Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 10:18
Behavioral task
behavioral1
Sample
34ce548dd54899dcbfe4d45befbea8349f0e6512c78e1e8e9ae126fe75a19df2_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
34ce548dd54899dcbfe4d45befbea8349f0e6512c78e1e8e9ae126fe75a19df2_NeikiAnalytics.exe
-
Size
381KB
-
MD5
e3e3d18a7a8a85711fdd0d70286e0ff0
-
SHA1
651fc5f5f2d986bae08739c6e2216f33536496a6
-
SHA256
34ce548dd54899dcbfe4d45befbea8349f0e6512c78e1e8e9ae126fe75a19df2
-
SHA512
897330bdfd20e98f3f39afae075169e53d12d977d7d68e066b52224797867f09fdfa0efb6ac285abfa420b480d209be6631ec18db0e58625e8e6f529a3f23b4e
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0IbswYT7:y4wFHoS3eFaKHpNKbbswe7
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1996-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2812-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3860-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2632-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-609-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-717-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-793-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-830-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-896-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-931-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
htbbbb.exebbbbbh.exepjjdv.exerxxfxll.exe9djjj.exelrrfxxx.exexxfllrl.exe7bbnhh.exebnnhbb.exe5ddvv.exebtbtnh.exepdvvp.exenbnntt.exejvdpp.exeffrrlrr.exevpvjd.exebhbnbt.exedvvpj.exefxffxrf.exejjdpv.exevvvjd.exexxlffff.exedjpjd.exe7ffxxrf.exetnhtnn.exevpppj.exe7rlfxxr.exentthbt.exeppppp.exe5fxrlff.exexfrrllf.exe3htnhb.exeffffxxx.exehbhnnt.exepvddp.exexrrrllf.exerffxrrr.exevdjdd.exe5lfxlfr.exenbhtbt.exe1pjjd.exe1xrfxrl.exetnnnnh.exepdjvd.exefxrrlfx.exehbhtbt.exevjvvv.exexxxrrrr.exe5tbthb.exe1djdv.exexrxffrf.exebbnhht.exepvvjp.exelfrxfrl.exetnthbt.exevvdvp.exelxlxfxx.exehthbtn.exebhnhtt.exevvvpd.exefllrrll.exe5tttnb.exepddjd.exejvdvp.exepid process 2296 htbbbb.exe 3500 bbbbbh.exe 1584 pjjdv.exe 2556 rxxfxll.exe 2952 9djjj.exe 4656 lrrfxxx.exe 3428 xxfllrl.exe 2956 7bbnhh.exe 1012 bnnhbb.exe 1740 5ddvv.exe 4824 btbtnh.exe 3204 pdvvp.exe 4080 nbnntt.exe 3064 jvdpp.exe 3880 ffrrlrr.exe 3000 vpvjd.exe 2772 bhbnbt.exe 1464 dvvpj.exe 2884 fxffxrf.exe 1444 jjdpv.exe 4652 vvvjd.exe 4532 xxlffff.exe 4428 djpjd.exe 4816 7ffxxrf.exe 3080 tnhtnn.exe 2264 vpppj.exe 1320 7rlfxxr.exe 392 ntthbt.exe 2880 ppppp.exe 940 5fxrlff.exe 4416 xfrrllf.exe 4968 3htnhb.exe 2920 ffffxxx.exe 4184 hbhnnt.exe 4856 pvddp.exe 4604 xrrrllf.exe 4848 rffxrrr.exe 968 vdjdd.exe 2520 5lfxlfr.exe 1116 nbhtbt.exe 4636 1pjjd.exe 4156 1xrfxrl.exe 3752 tnnnnh.exe 3164 pdjvd.exe 696 fxrrlfx.exe 5116 hbhtbt.exe 2040 vjvvv.exe 3864 xxxrrrr.exe 4820 5tbthb.exe 2812 1djdv.exe 4516 xrxffrf.exe 3940 bbnhht.exe 3860 pvvjp.exe 4784 lfrxfrl.exe 812 tnthbt.exe 2248 vvdvp.exe 3672 lxlxfxx.exe 3980 hthbtn.exe 4172 bhnhtt.exe 2172 vvvpd.exe 1756 fllrrll.exe 5112 5tttnb.exe 3628 pddjd.exe 3348 jvdvp.exe -
