Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:25
Behavioral task
behavioral1
Sample
e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe
-
Size
537KB
-
MD5
e2c5b7ea01deb2fd21859fd58c3cf4f0
-
SHA1
ad7db572d2aa10d82fbd4609cf15f14484e1c7dd
-
SHA256
f6e54a24dfbfad59920a59fcdb8b0056b8c92f920b9908ac3e31af09793dc35f
-
SHA512
bd0c585cdb3bceeb5f81171789062dec8be93f3c46e42988a4fc13fc20d7238bb2aa7b4a92d6cbb9906c9a99b804058ecd6dccf573c2e1fc1465da98461e9182
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZd:HFp3lzZbGa5sod
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2864-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1280-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/364-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2184-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/692-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3388-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2744-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3788-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-714-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-748-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-752-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-756-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-764-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-782-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-929-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lrxrrrl.exenhnnhh.exevpvvd.exerllfxxr.exe3btnhb.exehhnhnt.exevjvvp.exepvpjd.exerrfffrl.exenbtnnh.exejvdvv.exehtthtt.exetbnhbb.exethnhnh.exehhthbb.exejddpd.exebhnbnh.exeffxrlfx.exe9jpdp.exehtthbb.exevpvdp.exelxfxlfx.exellxrrxl.exehbhthn.exedjjdp.exedpjvj.exerffrlfx.exehbthbn.exedvjdp.exenhbnhb.exejjjdp.exehtbtth.exerxlflfl.exe1lrlflf.exethhbbb.exepdjjj.exedvjvp.exelrxlxxf.exehntnbt.exedjjvp.exefxfrlrl.exelfrlxrl.exenhnhnh.exerxrfxrr.exenbthbn.exedjvpj.exelrfxrxl.exenhnhhb.exe9hnhtn.exevppjd.exefxrxlfx.exetbhttn.exevpdvj.exexxfxrxr.exexlfxlfr.exenhthnt.exeppppv.exefrrfxlf.exebhtnhb.exejddvv.exerllxrlx.exenbbthb.exejdjdv.exexrlxrlx.exepid process 3116 lrxrrrl.exe 2080 nhnnhh.exe 1632 vpvvd.exe 3372 rllfxxr.exe 636 3btnhb.exe 1888 hhnhnt.exe 2972 vjvvp.exe 4168 pvpjd.exe 3784 rrfffrl.exe 3880 nbtnnh.exe 1280 jvdvv.exe 5048 htthtt.exe 5100 tbnhbb.exe 3056 thnhnh.exe 364 hhthbb.exe 4628 jddpd.exe 3292 bhnbnh.exe 4060 ffxrlfx.exe 3020 9jpdp.exe 4104 htthbb.exe 1684 vpvdp.exe 1756 lxfxlfx.exe 4732 llxrrxl.exe 4184 hbhthn.exe 1852 djjdp.exe 60 dpjvj.exe 3540 rffrlfx.exe 1092 hbthbn.exe 3120 dvjdp.exe 2360 nhbnhb.exe 4624 jjjdp.exe 3368 htbtth.exe 3228 rxlflfl.exe 2324 1lrlflf.exe 4656 thhbbb.exe 1500 pdjjj.exe 844 dvjvp.exe 4460 lrxlxxf.exe 4756 hntnbt.exe 4040 djjvp.exe 2092 fxfrlrl.exe 1132 lfrlxrl.exe 2380 nhnhnh.exe 3372 rxrfxrr.exe 2968 nbthbn.exe 2868 djvpj.exe 2184 lrfxrxl.exe 692 nhnhhb.exe 3388 9hnhtn.exe 2180 vppjd.exe 2744 fxrxlfx.exe 2104 tbhttn.exe 2608 vpdvj.exe 1428 xxfxrxr.exe 4876 xlfxlfr.exe 3056 nhthnt.exe 364 ppppv.exe 2812 frrfxlf.exe 4008 bhtnhb.exe 4716 jddvv.exe 3552 rllxrlx.exe 2392 nbbthb.exe 964 jdjdv.exe 2272 xrlxrlx.exe -
