Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:13
Behavioral task
behavioral1
Sample
d37c7661921408953808375eef828720_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d37c7661921408953808375eef828720_NeikiAnalytics.exe
-
Size
339KB
-
MD5
d37c7661921408953808375eef828720
-
SHA1
ace5372cc95fe49a1c60c474a7822e56290b4395
-
SHA256
4eaa6bbf6358c5963d51e9143ebd90f0644bb57271bc12d095f1824038f74935
-
SHA512
e680d30341cd3183650f7c3a3ed9b65fd8d46ed25d6bfa28a059c0f1ca8b0e35ec08071ffecc53762cac360f2a12958c15d99dd9b9a2721419b38d51e6cef2ec
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNip:9cm4FmowdHoS4BtguSPKyHp
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1136-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5264-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/768-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6000-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5628-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5608-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5676-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5564-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/952-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5344-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5856-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5664-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2984-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5712-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5824-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5204-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-705-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-727-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-731-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-754-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5308-912-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-973-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-1011-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-1085-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7tnnhh.exevpjjd.exedvdvj.exevjjpj.exeppjjv.exerlffxfx.exepdpjp.exexrxrffx.exebbhbtt.exejpvpj.exexrrxffx.exetttbth.exexrlfrlr.exerrrlffx.exenhnhhn.exeddpvv.exe1bnhbt.exe1jjdp.exexrlfxlf.exetbttnh.exebntnbb.exexxrrrlf.exedvdvv.exeddvvp.exerlrlxrl.exehntnhh.exe9jpvj.exevpvpj.exellxffxf.exebbhbhh.exevjjpd.exefxlfllr.exehhhhbh.exedvdvv.exedpvpv.exexrxrlxf.exerfffllf.exenttnhb.exevvjjp.exe1djjd.exexlrlfxx.exehhhhnh.exebbtnnh.exepvdjd.exejvvpp.exe5rrlflf.exentbbtt.exettnhnn.exejdpvp.exelfxrrlf.exerlfxxrr.exehhbttt.exe7nbttt.exejdddv.exerflfxxr.exexrxrrrr.exehbnnnn.exevppjd.exe1xxrfll.exelflfllf.exetnnhbb.exebbhhbb.exe7ppjd.exejdjjd.exepid process 2112 7tnnhh.exe 5092 vpjjd.exe 5072 dvdvj.exe 5264 vjjpj.exe 4212 ppjjv.exe 768 rlffxfx.exe 5060 pdpjp.exe 3716 xrxrffx.exe 2016 bbhbtt.exe 1800 jpvpj.exe 4984 xrrxffx.exe 6000 tttbth.exe 4020 xrlfrlr.exe 4672 rrrlffx.exe 5628 nhnhhn.exe 5608 