Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 22:20
Behavioral task
behavioral1
Sample
976fb1e86e259b0266c23e7d3732e670_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
976fb1e86e259b0266c23e7d3732e670_NeikiAnalytics.exe
-
Size
226KB
-
MD5
976fb1e86e259b0266c23e7d3732e670
-
SHA1
bccda371d7c0a5ca069cfe4fdffe0d3bd933194a
-
SHA256
4b1c7d29497e7ab2e2a881366847946511aede2c828046e18d84b1cc5f2b0ffc
-
SHA512
b600023e4211b85951587a9e6d8d2c7d4527ee720cb4fcfcbabe7cd185b69bf3152e715c7425828e6b02ac24aa175af5fcdda0616bdefd4e3299952e83d10176
-
SSDEEP
6144:Dcm4FmowdHoSkHcJkkcm4FmowdHoS2qOv7r+MubPtylm:p4wFHoSk0ky4wFHoS2nDr9ubQlm
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4028-13-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3888-7-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4348-27-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2520-22-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4124-33-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4828-41-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/5008-49-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1960-54-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/764-62-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1904-61-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1904-69-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/372-75-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4388-83-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2352-85-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2352-88-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1636-95-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4352-108-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1152-115-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1392-124-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1392-120-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1060-131-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4244-137-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4512-147-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2044-151-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3736-158-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1396-169-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3564-174-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3272-181-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1572-190-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2420-188-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1572-194-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4040-201-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2476-210-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4904-217-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2156-221-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4964-228-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4012-233-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3868-238-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1492-243-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4348-245-