Processes:
resource yara_rule behavioral2/memory/2864-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrxrrrl.exe upx behavioral2/memory/3116-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnnhh.exe upx behavioral2/memory/3116-12-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vpvvd.exe upx \??\c:\rllfxxr.exe upx behavioral2/memory/3372-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1632-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2080-14-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3btnhb.exe upx behavioral2/memory/636-35-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhnhnt.exe upx behavioral2/memory/1888-38-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vjvvp.exe upx behavioral2/memory/2972-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvpjd.exe upx C:\rrfffrl.exe upx behavioral2/memory/4168-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbtnnh.exe upx behavioral2/memory/3784-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvdvv.exe upx behavioral2/memory/3880-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1280-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htthtt.exe upx behavioral2/memory/5048-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5100-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thnhnh.exe upx \??\c:\tbnhbb.exe upx C:\hhthbb.exe upx behavioral2/memory/3056-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/364-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddpd.exe upx C:\bhnbnh.exe upx behavioral2/memory/4628-102-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ffxrlfx.exe upx behavioral2/memory/3292-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4060-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9jpdp.exe upx behavioral2/memory/4060-114-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\htthbb.exe upx C:\vpvdp.exe upx behavioral2/memory/1684-128-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxfxlfx.exe upx behavioral2/memory/4104-127-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llxrrxl.exe upx \??\c:\hbhthn.exe upx \??\c:\djjdp.exe upx C:\dpjvj.exe upx behavioral2/memory/60-153-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rffrlfx.exe upx C:\hbthbn.exe upx \??\c:\dvjdp.exe upx behavioral2/memory/3120-171-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbnhb.exe upx behavioral2/memory/2360-176-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjdp.exe upx \??