Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:23
Behavioral task
behavioral1
Sample
42205745c5b2d9365833402f8ade9d50_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
42205745c5b2d9365833402f8ade9d50_NeikiAnalytics.exe
-
Size
367KB
-
MD5
42205745c5b2d9365833402f8ade9d50
-
SHA1
6059359841a901c61cade4ab4a579b277b77ab80
-
SHA256
fff8103b783afc63a726b9148664ba80411717d1b34f432464767cf284e54d6e
-
SHA512
2d15a0b5cfddfbb4b2205a74f421ab04bf237c292d80d165e567cd5122a55fc7aa0ef37fb561f488b421858529eef918f6b785e2f64121f5deeecf49e4673bc1
-
SSDEEP
6144:9cm4FmowdHoSdSyEAxyx/ZrTTr4qIMgE8j:/4wFHoSQuxy3rTXIM18j
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1948-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1244-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1396-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/892-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2732-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/948-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-640-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-675-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-707-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-718-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-784-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-788-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
06482.exec808048.exew40860.exe660642.exehttnbt.exe266868.exe00626.exebbbthh.exenhbnbb.exe5rfrfxr.exeo066044.exe008266.exexlrllfx.exenhtbhh.exepvdjd.exefxfxrrl.exefrxlfxr.exe4628668.exedppjd.exe42828.exe02628.exe9pppp.exetbttbb.exe1nnhbb.exennnthn.exeddjdd.exeppjjv.exerlrfxfl.exe6004488.exe0084666.exefrrlffx.exe606266.exes4662.exehtnhhh.exe684400.exek00088.exetbtntt.exehhnbhb.exenbbbtt.exe228282.exefrxrrrr.exebhnhth.exehbthbb.exe040082.exe06888.exe4242606.exepjppp.exefrrlrrr.exe02824.exethbhbb.exehthbhh.exe8602888.exejdvjd.exerrfrfrl.exefrxfrfl.exepjjdj.exe42864.exetbnhhb.exerffrrrr.exehhtbnn.exepddvp.exe246046.exeg4044.exe66482.exepid process 2156 06482.exe 1068 c808048.exe 5040 w40860.exe 744 660642.exe 224 httnbt.exe 436 266868.exe 4812 00626.exe 1592 bbbthh.exe 4128 nhbnbb.exe 1168 5rfrfxr.exe 4024 o066044.exe 4384 008266.exe 2108 xlrllfx.exe 1788 nhtbhh.exe 3576 pvdjd.exe 2836 fxfxrrl.exe 4628 frxlfxr.exe 920 4628668.exe 2944 dppjd.exe 1940 42828.exe 1632 02628.exe 3200 9pppp.exe 3716 tbttbb.exe 4388 1nnhbb.exe 2732 nnnthn.exe 2824 ddjdd.exe 4252 ppjjv.exe 4468 rlrfxfl.exe 544 6004488.exe 4036 0084666.exe 3052 frrlffx.exe 2932 606266.exe 892 s4662.exe 5044 htnhhh.exe 2176 684400.exe 3900 k00088.exe 1772 tbtntt.exe 3932 hhnbhb.exe 2868 nbbbtt.exe 2016 228282.exe 2940 frxrrrr.exe 1636 bhnhth.exe 4956 hbthbb.exe 1396 040082.exe 624 06888.exe 1700 4242606.exe 4856 pjppp.exe 3216 frrlrrr.exe 1644 02824.exe 4872 thbhbb.exe 2956 hthbhh.exe 3808 8602888.exe 3104 jdvjd.exe 3448 rrfrfrl.exe 4720 frxfrfl.exe 1484 pjjdj.exe 3076 42864.exe 2836 tbnhhb.exe 3672 rffrrrr.exe 3088 hhtbnn.exe 4964 pddvp.exe 1940 246046.exe 4360 g4044.exe 4456 66482.exe -
Processes:
resource yara_rule behavioral2/memory/1948-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\06482.exe upx behavioral2/memory/2156-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\c808048.exe upx behavioral2/memory/2156-12-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\w40860.exe upx C:\660642.exe upx behavioral2/memory/5040-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/744-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/224-30-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\httnbt.exe upx behavioral2/memory/436-37-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\266868.exe upx behavioral2/memory/224-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\00626.exe upx behavioral2/memory/436-42-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbbthh.exe upx \??