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4348-250-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2908-253-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4876-254-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4876-259-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/880-264-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3732-268-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2364-273-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3608-275-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3608-278-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2864-283-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3428-285-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3428-288-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2692-289-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2932-294-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2692-293-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2932-299-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4120-303-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4540-1527-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4404-1541-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4028-1945-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1396-3749-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3448-3911-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1324-3968-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4536-3986-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dddvj.exefxrrlxl.exe3llffff.exe7bbtnt.exeffrrrrx.exe1dppd.exebtbbhn.exelrlfxrl.exettnbth.exejpvpj.exeffxxrrr.exebnttnn.exexxlflff.exejvjpd.exefxlxrlx.exebbbthn.exe1dvjv.exetnnbth.exejdpjd.exehhnhhh.exevpdvj.exe5ppjv.exevppjv.exelxffxxr.exebntnnn.exedvpdj.exelrfxllr.exerxxxxxr.exedvdvp.exefxlflrr.exehntnhh.exexllfxrl.exethtntt.exe1jvvj.exe7xxrrrl.exebttbtt.exetnbttt.exe3jjdp.exeflllxxr.exetntnhh.exepdjdp.exebnbbbb.exenbhtnn.exedvjdd.exelflfxrr.exexlrlfxx.exethhtnh.exe1xrlflf.exerxrlllf.exehbtnhh.exepjjvp.exedddvp.exe9flffff.exebbhbtt.exe3httnn.exedvdvj.exepvdvj.exexlxrxxx.exefflfxrr.exehbbtbb.exehbbnhb.exejddvv.exexllrlrl.exexrrrxxf.exepid process 4028 dddvj.exe 2520 fxrrlxl.exe 4348 3llffff.exe 4124 7bbtnt.exe 4828 ffrrrrx.exe 5008 1dppd.exe 1960 btbbhn.exe 764 lrlfxrl.exe 1904 ttnbth.exe 372 jpvpj.exe 4388 ffxxrrr.exe 2352 bnttnn.exe 1636 xxlflff.exe 4440 jvjpd.exe 4352 fxlxrlx.exe 1152 bbbthn.exe 1392 1dvjv.exe 1060 tnnbth.exe 4244 jdpjd.exe 4512 hhnhhh.exe 2044 vpdvj.exe 3736 5ppjv.exe 1396 vppjv.exe 3564 lxffxxr.exe 3272 bntnnn.exe 2420 dvpdj.exe 1572 lrfxllr.exe 4040 rxxxxxr.exe 2476 dvdvp.exe 4904 fxlflrr.exe 2156 hntnhh.exe 4964 xllfxrl.exe 4012 thtntt.exe 3868 1jvvj.exe 1492 7xxrrrl.exe 4348 bttbtt.exe 2908 tnbttt.exe 4876 3jjdp.exe 880 flllxxr.exe 3732 tntnhh.exe 2364 pdjdp.exe 3608 bnbbbb.exe 2864 nbhtnn.exe 3428 dvjdd.exe 2692 lflfxrr.exe 2932 xlrlfxx.exe 4120 thhtnh.exe 3828 1xrlflf.exe 1312 rxrlllf.exe 4592 hbtnhh.exe 2648 pjjvp.exe 4352 dddvp.exe 1324 9flffff.exe 3328 bbhbtt.exe 892 3httnn.exe 2980 dvdvj.exe 4800 pvdvj.exe 2760 xlxrxxx.exe 3904 fflfxrr.exe 3668 hbbtbb.exe 4868 hbbnhb.exe 4072 jddvv.exe 1468 xllrlrl.exe 1688 xrrrxxf.exe -
