Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 13:27
Behavioral task
behavioral1
Sample
33095629e9f91950cf77ecfe37f3acb0_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
33095629e9f91950cf77ecfe37f3acb0_NeikiAnalytics.exe
-
Size
165KB
-
MD5
33095629e9f91950cf77ecfe37f3acb0
-
SHA1
9917e5ae7cc441f47e74c54161a26c2bda21569e
-
SHA256
2d3bebfc9a62c07fa6d19ff639bb3ddb5a281c86f48302eb4c7ffc34d070d8b8
-
SHA512
5b63f5e447ab90b6e25aec49452401774df7251191c9952ed94d399226d883f43a779f89b5ccdfcc778db8c4e2b81e773bcdc94ac9fbb77a0e35b062355c8176
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4t6NDWOH148BH15vy:kcm4FmowdHoSphraHcpOFltH4ttj8BHu
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1256-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2548-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/616-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/728-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1208-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/388-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-567-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-659-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-697-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-773-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-830-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rxlfxxx.exe9hnnnt.exefrxrllf.exejvdjj.exetthbbb.exedvvvp.exexfxxrxr.exevpppj.exedjdjd.exerflfxrl.exenhhbtt.exe7djdd.exelfffxrl.exe3bhbbb.exejvvpj.exelrxrxxl.exehtnbnh.exepdjvj.exelxlxxlf.exehbhbhh.exepdjdp.exerlllffx.exettbbtn.exenbbhnb.exejjvvd.exexrrrllf.exepjppv.exefrlxrlx.exetbthbt.exehnnhhb.exedjvjd.exelflfxrl.exenbnhbt.exehbbbtt.exejvvvj.exerlfrlff.exexffrffl.exetththn.exe1pjdd.exe1rffffx.exexrxrrxr.exebttnhh.exe7vvpd.exepdjdv.exellxrxxl.exetthbnn.exedjjpj.exejddvp.exexrxfrlf.exexflffxx.exebntbtn.exevjjdv.exedjdpj.exerlfxffx.exenbhbbb.exeddpdj.exerrlxxrl.exerfxrrlr.exehbttnh.exedvvpj.exelrfxllf.exehbbtht.exetbnnnn.exenhtnbt.exepid process 2604 rxlfxxx.exe 4876 9hnnnt.exe 4504 frxrllf.exe 1336 jvdjj.exe 1216 tthbbb.exe 4480 dvvvp.exe 4312 xfxxrxr.exe 2520 vpppj.exe 1488 djdjd.exe 2548 rflfxrl.exe 2492 nhhbtt.exe 1768 7djdd.exe 616 lfffxrl.exe 4836 3bhbbb.exe 1356 jvvpj.exe 3180 lrxrxxl.exe 2232 htnbnh.exe 888 pdjvj.exe 1652 lxlxxlf.exe 1812 hbhbhh.exe 3560 pdjdp.exe 1392 rlllffx.exe 3196 ttbbtn.exe 5108 nbbhnb.exe 1764 jjvvd.exe 2088 xrrrllf.exe 3944 pjppv.exe 4352 frlxrlx.exe 3932 tbthbt.exe 2604 hnnhhb.exe 3548 djvjd.exe 4876 lflfxrl.exe 1432 nbnhbt.exe 4388 hbbbtt.exe 3056 jvvvj.exe 1216 rlfrlff.exe 936 xffrffl.exe 316 tththn.exe 1992 1pjdd.exe 3564 1rffffx.exe 2196 xrxrrxr.exe 4428 bttnhh.exe 5112 7vvpd.exe 1408 pdjdv.exe 3272 llxrxxl.exe 728 tthbnn.exe 1560 djjpj.exe 3464 jddvp.exe 4524 xrxfrlf.exe 1104 xflffxx.exe 4620 bntbtn.exe 1168 vjjdv.exe 1208 djdpj.exe 1812 rlfxffx.exe 3560 nbhbbb.exe 388 ddpdj.exe 2068 rrlxxrl.exe 940 rfxrrlr.exe 1164 hbttnh.exe 1180 dvvpj.exe 2796 lrfxllf.exe 3860 hbbtht.exe 2440 tbnnnn.exe 1696 nhtnbt.exe -
Processes:
resource yara_rule behavioral2/memory/1256-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxlfxxx.exe upx behavioral2/memory/1256-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2604-7-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9hnnnt.exe upx behavioral2/memory/2604-13-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frxrllf.exe upx behavioral2/memory/4876-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4504-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4504-24-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jvdjj.exe upx C:\tthbbb.exe upx behavioral2/memory/1336-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvvp.exe upx behavioral2/memory/1216-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4480-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xfxxrxr.exe upx behavioral2/memory/4480-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpppj.exe upx C:\djdjd.exe upx behavioral2/memory/2520-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rflfxrl.exe upx behavioral2/memory/1488-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhbtt.exe upx behavioral2/memory/2548-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2492-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7djdd.exe upx C:\lfffxrl.exe upx behavioral2/memory/1768-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3bhbbb.exe upx behavioral2/memory/4836-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/616-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvvpj.exe upx C:\lrxrxxl.exe upx behavioral2/memory/1356-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3180-98-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\htnbnh.exe upx behavioral2/memory/2232-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjvj.exe upx C:\lxlxxlf.exe upx behavioral2/memory/888-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1652-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhbhh.exe upx C:\pdjdp.exe upx C:\rlllffx.exe upx \??\c:\ttbbtn.exe upx behavioral2/memory/3196-138-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbbhnb.exe upx behavioral2/memory/5108-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1764-150-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjvvd.exe upx C:\xrrrllf.exe upx C:\pjppv.exe upx C:\frlxrlx.exe upx behavioral2/memory/4352-166-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbthbt.exe upx C:\hnnhhb.exe upx C:\djvjd.exe upx behavioral2/memory/3548-185-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflfxrl.exe upx behavioral2/memory/4876-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1432-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4388-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1992-212-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33095629e9f91950cf77ecfe37f3acb0_NeikiAnalytics.exerxlfxxx.exe9hnnnt.exefrxrllf.exejvdjj.exetthbbb.exedvvvp.exexfxxrxr.exevpppj.exedjdjd.exerflfxrl.exenhhbtt.exe7djdd.exelfffxrl.exe3bhbbb.exejvvpj.exelrxrxxl.exehtnbnh.exepdjvj.exelxlxxlf.exehbhbhh.exepdjdp.exedescription