Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 03:57
Behavioral task
behavioral1
Sample
1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe
-
Size
75KB
-
MD5
1922618342dfb1d62f1cedce4c6b7d90
-
SHA1
0f8b9beaac510c54e413e6c450426dc99ced2816
-
SHA256
f92a5ef402178f316dabef6a2e5d87fef0c65770fac7f087d2907ccb923b2528
-
SHA512
b678b8a607152c4d721fce53eb83006a0827dd0860b180e576861c5d089acdb8140230260a1bd52d2733701f925ff631d297801ee2ae5c46f664d0c92cfd4116
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE8V:9hOmTsF93UYfwC6GIoutz5yLpOSDv
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2256-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/516-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3864-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/656-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-576-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1780-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-672-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-761-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-780-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3820-820-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-837-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-861-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnnttn.exeddpvp.exehhbbbb.exedvdvv.exelfxxlxx.exehnbttn.exedjpjd.exexrflrll.exeppdvv.exexrffllx.exebnhnhh.exeppvdd.exe7httbb.exedvjdp.exebbhhhn.exetnnnnn.exe1fxrlll.exerrxxxxx.exebbnhtt.exehbhbbb.exejddvv.exefflllll.exerrfllrr.exenhhbhh.exevpvvv.exe3dppd.exellxrrxx.exennnnhh.exedpvvv.exepvvpd.exelllfxxx.exehbthbn.exedpvpv.exethhbbh.exetnhbnt.exeppddv.exerlllfxx.exerlllfff.exebbbbbh.exe1jdvv.exepdppp.exeffrlrrf.exebbnnhh.exehthbtn.exe1pvvd.exe3rffrrf.exebnnbbb.exehbbbbt.exejvdvv.exelxrlllr.exelfffllr.exebnnnnn.exedvdvp.exedvjpp.exerrlxrrr.exebhnntt.exennthht.exejjjjd.exerlflxlx.exenbhbtt.exebhhhhh.exepjddd.exe9fxxrrl.exettbtth.exepid process 4680 tnnttn.exe 2872 ddpvp.exe 212 hhbbbb.exe 932 dvdvv.exe 4560 lfxxlxx.exe 2748 hnbttn.exe 4960 djpjd.exe 5104 xrflrll.exe 2296 ppdvv.exe 516 xrffllx.exe 2204 bnhnhh.exe 2892 ppvdd.exe 4992 7httbb.exe 1448 dvjdp.exe 1436 bbhhhn.exe 1764 tnnnnn.exe 4204 1fxrlll.exe 1576 rrxxxxx.exe 1168 bbnhtt.exe 2652 hbhbbb.exe 3588 jddvv.exe 552 fflllll.exe 512 rrfllrr.exe 1624 nhhbhh.exe 3904 vpvvv.exe 1356 3dppd.exe 644 llxrrxx.exe 4736 nnnnhh.exe 3312 dpvvv.exe 2420 pvvpd.exe 3160 lllfxxx.exe 3892 hbthbn.exe 1000 dpvpv.exe 4476 thhbbh.exe 3968 tnhbnt.exe 3552 ppddv.exe 3336 rlllfxx.exe 1492 rlllfff.exe 4612 bbbbbh.exe 3268 1jdvv.exe 1500 pdppp.exe 2696 ffrlrrf.exe 1976 bbnnhh.exe 4680 hthbtn.exe 1816 1pvvd.exe 3352 3rffrrf.exe 2668 bnnbbb.exe 4508 hbbbbt.exe 1360 jvdvv.exe 1880 lxrlllr.exe 740 lfffllr.exe 4464 bnnnnn.exe 2828 dvdvp.exe 3568 dvjpp.exe 4732 rrlxrrr.exe 992 bhnntt.exe 4544 nnthht.exe 1340 jjjjd.exe 948 rlflxlx.exe 3604 nbhbtt.exe 3232 bhhhhh.exe 1136 pjddd.exe 4852 9fxxrrl.exe 1764 ttbtth.exe -
Processes:
resource yara_rule behavioral2/memory/2256-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnttn.exe upx behavioral2/memory/2256-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4680-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddpvp.exe upx C:\hhbbbb.exe upx behavioral2/memory/2872-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvdvv.exe upx behavioral2/memory/212-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/932-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxxlxx.exe upx behavioral2/memory/932-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4560-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnbttn.exe upx behavioral2/memory/2748-39-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djpjd.exe upx behavioral2/memory/4960-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrflrll.exe upx C:\ppdvv.exe upx C:\xrffllx.exe upx behavioral2/memory/2296-59-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnhnhh.exe upx behavioral2/memory/516-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppvdd.exe upx behavioral2/memory/2204-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7httbb.exe upx behavioral2/memory/2892-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4992-80-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvjdp.exe upx C:\bbhhhn.exe upx behavioral2/memory/1448-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnnnn.exe upx behavioral2/memory/1436-95-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1fxrlll.exe upx behavioral2/memory/1764-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4204-104-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrxxxxx.exe upx behavioral2/memory/1168-116-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbnhtt.exe upx behavioral2/memory/1576-113-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhbbb.exe upx C:\jddvv.exe upx behavioral2/memory/3588-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2652-125-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fflllll.exe upx behavioral2/memory/552-134-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrfllrr.exe upx behavioral2/memory/512-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1624-146-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhhbhh.exe upx behavioral2/memory/1356-158-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3dppd.exe upx behavioral2/memory/3904-150-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vpvvv.exe upx \??\c:\llxrrxx.exe upx behavioral2/memory/644-163-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpvvv.exe upx \??\c:\nnnnhh.exe upx behavioral2/memory/644-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4736-173-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvvpd.exe upx C:\lllfxxx.exe upx behavioral2/memory/2420-182-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbthbn.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exetnnttn.exeddpvp.exehhbbbb.exedvdvv.exelfxxlxx.exehnbttn.exedjpjd.exexrflrll.exeppdvv.exexrffllx.exebnhnhh.exeppvdd.exe7httbb.exedvjdp.exebbhhhn.exetnnnnn.exe1fxrlll.exerrxxxxx.exebbnhtt.exehbhbbb.exejddvv.exedescription pid process target process PID 2256 wrote to memory of 4680 2256 1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe tnnttn.exe PID 2256 wrote to memory of 4680 2256 1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe tnnttn.exe PID 2256 wrote to memory of 4680 2256 1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe tnnttn.exe PID 4680 wrote to memory of 2872 4680 tnnttn.exe ddpvp.exe PID 4680 wrote to memory of 2872 4680 tnnttn.exe ddpvp.exe PID 4680 wrote to memory of 2872 4680 tnnttn.exe ddpvp.exe PID 2872 wrote to memory of 212 2872 ddpvp.exe hhbbbb.exe PID 2872 wrote to memory of 212 2872 ddpvp.exe hhbbbb.exe PID 2872 wrote to memory of 212 2872 ddpvp.exe hhbbbb.exe PID 212 wrote to memory of 932 212 hhbbbb.exe dvdvv.exe PID 212 wrote to memory of 932 212 hhbbbb.exe dvdvv.exe PID 212 wrote to memory of 932 212 hhbbbb.exe dvdvv.exe PID 932 wrote to memory of 4560 932 dvdvv.exe lfxxlxx.exe PID 932 wrote to memory of 4560 932 dvdvv.exe lfxxlxx.exe PID 932 wrote to memory of 4560 932 dvdvv.exe lfxxlxx.exe PID 4560 wrote to memory of 2748 4560 lfxxlxx.exe hnbttn.exe PID 4560 wrote to memory of 2748 4560 lfxxlxx.exe hnbttn.exe PID 4560 wrote to memory of 2748 4560 lfxxlxx.exe hnbttn.exe PID 2748 wrote to memory of 4960 2748 hnbttn.exe djpjd.exe PID 2748 wrote to memory of 4960 2748 hnbttn.exe djpjd.exe PID 2748 wrote to memory of 4960 2748 hnbttn.exe djpjd.exe PID 4960 wrote to memory of 5104 4960 djpjd.exe xrflrll.exe PID 4960 wrote to memory of 5104 4960 djpjd.exe xrflrll.exe PID 4960 wrote to memory of 5104 4960 djpjd.exe xrflrll.exe PID 5104 wrote to memory of 2296 5104 xrflrll.exe ppdvv.exe PID 5104 wrote to memory of 2296 5104 xrflrll.exe ppdvv.exe PID 5104 wrote to memory of 2296 5104 xrflrll.exe ppdvv.exe PID 2296 wrote to memory of 516 2296 ppdvv.exe xrffllx.exe PID 2296 wrote to memory of 516 2296 ppdvv.exe xrffllx.exe PID 2296 wrote to memory of 516 2296 ppdvv.exe xrffllx.exe PID 516 wrote to memory of 2204 516 xrffllx.exe bnhnhh.exe PID 516 wrote to memory of 2204 516 xrffllx.exe bnhnhh.exe PID 516 wrote to memory of 2204 516 xrffllx.exe bnhnhh.exe PID 2204 wrote to memory of 2892 2204 bnhnhh.exe ppvdd.exe PID 2204 wrote to memory of 2892 2204 bnhnhh.exe ppvdd.exe PID 2204 wrote to memory of 2892 2204 bnhnhh.exe ppvdd.exe PID 2892 wrote to memory of 4992 2892 ppvdd.exe 7httbb.exe PID 2892 wrote to memory of 4992 2892 ppvdd.exe 7httbb.exe PID 2892 wrote to memory of 4992 2892 ppvdd.exe 7httbb.exe PID 4992 wrote to memory of 1448 4992 7httbb.exe dvjdp.exe PID 4992 wrote to memory of 1448 4992 7httbb.exe dvjdp.exe PID 4992 wrote to memory of 1448 4992 7httbb.exe dvjdp.exe PID 1448 wrote to memory of 1436 1448 dvjdp.exe bbhhhn.exe PID 1448 wrote to memory of 1436 1448 dvjdp.exe bbhhhn.exe PID 1448 wrote to memory of 1436 1448 