Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 13:22
Behavioral task
behavioral1
Sample
5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe
-
Size
114KB
-
MD5
f50f633566efa86b028cf97908a33fc0
-
SHA1
be20df94fe090b45d0b809973173dd1b581e0b36
-
SHA256
5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20
-
SHA512
76dd8141291f28e3d1c1c0d8ed8d0c508a0cfb135a93ad50a76ed0ef2cfcd4d30dd2eb9e0eac9b56d0e54e68c747752087d0946eb764fd460f2b3916f9a8dec9
-
SSDEEP
3072:chOmTsF93UYfwC6GIout5pi8rY9AABa1U+a88r:ccm4FmowdHoS5ddWX+a1
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/4744-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2508-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/828-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2564-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/784-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2560-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1496-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2480-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-695-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3408-780-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/332-787-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-810-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-833-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrllffx.exelllfffl.exenhhbtt.exevvjdj.exevvjdj.exefflxlll.exexffxxrl.exehhhbhh.exevpvpj.exeffxrrll.exerxxrrrr.exenhnhnn.exenttttn.exepjdjv.exedvdpd.exeffxrllx.exexrrrlll.exenbhhbh.exe5bbthh.exeddjdv.exedpdvp.exelfxxffl.exe7lrxrxx.exetbnnhb.exedjjdv.exerlffffl.exexxxrlfr.exe5bbtnn.exejddvj.exe5ppjd.exexffrfff.exeffffxlf.exebhnhnn.exeddjdv.exe9ddjd.exefffxllf.exe1xxrlfx.exebhtnhh.exe5tnhtb.exevvpvp.exelxfxrrf.exenbnhbb.exetnnbbt.exedjdvp.exe3djdv.exelrlxrrf.exehhtntt.exehhtnnh.exennhbtt.exe3pvjd.exe1lxlfxl.exe5ffxxxr.exe3hhhbb.exehttnhb.exevpdvv.exe3jdvj.exe3vvpp.exe5rxrlrl.exe9bhbbb.exehtbtnt.exedddvp.exejpjjv.exellrffff.exe7xrxlrl.exepid process 3976 xrllffx.exe 4308 lllfffl.exe 1344 nhhbtt.exe 1788 vvjdj.exe 3108 vvjdj.exe 2508 fflxlll.exe 1428 xffxxrl.exe 4728 hhhbhh.exe 4888 vpvpj.exe 3888 ffxrrll.exe 2976 rxxrrrr.exe 3916 nhnhnn.exe 3156 nttttn.exe 3972 pjdjv.exe 3064 dvdpd.exe 2836 ffxrllx.exe 4188 xrrrlll.exe 4416 nbhhbh.exe 1324 5bbthh.exe 4960 ddjdv.exe 4740 dpdvp.exe 2756 lfxxffl.exe 2284 7lrxrxx.exe 4256 tbnnhb.exe 3744 djjdv.exe 3348 rlffffl.exe 4208 xxxrlfr.exe 468 5bbtnn.exe 1888 jddvj.exe 3352 5ppjd.exe 828 xffrfff.exe 4788 ffffxlf.exe 4816 bhnhnn.exe 4692 ddjdv.exe 5100 9ddjd.exe 216 fffxllf.exe 4760 1xxrlfx.exe 4596 bhtnhh.exe 1312 5tnhtb.exe 3568 vvpvp.exe 4308 lxfxrrf.exe 1392 nbnhbb.exe 4680 tnnbbt.exe 1284 djdvp.exe 1400 3djdv.exe 2996 lrlxrrf.exe 2372 hhtntt.exe 2028 hhtnnh.exe 4084 nnhbtt.exe 2496 3pvjd.exe 3888 1lxlfxl.exe 1884 5ffxxxr.exe 3212 3hhhbb.exe 4148 httnhb.exe 2564 vpdvv.exe 3972 3jdvj.exe 4820 3vvpp.exe 1488 5rxrlrl.exe 784 9bhbbb.exe 2204 htbtnt.exe 4416 dddvp.exe 1324 jpjjv.exe 4884 llrffff.exe 4960 7xrxlrl.exe -
