Analysis
-
max time kernel
149s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 12:27
Behavioral task
behavioral1
Sample
4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe
-
Size
76KB
-
MD5
d7746a182e2755c5dfd564b515104b60
-
SHA1
71bc80d8294ff22f7d3c1bb42d50431ee08eb2bd
-
SHA256
4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81
-
SHA512
0dbd3c47de91834fdfb97e5a6cfe8998c6875e684761e0b5dc5e2b5eaa2d77949f2659fba9dc7d2c62fd4aa50fa9742c83039120c45e5746cd9f9bd757dbbf41
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE87B:9hOmTsF93UYfwC6GIoutz5yLpOSDRB
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2920-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/824-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3860-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2336-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2548-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4768-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-623-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-660-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-689-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-737-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-935-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-1040-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-1075-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-1523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xffrfxr.exettnhtt.exejpdpj.exe9vdjd.exe9xfxrxr.exennntnh.exepvdpj.exellllffx.exenhbtnn.exennnbtn.exejvdvp.exejvvpp.exe9fllllx.exebnnbtb.exejdvpv.exe3pvvv.exexrlfxrl.exelxrlfxl.exehhnhtn.exevvppd.exerlfxllf.exerlfxfxf.exe5bhttn.exebhbhbt.exejdppd.exerrllxxx.exexxxfrlf.exethbthh.exe9jppv.exe7vvpj.exelflxxxr.exexrrlffx.exebhnhbb.exeppvjp.exejdvjd.exefxlffxf.exefllfrlf.exebnnnhb.exeddvpd.exejjdvj.exelffxrlr.exethhbnh.exe3hhbtt.exejppdp.exepvvpd.exefxrfffl.exe9htnhb.exehhtnhb.exejvppj.exe1pjdp.exerxlfrlf.exerlrrxxx.exe7nnhbt.exebbhhhb.exejvjdp.exejjpjv.exelrlxllx.exe1rrllll.exehnhnhb.exehbhbnh.exevdvpj.exe5ppdj.exellrrllr.exe7lfrfxr.exepid process 1328 xffrfxr.exe 3552 ttnhtt.exe 1652 jpdpj.exe 1392 9vdjd.exe 3604 9xfxrxr.exe 3216 nnntnh.exe 3508 pvdpj.exe 2004 llllffx.exe 3068 nhbtnn.exe 2408 nnnbtn.exe 4656 jvdvp.exe 4776 jvvpp.exe 2644 9fllllx.exe 3340 bnnbtb.exe 4604 jdvpv.exe 3236 3pvvv.exe 2936 xrlfxrl.exe 2044 lxrlfxl.exe 4708 hhnhtn.exe 2280 vvppd.exe 5012 rlfxllf.exe 2976 rlfxfxf.exe 824 5bhttn.exe 3736 bhbhbt.exe 2348 jdppd.exe 5100 rrllxxx.exe 1800 xxxfrlf.exe 3888 thbthh.exe 2868 9jppv.exe 3692 7vvpj.exe 1948 lflxxxr.exe 748 xrrlffx.exe 4564 bhnhbb.exe 412 ppvjp.exe 4404 jdvjd.exe 216 fxlffxf.exe 2452 fllfrlf.exe 3860 bnnnhb.exe 4380 ddvpd.exe 4384 jjdvj.exe 376 lffxrlr.exe 1220 thhbnh.exe 764 3hhbtt.exe 1348 jppdp.exe 3324 pvvpd.exe 2436 fxrfffl.exe 552 9htnhb.exe 3264 hhtnhb.exe 1988 jvppj.exe 3508 1pjdp.exe 3720 rxlfrlf.exe 2696 rlrrxxx.exe 2880 7nnhbt.exe 4980 bbhhhb.exe 2780 jvjdp.exe 5004 jjpjv.exe 4776 lrlxllx.exe 1204 1rrllll.exe 3340 hnhnhb.exe 3396 hbhbnh.exe 2336 vdvpj.exe 3372 5ppdj.exe 4544 llrrllr.exe 4796 7lfrfxr.exe -
