Analysis
-
max time kernel
98s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 03:51
Behavioral task
behavioral1
Sample
17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe
-
Size
107KB
-
MD5
17a879b03076531eb5b4d727e97f41e0
-
SHA1
87a934717665f3e4ed6712bbd6eec7050cb4928c
-
SHA256
5b238a3ba55d8c5d40ccea94a09cee393d3700cf1f46799bc921c72cdd234f92
-
SHA512
09e5a5ee40a1693e274c9e9b9787843ea14ed37ac3e6328c4b882dd8c731f3d08ad698e990c5eee701f55a4c26ff388d092b362fc0d20379a64c34d3080d7f07
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66krop7Bcgw:kcm4FmowdHoSphraHcp7yV
Malware Config
Signatures
-
Detect Blackmoon payload 60 IoCs
Processes:
resource yara_rule behavioral2/memory/2740-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1676-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/100-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3356-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2212-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1916-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/784-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/936-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-597-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-767-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-779-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hhhbtn.exepvpjv.exexrllffx.exenhhtbt.exebnhhbt.exe3djvj.exedpvjv.exe1lffffl.exexllfrlf.exethnhht.exejpjvj.exefrxfxxl.exelfxlxrf.exebhhhtn.exetnbttn.exedppdd.exexrflxrf.exefffxlfr.exebbhhtn.exebhnbhb.exe3jdjd.exepvjvv.exefllxfxr.exehbnhbt.exetbbbtn.exepdpjj.exerxxflxx.exe1tbbtb.exennttbb.exepvpjj.exelfxlfxl.exefxfxxrl.exehnhbth.exebhhbnb.exejvvpj.exejvvjd.exefrxrlfx.exe3flfxrl.exebntnhh.exe7ntnnn.exevdpvd.exefllxllf.exefrlfxxl.exehbttnn.exe9bnhnh.exeppdpv.exepddvp.exeffrrlll.exelfrlxxx.exebbhbbn.exetbtthb.exepdvpp.exedpjdp.exelxxxlxr.exerfrrlll.exe3hnhnb.exe9nhbbb.exepjvvd.exefxfxfxf.exerffrlxx.exe9ntnhb.exebtbnhh.exejppjd.exe9jdjv.exepid process 3484 hhhbtn.exe 4552 pvpjv.exe 2864 xrllffx.exe 1624 nhhtbt.exe 3032 bnhhbt.exe 1368 3djvj.exe 4512 dpvjv.exe 2520 1lffffl.exe 3244 xllfrlf.exe 4144 thnhht.exe 3840 jpjvj.exe 4076 frxfxxl.exe 3360 lfxlxrf.exe 4900 bhhhtn.exe 3260 tnbttn.exe 3108 dppdd.exe 3252 xrflxrf.exe 2204 fffxlfr.exe 1684 bbhhtn.exe 784 bhnbhb.exe 564 3jdjd.exe 4080 pvjvv.exe 3456 fllxfxr.exe 1676 hbnhbt.exe 2568 tbbbtn.exe 752 pdpjj.exe 5040 rxxflxx.exe 4736 1tbbtb.exe 4336 nnttbb.exe 4380 pvpjj.exe 4404 lfxlfxl.exe 208 fxfxxrl.exe 4300 hnhbth.exe 2852 bhhbnb.exe 5092 jvvpj.exe 4524 jvvjd.exe 3552 frxrlfx.exe 1936 3flfxrl.exe 2116 bntnhh.exe 1484 7ntnnn.exe 1916 vdpvd.exe 4624 fllxllf.exe 8 frlfxxl.exe 4988 hbttnn.exe 4512 9bnhnh.exe 2124 ppdpv.exe 3176 pddvp.exe 1912 ffrrlll.exe 4144 lfrlxxx.exe 996 bbhbbn.exe 4596 tbtthb.exe 2692 pdvpp.exe 2212 dpjdp.exe 4172 lxxxlxr.exe 3356 rfrrlll.exe 3592 3hnhnb.exe 2236 9nhbbb.exe 2080 pjvvd.exe 3464 fxfxfxf.exe 4012 rffrlxx.exe 2288 9ntnhb.exe 2796 btbnhh.exe 1460 jppjd.exe 2732 9jdjv.exe -
Processes:
resource yara_rule behavioral2/memory/2740-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhbtn.exe upx behavioral2/memory/2740-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3484-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvpjv.exe upx behavioral2/memory/4552-13-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrllffx.exe upx behavioral2/memory/4552-18-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bnhhbt.exe upx behavioral2/memory/1624-27-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhhtbt.exe upx behavioral2/memory/2864-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3032-38-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3djvj.exe upx behavioral2/memory/4512-45-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dpvjv.exe upx \??\c:\xllfrlf.exe upx behavioral2/memory/2520-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2520-52-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1lffffl.exe upx C:\jpjvj.exe upx behavioral2/memory/4144-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4076-77-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhhhtn.exe upx \??\c:\tnbttn.exe upx C:\xrflxrf.exe upx C:\bbhhtn.exe upx \??\c:\bhnbhb.exe upx behavioral2/memory/1684-125-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3jdjd.exe upx C:\pvjvv.exe upx \??\c:\fllxfxr.exe upx behavioral2/memory/4080-142-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbbbtn.exe upx behavioral2/memory/1676-153-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxxflxx.exe upx \??\c:\1tbbtb.exe upx \??\c:\lfxlfxl.exe upx behavioral2/memory/208-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4300-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2852-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2236-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5000-335-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4492-370-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2852-367-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/100-357-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2652-350-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/936-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1584-339-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4084-392-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3032-399-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2796-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4012-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2080-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3356-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2212-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2692-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4704-412-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2692-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/996-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2124-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4512-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1224-422-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/8-233-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exehhhbtn.exepvpjv.exexrllffx.exenhhtbt.exebnhhbt.exe3djvj.exedpvjv.exe1lffffl.exexllfrlf.exethnhht.exejpjvj.exefrxfxxl.exelfxlxrf.exebhhhtn.exetnbttn.exedppdd.exexrflxrf.exefffxlfr.exebbhhtn.exebhnbhb.exe3jdjd.exedescription