Processes:
resource yara_rule behavioral2/memory/4744-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrllffx.exe upx behavioral2/memory/4744-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3976-8-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lllfffl.exe upx C:\nhhbtt.exe upx behavioral2/memory/4308-14-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjdj.exe upx C:\fflxlll.exe upx behavioral2/memory/2508-34-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xffxxrl.exe upx behavioral2/memory/1788-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1344-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1428-43-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhhbhh.exe upx behavioral2/memory/4728-45-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvpj.exe upx behavioral2/memory/4728-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffxrrll.exe upx behavioral2/memory/4888-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnhnn.exe upx C:\nttttn.exe upx C:\pjdjv.exe upx \??\c:\dvdpd.exe upx behavioral2/memory/3972-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffxrllx.exe upx \??\c:\xrrrlll.exe upx \??\c:\nbhhbh.exe upx behavioral2/memory/4416-105-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5bbthh.exe upx behavioral2/memory/4188-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1324-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1324-116-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddjdv.exe upx \??\c:\dpdvp.exe upx behavioral2/memory/4740-122-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxxffl.exe upx \??\c:\7lrxrxx.exe upx behavioral2/memory/2756-132-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbnnhb.exe upx \??\c:\djjdv.exe upx behavioral2/memory/3348-149-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlffffl.exe upx \??\c:\xxxrlfr.exe upx \??\c:\5bbtnn.exe upx C:\jddvj.exe upx behavioral2/memory/1888-165-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5ppjd.exe upx behavioral2/memory/828-178-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xffrfff.exe upx \??\c:\ffffxlf.exe upx C:\bhnhnn.exe upx behavioral2/memory/4692-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4816-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4692-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5100-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/828-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4760-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4760-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3352-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1888-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3568-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4256-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2284-137-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exexrllffx.exelllfffl.exenhhbtt.exevvjdj.exevvjdj.exefflxlll.exexffxxrl.exehhhbhh.exevpvpj.exeffxrrll.exerxxrrrr.exenhnhnn.exenttttn.exepjdjv.exedvdpd.exeffxrllx.exexrrrlll.exenbhhbh.exe5bbthh.exeddjdv.exedpdvp.exedescription