ddpvv.exe 5112 1bnhbt.exe 5676 1jjdp.exe 5564 xrlfxlf.exe 2936 tbttnh.exe 1216 bntnbb.exe 3108 xxrrrlf.exe 4596 dvdvv.exe 1500 ddvvp.exe 6080 rlrlxrl.exe 952 hntnhh.exe 3380 9jpvj.exe 680 vpvpj.exe 4520 llxffxf.exe 2924 bbhbhh.exe 2200 vjjpd.exe 4552 fxlfllr.exe 3404 hhhhbh.exe 4560 dvdvv.exe 1340 dpvpv.exe 3696 xrxrlxf.exe 1788 rfffllf.exe 1964 nttnhb.exe 5344 vvjjp.exe 4572 1djjd.exe 1720 xlrlfxx.exe 5856 hhhhnh.exe 4964 bbtnnh.exe 4952 pvdjd.exe 5664 jvvpp.exe 4696 5rrlflf.exe 4908 ntbbtt.exe 1376 ttnhnn.exe 1884 jdpvp.exe 1116 lfxrrlf.exe 2984 rlfxxrr.exe 2828 hhbttt.exe 1852 7nbttt.exe 5068 jdddv.exe 5880 rflfxxr.exe 1624 xrxrrrr.exe 512 hbnnnn.exe 4944 vppjd.exe 2240 1xxrfll.exe 4544 lflfllf.exe 1008 tnnhbb.exe 2760 bbhhbb.exe 3300 7ppjd.exe 4472 jdjjd.exe -
Processes:
resource yara_rule behavioral2/memory/1136-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7tnnhh.exe upx behavioral2/memory/1136-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2112-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjjd.exe upx C:\dvdvj.exe upx behavioral2/memory/5092-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5072-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjjpj.exe upx behavioral2/memory/5264-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjjv.exe upx behavioral2/memory/4212-32-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlffxfx.exe upx behavioral2/memory/768-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdpjp.exe upx behavioral2/memory/5060-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxrffx.exe upx behavioral2/memory/3716-49-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbhbtt.exe upx C:\jpvpj.exe upx behavioral2/memory/2016-59-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrrxffx.exe upx behavioral2/memory/4984-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tttbth.exe upx behavioral2/memory/6000-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlfrlr.exe upx behavioral2/memory/6000-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrrlffx.exe upx behavioral2/memory/4020-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4672-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnhhn.exe upx behavioral2/memory/5628-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddpvv.exe upx C:\1bnhbt.exe upx behavioral2/memory/5608-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1jjdp.exe upx behavioral2/memory/5112-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5676-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlfxlf.exe upx C:\tbttnh.exe upx behavioral2/memory/2936-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5564-115-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bntnbb.exe upx C:\xxrrrlf.exe upx behavioral2/memory/1216-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvdvv.exe upx behavioral2/memory/3108-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvvp.exe upx behavioral2/memory/4596-142-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrlxrl.exe upx C:\hntnhh.exe upx C:\9jpvj.exe upx behavioral2/memory/952-156-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vpvpj.exe upx behavioral2/memory/3380-163-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llxffxf.exe upx C:\bbhbhh.exe upx C:\vjjpd.exe upx \??