Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:41
Behavioral task
behavioral1
Sample
d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe
-
Size
537KB
-
MD5
d9816cf137b90efe6e891ab6a5013460
-
SHA1
1ac2b693f0657bba730250e2112920cd2e6426db
-
SHA256
797f5849d1a0363ad742a9f1fa1424a83700db2c9cfa56e9a6093ba864c6512c
-
SHA512
29ba28d3afb57c559a8cacdc62de1b41df0012e8c9e71a322529170624b52223d0a90c62d6ace0f73bbde98ac9471b764a28fe55856374eff60f8fec040dc752
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZR:HFp3lzZbGa5soR
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2028-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3832-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/988-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/672-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1288-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1876-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-558-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-651-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-726-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-784-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpdjj.exerllxxxr.exebtbbtn.exedvdpj.exehhbtnn.exerrrllfx.exehbhnhb.exevddjp.exelffxfxf.exehthnbb.exedddjj.exerrxxxrl.exexxlllff.exe3hnhbb.exetnhhnn.exe7vvjj.exefrxxrrl.exefrlrlrl.exedpddv.exe3nnbbb.exe1vjvv.exe5lrlrrx.exelxfxrlf.exedjddp.exe3lfxxxx.exebnhhbb.exefxxxrrl.exelffxxfx.exettttnn.exelxfrxxf.exebnnhbt.exevpddv.exe5hhbnn.exerxllflf.exe1tbtnn.exejddvp.exexrllfxr.exehtbbtn.exedpvpj.exerrllfff.exetbhhbb.exepvpjp.exelxlfxff.exexxxxrrr.exebtnhhh.exe1jjdv.exexrrllfr.exelrfxlfr.exebhnhnn.exe1pdvp.exerfffffx.exehthbtn.exetttnhh.exe1dpjd.exerrxxfrr.exe1fllflx.exedvpjp.exevjpjd.exexxllrrx.exetttbtb.exebhnhhb.exepddjj.exexrfxrlf.exehnbtnn.exepid process 228 vpdjj.exe 4812 rllxxxr.exe 3036 btbbtn.exe 4160 dvdpj.exe 3832 hhbtnn.exe 1720 rrrllfx.exe 2520 hbhnhb.exe 944 vddjp.exe 2240 lffxfxf.exe 4816 hthnbb.exe 3380 dddjj.exe 4696 rrxxxrl.exe 1448 xxlllff.exe 4828 3hnhbb.exe 460 tnhhnn.exe 3596 7vvjj.exe 3856 frxxrrl.exe 2444 frlrlrl.exe 4396 dpddv.exe 2328 3nnbbb.exe 712 1vjvv.exe 3808 5lrlrrx.exe 3292 lxfxrlf.exe 3692 djddp.exe 4164 3lfxxxx.exe 3076 bnhhbb.exe 4280 fxxxrrl.exe 1356 lffxxfx.exe 636 ttttnn.exe 4932 lxfrxxf.exe 3980 bnnhbt.exe 2440 vpddv.exe 4288 5hhbnn.exe 3456 rxllflf.exe 8 1tbtnn.exe 4432 jddvp.exe 232 xrllfxr.exe 3240 htbbtn.exe 220 dpvpj.exe 3036 rrllfff.exe 3016 tbhhbb.exe 1604 pvpjp.exe 1520 lxlfxff.exe 2012 xxxxrrr.exe 4860 btnhhh.exe 3132 1jjdv.exe 3288 xrrllfr.exe 5100 lrfxlfr.exe 1644 bhnhnn.exe 3656 1pdvp.exe 1504 rfffffx.exe 5084 hthbtn.exe 3380 tttnhh.exe 872 1dpjd.exe 4696 rrxxfrr.exe 4940 1fllflx.exe 3904 dvpjp.exe 4828 vjpjd.exe 3536 xxllrrx.exe 64 tttbtb.exe 776 bhnhhb.exe 3696 pddjj.exe 3932 xrfxrlf.exe 1800 hnbtnn.exe -
