Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 10:28
Behavioral task
behavioral1
Sample
4adda7603d9073f6bae4ef1690769089d979cffe5164ae02f60bd7a691178ba5_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4adda7603d9073f6bae4ef1690769089d979cffe5164ae02f60bd7a691178ba5_NeikiAnalytics.exe
-
Size
124KB
-
MD5
9d1996b74cf71d1abeb88e55ab36ec00
-
SHA1
44b2fe1b274ee4f120ea37996bbc5edcad4c695c
-
SHA256
4adda7603d9073f6bae4ef1690769089d979cffe5164ae02f60bd7a691178ba5
-
SHA512
64e414c2eb62f2db146831de4365014d9710baec4a97a39e169001c8cde3916a4a10c2d7e5e0828687fd672659266e234ad22ebf75c352d4747e1a1734fc3730
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JgY0nUp:9cm4FmowdHoS49oUp
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3780-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2212-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3520-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/664-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4132-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-685-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-768-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2648-799-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1096-837-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-838-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-870-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hnbttn.exedjvpp.exerxrfxfl.exelxffffx.exe7nbbnh.exevppjd.exe3vppj.exexrlfxrf.exennhbnt.exevvvdv.exeflfllxx.exentnnhn.exebtbnnh.exerlrlxxx.exerllffxr.exetnhhbh.exedvvpv.exejjvdd.exefrlrlrx.exefrfxxfl.exenhhbhb.exethnbtt.exetbhtnb.exe7jjdp.exe3rlfrrf.exetbbhhn.exe3pvpv.exeffffxxx.exefflfxxr.exebntnbh.exepjpvd.exeffrrxxf.exe1tnnhn.exebbnbbh.exedpppj.exexxrfxll.exe1xrlflf.exe1nttnn.exebtnnhh.exe5djdv.exeddppd.exe7ffllrr.exe3fxxxxr.exehthhhn.exedjvjd.exelfrrxxr.exehhhhhh.exe5jppd.exevdjdv.exelrffrrr.exettbnbn.exehnbtnt.exedvvjv.exelxlrrxx.exehthbbb.exebbbtnn.exepvvpp.exepvpvd.exe3fxxxfx.exebnhnth.exehtbttn.exejdpdv.exellrxxxx.exenthhbb.exepid process 2212 hnbttn.exe 5112 djvpp.exe 3520 rxrfxfl.exe 3476 lxffffx.exe 2992 7nbbnh.exe 3256 vppjd.exe 1000 3vppj.exe 1584 xrlfxrf.exe 4384 nnhbnt.exe 2312 vvvdv.exe 1068 flfllxx.exe 1440 ntnnhn.exe 4480 btbnnh.exe 2028 rlrlxxx.exe 5000 rllffxr.exe 2220 tnhhbh.exe 3708 dvvpv.exe 1204 jjvdd.exe 1860 frlrlrx.exe 3752 frfxxfl.exe 4176 nhhbhb.exe 4196 thnbtt.exe 4524 tbhtnb.exe 1168 7jjdp.exe 4120 3rlfrrf.exe 1924 tbbhhn.exe 2020 3pvpv.exe 4060 ffffxxx.exe 3316 fflfxxr.exe 5056 bntnbh.exe 4852 pjpvd.exe 1500 ffrrxxf.exe 4032 1tnnhn.exe 3116 bbnbbh.exe 2364 dpppj.exe 3084 xxrfxll.exe 1484 1xrlflf.exe 4780 1nttnn.exe 3280 btnnhh.exe 1072 5djdv.exe 724 ddppd.exe 952 7ffllrr.exe 2580 3fxxxxr.exe 4620 hthhhn.exe 664 djvjd.exe 3788 lfrrxxr.exe 3360 hhhhhh.exe 4996 5jppd.exe 4696 vdjdv.exe 2408 lrffrrr.exe 3012 ttbnbn.exe 1720 hnbtnt.exe 3000 dvvjv.exe 4508 lxlrrxx.exe 2428 hthbbb.exe 2932 bbbtnn.exe 3904 pvvpp.exe 4048 pvpvd.exe 5100 3fxxxfx.exe 4292 bnhnth.exe 2344 htbttn.exe 1408 jdpdv.exe 3708 llrxxxx.exe 1200 nthhbb.exe -
