Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:26
Behavioral task
behavioral1
Sample
06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe
-
Size
90KB
-
MD5
06fe7e6a7665c0be5e8adae752958070
-
SHA1
0bb046849b144b5ac5c038df90ce50770bbd333e
-
SHA256
8dd9ff98571721363fefd78f8a4eac190a5aac96b2f1a287fef1cf8a3ae378e4
-
SHA512
2e31962000f5c922d946932ee8f7bbd0eb85654ad370afd40b0d35646d09ad5a8af4347f3753b6d8670281474245433c13b2546186c504467d3a3e1fb67ad322
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0s1rR6Q:8hOmTsF93UYfwC6GIout0fmCiiiXAwKQ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3080-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2840-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4132-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/892-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/688-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1460-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-632-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-751-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-767-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tbnhtt.exenbhbtt.exejvjjd.exejjdvp.exeffxrfff.exe3hnhbh.exennthbh.exe5jvpd.exevvvpp.exexfrlffx.exebnnnhh.exeppjdj.exerflfxxr.exe5nbbhh.exejpppj.exexlxrxxx.exehbhntt.exehttnhh.exe5vpvj.exerllrllf.exexlfxrrl.exe3nntnb.exedpdvv.exe3vpvp.exe5ttnbb.exebtbnhh.exe9hbtnn.exevpdvj.exexxxfxrr.exerffxxxr.exebhtnnn.exenntthb.exedvpvp.exexlxxrrr.exenhnnhh.exe1pdvv.exe3jvpj.exe7xfxrll.exenhbtbb.exenhbttt.exepjppd.exevppjd.exellfxxfl.exetnbthh.exevjpjd.exe5vvdv.exexxlfxxr.exebthbhn.exepjvvp.exepdvpp.exexrfxrrl.exe1rrrllf.exebnbtbb.exettbttt.exedpppj.exevppjd.exelfrrlll.exelrxrrrr.exethnnhn.exedddvp.exedvpvd.exerlrrflf.exetnbtnn.exebbhbtt.exepid process 2452 tbnhtt.exe 4904 nbhbtt.exe 4612 jvjjd.exe 4068 jjdvp.exe 4436 ffxrfff.exe 2840 3hnhbh.exe 4084 nnthbh.exe 1748 5jvpd.exe 3464 vvvpp.exe 4764 xfrlffx.exe 2572 bnnnhh.exe 4852 ppjdj.exe 5096 rflfxxr.exe 752 5nbbhh.exe 1548 jpppj.exe 1840 xlxrxxx.exe 4456 hbhntt.exe 4552 httnhh.exe 3568 5vpvj.exe 316 rllrllf.exe 2172 xlfxrrl.exe 3280 3nntnb.exe 2552 dpdvv.exe 3588 3vpvp.exe 4804 5ttnbb.exe 3492 btbnhh.exe 940 9hbtnn.exe 3152 vpdvj.exe 1536 xxxfxrr.exe 1932 rffxxxr.exe 4500 bhtnnn.exe 3876 nntthb.exe 3620 dvpvp.exe 1452 xlxxrrr.exe 4132 nhnnhh.exe 4920 1pdvv.exe 1176 3jvpj.exe 3776 7xfxrll.exe 2328 nhbtbb.exe 4972 nhbttt.exe 4892 pjppd.exe 1760 vppjd.exe 3244 llfxxfl.exe 1488 tnbthh.exe 4416 vjpjd.exe 3036 5vvdv.exe 4788 xxlfxxr.exe 3444 bthbhn.exe 1884 pjvvp.exe 4612 pdvpp.exe 2596 xrfxrrl.exe 4068 1rrrllf.exe 3064 bnbtbb.exe 3380 ttbttt.exe 4648 dpppj.exe 1928 vppjd.exe 892 lfrrlll.exe 3464 lrxrrrr.exe 4764 thnnhn.exe 1992 dddvp.exe 3432 dvpvd.exe 2272 rlrrflf.exe 2352 tnbtnn.exe 4836 bbhbtt.exe -
Processes:
