Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 06:11
Behavioral task
behavioral1
Sample
cf4be40fac405dcd18e6ed8b275a1a90_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
cf4be40fac405dcd18e6ed8b275a1a90_NeikiAnalytics.exe
-
Size
328KB
-
MD5
cf4be40fac405dcd18e6ed8b275a1a90
-
SHA1
3192ef205f9acf1f2decf30f0ae1671cccf80ee2
-
SHA256
1f9bc167ed974be8a2ceb5f488b74c8f6e88e6b8154cbca351541779590fd5a8
-
SHA512
2256bf70f44cdfe50ac8ca0a22773615fbb4dfc1da59c67841909084ba5dc55a18d36fed5e4b75dc8d58c86745777c7c7af79bec4ec3148cc5b2056978e3da98
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbe1:R4wFHoSHYHUrAwfMp3CD1
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3496-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/772-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4208-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nnbbtt.exelflfrrl.exenhttnt.exevppjd.exefxxxrrr.exelfxxrrr.exedjdpj.exepvvpd.exenbbtnn.exenhhbbb.exedddvv.exe1lxxxxx.exefxrrllf.exeddpjp.exerrllfff.exethhbbb.exepjpjv.exepjvpj.exe9thbhh.exetnhhnn.exevpvpd.exe9rrfxxl.exetnhbtn.exe9vvdv.exepdddv.exefxflfxx.exennntnt.exepvvvp.exelrxrxxx.exe1btnnn.exepjvpj.exe3pjdv.exelxllxfx.exettbbhb.exenhhbbb.exejjjjd.exellxxllr.exexrfflfl.exebnnbnn.exeddpvv.exejjddv.exexfrlxxr.exe5ttnhn.exentbtnh.exe5vpdv.exexlfrfxr.exexfxxxxr.exetbnhhh.exetnthbn.exeddjjj.exexlrfffx.exelrrffxr.exehhhbnn.exejjvpp.exedppvd.exefrxffff.exerrfxrlf.exebhttnn.exejvvjv.exejpvvp.exe7xlfxrr.exe5llfxxl.exe5bhtnb.exedjvvv.exepid process 1972 nnbbtt.exe 1584 lflfrrl.exe 3484 nhttnt.exe 4152 vppjd.exe 1480 fxxxrrr.exe 1196 lfxxrrr.exe 976 djdpj.exe 3724 pvvpd.exe 2208 nbbtnn.exe 2160 nhhbbb.exe 1784 dddvv.exe 3060 1lxxxxx.exe 3460 fxrrllf.exe 772 ddpjp.exe 4208 rrllfff.exe 1216 thhbbb.exe 644 pjpjv.exe 4168 pjvpj.exe 1348 9thbhh.exe 4428 tnhhnn.exe 4000 vpvpd.exe 3432 9rrfxxl.exe 4648 tnhbtn.exe 3300 9vvdv.exe 4508 pdddv.exe 1588 fxflfxx.exe 884 nnntnt.exe 1124 pvvvp.exe 4608 lrxrxxx.exe 2920 1btnnn.exe 4184 pjvpj.exe 3340 3pjdv.exe 4792 lxllxfx.exe 3384 ttbbhb.exe 3968 nhhbbb.exe 4264 jjjjd.exe 1176 llxxllr.exe 432 xrfflfl.exe 3524 bnnbnn.exe 4488 ddpvv.exe 4628 jjddv.exe 5116 xfrlxxr.exe 1772 5ttnhn.exe 2988 ntbtnh.exe 3436 5vpdv.exe 640 xlfrfxr.exe 1272 xfxxxxr.exe 4088 tbnhhh.exe 976 tnthbn.exe 4784 ddjjj.exe 312 xlrfffx.exe 5080 lrrffxr.exe 2672 hhhbnn.exe 5000 jjvpp.exe 4580 dppvd.exe 5052 frxffff.exe 1988 rrfxrlf.exe 4864 bhttnn.exe 3060 jvvjv.exe 3732 jpvvp.exe 4248 7xlfxrr.exe 3348 5llfxxl.exe 3000 5bhtnb.exe 5108 djvvv.exe -
Processes:
resource yara_rule behavioral2/memory/3496-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nnbbtt.exe upx behavioral2/memory/3496-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1972-6-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lflfrrl.exe upx behavioral2/memory/1972-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhttnt.exe upx behavioral2/memory/1584-16-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppjd.exe upx behavioral2/memory/3484-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4152-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1480-27-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxxxrrr.exe upx \??\c:\lfxxrrr.exe upx behavioral2/memory/1196-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djdpj.exe upx behavioral2/memory/1196-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/976-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvvpd.exe upx behavioral2/memory/3724-43-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbbtnn.exe upx behavioral2/memory/2208-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2208-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1784-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1lxxxxx.exe upx \??\c:\fxrrllf.exe upx behavioral2/memory/3060-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2160-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3460-73-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddpjp.exe upx behavioral2/memory/772-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjpjv.exe upx behavioral2/memory/1216-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/644-93-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjvpj.exe upx C:\9thbhh.exe upx behavioral2/memory/1348-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4168-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvpd.exe upx \??\c:\tnhbtn.exe upx behavioral2/memory/4648-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3300-124-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdddv.exe upx \??\c:\nnntnt.exe upx C:\pvvvp.exe upx C:\1btnnn.exe upx C:\pjvpj.exe upx behavioral2/memory/3340-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1176-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4264-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2988-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3436-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5080-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5000-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4864-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4248-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