Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 11:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
406a73a43b1bd20699afe0e081f2459bf11896ce744488cf8751eb23ff50e90f_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
406a73a43b1bd20699afe0e081f2459bf11896ce744488cf8751eb23ff50e90f_NeikiAnalytics.exe
-
Size
483KB
-
MD5
907616ada4f07f5f4695a1a139d9a480
-
SHA1
7da2114aedf9066435bd78e68bc2ec91e395ee16
-
SHA256
406a73a43b1bd20699afe0e081f2459bf11896ce744488cf8751eb23ff50e90f
-
SHA512
5eec2adda27b1f5be57202f0776ed233daf57ccf2499d85d29acbe3c5a952db9472ecec3be7c821109dc4ee8d7740010e8a23d7430a50b4f5a70db95b590c883
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjhtSizji:q7Tc2NYHUrAwqzck
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1848-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-941-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-999-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-1061-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-1472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pvjpd.exelrxrrrl.exe9xllrff.exeddjpp.exe3djdj.exerrrrrrr.exehttbbb.exevvpdp.exevvvvp.exebttnnn.exerrrllll.exebnthhn.exe7thhhn.exedjdvj.exethnhhn.exellrxxxr.exejjdvd.exerfxlrrl.exebtnnnn.exexxrrffx.exexrxrrrl.exe5hbbtb.exe5hhtnn.exe3pdvv.exe3lxlxxr.exepjppj.exenbnnhb.exejjvvj.exerxflrfl.exevvdvv.exedpvvd.exehbhhnt.exevdppv.exenhnnnt.exeddjdj.exefrllfff.exefrxfffx.exetbhhnt.exepdddd.exexxlxxxx.exebtbhhh.exepjpjp.exefrfffll.exebbhhhn.exevvdjv.exeflxxrrf.exehbbbbb.exejdjjd.exexxlllrr.exexxlllrl.exenbtttb.exeppdjj.exexlxxxxf.exelfllrxf.exethttnn.exevvddv.exerxrrfff.exe3hhbbt.exenbnhhh.exe1vvvv.exe7fffxxr.exebnttnt.exehhnntb.exedddvp.exepid process 5092 pvjpd.exe 368 lrxrrrl.exe 4144 9xllrff.exe 3332 ddjpp.exe 4016 3djdj.exe 4008 rrrrrrr.exe 1668 httbbb.exe 3856 vvpdp.exe 2520 vvvvp.exe 5096 bttnnn.exe 2188 rrrllll.exe 552 bnthhn.exe 3924 7thhhn.exe 4812 djdvj.exe 4288 thnhhn.exe 4760 llrxxxr.exe 500 jjdvd.exe 3124 rfxlrrl.exe 4832 btnnnn.exe 1780 xxrrffx.exe 4676 xrxrrrl.exe 1968 5hbbtb.exe 2584 5hhtnn.exe 2964 3pdvv.exe 1872 3lxlxxr.exe 4036 pjppj.exe 1372 nbnnhb.exe 1284 jjvvj.exe 4796 rxflrfl.exe 4624 vvdvv.exe 2392 dpvvd.exe 656 hbhhnt.exe 2524 vdppv.exe 1736 nhnnnt.exe 2556 ddjdj.exe 4432 frllfff.exe 5036 frxfffx.exe 2768 tbhhnt.exe 856 pdddd.exe 2292 xxlxxxx.exe 4364 btbhhh.exe 1440 pjpjp.exe 1124 frfffll.exe 2640 bbhhhn.exe 1620 vvdjv.exe 3408 flxxrrf.exe 1548 hbbbbb.exe 3820 jdjjd.exe 2252 xxlllrr.exe 3236 xxlllrl.exe 4980 nbtttb.exe 2180 ppdjj.exe 3772 xlxxxxf.exe 2188 lfllrxf.exe 2020 thttnn.exe 4616 vvddv.exe 3924 rxrrfff.exe 4812 3hhbbt.exe 812 nbnhhh.exe 3304 1vvvv.exe 3320 7fffxxr.exe 3160 bnttnt.exe 4992 hhnntb.exe 4832 dddvp.exe -