Processes:
resource yara_rule behavioral2/memory/2920-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2920-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1328-8-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xffrfxr.exe upx C:\ttnhtt.exe upx C:\jpdpj.exe upx behavioral2/memory/3552-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1652-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vdjd.exe upx behavioral2/memory/1652-25-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9xfxrxr.exe upx behavioral2/memory/1392-31-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nnntnh.exe upx C:\pvdpj.exe upx behavioral2/memory/3604-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3216-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3508-46-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llllffx.exe upx C:\nhbtnn.exe upx behavioral2/memory/2004-53-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnnbtn.exe upx behavioral2/memory/3068-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvdvp.exe upx behavioral2/memory/2408-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4656-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvvpp.exe upx behavioral2/memory/4656-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4776-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9fllllx.exe upx C:\bnnbtb.exe upx behavioral2/memory/2644-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdvpv.exe upx behavioral2/memory/3340-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3pvvv.exe upx \??\c:\xrlfxrl.exe upx behavioral2/memory/3236-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2936-103-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxrlfxl.exe upx behavioral2/memory/2044-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhnhtn.exe upx C:\vvppd.exe upx behavioral2/memory/4708-118-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlfxllf.exe upx C:\rlfxfxf.exe upx C:\5bhttn.exe upx behavioral2/memory/824-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhbhbt.exe upx behavioral2/memory/3736-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3736-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdppd.exe upx C:\rrllxxx.exe upx behavioral2/memory/2348-151-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xxxfrlf.exe upx behavioral2/memory/5100-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1800-160-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thbthh.exe upx C:\9jppv.exe upx C:\7vvpj.exe upx behavioral2/memory/2868-175-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflxxxr.exe upx behavioral2/memory/1948-182-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrrlffx.exe upx behavioral2/memory/748-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/412-195-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exexffrfxr.exettnhtt.exejpdpj.exe9vdjd.exe9xfxrxr.exennntnh.exepvdpj.exellllffx.exenhbtnn.exennnbtn.exejvdvp.exejvvpp.exe9fllllx.exebnnbtb.exejdvpv.exe3pvvv.exexrlfxrl.exelxrlfxl.exehhnhtn.exevvppd.exerlfxllf.exedescription