pid process target process PID 2740 wrote to memory of 3484 2740 17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe vvpvj.exe PID 2740 wrote to memory of 3484 2740 17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe vvpvj.exe PID 2740 wrote to memory of 3484 2740 17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe vvpvj.exe PID 3484 wrote to memory of 4552 3484 hhhbtn.exe pvpjv.exe PID 3484 wrote to memory of 4552 3484 hhhbtn.exe pvpjv.exe PID 3484 wrote to memory of 4552 3484 hhhbtn.exe pvpjv.exe PID 4552 wrote to memory of 2864 4552 pvpjv.exe xrllffx.exe PID 4552 wrote to memory of 2864 4552 pvpjv.exe xrllffx.exe PID 4552 wrote to memory of 2864 4552 pvpjv.exe xrllffx.exe PID 2864 wrote to memory of 1624 2864 xrllffx.exe nhhtbt.exe PID 2864 wrote to memory of 1624 2864 xrllffx.exe nhhtbt.exe PID 2864 wrote to memory of 1624 2864 xrllffx.exe nhhtbt.exe PID 1624 wrote to memory of 3032 1624 nhhtbt.exe rflffrr.exe PID 1624 wrote to memory of 3032 1624 nhhtbt.exe rflffrr.exe PID 1624 wrote to memory of 3032 1624 nhhtbt.exe rflffrr.exe PID 3032 wrote to memory of 1368 3032 bnhhbt.exe 3djvj.exe PID 3032 wrote to memory of 1368 3032 bnhhbt.exe 3djvj.exe PID 3032 wrote to memory of 1368 3032 bnhhbt.exe 3djvj.exe PID 1368 wrote to memory of 4512 1368 3djvj.exe flxffxx.exe PID 1368 wrote to memory of 4512 1368 3djvj.exe flxffxx.exe PID 1368 wrote to memory of 4512 1368 3djvj.exe flxffxx.exe PID 4512 wrote to memory of 2520 4512 dpvjv.exe 1lffffl.exe PID 4512 wrote to memory of 2520 4512 dpvjv.exe 1lffffl.exe PID 4512 wrote to memory of 2520 4512 dpvjv.exe 1lffffl.exe PID 2520 wrote to memory of 3244 2520 1lffffl.exe xllfrlf.exe PID 2520 wrote to memory of 3244 2520 1lffffl.exe xllfrlf.exe PID 2520 wrote to memory of 3244 2520 1lffffl.exe xllfrlf.exe PID 3244 wrote to memory of 4144 3244 xllfrlf.exe jpjdp.exe PID 3244 wrote to memory of 4144 3244 xllfrlf.exe jpjdp.exe PID 3244 wrote to memory of 4144 3244 xllfrlf.exe jpjdp.exe PID 4144 wrote to memory of 3840 4144 thnhht.exe jpjvj.exe PID 4144 wrote to memory of 3840 4144 thnhht.exe jpjvj.exe PID 4144 wrote to memory of 3840 4144 thnhht.exe jpjvj.exe PID 3840 wrote to memory of 4076 3840 jpjvj.exe frxfxxl.exe PID 3840 wrote to memory of 4076 3840 jpjvj.exe frxfxxl.exe PID 3840 wrote to memory of 4076 3840 jpjvj.exe frxfxxl.exe PID 4076 wrote to memory of 3360 4076 frxfxxl.exe lfxlxrf.exe PID 4076 wrote to memory of 3360 4076 frxfxxl.exe lfxlxrf.exe PID 4076 wrote to memory of 3360 4076 frxfxxl.exe lfxlxrf.exe PID 3360 wrote to memory of 4900 3360 lfxlxrf.exe bhhhtn.exe PID 3360 wrote to memory of 4900 3360 lfxlxrf.exe bhhhtn.exe PID 3360 wrote to memory of 4900 3360 lfxlxrf.exe bhhhtn.exe PID 4900 wrote to memory