pid process target process PID 4744 wrote to memory of 3976 4744 5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe xrllffx.exe PID 4744 wrote to memory of 3976 4744 5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe xrllffx.exe PID 4744 wrote to memory of 3976 4744 5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe xrllffx.exe PID 3976 wrote to memory of 4308 3976 xrllffx.exe lxfxrrf.exe PID 3976 wrote to memory of 4308 3976 xrllffx.exe lxfxrrf.exe PID 3976 wrote to memory of 4308 3976 xrllffx.exe lxfxrrf.exe PID 4308 wrote to memory of 1344 4308 lllfffl.exe nhhbtt.exe PID 4308 wrote to memory of 1344 4308 lllfffl.exe nhhbtt.exe PID 4308 wrote to memory of 1344 4308 lllfffl.exe nhhbtt.exe PID 1344 wrote to memory of 1788 1344 nhhbtt.exe vvjdj.exe PID 1344 wrote to memory of 1788 1344 nhhbtt.exe vvjdj.exe PID 1344 wrote to memory of 1788 1344 nhhbtt.exe vvjdj.exe PID 1788 wrote to memory of 3108 1788 vvjdj.exe 3rxrffx.exe PID 1788 wrote to memory of 3108 1788 vvjdj.exe 3rxrffx.exe PID 1788 wrote to memory of 3108 1788 vvjdj.exe 3rxrffx.exe PID 3108 wrote to memory of 2508 3108 vvjdj.exe fflxlll.exe PID 3108 wrote to memory of 2508 3108 vvjdj.exe fflxlll.exe PID 3108 wrote to memory of 2508 3108 vvjdj.exe fflxlll.exe PID 2508 wrote to memory of 1428 2508 fflxlll.exe xlrfrrl.exe PID 2508 wrote to memory of 1428 2508 fflxlll.exe xlrfrrl.exe PID 2508 wrote to memory of 1428 2508 fflxlll.exe xlrfrrl.exe PID 1428 wrote to memory of 4728 1428 xffxxrl.exe hhhbhh.exe PID 1428 wrote to memory of 4728 1428 xffxxrl.exe hhhbhh.exe PID 1428 wrote to memory of 4728 1428 xffxxrl.exe hhhbhh.exe PID 4728 wrote to memory of 4888 4728 hhhbhh.exe vpvpj.exe PID 4728 wrote to memory of 4888 4728 hhhbhh.exe vpvpj.exe PID 4728 wrote to memory of 4888 4728 hhhbhh.exe vpvpj.exe PID 4888 wrote to memory of 3888 4888 vpvpj.exe xfxrlff.exe PID 4888 wrote to memory of 3888 4888 vpvpj.exe xfxrlff.exe PID 4888 wrote to memory of 3888 4888 vpvpj.exe xfxrlff.exe PID 3888 wrote to memory of 2976 3888 ffxrrll.exe rxxrrrr.exe PID 3888 wrote to memory of 2976 3888 ffxrrll.exe rxxrrrr.exe PID 3888 wrote to memory of 2976 3888 ffxrrll.exe rxxrrrr.exe PID 2976 wrote to memory of 3916 2976 rxxrrrr.exe httthh.exe PID 2976 wrote to memory of 3916 2976 rxxrrrr.exe httthh.exe PID 2976 wrote to memory of 3916 2976 rxxrrrr.exe httthh.exe PID 3916 wrote to memory of 3156 3916 nhnhnn.exe nttttn.exe PID 3916 wrote to memory of 3156 3916 nhnhnn.exe nttttn.exe PID 3916 wrote to memory of 3156 3916 nhnhnn.exe nttttn.exe PID 3156 wrote to memory of 3972 3156 nttttn.exe 3jdvj.exe PID 3156 wrote to memory of 3972 3156 nttttn.exe 3jdvj.exe PID 3156 wrote to memory of 3972 3156 nttttn.exe 3jdvj.exe PID 3972 wrote to memory of 3064 3972 pjdjv.exe pdvpj.exe PID 3972 wrote to memory of 3064 3972 pjdjv.exe pdvpj.exe PID 3972 wrote