Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 12:07
Behavioral task
behavioral1
Sample
46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe
-
Size
328KB
-
MD5
80d599f3a116bea8867625098bf51160
-
SHA1
1df09ce73ccc6d51d4dcdccaf0a974a0d6094529
-
SHA256
46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23
-
SHA512
bc014c7bd33eca7be0fac4f37b6bf0b28cbc310855ad80d97505b42850758f11035d6e1b18ac475191eb20eb8f3b670f61a61d86b5711b7f898b97489caa367e
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbem:R4wFHoSHYHUrAwfMp3CDm
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2616-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/676-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/892-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/924-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1656-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/428-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1264-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2960-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1156-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1304-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1496-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-747-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1076-772-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nbbtnh.exevjppj.exehhttht.exehbbbbt.exejpdvp.exebnthbt.exe5lrlllr.exebbhhnn.exefrxrlfx.exe7bhbbb.exejpvvj.exettbnnb.exe7bhbtn.exeppvvd.exellllrll.exehbttnn.exepvjjd.exefllffxf.exe7tbtbb.exexrfxlfx.exe7bbthb.exepvdvd.exefrffflr.exetbhbnh.exepdvjd.exe3hbthh.exejjjvp.exerlrffxf.exenbbttt.exevpjdp.exexxrrlfx.exebbnbhh.exefxrrrxx.exefxrrlll.exe9tbnhh.exe7jjpd.exefrfxxxx.exerrrllll.exebhnhtt.exepjpjd.exe3lfrxxf.exe7ntnnt.exehbbhbt.exejppjd.exefrfxffr.exerrlffff.exehnnbtt.exevvpjv.exerrrlffx.exeffllllf.exehnnhbt.exejjppd.exexrrlllf.exexxrxxxr.exehbnnhn.exedjvpp.exejdpvv.exexllrxrx.exehbtttt.exenhbthh.exejdddv.exerxlxrrl.exefxrlffx.exe9hhbtt.exepid process 4480 nbbtnh.exe 1404 vjppj.exe 3612 hhttht.exe 3628 hbbbbt.exe 676 jpdvp.exe 892 bnthbt.exe 2172 5lrlllr.exe 4424 bbhhnn.exe 924 frxrlfx.exe 2636 7bhbbb.exe 396 jpvvj.exe 1656 ttbnnb.exe 4452 7bhbtn.exe 428 ppvvd.exe 4192 llllrll.exe 4240 hbttnn.exe 3028 pvjjd.exe 2572 fllffxf.exe 1548 7tbtbb.exe 4752 xrfxlfx.exe 2004 7bbthb.exe 1944 pvdvd.exe 3572 frffflr.exe 3668 tbhbnh.exe 4300 pdvjd.exe 1264 3hbthh.exe 3596 jjjvp.exe 1600 rlrffxf.exe 2660 nbbttt.exe 4328 vpjdp.exe 3864 xxrrlfx.exe 5076 bbnbhh.exe 3256 fxrrrxx.exe 212 fxrrlll.exe 4048 9tbnhh.exe 3212 7jjpd.exe 3876 frfxxxx.exe 2532 rrrllll.exe 1008 bhnhtt.exe 1936 pjpjd.exe 4384 3lfrxxf.exe 4368 7ntnnt.exe 2616 hbbhbt.exe 3504 jppjd.exe 3756 frfxffr.exe 3588 rrlffff.exe 3984 hnnbtt.exe 3632 vvpjv.exe 4420 rrrlffx.exe 4896 ffllllf.exe 1128 hnnhbt.exe 5060 jjppd.exe 892 xrrlllf.exe 1660 xxrxxxr.exe 760 hbnnhn.exe 4424 djvpp.exe 2684 jdpvv.exe 2160 xllrxrx.exe 2960 hbtttt.exe 2636 nhbthh.exe 3192 jdddv.exe 1156 rxlxrrl.exe 2800 fxrlffx.exe 3180 9hhbtt.exe -