\c:\fxlfllr.exe upx behavioral2/memory/4552-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4552-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4560-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1340-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1788-204-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d37c7661921408953808375eef828720_NeikiAnalytics.exe7tnnhh.exevpjjd.exedvdvj.exevjjpj.exeppjjv.exerlffxfx.exepdpjp.exexrxrffx.exebbhbtt.exejpvpj.exexrrxffx.exetttbth.exexrlfrlr.exerrrlffx.exenhnhhn.exeddpvv.exe1bnhbt.exe1jjdp.exexrlfxlf.exetbttnh.exebntnbb.exedescription pid process target process PID 1136 wrote to memory of 2112 1136 d37c7661921408953808375eef828720_NeikiAnalytics.exe 7tnnhh.exe PID 1136 wrote to memory of 2112 1136 d37c7661921408953808375eef828720_NeikiAnalytics.exe 7tnnhh.exe PID 1136 wrote to memory of 2112 1136 d37c7661921408953808375eef828720_NeikiAnalytics.exe 7tnnhh.exe PID 2112 wrote to memory of 5092 2112 7tnnhh.exe vpjjd.exe PID 2112 wrote to memory of 5092 2112 7tnnhh.exe vpjjd.exe PID 2112 wrote to memory of 5092 2112 7tnnhh.exe vpjjd.exe PID 5092 wrote to memory of 5072 5092 vpjjd.exe dvdvj.exe PID 5092 wrote to memory of 5072 5092 vpjjd.exe dvdvj.exe PID 5092 wrote to memory of 5072 5092 vpjjd.exe dvdvj.exe PID 5072 wrote to memory of 5264 5072 dvdvj.exe vjjpj.exe PID 5072 wrote to memory of 5264 5072 dvdvj.exe vjjpj.exe PID 5072 wrote to memory of 5264 5072 dvdvj.exe vjjpj.exe PID 5264 wrote to memory of 4212 5264 vjjpj.exe ppjjv.exe PID 5264 wrote to memory of 4212 5264 vjjpj.exe ppjjv.exe PID 5264 wrote to memory of 4212 5264 vjjpj.exe ppjjv.exe PID 4212 wrote to memory of 768 4212 ppjjv.exe rlffxfx.exe PID 4212 wrote to memory of 768 4212 ppjjv.exe rlffxfx.exe PID 4212 wrote to memory of 768 4212 ppjjv.exe rlffxfx.exe PID 768 wrote to memory of 5060 768 rlffxfx.exe pdpjp.exe PID 768 wrote to memory of 5060 768 rlffxfx.exe pdpjp.exe PID 768 wrote to memory of 5060 768 rlffxfx.exe pdpjp.exe PID 5060 wrote to memory of 3716 5060 pdpjp.exe xrxrffx.exe PID 5060 wrote to memory of 3716 5060 pdpjp.exe xrxrffx.exe PID 5060 wrote to memory of 3716 5060 pdpjp.exe xrxrffx.exe PID 3716 wrote to memory of 2016 3716 xrxrffx.exe bbhbtt.exe PID 3716 wrote to memory of 2016 3716 xrxrffx.exe bbhbtt.exe PID 3716 wrote to memory of 2016 3716 xrxrffx.exe bbhbtt.exe PID 2016 wrote to memory of 1800 2016 bbhbtt.exe jpvpj.exe PID 2016 wrote to memory of 1800 2016 bbhbtt.exe jpvpj.exe PID 2016 wrote to memory of 1800 2016 bbhbtt.exe jpvpj.exe PID 1800 wrote to memory of 4984 1800 jpvpj.exe xrrxffx.exe PID 1800 wrote to memory of 4984 1800 jpvpj.exe xrrxffx.exe