to memory of 3064 3972 pjdjv.exe pdvpj.exe PID 3064 wrote to memory of 2836 3064 dvdpd.exe 9ppjd.exe PID 3064 wrote to memory of 2836 3064 dvdpd.exe 9ppjd.exe PID 3064 wrote to memory of 2836 3064 dvdpd.exe 9ppjd.exe PID 2836 wrote to memory of 4188 2836 ffxrllx.exe xrrrlll.exe PID 2836 wrote to memory of 4188 2836 ffxrllx.exe xrrrlll.exe PID 2836 wrote to memory of 4188 2836 ffxrllx.exe xrrrlll.exe PID 4188 wrote to memory of 4416 4188 xrrrlll.exe jdpjv.exe PID 4188 wrote to memory of 4416 4188 xrrrlll.exe jdpjv.exe PID 4188 wrote to memory of 4416 4188 xrrrlll.exe jdpjv.exe PID 4416 wrote to memory of 1324 4416 nbhhbh.exe xxxrfxr.exe PID 4416 wrote to memory of 1324 4416 nbhhbh.exe xxxrfxr.exe PID 4416 wrote to memory of 1324 4416 nbhhbh.exe xxxrfxr.exe PID 1324 wrote to memory of 4960 1324 5bbthh.exe 7xrxlrl.exe PID 1324 wrote to memory of 4960 1324 5bbthh.exe 7xrxlrl.exe PID 1324 wrote to memory of 4960 1324 5bbthh.exe 7xrxlrl.exe PID 4960 wrote to memory of 4740 4960 ddjdv.exe dpdvp.exe PID 4960 wrote to memory of 4740 4960 ddjdv.exe dpdvp.exe PID 4960 wrote to memory of 4740 4960 ddjdv.exe dpdvp.exe PID 4740 wrote to memory of 2756 4740 dpdvp.exe lfxxffl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xrllffx.exec:\xrllffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lllfffl.exec:\lllfffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhbtt.exec:\nhhbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjdj.exec:\vvjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjdj.exec:\vvjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflxlll.exec:\fflxlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xffxxrl.exec:\xffxxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhbhh.exec:\hhhbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvpj.exec:\vpvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxrrll.exec:\ffxrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnhnn.exec:\nhnhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nttttn.exec:\nttttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdjv.exec:\pjdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdpd.exec:\dvdpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxrllx.exec:\ffxrllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrrlll.exec:\xrrrlll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhhbh.exec:\nbhhbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5bbthh.exec:\5bbthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjdv.exec:\ddjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpdvp.exec:\dpdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxxffl.exec:\lfxxffl.exe23⤵
- Executes dropped EXE
-
\??\c:\7lrxrxx.exec:\7lrxrxx.exe24⤵
- Executes dropped EXE
-
\??\c:\tbnnhb.exec:\tbnnhb.exe25⤵
- Executes dropped EXE
-
\??\c:\djjdv.exec:\djjdv.exe26⤵
- Executes dropped EXE
-
\??\c:\rlffffl.exec:\rlffffl.exe27⤵
- Executes dropped EXE
-
\??\c:\xxxrlfr.exec:\xxxrlfr.exe28⤵
- Executes dropped EXE
-