dvjdp.exe bbhhhn.exe PID 1436 wrote to memory of 1764 1436 bbhhhn.exe tnnnnn.exe PID 1436 wrote to memory of 1764 1436 bbhhhn.exe tnnnnn.exe PID 1436 wrote to memory of 1764 1436 bbhhhn.exe tnnnnn.exe PID 1764 wrote to memory of 4204 1764 tnnnnn.exe 1fxrlll.exe PID 1764 wrote to memory of 4204 1764 tnnnnn.exe 1fxrlll.exe PID 1764 wrote to memory of 4204 1764 tnnnnn.exe 1fxrlll.exe PID 4204 wrote to memory of 1576 4204 1fxrlll.exe rrxxxxx.exe PID 4204 wrote to memory of 1576 4204 1fxrlll.exe rrxxxxx.exe PID 4204 wrote to memory of 1576 4204 1fxrlll.exe rrxxxxx.exe PID 1576 wrote to memory of 1168 1576 rrxxxxx.exe bbnhtt.exe PID 1576 wrote to memory of 1168 1576 rrxxxxx.exe bbnhtt.exe PID 1576 wrote to memory of 1168 1576 rrxxxxx.exe bbnhtt.exe PID 1168 wrote to memory of 2652 1168 bbnhtt.exe hbhbbb.exe PID 1168 wrote to memory of 2652 1168 bbnhtt.exe hbhbbb.exe PID 1168 wrote to memory of 2652 1168 bbnhtt.exe hbhbbb.exe PID 2652 wrote to memory of 3588 2652 hbhbbb.exe jddvv.exe PID 2652 wrote to memory of 3588 2652 hbhbbb.exe jddvv.exe PID 2652 wrote to memory of 3588 2652 hbhbbb.exe jddvv.exe PID 3588 wrote to memory of 552 3588 jddvv.exe fflllll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1922618342dfb1d62f1cedce4c6b7d90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnttn.exec:\tnnttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddpvp.exec:\ddpvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbbbb.exec:\hhbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdvv.exec:\dvdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxxlxx.exec:\lfxxlxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbttn.exec:\hnbttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djpjd.exec:\djpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrflrll.exec:\xrflrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppdvv.exec:\ppdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrffllx.exec:\xrffllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhnhh.exec:\bnhnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvdd.exec:\ppvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7httbb.exec:\7httbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvjdp.exec:\dvjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhhhn.exec:\bbhhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnnnn.exec:\tnnnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1fxrlll.exec:\1fxrlll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnhtt.exec:\bbnhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbbb.exec:\hbhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddvv.exec:\jddvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflllll.exec:\fflllll.exe23⤵
- Executes dropped EXE
-
\??\c:\rrfllrr.exec:\rrfllrr.exe24⤵
- Executes dropped EXE
-
\??\c:\nhhbhh.exec:\nhhbhh.exe25⤵
- Executes dropped EXE
-
\??\c:\vpvvv.exec:\vpvvv.exe26⤵
- Executes dropped EXE
-
\??\c:\3dppd.exec:\3dppd.exe27⤵
- Executes dropped EXE
-