Processes:
resource yara_rule behavioral2/memory/3780-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnbttn.exe upx behavioral2/memory/2212-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5112-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djvpp.exe upx C:\rxrfxfl.exe upx C:\lxffffx.exe upx behavioral2/memory/3476-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppjd.exe upx behavioral2/memory/2992-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3vppj.exe upx behavioral2/memory/3256-37-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7nbbnh.exe upx behavioral2/memory/3520-20-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlfxrf.exe upx behavioral2/memory/5112-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnhbnt.exe upx behavioral2/memory/1584-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvdv.exe upx behavioral2/memory/4384-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2312-61-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flfllxx.exe upx \??\c:\ntnnhn.exe upx behavioral2/memory/1068-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1440-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbnnh.exe upx behavioral2/memory/4480-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrlxxx.exe upx behavioral2/memory/2028-88-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rllffxr.exe upx behavioral2/memory/5000-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhhbh.exe upx behavioral2/memory/2220-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvpv.exe upx behavioral2/memory/3708-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjvdd.exe upx C:\frlrlrx.exe upx behavioral2/memory/1860-113-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frfxxfl.exe upx behavioral2/memory/3752-123-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhbhb.exe upx C:\thnbtt.exe upx \??\c:\tbhtnb.exe upx behavioral2/memory/4196-135-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7jjdp.exe upx behavioral2/memory/1168-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3rlfrrf.exe upx C:\tbbhhn.exe upx behavioral2/memory/4120-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4120-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3pvpv.exe upx behavioral2/memory/4060-168-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ffffxxx.exe