pid process target process PID 1256 wrote to memory of 2604 1256 33095629e9f91950cf77ecfe37f3acb0_NeikiAnalytics.exe rxlfxxx.exe PID 1256 wrote to memory of 2604 1256 33095629e9f91950cf77ecfe37f3acb0_NeikiAnalytics.exe rxlfxxx.exe PID 1256 wrote to memory of 2604 1256 33095629e9f91950cf77ecfe37f3acb0_NeikiAnalytics.exe rxlfxxx.exe PID 2604 wrote to memory of 4876 2604 rxlfxxx.exe 9hnnnt.exe PID 2604 wrote to memory of 4876 2604 rxlfxxx.exe 9hnnnt.exe PID 2604 wrote to memory of 4876 2604 rxlfxxx.exe 9hnnnt.exe PID 4876 wrote to memory of 4504 4876 9hnnnt.exe frxrllf.exe PID 4876 wrote to memory of 4504 4876 9hnnnt.exe frxrllf.exe PID 4876 wrote to memory of 4504 4876 9hnnnt.exe frxrllf.exe PID 4504 wrote to memory of 1336 4504 frxrllf.exe jvdjj.exe PID 4504 wrote to memory of 1336 4504 frxrllf.exe jvdjj.exe PID 4504 wrote to memory of 1336 4504 frxrllf.exe jvdjj.exe PID 1336 wrote to memory of 1216 1336 jvdjj.exe tthbbb.exe PID 1336 wrote to memory of 1216 1336 jvdjj.exe tthbbb.exe PID 1336 wrote to memory of 1216 1336 jvdjj.exe tthbbb.exe PID 1216 wrote to memory of 4480 1216 tthbbb.exe dvvvp.exe PID 1216 wrote to memory of 4480 1216 tthbbb.exe dvvvp.exe PID 1216 wrote to memory of 4480 1216 tthbbb.exe dvvvp.exe PID 4480 wrote to memory of 4312 4480 dvvvp.exe xfxxrxr.exe PID 4480 wrote to memory of 4312 4480 dvvvp.exe xfxxrxr.exe PID 4480 wrote to memory of 4312 4480 dvvvp.exe xfxxrxr.exe PID 4312 wrote to memory of 2520 4312 xfxxrxr.exe vpppj.exe PID 4312 wrote to memory of 2520 4312 xfxxrxr.exe vpppj.exe PID 4312 wrote to memory of 2520 4312 xfxxrxr.exe vpppj.exe PID 2520 wrote to memory of 1488 2520 vpppj.exe djdjd.exe PID 2520 wrote to memory of 1488 2520 vpppj.exe djdjd.exe PID 2520 wrote to memory of 1488 2520 vpppj.exe djdjd.exe PID 1488 wrote to memory of 2548 1488 djdjd.exe rflfxrl.exe PID 1488 wrote to memory of 2548 1488 djdjd.exe rflfxrl.exe PID 1488 wrote to memory of 2548 1488 djdjd.exe rflfxrl.exe PID 2548 wrote to memory of 2492 2548 rflfxrl.exe nhhbtt.exe PID 2548 wrote to memory of 2492 2548 rflfxrl.exe nhhbtt.exe PID 2548 wrote to memory of 2492 2548 rflfxrl.exe nhhbtt.exe PID 2492 wrote to memory of 1768 2492 nhhbtt.exe 7djdd.exe PID 2492 wrote to memory of 1768 2492 nhhbtt.exe 7djdd.exe PID 2492 wrote to memory of 1768 2492 nhhbtt.exe 7djdd.exe PID 1768 wrote to memory of 616 1768 7djdd.exe lfffxrl.exe PID 1768 wrote to memory of 616 1768 7djdd.exe lfffxrl.exe PID 1768 wrote to memory of 616 1768 7djdd.exe lfffxrl.exe PID 616 wrote to memory of 4836 616 lfffxrl.exe 3bhbbb.exe PID 616 wrote to memory of 4836 616 lfffxrl.exe 3bhbbb.exe PID 616 wrote to memory of 4836 616 lfffxrl.exe 3bhbbb.exe PID 4836 wrote to memory of 1356 4836 3bhbbb.exe jvvpj.exe PID 4836 wrote to memory of 1356 4836 3bhbbb.exe jvvpj.exe PID 4836 wrote to memory of 1356 4836 3bhbbb.exe jvvpj.exe PID 1356 wrote to memory of 3180 1356 jvvpj.exe lrxrxxl.exe PID 1356 wrote to memory of 3180 1356 jvvpj.exe lrxrxxl.exe PID 1356 wrote to memory of 3180 1356 jvvpj.exe