Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 12:27
Behavioral task
behavioral1
Sample
4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe
-
Size
76KB
-
MD5
d7746a182e2755c5dfd564b515104b60
-
SHA1
71bc80d8294ff22f7d3c1bb42d50431ee08eb2bd
-
SHA256
4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81
-
SHA512
0dbd3c47de91834fdfb97e5a6cfe8998c6875e684761e0b5dc5e2b5eaa2d77949f2659fba9dc7d2c62fd4aa50fa9742c83039120c45e5746cd9f9bd757dbbf41
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE87B:9hOmTsF93UYfwC6GIoutz5yLpOSDRB
Malware Config
Signatures
-
Detect Blackmoon payload 60 IoCs
Processes:
resource yara_rule behavioral1/memory/2956-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-31-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1636-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-56-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2532-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-101-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2700-100-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1464-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-148-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1040-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-172-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1272-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/532-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1132-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-239-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1656-245-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1656-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/476-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-270-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2584-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-303-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2780-311-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2780-314-0x0000000077610000-0x000000007770A000-memory.dmp family_blackmoon behavioral1/memory/2932-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-356-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2592-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-381-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2868-396-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2592-414-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/832-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1196-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-615-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1612-628-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2776-632-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/2784-652-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2576-671-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2576-704-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/864-699-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/992-711-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/992-712-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/3056-783-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3056-782-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dtlhjtl.exefvdjbf.exeflvll.exertlhdr.exelvvbhfv.exefflffd.exedprrbf.exexvtfx.exefjxrrx.exehhbnx.exervtpl.exeprhnnvj.exebdlln.exetvtvt.exexpvbr.exebdhnttv.exepdtrp.exefjnlrl.exedhvjt.exerrthlfn.exenfbrvv.exenlbtfbh.exehlfhvr.exejrtjfnn.exevpvffj.exexrhvjdb.exedvjptj.exefrvpftn.exexprrljr.exefjptjtv.exejjxtfpj.exehjfhffx.exeprxndtl.exetttffn.exelppnntl.exefhdvrf.exejdpdj.exertrrvj.exedfxffh.exexvhjt.exelhrtjhd.exebjpjrp.exevdxndr.exeddbjb.exejldpvv.exebvfdfnx.exevvjnlb.exehvljhvd.exetjlxn.exehrtbvf.exedtdfrn.exehdvfnb.exetbjlbvl.exevxpnplr.exervnnrnh.exejxlfphd.exeffbjdd.exeprfpv.exexhfjvdl.exefdllhf.exehxxtdtr.exepfvjttp.exedfbhx.exenpxdlnh.exepid process 2940 dtlhjtl.exe 1636 fvdjbf.exe 2956 flvll.exe 2680 rtlhdr.exe 2532 lvvbhfv.exe 2568 fflffd.exe 2432 dprrbf.exe 2520 xvtfx.exe 2484 fjxrrx.exe 2700 hhbnx.exe 1464 rvtpl.exe 1960 prhnnvj.exe 1620 bdlln.exe 1116 tvtvt.exe 1732 xpvbr.exe 1040 bdhnttv.exe 1964 pdtrp.exe 1272 fjnlrl.exe 932 dhvjt.exe 2448 rrthlfn.exe 532 nfbrvv.exe 2152 nlbtfbh.exe 1132 hlfhvr.exe 2132 jrtjfnn.exe 1764 vpvffj.exe 1656 xrhvjdb.exe 476 dvjptj.exe 2036 frvpftn.exe 2584 xprrljr.exe 2888 fjptjtv.exe 2260 jjxtfpj.exe 2652 hjfhffx.exe 1224 prxndtl.exe 2780 tttffn.exe 1588 lppnntl.exe 2144 fhdvrf.exe 2556 jdpdj.exe 2564 rtrrvj.exe 2788 dfxffh.exe 2944 xvhjt.exe 2720 lhrtjhd.exe 2748 bjpjrp.exe 2592 vdxndr.exe 2432 ddbjb.exe 2868 jldpvv.exe 2872 bvfdfnx.exe 1048 vvjnlb.exe 1628 hvljhvd.exe 1984 tjlxn.exe 832 hrtbvf.exe 1840 dtdfrn.exe 1620 hdvfnb.exe 1264 tbjlbvl.exe 2044 vxpnplr.exe 2240 rvnnrnh.exe 2252 jxlfphd.exe 1032 ffbjdd.exe 2504 prfpv.exe 2768 xhfjvdl.exe 2812 fdllhf.exe 2988 hxxtdtr.exe 2088 pfvjttp.exe 2256 dfbhx.exe 2188 npxdlnh.exe -
Processes:
resource yara_rule behavioral1/memory/2776-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dtlhjtl.exe upx \??\c:\fvdjbf.exe upx C:\flvll.exe upx behavioral1/memory/2956-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rtlhdr.exe upx behavioral1/memory/1636-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2776-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-41-0x00000000002E0000-0x0000000000307000-memory.dmp upx C:\lvvbhfv.exe upx C:\fflffd.exe upx behavioral1/memory/2532-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2568-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dprrbf.exe upx