Processes:
resource yara_rule behavioral2/memory/1996-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htbbbb.exe upx behavioral2/memory/2296-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbbbbh.exe upx behavioral2/memory/2296-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjjdv.exe upx behavioral2/memory/1584-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2556-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9djjj.exe upx behavioral2/memory/2952-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrrfxxx.exe upx \??\c:\xxfllrl.exe upx behavioral2/memory/3428-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2956-49-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7bbnhh.exe upx behavioral2/memory/4656-37-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxxfxll.exe upx behavioral2/memory/3500-13-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnnhbb.exe upx behavioral2/memory/1012-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ddvv.exe upx C:\btbtnh.exe upx behavioral2/memory/1740-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvvp.exe upx behavioral2/memory/4824-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3204-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3204-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbnntt.exe upx C:\jvdpp.exe upx behavioral2/memory/3064-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffrrlrr.exe upx behavioral2/memory/3880-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvjd.exe upx behavioral2/memory/3000-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3000-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhbnbt.exe upx C:\dvvpj.exe upx behavioral2/memory/2772-106-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxffxrf.exe upx behavioral2/memory/1464-112-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjdpv.exe upx C:\vvvjd.exe upx behavioral2/memory/1444-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4652-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2884-119-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlffff.exe upx C:\djpjd.exe upx behavioral2/memory/4428-137-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7ffxxrf.exe upx C:\tnhtnn.exe upx behavioral2/memory/3080-149-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpppj.exe