PID 1800 wrote to memory of 4984 1800 jpvpj.exe xrrxffx.exe PID 4984 wrote to memory of 6000 4984 xrrxffx.exe tttbth.exe PID 4984 wrote to memory of 6000 4984 xrrxffx.exe tttbth.exe PID 4984 wrote to memory of 6000 4984 xrrxffx.exe tttbth.exe PID 6000 wrote to memory of 4020 6000 tttbth.exe xrlfrlr.exe PID 6000 wrote to memory of 4020 6000 tttbth.exe xrlfrlr.exe PID 6000 wrote to memory of 4020 6000 tttbth.exe xrlfrlr.exe PID 4020 wrote to memory of 4672 4020 xrlfrlr.exe rrrlffx.exe PID 4020 wrote to memory of 4672 4020 xrlfrlr.exe rrrlffx.exe PID 4020 wrote to memory of 4672 4020 xrlfrlr.exe rrrlffx.exe PID 4672 wrote to memory of 5628 4672 rrrlffx.exe nhnhhn.exe PID 4672 wrote to memory of 5628 4672 rrrlffx.exe nhnhhn.exe PID 4672 wrote to memory of 5628 4672 rrrlffx.exe nhnhhn.exe PID 5628 wrote to memory of 5608 5628 nhnhhn.exe ddpvv.exe PID 5628 wrote to memory of 5608 5628 nhnhhn.exe ddpvv.exe PID 5628 wrote to memory of 5608 5628 nhnhhn.exe ddpvv.exe PID 5608 wrote to memory of 5112 5608 ddpvv.exe 1bnhbt.exe PID 5608 wrote to memory of 5112 5608 ddpvv.exe 1bnhbt.exe PID 5608 wrote to memory of 5112 5608 ddpvv.exe 1bnhbt.exe PID 5112 wrote to memory of 5676 5112 1bnhbt.exe 1jjdp.exe PID 5112 wrote to memory of 5676 5112 1bnhbt.exe 1jjdp.exe PID 5112 wrote to memory of 5676 5112 1bnhbt.exe 1jjdp.exe PID 5676 wrote to memory of 5564 5676 1jjdp.exe xrlfxlf.exe PID 5676 wrote to memory of 5564 5676 1jjdp.exe xrlfxlf.exe PID 5676 wrote to memory of 5564 5676 1jjdp.exe xrlfxlf.exe PID 5564 wrote to memory of 2936 5564 xrlfxlf.exe tbttnh.exe PID 5564 wrote to memory of 2936 5564 xrlfxlf.exe tbttnh.exe PID 5564 wrote to memory of 2936 5564 xrlfxlf.exe tbttnh.exe PID 2936 wrote to memory of 1216 2936 tbttnh.exe bntnbb.exe PID 2936 wrote to memory of 1216 2936 tbttnh.exe bntnbb.exe PID 2936 wrote to memory of 1216 2936 tbttnh.exe bntnbb.exe PID 1216 wrote to memory of 3108 1216 bntnbb.exe xxrrrlf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d37c7661921408953808375eef828720_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d37c7661921408953808375eef828720_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\7tnnhh.exec:\7tnnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\vpjjd.exec:\vpjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\dvdvj.exec:\dvdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\vjjpj.exec:\vjjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
\??\c:\ppjjv.exec:\ppjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\rlffxfx.exec:\rlffxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\pdpjp.exec:\pdpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\xrxrffx.exec:\xrxrffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\bbhbtt.exec:\bbhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\jpvpj.exec:\jpvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\xrrxffx.exec:\xrrxffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\tttbth.exec:\tttbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
