral2/memory/1124-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jppjv.exe upx C:\5llfxrr.exe upx behavioral2/memory/2636-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4576-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1836-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhnhhh.exe upx C:\ntbhhb.exe upx behavioral2/memory/3160-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vdjjd.exe upx behavioral2/memory/3160-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3472-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9fxxxxl.exe upx behavioral2/memory/3228-69-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hnttnh.exe upx behavioral2/memory/4216-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnhbb.exe upx behavioral2/memory/3172-77-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3pvjj.exe upx C:\pvpjv.exe upx behavioral2/memory/1704-86-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrlflf.exe upx behavioral2/memory/1656-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hntnhb.exe upx behavioral2/memory/1656-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnhbnh.exe upx behavioral2/memory/4932-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4344-106-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ppvpp.exe upx C:\xrrllxr.exe upx behavioral2/memory/1032-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxrfrlx.exe upx C:\bbbhth.exe upx behavioral2/memory/5116-118-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3djdp.exe upx \??\c:\1vpjv.exe upx behavioral2/memory/4388-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4440-132-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frlfxrx.exe upx behavioral2/memory/4256-135-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhbtn.exe upx behavioral2/memory/3356-142-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5dpjv.exe upx C:\1jdpd.exe upx C:\xrllxxx.exe upx behavioral2/memory/3096-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbbhhn.exe upx behavioral2/memory/3572-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4776-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1724-166-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exebbtnhh.exepjpjp.exerlrlxrl.exe5lrlrlr.exe3bhtnn.exebttnbt.exepjpdj.exejppjv.exe5llfxrr.exentbhhb.exebhnhhh.exevdjjd.exe9fxxxxl.exehnttnh.exetnnhbb.exe3pvjj.exepvpjv.exexrrlflf.exehntnhb.exennhbnh.exeppvpp.exedescription pid process target process PID 1660 wrote to memory of 2020 1660 d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe bbtnhh.exe PID 1660 wrote to memory of 2020 1660 d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe bbtnhh.exe PID 1660 wrote to memory of 2020 1660 d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe bbtnhh.exe PID 2020 wrote to memory of 2404 2020 bbtnhh.exe pjpjp.exe PID 2020 wrote to memory of 2404 2020 bbtnhh.exe pjpjp.exe PID 2020 wrote to memory of 2404 2020 bbtnhh.exe pjpjp.exe PID 2404 wrote to memory of 1052 2404 pjpjp.exe rlrlxrl.exe PID 2404 wrote to memory of 1052 2404 pjpjp.exe rlrlxrl.exe PID 2404 wrote to memory of 1052 2404 pjpjp.exe rlrlxrl.exe PID 1052 wrote to memory of 792 1052 rlrlxrl.exe 5lrlrlr.exe PID 1052 wrote to memory of 792 1052 rlrlxrl.exe 5lrlrlr.exe PID 1052 wrote to memory of 792 1052 rlrlxrl.exe 5lrlrlr.exe PID 792 wrote to memory of 3224 792 5lrlrlr.exe 3bhtnn.exe PID 792 wrote to memory of 3224 792 5lrlrlr.exe 3bhtnn.exe PID 792 wrote to memory of 3224 792 5lrlrlr.exe 3bhtnn.exe PID 3224 wrote to memory of 3088 3224 3bhtnn.exe bttnbt.exe PID 3224 wrote to memory of 3088 3224 3bhtnn.exe bttnbt.exe PID 3224 wrote to memory of 3088 3224 3bhtnn.exe bttnbt.exe PID 3088 wrote to memory of 1124 3088 bttnbt.exe pjpdj.exe PID 3088 wrote to memory of 1124 3088 bttnbt.exe pjpdj.exe PID 3088 wrote to memory of 1124 3088 bttnbt.exe pjpdj.exe PID 1124 wrote to memory of 2636 1124 pjpdj.exe jppjv.exe PID 1124 wrote to memory of 2636 1124 pjpdj.exe jppjv.exe PID 1124 wrote to memory of 2636 1124 pjpdj.exe jppjv.exe PID 2636 wrote to memory of 4576 2636 jppjv.exe 5llfxrr.exe PID 2636 wrote to memory of 4576 2636 jppjv.exe 5llfxrr.exe PID 2636 wrote to memory of 4576 2636 jppjv.exe 5llfxrr.exe PID 4576 wrote to memory of 1836 4576 5llfxrr.exe ntbhhb.exe PID 4576 wrote to memory of 1836 4576 5llfxrr.exe ntbhhb.exe PID 4576 wrote to memory of 1836 4576 5llfxrr.exe ntbhhb.exe PID 1836 wrote to memory of 3160 1836 ntbhhb.exe bhnhhh.exe PID 1836 wrote to memory of 3160 1836 ntbhhb.exe bhnhhh.exe PID 1836 wrote to memory of 3160 1836 ntbhhb.exe bhnhhh.exe PID 3160 wrote to memory of 3472 3160 bhnhhh.exe vdjjd.exe PID 3160 wrote to memory of 3472 3160 bhnhhh.exe vdjjd.exe PID 3160 wrote to memory of 3472 3160 bhnhhh.exe vdjjd.exe PID 3472 wrote to memory of 3228 3472 vdjjd.exe 9fxxxxl.exe PID 3472 wrote to memory of 3228 3472 vdjjd.exe 9fxxxxl.exe PID 3472 wrote to memory of 3228 3472 vdjjd.exe 9fxxxxl.exe PID 3228 wrote to memory of 4216 3228 9fxxxxl.exe hnttnh.exe PID 3228 wrote to memory of 4216 3228 9fxxxxl.exe hnttnh.exe PID 3228 wrote to memory of 4216 3228 9fxxxxl.exe hnttnh.exe PID 4216 wrote to memory of 3172 4216 hnttnh.exe tnnhbb.exe PID 4216 wrote to memory of 3172 4216 hnttnh.exe tnnhbb.exe PID 4216 wrote to memory of 3172 4216 hnttnh.exe tnnhbb.exe PID 3172 wrote to memory of 2744 3172 tnnhbb.exe 3pvjj.exe PID 3172 wrote to memory of 2744 3172 tnnhbb.exe 3pvjj.exe PID 3172 wrote to memory of 2744 3172 tnnhbb.exe 3pvjj.exe PID 2744 wrote to