upx behavioral2/memory/2264-155-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7rlfxxr.exe upx C:\5fxrlff.exe upx C:\xfrrllf.exe upx C:\3htnhb.exe upx C:\ppppp.exe upx behavioral2/memory/392-169-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ntthbt.exe upx behavioral2/memory/1320-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4968-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2920-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4184-197-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
34ce548dd54899dcbfe4d45befbea8349f0e6512c78e1e8e9ae126fe75a19df2_NeikiAnalytics.exehtbbbb.exebbbbbh.exepjjdv.exerxxfxll.exe9djjj.exelrrfxxx.exexxfllrl.exe7bbnhh.exebnnhbb.exe5ddvv.exebtbtnh.exepdvvp.exenbnntt.exejvdpp.exeffrrlrr.exevpvjd.exebhbnbt.exedvvpj.exefxffxrf.exejjdpv.exevvvjd.exedescription pid process target process PID 1996 wrote to memory of 2296 1996 34ce548dd54899dcbfe4d45befbea8349f0e6512c78e1e8e9ae126fe75a19df2_NeikiAnalytics.exe htbbbb.exe PID 1996 wrote to memory of 2296 1996 34ce548dd54899dcbfe4d45befbea8349f0e6512c78e1e8e9ae126fe75a19df2_NeikiAnalytics.exe htbbbb.exe PID 1996 wrote to memory of 2296 1996 34ce548dd54899dcbfe4d45befbea8349f0e6512c78e1e8e9ae126fe75a19df2_NeikiAnalytics.exe htbbbb.exe PID 2296 wrote to memory of 3500 2296 htbbbb.exe bbbbbh.exe PID 2296 wrote to memory of 3500 2296 htbbbb.exe bbbbbh.exe PID 2296 wrote to memory of 3500 2296 htbbbb.exe bbbbbh.exe PID 3500 wrote to memory of 1584 3500 bbbbbh.exe pjjdv.exe PID 3500 wrote to memory of 1584 3500 bbbbbh.exe pjjdv.exe PID 3500 wrote to memory of 1584 3500 bbbbbh.exe pjjdv.exe PID 1584 wrote to memory of 2556 1584 pjjdv.exe rxxfxll.exe PID 1584 wrote to memory of 2556 1584 pjjdv.exe rxxfxll.exe PID 1584 wrote to memory of 2556 1584 pjjdv.exe rxxfxll.exe PID 2556 wrote to memory of 2952 2556 rxxfxll.exe 9djjj.exe PID 2556 wrote to memory of 2952 2556 rxxfxll.exe 9djjj.exe PID 2556 wrote to memory of 2952 2556 rxxfxll.exe 9djjj.exe PID 2952 wrote to memory of 4656 2952 9djjj.exe lrrfxxx.exe PID 2952 wrote to memory of 4656 2952 9djjj.exe lrrfxxx.exe PID 2952 wrote to memory of 4656 2952 9djjj.exe lrrfxxx.exe PID 4656 wrote to memory of 3428 4656 lrrfxxx.exe xxfllrl.exe PID 4656 wrote to memory of 3428 4656 lrrfxxx.exe xxfllrl.exe PID 4656 wrote to memory of 3428 4656 lrrfxxx.exe xxfllrl.exe PID 3428 wrote to memory of 2956 3428 xxfllrl.exe 7bbnhh.exe PID 3428 wrote to memory of 2956 3428 xxfllrl.exe 7bbnhh.exe PID 3428 wrote to memory of 2956 3428 xxfllrl.exe 7bbnhh.exe PID 2956 wrote to memory of 1012 2956 7bbnhh.exe bnnhbb.exe PID 2956 wrote to memory of 1012 2956 7bbnhh.exe bnnhbb.exe PID 2956 wrote to memory