\??\c:\llxrrxx.exec:\llxrrxx.exe28⤵
- Executes dropped EXE
-
\??\c:\nnnnhh.exec:\nnnnhh.exe29⤵
- Executes dropped EXE
-
\??\c:\dpvvv.exec:\dpvvv.exe30⤵
- Executes dropped EXE
-
\??\c:\pvvpd.exec:\pvvpd.exe31⤵
- Executes dropped EXE
-
\??\c:\lllfxxx.exec:\lllfxxx.exe32⤵
- Executes dropped EXE
-
\??\c:\hbthbn.exec:\hbthbn.exe33⤵
- Executes dropped EXE
-
\??\c:\dpvpv.exec:\dpvpv.exe34⤵
- Executes dropped EXE
-
\??\c:\thhbbh.exec:\thhbbh.exe35⤵
- Executes dropped EXE
-
\??\c:\tnhbnt.exec:\tnhbnt.exe36⤵
- Executes dropped EXE
-
\??\c:\ppddv.exec:\ppddv.exe37⤵
- Executes dropped EXE
-
\??\c:\rlllfxx.exec:\rlllfxx.exe38⤵
- Executes dropped EXE
-
\??\c:\rlllfff.exec:\rlllfff.exe39⤵
- Executes dropped EXE
-
\??\c:\bbbbbh.exec:\bbbbbh.exe40⤵
- Executes dropped EXE
-
\??\c:\1jdvv.exec:\1jdvv.exe41⤵
- Executes dropped EXE
-
\??\c:\pdppp.exec:\pdppp.exe42⤵
- Executes dropped EXE
-
\??\c:\ffrlrrf.exec:\ffrlrrf.exe43⤵
- Executes dropped EXE
-
\??\c:\bbnnhh.exec:\bbnnhh.exe44⤵
- Executes dropped EXE
-
\??\c:\hthbtn.exec:\hthbtn.exe45⤵
- Executes dropped EXE
-
\??\c:\1pvvd.exec:\1pvvd.exe46⤵
- Executes dropped EXE
-
\??\c:\3rffrrf.exec:\3rffrrf.exe47⤵
- Executes dropped EXE
-
\??\c:\bnnbbb.exec:\bnnbbb.exe48⤵
- Executes dropped EXE
-
\??\c:\hbbbbt.exec:\hbbbbt.exe49⤵
- Executes dropped EXE
-
\??\c:\jvdvv.exec:\jvdvv.exe50⤵
- Executes dropped EXE
-
\??\c:\lxrlllr.exec:\lxrlllr.exe51⤵
- Executes dropped EXE
-
\??\c:\lfffllr.exec:\lfffllr.exe52⤵
- Executes dropped EXE
-
\??\c:\bnnnnn.exec:\bnnnnn.exe53⤵
- Executes dropped EXE
-
\??\c:\dvdvp.exec:\dvdvp.exe54⤵
- Executes dropped EXE
-
\??\c:\dvjpp.exec:\dvjpp.exe55⤵
- Executes dropped EXE
-
\??\c:\rrlxrrr.exec:\rrlxrrr.exe56⤵
- Executes dropped EXE
-
\??\c:\bhnntt.exec:\bhnntt.exe57⤵
- Executes dropped EXE
-
\??\c:\nnthht.exec:\nnthht.exe58⤵
- Executes dropped EXE
-
\??\c:\jjjjd.exec:\jjjjd.exe59⤵
- Executes dropped EXE
-
\??\c:\rlflxlx.exec:\rlflxlx.exe60⤵
- Executes dropped EXE
-
\??\c:\nbhbtt.exec:\nbhbtt.exe61⤵
- Executes dropped EXE
-
\??\c:\bhhhhh.exec:\bhhhhh.exe62⤵
- Executes dropped EXE
-
\??\c:\pjddd.exec:\pjddd.exe63⤵
- Executes dropped EXE
-
\??\c:\9fxxrrl.exec:\9fxxrrl.exe64⤵
- Executes dropped EXE
-
\??\c:\ttbtth.exec:\ttbtth.exe65⤵
- Executes dropped EXE
-
\??\c:\thhbtb.exec:\thhbtb.exe66⤵
-
\??\c:\rlllrxr.exec:\rlllrxr.exe67⤵
-
\??\c:\bbhhhb.exec:\bbhhhb.exe68⤵
-
\??\c:\djvvp.exec:\djvvp.exe69⤵
-
\??\c:\rllfrrf.exec:\rllfrrf.exe70⤵
-
\??\c:\hbttht.exec:\hbttht.exe71⤵
-
\??\c:\vjvvj.exec:\vjvvj.exe72⤵
-
\??\c:\xfffxff.exec:\xfffxff.exe73⤵
-
\??\c:\tnhnhh.exec:\tnhnhh.exe74⤵
-
\??\c:\bnnhnn.exec:\bnnhnn.exe75⤵
-
\??\c:\pjdvv.exec:\pjdvv.exe76⤵
-
\??\c:\lfflfrr.exec:\lfflfrr.exe77⤵
-
\??\c:\llffflf.exec:\llffflf.exe78⤵
-
\??\c:\nbhbtn.exec:\nbhbtn.exe79⤵
-
\??\c:\pjvpj.exec:\pjvpj.exe80⤵
-
\??\c:\fxrxrrx.exec:\fxrxrrx.exe81⤵
-
\??\c:\rfrllrl.exec:\rfrllrl.exe82⤵
-
\??\c:\tnhhnn.exec:\tnhhnn.exe83⤵
-
\??\c:\djddp.exec:\djddp.exe84⤵
-
\??\c:\3lfxlfx.exec:\3lfxlfx.exe85⤵
-
\??\c:\tnnnhh.exec:\tnnnhh.exe86⤵