Processes:
resource yara_rule behavioral2/memory/3888-1-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\dddvj.exe upx behavioral2/memory/4028-8-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\fxrrlxl.exe upx behavioral2/memory/4028-13-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3888-7-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2520-15-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\3llffff.exe upx C:\7bbtnt.exe upx behavioral2/memory/4348-27-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4124-28-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2520-22-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4348-19-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\ffrrrrx.exe upx behavioral2/memory/4828-34-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4124-33-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/5008-42-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4828-41-0x0000000000400000-0x000000000044B000-memory.dmp upx \??\c:\1dppd.exe upx C:\btbbhn.exe upx behavioral2/memory/1960-46-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/5008-49-0x0000000000400000-0x000000000044B000-memory.dmp upx \??\c:\lrlfxrl.exe upx behavioral2/memory/1960-54-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/764-56-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\ttnbth.exe upx behavioral2/memory/764-62-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1904-61-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\jpvpj.exe upx behavioral2/memory/1904-69-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/372-71-0x0000000000400000-0x000000000044B000-memory.dmp upx \??\c:\ffxxrrr.exe upx behavioral2/memory/372-75-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4388-78-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\bnttnn.exe upx behavioral2/memory/4388-83-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2352-85-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2352-88-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\xxlflff.exe upx behavioral2/memory/1636-90-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\jvjpd.exe upx behavioral2/memory/1636-95-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4440-98-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\fxlxrlx.exe upx behavioral2/memory/4352-104-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\bbbthn.exe upx behavioral2/memory/4352-108-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1152-111-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1152-115-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\1dvjv.exe upx C:\tnnbth.exe upx behavioral2/memory/1392-124-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1392-120-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1060-125-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1060-131-0x0000000000400000-0x000000000044B000-memory.dmp upx \??\c:\jdpjd.exe upx behavioral2/memory/4244-132-0x0000000000400000-0x000000000044B000-memory.dmp upx C:\hhnhhh.exe upx behavioral2/memory/4244-137-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4512-140-0x0000000000400000-0x000000000044B000-memory.dmp upx \??\c:\vpdvj.exe upx behavioral2/memory/4512-147-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2044-145-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2044-151-0x0000000000400000-0x000000000044B000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