\c:\htbtth.exe upx behavioral2/memory/3228-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4656-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/844-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4756-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2092-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1132-224-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exelrxrrrl.exenhnnhh.exevpvvd.exerllfxxr.exe3btnhb.exehhnhnt.exevjvvp.exepvpjd.exerrfffrl.exenbtnnh.exejvdvv.exehtthtt.exetbnhbb.exethnhnh.exehhthbb.exejddpd.exebhnbnh.exeffxrlfx.exe9jpdp.exehtthbb.exevpvdp.exedescription pid process target process PID 2864 wrote to memory of 3116 2864 e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe lrxrrrl.exe PID 2864 wrote to memory of 3116 2864 e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe lrxrrrl.exe PID 2864 wrote to memory of 3116 2864 e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe lrxrrrl.exe PID 3116 wrote to memory of 2080 3116 lrxrrrl.exe nhnnhh.exe PID 3116 wrote to memory of 2080 3116 lrxrrrl.exe nhnnhh.exe PID 3116 wrote to memory of 2080 3116 lrxrrrl.exe nhnnhh.exe PID 2080 wrote to memory of 1632 2080 nhnnhh.exe vpvvd.exe PID 2080 wrote to memory of 1632 2080 nhnnhh.exe vpvvd.exe PID 2080 wrote to memory of 1632 2080 nhnnhh.exe vpvvd.exe PID 1632 wrote to memory of 3372 1632 vpvvd.exe rllfxxr.exe PID 1632 wrote to memory of 3372 1632 vpvvd.exe rllfxxr.exe PID 1632 wrote to memory of 3372 1632 vpvvd.exe rllfxxr.exe PID 3372 wrote to memory of 636 3372 rllfxxr.exe 3btnhb.exe PID 3372 wrote to memory of 636 3372 rllfxxr.exe 3btnhb.exe PID 3372 wrote to memory of 636 3372 rllfxxr.exe 3btnhb.exe PID 636 wrote to memory of 1888 636 3btnhb.exe hhnhnt.exe PID 636 wrote to memory of 1888 636 3btnhb.exe hhnhnt.exe PID 636 wrote to memory of 1888 636 3btnhb.exe hhnhnt.exe PID 1888 wrote to memory of 2972 1888 hhnhnt.exe vjvvp.exe PID 1888 wrote to memory of 2972 1888 hhnhnt.exe vjvvp.exe PID 1888 wrote to memory of 2972 1888 hhnhnt.exe vjvvp.exe PID 2972 wrote to memory of 4168 2972 vjvvp.exe pvpjd.exe PID 2972 wrote to memory of 4168 2972 vjvvp.exe pvpjd.exe PID 2972 wrote to memory of 4168 2972 vjvvp.exe pvpjd.exe PID 4168 wrote to memory of 3784 4168 pvpjd.exe rrfffrl.exe PID 4168 wrote to memory of 3784 4168 pvpjd.exe rrfffrl.exe PID 4168 wrote to memory of 3784 4168 pvpjd.exe rrfffrl.exe PID 3784 wrote to memory of 3880 3784 rrfffrl.exe nbtnnh.exe PID 3784 wrote to memory of 3880 3784 rrfffrl.exe nbtnnh.exe PID 3784 wrote to memory of 3880 3784 rrfffrl.exe nbtnnh.exe PID 3880 wrote to memory of 1280 3880 nbtnnh.exe jvdvv.exe PID 3880 wrote to memory of 1280 3880 nbtnnh.exe jvdvv.exe PID 3880 wrote to memory of 1280 3880 nbtnnh.exe jvdvv.exe PID 1280 wrote to memory of 5048 1280 jvdvv.exe htthtt.exe PID 1280 wrote to memory of 5048 1280 jvdvv.exe htthtt.exe PID 1280 wrote to memory of 5048 1280 jvdvv.exe htthtt.exe PID 5048 wrote to