behavioral1/memory/2432-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fjxrrx.exe upx behavioral1/memory/2520-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xvtfx.exe upx behavioral1/memory/2432-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhbnx.exe upx C:\rvtpl.exe upx behavioral1/memory/2700-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1464-104-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\prhnnvj.exe upx behavioral1/memory/1960-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1464-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1960-123-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bdlln.exe upx \??\c:\tvtvt.exe upx C:\xpvbr.exe upx \??\c:\bdhnttv.exe upx behavioral1/memory/1040-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1040-159-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdtrp.exe upx C:\fjnlrl.exe upx C:\dhvjt.exe upx behavioral1/memory/1272-177-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrthlfn.exe upx C:\nfbrvv.exe upx \??\c:\nlbtfbh.exe upx behavioral1/memory/532-203-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hlfhvr.exe upx \??\c:\jrtjfnn.exe upx behavioral1/memory/2132-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1132-221-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvffj.exe upx C:\xrhvjdb.exe upx C:\dvjptj.exe upx behavioral1/memory/1656-243-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\frvpftn.exe upx behavioral1/memory/2036-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/476-258-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xprrljr.exe upx C:\fjptjtv.exe upx behavioral1/memory/2584-278-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjxtfpj.exe upx C:\hjfhffx.exe upx behavioral1/memory/2780-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2932-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2932-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2144-335-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exedtlhjtl.exefvdjbf.exeflvll.exertlhdr.exelvvbhfv.exefflffd.exedprrbf.exexvtfx.exefjxrrx.exehhbnx.exervtpl.exeprhnnvj.exebdlln.exetvtvt.exexpvbr.exedescription pid process target process PID 2776 wrote to memory of 2940 2776 4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe dtlhjtl.exe PID 2776 wrote to memory of 2940 2776 4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe dtlhjtl.exe PID 2776 wrote to memory of 2940 2776 4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe dtlhjtl.exe PID 2776 wrote to memory of 2940 2776 4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe dtlhjtl.exe PID 2940 wrote to memory of 1636 2940 dtlhjtl.exe fvdjbf.exe PID 2940 wrote to memory of 1636 2940 dtlhjtl.exe fvdjbf.exe PID 2940 wrote to memory of 1636 2940 dtlhjtl.exe fvdjbf.exe PID 2940 wrote to memory of 