Processes:
resource yara_rule behavioral2/memory/1848-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-643-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
406a73a43b1bd20699afe0e081f2459bf11896ce744488cf8751eb23ff50e90f_NeikiAnalytics.exepvjpd.exelrxrrrl.exe9xllrff.exeddjpp.exe3djdj.exerrrrrrr.exehttbbb.exevvpdp.exevvvvp.exebttnnn.exerrrllll.exebnthhn.exe7thhhn.exedjdvj.exethnhhn.exellrxxxr.exejjdvd.exerfxlrrl.exebtnnnn.exexxrrffx.exexrxrrrl.exedescription pid process target process PID 1848 wrote to memory of 5092 1848 406a73a43b1bd20699afe0e081f2459bf11896ce744488cf8751eb23ff50e90f_NeikiAnalytics.exe pvjpd.exe PID 1848 wrote to memory of 5092 1848 406a73a43b1bd20699afe0e081f2459bf11896ce744488cf8751eb23ff50e90f_NeikiAnalytics.exe pvjpd.exe PID 1848 wrote to memory of 5092 1848 406a73a43b1bd20699afe0e081f2459bf11896ce744488cf8751eb23ff50e90f_NeikiAnalytics.exe pvjpd.exe PID 5092 wrote to memory of 368 5092 pvjpd.exe lrxrrrl.exe PID 5092 wrote to memory of 368 5092 pvjpd.exe lrxrrrl.exe PID 5092 wrote to memory of 368 5092 pvjpd.exe lrxrrrl.exe PID 368 wrote to memory of 4144 368 lrxrrrl.exe 9xllrff.exe PID 368 wrote to memory of 4144 368 lrxrrrl.exe 9xllrff.exe PID 368 wrote to memory of 4144 368 lrxrrrl.exe 9xllrff.exe PID 4144 wrote to memory of 3332 4144 9xllrff.exe ddjpp.exe PID 4144 wrote to memory of 3332 4144 9xllrff.exe ddjpp.exe PID 4144 wrote to memory of 3332 4144 9xllrff.exe ddjpp.exe PID 3332 wrote to memory of 4016 3332 ddjpp.exe 3djdj.exe PID 3332 wrote to memory of 4016 3332 ddjpp.exe 3djdj.exe PID 3332 wrote to memory of 4016 3332 ddjpp.exe 3djdj.exe PID 4016 wrote to memory of 4008 4016 3djdj.exe rrrrrrr.exe PID 4016 wrote to memory of 4008 4016 3djdj.exe rrrrrrr.exe PID 4016 wrote to memory of 4008 4016 3djdj.exe rrrrrrr.exe PID 4008 wrote to memory of 1668 4008 rrrrrrr.exe httbbb.exe PID 4008 wrote to memory of 1668 4008 rrrrrrr.exe httbbb.exe PID 4008 wrote to memory of 1668 4008 rrrrrrr.exe httbbb.exe PID 1668 wrote to memory of 3856 1668 httbbb.exe vvpdp.exe PID 1668 wrote to memory of 3856 1668 httbbb.exe vvpdp.exe PID 1668 wrote to memory of 3856 1668 httbbb.exe vvpdp.exe PID 3856 wrote to memory of 2520 3856 vvpdp.exe vvvvp.exe PID 3856 wrote to memory of 2520 3856 vvpdp.exe vvvvp.exe PID 3856 wrote to memory of 2520 3856 vvpdp.exe vvvvp.exe PID 2520 wrote to memory of 5096 2520 vvvvp.exe bttnnn.exe PID 2520 wrote to memory of 5096 2520 vvvvp.exe bttnnn.exe PID 2520 wrote to memory of 5096 2520 vvvvp.exe bttnnn.exe