5052-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3348-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5108-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1772-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4628-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/404-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4608-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/432-177-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cf4be40fac405dcd18e6ed8b275a1a90_NeikiAnalytics.exennbbtt.exelflfrrl.exenhttnt.exevppjd.exefxxxrrr.exelfxxrrr.exedjdpj.exepvvpd.exenbbtnn.exenhhbbb.exedddvv.exe1lxxxxx.exefxrrllf.exeddpjp.exerrllfff.exethhbbb.exepjpjv.exepjvpj.exe9thbhh.exetnhhnn.exevpvpd.exedescription pid process target process PID 3496 wrote to memory of 1972 3496 cf4be40fac405dcd18e6ed8b275a1a90_NeikiAnalytics.exe nnbbtt.exe PID 3496 wrote to memory of 1972 3496 cf4be40fac405dcd18e6ed8b275a1a90_NeikiAnalytics.exe nnbbtt.exe PID 3496 wrote to memory of 1972 3496 cf4be40fac405dcd18e6ed8b275a1a90_NeikiAnalytics.exe nnbbtt.exe PID 1972 wrote to memory of 1584 1972 nnbbtt.exe lflfrrl.exe PID 1972 wrote to memory of 1584 1972 nnbbtt.exe lflfrrl.exe PID 1972 wrote to memory of 1584 1972 nnbbtt.exe lflfrrl.exe PID 1584 wrote to memory of 3484 1584 lflfrrl.exe nhttnt.exe PID 1584 wrote to memory of 3484 1584 lflfrrl.exe nhttnt.exe PID 1584 wrote to memory of 3484 1584 lflfrrl.exe nhttnt.exe PID 3484 wrote to memory of 4152 3484 nhttnt.exe vppjd.exe PID 3484 wrote to memory of 4152 3484 nhttnt.exe vppjd.exe PID 3484 wrote to memory of 4152 3484 nhttnt.exe vppjd.exe PID 4152 wrote to memory of 1480 4152 vppjd.exe fxxxrrr.exe PID 4152 wrote to memory of 1480 4152 vppjd.exe fxxxrrr.exe PID 4152 wrote to memory of 1480 4152 vppjd.exe fxxxrrr.exe PID 1480 wrote to memory of 1196 1480 fxxxrrr.exe lfxxrrr.exe PID 1480 wrote to memory of 1196 1480 fxxxrrr.exe lfxxrrr.exe PID 1480 wrote to memory of 1196 1480 fxxxrrr.exe lfxxrrr.exe PID 1196 wrote to memory of 976 1196 lfxxrrr.exe tnthbn.exe PID 1196 wrote to memory of 976 1196 lfxxrrr.exe tnthbn.exe PID 1196 wrote to memory of 976 1196 lfxxrrr.exe tnthbn.exe PID 976 wrote to memory of 3724 976 djdpj.exe pvvpd.exe PID 976 wrote to memory of 3724 976 djdpj.exe pvvpd.exe PID 976 wrote to memory of 3724 976 djdpj.exe pvvpd.exe PID 3724 wrote to memory of 2208 3724 pvvpd.exe nbbtnn.exe PID 3724 wrote to memory of 2208 3724 pvvpd.exe nbbtnn.exe PID 3724 wrote to memory of 2208 3724 pvvpd.exe nbbtnn.exe PID 2208 wrote to memory of 2160 2208 nbbtnn.exe