lrxrxxl.exe PID 3180 wrote to memory of 2232 3180 lrxrxxl.exe htnbnh.exe PID 3180 wrote to memory of 2232 3180 lrxrxxl.exe htnbnh.exe PID 3180 wrote to memory of 2232 3180 lrxrxxl.exe htnbnh.exe PID 2232 wrote to memory of 888 2232 htnbnh.exe pdjvj.exe PID 2232 wrote to memory of 888 2232 htnbnh.exe pdjvj.exe PID 2232 wrote to memory of 888 2232 htnbnh.exe pdjvj.exe PID 888 wrote to memory of 1652 888 pdjvj.exe lxlxxlf.exe PID 888 wrote to memory of 1652 888 pdjvj.exe lxlxxlf.exe PID 888 wrote to memory of 1652 888 pdjvj.exe lxlxxlf.exe PID 1652 wrote to memory of 1812 1652 lxlxxlf.exe hbhbhh.exe PID 1652 wrote to memory of 1812 1652 lxlxxlf.exe hbhbhh.exe PID 1652 wrote to memory of 1812 1652 lxlxxlf.exe hbhbhh.exe PID 1812 wrote to memory of 3560 1812 hbhbhh.exe pdjdp.exe PID 1812 wrote to memory of 3560 1812 hbhbhh.exe pdjdp.exe PID 1812 wrote to memory of 3560 1812 hbhbhh.exe pdjdp.exe PID 3560 wrote to memory of 1392 3560 pdjdp.exe rlllffx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33095629e9f91950cf77ecfe37f3acb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\33095629e9f91950cf77ecfe37f3acb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9hnnnt.exec:\9hnnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxrllf.exec:\frxrllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdjj.exec:\jvdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthbbb.exec:\tthbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvvp.exec:\dvvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfxxrxr.exec:\xfxxrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpppj.exec:\vpppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djdjd.exec:\djdjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflfxrl.exec:\rflfxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhbtt.exec:\nhhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7djdd.exec:\7djdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfffxrl.exec:\lfffxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bhbbb.exec:\3bhbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvpj.exec:\jvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxrxxl.exec:\lrxrxxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnbnh.exec:\htnbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjvj.exec:\pdjvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlxxlf.exec:\lxlxxlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbhh.exec:\hbhbhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjdp.exec:\pdjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlllffx.exec:\rlllffx.exe23⤵
- Executes dropped EXE
-
\??\c:\ttbbtn.exec:\ttbbtn.exe24⤵
- Executes dropped EXE
-
\??\c:\nbbhnb.exec:\nbbhnb.exe25⤵
- Executes dropped EXE
-
\??\c:\jjvvd.exec:\jjvvd.exe26⤵
- Executes dropped EXE
-
\??\c:\xrrrllf.exec:\xrrrllf.exe27⤵
- Executes dropped EXE
-
\??\c:\pjppv.exec:\pjppv.exe28⤵
- Executes dropped EXE
-
\??\c:\frlxrlx.exec:\frlxrlx.exe29⤵
- Executes dropped EXE
-
\??\c:\tbthbt.exec:\tbthbt.exe30⤵
- Executes dropped EXE
-
