Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 16:16
Behavioral task
behavioral1
Sample
22911febc68ff164996e0d3d9d140230_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
22911febc68ff164996e0d3d9d140230_NeikiAnalytics.exe
-
Size
454KB
-
MD5
22911febc68ff164996e0d3d9d140230
-
SHA1
4f6bd6a82184e5566cd07bec12fd0d383ea7e17c
-
SHA256
6fc15296952088cdd5b650618d77bc2958c4e45f5c35140d6d383bb0207fa4fa
-
SHA512
7a7d8f6d26842188ab1dd1297d8410f6dde6404acc21d5cad4d6d71ee6ca322e7cf945352db5a23bc90eb49a4261f19052a79be5d10e3755d21a6994f68c8b5f
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNmw:x4wFHoS3eFaKHpv/VycgE81lgH
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1672-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/864-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2508-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2960-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4132-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2336-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/332-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/724-558-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-636-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-671-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-847-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-926-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrxlfll.exenbbbbb.exehnttth.exexrflxfr.exenhnhbt.exe1jppp.exerxxlxxl.exevpvvj.exelxffffl.exeddvvd.exennbbhh.exevpjjd.exehtttnt.exe9dvpp.exennnhtt.exevvjjd.exenbnhhh.exelrrlxxx.exexflfrrx.exexlrlffx.exexllrrxx.exenthhhn.exejjvvv.exexrlfrlx.exexxfrlrl.exehbnhnn.exerrxxrfx.exejpdpv.exexlxrllf.exepjjjd.exerflffxr.exenhttbh.exehtnnhh.exevjppp.exelxlrlff.exe9nhbtn.exevjpjd.exefxxrlxr.exenbhbhh.exepjvpj.exelxffxxx.exetnbttt.exevpjdv.exedppjj.exe5ffllff.exenhbtnn.exevdppj.exexrfxfxx.exe3dvpj.exerrlxrrl.exebhhhbh.exepdvjp.exe7llflll.exethhbtn.exethnnhh.exevjpjd.exerrrlxxr.exehhbbbh.exedjppv.exefxfxxxr.exenhnnnn.exejvdvp.exerrrlxxr.exebhbttt.exepid process 1940 xrxlfll.exe 3148 nbbbbb.exe 212 hnttth.exe 4368 xrflxfr.exe 2844 nhnhbt.exe 940 1jppp.exe 2132 rxxlxxl.exe 3112 vpvvj.exe 1980 lxffffl.exe 3124 ddvvd.exe 656 nnbbhh.exe 3932 vpjjd.exe 4028 htttnt.exe 3448 9dvpp.exe 864 nnnhtt.exe 1456 vvjjd.exe 2524 nbnhhh.exe 3616 lrrlxxx.exe 2508 xflfrrx.exe 5032 xlrlffx.exe 5044 xllrrxx.exe 4300 nthhhn.exe 4412 jjvvv.exe 4808 xrlfrlx.exe 4512 xxfrlrl.exe 1952 hbnhnn.exe 1232 rrxxrfx.exe 4712 jpdpv.exe 552 xlxrllf.exe 2312 pjjjd.exe 2960 rflffxr.exe 4656 nhttbh.exe 3528 htnnhh.exe 2280 vjppp.exe 4528 lxlrlff.exe 412 9nhbtn.exe 2020 vjpjd.exe 2872 fxxrlxr.exe 1964 nbhbhh.exe 4968 pjvpj.exe 4132 lxffxxx.exe 4368 tnbttt.exe 2984 vpjdv.exe 3976 dppjj.exe 1344 5ffllff.exe 4484 nhbtnn.exe 2336 vdppj.exe 5080 xrfxfxx.exe 4152 3dvpj.exe 3300 rrlxrrl.exe 1520 bhhhbh.exe 1240 pdvjp.exe 4704 7llflll.exe 3000 thhbtn.exe 3872 thnnhh.exe 724 vjpjd.exe 2368 rrrlxxr.exe 2236 hhbbbh.exe 3516 djppv.exe 4588 fxfxxxr.exe 4384 nhnnnn.exe 1092 jvdvp.exe 900 rrrlxxr.exe 332 bhbttt.exe -
Processes:
resource yara_rule behavioral2/memory/1672-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxlfll.exe upx behavioral2/memory/1672-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1940-7-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbbbbb.exe upx C:\hnttth.exe upx behavioral2/memory/3148-16-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrflxfr.exe upx behavioral2/memory/4368-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/212-23-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnhbt.exe upx behavioral2/memory/4368-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2844-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1jppp.exe upx behavioral2/memory/940-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxxlxxl.exe upx behavioral2/memory/940-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvvj.exe upx behavioral2/memory/2132-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3112-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxffffl.exe upx behavioral2/memory/1980-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvvd.exe upx behavioral2/memory/1980-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3124-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnbbhh.exe upx C:\vpjjd.exe upx C:\htttnt.exe upx behavioral2/memory/3932-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9dvpp.exe upx behavioral2/memory/4028-85-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nnnhtt.exe upx behavioral2/memory/864-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3448-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjjd.exe upx C:\nbnhhh.exe upx behavioral2/memory/1456-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrrlxxx.exe upx behavioral2/memory/2524-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3616-113-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xflfrrx.exe upx behavioral2/memory/2508-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrlffx.exe upx behavioral2/memory/5044-128-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xllrrxx.exe upx behavioral2/memory/5032-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nthhhn.exe upx behavioral2/memory/5044-133-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjvvv.exe upx C:\xrlfrlx.exe upx C:\xxfrlrl.exe upx behavioral2/memory/4808-149-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbnhnn.exe upx behavioral2/memory/4512-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1952-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1952-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrxxrfx.exe upx behavioral2/memory/1232-165-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jpdpv.exe upx \??\c:\xlxrllf.exe upx behavioral2/memory/4712-175-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjjjd.exe upx behavioral2/memory/552-179-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rflffxr.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