976fb1e86e259b0266c23e7d3732e670_NeikiAnalytics.exedddvj.exefxrrlxl.exe3llffff.exe7bbtnt.exeffrrrrx.exe1dppd.exebtbbhn.exelrlfxrl.exettnbth.exejpvpj.exeffxxrrr.exebnttnn.exexxlflff.exejvjpd.exefxlxrlx.exebbbthn.exe1dvjv.exetnnbth.exejdpjd.exehhnhhh.exevpdvj.exedescription pid process target process PID 3888 wrote to memory of 4028 3888 976fb1e86e259b0266c23e7d3732e670_NeikiAnalytics.exe dddvj.exe PID 3888 wrote to memory of 4028 3888 976fb1e86e259b0266c23e7d3732e670_NeikiAnalytics.exe dddvj.exe PID 3888 wrote to memory of 4028 3888 976fb1e86e259b0266c23e7d3732e670_NeikiAnalytics.exe dddvj.exe PID 4028 wrote to memory of 2520 4028 dddvj.exe fxrrlxl.exe PID 4028 wrote to memory of 2520 4028 dddvj.exe fxrrlxl.exe PID 4028 wrote to memory of 2520 4028 dddvj.exe fxrrlxl.exe PID 2520 wrote to memory of 4348 2520 fxrrlxl.exe 3llffff.exe PID 2520 wrote to memory of 4348 2520 fxrrlxl.exe 3llffff.exe PID 2520 wrote to memory of 4348 2520 fxrrlxl.exe 3llffff.exe PID 4348 wrote to memory of 4124 4348 3llffff.exe 7bbtnt.exe PID 4348 wrote to memory of 4124 4348 3llffff.exe 7bbtnt.exe PID 4348 wrote to memory of 4124 4348 3llffff.exe 7bbtnt.exe PID 4124 wrote to memory of 4828 4124 7bbtnt.exe ffrrrrx.exe PID 4124 wrote to memory of 4828 4124 7bbtnt.exe ffrrrrx.exe PID 4124 wrote to memory of 4828 4124 7bbtnt.exe ffrrrrx.exe PID 4828 wrote to memory of 5008 4828 ffrrrrx.exe 1dppd.exe PID 4828 wrote to memory of 5008 4828 ffrrrrx.exe 1dppd.exe PID 4828 wrote to memory of 5008 4828 ffrrrrx.exe 1dppd.exe PID 5008 wrote to memory of 1960 5008 1dppd.exe btbbhn.exe PID 5008 wrote to memory of 1960 5008 1dppd.exe btbbhn.exe PID 5008 wrote to memory of 1960 5008 1dppd.exe btbbhn.exe PID 1960 wrote to memory of 764 1960 btbbhn.exe lrlfxrl.exe PID 1960 wrote to memory of 764 1960 btbbhn.exe lrlfxrl.exe PID 1960 wrote to memory of 764 1960 btbbhn.exe lrlfxrl.exe PID 764 wrote to memory of 1904 764 lrlfxrl.exe ttnbth.exe PID 764 wrote to memory of 1904 764 lrlfxrl.exe ttnbth.exe PID 764 wrote to memory of 1904 764 lrlfxrl.exe ttnbth.exe PID 1904 wrote to memory of 372 1904 ttnbth.exe jpvpj.exe PID 1904 wrote to memory of 372 1904 ttnbth.exe jpvpj.exe PID 1904 wrote to memory of 372 1904 ttnbth.exe jpvpj.exe PID 372 wrote to memory of 4388 372 jpvpj.exe ffxxrrr.exe PID 372 wrote to memory of 4388 372 jpvpj.exe ffxxrrr.exe PID 372 wrote to memory of 4388 372 jpvpj.exe ffxxrrr.exe PID 4388 wrote to memory of 2352 4388 ffxxrrr.exe bnttnn.exe PID 4388 wrote to memory of 2352 4388 ffxxrrr.exe bnttnn.exe PID 4388 wrote to memory of 2352 4388 ffxxrrr.exe bnttnn.exe PID 2352 wrote to memory of 1636 2352 bnttnn.exe xxlflff.exe PID 2352 wrote to memory of 1636 2352 bnttnn.exe xxlflff.exe