Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 00:49
Behavioral task
behavioral1
Sample
3933c4c660d4024672ba40d807eb7b90_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3933c4c660d4024672ba40d807eb7b90_NeikiAnalytics.exe
-
Size
80KB
-
MD5
3933c4c660d4024672ba40d807eb7b90
-
SHA1
7f86efed4494760323736b2db0a6dd28c2d24329
-
SHA256
4a68d44900a4d2dd0bdd3384b82897c44aeb326a296443b3e347032847a4d6b6
-
SHA512
72448088723f82752ccdc86e4df82b7877819fb65b8e65e91ee1897443c33d075dd948894d82a17fed8f21a7ff365bc0ba6d6f33396eadea519ad0db621783e6
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TVqMJ897:zhOmTsF93UYfwC6GIoutiTU2HVS6cMJs
Malware Config
Signatures
-
Detect Blackmoon payload 61 IoCs
Processes:
resource yara_rule behavioral2/memory/4372-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2056-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1092-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2960-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4208-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/336-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tthbtn.exehnbhnh.exevdjpp.exelrlxffr.exerlfxrrl.exehhttht.exetnnhhb.exedvppj.exefxrfrfr.exeflfxllf.exe3tntbn.exethnbnh.exeddjvp.exedvpdp.exefrfxrrl.exerlrfxxr.exehnhhbh.exehthbnh.exebtnhnn.exepvpjv.exejdvjp.exefllfxxl.exerffrlfr.exenbbhbn.exehhnhbt.exepjvvp.exedpdvj.exerlrlflf.exelllfxxr.exejdjvv.exevjjdv.exexrllfxr.exerffxrlf.exehtnhbt.exe7tbnnt.exe1jjdp.exevvpjj.exerlfrfxr.exelrrfxrl.exebthbtn.exentbthb.exedpjvj.exejvvpd.exerxrlfxr.exelrrrfxf.exetnhnhb.exehbhbht.exe3ddvv.exe1ppjv.exe3lrxrfr.exexlfxlrx.exennnnhb.exehthtbn.exejjjdj.exejdjjd.exelrxrxlf.exelxrfxrl.exexrlxrll.exehtbthb.exe7vvpd.exepjvpd.exeddjdp.exexrrlrlr.exexrlffrl.exepid process 3068 tthbtn.exe 2204 hnbhnh.exe 2828 vdjpp.exe 2580 lrlxffr.exe 972 rlfxrrl.exe 4468 hhttht.exe 4188 tnnhhb.exe 2960 dvppj.exe 1092 fxrfrfr.exe 5068 flfxllf.exe 64 3tntbn.exe 2780 thnbnh.exe 3196 ddjvp.exe 4704 dvpdp.exe 2484 frfxrrl.exe 1400 rlrfxxr.exe 2440 hnhhbh.exe 2100 hthbnh.exe 4216 btnhnn.exe 4908 pvpjv.exe 1388 jdvjp.exe 4648 fllfxxl.exe 1300 rffrlfr.exe 4928 nbbhbn.exe 2864 hhnhbt.exe 4020 pjvvp.exe 2316 dpdvj.exe 544 rlrlflf.exe 2176 lllfxxr.exe 4304 jdjvv.exe 4596 vjjdv.exe 2848 xrllfxr.exe 2380 rffxrlf.exe 1832 htnhbt.exe 4696 7tbnnt.exe 1436 1jjdp.exe 3740 vvpjj.exe 4180 rlfrfxr.exe 4420 lrrfxrl.exe 1888 bthbtn.exe 3976 ntbthb.exe 2112 dpjvj.exe 2284 jvvpd.exe 1520 rxrlfxr.exe 652 lrrrfxf.exe 2452 tnhnhb.exe 3512 hbhbht.exe 3432 3ddvv.exe 2644 1ppjv.exe 1964 3lrxrfr.exe 1572 xlfxlrx.exe 2276 nnnnhb.exe 944 hthtbn.exe 1140 jjjdj.exe 1540 jdjjd.exe 4704 lrxrxlf.exe 4920 lxrfxrl.exe 5044 xrlxrll.exe 212 htbthb.exe 3564 7vvpd.exe 2100 pjvpd.exe 3720 ddjdp.exe 5096 xrrlrlr.exe 4232 xrlffrl.exe -
Processes:
resource yara_rule behavioral2/memory/4372-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tthbtn.exe upx C:\hnbhnh.exe upx behavioral2/memory/3068-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vdjpp.exe upx behavioral2/memory/3068-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2204-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2828-19-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lrlxffr.exe upx behavioral2/memory/2580-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlfxrrl.exe upx \??\c:\hhttht.exe upx behavioral2/memory/972-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4468-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnhhb.exe upx C:\dvppj.exe upx behavioral2/memory/4188-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxrfrfr.exe upx C:\3tntbn.exe upx \??\c:\thnbnh.exe upx behavioral2/memory/3196-66-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvpdp.exe upx behavioral2/memory/3196-70-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hthbnh.exe upx C:\pvpjv.exe upx \??\c:\jdvjp.exe upx behavioral2/memory/4908-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4648-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhnhbt.exe upx \??\c:\dpdvj.exe upx C:\rlrlflf.exe upx \??\c:\jdjvv.exe upx behavioral2/memory/4596-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2112-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2276-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4704-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3564-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2100-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4232-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2056-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4020-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4448-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2424-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4232-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1540-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3512-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2452-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/652-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2112-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/844-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3976-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1888-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4420-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3740-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2848-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2848-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4596-282-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrllfxr.exe upx behavioral2/memory/4596-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3576-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4304-155-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjjdv.exe upx \??