22911febc68ff164996e0d3d9d140230_NeikiAnalytics.exexrxlfll.exenbbbbb.exehnttth.exexrflxfr.exenhnhbt.exe1jppp.exerxxlxxl.exevpvvj.exelxffffl.exeddvvd.exennbbhh.exevpjjd.exehtttnt.exe9dvpp.exennnhtt.exevvjjd.exenbnhhh.exelrrlxxx.exexflfrrx.exexlrlffx.exexllrrxx.exedescription pid process target process PID 1672 wrote to memory of 1940 1672 22911febc68ff164996e0d3d9d140230_NeikiAnalytics.exe xrxlfll.exe PID 1672 wrote to memory of 1940 1672 22911febc68ff164996e0d3d9d140230_NeikiAnalytics.exe xrxlfll.exe PID 1672 wrote to memory of 1940 1672 22911febc68ff164996e0d3d9d140230_NeikiAnalytics.exe xrxlfll.exe PID 1940 wrote to memory of 3148 1940 xrxlfll.exe nbbbbb.exe PID 1940 wrote to memory of 3148 1940 xrxlfll.exe nbbbbb.exe PID 1940 wrote to memory of 3148 1940 xrxlfll.exe nbbbbb.exe PID 3148 wrote to memory of 212 3148 nbbbbb.exe hnttth.exe PID 3148 wrote to memory of 212 3148 nbbbbb.exe hnttth.exe PID 3148 wrote to memory of 212 3148 nbbbbb.exe hnttth.exe PID 212 wrote to memory of 4368 212 hnttth.exe xrflxfr.exe PID 212 wrote to memory of 4368 212 hnttth.exe xrflxfr.exe PID 212 wrote to memory of 4368 212 hnttth.exe xrflxfr.exe PID 4368 wrote to memory of 2844 4368 xrflxfr.exe nhnhbt.exe PID 4368 wrote to memory of 2844 4368 xrflxfr.exe nhnhbt.exe PID 4368 wrote to memory of 2844 4368 xrflxfr.exe nhnhbt.exe PID 2844 wrote to memory of 940 2844 nhnhbt.exe 1jppp.exe PID 2844 wrote to memory of 940 2844 nhnhbt.exe 1jppp.exe PID 2844 wrote to memory of 940 2844 nhnhbt.exe 1jppp.exe PID 940 wrote to memory of 2132 940 1jppp.exe rxxlxxl.exe PID 940 wrote to memory of 2132 940 1jppp.exe rxxlxxl.exe PID 940 wrote to memory of 2132 940 1jppp.exe rxxlxxl.exe PID 2132 wrote to memory of 3112 2132 rxxlxxl.exe vpvvj.exe PID 2132 wrote to memory of 3112 2132 rxxlxxl.exe vpvvj.exe PID 2132 wrote to memory of 3112 2132 rxxlxxl.exe vpvvj.exe PID 3112 wrote to memory of 1980 3112 vpvvj.exe lxffffl.exe PID 3112 wrote to memory of 1980 3112 vpvvj.exe lxffffl.exe PID 3112 wrote to memory of 1980 3112 vpvvj.exe lxffffl.exe PID 1980 wrote to memory of 3124 1980 lxffffl.exe ddvvd.exe PID 1980 wrote to memory of 3124 1980 lxffffl.exe ddvvd.exe PID 1980 wrote to memory of 3124 1980 lxffffl.exe ddvvd.exe PID 3124 wrote to memory of 656 3124 ddvvd.exe nnbbhh.exe PID 3124 wrote to memory of 656 3124 ddvvd.exe nnbbhh.exe PID 3124 wrote to memory of 656 3124 ddvvd.exe nnbbhh.exe PID 656 wrote to memory of 3932 656 nnbbhh.exe vpjjd.exe PID 656 wrote to memory of 3932 656 nnbbhh.exe vpjjd.exe PID 656 wrote to memory of 3932 656 nnbbhh.exe vpjjd.exe PID 3932 wrote to memory of 4028 3932 vpjjd.exe htttnt.exe PID 3932 wrote to memory of 4028 3932 vpjjd.exe htttnt.exe PID 3932 wrote to memory of 4028 3932 vpjjd.exe htttnt.exe PID 4028 wrote to memory of 3448 4028 htttnt.exe 9dvpp.exe PID 4028 wrote to memory of 3448 4028 htttnt.exe 9dvpp.exe PID 4028 wrote to memory of 3448 4028 htttnt.exe 9dvpp.exe PID 3448 wrote to memory of 864 3448 9dvpp.exe nnnhtt.exe PID 3448 wrote to memory of 864 3448 9dvpp.exe nnnhtt.exe PID 3448 wrote to memory of 864 3448 9dvpp.exe nnnhtt.exe PID 864 wrote to memory of 1456 864 nnnhtt.exe vvjjd.exe PID 864 wrote to memory of 1456 864 nnnhtt.exe vvjjd.exe PID 864 wrote to memory of 1456 864 nnnhtt.exe vvjjd.exe PID 1456 