PID 2352 wrote to memory of 1636 2352 bnttnn.exe xxlflff.exe PID 1636 wrote to memory of 4440 1636 xxlflff.exe jvjpd.exe PID 1636 wrote to memory of 4440 1636 xxlflff.exe jvjpd.exe PID 1636 wrote to memory of 4440 1636 xxlflff.exe jvjpd.exe PID 4440 wrote to memory of 4352 4440 jvjpd.exe fxlxrlx.exe PID 4440 wrote to memory of 4352 4440 jvjpd.exe fxlxrlx.exe PID 4440 wrote to memory of 4352 4440 jvjpd.exe fxlxrlx.exe PID 4352 wrote to memory of 1152 4352 fxlxrlx.exe bbbthn.exe PID 4352 wrote to memory of 1152 4352 fxlxrlx.exe bbbthn.exe PID 4352 wrote to memory of 1152 4352 fxlxrlx.exe bbbthn.exe PID 1152 wrote to memory of 1392 1152 bbbthn.exe 1dvjv.exe PID 1152 wrote to memory of 1392 1152 bbbthn.exe 1dvjv.exe PID 1152 wrote to memory of 1392 1152 bbbthn.exe 1dvjv.exe PID 1392 wrote to memory of 1060 1392 1dvjv.exe tnnbth.exe PID 1392 wrote to memory of 1060 1392 1dvjv.exe tnnbth.exe PID 1392 wrote to memory of 1060 1392 1dvjv.exe tnnbth.exe PID 1060 wrote to memory of 4244 1060 tnnbth.exe jdpjd.exe PID 1060 wrote to memory of 4244 1060 tnnbth.exe jdpjd.exe PID 1060 wrote to memory of 4244 1060 tnnbth.exe jdpjd.exe PID 4244 wrote to memory of 4512 4244 jdpjd.exe hhnhhh.exe PID 4244 wrote to memory of 4512 4244 jdpjd.exe hhnhhh.exe PID 4244 wrote to memory of 4512 4244 jdpjd.exe hhnhhh.exe PID 4512 wrote to memory of 2044 4512 hhnhhh.exe vpdvj.exe PID 4512 wrote to memory of 2044 4512 hhnhhh.exe vpdvj.exe PID 4512 wrote to memory of 2044 4512 hhnhhh.exe vpdvj.exe PID 2044 wrote to memory of 3736 2044 vpdvj.exe 5ppjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\976fb1e86e259b0266c23e7d3732e670_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\976fb1e86e259b0266c23e7d3732e670_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\dddvj.exec:\dddvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrrlxl.exec:\fxrrlxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3llffff.exec:\3llffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7bbtnt.exec:\7bbtnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1dppd.exec:\1dppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbbhn.exec:\btbbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnbth.exec:\ttnbth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvpj.exec:\jpvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnttnn.exec:\bnttnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlflff.exec:\xxlflff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvjpd.exec:\jvjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxlxrlx.exec:\fxlxrlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbbthn.exec:\bbbthn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1dvjv.exec:\1dvjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnbth.exec:\tnnbth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpjd.exec:\jdpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhnhhh.exec:\hhnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdvj.exec:\vpdvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5ppjv.exec:\5ppjv.exe23⤵
- Executes dropped EXE
-
\??\c:\vppjv.exec:\vppjv.exe24⤵
- Executes dropped EXE
