Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b9d518255d473ccb28aa941471c7810_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
0b9d518255d473ccb28aa941471c7810_NeikiAnalytics.exe
-
Size
205KB
-
MD5
0b9d518255d473ccb28aa941471c7810
-
SHA1
90b1cba0ac130865ff627d2f10a44e350a46e48d
-
SHA256
9df22ab39a1dab060277fdcbedf296f3d277033ea3070ecd7468f0e1060daf3e
-
SHA512
a5bcd92ac74aaffae1ed1fe9fcd927b522afaf87fcd580a0caadb482cb534a958b5091c7fead74729a6113068729ba1a84a2528b36a41f089131e6463a2b52e5
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6TQpCihZ:PhOm2sI93UufdC67ciJTU2HVS64hZ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/232-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/660-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2652-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-439-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-457-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-481-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-512-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-519-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-548-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-558-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-569-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-603-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-664-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-813-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-869-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-882-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-919-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-930-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-975-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 660 ththbh.exe 2832 ddvvp.exe 1724 hbnhbb.exe 4736 5jvpd.exe 1872 xlxllfx.exe 3496 dvjpv.exe 2016 dpvpj.exe 224 bbhhbb.exe 3324 djdvd.exe 3296 tbtthh.exe 4160 vdvdj.exe 4520 rrfxlfr.exe 3944 tthhnt.exe 4848 djvjp.exe 552 llxrffx.exe 5036 bbhhnb.exe 4328 vpjdd.exe 5092 5rxlxxl.exe 4748 thhtnh.exe 3612 xfffrrl.exe 4240 nhnhnh.exe 1712 5jdvp.exe 1780 dppvj.exe 3780 xxxlfff.exe 1260 ntntnn.exe 2700 frxrrrf.exe 5072 7bhhbb.exe 4564 btnnbh.exe 4616 fxxlfxr.exe 4924 rfxrrxx.exe 4624 bhhhbb.exe 2308 vpvpj.exe 3628 lfxrllf.exe 2652 7ttntt.exe 2884 bbtnhh.exe 1904 rllfxxr.exe 2312 5lllflf.exe 2952 7bbtnn.exe 2620 frllffl.exe 1360 lffxxxr.exe 3508 bthhnn.exe 3324 vpvpj.exe 4752 vvppv.exe 676 lxxxrxx.exe 4160 hhhhnb.exe 2032 jvppj.exe 2876 lflfxxx.exe 4028 pjvpj.exe 1480 rfrxrrr.exe 1212 bbtbbb.exe 3684 pjpjd.exe 544 rxxrlll.exe 3644 tbbnbn.exe 2320 hbbbbb.exe 1444 9pddj.exe 4696 xxlrlxr.exe 4240 5xxffrl.exe 4728 1nhtnb.exe 2612 9nnhhh.exe 3780 dvdpj.exe 1924 fxlfffr.exe 2700 1rlrlrl.exe 1696 nnnnhh.exe 3368 pjjdv.exe -
resource yara_rule behavioral2/memory/232-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2652-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-389-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-414-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-439-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-446-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-457-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-467-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-481-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-512-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-519-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-522-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-548-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-558-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 