nhhbbb.exe PID 2208 wrote to memory of 2160 2208 nbbtnn.exe nhhbbb.exe PID 2208 wrote to memory of 2160 2208 nbbtnn.exe nhhbbb.exe PID 2160 wrote to memory of 1784 2160 nhhbbb.exe dddvv.exe PID 2160 wrote to memory of 1784 2160 nhhbbb.exe dddvv.exe PID 2160 wrote to memory of 1784 2160 nhhbbb.exe dddvv.exe PID 1784 wrote to memory of 3060 1784 dddvv.exe 1lxxxxx.exe PID 1784 wrote to memory of 3060 1784 dddvv.exe 1lxxxxx.exe PID 1784 wrote to memory of 3060 1784 dddvv.exe 1lxxxxx.exe PID 3060 wrote to memory of 3460 3060 1lxxxxx.exe fxrrllf.exe PID 3060 wrote to memory of 3460 3060 1lxxxxx.exe fxrrllf.exe PID 3060 wrote to memory of 3460 3060 1lxxxxx.exe fxrrllf.exe PID 3460 wrote to memory of 772 3460 fxrrllf.exe ddpjp.exe PID 3460 wrote to memory of 772 3460 fxrrllf.exe ddpjp.exe PID 3460 wrote to memory of 772 3460 fxrrllf.exe ddpjp.exe PID 772 wrote to memory of 4208 772 ddpjp.exe rrllfff.exe PID 772 wrote to memory of 4208 772 ddpjp.exe rrllfff.exe PID 772 wrote to memory of 4208 772 ddpjp.exe rrllfff.exe PID 4208 wrote to memory of 1216 4208 rrllfff.exe thhbbb.exe PID 4208 wrote to memory of 1216 4208 rrllfff.exe thhbbb.exe PID 4208 wrote to memory of 1216 4208 rrllfff.exe thhbbb.exe PID 1216 wrote to memory of 644 1216 thhbbb.exe pjpjv.exe PID 1216 wrote to memory of 644 1216 thhbbb.exe pjpjv.exe PID 1216 wrote to memory of 644 1216 thhbbb.exe pjpjv.exe PID 644 wrote to memory of 4168 644 pjpjv.exe pjvpj.exe PID 644 wrote to memory of 4168 644 pjpjv.exe pjvpj.exe PID 644 wrote to memory of 4168 644 pjpjv.exe pjvpj.exe PID 4168 wrote to memory of 1348 4168 pjvpj.exe djppp.exe PID 4168 wrote to memory of 1348 4168 pjvpj.exe djppp.exe PID 4168 wrote to memory of 1348 4168 pjvpj.exe djppp.exe PID 1348 wrote to memory of 4428 1348 9thbhh.exe tnhhnn.exe PID 1348 wrote to memory of 4428 1348 9thbhh.exe tnhhnn.exe PID 1348 wrote to memory of 4428 1348 9thbhh.exe tnhhnn.exe PID 4428 wrote to memory of 4000 4428 tnhhnn.exe vpvpd.exe PID 4428 wrote to memory of 4000 4428 tnhhnn.exe vpvpd.exe PID 4428 wrote to memory of 4000 4428 tnhhnn.exe vpvpd.exe PID 4000 wrote to memory of 3432 4000 vpvpd.exe 9rrfxxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf4be40fac405dcd18e6ed8b275a1a90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cf4be40fac405dcd18e6ed8b275a1a90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\nnbbtt.exec:\nnbbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflfrrl.exec:\lflfrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhttnt.exec:\nhttnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vppjd.exec:\vppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djdpj.exec:\djdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvvpd.exec:\pvvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbtnn.exec:\nbbtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhbbb.exec:\nhhbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dddvv.exec:\dddvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1lxxxxx.exec:\1lxxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrrllf.exec:\fxrrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddpjp.exec:\ddpjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrllfff.exec:\rrllfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thhbbb.exec:\thhbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpjv.exec:\pjpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvpj.exec:\pjvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9thbhh.exec:\9thbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhhnn.exec:\tnhhnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvpd.exec:\vpvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9rrfxxl.exec:\9rrfxxl.exe23⤵
- Executes dropped EXE
-
\??\c:\tnhbtn.exec:\tnhbtn.exe24⤵
- Executes dropped EXE
-
\??\c:\9vvdv.exec:\9vvdv.exe25⤵
- Executes dropped EXE
-
\??\c:\pdddv.exec:\pdddv.exe26⤵
- Executes dropped EXE
-
\??\c:\fxflfxx.exec:\fxflfxx.exe27⤵
- Executes dropped EXE
-
\??\c:\nnntnt.exec:\nnntnt.exe28⤵
- Executes dropped EXE
-
\??\c:\pvvvp.exec:\pvvvp.exe29⤵
- Executes dropped EXE
-
\??\c:\lrxrxxx.exec:\lrxrxxx.exe30⤵
- Executes dropped EXE
-
\??\c:\1btnnn.exec:\1btnnn.exe31⤵
- Executes dropped EXE
-
\??\c:\pjvpj.exec:\pjvpj.exe32⤵
- Executes dropped EXE
-
\??\c:\3pjdv.exec:\3pjdv.exe33⤵
- Executes dropped EXE
-
\??\c:\lxllxfx.exec:\lxllxfx.exe34⤵
- Executes dropped EXE
-
\??\c:\ttbbhb.exec:\ttbbhb.exe35⤵
- Executes dropped EXE
-
\??\c:\nhhbbb.exec:\nhhbbb.exe36⤵
- Executes dropped EXE
-
\??\c:\jjjjd.exec:\jjjjd.exe37⤵
- Executes dropped EXE
-
\??\c:\llxxllr.exec:\llxxllr.exe38⤵
- Executes dropped EXE
-
\??\c:\xrfflfl.exec:\xrfflfl.exe39⤵
- Executes dropped EXE
-
\??\c:\bnnbnn.exec:\bnnbnn.exe40⤵
- Executes dropped EXE
-
\??\c:\ddpvv.exec:\ddpvv.exe41⤵
- Executes dropped EXE
-
\??\c:\jjddv.exec:\jjddv.exe42⤵
- Executes dropped EXE
-
\??\c:\xfrlxxr.exec:\xfrlxxr.exe43⤵
- Executes dropped EXE
-
\??\c:\5ttnhn.exec:\5ttnhn.exe44⤵
- Executes dropped EXE
-
\??\c:\ntbtnh.exec:\ntbtnh.exe45⤵
- Executes dropped EXE
-
\??\c:\5vpdv.exec:\5vpdv.exe46⤵
- Executes dropped EXE
-
\??\c:\xlfrfxr.exec:\xlfrfxr.exe47⤵
- Executes dropped EXE
-
\??\c:\xfxxxxr.exec:\xfxxxxr.exe48⤵