\c:\nhbnbb.exe upx behavioral2/memory/4128-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\o066044.exe upx behavioral2/memory/4024-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4384-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4384-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2108-82-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xlrllfx.exe upx \??\c:\008266.exe upx \??\c:\nhtbhh.exe upx \??\c:\pvdjd.exe upx C:\fxfxrrl.exe upx behavioral2/memory/2836-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4628-105-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\4628668.exe upx behavioral2/memory/4628-111-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dppjd.exe upx behavioral2/memory/920-116-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\42828.exe upx behavioral2/memory/1940-131-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9pppp.exe upx behavioral2/memory/3716-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4388-148-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nnnthn.exe upx C:\rlrfxfl.exe upx behavioral2/memory/4468-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4036-185-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frrlffx.exe upx behavioral2/memory/2932-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3932-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2868-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2940-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1636-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/624-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4872-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3104-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3448-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2836-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3244-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4760-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4876-407-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5080-417-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4676-422-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4024-414-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3500-432-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1244-439-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4340-364-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
42205745c5b2d9365833402f8ade9d50_NeikiAnalytics.exe06482.exec808048.exew40860.exe660642.exehttnbt.exe266868.exe00626.exebbbthh.exenhbnbb.exe5rfrfxr.exeo066044.exe008266.exexlrllfx.exenhtbhh.exepvdjd.exefxfxrrl.exefrxlfxr.exe4628668.exedppjd.exe42828.exe02628.exedescription pid process target process PID 1948 wrote to memory of 2156 1948 42205745c5b2d9365833402f8ade9d50_NeikiAnalytics.exe 06482.exe PID 1948 wrote to memory of 2156 1948 42205745c5b2d9365833402f8ade9d50_NeikiAnalytics.exe 06482.exe PID 1948 wrote to memory of 2156 1948 42205745c5b2d9365833402f8ade9d50_NeikiAnalytics.exe 06482.exe PID 2156 wrote to memory of 1068 2156 06482.exe c808048.exe PID 2156 wrote to memory of 1068 2156 06482.exe c808048.exe PID 2156 wrote to memory of 1068 2156 06482.exe c808048.exe PID 1068 wrote to memory of 5040 1068 c808048.exe w40860.exe PID 1068 wrote to memory of 5040 1068 c808048.exe w40860.exe PID 1068 wrote to memory of 5040 1068 c808048.exe w40860.exe PID 5040 wrote to memory of 744 5040 w40860.exe 660642.exe PID 5040 wrote to memory of 744 5040 w40860.exe 660642.exe PID 5040 wrote to memory of 744 5040 w40860.exe 660642.exe PID 744 wrote to memory of 224 744 660642.exe httnbt.exe PID 744 wrote to memory of 224 744 660642.exe