\c:\lllfxxr.exe upx behavioral2/memory/544-145-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3933c4c660d4024672ba40d807eb7b90_NeikiAnalytics.exetthbtn.exehnbhnh.exevdjpp.exelrlxffr.exerlfxrrl.exehhttht.exetnnhhb.exedvppj.exefxrfrfr.exeflfxllf.exe3tntbn.exethnbnh.exeddjvp.exedvpdp.exefrfxrrl.exerlrfxxr.exehnhhbh.exehthbnh.exebtnhnn.exepvpjv.exejdvjp.exedescription pid process target process PID 4372 wrote to memory of 3068 4372 3933c4c660d4024672ba40d807eb7b90_NeikiAnalytics.exe tthbtn.exe PID 4372 wrote to memory of 3068 4372 3933c4c660d4024672ba40d807eb7b90_NeikiAnalytics.exe tthbtn.exe PID 4372 wrote to memory of 3068 4372 3933c4c660d4024672ba40d807eb7b90_NeikiAnalytics.exe tthbtn.exe PID 3068 wrote to memory of 2204 3068 tthbtn.exe hnbhnh.exe PID 3068 wrote to memory of 2204 3068 tthbtn.exe hnbhnh.exe PID 3068 wrote to memory of 2204 3068 tthbtn.exe hnbhnh.exe PID 2204 wrote to memory of 2828 2204 hnbhnh.exe vdjpp.exe PID 2204 wrote to memory of 2828 2204 hnbhnh.exe vdjpp.exe PID 2204 wrote to memory of 2828 2204 hnbhnh.exe vdjpp.exe PID 2828 wrote to memory of 2580 2828 vdjpp.exe lrlxffr.exe PID 2828 wrote to memory of 2580 2828 vdjpp.exe lrlxffr.exe PID 2828 wrote to memory of 2580 2828 vdjpp.exe lrlxffr.exe PID 2580 wrote to memory of 972 2580 lrlxffr.exe rlfxrrl.exe PID 2580 wrote to memory of 972 2580 lrlxffr.exe rlfxrrl.exe PID 2580 wrote to memory of 972 2580 lrlxffr.exe rlfxrrl.exe PID 972 wrote to memory of 4468 972 rlfxrrl.exe hhttht.exe PID 972 wrote to memory of 4468 972 rlfxrrl.exe hhttht.exe PID 972 wrote to memory of 4468 972 rlfxrrl.exe hhttht.exe PID 4468 wrote to memory of 4188 4468 hhttht.exe tnnhhb.exe PID 4468 wrote to memory of 4188 4468 hhttht.exe tnnhhb.exe PID 4468 wrote to memory of 4188 4468 hhttht.exe tnnhhb.exe PID 4188 wrote to memory of 2960 4188 tnnhhb.exe dvppj.exe PID 4188 wrote to memory of 2960 4188 tnnhhb.exe dvppj.exe PID 4188 wrote to memory of 2960 4188 tnnhhb.exe dvppj.exe PID 2960 wrote to memory of 1092 2960 dvppj.exe fxrfrfr.exe PID 2960 wrote to memory of 1092 2960 dvppj.exe fxrfrfr.exe PID 2960 wrote to memory of 1092 2960 dvppj.exe fxrfrfr.exe PID 1092 wrote to memory of 5068 1092 fxrfrfr.exe flfxllf.exe PID 1092 wrote to memory of 5068 1092 fxrfrfr.exe flfxllf.exe PID 1092 wrote to memory of 5068 1092 fxrfrfr.exe flfxllf.exe PID 5068 wrote to memory of 64 5068 flfxllf.exe 3tntbn.exe PID 5068 wrote to memory of 64 5068 flfxllf.exe 3tntbn.exe PID 5068 wrote to memory of 64 5068 flfxllf.exe 3tntbn.exe PID 64 wrote to memory of 2780 64 3tntbn.exe thnbnh.exe PID 64 wrote to memory of 2780 64 3tntbn.exe thnbnh.exe PID 64 wrote to memory of 2780 64 3tntbn.exe thnbnh.exe PID 2780 wrote to memory of 3196 2780 thnbnh.exe ddjvp.exe PID 2780 wrote to memory of 3196 2780 thnbnh.exe ddjvp.exe