Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 05:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bbcbce41d02d88b268c27240c2c8dc80_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
bbcbce41d02d88b268c27240c2c8dc80_NeikiAnalytics.exe
-
Size
442KB
-
MD5
bbcbce41d02d88b268c27240c2c8dc80
-
SHA1
c3b71e9a09981eaf35e071e2605a5021e2bae08c
-
SHA256
0ba1dc6ad5d5897297f0fd4b4d2a48d4b99e72e469d31c3d9f180e1610714925
-
SHA512
525d306a3ef4a528dace7ad52f79013426701977eaebaddf0c469634dc4a1c36cae611b4c52b0a1d4fa3edabbf21996fe92e14c80c01d66d4d1046b2c851dc50
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFwT0JOfZKlLXh/rQR:8cm7ImGddXmNt251UriZFwT+aZKl7SR
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2856-5-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2740-8-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2740-13-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/5040-20-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4676-21-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4676-25-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2932-27-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2932-32-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4156-35-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4156-40-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4000-43-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4000-50-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/880-62-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4948-64-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3572-71-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1196-83-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2560-92-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2092-90-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2092-98-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2952-106-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4040-118-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1436-113-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4040-111-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4308-139-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4308-145-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4028-153-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4028-159-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3236-168-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3420-174-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2940-195-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2940-203-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2584-234-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2932-242-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2984-252-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1452-250-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2984-249-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1452-255-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2944-266-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4360-279-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1824-281-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4848-285-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1824-284-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4488-290-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4848-289-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2892-295-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4876-314-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/784-315-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4876-310-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4656-309-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4656-305-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4016-304-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4016-300-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2892-299-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4488-294-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4360-275-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2092-274-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2944-270-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2500-265-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/3896-260-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/556-246-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/1624-238-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/4496-230-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2948-226-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral2/memory/2252-222-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2740 