PID 5096 wrote to memory of 2188 5096 bttnnn.exe rrrllll.exe PID 5096 wrote to memory of 2188 5096 bttnnn.exe rrrllll.exe PID 5096 wrote to memory of 2188 5096 bttnnn.exe rrrllll.exe PID 2188 wrote to memory of 552 2188 rrrllll.exe bnthhn.exe PID 2188 wrote to memory of 552 2188 rrrllll.exe bnthhn.exe PID 2188 wrote to memory of 552 2188 rrrllll.exe bnthhn.exe PID 552 wrote to memory of 3924 552 bnthhn.exe 7thhhn.exe PID 552 wrote to memory of 3924 552 bnthhn.exe 7thhhn.exe PID 552 wrote to memory of 3924 552 bnthhn.exe 7thhhn.exe PID 3924 wrote to memory of 4812 3924 7thhhn.exe djdvj.exe PID 3924 wrote to memory of 4812 3924 7thhhn.exe djdvj.exe PID 3924 wrote to memory of 4812 3924 7thhhn.exe djdvj.exe PID 4812 wrote to memory of 4288 4812 djdvj.exe thnhhn.exe PID 4812 wrote to memory of 4288 4812 djdvj.exe thnhhn.exe PID 4812 wrote to memory of 4288 4812 djdvj.exe thnhhn.exe PID 4288 wrote to memory of 4760 4288 thnhhn.exe llrxxxr.exe PID 4288 wrote to memory of 4760 4288 thnhhn.exe llrxxxr.exe PID 4288 wrote to memory of 4760 4288 thnhhn.exe llrxxxr.exe PID 4760 wrote to memory of 500 4760 llrxxxr.exe jjdvd.exe PID 4760 wrote to memory of 500 4760 llrxxxr.exe jjdvd.exe PID 4760 wrote to memory of 500 4760 llrxxxr.exe jjdvd.exe PID 500 wrote to memory of 3124 500 jjdvd.exe rfxlrrl.exe PID 500 wrote to memory of 3124 500 jjdvd.exe rfxlrrl.exe PID 500 wrote to memory of 3124 500 jjdvd.exe rfxlrrl.exe PID 3124 wrote to memory of 4832 3124 rfxlrrl.exe btnnnn.exe PID 3124 wrote to memory of 4832 3124 rfxlrrl.exe btnnnn.exe PID 3124 wrote to memory of 4832 3124 rfxlrrl.exe btnnnn.exe PID 4832 wrote to memory of 1780 4832 btnnnn.exe xxrrffx.exe PID 4832 wrote to memory of 1780 4832 btnnnn.exe xxrrffx.exe PID 4832 wrote to memory of 1780 4832 btnnnn.exe xxrrffx.exe PID 1780 wrote to memory of 4676 1780 xxrrffx.exe xrxrrrl.exe PID 1780 wrote to memory of 4676 1780 xxrrffx.exe xrxrrrl.exe PID 1780 wrote to memory of 4676 1780 xxrrffx.exe xrxrrrl.exe PID 4676 wrote to memory of 1968 4676 xrxrrrl.exe 5hbbtb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\406a73a43b1bd20699afe0e081f2459bf11896ce744488cf8751eb23ff50e90f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\406a73a43b1bd20699afe0e081f2459bf11896ce744488cf8751eb23ff50e90f_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\pvjpd.exec:\pvjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xllrff.exec:\9xllrff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjpp.exec:\ddjpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3djdj.exec:\3djdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\httbbb.exec:\httbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvpdp.exec:\vvpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvvp.exec:\vvvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bttnnn.exec:\bttnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrllll.exec:\rrrllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnthhn.exec:\bnthhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7thhhn.exec:\7thhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djdvj.exec:\djdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnhhn.exec:\thnhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llrxxxr.exec:\llrxxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjdvd.exec:\jjdvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfxlrrl.exec:\rfxlrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnnnn.exec:\btnnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrrffx.exec:\xxrrffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5hbbtb.exec:\5hbbtb.exe23⤵
- Executes dropped EXE
-
\??\c:\5hhtnn.exec:\5hhtnn.exe24⤵
- Executes dropped EXE
-
\??\c:\3pdvv.exec:\3pdvv.exe25⤵
- Executes dropped EXE
-
\??\c:\3lxlxxr.exec:\3lxlxxr.exe26⤵
- Executes dropped EXE
-
\??\c:\pjppj.exec:\pjppj.exe27⤵
- Executes dropped EXE
-
\??\c:\nbnnhb.exec:\nbnnhb.exe28⤵
- Executes dropped EXE
-
\??\c:\jjvvj.exec:\jjvvj.exe29⤵
- Executes dropped EXE
-
\??\c:\rxflrfl.exec:\rxflrfl.exe30⤵
- Executes dropped EXE
-
\??\c:\vvdvv.exec:\vvdvv.exe31⤵
- Executes dropped EXE
-
\??\c:\dpvvd.exec:\dpvvd.exe32⤵
- Executes dropped EXE
-
\??\c:\hbhhnt.exec:\hbhhnt.exe33⤵
- Executes dropped EXE
-
\??\c:\vdppv.exec:\vdppv.exe34⤵
- Executes dropped EXE
-
\??\c:\nhnnnt.exec:\nhnnnt.exe35⤵
- Executes dropped EXE
-
\??\c:\ddjdj.exec:\ddjdj.exe36⤵
- Executes dropped EXE
-
\??\c:\frllfff.exec:\frllfff.exe37⤵
- Executes dropped EXE
-
\??\c:\frxfffx.exec:\frxfffx.exe38⤵
- Executes dropped EXE
-
\??\c:\tbhhnt.exec:\tbhhnt.exe39⤵
- Executes dropped EXE
-
\??\c:\pdddd.exec:\pdddd.exe40⤵
- Executes dropped EXE
-
\??\c:\xxlxxxx.exec:\xxlxxxx.exe41⤵
- Executes dropped EXE
-
\??\c:\btbhhh.exec:\btbhhh.exe42⤵
- Executes dropped EXE
-
\??\c:\pjpjp.exec:\pjpjp.exe43⤵
- Executes dropped EXE
-
\??\c:\frfffll.exec:\frfffll.exe44⤵
- Executes dropped EXE
-
\??\c:\bbhhhn.exec:\bbhhhn.exe45⤵
- Executes dropped EXE
-
\??\c:\vvdjv.exec:\vvdjv.exe46⤵
- Executes dropped EXE
-
\??\c:\flxxrrf.exec:\flxxrrf.exe47⤵
- Executes dropped EXE
-
\??\c:\hbbbbb.exec:\hbbbbb.exe48⤵
- Executes dropped EXE
-
\??\c:\jdjjd.exec:\jdjjd.exe49⤵
- Executes dropped EXE
-
\??\c:\xxlllrr.exec:\xxlllrr.exe50⤵
- Executes dropped EXE
-