-
\??\c:\djppj.exec:\djppj.exe87⤵
-
\??\c:\dvddd.exec:\dvddd.exe88⤵
-
\??\c:\rxfxrll.exec:\rxfxrll.exe89⤵
-
\??\c:\xrfxrfx.exec:\xrfxrfx.exe90⤵
-
\??\c:\tntntt.exec:\tntntt.exe91⤵
-
\??\c:\djppp.exec:\djppp.exe92⤵
-
\??\c:\fxrrlll.exec:\fxrrlll.exe93⤵
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe94⤵
-
\??\c:\tttnbb.exec:\tttnbb.exe95⤵
-
\??\c:\vddvv.exec:\vddvv.exe96⤵
-
\??\c:\jpdpd.exec:\jpdpd.exe97⤵
-
\??\c:\bbbtnn.exec:\bbbtnn.exe98⤵
-
\??\c:\jvvvp.exec:\jvvvp.exe99⤵
-
\??\c:\lxflrff.exec:\lxflrff.exe100⤵
-
\??\c:\xllrxxf.exec:\xllrxxf.exe101⤵
-
\??\c:\hhntbb.exec:\hhntbb.exe102⤵
-
\??\c:\pvvvj.exec:\pvvvj.exe103⤵
-
\??\c:\ddvdj.exec:\ddvdj.exe104⤵
-
\??\c:\lxlrrxx.exec:\lxlrrxx.exe105⤵
-
\??\c:\bttttt.exec:\bttttt.exe106⤵
-
\??\c:\btbtbh.exec:\btbtbh.exe107⤵
-
\??\c:\vdjvp.exec:\vdjvp.exe108⤵
-
\??\c:\lflflll.exec:\lflflll.exe109⤵
-
\??\c:\htttnn.exec:\htttnn.exe110⤵
-
\??\c:\httnbb.exec:\httnbb.exe111⤵
-
\??\c:\vdjvj.exec:\vdjvj.exe112⤵
-
\??\c:\fxlfrll.exec:\fxlfrll.exe113⤵
-
\??\c:\flllxlr.exec:\flllxlr.exe114⤵
-
\??\c:\nhbnnt.exec:\nhbnnt.exe115⤵
-
\??\c:\hnbhnt.exec:\hnbhnt.exe116⤵
-
\??\c:\jvvpp.exec:\jvvpp.exe117⤵
-
\??\c:\xflfxlx.exec:\xflfxlx.exe118⤵
-
\??\c:\ntnnnb.exec:\ntnnnb.exe119⤵
-
\??\c:\vdddd.exec:\vdddd.exe120⤵
-
\??\c:\lrxlfxl.exec:\lrxlfxl.exe121⤵
-
\??\c:\tnnttt.exec:\tnnttt.exe122⤵
-
\??\c:\ddjdd.exec:\ddjdd.exe123⤵
-
\??\c:\pppvd.exec:\pppvd.exe124⤵
-
\??\c:\lxrxlll.exec:\lxrxlll.exe125⤵
-
\??\c:\tthhbt.exec:\tthhbt.exe126⤵
-
\??\c:\ddvpp.exec:\ddvpp.exe127⤵
-
\??\c:\nbhnnh.exec:\nbhnnh.exe128⤵
-
\??\c:\vvdvd.exec:\vvdvd.exe129⤵
-
\??\c:\rfrfrfr.exec:\rfrfrfr.exe130⤵
-
\??\c:\nhbttb.exec:\nhbttb.exe131⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe132⤵
-
\??\c:\nhnbnb.exec:\nhnbnb.exe133⤵
-
\??\c:\rfrlrll.exec:\rfrlrll.exe134⤵
-
\??\c:\ffxxxfr.exec:\ffxxxfr.exe135⤵
-
\??\c:\thnbnh.exec:\thnbnh.exe136⤵
-
\??\c:\vddvv.exec:\vddvv.exe137⤵
-
\??\c:\djvdj.exec:\djvdj.exe138⤵
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe139⤵
-
\??\c:\bnbbhn.exec:\bnbbhn.exe140⤵
-
\??\c:\hthhth.exec:\hthhth.exe141⤵
-
\??\c:\jdddj.exec:\jdddj.exe142⤵
-
\??\c:\frfrrff.exec:\frfrrff.exe143⤵
-
\??\c:\xfxrxxl.exec:\xfxrxxl.exe144⤵
-
\??\c:\bnthbn.exec:\bnthbn.exe145⤵
-
\??\c:\jjvpp.exec:\jjvpp.exe146⤵
-
\??\c:\dppjj.exec:\dppjj.exe147⤵
-
\??\c:\xffxrll.exec:\xffxrll.exe148⤵
-
\??\c:\nbbnhh.exec:\nbbnhh.exe149⤵
-
\??\c:\3hnhbb.exec:\3hnhbb.exe150⤵
-
\??\c:\jjpjd.exec:\jjpjd.exe151⤵
-
\??\c:\9jdpj.exec:\9jdpj.exe152⤵
-
\??\c:\flrrlrr.exec:\flrrlrr.exe153⤵
-
\??\c:\bhthhb.exec:\bhthhb.exe154⤵
-
\??\c:\hhhbtn.exec:\hhhbtn.exe155⤵
-
\??\c:\pddvj.exec:\pddvj.exe156⤵
-
\??\c:\jjdvp.exec:\jjdvp.exe157⤵
-
\??\c:\xlrllrr.exec:\xlrllrr.exe158⤵
-
\??\c:\7bttnn.exec:\7bttnn.exe159⤵
-
\??\c:\nbbtnh.exec:\nbbtnh.exe160⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe161⤵
-
\??\c:\lrxrllf.exec:\lrxrllf.exe162⤵
-
\??\c:\nhnnnt.exec:\nhnnnt.exe163⤵
-
\??\c:\5htttt.exec:\5htttt.exe164⤵
-