Processes:
resource yara_rule behavioral2/memory/2616-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbbtnh.exe upx behavioral2/memory/2616-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjppj.exe upx behavioral2/memory/4480-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhttht.exe upx behavioral2/memory/3612-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1404-15-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbbbbt.exe upx C:\jpdvp.exe upx behavioral2/memory/3628-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/676-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnthbt.exe upx behavioral2/memory/676-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lrlllr.exe upx behavioral2/memory/892-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2172-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2172-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbhhnn.exe upx behavioral2/memory/4424-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frxrlfx.exe upx behavioral2/memory/4424-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/924-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bhbbb.exe upx C:\jpvvj.exe upx behavioral2/memory/2636-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttbnnb.exe upx behavioral2/memory/1656-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bhbtn.exe upx C:\ppvvd.exe upx behavioral2/memory/428-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4452-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llllrll.exe upx C:\hbttnn.exe upx C:\pvjjd.exe upx C:\fllffxf.exe upx behavioral2/memory/2572-91-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7tbtbb.exe upx behavioral2/memory/1548-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrfxlfx.exe upx C:\7bbthb.exe upx behavioral2/memory/4752-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2004-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvdvd.exe upx C:\frffflr.exe upx C:\tbhbnh.exe upx behavioral2/memory/3572-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvjd.exe upx behavioral2/memory/3668-122-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3hbthh.exe upx behavioral2/memory/1264-131-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjvp.exe upx \??\c:\rlrffxf.exe upx C:\nbbttt.exe upx behavioral2/memory/1600-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjdp.exe upx behavioral2/memory/2660-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4328-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrrlfx.exe upx C:\bbnbhh.exe upx behavioral2/memory/5076-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3256-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/212-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4048-166-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exenbbtnh.exevjppj.exehhttht.exehbbbbt.exejpdvp.exebnthbt.exe5lrlllr.exebbhhnn.exefrxrlfx.exe7bhbbb.exejpvvj.exettbnnb.exe7bhbtn.exeppvvd.exellllrll.exehbttnn.exepvjjd.exefllffxf.exe7tbtbb.exexrfxlfx.exe7bbthb.exedescription