PID 2780 wrote to memory of 3196 2780 thnbnh.exe ddjvp.exe PID 3196 wrote to memory of 4704 3196 ddjvp.exe lrxrxlf.exe PID 3196 wrote to memory of 4704 3196 ddjvp.exe lrxrxlf.exe PID 3196 wrote to memory of 4704 3196 ddjvp.exe lrxrxlf.exe PID 4704 wrote to memory of 2484 4704 dvpdp.exe frfxrrl.exe PID 4704 wrote to memory of 2484 4704 dvpdp.exe frfxrrl.exe PID 4704 wrote to memory of 2484 4704 dvpdp.exe frfxrrl.exe PID 2484 wrote to memory of 1400 2484 frfxrrl.exe rlrfxxr.exe PID 2484 wrote to memory of 1400 2484 frfxrrl.exe rlrfxxr.exe PID 2484 wrote to memory of 1400 2484 frfxrrl.exe rlrfxxr.exe PID 1400 wrote to memory of 2440 1400 rlrfxxr.exe hnhhbh.exe PID 1400 wrote to memory of 2440 1400 rlrfxxr.exe hnhhbh.exe PID 1400 wrote to memory of 2440 1400 rlrfxxr.exe hnhhbh.exe PID 2440 wrote to memory of 2100 2440 hnhhbh.exe hthbnh.exe PID 2440 wrote to memory of 2100 2440 hnhhbh.exe hthbnh.exe PID 2440 wrote to memory of 2100 2440 hnhhbh.exe hthbnh.exe PID 2100 wrote to memory of 4216 2100 hthbnh.exe btnhnn.exe PID 2100 wrote to memory of 4216 2100 hthbnh.exe btnhnn.exe PID 2100 wrote to memory of 4216 2100 hthbnh.exe btnhnn.exe PID 4216 wrote to memory of 4908 4216 btnhnn.exe pvpjv.exe PID 4216 wrote to memory of 4908 4216 btnhnn.exe pvpjv.exe PID 4216 wrote to memory of 4908 4216 btnhnn.exe pvpjv.exe PID 4908 wrote to memory of 1388 4908 pvpjv.exe jdvjp.exe PID 4908 wrote to memory of 1388 4908 pvpjv.exe jdvjp.exe PID 4908 wrote to memory of 1388 4908 pvpjv.exe jdvjp.exe PID 1388 wrote to memory of 4648 1388 jdvjp.exe fllfxxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3933c4c660d4024672ba40d807eb7b90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3933c4c660d4024672ba40d807eb7b90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\tthbtn.exec:\tthbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\hnbhnh.exec:\hnbhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\vdjpp.exec:\vdjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\lrlxffr.exec:\lrlxffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\hhttht.exec:\hhttht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\tnnhhb.exec:\tnnhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\dvppj.exec:\dvppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\fxrfrfr.exec:\fxrfrfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\flfxllf.exec:\flfxllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\3tntbn.exec:\3tntbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\thnbnh.exec:\thnbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ddjvp.exec:\ddjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\dvpdp.exec:\dvpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\frfxrrl.exec:\frfxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\rlrfxxr.exec:\rlrfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\hnhhbh.exec:\hnhhbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\hthbnh.exec:\hthbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\btnhnn.exec:\btnhnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\pvpjv.exec:\pvpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\jdvjp.exec:\jdvjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\fllfxxl.exec:\fllfxxl.exe23⤵
