Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 13:21
Behavioral task
behavioral1
Sample
545c3bc63113877b39d2ddf6bcea5537e1705d596fee1680fb0828d6b37cbda3_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
545c3bc63113877b39d2ddf6bcea5537e1705d596fee1680fb0828d6b37cbda3_NeikiAnalytics.exe
-
Size
58KB
-
MD5
94426ab1c7e17436a60390a391baba00
-
SHA1
c8437ea7edf6ee91c8e48259e0c89e08e3d40875
-
SHA256
545c3bc63113877b39d2ddf6bcea5537e1705d596fee1680fb0828d6b37cbda3
-
SHA512
5b46e331ee10531519a733f217fe577bcc62018d3cda1e834c393a1f389597038e6b326d34fe08c75228b60b123db934b5ad104042d9f9aac08f374661676775
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+IJ9OJc3n:zhOmTsF93UYfwC6GIoutiTmm+n
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3144-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1240-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1620-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1964-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/648-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1828-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2144-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1752-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-608-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-692-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-709-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-737-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-776-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-778-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvdvv.exe3rrlxxr.exerllxlxf.exehbbtnh.exejvvvv.exevpjjd.exe5xxxlll.exelfxrlfx.exethbbtt.exeddpjv.exejjjjv.exe9xfxxlr.exentnnhh.exehbhhhh.exevdddv.exerrlrrxl.exefxfxffl.exe9hhnnn.exepppjv.exe5xrllrr.exenhhhhh.exenbttnn.exehttnhh.exe3vddp.exehhbbtt.exehbnhbh.exepjjdp.exe3llfrrr.exelffxrll.exebnthbb.exepvjjd.exe3pjdp.exe3llxrrl.exehbthbb.exebnthbt.exejdvpp.exelxlfrlr.exerlfxrxr.exerlxxfrf.exetbbtnn.exevvjjv.exevjjjv.exelxxfxlf.exe3xxxxrr.exetnbbtt.exethnhbb.exepjvdp.exe5pjdv.exexrrlfff.exexrxxrrr.exebttnhb.exethbthb.exevdppd.exedvjdp.exerfxxlll.exebbttnn.exetnbtnn.exe9hnnbb.exeppddp.exe7vppp.exexfxrrll.exe1hbttn.exenhnhbn.exevdvpj.exepid process 1548 dvdvv.exe 3152 3rrlxxr.exe 2188 rllxlxf.exe 4852 hbbtnh.exe 1524 jvvvv.exe 3440 vpjjd.exe 4904 5xxxlll.exe 4324 lfxrlfx.exe 1240 thbbtt.exe 2592 ddpjv.exe 1508 jjjjv.exe 1948 9xfxxlr.exe 1328 ntnnhh.exe 940 hbhhhh.exe 2832 vdddv.exe 3232 rrlrrxl.exe 3396 fxfxffl.exe 2584 9hhnnn.exe 1620 pppjv.exe 2776 5xrllrr.exe 4520 nhhhhh.exe 2376 nbttnn.exe 2696 httnhh.exe 2136 3vddp.exe 4692 hhbbtt.exe 4788 hbnhbh.exe 1964 pjjdp.exe 1456 3llfrrr.exe 3508 lffxrll.exe 2768 