pid process target process PID 2616 wrote to memory of 4480 2616 46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe nbbtnh.exe PID 2616 wrote to memory of 4480 2616 46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe nbbtnh.exe PID 2616 wrote to memory of 4480 2616 46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe nbbtnh.exe PID 4480 wrote to memory of 1404 4480 nbbtnh.exe vjppj.exe PID 4480 wrote to memory of 1404 4480 nbbtnh.exe vjppj.exe PID 4480 wrote to memory of 1404 4480 nbbtnh.exe vjppj.exe PID 1404 wrote to memory of 3612 1404 vjppj.exe hhttht.exe PID 1404 wrote to memory of 3612 1404 vjppj.exe hhttht.exe PID 1404 wrote to memory of 3612 1404 vjppj.exe hhttht.exe PID 3612 wrote to memory of 3628 3612 hhttht.exe hbbbbt.exe PID 3612 wrote to memory of 3628 3612 hhttht.exe hbbbbt.exe PID 3612 wrote to memory of 3628 3612 hhttht.exe hbbbbt.exe PID 3628 wrote to memory of 676 3628 hbbbbt.exe jpdvp.exe PID 3628 wrote to memory of 676 3628 hbbbbt.exe jpdvp.exe PID 3628 wrote to memory of 676 3628 hbbbbt.exe jpdvp.exe PID 676 wrote to memory of 892 676 jpdvp.exe bnthbt.exe PID 676 wrote to memory of 892 676 jpdvp.exe bnthbt.exe PID 676 wrote to memory of 892 676 jpdvp.exe bnthbt.exe PID 892 wrote to memory of 2172 892 bnthbt.exe 5lrlllr.exe PID 892 wrote to memory of 2172 892 bnthbt.exe 5lrlllr.exe PID 892 wrote to memory of 2172 892 bnthbt.exe 5lrlllr.exe PID 2172 wrote to memory of 4424 2172 5lrlllr.exe bbhhnn.exe PID 2172 wrote to memory of 4424 2172 5lrlllr.exe bbhhnn.exe PID 2172 wrote to memory of 4424 2172 5lrlllr.exe bbhhnn.exe PID 4424 wrote to memory of 924 4424 bbhhnn.exe frxrlfx.exe PID 4424 wrote to memory of 924 4424 bbhhnn.exe frxrlfx.exe PID 4424 wrote to memory of 924 4424 bbhhnn.exe frxrlfx.exe PID 924 wrote to memory of 2636 924 frxrlfx.exe 7bhbbb.exe PID 924 wrote to memory of 2636 924 frxrlfx.exe 7bhbbb.exe PID 924 wrote to memory of 2636 924 frxrlfx.exe 7bhbbb.exe PID 2636 wrote to memory of 396 2636 7bhbbb.exe jpvvj.exe PID 2636 wrote to memory of 396 2636 7bhbbb.exe jpvvj.exe PID 2636 wrote to memory of 396 2636 7bhbbb.exe jpvvj.exe PID 396 wrote to memory of 1656 396 jpvvj.exe ttbnnb.exe PID 396 wrote to memory of 1656 396 jpvvj.exe ttbnnb.exe PID 396 wrote to memory of 1656 396 jpvvj.exe ttbnnb.exe PID 1656 wrote to memory of 4452 1656 ttbnnb.exe 7bhbtn.exe PID 1656 wrote to memory of 4452 1656 ttbnnb.exe 7bhbtn.exe PID 1656 wrote to memory of 4452 1656 ttbnnb.exe 7bhbtn.exe PID 4452 wrote to memory of 428 4452 7bhbtn.exe ppvvd.exe PID 4452 wrote to memory of 428 4452 7bhbtn.exe ppvvd.exe PID 4452 wrote to memory of 428 4452 7bhbtn.exe ppvvd.exe PID 428 wrote to memory of 4192 428 ppvvd.exe llllrll.exe PID 428 wrote to memory of 4192 428 ppvvd.exe llllrll.exe PID 428 wrote to memory of 4192 428 ppvvd.exe llllrll.exe PID 4192 wrote to memory of 4240 4192 llllrll.exe hbttnn.exe PID 4192 wrote to memory of 4240 4192 llllrll.exe hbttnn.exe PID 4192 wrote to memory of 4240 4192 llllrll.exe