1636 2940 dtlhjtl.exe fvdjbf.exe PID 1636 wrote to memory of 2956 1636 fvdjbf.exe flvll.exe PID 1636 wrote to memory of 2956 1636 fvdjbf.exe flvll.exe PID 1636 wrote to memory of 2956 1636 fvdjbf.exe flvll.exe PID 1636 wrote to memory of 2956 1636 fvdjbf.exe flvll.exe PID 2956 wrote to memory of 2680 2956 flvll.exe rtlhdr.exe PID 2956 wrote to memory of 2680 2956 flvll.exe rtlhdr.exe PID 2956 wrote to memory of 2680 2956 flvll.exe rtlhdr.exe PID 2956 wrote to memory of 2680 2956 flvll.exe rtlhdr.exe PID 2680 wrote to memory of 2532 2680 rtlhdr.exe lvvbhfv.exe PID 2680 wrote to memory of 2532 2680 rtlhdr.exe lvvbhfv.exe PID 2680 wrote to memory of 2532 2680 rtlhdr.exe lvvbhfv.exe PID 2680 wrote to memory of 2532 2680 rtlhdr.exe lvvbhfv.exe PID 2532 wrote to memory of 2568 2532 lvvbhfv.exe fflffd.exe PID 2532 wrote to memory of 2568 2532 lvvbhfv.exe fflffd.exe PID 2532 wrote to memory of 2568 2532 lvvbhfv.exe fflffd.exe PID 2532 wrote to memory of 2568 2532 lvvbhfv.exe fflffd.exe PID 2568 wrote to memory of 2432 2568 fflffd.exe dprrbf.exe PID 2568 wrote to memory of 2432 2568 fflffd.exe dprrbf.exe PID 2568 wrote to memory of 2432 2568 fflffd.exe dprrbf.exe PID 2568 wrote to memory of 2432 2568 fflffd.exe dprrbf.exe PID 2432 wrote to memory of 2520 2432 dprrbf.exe xvtfx.exe PID 2432 wrote to memory of 2520 2432 dprrbf.exe xvtfx.exe PID 2432 wrote to memory of 2520 2432 dprrbf.exe xvtfx.exe PID 2432 wrote to memory of 2520 2432 dprrbf.exe xvtfx.exe PID 2520 wrote to memory of 2484 2520 xvtfx.exe fjxrrx.exe PID 2520 wrote to memory of 2484 2520 xvtfx.exe fjxrrx.exe PID 2520 wrote to memory of 2484 2520 xvtfx.exe fjxrrx.exe PID 2520 wrote to memory of 2484 2520 xvtfx.exe fjxrrx.exe PID 2484 wrote to memory of 2700 2484 fjxrrx.exe hhbnx.exe PID 2484 wrote to memory of 2700 2484 fjxrrx.exe hhbnx.exe PID 2484 wrote to memory of 2700 2484 fjxrrx.exe hhbnx.exe PID 2484 wrote to memory of 2700 2484 fjxrrx.exe hhbnx.exe PID 2700 wrote to memory of 1464 2700 hhbnx.exe rvtpl.exe PID 2700 wrote to memory of 1464 2700 hhbnx.exe rvtpl.exe PID 2700 wrote to memory of 1464 2700 hhbnx.exe rvtpl.exe PID 2700 wrote to memory of 1464 2700 hhbnx.exe rvtpl.exe PID 1464 wrote to memory of 1960 1464 rvtpl.exe prhnnvj.exe PID 1464 wrote to memory of 1960 1464 rvtpl.exe prhnnvj.exe PID 1464 wrote to memory of 1960 1464 rvtpl.exe prhnnvj.exe PID 1464 wrote to memory of 1960 1464 rvtpl.exe prhnnvj.exe PID 1960 wrote to memory of 1620 1960 prhnnvj.exe bdlln.exe PID 1960 wrote to memory of 1620 1960 prhnnvj.exe bdlln.exe PID 1960 wrote to memory of 1620 1960 prhnnvj.exe bdlln.exe PID 1960 wrote to memory of 1620 1960 prhnnvj.exe bdlln.exe PID 1620 wrote to memory of 1116 1620 bdlln.exe tvtvt.exe PID 1620 wrote to memory of 1116 1620 bdlln.exe tvtvt.exe PID 