Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe
-
Size
473KB
-
MD5
dcd0ea1fc7b348236c10843855911480
-
SHA1
6ff86a43807e7e76d9ca4c000041953baa7d9f41
-
SHA256
e366c7765591178dde6e51f8cd648daa49609f67d5eb479b6b0f20feffbdbf8c
-
SHA512
b3d3737018bc267367405f86dc87409fc813d97dfd5e4fdf32777672b61542f9bc580ad856c674d4588ece76a2449020ea6201d5e2fd00acaa95e24360bf9a80
-
SSDEEP
6144:lcm7ImGddXmNt251UriZFwT+aZKl7pg1xBn:H7Tc2NYHUrAwT+OKLSjn
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral1/memory/3044-11-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2784-8-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/3044-18-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2796-34-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2932-30-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2932-29-0x0000000000310000-0x00000000003D4000-memory.dmp family_blackmoon behavioral1/memory/2796-40-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2796-39-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2620-50-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2620-52-0x0000000001E20000-0x0000000001EE4000-memory.dmp family_blackmoon behavioral1/memory/2488-62-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2580-60-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2488-71-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2468-74-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2468-79-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1736-82-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2468-80-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1736-90-0x0000000001E10000-0x0000000001ED4000-memory.dmp family_blackmoon behavioral1/memory/1672-95-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1736-92-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2420-110-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1856-129-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1856-134-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/664-143-0x0000000000220000-0x00000000002E4000-memory.dmp family_blackmoon behavioral1/memory/664-144-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1540-155-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2224-153-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2016-167-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1540-164-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2824-175-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2016-174-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2824-182-0x0000000001E00000-0x0000000001EC4000-memory.dmp family_blackmoon behavioral1/memory/2824-184-0x0000000001E00000-0x0000000001EC4000-memory.dmp family_blackmoon behavioral1/memory/2656-188-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2656-194-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/336-198-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/336-204-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/588-214-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2552-216-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2552-223-0x0000000000310000-0x00000000003D4000-memory.dmp family_blackmoon