Processes:
resource yara_rule behavioral2/memory/2028-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpdjj.exe upx behavioral2/memory/2028-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/228-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rllxxxr.exe upx C:\btbbtn.exe upx behavioral2/memory/4812-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3036-18-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvdpj.exe upx behavioral2/memory/4160-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhbtnn.exe upx \??\c:\rrrllfx.exe upx C:\hbhnhb.exe upx behavioral2/memory/2520-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vddjp.exe upx behavioral2/memory/944-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1720-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3832-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lffxfxf.exe upx behavioral2/memory/2240-56-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hthnbb.exe upx behavioral2/memory/2240-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4816-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/944-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddjj.exe upx behavioral2/memory/4816-68-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrxxxrl.exe upx behavioral2/memory/3380-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4696-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4696-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlllff.exe upx C:\3hnhbb.exe upx behavioral2/memory/4828-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1448-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4828-93-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnhhnn.exe upx behavioral2/memory/460-97-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7vvjj.exe upx behavioral2/memory/3596-107-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\frlrlrl.exe upx behavioral2/memory/3856-111-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\frxxrrl.exe upx behavioral2/memory/2444-114-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpddv.exe upx C:\3nnbbb.exe upx behavioral2/memory/2328-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1vjvv.exe upx C:\5lrlrrx.exe upx \??\c:\lxfxrlf.exe upx behavioral2/memory/3292-142-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djddp.exe upx C:\3lfxxxx.exe upx behavioral2/memory/3692-150-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnhhbb.exe upx \??