- Executes dropped EXE
PID:4648 -
\??\c:\rffrlfr.exec:\rffrlfr.exe24⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nbbhbn.exec:\nbbhbn.exe25⤵
- Executes dropped EXE
PID:4928 -
\??\c:\hhnhbt.exec:\hhnhbt.exe26⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pjvvp.exec:\pjvvp.exe27⤵
- Executes dropped EXE
PID:4020 -
\??\c:\dpdvj.exec:\dpdvj.exe28⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rlrlflf.exec:\rlrlflf.exe29⤵
- Executes dropped EXE
PID:544 -
\??\c:\lllfxxr.exec:\lllfxxr.exe30⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jdjvv.exec:\jdjvv.exe31⤵
- Executes dropped EXE
PID:4304 -
\??\c:\vjjdv.exec:\vjjdv.exe32⤵
- Executes dropped EXE
PID:4596 -
\??\c:\xrllfxr.exec:\xrllfxr.exe33⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rffxrlf.exec:\rffxrlf.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\htnhbt.exec:\htnhbt.exe35⤵
- Executes dropped EXE
PID:1832 -
\??\c:\7tbnnt.exec:\7tbnnt.exe36⤵
- Executes dropped EXE
PID:4696 -
\??\c:\1jjdp.exec:\1jjdp.exe37⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vvpjj.exec:\vvpjj.exe38⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rlfrfxr.exec:\rlfrfxr.exe39⤵
- Executes dropped EXE
PID:4180 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe40⤵
- Executes dropped EXE
PID:4420 -
\??\c:\bthbtn.exec:\bthbtn.exe41⤵
- Executes dropped EXE
PID:1888 -
\??\c:\ntbthb.exec:\ntbthb.exe42⤵
- Executes dropped EXE
PID:3976 -
\??\c:\dpjvj.exec:\dpjvj.exe43⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jvvpd.exec:\jvvpd.exe44⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe45⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lrrrfxf.exec:\lrrrfxf.exe46⤵
- Executes dropped EXE
PID:652 -
\??\c:\tnhnhb.exec:\tnhnhb.exe47⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hbhbht.exec:\hbhbht.exe48⤵
- Executes dropped EXE
PID:3512 -
\??\c:\3ddvv.exec:\3ddvv.exe49⤵
- Executes dropped EXE
PID:3432 -
\??\c:\1ppjv.exec:\1ppjv.exe50⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3lrxrfr.exec:\3lrxrfr.exe51⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xlfxlrx.exec:\xlfxlrx.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\nnnnhb.exec:\nnnnhb.exe53⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hthtbn.exec:\hthtbn.exe54⤵
- Executes dropped EXE
PID:944 -
\??\c:\jjjdj.exec:\jjjdj.exe55⤵
- Executes dropped EXE
PID:1140 -
\??\c:\jdjjd.exec:\jdjjd.exe56⤵
- Executes dropped EXE
PID:1540 -
\??\c:\lrxrxlf.exec:\lrxrxlf.exe57⤵