wrote to memory of 2524 1456 vvjjd.exe nbnhhh.exe PID 1456 wrote to memory of 2524 1456 vvjjd.exe nbnhhh.exe PID 1456 wrote to memory of 2524 1456 vvjjd.exe nbnhhh.exe PID 2524 wrote to memory of 3616 2524 nbnhhh.exe lrrlxxx.exe PID 2524 wrote to memory of 3616 2524 nbnhhh.exe lrrlxxx.exe PID 2524 wrote to memory of 3616 2524 nbnhhh.exe lrrlxxx.exe PID 3616 wrote to memory of 2508 3616 lrrlxxx.exe xflfrrx.exe PID 3616 wrote to memory of 2508 3616 lrrlxxx.exe xflfrrx.exe PID 3616 wrote to memory of 2508 3616 lrrlxxx.exe xflfrrx.exe PID 2508 wrote to memory of 5032 2508 xflfrrx.exe xlrlffx.exe PID 2508 wrote to memory of 5032 2508 xflfrrx.exe xlrlffx.exe PID 2508 wrote to memory of 5032 2508 xflfrrx.exe xlrlffx.exe PID 5032 wrote to memory of 5044 5032 xlrlffx.exe xllrrxx.exe PID 5032 wrote to memory of 5044 5032 xlrlffx.exe xllrrxx.exe PID 5032 wrote to memory of 5044 5032 xlrlffx.exe xllrrxx.exe PID 5044 wrote to memory of 4300 5044 xllrrxx.exe nthhhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22911febc68ff164996e0d3d9d140230_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\22911febc68ff164996e0d3d9d140230_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxlfll.exec:\xrxlfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbbbb.exec:\nbbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnttth.exec:\hnttth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrflxfr.exec:\xrflxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnhbt.exec:\nhnhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1jppp.exec:\1jppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxxlxxl.exec:\rxxlxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvvj.exec:\vpvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxffffl.exec:\lxffffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvvd.exec:\ddvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnbbhh.exec:\nnbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjjd.exec:\vpjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htttnt.exec:\htttnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9dvpp.exec:\9dvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnnhtt.exec:\nnnhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjjd.exec:\vvjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbnhhh.exec:\nbnhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrlxxx.exec:\lrrlxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xflfrrx.exec:\xflfrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlrlffx.exec:\xlrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xllrrxx.exec:\xllrrxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nthhhn.exec:\nthhhn.exe23⤵
- Executes dropped EXE
-
\??\c:\jjvvv.exec:\jjvvv.exe24⤵
- Executes dropped EXE
-
\??\c:\xrlfrlx.exec:\xrlfrlx.exe25⤵
- Executes dropped EXE
-
\??\c:\xxfrlrl.exec:\xxfrlrl.exe26⤵
- Executes dropped EXE
-
\??\c:\hbnhnn.exec:\hbnhnn.exe27⤵
- Executes dropped EXE
-
\??\c:\rrxxrfx.exec:\rrxxrfx.exe28⤵
- Executes dropped EXE
-
\??\c:\jpdpv.exec:\jpdpv.exe29⤵
- Executes dropped EXE
-
\??\c:\xlxrllf.exec:\xlxrllf.exe30⤵