pid process target process PID 2920 wrote to memory of 1328 2920 4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe xffrfxr.exe PID 2920 wrote to memory of 1328 2920 4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe xffrfxr.exe PID 2920 wrote to memory of 1328 2920 4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe xffrfxr.exe PID 1328 wrote to memory of 3552 1328 xffrfxr.exe ttnhtt.exe PID 1328 wrote to memory of 3552 1328 xffrfxr.exe ttnhtt.exe PID 1328 wrote to memory of 3552 1328 xffrfxr.exe ttnhtt.exe PID 3552 wrote to memory of 1652 3552 ttnhtt.exe jpdpj.exe PID 3552 wrote to memory of 1652 3552 ttnhtt.exe jpdpj.exe PID 3552 wrote to memory of 1652 3552 ttnhtt.exe jpdpj.exe PID 1652 wrote to memory of 1392 1652 jpdpj.exe 9vdjd.exe PID 1652 wrote to memory of 1392 1652 jpdpj.exe 9vdjd.exe PID 1652 wrote to memory of 1392 1652 jpdpj.exe 9vdjd.exe PID 1392 wrote to memory of 3604 1392 9vdjd.exe 9xfxrxr.exe PID 1392 wrote to memory of 3604 1392 9vdjd.exe 9xfxrxr.exe PID 1392 wrote to memory of 3604 1392 9vdjd.exe 9xfxrxr.exe PID 3604 wrote to memory of 3216 3604 9xfxrxr.exe nnntnh.exe PID 3604 wrote to memory of 3216 3604 9xfxrxr.exe nnntnh.exe PID 3604 wrote to memory of 3216 3604 9xfxrxr.exe nnntnh.exe PID 3216 wrote to memory of 3508 3216 nnntnh.exe pvdpj.exe PID 3216 wrote to memory of 3508 3216 nnntnh.exe pvdpj.exe PID 3216 wrote to memory of 3508 3216 nnntnh.exe pvdpj.exe PID 3508 wrote to memory of 2004 3508 pvdpj.exe llllffx.exe PID 3508 wrote to memory of 2004 3508 pvdpj.exe llllffx.exe PID 3508 wrote to memory of 2004 3508 pvdpj.exe llllffx.exe PID 2004 wrote to memory of 3068 2004 llllffx.exe nhbtnn.exe PID 2004 wrote to memory of 3068 2004 llllffx.exe nhbtnn.exe PID 2004 wrote to memory of 3068 2004 llllffx.exe nhbtnn.exe PID 3068 wrote to memory of 2408 3068 nhbtnn.exe nnnbtn.exe PID 3068 wrote to memory of 2408 3068 nhbtnn.exe nnnbtn.exe PID 3068 wrote to memory of 2408 3068 nhbtnn.exe nnnbtn.exe PID 2408 wrote to memory of 4656 2408 nnnbtn.exe jvdvp.exe PID 2408 wrote to memory of 4656 2408 nnnbtn.exe jvdvp.exe PID 2408 wrote to memory of 4656 2408 nnnbtn.exe jvdvp.exe PID 4656 wrote to memory of 4776 4656 jvdvp.exe jvvpp.exe PID 4656 wrote to memory of 4776 4656 jvdvp.exe jvvpp.exe PID 4656 wrote to memory of 4776 4656 jvdvp.exe jvvpp.exe PID 4776 wrote to memory of 2644 4776 jvvpp.exe 9fllllx.exe PID 4776 wrote to memory of 2644 4776 jvvpp.exe 9fllllx.exe PID 4776 wrote to memory of 2644 4776 jvvpp.exe 9fllllx.exe PID 2644 wrote to memory of 3340 2644 9fllllx.exe bnnbtb.exe PID 2644 wrote to memory of 3340 2644 9fllllx.exe bnnbtb.exe PID 2644 wrote to memory of 3340 2644 9fllllx.exe bnnbtb.exe PID 3340 wrote to memory of 4604 3340 bnnbtb.exe jdvpv.exe PID 3340 wrote to memory of 4604 3340 bnnbtb.exe jdvpv.exe PID 3340 wrote to memory of 4604 3340 bnnbtb.exe jdvpv.exe