232 wrote to memory of 660 232 0b9d518255d473ccb28aa941471c7810_NeikiAnalytics.exe 89 PID 232 wrote to memory of 660 232 0b9d518255d473ccb28aa941471c7810_NeikiAnalytics.exe 89 PID 232 wrote to memory of 660 232 0b9d518255d473ccb28aa941471c7810_NeikiAnalytics.exe 89 PID 660 wrote to memory of 2832 660 ththbh.exe 90 PID 660 wrote to memory of 2832 660 ththbh.exe 90 PID 660 wrote to memory of 2832 660 ththbh.exe 90 PID 2832 wrote to memory of 1724 2832 ddvvp.exe 91 PID 2832 wrote to memory of 1724 2832 ddvvp.exe 91 PID 2832 wrote to memory of 1724 2832 ddvvp.exe 91 PID 1724 wrote to memory of 4736 1724 hbnhbb.exe 92 PID 1724 wrote to memory of 4736 1724 hbnhbb.exe 92 PID 1724 wrote to memory of 4736 1724 hbnhbb.exe 92 PID 4736 wrote to memory of 1872 4736 5jvpd.exe 93 PID 4736 wrote to memory of 1872 4736 5jvpd.exe 93 PID 4736 wrote to memory of 1872 4736 5jvpd.exe 93 PID 1872 wrote to memory of 3496 1872 xlxllfx.exe 95 PID 1872 wrote to memory of 3496 1872 xlxllfx.exe 95 PID 1872 wrote to memory of 3496 1872 xlxllfx.exe 95 PID 3496 wrote to memory of 2016 3496 dvjpv.exe 96 PID 3496 wrote to memory of 2016 3496 dvjpv.exe 96 PID 3496 wrote to memory of 2016 3496 dvjpv.exe 96 PID 2016 wrote to memory of 224 2016 dpvpj.exe 98 PID 2016 wrote to memory of 224 2016 dpvpj.exe 98 PID 2016 wrote to memory of 224 2016 dpvpj.exe 98 PID 224 wrote to memory of 3324 224 bbhhbb.exe 99 PID 224 wrote to memory of 3324 224 bbhhbb.exe 99 PID 224 wrote to memory of 3324 224 bbhhbb.exe 99 PID 3324 wrote to memory of 3296 3324 djdvd.exe 100 PID 3324 wrote to memory of 3296 3324 djdvd.exe 100 PID 3324 wrote to memory of 3296 3324 djdvd.exe 100 PID 3296 wrote to memory of 4160 3296 tbtthh.exe 101 PID 3296 wrote to memory of 4160 3296 tbtthh.exe 101 PID 3296 wrote to memory of 4160 3296 tbtthh.exe 101 PID 4160 wrote to memory of 4520 4160 vdvdj.exe 103 PID 4160 wrote to memory of 4520 4160 vdvdj.exe 103 PID 4160 wrote to memory of 4520 4160 vdvdj.exe 103 PID 4520 wrote to memory of 3944 4520 rrfxlfr.exe 104 PID 4520 wrote to memory of 3944 4520 rrfxlfr.exe 104 PID 4520 wrote to memory of 3944 4520 rrfxlfr.exe 104 PID 3944 wrote to memory of 4848 3944 tthhnt.exe 105 PID 3944 wrote to memory of 4848 3944 tthhnt.exe 105 PID 3944 wrote to memory of 4848 3944 tthhnt.exe 105 PID 4848 wrote to memory of 552 4848 djvjp.exe 106 PID 4848 wrote to memory of 552 4848 djvjp.exe 106 PID 4848 wrote to memory of 552 4848 djvjp.exe 106 PID 552 wrote to memory of 5036 552 llxrffx.exe 107 PID 552 wrote to memory of 5036 552 llxrffx.exe 107 PID 552 wrote to memory of 5036 552 llxrffx.exe 107 PID 5036 wrote to memory of 4328 5036 bbhhnb.exe 108 PID 5036 wrote to memory of 4328 5036 bbhhnb.exe 108 PID 5036 wrote to memory of 4328 5036 bbhhnb.exe 108 PID 4328 wrote to memory of 5092 4328 vpjdd.exe 109 PID 4328 wrote to memory of 5092 4328 vpjdd.exe 109 PID 4328 wrote to memory of 5092 4328 vpjdd.exe 109 PID 5092 wrote to memory of 4748 5092 5rxlxxl.exe 110 PID 5092 wrote to memory of 4748 5092 5rxlxxl.exe 110 PID 5092 wrote to memory of 4748 5092 5rxlxxl.exe 110 PID 4748 wrote to memory of 3612 4748 thhtnh.exe 111 PID 4748 wrote to memory of 3612 4748 thhtnh.exe 111 PID 4748 wrote to memory of 3612 4748 thhtnh.exe 111 PID 3612 wrote to memory of 4240 3612 xfffrrl.exe 112 PID 3612 wrote to memory of 4240 3612 xfffrrl.exe 112 PID 3612 wrote to memory of 4240 3612 xfffrrl.exe 112 PID 4240 wrote to memory of 1712 4240 nhnhnh.