\??\c:\xxlllrl.exec:\xxlllrl.exe51⤵
- Executes dropped EXE
-
\??\c:\nbtttb.exec:\nbtttb.exe52⤵
- Executes dropped EXE
-
\??\c:\ppdjj.exec:\ppdjj.exe53⤵
- Executes dropped EXE
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe54⤵
- Executes dropped EXE
-
\??\c:\lfllrxf.exec:\lfllrxf.exe55⤵
- Executes dropped EXE
-
\??\c:\thttnn.exec:\thttnn.exe56⤵
- Executes dropped EXE
-
\??\c:\vvddv.exec:\vvddv.exe57⤵
- Executes dropped EXE
-
\??\c:\rxrrfff.exec:\rxrrfff.exe58⤵
- Executes dropped EXE
-
\??\c:\3hhbbt.exec:\3hhbbt.exe59⤵
- Executes dropped EXE
-
\??\c:\nbnhhh.exec:\nbnhhh.exe60⤵
- Executes dropped EXE
-
\??\c:\1vvvv.exec:\1vvvv.exe61⤵
- Executes dropped EXE
-
\??\c:\7fffxxr.exec:\7fffxxr.exe62⤵
- Executes dropped EXE
-
\??\c:\bnttnt.exec:\bnttnt.exe63⤵
- Executes dropped EXE
-
\??\c:\hhnntb.exec:\hhnntb.exe64⤵
- Executes dropped EXE
-
\??\c:\dddvp.exec:\dddvp.exe65⤵
- Executes dropped EXE
-
\??\c:\llxrrll.exec:\llxrrll.exe66⤵
-
\??\c:\ddppd.exec:\ddppd.exe67⤵
-
\??\c:\frrrxfx.exec:\frrrxfx.exe68⤵
-
\??\c:\xxfffff.exec:\xxfffff.exe69⤵
-
\??\c:\bnbbbb.exec:\bnbbbb.exe70⤵
-
\??\c:\jjddv.exec:\jjddv.exe71⤵
-
\??\c:\rrxxlrr.exec:\rrxxlrr.exe72⤵
-
\??\c:\5nnhhn.exec:\5nnhhn.exe73⤵
-
\??\c:\tttttt.exec:\tttttt.exe74⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe75⤵
-
\??\c:\rrxrxxl.exec:\rrxrxxl.exe76⤵
-
\??\c:\5bbttn.exec:\5bbttn.exe77⤵
-
\??\c:\ddpvd.exec:\ddpvd.exe78⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe79⤵
-
\??\c:\fxxrlff.exec:\fxxrlff.exe80⤵
-
\??\c:\htthhn.exec:\htthhn.exe81⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe82⤵
-
\??\c:\rxffffl.exec:\rxffffl.exe83⤵
-
\??\c:\1rffrrf.exec:\1rffrrf.exe84⤵
-
\??\c:\vdjdd.exec:\vdjdd.exe85⤵
-
\??\c:\fffxlfr.exec:\fffxlfr.exe86⤵
-
\??\c:\hhbtbb.exec:\hhbtbb.exe87⤵
-
\??\c:\5pvjd.exec:\5pvjd.exe88⤵
-
\??\c:\dvddj.exec:\dvddj.exe89⤵
-
\??\c:\llrrrff.exec:\llrrrff.exe90⤵
-
\??\c:\bhnhbt.exec:\bhnhbt.exe91⤵
-
\??\c:\jdpjj.exec:\jdpjj.exe92⤵
-
\??\c:\rlrrfxx.exec:\rlrrfxx.exe93⤵
-
\??\c:\ttnnnn.exec:\ttnnnn.exe94⤵
-
\??\c:\djdvv.exec:\djdvv.exe95⤵
-
\??\c:\dvddv.exec:\dvddv.exe96⤵
-
\??\c:\httttt.exec:\httttt.exe97⤵
-
\??\c:\bthhhn.exec:\bthhhn.exe98⤵
-
\??\c:\vvvdd.exec:\vvvdd.exe99⤵
-
\??\c:\rfllffl.exec:\rfllffl.exe100⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe101⤵
-
\??\c:\htbnht.exec:\htbnht.exe102⤵
-
\??\c:\3vdpv.exec:\3vdpv.exe103⤵
-
\??\c:\xfffffx.exec:\xfffffx.exe104⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe105⤵
-
\??\c:\nhtnbt.exec:\nhtnbt.exe106⤵
-
\??\c:\ppvvj.exec:\ppvvj.exe107⤵
-
\??\c:\xlfrrxx.exec:\xlfrrxx.exe108⤵
-
\??\c:\bbtbbb.exec:\bbtbbb.exe109⤵
-