\??\c:\5bbtnn.exec:\5bbtnn.exe29⤵
- Executes dropped EXE
-
\??\c:\jddvj.exec:\jddvj.exe30⤵
- Executes dropped EXE
-
\??\c:\5ppjd.exec:\5ppjd.exe31⤵
- Executes dropped EXE
-
\??\c:\xffrfff.exec:\xffrfff.exe32⤵
- Executes dropped EXE
-
\??\c:\ffffxlf.exec:\ffffxlf.exe33⤵
- Executes dropped EXE
-
\??\c:\bhnhnn.exec:\bhnhnn.exe34⤵
- Executes dropped EXE
-
\??\c:\ddjdv.exec:\ddjdv.exe35⤵
- Executes dropped EXE
-
\??\c:\9ddjd.exec:\9ddjd.exe36⤵
- Executes dropped EXE
-
\??\c:\fffxllf.exec:\fffxllf.exe37⤵
- Executes dropped EXE
-
\??\c:\1xxrlfx.exec:\1xxrlfx.exe38⤵
- Executes dropped EXE
-
\??\c:\bhtnhh.exec:\bhtnhh.exe39⤵
- Executes dropped EXE
-
\??\c:\5tnhtb.exec:\5tnhtb.exe40⤵
- Executes dropped EXE
-
\??\c:\vvpvp.exec:\vvpvp.exe41⤵
- Executes dropped EXE
-
\??\c:\lxfxrrf.exec:\lxfxrrf.exe42⤵
- Executes dropped EXE
-
\??\c:\nbnhbb.exec:\nbnhbb.exe43⤵
- Executes dropped EXE
-
\??\c:\tnnbbt.exec:\tnnbbt.exe44⤵
- Executes dropped EXE
-
\??\c:\djdvp.exec:\djdvp.exe45⤵
- Executes dropped EXE
-
\??\c:\3djdv.exec:\3djdv.exe46⤵
- Executes dropped EXE
-
\??\c:\lrlxrrf.exec:\lrlxrrf.exe47⤵
- Executes dropped EXE
-
\??\c:\hhtntt.exec:\hhtntt.exe48⤵
- Executes dropped EXE
-
\??\c:\hhtnnh.exec:\hhtnnh.exe49⤵
- Executes dropped EXE
-
\??\c:\nnhbtt.exec:\nnhbtt.exe50⤵
- Executes dropped EXE
-
\??\c:\3pvjd.exec:\3pvjd.exe51⤵
- Executes dropped EXE
-
\??\c:\1lxlfxl.exec:\1lxlfxl.exe52⤵
- Executes dropped EXE
-
\??\c:\5ffxxxr.exec:\5ffxxxr.exe53⤵
- Executes dropped EXE
-
\??\c:\3hhhbb.exec:\3hhhbb.exe54⤵
- Executes dropped EXE
-
\??\c:\httnhb.exec:\httnhb.exe55⤵
- Executes dropped EXE
-
\??\c:\vpdvv.exec:\vpdvv.exe56⤵
- Executes dropped EXE
-
\??\c:\3jdvj.exec:\3jdvj.exe57⤵
- Executes dropped EXE
-
\??\c:\3vvpp.exec:\3vvpp.exe58⤵
- Executes dropped EXE
-
\??\c:\5rxrlrl.exec:\5rxrlrl.exe59⤵
- Executes dropped EXE
-
\??\c:\9bhbbb.exec:\9bhbbb.exe60⤵
- Executes dropped EXE
-
\??\c:\htbtnt.exec:\htbtnt.exe61⤵
- Executes dropped EXE
-
\??\c:\dddvp.exec:\dddvp.exe62⤵
- Executes dropped EXE
-
\??\c:\jpjjv.exec:\jpjjv.exe63⤵
- Executes dropped EXE
-
\??\c:\llrffff.exec:\llrffff.exe64⤵
- Executes dropped EXE
-
\??\c:\7xrxlrl.exec:\7xrxlrl.exe65⤵
- Executes dropped EXE
-
\??\c:\btbtnb.exec:\btbtnb.exe66⤵
-
\??\c:\hnhbbb.exec:\hnhbbb.exe67⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe68⤵
-
\??\c:\7jpdp.exec:\7jpdp.exe69⤵
-
\??\c:\frxrlrr.exec:\frxrlrr.exe70⤵
-
\??\c:\xfffxxr.exec:\xfffxxr.exe71⤵
-
\??\c:\rrlxrrr.exec:\rrlxrrr.exe72⤵
-
\??\c:\bttbtn.exec:\bttbtn.exe73⤵
-
\??\c:\1ddpv.exec:\1ddpv.exe74⤵
-
\??\c:\3jjdp.exec:\3jjdp.exe75⤵
-
\??\c:\llllfxr.exec:\llllfxr.exe76⤵
-
\??\c:\xrxrxrl.exec:\xrxrxrl.exe77⤵
-
\??\c:\nnnntt.exec:\nnnntt.exe78⤵
-
\??\c:\hhtntt.exec:\hhtntt.exe79⤵
-
\??\c:\pddvv.exec:\pddvv.exe80⤵
-
\??\c:\dpdpj.exec:\dpdpj.exe81⤵
-
\??\c:\9fxxrrr.exec:\9fxxrrr.exe82⤵
-
\??\c:\flrrrrr.exec:\flrrrrr.exe83⤵
-
\??\c:\hhnnhh.exec:\hhnnhh.exe84⤵
-
\??\c:\9tnbtn.exec:\9tnbtn.exe85⤵
-
\??\c:\pdjvj.exec:\pdjvj.exe86⤵
-
\??\c:\jpddv.exec:\jpddv.exe87⤵
-