- Executes dropped EXE
-
\??\c:\tbnhhh.exec:\tbnhhh.exe49⤵
- Executes dropped EXE
-
\??\c:\tnthbn.exec:\tnthbn.exe50⤵
- Executes dropped EXE
-
\??\c:\ddjjj.exec:\ddjjj.exe51⤵
- Executes dropped EXE
-
\??\c:\xlrfffx.exec:\xlrfffx.exe52⤵
- Executes dropped EXE
-
\??\c:\lrrffxr.exec:\lrrffxr.exe53⤵
- Executes dropped EXE
-
\??\c:\hhhbnn.exec:\hhhbnn.exe54⤵
- Executes dropped EXE
-
\??\c:\jjvpp.exec:\jjvpp.exe55⤵
- Executes dropped EXE
-
\??\c:\dppvd.exec:\dppvd.exe56⤵
- Executes dropped EXE
-
\??\c:\frxffff.exec:\frxffff.exe57⤵
- Executes dropped EXE
-
\??\c:\rrfxrlf.exec:\rrfxrlf.exe58⤵
- Executes dropped EXE
-
\??\c:\bhttnn.exec:\bhttnn.exe59⤵
- Executes dropped EXE
-
\??\c:\jvvjv.exec:\jvvjv.exe60⤵
- Executes dropped EXE
-
\??\c:\jpvvp.exec:\jpvvp.exe61⤵
- Executes dropped EXE
-
\??\c:\7xlfxrr.exec:\7xlfxrr.exe62⤵
- Executes dropped EXE
-
\??\c:\5llfxxl.exec:\5llfxxl.exe63⤵
- Executes dropped EXE
-
\??\c:\5bhtnb.exec:\5bhtnb.exe64⤵
- Executes dropped EXE
-
\??\c:\djvvv.exec:\djvvv.exe65⤵
- Executes dropped EXE
-
\??\c:\xllfrrr.exec:\xllfrrr.exe66⤵
-
\??\c:\rlfxllf.exec:\rlfxllf.exe67⤵
-
\??\c:\nbhbbt.exec:\nbhbbt.exe68⤵
-
\??\c:\djppp.exec:\djppp.exe69⤵
-
\??\c:\dpppj.exec:\dpppj.exe70⤵
-
\??\c:\fxrfxxr.exec:\fxrfxxr.exe71⤵
-
\??\c:\xxllrxf.exec:\xxllrxf.exe72⤵
-
\??\c:\nbtnnn.exec:\nbtnnn.exe73⤵
-
\??\c:\pddvp.exec:\pddvp.exe74⤵
-
\??\c:\xlrfxxx.exec:\xlrfxxx.exe75⤵
-
\??\c:\tttbhh.exec:\tttbhh.exe76⤵
-
\??\c:\ntbbbt.exec:\ntbbbt.exe77⤵
-
\??\c:\jddvj.exec:\jddvj.exe78⤵
-
\??\c:\lllfrrr.exec:\lllfrrr.exe79⤵
-
\??\c:\nhttbb.exec:\nhttbb.exe80⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe81⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe82⤵
-
\??\c:\flxrrrr.exec:\flxrrrr.exe83⤵
-
\??\c:\tnthhb.exec:\tnthhb.exe84⤵
-
\??\c:\djpjj.exec:\djpjj.exe85⤵
-
\??\c:\3xrrllf.exec:\3xrrllf.exe86⤵
-
\??\c:\7rxxlrx.exec:\7rxxlrx.exe87⤵
-
\??\c:\bbtnhn.exec:\bbtnhn.exe88⤵
-
\??\c:\dpvdp.exec:\dpvdp.exe89⤵
-
\??\c:\1lxrfxr.exec:\1lxrfxr.exe90⤵
-
\??\c:\9rffxxr.exec:\9rffxxr.exe91⤵
-
\??\c:\hbbtnb.exec:\hbbtnb.exe92⤵
-
\??\c:\bnnhhh.exec:\bnnhhh.exe93⤵
-
\??\c:\pddvv.exec:\pddvv.exe94⤵
-
\??\c:\lflfxlf.exec:\lflfxlf.exe95⤵
-
\??\c:\tnbbtb.exec:\tnbbtb.exe96⤵
-
\??\c:\djpjj.exec:\djpjj.exe97⤵
-
\??\c:\5pjdv.exec:\5pjdv.exe98⤵
-
\??\c:\tbttnn.exec:\tbttnn.exe99⤵
-
\??\c:\tbtnhb.exec:\tbtnhb.exe100⤵
-
\??\c:\vvpdj.exec:\vvpdj.exe101⤵
-
\??\c:\rrfflfl.exec:\rrfflfl.exe102⤵
-
\??\c:\rrfxfrr.exec:\rrfxfrr.exe103⤵
-
\??\c:\hbtnhh.exec:\hbtnhh.exe104⤵
-
\??\c:\vvvjp.exec:\vvvjp.exe105⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe106⤵