memory of 5100 5048 htthtt.exe tbnhbb.exe PID 5048 wrote to memory of 5100 5048 htthtt.exe tbnhbb.exe PID 5048 wrote to memory of 5100 5048 htthtt.exe tbnhbb.exe PID 5100 wrote to memory of 3056 5100 tbnhbb.exe thnhnh.exe PID 5100 wrote to memory of 3056 5100 tbnhbb.exe thnhnh.exe PID 5100 wrote to memory of 3056 5100 tbnhbb.exe thnhnh.exe PID 3056 wrote to memory of 364 3056 thnhnh.exe hhthbb.exe PID 3056 wrote to memory of 364 3056 thnhnh.exe hhthbb.exe PID 3056 wrote to memory of 364 3056 thnhnh.exe hhthbb.exe PID 364 wrote to memory of 4628 364 hhthbb.exe jddpd.exe PID 364 wrote to memory of 4628 364 hhthbb.exe jddpd.exe PID 364 wrote to memory of 4628 364 hhthbb.exe jddpd.exe PID 4628 wrote to memory of 3292 4628 jddpd.exe bhnbnh.exe PID 4628 wrote to memory of 3292 4628 jddpd.exe bhnbnh.exe PID 4628 wrote to memory of 3292 4628 jddpd.exe bhnbnh.exe PID 3292 wrote to memory of 4060 3292 bhnbnh.exe ffxrlfx.exe PID 3292 wrote to memory of 4060 3292 bhnbnh.exe ffxrlfx.exe PID 3292 wrote to memory of 4060 3292 bhnbnh.exe ffxrlfx.exe PID 4060 wrote to memory of 3020 4060 ffxrlfx.exe 9jpdp.exe PID 4060 wrote to memory of 3020 4060 ffxrlfx.exe 9jpdp.exe PID 4060 wrote to memory of 3020 4060 ffxrlfx.exe 9jpdp.exe PID 3020 wrote to memory of 4104 3020 9jpdp.exe htthbb.exe PID 3020 wrote to memory of 4104 3020 9jpdp.exe htthbb.exe PID 3020 wrote to memory of 4104 3020 9jpdp.exe htthbb.exe PID 4104 wrote to memory of 1684 4104 htthbb.exe vpvdp.exe PID 4104 wrote to memory of 1684 4104 htthbb.exe vpvdp.exe PID 4104 wrote to memory of 1684 4104 htthbb.exe vpvdp.exe PID 1684 wrote to memory of 1756 1684 vpvdp.exe lxfxlfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\nhnnhh.exec:\nhnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\vpvvd.exec:\vpvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\rllfxxr.exec:\rllfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\3btnhb.exec:\3btnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\hhnhnt.exec:\hhnhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\vjvvp.exec:\vjvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\pvpjd.exec:\pvpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\rrfffrl.exec:\rrfffrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\nbtnnh.exec:\nbtnnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\jvdvv.exec:\jvdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\htthtt.exec:\htthtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\tbnhbb.exec:\tbnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\thnhnh.exec:\thnhnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\hhthbb.exec:\hhthbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\jddpd.exec:\jddpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\bhnbnh.exec:\bhnbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\9jpdp.exec:\9jpdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\htthbb.exec:\htthbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\vpvdp.exec:\vpvdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\lxfxlfx.exec:\lxfxlfx.exe23⤵