upx behavioral2/memory/1924-160-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fflfxxr.exe upx C:\bntnbh.exe upx behavioral2/memory/5056-178-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjpvd.exe upx C:\ffrrxxf.exe upx behavioral2/memory/4852-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3116-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2364-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1484-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4780-211-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4adda7603d9073f6bae4ef1690769089d979cffe5164ae02f60bd7a691178ba5_NeikiAnalytics.exehnbttn.exedjvpp.exerxrfxfl.exelxffffx.exe7nbbnh.exevppjd.exe3vppj.exexrlfxrf.exennhbnt.exevvvdv.exeflfllxx.exentnnhn.exebtbnnh.exerlrlxxx.exerllffxr.exetnhhbh.exedvvpv.exejjvdd.exefrlrlrx.exefrfxxfl.exenhhbhb.exedescription pid process target process PID 3780 wrote to memory of 2212 3780 4adda7603d9073f6bae4ef1690769089d979cffe5164ae02f60bd7a691178ba5_NeikiAnalytics.exe hnbttn.exe PID 3780 wrote to memory of 2212 3780 4adda7603d9073f6bae4ef1690769089d979cffe5164ae02f60bd7a691178ba5_NeikiAnalytics.exe hnbttn.exe PID 3780 wrote to memory of 2212 3780 4adda7603d9073f6bae4ef1690769089d979cffe5164ae02f60bd7a691178ba5_NeikiAnalytics.exe hnbttn.exe PID 2212 wrote to memory of 5112 2212 hnbttn.exe djvpp.exe PID 2212 wrote to memory of 5112 2212 hnbttn.exe djvpp.exe PID 2212 wrote to memory of 5112 2212 hnbttn.exe djvpp.exe PID 5112 wrote to memory of 3520 5112 djvpp.exe rxrfxfl.exe PID 5112 wrote to memory of 3520 5112 djvpp.exe rxrfxfl.exe PID 5112 wrote to memory of 3520 5112 djvpp.exe rxrfxfl.exe PID 3520 wrote to memory of 3476 3520 rxrfxfl.exe lxffffx.exe PID 3520 wrote to memory of 3476 3520 rxrfxfl.exe lxffffx.exe PID 3520 wrote to memory of 3476 3520 rxrfxfl.exe lxffffx.exe PID 3476 wrote to memory of 2992 3476 lxffffx.exe 7nbbnh.exe PID 3476 wrote to memory of 2992 3476 lxffffx.exe 7nbbnh.exe PID 3476 wrote to memory of 2992 3476 lxffffx.exe 7nbbnh.exe PID 2992 wrote to memory of 3256 2992 7nbbnh.exe vppjd.exe PID 2992 wrote to memory of 3256 2992 7nbbnh.exe vppjd.exe PID 2992 wrote to memory of 3256 2992 7nbbnh.exe vppjd.exe PID 3256 wrote to memory of 1000 3256 vppjd.exe 3vppj.exe PID 3256 wrote to memory of 1000 3256 vppjd.exe 3vppj.exe PID 3256 wrote to memory of 1000 3256 vppjd.exe 3vppj.exe PID 1000 wrote to memory of 1584 1000 3vppj.exe xrlfxrf.exe PID 1000 wrote to memory of 1584 1000 3vppj.exe xrlfxrf.exe PID 1000 wrote to memory of 1584 1000 3vppj.exe xrlfxrf.exe PID 1584 wrote to memory of 4384 1584 xrlfxrf.exe nnhbnt.exe PID 1584 wrote to memory of 4384 1584 xrlfxrf.exe