-
\??\c:\5lrrfxf.exec:\5lrrfxf.exe107⤵
-
\??\c:\djpvj.exec:\djpvj.exe108⤵
-
\??\c:\3bbnhh.exec:\3bbnhh.exe109⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe110⤵
-
\??\c:\3jpvv.exec:\3jpvv.exe111⤵
-
\??\c:\nthhtt.exec:\nthhtt.exe112⤵
-
\??\c:\vdppj.exec:\vdppj.exe113⤵
-
\??\c:\flrllrl.exec:\flrllrl.exe114⤵
-
\??\c:\bttbtb.exec:\bttbtb.exe115⤵
-
\??\c:\jvddv.exec:\jvddv.exe116⤵
-
\??\c:\rxflxxx.exec:\rxflxxx.exe117⤵
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe118⤵
-
\??\c:\thhhbb.exec:\thhhbb.exe119⤵
-
\??\c:\nthhbt.exec:\nthhbt.exe120⤵
-
\??\c:\vppjv.exec:\vppjv.exe121⤵
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe122⤵
-
\??\c:\rfrlllr.exec:\rfrlllr.exe123⤵
-
\??\c:\tntnhh.exec:\tntnhh.exe124⤵
-
\??\c:\vvjvj.exec:\vvjvj.exe125⤵
-
\??\c:\dppdv.exec:\dppdv.exe126⤵
-
\??\c:\3lxxlll.exec:\3lxxlll.exe127⤵
-
\??\c:\3bbbtt.exec:\3bbbtt.exe128⤵
-
\??\c:\jjdvp.exec:\jjdvp.exe129⤵
-
\??\c:\9rfrrlr.exec:\9rfrrlr.exe130⤵
-
\??\c:\lffxrrx.exec:\lffxrrx.exe131⤵
-
\??\c:\ttbtnn.exec:\ttbtnn.exe132⤵
-
\??\c:\5tttnn.exec:\5tttnn.exe133⤵
-
\??\c:\ppppd.exec:\ppppd.exe134⤵
-
\??\c:\lxlxrll.exec:\lxlxrll.exe135⤵
-
\??\c:\rfrlfff.exec:\rfrlfff.exe136⤵
-
\??\c:\bnnnhh.exec:\bnnnhh.exe137⤵
-
\??\c:\1pjjp.exec:\1pjjp.exe138⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe139⤵
-
\??\c:\xrfrxrl.exec:\xrfrxrl.exe140⤵
-
\??\c:\thhbhb.exec:\thhbhb.exe141⤵
-
\??\c:\djvvj.exec:\djvvj.exe142⤵
-
\??\c:\bttbtt.exec:\bttbtt.exe143⤵
-
\??\c:\pvvjp.exec:\pvvjp.exe144⤵
-
\??\c:\pddpv.exec:\pddpv.exe145⤵
-
\??\c:\jjppd.exec:\jjppd.exe146⤵
-
\??\c:\7lrrlrr.exec:\7lrrlrr.exe147⤵
-
\??\c:\tnbthh.exec:\tnbthh.exe148⤵
-
\??\c:\dddvj.exec:\dddvj.exe149⤵
-
\??\c:\1jdvj.exec:\1jdvj.exe150⤵
-
\??\c:\rfflfxf.exec:\rfflfxf.exe151⤵
-
\??\c:\fxlfxxl.exec:\fxlfxxl.exe152⤵
-
\??\c:\7tnnhh.exec:\7tnnhh.exe153⤵
-
\??\c:\btnhtn.exec:\btnhtn.exe154⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe155⤵
-
\??\c:\pvvpd.exec:\pvvpd.exe156⤵
-
\??\c:\rlflfrf.exec:\rlflfrf.exe157⤵
-
\??\c:\5tnhtn.exec:\5tnhtn.exe158⤵
-
\??\c:\ttbtbb.exec:\ttbtbb.exe159⤵
-
\??\c:\dddpj.exec:\dddpj.exe160⤵
-
\??\c:\1jpjv.exec:\1jpjv.exe161⤵
-
\??\c:\lrrxlxr.exec:\lrrxlxr.exe162⤵
-
\??\c:\bnhtht.exec:\bnhtht.exe163⤵
-
\??\c:\nnnnbb.exec:\nnnnbb.exe164⤵
-
\??\c:\vjjvp.exec:\vjjvp.exe165⤵
-
\??\c:\dvdjv.exec:\dvdjv.exe166⤵
-
\??\c:\xxfxlfl.exec:\xxfxlfl.exe167⤵
-
\??\c:\xrlxrfr.exec:\xrlxrfr.exe168⤵
-
\??\c:\5tnbtn.exec:\5tnbtn.exe169⤵
-
\??\c:\jjdpd.exec:\jjdpd.exe170⤵
-
\??\c:\vjjvd.exec:\vjjvd.exe171⤵
-
\??\c:\frfxxlf.exec:\frfxxlf.exe172⤵
-
\??\c:\5ntnnh.exec:\5ntnnh.exe173⤵