httnbt.exe PID 744 wrote to memory of 224 744 660642.exe httnbt.exe PID 224 wrote to memory of 436 224 httnbt.exe 266868.exe PID 224 wrote to memory of 436 224 httnbt.exe 266868.exe PID 224 wrote to memory of 436 224 httnbt.exe 266868.exe PID 436 wrote to memory of 4812 436 266868.exe 00626.exe PID 436 wrote to memory of 4812 436 266868.exe 00626.exe PID 436 wrote to memory of 4812 436 266868.exe 00626.exe PID 4812 wrote to memory of 1592 4812 00626.exe bbbthh.exe PID 4812 wrote to memory of 1592 4812 00626.exe bbbthh.exe PID 4812 wrote to memory of 1592 4812 00626.exe bbbthh.exe PID 1592 wrote to memory of 4128 1592 bbbthh.exe nhbnbb.exe PID 1592 wrote to memory of 4128 1592 bbbthh.exe nhbnbb.exe PID 1592 wrote to memory of 4128 1592 bbbthh.exe nhbnbb.exe PID 4128 wrote to memory of 1168 4128 nhbnbb.exe 5rfrfxr.exe PID 4128 wrote to memory of 1168 4128 nhbnbb.exe 5rfrfxr.exe PID 4128 wrote to memory of 1168 4128 nhbnbb.exe 5rfrfxr.exe PID 1168 wrote to memory of 4024 1168 5rfrfxr.exe o066044.exe PID 1168 wrote to memory of 4024 1168 5rfrfxr.exe o066044.exe PID 1168 wrote to memory of 4024 1168 5rfrfxr.exe o066044.exe PID 4024 wrote to memory of 4384 4024 o066044.exe 008266.exe PID 4024 wrote to memory of 4384 4024 o066044.exe 008266.exe PID 4024 wrote to memory of 4384 4024 o066044.exe 008266.exe PID 4384 wrote to memory of 2108 4384 008266.exe xlrllfx.exe PID 4384 wrote to memory of 2108 4384 008266.exe xlrllfx.exe PID 4384 wrote to memory of 2108 4384 008266.exe xlrllfx.exe PID 2108 wrote to memory of 1788 2108 xlrllfx.exe nhtbhh.exe PID 2108 wrote to memory of 1788 2108 xlrllfx.exe nhtbhh.exe PID 2108 wrote to memory of 1788 2108 xlrllfx.exe nhtbhh.exe PID 1788 wrote to memory of 3576 1788 nhtbhh.exe pvdjd.exe PID 1788 wrote to memory of 3576 1788 nhtbhh.exe pvdjd.exe PID 1788 wrote to memory of 3576 1788 nhtbhh.exe pvdjd.exe PID 3576 wrote to memory of 2836 3576 pvdjd.exe fxfxrrl.exe PID 3576 wrote to memory of 2836 3576 pvdjd.exe fxfxrrl.exe PID 3576 wrote to memory of 2836 3576 pvdjd.exe fxfxrrl.exe PID 2836 wrote to memory of 4628 2836 fxfxrrl.exe frxlfxr.exe PID 2836 wrote to memory of 4628 2836 fxfxrrl.exe frxlfxr.exe PID 2836 wrote to memory of 4628 2836 fxfxrrl.exe frxlfxr.exe PID 4628 wrote to memory of 920 4628 frxlfxr.exe 4628668.exe PID 4628 wrote to memory of 920 4628 frxlfxr.exe 4628668.exe PID 4628 wrote to memory of 920 4628 frxlfxr.exe 4628668.exe PID 920 wrote to memory of 2944 920 4628668.exe dppjd.exe PID 920 wrote to memory of 2944 920 4628668.exe dppjd.exe PID 920 wrote to memory of 2944 920 4628668.exe dppjd.exe PID 2944 wrote to memory of 1940 2944 dppjd.exe 42828.exe PID 2944 wrote to memory of 1940 2944 dppjd.exe 42828.exe PID 2944 wrote to memory of 1940 2944 dppjd.exe 42828.exe PID 1940 wrote to memory of 1632 1940 42828.exe 02628.exe PID 1940 wrote to memory of 1632 1940 42828.exe 02628.exe PID 1940 wrote to memory of 1632 1940 42828.exe 02628.exe PID 1632 wrote to memory of 3200 1632 02628.exe 9pppp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42205745c5b2d9365833402f8ade9d50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\42205745c5b2d9365833402f8ade9d50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\06482.exec:\06482.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\c808048.exec:\c808048.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\w40860.exec:\w40860.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\660642.exec:\660642.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\httnbt.exec:\httnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\266868.exec:\266868.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\00626.exec:\00626.