- Executes dropped EXE
PID:1756 -
\??\c:\llxrrxl.exec:\llxrrxl.exe24⤵
- Executes dropped EXE
PID:4732 -
\??\c:\hbhthn.exec:\hbhthn.exe25⤵
- Executes dropped EXE
PID:4184 -
\??\c:\djjdp.exec:\djjdp.exe26⤵
- Executes dropped EXE
PID:1852 -
\??\c:\dpjvj.exec:\dpjvj.exe27⤵
- Executes dropped EXE
PID:60 -
\??\c:\rffrlfx.exec:\rffrlfx.exe28⤵
- Executes dropped EXE
PID:3540 -
\??\c:\hbthbn.exec:\hbthbn.exe29⤵
- Executes dropped EXE
PID:1092 -
\??\c:\dvjdp.exec:\dvjdp.exe30⤵
- Executes dropped EXE
PID:3120 -
\??\c:\nhbnhb.exec:\nhbnhb.exe31⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jjjdp.exec:\jjjdp.exe32⤵
- Executes dropped EXE
PID:4624 -
\??\c:\htbtth.exec:\htbtth.exe33⤵
- Executes dropped EXE
PID:3368 -
\??\c:\rxlflfl.exec:\rxlflfl.exe34⤵
- Executes dropped EXE
PID:3228 -
\??\c:\1lrlflf.exec:\1lrlflf.exe35⤵
- Executes dropped EXE
PID:2324 -
\??\c:\thhbbb.exec:\thhbbb.exe36⤵
- Executes dropped EXE
PID:4656 -
\??\c:\pdjjj.exec:\pdjjj.exe37⤵
- Executes dropped EXE
PID:1500 -
\??\c:\dvjvp.exec:\dvjvp.exe38⤵
- Executes dropped EXE
PID:844 -
\??\c:\lrxlxxf.exec:\lrxlxxf.exe39⤵
- Executes dropped EXE
PID:4460 -
\??\c:\hntnbt.exec:\hntnbt.exe40⤵
- Executes dropped EXE
PID:4756 -
\??\c:\djjvp.exec:\djjvp.exe41⤵
- Executes dropped EXE
PID:4040 -
\??\c:\fxfrlrl.exec:\fxfrlrl.exe42⤵
- Executes dropped EXE
PID:2092 -
\??\c:\lfrlxrl.exec:\lfrlxrl.exe43⤵
- Executes dropped EXE
PID:1132 -
\??\c:\nhnhnh.exec:\nhnhnh.exe44⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rxrfxrr.exec:\rxrfxrr.exe45⤵
- Executes dropped EXE
PID:3372 -
\??\c:\nbthbn.exec:\nbthbn.exe46⤵
- Executes dropped EXE
PID:2968 -
\??\c:\djvpj.exec:\djvpj.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lrfxrxl.exec:\lrfxrxl.exe48⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nhnhhb.exec:\nhnhhb.exe49⤵
- Executes dropped EXE
PID:692 -
\??\c:\9hnhtn.exec:\9hnhtn.exe50⤵
- Executes dropped EXE
PID:3388 -
\??\c:\vppjd.exec:\vppjd.exe51⤵
- Executes dropped EXE
PID:2180 -
\??\c:\fxrxlfx.exec:\fxrxlfx.exe52⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tbhttn.exec:\tbhttn.exe53⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vpdvj.exec:\vpdvj.exe54⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xxfxrxr.exec:\xxfxrxr.exe55⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xlfxlfr.exec:\xlfxlfr.exe56⤵
- Executes dropped EXE
PID:4876 -
\??\c:\nhthnt.exec:\nhthnt.exe57⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ppppv.exec:\ppppv.exe58⤵
- Executes dropped EXE
PID:364 -