pvvjd.exe 5040 fflxfrl.exe 4676 tbhhtt.exe 2932 pjjdj.exe 4156 bbttnt.exe 4000 hhnbnh.exe 4404 vdppj.exe 4948 jjdvd.exe 880 7frfxxr.exe 3572 hbbhhb.exe 1196 dpdpp.exe 2560 jdppj.exe 2092 lxxxlxf.exe 2952 bntthh.exe 1436 xfxxrll.exe 4040 thtnhh.exe 3584 xrflrxr.exe 2384 pdjjd.exe 816 rlxxfxr.exe 4308 7bnthh.exe 4316 vvjjj.exe 4028 hnnnnh.exe 3236 xrrlllf.exe 3832 5xfxrxr.exe 3420 ttttth.exe 3336 rxxrrrl.exe 3464 vvvjd.exe 2940 vdjdd.exe 3936 llxxrrl.exe 2112 nbbnhh.exe 2252 nnbthn.exe 2948 dpdvd.exe 4496 lllfxxr.exe 2584 7fflllr.exe 1624 nbhbbb.exe 2932 jdppj.exe 556 pjvvp.exe 2984 fxrfxlf.exe 1452 5bhhbh.exe 3896 pdjjj.exe 2500 bbttnt.exe 2944 dvdjd.exe 2092 rxlfflf.exe 4360 bbnntb.exe 1824 hnnhbb.exe 4848 3dvpp.exe 4488 lxxrrll.exe 2892 1rllrrx.exe 4016 nhhhnn.exe 4656 pvddd.exe 4876 7djjd.exe 784 lrrrrrl.exe 1048 bhtnbb.exe 404 thhhnn.exe 3664 nhtttt.exe 732 5rrfflf.exe 2172 tntnbb.exe 2628 ppppj.exe 2216 rrlffxr.exe 4332 xlxrllf.exe 4232 rfrrflx.exe 2252 btbbtt.exe 4496 jpjvp.exe 4544 fxfffll.exe -
resource yara_rule behavioral2/memory/2856-5-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2740-8-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2740-13-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/5040-14-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/5040-20-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4676-21-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4676-25-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2932-32-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4156-40-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4000-50-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/880-62-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4948-64-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3572-71-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1196-83-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2560-92-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2092-90-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2092-98-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2952-106-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4040-118-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1436-113-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4040-111-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4308-139-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4308-145-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4028-153-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4028-159-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3236-168-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3420-174-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2940-195-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2940-203-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2584-234-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2932-242-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2984-252-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1452-250-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2984-249-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1452-255-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2944-266-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4360-279-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1824-281-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4848-285-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1824-284-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4848-289-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