memory of 1704 2744 3pvjj.exe pvpjv.exe PID 2744 wrote to memory of 1704 2744 3pvjj.exe pvpjv.exe PID 2744 wrote to memory of 1704 2744 3pvjj.exe pvpjv.exe PID 1704 wrote to memory of 1656 1704 pvpjv.exe xrrlflf.exe PID 1704 wrote to memory of 1656 1704 pvpjv.exe xrrlflf.exe PID 1704 wrote to memory of 1656 1704 pvpjv.exe xrrlflf.exe PID 1656 wrote to memory of 4932 1656 xrrlflf.exe hntnhb.exe PID 1656 wrote to memory of 4932 1656 xrrlflf.exe hntnhb.exe PID 1656 wrote to memory of 4932 1656 xrrlflf.exe hntnhb.exe PID 4932 wrote to memory of 4344 4932 hntnhb.exe nnhbnh.exe PID 4932 wrote to memory of 4344 4932 hntnhb.exe nnhbnh.exe PID 4932 wrote to memory of 4344 4932 hntnhb.exe nnhbnh.exe PID 4344 wrote to memory of 4464 4344 nnhbnh.exe ppvpp.exe PID 4344 wrote to memory of 4464 4344 nnhbnh.exe ppvpp.exe PID 4344 wrote to memory of 4464 4344 nnhbnh.exe ppvpp.exe PID 4464 wrote to memory of 1032 4464 ppvpp.exe xrrllxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d873afa1c12ff92eb38b063191b50d70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\bbtnhh.exec:\bbtnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\pjpjp.exec:\pjpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\rlrlxrl.exec:\rlrlxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\5lrlrlr.exec:\5lrlrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\3bhtnn.exec:\3bhtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\bttnbt.exec:\bttnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\pjpdj.exec:\pjpdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\jppjv.exec:\jppjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\5llfxrr.exec:\5llfxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\ntbhhb.exec:\ntbhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\bhnhhh.exec:\bhnhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\vdjjd.exec:\vdjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\9fxxxxl.exec:\9fxxxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\hnttnh.exec:\hnttnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\tnnhbb.exec:\tnnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\3pvjj.exec:\3pvjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\pvpjv.exec:\pvpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\xrrlflf.exec:\xrrlflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\hntnhb.exec:\hntnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\nnhbnh.exec:\nnhbnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\ppvpp.exec:\ppvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\xrrllxr.exec:\xrrllxr.exe23⤵
- Executes dropped EXE
PID:1032 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe24⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bbbhth.exec:\bbbhth.exe25⤵