\c:\fxxxrrl.exe upx C:\lffxxfx.exe upx C:\ttttnn.exe upx C:\lxfrxxf.exe upx behavioral2/memory/636-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4932-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnnhbt.exe upx behavioral2/memory/3980-188-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpddv.exe upx behavioral2/memory/2440-194-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exevpdjj.exerllxxxr.exebtbbtn.exedvdpj.exehhbtnn.exerrrllfx.exehbhnhb.exevddjp.exelffxfxf.exehthnbb.exedddjj.exerrxxxrl.exexxlllff.exe3hnhbb.exetnhhnn.exe7vvjj.exefrxxrrl.exefrlrlrl.exedpddv.exe3nnbbb.exe1vjvv.exedescription pid process target process PID 2028 wrote to memory of 228 2028 d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe vpdjj.exe PID 2028 wrote to memory of 228 2028 d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe vpdjj.exe PID 2028 wrote to memory of 228 2028 d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe vpdjj.exe PID 228 wrote to memory of 4812 228 vpdjj.exe rllxxxr.exe PID 228 wrote to memory of 4812 228 vpdjj.exe rllxxxr.exe PID 228 wrote to memory of 4812 228 vpdjj.exe rllxxxr.exe PID 4812 wrote to memory of 3036 4812 rllxxxr.exe btbbtn.exe PID 4812 wrote to memory of 3036 4812 rllxxxr.exe btbbtn.exe PID 4812 wrote to memory of 3036 4812 rllxxxr.exe btbbtn.exe PID 3036 wrote to memory of 4160 3036 btbbtn.exe dvdpj.exe PID 3036 wrote to memory of 4160 3036 btbbtn.exe dvdpj.exe PID 3036 wrote to memory of 4160 3036 btbbtn.exe dvdpj.exe PID 4160 wrote to memory of 3832 4160 dvdpj.exe hhbtnn.exe PID 4160 wrote to memory of 3832 4160 dvdpj.exe hhbtnn.exe PID 4160 wrote to memory of 3832 4160 dvdpj.exe hhbtnn.exe PID 3832 wrote to memory of 1720 3832 hhbtnn.exe rrrllfx.exe PID 3832 wrote to memory of 1720 3832 hhbtnn.exe rrrllfx.exe PID 3832 wrote to memory of 1720 3832 hhbtnn.exe rrrllfx.exe PID 1720 wrote to memory of 2520 1720 rrrllfx.exe hbhnhb.exe PID 1720 wrote to memory of 2520 1720 rrrllfx.exe hbhnhb.exe PID 1720 wrote to memory of 2520 1720 rrrllfx.exe hbhnhb.exe PID 2520 wrote to memory of 944 2520 hbhnhb.exe vddjp.exe PID 2520 wrote to memory of 944 2520 hbhnhb.exe vddjp.exe PID 2520 wrote to memory of 944 2520 hbhnhb.exe vddjp.exe PID 944 wrote to memory of 2240 944 vddjp.exe lffxfxf.exe PID 944 wrote to memory of 2240 944 vddjp.exe lffxfxf.exe PID 944 wrote to memory of 2240 944 vddjp.exe lffxfxf.exe PID 2240 wrote to memory of 4816 2240 lffxfxf.exe hthnbb.exe PID 2240 wrote to memory of 4816 2240 lffxfxf.exe hthnbb.exe PID 2240 wrote to memory of 4816 2240 lffxfxf.exe hthnbb.exe PID 4816 wrote to memory of 3380 4816 hthnbb.exe dddjj.exe PID 4816 wrote to memory of 3380 4816 hthnbb.exe dddjj.exe PID 4816 wrote to memory of 3380 4816 hthnbb.exe dddjj.exe PID 3380 wrote to memory of 4696 3380 dddjj.exe rrxxxrl.exe PID 3380 wrote to memory of 4696 3380 dddjj.exe rrxxxrl.exe PID 3380 wrote to memory of 4696 3380 dddjj.exe rrxxxrl.exe PID 4696 wrote to memory of 1448 4696 rrxxxrl.exe xxlllff.exe PID 4696 wrote to memory of 1448 4696 rrxxxrl.exe xxlllff.exe PID 4696 wrote to memory of 1448 4696 rrxxxrl.exe xxlllff.exe PID 1448 wrote to memory of 4828 1448 xxlllff.exe 3hnhbb.exe PID 1448 wrote to