resource yara_rule behavioral2/memory/3080-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbnhtt.exe upx behavioral2/memory/3080-5-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbhbtt.exe upx behavioral2/memory/4904-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvjjd.exe upx behavioral2/memory/4612-16-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjdvp.exe upx behavioral2/memory/4068-26-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ffxrfff.exe upx C:\3hnhbh.exe upx behavioral2/memory/4436-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2840-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnthbh.exe upx behavioral2/memory/4084-36-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5jvpd.exe upx behavioral2/memory/1748-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvpp.exe upx behavioral2/memory/3464-45-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xfrlffx.exe upx behavioral2/memory/3464-49-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnnnhh.exe upx behavioral2/memory/4764-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjdj.exe upx behavioral2/memory/2572-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4852-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rflfxxr.exe upx C:\5nbbhh.exe upx C:\jpppj.exe upx behavioral2/memory/752-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxrxxx.exe upx behavioral2/memory/1548-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1840-83-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbhntt.exe upx behavioral2/memory/4456-86-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\httnhh.exe upx \??\c:\5vpvj.exe upx C:\rllrllf.exe upx behavioral2/memory/3568-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlfxrrl.exe upx behavioral2/memory/316-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3nntnb.exe upx behavioral2/memory/2172-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpdvv.exe upx behavioral2/memory/3280-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2552-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3vpvp.exe upx C:\5ttnbb.exe upx C:\btbnhh.exe upx C:\9hbtnn.exe upx C:\vpdvj.exe upx C:\xxxfxrr.exe upx behavioral2/memory/3152-138-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rffxxxr.exe upx behavioral2/memory/1932-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhtnnn.exe upx C:\nntthb.exe upx behavioral2/memory/3876-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1452-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4132-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4920-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1176-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1760-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3244-182-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exetbnhtt.exenbhbtt.exejvjjd.exejjdvp.exeffxrfff.exe3hnhbh.exennthbh.exe5jvpd.exevvvpp.exexfrlffx.exebnnnhh.exeppjdj.exerflfxxr.exe5nbbhh.exejpppj.exexlxrxxx.exehbhntt.exehttnhh.exe5vpvj.exerllrllf.exexlfxrrl.exedescription pid process target process PID 3080 wrote to memory of 2452 3080 06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe tbnhtt.exe PID 3080 wrote to memory of 2452 3080 06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe tbnhtt.exe PID 3080 wrote to memory of 2452 3080 06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe tbnhtt.exe PID 2452 wrote to memory of 4904 2452 tbnhtt.exe nbhbtt.exe PID 2452 wrote to memory of 4904 2452 tbnhtt.exe nbhbtt.exe PID 2452 wrote to memory of 4904 2452 tbnhtt.exe nbhbtt.exe PID 4904 wrote to memory of 4612 4904 nbhbtt.exe jvjjd.exe PID 4904 wrote to memory of 4612 4904 nbhbtt.exe jvjjd.exe PID 4904 wrote to memory of 4612 4904 nbhbtt.exe jvjjd.exe PID 4612 wrote to memory of 4068 4612 jvjjd.exe jjdvp.exe PID 4612 wrote to memory of 4068 4612 jvjjd.exe jjdvp.exe PID 4612 wrote to memory of 4068 4612 jvjjd.exe jjdvp.exe PID 4068 wrote to memory of 4436 4068 jjdvp.exe ffxrfff.exe PID 4068 wrote to memory of 4436 4068 jjdvp.exe ffxrfff.exe PID 4068 wrote to memory of 4436 4068 jjdvp.exe ffxrfff.exe PID 4436 wrote to memory of 2840 4436 ffxrfff.exe 3hnhbh.exe PID 4436 wrote to memory of 2840 4436 ffxrfff.exe 3hnhbh.exe PID 4436 wrote to memory of 2840 4436 ffxrfff.exe 3hnhbh.exe PID 2840 wrote to memory of 4084 2840 3hnhbh.exe nnthbh.exe PID 2840 wrote to memory of 4084 2840 3hnhbh.exe nnthbh.exe PID 2840 wrote to memory of 4084 2840 3hnhbh.exe nnthbh.exe PID 4084 wrote to memory of 1748 4084 nnthbh.exe 5jvpd.exe PID 4084 wrote to memory of 1748 4084 nnthbh.exe 5jvpd.exe PID 4084 wrote to memory of 1748 4084 nnthbh.exe 5jvpd.exe PID 1748 wrote to memory of 3464 1748 5jvpd.exe vvvpp.exe PID 1748 wrote to memory of 3464 1748 5jvpd.exe vvvpp.exe PID 1748 wrote to memory of 3464 1748 5jvpd.exe vvvpp.exe PID 3464 wrote to memory of 4764 3464 vvvpp.exe xfrlffx.exe PID 3464 wrote to memory of 4764 3464 vvvpp.exe xfrlffx.exe PID 3464 wrote to memory of 4764 3464 vvvpp.exe xfrlffx.exe PID 4764 wrote to memory of 2572 4764 xfrlffx.exe bnnnhh.exe PID 4764 wrote to memory of 2572 4764 xfrlffx.exe bnnnhh.exe PID 4764 wrote to memory of 2572 4764 xfrlffx.exe bnnnhh.exe PID 2572 wrote to memory of 4852 2572 bnnnhh.exe ppjdj.exe PID 2572 wrote to memory of 4852 2572 bnnnhh.exe ppjdj.exe PID 2572 wrote to memory of 4852 2572 bnnnhh.exe ppjdj.exe PID 4852 wrote to memory of 5096 4852 ppjdj.exe rflfxxr.exe PID 4852 wrote to memory of 5096 4852 ppjdj.exe rflfxxr.exe PID 4852 wrote to memory of 5096 4852 ppjdj.exe rflfxxr.exe PID 5096 wrote to memory of 752 5096 rflfxxr.exe 5nbbhh.exe PID 5096 wrote to memory of 752 5096 rflfxxr.exe 5nbbhh.exe PID 5096 wrote to memory of 752 5096 rflfxxr.exe 5nbbhh.exe PID 752 wrote to memory of 1548 752 5nbbhh.exe jpppj.exe PID 752 wrote to memory of 1548 752 5nbbhh.exe jpppj.exe PID 752 wrote to memory of 1548 752 5nbbhh.exe jpppj.exe PID 1548 wrote to memory of 1840 1548 jpppj.exe xlxrxxx.exe PID 1548 wrote to memory of 1840 1548 jpppj.exe xlxrxxx.exe PID 1548 wrote to memory of 1840 1548 jpppj.exe xlxrxxx.exe PID 1840 wrote to memory of 4456 1840 xlxrxxx.exe