\??\c:\rfxrrlf.exec:\rfxrrlf.exe88⤵
-
\??\c:\lffxxxx.exec:\lffxxxx.exe89⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe90⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe91⤵
-
\??\c:\jvvpd.exec:\jvvpd.exe92⤵
-
\??\c:\5jdvv.exec:\5jdvv.exe93⤵
-
\??\c:\xllfxrl.exec:\xllfxrl.exe94⤵
-
\??\c:\bhnbtt.exec:\bhnbtt.exe95⤵
-
\??\c:\nhtnnn.exec:\nhtnnn.exe96⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe97⤵
-
\??\c:\5jdjd.exec:\5jdjd.exe98⤵
-
\??\c:\fflrxrr.exec:\fflrxrr.exe99⤵
-
\??\c:\ntbtnn.exec:\ntbtnn.exe100⤵
-
\??\c:\bhbtnn.exec:\bhbtnn.exe101⤵
-
\??\c:\xlrfrrl.exec:\xlrfrrl.exe102⤵
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe103⤵
-
\??\c:\hnnhtb.exec:\hnnhtb.exe104⤵
-
\??\c:\pdvpp.exec:\pdvpp.exe105⤵
-
\??\c:\1ppdv.exec:\1ppdv.exe106⤵
-
\??\c:\flllxrr.exec:\flllxrr.exe107⤵
-
\??\c:\ffflfll.exec:\ffflfll.exe108⤵
-
\??\c:\5bttnn.exec:\5bttnn.exe109⤵
-
\??\c:\bthnbn.exec:\bthnbn.exe110⤵
-
\??\c:\7dvpd.exec:\7dvpd.exe111⤵
-
\??\c:\vvpjj.exec:\vvpjj.exe112⤵
-
\??\c:\dvdpj.exec:\dvdpj.exe113⤵
-
\??\c:\9fxfrlf.exec:\9fxfrlf.exe114⤵
-
\??\c:\xrlffxx.exec:\xrlffxx.exe115⤵
-
\??\c:\nnnbtn.exec:\nnnbtn.exe116⤵
-
\??\c:\bbtbnn.exec:\bbtbnn.exe117⤵
-
\??\c:\1jjdv.exec:\1jjdv.exe118⤵
-
\??\c:\jvpjd.exec:\jvpjd.exe119⤵
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe120⤵
-
\??\c:\3flxlxf.exec:\3flxlxf.exe121⤵
-
\??\c:\nnnhnh.exec:\nnnhnh.exe122⤵
-
\??\c:\bhhnhn.exec:\bhhnhn.exe123⤵
-
\??\c:\pvdjj.exec:\pvdjj.exe124⤵
-
\??\c:\dvjvj.exec:\dvjvj.exe125⤵
-
\??\c:\1lrlrrl.exec:\1lrlrrl.exe126⤵
-
\??\c:\ffxxrlx.exec:\ffxxrlx.exe127⤵
-
\??\c:\bnnbtn.exec:\bnnbtn.exe128⤵
-
\??\c:\9hhtnn.exec:\9hhtnn.exe129⤵
-
\??\c:\bbhtnn.exec:\bbhtnn.exe130⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe131⤵
-
\??\c:\xflfrll.exec:\xflfrll.exe132⤵
-
\??\c:\nnbtbt.exec:\nnbtbt.exe133⤵
-
\??\c:\nbnbtn.exec:\nbnbtn.exe134⤵
-
\??\c:\bthttt.exec:\bthttt.exe135⤵
-
\??\c:\ddddj.exec:\ddddj.exe136⤵
-
\??\c:\vjvjv.exec:\vjvjv.exe137⤵
-
\??\c:\lxxxrlf.exec:\lxxxrlf.exe138⤵
-
\??\c:\rxllfxl.exec:\rxllfxl.exe139⤵
-
\??\c:\hnnnbt.exec:\hnnnbt.exe140⤵
-
\??\c:\tthbtt.exec:\tthbtt.exe141⤵
-
\??\c:\7ppjp.exec:\7ppjp.exe142⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe143⤵
-
\??\c:\7lfxlfl.exec:\7lfxlfl.exe144⤵
-
\??\c:\flxxlrl.exec:\flxxlrl.exe145⤵
-
\??\c:\bntnhh.exec:\bntnhh.exe146⤵
-
\??\c:\bbtnbb.exec:\bbtnbb.exe147⤵
-
\??\c:\3nttnh.exec:\3nttnh.exe148⤵
-
\??\c:\7djpd.exec:\7djpd.exe149⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe150⤵
-
\??\c:\rffxlfx.exec:\rffxlfx.exe151⤵
-
\??\c:\frxrlfx.exec:\frxrlfx.exe152⤵
-
\??\c:\xrlllrl.exec:\xrlllrl.exe153⤵
-
\??\c:\thnbnh.exec:\thnbnh.exe154⤵
-
\??\c:\httntn.exec:\httntn.exe155⤵
-
\??\c:\9ppjd.exec:\9ppjd.exe156⤵
-
\??\c:\dpdpd.exec:\dpdpd.exe157⤵
-
\??\c:\jvjvp.exec:\jvjvp.exe158⤵
-
\??\c:\fxxfxrl.exec:\fxxfxrl.exe159⤵
-
\??\c:\xfllxxl.exec:\xfllxxl.exe160⤵
-
\??\c:\httnhb.exec:\httnhb.exe161⤵
-
\??\c:\bttnnh.exec:\bttnnh.exe162⤵
-
\??\c:\rffxlff.exec:\rffxlff.exe163⤵
-