memory of 4828 1448 xxlllff.exe 3hnhbb.exe PID 1448 wrote to memory of 4828 1448 xxlllff.exe 3hnhbb.exe PID 4828 wrote to memory of 460 4828 3hnhbb.exe tnhhnn.exe PID 4828 wrote to memory of 460 4828 3hnhbb.exe tnhhnn.exe PID 4828 wrote to memory of 460 4828 3hnhbb.exe tnhhnn.exe PID 460 wrote to memory of 3596 460 tnhhnn.exe 7vvjj.exe PID 460 wrote to memory of 3596 460 tnhhnn.exe 7vvjj.exe PID 460 wrote to memory of 3596 460 tnhhnn.exe 7vvjj.exe PID 3596 wrote to memory of 3856 3596 7vvjj.exe frxxrrl.exe PID 3596 wrote to memory of 3856 3596 7vvjj.exe frxxrrl.exe PID 3596 wrote to memory of 3856 3596 7vvjj.exe frxxrrl.exe PID 3856 wrote to memory of 2444 3856 frxxrrl.exe frlrlrl.exe PID 3856 wrote to memory of 2444 3856 frxxrrl.exe frlrlrl.exe PID 3856 wrote to memory of 2444 3856 frxxrrl.exe frlrlrl.exe PID 2444 wrote to memory of 4396 2444 frlrlrl.exe dpddv.exe PID 2444 wrote to memory of 4396 2444 frlrlrl.exe dpddv.exe PID 2444 wrote to memory of 4396 2444 frlrlrl.exe dpddv.exe PID 4396 wrote to memory of 2328 4396 dpddv.exe 3nnbbb.exe PID 4396 wrote to memory of 2328 4396 dpddv.exe 3nnbbb.exe PID 4396 wrote to memory of 2328 4396 dpddv.exe 3nnbbb.exe PID 2328 wrote to memory of 712 2328 3nnbbb.exe 1vjvv.exe PID 2328 wrote to memory of 712 2328 3nnbbb.exe 1vjvv.exe PID 2328 wrote to memory of 712 2328 3nnbbb.exe 1vjvv.exe PID 712 wrote to memory of 3808 712 1vjvv.exe 5lrlrrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d9816cf137b90efe6e891ab6a5013460_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\vpdjj.exec:\vpdjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\rllxxxr.exec:\rllxxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\btbbtn.exec:\btbbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\dvdpj.exec:\dvdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\hhbtnn.exec:\hhbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\rrrllfx.exec:\rrrllfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\hbhnhb.exec:\hbhnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vddjp.exec:\vddjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\lffxfxf.exec:\lffxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\hthnbb.exec:\hthnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\dddjj.exec:\dddjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\rrxxxrl.exec:\rrxxxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\xxlllff.exec:\xxlllff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\3hnhbb.exec:\3hnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\tnhhnn.exec:\tnhhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\7vvjj.exec:\7vvjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\frxxrrl.exec:\frxxrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\frlrlrl.exec:\frlrlrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\dpddv.exec:\dpddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\3nnbbb.exec:\3nnbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\1vjvv.exec:\1vjvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\5lrlrrx.exec:\5lrlrrx.exe23⤵