behavioral1/memory/2184-228-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2552-224-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2176-235-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2184-233-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2176-244-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1572-247-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/748-261-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2036-263-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/564-273-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2036-271-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/564-281-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2260-283-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1248-294-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2260-291-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1248-300-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2844-305-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1248-302-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2844-311-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1276-314-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/3040-324-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1276-322-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2928-331-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2664-340-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2664-346-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnbbhn.exeddvvd.exevpjpd.exejjdpj.exehbhnbh.exenhhbhn.exejdpjp.exerlrxlrl.exeffxlxxl.exehbtttt.exejdppp.exefxflxxf.exe7nbbhh.exeddvjd.exe3hbhhh.exejdvdv.exellfrfxl.exehhnthh.exe7jvvv.exerflrxfl.exebthhtt.exetthhhn.exehbnnbb.exedvvvv.exexxrfllr.exexfxlfxr.exevdppd.exelrlrflx.exebbnbnt.exejjvjp.exexxrfllx.exebbthbn.exe3vpdd.exennhnbb.exehnthnh.exeffrrxxl.exebbnthh.exe1jppv.exefxrlxfx.exe9tntbh.exepdvdd.exennnthh.exepvvvj.exefxllrxl.exebhbtnb.exejpdpj.exe1lxlrrf.exebbtbtt.exejjjvj.exerrlrflf.exepdvdp.exellxflfl.exetnbbbh.exe5pdvd.exe7hhthb.exetbtthn.exe3vpvj.exefffflrx.exennhthb.exe7dvvv.exe9xrxffr.exennbhth.exedvjpd.exellflxxl.exepid process 3044 tnbbhn.exe 2932 ddvvd.exe 2796 vpjpd.exe 2620 jjdpj.exe 2580 hbhnbh.exe 2488 nhhbhn.exe 2468 jdpjp.exe 1736 rlrxlrl.exe 1672 ffxlxxl.exe 2420 hbtttt.exe 2440 jdppp.exe 1316 fxflxxf.exe 1856 7nbbhh.exe 664 ddvjd.exe 2224 3hbhhh.exe 1540 jdvdv.exe 2016 llfrfxl.exe 2824 hhnthh.exe 2656 7jvvv.exe 336 rflrxfl.exe 588 bthhtt.exe 2552 tthhhn.exe 2184 hbnnbb.exe 2176 dvvvv.exe 1572 xxrfllr.exe 748 xfxlfxr.exe 2036 vdppd.exe 564 lrlrflx.exe 2260 bbnbnt.exe 1248 jjvjp.exe 2844 xxrfllx.exe 1276 bbthbn.exe 3040 3vpdd.exe 2928 nnhnbb.exe 2664 hnthnh.exe 2680 ffrrxxl.exe 2800 bbnthh.exe 2752 1jppv.exe 2232 fxrlxfx.exe 2520 9tntbh.exe 2484 pdvdd.exe 2516 nnnthh.exe 2880 pvvvj.exe 2964 fxllrxl.exe 1800 bhbtnb.exe 2420 jpdpj.exe 2532 1lxlrrf.exe 1852 bbtbtt.exe 1988 jjjvj.exe 1980 rrlrflf.exe 664 pdvdp.exe 2180 llxflfl.exe 1716 tnbbbh.exe 2080 5pdvd.exe 884 7hhthb.exe 1952 tbtthn.exe 2448 3vpvj.exe 2808 fffflrx.exe 1956 nnhthb.exe 1272 7dvvv.exe 1664 9xrxffr.exe 2024 nnbhth.exe 2764 dvjpd.exe 280 llflxxl.exe -
Processes:
resource yara_rule behavioral1/memory/2784-0-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3044-11-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2784-8-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2784-7-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3044-18-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2932-20-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2796-34-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2932-30-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2796-40-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2620-50-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2620-52-0x0000000001E20000-0x0000000001EE4000-memory.dmp upx behavioral1/memory/2580-60-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2488-71-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2468-74-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2468-79-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2468-80-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1672-95-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1736-92-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2420-110-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1856-129-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1856-134-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/664-144-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2224-153-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2016-167-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1540-164-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2016-174-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2824-184-0x0000000001E00000-0x0000000001EC4000-memory.dmp upx behavioral1/memory/2656-188-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2656-194-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/336-198-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/336-204-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/588-214-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2552-216-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2184-228-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2552-224-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2176-244-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1572-247-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/748-261-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2036-263-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2036-271-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/564-281-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2260-283-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1248-294-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2260-291-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2844-305-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1248-302-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2844-311-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1276-314-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3040-324-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1276-322-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2928-331-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2664-340-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2664-346-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2800-356-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2680-354-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2752-363-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2232-371-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2520-378-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2484-386-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2232-377-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2484-392-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2516-400-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2880-402-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2880-408-0x0000000000400000-0x00000000004C4000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exetnbbhn.exeddvvd.exevpjpd.exejjdpj.exehbhnbh.exenhhbhn.exejdpjp.exerlrxlrl.exeffxlxxl.exehbtttt.exejdppp.exefxflxxf.exe7nbbhh.exeddvjd.exe3hbhhh.exedescription