\??\c:\hnnhhb.exec:\hnnhhb.exe31⤵
- Executes dropped EXE
-
\??\c:\djvjd.exec:\djvjd.exe32⤵
- Executes dropped EXE
-
\??\c:\lflfxrl.exec:\lflfxrl.exe33⤵
- Executes dropped EXE
-
\??\c:\nbnhbt.exec:\nbnhbt.exe34⤵
- Executes dropped EXE
-
\??\c:\hbbbtt.exec:\hbbbtt.exe35⤵
- Executes dropped EXE
-
\??\c:\jvvvj.exec:\jvvvj.exe36⤵
- Executes dropped EXE
-
\??\c:\rlfrlff.exec:\rlfrlff.exe37⤵
- Executes dropped EXE
-
\??\c:\xffrffl.exec:\xffrffl.exe38⤵
- Executes dropped EXE
-
\??\c:\tththn.exec:\tththn.exe39⤵
- Executes dropped EXE
-
\??\c:\1pjdd.exec:\1pjdd.exe40⤵
- Executes dropped EXE
-
\??\c:\1rffffx.exec:\1rffffx.exe41⤵
- Executes dropped EXE
-
\??\c:\xrxrrxr.exec:\xrxrrxr.exe42⤵
- Executes dropped EXE
-
\??\c:\bttnhh.exec:\bttnhh.exe43⤵
- Executes dropped EXE
-
\??\c:\7vvpd.exec:\7vvpd.exe44⤵
- Executes dropped EXE
-
\??\c:\pdjdv.exec:\pdjdv.exe45⤵
- Executes dropped EXE
-
\??\c:\llxrxxl.exec:\llxrxxl.exe46⤵
- Executes dropped EXE
-
\??\c:\tthbnn.exec:\tthbnn.exe47⤵
- Executes dropped EXE
-
\??\c:\djjpj.exec:\djjpj.exe48⤵
- Executes dropped EXE
-
\??\c:\jddvp.exec:\jddvp.exe49⤵
- Executes dropped EXE
-
\??\c:\xrxfrlf.exec:\xrxfrlf.exe50⤵
- Executes dropped EXE
-
\??\c:\xflffxx.exec:\xflffxx.exe51⤵
- Executes dropped EXE
-
\??\c:\bntbtn.exec:\bntbtn.exe52⤵
- Executes dropped EXE
-
\??\c:\vjjdv.exec:\vjjdv.exe53⤵
- Executes dropped EXE
-
\??\c:\djdpj.exec:\djdpj.exe54⤵
- Executes dropped EXE
-
\??\c:\rlfxffx.exec:\rlfxffx.exe55⤵
- Executes dropped EXE
-
\??\c:\nbhbbb.exec:\nbhbbb.exe56⤵
- Executes dropped EXE
-
\??\c:\ddpdj.exec:\ddpdj.exe57⤵
- Executes dropped EXE
-
\??\c:\rrlxxrl.exec:\rrlxxrl.exe58⤵
- Executes dropped EXE
-
\??\c:\rfxrrlr.exec:\rfxrrlr.exe59⤵
- Executes dropped EXE
-
\??\c:\hbttnh.exec:\hbttnh.exe60⤵
- Executes dropped EXE
-
\??\c:\dvvpj.exec:\dvvpj.exe61⤵
- Executes dropped EXE
-
\??\c:\lrfxllf.exec:\lrfxllf.exe62⤵
- Executes dropped EXE
-
\??\c:\hbbtht.exec:\hbbtht.exe63⤵
- Executes dropped EXE
-
\??\c:\tbnnnn.exec:\tbnnnn.exe64⤵
- Executes dropped EXE
-
\??\c:\nhtnbt.exec:\nhtnbt.exe65⤵
- Executes dropped EXE
-
\??\c:\dvjdp.exec:\dvjdp.exe66⤵
-
\??\c:\1xxlxrl.exec:\1xxlxrl.exe67⤵
-
\??\c:\btnnbb.exec:\btnnbb.exe68⤵
-
\??\c:\hhbbhh.exec:\hhbbhh.exe69⤵
-
\??\c:\vdvvp.exec:\vdvvp.exe70⤵
-
\??\c:\rrrlxxx.exec:\rrrlxxx.exe71⤵
-
\??\c:\tnnntn.exec:\tnnntn.exe72⤵
-
\??\c:\htnbnh.exec:\htnbnh.exe73⤵
-
\??\c:\djpjd.exec:\djpjd.exe74⤵
-
\??\c:\ddvjd.exec:\ddvjd.exe75⤵
-
\??\c:\xflfxrf.exec:\xflfxrf.exe76⤵
-
\??\c:\rxlxllf.exec:\rxlxllf.exe77⤵
-
\??\c:\bnhnhb.exec:\bnhnhb.exe78⤵
-
\??\c:\nbbbnn.exec:\nbbbnn.exe79⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe80⤵
-
\??\c:\vpjjj.exec:\vpjjj.exe81⤵
-
\??\c:\fffxlfx.exec:\fffxlfx.exe82⤵
-
\??\c:\ttttth.exec:\ttttth.exe83⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe84⤵
-
\??\c:\vvdvv.exec:\vvdvv.exe85⤵
-
\??\c:\vdjdd.exec:\vdjdd.exe86⤵
-
\??\c:\rxrrlrf.exec:\rxrrlrf.exe87⤵
-
\??\c:\rlfrrlf.exec:\rlfrrlf.exe88⤵
-
\??\c:\nnnnnn.exec:\nnnnnn.exe89⤵
-
\??\c:\tnhbtn.exec:\tnhbtn.exe90⤵
-
\??\c:\5ppjd.exec:\5ppjd.exe91⤵
-