hbhntt.exe PID 1840 wrote to memory of 4456 1840 xlxrxxx.exe hbhntt.exe PID 1840 wrote to memory of 4456 1840 xlxrxxx.exe hbhntt.exe PID 4456 wrote to memory of 4552 4456 hbhntt.exe httnhh.exe PID 4456 wrote to memory of 4552 4456 hbhntt.exe httnhh.exe PID 4456 wrote to memory of 4552 4456 hbhntt.exe httnhh.exe PID 4552 wrote to memory of 3568 4552 httnhh.exe 5vpvj.exe PID 4552 wrote to memory of 3568 4552 httnhh.exe 5vpvj.exe PID 4552 wrote to memory of 3568 4552 httnhh.exe 5vpvj.exe PID 3568 wrote to memory of 316 3568 5vpvj.exe rllrllf.exe PID 3568 wrote to memory of 316 3568 5vpvj.exe rllrllf.exe PID 3568 wrote to memory of 316 3568 5vpvj.exe rllrllf.exe PID 316 wrote to memory of 2172 316 rllrllf.exe xlfxrrl.exe PID 316 wrote to memory of 2172 316 rllrllf.exe xlfxrrl.exe PID 316 wrote to memory of 2172 316 rllrllf.exe xlfxrrl.exe PID 2172 wrote to memory of 3280 2172 xlfxrrl.exe 3nntnb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\tbnhtt.exec:\tbnhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhbtt.exec:\nbhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvjjd.exec:\jvjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjdvp.exec:\jjdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxrfff.exec:\ffxrfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3hnhbh.exec:\3hnhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnthbh.exec:\nnthbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5jvpd.exec:\5jvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvpp.exec:\vvvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfrlffx.exec:\xfrlffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnnhh.exec:\bnnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjdj.exec:\ppjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflfxxr.exec:\rflfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nbbhh.exec:\5nbbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpppj.exec:\jpppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlxrxxx.exec:\xlxrxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhntt.exec:\hbhntt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\httnhh.exec:\httnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5vpvj.exec:\5vpvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rllrllf.exec:\rllrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nntnb.exec:\3nntnb.exe23⤵
- Executes dropped EXE
-
\??\c:\dpdvv.exec:\dpdvv.exe24⤵
- Executes dropped EXE
-
\??\c:\3vpvp.exec:\3vpvp.exe25⤵
- Executes dropped EXE
-
\??\c:\5ttnbb.exec:\5ttnbb.exe26⤵
- Executes dropped EXE
-
\??\c:\btbnhh.exec:\btbnhh.exe27⤵
- Executes dropped EXE
-
\??\c:\9hbtnn.exec:\9hbtnn.exe28⤵
- Executes dropped EXE
-
\??\c:\vpdvj.exec:\vpdvj.exe29⤵
- Executes dropped EXE
-
\??\c:\xxxfxrr.exec:\xxxfxrr.exe30⤵
- Executes dropped EXE
-
\??\c:\rffxxxr.exec:\rffxxxr.exe31⤵
- Executes dropped EXE
-
\??\c:\bhtnnn.exec:\bhtnnn.exe32⤵
- Executes dropped EXE
-
\??\c:\nntthb.exec:\nntthb.exe33⤵
- Executes dropped EXE