\??\c:\xrlfrlr.exec:\xrlfrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\rrrlffx.exec:\rrrlffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\nhnhhn.exec:\nhnhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
\??\c:\ddpvv.exec:\ddpvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
\??\c:\1bnhbt.exec:\1bnhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\1jjdp.exec:\1jjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
\??\c:\xrlfxlf.exec:\xrlfxlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
\??\c:\tbttnh.exec:\tbttnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\bntnbb.exec:\bntnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\xxrrrlf.exec:\xxrrrlf.exe23⤵
- Executes dropped EXE
PID:3108 -
\??\c:\dvdvv.exec:\dvdvv.exe24⤵
- Executes dropped EXE
PID:4596 -
\??\c:\ddvvp.exec:\ddvvp.exe25⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rlrlxrl.exec:\rlrlxrl.exe26⤵
- Executes dropped EXE
PID:6080 -
\??\c:\hntnhh.exec:\hntnhh.exe27⤵
- Executes dropped EXE
PID:952 -
\??\c:\9jpvj.exec:\9jpvj.exe28⤵
- Executes dropped EXE
PID:3380 -
\??\c:\vpvpj.exec:\vpvpj.exe29⤵
- Executes dropped EXE
PID:680 -
\??\c:\llxffxf.exec:\llxffxf.exe30⤵
- Executes dropped EXE
PID:4520 -
\??\c:\bbhbhh.exec:\bbhbhh.exe31⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vjjpd.exec:\vjjpd.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\fxlfllr.exec:\fxlfllr.exe33⤵
- Executes dropped EXE
PID:4552 -
\??\c:\hhhhbh.exec:\hhhhbh.exe34⤵
- Executes dropped EXE
PID:3404 -
\??\c:\dvdvv.exec:\dvdvv.exe35⤵
- Executes dropped EXE
PID:4560 -
\??\c:\dpvpv.exec:\dpvpv.exe36⤵
- Executes dropped EXE
PID:1340 -
\??\c:\xrxrlxf.exec:\xrxrlxf.exe37⤵
- Executes dropped EXE
PID:3696 -
\??\c:\rfffllf.exec:\rfffllf.exe38⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nttnhb.exec:\nttnhb.exe39⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vvjjp.exec:\vvjjp.exe40⤵
- Executes dropped EXE
PID:5344 -
\??\c:\1djjd.exec:\1djjd.exe41⤵
- Executes dropped EXE
PID:4572 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe42⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hhhhnh.exec:\hhhhnh.exe43⤵
- Executes dropped EXE
PID:5856 -
\??\c:\bbtnnh.exec:\bbtnnh.exe44⤵
- Executes dropped EXE
PID:4964 -
\??\c:\pvdjd.exec:\pvdjd.exe45⤵
- Executes dropped EXE
PID:4952 -
\??\c:\jvvpp.exec:\jvvpp.exe46⤵
- Executes dropped EXE
PID:5664 -
\??\c:\5rrlflf.exec:\5rrlflf.exe47⤵
- Executes dropped EXE
PID:4696 -
\??\c:\ntbbtt.exec:\ntbbtt.exe48⤵
- Executes dropped EXE
PID:4908 -
\??\c:\ttnhnn.exec:\ttnhnn.exe49⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jdpvp.exec:\jdpvp.exe50⤵
- Executes dropped EXE
PID:1884 -
\??\c:\lfxrrlf.exec:\lfxrrlf.exe51⤵
- Executes dropped EXE
PID:1116 -
\??\c:\rlfxxrr.exec:\rlfxxrr.exe52⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hhbttt.exec:\hhbttt.exe53⤵
- Executes dropped EXE
PID:2828 -