bnthbb.exe 208 pvjjd.exe 2692 3pjdp.exe 2540 3llxrrl.exe 2848 hbthbb.exe 5080 bnthbt.exe 944 jdvpp.exe 648 lxlfrlr.exe 4020 rlfxrxr.exe 3668 rlxxfrf.exe 824 tbbtnn.exe 4740 vvjjv.exe 4516 vjjjv.exe 4488 lxxfxlf.exe 3712 3xxxxrr.exe 368 tnbbtt.exe 1704 thnhbb.exe 1612 pjvdp.exe 1836 5pjdv.exe 1232 xrrlfff.exe 632 xrxxrrr.exe 3276 bttnhb.exe 3640 thbthb.exe 3120 vdppd.exe 2796 dvjdp.exe 2592 rfxxlll.exe 3468 bbttnn.exe 2132 tnbtnn.exe 696 9hnnbb.exe 4564 ppddp.exe 2104 7vppp.exe 2984 xfxrrll.exe 3136 1hbttn.exe 940 nhnhbn.exe 4208 vdvpj.exe -
Processes:
resource yara_rule behavioral2/memory/3144-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvdvv.exe upx behavioral2/memory/3144-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1548-7-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3rrlxxr.exe upx behavioral2/memory/3152-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rllxlxf.exe upx behavioral2/memory/2188-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbbtnh.exe upx behavioral2/memory/4852-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1524-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjjd.exe upx behavioral2/memory/3440-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvvvv.exe upx C:\5xxxlll.exe upx C:\lfxrlfx.exe upx behavioral2/memory/4904-39-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thbbtt.exe upx behavioral2/memory/4324-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddpjv.exe upx behavioral2/memory/1240-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2592-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjjv.exe upx behavioral2/memory/1508-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9xfxxlr.exe upx C:\ntnnhh.exe upx behavioral2/memory/1948-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1328-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhhhh.exe upx behavioral2/memory/1328-70-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vdddv.exe upx C:\rrlrrxl.exe upx behavioral2/memory/2832-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxfxffl.exe upx C:\9hhnnn.exe upx behavioral2/memory/3396-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2584-94-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pppjv.exe upx behavioral2/memory/1620-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5xrllrr.exe upx C:\nhhhhh.exe upx behavioral2/memory/2776-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4520-106-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbttnn.exe upx behavioral2/memory/2376-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\httnhh.exe upx C:\3vddp.exe upx C:\hhbbtt.exe upx C:\hbnhbh.exe upx