-
\??\c:\dvpvp.exec:\dvpvp.exe34⤵
- Executes dropped EXE
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe35⤵
- Executes dropped EXE
-
\??\c:\nhnnhh.exec:\nhnnhh.exe36⤵
- Executes dropped EXE
-
\??\c:\1pdvv.exec:\1pdvv.exe37⤵
- Executes dropped EXE
-
\??\c:\3jvpj.exec:\3jvpj.exe38⤵
- Executes dropped EXE
-
\??\c:\7xfxrll.exec:\7xfxrll.exe39⤵
- Executes dropped EXE
-
\??\c:\nhbtbb.exec:\nhbtbb.exe40⤵
- Executes dropped EXE
-
\??\c:\nhbttt.exec:\nhbttt.exe41⤵
- Executes dropped EXE
-
\??\c:\pjppd.exec:\pjppd.exe42⤵
- Executes dropped EXE
-
\??\c:\vppjd.exec:\vppjd.exe43⤵
- Executes dropped EXE
-
\??\c:\llfxxfl.exec:\llfxxfl.exe44⤵
- Executes dropped EXE
-
\??\c:\tnbthh.exec:\tnbthh.exe45⤵
- Executes dropped EXE
-
\??\c:\vjpjd.exec:\vjpjd.exe46⤵
- Executes dropped EXE
-
\??\c:\5vvdv.exec:\5vvdv.exe47⤵
- Executes dropped EXE
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe48⤵
- Executes dropped EXE
-
\??\c:\bthbhn.exec:\bthbhn.exe49⤵
- Executes dropped EXE
-
\??\c:\pjvvp.exec:\pjvvp.exe50⤵
- Executes dropped EXE
-
\??\c:\pdvpp.exec:\pdvpp.exe51⤵
- Executes dropped EXE
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe52⤵
- Executes dropped EXE
-
\??\c:\1rrrllf.exec:\1rrrllf.exe53⤵
- Executes dropped EXE
-
\??\c:\bnbtbb.exec:\bnbtbb.exe54⤵
- Executes dropped EXE
-
\??\c:\ttbttt.exec:\ttbttt.exe55⤵
- Executes dropped EXE
-
\??\c:\dpppj.exec:\dpppj.exe56⤵
- Executes dropped EXE
-
\??\c:\vppjd.exec:\vppjd.exe57⤵
- Executes dropped EXE
-
\??\c:\lfrrlll.exec:\lfrrlll.exe58⤵
- Executes dropped EXE
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe59⤵
- Executes dropped EXE
-
\??\c:\thnnhn.exec:\thnnhn.exe60⤵
- Executes dropped EXE
-
\??\c:\dddvp.exec:\dddvp.exe61⤵
- Executes dropped EXE
-
\??\c:\dvpvd.exec:\dvpvd.exe62⤵
- Executes dropped EXE
-
\??\c:\rlrrflf.exec:\rlrrflf.exe63⤵
- Executes dropped EXE
-
\??\c:\tnbtnn.exec:\tnbtnn.exe64⤵
- Executes dropped EXE
-
\??\c:\bbhbtt.exec:\bbhbtt.exe65⤵
- Executes dropped EXE
-
\??\c:\jjddp.exec:\jjddp.exe66⤵
-
\??\c:\vjvjd.exec:\vjvjd.exe67⤵
-
\??\c:\rllrlrl.exec:\rllrlrl.exe68⤵
-
\??\c:\fxllffx.exec:\fxllffx.exe69⤵
-
\??\c:\tnhhnh.exec:\tnhhnh.exe70⤵
-
\??\c:\5ttbth.exec:\5ttbth.exe71⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe72⤵
-
\??\c:\ppvpv.exec:\ppvpv.exe73⤵
-
\??\c:\ffxrrlx.exec:\ffxrrlx.exe74⤵
-
\??\c:\xlrrlll.exec:\xlrrlll.exe75⤵
-
\??\c:\nnnbnh.exec:\nnnbnh.exe76⤵
-
\??\c:\5vppp.exec:\5vppp.exe77⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe78⤵
-
\??\c:\lxxrlff.exec:\lxxrlff.exe79⤵
-
\??\c:\ttbbtn.exec:\ttbbtn.exe80⤵
-
\??\c:\3nthbh.exec:\3nthbh.exe81⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe82⤵
-
\??\c:\dppjd.exec:\dppjd.exe83⤵
-
\??\c:\rrllxxl.exec:\rrllxxl.exe84⤵
-
\??\c:\bbtnnt.exec:\bbtnnt.exe85⤵
-
\??\c:\nhtttt.exec:\nhtttt.exe86⤵
-
\??\c:\vjvdd.exec:\vjvdd.exe87⤵
-
\??\c:\3rxxxxx.exec:\3rxxxxx.exe88⤵
-
\??\c:\xfxfrrx.exec:\xfxfrrx.exe89⤵
-
\??\c:\ttnhnh.exec:\ttnhnh.exe90⤵
-
\??\c:\hbnhbb.exec:\hbnhbb.exe91⤵
-