\??\c:\vvppp.exec:\vvppp.exe165⤵
-
\??\c:\fffllrx.exec:\fffllrx.exe166⤵
-
\??\c:\3tbbhn.exec:\3tbbhn.exe167⤵
-
\??\c:\tbbbth.exec:\tbbbth.exe168⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe169⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe170⤵
-
\??\c:\9ffxrlf.exec:\9ffxrlf.exe171⤵
-
\??\c:\9tbtht.exec:\9tbtht.exe172⤵
-
\??\c:\pvjjv.exec:\pvjjv.exe173⤵
-
\??\c:\lfrxxxx.exec:\lfrxxxx.exe174⤵
-
\??\c:\7hntbb.exec:\7hntbb.exe175⤵
-
\??\c:\hhhnth.exec:\hhhnth.exe176⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe177⤵
-
\??\c:\lflxlfr.exec:\lflxlfr.exe178⤵
-
\??\c:\hbhnbb.exec:\hbhnbb.exe179⤵
-
\??\c:\hbnhnn.exec:\hbnhnn.exe180⤵
-
\??\c:\pppjd.exec:\pppjd.exe181⤵
-
\??\c:\lxllxrx.exec:\lxllxrx.exe182⤵
-
\??\c:\bhbnbn.exec:\bhbnbn.exe183⤵
-
\??\c:\ppddj.exec:\ppddj.exe184⤵
-
\??\c:\ppppv.exec:\ppppv.exe185⤵
-
\??\c:\xlfrxxx.exec:\xlfrxxx.exe186⤵
-
\??\c:\ttnnht.exec:\ttnnht.exe187⤵
-
\??\c:\btbtbb.exec:\btbtbb.exe188⤵
-
\??\c:\9vddd.exec:\9vddd.exe189⤵
-
\??\c:\3jddd.exec:\3jddd.exe190⤵
-
\??\c:\xrxrllf.exec:\xrxrllf.exe191⤵
-
\??\c:\1rlffxx.exec:\1rlffxx.exe192⤵
-
\??\c:\nhnhnh.exec:\nhnhnh.exe193⤵
-
\??\c:\vpvdp.exec:\vpvdp.exe194⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe195⤵
-
\??\c:\llrxfrl.exec:\llrxfrl.exe196⤵
-
\??\c:\fflllll.exec:\fflllll.exe197⤵
-
\??\c:\1nbntt.exec:\1nbntt.exe198⤵
-
\??\c:\jvvvp.exec:\jvvvp.exe199⤵
-
\??\c:\5vpvv.exec:\5vpvv.exe200⤵
-
\??\c:\9xfrflf.exec:\9xfrflf.exe201⤵
-
\??\c:\hhhhbh.exec:\hhhhbh.exe202⤵
-
\??\c:\nhthnn.exec:\nhthnn.exe203⤵
-
\??\c:\jddvp.exec:\jddvp.exe204⤵
-
\??\c:\ddjjp.exec:\ddjjp.exe205⤵
-
\??\c:\fxfxlll.exec:\fxfxlll.exe206⤵
-
\??\c:\xlrlfll.exec:\xlrlfll.exe207⤵
-
\??\c:\tthttb.exec:\tthttb.exe208⤵
-
\??\c:\djvvp.exec:\djvvp.exe209⤵
-
\??\c:\djvvp.exec:\djvvp.exe210⤵
-
\??\c:\pvjpp.exec:\pvjpp.exe211⤵
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe212⤵
-
\??\c:\lfxrlll.exec:\lfxrlll.exe213⤵
-
\??\c:\7hhbnn.exec:\7hhbnn.exe214⤵
-
\??\c:\nntnhn.exec:\nntnhn.exe215⤵
-
\??\c:\vdpdv.exec:\vdpdv.exe216⤵
-
\??\c:\dpddv.exec:\dpddv.exe217⤵
-
\??\c:\rllfxxx.exec:\rllfxxx.exe218⤵
-
\??\c:\rrfffff.exec:\rrfffff.exe219⤵
-
\??\c:\nhnnhb.exec:\nhnnhb.exe220⤵
-
\??\c:\tbthbt.exec:\tbthbt.exe221⤵
-
\??\c:\jjvvp.exec:\jjvvp.exe222⤵
-
\??\c:\pdppd.exec:\pdppd.exe223⤵
-
\??\c:\ffffxxf.exec:\ffffxxf.exe224⤵
-
\??\c:\3frxrxx.exec:\3frxrxx.exe225⤵
-
\??\c:\bhttht.exec:\bhttht.exe226⤵
-
\??\c:\nttttb.exec:\nttttb.exe227⤵
-
\??\c:\vjjvj.exec:\vjjvj.exe228⤵
-
\??\c:\3jjjj.exec:\3jjjj.exe229⤵
-
\??\c:\xfffrxx.exec:\xfffrxx.exe230⤵
-
\??\c:\bthbtb.exec:\bthbtb.exe231⤵
-
\??\c:\tnhbhh.exec:\tnhbhh.exe232⤵
-
\??\c:\3pdvp.exec:\3pdvp.exe233⤵
-
\??\c:\xfflflr.exec:\xfflflr.exe234⤵
-
\??\c:\3llxflr.exec:\3llxflr.exe235⤵
-
\??\c:\5hbtbh.exec:\5hbtbh.exe236⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe237⤵
-
\??\c:\9pjvd.exec:\9pjvd.exe238⤵
-
\??\c:\rfffrrl.exec:\rfffrrl.exe239⤵
-
\??\c:\xfrfrxf.exec:\xfrfrxf.exe240⤵
-
\??\c:\nnnnbb.exec:\nnnnbb.exe241⤵