Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:02
Behavioral task
behavioral1
Sample
0083f36a4304a775787e8af424e93160_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0083f36a4304a775787e8af424e93160_NeikiAnalytics.exe
-
Size
453KB
-
MD5
0083f36a4304a775787e8af424e93160
-
SHA1
10459c970e849d969838d2dc1860bc38906eaf97
-
SHA256
d9259af758934c54fb1696e15c6203f35abe91f0327f6a468f4de0cda86d8bdd
-
SHA512
85922c9df18f9fbb311c91c005a5062dce7e4af4c4fdd99fce00e93e2aa8cd447bd3aed0dc6f82a6c8c59e830f835a674b79d023e7e06561c3c89724482340f9
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNmr:x4wFHoS3eFaKHpv/VycgE81lgi
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4896-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5344-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5764-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5592-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5436-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/492-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/492-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/616-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/184-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5468-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5316-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2752-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2752-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6112-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2668-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/564-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5460-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6104-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5628-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5344-569-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5700-707-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbnhnt.exetnnhnh.exe5lrlrlf.exe3djdv.exerxxrllf.exerrfxxxr.exedpjjj.exeflxrlfx.exelfrlrrx.exethhhbb.exevjpjp.exeflfrlfx.exerrxrlff.exentnbnb.exebbnnbb.exexlrxrxl.exe3hbnnh.exexfrllff.exehnhnhb.exejjjjd.exe9bbbtt.exe1lrrfff.exenhbtnn.exelrllflf.exe1vvvp.exe1btttt.exevpdvj.exetbnhtt.exelfrlrfl.exevdddv.exefrrrrxx.exevdjdv.exebtnhbn.exetnhnhh.exenhtntn.exe7jpjd.exelxlflrl.exehbhbtn.exeddvpv.exerrxxrlx.exefrfxrlx.exe7nhbhn.exejjjdd.exerxlfxrr.exenbhtnn.exevpppp.exexrrrffx.exehbhhnb.exeddjdp.exe9fffxrx.exe7bhbhn.exepdjdv.exepdjdv.exe5rxrllf.exenbhbtt.exepjppj.exejdvpp.exelxxrlff.exenhtnnn.exejpjjd.exelfrrllf.exexfrlfff.exejdppv.exerrrlrxx.exepid process 2996 bbnhnt.exe 1556 tnnhnh.exe 4376 5lrlrlf.exe 2524 3djdv.exe 4932 rxxrllf.exe 2724 rrfxxxr.exe 5344 dpjjj.exe 5660 flxrlfx.exe 1764 lfrlrrx.exe 1572 thhhbb.exe 5212 vjpjp.exe 4580 flfrlfx.exe 4472 rrxrlff.exe 4260 ntnbnb.exe 4992 bbnnbb.exe 5764 xlrxrxl.exe 3196 3hbnnh.exe 3988 xfrllff.exe 4048 hnhnhb.exe 5064 jjjjd.exe 5592 9bbbtt.exe 1872 1lrrfff.exe 5436 nhbtnn.exe 