Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 10:19
Behavioral task
behavioral1
Sample
e6cbef971162d4281117523804676300_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e6cbef971162d4281117523804676300_NeikiAnalytics.exe
-
Size
90KB
-
MD5
e6cbef971162d4281117523804676300
-
SHA1
50fce3364a69984e8c17c51cdee4e5a5daff29c6
-
SHA256
c1f97d7a011d1cbe5fbcea6ad0934eec76eda7c290a17ea79c67168ff57e015f
-
SHA512
7ee2b5a9c286ea1a31d2fa936a196305dc6cd05f92fdd4c6df0a7e9e4b6fc4b276c0e6bfd6e1183b91de02bd6401ee50dadd4459a2b2c0c7a375846fbed8d8e3
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpb:8hOmTsF93UYfwC6GIout0fmCiiiXA6ml
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4604-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1156-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhnbnn.exe666486.exebbhbtn.exe9vddv.exe2682666.exehnnnhn.exepjvjp.exehbhntt.exevppvp.exejjdvd.exe68048.exebhnhbb.exe8800828.exe64644.exehhnhbb.exebddpjj.exe422660.exelrlfrlf.exedvpvj.exe644866.exebnhnhh.exe68822.exe2460482.exe26888.exe6282666.exenhhnhn.exe460826.exe4448028.exe022204.exeo006486.exebbbnth.exe262662.exe4288222.exetnnhhh.exe262600.exe460808.exe1fxrllf.exenbbntb.exehtthbh.exejjjdj.exe3frfrxr.exe662288.exe0666622.exexfrrxxl.exe6666860.exea0226.exe5jvvd.exettnhbb.exe800426.exepdjjd.exe6804486.exe046266.exe062666.exe246004.exeflxllff.exe02482.exe644822.exe26840.exelfxrlfx.exe7pjvj.exe64080.exe6826048.exerffxrll.exerfxlxxr.exepid process 4460 nhnbnn.exe 4244 666486.exe 1804 bbhbtn.exe 1512 9vddv.exe 2552 2682666.exe 2424 hnnnhn.exe 4836 pjvjp.exe 1520 hbhntt.exe 1276 vppvp.exe 2364 jjdvd.exe 1376 68048.exe 1788 bhnhbb.exe 2764 8800828.exe 3436 64644.exe 3100 hhnhbb.exe 1448 bddpjj.exe 3432 422660.exe 3092 lrlfrlf.exe 3596 dvpvj.exe 3456 644866.exe 3188 bnhnhh.exe 3420 68822.exe 868 2460482.exe 5020 26888.exe 5104 6282666.exe 4064 nhhnhn.exe 4940 460826.exe 4768 4448028.exe 468 022204.exe 1988 o006486.exe 2004 bbbnth.exe 3664 262662.exe 1140 4288222.exe 2488 tnnhhh.exe 4160 262600.exe 3424 460808.exe 2448 1fxrllf.exe 1328 nbbntb.exe 1064 htthbh.exe 4648 jjjdj.exe 1464 3frfrxr.exe 540 662288.exe 4372 0666622.exe 5088 xfrrxxl.exe 4356 6666860.exe 464 a0226.exe 4700 5jvvd.exe 4276 ttnhbb.exe 1980 800426.exe 1732 pdjjd.exe 740 6804486.exe 2196 046266.exe 2152 062666.exe 3808 246004.exe 1156 flxllff.exe 3852 02482.exe 2428 644822.exe 2204 26840.exe 3816 lfxrlfx.exe 4896 7pjvj.exe 4132 64080.exe 3336 6826048.exe 4672 rffxrll.exe 756 rfxlxxr.exe -
Processes:
resource yara_rule behavioral2/memory/4604-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnbnn.exe upx behavioral2/memory/4604-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4460-9-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\666486.exe upx C:\bbhbtn.exe upx behavioral2/memory/4244-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1804-17-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9vddv.exe upx \??\c:\2682666.exe upx C:\hnnnhn.exe upx behavioral2/memory/2552-28-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjvjp.exe upx behavioral2/memory/4836-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhntt.exe upx behavioral2/memory/2424-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1520-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppvp.exe upx behavioral2/memory/1276-46-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjdvd.exe upx C:\68048.exe upx behavioral2/memory/1376-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhnhbb.exe upx C:\8800828.exe upx behavioral2/memory/1788-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\64644.exe upx behavioral2/memory/2764-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3436-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhnhbb.exe upx behavioral2/memory/3100-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bddpjj.exe upx \??\c:\422660.exe upx behavioral2/memory/1448-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3432-87-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrlfrlf.exe upx behavioral2/memory/3092-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvpvj.exe upx behavioral2/memory/3092-93-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\644866.exe upx behavioral2/memory/3456-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnhnhh.exe upx C:\68822.exe upx behavioral2/memory/3188-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\2460482.exe upx behavioral2/memory/3420-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\26888.exe upx behavioral2/memory/868-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5020-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5020-123-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\6282666.exe upx behavioral2/memory/5104-125-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhnhn.exe upx C:\460826.exe upx behavioral2/memory/4064-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4940-142-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\022204.exe upx behavioral2/memory/468-144-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\o006486.exe upx \??\c:\4448028.exe upx \??\c:\bbbnth.exe upx \??\c:\262662.exe upx behavioral2/memory/3664-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1140-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2488-165-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e6cbef971162d4281117523804676300_NeikiAnalytics.exenhnbnn.exe666486.exebbhbtn.exe9vddv.exe2682666.exehnnnhn.exepjvjp.exehbhntt.exevppvp.exejjdvd.exe68048.exebhnhbb.exe8800828.exe64644.exehhnhbb.exebddpjj.exe422660.exelrlfrlf.exedvpvj.exe644866.exebnhnhh.exedescription