\??\c:\frrfxlf.exec:\frrfxlf.exe59⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bhtnhb.exec:\bhtnhb.exe60⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jddvv.exec:\jddvv.exe61⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rllxrlx.exec:\rllxrlx.exe62⤵
- Executes dropped EXE
PID:3552 -
\??\c:\nbbthb.exec:\nbbthb.exe63⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jdjdv.exec:\jdjdv.exe64⤵
- Executes dropped EXE
PID:964 -
\??\c:\xrlxrlx.exec:\xrlxrlx.exe65⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ttbttn.exec:\ttbttn.exe66⤵PID:640
-
\??\c:\djdvj.exec:\djdvj.exe67⤵PID:3324
-
\??\c:\lxffxrr.exec:\lxffxrr.exe68⤵PID:3400
-
\??\c:\ntbtnn.exec:\ntbtnn.exe69⤵PID:4592
-
\??\c:\dddvp.exec:\dddvp.exe70⤵PID:1896
-
\??\c:\xlrrllf.exec:\xlrrllf.exe71⤵PID:1388
-
\??\c:\btbttt.exec:\btbttt.exe72⤵PID:2740
-
\??\c:\vdppd.exec:\vdppd.exe73⤵PID:2472
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe74⤵PID:1340
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe75⤵PID:2676
-
\??\c:\bbbbhb.exec:\bbbbhb.exe76⤵PID:3788
-
\??\c:\vjdvp.exec:\vjdvp.exe77⤵PID:5040
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe78⤵PID:4388
-
\??\c:\hbbhbt.exec:\hbbhbt.exe79⤵PID:4704
-
\??\c:\nbtnbn.exec:\nbtnbn.exe80⤵PID:2544
-
\??\c:\dvvjd.exec:\dvvjd.exe81⤵PID:3100
-
\??\c:\xxlfxfx.exec:\xxlfxfx.exe82⤵PID:3660
-
\??\c:\nbnhhb.exec:\nbnhhb.exe83⤵PID:3672
-
\??\c:\vdpjd.exec:\vdpjd.exe84⤵PID:392
-
\??\c:\jdvpv.exec:\jdvpv.exe85⤵PID:4384
-
\??\c:\flllffx.exec:\flllffx.exe86⤵PID:1588
-
\??\c:\nbhthh.exec:\nbhthh.exe87⤵PID:452
-
\??\c:\thnnhb.exec:\thnnhb.exe88⤵PID:696
-
\??\c:\vjjdp.exec:\vjjdp.exe89⤵PID:1832
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe90⤵PID:4052
-
\??\c:\frrfrrf.exec:\frrfrrf.exe91⤵PID:3468
-
\??\c:\1tnhbb.exec:\1tnhbb.exe92⤵PID:2136
-
\??\c:\vjjvv.exec:\vjjvv.exe93⤵PID:3060
-
\??\c:\djpdp.exec:\djpdp.exe94⤵PID:2968
-
\??\c:\3xrlxrl.exec:\3xrlxrl.exe95⤵PID:2868
-
\??\c:\nbtnbt.exec:\nbtnbt.exe96⤵PID:2184
-
\??\c:\pddvp.exec:\pddvp.exe97⤵PID:692
-
\??\c:\jjpdv.exec:\jjpdv.exe98⤵PID:3704
-
\??\c:\hhbtht.exec:\hhbtht.exe99⤵PID:1072
-
\??\c:\tnhbtn.exec:\tnhbtn.exe100⤵PID:1644
-
\??\c:\dvppj.exec:\dvppj.exe101⤵PID:5048
-
\??\c:\rrfxxrl.exec:\rrfxxrl.exe102⤵PID:3344
-
\??\c:\nbhbhb.exec:\nbhbhb.exe103⤵PID:5100
-
\??\c:\vvdjj.exec:\vvdjj.exe104⤵PID:1880
-
\??\c:\9vpjd.exec:\9vpjd.exe105⤵PID:932
-
\??\c:\flffxxl.exec:\flffxxl.exe106⤵PID:2444
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe107⤵PID:2812
-
\??\c:\thbtnt.exec:\thbtnt.exe108⤵PID:4856
-
\??\c:\djpdv.exec:\djpdv.exe109⤵PID:4716
-
\??\c:\vddvp.exec:\vddvp.exe110⤵PID:4880
-
\??\c:\rrxrrlr.exec:\rrxrrlr.exe111⤵PID:2984
-
\??\c:\bttnhb.exec:\bttnhb.exe112⤵PID:4848
-
\??\c:\djpdp.exec:\djpdp.exe113⤵PID:4316
-
\??\c:\9djpj.exec:\9djpj.exe114⤵PID:3400
-
\??\c:\frrrxff.exec:\frrrxff.exe115⤵PID:1756
-
\??\c:\nhtnnn.exec:\nhtnnn.exe116⤵PID:2540
-
\??\c:\hnnnnt.exec:\hnnnnt.exe117⤵PID:2664
-
\??\c:\jdvpd.exec:\jdvpd.exe118⤵PID:1852