nnhbnt.exe PID 1584 wrote to memory of 4384 1584 xrlfxrf.exe nnhbnt.exe PID 4384 wrote to memory of 2312 4384 nnhbnt.exe vvvdv.exe PID 4384 wrote to memory of 2312 4384 nnhbnt.exe vvvdv.exe PID 4384 wrote to memory of 2312 4384 nnhbnt.exe vvvdv.exe PID 2312 wrote to memory of 1068 2312 vvvdv.exe flfllxx.exe PID 2312 wrote to memory of 1068 2312 vvvdv.exe flfllxx.exe PID 2312 wrote to memory of 1068 2312 vvvdv.exe flfllxx.exe PID 1068 wrote to memory of 1440 1068 flfllxx.exe ntnnhn.exe PID 1068 wrote to memory of 1440 1068 flfllxx.exe ntnnhn.exe PID 1068 wrote to memory of 1440 1068 flfllxx.exe ntnnhn.exe PID 1440 wrote to memory of 4480 1440 ntnnhn.exe btbnnh.exe PID 1440 wrote to memory of 4480 1440 ntnnhn.exe btbnnh.exe PID 1440 wrote to memory of 4480 1440 ntnnhn.exe btbnnh.exe PID 4480 wrote to memory of 2028 4480 btbnnh.exe rlrlxxx.exe PID 4480 wrote to memory of 2028 4480 btbnnh.exe rlrlxxx.exe PID 4480 wrote to memory of 2028 4480 btbnnh.exe rlrlxxx.exe PID 2028 wrote to memory of 5000 2028 rlrlxxx.exe rllffxr.exe PID 2028 wrote to memory of 5000 2028 rlrlxxx.exe rllffxr.exe PID 2028 wrote to memory of 5000 2028 rlrlxxx.exe rllffxr.exe PID 5000 wrote to memory of 2220 5000 rllffxr.exe tnhhbh.exe PID 5000 wrote to memory of 2220 5000 rllffxr.exe tnhhbh.exe PID 5000 wrote to memory of 2220 5000 rllffxr.exe tnhhbh.exe PID 2220 wrote to memory of 3708 2220 tnhhbh.exe dvvpv.exe PID 2220 wrote to memory of 3708 2220 tnhhbh.exe dvvpv.exe PID 2220 wrote to memory of 3708 2220 tnhhbh.exe dvvpv.exe PID 3708 wrote to memory of 1204 3708 dvvpv.exe jjvdd.exe PID 3708 wrote to memory of 1204 3708 dvvpv.exe jjvdd.exe PID 3708 wrote to memory of 1204 3708 dvvpv.exe jjvdd.exe PID 1204 wrote to memory of 1860 1204 jjvdd.exe frlrlrx.exe PID 1204 wrote to memory of 1860 1204 jjvdd.exe frlrlrx.exe PID 1204 wrote to memory of 1860 1204 jjvdd.exe frlrlrx.exe PID 1860 wrote to memory of 3752 1860 frlrlrx.exe frfxxfl.exe PID 1860 wrote to memory of 3752 1860 frlrlrx.exe frfxxfl.exe PID 1860 wrote to memory of 3752 1860 frlrlrx.exe frfxxfl.exe PID 3752 wrote to memory of 4176 3752 frfxxfl.exe nhhbhb.exe PID 3752 wrote to memory of 4176 3752 frfxxfl.exe nhhbhb.exe PID 3752 wrote to memory of 4176 3752 frfxxfl.exe nhhbhb.exe PID 4176 wrote to memory of 4196 4176 nhhbhb.exe thnbtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4adda7603d9073f6bae4ef1690769089d979cffe5164ae02f60bd7a691178ba5_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4adda7603d9073f6bae4ef1690769089d979cffe5164ae02f60bd7a691178ba5_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbttn.exec:\hnbttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djvpp.exec:\djvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrfxfl.exec:\rxrfxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxffffx.exec:\lxffffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7nbbnh.exec:\7nbbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vppjd.exec:\vppjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3vppj.exec:\3vppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlfxrf.exec:\xrlfxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhbnt.exec:\nnhbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvdv.exec:\vvvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flfllxx.exec:\flfllxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntnnhn.exec:\ntnnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbnnh.exec:\btbnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rllffxr.exec:\rllffxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhhbh.exec:\tnhhbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvpv.exec:\dvvpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjvdd.exec:\jjvdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frlrlrx.exec:\frlrlrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frfxxfl.exec:\frfxxfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhbhb.exec:\nhhbhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnbtt.exec:\thnbtt.exe23⤵
- Executes dropped EXE
-
\??\c:\tbhtnb.exec:\tbhtnb.exe24⤵
- Executes dropped EXE
-
\??\c:\7jjdp.exec:\7jjdp.exe25⤵
- Executes dropped EXE
-
\??\c:\3rlfrrf.exec:\3rlfrrf.exe26⤵
- Executes dropped EXE
-
\??\c:\tbbhhn.exec:\tbbhhn.exe27⤵
- Executes dropped EXE
-
\??\c:\3pvpv.exec:\3pvpv.exe28⤵
- Executes dropped EXE
-
\??\c:\ffffxxx.exec:\ffffxxx.exe29⤵
- Executes dropped EXE
-
\??\c:\fflfxxr.exec:\fflfxxr.exe30⤵
- Executes dropped EXE
-
\??\c:\bntnbh.exec:\bntnbh.exe31⤵
- Executes dropped EXE
-
\??\c:\pjpvd.exec:\pjpvd.exe32⤵
- Executes dropped EXE
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe33⤵
- Executes dropped EXE
-
\??\c:\1tnnhn.exec:\1tnnhn.exe34⤵
- Executes dropped EXE
-
\??\c:\bbnbbh.exec:\bbnbbh.exe35⤵
- Executes dropped EXE
-
\??\c:\dpppj.exec:\dpppj.exe36⤵
- Executes dropped EXE
-
\??\c:\xxrfxll.exec:\xxrfxll.exe37⤵
- Executes dropped EXE
-
\??\c:\1xrlflf.exec:\1xrlflf.exe38⤵
- Executes dropped EXE
-
\??\c:\1nttnn.exec:\1nttnn.exe39⤵
- Executes dropped EXE
-
\??\c:\btnnhh.exec:\btnnhh.exe40⤵
- Executes dropped EXE
-
\??\c:\5djdv.exec:\5djdv.exe41⤵
- Executes dropped EXE
-
\??\c:\ddppd.exec:\ddppd.exe42⤵
- Executes dropped EXE
-
\??\c:\7ffllrr.exec:\7ffllrr.exe43⤵
- Executes dropped EXE
-
\??\c:\3fxxxxr.exec:\3fxxxxr.exe44⤵
- Executes dropped EXE
-
\??\c:\hthhhn.exec:\hthhhn.exe45⤵
- Executes dropped EXE
-