-
\??\c:\lxffxxr.exec:\lxffxxr.exe25⤵
- Executes dropped EXE
-
\??\c:\bntnnn.exec:\bntnnn.exe26⤵
- Executes dropped EXE
-
\??\c:\dvpdj.exec:\dvpdj.exe27⤵
- Executes dropped EXE
-
\??\c:\lrfxllr.exec:\lrfxllr.exe28⤵
- Executes dropped EXE
-
\??\c:\rxxxxxr.exec:\rxxxxxr.exe29⤵
- Executes dropped EXE
-
\??\c:\dvdvp.exec:\dvdvp.exe30⤵
- Executes dropped EXE
-
\??\c:\fxlflrr.exec:\fxlflrr.exe31⤵
- Executes dropped EXE
-
\??\c:\hntnhh.exec:\hntnhh.exe32⤵
- Executes dropped EXE
-
\??\c:\xllfxrl.exec:\xllfxrl.exe33⤵
- Executes dropped EXE
-
\??\c:\thtntt.exec:\thtntt.exe34⤵
- Executes dropped EXE
-
\??\c:\1jvvj.exec:\1jvvj.exe35⤵
- Executes dropped EXE
-
\??\c:\7xxrrrl.exec:\7xxrrrl.exe36⤵
- Executes dropped EXE
-
\??\c:\bttbtt.exec:\bttbtt.exe37⤵
- Executes dropped EXE
-
\??\c:\tnbttt.exec:\tnbttt.exe38⤵
- Executes dropped EXE
-
\??\c:\3jjdp.exec:\3jjdp.exe39⤵
- Executes dropped EXE
-
\??\c:\flllxxr.exec:\flllxxr.exe40⤵
- Executes dropped EXE
-
\??\c:\tntnhh.exec:\tntnhh.exe41⤵
- Executes dropped EXE
-
\??\c:\pdjdp.exec:\pdjdp.exe42⤵
- Executes dropped EXE
-
\??\c:\bnbbbb.exec:\bnbbbb.exe43⤵
- Executes dropped EXE
-
\??\c:\nbhtnn.exec:\nbhtnn.exe44⤵
- Executes dropped EXE
-
\??\c:\dvjdd.exec:\dvjdd.exe45⤵
- Executes dropped EXE
-
\??\c:\lflfxrr.exec:\lflfxrr.exe46⤵
- Executes dropped EXE
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe47⤵
- Executes dropped EXE
-
\??\c:\thhtnh.exec:\thhtnh.exe48⤵
- Executes dropped EXE
-
\??\c:\1xrlflf.exec:\1xrlflf.exe49⤵
- Executes dropped EXE
-
\??\c:\rxrlllf.exec:\rxrlllf.exe50⤵
- Executes dropped EXE
-
\??\c:\hbtnhh.exec:\hbtnhh.exe51⤵
- Executes dropped EXE
-
\??\c:\pjjvp.exec:\pjjvp.exe52⤵
- Executes dropped EXE
-
\??\c:\dddvp.exec:\dddvp.exe53⤵
- Executes dropped EXE
-
\??\c:\9flffff.exec:\9flffff.exe54⤵
- Executes dropped EXE
-
\??\c:\bbhbtt.exec:\bbhbtt.exe55⤵
- Executes dropped EXE
-
\??\c:\3httnn.exec:\3httnn.exe56⤵
- Executes dropped EXE
-
\??\c:\dvdvj.exec:\dvdvj.exe57⤵
- Executes dropped EXE
-
\??\c:\pvdvj.exec:\pvdvj.exe58⤵
- Executes dropped EXE
-
\??\c:\xlxrxxx.exec:\xlxrxxx.exe59⤵
- Executes dropped EXE
-
\??\c:\fflfxrr.exec:\fflfxrr.exe60⤵
- Executes dropped EXE
-
\??\c:\hbbtbb.exec:\hbbtbb.exe61⤵
- Executes dropped EXE
-
\??\c:\hbbnhb.exec:\hbbnhb.exe62⤵
- Executes dropped EXE
-
\??\c:\jddvv.exec:\jddvv.exe63⤵
- Executes dropped EXE
-
\??\c:\xllrlrl.exec:\xllrlrl.exe64⤵
- Executes dropped EXE
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe65⤵
- Executes dropped EXE
-
\??\c:\7tbtnn.exec:\7tbtnn.exe66⤵
-
\??\c:\djvvj.exec:\djvvj.exe67⤵
-
\??\c:\fllfxxx.exec:\fllfxxx.exe68⤵
-
\??\c:\fxffxxr.exec:\fxffxxr.exe69⤵
-
\??\c:\hnbtnn.exec:\hnbtnn.exe70⤵
-
\??\c:\pvddv.exec:\pvddv.exe71⤵
-
\??\c:\3jvjd.exec:\3jvjd.exe72⤵
-
\??\c:\llrlfxr.exec:\llrlfxr.exe73⤵
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe74⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe75⤵
-
\??\c:\bhhbtn.exec:\bhhbtn.exe76⤵
-
\??\c:\jdvvv.exec:\jdvvv.exe77⤵
-
\??\c:\jppjv.exec:\jppjv.exe78⤵
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe79⤵
-
\??\c:\7tthbh.exec:\7tthbh.exe80⤵
-