of 3260 4900 bhhhtn.exe tnbttn.exe PID 4900 wrote to memory of 3260 4900 bhhhtn.exe tnbttn.exe PID 4900 wrote to memory of 3260 4900 bhhhtn.exe tnbttn.exe PID 3260 wrote to memory of 3108 3260 tnbttn.exe 7jppj.exe PID 3260 wrote to memory of 3108 3260 tnbttn.exe 7jppj.exe PID 3260 wrote to memory of 3108 3260 tnbttn.exe 7jppj.exe PID 3108 wrote to memory of 3252 3108 dppdd.exe xrflxrf.exe PID 3108 wrote to memory of 3252 3108 dppdd.exe xrflxrf.exe PID 3108 wrote to memory of 3252 3108 dppdd.exe xrflxrf.exe PID 3252 wrote to memory of 2204 3252 xrflxrf.exe fffxlfr.exe PID 3252 wrote to memory of 2204 3252 xrflxrf.exe fffxlfr.exe PID 3252 wrote to memory of 2204 3252 xrflxrf.exe fffxlfr.exe PID 2204 wrote to memory of 1684 2204 fffxlfr.exe bbhhtn.exe PID 2204 wrote to memory of 1684 2204 fffxlfr.exe bbhhtn.exe PID 2204 wrote to memory of 1684 2204 fffxlfr.exe bbhhtn.exe PID 1684 wrote to memory of 784 1684 bbhhtn.exe bhnbhb.exe PID 1684 wrote to memory of 784 1684 bbhhtn.exe bhnbhb.exe PID 1684 wrote to memory of 784 1684 bbhhtn.exe bhnbhb.exe PID 784 wrote to memory of 564 784 bhnbhb.exe tbnnht.exe PID 784 wrote to memory of 564 784 bhnbhb.exe tbnnht.exe PID 784 wrote to memory of 564 784 bhnbhb.exe tbnnht.exe PID 564 wrote to memory of 4080 564 3jdjd.exe pvjvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhbtn.exec:\hhhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpjv.exec:\pvpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrllffx.exec:\xrllffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhtbt.exec:\nhhtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhhbt.exec:\bnhhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3djvj.exec:\3djvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpvjv.exec:\dpvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1lffffl.exec:\1lffffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xllfrlf.exec:\xllfrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnhht.exec:\thnhht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpjvj.exec:\jpjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxfxxl.exec:\frxfxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxlxrf.exec:\lfxlxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhhhtn.exec:\bhhhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbttn.exec:\tnbttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dppdd.exec:\dppdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrflxrf.exec:\xrflxrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffxlfr.exec:\fffxlfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhhtn.exec:\bbhhtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnbhb.exec:\bhnbhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3jdjd.exec:\3jdjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvjvv.exec:\pvjvv.exe23⤵
- Executes dropped EXE
-
\??\c:\fllxfxr.exec:\fllxfxr.exe24⤵
- Executes dropped EXE
-
\??\c:\hbnhbt.exec:\hbnhbt.exe25⤵
- Executes dropped EXE
-
\??\c:\tbbbtn.exec:\tbbbtn.exe26⤵
- Executes dropped EXE
-
\??\c:\pdpjj.exec:\pdpjj.exe27⤵