- Executes dropped EXE
PID:3808 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe24⤵
- Executes dropped EXE
PID:3292 -
\??\c:\djddp.exec:\djddp.exe25⤵
- Executes dropped EXE
PID:3692 -
\??\c:\3lfxxxx.exec:\3lfxxxx.exe26⤵
- Executes dropped EXE
PID:4164 -
\??\c:\bnhhbb.exec:\bnhhbb.exe27⤵
- Executes dropped EXE
PID:3076 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe28⤵
- Executes dropped EXE
PID:4280 -
\??\c:\lffxxfx.exec:\lffxxfx.exe29⤵
- Executes dropped EXE
PID:1356 -
\??\c:\ttttnn.exec:\ttttnn.exe30⤵
- Executes dropped EXE
PID:636 -
\??\c:\lxfrxxf.exec:\lxfrxxf.exe31⤵
- Executes dropped EXE
PID:4932 -
\??\c:\bnnhbt.exec:\bnnhbt.exe32⤵
- Executes dropped EXE
PID:3980 -
\??\c:\vpddv.exec:\vpddv.exe33⤵
- Executes dropped EXE
PID:2440 -
\??\c:\5hhbnn.exec:\5hhbnn.exe34⤵
- Executes dropped EXE
PID:4288 -
\??\c:\rxllflf.exec:\rxllflf.exe35⤵
- Executes dropped EXE
PID:3456 -
\??\c:\1tbtnn.exec:\1tbtnn.exe36⤵
- Executes dropped EXE
PID:8 -
\??\c:\jddvp.exec:\jddvp.exe37⤵
- Executes dropped EXE
PID:4432 -
\??\c:\xrllfxr.exec:\xrllfxr.exe38⤵
- Executes dropped EXE
PID:232 -
\??\c:\htbbtn.exec:\htbbtn.exe39⤵
- Executes dropped EXE
PID:3240 -
\??\c:\dpvpj.exec:\dpvpj.exe40⤵
- Executes dropped EXE
PID:220 -
\??\c:\rrllfff.exec:\rrllfff.exe41⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tbhhbb.exec:\tbhhbb.exe42⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pvpjp.exec:\pvpjp.exe43⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lxlfxff.exec:\lxlfxff.exe44⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe45⤵
- Executes dropped EXE
PID:2012 -
\??\c:\btnhhh.exec:\btnhhh.exe46⤵
- Executes dropped EXE
PID:4860 -
\??\c:\1jjdv.exec:\1jjdv.exe47⤵
- Executes dropped EXE
PID:3132 -
\??\c:\xrrllfr.exec:\xrrllfr.exe48⤵
- Executes dropped EXE
PID:3288 -
\??\c:\lrfxlfr.exec:\lrfxlfr.exe49⤵
- Executes dropped EXE
PID:5100 -
\??\c:\bhnhnn.exec:\bhnhnn.exe50⤵
- Executes dropped EXE
PID:1644 -
\??\c:\1pdvp.exec:\1pdvp.exe51⤵
- Executes dropped EXE
PID:3656 -
\??\c:\rfffffx.exec:\rfffffx.exe52⤵
- Executes dropped EXE
PID:1504 -
\??\c:\hthbtn.exec:\hthbtn.exe53⤵
- Executes dropped EXE
PID:5084 -
\??\c:\tttnhh.exec:\tttnhh.exe54⤵
- Executes dropped EXE
PID:3380 -
\??\c:\1dpjd.exec:\1dpjd.exe55⤵
- Executes dropped EXE
PID:872 -
\??\c:\rrxxfrr.exec:\rrxxfrr.exe56⤵
- Executes dropped EXE
PID:4696 -
\??\c:\1fllflx.exec:\1fllflx.exe57⤵
- Executes dropped EXE
PID:4940 -
\??\c:\dvpjp.exec:\dvpjp.exe58⤵
- Executes dropped EXE
PID:3904 -
\??\c:\vjpjd.exec:\vjpjd.exe59⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xxllrrx.exec:\xxllrrx.exe60⤵