\??\c:\7nbttt.exec:\7nbttt.exe54⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jdddv.exec:\jdddv.exe55⤵
- Executes dropped EXE
PID:5068 -
\??\c:\rflfxxr.exec:\rflfxxr.exe56⤵
- Executes dropped EXE
PID:5880 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe57⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hbnnnn.exec:\hbnnnn.exe58⤵
- Executes dropped EXE
PID:512 -
\??\c:\vppjd.exec:\vppjd.exe59⤵
- Executes dropped EXE
PID:4944 -
\??\c:\1xxrfll.exec:\1xxrfll.exe60⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lflfllf.exec:\lflfllf.exe61⤵
- Executes dropped EXE
PID:4544 -
\??\c:\tnnhbb.exec:\tnnhbb.exe62⤵
- Executes dropped EXE
PID:1008 -
\??\c:\bbhhbb.exec:\bbhhbb.exe63⤵
- Executes dropped EXE
PID:2760 -
\??\c:\7ppjd.exec:\7ppjd.exe64⤵
- Executes dropped EXE
PID:3300 -
\??\c:\jdjjd.exec:\jdjjd.exe65⤵
- Executes dropped EXE
PID:4472 -
\??\c:\lrxxrlr.exec:\lrxxrlr.exe66⤵PID:2376
-
\??\c:\btbbbt.exec:\btbbbt.exe67⤵PID:2496
-
\??\c:\bntnnn.exec:\bntnnn.exe68⤵PID:1640
-
\??\c:\hntnbb.exec:\hntnbb.exe69⤵PID:5200
-
\??\c:\pjpjv.exec:\pjpjv.exe70⤵PID:3868
-
\??\c:\lffxllf.exec:\lffxllf.exe71⤵PID:5680
-
\??\c:\llllffl.exec:\llllffl.exe72⤵PID:3184
-
\??\c:\nthbtn.exec:\nthbtn.exe73⤵PID:1868
-
\??\c:\nhtthh.exec:\nhtthh.exe74⤵PID:1564
-
\??\c:\jvjjj.exec:\jvjjj.exe75⤵PID:664
-
\??\c:\lflfrrr.exec:\lflfrrr.exe76⤵PID:4056
-
\??\c:\xflfxxr.exec:\xflfxxr.exe77⤵PID:3660
-
\??\c:\5nhhbn.exec:\5nhhbn.exe78⤵PID:2652
-
\??\c:\djddv.exec:\djddv.exe79⤵PID:1800
-
\??\c:\dvdvj.exec:\dvdvj.exe80⤵PID:5896
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe81⤵PID:3152
-
\??\c:\lrxxrrl.exec:\lrxxrrl.exe82⤵PID:3396
-
\??\c:\hnnnhh.exec:\hnnnhh.exe83⤵PID:400
-
\??\c:\hnbtnn.exec:\hnbtnn.exe84⤵PID:4972
-
\??\c:\jpvpj.exec:\jpvpj.exe85⤵PID:1164
-
\??\c:\3jpjd.exec:\3jpjd.exe86⤵PID:2068
-
\??\c:\xrxfxlf.exec:\xrxfxlf.exe87⤵PID:3724
-
\??\c:\5tnhbh.exec:\5tnhbh.exe88⤵PID:2600
-
\??\c:\jjvpv.exec:\jjvpv.exe89⤵PID:5712
-
\??\c:\jvvdp.exec:\jvvdp.exe90⤵PID:4980
-
\??\c:\flflxrf.exec:\flflxrf.exe91⤵PID:2584
-
\??\c:\hntbtt.exec:\hntbtt.exe92⤵PID:1616
-
\??\c:\1hhhhb.exec:\1hhhhb.exe93⤵PID:2772
-
\??\c:\rlllfrr.exec:\rlllfrr.exe94⤵PID:2216
-
\??\c:\1tttnt.exec:\1tttnt.exe95⤵PID:5724
-
\??\c:\hntthh.exec:\hntthh.exe96⤵PID:2936
-
\??\c:\3jppv.exec:\3jppv.exe97⤵PID:5748
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe98⤵PID:1216
-
\??\c:\btbttt.exec:\btbttt.exe99⤵PID:2980
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe100⤵PID:5104
-
\??\c:\7hnhnn.exec:\7hnhnn.exe101⤵PID:3116
-
\??\c:\9pdvd.exec:\9pdvd.exe102⤵PID:5132
-
\??\c:\ppddd.exec:\ppddd.exe103⤵PID:1084
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe104⤵PID:5248
-
\??\c:\tbnhbb.exec:\tbnhbb.exe105⤵PID:3216
-
\??\c:\bnhbtt.exec:\bnhbtt.exe106⤵PID:4736
-
\??\c:\rrrlffx.exec:\rrrlffx.exe107⤵PID:1980
-
\??\c:\ttbbtb.exec:\ttbbtb.exe108⤵PID:4580
-
\??\c:\pddvj.exec:\pddvj.exe109⤵PID:2396
-
\??\c:\7xflllx.exec:\7xflllx.exe110⤵PID:5188
-
\??\c:\dpvpv.exec:\dpvpv.exe111⤵PID:6088
-