1620 wrote to memory of 1116 1620 bdlln.exe tvtvt.exe PID 1620 wrote to memory of 1116 1620 bdlln.exe tvtvt.exe PID 1116 wrote to memory of 1732 1116 tvtvt.exe xpvbr.exe PID 1116 wrote to memory of 1732 1116 tvtvt.exe xpvbr.exe PID 1116 wrote to memory of 1732 1116 tvtvt.exe xpvbr.exe PID 1116 wrote to memory of 1732 1116 tvtvt.exe xpvbr.exe PID 1732 wrote to memory of 1040 1732 xpvbr.exe bdhnttv.exe PID 1732 wrote to memory of 1040 1732 xpvbr.exe bdhnttv.exe PID 1732 wrote to memory of 1040 1732 xpvbr.exe bdhnttv.exe PID 1732 wrote to memory of 1040 1732 xpvbr.exe bdhnttv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\dtlhjtl.exec:\dtlhjtl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fvdjbf.exec:\fvdjbf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flvll.exec:\flvll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rtlhdr.exec:\rtlhdr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lvvbhfv.exec:\lvvbhfv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflffd.exec:\fflffd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dprrbf.exec:\dprrbf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xvtfx.exec:\xvtfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fjxrrx.exec:\fjxrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbnx.exec:\hhbnx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rvtpl.exec:\rvtpl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\prhnnvj.exec:\prhnnvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bdlln.exec:\bdlln.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tvtvt.exec:\tvtvt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xpvbr.exec:\xpvbr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bdhnttv.exec:\bdhnttv.exe17⤵
- Executes dropped EXE
-
\??\c:\pdtrp.exec:\pdtrp.exe18⤵
- Executes dropped EXE
-
\??\c:\fjnlrl.exec:\fjnlrl.exe19⤵
- Executes dropped EXE
-
\??\c:\dhvjt.exec:\dhvjt.exe20⤵
- Executes dropped EXE
-
\??\c:\rrthlfn.exec:\rrthlfn.exe21⤵
- Executes dropped EXE
-
\??\c:\nfbrvv.exec:\nfbrvv.exe22⤵
- Executes dropped EXE
-
\??\c:\nlbtfbh.exec:\nlbtfbh.exe23⤵
- Executes dropped EXE
-
\??\c:\hlfhvr.exec:\hlfhvr.exe24⤵
- Executes dropped EXE
-
\??\c:\jrtjfnn.exec:\jrtjfnn.exe25⤵
- Executes dropped EXE
-
\??\c:\vpvffj.exec:\vpvffj.exe26⤵
- Executes dropped EXE
-
\??\c:\xrhvjdb.exec:\xrhvjdb.exe27⤵
- Executes dropped EXE
-
\??\c:\dvjptj.exec:\dvjptj.exe28⤵
- Executes dropped EXE
-
\??\c:\frvpftn.exec:\frvpftn.exe29⤵
- Executes dropped EXE
-
\??\c:\xprrljr.exec:\xprrljr.exe30⤵
- Executes dropped EXE
-
\??\c:\fjptjtv.exec:\fjptjtv.exe31⤵
- Executes dropped EXE
-
\??\c:\jjxtfpj.exec:\jjxtfpj.exe32⤵
- Executes dropped EXE
-
\??\c:\hjfhffx.exec:\hjfhffx.exe33⤵
- Executes dropped EXE
-
\??\c:\prxndtl.exec:\prxndtl.exe34⤵
- Executes dropped EXE
-