492 lrllflf.exe 396 1vvvp.exe 616 1btttt.exe 3844 vpdvj.exe 2592 tbnhtt.exe 3260 lfrlrfl.exe 2236 vdddv.exe 2872 frrrrxx.exe 2232 vdjdv.exe 3948 btnhbn.exe 184 tnhnhh.exe 1540 nhtntn.exe 3472 7jpjd.exe 4724 lxlflrl.exe 2740 hbhbtn.exe 1388 ddvpv.exe 4388 rrxxrlx.exe 452 frfxrlx.exe 2912 7nhbhn.exe 4720 jjjdd.exe 5468 rxlfxrr.exe 2136 nbhtnn.exe 5008 vpppp.exe 5316 xrrrffx.exe 2004 hbhhnb.exe 2440 ddjdp.exe 2224 9fffxrx.exe 5160 7bhbhn.exe 2476 pdjdv.exe 3264 pdjdv.exe 3724 5rxrllf.exe 2752 nbhbtt.exe 6112 pjppj.exe 5236 jdvpp.exe 2844 lxxrlff.exe 1228 nhtnnn.exe 4804 jpjjd.exe 2668 lfrrllf.exe 644 xfrlfff.exe 4896 jdppv.exe 4416 rrrlrxx.exe -
Processes:
resource yara_rule behavioral2/memory/4896-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbnhnt.exe upx behavioral2/memory/4896-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2996-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnhnh.exe upx C:\5lrlrlf.exe upx behavioral2/memory/1556-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3djdv.exe upx behavioral2/memory/4376-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2524-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxxrllf.exe upx behavioral2/memory/4932-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrfxxxr.exe upx behavioral2/memory/4932-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2724-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpjjj.exe upx C:\flxrlfx.exe upx behavioral2/memory/5344-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfrlrrx.exe upx C:\thhhbb.exe upx C:\vjpjp.exe upx behavioral2/memory/1572-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flfrlfx.exe upx C:\rrxrlff.exe upx C:\ntnbnb.exe upx behavioral2/memory/4260-81-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbnnbb.exe upx behavioral2/memory/4472-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrxrxl.exe upx C:\3hbnnh.exe upx behavioral2/memory/5764-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3196-97-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hnhnhb.exe upx behavioral2/memory/4048-112-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjjjd.exe upx behavioral2/memory/3988-108-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xfrllff.exe upx C:\9bbbtt.exe upx C:\1lrrfff.exe upx behavioral2/memory/5592-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1872-127-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbtnn.exe upx behavioral2/memory/5436-135-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrllflf.exe upx behavioral2/memory/1872-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/492-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1vvvp.exe upx behavioral2/memory/492-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/396-149-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1btttt.exe upx behavioral2/memory/616-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpdvj.exe upx C:\tbnhtt.exe upx behavioral2/memory/3844-165-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfrlrfl.exe upx C:\vdddv.exe upx behavioral2/memory/3260-175-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frrrrxx.exe upx \??