\??\c:\djppd.exec:\djppd.exe81⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe82⤵
-
\??\c:\7fxrrrx.exec:\7fxrrrx.exe83⤵
-
\??\c:\llfxrrl.exec:\llfxrrl.exe84⤵
-
\??\c:\nhhbth.exec:\nhhbth.exe85⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe86⤵
-
\??\c:\pddpd.exec:\pddpd.exe87⤵
-
\??\c:\fxlffxx.exec:\fxlffxx.exe88⤵
-
\??\c:\rxrlfxr.exec:\rxrlfxr.exe89⤵
-
\??\c:\9tnnhh.exec:\9tnnhh.exe90⤵
-
\??\c:\bthbtn.exec:\bthbtn.exe91⤵
-
\??\c:\vjvpd.exec:\vjvpd.exe92⤵
-
\??\c:\jppjd.exec:\jppjd.exe93⤵
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe94⤵
-
\??\c:\nhthnh.exec:\nhthnh.exe95⤵
-
\??\c:\9tnbtt.exec:\9tnbtt.exe96⤵
-
\??\c:\vvddv.exec:\vvddv.exe97⤵
-
\??\c:\lflfxxr.exec:\lflfxxr.exe98⤵
-
\??\c:\llfxllf.exec:\llfxllf.exe99⤵
-
\??\c:\hbtnhb.exec:\hbtnhb.exe100⤵
-
\??\c:\dddvv.exec:\dddvv.exe101⤵
-
\??\c:\djjjd.exec:\djjjd.exe102⤵
-
\??\c:\frlffxx.exec:\frlffxx.exe103⤵
-
\??\c:\3nnnhh.exec:\3nnnhh.exe104⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe105⤵
-
\??\c:\vddpj.exec:\vddpj.exe106⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe107⤵
-
\??\c:\frxlrlr.exec:\frxlrlr.exe108⤵
-
\??\c:\bbntht.exec:\bbntht.exe109⤵
-
\??\c:\thnbht.exec:\thnbht.exe110⤵
-
\??\c:\dvvdv.exec:\dvvdv.exe111⤵
-
\??\c:\dvpjv.exec:\dvpjv.exe112⤵
-
\??\c:\9lllfxf.exec:\9lllfxf.exe113⤵
-
\??\c:\rflfxxr.exec:\rflfxxr.exe114⤵
-
\??\c:\pvpdp.exec:\pvpdp.exe115⤵
-
\??\c:\jdjpd.exec:\jdjpd.exe116⤵
-
\??\c:\xxxxlff.exec:\xxxxlff.exe117⤵
-
\??\c:\nhbnbt.exec:\nhbnbt.exe118⤵
-
\??\c:\ttnbtn.exec:\ttnbtn.exe119⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe120⤵
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe121⤵
-
\??\c:\rfrxrrl.exec:\rfrxrrl.exe122⤵
-
\??\c:\hnttnn.exec:\hnttnn.exe123⤵
-
\??\c:\pdjjj.exec:\pdjjj.exe124⤵
-
\??\c:\dvvpp.exec:\dvvpp.exe125⤵
-
\??\c:\1rlfxxr.exec:\1rlfxxr.exe126⤵
-
\??\c:\lfrlllf.exec:\lfrlllf.exe127⤵
-
\??\c:\hhhnhn.exec:\hhhnhn.exe128⤵
-
\??\c:\nhhbtb.exec:\nhhbtb.exe129⤵
-
\??\c:\jddvp.exec:\jddvp.exe130⤵
-
\??\c:\7vdvj.exec:\7vdvj.exe131⤵
-
\??\c:\rrxrffx.exec:\rrxrffx.exe132⤵
-
\??\c:\fllfffx.exec:\fllfffx.exe133⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe134⤵
-
\??\c:\nhhbnn.exec:\nhhbnn.exe135⤵
-
\??\c:\3jjjv.exec:\3jjjv.exe136⤵
-
\??\c:\pvjjd.exec:\pvjjd.exe137⤵
-
\??\c:\lxfrllf.exec:\lxfrllf.exe138⤵
-
\??\c:\bnnhbb.exec:\bnnhbb.exe139⤵
-
\??\c:\hhbhbh.exec:\hhbhbh.exe140⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe141⤵
-
\??\c:\5jdvp.exec:\5jdvp.exe142⤵
-
\??\c:\ffrflfx.exec:\ffrflfx.exe143⤵
-
\??\c:\1nnnhh.exec:\1nnnhh.exe144⤵
-
\??\c:\tttnhh.exec:\tttnhh.exe145⤵
-
\??\c:\5vdvp.exec:\5vdvp.exe146⤵
-
\??\c:\rxfrffx.exec:\rxfrffx.exe147⤵
-
\??\c:\rxffxxr.exec:\rxffxxr.exe148⤵
-
\??\c:\tntttt.exec:\tntttt.exe149⤵
-
\??\c:\7tbhtt.exec:\7tbhtt.exe150⤵
-
\??\c:\7jppd.exec:\7jppd.exe151⤵
-
\??\c:\jvvpj.exec:\jvvpj.exe152⤵
-
\??\c:\rxxfrrr.exec:\rxxfrrr.exe153⤵
-
\??\c:\frxfffl.exec:\frxfffl.exe154⤵
-
\??\c:\nnhtnt.exec:\nnhtnt.exe155⤵
-
\??\c:\thhbnn.exec:\thhbnn.exe156⤵
-
\??\c:\dddvp.exec:\dddvp.exe157⤵
-
\??\c:\xrrxlff.exec:\xrrxlff.exe158⤵
-
\??\c:\lxffffx.exec:\lxffffx.exe159⤵
-
\??\c:\nnbbhh.exec:\nnbbhh.exe160⤵
-
\??\c:\nhbbtt.exec:\nhbbtt.exe161⤵