\??\c:\tttffn.exec:\tttffn.exe35⤵
- Executes dropped EXE
-
\??\c:\bvdhvnl.exec:\bvdhvnl.exe36⤵
-
\??\c:\lppnntl.exec:\lppnntl.exe37⤵
- Executes dropped EXE
-
\??\c:\fhdvrf.exec:\fhdvrf.exe38⤵
- Executes dropped EXE
-
\??\c:\jdpdj.exec:\jdpdj.exe39⤵
- Executes dropped EXE
-
\??\c:\rtrrvj.exec:\rtrrvj.exe40⤵
- Executes dropped EXE
-
\??\c:\dfxffh.exec:\dfxffh.exe41⤵
- Executes dropped EXE
-
\??\c:\xvhjt.exec:\xvhjt.exe42⤵
- Executes dropped EXE
-
\??\c:\lhrtjhd.exec:\lhrtjhd.exe43⤵
- Executes dropped EXE
-
\??\c:\bjpjrp.exec:\bjpjrp.exe44⤵
- Executes dropped EXE
-
\??\c:\vdxndr.exec:\vdxndr.exe45⤵
- Executes dropped EXE
-
\??\c:\ddbjb.exec:\ddbjb.exe46⤵
- Executes dropped EXE
-
\??\c:\jldpvv.exec:\jldpvv.exe47⤵
- Executes dropped EXE
-
\??\c:\bvfdfnx.exec:\bvfdfnx.exe48⤵
- Executes dropped EXE
-
\??\c:\vvjnlb.exec:\vvjnlb.exe49⤵
- Executes dropped EXE
-
\??\c:\hvljhvd.exec:\hvljhvd.exe50⤵
- Executes dropped EXE
-
\??\c:\tjlxn.exec:\tjlxn.exe51⤵
- Executes dropped EXE
-
\??\c:\hrtbvf.exec:\hrtbvf.exe52⤵
- Executes dropped EXE
-
\??\c:\dtdfrn.exec:\dtdfrn.exe53⤵
- Executes dropped EXE
-
\??\c:\hdvfnb.exec:\hdvfnb.exe54⤵
- Executes dropped EXE
-
\??\c:\tbjlbvl.exec:\tbjlbvl.exe55⤵
- Executes dropped EXE
-
\??\c:\vxpnplr.exec:\vxpnplr.exe56⤵
- Executes dropped EXE
-
\??\c:\rvnnrnh.exec:\rvnnrnh.exe57⤵
- Executes dropped EXE
-
\??\c:\jxlfphd.exec:\jxlfphd.exe58⤵
- Executes dropped EXE
-
\??\c:\ffbjdd.exec:\ffbjdd.exe59⤵
- Executes dropped EXE
-
\??\c:\prfpv.exec:\prfpv.exe60⤵
- Executes dropped EXE
-
\??\c:\xhfjvdl.exec:\xhfjvdl.exe61⤵
- Executes dropped EXE
-
\??\c:\fdllhf.exec:\fdllhf.exe62⤵
- Executes dropped EXE
-
\??\c:\hxxtdtr.exec:\hxxtdtr.exe63⤵
- Executes dropped EXE
-
\??\c:\pfvjttp.exec:\pfvjttp.exe64⤵
- Executes dropped EXE
-
\??\c:\dfbhx.exec:\dfbhx.exe65⤵
- Executes dropped EXE
-
\??\c:\npxdlnh.exec:\npxdlnh.exe66⤵
- Executes dropped EXE
-
\??\c:\dnxvvht.exec:\dnxvvht.exe67⤵
-
\??\c:\dntftf.exec:\dntftf.exe68⤵
-
\??\c:\lxtdhr.exec:\lxtdhr.exe69⤵
-
\??\c:\tnpvfvr.exec:\tnpvfvr.exe70⤵
-
\??\c:\vxpflb.exec:\vxpflb.exe71⤵
-
\??\c:\vfvbl.exec:\vfvbl.exe72⤵
-
\??\c:\ffdtbt.exec:\ffdtbt.exe73⤵
-
\??\c:\xbbbrrv.exec:\xbbbrrv.exe74⤵
-
\??\c:\rfddbnl.exec:\rfddbnl.exe75⤵
-
\??\c:\pjfdh.exec:\pjfdh.exe76⤵
-
\??\c:\hnlvbx.exec:\hnlvbx.exe77⤵
-
\??\c:\ljbff.exec:\ljbff.exe78⤵
-
\??\c:\tfvjjv.exec:\tfvjjv.exe79⤵
-
\??\c:\xxrhr.exec:\xxrhr.exe80⤵
-
\??\c:\xnpvnj.exec:\xnpvnj.exe81⤵
-
\??\c:\pnrttn.exec:\pnrttn.exe82⤵
-
\??\c:\vrfjb.exec:\vrfjb.exe83⤵
-
\??\c:\ldfbvdj.exec:\ldfbvdj.exe84⤵
-
\??\c:\xppxpj.exec:\xppxpj.exe85⤵
-
\??\c:\ndnbj.exec:\ndnbj.exe86⤵
-
\??\c:\fffdlv.exec:\fffdlv.exe87⤵
-
\??\c:\ntjth.exec:\ntjth.exe88⤵
-
\??\c:\lpdvnp.exec:\lpdvnp.exe89⤵
-
\??\c:\rhrfd.exec:\rhrfd.exe90⤵
-
\??\c:\dddbntb.exec:\dddbntb.exe91⤵
-