of 1012 2956 7bbnhh.exe bnnhbb.exe PID 1012 wrote to memory of 1740 1012 bnnhbb.exe 5ddvv.exe PID 1012 wrote to memory of 1740 1012 bnnhbb.exe 5ddvv.exe PID 1012 wrote to memory of 1740 1012 bnnhbb.exe 5ddvv.exe PID 1740 wrote to memory of 4824 1740 5ddvv.exe btbtnh.exe PID 1740 wrote to memory of 4824 1740 5ddvv.exe btbtnh.exe PID 1740 wrote to memory of 4824 1740 5ddvv.exe btbtnh.exe PID 4824 wrote to memory of 3204 4824 btbtnh.exe pdvvp.exe PID 4824 wrote to memory of 3204 4824 btbtnh.exe pdvvp.exe PID 4824 wrote to memory of 3204 4824 btbtnh.exe pdvvp.exe PID 3204 wrote to memory of 4080 3204 pdvvp.exe nbnntt.exe PID 3204 wrote to memory of 4080 3204 pdvvp.exe nbnntt.exe PID 3204 wrote to memory of 4080 3204 pdvvp.exe nbnntt.exe PID 4080 wrote to memory of 3064 4080 nbnntt.exe jvdpp.exe PID 4080 wrote to memory of 3064 4080 nbnntt.exe jvdpp.exe PID 4080 wrote to memory of 3064 4080 nbnntt.exe jvdpp.exe PID 3064 wrote to memory of 3880 3064 jvdpp.exe ffrrlrr.exe PID 3064 wrote to memory of 3880 3064 jvdpp.exe ffrrlrr.exe PID 3064 wrote to memory of 3880 3064 jvdpp.exe ffrrlrr.exe PID 3880 wrote to memory of 3000 3880 ffrrlrr.exe vpvjd.exe PID 3880 wrote to memory of 3000 3880 ffrrlrr.exe vpvjd.exe PID 3880 wrote to memory of 3000 3880 ffrrlrr.exe vpvjd.exe PID 3000 wrote to memory of 2772 3000 vpvjd.exe bhbnbt.exe PID 3000 wrote to memory of 2772 3000 vpvjd.exe bhbnbt.exe PID 3000 wrote to memory of 2772 3000 vpvjd.exe bhbnbt.exe PID 2772 wrote to memory of 1464 2772 bhbnbt.exe dvvpj.exe PID 2772 wrote to memory of 1464 2772 bhbnbt.exe dvvpj.exe PID 2772 wrote to memory of 1464 2772 bhbnbt.exe dvvpj.exe PID 1464 wrote to memory of 2884 1464 dvvpj.exe fxffxrf.exe PID 1464 wrote to memory of 2884 1464 dvvpj.exe fxffxrf.exe PID 1464 wrote to memory of 2884 1464 dvvpj.exe fxffxrf.exe PID 2884 wrote to memory of 1444 2884 fxffxrf.exe jjdpv.exe PID 2884 wrote to memory of 1444 2884 fxffxrf.exe jjdpv.exe PID 2884 wrote to memory of 1444 2884 fxffxrf.exe jjdpv.exe PID 1444 wrote to memory of 4652 1444 jjdpv.exe vvvjd.exe PID 1444 wrote to memory of 4652 1444 jjdpv.exe vvvjd.exe PID 1444 wrote to memory of 4652 1444 jjdpv.exe vvvjd.exe PID 4652 wrote to memory of 4532 4652 vvvjd.exe xxlffff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\34ce548dd54899dcbfe4d45befbea8349f0e6512c78e1e8e9ae126fe75a19df2_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\34ce548dd54899dcbfe4d45befbea8349f0e6512c78e1e8e9ae126fe75a19df2_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\htbbbb.exec:\htbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbbbbh.exec:\bbbbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjjdv.exec:\pjjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxxfxll.exec:\rxxfxll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9djjj.exec:\9djjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrfxxx.exec:\lrrfxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxfllrl.exec:\xxfllrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7bbnhh.exec:\7bbnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnhbb.exec:\bnnhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5ddvv.exec:\5ddvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbtnh.exec:\btbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvvp.exec:\pdvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbnntt.exec:\nbnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdpp.exec:\jvdpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrrlrr.exec:\ffrrlrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvjd.exec:\vpvjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbnbt.exec:\bhbnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvpj.exec:\dvvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxffxrf.exec:\fxffxrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjdpv.exec:\jjdpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvjd.exec:\vvvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlffff.exec:\xxlffff.exe23⤵
- Executes dropped EXE
-
\??\c:\djpjd.exec:\djpjd.exe24⤵
- Executes dropped EXE
-
\??\c:\7ffxxrf.exec:\7ffxxrf.exe25⤵
- Executes dropped EXE
-
\??\c:\tnhtnn.exec:\tnhtnn.exe26⤵
- Executes dropped EXE
-
\??\c:\vpppj.exec:\vpppj.exe27⤵
- Executes dropped EXE
-
\??\c:\7rlfxxr.exec:\7rlfxxr.exe28⤵
- Executes dropped EXE
-
\??\c:\ntthbt.exec:\ntthbt.exe29⤵
- Executes dropped EXE
-
\??\c:\ppppp.exec:\ppppp.exe30⤵
- Executes dropped EXE
-
\??\c:\5fxrlff.exec:\5fxrlff.exe31⤵
- Executes dropped EXE
-
\??\c:\xfrrllf.exec:\xfrrllf.exe32⤵
- Executes dropped EXE
-
\??\c:\3htnhb.exec:\3htnhb.exe33⤵
- Executes dropped EXE
-
\??\c:\ffffxxx.exec:\ffffxxx.exe34⤵
- Executes dropped EXE
-
\??\c:\hbhnnt.exec:\hbhnnt.exe35⤵
- Executes dropped EXE
-
\??\c:\pvddp.exec:\pvddp.exe36⤵
- Executes dropped EXE
-
\??\c:\xrrrllf.exec:\xrrrllf.exe37⤵
- Executes dropped EXE
-
\??\c:\rffxrrr.exec:\rffxrrr.exe38⤵
- Executes dropped EXE
-
\??\c:\vdjdd.exec:\vdjdd.exe39⤵
- Executes dropped EXE
-
\??\c:\5lfxlfr.exec:\5lfxlfr.exe40⤵
- Executes dropped EXE
-
\??\c:\nbhtbt.exec:\nbhtbt.exe41⤵
- Executes dropped EXE
-
\??\c:\1pjjd.exec:\1pjjd.exe42⤵
- Executes dropped EXE
-
\??\c:\1xrfxrl.exec:\1xrfxrl.exe43⤵
- Executes dropped EXE
-
\??\c:\tnnnnh.exec:\tnnnnh.exe44⤵
- Executes dropped EXE
-
\??\c:\pdjvd.exec:\pdjvd.exe45⤵
- Executes dropped EXE
-