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b9d518255d473ccb28aa941471c7810_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0b9d518255d473ccb28aa941471c7810_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\ththbh.exec:\ththbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\ddvvp.exec:\ddvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\hbnhbb.exec:\hbnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\5jvpd.exec:\5jvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\xlxllfx.exec:\xlxllfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\dvjpv.exec:\dvjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\dpvpj.exec:\dpvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\bbhhbb.exec:\bbhhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\djdvd.exec:\djdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\tbtthh.exec:\tbtthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\vdvdj.exec:\vdvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\rrfxlfr.exec:\rrfxlfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\tthhnt.exec:\tthhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\djvjp.exec:\djvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\llxrffx.exec:\llxrffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\bbhhnb.exec:\bbhhnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\vpjdd.exec:\vpjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\5rxlxxl.exec:\5rxlxxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\thhtnh.exec:\thhtnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\xfffrrl.exec:\xfffrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\nhnhnh.exec:\nhnhnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\5jdvp.exec:\5jdvp.exe23⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dppvj.exec:\dppvj.exe24⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xxxlfff.exec:\xxxlfff.exe25⤵
- Executes dropped EXE
PID:3780 -
\??\c:\ntntnn.exec:\ntntnn.exe26⤵
- Executes dropped EXE
PID:1260 -
\??\c:\frxrrrf.exec:\frxrrrf.exe27⤵
- Executes dropped EXE
PID:2700 -
\??\c:\7bhhbb.exec:\7bhhbb.exe28⤵
- Executes dropped EXE
PID:5072 -
\??\c:\btnnbh.exec:\btnnbh.exe29⤵
- Executes dropped EXE
PID:4564 -
\??\c:\fxxlfxr.exec:\fxxlfxr.exe30⤵
- Executes dropped EXE
PID:4616 -
\??\c:\rfxrrxx.exec:\rfxrrxx.exe31⤵
- Executes dropped EXE
PID:4924 -
\??\c:\bhhhbb.exec:\bhhhbb.exe32⤵
- Executes dropped EXE
PID:4624 -
\??\c:\vpvpj.exec:\vpvpj.exe33⤵
- Executes dropped EXE
PID:2308 -
\??\c:\lfxrllf.exec:\lfxrllf.exe34⤵
- Executes dropped EXE
PID:3628 -
\??\c:\7ttntt.exec:\7ttntt.exe35⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bbtnhh.exec:\bbtnhh.exe36⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rllfxxr.exec:\rllfxxr.exe37⤵
- Executes dropped EXE
PID:1904 -
\??\c:\5lllflf.exec:\5lllflf.exe38⤵
- Executes dropped EXE
PID:2312 -
\??\c:\7bbtnn.exec:\7bbtnn.exe39⤵
- Executes dropped EXE
PID:2952 -
\??\c:\frllffl.exec:\frllffl.exe40⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lffxxxr.exec:\lffxxxr.exe41⤵
- Executes dropped EXE
PID:1360 -
\??\c:\bthhnn.exec:\bthhnn.exe42⤵
- Executes dropped EXE
PID:3508 -
\??\c:\vpvpj.exec:\vpvpj.exe43⤵
- Executes dropped EXE
PID:3324 -
\??\c:\vvppv.exec:\vvppv.exe44⤵
- Executes dropped EXE
PID:4752 -
\??\c:\lxxxrxx.exec:\lxxxrxx.exe45⤵
- Executes dropped EXE
PID:676 -
\??\c:\hhhhnb.exec:\hhhhnb.exe46⤵
- Executes dropped EXE
PID:4160 -
\??\c:\jvppj.exec:\jvppj.exe47⤵
- Executes dropped EXE
PID:2032 -
\??\c:\lflfxxx.exec:\lflfxxx.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pjvpj.exec:\pjvpj.exe49⤵
- Executes dropped EXE
PID:4028 -
\??\c:\rfrxrrr.exec:\rfrxrrr.exe50⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bbtbbb.exec:\bbtbbb.exe51⤵
- Executes dropped EXE
PID:1212 -