\??\c:\rfxlffx.exec:\rfxlffx.exe112⤵PID:1668
-
\??\c:\bnnnnt.exec:\bnnnnt.exe113⤵PID:1240
-
\??\c:\pjjjd.exec:\pjjjd.exe114⤵PID:5136
-
\??\c:\1lfxlll.exec:\1lfxlll.exe115⤵PID:5824
-
\??\c:\1tnhtt.exec:\1tnhtt.exe116⤵PID:4560
-
\??\c:\ttbtnt.exec:\ttbtnt.exe117⤵PID:4748
-
\??\c:\jjdvv.exec:\jjdvv.exe118⤵PID:1464
-
\??\c:\dpvjv.exec:\dpvjv.exe119⤵PID:3272
-
\??\c:\rllffxx.exec:\rllffxx.exe120⤵PID:5320
-
\??\c:\tbhbbb.exec:\tbhbbb.exe121⤵PID:2044
-
\??\c:\vpjdp.exec:\vpjdp.exe122⤵PID:3024
-
\??\c:\ppppj.exec:\ppppj.exe123⤵PID:4572
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe124⤵PID:624
-
\??\c:\flfxrrl.exec:\flfxrrl.exe125⤵PID:4732
-
\??\c:\bntbtt.exec:\bntbtt.exe126⤵PID:5008
-
\??\c:\pvpdv.exec:\pvpdv.exe127⤵PID:1972
-
\??\c:\vdjjd.exec:\vdjjd.exe128⤵PID:3252
-
\??\c:\5rxrllf.exec:\5rxrllf.exe129⤵PID:4836
-
\??\c:\7thtbb.exec:\7thtbb.exe130⤵PID:5436
-
\??\c:\ttbnbh.exec:\ttbnbh.exe131⤵PID:3148
-
\??\c:\vppvv.exec:\vppvv.exe132⤵PID:1884
-
\??\c:\rlrrlll.exec:\rlrrlll.exe133⤵PID:1116
-
\??\c:\9hnhth.exec:\9hnhth.exe134⤵PID:2984
-
\??\c:\bntnbt.exec:\bntnbt.exe135⤵PID:3212
-
\??\c:\pvvjv.exec:\pvvjv.exe136⤵PID:1316
-
\??\c:\llrrfxx.exec:\llrrfxx.exe137⤵PID:1512
-
\??\c:\ffrlrxf.exec:\ffrlrxf.exe138⤵PID:3744
-
\??\c:\nhhbnb.exec:\nhhbnb.exe139⤵PID:6024
-
\??\c:\pjjjj.exec:\pjjjj.exe140⤵PID:6140
-
\??\c:\vpddv.exec:\vpddv.exe141⤵PID:100
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe142⤵PID:6020
-
\??\c:\frfxxxf.exec:\frfxxxf.exe143⤵PID:336
-
\??\c:\btnnnn.exec:\btnnnn.exe144⤵PID:2240
-
\??\c:\pjjjd.exec:\pjjjd.exe145⤵PID:4820
-
\??\c:\pppdv.exec:\pppdv.exe146⤵PID:4844
-
\??\c:\xfllffr.exec:\xfllffr.exe147⤵PID:956
-
\??\c:\lrxrlff.exec:\lrxrlff.exe148⤵PID:1532
-
\??\c:\thnnhh.exec:\thnnhh.exe149⤵PID:1524
-
\??\c:\jjpjj.exec:\jjpjj.exe150⤵PID:4328
-
\??\c:\5ddvp.exec:\5ddvp.exe151⤵PID:5184
-
\??\c:\7ffxllf.exec:\7ffxllf.exe152⤵PID:5204
-
\??\c:\rlrlffx.exec:\rlrlffx.exe153⤵PID:5352
-
\??\c:\tbbbtt.exec:\tbbbtt.exe154⤵PID:4016
-
\??\c:\jddvj.exec:\jddvj.exe155⤵PID:5464
-
\??\c:\pddjd.exec:\pddjd.exe156⤵PID:5208
-
\??\c:\1xlfrlf.exec:\1xlfrlf.exe157⤵PID:4072
-
\??\c:\nhbbnn.exec:\nhbbnn.exe158⤵PID:4092
-
\??\c:\9bbtnh.exec:\9bbtnh.exe159⤵PID:5060
-
\??\c:\pjvpv.exec:\pjvpv.exe160⤵PID:4352
-
\??\c:\vdjpv.exec:\vdjpv.exe161⤵PID:2064
-
\??\c:\9rfrfxr.exec:\9rfrfxr.exe162⤵PID:6016
-
\??\c:\lxxrlrl.exec:\lxxrlrl.exe163⤵PID:2652
-
\??\c:\3nhbtt.exec:\3nhbtt.exe164⤵PID:4984
-
\??\c:\djjdp.exec:\djjdp.exe165⤵PID:1232
-
\??\c:\jdjjd.exec:\jdjjd.exe166⤵PID:5852
-
\??\c:\3llrlll.exec:\3llrlll.exe167⤵PID:2500
-
\??\c:\rfxxxll.exec:\rfxxxll.exe168⤵PID:5628
-
\??\c:\tnhbbt.exec:\tnhbbt.exe169⤵PID:4828
-
\??\c:\tthhnt.exec:\tthhnt.exe170⤵PID:3048
-
\??\c:\dvjjv.exec:\dvjjv.exe171⤵PID:5332
-
\??\c:\frfxxff.exec:\frfxxff.exe172⤵PID:5516
-
\??\c:\rllfxrl.exec:\rllfxrl.exe173⤵PID:3516
-
\??\c:\bntnbt.exec:\bntnbt.exe174⤵PID:5308
-
\??\c:\ntbtnn.exec:\ntbtnn.exe175⤵PID:3852
-
\??\c:\9vdpj.exec:\9vdpj.exe176⤵PID:2936
-
\??\c:\pjvpj.exec:\pjvpj.exe177⤵PID:5748