\??\c:\djvjd.exec:\djvjd.exe46⤵
- Executes dropped EXE
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe47⤵
- Executes dropped EXE
-
\??\c:\hhhhhh.exec:\hhhhhh.exe48⤵
- Executes dropped EXE
-
\??\c:\5jppd.exec:\5jppd.exe49⤵
- Executes dropped EXE
-
\??\c:\vdjdv.exec:\vdjdv.exe50⤵
- Executes dropped EXE
-
\??\c:\lrffrrr.exec:\lrffrrr.exe51⤵
- Executes dropped EXE
-
\??\c:\ttbnbn.exec:\ttbnbn.exe52⤵
- Executes dropped EXE
-
\??\c:\hnbtnt.exec:\hnbtnt.exe53⤵
- Executes dropped EXE
-
\??\c:\dvvjv.exec:\dvvjv.exe54⤵
- Executes dropped EXE
-
\??\c:\lxlrrxx.exec:\lxlrrxx.exe55⤵
- Executes dropped EXE
-
\??\c:\hthbbb.exec:\hthbbb.exe56⤵
- Executes dropped EXE
-
\??\c:\bbbtnn.exec:\bbbtnn.exe57⤵
- Executes dropped EXE
-
\??\c:\pvvpp.exec:\pvvpp.exe58⤵
- Executes dropped EXE
-
\??\c:\pvpvd.exec:\pvpvd.exe59⤵
- Executes dropped EXE
-
\??\c:\3fxxxfx.exec:\3fxxxfx.exe60⤵
- Executes dropped EXE
-
\??\c:\bnhnth.exec:\bnhnth.exe61⤵
- Executes dropped EXE
-
\??\c:\htbttn.exec:\htbttn.exe62⤵
- Executes dropped EXE
-
\??\c:\jdpdv.exec:\jdpdv.exe63⤵
- Executes dropped EXE
-
\??\c:\llrxxxx.exec:\llrxxxx.exe64⤵
- Executes dropped EXE
-
\??\c:\nthhbb.exec:\nthhbb.exe65⤵
- Executes dropped EXE
-
\??\c:\vjjpp.exec:\vjjpp.exe66⤵
-
\??\c:\xrlrlfx.exec:\xrlrlfx.exe67⤵
-
\??\c:\bbhbnt.exec:\bbhbnt.exe68⤵
-
\??\c:\hnnhtt.exec:\hnnhtt.exe69⤵
-
\??\c:\dpvvd.exec:\dpvvd.exe70⤵
-
\??\c:\jddpj.exec:\jddpj.exe71⤵
-
\??\c:\htttnn.exec:\htttnn.exe72⤵
-
\??\c:\ddddv.exec:\ddddv.exe73⤵
-
\??\c:\3dpjd.exec:\3dpjd.exe74⤵
-
\??\c:\rlxxfrx.exec:\rlxxfrx.exe75⤵
-
\??\c:\hbnhbb.exec:\hbnhbb.exe76⤵
-
\??\c:\5tnhbt.exec:\5tnhbt.exe77⤵
-
\??\c:\jppdv.exec:\jppdv.exe78⤵
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe79⤵
-
\??\c:\lflffll.exec:\lflffll.exe80⤵
-
\??\c:\tnnhhb.exec:\tnnhhb.exe81⤵
-
\??\c:\9pjdv.exec:\9pjdv.exe82⤵
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe83⤵
-
\??\c:\nhhtbh.exec:\nhhtbh.exe84⤵
-
\??\c:\ppvdj.exec:\ppvdj.exe85⤵
-
\??\c:\1jppp.exec:\1jppp.exe86⤵
-
\??\c:\7llfxrl.exec:\7llfxrl.exe87⤵
-
\??\c:\nhtttt.exec:\nhtttt.exe88⤵
-
\??\c:\nbtnhn.exec:\nbtnhn.exe89⤵
-
\??\c:\1pddp.exec:\1pddp.exe90⤵
-
\??\c:\rxffxrl.exec:\rxffxrl.exe91⤵
-
\??\c:\1rllffx.exec:\1rllffx.exe92⤵
-
\??\c:\tnnhbh.exec:\tnnhbh.exe93⤵
-
\??\c:\thhhnh.exec:\thhhnh.exe94⤵
-
\??\c:\vjdvv.exec:\vjdvv.exe95⤵
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe96⤵
-
\??\c:\hnbbhn.exec:\hnbbhn.exe97⤵
-
\??\c:\9vjjd.exec:\9vjjd.exe98⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe99⤵
-
\??\c:\ffllfxx.exec:\ffllfxx.exe100⤵
-
\??\c:\rlrxfxr.exec:\rlrxfxr.exe101⤵
-
\??\c:\btttnn.exec:\btttnn.exe102⤵
-
\??\c:\pdjvj.exec:\pdjvj.exe103⤵
-
\??\c:\pvpjd.exec:\pvpjd.exe104⤵
-