2892-295-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4876-314-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/784-315-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4876-310-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4656-309-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4656-305-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4016-304-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4016-300-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2892-299-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4488-294-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4360-275-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2092-274-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2944-270-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2500-265-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2500-261-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3896-260-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/3896-256-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/556-246-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/1624-238-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/4496-230-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2948-226-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2252-222-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral2/memory/2112-216-0x0000000000400000-0x00000000004C4000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2740 2856 bbcbce41d02d88b268c27240c2c8dc80_NeikiAnalytics.exe 83 PID 2856 wrote to memory of 2740 2856 bbcbce41d02d88b268c27240c2c8dc80_NeikiAnalytics.exe 83 PID 2856 wrote to memory of 2740 2856 bbcbce41d02d88b268c27240c2c8dc80_NeikiAnalytics.exe 83 PID 2740 wrote to memory of 5040 2740 pvvjd.exe 84 PID 2740 wrote to memory of 5040 2740 pvvjd.exe 84 PID 2740 wrote to memory of 5040 2740 pvvjd.exe 84 PID 5040 wrote to memory of 4676 5040 fflxfrl.exe 85 PID 5040 wrote to memory of 4676 5040 fflxfrl.exe 85 PID 5040 wrote to memory of 4676 5040 fflxfrl.exe 85 PID 4676 wrote to memory of 2932 4676 tbhhtt.exe 121 PID 4676 wrote to memory of 2932 4676 tbhhtt.exe 121 PID 4676 wrote to memory of 2932 4676 tbhhtt.exe 121 PID 2932 wrote to memory of 4156 2932 pjjdj.exe 87 PID 2932 wrote to memory of 4156 2932 pjjdj.exe 87 PID 2932 wrote to memory of 4156 2932 pjjdj.exe 87 PID 4156 wrote to memory of 4000 4156 bbttnt.exe 89 PID 4156 wrote to memory of 4000 4156 bbttnt.exe 89 PID 4156 wrote to memory of 4000 4156 bbttnt.exe 89 PID 4000 wrote to memory of 4404 4000 hhnbnh.exe 90 PID 4000 wrote to memory of 4404 4000 hhnbnh.exe 90 PID 4000 wrote to memory of 4404 4000 hhnbnh.exe 90 PID 4404 wrote to memory of 4948 4404 vdppj.exe 91 PID 4404 wrote to memory of 4948 4404 vdppj.exe 91 PID 4404 wrote to memory of 4948 4404 vdppj.exe 91 PID 4948 wrote to memory of 880 4948 jjdvd.exe 92 PID 4948 wrote to memory of 880 4948 jjdvd.exe 92 PID 4948 wrote to memory of 880 4948 jjdvd.exe 92 PID 880 wrote to memory of 3572 880 7frfxxr.exe 93 PID 880 wrote to memory of 3572 880 7frfxxr.exe 93 PID 880 wrote to memory of 3572 880 7frfxxr.exe 93 PID 3572 wrote to memory of 1196 3572 hbbhhb.exe 94 PID 3572 wrote to memory of 1196 3572 hbbhhb.exe 94 PID 3572 wrote to memory of 1196 3572 hbbhhb.exe 94 PID 1196 wrote to memory of 2560 1196 dpdpp.exe 299 PID 1196 wrote to memory of 2560 1196 dpdpp.exe 299 PID 1196 wrote to memory of 2560 1196 dpdpp.exe 299 PID 2560 wrote to memory of 2092 2560 jdppj.exe 96 PID 2560 wrote to memory of 2092 2560 jdppj.exe 96 PID 2560 wrote to memory of 2092 2560 jdppj.exe 96 PID 2092 wrote to memory of 2952 2092 lxxxlxf.exe 97 PID 2092 wrote to memory of 2952 2092 lxxxlxf.exe 97 PID 2092 wrote to memory of 2952 2092 lxxxlxf.exe 97 PID 2952 wrote to memory of 1436 2952 bntthh.exe 98 PID 2952 wrote to memory of 1436 2952 bntthh.exe 98 PID 2952 wrote to memory of 1436 2952 bntthh.exe 98 PID 1436 wrote to memory of 4040 1436 xfxxrll.exe 99 PID 1436 wrote to memory of 4040 1436 xfxxrll.exe 99 PID 1436 wrote to memory of 4040 1436 xfxxrll.exe 99 PID 4040 wrote to memory of 3584 4040 thtnhh.exe 