behavioral2/memory/4692-125-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjjdp.exe upx behavioral2/memory/4788-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1964-134-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3llfrrr.exe upx C:\lffxrll.exe upx behavioral2/memory/1456-140-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnthbb.exe upx behavioral2/memory/3508-146-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvjjd.exe upx \??\c:\3pjdp.exe upx behavioral2/memory/2692-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2848-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5080-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/648-171-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
545c3bc63113877b39d2ddf6bcea5537e1705d596fee1680fb0828d6b37cbda3_NeikiAnalytics.exedvdvv.exe3rrlxxr.exerllxlxf.exehbbtnh.exejvvvv.exevpjjd.exe5xxxlll.exelfxrlfx.exethbbtt.exeddpjv.exejjjjv.exe9xfxxlr.exentnnhh.exehbhhhh.exevdddv.exerrlrrxl.exefxfxffl.exe9hhnnn.exepppjv.exe5xrllrr.exenhhhhh.exedescription pid process target process PID 3144 wrote to memory of 1548 3144 545c3bc63113877b39d2ddf6bcea5537e1705d596fee1680fb0828d6b37cbda3_NeikiAnalytics.exe dvdvv.exe PID 3144 wrote to memory of 1548 3144 545c3bc63113877b39d2ddf6bcea5537e1705d596fee1680fb0828d6b37cbda3_NeikiAnalytics.exe dvdvv.exe PID 3144 wrote to memory of 1548 3144 545c3bc63113877b39d2ddf6bcea5537e1705d596fee1680fb0828d6b37cbda3_NeikiAnalytics.exe dvdvv.exe PID 1548 wrote to memory of 3152 1548 dvdvv.exe 3rrlxxr.exe PID 1548 wrote to memory of 3152 1548 dvdvv.exe 3rrlxxr.exe PID 1548 wrote to memory of 3152 1548 dvdvv.exe 3rrlxxr.exe PID 3152 wrote to memory of 2188 3152 3rrlxxr.exe rllxlxf.exe PID 3152 wrote to memory of 2188 3152 3rrlxxr.exe rllxlxf.exe PID 3152 wrote to memory of 2188 3152 3rrlxxr.exe rllxlxf.exe PID 2188 wrote to memory of 4852 2188 rllxlxf.exe hbbtnh.exe PID 2188 wrote to memory of 4852 2188 rllxlxf.exe hbbtnh.exe PID 2188 wrote to memory of 4852 2188 rllxlxf.exe hbbtnh.exe PID 4852 wrote to memory of 1524 4852 hbbtnh.exe jvvvv.exe PID 4852 wrote to memory of 1524 4852 hbbtnh.exe jvvvv.exe PID 4852 wrote to memory of 1524 4852 hbbtnh.exe jvvvv.exe PID 1524 wrote to memory of 3440 1524 jvvvv.exe vpjjd.exe PID 1524 wrote to memory of 3440 1524 jvvvv.exe vpjjd.exe PID 1524 wrote to memory of 3440 1524 jvvvv.exe vpjjd.exe PID 3440 wrote to memory of 4904 3440 vpjjd.exe 5xxxlll.exe PID 3440 wrote to memory of 4904 3440 vpjjd.exe 5xxxlll.exe PID 3440 wrote to memory of 4904 3440 vpjjd.exe 5xxxlll.exe PID 4904 wrote to memory of 4324 4904 5xxxlll.exe lfxrlfx.exe PID 4904 wrote to memory of 4324 4904 5xxxlll.exe lfxrlfx.exe PID 4904 wrote to memory of 4324 4904 