PID 4604 wrote to memory of 3236 4604 jdvpv.exe 3pvvv.exe PID 4604 wrote to memory of 3236 4604 jdvpv.exe 3pvvv.exe PID 4604 wrote to memory of 3236 4604 jdvpv.exe 3pvvv.exe PID 3236 wrote to memory of 2936 3236 3pvvv.exe xrlfxrl.exe PID 3236 wrote to memory of 2936 3236 3pvvv.exe xrlfxrl.exe PID 3236 wrote to memory of 2936 3236 3pvvv.exe xrlfxrl.exe PID 2936 wrote to memory of 2044 2936 xrlfxrl.exe lxrlfxl.exe PID 2936 wrote to memory of 2044 2936 xrlfxrl.exe lxrlfxl.exe PID 2936 wrote to memory of 2044 2936 xrlfxrl.exe lxrlfxl.exe PID 2044 wrote to memory of 4708 2044 lxrlfxl.exe hhnhtn.exe PID 2044 wrote to memory of 4708 2044 lxrlfxl.exe hhnhtn.exe PID 2044 wrote to memory of 4708 2044 lxrlfxl.exe hhnhtn.exe PID 4708 wrote to memory of 2280 4708 hhnhtn.exe vvppd.exe PID 4708 wrote to memory of 2280 4708 hhnhtn.exe vvppd.exe PID 4708 wrote to memory of 2280 4708 hhnhtn.exe vvppd.exe PID 2280 wrote to memory of 5012 2280 vvppd.exe rlfxllf.exe PID 2280 wrote to memory of 5012 2280 vvppd.exe rlfxllf.exe PID 2280 wrote to memory of 5012 2280 vvppd.exe rlfxllf.exe PID 5012 wrote to memory of 2976 5012 rlfxllf.exe rlfxfxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4a5dcc95b8a3342bdd9d5aca1741546666abb9cfcca084a20e6a3cd2af913f81_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xffrfxr.exec:\xffrfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnhtt.exec:\ttnhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpdpj.exec:\jpdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9vdjd.exec:\9vdjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xfxrxr.exec:\9xfxrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnntnh.exec:\nnntnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvdpj.exec:\pvdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llllffx.exec:\llllffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbtnn.exec:\nhbtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnnbtn.exec:\nnnbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdvp.exec:\jvdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvpp.exec:\jvvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9fllllx.exec:\9fllllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnbtb.exec:\bnnbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvpv.exec:\jdvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pvvv.exec:\3pvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxrlfxl.exec:\lxrlfxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhnhtn.exec:\hhnhtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvppd.exec:\vvppd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlfxllf.exec:\rlfxllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlfxfxf.exec:\rlfxfxf.exe23⤵
- Executes dropped EXE
-
\??\c:\5bhttn.exec:\5bhttn.exe24⤵
- Executes dropped EXE
-
\??\c:\bhbhbt.exec:\bhbhbt.exe25⤵
- Executes dropped EXE
-
\??\c:\jdppd.exec:\jdppd.exe26⤵
- Executes dropped EXE
-
\??\c:\rrllxxx.exec:\rrllxxx.exe27⤵
- Executes dropped EXE
-
\??\c:\xxxfrlf.exec:\xxxfrlf.exe28⤵