\??\c:\dvvdj.exec:\dvvdj.exe110⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe111⤵
-
\??\c:\lffxxrl.exec:\lffxxrl.exe112⤵
-
\??\c:\hnnnbt.exec:\hnnnbt.exe113⤵
-
\??\c:\pvddd.exec:\pvddd.exe114⤵
-
\??\c:\5lrrrxr.exec:\5lrrrxr.exe115⤵
-
\??\c:\tbbbbb.exec:\tbbbbb.exe116⤵
-
\??\c:\1ddvp.exec:\1ddvp.exe117⤵
-
\??\c:\lrxxxxr.exec:\lrxxxxr.exe118⤵
-
\??\c:\fxfffff.exec:\fxfffff.exe119⤵
-
\??\c:\bthbnt.exec:\bthbnt.exe120⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe121⤵
-
\??\c:\frlllrr.exec:\frlllrr.exe122⤵
-
\??\c:\lfllxrx.exec:\lfllxrx.exe123⤵
-
\??\c:\5bhbnn.exec:\5bhbnn.exe124⤵
-
\??\c:\dvjdj.exec:\dvjdj.exe125⤵
-
\??\c:\fxlllrr.exec:\fxlllrr.exe126⤵
-
\??\c:\xxllfff.exec:\xxllfff.exe127⤵
-
\??\c:\3bttnn.exec:\3bttnn.exe128⤵
-
\??\c:\jjppp.exec:\jjppp.exe129⤵
-
\??\c:\xxffffl.exec:\xxffffl.exe130⤵
-
\??\c:\bntntt.exec:\bntntt.exe131⤵
-
\??\c:\jvvpv.exec:\jvvpv.exe132⤵
-
\??\c:\vpjvv.exec:\vpjvv.exe133⤵
-
\??\c:\7fllfll.exec:\7fllfll.exe134⤵
-
\??\c:\hthbbh.exec:\hthbbh.exe135⤵
-
\??\c:\dppjd.exec:\dppjd.exe136⤵
-
\??\c:\dddjj.exec:\dddjj.exe137⤵
-
\??\c:\xlffxxx.exec:\xlffxxx.exe138⤵
-
\??\c:\hhtttt.exec:\hhtttt.exe139⤵
-
\??\c:\bttttt.exec:\bttttt.exe140⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe141⤵
-
\??\c:\lfllrfl.exec:\lfllrfl.exe142⤵
-
\??\c:\xrffxxx.exec:\xrffxxx.exe143⤵
-
\??\c:\htbbtt.exec:\htbbtt.exe144⤵
-
\??\c:\djjdj.exec:\djjdj.exe145⤵
-
\??\c:\xrxrrlf.exec:\xrxrrlf.exe146⤵
-
\??\c:\xrfffll.exec:\xrfffll.exe147⤵
-
\??\c:\nhthnh.exec:\nhthnh.exe148⤵
-
\??\c:\ddvjp.exec:\ddvjp.exe149⤵
-
\??\c:\lfffxxl.exec:\lfffxxl.exe150⤵
-
\??\c:\thhbnn.exec:\thhbnn.exe151⤵
-
\??\c:\vjdpp.exec:\vjdpp.exe152⤵
-
\??\c:\7fxlfxl.exec:\7fxlfxl.exe153⤵
-
\??\c:\hhnhbb.exec:\hhnhbb.exe154⤵
-
\??\c:\bbbbtb.exec:\bbbbtb.exe155⤵
-
\??\c:\jjjvd.exec:\jjjvd.exe156⤵
-
\??\c:\flrlffx.exec:\flrlffx.exe157⤵
-
\??\c:\thhbtn.exec:\thhbtn.exe158⤵
-
\??\c:\vppjj.exec:\vppjj.exe159⤵
-
\??\c:\pjppp.exec:\pjppp.exe160⤵
-
\??\c:\llxlxrl.exec:\llxlxrl.exe161⤵
-
\??\c:\tbbtnb.exec:\tbbtnb.exe162⤵
-
\??\c:\djpjv.exec:\djpjv.exe163⤵
-
\??\c:\rflxxrl.exec:\rflxxrl.exe164⤵
-
\??\c:\btnhtt.exec:\btnhtt.exe165⤵
-
\??\c:\thbhtn.exec:\thbhtn.exe166⤵
-
\??\c:\vjvdj.exec:\vjvdj.exe167⤵
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe168⤵
-
\??\c:\nbtntt.exec:\nbtntt.exe169⤵
-
\??\c:\7tnbnn.exec:\7tnbnn.exe170⤵
-
\??\c:\pppjd.exec:\pppjd.exe171⤵
-
\??\c:\xlxlrfx.exec:\xlxlrfx.exe172⤵
-
\??\c:\bnttnb.exec:\bnttnb.exe173⤵
-
\??\c:\5tthbt.exec:\5tthbt.exe174⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe175⤵
-
\??\c:\rlfxfxf.exec:\rlfxfxf.exe176⤵
-