- Executes dropped EXE
-
\??\c:\rxxflxx.exec:\rxxflxx.exe28⤵
- Executes dropped EXE
-
\??\c:\1tbbtb.exec:\1tbbtb.exe29⤵
- Executes dropped EXE
-
\??\c:\nnttbb.exec:\nnttbb.exe30⤵
- Executes dropped EXE
-
\??\c:\pvpjj.exec:\pvpjj.exe31⤵
- Executes dropped EXE
-
\??\c:\lfxlfxl.exec:\lfxlfxl.exe32⤵
- Executes dropped EXE
-
\??\c:\fxfxxrl.exec:\fxfxxrl.exe33⤵
- Executes dropped EXE
-
\??\c:\hnhbth.exec:\hnhbth.exe34⤵
- Executes dropped EXE
-
\??\c:\bhhbnb.exec:\bhhbnb.exe35⤵
- Executes dropped EXE
-
\??\c:\jvvpj.exec:\jvvpj.exe36⤵
- Executes dropped EXE
-
\??\c:\jvvjd.exec:\jvvjd.exe37⤵
- Executes dropped EXE
-
\??\c:\frxrlfx.exec:\frxrlfx.exe38⤵
- Executes dropped EXE
-
\??\c:\3flfxrl.exec:\3flfxrl.exe39⤵
- Executes dropped EXE
-
\??\c:\bntnhh.exec:\bntnhh.exe40⤵
- Executes dropped EXE
-
\??\c:\7ntnnn.exec:\7ntnnn.exe41⤵
- Executes dropped EXE
-
\??\c:\vdpvd.exec:\vdpvd.exe42⤵
- Executes dropped EXE
-
\??\c:\fllxllf.exec:\fllxllf.exe43⤵
- Executes dropped EXE
-
\??\c:\frlfxxl.exec:\frlfxxl.exe44⤵
- Executes dropped EXE
-
\??\c:\hbttnn.exec:\hbttnn.exe45⤵
- Executes dropped EXE
-
\??\c:\9bnhnh.exec:\9bnhnh.exe46⤵
- Executes dropped EXE
-
\??\c:\ppdpv.exec:\ppdpv.exe47⤵
- Executes dropped EXE
-
\??\c:\pddvp.exec:\pddvp.exe48⤵
- Executes dropped EXE
-
\??\c:\ffrrlll.exec:\ffrrlll.exe49⤵
- Executes dropped EXE
-
\??\c:\lfrlxxx.exec:\lfrlxxx.exe50⤵
- Executes dropped EXE
-
\??\c:\bbhbbn.exec:\bbhbbn.exe51⤵
- Executes dropped EXE
-
\??\c:\tbtthb.exec:\tbtthb.exe52⤵
- Executes dropped EXE
-
\??\c:\pdvpp.exec:\pdvpp.exe53⤵
- Executes dropped EXE
-
\??\c:\dpjdp.exec:\dpjdp.exe54⤵
- Executes dropped EXE
-
\??\c:\lxxxlxr.exec:\lxxxlxr.exe55⤵
- Executes dropped EXE
-
\??\c:\rfrrlll.exec:\rfrrlll.exe56⤵
- Executes dropped EXE
-
\??\c:\3hnhnb.exec:\3hnhnb.exe57⤵
- Executes dropped EXE
-
\??\c:\9nhbbb.exec:\9nhbbb.exe58⤵
- Executes dropped EXE
-
\??\c:\pjvvd.exec:\pjvvd.exe59⤵
- Executes dropped EXE
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe60⤵
- Executes dropped EXE
-
\??\c:\rffrlxx.exec:\rffrlxx.exe61⤵
- Executes dropped EXE
-
\??\c:\9ntnhb.exec:\9ntnhb.exe62⤵
- Executes dropped EXE
-
\??\c:\btbnhh.exec:\btbnhh.exe63⤵
- Executes dropped EXE
-
\??\c:\jppjd.exec:\jppjd.exe64⤵
- Executes dropped EXE
-
\??\c:\9jdjv.exec:\9jdjv.exe65⤵
- Executes dropped EXE
-
\??\c:\lrxrrxx.exec:\lrxrrxx.exe66⤵
-
\??\c:\lfflllf.exec:\lfflllf.exe67⤵
-
\??\c:\bhhhbt.exec:\bhhhbt.exe68⤵
-
\??\c:\3hbtnt.exec:\3hbtnt.exe69⤵
-
\??\c:\jjjvj.exec:\jjjvj.exe70⤵
-
\??\c:\pjvjd.exec:\pjvjd.exe71⤵
-
\??\c:\lffrlfx.exec:\lffrlfx.exe72⤵
-
\??\c:\flflrxf.exec:\flflrxf.exe73⤵
-
\??\c:\lrlxrll.exec:\lrlxrll.exe74⤵
-
\??\c:\nhbthb.exec:\nhbthb.exe75⤵
-
\??\c:\thttbh.exec:\thttbh.exe76⤵
-
\??\c:\vvpdv.exec:\vvpdv.exe77⤵
-
\??\c:\ddddd.exec:\ddddd.exe78⤵
-
\??\c:\vvjdp.exec:\vvjdp.exe79⤵
-
\??\c:\3lfrlfr.exec:\3lfrlfr.exe80⤵
-
\??\c:\flrlfxl.exec:\flrlfxl.exe81⤵
-
\??\c:\5nnbtt.exec:\5nnbtt.exe82⤵
-
\??\c:\hbbttt.exec:\hbbttt.exe83⤵
-
\??\c:\jppdv.exec:\jppdv.exe84⤵
-
\??\c:\jppdp.exec:\jppdp.exe85⤵
-