hbttnn.exe PID 4240 wrote to memory of 3028 4240 hbttnn.exe pvjjd.exe PID 4240 wrote to memory of 3028 4240 hbttnn.exe pvjjd.exe PID 4240 wrote to memory of 3028 4240 hbttnn.exe pvjjd.exe PID 3028 wrote to memory of 2572 3028 pvjjd.exe fllffxf.exe PID 3028 wrote to memory of 2572 3028 pvjjd.exe fllffxf.exe PID 3028 wrote to memory of 2572 3028 pvjjd.exe fllffxf.exe PID 2572 wrote to memory of 1548 2572 fllffxf.exe 7tbtbb.exe PID 2572 wrote to memory of 1548 2572 fllffxf.exe 7tbtbb.exe PID 2572 wrote to memory of 1548 2572 fllffxf.exe 7tbtbb.exe PID 1548 wrote to memory of 4752 1548 7tbtbb.exe xrfxlfx.exe PID 1548 wrote to memory of 4752 1548 7tbtbb.exe xrfxlfx.exe PID 1548 wrote to memory of 4752 1548 7tbtbb.exe xrfxlfx.exe PID 4752 wrote to memory of 2004 4752 xrfxlfx.exe 7bbthb.exe PID 4752 wrote to memory of 2004 4752 xrfxlfx.exe 7bbthb.exe PID 4752 wrote to memory of 2004 4752 xrfxlfx.exe 7bbthb.exe PID 2004 wrote to memory of 1944 2004 7bbthb.exe pvdvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\46b8f73839e1553a7fa7a21a7ac56916f226c11179e96fd6fc361715d54f0e23_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbtnh.exec:\nbbtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjppj.exec:\vjppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhttht.exec:\hhttht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbbbt.exec:\hbbbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpdvp.exec:\jpdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnthbt.exec:\bnthbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5lrlllr.exec:\5lrlllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhhnn.exec:\bbhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxrlfx.exec:\frxrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7bhbbb.exec:\7bhbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvvj.exec:\jpvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttbnnb.exec:\ttbnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7bhbtn.exec:\7bhbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvvd.exec:\ppvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llllrll.exec:\llllrll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbttnn.exec:\hbttnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvjjd.exec:\pvjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fllffxf.exec:\fllffxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7tbtbb.exec:\7tbtbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrfxlfx.exec:\xrfxlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7bbthb.exec:\7bbthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvdvd.exec:\pvdvd.exe23⤵
- Executes dropped EXE
-
\??\c:\frffflr.exec:\frffflr.exe24⤵
- Executes dropped EXE
-
\??\c:\tbhbnh.exec:\tbhbnh.exe25⤵
- Executes dropped EXE
-
\??\c:\pdvjd.exec:\pdvjd.exe26⤵
- Executes dropped EXE
-
\??\c:\3hbthh.exec:\3hbthh.exe27⤵
- Executes dropped EXE
-
\??\c:\jjjvp.exec:\jjjvp.exe28⤵
- Executes dropped EXE
-
\??\c:\rlrffxf.exec:\rlrffxf.exe29⤵
- Executes dropped EXE
-