5xxxlll.exe lfxrlfx.exe PID 4324 wrote to memory of 1240 4324 lfxrlfx.exe thbbtt.exe PID 4324 wrote to memory of 1240 4324 lfxrlfx.exe thbbtt.exe PID 4324 wrote to memory of 1240 4324 lfxrlfx.exe thbbtt.exe PID 1240 wrote to memory of 2592 1240 thbbtt.exe ddpjv.exe PID 1240 wrote to memory of 2592 1240 thbbtt.exe ddpjv.exe PID 1240 wrote to memory of 2592 1240 thbbtt.exe ddpjv.exe PID 2592 wrote to memory of 1508 2592 ddpjv.exe jjjjv.exe PID 2592 wrote to memory of 1508 2592 ddpjv.exe jjjjv.exe PID 2592 wrote to memory of 1508 2592 ddpjv.exe jjjjv.exe PID 1508 wrote to memory of 1948 1508 jjjjv.exe 9xfxxlr.exe PID 1508 wrote to memory of 1948 1508 jjjjv.exe 9xfxxlr.exe PID 1508 wrote to memory of 1948 1508 jjjjv.exe 9xfxxlr.exe PID 1948 wrote to memory of 1328 1948 9xfxxlr.exe ntnnhh.exe PID 1948 wrote to memory of 1328 1948 9xfxxlr.exe ntnnhh.exe PID 1948 wrote to memory of 1328 1948 9xfxxlr.exe ntnnhh.exe PID 1328 wrote to memory of 940 1328 ntnnhh.exe hbhhhh.exe PID 1328 wrote to memory of 940 1328 ntnnhh.exe hbhhhh.exe PID 1328 wrote to memory of 940 1328 ntnnhh.exe hbhhhh.exe PID 940 wrote to memory of 2832 940 hbhhhh.exe vdddv.exe PID 940 wrote to memory of 2832 940 hbhhhh.exe vdddv.exe PID 940 wrote to memory of 2832 940 hbhhhh.exe vdddv.exe PID 2832 wrote to memory of 3232 2832 vdddv.exe rrlrrxl.exe PID 2832 wrote to memory of 3232 2832 vdddv.exe rrlrrxl.exe PID 2832 wrote to memory of 3232 2832 vdddv.exe rrlrrxl.exe PID 3232 wrote to memory of 3396 3232 rrlrrxl.exe fxfxffl.exe PID 3232 wrote to memory of 3396 3232 rrlrrxl.exe fxfxffl.exe PID 3232 wrote to memory of 3396 3232 rrlrrxl.exe fxfxffl.exe PID 3396 wrote to memory of 2584 3396 fxfxffl.exe 9hhnnn.exe PID 3396 wrote to memory of 2584 3396 fxfxffl.exe 9hhnnn.exe PID 3396 wrote to memory of 2584 3396 fxfxffl.exe 9hhnnn.exe PID 2584 wrote to memory of 1620 2584 9hhnnn.exe pppjv.exe PID 2584 wrote to memory of 1620 2584 9hhnnn.exe pppjv.exe PID 2584 wrote to memory of 1620 2584 9hhnnn.exe pppjv.exe PID 1620 wrote to memory of 2776 1620 pppjv.exe 5xrllrr.exe PID 1620 wrote to memory of 2776 1620 pppjv.exe 5xrllrr.exe PID 1620 wrote to memory of 2776 1620 pppjv.exe 5xrllrr.exe PID 2776 wrote to memory of 4520 2776 5xrllrr.exe nhhhhh.exe PID 2776 wrote to memory of 4520 2776 5xrllrr.exe nhhhhh.exe PID 2776 wrote to memory of 4520 2776 5xrllrr.exe nhhhhh.exe PID 4520 wrote to memory of 2376 4520 nhhhhh.exe nbttnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\545c3bc63113877b39d2ddf6bcea5537e1705d596fee1680fb0828d6b37cbda3_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\545c3bc63113877b39d2ddf6bcea5537e1705d596fee1680fb0828d6b37cbda3_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdvv.exec:\dvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3rrlxxr.exec:\3rrlxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rllxlxf.exec:\rllxlxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbtnh.exec:\hbbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvvv.exec:\jvvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjjd.exec:\vpjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xxxlll.exec:\5xxxlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thbbtt.exec:\thbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddpjv.exec:\ddpjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjjv.exec:\jjjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xfxxlr.exec:\9xfxxlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntnnhh.exec:\ntnnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhhh.exec:\hbhhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdddv.exec:\vdddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrlrrxl.exec:\rrlrrxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxfxffl.exec:\fxfxffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9hhnnn.exec:\9hhnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pppjv.exec:\pppjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xrllrr.exec:\5xrllrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhhhh.exec:\nhhhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbttnn.exec:\nbttnn.exe23⤵
- Executes dropped EXE
-
\??\c:\httnhh.exec:\httnhh.exe24⤵
- Executes dropped EXE
-
\??\c:\3vddp.exec:\3vddp.exe25⤵
- Executes dropped EXE
-
\??\c:\hhbbtt.exec:\hhbbtt.exe26⤵
- Executes dropped EXE
-
\??\c:\hbnhbh.exec:\hbnhbh.exe27⤵
- Executes dropped EXE
-
\??\c:\pjjdp.exec:\pjjdp.exe28⤵
- Executes dropped EXE
-
\??\c:\3llfrrr.exec:\3llfrrr.exe29⤵
- Executes dropped EXE
-
\??\c:\lffxrll.exec:\lffxrll.exe30⤵
- Executes dropped EXE
-
\??\c:\bnthbb.exec:\bnthbb.exe31⤵
- Executes dropped EXE
-
\??\c:\pvjjd.exec:\pvjjd.exe32⤵
- Executes dropped EXE
-
\??\c:\3pjdp.exec:\3pjdp.exe33⤵
- Executes dropped EXE
-
\??\c:\3llxrrl.exec:\3llxrrl.exe34⤵
- Executes dropped EXE
-
\??\c:\hbthbb.exec:\hbthbb.exe35⤵
- Executes dropped EXE
-
\??\c:\bnthbt.exec:\bnthbt.exe36⤵
- Executes dropped EXE
-
\??\c:\jdvpp.exec:\jdvpp.exe37⤵
- Executes dropped EXE
-
\??\c:\lxlfrlr.exec:\lxlfrlr.exe38⤵
- Executes dropped EXE
-
\??\c:\rlfxrxr.exec:\rlfxrxr.exe39⤵
- Executes dropped EXE
-
\??\c:\rlxxfrf.exec:\rlxxfrf.exe40⤵
- Executes dropped EXE
-
\??\c:\tbbtnn.exec:\tbbtnn.exe41⤵
- Executes dropped EXE
-
\??\c:\vvjjv.exec:\vvjjv.exe42⤵
- Executes dropped EXE
-
\??\c:\vjjjv.exec:\vjjjv.exe43⤵
- Executes dropped EXE
-
\??\c:\lxxfxlf.exec:\lxxfxlf.exe44⤵
- Executes dropped EXE