- Executes dropped EXE
PID:3536 -
\??\c:\tttbtb.exec:\tttbtb.exe61⤵
- Executes dropped EXE
PID:64 -
\??\c:\bhnhhb.exec:\bhnhhb.exe62⤵
- Executes dropped EXE
PID:776 -
\??\c:\pddjj.exec:\pddjj.exe63⤵
- Executes dropped EXE
PID:3696 -
\??\c:\xrfxrlf.exec:\xrfxrlf.exe64⤵
- Executes dropped EXE
PID:3932 -
\??\c:\hnbtnn.exec:\hnbtnn.exe65⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7tttnn.exec:\7tttnn.exe66⤵PID:3824
-
\??\c:\vvdvp.exec:\vvdvp.exe67⤵PID:1320
-
\??\c:\xxffxxr.exec:\xxffxxr.exe68⤵PID:3940
-
\??\c:\bnbtnn.exec:\bnbtnn.exe69⤵PID:1124
-
\??\c:\xfllrrf.exec:\xfllrrf.exe70⤵PID:3692
-
\??\c:\llfxrrl.exec:\llfxrrl.exe71⤵PID:4972
-
\??\c:\hbnnbn.exec:\hbnnbn.exe72⤵PID:3068
-
\??\c:\xfrlffx.exec:\xfrlffx.exe73⤵PID:1312
-
\??\c:\7nthbb.exec:\7nthbb.exe74⤵PID:4496
-
\??\c:\jdjdv.exec:\jdjdv.exe75⤵PID:4824
-
\??\c:\xflfrrl.exec:\xflfrrl.exe76⤵PID:2032
-
\??\c:\tnhbnn.exec:\tnhbnn.exe77⤵PID:544
-
\??\c:\dpvvp.exec:\dpvvp.exe78⤵PID:2360
-
\??\c:\7ffxffr.exec:\7ffxffr.exe79⤵PID:4604
-
\??\c:\xrfxllx.exec:\xrfxllx.exe80⤵PID:4388
-
\??\c:\nhhbtt.exec:\nhhbtt.exe81⤵PID:896
-
\??\c:\jddpj.exec:\jddpj.exe82⤵PID:3456
-
\??\c:\pjpjp.exec:\pjpjp.exe83⤵PID:3364
-
\??\c:\3llxlxx.exec:\3llxlxx.exe84⤵PID:208
-
\??\c:\bnbtnt.exec:\bnbtnt.exe85⤵PID:4000
-
\??\c:\vvvpj.exec:\vvvpj.exe86⤵PID:2216
-
\??\c:\pjdvv.exec:\pjdvv.exe87⤵PID:4344
-
\??\c:\rllfxrl.exec:\rllfxrl.exe88⤵PID:440
-
\??\c:\7nnbtb.exec:\7nnbtb.exe89⤵PID:1136
-
\??\c:\vjjdv.exec:\vjjdv.exe90⤵PID:4160
-
\??\c:\lrxxrlf.exec:\lrxxrlf.exe91⤵PID:2656
-
\??\c:\xxxrlxr.exec:\xxxrlxr.exe92⤵PID:956
-
\??\c:\htntht.exec:\htntht.exe93⤵PID:4792
-
\??\c:\jvjvp.exec:\jvjvp.exe94⤵PID:2612
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe95⤵PID:988
-
\??\c:\fffxxxx.exec:\fffxxxx.exe96⤵PID:2192
-
\??\c:\nbbttn.exec:\nbbttn.exe97⤵PID:3796
-
\??\c:\jjjjd.exec:\jjjjd.exe98⤵PID:672
-
\??\c:\fxffxfx.exec:\fxffxfx.exe99⤵PID:932
-
\??\c:\rrxrrxx.exec:\rrxrrxx.exe100⤵PID:5044
-
\??\c:\bttnhh.exec:\bttnhh.exe101⤵PID:576
-
\??\c:\jjppj.exec:\jjppj.exe102⤵PID:4456
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe103⤵PID:944
-
\??\c:\llflrrx.exec:\llflrrx.exe104⤵PID:1820
-
\??\c:\nhnhtt.exec:\nhnhtt.exe105⤵PID:1288
-
\??\c:\dvvpj.exec:\dvvpj.exe106⤵PID:1508
-
\??\c:\rrrlrrx.exec:\rrrlrrx.exe107⤵PID:3856
-
\??\c:\1tbbtt.exec:\1tbbtt.exe108⤵PID:4420
-
\??\c:\thtnnn.exec:\thtnnn.exe109⤵PID:2328
-
\??\c:\jvdvp.exec:\jvdvp.exe110⤵PID:2776
-
\??\c:\3xxfrlf.exec:\3xxfrlf.exe111⤵PID:2384
-
\??\c:\bbbhht.exec:\bbbhht.exe112⤵PID:4904
-
\??\c:\nthbtt.exec:\nthbtt.exe113⤵PID:2592
-
\??\c:\3djdj.exec:\3djdj.exe114⤵PID:2568
-
\??\c:\xrfxrll.exec:\xrfxrll.exe115⤵PID:3664
-
\??\c:\fffxxxr.exec:\fffxxxr.exe116⤵PID:3356
-
\??\c:\ntnnhh.exec:\ntnnhh.exe117⤵PID:1360
-
\??\c:\dvdpp.exec:\dvdpp.exe118⤵PID:3868
-
\??\c:\lxlffll.exec:\lxlffll.exe119⤵PID:2032
-