-
\??\c:\5rrlxrf.exec:\5rrlxrf.exe119⤵PID:1212
-
\??\c:\xllfxxr.exec:\xllfxxr.exe120⤵PID:4568
-
\??\c:\thnhtn.exec:\thnhtn.exe121⤵PID:3948
-
\??\c:\1jjvj.exec:\1jjvj.exe122⤵PID:1516
-
\??\c:\vjdpj.exec:\vjdpj.exe123⤵PID:2504
-
\??\c:\7frlffx.exec:\7frlffx.exe124⤵PID:3100
-
\??\c:\nhtnbt.exec:\nhtnbt.exe125⤵PID:3672
-
\??\c:\tthbtt.exec:\tthbtt.exe126⤵PID:1956
-
\??\c:\ppvjd.exec:\ppvjd.exe127⤵PID:3464
-
\??\c:\lxxrfxl.exec:\lxxrfxl.exe128⤵PID:2860
-
\??\c:\bbtnhh.exec:\bbtnhh.exe129⤵PID:1952
-
\??\c:\hnbhbt.exec:\hnbhbt.exe130⤵PID:4556
-
\??\c:\ppjpj.exec:\ppjpj.exe131⤵PID:3372
-
\??\c:\xrxffrx.exec:\xrxffrx.exe132⤵PID:2136
-
\??\c:\bnbbtb.exec:\bnbbtb.exe133⤵PID:2224
-
\??\c:\ddpjv.exec:\ddpjv.exe134⤵PID:3700
-
\??\c:\lffrlrf.exec:\lffrlrf.exe135⤵PID:2184
-
\??\c:\flrlfxx.exec:\flrlfxx.exe136⤵PID:2180
-
\??\c:\nbbnhh.exec:\nbbnhh.exe137⤵PID:2744
-
\??\c:\vvvvp.exec:\vvvvp.exe138⤵PID:1072
-
\??\c:\lfxrffx.exec:\lfxrffx.exe139⤵PID:5116
-
\??\c:\httnhb.exec:\httnhb.exe140⤵PID:2608
-
\??\c:\ttnhbt.exec:\ttnhbt.exe141⤵PID:4876
-
\??\c:\3pdvj.exec:\3pdvj.exe142⤵PID:3840
-
\??\c:\3lrfxxl.exec:\3lrfxxl.exe143⤵PID:4432
-
\??\c:\bbbnhb.exec:\bbbnhb.exe144⤵PID:2308
-
\??\c:\djpdp.exec:\djpdp.exe145⤵PID:4488
-
\??\c:\ffrfxrf.exec:\ffrfxrf.exe146⤵PID:2812
-
\??\c:\hbbthh.exec:\hbbthh.exe147⤵PID:4648
-
\??\c:\ppvpp.exec:\ppvpp.exe148⤵PID:2392
-
\??\c:\dvvpj.exec:\dvvpj.exe149⤵PID:3992
-
\??\c:\fffrlfx.exec:\fffrlfx.exe150⤵PID:4104
-
\??\c:\bhthbt.exec:\bhthbt.exe151⤵PID:4496
-
\??\c:\hhhbtn.exec:\hhhbtn.exe152⤵PID:1672
-
\??\c:\dvdvv.exec:\dvdvv.exe153⤵PID:1640
-
\??\c:\lllfxxl.exec:\lllfxxl.exe154⤵PID:1664
-
\??\c:\nbhbbb.exec:\nbhbbb.exe155⤵PID:4832
-
\??\c:\vjvjd.exec:\vjvjd.exe156⤵PID:2508
-
\??\c:\rrlxrlf.exec:\rrlxrlf.exe157⤵PID:60
-
\??\c:\fxxrxxl.exec:\fxxrxxl.exe158⤵PID:3312
-
\??\c:\ttnttn.exec:\ttnttn.exe159⤵PID:4484
-
\??\c:\dpvjd.exec:\dpvjd.exe160⤵PID:3720
-
\??\c:\7flfffl.exec:\7flfffl.exe161⤵PID:1604
-
\??\c:\rxxflff.exec:\rxxflff.exe162⤵PID:4624
-
\??\c:\3bttnh.exec:\3bttnh.exe163⤵PID:2124
-
\??\c:\jdjjd.exec:\jdjjd.exe164⤵PID:3552
-
\??\c:\rlfrlfr.exec:\rlfrlfr.exe165⤵PID:844
-
\??\c:\rflfrrl.exec:\rflfrrl.exe166⤵PID:2400
-
\??\c:\tnhnhn.exec:\tnhnhn.exe167⤵PID:1956
-
\??\c:\dpvjd.exec:\dpvjd.exe168⤵PID:3464
-
\??\c:\5ddvp.exec:\5ddvp.exe169⤵PID:3960
-
\??\c:\xxxlrxf.exec:\xxxlrxf.exe170⤵PID:1952
-
\??\c:\nbbnhb.exec:\nbbnhb.exe171⤵PID:4556
-
\??\c:\hbbtnt.exec:\hbbtnt.exe172⤵PID:3864
-
\??\c:\pjpjv.exec:\pjpjv.exe173⤵PID:3288
-
\??\c:\llfxlll.exec:\llfxlll.exe174⤵PID:692
-
\??\c:\htnhtn.exec:\htnhtn.exe175⤵PID:2184
-
\??\c:\btnbnb.exec:\btnbnb.exe176⤵PID:2180
-
\??\c:\vjjvd.exec:\vjjvd.exe177⤵PID:2744
-
\??\c:\xlfrflr.exec:\xlfrflr.exe178⤵PID:2768
-
\??\c:\lxrlfxl.exec:\lxrlfxl.exe179⤵PID:1784
-
\??\c:\btnnhb.exec:\btnnhb.exe180⤵PID:2608
-
\??\c:\jvvpj.exec:\jvvpj.exe181⤵PID:4876