pid process target process PID 4604 wrote to memory of 4460 4604 e6cbef971162d4281117523804676300_NeikiAnalytics.exe nhnbnn.exe PID 4604 wrote to memory of 4460 4604 e6cbef971162d4281117523804676300_NeikiAnalytics.exe nhnbnn.exe PID 4604 wrote to memory of 4460 4604 e6cbef971162d4281117523804676300_NeikiAnalytics.exe nhnbnn.exe PID 4460 wrote to memory of 4244 4460 nhnbnn.exe 666486.exe PID 4460 wrote to memory of 4244 4460 nhnbnn.exe 666486.exe PID 4460 wrote to memory of 4244 4460 nhnbnn.exe 666486.exe PID 4244 wrote to memory of 1804 4244 666486.exe bbhbtn.exe PID 4244 wrote to memory of 1804 4244 666486.exe bbhbtn.exe PID 4244 wrote to memory of 1804 4244 666486.exe bbhbtn.exe PID 1804 wrote to memory of 1512 1804 bbhbtn.exe 9vddv.exe PID 1804 wrote to memory of 1512 1804 bbhbtn.exe 9vddv.exe PID 1804 wrote to memory of 1512 1804 bbhbtn.exe 9vddv.exe PID 1512 wrote to memory of 2552 1512 9vddv.exe 2682666.exe PID 1512 wrote to memory of 2552 1512 9vddv.exe 2682666.exe PID 1512 wrote to memory of 2552 1512 9vddv.exe 2682666.exe PID 2552 wrote to memory of 2424 2552 2682666.exe hnnnhn.exe PID 2552 wrote to memory of 2424 2552 2682666.exe hnnnhn.exe PID 2552 wrote to memory of 2424 2552 2682666.exe hnnnhn.exe PID 2424 wrote to memory of 4836 2424 hnnnhn.exe pjvjp.exe PID 2424 wrote to memory of 4836 2424 hnnnhn.exe pjvjp.exe PID 2424 wrote to memory of 4836 2424 hnnnhn.exe pjvjp.exe PID 4836 wrote to memory of 1520 4836 pjvjp.exe hbhntt.exe PID 4836 wrote to memory of 1520 4836 pjvjp.exe hbhntt.exe PID 4836 wrote to memory of 1520 4836 pjvjp.exe hbhntt.exe PID 1520 wrote to memory of 1276 1520 hbhntt.exe vppvp.exe PID 1520 wrote to memory of 1276 1520 hbhntt.exe vppvp.exe PID 1520 wrote to memory of 1276 1520 hbhntt.exe vppvp.exe PID 1276 wrote to memory of 2364 1276 vppvp.exe jjdvd.exe PID 1276 wrote to memory of 2364 1276 vppvp.exe jjdvd.exe PID 1276 wrote to memory of 2364 1276 vppvp.exe jjdvd.exe PID 2364 wrote to memory of 1376 2364 jjdvd.exe 68048.exe PID 2364 wrote to memory of 1376 2364 jjdvd.exe 68048.exe PID 2364 wrote to memory of 1376 2364 jjdvd.exe 68048.exe PID 1376 wrote to memory of 1788 1376 68048.exe bhnhbb.exe PID 1376 wrote to memory of 1788 1376 68048.exe bhnhbb.exe PID 1376 wrote to memory of 1788 1376 68048.exe bhnhbb.exe PID 1788 wrote to memory of 2764 1788 bhnhbb.exe 8800828.exe PID 1788 wrote to memory of 2764 1788 bhnhbb.exe 8800828.exe PID 1788 wrote to memory of 2764 1788 bhnhbb.exe 8800828.exe PID 2764 wrote to memory of 3436 2764 8800828.exe 64644.exe PID 2764 wrote to memory of 3436 2764 8800828.exe 64644.exe PID 2764 wrote to memory of 3436 2764 8800828.exe 64644.exe PID 3436 wrote to memory of 3100 3436 64644.exe hhnhbb.exe PID 3436 wrote to memory