-
\??\c:\tnhnbh.exec:\tnhnbh.exe174⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe175⤵
-
\??\c:\rxffxlf.exec:\rxffxlf.exe176⤵
-
\??\c:\5lxxrxl.exec:\5lxxrxl.exe177⤵
-
\??\c:\nnbtnh.exec:\nnbtnh.exe178⤵
-
\??\c:\vvvpv.exec:\vvvpv.exe179⤵
-
\??\c:\fxxrffx.exec:\fxxrffx.exe180⤵
-
\??\c:\5hbtnh.exec:\5hbtnh.exe181⤵
-
\??\c:\7bnbbt.exec:\7bnbbt.exe182⤵
-
\??\c:\pddpv.exec:\pddpv.exe183⤵
-
\??\c:\7pvjv.exec:\7pvjv.exe184⤵
-
\??\c:\frlxlfr.exec:\frlxlfr.exe185⤵
-
\??\c:\bhbtnn.exec:\bhbtnn.exe186⤵
-
\??\c:\nnthhn.exec:\nnthhn.exe187⤵
-
\??\c:\pvvjd.exec:\pvvjd.exe188⤵
-
\??\c:\rfrfxrr.exec:\rfrfxrr.exe189⤵
-
\??\c:\tbbttn.exec:\tbbttn.exe190⤵
-
\??\c:\5nbnbt.exec:\5nbnbt.exe191⤵
-
\??\c:\vdddp.exec:\vdddp.exe192⤵
-
\??\c:\jjjdj.exec:\jjjdj.exe193⤵
-
\??\c:\lllfxxx.exec:\lllfxxx.exe194⤵
-
\??\c:\htnhbt.exec:\htnhbt.exe195⤵
-
\??\c:\tnnhnh.exec:\tnnhnh.exe196⤵
-
\??\c:\9jdvp.exec:\9jdvp.exe197⤵
-
\??\c:\vddvd.exec:\vddvd.exe198⤵
-
\??\c:\lrxlfxr.exec:\lrxlfxr.exe199⤵
-
\??\c:\5bhthh.exec:\5bhthh.exe200⤵
-
\??\c:\dvpdd.exec:\dvpdd.exe201⤵
-
\??\c:\jdddj.exec:\jdddj.exe202⤵
-
\??\c:\rlfrfxl.exec:\rlfrfxl.exe203⤵
-
\??\c:\1nnnhb.exec:\1nnnhb.exe204⤵
-
\??\c:\thbthb.exec:\thbthb.exe205⤵
-
\??\c:\pppdp.exec:\pppdp.exe206⤵
-
\??\c:\7lxlfxf.exec:\7lxlfxf.exe207⤵
-
\??\c:\nbtnbh.exec:\nbtnbh.exe208⤵
-
\??\c:\tnnhtt.exec:\tnnhtt.exe209⤵
-
\??\c:\pjvjp.exec:\pjvjp.exe210⤵
-
\??\c:\7lxrfxx.exec:\7lxrfxx.exe211⤵
-
\??\c:\xrlrfxf.exec:\xrlrfxf.exe212⤵
-
\??\c:\nbhthh.exec:\nbhthh.exe213⤵
-
\??\c:\vpjvp.exec:\vpjvp.exe214⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe215⤵
-
\??\c:\7rlfrlf.exec:\7rlfrlf.exe216⤵
-
\??\c:\rfllffx.exec:\rfllffx.exe217⤵
-
\??\c:\hhntnh.exec:\hhntnh.exe218⤵
-
\??\c:\hthtnh.exec:\hthtnh.exe219⤵
-
\??\c:\jjppj.exec:\jjppj.exe220⤵
-
\??\c:\7lxrxlf.exec:\7lxrxlf.exe221⤵
-
\??\c:\1ffrffr.exec:\1ffrffr.exe222⤵
-
\??\c:\thhthn.exec:\thhthn.exe223⤵
-
\??\c:\5tnbnh.exec:\5tnbnh.exe224⤵
-
\??\c:\ppjpp.exec:\ppjpp.exe225⤵
-
\??\c:\lflfrxx.exec:\lflfrxx.exe226⤵
-
\??\c:\3bbtbb.exec:\3bbtbb.exe227⤵
-
\??\c:\bnhntn.exec:\bnhntn.exe228⤵
-
\??\c:\jvvpj.exec:\jvvpj.exe229⤵
-
\??\c:\frxlfxx.exec:\frxlfxx.exe230⤵
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe231⤵
-
\??\c:\thhbnh.exec:\thhbnh.exe232⤵
-
\??\c:\nbhttn.exec:\nbhttn.exe233⤵
-
\??\c:\jvvjv.exec:\jvvjv.exe234⤵
-
\??\c:\pdpdp.exec:\pdpdp.exe235⤵
-
\??\c:\lxlflfx.exec:\lxlflfx.exe236⤵
-
\??\c:\ntbhhh.exec:\ntbhhh.exe237⤵
-
\??\c:\5ddvp.exec:\5ddvp.exe238⤵
-
\??\c:\9jjdv.exec:\9jjdv.exe239⤵
-
\??\c:\rxxrfxl.exec:\rxxrfxl.exe240⤵
-
\??\c:\3thbnh.exec:\3thbnh.exe241⤵