\??\c:\httntn.exec:\httntn.exe164⤵
-
\??\c:\3tnhnh.exec:\3tnhnh.exe165⤵
-
\??\c:\nbbthb.exec:\nbbthb.exe166⤵
-
\??\c:\ddvpj.exec:\ddvpj.exe167⤵
-
\??\c:\jdjvj.exec:\jdjvj.exe168⤵
-
\??\c:\rrrfrll.exec:\rrrfrll.exe169⤵
-
\??\c:\9llfxrl.exec:\9llfxrl.exe170⤵
-
\??\c:\3nbthb.exec:\3nbthb.exe171⤵
-
\??\c:\nbbthh.exec:\nbbthh.exe172⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe173⤵
-
\??\c:\pvjpd.exec:\pvjpd.exe174⤵
-
\??\c:\lrrfrlf.exec:\lrrfrlf.exe175⤵
-
\??\c:\rlrlrrl.exec:\rlrlrrl.exe176⤵
-
\??\c:\hbtnbt.exec:\hbtnbt.exe177⤵
-
\??\c:\htbhnn.exec:\htbhnn.exe178⤵
-
\??\c:\5ddvd.exec:\5ddvd.exe179⤵
-
\??\c:\7pjdv.exec:\7pjdv.exe180⤵
-
\??\c:\jdvpd.exec:\jdvpd.exe181⤵
-
\??\c:\lfflrxf.exec:\lfflrxf.exe182⤵
-
\??\c:\xlrlrrl.exec:\xlrlrrl.exe183⤵
-
\??\c:\7ttnbb.exec:\7ttnbb.exe184⤵
-
\??\c:\btbttn.exec:\btbttn.exe185⤵
-
\??\c:\pppjv.exec:\pppjv.exe186⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe187⤵
-
\??\c:\rlfxllf.exec:\rlfxllf.exe188⤵
-
\??\c:\hhhthb.exec:\hhhthb.exe189⤵
-
\??\c:\1tnhbt.exec:\1tnhbt.exe190⤵
-
\??\c:\ttnhtt.exec:\ttnhtt.exe191⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe192⤵
-
\??\c:\ddvvj.exec:\ddvvj.exe193⤵
-
\??\c:\1rlfrlf.exec:\1rlfrlf.exe194⤵
-
\??\c:\lrrlffx.exec:\lrrlffx.exe195⤵
-
\??\c:\ttnhbt.exec:\ttnhbt.exe196⤵
-
\??\c:\bttntt.exec:\bttntt.exe197⤵
-
\??\c:\9tbbnn.exec:\9tbbnn.exe198⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe199⤵
-
\??\c:\jjdjd.exec:\jjdjd.exe200⤵
-
\??\c:\7llxlfx.exec:\7llxlfx.exe201⤵
-
\??\c:\fffrlrr.exec:\fffrlrr.exe202⤵
-
\??\c:\hnbnnb.exec:\hnbnnb.exe203⤵
-
\??\c:\ntnnbb.exec:\ntnnbb.exe204⤵
-
\??\c:\ttbtnt.exec:\ttbtnt.exe205⤵
-
\??\c:\djpjv.exec:\djpjv.exe206⤵
-
\??\c:\dpjjv.exec:\dpjjv.exe207⤵
-
\??\c:\jpvjd.exec:\jpvjd.exe208⤵
-
\??\c:\lfxlfxr.exec:\lfxlfxr.exe209⤵
-
\??\c:\7fxrrlf.exec:\7fxrrlf.exe210⤵
-
\??\c:\tnnhtt.exec:\tnnhtt.exe211⤵
-
\??\c:\7bbtbb.exec:\7bbtbb.exe212⤵
-
\??\c:\vpjjd.exec:\vpjjd.exe213⤵
-
\??\c:\7xrlrlf.exec:\7xrlrlf.exe214⤵
-
\??\c:\xxflffx.exec:\xxflffx.exe215⤵
-
\??\c:\frrlfff.exec:\frrlfff.exe216⤵
-
\??\c:\btnhht.exec:\btnhht.exe217⤵
-
\??\c:\nhtnhb.exec:\nhtnhb.exe218⤵
-
\??\c:\3rxrffl.exec:\3rxrffl.exe219⤵
-
\??\c:\9rrlfxl.exec:\9rrlfxl.exe220⤵
-
\??\c:\5bhtnh.exec:\5bhtnh.exe221⤵
-
\??\c:\tntntn.exec:\tntntn.exe222⤵
-
\??\c:\3bbtnn.exec:\3bbtnn.exe223⤵
-
\??\c:\pjjjp.exec:\pjjjp.exe224⤵
-
\??\c:\1jpjd.exec:\1jpjd.exe225⤵
-
\??\c:\rlfrrrr.exec:\rlfrrrr.exe226⤵
-
\??\c:\xllxrfx.exec:\xllxrfx.exe227⤵
-
\??\c:\fxxxlrl.exec:\fxxxlrl.exe228⤵
-
\??\c:\hbnbtn.exec:\hbnbtn.exe229⤵
-
\??\c:\btbnht.exec:\btbnht.exe230⤵
-
\??\c:\ddpjd.exec:\ddpjd.exe231⤵
-
\??\c:\vddpj.exec:\vddpj.exe232⤵
-
\??\c:\lffrfxr.exec:\lffrfxr.exe233⤵
-
\??\c:\5xfrlff.exec:\5xfrlff.exe234⤵
-
\??\c:\fllxrlx.exec:\fllxrlx.exe235⤵
-
\??\c:\nnnhtn.exec:\nnnhtn.exe236⤵
-
\??\c:\thtnhh.exec:\thtnhh.exe237⤵
-
\??\c:\pjdvj.exec:\pjdvj.exe238⤵
-
\??\c:\pdddv.exec:\pdddv.exe239⤵
-
\??\c:\ddvdv.exec:\ddvdv.exe240⤵
-
\??\c:\rlxrxrf.exec:\rlxrxrf.exe241⤵