\??\c:\fflxffx.exec:\fflxffx.exe86⤵
-
\??\c:\xrrrlll.exec:\xrrrlll.exe87⤵
-
\??\c:\nhbhhb.exec:\nhbhhb.exe88⤵
-
\??\c:\nhnhnn.exec:\nhnhnn.exe89⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe90⤵
-
\??\c:\vpdvd.exec:\vpdvd.exe91⤵
-
\??\c:\rflffrr.exec:\rflffrr.exe92⤵
-
\??\c:\xffrfxr.exec:\xffrfxr.exe93⤵
-
\??\c:\ttbnbb.exec:\ttbnbb.exe94⤵
-
\??\c:\nnhbnn.exec:\nnhbnn.exe95⤵
-
\??\c:\bhnthb.exec:\bhnthb.exe96⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe97⤵
-
\??\c:\djpdv.exec:\djpdv.exe98⤵
-
\??\c:\rfrflff.exec:\rfrflff.exe99⤵
-
\??\c:\lrllxxr.exec:\lrllxxr.exe100⤵
-
\??\c:\nbhbhb.exec:\nbhbhb.exe101⤵
-
\??\c:\bhhbbb.exec:\bhhbbb.exe102⤵
-
\??\c:\jvppd.exec:\jvppd.exe103⤵
-
\??\c:\xlrlfxf.exec:\xlrlfxf.exe104⤵
-
\??\c:\rffxrrl.exec:\rffxrrl.exe105⤵
-
\??\c:\bnhbtn.exec:\bnhbtn.exe106⤵
-
\??\c:\3tthtt.exec:\3tthtt.exe107⤵
-
\??\c:\pvjjd.exec:\pvjjd.exe108⤵
-
\??\c:\ppvdv.exec:\ppvdv.exe109⤵
-
\??\c:\dpjvj.exec:\dpjvj.exe110⤵
-
\??\c:\xrfllfx.exec:\xrfllfx.exe111⤵
-
\??\c:\nbbbbt.exec:\nbbbbt.exe112⤵
-
\??\c:\btbtnn.exec:\btbtnn.exe113⤵
-
\??\c:\tbbbhh.exec:\tbbbhh.exe114⤵
-
\??\c:\pjjdp.exec:\pjjdp.exe115⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe116⤵
-
\??\c:\xrrfrlr.exec:\xrrfrlr.exe117⤵
-
\??\c:\bhnhhh.exec:\bhnhhh.exe118⤵
-
\??\c:\tbntht.exec:\tbntht.exe119⤵
-
\??\c:\jpvpp.exec:\jpvpp.exe120⤵
-
\??\c:\7djpv.exec:\7djpv.exe121⤵
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe122⤵
-
\??\c:\fxxrrlf.exec:\fxxrrlf.exe123⤵
-
\??\c:\5nnhtn.exec:\5nnhtn.exe124⤵
-
\??\c:\9bbtbt.exec:\9bbtbt.exe125⤵
-
\??\c:\jjdvp.exec:\jjdvp.exe126⤵
-
\??\c:\vjpdv.exec:\vjpdv.exe127⤵
-
\??\c:\lxfrrxl.exec:\lxfrrxl.exe128⤵
-
\??\c:\xfxrxxx.exec:\xfxrxxx.exe129⤵
-
\??\c:\bbhhbt.exec:\bbhhbt.exe130⤵
-
\??\c:\btbthb.exec:\btbthb.exe131⤵
-
\??\c:\9ppjv.exec:\9ppjv.exe132⤵
-
\??\c:\vvpvj.exec:\vvpvj.exe133⤵
-
\??\c:\5xfxrrr.exec:\5xfxrrr.exe134⤵
-
\??\c:\rxrlfxr.exec:\rxrlfxr.exe135⤵
-
\??\c:\tnnhhb.exec:\tnnhhb.exe136⤵
-
\??\c:\thbtbt.exec:\thbtbt.exe137⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe138⤵
-
\??\c:\jvddj.exec:\jvddj.exe139⤵
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe140⤵
-
\??\c:\frlfrrl.exec:\frlfrrl.exe141⤵
-
\??\c:\flxffxx.exec:\flxffxx.exe142⤵
-
\??\c:\tttttn.exec:\tttttn.exe143⤵
-
\??\c:\bthbhh.exec:\bthbhh.exe144⤵
-
\??\c:\3pjvp.exec:\3pjvp.exe145⤵
-
\??\c:\jpjdp.exec:\jpjdp.exe146⤵
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe147⤵
-
\??\c:\rlxxrlf.exec:\rlxxrlf.exe148⤵
-
\??\c:\hbntnb.exec:\hbntnb.exe149⤵
-
\??\c:\nntntt.exec:\nntntt.exe150⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe151⤵
-
\??\c:\llfxlfx.exec:\llfxlfx.exe152⤵
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe153⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe154⤵
-
\??\c:\5dppj.exec:\5dppj.exe155⤵
-
\??\c:\xlrrffr.exec:\xlrrffr.exe156⤵
-
\??\c:\lxxxxfx.exec:\lxxxxfx.exe157⤵
-
\??\c:\nthbtb.exec:\nthbtb.exe158⤵
-
\??\c:\tbnnht.exec:\tbnnht.exe159⤵
-
\??\c:\pvvvd.exec:\pvvvd.exe160⤵
-
\??\c:\fxflrrl.exec:\fxflrrl.exe161⤵
-
\??\c:\fxlxlxf.exec:\fxlxlxf.exe162⤵