-
\??\c:\jpvpd.exec:\jpvpd.exe162⤵
-
\??\c:\9xxrllx.exec:\9xxrllx.exe163⤵
-
\??\c:\frrxrxr.exec:\frrxrxr.exe164⤵
-
\??\c:\tnnhbt.exec:\tnnhbt.exe165⤵
-
\??\c:\1pdpv.exec:\1pdpv.exe166⤵
-
\??\c:\fxllffr.exec:\fxllffr.exe167⤵
-
\??\c:\7fxrllx.exec:\7fxrllx.exe168⤵
-
\??\c:\nnbtnn.exec:\nnbtnn.exe169⤵
-
\??\c:\nbhhbb.exec:\nbhhbb.exe170⤵
-
\??\c:\vpvjj.exec:\vpvjj.exe171⤵
-
\??\c:\ffxxxll.exec:\ffxxxll.exe172⤵
-
\??\c:\rlrlffr.exec:\rlrlffr.exe173⤵
-
\??\c:\xxxrlff.exec:\xxxrlff.exe174⤵
-
\??\c:\hnnnhh.exec:\hnnnhh.exe175⤵
-
\??\c:\vjpjv.exec:\vjpjv.exe176⤵
-
\??\c:\9dvvj.exec:\9dvvj.exe177⤵
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe178⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe179⤵
-
\??\c:\bhntbt.exec:\bhntbt.exe180⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe181⤵
-
\??\c:\3rlxfxl.exec:\3rlxfxl.exe182⤵
-
\??\c:\ffrfrlx.exec:\ffrfrlx.exe183⤵
-
\??\c:\btbhhh.exec:\btbhhh.exe184⤵
-
\??\c:\vvvjv.exec:\vvvjv.exe185⤵
-
\??\c:\vpdvv.exec:\vpdvv.exe186⤵
-
\??\c:\lxlxfxx.exec:\lxlxfxx.exe187⤵
-
\??\c:\rrlfrlf.exec:\rrlfrlf.exe188⤵
-
\??\c:\9nthtt.exec:\9nthtt.exe189⤵
-
\??\c:\thbbhh.exec:\thbbhh.exe190⤵
-
\??\c:\vjjvp.exec:\vjjvp.exe191⤵
-
\??\c:\pjpdv.exec:\pjpdv.exe192⤵
-
\??\c:\fffrxrl.exec:\fffrxrl.exe193⤵
-
\??\c:\ffxffxx.exec:\ffxffxx.exe194⤵
-
\??\c:\nnthtt.exec:\nnthtt.exe195⤵
-
\??\c:\1vvpj.exec:\1vvpj.exe196⤵
-
\??\c:\1jddp.exec:\1jddp.exe197⤵
-
\??\c:\lrlfrrf.exec:\lrlfrrf.exe198⤵
-
\??\c:\5hhthb.exec:\5hhthb.exe199⤵
-
\??\c:\nbtnhh.exec:\nbtnhh.exe200⤵
-
\??\c:\3ddvj.exec:\3ddvj.exe201⤵
-
\??\c:\3vpdv.exec:\3vpdv.exe202⤵
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe203⤵
-
\??\c:\frrfrlx.exec:\frrfrlx.exe204⤵
-
\??\c:\tttnhh.exec:\tttnhh.exe205⤵
-
\??\c:\dpdvj.exec:\dpdvj.exe206⤵
-
\??\c:\vvjvj.exec:\vvjvj.exe207⤵
-
\??\c:\xxxrfxl.exec:\xxxrfxl.exe208⤵
-
\??\c:\nbhthb.exec:\nbhthb.exe209⤵
-
\??\c:\1btnnh.exec:\1btnnh.exe210⤵
-
\??\c:\jvpdp.exec:\jvpdp.exe211⤵
-
\??\c:\7rflxxl.exec:\7rflxxl.exe212⤵
-
\??\c:\rxxrllf.exec:\rxxrllf.exe213⤵
-
\??\c:\tbhtnh.exec:\tbhtnh.exe214⤵
-
\??\c:\hnnbtn.exec:\hnnbtn.exe215⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe216⤵
-
\??\c:\frlxllx.exec:\frlxllx.exe217⤵
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe218⤵
-
\??\c:\fxxxfxr.exec:\fxxxfxr.exe219⤵
-
\??\c:\hthtnb.exec:\hthtnb.exe220⤵
-
\??\c:\pjdpd.exec:\pjdpd.exe221⤵
-
\??\c:\pdpdp.exec:\pdpdp.exe222⤵
-
\??\c:\rflrfxf.exec:\rflrfxf.exe223⤵
-
\??\c:\fxrfxrf.exec:\fxrfxrf.exe224⤵
-
\??\c:\hthbtb.exec:\hthbtb.exe225⤵
-
\??\c:\thhbbb.exec:\thhbbb.exe226⤵
-
\??\c:\dvvjd.exec:\dvvjd.exe227⤵
-
\??\c:\fxlxxrx.exec:\fxlxxrx.exe228⤵
-
\??\c:\xllfffx.exec:\xllfffx.exe229⤵
-
\??\c:\hbttnn.exec:\hbttnn.exe230⤵
-
\??\c:\jddvp.exec:\jddvp.exe231⤵
-
\??\c:\djpdp.exec:\djpdp.exe232⤵
-
\??\c:\flxrfxr.exec:\flxrfxr.exe233⤵
-
\??\c:\frrlxxr.exec:\frrlxxr.exe234⤵
-
\??\c:\thhtnh.exec:\thhtnh.exe235⤵
-
\??\c:\bhnhtt.exec:\bhnhtt.exe236⤵
-
\??\c:\vvpvv.exec:\vvpvv.exe237⤵
-
\??\c:\lllfrll.exec:\lllfrll.exe238⤵
-
\??\c:\rfxlfxr.exec:\rfxlfxr.exe239⤵
-
\??\c:\hthttt.exec:\hthttt.exe240⤵
-
\??\c:\btbtnt.exec:\btbtnt.exe241⤵