\??\c:\hnthbt.exec:\hnthbt.exe177⤵
-
\??\c:\3hbbtn.exec:\3hbbtn.exe178⤵
-
\??\c:\7jjdv.exec:\7jjdv.exe179⤵
-
\??\c:\lffxxrx.exec:\lffxxrx.exe180⤵
-
\??\c:\ntbtnn.exec:\ntbtnn.exe181⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe182⤵
-
\??\c:\pdvpd.exec:\pdvpd.exe183⤵
-
\??\c:\xlxflfl.exec:\xlxflfl.exe184⤵
-
\??\c:\hhbnhh.exec:\hhbnhh.exe185⤵
-
\??\c:\pjdvp.exec:\pjdvp.exe186⤵
-
\??\c:\rffxrlf.exec:\rffxrlf.exe187⤵
-
\??\c:\frrlxrl.exec:\frrlxrl.exe188⤵
-
\??\c:\ttbtbb.exec:\ttbtbb.exe189⤵
-
\??\c:\jvvjd.exec:\jvvjd.exe190⤵
-
\??\c:\lxxlxrx.exec:\lxxlxrx.exe191⤵
-
\??\c:\frrflfr.exec:\frrflfr.exe192⤵
-
\??\c:\nnttnn.exec:\nnttnn.exe193⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe194⤵
-
\??\c:\vvvjj.exec:\vvvjj.exe195⤵
-
\??\c:\rlffxxf.exec:\rlffxxf.exe196⤵
-
\??\c:\nhnhhn.exec:\nhnhhn.exe197⤵
-
\??\c:\pdvjv.exec:\pdvjv.exe198⤵
-
\??\c:\5rfxllx.exec:\5rfxllx.exe199⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe200⤵
-
\??\c:\nbtnhb.exec:\nbtnhb.exe201⤵
-
\??\c:\vvvpv.exec:\vvvpv.exe202⤵
-
\??\c:\xlrfxrf.exec:\xlrfxrf.exe203⤵
-
\??\c:\5bbtnh.exec:\5bbtnh.exe204⤵
-
\??\c:\bbhbnn.exec:\bbhbnn.exe205⤵
-
\??\c:\3dvpd.exec:\3dvpd.exe206⤵
-
\??\c:\1xrfxrl.exec:\1xrfxrl.exe207⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe208⤵
-
\??\c:\nnbnhb.exec:\nnbnhb.exe209⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe210⤵
-
\??\c:\rllfrll.exec:\rllfrll.exe211⤵
-
\??\c:\1hbbtt.exec:\1hbbtt.exe212⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe213⤵
-
\??\c:\vddvp.exec:\vddvp.exe214⤵
-
\??\c:\3frlxxl.exec:\3frlxxl.exe215⤵
-
\??\c:\tbtbnb.exec:\tbtbnb.exe216⤵
-
\??\c:\bhthnb.exec:\bhthnb.exe217⤵
-
\??\c:\3pdvj.exec:\3pdvj.exe218⤵
-
\??\c:\xlxrrll.exec:\xlxrrll.exe219⤵
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe220⤵
-
\??\c:\bntnhh.exec:\bntnhh.exe221⤵
-
\??\c:\dpdpp.exec:\dpdpp.exe222⤵
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe223⤵
-
\??\c:\xrfxrlf.exec:\xrfxrlf.exe224⤵
-
\??\c:\bbhhnn.exec:\bbhhnn.exe225⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe226⤵
-
\??\c:\xflxxrl.exec:\xflxxrl.exe227⤵
-
\??\c:\9ffxllf.exec:\9ffxllf.exe228⤵
-
\??\c:\btbnhh.exec:\btbnhh.exe229⤵
-
\??\c:\vpppj.exec:\vpppj.exe230⤵
-
\??\c:\fxlfffr.exec:\fxlfffr.exe231⤵
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe232⤵
-
\??\c:\hhnnhb.exec:\hhnnhb.exe233⤵
-
\??\c:\vpjdd.exec:\vpjdd.exe234⤵
-
\??\c:\rllxxrl.exec:\rllxxrl.exe235⤵
-
\??\c:\nbthbt.exec:\nbthbt.exe236⤵
-
\??\c:\hbnbtn.exec:\hbnbtn.exe237⤵
-
\??\c:\pjdjd.exec:\pjdjd.exe238⤵
-
\??\c:\rflxrxr.exec:\rflxrxr.exe239⤵
-
\??\c:\htbnhh.exec:\htbnhh.exe240⤵
-
\??\c:\3hnhbh.exec:\3hnhbh.exe241⤵