\??\c:\pjpjd.exec:\pjpjd.exe52⤵
- Executes dropped EXE
PID:3684 -
\??\c:\rxxrlll.exec:\rxxrlll.exe53⤵
- Executes dropped EXE
PID:544 -
\??\c:\tbbnbn.exec:\tbbnbn.exe54⤵
- Executes dropped EXE
PID:3644 -
\??\c:\hbbbbb.exec:\hbbbbb.exe55⤵
- Executes dropped EXE
PID:2320 -
\??\c:\9pddj.exec:\9pddj.exe56⤵
- Executes dropped EXE
PID:1444 -
\??\c:\xxlrlxr.exec:\xxlrlxr.exe57⤵
- Executes dropped EXE
PID:4696 -
\??\c:\5xxffrl.exec:\5xxffrl.exe58⤵
- Executes dropped EXE
PID:4240 -
\??\c:\1nhtnb.exec:\1nhtnb.exe59⤵
- Executes dropped EXE
PID:4728 -
\??\c:\9nnhhh.exec:\9nnhhh.exe60⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dvdpj.exec:\dvdpj.exe61⤵
- Executes dropped EXE
PID:3780 -
\??\c:\fxlfffr.exec:\fxlfffr.exe62⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1rlrlrl.exec:\1rlrlrl.exe63⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nnnnhh.exec:\nnnnhh.exe64⤵
- Executes dropped EXE
PID:1696 -
\??\c:\djjdv.exec:\djjdv.exe65⤵PID:5044
-
\??\c:\pjjdv.exec:\pjjdv.exe66⤵
- Executes dropped EXE
PID:3368 -
\??\c:\rlrrrrf.exec:\rlrrrrf.exe67⤵PID:728
-
\??\c:\bnhhhh.exec:\bnhhhh.exe68⤵PID:1832
-
\??\c:\nhtnht.exec:\nhtnht.exe69⤵PID:744
-
\??\c:\vjdvp.exec:\vjdvp.exe70⤵PID:336
-
\??\c:\dvdvd.exec:\dvdvd.exe71⤵PID:1988
-
\??\c:\1flxfff.exec:\1flxfff.exe72⤵PID:5020
-
\??\c:\3rfllll.exec:\3rfllll.exe73⤵PID:768
-
\??\c:\btbbtt.exec:\btbbtt.exe74⤵PID:868
-
\??\c:\btttbb.exec:\btttbb.exe75⤵PID:2276
-
\??\c:\vjjpj.exec:\vjjpj.exe76⤵PID:4468
-
\??\c:\xrlrlll.exec:\xrlrlll.exe77⤵PID:224
-
\??\c:\fxfxxff.exec:\fxfxxff.exe78⤵PID:4008
-
\??\c:\9nttnt.exec:\9nttnt.exe79⤵PID:4364
-
\??\c:\nhnhnn.exec:\nhnhnn.exe80⤵PID:2036
-
\??\c:\pjvvj.exec:\pjvvj.exe81⤵PID:4032
-
\??\c:\dpdvv.exec:\dpdvv.exe82⤵PID:4708
-
\??\c:\xrffflr.exec:\xrffflr.exe83⤵PID:2272
-
\??\c:\nbbnhh.exec:\nbbnhh.exe84⤵PID:3944
-
\??\c:\bbtttb.exec:\bbtttb.exe85⤵PID:4848
-
\??\c:\1jjdd.exec:\1jjdd.exe86⤵PID:2656
-
\??\c:\dpvpp.exec:\dpvpp.exe87⤵PID:4028
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe88⤵PID:408
-
\??\c:\hhhhhb.exec:\hhhhhb.exe89⤵PID:2344
-
\??\c:\5bhbtt.exec:\5bhbtt.exe90⤵PID:544
-
\??\c:\vppvp.exec:\vppvp.exe91⤵PID:3644
-
\??\c:\3lllllr.exec:\3lllllr.exe92⤵PID:3612
-
\??\c:\nbhhbb.exec:\nbhhbb.exe93⤵PID:3092
-
\??\c:\ntbbnn.exec:\ntbbnn.exe94⤵PID:1504
-
\??\c:\pvpjd.exec:\pvpjd.exe95⤵PID:1188
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe96⤵PID:2284
-
\??\c:\fffllrl.exec:\fffllrl.exe97⤵PID:2612
-
\??\c:\3nnnhh.exec:\3nnnhh.exe98⤵PID:3780
-
\??\c:\dvvvj.exec:\dvvvj.exe99⤵PID:4276
-
\??\c:\jvddv.exec:\jvddv.exe100⤵PID:2028
-
\??\c:\3lxxrrr.exec:\3lxxrrr.exe101⤵PID:5064
-
\??\c:\thntbt.exec:\thntbt.exe102⤵PID:2072
-
\??\c:\7bbhhh.exec:\7bbhhh.exe103⤵PID:3704
-
\??\c:\pjjvp.exec:\pjjvp.exe104⤵PID:4972
-
\??\c:\tnhbbb.exec:\tnhbbb.exe105⤵PID:1832
-
\??\c:\vpvjp.exec:\vpvjp.exe106⤵PID:2308
-
\??\c:\fxfxlxr.exec:\fxfxlxr.exe107⤵PID:336
-
\??\c:\bbbbtb.exec:\bbbbtb.exe108⤵PID:4836
-
\??\c:\hbhhbb.exec:\hbhhbb.exe109⤵PID:1872
-
\??\c:\ppvvd.exec:\ppvvd.exe110⤵PID:2608
-
\??\c:\ffxrxxx.exec:\ffxrxxx.exe111⤵PID:1416
-
\??\c:\lfxrffl.exec:\lfxrffl.exe112⤵PID:2620
-
\??\c:\tbtttn.exec:\tbtttn.exe113⤵PID:2604
-
\??\c:\hhbtnn.exec:\hhbtnn.exe114⤵PID:4416
-
\??\c:\pjppj.exec:\pjppj.exe115⤵PID:4168
-
\??\c:\jvvvv.exec:\jvvvv.exe116⤵PID:1208
-
\??\c:\1llfxxx.exec:\1llfxxx.exe117⤵PID:388
-
\??\c:\tntnhh.exec:\tntnhh.exe118⤵PID:4520
-
\??\c:\htnnhh.exec:\htnnhh.exe119⤵PID:1912
-
\??\c:\pvdvp.exec:\pvdvp.exe120⤵PID:1864
-
\??\c:\vddvv.exec:\vddvv.exe121⤵PID:2272
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe122⤵PID:3944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-