\??\c:\fxrrlfx.exec:\fxrrlfx.exe46⤵
- Executes dropped EXE
-
\??\c:\hbhtbt.exec:\hbhtbt.exe47⤵
- Executes dropped EXE
-
\??\c:\vjvvv.exec:\vjvvv.exe48⤵
- Executes dropped EXE
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe49⤵
- Executes dropped EXE
-
\??\c:\5tbthb.exec:\5tbthb.exe50⤵
- Executes dropped EXE
-
\??\c:\1djdv.exec:\1djdv.exe51⤵
- Executes dropped EXE
-
\??\c:\xrxffrf.exec:\xrxffrf.exe52⤵
- Executes dropped EXE
-
\??\c:\bbnhht.exec:\bbnhht.exe53⤵
- Executes dropped EXE
-
\??\c:\pvvjp.exec:\pvvjp.exe54⤵
- Executes dropped EXE
-
\??\c:\lfrxfrl.exec:\lfrxfrl.exe55⤵
- Executes dropped EXE
-
\??\c:\tnthbt.exec:\tnthbt.exe56⤵
- Executes dropped EXE
-
\??\c:\vvdvp.exec:\vvdvp.exe57⤵
- Executes dropped EXE
-
\??\c:\lxlxfxx.exec:\lxlxfxx.exe58⤵
- Executes dropped EXE
-
\??\c:\hthbtn.exec:\hthbtn.exe59⤵
- Executes dropped EXE
-
\??\c:\bhnhtt.exec:\bhnhtt.exe60⤵
- Executes dropped EXE
-
\??\c:\vvvpd.exec:\vvvpd.exe61⤵
- Executes dropped EXE
-
\??\c:\fllrrll.exec:\fllrrll.exe62⤵
- Executes dropped EXE
-
\??\c:\5tttnb.exec:\5tttnb.exe63⤵
- Executes dropped EXE
-
\??\c:\pddjd.exec:\pddjd.exe64⤵
- Executes dropped EXE
-
\??\c:\jvdvp.exec:\jvdvp.exe65⤵
- Executes dropped EXE
-
\??\c:\nhtbnt.exec:\nhtbnt.exe66⤵
-
\??\c:\1tttnt.exec:\1tttnt.exe67⤵
-
\??\c:\fxrlrxr.exec:\fxrlrxr.exe68⤵
-
\??\c:\9bhbhh.exec:\9bhbhh.exe69⤵
-
\??\c:\vpvjv.exec:\vpvjv.exe70⤵
-
\??\c:\rllfxxr.exec:\rllfxxr.exe71⤵
-
\??\c:\xrxrxrl.exec:\xrxrxrl.exe72⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe73⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe74⤵
-
\??\c:\vppjd.exec:\vppjd.exe75⤵
-
\??\c:\btbbnn.exec:\btbbnn.exe76⤵
-
\??\c:\7tthhn.exec:\7tthhn.exe77⤵
-
\??\c:\djjdv.exec:\djjdv.exe78⤵
-
\??\c:\vvvvv.exec:\vvvvv.exe79⤵
-
\??\c:\thhhhh.exec:\thhhhh.exe80⤵
-
\??\c:\bnhhtt.exec:\bnhhtt.exe81⤵
-
\??\c:\jpvjv.exec:\jpvjv.exe82⤵
-
\??\c:\xlffxxr.exec:\xlffxxr.exe83⤵
-
\??\c:\rrxxffx.exec:\rrxxffx.exe84⤵
-
\??\c:\bbtnnn.exec:\bbtnnn.exe85⤵
-
\??\c:\jdvjd.exec:\jdvjd.exe86⤵
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe87⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe88⤵
-
\??\c:\btbbbb.exec:\btbbbb.exe89⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe90⤵
-
\??\c:\fxrrfff.exec:\fxrrfff.exe91⤵
-
\??\c:\fxxrlll.exec:\fxxrlll.exe92⤵
-
\??\c:\9bbtth.exec:\9bbtth.exe93⤵
-
\??\c:\vdjvj.exec:\vdjvj.exe94⤵
-
\??\c:\vvpdp.exec:\vvpdp.exe95⤵
-
\??\c:\5rllflf.exec:\5rllflf.exe96⤵
-
\??\c:\hhnnhh.exec:\hhnnhh.exe97⤵
-
\??\c:\ppjdd.exec:\ppjdd.exe98⤵
-
\??\c:\5pppj.exec:\5pppj.exe99⤵
-
\??\c:\xxlffff.exec:\xxlffff.exe100⤵
-
\??\c:\9nhhbh.exec:\9nhhbh.exe101⤵
-
\??\c:\pdddv.exec:\pdddv.exe102⤵
-
\??\c:\djpjd.exec:\djpjd.exe103⤵