- Executes dropped EXE
PID:4704 -
\??\c:\lxrfxrl.exec:\lxrfxrl.exe58⤵
- Executes dropped EXE
PID:4920 -
\??\c:\xrlxrll.exec:\xrlxrll.exe59⤵
- Executes dropped EXE
PID:5044 -
\??\c:\htbthb.exec:\htbthb.exe60⤵
- Executes dropped EXE
PID:212 -
\??\c:\7vvpd.exec:\7vvpd.exe61⤵
- Executes dropped EXE
PID:3564 -
\??\c:\pjvpd.exec:\pjvpd.exe62⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ddjdp.exec:\ddjdp.exe63⤵
- Executes dropped EXE
PID:3720 -
\??\c:\xrrlrlr.exec:\xrrlrlr.exe64⤵
- Executes dropped EXE
PID:5096 -
\??\c:\xrlffrl.exec:\xrlffrl.exe65⤵
- Executes dropped EXE
PID:4232 -
\??\c:\hbhhtt.exec:\hbhhtt.exe66⤵PID:4888
-
\??\c:\bnhbbb.exec:\bnhbbb.exe67⤵PID:2056
-
\??\c:\thhbth.exec:\thhbth.exe68⤵PID:1300
-
\??\c:\ppvpd.exec:\ppvpd.exe69⤵PID:2424
-
\??\c:\jpjdv.exec:\jpjdv.exe70⤵PID:4448
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe71⤵PID:980
-
\??\c:\7lfrllx.exec:\7lfrllx.exe72⤵PID:4020
-
\??\c:\bttnnh.exec:\bttnnh.exe73⤵PID:2316
-
\??\c:\htbtnh.exec:\htbtnh.exe74⤵PID:2208
-
\??\c:\9dvpd.exec:\9dvpd.exe75⤵PID:4132
-
\??\c:\pjvdj.exec:\pjvdj.exe76⤵PID:1316
-
\??\c:\llrxllf.exec:\llrxllf.exe77⤵PID:3224
-
\??\c:\fxrrffr.exec:\fxrrffr.exe78⤵PID:2028
-
\??\c:\1nnhbt.exec:\1nnhbt.exe79⤵PID:4512
-
\??\c:\hnnbtn.exec:\hnnbtn.exe80⤵PID:844
-
\??\c:\1vdvj.exec:\1vdvj.exe81⤵PID:4596
-
\??\c:\vjvdv.exec:\vjvdv.exe82⤵PID:3576
-
\??\c:\rxxxlfx.exec:\rxxxlfx.exe83⤵PID:1148
-
\??\c:\nhnhhb.exec:\nhnhhb.exe84⤵PID:2380
-
\??\c:\5bnnhb.exec:\5bnnhb.exe85⤵PID:4208
-
\??\c:\djddv.exec:\djddv.exe86⤵PID:768
-
\??\c:\9ffxrlf.exec:\9ffxrlf.exe87⤵PID:4568
-
\??\c:\xllrfff.exec:\xllrfff.exe88⤵PID:2856
-
\??\c:\nttnhn.exec:\nttnhn.exe89⤵PID:4348
-
\??\c:\vdpdj.exec:\vdpdj.exe90⤵PID:2656
-
\??\c:\rllxlfr.exec:\rllxlfr.exe91⤵PID:4328
-
\??\c:\1xxxlfx.exec:\1xxxlfx.exe92⤵PID:1224
-
\??\c:\thhbtn.exec:\thhbtn.exe93⤵PID:1552
-
\??\c:\vjjdp.exec:\vjjdp.exe94⤵PID:2828
-
\??\c:\jpdjv.exec:\jpdjv.exe95⤵PID:2112
-
\??\c:\rfflrrl.exec:\rfflrrl.exe96⤵PID:3208
-
\??\c:\1lflffx.exec:\1lflffx.exe97⤵PID:4356
-
\??\c:\nhhhtn.exec:\nhhhtn.exe98⤵PID:1476
-
\??\c:\vpjvj.exec:\vpjvj.exe99⤵PID:1948
-
\??\c:\ddvpd.exec:\ddvpd.exe100⤵PID:1080
-
\??\c:\3xrlffx.exec:\3xrlffx.exe101⤵PID:2644
-
\??\c:\9ntnbb.exec:\9ntnbb.exe102⤵PID:3756
-
\??\c:\hbbtnh.exec:\hbbtnh.exe103⤵PID:2040
-
\??\c:\vpddj.exec:\vpddj.exe104⤵PID:1708
-
\??\c:\xxfrfxf.exec:\xxfrfxf.exe105⤵PID:3936
-
\??\c:\hhbtnh.exec:\hhbtnh.exe106⤵PID:336
-
\??\c:\dvvjv.exec:\dvvjv.exe107⤵PID:2204
-
\??\c:\vvjpv.exec:\vvjpv.exe108⤵PID:4704
-
\??\c:\lxlfrff.exec:\lxlfrff.exe109⤵PID:4920
-
\??\c:\hbnhbt.exec:\hbnhbt.exe110⤵PID:2264
-
\??\c:\3dpdp.exec:\3dpdp.exe111⤵PID:3604
-
\??\c:\vvjpv.exec:\vvjpv.exe112⤵PID:2348
-
\??\c:\rffrfrf.exec:\rffrfrf.exe113⤵PID:4820
-
\??\c:\rlxxlff.exec:\rlxxlff.exe114⤵PID:3252
-
\??\c:\nnnhnn.exec:\nnnhnn.exe115⤵PID:3168
-
\??\c:\5pjpv.exec:\5pjpv.exe116⤵PID:3088