pid process target process PID 2784 wrote to memory of 3044 2784 dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe tnbbhn.exe PID 2784 wrote to memory of 3044 2784 dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe tnbbhn.exe PID 2784 wrote to memory of 3044 2784 dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe tnbbhn.exe PID 2784 wrote to memory of 3044 2784 dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe tnbbhn.exe PID 3044 wrote to memory of 2932 3044 tnbbhn.exe ddvvd.exe PID 3044 wrote to memory of 2932 3044 tnbbhn.exe ddvvd.exe PID 3044 wrote to memory of 2932 3044 tnbbhn.exe ddvvd.exe PID 3044 wrote to memory of 2932 3044 tnbbhn.exe ddvvd.exe PID 2932 wrote to memory of 2796 2932 ddvvd.exe vpjpd.exe PID 2932 wrote to memory of 2796 2932 ddvvd.exe vpjpd.exe PID 2932 wrote to memory of 2796 2932 ddvvd.exe vpjpd.exe PID 2932 wrote to memory of 2796 2932 ddvvd.exe vpjpd.exe PID 2796 wrote to memory of 2620 2796 vpjpd.exe jjdpj.exe PID 2796 wrote to memory of 2620 2796 vpjpd.exe jjdpj.exe PID 2796 wrote to memory of 2620 2796 vpjpd.exe jjdpj.exe PID 2796 wrote to memory of 2620 2796 vpjpd.exe jjdpj.exe PID 2620 wrote to memory of 2580 2620 jjdpj.exe hbhnbh.exe PID 2620 wrote to memory of 2580 2620 jjdpj.exe hbhnbh.exe PID 2620 wrote to memory of 2580 2620 jjdpj.exe hbhnbh.exe PID 2620 wrote to memory of 2580 2620 jjdpj.exe hbhnbh.exe PID 2580 wrote to memory of 2488 2580 hbhnbh.exe nhhbhn.exe PID 2580 wrote to memory of 2488 2580 hbhnbh.exe nhhbhn.exe PID 2580 wrote to memory of 2488 2580 hbhnbh.exe nhhbhn.exe PID 2580 wrote to memory of 2488 2580 hbhnbh.exe nhhbhn.exe PID 2488 wrote to memory of 2468 2488 nhhbhn.exe jdpjp.exe PID 2488 wrote to memory of 2468 2488 nhhbhn.exe jdpjp.exe PID 2488 wrote to memory of 2468 2488 nhhbhn.exe jdpjp.exe PID 2488 wrote to memory of 2468 2488 nhhbhn.exe jdpjp.exe PID 2468 wrote to memory of 1736 2468 jdpjp.exe rlrxlrl.exe PID 2468 wrote to memory of 1736 2468 jdpjp.exe rlrxlrl.exe PID 2468 wrote to memory of 1736 2468 jdpjp.exe rlrxlrl.exe PID 2468 wrote to memory of 1736 2468 jdpjp.exe rlrxlrl.exe PID 1736 wrote to memory of 1672 1736 rlrxlrl.exe ffxlxxl.exe PID 1736 wrote to memory of 1672 1736 rlrxlrl.exe ffxlxxl.exe PID 1736 wrote to memory of 1672 1736 rlrxlrl.exe ffxlxxl.exe PID 1736 wrote to memory of 1672 1736 rlrxlrl.exe ffxlxxl.exe PID 1672 wrote to memory of 2420 1672 ffxlxxl.exe hbtttt.exe PID 1672 wrote to memory of 2420 1672 ffxlxxl.exe hbtttt.exe PID 1672 wrote to memory of 2420 1672 ffxlxxl.exe hbtttt.exe PID 1672 wrote to memory of 2420 1672 ffxlxxl.exe hbtttt.exe PID 2420 wrote to memory of 2440 2420 hbtttt.exe jdppp.exe PID 2420 wrote to memory of 2440 2420 hbtttt.exe jdppp.exe PID 2420 wrote to memory of 2440 2420 hbtttt.exe jdppp.exe PID 2420 wrote to memory of 2440 2420 hbtttt.exe jdppp.exe PID 2440 wrote to memory of 1316 2440 jdppp.exe fxflxxf.exe PID 2440 wrote to memory of 1316 2440 jdppp.exe fxflxxf.exe PID 2440 wrote to memory of 1316 2440 jdppp.exe fxflxxf.exe PID 2440 wrote to memory of 1316 2440 jdppp.exe