239 PID 4040 wrote to memory of 3584 4040 thtnhh.exe 239 PID 4040 wrote to memory of 3584 4040 thtnhh.exe 239 PID 3584 wrote to memory of 2384 3584 xrflrxr.exe 266 PID 3584 wrote to memory of 2384 3584 xrflrxr.exe 266 PID 3584 wrote to memory of 2384 3584 xrflrxr.exe 266 PID 2384 wrote to memory of 816 2384 pdjjd.exe 104 PID 2384 wrote to memory of 816 2384 pdjjd.exe 104 PID 2384 wrote to memory of 816 2384 pdjjd.exe 104 PID 816 wrote to memory of 4308 816 rlxxfxr.exe 105 PID 816 wrote to memory of 4308 816 rlxxfxr.exe 105 PID 816 wrote to memory of 4308 816 rlxxfxr.exe 105 PID 4308 wrote to memory of 4316 4308 7bnthh.exe 106 PID 4308 wrote to memory of 4316 4308 7bnthh.exe 106 PID 4308 wrote to memory of 4316 4308 7bnthh.exe 106 PID 4316 wrote to memory of 4028 4316 vvjjj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbcbce41d02d88b268c27240c2c8dc80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bbcbce41d02d88b268c27240c2c8dc80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\pvvjd.exec:\pvvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\fflxfrl.exec:\fflxfrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\tbhhtt.exec:\tbhhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\pjjdj.exec:\pjjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\bbttnt.exec:\bbttnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\hhnbnh.exec:\hhnbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\vdppj.exec:\vdppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\jjdvd.exec:\jjdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\7frfxxr.exec:\7frfxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\hbbhhb.exec:\hbbhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\dpdpp.exec:\dpdpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\jdppj.exec:\jdppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\lxxxlxf.exec:\lxxxlxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\bntthh.exec:\bntthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\xfxxrll.exec:\xfxxrll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\thtnhh.exec:\thtnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\xrflrxr.exec:\xrflrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\pdjjd.exec:\pdjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\rlxxfxr.exec:\rlxxfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\7bnthh.exec:\7bnthh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\vvjjj.exec:\vvjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\hnnnnh.exec:\hnnnnh.exe23⤵
- Executes dropped EXE
PID:4028 -
\??\c:\xrrlllf.exec:\xrrlllf.exe24⤵
- Executes dropped EXE
PID:3236 -
\??\c:\5xfxrxr.exec:\5xfxrxr.exe25⤵
- Executes dropped EXE
PID:3832 -
\??\c:\ttttth.exec:\ttttth.exe26⤵
- Executes dropped EXE
PID:3420 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe27⤵
- Executes dropped EXE
PID:3336 -
\??\c:\vvvjd.exec:\vvvjd.exe28⤵
- Executes dropped EXE
PID:3464 -
\??\c:\vdjdd.exec:\vdjdd.exe29⤵
- Executes dropped EXE
PID:2940 -
\??\c:\llxxrrl.exec:\llxxrrl.exe30⤵
- Executes dropped EXE
PID:3936 -
\??\c:\nbbnhh.exec:\nbbnhh.exe31⤵
- Executes dropped EXE
PID:2112 -
\??\c:\nnbthn.exec:\nnbthn.exe32⤵
- Executes dropped EXE
PID:2252 -
\??\c:\dpdvd.exec:\dpdvd.exe33⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lllfxxr.exec:\lllfxxr.exe34⤵
- Executes dropped EXE
PID:4496 -
\??\c:\7fflllr.exec:\7fflllr.exe35⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nbhbbb.exec:\nbhbbb.exe36⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jdppj.exec:\jdppj.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjvvp.exec:\pjvvp.exe38⤵
- Executes dropped EXE
PID:556 -
\??\c:\fxrfxlf.exec:\fxrfxlf.exe39⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5bhhbh.exec:\5bhhbh.exe40⤵
- Executes dropped EXE
PID:1452 -
\??\c:\pdjjj.exec:\pdjjj.exe41⤵
- Executes dropped EXE
PID:3896 -
\??\c:\bbttnt.exec:\bbttnt.exe42⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dvdjd.exec:\dvdjd.exe43⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rxlfflf.exec:\rxlfflf.exe44⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bbnntb.exec:\bbnntb.exe45⤵