-
\??\c:\1flxrrr.exec:\1flxrrr.exe104⤵
-
\??\c:\5hhhhn.exec:\5hhhhn.exe105⤵
-
\??\c:\3jjjj.exec:\3jjjj.exe106⤵
-
\??\c:\pvvpd.exec:\pvvpd.exe107⤵
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe108⤵
-
\??\c:\3vvvp.exec:\3vvvp.exe109⤵
-
\??\c:\vvvpp.exec:\vvvpp.exe110⤵
-
\??\c:\xrfxllf.exec:\xrfxllf.exe111⤵
-
\??\c:\btnbtn.exec:\btnbtn.exe112⤵
-
\??\c:\ntbthh.exec:\ntbthh.exe113⤵
-
\??\c:\ppddj.exec:\ppddj.exe114⤵
-
\??\c:\lfrlfxf.exec:\lfrlfxf.exe115⤵
-
\??\c:\nhhhbb.exec:\nhhhbb.exe116⤵
-
\??\c:\bhbbtt.exec:\bhbbtt.exe117⤵
-
\??\c:\3jpjd.exec:\3jpjd.exe118⤵
-
\??\c:\lrlffll.exec:\lrlffll.exe119⤵
-
\??\c:\lfrlfrl.exec:\lfrlfrl.exe120⤵
-
\??\c:\tbtnbh.exec:\tbtnbh.exe121⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe122⤵
-
\??\c:\jdjjv.exec:\jdjjv.exe123⤵
-
\??\c:\rllllll.exec:\rllllll.exe124⤵
-
\??\c:\thnnhh.exec:\thnnhh.exe125⤵
-
\??\c:\tntnhb.exec:\tntnhb.exe126⤵
-
\??\c:\9ddvp.exec:\9ddvp.exe127⤵
-
\??\c:\llrrlll.exec:\llrrlll.exe128⤵
-
\??\c:\7hnbbt.exec:\7hnbbt.exe129⤵
-
\??\c:\nthhbb.exec:\nthhbb.exe130⤵
-
\??\c:\vjdpd.exec:\vjdpd.exe131⤵
-
\??\c:\fffxlll.exec:\fffxlll.exe132⤵
-
\??\c:\thbbtb.exec:\thbbtb.exe133⤵
-
\??\c:\jvppv.exec:\jvppv.exe134⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe135⤵
-
\??\c:\fxxxfxr.exec:\fxxxfxr.exe136⤵
-
\??\c:\hhbhtb.exec:\hhbhtb.exe137⤵
-
\??\c:\vdpdp.exec:\vdpdp.exe138⤵
-
\??\c:\xxxrfxr.exec:\xxxrfxr.exe139⤵
-
\??\c:\5lllffx.exec:\5lllffx.exe140⤵
-
\??\c:\thhhbb.exec:\thhhbb.exe141⤵
-
\??\c:\tnhbtn.exec:\tnhbtn.exe142⤵
-
\??\c:\ddpjp.exec:\ddpjp.exe143⤵
-
\??\c:\lfrxrfx.exec:\lfrxrfx.exe144⤵
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe145⤵
-
\??\c:\5hhhbh.exec:\5hhhbh.exe146⤵
-
\??\c:\jjpvj.exec:\jjpvj.exe147⤵
-
\??\c:\3dpjp.exec:\3dpjp.exe148⤵
-
\??\c:\rrrlffx.exec:\rrrlffx.exe149⤵
-
\??\c:\1bbttt.exec:\1bbttt.exe150⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe151⤵
-
\??\c:\5pvvj.exec:\5pvvj.exe152⤵
-
\??\c:\xxllfff.exec:\xxllfff.exe153⤵
-
\??\c:\dddvp.exec:\dddvp.exe154⤵
-
\??\c:\3jpdj.exec:\3jpdj.exe155⤵
-
\??\c:\xfllfff.exec:\xfllfff.exe156⤵
-
\??\c:\9btnbb.exec:\9btnbb.exe157⤵
-
\??\c:\7ddvv.exec:\7ddvv.exe158⤵
-
\??\c:\xfllfff.exec:\xfllfff.exe159⤵
-
\??\c:\7bnhtt.exec:\7bnhtt.exe160⤵
-
\??\c:\1pvpp.exec:\1pvpp.exe161⤵
-
\??\c:\xrrfxfx.exec:\xrrfxfx.exe162⤵
-
\??\c:\fxlfrfx.exec:\fxlfrfx.exe163⤵
-
\??\c:\ttnnhh.exec:\ttnnhh.exe164⤵
-
\??\c:\btbttt.exec:\btbttt.exe165⤵
-
\??\c:\ddddv.exec:\ddddv.exe166⤵
-
\??\c:\pjppj.exec:\pjppj.exe167⤵
-
\??\c:\9lllxfx.exec:\9lllxfx.exe168⤵
-
\??\c:\bhnttt.exec:\bhnttt.exe169⤵
-
\??\c:\bthhtb.exec:\bthhtb.exe170⤵
-
\??\c:\ddvpj.exec:\ddvpj.exe171⤵
-
\??\c:\vdvjd.exec:\vdvjd.exe172⤵
-