-
\??\c:\nbhbtt.exec:\nbhbtt.exe163⤵
-
\??\c:\hbtnhb.exec:\hbtnhb.exe164⤵
-
\??\c:\vjjjd.exec:\vjjjd.exe165⤵
-
\??\c:\rffrlfx.exec:\rffrlfx.exe166⤵
-
\??\c:\xrrrffx.exec:\xrrrffx.exe167⤵
-
\??\c:\tnnnhn.exec:\tnnnhn.exe168⤵
-
\??\c:\ntbthh.exec:\ntbthh.exe169⤵
-
\??\c:\pppvj.exec:\pppvj.exe170⤵
-
\??\c:\dvpvv.exec:\dvpvv.exe171⤵
-
\??\c:\frrrllf.exec:\frrrllf.exe172⤵
-
\??\c:\xrxxffr.exec:\xrxxffr.exe173⤵
-
\??\c:\btnhtt.exec:\btnhtt.exe174⤵
-
\??\c:\nhtbbb.exec:\nhtbbb.exe175⤵
-
\??\c:\ppjjd.exec:\ppjjd.exe176⤵
-
\??\c:\ddvpp.exec:\ddvpp.exe177⤵
-
\??\c:\rxrfrrx.exec:\rxrfrrx.exe178⤵
-
\??\c:\lxffxff.exec:\lxffxff.exe179⤵
-
\??\c:\rrllfll.exec:\rrllfll.exe180⤵
-
\??\c:\nnhhbb.exec:\nnhhbb.exe181⤵
-
\??\c:\bhnnnt.exec:\bhnnnt.exe182⤵
-
\??\c:\dvddd.exec:\dvddd.exe183⤵
-
\??\c:\dpvdv.exec:\dpvdv.exe184⤵
-
\??\c:\lxxxlll.exec:\lxxxlll.exe185⤵
-
\??\c:\ffrrxxx.exec:\ffrrxxx.exe186⤵
-
\??\c:\llffxfr.exec:\llffxfr.exe187⤵
-
\??\c:\hbtnht.exec:\hbtnht.exe188⤵
-
\??\c:\hhtnhh.exec:\hhtnhh.exe189⤵
-
\??\c:\pjddp.exec:\pjddp.exe190⤵
-
\??\c:\dpjpj.exec:\dpjpj.exe191⤵
-
\??\c:\fxxxrff.exec:\fxxxrff.exe192⤵
-
\??\c:\rlfxrxl.exec:\rlfxrxl.exe193⤵
-
\??\c:\fxffffl.exec:\fxffffl.exe194⤵
-
\??\c:\ttbbbb.exec:\ttbbbb.exe195⤵
-
\??\c:\tttnnn.exec:\tttnnn.exe196⤵
-
\??\c:\vdpjj.exec:\vdpjj.exe197⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe198⤵
-
\??\c:\7jppj.exec:\7jppj.exe199⤵
-
\??\c:\rfxxxxx.exec:\rfxxxxx.exe200⤵
-
\??\c:\lxxfllf.exec:\lxxfllf.exe201⤵
-
\??\c:\xlffxxr.exec:\xlffxxr.exe202⤵
-
\??\c:\ttntth.exec:\ttntth.exe203⤵
-
\??\c:\thnnhn.exec:\thnnhn.exe204⤵
-
\??\c:\jjjjv.exec:\jjjjv.exe205⤵
-
\??\c:\dpjjd.exec:\dpjjd.exe206⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe207⤵
-
\??\c:\rlllfll.exec:\rlllfll.exe208⤵
-
\??\c:\fxlfffx.exec:\fxlfffx.exe209⤵
-
\??\c:\ttbhtt.exec:\ttbhtt.exe210⤵
-
\??\c:\hbtnhn.exec:\hbtnhn.exe211⤵
-
\??\c:\1dpvj.exec:\1dpvj.exe212⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe213⤵
-
\??\c:\ffrlfff.exec:\ffrlfff.exe214⤵
-
\??\c:\lxflffx.exec:\lxflffx.exe215⤵
-
\??\c:\nnbbhh.exec:\nnbbhh.exe216⤵
-
\??\c:\tbhhbb.exec:\tbhhbb.exe217⤵
-
\??\c:\ddpjd.exec:\ddpjd.exe218⤵
-
\??\c:\pddvv.exec:\pddvv.exe219⤵
-
\??\c:\lfrllfx.exec:\lfrllfx.exe220⤵
-
\??\c:\hnhthb.exec:\hnhthb.exe221⤵
-
\??\c:\hhnhnh.exec:\hhnhnh.exe222⤵
-
\??\c:\dddvv.exec:\dddvv.exe223⤵
-
\??\c:\ddpdv.exec:\ddpdv.exe224⤵
-
\??\c:\dvddv.exec:\dvddv.exe225⤵
-
\??\c:\xrlrrll.exec:\xrlrrll.exe226⤵
-
\??\c:\rfllfff.exec:\rfllfff.exe227⤵
-
\??\c:\flffxrx.exec:\flffxrx.exe228⤵
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe229⤵
-
\??\c:\jjvpj.exec:\jjvpj.exe230⤵
-
\??\c:\nbbntt.exec:\nbbntt.exe231⤵
-
\??\c:\pddpj.exec:\pddpj.exe232⤵
-
\??\c:\jddvj.exec:\jddvj.exe233⤵
-
\??\c:\ntbtnh.exec:\ntbtnh.exe234⤵
-
\??\c:\pddjj.exec:\pddjj.exe235⤵
-
\??\c:\jjppj.exec:\jjppj.exe236⤵
-
\??\c:\7lxlffx.exec:\7lxlffx.exe237⤵
-
\??\c:\xxlrrff.exec:\xxlrrff.exe238⤵
-
\??\c:\ppppd.exec:\ppppd.exe239⤵
-
\??\c:\xfffxfr.exec:\xfffxfr.exe240⤵
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe241⤵