- Executes dropped EXE
-
\??\c:\thbthh.exec:\thbthh.exe29⤵
- Executes dropped EXE
-
\??\c:\9jppv.exec:\9jppv.exe30⤵
- Executes dropped EXE
-
\??\c:\7vvpj.exec:\7vvpj.exe31⤵
- Executes dropped EXE
-
\??\c:\lflxxxr.exec:\lflxxxr.exe32⤵
- Executes dropped EXE
-
\??\c:\xrrlffx.exec:\xrrlffx.exe33⤵
- Executes dropped EXE
-
\??\c:\bhnhbb.exec:\bhnhbb.exe34⤵
- Executes dropped EXE
-
\??\c:\ppvjp.exec:\ppvjp.exe35⤵
- Executes dropped EXE
-
\??\c:\jdvjd.exec:\jdvjd.exe36⤵
- Executes dropped EXE
-
\??\c:\fxlffxf.exec:\fxlffxf.exe37⤵
- Executes dropped EXE
-
\??\c:\fllfrlf.exec:\fllfrlf.exe38⤵
- Executes dropped EXE
-
\??\c:\bnnnhb.exec:\bnnnhb.exe39⤵
- Executes dropped EXE
-
\??\c:\ddvpd.exec:\ddvpd.exe40⤵
- Executes dropped EXE
-
\??\c:\jjdvj.exec:\jjdvj.exe41⤵
- Executes dropped EXE
-
\??\c:\lffxrlr.exec:\lffxrlr.exe42⤵
- Executes dropped EXE
-
\??\c:\thhbnh.exec:\thhbnh.exe43⤵
- Executes dropped EXE
-
\??\c:\3hhbtt.exec:\3hhbtt.exe44⤵
- Executes dropped EXE
-
\??\c:\jppdp.exec:\jppdp.exe45⤵
- Executes dropped EXE
-
\??\c:\pvvpd.exec:\pvvpd.exe46⤵
- Executes dropped EXE
-
\??\c:\fxrfffl.exec:\fxrfffl.exe47⤵
- Executes dropped EXE
-
\??\c:\9htnhb.exec:\9htnhb.exe48⤵
- Executes dropped EXE
-
\??\c:\hhtnhb.exec:\hhtnhb.exe49⤵
- Executes dropped EXE
-
\??\c:\jvppj.exec:\jvppj.exe50⤵
- Executes dropped EXE
-
\??\c:\1pjdp.exec:\1pjdp.exe51⤵
- Executes dropped EXE
-
\??\c:\rxlfrlf.exec:\rxlfrlf.exe52⤵
- Executes dropped EXE
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe53⤵
- Executes dropped EXE
-
\??\c:\7nnhbt.exec:\7nnhbt.exe54⤵
- Executes dropped EXE
-
\??\c:\bbhhhb.exec:\bbhhhb.exe55⤵
- Executes dropped EXE
-
\??\c:\jvjdp.exec:\jvjdp.exe56⤵
- Executes dropped EXE
-
\??\c:\jjpjv.exec:\jjpjv.exe57⤵
- Executes dropped EXE
-
\??\c:\lrlxllx.exec:\lrlxllx.exe58⤵
- Executes dropped EXE
-
\??\c:\1rrllll.exec:\1rrllll.exe59⤵
- Executes dropped EXE
-
\??\c:\hnhnhb.exec:\hnhnhb.exe60⤵
- Executes dropped EXE
-
\??\c:\hbhbnh.exec:\hbhbnh.exe61⤵
- Executes dropped EXE
-
\??\c:\vdvpj.exec:\vdvpj.exe62⤵
- Executes dropped EXE
-
\??\c:\5ppdj.exec:\5ppdj.exe63⤵
- Executes dropped EXE
-
\??\c:\llrrllr.exec:\llrrllr.exe64⤵
- Executes dropped EXE
-
\??\c:\7lfrfxr.exec:\7lfrfxr.exe65⤵
- Executes dropped EXE
-
\??\c:\nhnhhb.exec:\nhnhhb.exe66⤵
-
\??\c:\bntnhh.exec:\bntnhh.exe67⤵
-
\??\c:\dpjdv.exec:\dpjdv.exe68⤵
-
\??\c:\jddvp.exec:\jddvp.exe69⤵
-
\??\c:\xxrlrlr.exec:\xxrlrlr.exe70⤵
-
\??\c:\xfxrllf.exec:\xfxrllf.exe71⤵
-
\??\c:\7nhtnn.exec:\7nhtnn.exe72⤵
-
\??\c:\bthhhh.exec:\bthhhh.exe73⤵
-
\??\c:\dpppv.exec:\dpppv.exe74⤵
-
\??\c:\jvddv.exec:\jvddv.exe75⤵
-
\??\c:\xrxrlll.exec:\xrxrlll.exe76⤵
-
\??\c:\fxfffff.exec:\fxfffff.exe77⤵
-
\??\c:\nntnhn.exec:\nntnhn.exe78⤵
-
\??\c:\bnbbtt.exec:\bnbbtt.exe79⤵
-
\??\c:\bhhnnt.exec:\bhhnnt.exe80⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe81⤵
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe82⤵
-
\??\c:\frrllrx.exec:\frrllrx.exe83⤵
-
\??\c:\bnbhhn.exec:\bnbhhn.exe84⤵
-
\??\c:\3bhhbt.exec:\3bhhbt.exe85⤵
-