-
\??\c:\3xxxxrr.exec:\3xxxxrr.exe45⤵
- Executes dropped EXE
-
\??\c:\tnbbtt.exec:\tnbbtt.exe46⤵
- Executes dropped EXE
-
\??\c:\thnhbb.exec:\thnhbb.exe47⤵
- Executes dropped EXE
-
\??\c:\pjvdp.exec:\pjvdp.exe48⤵
- Executes dropped EXE
-
\??\c:\5pjdv.exec:\5pjdv.exe49⤵
- Executes dropped EXE
-
\??\c:\xrrlfff.exec:\xrrlfff.exe50⤵
- Executes dropped EXE
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe51⤵
- Executes dropped EXE
-
\??\c:\bttnhb.exec:\bttnhb.exe52⤵
- Executes dropped EXE
-
\??\c:\thbthb.exec:\thbthb.exe53⤵
- Executes dropped EXE
-
\??\c:\vdppd.exec:\vdppd.exe54⤵
- Executes dropped EXE
-
\??\c:\dvjdp.exec:\dvjdp.exe55⤵
- Executes dropped EXE
-
\??\c:\rfxxlll.exec:\rfxxlll.exe56⤵
- Executes dropped EXE
-
\??\c:\bbttnn.exec:\bbttnn.exe57⤵
- Executes dropped EXE
-
\??\c:\tnbtnn.exec:\tnbtnn.exe58⤵
- Executes dropped EXE
-
\??\c:\9hnnbb.exec:\9hnnbb.exe59⤵
- Executes dropped EXE
-
\??\c:\ppddp.exec:\ppddp.exe60⤵
- Executes dropped EXE
-
\??\c:\7vppp.exec:\7vppp.exe61⤵
- Executes dropped EXE
-
\??\c:\xfxrrll.exec:\xfxrrll.exe62⤵
- Executes dropped EXE
-
\??\c:\1hbttn.exec:\1hbttn.exe63⤵
- Executes dropped EXE
-
\??\c:\nhnhbn.exec:\nhnhbn.exe64⤵
- Executes dropped EXE
-
\??\c:\vdvpj.exec:\vdvpj.exe65⤵
- Executes dropped EXE
-
\??\c:\jdvdv.exec:\jdvdv.exe66⤵
-
\??\c:\3rfxxxf.exec:\3rfxxxf.exe67⤵
-
\??\c:\frffxxx.exec:\frffxxx.exe68⤵
-
\??\c:\thhnnn.exec:\thhnnn.exe69⤵
-
\??\c:\tnthnn.exec:\tnthnn.exe70⤵
-
\??\c:\jdvpp.exec:\jdvpp.exe71⤵
-
\??\c:\ppdvj.exec:\ppdvj.exe72⤵
-
\??\c:\xrxxrrf.exec:\xrxxrrf.exe73⤵
-
\??\c:\flflxrf.exec:\flflxrf.exe74⤵
-
\??\c:\1tbbbb.exec:\1tbbbb.exe75⤵
-
\??\c:\bttnht.exec:\bttnht.exe76⤵
-
\??\c:\vjvjp.exec:\vjvjp.exe77⤵
-
\??\c:\ddvdj.exec:\ddvdj.exe78⤵
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe79⤵
-
\??\c:\1rxxrxf.exec:\1rxxrxf.exe80⤵
-
\??\c:\hhnntb.exec:\hhnntb.exe81⤵
-
\??\c:\tthhhn.exec:\tthhhn.exe82⤵
-
\??\c:\pddjd.exec:\pddjd.exe83⤵
-
\??\c:\rxxflxf.exec:\rxxflxf.exe84⤵
-
\??\c:\rrlrrrr.exec:\rrlrrrr.exe85⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe86⤵
-
\??\c:\btnhhh.exec:\btnhhh.exe87⤵
-
\??\c:\jdvdd.exec:\jdvdd.exe88⤵
-
\??\c:\dvjvd.exec:\dvjvd.exe89⤵
-
\??\c:\xxxlxrx.exec:\xxxlxrx.exe90⤵
-
\??\c:\fxrrlrl.exec:\fxrrlrl.exe91⤵
-
\??\c:\bhhbhh.exec:\bhhbhh.exe92⤵
-
\??\c:\bntnhh.exec:\bntnhh.exe93⤵
-
\??\c:\pvvvj.exec:\pvvvj.exe94⤵
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe95⤵
-
\??\c:\jddvp.exec:\jddvp.exe96⤵
-
\??\c:\rxllrrx.exec:\rxllrrx.exe97⤵
-
\??\c:\9lrrfff.exec:\9lrrfff.exe98⤵
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe99⤵
-
\??\c:\hbhbbt.exec:\hbhbbt.exe100⤵
-
\??\c:\bntnbt.exec:\bntnbt.exe101⤵
-