- Executes dropped EXE
PID:4000 -
\??\c:\3djdp.exec:\3djdp.exe26⤵
- Executes dropped EXE
PID:4388 -
\??\c:\1vpjv.exec:\1vpjv.exe27⤵
- Executes dropped EXE
PID:4440 -
\??\c:\frlfxrx.exec:\frlfxrx.exe28⤵
- Executes dropped EXE
PID:4256 -
\??\c:\hbhbtn.exec:\hbhbtn.exe29⤵
- Executes dropped EXE
PID:3356 -
\??\c:\5dpjv.exec:\5dpjv.exe30⤵
- Executes dropped EXE
PID:1348 -
\??\c:\1jdpd.exec:\1jdpd.exe31⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xrllxxx.exec:\xrllxxx.exe32⤵
- Executes dropped EXE
PID:3096 -
\??\c:\tbbhhn.exec:\tbbhhn.exe33⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nhhbtb.exec:\nhhbtb.exe34⤵
- Executes dropped EXE
PID:3572 -
\??\c:\vjdvd.exec:\vjdvd.exe35⤵
- Executes dropped EXE
PID:4776 -
\??\c:\5lrlxxl.exec:\5lrlxxl.exe36⤵
- Executes dropped EXE
PID:1724 -
\??\c:\tbhbtn.exec:\tbhbtn.exe37⤵
- Executes dropped EXE
PID:756 -
\??\c:\vddvj.exec:\vddvj.exe38⤵
- Executes dropped EXE
PID:4996 -
\??\c:\flffxxr.exec:\flffxxr.exe39⤵
- Executes dropped EXE
PID:396 -
\??\c:\rxffxxx.exec:\rxffxxx.exe40⤵
- Executes dropped EXE
PID:3092 -
\??\c:\nbhbbt.exec:\nbhbbt.exe41⤵
- Executes dropped EXE
PID:3556 -
\??\c:\httnnn.exec:\httnnn.exe42⤵
- Executes dropped EXE
PID:1044 -
\??\c:\pvvpj.exec:\pvvpj.exe43⤵
- Executes dropped EXE
PID:4892 -
\??\c:\jjjjd.exec:\jjjjd.exe44⤵
- Executes dropped EXE
PID:2000 -
\??\c:\llfxrrr.exec:\llfxrrr.exe45⤵
- Executes dropped EXE
PID:1076 -
\??\c:\hbnhbb.exec:\hbnhbb.exe46⤵
- Executes dropped EXE
PID:5016 -
\??\c:\1hnnbh.exec:\1hnnbh.exe47⤵
- Executes dropped EXE
PID:4016 -
\??\c:\dpvvj.exec:\dpvvj.exe48⤵
- Executes dropped EXE
PID:4904 -
\??\c:\3rlfrlf.exec:\3rlfrlf.exe49⤵
- Executes dropped EXE
PID:2756 -
\??\c:\5frxrrr.exec:\5frxrrr.exe50⤵
- Executes dropped EXE
PID:960 -
\??\c:\nhntnt.exec:\nhntnt.exe51⤵
- Executes dropped EXE
PID:2004 -
\??\c:\bnbtnt.exec:\bnbtnt.exe52⤵
- Executes dropped EXE
PID:1420 -
\??\c:\dvjdp.exec:\dvjdp.exe53⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7frlfxl.exec:\7frlfxl.exe54⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe55⤵
- Executes dropped EXE
PID:1332 -
\??\c:\hbhttb.exec:\hbhttb.exe56⤵
- Executes dropped EXE
PID:4788 -
\??\c:\vpddd.exec:\vpddd.exe57⤵
- Executes dropped EXE
PID:1340 -
\??\c:\jpppj.exec:\jpppj.exe58⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xxfxxxf.exec:\xxfxxxf.exe59⤵
- Executes dropped EXE
PID:1124 -
\??\c:\tbttnh.exec:\tbttnh.exe60⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1btnbt.exec:\1btnbt.exe61⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jdvpj.exec:\jdvpj.exe62⤵
- Executes dropped EXE
PID:4576 -
\??\c:\frlfxrr.exec:\frlfxrr.exe63⤵
- Executes dropped EXE
PID:4008 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe64⤵