\??\c:\bnttnh.exec:\bnttnh.exe120⤵PID:4360
-
\??\c:\pjdjj.exec:\pjdjj.exe121⤵PID:1876
-
\??\c:\1vjvp.exec:\1vjvp.exe122⤵PID:2212
-
\??\c:\7llllfx.exec:\7llllfx.exe123⤵PID:4440
-
\??\c:\hbbbth.exec:\hbbbth.exe124⤵PID:320
-
\??\c:\1bbtnn.exec:\1bbtnn.exe125⤵PID:324
-
\??\c:\7djjd.exec:\7djjd.exe126⤵PID:4588
-
\??\c:\lxxrrlf.exec:\lxxrrlf.exe127⤵PID:3772
-
\??\c:\bnnnth.exec:\bnnnth.exe128⤵PID:1732
-
\??\c:\hhnnhh.exec:\hhnnhh.exe129⤵PID:3608
-
\??\c:\jppjp.exec:\jppjp.exe130⤵PID:3360
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe131⤵PID:3016
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe132⤵PID:3832
-
\??\c:\bthhnt.exec:\bthhnt.exe133⤵PID:4268
-
\??\c:\vpdvp.exec:\vpdvp.exe134⤵PID:460
-
\??\c:\xxffxxf.exec:\xxffxxf.exe135⤵PID:224
-
\??\c:\bnbttb.exec:\bnbttb.exe136⤵PID:960
-
\??\c:\hbbhbh.exec:\hbbhbh.exe137⤵PID:1568
-
\??\c:\lrlfxxl.exec:\lrlfxxl.exe138⤵PID:2172
-
\??\c:\hbnhhb.exec:\hbnhhb.exe139⤵PID:1080
-
\??\c:\jvjvp.exec:\jvjvp.exe140⤵PID:1528
-
\??\c:\vvddp.exec:\vvddp.exe141⤵PID:3464
-
\??\c:\tttnbb.exec:\tttnbb.exe142⤵PID:4112
-
\??\c:\bttttt.exec:\bttttt.exe143⤵PID:2904
-
\??\c:\pdjpj.exec:\pdjpj.exe144⤵PID:5084
-
\??\c:\lxffxxx.exec:\lxffxxx.exe145⤵PID:2608
-
\??\c:\hnttnn.exec:\hnttnn.exe146⤵PID:3200
-
\??\c:\vdjdp.exec:\vdjdp.exe147⤵PID:384
-
\??\c:\llfxflr.exec:\llfxflr.exe148⤵PID:4940
-
\??\c:\nhhhhh.exec:\nhhhhh.exe149⤵PID:1324
-
\??\c:\pdvvp.exec:\pdvvp.exe150⤵PID:2520
-
\??\c:\lxlffff.exec:\lxlffff.exe151⤵PID:4808
-
\??\c:\xrfrfff.exec:\xrfrfff.exe152⤵PID:4732
-
\??\c:\djvpp.exec:\djvpp.exe153⤵PID:4192
-
\??\c:\lfxrlll.exec:\lfxrlll.exe154⤵PID:4396
-
\??\c:\btbtnn.exec:\btbtnn.exe155⤵PID:4644
-
\??\c:\bttbth.exec:\bttbth.exe156⤵PID:2696
-
\??\c:\5ddpj.exec:\5ddpj.exe157⤵PID:1972
-
\??\c:\rlffrlf.exec:\rlffrlf.exe158⤵PID:3692
-
\??\c:\tnbbhh.exec:\tnbbhh.exe159⤵PID:4972
-
\??\c:\pjjdd.exec:\pjjdd.exe160⤵PID:1000
-
\??\c:\rlrlfff.exec:\rlrlfff.exe161⤵PID:3260
-
\??\c:\nhnhbb.exec:\nhnhbb.exe162⤵PID:4496
-
\??\c:\thnnbb.exec:\thnnbb.exe163⤵PID:1316
-
\??\c:\vpvdd.exec:\vpvdd.exe164⤵PID:1404
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe165⤵PID:2360
-
\??\c:\hbtntn.exec:\hbtntn.exe166⤵PID:4288
-
\??\c:\dpdvv.exec:\dpdvv.exe167⤵PID:1772
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe168⤵PID:896
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe169⤵PID:1484
-
\??\c:\bnnnbb.exec:\bnnnbb.exe170⤵PID:3456
-
\??\c:\pjjdp.exec:\pjjdp.exe171⤵PID:208
-
\??\c:\jjjvp.exec:\jjjvp.exe172⤵PID:4004
-
\??\c:\lfllffx.exec:\lfllffx.exe173⤵PID:2216
-
\??\c:\nhnnbb.exec:\nhnnbb.exe174⤵PID:4344
-
\??\c:\jddvp.exec:\jddvp.exe175⤵PID:440
-
\??\c:\xlxrlll.exec:\xlxrlll.exe176⤵PID:5016
-
\??\c:\httnhn.exec:\httnhn.exe177⤵PID:1136
-
\??\c:\1ppvp.exec:\1ppvp.exe178⤵PID:2620
-
\??\c:\5vdvj.exec:\5vdvj.exe179⤵PID:3748
-
\??\c:\xlfflxr.exec:\xlfflxr.exe180⤵PID:4200