fxflxxf.exe PID 1316 wrote to memory of 1856 1316 fxflxxf.exe 7nbbhh.exe PID 1316 wrote to memory of 1856 1316 fxflxxf.exe 7nbbhh.exe PID 1316 wrote to memory of 1856 1316 fxflxxf.exe 7nbbhh.exe PID 1316 wrote to memory of 1856 1316 fxflxxf.exe 7nbbhh.exe PID 1856 wrote to memory of 664 1856 7nbbhh.exe ddvjd.exe PID 1856 wrote to memory of 664 1856 7nbbhh.exe ddvjd.exe PID 1856 wrote to memory of 664 1856 7nbbhh.exe ddvjd.exe PID 1856 wrote to memory of 664 1856 7nbbhh.exe ddvjd.exe PID 664 wrote to memory of 2224 664 ddvjd.exe 3hbhhh.exe PID 664 wrote to memory of 2224 664 ddvjd.exe 3hbhhh.exe PID 664 wrote to memory of 2224 664 ddvjd.exe 3hbhhh.exe PID 664 wrote to memory of 2224 664 ddvjd.exe 3hbhhh.exe PID 2224 wrote to memory of 1540 2224 3hbhhh.exe jdvdv.exe PID 2224 wrote to memory of 1540 2224 3hbhhh.exe jdvdv.exe PID 2224 wrote to memory of 1540 2224 3hbhhh.exe jdvdv.exe PID 2224 wrote to memory of 1540 2224 3hbhhh.exe jdvdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dcd0ea1fc7b348236c10843855911480_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\tnbbhn.exec:\tnbbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\ddvvd.exec:\ddvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\vpjpd.exec:\vpjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\jjdpj.exec:\jjdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hbhnbh.exec:\hbhnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\nhhbhn.exec:\nhhbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\jdpjp.exec:\jdpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\rlrxlrl.exec:\rlrxlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\hbtttt.exec:\hbtttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\jdppp.exec:\jdppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\fxflxxf.exec:\fxflxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\7nbbhh.exec:\7nbbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\ddvjd.exec:\ddvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\3hbhhh.exec:\3hbhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\jdvdv.exec:\jdvdv.exe17⤵
- Executes dropped EXE
PID:1540 -
\??\c:\llfrfxl.exec:\llfrfxl.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hhnthh.exec:\hhnthh.exe19⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7jvvv.exec:\7jvvv.exe20⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rflrxfl.exec:\rflrxfl.exe21⤵
- Executes dropped EXE
PID:336 -
\??\c:\bthhtt.exec:\bthhtt.exe22⤵
- Executes dropped EXE
PID:588 -
\??\c:\tthhhn.exec:\tthhhn.exe23⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hbnnbb.exec:\hbnnbb.exe24⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dvvvv.exec:\dvvvv.exe25⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xxrfllr.exec:\xxrfllr.exe26⤵
- Executes dropped EXE
PID:1572 -
\??\c:\xfxlfxr.exec:\xfxlfxr.exe27⤵
- Executes dropped EXE
PID:748 -
\??\c:\vdppd.exec:\vdppd.exe28⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lrlrflx.exec:\lrlrflx.exe29⤵
- Executes dropped EXE
PID:564 -
\??\c:\bbnbnt.exec:\bbnbnt.exe30⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jjvjp.exec:\jjvjp.exe31⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xxrfllx.exec:\xxrfllx.exe32⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bbthbn.exec:\bbthbn.exe33⤵
- Executes dropped EXE
PID:1276 -