- Executes dropped EXE
PID:3492 -
\??\c:\lffrlfx.exec:\lffrlfx.exe65⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nnnnhb.exec:\nnnnhb.exe66⤵PID:1580
-
\??\c:\pdvvv.exec:\pdvvv.exe67⤵PID:376
-
\??\c:\3vppd.exec:\3vppd.exe68⤵PID:4048
-
\??\c:\frfxllf.exec:\frfxllf.exe69⤵PID:4840
-
\??\c:\bbtnbb.exec:\bbtnbb.exe70⤵PID:432
-
\??\c:\nttthn.exec:\nttthn.exe71⤵PID:2772
-
\??\c:\9pvvp.exec:\9pvvp.exe72⤵PID:2412
-
\??\c:\lllfrrx.exec:\lllfrrx.exe73⤵PID:3200
-
\??\c:\hntnbt.exec:\hntnbt.exe74⤵PID:3304
-
\??\c:\hthbtt.exec:\hthbtt.exe75⤵PID:4756
-
\??\c:\pjpjj.exec:\pjpjj.exe76⤵PID:4364
-
\??\c:\vpvvp.exec:\vpvvp.exe77⤵PID:4396
-
\??\c:\xfflxxr.exec:\xfflxxr.exe78⤵PID:3576
-
\??\c:\7ffxxxr.exec:\7ffxxxr.exe79⤵PID:4464
-
\??\c:\btnhbb.exec:\btnhbb.exe80⤵PID:2400
-
\??\c:\pddpv.exec:\pddpv.exe81⤵PID:3296
-
\??\c:\xxlfxxf.exec:\xxlfxxf.exe82⤵PID:1500
-
\??\c:\xrxxffr.exec:\xrxxffr.exe83⤵PID:4520
-
\??\c:\7hbtbb.exec:\7hbtbb.exe84⤵PID:5032
-
\??\c:\ppvdp.exec:\ppvdp.exe85⤵PID:3144
-
\??\c:\hbbnth.exec:\hbbnth.exe86⤵PID:4440
-
\??\c:\nhbtnn.exec:\nhbtnn.exe87⤵PID:3292
-
\??\c:\pjdvp.exec:\pjdvp.exe88⤵PID:3588
-
\??\c:\pjjdd.exec:\pjjdd.exe89⤵PID:3612
-
\??\c:\flxxxxf.exec:\flxxxxf.exe90⤵PID:4740
-
\??\c:\nbhhtt.exec:\nbhhtt.exe91⤵PID:3108
-
\??\c:\dvvvd.exec:\dvvvd.exe92⤵PID:4288
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe93⤵PID:3008
-
\??\c:\xlxfxxr.exec:\xlxfxxr.exe94⤵PID:1964
-
\??\c:\9nttnn.exec:\9nttnn.exe95⤵PID:2660
-
\??\c:\dpdpj.exec:\dpdpj.exe96⤵PID:3028
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe97⤵PID:112
-
\??\c:\3tnhhn.exec:\3tnhhn.exe98⤵PID:3552
-
\??\c:\vppvv.exec:\vppvv.exe99⤵PID:1812
-
\??\c:\xrrlffx.exec:\xrrlffx.exe100⤵PID:3048
-
\??\c:\hbnhhh.exec:\hbnhhh.exe101⤵PID:1932
-
\??\c:\hntthh.exec:\hntthh.exe102⤵PID:3260
-
\??\c:\jpddv.exec:\jpddv.exe103⤵PID:3308
-
\??\c:\xxllxxf.exec:\xxllxxf.exe104⤵PID:3232
-
\??\c:\httnnn.exec:\httnnn.exe105⤵PID:2376
-
\??\c:\5ttntt.exec:\5ttntt.exe106⤵PID:4736
-
\??\c:\ddjvp.exec:\ddjvp.exe107⤵PID:4528
-
\??\c:\1xfrrlx.exec:\1xfrrlx.exe108⤵PID:4452
-
\??\c:\lrrrxxl.exec:\lrrrxxl.exe109⤵PID:4304
-
\??\c:\hnntnn.exec:\hnntnn.exe110⤵PID:4136
-
\??\c:\dpjjd.exec:\dpjjd.exe111⤵PID:2020
-
\??\c:\vjjvp.exec:\vjjvp.exe112⤵PID:620
-
\??\c:\ppdvv.exec:\ppdvv.exe113⤵PID:4884
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe114⤵PID:3408
-
\??\c:\ffllfxx.exec:\ffllfxx.exe115⤵PID:668
-
\??\c:\tnhnht.exec:\tnhnht.exe116⤵PID:4488
-
\??\c:\bbtntt.exec:\bbtntt.exe117⤵PID:4788
-
\??\c:\vdjjd.exec:\vdjjd.exe118⤵PID:1340
-
\??\c:\3dpjd.exec:\3dpjd.exe119⤵PID:1896
-
\??\c:\fxxrffx.exec:\fxxrffx.exe120⤵PID:1176
-
\??\c:\frrrlxx.exec:\frrrlxx.exe121⤵PID:1828
-
\??\c:\xfxrllf.exec:\xfxrllf.exe122⤵PID:3692
-
\??\c:\nnhttt.exec:\nnhttt.exe123⤵PID:2604
-