\??\c:\3dpjv.exec:\3dpjv.exe102⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe103⤵
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe104⤵
-
\??\c:\frllffx.exec:\frllffx.exe105⤵
-
\??\c:\7nhbtt.exec:\7nhbtt.exe106⤵
-
\??\c:\nttttb.exec:\nttttb.exe107⤵
-
\??\c:\jddvv.exec:\jddvv.exe108⤵
-
\??\c:\jvpvv.exec:\jvpvv.exe109⤵
-
\??\c:\3xllflr.exec:\3xllflr.exe110⤵
-
\??\c:\lrrrlrr.exec:\lrrrlrr.exe111⤵
-
\??\c:\tnnnhh.exec:\tnnnhh.exe112⤵
-
\??\c:\bhnntb.exec:\bhnntb.exe113⤵
-
\??\c:\vdvjj.exec:\vdvjj.exe114⤵
-
\??\c:\dpjjd.exec:\dpjjd.exe115⤵
-
\??\c:\5rlfxfx.exec:\5rlfxfx.exe116⤵
-
\??\c:\llflxxf.exec:\llflxxf.exe117⤵
-
\??\c:\httnbb.exec:\httnbb.exe118⤵
-
\??\c:\bhnbtn.exec:\bhnbtn.exe119⤵
-
\??\c:\nntnnn.exec:\nntnnn.exe120⤵
-
\??\c:\pjdpv.exec:\pjdpv.exe121⤵
-
\??\c:\xlllllf.exec:\xlllllf.exe122⤵
-
\??\c:\xrrlllf.exec:\xrrlllf.exe123⤵
-
\??\c:\tnntnt.exec:\tnntnt.exe124⤵
-
\??\c:\5bhbtt.exec:\5bhbtt.exe125⤵
-
\??\c:\pvpvv.exec:\pvpvv.exe126⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe127⤵
-
\??\c:\flxlrlf.exec:\flxlrlf.exe128⤵
-
\??\c:\xlfxrlr.exec:\xlfxrlr.exe129⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe130⤵
-
\??\c:\thttnn.exec:\thttnn.exe131⤵
-
\??\c:\vvvvj.exec:\vvvvj.exe132⤵
-
\??\c:\vvpjp.exec:\vvpjp.exe133⤵
-
\??\c:\lfxlrfr.exec:\lfxlrfr.exe134⤵
-
\??\c:\lxlrxxl.exec:\lxlrxxl.exe135⤵
-
\??\c:\btthtn.exec:\btthtn.exe136⤵
-
\??\c:\thhhnh.exec:\thhhnh.exe137⤵
-
\??\c:\ppvvd.exec:\ppvvd.exe138⤵
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe139⤵
-
\??\c:\fxlrrlr.exec:\fxlrrlr.exe140⤵
-
\??\c:\vppjd.exec:\vppjd.exe141⤵
-
\??\c:\rfrlxrl.exec:\rfrlxrl.exe142⤵
-
\??\c:\lrlxrrf.exec:\lrlxrrf.exe143⤵
-
\??\c:\tttbtt.exec:\tttbtt.exe144⤵
-
\??\c:\thhhnh.exec:\thhhnh.exe145⤵
-
\??\c:\jjpdp.exec:\jjpdp.exe146⤵
-
\??\c:\pjddj.exec:\pjddj.exe147⤵
-
\??\c:\xlfxfxf.exec:\xlfxfxf.exe148⤵
-
\??\c:\3nnbtt.exec:\3nnbtt.exe149⤵
-
\??\c:\nbhnbn.exec:\nbhnbn.exe150⤵
-
\??\c:\vjvpd.exec:\vjvpd.exe151⤵
-
\??\c:\jdddj.exec:\jdddj.exe152⤵
-
\??\c:\5llfxxr.exec:\5llfxxr.exe153⤵
-
\??\c:\5rxrfxf.exec:\5rxrfxf.exe154⤵
-
\??\c:\xlrfrll.exec:\xlrfrll.exe155⤵
-
\??\c:\btnhtt.exec:\btnhtt.exe156⤵
-
\??\c:\7hbthh.exec:\7hbthh.exe157⤵
-
\??\c:\jvjjv.exec:\jvjjv.exe158⤵
-
\??\c:\vddvp.exec:\vddvp.exe159⤵
-
\??\c:\xffxrlx.exec:\xffxrlx.exe160⤵
-
\??\c:\rfrxrrl.exec:\rfrxrrl.exe161⤵
-
\??\c:\nnbhht.exec:\nnbhht.exe162⤵
-
\??\c:\tnhthb.exec:\tnhthb.exe163⤵
-
\??\c:\dpdpj.exec:\dpdpj.exe164⤵
-
\??\c:\ppdvj.exec:\ppdvj.exe165⤵
-
\??\c:\frlxfxl.exec:\frlxfxl.exe166⤵
-
\??\c:\xlrfrlr.exec:\xlrfrlr.exe167⤵
-
\??\c:\9lxxxrx.exec:\9lxxxrx.exe168⤵
-
\??\c:\nntbtn.exec:\nntbtn.exe169⤵
-
\??\c:\thhthb.exec:\thhthb.exe170⤵
-
\??\c:\jdppv.exec:\jdppv.exe171⤵
-