of 3100 3436 64644.exe hhnhbb.exe PID 3436 wrote to memory of 3100 3436 64644.exe hhnhbb.exe PID 3100 wrote to memory of 1448 3100 hhnhbb.exe bddpjj.exe PID 3100 wrote to memory of 1448 3100 hhnhbb.exe bddpjj.exe PID 3100 wrote to memory of 1448 3100 hhnhbb.exe bddpjj.exe PID 1448 wrote to memory of 3432 1448 bddpjj.exe 422660.exe PID 1448 wrote to memory of 3432 1448 bddpjj.exe 422660.exe PID 1448 wrote to memory of 3432 1448 bddpjj.exe 422660.exe PID 3432 wrote to memory of 3092 3432 422660.exe lrlfrlf.exe PID 3432 wrote to memory of 3092 3432 422660.exe lrlfrlf.exe PID 3432 wrote to memory of 3092 3432 422660.exe lrlfrlf.exe PID 3092 wrote to memory of 3596 3092 lrlfrlf.exe dvpvj.exe PID 3092 wrote to memory of 3596 3092 lrlfrlf.exe dvpvj.exe PID 3092 wrote to memory of 3596 3092 lrlfrlf.exe dvpvj.exe PID 3596 wrote to memory of 3456 3596 dvpvj.exe i626482.exe PID 3596 wrote to memory of 3456 3596 dvpvj.exe i626482.exe PID 3596 wrote to memory of 3456 3596 dvpvj.exe i626482.exe PID 3456 wrote to memory of 3188 3456 644866.exe bnhnhh.exe PID 3456 wrote to memory of 3188 3456 644866.exe bnhnhh.exe PID 3456 wrote to memory of 3188 3456 644866.exe bnhnhh.exe PID 3188 wrote to memory of 3420 3188 bnhnhh.exe 68822.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6cbef971162d4281117523804676300_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e6cbef971162d4281117523804676300_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\nhnbnn.exec:\nhnbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\666486.exec:\666486.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\bbhbtn.exec:\bbhbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\9vddv.exec:\9vddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\2682666.exec:\2682666.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\hnnnhn.exec:\hnnnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\pjvjp.exec:\pjvjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\hbhntt.exec:\hbhntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\vppvp.exec:\vppvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\jjdvd.exec:\jjdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\68048.exec:\68048.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\bhnhbb.exec:\bhnhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\8800828.exec:\8800828.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\64644.exec:\64644.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\hhnhbb.exec:\hhnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\bddpjj.exec:\bddpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\422660.exec:\422660.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\lrlfrlf.exec:\lrlfrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\dvpvj.exec:\dvpvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\644866.exec:\644866.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\bnhnhh.exec:\bnhnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\68822.exec:\68822.exe23⤵