-
\??\c:\fxfrfxl.exec:\fxfrfxl.exe178⤵PID:4372
-
\??\c:\5thnnn.exec:\5thnnn.exe179⤵PID:4172
-
\??\c:\3vdvj.exec:\3vdvj.exe180⤵PID:1500
-
\??\c:\3rxrffl.exec:\3rxrffl.exe181⤵PID:5296
-
\??\c:\lxffxfx.exec:\lxffxfx.exe182⤵PID:6124
-
\??\c:\tnbbtn.exec:\tnbbtn.exe183⤵PID:2308
-
\??\c:\vvdvp.exec:\vvdvp.exe184⤵PID:3644
-
\??\c:\jvddv.exec:\jvddv.exe185⤵PID:3400
-
\??\c:\1ttnnh.exec:\1ttnnh.exe186⤵PID:2748
-
\??\c:\htthbb.exec:\htthbb.exe187⤵PID:2404
-
\??\c:\pvvpj.exec:\pvvpj.exe188⤵PID:5652
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe189⤵PID:3732
-
\??\c:\btbnnn.exec:\btbnnn.exe190⤵PID:1208
-
\??\c:\9htntn.exec:\9htntn.exe191⤵PID:4536
-
\??\c:\dvjjd.exec:\dvjjd.exe192⤵PID:5272
-
\??\c:\fxrrlll.exec:\fxrrlll.exe193⤵PID:2440
-
\??\c:\xxlfffx.exec:\xxlfffx.exe194⤵PID:6048
-
\??\c:\hthhbh.exec:\hthhbh.exe195⤵PID:1652
-
\??\c:\dpjdj.exec:\dpjdj.exe196⤵PID:720
-
\??\c:\pjjvj.exec:\pjjvj.exe197⤵PID:2312
-
\??\c:\7rxfflr.exec:\7rxfflr.exe198⤵PID:1220
-
\??\c:\tbhbtn.exec:\tbhbtn.exe199⤵PID:1424
-
\??\c:\jddvv.exec:\jddvv.exe200⤵PID:1508
-
\??\c:\5xflxxx.exec:\5xflxxx.exe201⤵PID:1796
-
\??\c:\5xxrllf.exec:\5xxrllf.exe202⤵PID:5708
-
\??\c:\7bnnhb.exec:\7bnnhb.exe203⤵PID:624
-
\??\c:\tntnhh.exec:\tntnhh.exe204⤵PID:3752
-
\??\c:\vdjpj.exec:\vdjpj.exe205⤵PID:4952
-
\??\c:\lllxlxl.exec:\lllxlxl.exe206⤵PID:2604
-
\??\c:\xllrxrf.exec:\xllrxrf.exe207⤵PID:4696
-
\??\c:\bhhtnh.exec:\bhhtnh.exe208⤵PID:1924
-
\??\c:\3djdp.exec:\3djdp.exe209⤵PID:3608
-
\??\c:\xxfrffr.exec:\xxfrffr.exe210⤵PID:4600
-
\??\c:\hbntbb.exec:\hbntbb.exe211⤵PID:3684
-
\??\c:\hbhbbb.exec:\hbhbbb.exe212⤵PID:1448
-
\??\c:\dppjp.exec:\dppjp.exe213⤵PID:1236
-
\??\c:\fxrlxrf.exec:\fxrlxrf.exe214⤵PID:3824
-
\??\c:\xrlxlxl.exec:\xrlxlxl.exe215⤵PID:3440
-
\??\c:\5nhbnh.exec:\5nhbnh.exe216⤵PID:5584
-
\??\c:\7vdvj.exec:\7vdvj.exe217⤵PID:2904
-
\??\c:\vvjvv.exec:\vvjvv.exe218⤵PID:3240
-
\??\c:\1xxrxlx.exec:\1xxrxlx.exe219⤵PID:1852
-
\??\c:\rffrlfx.exec:\rffrlfx.exe220⤵PID:5372
-
\??\c:\hnttnh.exec:\hnttnh.exe221⤵PID:3744
-
\??\c:\pppjd.exec:\pppjd.exe222⤵PID:3284
-
\??\c:\rllxxxf.exec:\rllxxxf.exe223⤵PID:6140
-
\??\c:\rrrlfff.exec:\rrrlfff.exe224⤵PID:4944
-
\??\c:\tnnttt.exec:\tnnttt.exe225⤵PID:6020
-
\??\c:\hbbbtt.exec:\hbbbtt.exe226⤵PID:336
-
\??\c:\ppvjv.exec:\ppvjv.exe227⤵PID:1008
-
\??\c:\pdjdv.exec:\pdjdv.exe228⤵PID:5432
-
\??\c:\rfrlfff.exec:\rfrlfff.exe229⤵PID:4452
-
\??\c:\tnnhbt.exec:\tnnhbt.exe230⤵PID:4472
-
\??\c:\7jdpd.exec:\7jdpd.exe231⤵PID:5108
-
\??\c:\1vvjd.exec:\1vvjd.exe232⤵PID:1524
-
\??\c:\rrxfffl.exec:\rrxfffl.exe233⤵PID:4328
-
\??\c:\rfrfflf.exec:\rfrfflf.exe234⤵PID:5184
-
\??\c:\3bhbtt.exec:\3bhbtt.exe235⤵PID:3004
-
\??\c:\pjvpv.exec:\pjvpv.exe236⤵PID:4336
-
\??\c:\7vjjv.exec:\7vjjv.exe237⤵PID:4016
-
\??\c:\rrlfrrr.exec:\rrlfrrr.exe238⤵PID:5464
-
\??\c:\1hhbtt.exec:\1hhbtt.exe239⤵PID:5208
-
\??\c:\bhbbnh.exec:\bhbbnh.exe240⤵PID:4072
-
\??\c:\vjvjv.exec:\vjvjv.exe241⤵PID:3716
-
\??\c:\5rxrlrr.exec:\5rxrlrr.exe242⤵PID:4056