-
\??\c:\xxxrlrr.exec:\xxxrlrr.exe117⤵PID:1648
-
\??\c:\1frrxfr.exec:\1frrxfr.exe118⤵PID:2868
-
\??\c:\ntnhtn.exec:\ntnhtn.exe119⤵PID:3144
-
\??\c:\nbhbnn.exec:\nbhbnn.exe120⤵PID:424
-
\??\c:\pddvd.exec:\pddvd.exe121⤵PID:1380
-
\??\c:\vpjdj.exec:\vpjdj.exe122⤵PID:516
-
\??\c:\xllflfx.exec:\xllflfx.exe123⤵PID:372
-
\??\c:\bttnhn.exec:\bttnhn.exe124⤵PID:1388
-
\??\c:\nnbhhn.exec:\nnbhhn.exe125⤵PID:5092
-
\??\c:\5vvvp.exec:\5vvvp.exe126⤵PID:2172
-
\??\c:\ffrlrrf.exec:\ffrlrrf.exe127⤵PID:3704
-
\??\c:\tbbbbh.exec:\tbbbbh.exe128⤵PID:2588
-
\??\c:\bntthb.exec:\bntthb.exe129⤵PID:2976
-
\??\c:\jvpjd.exec:\jvpjd.exe130⤵PID:2028
-
\??\c:\vpppj.exec:\vpppj.exe131⤵PID:4260
-
\??\c:\rxllfrx.exec:\rxllfrx.exe132⤵PID:784
-
\??\c:\9xfxrrx.exec:\9xfxrrx.exe133⤵PID:3676
-
\??\c:\hnnhtt.exec:\hnnhtt.exe134⤵PID:2672
-
\??\c:\3thbnt.exec:\3thbnt.exe135⤵PID:1832
-
\??\c:\pdjdp.exec:\pdjdp.exe136⤵PID:4696
-
\??\c:\1pjjv.exec:\1pjjv.exe137⤵PID:2784
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe138⤵PID:3800
-
\??\c:\lfrlffx.exec:\lfrlffx.exe139⤵PID:2060
-
\??\c:\9rlfrrl.exec:\9rlfrrl.exe140⤵PID:1444
-
\??\c:\hnntnn.exec:\hnntnn.exe141⤵PID:4344
-
\??\c:\pvjdp.exec:\pvjdp.exe142⤵PID:940
-
\??\c:\vpdjj.exec:\vpdjj.exe143⤵PID:2884
-
\??\c:\fxfflfr.exec:\fxfflfr.exe144⤵PID:4796
-
\??\c:\lfxxlfx.exec:\lfxxlfx.exe145⤵PID:3300
-
\??\c:\bhnnhb.exec:\bhnnhb.exe146⤵PID:3248
-
\??\c:\hbbtnh.exec:\hbbtnh.exe147⤵PID:972
-
\??\c:\vjpjd.exec:\vjpjd.exe148⤵PID:4468
-
\??\c:\dvpdp.exec:\dvpdp.exe149⤵PID:2452
-
\??\c:\llfrlfl.exec:\llfrlfl.exe150⤵PID:3512
-
\??\c:\rxffrrf.exec:\rxffrrf.exe151⤵PID:3516
-
\??\c:\tnnnhn.exec:\tnnnhn.exe152⤵PID:1168
-
\??\c:\nbhbhb.exec:\nbhbhb.exe153⤵PID:5068
-
\??\c:\9djdj.exec:\9djdj.exe154⤵PID:4616
-
\??\c:\dddvj.exec:\dddvj.exe155⤵PID:2276
-
\??\c:\7flxllx.exec:\7flxllx.exe156⤵PID:3812
-
\??\c:\thhhtt.exec:\thhhtt.exe157⤵PID:1540
-
\??\c:\5pvjv.exec:\5pvjv.exe158⤵PID:2708
-
\??\c:\9vvdd.exec:\9vvdd.exe159⤵PID:2204
-
\??\c:\fllrxfl.exec:\fllrxfl.exe160⤵PID:4704
-
\??\c:\nnnnbt.exec:\nnnnbt.exe161⤵PID:60
-
\??\c:\tthhnb.exec:\tthhnb.exe162⤵PID:2164
-
\??\c:\btnntn.exec:\btnntn.exe163⤵PID:4808
-
\??\c:\pddvj.exec:\pddvj.exe164⤵PID:2992
-
\??\c:\rffrxxl.exec:\rffrxxl.exe165⤵PID:4908
-
\??\c:\1lfrlfr.exec:\1lfrlfr.exe166⤵PID:5052
-
\??\c:\tbnnnt.exec:\tbnnnt.exe167⤵PID:2580
-
\??\c:\jdppv.exec:\jdppv.exe168⤵PID:1260
-
\??\c:\xfxlxrl.exec:\xfxlxrl.exe169⤵PID:2056
-
\??\c:\hntttt.exec:\hntttt.exe170⤵PID:1648
-
\??\c:\djpjp.exec:\djpjp.exe171⤵PID:2868
-
\??\c:\1rrlxff.exec:\1rrlxff.exe172⤵PID:3144
-
\??\c:\nhtbnb.exec:\nhtbnb.exe173⤵PID:4400
-
\??\c:\3xlfrrl.exec:\3xlfrrl.exe174⤵PID:1380
-
\??\c:\3dvdp.exec:\3dvdp.exe175⤵PID:516
-
\??\c:\pjvjj.exec:\pjvjj.exe176⤵PID:980
-
\??\c:\9nnbnt.exec:\9nnbnt.exe177⤵PID:4396
-
\??\c:\thbnbb.exec:\thbnbb.exe178⤵PID:1716
-
\??\c:\hntnbb.exec:\hntnbb.exe179⤵PID:544