-
\??\c:\thnhhh.exec:\thnhhh.exe181⤵PID:956
-
\??\c:\7jjdv.exec:\7jjdv.exe182⤵PID:1156
-
\??\c:\llfrlll.exec:\llfrlll.exe183⤵PID:5116
-
\??\c:\nnbthb.exec:\nnbthb.exe184⤵PID:3632
-
\??\c:\jdjdd.exec:\jdjdd.exe185⤵PID:1524
-
\??\c:\dpdvj.exec:\dpdvj.exe186⤵PID:2332
-
\??\c:\rlxrlll.exec:\rlxrlll.exe187⤵PID:2240
-
\??\c:\hhhbnn.exec:\hhhbnn.exe188⤵PID:2172
-
\??\c:\jdpdd.exec:\jdpdd.exe189⤵PID:1080
-
\??\c:\fxfffff.exec:\fxfffff.exe190⤵PID:3872
-
\??\c:\hhnnhh.exec:\hhnnhh.exe191⤵PID:3716
-
\??\c:\ddppp.exec:\ddppp.exe192⤵PID:1048
-
\??\c:\rrxrllf.exec:\rrxrllf.exe193⤵PID:5084
-
\??\c:\nnttnh.exec:\nnttnh.exe194⤵PID:4456
-
\??\c:\djpdj.exec:\djpdj.exe195⤵PID:3784
-
\??\c:\1lfrfxr.exec:\1lfrfxr.exe196⤵PID:384
-
\??\c:\5nnhtt.exec:\5nnhtt.exe197⤵PID:944
-
\??\c:\nhhbnn.exec:\nhhbnn.exe198⤵PID:1948
-
\??\c:\jppdp.exec:\jppdp.exe199⤵PID:2104
-
\??\c:\5lxxrrr.exec:\5lxxrrr.exe200⤵PID:4808
-
\??\c:\hbthth.exec:\hbthth.exe201⤵PID:4732
-
\??\c:\jjpvj.exec:\jjpvj.exe202⤵PID:2328
-
\??\c:\rlrlffx.exec:\rlrlffx.exe203⤵PID:4396
-
\??\c:\7bthnt.exec:\7bthnt.exe204⤵PID:4644
-
\??\c:\5jvvv.exec:\5jvvv.exe205⤵PID:2696
-
\??\c:\7xrfrlf.exec:\7xrfrlf.exe206⤵PID:4492
-
\??\c:\btbtnn.exec:\btbtnn.exe207⤵PID:3692
-
\??\c:\ddddv.exec:\ddddv.exe208⤵PID:4972
-
\??\c:\rxfrlll.exec:\rxfrlll.exe209⤵PID:1000
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe210⤵PID:3196
-
\??\c:\ntbtnn.exec:\ntbtnn.exe211⤵PID:4496
-
\??\c:\ddppj.exec:\ddppj.exe212⤵PID:1316
-
\??\c:\xfrlffr.exec:\xfrlffr.exe213⤵PID:1404
-
\??\c:\fxrrffl.exec:\fxrrffl.exe214⤵PID:4592
-
\??\c:\thhhhb.exec:\thhhhb.exe215⤵PID:4288
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe216⤵PID:804
-
\??\c:\nnbbhh.exec:\nnbbhh.exe217⤵PID:4440
-
\??\c:\7htthh.exec:\7htthh.exe218⤵PID:3364
-
\??\c:\vjvpd.exec:\vjvpd.exe219⤵PID:228
-
\??\c:\fxlxrlf.exec:\fxlxrlf.exe220⤵PID:4800
-
\??\c:\frxrrrr.exec:\frxrrrr.exe221⤵PID:3572
-
\??\c:\1hnhbb.exec:\1hnhbb.exe222⤵PID:4292
-
\??\c:\djdvj.exec:\djdvj.exe223⤵PID:2260
-
\??\c:\xlrlfll.exec:\xlrlfll.exe224⤵PID:852
-
\??\c:\3llxrrl.exec:\3llxrrl.exe225⤵PID:4052
-
\??\c:\hbnhbt.exec:\hbnhbt.exe226⤵PID:560
-
\??\c:\jdjdv.exec:\jdjdv.exe227⤵PID:1428
-
\??\c:\9lfllxr.exec:\9lfllxr.exe228⤵PID:380
-
\??\c:\tnhhnn.exec:\tnhhnn.exe229⤵PID:1432
-
\??\c:\vpdvd.exec:\vpdvd.exe230⤵PID:472
-
\??\c:\1xfxllf.exec:\1xfxllf.exe231⤵PID:536
-
\??\c:\bttnbh.exec:\bttnbh.exe232⤵PID:2860
-
\??\c:\ppjjd.exec:\ppjjd.exe233⤵PID:1912
-
\??\c:\9ppjv.exec:\9ppjv.exe234⤵PID:3132
-
\??\c:\9ffxllx.exec:\9ffxllx.exe235⤵PID:3840
-
\??\c:\5tthbt.exec:\5tthbt.exe236⤵PID:2240
-
\??\c:\djjdp.exec:\djjdp.exe237⤵PID:3464
-
\??\c:\9ffxllf.exec:\9ffxllf.exe238⤵PID:4112
-
\??\c:\bbnntt.exec:\bbnntt.exe239⤵PID:4876
-
\??\c:\dddvd.exec:\dddvd.exe240⤵PID:4176
-
\??\c:\vdjdv.exec:\vdjdv.exe241⤵PID:872
-
\??\c:\lxxrfxx.exec:\lxxrfxx.exe242⤵PID:2464