- Executes dropped EXE
-
\??\c:\pjjjd.exec:\pjjjd.exe31⤵
- Executes dropped EXE
-
\??\c:\rflffxr.exec:\rflffxr.exe32⤵
- Executes dropped EXE
-
\??\c:\nhttbh.exec:\nhttbh.exe33⤵
- Executes dropped EXE
-
\??\c:\htnnhh.exec:\htnnhh.exe34⤵
- Executes dropped EXE
-
\??\c:\vjppp.exec:\vjppp.exe35⤵
- Executes dropped EXE
-
\??\c:\lxlrlff.exec:\lxlrlff.exe36⤵
- Executes dropped EXE
-
\??\c:\9nhbtn.exec:\9nhbtn.exe37⤵
- Executes dropped EXE
-
\??\c:\vjpjd.exec:\vjpjd.exe38⤵
- Executes dropped EXE
-
\??\c:\fxxrlxr.exec:\fxxrlxr.exe39⤵
- Executes dropped EXE
-
\??\c:\nbhbhh.exec:\nbhbhh.exe40⤵
- Executes dropped EXE
-
\??\c:\pjvpj.exec:\pjvpj.exe41⤵
- Executes dropped EXE
-
\??\c:\lxffxxx.exec:\lxffxxx.exe42⤵
- Executes dropped EXE
-
\??\c:\tnbttt.exec:\tnbttt.exe43⤵
- Executes dropped EXE
-
\??\c:\vpjdv.exec:\vpjdv.exe44⤵
- Executes dropped EXE
-
\??\c:\dppjj.exec:\dppjj.exe45⤵
- Executes dropped EXE
-
\??\c:\5ffllff.exec:\5ffllff.exe46⤵
- Executes dropped EXE
-
\??\c:\nhbtnn.exec:\nhbtnn.exe47⤵
- Executes dropped EXE
-
\??\c:\vdppj.exec:\vdppj.exe48⤵
- Executes dropped EXE
-
\??\c:\xrfxfxx.exec:\xrfxfxx.exe49⤵
- Executes dropped EXE
-
\??\c:\3dvpj.exec:\3dvpj.exe50⤵
- Executes dropped EXE
-
\??\c:\rrlxrrl.exec:\rrlxrrl.exe51⤵
- Executes dropped EXE
-
\??\c:\bhhhbh.exec:\bhhhbh.exe52⤵
- Executes dropped EXE
-
\??\c:\pdvjp.exec:\pdvjp.exe53⤵
- Executes dropped EXE
-
\??\c:\7llflll.exec:\7llflll.exe54⤵
- Executes dropped EXE
-
\??\c:\thhbtn.exec:\thhbtn.exe55⤵
- Executes dropped EXE
-
\??\c:\thnnhh.exec:\thnnhh.exe56⤵
- Executes dropped EXE
-
\??\c:\vjpjd.exec:\vjpjd.exe57⤵
- Executes dropped EXE
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe58⤵
- Executes dropped EXE
-
\??\c:\hhbbbh.exec:\hhbbbh.exe59⤵
- Executes dropped EXE
-
\??\c:\djppv.exec:\djppv.exe60⤵
- Executes dropped EXE
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe61⤵
- Executes dropped EXE
-
\??\c:\nhnnnn.exec:\nhnnnn.exe62⤵
- Executes dropped EXE
-
\??\c:\jvdvp.exec:\jvdvp.exe63⤵
- Executes dropped EXE
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe64⤵
- Executes dropped EXE
-
\??\c:\bhbttt.exec:\bhbttt.exe65⤵
- Executes dropped EXE
-
\??\c:\htntnb.exec:\htntnb.exe66⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe67⤵
-
\??\c:\9xxrlxr.exec:\9xxrlxr.exe68⤵
-
\??\c:\bnbbtt.exec:\bnbbtt.exe69⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe70⤵
-
\??\c:\vdpjj.exec:\vdpjj.exe71⤵
-
\??\c:\rrrlllx.exec:\rrrlllx.exe72⤵
-
\??\c:\xlrllfx.exec:\xlrllfx.exe73⤵
-
\??\c:\ttbbtt.exec:\ttbbtt.exe74⤵
-
\??\c:\ddpjv.exec:\ddpjv.exe75⤵
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe76⤵
-
\??\c:\rlrlffx.exec:\rlrlffx.exe77⤵
-
\??\c:\btbnhh.exec:\btbnhh.exe78⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe79⤵
-
\??\c:\xflfrxx.exec:\xflfrxx.exe80⤵
-
\??\c:\xrrlffx.exec:\xrrlffx.exe81⤵
-
\??\c:\7nnbtt.exec:\7nnbtt.exe82⤵
-
\??\c:\pvvvv.exec:\pvvvv.exe83⤵
-
\??\c:\dddpj.exec:\dddpj.exe84⤵
-
\??\c:\frfxrrr.exec:\frfxrrr.exe85⤵
-
\??\c:\hntbbh.exec:\hntbbh.exe86⤵
-
\??\c:\tbhbnn.exec:\tbhbnn.exe87⤵
-
\??\c:\7jvvp.exec:\7jvvp.exe88⤵
-
\??\c:\rxlfrrx.exec:\rxlfrrx.exe89⤵