\??\c:\lfxrlll.exec:\lfxrlll.exe105⤵
-
\??\c:\tthhnt.exec:\tthhnt.exe106⤵
-
\??\c:\ntnbbb.exec:\ntnbbb.exe107⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe108⤵
-
\??\c:\lrxxlff.exec:\lrxxlff.exe109⤵
-
\??\c:\xxrrlrr.exec:\xxrrlrr.exe110⤵
-
\??\c:\hhnhbt.exec:\hhnhbt.exe111⤵
-
\??\c:\7pvpj.exec:\7pvpj.exe112⤵
-
\??\c:\pppvv.exec:\pppvv.exe113⤵
-
\??\c:\7vvpp.exec:\7vvpp.exe114⤵
-
\??\c:\lxrlxrf.exec:\lxrlxrf.exe115⤵
-
\??\c:\bnbhbh.exec:\bnbhbh.exe116⤵
-
\??\c:\thtnnt.exec:\thtnnt.exe117⤵
-
\??\c:\jdddv.exec:\jdddv.exe118⤵
-
\??\c:\frxrllr.exec:\frxrllr.exe119⤵
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe120⤵
-
\??\c:\5nnbbh.exec:\5nnbbh.exe121⤵
-
\??\c:\bbtnbt.exec:\bbtnbt.exe122⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe123⤵
-
\??\c:\lfllxxx.exec:\lfllxxx.exe124⤵
-
\??\c:\bbnhnt.exec:\bbnhnt.exe125⤵
-
\??\c:\nntnnh.exec:\nntnnh.exe126⤵
-
\??\c:\vjjdd.exec:\vjjdd.exe127⤵
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe128⤵
-
\??\c:\tbtnth.exec:\tbtnth.exe129⤵
-
\??\c:\7vddd.exec:\7vddd.exe130⤵
-
\??\c:\vdpdp.exec:\vdpdp.exe131⤵
-
\??\c:\xfrfxfr.exec:\xfrfxfr.exe132⤵
-
\??\c:\rllfxlf.exec:\rllfxlf.exe133⤵
-
\??\c:\ttttbt.exec:\ttttbt.exe134⤵
-
\??\c:\vdpvp.exec:\vdpvp.exe135⤵
-
\??\c:\pjpvd.exec:\pjpvd.exe136⤵
-
\??\c:\xlxrxrl.exec:\xlxrxrl.exe137⤵
-
\??\c:\htnhbb.exec:\htnhbb.exe138⤵
-
\??\c:\thbbnt.exec:\thbbnt.exe139⤵
-
\??\c:\djjvd.exec:\djjvd.exe140⤵
-
\??\c:\rxrrlll.exec:\rxrrlll.exe141⤵
-
\??\c:\bbhhnt.exec:\bbhhnt.exe142⤵
-
\??\c:\tnhbbt.exec:\tnhbbt.exe143⤵
-
\??\c:\dppjj.exec:\dppjj.exe144⤵
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe145⤵
-
\??\c:\fxxxflf.exec:\fxxxflf.exe146⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe147⤵
-
\??\c:\9vpjj.exec:\9vpjj.exe148⤵
-
\??\c:\ddjvv.exec:\ddjvv.exe149⤵
-
\??\c:\rfrfxlx.exec:\rfrfxlx.exe150⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe151⤵
-
\??\c:\pvvjd.exec:\pvvjd.exe152⤵
-
\??\c:\lffxrrr.exec:\lffxrrr.exe153⤵
-
\??\c:\btbttn.exec:\btbttn.exe154⤵
-
\??\c:\bbhtbh.exec:\bbhtbh.exe155⤵
-
\??\c:\pdpvv.exec:\pdpvv.exe156⤵
-
\??\c:\lfrlrrl.exec:\lfrlrrl.exe157⤵
-
\??\c:\frllxfl.exec:\frllxfl.exe158⤵
-
\??\c:\tnbhnn.exec:\tnbhnn.exe159⤵
-
\??\c:\5bhbnh.exec:\5bhbnh.exe160⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe161⤵
-
\??\c:\rfflflr.exec:\rfflflr.exe162⤵
-
\??\c:\7hnntt.exec:\7hnntt.exe163⤵
-
\??\c:\ddjjd.exec:\ddjjd.exe164⤵
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe165⤵
-
\??\c:\ntbtnn.exec:\ntbtnn.exe166⤵
-
\??\c:\lxlrxlr.exec:\lxlrxlr.exe167⤵
-
\??\c:\7ntnhh.exec:\7ntnhh.exe168⤵
-
\??\c:\hnhbnn.exec:\hnhbnn.exe169⤵
-
\??\c:\9jvdv.exec:\9jvdv.exe170⤵
-
\??\c:\lrfrrfr.exec:\lrfrrfr.exe171⤵
-
\??\c:\ffxrffx.exec:\ffxrffx.exe172⤵