\c:\vdjdv.exe upx behavioral2/memory/2232-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2872-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/184-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1540-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1388-212-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0083f36a4304a775787e8af424e93160_NeikiAnalytics.exebbnhnt.exetnnhnh.exe5lrlrlf.exe3djdv.exerxxrllf.exerrfxxxr.exedpjjj.exeflxrlfx.exelfrlrrx.exethhhbb.exevjpjp.exeflfrlfx.exerrxrlff.exentnbnb.exebbnnbb.exexlrxrxl.exe3hbnnh.exexfrllff.exehnhnhb.exejjjjd.exe9bbbtt.exedescription pid process target process PID 4896 wrote to memory of 2996 4896 0083f36a4304a775787e8af424e93160_NeikiAnalytics.exe bbnhnt.exe PID 4896 wrote to memory of 2996 4896 0083f36a4304a775787e8af424e93160_NeikiAnalytics.exe bbnhnt.exe PID 4896 wrote to memory of 2996 4896 0083f36a4304a775787e8af424e93160_NeikiAnalytics.exe bbnhnt.exe PID 2996 wrote to memory of 1556 2996 bbnhnt.exe tnnhnh.exe PID 2996 wrote to memory of 1556 2996 bbnhnt.exe tnnhnh.exe PID 2996 wrote to memory of 1556 2996 bbnhnt.exe tnnhnh.exe PID 1556 wrote to memory of 4376 1556 tnnhnh.exe 5lrlrlf.exe PID 1556 wrote to memory of 4376 1556 tnnhnh.exe 5lrlrlf.exe PID 1556 wrote to memory of 4376 1556 tnnhnh.exe 5lrlrlf.exe PID 4376 wrote to memory of 2524 4376 5lrlrlf.exe 3djdv.exe PID 4376 wrote to memory of 2524 4376 5lrlrlf.exe 3djdv.exe PID 4376 wrote to memory of 2524 4376 5lrlrlf.exe 3djdv.exe PID 2524 wrote to memory of 4932 2524 3djdv.exe rxxrllf.exe PID 2524 wrote to memory of 4932 2524 3djdv.exe rxxrllf.exe PID 2524 wrote to memory of 4932 2524 3djdv.exe rxxrllf.exe PID 4932 wrote to memory of 2724 4932 rxxrllf.exe rrfxxxr.exe PID 4932 wrote to memory of 2724 4932 rxxrllf.exe rrfxxxr.exe PID 4932 wrote to memory of 2724 4932 rxxrllf.exe rrfxxxr.exe PID 2724 wrote to memory of 5344 2724 rrfxxxr.exe dpjjj.exe PID 2724 wrote to memory of 5344 2724 rrfxxxr.exe dpjjj.exe PID 2724 wrote to memory of 5344 2724 rrfxxxr.exe dpjjj.exe PID 5344 wrote to memory of 5660 5344 dpjjj.exe flxrlfx.exe PID 5344 wrote to memory of 5660 5344 dpjjj.exe flxrlfx.exe PID 5344 wrote to memory of 5660 5344 dpjjj.exe flxrlfx.exe PID 5660 wrote to memory of 1764 5660 flxrlfx.exe lfrlrrx.exe PID 5660 wrote to memory of 1764 5660 flxrlfx.exe lfrlrrx.exe PID 5660 wrote to memory of 1764 5660 flxrlfx.exe lfrlrrx.exe PID 1764 wrote to memory of 1572 1764 lfrlrrx.exe thhhbb.exe PID 1764 wrote to memory of 1572 1764 lfrlrrx.exe thhhbb.exe PID 1764 wrote to memory of 1572 1764 lfrlrrx.exe thhhbb.exe PID 1572 wrote to memory of 5212 1572 thhhbb.exe vjpjp.exe PID 1572 wrote to memory of 5212 1572 thhhbb.exe vjpjp.exe PID 1572 wrote