-
\??\c:\ddvvj.exec:\ddvvj.exe180⤵PID:4948
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe181⤵PID:2088
-
\??\c:\tnhbnn.exec:\tnhbnn.exe182⤵PID:4316
-
\??\c:\htbnhn.exec:\htbnhn.exe183⤵PID:4712
-
\??\c:\pdddd.exec:\pdddd.exe184⤵PID:2816
-
\??\c:\vppjd.exec:\vppjd.exe185⤵PID:4424
-
\??\c:\7xrfrlx.exec:\7xrfrlx.exe186⤵PID:2848
-
\??\c:\ffffxrl.exec:\ffffxrl.exe187⤵PID:4580
-
\??\c:\thhhbt.exec:\thhhbt.exe188⤵PID:4624
-
\??\c:\thhhtn.exec:\thhhtn.exe189⤵PID:2280
-
\??\c:\vpvpd.exec:\vpvpd.exe190⤵PID:4012
-
\??\c:\3rxrrlf.exec:\3rxrrlf.exe191⤵PID:768
-
\??\c:\5nbthn.exec:\5nbthn.exe192⤵PID:2856
-
\??\c:\thhhtn.exec:\thhhtn.exe193⤵PID:380
-
\??\c:\jvvpv.exec:\jvvpv.exe194⤵PID:4348
-
\??\c:\rxfrfxr.exec:\rxfrfxr.exe195⤵PID:4128
-
\??\c:\vvdpd.exec:\vvdpd.exe196⤵PID:1552
-
\??\c:\djdpj.exec:\djdpj.exe197⤵PID:3184
-
\??\c:\lrlxrlx.exec:\lrlxrlx.exe198⤵PID:2112
-
\??\c:\tnhbhh.exec:\tnhbhh.exe199⤵PID:4408
-
\??\c:\jvpjv.exec:\jvpjv.exe200⤵PID:4356
-
\??\c:\jpvjv.exec:\jpvjv.exe201⤵PID:1476
-
\??\c:\flrfrlf.exec:\flrfrlf.exe202⤵PID:1948
-
\??\c:\flxxllf.exec:\flxxllf.exe203⤵PID:1080
-
\??\c:\nnnhnh.exec:\nnnhnh.exe204⤵PID:2984
-
\??\c:\thbthh.exec:\thbthh.exe205⤵PID:3756
-
\??\c:\1jppp.exec:\1jppp.exe206⤵PID:2040
-
\??\c:\ppvpj.exec:\ppvpj.exe207⤵PID:2600
-
\??\c:\5fxxffx.exec:\5fxxffx.exe208⤵PID:744
-
\??\c:\9llfxrl.exec:\9llfxrl.exe209⤵PID:1140
-
\??\c:\ntnhbb.exec:\ntnhbb.exe210⤵PID:4388
-
\??\c:\nnnhhh.exec:\nnnhhh.exe211⤵PID:3124
-
\??\c:\5jjdd.exec:\5jjdd.exe212⤵PID:2464
-
\??\c:\pjdpd.exec:\pjdpd.exe213⤵PID:4884
-
\??\c:\fllrlxx.exec:\fllrlxx.exe214⤵PID:4352
-
\??\c:\rrllfxx.exec:\rrllfxx.exe215⤵PID:2664
-
\??\c:\bhhhtn.exec:\bhhhtn.exe216⤵PID:5100
-
\??\c:\nbhhtt.exec:\nbhhtt.exe217⤵PID:5096
-
\??\c:\pjjdd.exec:\pjjdd.exe218⤵PID:100
-
\??\c:\jvddd.exec:\jvddd.exe219⤵PID:5020
-
\??\c:\5xrfrlf.exec:\5xrfrlf.exe220⤵PID:2560
-
\??\c:\lfflxfx.exec:\lfflxfx.exe221⤵PID:4648
-
\??\c:\rfffxrr.exec:\rfffxrr.exe222⤵PID:528
-
\??\c:\tbtnhb.exec:\tbtnhb.exe223⤵PID:3440
-
\??\c:\nbhtbb.exec:\nbhtbb.exe224⤵PID:4196
-
\??\c:\djpdj.exec:\djpdj.exe225⤵PID:5040
-
\??\c:\7jvpj.exec:\7jvpj.exe226⤵PID:1752
-
\??\c:\rrrrxxl.exec:\rrrrxxl.exe227⤵PID:3272
-
\??\c:\9fxrlfx.exec:\9fxrlfx.exe228⤵PID:1388
-
\??\c:\bhbbhh.exec:\bhbbhh.exe229⤵PID:5092
-
\??\c:\9htnnh.exec:\9htnnh.exe230⤵PID:3444
-
\??\c:\9jppj.exec:\9jppj.exe231⤵PID:1316
-
\??\c:\jvdjv.exec:\jvdjv.exe232⤵PID:5004
-
\??\c:\llrxrxf.exec:\llrxrxf.exe233⤵PID:428
-
\??\c:\nbthbt.exec:\nbthbt.exe234⤵PID:2976
-
\??\c:\tntnbt.exec:\tntnbt.exe235⤵PID:844
-
\??\c:\vjpjp.exec:\vjpjp.exe236⤵PID:4596
-
\??\c:\jdvjd.exec:\jdvjd.exe237⤵PID:4100
-
\??\c:\dpdvd.exec:\dpdvd.exe238⤵PID:1668
-
\??\c:\lrffrfx.exec:\lrffrfx.exe239⤵PID:4696
-
\??\c:\hnbhtt.exec:\hnbhtt.exe240⤵PID:4568
-
\??\c:\thnnhh.exec:\thnnhh.exe241⤵PID:4180
-
\??\c:\pvpdj.exec:\pvpdj.exe242⤵PID:4344