-
\??\c:\1nbtbn.exec:\1nbtbn.exe90⤵
-
\??\c:\pjpdd.exec:\pjpdd.exe91⤵
-
\??\c:\vjvvd.exec:\vjvvd.exe92⤵
-
\??\c:\9lrrlff.exec:\9lrrlff.exe93⤵
-
\??\c:\tnhhnt.exec:\tnhhnt.exe94⤵
-
\??\c:\nhttbt.exec:\nhttbt.exe95⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe96⤵
-
\??\c:\rrxxxrr.exec:\rrxxxrr.exe97⤵
-
\??\c:\thtnnt.exec:\thtnnt.exe98⤵
-
\??\c:\dppjd.exec:\dppjd.exe99⤵
-
\??\c:\djvjp.exec:\djvjp.exe100⤵
-
\??\c:\1rfxffl.exec:\1rfxffl.exe101⤵
-
\??\c:\bbnnnt.exec:\bbnnnt.exe102⤵
-
\??\c:\5dppd.exec:\5dppd.exe103⤵
-
\??\c:\jjpjv.exec:\jjpjv.exe104⤵
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe105⤵
-
\??\c:\btbbtt.exec:\btbbtt.exe106⤵
-
\??\c:\tbnbbh.exec:\tbnbbh.exe107⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe108⤵
-
\??\c:\lfffrrr.exec:\lfffrrr.exe109⤵
-
\??\c:\thnhbh.exec:\thnhbh.exe110⤵
-
\??\c:\1vdvp.exec:\1vdvp.exe111⤵
-
\??\c:\pdppp.exec:\pdppp.exe112⤵
-
\??\c:\rlxrlll.exec:\rlxrlll.exe113⤵
-
\??\c:\hhnnhn.exec:\hhnnhn.exe114⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe115⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe116⤵
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe117⤵
-
\??\c:\9hnhhh.exec:\9hnhhh.exe118⤵
-
\??\c:\bnhbbb.exec:\bnhbbb.exe119⤵
-
\??\c:\vjpvj.exec:\vjpvj.exe120⤵
-
\??\c:\1xffxff.exec:\1xffxff.exe121⤵
-
\??\c:\frffxxr.exec:\frffxxr.exe122⤵
-
\??\c:\btttnn.exec:\btttnn.exe123⤵
-
\??\c:\3pvvv.exec:\3pvvv.exe124⤵
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe125⤵
-
\??\c:\nhhhhh.exec:\nhhhhh.exe126⤵
-
\??\c:\jjvpv.exec:\jjvpv.exe127⤵
-
\??\c:\xfffxrr.exec:\xfffxrr.exe128⤵
-
\??\c:\3fxrrxf.exec:\3fxrrxf.exe129⤵
-
\??\c:\tnhhnh.exec:\tnhhnh.exe130⤵
-
\??\c:\vpjvp.exec:\vpjvp.exe131⤵
-
\??\c:\rrrllll.exec:\rrrllll.exe132⤵
-
\??\c:\xffxllf.exec:\xffxllf.exe133⤵
-
\??\c:\nnnbtn.exec:\nnnbtn.exe134⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe135⤵
-
\??\c:\llfrrlf.exec:\llfrrlf.exe136⤵
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe137⤵
-
\??\c:\hthnnt.exec:\hthnnt.exe138⤵
-
\??\c:\ddpjp.exec:\ddpjp.exe139⤵
-
\??\c:\rrrlffr.exec:\rrrlffr.exe140⤵
-
\??\c:\1rxlflx.exec:\1rxlflx.exe141⤵
-
\??\c:\nttttt.exec:\nttttt.exe142⤵
-
\??\c:\djddj.exec:\djddj.exe143⤵
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe144⤵
-
\??\c:\hntnhh.exec:\hntnhh.exe145⤵
-
\??\c:\dvdpj.exec:\dvdpj.exe146⤵
-
\??\c:\llxlrlf.exec:\llxlrlf.exe147⤵
-
\??\c:\bttnhb.exec:\bttnhb.exe148⤵
-
\??\c:\bthbnh.exec:\bthbnh.exe149⤵
-
\??\c:\jvdvd.exec:\jvdvd.exe150⤵
-
\??\c:\fxxrxxr.exec:\fxxrxxr.exe151⤵
-
\??\c:\bhbhnn.exec:\bhbhnn.exe152⤵
-
\??\c:\nbhhbb.exec:\nbhhbb.exe153⤵
-
\??\c:\djpvj.exec:\djpvj.exe154⤵
-
\??\c:\1ffrlfx.exec:\1ffrlfx.exe155⤵
-
\??\c:\htbbbb.exec:\htbbbb.exe156⤵
-
\??\c:\hbhhbb.exec:\hbhhbb.exe157⤵
-
\??\c:\vdvdd.exec:\vdvdd.exe158⤵
-
\??\c:\rrrrflr.exec:\rrrrflr.exe159⤵
-
\??\c:\bhhhbb.exec:\bhhhbb.exe160⤵
-
\??\c:\tnbbbb.exec:\tnbbbb.exe161⤵
-
\??\c:\dvdjd.exec:\dvdjd.exe162⤵
-
\??\c:\xxlffff.exec:\xxlffff.exe163⤵
-
\??\c:\bnhhnn.exec:\bnhhnn.exe164⤵
-
\??\c:\ttnhbt.exec:\ttnhbt.exe165⤵
-
\??\c:\9jvvj.exec:\9jvvj.exe166⤵
-
\??\c:\rfxrffx.exec:\rfxrffx.exe167⤵