to memory of 5212 1572 thhhbb.exe vjpjp.exe PID 5212 wrote to memory of 4580 5212 vjpjp.exe flfrlfx.exe PID 5212 wrote to memory of 4580 5212 vjpjp.exe flfrlfx.exe PID 5212 wrote to memory of 4580 5212 vjpjp.exe flfrlfx.exe PID 4580 wrote to memory of 4472 4580 flfrlfx.exe rrxrlff.exe PID 4580 wrote to memory of 4472 4580 flfrlfx.exe rrxrlff.exe PID 4580 wrote to memory of 4472 4580 flfrlfx.exe rrxrlff.exe PID 4472 wrote to memory of 4260 4472 rrxrlff.exe ntnbnb.exe PID 4472 wrote to memory of 4260 4472 rrxrlff.exe ntnbnb.exe PID 4472 wrote to memory of 4260 4472 rrxrlff.exe ntnbnb.exe PID 4260 wrote to memory of 4992 4260 ntnbnb.exe bbnnbb.exe PID 4260 wrote to memory of 4992 4260 ntnbnb.exe bbnnbb.exe PID 4260 wrote to memory of 4992 4260 ntnbnb.exe bbnnbb.exe PID 4992 wrote to memory of 5764 4992 bbnnbb.exe xlrxrxl.exe PID 4992 wrote to memory of 5764 4992 bbnnbb.exe xlrxrxl.exe PID 4992 wrote to memory of 5764 4992 bbnnbb.exe xlrxrxl.exe PID 5764 wrote to memory of 3196 5764 xlrxrxl.exe 3hbnnh.exe PID 5764 wrote to memory of 3196 5764 xlrxrxl.exe 3hbnnh.exe PID 5764 wrote to memory of 3196 5764 xlrxrxl.exe 3hbnnh.exe PID 3196 wrote to memory of 3988 3196 3hbnnh.exe xfrllff.exe PID 3196 wrote to memory of 3988 3196 3hbnnh.exe xfrllff.exe PID 3196 wrote to memory of 3988 3196 3hbnnh.exe xfrllff.exe PID 3988 wrote to memory of 4048 3988 xfrllff.exe hnhnhb.exe PID 3988 wrote to memory of 4048 3988 xfrllff.exe hnhnhb.exe PID 3988 wrote to memory of 4048 3988 xfrllff.exe hnhnhb.exe PID 4048 wrote to memory of 5064 4048 hnhnhb.exe jjjjd.exe PID 4048 wrote to memory of 5064 4048 hnhnhb.exe jjjjd.exe PID 4048 wrote to memory of 5064 4048 hnhnhb.exe jjjjd.exe PID 5064 wrote to memory of 5592 5064 jjjjd.exe 9bbbtt.exe PID 5064 wrote to memory of 5592 5064 jjjjd.exe 9bbbtt.exe PID 5064 wrote to memory of 5592 5064 jjjjd.exe 9bbbtt.exe PID 5592 wrote to memory of 1872 5592 9bbbtt.exe 1lrrfff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0083f36a4304a775787e8af424e93160_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0083f36a4304a775787e8af424e93160_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\bbnhnt.exec:\bbnhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\tnnhnh.exec:\tnnhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\5lrlrlf.exec:\5lrlrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\3djdv.exec:\3djdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\rxxrllf.exec:\rxxrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\dpjjj.exec:\dpjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
\??\c:\flxrlfx.exec:\flxrlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\thhhbb.exec:\thhhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\vjpjp.exec:\vjpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