-
\??\c:\jpdjv.exec:\jpdjv.exe182⤵PID:3840
-
\??\c:\lrrlxfl.exec:\lrrlxfl.exe183⤵PID:1116
-
\??\c:\nhhhbb.exec:\nhhhbb.exe184⤵PID:5064
-
\??\c:\5hnnbb.exec:\5hnnbb.exe185⤵PID:4488
-
\??\c:\vpjdv.exec:\vpjdv.exe186⤵PID:4436
-
\??\c:\lflfxfx.exec:\lflfxfx.exe187⤵PID:4060
-
\??\c:\lllxlfr.exec:\lllxlfr.exe188⤵PID:2984
-
\??\c:\btnbtn.exec:\btnbtn.exe189⤵PID:3992
-
\??\c:\djpjv.exec:\djpjv.exe190⤵PID:1048
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe191⤵PID:868
-
\??\c:\hbnbnh.exec:\hbnbnh.exe192⤵PID:1672
-
\??\c:\hbtnbt.exec:\hbtnbt.exe193⤵PID:1640
-
\??\c:\pddjv.exec:\pddjv.exe194⤵PID:1664
-
\??\c:\xfxrfxl.exec:\xfxrfxl.exe195⤵PID:4832
-
\??\c:\btnnhb.exec:\btnnhb.exe196⤵PID:3108
-
\??\c:\5bhttt.exec:\5bhttt.exe197⤵PID:2476
-
\??\c:\dvpdv.exec:\dvpdv.exe198⤵PID:1092
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe199⤵PID:3392
-
\??\c:\hbtbtn.exec:\hbtbtn.exe200⤵PID:4612
-
\??\c:\7jpjd.exec:\7jpjd.exe201⤵PID:1604
-
\??\c:\rxffrlf.exec:\rxffrlf.exe202⤵PID:4624
-
\??\c:\rllxrlf.exec:\rllxrlf.exe203⤵PID:2124
-
\??\c:\ththht.exec:\ththht.exe204⤵PID:3428
-
\??\c:\3vpdv.exec:\3vpdv.exe205⤵PID:3324
-
\??\c:\vvvjv.exec:\vvvjv.exe206⤵PID:2492
-
\??\c:\lfffrlx.exec:\lfffrlx.exe207⤵PID:844
-
\??\c:\1ttthh.exec:\1ttthh.exe208⤵PID:804
-
\??\c:\bnnbth.exec:\bnnbth.exe209⤵PID:2596
-
\??\c:\vjdvj.exec:\vjdvj.exe210⤵PID:1704
-
\??\c:\lffrfxr.exec:\lffrfxr.exe211⤵PID:4596
-
\??\c:\nbbtht.exec:\nbbtht.exe212⤵PID:1496
-
\??\c:\thnbtt.exec:\thnbtt.exe213⤵PID:3388
-
\??\c:\pdjvj.exec:\pdjvj.exe214⤵PID:3160
-
\??\c:\1rfrfxl.exec:\1rfrfxl.exe215⤵PID:1860
-
\??\c:\tbhbtt.exec:\tbhbtt.exe216⤵PID:1904
-
\??\c:\ntthtn.exec:\ntthtn.exe217⤵PID:2524
-
\??\c:\jddvp.exec:\jddvp.exe218⤵PID:5048
-
\??\c:\rlllllr.exec:\rlllllr.exe219⤵PID:444
-
\??\c:\bntnhh.exec:\bntnhh.exe220⤵PID:1428
-
\??\c:\pvpjv.exec:\pvpjv.exe221⤵PID:3056
-
\??\c:\jddvj.exec:\jddvj.exe222⤵PID:364
-
\??\c:\3lfxfxr.exec:\3lfxfxr.exe223⤵PID:1892
-
\??\c:\ttbbtt.exec:\ttbbtt.exe224⤵PID:2444
-
\??\c:\vpjvd.exec:\vpjvd.exe225⤵PID:4804
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe226⤵PID:4724
-
\??\c:\bnttnn.exec:\bnttnn.exe227⤵PID:464
-
\??\c:\bhhnhh.exec:\bhhnhh.exe228⤵PID:2488
-
\??\c:\vjjdv.exec:\vjjdv.exe229⤵PID:4848
-
\??\c:\lllfrrl.exec:\lllfrrl.exe230⤵PID:3992
-
\??\c:\btthbt.exec:\btthbt.exe231⤵PID:5072
-
\??\c:\dvvvv.exec:\dvvvv.exe232⤵PID:2120
-
\??\c:\lxlxffl.exec:\lxlxffl.exe233⤵PID:4592
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe234⤵PID:4084
-
\??\c:\nntntn.exec:\nntntn.exe235⤵PID:2424
-
\??\c:\vppdv.exec:\vppdv.exe236⤵PID:2908
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe237⤵PID:3408
-
\??\c:\bbhbbt.exec:\bbhbbt.exe238⤵PID:3732
-
\??\c:\vjjvv.exec:\vjjvv.exe239⤵PID:3336
-
\??\c:\jdjjd.exec:\jdjjd.exe240⤵PID:3720
-
\??\c:\xxxfffx.exec:\xxxfffx.exe241⤵PID:4216
-
\??\c:\nhhtnn.exec:\nhhtnn.exe242⤵PID:4212