-
\??\c:\1rfflrl.exec:\1rfflrl.exe168⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe169⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe170⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe171⤵
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe172⤵
-
\??\c:\bbnhnn.exec:\bbnhnn.exe173⤵
-
\??\c:\jjjjp.exec:\jjjjp.exe174⤵
-
\??\c:\djvdv.exec:\djvdv.exe175⤵
-
\??\c:\3xfxrlf.exec:\3xfxrlf.exe176⤵
-
\??\c:\bnbnhh.exec:\bnbnhh.exe177⤵
-
\??\c:\jjjpj.exec:\jjjpj.exe178⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe179⤵
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe180⤵
-
\??\c:\1hhbbb.exec:\1hhbbb.exe181⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe182⤵
-
\??\c:\pppjv.exec:\pppjv.exe183⤵
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe184⤵
-
\??\c:\bhnnnb.exec:\bhnnnb.exe185⤵
-
\??\c:\pddvv.exec:\pddvv.exe186⤵
-
\??\c:\jdddp.exec:\jdddp.exe187⤵
-
\??\c:\rxxrllf.exec:\rxxrllf.exe188⤵
-
\??\c:\tthnhn.exec:\tthnhn.exe189⤵
-
\??\c:\tnntnt.exec:\tnntnt.exe190⤵
-
\??\c:\3vvpj.exec:\3vvpj.exe191⤵
-
\??\c:\xrxrxlf.exec:\xrxrxlf.exe192⤵
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe193⤵
-
\??\c:\tttnhn.exec:\tttnhn.exe194⤵
-
\??\c:\vvjjp.exec:\vvjjp.exe195⤵
-
\??\c:\llrlxxf.exec:\llrlxxf.exe196⤵
-
\??\c:\1lrrrrr.exec:\1lrrrrr.exe197⤵
-
\??\c:\hbbnhb.exec:\hbbnhb.exe198⤵
-
\??\c:\dpvpp.exec:\dpvpp.exe199⤵
-
\??\c:\rrrrlxx.exec:\rrrrlxx.exe200⤵
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe201⤵
-
\??\c:\5bbbtb.exec:\5bbbtb.exe202⤵
-
\??\c:\dddvv.exec:\dddvv.exe203⤵
-
\??\c:\vjvpv.exec:\vjvpv.exe204⤵
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe205⤵
-
\??\c:\hbbhbb.exec:\hbbhbb.exe206⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe207⤵
-
\??\c:\1ddvp.exec:\1ddvp.exe208⤵
-
\??\c:\rfrlrrr.exec:\rfrlrrr.exe209⤵
-
\??\c:\bnhtnh.exec:\bnhtnh.exe210⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe211⤵
-
\??\c:\vvppj.exec:\vvppj.exe212⤵
-
\??\c:\3rrlxfx.exec:\3rrlxfx.exe213⤵
-
\??\c:\tbhhhh.exec:\tbhhhh.exe214⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe215⤵
-
\??\c:\xxffxxr.exec:\xxffxxr.exe216⤵
-
\??\c:\1hhnhn.exec:\1hhnhn.exe217⤵
-
\??\c:\ddppd.exec:\ddppd.exe218⤵
-
\??\c:\ddvvp.exec:\ddvvp.exe219⤵
-
\??\c:\rffxrlf.exec:\rffxrlf.exe220⤵
-
\??\c:\bnbnhb.exec:\bnbnhb.exe221⤵
-
\??\c:\jvddd.exec:\jvddd.exe222⤵
-
\??\c:\lxfrrrr.exec:\lxfrrrr.exe223⤵
-
\??\c:\rfllfff.exec:\rfllfff.exe224⤵
-
\??\c:\tbhhhb.exec:\tbhhhb.exe225⤵
-
\??\c:\jddvp.exec:\jddvp.exe226⤵
-
\??\c:\frfrrxl.exec:\frfrrxl.exe227⤵
-
\??\c:\hbbhhh.exec:\hbbhhh.exe228⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe229⤵
-
\??\c:\1vvpp.exec:\1vvpp.exe230⤵
-
\??\c:\lfxrlrr.exec:\lfxrlrr.exe231⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe232⤵
-
\??\c:\vjpvj.exec:\vjpvj.exe233⤵
-
\??\c:\llxrfff.exec:\llxrfff.exe234⤵
-
\??\c:\frlfxrl.exec:\frlfxrl.exe235⤵
-
\??\c:\bhhhht.exec:\bhhhht.exe236⤵
-
\??\c:\jddvj.exec:\jddvj.exe237⤵
-
\??\c:\5rrrrxx.exec:\5rrrrxx.exe238⤵
-
\??\c:\bhhhbb.exec:\bhhhbb.exe239⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe240⤵
-
\??\c:\1jdvp.exec:\1jdvp.exe241⤵