\??\c:\flfrlfx.exec:\flfrlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\rrxrlff.exec:\rrxrlff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\ntnbnb.exec:\ntnbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\bbnnbb.exec:\bbnnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\xlrxrxl.exec:\xlrxrxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
\??\c:\3hbnnh.exec:\3hbnnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\xfrllff.exec:\xfrllff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\hnhnhb.exec:\hnhnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\jjjjd.exec:\jjjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\9bbbtt.exec:\9bbbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
\??\c:\1lrrfff.exec:\1lrrfff.exe23⤵
- Executes dropped EXE
PID:1872 -
\??\c:\nhbtnn.exec:\nhbtnn.exe24⤵
- Executes dropped EXE
PID:5436 -
\??\c:\lrllflf.exec:\lrllflf.exe25⤵
- Executes dropped EXE
PID:492 -
\??\c:\1vvvp.exec:\1vvvp.exe26⤵
- Executes dropped EXE
PID:396 -
\??\c:\1btttt.exec:\1btttt.exe27⤵
- Executes dropped EXE
PID:616 -
\??\c:\vpdvj.exec:\vpdvj.exe28⤵
- Executes dropped EXE
PID:3844 -
\??\c:\tbnhtt.exec:\tbnhtt.exe29⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lfrlrfl.exec:\lfrlrfl.exe30⤵
- Executes dropped EXE
PID:3260 -
\??\c:\vdddv.exec:\vdddv.exe31⤵
- Executes dropped EXE
PID:2236 -
\??\c:\frrrrxx.exec:\frrrrxx.exe32⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vdjdv.exec:\vdjdv.exe33⤵
- Executes dropped EXE
PID:2232 -
\??\c:\btnhbn.exec:\btnhbn.exe34⤵
- Executes dropped EXE
PID:3948 -
\??\c:\tnhnhh.exec:\tnhnhh.exe35⤵
- Executes dropped EXE
PID:184 -
\??\c:\nhtntn.exec:\nhtntn.exe36⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7jpjd.exec:\7jpjd.exe37⤵
- Executes dropped EXE
PID:3472 -
\??\c:\lxlflrl.exec:\lxlflrl.exe38⤵
- Executes dropped EXE
PID:4724 -
\??\c:\hbhbtn.exec:\hbhbtn.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ddvpv.exec:\ddvpv.exe40⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rrxxrlx.exec:\rrxxrlx.exe41⤵
- Executes dropped EXE
PID:4388 -
\??\c:\frfxrlx.exec:\frfxrlx.exe42⤵
- Executes dropped EXE
PID:452 -
\??\c:\7nhbhn.exec:\7nhbhn.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jjjdd.exec:\jjjdd.exe44⤵
- Executes dropped EXE
PID:4720 -
\??\c:\rxlfxrr.exec:\rxlfxrr.exe45⤵
- Executes dropped EXE
PID:5468 -
\??\c:\nbhtnn.exec:\nbhtnn.exe46⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vpppp.exec:\vpppp.exe47⤵
- Executes dropped EXE
PID:5008 -
\??\c:\xrrrffx.exec:\xrrrffx.exe48⤵
- Executes dropped EXE
PID:5316 -
\??\c:\hbhhnb.exec:\hbhhnb.exe49⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ddjdp.exec:\ddjdp.exe50⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9fffxrx.exec:\9fffxrx.exe51⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7bhbhn.exec:\7bhbhn.exe52⤵
- Executes dropped EXE
PID:5160 -
\??\c:\pdjdv.exec:\pdjdv.exe53⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pdjdv.exec:\pdjdv.exe54⤵
- Executes dropped EXE
PID:3264 -
\??\c:\5rxrllf.exec:\5rxrllf.exe55⤵
- Executes dropped EXE