\??\c:\nbbttt.exec:\nbbttt.exe30⤵
- Executes dropped EXE
-
\??\c:\vpjdp.exec:\vpjdp.exe31⤵
- Executes dropped EXE
-
\??\c:\xxrrlfx.exec:\xxrrlfx.exe32⤵
- Executes dropped EXE
-
\??\c:\bbnbhh.exec:\bbnbhh.exe33⤵
- Executes dropped EXE
-
\??\c:\fxrrrxx.exec:\fxrrrxx.exe34⤵
- Executes dropped EXE
-
\??\c:\fxrrlll.exec:\fxrrlll.exe35⤵
- Executes dropped EXE
-
\??\c:\9tbnhh.exec:\9tbnhh.exe36⤵
- Executes dropped EXE
-
\??\c:\7jjpd.exec:\7jjpd.exe37⤵
- Executes dropped EXE
-
\??\c:\frfxxxx.exec:\frfxxxx.exe38⤵
- Executes dropped EXE
-
\??\c:\rrrllll.exec:\rrrllll.exe39⤵
- Executes dropped EXE
-
\??\c:\bhnhtt.exec:\bhnhtt.exe40⤵
- Executes dropped EXE
-
\??\c:\pjpjd.exec:\pjpjd.exe41⤵
- Executes dropped EXE
-
\??\c:\3lfrxxf.exec:\3lfrxxf.exe42⤵
- Executes dropped EXE
-
\??\c:\7ntnnt.exec:\7ntnnt.exe43⤵
- Executes dropped EXE
-
\??\c:\hbbhbt.exec:\hbbhbt.exe44⤵
- Executes dropped EXE
-
\??\c:\jppjd.exec:\jppjd.exe45⤵
- Executes dropped EXE
-
\??\c:\frfxffr.exec:\frfxffr.exe46⤵
- Executes dropped EXE
-
\??\c:\rrlffff.exec:\rrlffff.exe47⤵
- Executes dropped EXE
-
\??\c:\hnnbtt.exec:\hnnbtt.exe48⤵
- Executes dropped EXE
-
\??\c:\vvpjv.exec:\vvpjv.exe49⤵
- Executes dropped EXE
-
\??\c:\rrrlffx.exec:\rrrlffx.exe50⤵
- Executes dropped EXE
-
\??\c:\ffllllf.exec:\ffllllf.exe51⤵
- Executes dropped EXE
-
\??\c:\hnnhbt.exec:\hnnhbt.exe52⤵
- Executes dropped EXE
-
\??\c:\jjppd.exec:\jjppd.exe53⤵
- Executes dropped EXE
-
\??\c:\xrrlllf.exec:\xrrlllf.exe54⤵
- Executes dropped EXE
-
\??\c:\xxrxxxr.exec:\xxrxxxr.exe55⤵
- Executes dropped EXE
-
\??\c:\hbnnhn.exec:\hbnnhn.exe56⤵
- Executes dropped EXE
-
\??\c:\djvpp.exec:\djvpp.exe57⤵
- Executes dropped EXE
-
\??\c:\jdpvv.exec:\jdpvv.exe58⤵
- Executes dropped EXE
-
\??\c:\xllrxrx.exec:\xllrxrx.exe59⤵
- Executes dropped EXE
-
\??\c:\hbtttt.exec:\hbtttt.exe60⤵
- Executes dropped EXE
-
\??\c:\nhbthh.exec:\nhbthh.exe61⤵
- Executes dropped EXE
-
\??\c:\jdddv.exec:\jdddv.exe62⤵
- Executes dropped EXE
-
\??\c:\rxlxrrl.exec:\rxlxrrl.exe63⤵
- Executes dropped EXE
-
\??\c:\fxrlffx.exec:\fxrlffx.exe64⤵
- Executes dropped EXE
-
\??\c:\9hhbtt.exec:\9hhbtt.exe65⤵
- Executes dropped EXE
-
\??\c:\djddv.exec:\djddv.exe66⤵
-
\??\c:\3xxxxfl.exec:\3xxxxfl.exe67⤵
-
\??\c:\3hhbth.exec:\3hhbth.exe68⤵
-
\??\c:\tbtnhb.exec:\tbtnhb.exe69⤵
-
\??\c:\jpjdj.exec:\jpjdj.exe70⤵
-
\??\c:\lfrxrlx.exec:\lfrxrlx.exe71⤵
-
\??\c:\frrlffx.exec:\frrlffx.exe72⤵
-
\??\c:\hhnnhh.exec:\hhnnhh.exe73⤵
-
\??\c:\7bbtnn.exec:\7bbtnn.exe74⤵
-
\??\c:\ppddd.exec:\ppddd.exe75⤵
-
\??\c:\3fffxfx.exec:\3fffxfx.exe76⤵
-
\??\c:\fllfrll.exec:\fllfrll.exe77⤵
-
\??\c:\1hbbbh.exec:\1hbbbh.exe78⤵
-
\??\c:\dvdpp.exec:\dvdpp.exe79⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe80⤵
-
\??\c:\lxfxrxf.exec:\lxfxrxf.exe81⤵
-
\??\c:\lrrxxrl.exec:\lrrxxrl.exe82⤵
-
\??\c:\5bnbnt.exec:\5bnbnt.exe83⤵
-
\??\c:\btnhbn.exec:\btnhbn.exe84⤵
-
\??\c:\5pvvj.exec:\5pvvj.exe85⤵
-
\??\c:\fflfxxr.exec:\fflfxxr.exe86⤵
-
\??\c:\lxlllll.exec:\lxlllll.exe87⤵
-
\??\c:\7tbtbt.exec:\7tbtbt.exe88⤵
-
\??\c:\dvppv.exec:\dvppv.exe89⤵
-