- Executes dropped EXE
PID:3420 -
\??\c:\2460482.exec:\2460482.exe24⤵
- Executes dropped EXE
PID:868 -
\??\c:\26888.exec:\26888.exe25⤵
- Executes dropped EXE
PID:5020 -
\??\c:\6282666.exec:\6282666.exe26⤵
- Executes dropped EXE
PID:5104 -
\??\c:\nhhnhn.exec:\nhhnhn.exe27⤵
- Executes dropped EXE
PID:4064 -
\??\c:\460826.exec:\460826.exe28⤵
- Executes dropped EXE
PID:4940 -
\??\c:\4448028.exec:\4448028.exe29⤵
- Executes dropped EXE
PID:4768 -
\??\c:\022204.exec:\022204.exe30⤵
- Executes dropped EXE
PID:468 -
\??\c:\o006486.exec:\o006486.exe31⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bbbnth.exec:\bbbnth.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\262662.exec:\262662.exe33⤵
- Executes dropped EXE
PID:3664 -
\??\c:\4288222.exec:\4288222.exe34⤵
- Executes dropped EXE
PID:1140 -
\??\c:\tnnhhh.exec:\tnnhhh.exe35⤵
- Executes dropped EXE
PID:2488 -
\??\c:\262600.exec:\262600.exe36⤵
- Executes dropped EXE
PID:4160 -
\??\c:\460808.exec:\460808.exe37⤵
- Executes dropped EXE
PID:3424 -
\??\c:\1fxrllf.exec:\1fxrllf.exe38⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nbbntb.exec:\nbbntb.exe39⤵
- Executes dropped EXE
PID:1328 -
\??\c:\htthbh.exec:\htthbh.exe40⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jjjdj.exec:\jjjdj.exe41⤵
- Executes dropped EXE
PID:4648 -
\??\c:\3frfrxr.exec:\3frfrxr.exe42⤵
- Executes dropped EXE
PID:1464 -
\??\c:\662288.exec:\662288.exe43⤵
- Executes dropped EXE
PID:540 -
\??\c:\0666622.exec:\0666622.exe44⤵
- Executes dropped EXE
PID:4372 -
\??\c:\xfrrxxl.exec:\xfrrxxl.exe45⤵
- Executes dropped EXE
PID:5088 -
\??\c:\m8662.exec:\m8662.exe46⤵PID:4632
-
\??\c:\6666860.exec:\6666860.exe47⤵
- Executes dropped EXE
PID:4356 -
\??\c:\a0226.exec:\a0226.exe48⤵
- Executes dropped EXE
PID:464 -
\??\c:\5jvvd.exec:\5jvvd.exe49⤵
- Executes dropped EXE
PID:4700 -
\??\c:\ttnhbb.exec:\ttnhbb.exe50⤵
- Executes dropped EXE
PID:4276 -
\??\c:\800426.exec:\800426.exe51⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pdjjd.exec:\pdjjd.exe52⤵
- Executes dropped EXE
PID:1732 -
\??\c:\6804486.exec:\6804486.exe53⤵
- Executes dropped EXE
PID:740 -
\??\c:\046266.exec:\046266.exe54⤵
- Executes dropped EXE
PID:2196 -
\??\c:\062666.exec:\062666.exe55⤵
- Executes dropped EXE
PID:2152 -
\??\c:\246004.exec:\246004.exe56⤵
- Executes dropped EXE
PID:3808 -
\??\c:\flxllff.exec:\flxllff.exe57⤵
- Executes dropped EXE
PID:1156 -
\??\c:\02482.exec:\02482.exe58⤵
- Executes dropped EXE
PID:3852 -
\??\c:\644822.exec:\644822.exe59⤵
- Executes dropped EXE
PID:2428 -
\??\c:\26840.exec:\26840.exe60⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe61⤵