PID:3724 -
\??\c:\nbhbtt.exec:\nbhbtt.exe56⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pjppj.exec:\pjppj.exe57⤵
- Executes dropped EXE
PID:6112 -
\??\c:\jdvpp.exec:\jdvpp.exe58⤵
- Executes dropped EXE
PID:5236 -
\??\c:\lxxrlff.exec:\lxxrlff.exe59⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nhtnnn.exec:\nhtnnn.exe60⤵
- Executes dropped EXE
PID:1228 -
\??\c:\jpjjd.exec:\jpjjd.exe61⤵
- Executes dropped EXE
PID:4804 -
\??\c:\lfrrllf.exec:\lfrrllf.exe62⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xfrlfff.exec:\xfrlfff.exe63⤵
- Executes dropped EXE
PID:644 -
\??\c:\1jpjj.exec:\1jpjj.exe64⤵PID:2296
-
\??\c:\jdppv.exec:\jdppv.exe65⤵
- Executes dropped EXE
PID:4896 -
\??\c:\rrrlrxx.exec:\rrrlrxx.exe66⤵
- Executes dropped EXE
PID:4416 -
\??\c:\nnnnbt.exec:\nnnnbt.exe67⤵PID:3372
-
\??\c:\jdjdv.exec:\jdjdv.exe68⤵PID:1556
-
\??\c:\rlxxffr.exec:\rlxxffr.exe69⤵PID:4376
-
\??\c:\5hhbbb.exec:\5hhbbb.exe70⤵PID:5116
-
\??\c:\pdpvd.exec:\pdpvd.exe71⤵PID:1272
-
\??\c:\rlrlffx.exec:\rlrlffx.exe72⤵PID:1140
-
\??\c:\bhhbbt.exec:\bhhbbt.exe73⤵PID:2724
-
\??\c:\7ttnhh.exec:\7ttnhh.exe74⤵PID:3860
-
\??\c:\jjvpp.exec:\jjvpp.exe75⤵PID:4404
-
\??\c:\fxllfff.exec:\fxllfff.exe76⤵PID:4448
-
\??\c:\bbtnnb.exec:\bbtnnb.exe77⤵PID:5660
-
\??\c:\dpjdv.exec:\dpjdv.exe78⤵PID:3816
-
\??\c:\9xfxrrr.exec:\9xfxrrr.exe79⤵PID:1076
-
\??\c:\tbnttb.exec:\tbnttb.exe80⤵PID:1124
-
\??\c:\nbnhhh.exec:\nbnhhh.exe81⤵PID:5020
-
\??\c:\jjjdd.exec:\jjjdd.exe82⤵PID:1936
-
\??\c:\3lrrlrx.exec:\3lrrlrx.exe83⤵PID:1896
-
\??\c:\hbtnbb.exec:\hbtnbb.exe84⤵PID:5680
-
\??\c:\dvvjd.exec:\dvvjd.exe85⤵PID:5712
-
\??\c:\jdppp.exec:\jdppp.exe86⤵PID:2044
-
\??\c:\5lrllrr.exec:\5lrllrr.exe87⤵PID:4876
-
\??\c:\bthbbn.exec:\bthbbn.exe88⤵PID:3924
-
\??\c:\jvjpd.exec:\jvjpd.exe89⤵PID:5372
-
\??\c:\jppjd.exec:\jppjd.exe90⤵PID:5640
-
\??\c:\llllflf.exec:\llllflf.exe91⤵PID:2324
-
\??\c:\htbtnn.exec:\htbtnn.exe92⤵PID:2516
-
\??\c:\5jjpp.exec:\5jjpp.exe93⤵PID:5596
-
\??\c:\jdvpp.exec:\jdvpp.exe94⤵PID:5688
-
\??\c:\rlrlffx.exec:\rlrlffx.exe95⤵PID:840
-
\??\c:\ttthbt.exec:\ttthbt.exe96⤵PID:1872
-
\??\c:\ppdpd.exec:\ppdpd.exe97⤵PID:2340
-
\??\c:\rlllfff.exec:\rlllfff.exe98⤵PID:5132
-
\??\c:\lrxxrrf.exec:\lrxxrrf.exe99⤵PID:564
-
\??\c:\htttnb.exec:\htttnb.exe100⤵PID:2696
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe101⤵PID:5904
-
\??\c:\hthbnh.exec:\hthbnh.exe102⤵PID:2684
-
\??\c:\3hhhbt.exec:\3hhhbt.exe103⤵PID:2432
-
\??\c:\jddvp.exec:\jddvp.exe104⤵PID:3496
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe105⤵PID:3628
-
\??\c:\lffrllf.exec:\lffrllf.exe106⤵PID:5520
-
\??\c:\9bbtnn.exec:\9bbtnn.exe107⤵PID:5004
-
\??\c:\jjjdp.exec:\jjjdp.exe108⤵PID:1528
-
\??\c:\flfrrlf.exec:\flfrrlf.exe109⤵PID:1532
-
\??\c:\7bttnt.exec:\7bttnt.exe110⤵PID:1748
-
\??\c:\bnhbbt.exec:\bnhbbt.exe111⤵PID:752
-
\??\c:\vpppj.exec:\vpppj.exe112⤵PID:3080
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe113⤵PID:5460
-
\??\c:\bhtnnh.exec:\bhtnnh.exe114⤵PID:2812