\??\c:\bbhbnn.exec:\bbhbnn.exe124⤵PID:3132
-
\??\c:\jdpvp.exec:\jdpvp.exe125⤵PID:1580
-
\??\c:\dpdpj.exec:\dpdpj.exe126⤵PID:376
-
\??\c:\rflfffx.exec:\rflfffx.exe127⤵PID:4732
-
\??\c:\btnhhh.exec:\btnhhh.exe128⤵PID:856
-
\??\c:\1hhbtn.exec:\1hhbtn.exe129⤵PID:2192
-
\??\c:\tbbttt.exec:\tbbttt.exe130⤵PID:1656
-
\??\c:\vvdvv.exec:\vvdvv.exe131⤵PID:3304
-
\??\c:\7lrfrrf.exec:\7lrfrrf.exe132⤵PID:2904
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe133⤵PID:4396
-
\??\c:\hbbbtn.exec:\hbbbtn.exe134⤵PID:2964
-
\??\c:\3hhhnn.exec:\3hhhnn.exe135⤵PID:1032
-
\??\c:\pjdpj.exec:\pjdpj.exe136⤵PID:5048
-
\??\c:\ppjdd.exec:\ppjdd.exe137⤵PID:3280
-
\??\c:\xxrffll.exec:\xxrffll.exe138⤵PID:1508
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe139⤵PID:4440
-
\??\c:\bnbbtn.exec:\bnbbtn.exe140⤵PID:1908
-
\??\c:\hnbnhn.exec:\hnbnhn.exe141⤵PID:3832
-
\??\c:\pvvjd.exec:\pvvjd.exe142⤵PID:1968
-
\??\c:\jjjdd.exec:\jjjdd.exe143⤵PID:1844
-
\??\c:\tnthhn.exec:\tnthhn.exe144⤵PID:4776
-
\??\c:\ddjjd.exec:\ddjjd.exe145⤵PID:1964
-
\??\c:\7pvvd.exec:\7pvvd.exe146⤵PID:1468
-
\??\c:\3rlfrrl.exec:\3rlfrrl.exe147⤵PID:556
-
\??\c:\llfxxfx.exec:\llfxxfx.exe148⤵PID:3900
-
\??\c:\bnntnt.exec:\bnntnt.exe149⤵PID:3552
-
\??\c:\tntnnn.exec:\tntnnn.exe150⤵PID:1712
-
\??\c:\pjdvj.exec:\pjdvj.exe151⤵PID:3964
-
\??\c:\fflfrrl.exec:\fflfrrl.exe152⤵PID:3760
-
\??\c:\bhnbtt.exec:\bhnbtt.exe153⤵PID:3744
-
\??\c:\jvvpj.exec:\jvvpj.exe154⤵PID:2460
-
\??\c:\pppjd.exec:\pppjd.exe155⤵PID:388
-
\??\c:\rrlfrrl.exec:\rrlfrrl.exe156⤵PID:1424
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe157⤵PID:2524
-
\??\c:\htbtnn.exec:\htbtnn.exe158⤵PID:4528
-
\??\c:\hhtnhb.exec:\hhtnhb.exe159⤵PID:640
-
\??\c:\dpdvp.exec:\dpdvp.exe160⤵PID:1092
-
\??\c:\frrlffx.exec:\frrlffx.exe161⤵PID:2580
-
\??\c:\bntnhb.exec:\bntnhb.exe162⤵PID:3212
-
\??\c:\tnhbtt.exec:\tnhbtt.exe163⤵PID:2568
-
\??\c:\pjjjp.exec:\pjjjp.exe164⤵PID:4884
-
\??\c:\1dddv.exec:\1dddv.exe165⤵PID:3408
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe166⤵PID:668
-
\??\c:\nnnnhn.exec:\nnnnhn.exe167⤵PID:3716
-
\??\c:\3jjpj.exec:\3jjpj.exe168⤵PID:412
-
\??\c:\jjdpp.exec:\jjdpp.exe169⤵PID:772
-
\??\c:\frrlfxx.exec:\frrlfxx.exe170⤵PID:1460
-
\??\c:\1rxxrrl.exec:\1rxxrrl.exe171⤵PID:1304
-
\??\c:\tnbbnn.exec:\tnbbnn.exe172⤵PID:4008
-
\??\c:\jjvjj.exec:\jjvjj.exe173⤵PID:3104
-
\??\c:\ffxrffr.exec:\ffxrffr.exe174⤵PID:3912
-
\??\c:\bhtnhn.exec:\bhtnhn.exe175⤵PID:3132
-
\??\c:\djjdv.exec:\djjdv.exe176⤵PID:1864
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe177⤵PID:1640
-
\??\c:\7nbbtb.exec:\7nbbtb.exe178⤵PID:4524
-
\??\c:\jdvjp.exec:\jdvjp.exe179⤵PID:3152
-
\??\c:\3jpjj.exec:\3jpjj.exe180⤵PID:2348
-
\??\c:\frfxrrx.exec:\frfxrrx.exe181⤵PID:824
-
\??\c:\9nhhbt.exec:\9nhhbt.exe182⤵PID:948
-