- Executes dropped EXE
PID:3816 -
\??\c:\7pjvj.exec:\7pjvj.exe62⤵
- Executes dropped EXE
PID:4896 -
\??\c:\64080.exec:\64080.exe63⤵
- Executes dropped EXE
PID:4132 -
\??\c:\6826048.exec:\6826048.exe64⤵
- Executes dropped EXE
PID:3336 -
\??\c:\rffxrll.exec:\rffxrll.exe65⤵
- Executes dropped EXE
PID:4672 -
\??\c:\rfxlxxr.exec:\rfxlxxr.exe66⤵
- Executes dropped EXE
PID:756 -
\??\c:\vppdp.exec:\vppdp.exe67⤵PID:1220
-
\??\c:\46606.exec:\46606.exe68⤵PID:4944
-
\??\c:\htnbnh.exec:\htnbnh.exe69⤵PID:3568
-
\??\c:\i626482.exec:\i626482.exe70⤵PID:3456
-
\??\c:\7vvpj.exec:\7vvpj.exe71⤵PID:3512
-
\??\c:\xrxrrll.exec:\xrxrrll.exe72⤵PID:2504
-
\??\c:\ppvpj.exec:\ppvpj.exe73⤵PID:1048
-
\??\c:\w80422.exec:\w80422.exe74⤵PID:868
-
\??\c:\86806.exec:\86806.exe75⤵PID:3576
-
\??\c:\00440.exec:\00440.exe76⤵PID:4052
-
\??\c:\tbbhnt.exec:\tbbhnt.exe77⤵PID:432
-
\??\c:\3bbbnb.exec:\3bbbnb.exe78⤵PID:4424
-
\??\c:\pppjv.exec:\pppjv.exe79⤵PID:3524
-
\??\c:\7jvjj.exec:\7jvjj.exe80⤵PID:2704
-
\??\c:\044482.exec:\044482.exe81⤵PID:408
-
\??\c:\bbbbtt.exec:\bbbbtt.exe82⤵PID:4228
-
\??\c:\6200400.exec:\6200400.exe83⤵PID:2556
-
\??\c:\0204860.exec:\0204860.exe84⤵PID:544
-
\??\c:\628822.exec:\628822.exe85⤵PID:4484
-
\??\c:\nhhbht.exec:\nhhbht.exe86⤵PID:2004
-
\??\c:\jdvdj.exec:\jdvdj.exe87⤵PID:4568
-
\??\c:\flfllrr.exec:\flfllrr.exe88⤵PID:3616
-
\??\c:\vpjjd.exec:\vpjjd.exe89⤵PID:948
-
\??\c:\xxlxrff.exec:\xxlxrff.exe90⤵PID:1076
-
\??\c:\thbhbn.exec:\thbhbn.exe91⤵PID:3868
-
\??\c:\bnnhbh.exec:\bnnhbh.exe92⤵PID:3960
-
\??\c:\3htntt.exec:\3htntt.exe93⤵PID:2688
-
\??\c:\3pjdp.exec:\3pjdp.exe94⤵PID:3208
-
\??\c:\fllllrl.exec:\fllllrl.exe95⤵PID:2660
-
\??\c:\jdvpj.exec:\jdvpj.exe96⤵PID:368
-
\??\c:\ddjjj.exec:\ddjjj.exe97⤵PID:4380
-
\??\c:\rxfrfff.exec:\rxfrfff.exe98⤵PID:3496
-
\??\c:\s8404.exec:\s8404.exe99⤵PID:3328
-
\??\c:\i026000.exec:\i026000.exe100⤵PID:4460
-
\??\c:\vjjdv.exec:\vjjdv.exe101⤵PID:2320
-
\??\c:\xxfffll.exec:\xxfffll.exe102⤵PID:1816
-
\??\c:\6640460.exec:\6640460.exe103⤵PID:5080
-
\??\c:\08060.exec:\08060.exe104⤵PID:4276
-
\??\c:\btbbhn.exec:\btbbhn.exe105⤵PID:2012
-
\??\c:\62884.exec:\62884.exe106⤵PID:1752
-
\??\c:\2648244.exec:\2648244.exe107⤵PID:2288
-
\??\c:\44060.exec:\44060.exe108⤵PID:4676
-
\??\c:\1bhhtt.exec:\1bhhtt.exe109⤵PID:1276
-
\??\c:\2400022.exec:\2400022.exe110⤵PID:1928
-
\??\c:\vdpjj.exec:\vdpjj.exe111⤵PID:5012
-
\??\c:\lllffll.exec:\lllffll.exe112⤵PID:3068
-
\??\c:\fxffxfx.exec:\fxffxfx.exe113⤵PID:5052
-
\??\c:\3jpjj.exec:\3jpjj.exe114⤵PID:3436
-
\??\c:\rlrffrf.exec:\rlrffrf.exe115⤵PID:2204
-
\??\c:\044648.exec:\044648.exe116⤵PID:3796
-
\??\c:\48242.exec:\48242.exe117⤵PID:404
-
\??\c:\0408886.exec:\0408886.exe118⤵PID:3152
-
\??\c:\4628882.exec:\4628882.exe119⤵PID:4684
-
\??\c:\680484.exec:\680484.exe120⤵PID:4672