- Executes dropped EXE
PID:4360 -
\??\c:\hnnhbb.exec:\hnnhbb.exe46⤵
- Executes dropped EXE
PID:1824 -
\??\c:\3dvpp.exec:\3dvpp.exe47⤵
- Executes dropped EXE
PID:4848 -
\??\c:\lxxrrll.exec:\lxxrrll.exe48⤵
- Executes dropped EXE
PID:4488 -
\??\c:\1rllrrx.exec:\1rllrrx.exe49⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nhhhnn.exec:\nhhhnn.exe50⤵
- Executes dropped EXE
PID:4016 -
\??\c:\pvddd.exec:\pvddd.exe51⤵
- Executes dropped EXE
PID:4656 -
\??\c:\7djjd.exec:\7djjd.exe52⤵
- Executes dropped EXE
PID:4876 -
\??\c:\lrrrrrl.exec:\lrrrrrl.exe53⤵
- Executes dropped EXE
PID:784 -
\??\c:\bhtnbb.exec:\bhtnbb.exe54⤵
- Executes dropped EXE
PID:1048 -
\??\c:\thhhnn.exec:\thhhnn.exe55⤵
- Executes dropped EXE
PID:404 -
\??\c:\nhtttt.exec:\nhtttt.exe56⤵
- Executes dropped EXE
PID:3664 -
\??\c:\5rrfflf.exec:\5rrfflf.exe57⤵
- Executes dropped EXE
PID:732 -
\??\c:\tntnbb.exec:\tntnbb.exe58⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ppppj.exec:\ppppj.exe59⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rrlffxr.exec:\rrlffxr.exe60⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xlxrllf.exec:\xlxrllf.exe61⤵
- Executes dropped EXE
PID:4332 -
\??\c:\rfrrflx.exec:\rfrrflx.exe62⤵
- Executes dropped EXE
PID:4232 -
\??\c:\btbbtt.exec:\btbbtt.exe63⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jpjvp.exec:\jpjvp.exe64⤵
- Executes dropped EXE
PID:4496 -
\??\c:\fxfffll.exec:\fxfffll.exe65⤵
- Executes dropped EXE
PID:4544 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe66⤵PID:4784
-
\??\c:\htbhnn.exec:\htbhnn.exe67⤵PID:4764
-
\??\c:\vvjdd.exec:\vvjdd.exe68⤵PID:2776
-
\??\c:\fflfflf.exec:\fflfflf.exe69⤵PID:3668
-
\??\c:\9frrrrr.exec:\9frrrrr.exe70⤵PID:1196
-
\??\c:\hhhhnb.exec:\hhhhnb.exe71⤵PID:2148
-
\??\c:\nnhhhh.exec:\nnhhhh.exe72⤵PID:1504
-
\??\c:\jvpjj.exec:\jvpjj.exe73⤵PID:3212
-
\??\c:\lllffxx.exec:\lllffxx.exe74⤵PID:3160
-
\??\c:\fxlllll.exec:\fxlllll.exe75⤵PID:5000
-
\??\c:\hhtthh.exec:\hhtthh.exe76⤵PID:3540
-
\??\c:\3djpp.exec:\3djpp.exe77⤵PID:1164
-
\??\c:\pjvpd.exec:\pjvpd.exe78⤵PID:4452
-
\??\c:\fxlffff.exec:\fxlffff.exe79⤵PID:3676
-
\??\c:\frxrlrr.exec:\frxrlrr.exe80⤵PID:2916
-
\??\c:\tnnnhh.exec:\tnnnhh.exe81⤵PID:4248
-
\??\c:\1vvvd.exec:\1vvvd.exe82⤵PID:5044
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe83⤵PID:2176
-
\??\c:\5nnnnn.exec:\5nnnnn.exe84⤵PID:400
-
\??\c:\tntnhh.exec:\tntnhh.exe85⤵PID:4508
-
\??\c:\jdjdd.exec:\jdjdd.exe86⤵PID:4796
-
\??\c:\1jppv.exec:\1jppv.exe87⤵PID:2484
-
\??\c:\rxffrrl.exec:\rxffrrl.exe88⤵PID:2556
-
\??\c:\nbhhbb.exec:\nbhhbb.exe89⤵PID:3336
-
\??\c:\pjdvv.exec:\pjdvv.exe90⤵PID:3480
-
\??\c:\fxxrlll.exec:\fxxrlll.exe91⤵PID:640
-
\??\c:\ffffrfx.exec:\ffffrfx.exe92⤵PID:2864
-
\??\c:\3hbhbh.exec:\3hbhbh.exe93⤵PID:764
-
\??\c:\bnnhbt.exec:\bnnhbt.exe94⤵PID:636
-
\??\c:\ppjvd.exec:\ppjvd.exe95⤵PID:912
-
\??\c:\7frffff.exec:\7frffff.exe96⤵PID:1940
-
\??\c:\tnbtth.exec:\tnbtth.exe97⤵PID:2896
-
\??\c:\jpvvd.exec:\jpvvd.exe98⤵PID:3680
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe99⤵PID:3408
-
\??\c:\llllfxx.exec:\llllfxx.exe100⤵PID:2848
-
\??\c:\bnttnn.exec:\bnttnn.exe101⤵PID:2336
-
\??\c:\jpdvv.exec:\jpdvv.exe102⤵PID:1504
-
\??\c:\xfrlxxr.exec:\xfrlxxr.exe103⤵PID:3340
-
\??\c:\5lrlllx.exec:\5lrlllx.exe104⤵PID:3160
-
\??\c:\tbbbbt.exec:\tbbbbt.exe105⤵PID:4252
-
\??\c:\pjjdv.exec:\pjjdv.exe106⤵PID:4392
-
\??\c:\llxrxxl.exec:\llxrxxl.exe107⤵PID:2892
-
\??\c:\bbhhht.exec:\bbhhht.exe108⤵PID:752
-
\??\c:\ddjpp.exec:\ddjpp.exe109⤵PID:3676
-
\??\c:\9dvpj.exec:\9dvpj.exe110⤵PID:5004
-
\??\c:\rlxrffx.exec:\rlxrffx.exe111⤵PID:4204
-
\??\c:\tnhttn.exec:\tnhttn.exe112⤵PID:3280
-
\??\c:\3ddvj.exec:\3ddvj.exe113⤵PID:4860
-
\??\c:\1vdvv.exec:\1vdvv.exe114⤵PID:3664
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe115⤵PID:336
-
\??\c:\9xfxxff.exec:\9xfxxff.exe116⤵PID:3460
-
\??\c:\5hhhbt.exec:\5hhhbt.exe117⤵PID:2172
-
\??\c:\ppvjj.exec:\ppvjj.exe118⤵PID:1688
-
\??\c:\ffllrxf.exec:\ffllrxf.exe119⤵PID:4376
-
\??\c:\ffffxxx.exec:\ffffxxx.exe120⤵PID:2216
-
\??\c:\1dpjd.exec:\1dpjd.exe121⤵PID:3364
-
\??\c:\dvvdp.exec:\dvvdp.exe122⤵PID:764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-