\??\c:\9hnhht.exec:\9hnhht.exe86⤵
-
\??\c:\vpjjj.exec:\vpjjj.exe87⤵
-
\??\c:\ffllrxx.exec:\ffllrxx.exe88⤵
-
\??\c:\7xxxxxf.exec:\7xxxxxf.exe89⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe90⤵
-
\??\c:\3hnnhh.exec:\3hnnhh.exe91⤵
-
\??\c:\5njdvd.exec:\5njdvd.exe92⤵
-
\??\c:\vppjd.exec:\vppjd.exe93⤵
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe94⤵
-
\??\c:\9nttnt.exec:\9nttnt.exe95⤵
-
\??\c:\pvdvj.exec:\pvdvj.exe96⤵
-
\??\c:\1ppjd.exec:\1ppjd.exe97⤵
-
\??\c:\rrlllrl.exec:\rrlllrl.exe98⤵
-
\??\c:\3hntbb.exec:\3hntbb.exe99⤵
-
\??\c:\bnnnnn.exec:\bnnnnn.exe100⤵
-
\??\c:\jpjvp.exec:\jpjvp.exe101⤵
-
\??\c:\1pdpp.exec:\1pdpp.exe102⤵
-
\??\c:\llfxrfr.exec:\llfxrfr.exe103⤵
-
\??\c:\7rxffll.exec:\7rxffll.exe104⤵
-
\??\c:\hbhntt.exec:\hbhntt.exe105⤵
-
\??\c:\5vvvv.exec:\5vvvv.exe106⤵
-
\??\c:\vdddv.exec:\vdddv.exe107⤵
-
\??\c:\rllllrr.exec:\rllllrr.exe108⤵
-
\??\c:\9ffxxxl.exec:\9ffxxxl.exe109⤵
-
\??\c:\hhnhbb.exec:\hhnhbb.exe110⤵
-
\??\c:\nnnnnn.exec:\nnnnnn.exe111⤵
-
\??\c:\ppdjp.exec:\ppdjp.exe112⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe113⤵
-
\??\c:\rllfxxx.exec:\rllfxxx.exe114⤵
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe115⤵
-
\??\c:\nnbhnt.exec:\nnbhnt.exe116⤵
-
\??\c:\3bbtnb.exec:\3bbtnb.exe117⤵
-
\??\c:\vvjvd.exec:\vvjvd.exe118⤵
-
\??\c:\7ppvv.exec:\7ppvv.exe119⤵
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe120⤵
-
\??\c:\9ttttt.exec:\9ttttt.exe121⤵
-
\??\c:\1btbbb.exec:\1btbbb.exe122⤵
-
\??\c:\dvddj.exec:\dvddj.exe123⤵
-
\??\c:\7frlfff.exec:\7frlfff.exe124⤵
-
\??\c:\5rrlfxr.exec:\5rrlfxr.exe125⤵
-
\??\c:\ttbbbh.exec:\ttbbbh.exe126⤵
-
\??\c:\ppvdj.exec:\ppvdj.exe127⤵
-
\??\c:\pdvvp.exec:\pdvvp.exe128⤵
-
\??\c:\fxflrxl.exec:\fxflrxl.exe129⤵
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe130⤵
-
\??\c:\tbhhtt.exec:\tbhhtt.exe131⤵
-
\??\c:\thhttt.exec:\thhttt.exe132⤵
-
\??\c:\3jpdp.exec:\3jpdp.exe133⤵
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe134⤵
-
\??\c:\flrffll.exec:\flrffll.exe135⤵
-
\??\c:\3xxxxff.exec:\3xxxxff.exe136⤵
-
\??\c:\hhhhbb.exec:\hhhhbb.exe137⤵
-
\??\c:\1djpj.exec:\1djpj.exe138⤵
-
\??\c:\7dppj.exec:\7dppj.exe139⤵
-
\??\c:\rxflrxr.exec:\rxflrxr.exe140⤵
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe141⤵
-
\??\c:\hbtbtn.exec:\hbtbtn.exe142⤵
-
\??\c:\7bhthh.exec:\7bhthh.exe143⤵
-
\??\c:\djjdv.exec:\djjdv.exe144⤵
-
\??\c:\rrfllrx.exec:\rrfllrx.exe145⤵
-
\??\c:\9rxxfff.exec:\9rxxfff.exe146⤵
-
\??\c:\1jjdd.exec:\1jjdd.exe147⤵
-
\??\c:\xllxlfx.exec:\xllxlfx.exe148⤵
-
\??\c:\3btnbb.exec:\3btnbb.exe149⤵
-
\??\c:\3hhbnh.exec:\3hhbnh.exe150⤵
-
\??\c:\9ddvj.exec:\9ddvj.exe151⤵
-
\??\c:\rrlxllr.exec:\rrlxllr.exe152⤵
-
\??\c:\rflfxfr.exec:\rflfxfr.exe153⤵
-
\??\c:\hbthtn.exec:\hbthtn.exe154⤵
-
\??\c:\vjddv.exec:\vjddv.exe155⤵
-
\??\c:\fxlfrlr.exec:\fxlfrlr.exe156⤵
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe157⤵
-
\??\c:\7tbthh.exec:\7tbthh.exe158⤵
-
\??\c:\7nhthb.exec:\7nhthb.exe159⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe160⤵
-
\??\c:\lllffxx.exec:\lllffxx.exe161⤵