\??\c:\3pvvj.exec:\3pvvj.exe92⤵
-
\??\c:\1xxrllx.exec:\1xxrllx.exe93⤵
-
\??\c:\rxlrlfx.exec:\rxlrlfx.exe94⤵
-
\??\c:\7nnhhh.exec:\7nnhhh.exe95⤵
-
\??\c:\hthhnn.exec:\hthhnn.exe96⤵
-
\??\c:\pdjjv.exec:\pdjjv.exe97⤵
-
\??\c:\7rrrxxl.exec:\7rrrxxl.exe98⤵
-
\??\c:\lrxrlff.exec:\lrxrlff.exe99⤵
-
\??\c:\rllffxr.exec:\rllffxr.exe100⤵
-
\??\c:\htnhht.exec:\htnhht.exe101⤵
-
\??\c:\vjvpp.exec:\vjvpp.exe102⤵
-
\??\c:\vpjdj.exec:\vpjdj.exe103⤵
-
\??\c:\lflffxf.exec:\lflffxf.exe104⤵
-
\??\c:\ntbtnn.exec:\ntbtnn.exe105⤵
-
\??\c:\htnbtn.exec:\htnbtn.exe106⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe107⤵
-
\??\c:\vddvp.exec:\vddvp.exe108⤵
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe109⤵
-
\??\c:\bhtbht.exec:\bhtbht.exe110⤵
-
\??\c:\thhthb.exec:\thhthb.exe111⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe112⤵
-
\??\c:\pjppj.exec:\pjppj.exe113⤵
-
\??\c:\rrfflff.exec:\rrfflff.exe114⤵
-
\??\c:\fffxrrf.exec:\fffxrrf.exe115⤵
-
\??\c:\htbbtt.exec:\htbbtt.exe116⤵
-
\??\c:\thbhtt.exec:\thbhtt.exe117⤵
-
\??\c:\jpvpd.exec:\jpvpd.exe118⤵
-
\??\c:\pdpvp.exec:\pdpvp.exe119⤵
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe120⤵
-
\??\c:\xxxrffx.exec:\xxxrffx.exe121⤵
-
\??\c:\ttbbnn.exec:\ttbbnn.exe122⤵
-
\??\c:\bbnhbb.exec:\bbnhbb.exe123⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe124⤵
-
\??\c:\llrlffx.exec:\llrlffx.exe125⤵
-
\??\c:\fxxrlff.exec:\fxxrlff.exe126⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe127⤵
-
\??\c:\tbnnhh.exec:\tbnnhh.exe128⤵
-
\??\c:\7jdvp.exec:\7jdvp.exe129⤵
-
\??\c:\fxlfrfl.exec:\fxlfrfl.exe130⤵
-
\??\c:\frrlffx.exec:\frrlffx.exe131⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe132⤵
-
\??\c:\hbbtbt.exec:\hbbtbt.exe133⤵
-
\??\c:\pvjdv.exec:\pvjdv.exe134⤵
-
\??\c:\pdvjv.exec:\pdvjv.exe135⤵
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe136⤵
-
\??\c:\nhbhnt.exec:\nhbhnt.exe137⤵
-
\??\c:\hbhbnn.exec:\hbhbnn.exe138⤵
-
\??\c:\5ppjj.exec:\5ppjj.exe139⤵
-
\??\c:\ddvvj.exec:\ddvvj.exe140⤵
-
\??\c:\ffrrrxr.exec:\ffrrrxr.exe141⤵
-
\??\c:\5nttnn.exec:\5nttnn.exe142⤵
-
\??\c:\5tnbtt.exec:\5tnbtt.exe143⤵
-
\??\c:\dpjjv.exec:\dpjjv.exe144⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe145⤵
-
\??\c:\xxllxxx.exec:\xxllxxx.exe146⤵
-
\??\c:\xxffllr.exec:\xxffllr.exe147⤵
-
\??\c:\tbtnhb.exec:\tbtnhb.exe148⤵
-
\??\c:\dvjdj.exec:\dvjdj.exe149⤵
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe150⤵
-
\??\c:\jjvpv.exec:\jjvpv.exe151⤵
-
\??\c:\llfxxrr.exec:\llfxxrr.exe152⤵
-
\??\c:\ppdvd.exec:\ppdvd.exe153⤵
-
\??\c:\dpvdv.exec:\dpvdv.exe154⤵
-
\??\c:\djjvp.exec:\djjvp.exe155⤵
-
\??\c:\lfrrxlx.exec:\lfrrxlx.exe156⤵
-
\??\c:\lrxrxrl.exec:\lrxrxrl.exe157⤵
-
\??\c:\tnnhtn.exec:\tnnhtn.exe158⤵
-
\??\c:\3hbthh.exec:\3hbthh.exe159⤵
-
\??\c:\ppjdp.exec:\ppjdp.exe160⤵
-
\??\c:\vppjj.exec:\vppjj.exe161⤵
-
\??\c:\frrlffx.exec:\frrlffx.exe162⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe163⤵
-
\??\c:\tttttn.exec:\tttttn.exe164⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe165⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe166⤵