\??\c:\dpvjj.exec:\dpvjj.exe92⤵
-
\??\c:\ddpvv.exec:\ddpvv.exe93⤵
-
\??\c:\lfffxxx.exec:\lfffxxx.exe94⤵
-
\??\c:\ffrxxxx.exec:\ffrxxxx.exe95⤵
-
\??\c:\btbbtt.exec:\btbbtt.exe96⤵
-
\??\c:\5ntttt.exec:\5ntttt.exe97⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe98⤵
-
\??\c:\jvdvd.exec:\jvdvd.exe99⤵
-
\??\c:\frlrrrr.exec:\frlrrrr.exe100⤵
-
\??\c:\lrxxxxl.exec:\lrxxxxl.exe101⤵
-
\??\c:\nbhbtb.exec:\nbhbtb.exe102⤵
-
\??\c:\hhttnh.exec:\hhttnh.exe103⤵
-
\??\c:\9djdp.exec:\9djdp.exe104⤵
-
\??\c:\vdvdv.exec:\vdvdv.exe105⤵
-
\??\c:\1flfxxr.exec:\1flfxxr.exe106⤵
-
\??\c:\lfrrrrl.exec:\lfrrrrl.exe107⤵
-
\??\c:\nbbttn.exec:\nbbttn.exe108⤵
-
\??\c:\djppj.exec:\djppj.exe109⤵
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe110⤵
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe111⤵
-
\??\c:\bhhtnb.exec:\bhhtnb.exe112⤵
-
\??\c:\thtnhh.exec:\thtnhh.exe113⤵
-
\??\c:\9pvvp.exec:\9pvvp.exe114⤵
-
\??\c:\7vppp.exec:\7vppp.exe115⤵
-
\??\c:\7fffrxr.exec:\7fffrxr.exe116⤵
-
\??\c:\rllfxxx.exec:\rllfxxx.exe117⤵
-
\??\c:\hnbtnn.exec:\hnbtnn.exe118⤵
-
\??\c:\djvvv.exec:\djvvv.exe119⤵
-
\??\c:\1dpjp.exec:\1dpjp.exe120⤵
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe121⤵
-
\??\c:\bbnnbb.exec:\bbnnbb.exe122⤵
-
\??\c:\9ddvv.exec:\9ddvv.exe123⤵
-
\??\c:\jpvvd.exec:\jpvvd.exe124⤵
-
\??\c:\9xlfxrl.exec:\9xlfxrl.exe125⤵
-
\??\c:\rflxxxr.exec:\rflxxxr.exe126⤵
-
\??\c:\hnbtnh.exec:\hnbtnh.exe127⤵
-
\??\c:\9jppd.exec:\9jppd.exe128⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe129⤵
-
\??\c:\flrrfff.exec:\flrrfff.exe130⤵
-
\??\c:\lrffrxr.exec:\lrffrxr.exe131⤵
-
\??\c:\htttnn.exec:\htttnn.exe132⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe133⤵
-
\??\c:\vdpvp.exec:\vdpvp.exe134⤵
-
\??\c:\rrffrrl.exec:\rrffrrl.exe135⤵
-
\??\c:\vppjj.exec:\vppjj.exe136⤵
-
\??\c:\3rfxrrl.exec:\3rfxrrl.exe137⤵
-
\??\c:\1fxrrrl.exec:\1fxrrrl.exe138⤵
-
\??\c:\5hntnt.exec:\5hntnt.exe139⤵
-
\??\c:\hbhhbb.exec:\hbhhbb.exe140⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe141⤵
-
\??\c:\xlrlffx.exec:\xlrlffx.exe142⤵
-
\??\c:\rlrlfff.exec:\rlrlfff.exe143⤵
-
\??\c:\3nnnbn.exec:\3nnnbn.exe144⤵
-
\??\c:\btbttt.exec:\btbttt.exe145⤵
-
\??\c:\jjjjv.exec:\jjjjv.exe146⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe147⤵
-
\??\c:\1rxxrxx.exec:\1rxxrxx.exe148⤵
-
\??\c:\frlfxxr.exec:\frlfxxr.exe149⤵
-
\??\c:\3hnnnn.exec:\3hnnnn.exe150⤵
-
\??\c:\hbtnnn.exec:\hbtnnn.exe151⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe152⤵
-
\??\c:\ddpvv.exec:\ddpvv.exe153⤵
-
\??\c:\lrffllx.exec:\lrffllx.exe154⤵
-
\??\c:\xrrrlrl.exec:\xrrrlrl.exe155⤵
-
\??\c:\tnnhhn.exec:\tnnhhn.exe156⤵
-
\??\c:\5ntnbb.exec:\5ntnbb.exe157⤵
-
\??\c:\jdpjj.exec:\jdpjj.exe158⤵
-
\??\c:\rlrlfff.exec:\rlrlfff.exe159⤵
-
\??\c:\xllfxxf.exec:\xllfxxf.exe160⤵
-
\??\c:\btbttt.exec:\btbttt.exe161⤵
-
\??\c:\jvddd.exec:\jvddd.exe162⤵
-
\??\c:\ppvpv.exec:\ppvpv.exe163⤵
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe164⤵
-
\??\c:\lxxrlxx.exec:\lxxrlxx.exe165⤵
-