\??\c:\9hhhtt.exec:\9hhhtt.exe183⤵PID:4364
-
\??\c:\vpdvj.exec:\vpdvj.exe184⤵PID:400
-
\??\c:\djjdv.exec:\djjdv.exe185⤵PID:1212
-
\??\c:\rffrllf.exec:\rffrllf.exe186⤵PID:1612
-
\??\c:\1rxllfx.exec:\1rxllfx.exe187⤵PID:1816
-
\??\c:\tnnhbb.exec:\tnnhbb.exe188⤵PID:2968
-
\??\c:\bhbtnn.exec:\bhbtnn.exe189⤵PID:1036
-
\??\c:\vdvpd.exec:\vdvpd.exe190⤵PID:3292
-
\??\c:\pvdvj.exec:\pvdvj.exe191⤵PID:5072
-
\??\c:\9xrrrxr.exec:\9xrrrxr.exe192⤵PID:3620
-
\??\c:\hbttnn.exec:\hbttnn.exe193⤵PID:3584
-
\??\c:\tttbbt.exec:\tttbbt.exe194⤵PID:2668
-
\??\c:\pjvpd.exec:\pjvpd.exe195⤵PID:4476
-
\??\c:\ppjdv.exec:\ppjdv.exe196⤵PID:2716
-
\??\c:\rrflxlr.exec:\rrflxlr.exe197⤵PID:404
-
\??\c:\xrlflrl.exec:\xrlflrl.exe198⤵PID:4952
-
\??\c:\nbhhbb.exec:\nbhhbb.exe199⤵PID:5112
-
\??\c:\pjppj.exec:\pjppj.exe200⤵PID:5080
-
\??\c:\jppdv.exec:\jppdv.exe201⤵PID:4644
-
\??\c:\lllfffl.exec:\lllfffl.exe202⤵PID:4512
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe203⤵PID:3056
-
\??\c:\tttnbb.exec:\tttnbb.exe204⤵PID:3760
-
\??\c:\7tnnhn.exec:\7tnnhn.exe205⤵PID:2460
-
\??\c:\9vjdd.exec:\9vjdd.exe206⤵PID:1560
-
\??\c:\pdpjv.exec:\pdpjv.exe207⤵PID:1408
-
\??\c:\1llxlfx.exec:\1llxlfx.exe208⤵PID:4528
-
\??\c:\fxrxflf.exec:\fxrxflf.exe209⤵PID:2060
-
\??\c:\thnntt.exec:\thnntt.exe210⤵PID:1092
-
\??\c:\vjvpd.exec:\vjvpd.exe211⤵PID:2436
-
\??\c:\5jpjd.exec:\5jpjd.exe212⤵PID:3404
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe213⤵PID:4948
-
\??\c:\3rrlflf.exec:\3rrlflf.exe214⤵PID:1332
-
\??\c:\bnnhhh.exec:\bnnhhh.exe215⤵PID:1512
-
\??\c:\thbthh.exec:\thbthh.exe216⤵PID:2876
-
\??\c:\dddjd.exec:\dddjd.exe217⤵PID:3716
-
\??\c:\dvvpd.exec:\dvvpd.exe218⤵PID:1340
-
\??\c:\vjpjd.exec:\vjpjd.exe219⤵PID:2352
-
\??\c:\frrllff.exec:\frrllff.exe220⤵PID:1748
-
\??\c:\xlrxxxx.exec:\xlrxxxx.exe221⤵PID:3692
-
\??\c:\nntnbb.exec:\nntnbb.exe222⤵PID:3472
-
\??\c:\bnbbtn.exec:\bnbbtn.exe223⤵PID:880
-
\??\c:\dpvjd.exec:\dpvjd.exe224⤵PID:3228
-
\??\c:\3jjdv.exec:\3jjdv.exe225⤵PID:4408
-
\??\c:\xlxrfxr.exec:\xlxrfxr.exe226⤵PID:2812
-
\??\c:\rfxxrll.exec:\rfxxrll.exe227⤵PID:1640
-
\??\c:\tbbtnn.exec:\tbbtnn.exe228⤵PID:4524
-
\??\c:\thbthh.exec:\thbthh.exe229⤵PID:3152
-
\??\c:\pjvpd.exec:\pjvpd.exe230⤵PID:2348
-
\??\c:\7dpdv.exec:\7dpdv.exe231⤵PID:824
-
\??\c:\frlfrrl.exec:\frlfrrl.exe232⤵PID:4980
-
\??\c:\rxxrxxr.exec:\rxxrxxr.exe233⤵PID:4364
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe234⤵PID:3240
-
\??\c:\ntbhbt.exec:\ntbhbt.exe235⤵PID:2424
-
\??\c:\vdjdp.exec:\vdjdp.exe236⤵PID:4564
-
\??\c:\vjdvj.exec:\vjdvj.exe237⤵PID:864
-
\??\c:\jdjdd.exec:\jdjdd.exe238⤵PID:3196
-
\??\c:\lllfxrr.exec:\lllfxrr.exe239⤵PID:1060
-
\??\c:\fflxrfl.exec:\fflxrfl.exe240⤵PID:1940
-
\??\c:\tnnhbt.exec:\tnnhbt.exe241⤵PID:4104
-
\??\c:\nhhbnn.exec:\nhhbnn.exe242⤵PID:4704