-
\??\c:\7rxlffr.exec:\7rxlffr.exe167⤵
-
\??\c:\frfrlll.exec:\frfrlll.exe168⤵
-
\??\c:\xlrlrlx.exec:\xlrlrlx.exe169⤵
-
\??\c:\tbbbtn.exec:\tbbbtn.exe170⤵
-
\??\c:\7tnhbb.exec:\7tnhbb.exe171⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe172⤵
-
\??\c:\xrrlffx.exec:\xrrlffx.exe173⤵
-
\??\c:\hbhtnh.exec:\hbhtnh.exe174⤵
-
\??\c:\tbnhbn.exec:\tbnhbn.exe175⤵
-
\??\c:\vppjv.exec:\vppjv.exe176⤵
-
\??\c:\jjpdv.exec:\jjpdv.exe177⤵
-
\??\c:\7xxlffr.exec:\7xxlffr.exe178⤵
-
\??\c:\5xxlfxr.exec:\5xxlfxr.exe179⤵
-
\??\c:\tbnhbb.exec:\tbnhbb.exe180⤵
-
\??\c:\3bhttt.exec:\3bhttt.exe181⤵
-
\??\c:\dvddd.exec:\dvddd.exe182⤵
-
\??\c:\vdvvp.exec:\vdvvp.exe183⤵
-
\??\c:\rfrlffx.exec:\rfrlffx.exe184⤵
-
\??\c:\frrrrxx.exec:\frrrrxx.exe185⤵
-
\??\c:\bthbtt.exec:\bthbtt.exe186⤵
-
\??\c:\bthbhh.exec:\bthbhh.exe187⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe188⤵
-
\??\c:\xfllffx.exec:\xfllffx.exe189⤵
-
\??\c:\xrlllll.exec:\xrlllll.exe190⤵
-
\??\c:\bbbbhn.exec:\bbbbhn.exe191⤵
-
\??\c:\jdvpd.exec:\jdvpd.exe192⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe193⤵
-
\??\c:\xrrxlxx.exec:\xrrxlxx.exe194⤵
-
\??\c:\hbbtbb.exec:\hbbtbb.exe195⤵
-
\??\c:\nnntnb.exec:\nnntnb.exe196⤵
-
\??\c:\jdppp.exec:\jdppp.exe197⤵
-
\??\c:\vjvpp.exec:\vjvpp.exe198⤵
-
\??\c:\rffrlfl.exec:\rffrlfl.exe199⤵
-
\??\c:\tbbtnn.exec:\tbbtnn.exe200⤵
-
\??\c:\ttbttb.exec:\ttbttb.exe201⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe202⤵
-
\??\c:\jpjjv.exec:\jpjjv.exe203⤵
-
\??\c:\1rrfffr.exec:\1rrfffr.exe204⤵
-
\??\c:\hhbntb.exec:\hhbntb.exe205⤵
-
\??\c:\nhbthh.exec:\nhbthh.exe206⤵
-
\??\c:\jddpd.exec:\jddpd.exe207⤵
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe208⤵
-
\??\c:\lrfrllr.exec:\lrfrllr.exe209⤵
-
\??\c:\htbbtn.exec:\htbbtn.exe210⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe211⤵
-
\??\c:\rxxrffx.exec:\rxxrffx.exe212⤵
-
\??\c:\frxrrxf.exec:\frxrrxf.exe213⤵
-
\??\c:\htnbnn.exec:\htnbnn.exe214⤵
-
\??\c:\nbhbtt.exec:\nbhbtt.exe215⤵
-
\??\c:\dddvj.exec:\dddvj.exe216⤵
-
\??\c:\fflrlfx.exec:\fflrlfx.exe217⤵
-
\??\c:\xlrlffr.exec:\xlrlffr.exe218⤵
-
\??\c:\ntbbhh.exec:\ntbbhh.exe219⤵
-
\??\c:\bnnhtt.exec:\bnnhtt.exe220⤵
-
\??\c:\3pddp.exec:\3pddp.exe221⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe222⤵
-
\??\c:\lfllxxl.exec:\lfllxxl.exe223⤵
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe224⤵
-
\??\c:\bnbttn.exec:\bnbttn.exe225⤵
-
\??\c:\nnnhtn.exec:\nnnhtn.exe226⤵
-
\??\c:\pjvdv.exec:\pjvdv.exe227⤵
-
\??\c:\dvpdp.exec:\dvpdp.exe228⤵
-
\??\c:\lrlfxxx.exec:\lrlfxxx.exe229⤵
-
\??\c:\llfxrrl.exec:\llfxrrl.exe230⤵
-
\??\c:\bbhhnh.exec:\bbhhnh.exe231⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe232⤵
-
\??\c:\djjvj.exec:\djjvj.exe233⤵
-
\??\c:\rflrrlf.exec:\rflrrlf.exe234⤵
-
\??\c:\rxrxrrr.exec:\rxrxrrr.exe235⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe236⤵
-
\??\c:\ntntnh.exec:\ntntnh.exe237⤵
-
\??\c:\djjjv.exec:\djjjv.exe238⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe239⤵
-
\??\c:\rfflrlf.exec:\rfflrlf.exe240⤵
-
\??\c:\5xrlfxr.exec:\5xrlfxr.exe241⤵