\??\c:\7bnhbb.exec:\7bnhbb.exe166⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe167⤵
-
\??\c:\vdvvp.exec:\vdvvp.exe168⤵
-
\??\c:\3djdv.exec:\3djdv.exe169⤵
-
\??\c:\1xxrrrl.exec:\1xxrrrl.exe170⤵
-
\??\c:\lllxrfr.exec:\lllxrfr.exe171⤵
-
\??\c:\tbthhh.exec:\tbthhh.exe172⤵
-
\??\c:\5ntntt.exec:\5ntntt.exe173⤵
-
\??\c:\pvpjv.exec:\pvpjv.exe174⤵
-
\??\c:\pdvvj.exec:\pdvvj.exe175⤵
-
\??\c:\pjvpj.exec:\pjvpj.exe176⤵
-
\??\c:\1lllxxx.exec:\1lllxxx.exe177⤵
-
\??\c:\xfllfff.exec:\xfllfff.exe178⤵
-
\??\c:\nhttth.exec:\nhttth.exe179⤵
-
\??\c:\9hhnnn.exec:\9hhnnn.exe180⤵
-
\??\c:\dpjdv.exec:\dpjdv.exe181⤵
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe182⤵
-
\??\c:\jjvvd.exec:\jjvvd.exe183⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe184⤵
-
\??\c:\lfrlffx.exec:\lfrlffx.exe185⤵
-
\??\c:\llllfxr.exec:\llllfxr.exe186⤵
-
\??\c:\5ntttt.exec:\5ntttt.exe187⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe188⤵
-
\??\c:\jppjv.exec:\jppjv.exe189⤵
-
\??\c:\dvvpd.exec:\dvvpd.exe190⤵
-
\??\c:\fxlffxx.exec:\fxlffxx.exe191⤵
-
\??\c:\bhhbtt.exec:\bhhbtt.exe192⤵
-
\??\c:\hhhbtt.exec:\hhhbtt.exe193⤵
-
\??\c:\nbhbtt.exec:\nbhbtt.exe194⤵
-
\??\c:\dpjjp.exec:\dpjjp.exe195⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe196⤵
-
\??\c:\ppvvp.exec:\ppvvp.exe197⤵
-
\??\c:\rrfrlxx.exec:\rrfrlxx.exe198⤵
-
\??\c:\xxllrxf.exec:\xxllrxf.exe199⤵
-
\??\c:\btnnht.exec:\btnnht.exe200⤵
-
\??\c:\nnbbtt.exec:\nnbbtt.exe201⤵
-
\??\c:\bhttnn.exec:\bhttnn.exe202⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe203⤵
-
\??\c:\jjddv.exec:\jjddv.exe204⤵
-
\??\c:\7rfxxfx.exec:\7rfxxfx.exe205⤵
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe206⤵
-
\??\c:\9hhbtb.exec:\9hhbtb.exe207⤵
-
\??\c:\hnhbbb.exec:\hnhbbb.exe208⤵
-
\??\c:\jdddv.exec:\jdddv.exe209⤵
-
\??\c:\7vppd.exec:\7vppd.exe210⤵
-
\??\c:\frfffff.exec:\frfffff.exe211⤵
-
\??\c:\lrxfxll.exec:\lrxfxll.exe212⤵
-
\??\c:\nthbtt.exec:\nthbtt.exe213⤵
-
\??\c:\7hthnn.exec:\7hthnn.exe214⤵
-
\??\c:\pppjd.exec:\pppjd.exe215⤵
-
\??\c:\vppjv.exec:\vppjv.exe216⤵
-
\??\c:\llllllx.exec:\llllllx.exe217⤵
-
\??\c:\flxrrrl.exec:\flxrrrl.exe218⤵
-
\??\c:\hbhhbb.exec:\hbhhbb.exe219⤵
-
\??\c:\bbbtnb.exec:\bbbtnb.exe220⤵
-
\??\c:\djdvv.exec:\djdvv.exe221⤵
-
\??\c:\9pvpj.exec:\9pvpj.exe222⤵
-
\??\c:\flxxrxx.exec:\flxxrxx.exe223⤵
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe224⤵
-
\??\c:\lxffflf.exec:\lxffflf.exe225⤵
-
\??\c:\btbbtn.exec:\btbbtn.exe226⤵
-
\??\c:\vdppp.exec:\vdppp.exe227⤵
-
\??\c:\rlrlfrr.exec:\rlrlfrr.exe228⤵
-
\??\c:\fflffff.exec:\fflffff.exe229⤵
-
\??\c:\ppppp.exec:\ppppp.exe230⤵
-
\??\c:\xrlrrrr.exec:\xrlrrrr.exe231⤵
-
\??\c:\bnnbnh.exec:\bnnbnh.exe232⤵
-
\??\c:\pvddv.exec:\pvddv.exe233⤵
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe234⤵
-
\??\c:\frlffxx.exec:\frlffxx.exe235⤵
-
\??\c:\1tttbt.exec:\1tttbt.exe236⤵
-
\??\c:\btnnhh.exec:\btnnhh.exe237⤵
-
\??\c:\jvjdp.exec:\jvjdp.exe238⤵
-
\??\c:\pvvdd.exec:\pvvdd.exe239⤵
-
\??\c:\xrxrxrf.exec:\xrxrxrf.exe240⤵
-
\??\c:\nnttbb.exec:\nnttbb.exe241⤵