\??\c:\tjjlhfp.exec:\tjjlhfp.exe92⤵
-
\??\c:\bxpjx.exec:\bxpjx.exe93⤵
-
\??\c:\lxfllt.exec:\lxfllt.exe94⤵
-
\??\c:\nbvrn.exec:\nbvrn.exe95⤵
-
\??\c:\llbfdnx.exec:\llbfdnx.exe96⤵
-
\??\c:\tjflvl.exec:\tjflvl.exe97⤵
-
\??\c:\rffvlbd.exec:\rffvlbd.exe98⤵
-
\??\c:\tvbtpd.exec:\tvbtpd.exe99⤵
-
\??\c:\bllrnr.exec:\bllrnr.exe100⤵
-
\??\c:\hfpbt.exec:\hfpbt.exe101⤵
-
\??\c:\tnffjvp.exec:\tnffjvp.exe102⤵
-
\??\c:\ppbbxrb.exec:\ppbbxrb.exe103⤵
-
\??\c:\tjbnnxt.exec:\tjbnnxt.exe104⤵
-
\??\c:\lbhthr.exec:\lbhthr.exe105⤵
-
\??\c:\pnbrvn.exec:\pnbrvn.exe106⤵
-
\??\c:\vbdnnr.exec:\vbdnnr.exe107⤵
-
\??\c:\prvrt.exec:\prvrt.exe108⤵
-
\??\c:\rpvpb.exec:\rpvpb.exe109⤵
-
\??\c:\nnthx.exec:\nnthx.exe110⤵
-
\??\c:\nlhvj.exec:\nlhvj.exe111⤵
-
\??\c:\tffhth.exec:\tffhth.exe112⤵
-
\??\c:\jtjndn.exec:\jtjndn.exe113⤵
-
\??\c:\tnrlf.exec:\tnrlf.exe114⤵
-
\??\c:\pptdht.exec:\pptdht.exe115⤵
-
\??\c:\xnffhl.exec:\xnffhl.exe116⤵
-
\??\c:\trblf.exec:\trblf.exe117⤵
-
\??\c:\tlflpf.exec:\tlflpf.exe118⤵
-
\??\c:\fbbvlvl.exec:\fbbvlvl.exe119⤵
-
\??\c:\jjlxdvt.exec:\jjlxdvt.exe120⤵
-
\??\c:\vrrhlbp.exec:\vrrhlbp.exe121⤵
-
\??\c:\fxlxvnn.exec:\fxlxvnn.exe122⤵
-
\??\c:\jfnlbld.exec:\jfnlbld.exe123⤵
-
\??\c:\prhxfdf.exec:\prhxfdf.exe124⤵
-
\??\c:\rfnfv.exec:\rfnfv.exe125⤵
-
\??\c:\vvpxfdt.exec:\vvpxfdt.exe126⤵
-
\??\c:\xtdvf.exec:\xtdvf.exe127⤵
-
\??\c:\tlvbhxd.exec:\tlvbhxd.exe128⤵
-
\??\c:\xpxdx.exec:\xpxdx.exe129⤵
-
\??\c:\rxttl.exec:\rxttl.exe130⤵
-
\??\c:\jjrvj.exec:\jjrvj.exe131⤵
-
\??\c:\nnhtn.exec:\nnhtn.exe132⤵
-
\??\c:\vljhbhv.exec:\vljhbhv.exe133⤵
-
\??\c:\nvnhft.exec:\nvnhft.exe134⤵
-
\??\c:\ljjvhv.exec:\ljjvhv.exe135⤵
-
\??\c:\fprtr.exec:\fprtr.exe136⤵
-
\??\c:\pnlxxt.exec:\pnlxxt.exe137⤵
-
\??\c:\dxttvpd.exec:\dxttvpd.exe138⤵
-
\??\c:\vpbbvv.exec:\vpbbvv.exe139⤵
-
\??\c:\drbhbt.exec:\drbhbt.exe140⤵
-
\??\c:\pffhnn.exec:\pffhnn.exe141⤵
-
\??\c:\xlbvfdb.exec:\xlbvfdb.exe142⤵
-
\??\c:\nvlbxxd.exec:\nvlbxxd.exe143⤵
-
\??\c:\nlhfv.exec:\nlhfv.exe144⤵
-
\??\c:\vvpdrv.exec:\vvpdrv.exe145⤵
-
\??\c:\fnprtr.exec:\fnprtr.exe146⤵
-
\??\c:\nfplnf.exec:\nfplnf.exe147⤵
-
\??\c:\dnbhtp.exec:\dnbhtp.exe148⤵
-
\??\c:\ftnldd.exec:\ftnldd.exe149⤵
-
\??\c:\bndvdv.exec:\bndvdv.exe150⤵
-
\??\c:\vnhhx.exec:\vnhhx.exe151⤵
-
\??\c:\fxvtlll.exec:\fxvtlll.exe152⤵
-
\??\c:\xlhxvb.exec:\xlhxvb.exe153⤵
-
\??\c:\rfvtnv.exec:\rfvtnv.exe154⤵
-
\??\c:\xjpxnp.exec:\xjpxnp.exe155⤵
-
\??\c:\flbbjf.exec:\flbbjf.exe156⤵
-
\??\c:\vvptft.exec:\vvptft.exe157⤵
-
\??\c:\trbnlfb.exec:\trbnlfb.exe158⤵
-
\??\c:\xftvfdf.exec:\xftvfdf.exe159⤵
-
\??\c:\hfnxdhj.exec:\hfnxdhj.exe160⤵
-
\??\c:\xhnnft.exec:\xhnnft.exe161⤵
-
\??\c:\tvrfp.exec:\tvrfp.exe162⤵
-
\??\c:\ntnvf.exec:\ntnvf.exe163⤵
-
\??\c:\nhbhb.exec:\nhbhb.exe164⤵
-
\??\c:\lxlhb.exec:\lxlhb.exe165⤵
-
\??\c:\fhhndj.exec:\fhhndj.exe166⤵
-