\??\c:\jdddp.exec:\jdddp.exe172⤵
-
\??\c:\jjdpd.exec:\jjdpd.exe173⤵
-
\??\c:\rxrlrrf.exec:\rxrlrrf.exe174⤵
-
\??\c:\rxrlrlf.exec:\rxrlrlf.exe175⤵
-
\??\c:\bnttnb.exec:\bnttnb.exe176⤵
-
\??\c:\bhnbbt.exec:\bhnbbt.exe177⤵
-
\??\c:\jpdpv.exec:\jpdpv.exe178⤵
-
\??\c:\lfrfrlf.exec:\lfrfrlf.exe179⤵
-
\??\c:\9hthtt.exec:\9hthtt.exe180⤵
-
\??\c:\1nhbnn.exec:\1nhbnn.exe181⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe182⤵
-
\??\c:\7dvjv.exec:\7dvjv.exe183⤵
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe184⤵
-
\??\c:\rfxrlfr.exec:\rfxrlfr.exe185⤵
-
\??\c:\hnhbnn.exec:\hnhbnn.exe186⤵
-
\??\c:\bbbbbb.exec:\bbbbbb.exe187⤵
-
\??\c:\ddpdp.exec:\ddpdp.exe188⤵
-
\??\c:\pddpd.exec:\pddpd.exe189⤵
-
\??\c:\frlxlfr.exec:\frlxlfr.exe190⤵
-
\??\c:\fllxxrf.exec:\fllxxrf.exe191⤵
-
\??\c:\tbbtnh.exec:\tbbtnh.exe192⤵
-
\??\c:\btnbtn.exec:\btnbtn.exe193⤵
-
\??\c:\djjdd.exec:\djjdd.exe194⤵
-
\??\c:\dvpdp.exec:\dvpdp.exe195⤵
-
\??\c:\rrxlxxl.exec:\rrxlxxl.exe196⤵
-
\??\c:\rrrllff.exec:\rrrllff.exe197⤵
-
\??\c:\bbbtnn.exec:\bbbtnn.exe198⤵
-
\??\c:\1hhbhh.exec:\1hhbhh.exe199⤵
-
\??\c:\ppvpd.exec:\ppvpd.exe200⤵
-
\??\c:\fllfllf.exec:\fllfllf.exe201⤵
-
\??\c:\nbbtnn.exec:\nbbtnn.exe202⤵
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe203⤵
-
\??\c:\tbhhbh.exec:\tbhhbh.exe204⤵
-
\??\c:\1nbtnn.exec:\1nbtnn.exe205⤵
-
\??\c:\pddvp.exec:\pddvp.exe206⤵
-
\??\c:\pjjdj.exec:\pjjdj.exe207⤵
-
\??\c:\rlfrrrr.exec:\rlfrrrr.exe208⤵
-
\??\c:\1rllfff.exec:\1rllfff.exe209⤵
-
\??\c:\hnbbhh.exec:\hnbbhh.exe210⤵
-
\??\c:\vpppj.exec:\vpppj.exe211⤵
-
\??\c:\dpvjj.exec:\dpvjj.exe212⤵
-
\??\c:\ffllrrf.exec:\ffllrrf.exe213⤵
-
\??\c:\nttbbh.exec:\nttbbh.exe214⤵
-
\??\c:\nbnhbn.exec:\nbnhbn.exe215⤵
-
\??\c:\jjvjj.exec:\jjvjj.exe216⤵
-
\??\c:\ddpjj.exec:\ddpjj.exe217⤵
-
\??\c:\ffxfxfl.exec:\ffxfxfl.exe218⤵
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe219⤵
-
\??\c:\bhhbth.exec:\bhhbth.exe220⤵
-
\??\c:\bttnhb.exec:\bttnhb.exe221⤵
-
\??\c:\jjvvj.exec:\jjvvj.exe222⤵
-
\??\c:\djpjv.exec:\djpjv.exe223⤵
-
\??\c:\lllfrrr.exec:\lllfrrr.exe224⤵
-
\??\c:\bbbbnn.exec:\bbbbnn.exe225⤵
-
\??\c:\ntbttt.exec:\ntbttt.exe226⤵
-
\??\c:\pjdvp.exec:\pjdvp.exe227⤵
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe228⤵
-
\??\c:\lxfxrrf.exec:\lxfxrrf.exe229⤵
-
\??\c:\tbbbbb.exec:\tbbbbb.exe230⤵
-
\??\c:\hbthnn.exec:\hbthnn.exe231⤵
-
\??\c:\djpdd.exec:\djpdd.exe232⤵
-
\??\c:\dddjv.exec:\dddjv.exe233⤵
-
\??\c:\lxxlfxx.exec:\lxxlfxx.exe234⤵
-
\??\c:\xlxflxx.exec:\xlxflxx.exe235⤵
-
\??\c:\bbnhhb.exec:\bbnhhb.exe236⤵
-
\??\c:\bnbthh.exec:\bnbthh.exe237⤵
-
\??\c:\pvppp.exec:\pvppp.exe238⤵
-
\??\c:\3djjj.exec:\3djjj.exe239⤵
-
\??\c:\lrxxlll.exec:\lrxxlll.exe240⤵
-
\??\c:\xxfrxll.exec:\xxfrxll.exe241⤵