\??\c:\3vpdd.exec:\3vpdd.exe34⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nnhnbb.exec:\nnhnbb.exe35⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hnthnh.exec:\hnthnh.exe36⤵
- Executes dropped EXE
PID:2664 -
\??\c:\ffrrxxl.exec:\ffrrxxl.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bbnthh.exec:\bbnthh.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\1jppv.exec:\1jppv.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\fxrlxfx.exec:\fxrlxfx.exe40⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9tntbh.exec:\9tntbh.exe41⤵
- Executes dropped EXE
PID:2520 -
\??\c:\pdvdd.exec:\pdvdd.exe42⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nnnthh.exec:\nnnthh.exe43⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pvvvj.exec:\pvvvj.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\fxllrxl.exec:\fxllrxl.exe45⤵
- Executes dropped EXE
PID:2964 -
\??\c:\bhbtnb.exec:\bhbtnb.exe46⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jpdpj.exec:\jpdpj.exe47⤵
- Executes dropped EXE
PID:2420 -
\??\c:\1lxlrrf.exec:\1lxlrrf.exe48⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bbtbtt.exec:\bbtbtt.exe49⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jjjvj.exec:\jjjvj.exe50⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rrlrflf.exec:\rrlrflf.exe51⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pdvdp.exec:\pdvdp.exe52⤵
- Executes dropped EXE
PID:664 -
\??\c:\llxflfl.exec:\llxflfl.exe53⤵
- Executes dropped EXE
PID:2180 -
\??\c:\tnbbbh.exec:\tnbbbh.exe54⤵
- Executes dropped EXE
PID:1716 -
\??\c:\5pdvd.exec:\5pdvd.exe55⤵
- Executes dropped EXE
PID:2080 -
\??\c:\7hhthb.exec:\7hhthb.exe56⤵
- Executes dropped EXE
PID:884 -
\??\c:\tbtthn.exec:\tbtthn.exe57⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3vpvj.exec:\3vpvj.exe58⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fffflrx.exec:\fffflrx.exe59⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nnhthb.exec:\nnhthb.exe60⤵
- Executes dropped EXE
PID:1956 -
\??\c:\7dvvv.exec:\7dvvv.exe61⤵
- Executes dropped EXE
PID:1272 -
\??\c:\9xrxffr.exec:\9xrxffr.exe62⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nnbhth.exec:\nnbhth.exe63⤵
- Executes dropped EXE
PID:2024 -
\??\c:\dvjpd.exec:\dvjpd.exe64⤵
- Executes dropped EXE
PID:2764 -
\??\c:\llflxxl.exec:\llflxxl.exe65⤵
- Executes dropped EXE
PID:280 -
\??\c:\hhhtht.exec:\hhhtht.exe66⤵PID:2152
-
\??\c:\ddppp.exec:\ddppp.exe67⤵PID:3016
-
\??\c:\3flrxlx.exec:\3flrxlx.exe68⤵PID:1356
-
\??\c:\bhbnbn.exec:\bhbnbn.exe69⤵PID:1060
-
\??\c:\7vjjv.exec:\7vjjv.exe70⤵PID:748
-
\??\c:\xlflrxr.exec:\xlflrxr.exe71⤵PID:1748
-
\??\c:\rlflrxl.exec:\rlflrxl.exe72⤵PID:1668
-
\??\c:\3hbthh.exec:\3hbthh.exe73⤵PID:564
-
\??\c:\djdjp.exec:\djdjp.exe74⤵PID:2260
-
\??\c:\llxlrxr.exec:\llxlrxr.exe75⤵PID:2544
-
\??\c:\5bnhtt.exec:\5bnhtt.exe76⤵PID:1004
-
\??\c:\dvjjd.exec:\dvjjd.exe77⤵PID:1616
-
\??\c:\nbhhtb.exec:\nbhhtb.exe78⤵PID:2972
-
\??\c:\7thbhb.exec:\7thbhb.exe79⤵PID:2200
-
\??\c:\pdppv.exec:\pdppv.exe80⤵PID:2572
-
\??\c:\xrfrxfr.exec:\xrfrxfr.exe81⤵PID:2592
-
\??\c:\tttbbn.exec:\tttbbn.exe82⤵PID:2596
-
\??\c:\nbttbh.exec:\nbttbh.exe83⤵PID:2800
-
\??\c:\pjvpp.exec:\pjvpp.exe84⤵PID:2500
-
\??\c:\lxllllr.exec:\lxllllr.exe85⤵PID:2956
-
\??\c:\7tnnnt.exec:\7tnnnt.exe86⤵PID:2520
-
\??\c:\bnhhhb.exec:\bnhhhb.exe87⤵PID:2460
-
\??\c:\ddpvd.exec:\ddpvd.exe88⤵PID:2888
-
\??\c:\xrffrxf.exec:\xrffrxf.exe89⤵PID:2508
-
\??\c:\1bnnth.exec:\1bnnth.exe90⤵PID:320
-
\??\c:\1httth.exec:\1httth.exe91⤵PID:2568
-