\??\c:\xljht.exec:\xljht.exe167⤵
-
\??\c:\jvtjhjd.exec:\jvtjhjd.exe168⤵
-
\??\c:\vvvtpt.exec:\vvvtpt.exe169⤵
-
\??\c:\nlrpvdt.exec:\nlrpvdt.exe170⤵
-
\??\c:\rdpxnln.exec:\rdpxnln.exe171⤵
-
\??\c:\lntnnxn.exec:\lntnnxn.exe172⤵
-
\??\c:\hlplp.exec:\hlplp.exe173⤵
-
\??\c:\htpndxd.exec:\htpndxd.exe174⤵
-
\??\c:\rtfvbr.exec:\rtfvbr.exe175⤵
-
\??\c:\jnrvfxv.exec:\jnrvfxv.exe176⤵
-
\??\c:\bprnrj.exec:\bprnrj.exe177⤵
-
\??\c:\hlnfxjr.exec:\hlnfxjr.exe178⤵
-
\??\c:\hfjfj.exec:\hfjfj.exe179⤵
-
\??\c:\hnhdhb.exec:\hnhdhb.exe180⤵
-
\??\c:\pvlxr.exec:\pvlxr.exe181⤵
-
\??\c:\dhjxln.exec:\dhjxln.exe182⤵
-
\??\c:\hpnnf.exec:\hpnnf.exe183⤵
-
\??\c:\tdrvh.exec:\tdrvh.exe184⤵
-
\??\c:\fjphhn.exec:\fjphhn.exe185⤵
-
\??\c:\xdlpbxf.exec:\xdlpbxf.exe186⤵
-
\??\c:\rdvrpvv.exec:\rdvrpvv.exe187⤵
-
\??\c:\tlfvxx.exec:\tlfvxx.exe188⤵
-
\??\c:\jttbvph.exec:\jttbvph.exe189⤵
-
\??\c:\lvlbprb.exec:\lvlbprb.exe190⤵
-
\??\c:\dpllbxl.exec:\dpllbxl.exe191⤵
-
\??\c:\tbhvfdb.exec:\tbhvfdb.exe192⤵
-
\??\c:\rtfvd.exec:\rtfvd.exe193⤵
-
\??\c:\hhnbfd.exec:\hhnbfd.exe194⤵
-
\??\c:\njhnp.exec:\njhnp.exe195⤵
-
\??\c:\vjhhdfv.exec:\vjhhdfv.exe196⤵
-
\??\c:\lbfrr.exec:\lbfrr.exe197⤵
-
\??\c:\xvtnl.exec:\xvtnl.exe198⤵
-
\??\c:\jjnnvtn.exec:\jjnnvtn.exe199⤵
-
\??\c:\njrrfnv.exec:\njrrfnv.exe200⤵
-
\??\c:\bvfpfpn.exec:\bvfpfpn.exe201⤵
-
\??\c:\tbjvv.exec:\tbjvv.exe202⤵
-
\??\c:\btxtbtj.exec:\btxtbtj.exe203⤵
-
\??\c:\nxvddhb.exec:\nxvddhb.exe204⤵
-
\??\c:\lfvjn.exec:\lfvjn.exe205⤵
-
\??\c:\bjrbhpb.exec:\bjrbhpb.exe206⤵
-
\??\c:\hfxnpjv.exec:\hfxnpjv.exe207⤵
-
\??\c:\xrhvl.exec:\xrhvl.exe208⤵
-
\??\c:\jlnhddb.exec:\jlnhddb.exe209⤵
-
\??\c:\bdffv.exec:\bdffv.exe210⤵
-
\??\c:\hlpvd.exec:\hlpvd.exe211⤵
-
\??\c:\lvrtht.exec:\lvrtht.exe212⤵
-
\??\c:\djrdvh.exec:\djrdvh.exe213⤵
-
\??\c:\nnrdbj.exec:\nnrdbj.exe214⤵
-
\??\c:\lhhvpn.exec:\lhhvpn.exe215⤵
-
\??\c:\nrndnxj.exec:\nrndnxj.exe216⤵
-
\??\c:\njfjrp.exec:\njfjrp.exe217⤵
-
\??\c:\pptbhvh.exec:\pptbhvh.exe218⤵
-
\??\c:\xrljjr.exec:\xrljjr.exe219⤵
-
\??\c:\rrrrx.exec:\rrrrx.exe220⤵
-
\??\c:\xbbnvvd.exec:\xbbnvvd.exe221⤵
-
\??\c:\lbpnn.exec:\lbpnn.exe222⤵
-
\??\c:\jvlrdxr.exec:\jvlrdxr.exe223⤵
-
\??\c:\vjvbvj.exec:\vjvbvj.exe224⤵
-
\??\c:\xjlpht.exec:\xjlpht.exe225⤵
-
\??\c:\jhblfjf.exec:\jhblfjf.exe226⤵
-
\??\c:\pdrfrxh.exec:\pdrfrxh.exe227⤵
-
\??\c:\tdlvl.exec:\tdlvl.exe228⤵
-
\??\c:\jvbdpnb.exec:\jvbdpnb.exe229⤵
-
\??\c:\hpdrv.exec:\hpdrv.exe230⤵
-
\??\c:\bvbnf.exec:\bvbnf.exe231⤵
-
\??\c:\jjflll.exec:\jjflll.exe232⤵
-
\??\c:\vfjlhp.exec:\vfjlhp.exe233⤵
-
\??\c:\thlpl.exec:\thlpl.exe234⤵
-
\??\c:\jbbbfjb.exec:\jbbbfjb.exe235⤵
-
\??\c:\bprjpv.exec:\bprjpv.exe236⤵
-
\??\c:\xbrprt.exec:\xbrprt.exe237⤵
-
\??\c:\hplvnh.exec:\hplvnh.exe238⤵
-
\??\c:\hjjfhnx.exec:\hjjfhnx.exe239⤵
-
\??\c:\tjlbvd.exec:\tjlbvd.exe240⤵
-
\??\c:\vxrnd.exec:\vxrnd.exe241⤵