\??\c:\xfxrrll.exec:\xfxrrll.exe173⤵
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe174⤵
-
\??\c:\hbnnbt.exec:\hbnnbt.exe175⤵
-
\??\c:\pvjdv.exec:\pvjdv.exe176⤵
-
\??\c:\vvppj.exec:\vvppj.exe177⤵
-
\??\c:\rlxrlll.exec:\rlxrlll.exe178⤵
-
\??\c:\btbthh.exec:\btbthh.exe179⤵
-
\??\c:\tthnhh.exec:\tthnhh.exe180⤵
-
\??\c:\dpvjv.exec:\dpvjv.exe181⤵
-
\??\c:\1rxxffl.exec:\1rxxffl.exe182⤵
-
\??\c:\lxfxllr.exec:\lxfxllr.exe183⤵
-
\??\c:\btbtnn.exec:\btbtnn.exe184⤵
-
\??\c:\ddjdd.exec:\ddjdd.exe185⤵
-
\??\c:\xrrfxll.exec:\xrrfxll.exe186⤵
-
\??\c:\thnhht.exec:\thnhht.exe187⤵
-
\??\c:\9tbttt.exec:\9tbttt.exe188⤵
-
\??\c:\vdjvd.exec:\vdjvd.exe189⤵
-
\??\c:\7fxrfll.exec:\7fxrfll.exe190⤵
-
\??\c:\tthhnh.exec:\tthhnh.exe191⤵
-
\??\c:\tnnhtt.exec:\tnnhtt.exe192⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe193⤵
-
\??\c:\lxrllll.exec:\lxrllll.exe194⤵
-
\??\c:\rflfllf.exec:\rflfllf.exe195⤵
-
\??\c:\hhnhnh.exec:\hhnhnh.exe196⤵
-
\??\c:\djvdv.exec:\djvdv.exe197⤵
-
\??\c:\xllfffx.exec:\xllfffx.exe198⤵
-
\??\c:\1frxffl.exec:\1frxffl.exe199⤵
-
\??\c:\tntttt.exec:\tntttt.exe200⤵
-
\??\c:\1pjdd.exec:\1pjdd.exe201⤵
-
\??\c:\ddjjd.exec:\ddjjd.exe202⤵
-
\??\c:\rlrrxrl.exec:\rlrrxrl.exe203⤵
-
\??\c:\ttnhbb.exec:\ttnhbb.exe204⤵
-
\??\c:\nnbnnn.exec:\nnbnnn.exe205⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe206⤵
-
\??\c:\ddppj.exec:\ddppj.exe207⤵
-
\??\c:\xfxxxfx.exec:\xfxxxfx.exe208⤵
-
\??\c:\nhtnhh.exec:\nhtnhh.exe209⤵
-
\??\c:\nbbthb.exec:\nbbthb.exe210⤵
-
\??\c:\dvjdd.exec:\dvjdd.exe211⤵
-
\??\c:\rfrlllf.exec:\rfrlllf.exe212⤵
-
\??\c:\bnnhnt.exec:\bnnhnt.exe213⤵
-
\??\c:\jdppd.exec:\jdppd.exe214⤵
-
\??\c:\jppvd.exec:\jppvd.exe215⤵
-
\??\c:\xxffxxx.exec:\xxffxxx.exe216⤵
-
\??\c:\htttnn.exec:\htttnn.exe217⤵
-
\??\c:\hbhbbb.exec:\hbhbbb.exe218⤵
-
\??\c:\pjjpp.exec:\pjjpp.exe219⤵
-
\??\c:\pdpjv.exec:\pdpjv.exe220⤵
-
\??\c:\rxxxxff.exec:\rxxxxff.exe221⤵
-
\??\c:\nnntbh.exec:\nnntbh.exe222⤵
-
\??\c:\jdvvp.exec:\jdvvp.exe223⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe224⤵
-
\??\c:\rxrrrxx.exec:\rxrrrxx.exe225⤵
-
\??\c:\hbtntt.exec:\hbtntt.exe226⤵
-
\??\c:\pjddv.exec:\pjddv.exe227⤵
-
\??\c:\pjjvd.exec:\pjjvd.exe228⤵
-
\??\c:\lfrfxfl.exec:\lfrfxfl.exe229⤵
-
\??\c:\bhnhhn.exec:\bhnhhn.exe230⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe231⤵
-
\??\c:\llrlfff.exec:\llrlfff.exe232⤵
-
\??\c:\fllrrff.exec:\fllrrff.exe233⤵
-
\??\c:\bbbtnn.exec:\bbbtnn.exe234⤵
-
\??\c:\vjvvd.exec:\vjvvd.exe235⤵
-
\??\c:\flrxxll.exec:\flrxxll.exe236⤵
-
\??\c:\tnttnb.exec:\tnttnb.exe237⤵
-
\??\c:\9vdvd.exec:\9vdvd.exe238⤵
-
\??\c:\vjvpv.exec:\vjvpv.exe239⤵
-
\??\c:\1flfxrf.exec:\1flfxrf.exe240⤵
-
\??\c:\thhbnh.exec:\thhbnh.exe241⤵