-
\??\c:\bbhhhh.exec:\bbhhhh.exe173⤵
-
\??\c:\3rllffx.exec:\3rllffx.exe174⤵
-
\??\c:\lllrrxf.exec:\lllrrxf.exe175⤵
-
\??\c:\nbhbtt.exec:\nbhbtt.exe176⤵
-
\??\c:\ntbbnn.exec:\ntbbnn.exe177⤵
-
\??\c:\vppjd.exec:\vppjd.exe178⤵
-
\??\c:\pjvpj.exec:\pjvpj.exe179⤵
-
\??\c:\rfxxxfl.exec:\rfxxxfl.exe180⤵
-
\??\c:\fffxrrl.exec:\fffxrrl.exe181⤵
-
\??\c:\hnhhnb.exec:\hnhhnb.exe182⤵
-
\??\c:\tthnnt.exec:\tthnnt.exe183⤵
-
\??\c:\vdjpp.exec:\vdjpp.exe184⤵
-
\??\c:\lxxrrlr.exec:\lxxrrlr.exe185⤵
-
\??\c:\9frrffl.exec:\9frrffl.exe186⤵
-
\??\c:\djvvj.exec:\djvvj.exe187⤵
-
\??\c:\vvppv.exec:\vvppv.exe188⤵
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe189⤵
-
\??\c:\nbtntn.exec:\nbtntn.exe190⤵
-
\??\c:\thnhnn.exec:\thnhnn.exe191⤵
-
\??\c:\jjvvv.exec:\jjvvv.exe192⤵
-
\??\c:\flrlllf.exec:\flrlllf.exe193⤵
-
\??\c:\xrffllx.exec:\xrffllx.exe194⤵
-
\??\c:\bttntb.exec:\bttntb.exe195⤵
-
\??\c:\jppdp.exec:\jppdp.exe196⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe197⤵
-
\??\c:\lxllffx.exec:\lxllffx.exe198⤵
-
\??\c:\frxxxxx.exec:\frxxxxx.exe199⤵
-
\??\c:\bhnbtn.exec:\bhnbtn.exe200⤵
-
\??\c:\tnnnbb.exec:\tnnnbb.exe201⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe202⤵
-
\??\c:\dddpj.exec:\dddpj.exe203⤵
-
\??\c:\rflfxll.exec:\rflfxll.exe204⤵
-
\??\c:\xxfffrr.exec:\xxfffrr.exe205⤵
-
\??\c:\hhttbb.exec:\hhttbb.exe206⤵
-
\??\c:\hbttnb.exec:\hbttnb.exe207⤵
-
\??\c:\9ppjj.exec:\9ppjj.exe208⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe209⤵
-
\??\c:\lfrffxx.exec:\lfrffxx.exe210⤵
-
\??\c:\tttbhh.exec:\tttbhh.exe211⤵
-
\??\c:\ttnnhn.exec:\ttnnhn.exe212⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe213⤵
-
\??\c:\pjpvd.exec:\pjpvd.exe214⤵
-
\??\c:\vppvd.exec:\vppvd.exe215⤵
-
\??\c:\rlflflr.exec:\rlflflr.exe216⤵
-
\??\c:\bnhbbt.exec:\bnhbbt.exe217⤵
-
\??\c:\nhbtbb.exec:\nhbtbb.exe218⤵
-
\??\c:\jpdvv.exec:\jpdvv.exe219⤵
-
\??\c:\fxxxxxl.exec:\fxxxxxl.exe220⤵
-
\??\c:\ffxxlxl.exec:\ffxxlxl.exe221⤵
-
\??\c:\tntbhn.exec:\tntbhn.exe222⤵
-
\??\c:\ddpjd.exec:\ddpjd.exe223⤵
-
\??\c:\pdjvp.exec:\pdjvp.exe224⤵
-
\??\c:\xlxffrr.exec:\xlxffrr.exe225⤵
-
\??\c:\fflfrrl.exec:\fflfrrl.exe226⤵
-
\??\c:\thtbhh.exec:\thtbhh.exe227⤵
-
\??\c:\vjddv.exec:\vjddv.exe228⤵
-
\??\c:\llrlrrx.exec:\llrlrrx.exe229⤵
-
\??\c:\ffxflrl.exec:\ffxflrl.exe230⤵
-
\??\c:\tbtbbb.exec:\tbtbbb.exe231⤵
-
\??\c:\rrrffrx.exec:\rrrffrx.exe232⤵
-
\??\c:\hhthnb.exec:\hhthnb.exe233⤵
-
\??\c:\9bttbb.exec:\9bttbb.exe234⤵
-
\??\c:\9pvpj.exec:\9pvpj.exe235⤵
-
\??\c:\rlxrfxf.exec:\rlxrfxf.exe236⤵
-
\??\c:\xxllrxl.exec:\xxllrxl.exe237⤵
-
\??\c:\1hbtnn.exec:\1hbtnn.exe238⤵
-
\??\c:\vjvdj.exec:\vjvdj.exe239⤵
-
\??\c:\pjpdp.exec:\pjpdp.exe240⤵
-
\??\c:\xfllfrl.exec:\xfllfrl.exe241⤵