-
\??\c:\rrlxrll.exec:\rrlxrll.exe162⤵
-
\??\c:\hnhnnn.exec:\hnhnnn.exe163⤵
-
\??\c:\nhhbht.exec:\nhhbht.exe164⤵
-
\??\c:\ppjjd.exec:\ppjjd.exe165⤵
-
\??\c:\5dvjd.exec:\5dvjd.exe166⤵
-
\??\c:\llfrllf.exec:\llfrllf.exe167⤵
-
\??\c:\3rlrfxf.exec:\3rlrfxf.exe168⤵
-
\??\c:\5hthtn.exec:\5hthtn.exe169⤵
-
\??\c:\hnbtnn.exec:\hnbtnn.exe170⤵
-
\??\c:\tntnhh.exec:\tntnhh.exe171⤵
-
\??\c:\dppjp.exec:\dppjp.exe172⤵
-
\??\c:\3jppd.exec:\3jppd.exe173⤵
-
\??\c:\lrfxlff.exec:\lrfxlff.exe174⤵
-
\??\c:\3xffxrr.exec:\3xffxrr.exe175⤵
-
\??\c:\hbhbtb.exec:\hbhbtb.exe176⤵
-
\??\c:\bnthtt.exec:\bnthtt.exe177⤵
-
\??\c:\pjjvp.exec:\pjjvp.exe178⤵
-
\??\c:\lfrlrll.exec:\lfrlrll.exe179⤵
-
\??\c:\3tnnbt.exec:\3tnnbt.exe180⤵
-
\??\c:\1fxlxrl.exec:\1fxlxrl.exe181⤵
-
\??\c:\3rlfrrl.exec:\3rlfrrl.exe182⤵
-
\??\c:\3tnhnn.exec:\3tnhnn.exe183⤵
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe184⤵
-
\??\c:\vvddd.exec:\vvddd.exe185⤵
-
\??\c:\nttnbt.exec:\nttnbt.exe186⤵
-
\??\c:\dpppj.exec:\dpppj.exe187⤵
-
\??\c:\jdddd.exec:\jdddd.exe188⤵
-
\??\c:\hhhbtt.exec:\hhhbtt.exe189⤵
-
\??\c:\3hhbnh.exec:\3hhbnh.exe190⤵
-
\??\c:\pjjvj.exec:\pjjvj.exe191⤵
-
\??\c:\fllffrl.exec:\fllffrl.exe192⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe193⤵
-
\??\c:\hbtttt.exec:\hbtttt.exe194⤵
-
\??\c:\1jpvj.exec:\1jpvj.exe195⤵
-
\??\c:\5xxllll.exec:\5xxllll.exe196⤵
-
\??\c:\lxllllf.exec:\lxllllf.exe197⤵
-
\??\c:\bnttnn.exec:\bnttnn.exe198⤵
-
\??\c:\tnbtnh.exec:\tnbtnh.exe199⤵
-
\??\c:\jdppj.exec:\jdppj.exe200⤵
-
\??\c:\lrxrfff.exec:\lrxrfff.exe201⤵
-
\??\c:\xfrfxlx.exec:\xfrfxlx.exe202⤵
-
\??\c:\7hnttt.exec:\7hnttt.exe203⤵
-
\??\c:\thhhbh.exec:\thhhbh.exe204⤵
-
\??\c:\pjppp.exec:\pjppp.exe205⤵
-
\??\c:\jjjvj.exec:\jjjvj.exe206⤵
-
\??\c:\9tbtht.exec:\9tbtht.exe207⤵
-
\??\c:\3tbbtt.exec:\3tbbtt.exe208⤵
-
\??\c:\7jpjd.exec:\7jpjd.exe209⤵
-
\??\c:\jpddp.exec:\jpddp.exe210⤵
-
\??\c:\jjjvp.exec:\jjjvp.exe211⤵
-
\??\c:\xxrlrxf.exec:\xxrlrxf.exe212⤵
-
\??\c:\5lrrrrr.exec:\5lrrrrr.exe213⤵
-
\??\c:\nnhthh.exec:\nnhthh.exe214⤵
-
\??\c:\tttnnh.exec:\tttnnh.exe215⤵
-
\??\c:\ppdjd.exec:\ppdjd.exe216⤵
-
\??\c:\3pppj.exec:\3pppj.exe217⤵
-
\??\c:\rxfffrr.exec:\rxfffrr.exe218⤵
-
\??\c:\7ffxxxx.exec:\7ffxxxx.exe219⤵
-
\??\c:\ttnhbb.exec:\ttnhbb.exe220⤵
-
\??\c:\tbnhtb.exec:\tbnhtb.exe221⤵
-
\??\c:\pppvj.exec:\pppvj.exe222⤵
-
\??\c:\1vvpd.exec:\1vvpd.exe223⤵
-
\??\c:\fllxfxr.exec:\fllxfxr.exe224⤵
-
\??\c:\7rxfxrx.exec:\7rxfxrx.exe225⤵
-
\??\c:\hhbbhh.exec:\hhbbhh.exe226⤵
-
\??\c:\ttbbtb.exec:\ttbbtb.exe227⤵
-
\??\c:\jvjjv.exec:\jvjjv.exe228⤵
-
\??\c:\pdppp.exec:\pdppp.exe229⤵
-
\??\c:\3lffxrr.exec:\3lffxrr.exe230⤵
-
\??\c:\1lffllf.exec:\1lffllf.exe231⤵
-
\??\c:\3ffllll.exec:\3ffllll.exe232⤵
-
\??\c:\1bnnht.exec:\1bnnht.exe233⤵
-
\??\c:\nnthbb.exec:\nnthbb.exe234⤵
-
\??\c:\dppjv.exec:\dppjv.exe235⤵
-
\??\c:\pvdpj.exec:\pvdpj.exe236⤵
-
\??\c:\9ffxllf.exec:\9ffxllf.exe237⤵
-
\??\c:\rrrrfll.exec:\rrrrfll.exe238⤵
-
\??\c:\tbbtnb.exec:\tbbtnb.exe239⤵
-
\??\c:\hnnnhh.exec:\hnnnhh.exe240⤵
-
\??\c:\dvddp.exec:\dvddp.exe241⤵