\??\c:\3vjjd.exec:\3vjjd.exe92⤵PID:2756
-
\??\c:\9fxfffl.exec:\9fxfffl.exe93⤵PID:1704
-
\??\c:\hthhnh.exec:\hthhnh.exe94⤵PID:352
-
\??\c:\pjpvd.exec:\pjpvd.exe95⤵PID:1708
-
\??\c:\jdppj.exec:\jdppj.exe96⤵PID:2488
-
\??\c:\xxxrxxf.exec:\xxxrxxf.exe97⤵PID:1316
-
\??\c:\nhtbhb.exec:\nhtbhb.exe98⤵PID:1684
-
\??\c:\vpddj.exec:\vpddj.exe99⤵PID:2360
-
\??\c:\jvjpd.exec:\jvjpd.exe100⤵PID:2396
-
\??\c:\llxfxfl.exec:\llxfxfl.exe101⤵PID:1344
-
\??\c:\tbtbhb.exec:\tbtbhb.exe102⤵PID:2300
-
\??\c:\dpvjj.exec:\dpvjj.exe103⤵PID:2112
-
\??\c:\pjpjp.exec:\pjpjp.exe104⤵PID:2812
-
\??\c:\frxrrlr.exec:\frxrrlr.exe105⤵PID:884
-
\??\c:\tnbbbt.exec:\tnbbbt.exe106⤵PID:1172
-
\??\c:\9pddd.exec:\9pddd.exe107⤵PID:2276
-
\??\c:\dpvpv.exec:\dpvpv.exe108⤵PID:1500
-
\??\c:\1lxxxxf.exec:\1lxxxxf.exe109⤵PID:704
-
\??\c:\7nbbhh.exec:\7nbbhh.exe110⤵PID:820
-
\??\c:\dpvdj.exec:\dpvdj.exe111⤵PID:1900
-
\??\c:\vvjjp.exec:\vvjjp.exe112⤵PID:2432
-
\??\c:\rlrflll.exec:\rlrflll.exe113⤵PID:1104
-
\??\c:\nbhhtt.exec:\nbhhtt.exe114⤵PID:1560
-
\??\c:\dvjjp.exec:\dvjjp.exe115⤵PID:1788
-
\??\c:\vjddj.exec:\vjddj.exe116⤵PID:2124
-
\??\c:\7rrrrxx.exec:\7rrrrxx.exe117⤵PID:1040
-
\??\c:\1htttt.exec:\1htttt.exe118⤵PID:1064
-
\??\c:\pdppd.exec:\pdppd.exe119⤵PID:2008
-
\??\c:\vvddp.exec:\vvddp.exe120⤵PID:1284
-
\??\c:\fxxfrfl.exec:\fxxfrfl.exe121⤵PID:1680
-
\??\c:\hbhbhb.exec:\hbhbhb.exe122⤵PID:1812
-
\??\c:\tttnbt.exec:\tttnbt.exe123⤵PID:2204
-
\??\c:\5dvjj.exec:\5dvjj.exe124⤵PID:1264
-
\??\c:\ffxxrlr.exec:\ffxxrlr.exe125⤵PID:2744
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe126⤵PID:2784
-
\??\c:\ttttht.exec:\ttttht.exe127⤵PID:3040
-
\??\c:\jdddj.exec:\jdddj.exe128⤵PID:3064
-
\??\c:\7xfflrr.exec:\7xfflrr.exe129⤵PID:1412
-
\??\c:\rxrrffl.exec:\rxrrffl.exe130⤵PID:2676
-
\??\c:\3btbhn.exec:\3btbhn.exe131⤵PID:2792
-
\??\c:\5pdvd.exec:\5pdvd.exe132⤵PID:2752
-
\??\c:\1dpvd.exec:\1dpvd.exe133⤵PID:2732
-
\??\c:\9fllrrf.exec:\9fllrrf.exe134⤵PID:2976
-
\??\c:\9btnbb.exec:\9btnbb.exe135⤵PID:2636
-
\??\c:\7vdpd.exec:\7vdpd.exe136⤵PID:2672
-
\??\c:\vjdjv.exec:\vjdjv.exe137⤵PID:2536
-
\??\c:\lfxxfll.exec:\lfxxfll.exe138⤵PID:2864
-
\??\c:\hththn.exec:\hththn.exe139⤵PID:2700
-
\??\c:\jjjpv.exec:\jjjpv.exe140⤵PID:1596
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe141⤵PID:1468
-
\??\c:\5lrrxxx.exec:\5lrrxxx.exe142⤵PID:2452
-
\??\c:\thbhtb.exec:\thbhtb.exe143⤵PID:2164
-
\??\c:\llflxxl.exec:\llflxxl.exe144⤵PID:1776
-
\??\c:\rrrxlxl.exec:\rrrxlxl.exe145⤵PID:312
-
\??\c:\tbthnb.exec:\tbthnb.exe146⤵PID:2416
-
\??\c:\pdvdv.exec:\pdvdv.exe147⤵PID:1988
-
\??\c:\fxxfflx.exec:\fxxfflx.exe148⤵PID:2388
-
\??\c:\tntbhh.exec:\tntbhh.exe149⤵PID:2392
-
\??\c:\tnbhth.exec:\tnbhth.exe150⤵PID:2224
-
\??\c:\5vpvd.exec:\5vpvd.exe151⤵PID:2560
-
\??\c:\lffflxf.exec:\lffflxf.exe152⤵PID:2444
-
\??\c:\ntnthb.exec:\ntnthb.exe153⤵PID:1348
-
\??\c:\5vdpp.exec:\5vdpp.exe154⤵PID:1952
-
\??\c:\xxlxffx.exec:\xxlxffx.exe155⤵PID:2824
-
\??\c:\hbbnbh.exec:\hbbnbh.exe156⤵PID:536
-
\??\c:\7btbnn.exec:\7btbnn.exe157⤵PID:1120
-
\??\c:\ppdpd.exec:\ppdpd.exe158⤵PID:1272
-
\??\c:\llrxxxf.exec:\llrxxxf.exe159⤵PID:1100
-
\??\c:\thttbh.exec:\thttbh.exe160⤵PID:344
-
\??\c:\nnbnhn.exec:\nnbnhn.exe161⤵PID:400
-
\??\c:\vpvpp.exec:\vpvpp.exe162⤵PID:280
-
\??\c:\dvppv.exec:\dvppv.exe163⤵PID:1632
-
\??\c:\fffxxrf.exec:\fffxxrf.exe164⤵PID:3016
-
\??\c:\7bhhnn.exec:\7bhhnn.exe165⤵PID:1636
-
\??\c:\vpdpd.exec:\vpdpd.exe166⤵PID:112
-