-
\??\c:\6822046.exec:\6822046.exe121⤵PID:4156
-
\??\c:\rlrflrf.exec:\rlrflrf.exe122⤵PID:2596
-
\??\c:\800044.exec:\800044.exe123⤵PID:4944
-
\??\c:\80260.exec:\80260.exe124⤵PID:4820
-
\??\c:\8204662.exec:\8204662.exe125⤵PID:2600
-
\??\c:\m0682.exec:\m0682.exe126⤵PID:4916
-
\??\c:\c402880.exec:\c402880.exe127⤵PID:764
-
\??\c:\jdjjd.exec:\jdjjd.exe128⤵PID:2504
-
\??\c:\0242888.exec:\0242888.exe129⤵PID:2108
-
\??\c:\bbthbt.exec:\bbthbt.exe130⤵PID:868
-
\??\c:\00840.exec:\00840.exe131⤵PID:3576
-
\??\c:\pjvjd.exec:\pjvjd.exe132⤵PID:432
-
\??\c:\jvdvp.exec:\jvdvp.exe133⤵PID:1844
-
\??\c:\0288222.exec:\0288222.exe134⤵PID:2296
-
\??\c:\btnbbb.exec:\btnbbb.exe135⤵PID:3684
-
\??\c:\fxxxlll.exec:\fxxxlll.exe136⤵PID:2556
-
\??\c:\7bbnhb.exec:\7bbnhb.exe137⤵PID:4484
-
\??\c:\8860000.exec:\8860000.exe138⤵PID:2004
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe139⤵PID:3488
-
\??\c:\i864644.exec:\i864644.exe140⤵PID:3616
-
\??\c:\w24888.exec:\w24888.exe141⤵PID:2036
-
\??\c:\xxlxrlr.exec:\xxlxrlr.exe142⤵PID:4548
-
\??\c:\28644.exec:\28644.exe143⤵PID:1464
-
\??\c:\hhntnb.exec:\hhntnb.exe144⤵PID:4520
-
\??\c:\042466.exec:\042466.exe145⤵PID:4372
-
\??\c:\022646.exec:\022646.exe146⤵PID:3496
-
\??\c:\xfrlfxx.exec:\xfrlfxx.exe147⤵PID:4516
-
\??\c:\3bhbtt.exec:\3bhbtt.exe148⤵PID:4680
-
\??\c:\bhhhbh.exec:\bhhhbh.exe149⤵PID:1692
-
\??\c:\0460440.exec:\0460440.exe150⤵PID:2240
-
\??\c:\6808008.exec:\6808008.exe151⤵PID:788
-
\??\c:\nttnhb.exec:\nttnhb.exe152⤵PID:1332
-
\??\c:\g2608.exec:\g2608.exe153⤵PID:2184
-
\??\c:\5jdvj.exec:\5jdvj.exe154⤵PID:436
-
\??\c:\bhhbtn.exec:\bhhbtn.exe155⤵PID:2196
-
\??\c:\8406266.exec:\8406266.exe156⤵PID:1412
-
\??\c:\7tbbtb.exec:\7tbbtb.exe157⤵PID:4960
-
\??\c:\42622.exec:\42622.exe158⤵PID:2344
-
\??\c:\24000.exec:\24000.exe159⤵PID:3068
-
\??\c:\5rffxxx.exec:\5rffxxx.exe160⤵PID:5052
-
\??\c:\tthnhn.exec:\tthnhn.exe161⤵PID:3436
-
\??\c:\1rrrlrl.exec:\1rrrlrl.exe162⤵PID:2204
-
\??\c:\hbbtnh.exec:\hbbtnh.exe163⤵PID:412
-
\??\c:\xxxrlll.exec:\xxxrlll.exe164⤵PID:1448
-
\??\c:\82000.exec:\82000.exe165⤵PID:3680
-
\??\c:\btnhbb.exec:\btnhbb.exe166⤵PID:1924
-
\??\c:\rlrrxfr.exec:\rlrrxfr.exe167⤵PID:4696
-
\??\c:\408888.exec:\408888.exe168⤵PID:3964
-
\??\c:\606600.exec:\606600.exe169⤵PID:4976
-
\??\c:\lrlflxr.exec:\lrlflxr.exe170⤵PID:4820
-
\??\c:\88848.exec:\88848.exe171⤵PID:2600
-
\??\c:\60600.exec:\60600.exe172⤵PID:4916
-
\??\c:\bntnbh.exec:\bntnbh.exe173⤵PID:764
-
\??\c:\828266.exec:\828266.exe174⤵PID:2504
-
\??\c:\5hhbtt.exec:\5hhbtt.exe175⤵PID:5104
-
\??\c:\pdvpd.exec:\pdvpd.exe176⤵PID:1560
-
\??\c:\6288266.exec:\6288266.exe177⤵PID:3576
-
\??\c:\ppddd.exec:\ppddd.exe178⤵PID:3032
-
\??\c:\lrxxlxx.exec:\lrxxlxx.exe179⤵PID:3544
-
\??\c:\62266.exec:\62266.exe180⤵PID:2612
-
\??\c:\0822222.exec:\0822222.exe181⤵PID:4656
-