-
\??\c:\ppjjd.exec:\ppjjd.exe115⤵PID:4732
-
\??\c:\fflxrrr.exec:\fflxrrr.exe116⤵PID:1848
-
\??\c:\btbhtb.exec:\btbhtb.exe117⤵PID:3176
-
\??\c:\hbhbbb.exec:\hbhbbb.exe118⤵PID:3028
-
\??\c:\dvpjd.exec:\dvpjd.exe119⤵PID:1360
-
\??\c:\3rlfxfx.exec:\3rlfxfx.exe120⤵PID:2968
-
\??\c:\tnnhbb.exec:\tnnhbb.exe121⤵PID:5192
-
\??\c:\vpvpj.exec:\vpvpj.exe122⤵PID:4692
-
\??\c:\5ffrrfx.exec:\5ffrrfx.exe123⤵PID:5480
-
\??\c:\tbtnhh.exec:\tbtnhh.exe124⤵PID:5288
-
\??\c:\bhnttn.exec:\bhnttn.exe125⤵PID:1608
-
\??\c:\jpppj.exec:\jpppj.exe126⤵PID:3172
-
\??\c:\lxfffff.exec:\lxfffff.exe127⤵PID:3896
-
\??\c:\ttthhn.exec:\ttthhn.exe128⤵PID:5348
-
\??\c:\dvvpj.exec:\dvvpj.exe129⤵PID:5236
-
\??\c:\xfffffl.exec:\xfffffl.exe130⤵PID:3592
-
\??\c:\xrrllrr.exec:\xrrllrr.exe131⤵PID:6104
-
\??\c:\bbthbn.exec:\bbthbn.exe132⤵PID:2160
-
\??\c:\ppvpp.exec:\ppvpp.exe133⤵PID:4788
-
\??\c:\flffffx.exec:\flffffx.exe134⤵PID:3804
-
\??\c:\bnnhnh.exec:\bnnhnh.exe135⤵PID:4292
-
\??\c:\jvjdv.exec:\jvjdv.exe136⤵PID:4608
-
\??\c:\jdjdd.exec:\jdjdd.exe137⤵PID:4136
-
\??\c:\xfxxlfr.exec:\xfxxlfr.exe138⤵PID:4204
-
\??\c:\5htnhh.exec:\5htnhh.exe139⤵PID:1356
-
\??\c:\nhnhbb.exec:\nhnhbb.exe140⤵PID:4408
-
\??\c:\1vddp.exec:\1vddp.exe141⤵PID:5012
-
\??\c:\rxrrxxf.exec:\rxrrxxf.exe142⤵PID:1196
-
\??\c:\btnhbt.exec:\btnhbt.exe143⤵PID:936
-
\??\c:\thtttb.exec:\thtttb.exe144⤵PID:5628
-
\??\c:\djvdd.exec:\djvdd.exe145⤵PID:4176
-
\??\c:\lxffxxf.exec:\lxffxxf.exe146⤵PID:5344
-
\??\c:\btnhhn.exec:\btnhhn.exe147⤵PID:6024
-
\??\c:\3pvdd.exec:\3pvdd.exe148⤵PID:1432
-
\??\c:\xrlxxrr.exec:\xrlxxrr.exe149⤵PID:5376
-
\??\c:\xfxrrll.exec:\xfxrrll.exe150⤵PID:4328
-
\??\c:\7hbtbh.exec:\7hbtbh.exe151⤵PID:4916
-
\??\c:\jddvj.exec:\jddvj.exe152⤵PID:2932
-
\??\c:\lflffff.exec:\lflffff.exe153⤵PID:2376
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe154⤵PID:5020
-
\??\c:\hntttt.exec:\hntttt.exe155⤵PID:1936
-
\??\c:\jjpvp.exec:\jjpvp.exe156⤵PID:2596
-
\??\c:\vpdvp.exec:\vpdvp.exe157⤵PID:4348
-
\??\c:\lfllxxx.exec:\lfllxxx.exe158⤵PID:4992
-
\??\c:\hhnbbb.exec:\hhnbbb.exe159⤵PID:3020
-
\??\c:\pdjdv.exec:\pdjdv.exe160⤵PID:4876
-
\??\c:\djjvp.exec:\djjvp.exe161⤵PID:2820
-
\??\c:\rlfxlll.exec:\rlfxlll.exe162⤵PID:5576
-
\??\c:\tttttb.exec:\tttttb.exe163⤵PID:5112
-
\??\c:\tnbhhh.exec:\tnbhhh.exe164⤵PID:2516
-
\??\c:\5jjjj.exec:\5jjjj.exe165⤵PID:5672
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe166⤵PID:1408
-
\??\c:\lfffxxr.exec:\lfffxxr.exe167⤵PID:1460
-
\??\c:\3tbbbb.exec:\3tbbbb.exe168⤵PID:2744
-
\??\c:\vpddd.exec:\vpddd.exe169⤵PID:392
-
\??\c:\xlrllll.exec:\xlrllll.exe170⤵PID:660
-
\??\c:\xrxlfrl.exec:\xrxlfrl.exe171⤵PID:1584
-
\??\c:\hnnhtt.exec:\hnnhtt.exe172⤵PID:2720
-
\??\c:\ppjpv.exec:\ppjpv.exe173⤵PID:3364
-
\??\c:\lfxrrlf.exec:\lfxrrlf.exe174⤵PID:948
-
\??\c:\xxrfxrl.exec:\xxrfxrl.exe175⤵PID:3480
-
\??\c:\ntbtnh.exec:\ntbtnh.exe176⤵PID:2236
-
\??\c:\vpppj.exec:\vpppj.exe177⤵PID:5356
-
\??\c:\9fxrlrl.exec:\9fxrlrl.exe178⤵PID:5888