\??\c:\ddpvd.exec:\ddpvd.exe167⤵PID:1828
-
\??\c:\xrflrrf.exec:\xrflrrf.exe168⤵PID:844
-
\??\c:\hbtttb.exec:\hbtttb.exe169⤵PID:1080
-
\??\c:\ntnbtb.exec:\ntnbtb.exe170⤵PID:2892
-
\??\c:\ppjpv.exec:\ppjpv.exe171⤵PID:1744
-
\??\c:\7flrxff.exec:\7flrxff.exe172⤵PID:2356
-
\??\c:\bbtthh.exec:\bbtthh.exe173⤵PID:2544
-
\??\c:\3pjvp.exec:\3pjvp.exe174⤵PID:1276
-
\??\c:\vpdvj.exec:\vpdvj.exe175⤵PID:1616
-
\??\c:\xxflrxf.exec:\xxflrxf.exe176⤵PID:2972
-
\??\c:\1thhnn.exec:\1thhnn.exe177⤵PID:2928
-
\??\c:\9nnthn.exec:\9nnthn.exe178⤵PID:2192
-
\??\c:\7pjpd.exec:\7pjpd.exe179⤵PID:2592
-
\??\c:\xxxfrxr.exec:\xxxfrxr.exe180⤵PID:2708
-
\??\c:\rrlflrf.exec:\rrlflrf.exe181⤵PID:2800
-
\??\c:\nnhntb.exec:\nnhntb.exe182⤵PID:1688
-
\??\c:\vvvdp.exec:\vvvdp.exe183⤵PID:2688
-
\??\c:\lffxxll.exec:\lffxxll.exe184⤵PID:2584
-
\??\c:\fffrllx.exec:\fffrllx.exe185⤵PID:2484
-
\??\c:\ntnthn.exec:\ntnthn.exe186⤵PID:2672
-
\??\c:\dvdpd.exec:\dvdpd.exe187⤵PID:2540
-
\??\c:\9pddd.exec:\9pddd.exe188⤵PID:320
-
\??\c:\xxrlllr.exec:\xxrlllr.exe189⤵PID:2944
-
\??\c:\tttbbb.exec:\tttbbb.exe190⤵PID:2756
-
\??\c:\ppjpj.exec:\ppjpj.exe191⤵PID:1800
-
\??\c:\5vjjp.exec:\5vjjp.exe192⤵PID:2524
-
\??\c:\9flfffl.exec:\9flfffl.exe193⤵PID:696
-
\??\c:\hbhhnt.exec:\hbhhnt.exe194⤵PID:2704
-
\??\c:\ppjvp.exec:\ppjvp.exe195⤵PID:768
-
\??\c:\pvvpv.exec:\pvvpv.exe196⤵PID:2380
-
\??\c:\1rlrllf.exec:\1rlrllf.exe197⤵PID:1820
-
\??\c:\hnnbnt.exec:\hnnbnt.exe198⤵PID:632
-
\??\c:\ppddj.exec:\ppddj.exe199⤵PID:2216
-
\??\c:\llflxfr.exec:\llflxfr.exe200⤵PID:2300
-
\??\c:\xrflflr.exec:\xrflflr.exe201⤵PID:2112
-
\??\c:\hhhnbb.exec:\hhhnbb.exe202⤵PID:2812
-
\??\c:\ppjdj.exec:\ppjdj.exe203⤵PID:480
-
\??\c:\5vdjd.exec:\5vdjd.exe204⤵PID:1712
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe205⤵PID:944
-
\??\c:\bbtnhn.exec:\bbtnhn.exe206⤵PID:852
-
\??\c:\hnbnbn.exec:\hnbnbn.exe207⤵PID:704
-
\??\c:\pdpdj.exec:\pdpdj.exe208⤵PID:820
-
\??\c:\lrlfrfx.exec:\lrlfrfx.exe209⤵PID:1900
-
\??\c:\1btnhb.exec:\1btnhb.exe210⤵PID:1692
-
\??\c:\thnnnh.exec:\thnnnh.exe211⤵PID:2408
-
\??\c:\ddvdd.exec:\ddvdd.exe212⤵PID:1420
-
\??\c:\frfxrfl.exec:\frfxrfl.exe213⤵PID:1356
-
\??\c:\3rrxfrf.exec:\3rrxfrf.exe214⤵PID:2124
-
\??\c:\bbnhtn.exec:\bbnhtn.exe215⤵PID:1044
-
\??\c:\9vpvj.exec:\9vpvj.exe216⤵PID:1012
-
\??\c:\lrlxrxl.exec:\lrlxrxl.exe217⤵PID:1752
-
\??\c:\3xllrxl.exec:\3xllrxl.exe218⤵PID:1284
-
\??\c:\httnhb.exec:\httnhb.exe219⤵PID:1248
-
\??\c:\vpjpd.exec:\vpjpd.exe220⤵PID:2212
-
\??\c:\pjdjp.exec:\pjdjp.exe221⤵PID:2228
-
\??\c:\3btthb.exec:\3btthb.exe222⤵PID:2916
-
\??\c:\dvpvp.exec:\dvpvp.exe223⤵PID:2556
-
\??\c:\1xllrrr.exec:\1xllrrr.exe224⤵PID:2652
-
\??\c:\fffrlrf.exec:\fffrlrf.exe225⤵PID:2920
-
\??\c:\hbnbbn.exec:\hbnbbn.exe226⤵PID:1296
-
\??\c:\djdpd.exec:\djdpd.exe227⤵PID:1412
-
\??\c:\flllffr.exec:\flllffr.exe228⤵PID:2684
-
\??\c:\5ffflxf.exec:\5ffflxf.exe229⤵PID:2660
-
\??\c:\ntbttb.exec:\ntbttb.exe230⤵PID:2752
-
\??\c:\jpvdv.exec:\jpvdv.exe231⤵PID:2576
-
\??\c:\lfrflrx.exec:\lfrflrx.exe232⤵PID:2580
-
\??\c:\bhntnb.exec:\bhntnb.exe233⤵PID:2496
-
\??\c:\5btnbt.exec:\5btnbt.exe234⤵PID:2632
-
\??\c:\dvvjv.exec:\dvvjv.exe235⤵PID:2324
-
\??\c:\flfxllx.exec:\flfxllx.exe236⤵PID:3028
-
\??\c:\xrflxrl.exec:\xrflxrl.exe237⤵PID:1656
-
\??\c:\hntnbh.exec:\hntnbh.exe238⤵PID:356
-
\??\c:\jjvvp.exec:\jjvvp.exe239⤵PID:2504
-
\??\c:\jppvd.exec:\jppvd.exe240⤵PID:2624
-
\??\c:\xrllrxl.exec:\xrllrxl.exe241⤵PID:1360
-
\??\c:\nhhhhh.exec:\nhhhhh.exe242⤵PID:1776