\??\c:\jjpdv.exec:\jjpdv.exe90⤵
-
\??\c:\lfxrllx.exec:\lfxrllx.exe91⤵
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe92⤵
-
\??\c:\tbttnn.exec:\tbttnn.exe93⤵
-
\??\c:\pddvv.exec:\pddvv.exe94⤵
-
\??\c:\ddvpv.exec:\ddvpv.exe95⤵
-
\??\c:\lrllffx.exec:\lrllffx.exe96⤵
-
\??\c:\tntnnh.exec:\tntnnh.exe97⤵
-
\??\c:\bnbnnt.exec:\bnbnnt.exe98⤵
-
\??\c:\9vvpj.exec:\9vvpj.exe99⤵
-
\??\c:\dppjd.exec:\dppjd.exe100⤵
-
\??\c:\lfxrllf.exec:\lfxrllf.exe101⤵
-
\??\c:\nbbnhb.exec:\nbbnhb.exe102⤵
-
\??\c:\bnntnt.exec:\bnntnt.exe103⤵
-
\??\c:\rrxxlfr.exec:\rrxxlfr.exe104⤵
-
\??\c:\bttnhh.exec:\bttnhh.exe105⤵
-
\??\c:\5jvpj.exec:\5jvpj.exe106⤵
-
\??\c:\vpppp.exec:\vpppp.exe107⤵
-
\??\c:\1rrfxxr.exec:\1rrfxxr.exe108⤵
-
\??\c:\bbhbhn.exec:\bbhbhn.exe109⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe110⤵
-
\??\c:\fllfrrl.exec:\fllfrrl.exe111⤵
-
\??\c:\9rrlfff.exec:\9rrlfff.exe112⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe113⤵
-
\??\c:\5ttnhh.exec:\5ttnhh.exe114⤵
-
\??\c:\dppvj.exec:\dppvj.exe115⤵
-
\??\c:\7lrfxxl.exec:\7lrfxxl.exe116⤵
-
\??\c:\3rfxxxf.exec:\3rfxxxf.exe117⤵
-
\??\c:\tthhhn.exec:\tthhhn.exe118⤵
-
\??\c:\jvvvp.exec:\jvvvp.exe119⤵
-
\??\c:\vddjv.exec:\vddjv.exe120⤵
-
\??\c:\xfxxrxf.exec:\xfxxrxf.exe121⤵
-
\??\c:\tthbtt.exec:\tthbtt.exe122⤵
-
\??\c:\ttnnbb.exec:\ttnnbb.exe123⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe124⤵
-
\??\c:\vjdvp.exec:\vjdvp.exe125⤵
-
\??\c:\rfxrrrf.exec:\rfxrrrf.exe126⤵
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe127⤵
-
\??\c:\1bbntn.exec:\1bbntn.exe128⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe129⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe130⤵
-
\??\c:\lrlfxrr.exec:\lrlfxrr.exe131⤵
-
\??\c:\btntbh.exec:\btntbh.exe132⤵
-
\??\c:\hhbttn.exec:\hhbttn.exe133⤵
-
\??\c:\djddp.exec:\djddp.exe134⤵
-
\??\c:\vvdvd.exec:\vvdvd.exe135⤵
-
\??\c:\9llfxxr.exec:\9llfxxr.exe136⤵
-
\??\c:\9ttnnn.exec:\9ttnnn.exe137⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe138⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe139⤵
-
\??\c:\fxxlxxr.exec:\fxxlxxr.exe140⤵
-
\??\c:\tnbbtt.exec:\tnbbtt.exe141⤵
-
\??\c:\tbttnh.exec:\tbttnh.exe142⤵
-
\??\c:\pvvdv.exec:\pvvdv.exe143⤵
-
\??\c:\llxlrfr.exec:\llxlrfr.exe144⤵
-
\??\c:\btthbt.exec:\btthbt.exe145⤵
-
\??\c:\nhnbnn.exec:\nhnbnn.exe146⤵
-
\??\c:\vjvjd.exec:\vjvjd.exe147⤵
-
\??\c:\9rrlrrl.exec:\9rrlrrl.exe148⤵
-
\??\c:\xrrfxlf.exec:\xrrfxlf.exe149⤵
-
\??\c:\nhbhtt.exec:\nhbhtt.exe150⤵
-
\??\c:\7dpjd.exec:\7dpjd.exe151⤵
-
\??\c:\jpvjd.exec:\jpvjd.exe152⤵
-
\??\c:\rxrfrlf.exec:\rxrfrlf.exe153⤵
-
\??\c:\xxrrxxx.exec:\xxrrxxx.exe154⤵
-
\??\c:\bhbtbt.exec:\bhbtbt.exe155⤵
-
\??\c:\jvjdj.exec:\jvjdj.exe156⤵
-
\??\c:\rflxxrr.exec:\rflxxrr.exe157⤵
-
\??\c:\tbbthn.exec:\tbbthn.exe158⤵
-
\??\c:\bnnhtn.exec:\bnnhtn.exe159⤵
-
\??\c:\vjvjd.exec:\vjvjd.exe160⤵
-
\??\c:\pdddv.exec:\pdddv.exe161⤵
-
\??\c:\3lrlllr.exec:\3lrlllr.exe162⤵
-
\??\c:\nbttnn.exec:\nbttnn.exe163⤵
-
\??\c:\tnbbbb.exec:\tnbbbb.exe164⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe165⤵