-
\??\c:\hbnhhb.exec:\hbnhhb.exe179⤵PID:1528
-
\??\c:\7vpdv.exec:\7vpdv.exe180⤵PID:1532
-
\??\c:\vppjd.exec:\vppjd.exe181⤵PID:3760
-
\??\c:\3lrrlxr.exec:\3lrrlxr.exe182⤵PID:4600
-
\??\c:\tbnnbh.exec:\tbnnbh.exe183⤵PID:880
-
\??\c:\jdpdp.exec:\jdpdp.exe184⤵PID:3080
-
\??\c:\5dvjd.exec:\5dvjd.exe185⤵PID:2200
-
\??\c:\9rflffx.exec:\9rflffx.exe186⤵PID:4696
-
\??\c:\bbnhnn.exec:\bbnhnn.exe187⤵PID:3272
-
\??\c:\dpjdp.exec:\dpjdp.exe188⤵PID:2056
-
\??\c:\dvvpp.exec:\dvvpp.exe189⤵PID:5716
-
\??\c:\xxlflll.exec:\xxlflll.exe190⤵PID:2664
-
\??\c:\hthhbb.exec:\hthhbb.exe191⤵PID:2440
-
\??\c:\jvjdv.exec:\jvjdv.exe192⤵PID:5700
-
\??\c:\rrlfrrl.exec:\rrlfrrl.exe193⤵PID:3992
-
\??\c:\htnhnh.exec:\htnhnh.exe194⤵PID:4516
-
\??\c:\btthbt.exec:\btthbt.exe195⤵PID:1868
-
\??\c:\pjjjv.exec:\pjjjv.exe196⤵PID:1144
-
\??\c:\llxxrll.exec:\llxxrll.exe197⤵PID:5652
-
\??\c:\hthhhn.exec:\hthhhn.exe198⤵PID:6112
-
\??\c:\tttbth.exec:\tttbth.exe199⤵PID:6128
-
\??\c:\pvvpj.exec:\pvvpj.exe200⤵PID:5944
-
\??\c:\xlxlffx.exec:\xlxlffx.exe201⤵PID:408
-
\??\c:\ntbtnn.exec:\ntbtnn.exe202⤵PID:6060
-
\??\c:\7htbtn.exec:\7htbtn.exe203⤵PID:2532
-
\??\c:\7dvvp.exec:\7dvvp.exe204⤵PID:4476
-
\??\c:\rlxlllr.exec:\rlxlllr.exe205⤵PID:4140
-
\??\c:\bbnhhh.exec:\bbnhhh.exe206⤵PID:2648
-
\??\c:\tthttn.exec:\tthttn.exe207⤵PID:4468
-
\??\c:\vpvpp.exec:\vpvpp.exe208⤵PID:3900
-
\??\c:\rlxrrrf.exec:\rlxrrrf.exe209⤵PID:5056
-
\??\c:\flllffx.exec:\flllffx.exe210⤵PID:4408
-
\??\c:\bbhbnn.exec:\bbhbnn.exe211⤵PID:5012
-
\??\c:\djvjj.exec:\djvjj.exe212⤵PID:1272
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe213⤵PID:1140
-
\??\c:\xxrrrrx.exec:\xxrrrrx.exe214⤵PID:5324
-
\??\c:\nbbtnh.exec:\nbbtnh.exe215⤵PID:3860
-
\??\c:\jjppp.exec:\jjppp.exe216⤵PID:1064
-
\??\c:\7vvpj.exec:\7vvpj.exe217⤵PID:4276
-
\??\c:\xrlfrrx.exec:\xrlfrrx.exe218⤵PID:1900
-
\??\c:\9bbtnn.exec:\9bbtnn.exe219⤵PID:4940
-
\??\c:\nbthhn.exec:\nbthhn.exe220⤵PID:5148
-
\??\c:\dvpjd.exec:\dvpjd.exe221⤵PID:4976
-
\??\c:\flrlfff.exec:\flrlfff.exe222⤵PID:556
-
\??\c:\xllfxxr.exec:\xllfxxr.exe223⤵PID:2092
-
\??\c:\hhnhtn.exec:\hhnhtn.exe224⤵PID:444
-
\??\c:\jddvp.exec:\jddvp.exe225⤵PID:4348
-
\??\c:\9pvpp.exec:\9pvpp.exe226⤵PID:4992
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe227⤵PID:3756
-
\??\c:\hhtbnb.exec:\hhtbnb.exe228⤵PID:5372
-
\??\c:\pvvvp.exec:\pvvvp.exe229⤵PID:5584
-
\??\c:\1ffxrll.exec:\1ffxrll.exe230⤵PID:5576
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe231⤵PID:5112
-
\??\c:\bnttnt.exec:\bnttnt.exe232⤵PID:2516
-
\??\c:\jdvpd.exec:\jdvpd.exe233⤵PID:5672
-
\??\c:\lfxrlxr.exec:\lfxrlxr.exe234⤵PID:1924
-
\??\c:\fxrrffx.exec:\fxrrffx.exe235⤵PID:3512
-
\??\c:\tbntnh.exec:\tbntnh.exe236⤵PID:396
-
\??\c:\djpdv.exec:\djpdv.exe237⤵PID:4968
-
\??\c:\rlrfrlx.exec:\rlrfrlx.exe238⤵PID:660
-
\??\c:\1lrlxfx.exec:\1lrlxfx.exe239⤵PID:5556
-
\??\c:\htbtnn.exec:\htbtnn.exe240⤵PID:2592
-
\??\c:\ddjjv.exec:\ddjjv.exe241⤵PID:4056
-
\??\c:\5vpjd.exec:\5vpjd.exe242⤵PID:2972