\??\c:\a2206.exec:\a2206.exe182⤵PID:3664
-
\??\c:\nnhbtt.exec:\nnhbtt.exe183⤵PID:3584
-
\??\c:\2626002.exec:\2626002.exe184⤵PID:2628
-
\??\c:\668888.exec:\668888.exe185⤵PID:4908
-
\??\c:\btnhtb.exec:\btnhtb.exe186⤵PID:4488
-
\??\c:\httnht.exec:\httnht.exe187⤵PID:2896
-
\??\c:\4060040.exec:\4060040.exe188⤵PID:4376
-
\??\c:\lrflxrr.exec:\lrflxrr.exe189⤵PID:880
-
\??\c:\6846060.exec:\6846060.exe190⤵PID:3200
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe191⤵PID:4428
-
\??\c:\vpvvv.exec:\vpvvv.exe192⤵PID:4368
-
\??\c:\lxfrlll.exec:\lxfrlll.exe193⤵PID:3768
-
\??\c:\bhnhnt.exec:\bhnhnt.exe194⤵PID:4680
-
\??\c:\6044660.exec:\6044660.exe195⤵PID:1692
-
\??\c:\6088088.exec:\6088088.exe196⤵PID:3528
-
\??\c:\frrrrll.exec:\frrrrll.exe197⤵PID:4836
-
\??\c:\842862.exec:\842862.exe198⤵PID:1892
-
\??\c:\bhhnbh.exec:\bhhnbh.exe199⤵PID:2636
-
\??\c:\vdpjj.exec:\vdpjj.exe200⤵PID:2152
-
\??\c:\hbnhbb.exec:\hbnhbb.exe201⤵PID:1928
-
\??\c:\04422.exec:\04422.exe202⤵PID:5012
-
\??\c:\fxllflf.exec:\fxllflf.exe203⤵PID:3980
-
\??\c:\nbbhhh.exec:\nbbhhh.exe204⤵PID:2400
-
\??\c:\602260.exec:\602260.exe205⤵PID:2252
-
\??\c:\vpvpj.exec:\vpvpj.exe206⤵PID:4084
-
\??\c:\440044.exec:\440044.exe207⤵PID:1428
-
\??\c:\tbbbtt.exec:\tbbbtt.exe208⤵PID:3948
-
\??\c:\btttbb.exec:\btttbb.exe209⤵PID:3944
-
\??\c:\ddjvv.exec:\ddjvv.exe210⤵PID:3336
-
\??\c:\064420.exec:\064420.exe211⤵PID:2632
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe212⤵PID:1924
-
\??\c:\bnbntt.exec:\bnbntt.exe213⤵PID:4696
-
\??\c:\9vvvv.exec:\9vvvv.exe214⤵PID:3964
-
\??\c:\m4088.exec:\m4088.exe215⤵PID:4976
-
\??\c:\84482.exec:\84482.exe216⤵PID:3420
-
\??\c:\8288266.exec:\8288266.exe217⤵PID:2600
-
\??\c:\fxrrrrf.exec:\fxrrrrf.exe218⤵PID:4916
-
\??\c:\022648.exec:\022648.exe219⤵PID:2108
-
\??\c:\w28288.exec:\w28288.exe220⤵PID:868
-
\??\c:\2086448.exec:\2086448.exe221⤵PID:5104
-
\??\c:\444882.exec:\444882.exe222⤵PID:1560
-
\??\c:\ddvvp.exec:\ddvvp.exe223⤵PID:1844
-
\??\c:\hnbbtt.exec:\hnbbtt.exe224⤵PID:3032
-
\??\c:\888460.exec:\888460.exe225⤵PID:3684
-
\??\c:\42642.exec:\42642.exe226⤵PID:2556
-
\??\c:\1tbhhh.exec:\1tbhhh.exe227⤵PID:4420
-
\??\c:\0602666.exec:\0602666.exe228⤵PID:2004
-
\??\c:\djpjd.exec:\djpjd.exe229⤵PID:4540
-
\??\c:\628268.exec:\628268.exe230⤵PID:4488
-
\??\c:\pdjpj.exec:\pdjpj.exe231⤵PID:2896
-
\??\c:\08482.exec:\08482.exe232⤵PID:4376
-
\??\c:\84624.exec:\84624.exe233⤵PID:2276
-
\??\c:\xlrxrrr.exec:\xlrxrrr.exe234⤵PID:4648
-
\??\c:\6666600.exec:\6666600.exe235⤵PID:4416
-
\??\c:\hntttt.exec:\hntttt.exe236⤵PID:2200
-
\??\c:\dvjjd.exec:\dvjjd.exe237⤵PID:316
-
\??\c:\2422666.exec:\2422666.exe238⤵PID:2424
-
\??\c:\a6226.exec:\a6226.exe239⤵PID:2184
-
\??\c:\028422.exec:\028422.exe240⤵PID:1892
-
\??\c:\xfrlxfx.exec:\xfrlxfx.exe241⤵PID:4676
-
\??\c:\6688888.exec:\6688888.exe242⤵PID:2000