-
\??\c:\rlllffl.exec:\rlllffl.exe166⤵
-
\??\c:\rxrrllf.exec:\rxrrllf.exe167⤵
-
\??\c:\5tnhtn.exec:\5tnhtn.exe168⤵
-
\??\c:\ppddd.exec:\ppddd.exe169⤵
-
\??\c:\jddpj.exec:\jddpj.exe170⤵
-
\??\c:\rlxrflf.exec:\rlxrflf.exe171⤵
-
\??\c:\xrffffx.exec:\xrffffx.exe172⤵
-
\??\c:\hbntbb.exec:\hbntbb.exe173⤵
-
\??\c:\pjdpj.exec:\pjdpj.exe174⤵
-
\??\c:\dvdjv.exec:\dvdjv.exe175⤵
-
\??\c:\5rrrllf.exec:\5rrrllf.exe176⤵
-
\??\c:\fxfffff.exec:\fxfffff.exe177⤵
-
\??\c:\9nbbhh.exec:\9nbbhh.exe178⤵
-
\??\c:\jjpjd.exec:\jjpjd.exe179⤵
-
\??\c:\7dvjd.exec:\7dvjd.exe180⤵
-
\??\c:\fxrllfl.exec:\fxrllfl.exe181⤵
-
\??\c:\lflfxxl.exec:\lflfxxl.exe182⤵
-
\??\c:\nnnbtt.exec:\nnnbtt.exe183⤵
-
\??\c:\dpdjp.exec:\dpdjp.exe184⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe185⤵
-
\??\c:\rlrlrlf.exec:\rlrlrlf.exe186⤵
-
\??\c:\xrxrxrr.exec:\xrxrxrr.exe187⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe188⤵
-
\??\c:\3jdvp.exec:\3jdvp.exe189⤵
-
\??\c:\vjddp.exec:\vjddp.exe190⤵
-
\??\c:\frfxxlf.exec:\frfxxlf.exe191⤵
-
\??\c:\lflfxxx.exec:\lflfxxx.exe192⤵
-
\??\c:\9ddvp.exec:\9ddvp.exe193⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe194⤵
-
\??\c:\7xlfxxr.exec:\7xlfxxr.exe195⤵
-
\??\c:\nbnhbb.exec:\nbnhbb.exe196⤵
-
\??\c:\htbbtn.exec:\htbbtn.exe197⤵
-
\??\c:\vdddv.exec:\vdddv.exe198⤵
-
\??\c:\ddvpj.exec:\ddvpj.exe199⤵
-
\??\c:\rllfrrl.exec:\rllfrrl.exe200⤵
-
\??\c:\5xfxrlf.exec:\5xfxrlf.exe201⤵
-
\??\c:\5nbbtt.exec:\5nbbtt.exe202⤵
-
\??\c:\dpppv.exec:\dpppv.exe203⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe204⤵
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe205⤵
-
\??\c:\rxrlxrx.exec:\rxrlxrx.exe206⤵
-
\??\c:\ntbbtn.exec:\ntbbtn.exe207⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe208⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe209⤵
-
\??\c:\flrlxrl.exec:\flrlxrl.exe210⤵
-
\??\c:\frfxxxx.exec:\frfxxxx.exe211⤵
-
\??\c:\hbnbnt.exec:\hbnbnt.exe212⤵
-
\??\c:\tbbhnt.exec:\tbbhnt.exe213⤵
-
\??\c:\djvpp.exec:\djvpp.exe214⤵
-
\??\c:\7pdjd.exec:\7pdjd.exe215⤵
-
\??\c:\flrlxfx.exec:\flrlxfx.exe216⤵
-
\??\c:\xrrlllf.exec:\xrrlllf.exe217⤵
-
\??\c:\bbtnnn.exec:\bbtnnn.exe218⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe219⤵
-
\??\c:\7djdv.exec:\7djdv.exe220⤵
-
\??\c:\xxrrlxr.exec:\xxrrlxr.exe221⤵
-
\??\c:\bntnhh.exec:\bntnhh.exe222⤵
-
\??\c:\9tthbt.exec:\9tthbt.exe223⤵
-
\??\c:\jdjjv.exec:\jdjjv.exe224⤵
-
\??\c:\lllfxfx.exec:\lllfxfx.exe225⤵
-
\??\c:\lfflfff.exec:\lfflfff.exe226⤵
-
\??\c:\7bbbtt.exec:\7bbbtt.exe227⤵
-
\??\c:\pjjvj.exec:\pjjvj.exe228⤵
-
\??\c:\5jjvv.exec:\5jjvv.exe229⤵
-
\??\c:\lxfllll.exec:\lxfllll.exe230⤵
-
\??\c:\bhttnh.exec:\bhttnh.exe231⤵
-
\??\c:\btthht.exec:\btthht.exe232⤵
-
\??\c:\dppdv.exec:\dppdv.exe233⤵
-
\??\c:\llrlffx.exec:\llrlffx.exe234⤵
-
\??\c:\flxxlfr.exec:\flxxlfr.exe235⤵
-
\??\c:\hhhhtt.exec:\hhhhtt.exe236⤵
-
\??\c:\nhnhbb.exec:\nhnhbb.exe237⤵
-
\??\c:\pvdvd.exec:\pvdvd.exe238⤵
-
\??\c:\jpvpd.exec:\jpvpd.exe239⤵
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe240⤵
-
\??\c:\lfxrxxx.exec:\lfxrxxx.exe241⤵