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\bbbthh.exec:\bbbthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\nhbnbb.exec:\nhbnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\5rfrfxr.exec:\5rfrfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\o066044.exec:\o066044.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\008266.exec:\008266.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\xlrllfx.exec:\xlrllfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\nhtbhh.exec:\nhtbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\pvdjd.exec:\pvdjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\frxlfxr.exec:\frxlfxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\4628668.exec:\4628668.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\dppjd.exec:\dppjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\42828.exec:\42828.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\02628.exec:\02628.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\9pppp.exec:\9pppp.exe23⤵
- Executes dropped EXE
PID:3200 -
\??\c:\tbttbb.exec:\tbttbb.exe24⤵
- Executes dropped EXE
PID:3716 -
\??\c:\1nnhbb.exec:\1nnhbb.exe25⤵
- Executes dropped EXE
PID:4388 -
\??\c:\nnnthn.exec:\nnnthn.exe26⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ddjdd.exec:\ddjdd.exe27⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ppjjv.exec:\ppjjv.exe28⤵
- Executes dropped EXE
PID:4252 -
\??\c:\rlrfxfl.exec:\rlrfxfl.exe29⤵
- Executes dropped EXE
PID:4468 -
\??\c:\6004488.exec:\6004488.exe30⤵
- Executes dropped EXE
PID:544 -
\??\c:\0084666.exec:\0084666.exe31⤵
- Executes dropped EXE
PID:4036 -
\??\c:\frrlffx.exec:\frrlffx.exe32⤵
- Executes dropped EXE
PID:3052 -
\??\c:\606266.exec:\606266.exe33⤵
- Executes dropped EXE
PID:2932 -
\??\c:\s4662.exec:\s4662.exe34⤵
- Executes dropped EXE
PID:892 -
\??\c:\htnhhh.exec:\htnhhh.exe35⤵
- Executes dropped EXE
PID:5044 -
\??\c:\684400.exec:\684400.exe36⤵
- Executes dropped EXE
PID:2176 -
\??\c:\k00088.exec:\k00088.exe37⤵
- Executes dropped EXE
PID:3900 -
\??\c:\620826.exec:\620826.exe38⤵PID:4352
-
\??\c:\tbtntt.exec:\tbtntt.exe39⤵
- Executes dropped EXE
PID:1772 -
\??\c:\hhnbhb.exec:\hhnbhb.exe40⤵
- Executes dropped EXE
PID:3932 -
\??\c:\nbbbtt.exec:\nbbbtt.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\228282.exec:\228282.exe42⤵
- Executes dropped EXE
PID:2016 -
\??\c:\frxrrrr.exec:\frxrrrr.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bhnhth.exec:\bhnhth.exe44⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hbthbb.exec:\hbthbb.exe45⤵
- Executes dropped EXE
PID:4956 -
\??\c:\040082.exec:\040082.exe46⤵
- Executes dropped EXE
PID:1396 -
\??\c:\06888.exec:\06888.exe47⤵
- Executes dropped EXE
PID:624 -
\??\c:\4242606.exec:\4242606.exe48⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pjppp.exec:\pjppp.exe49⤵
- Executes dropped EXE
PID:4856 -
\??\c:\frrlrrr.exec:\frrlrrr.exe50⤵
- Executes dropped EXE
PID:3216 -
\??\c:\02824.exec:\02824.exe51⤵
- Executes dropped EXE
PID:1644 -
\??\c:\thbhbb.exec:\thbhbb.exe52⤵
- Executes dropped EXE
PID:4872 -
\??\c:\hthbhh.exec:\hthbhh.exe53⤵
- Executes dropped EXE
PID:2956 -
\??\c:\8602888.exec:\8602888.exe54⤵
- Executes dropped EXE
PID:3808 -
\??\c:\jdvjd.exec:\jdvjd.exe55⤵
- Executes dropped EXE
PID:3104 -
\??\c:\rrfrfrl.exec:\rrfrfrl.exe56⤵
- Executes dropped EXE
PID:3448 -
\??\c:\frxfrfl.exec:\frxfrfl.exe57⤵
- Executes dropped EXE
PID:4720 -
\??\c:\pjjdj.exec:\pjjdj.exe58⤵
- Executes dropped EXE
PID:1484 -
\??\c:\42864.exec:\42864.exe59⤵
- Executes dropped EXE
PID:3076 -
\??\c:\tbnhhb.exec:\tbnhhb.exe60⤵
- Executes dropped EXE
PID:2836 -
\??\c:\rffrrrr.exec:\rffrrrr.exe61⤵
- Executes dropped EXE
PID:3672 -
\??\c:\hhtbnn.exec:\hhtbnn.exe62⤵
- Executes dropped EXE
PID:3088 -
\??\c:\pddvp.exec:\pddvp.exe63⤵
- Executes dropped EXE
PID:4964 -
\??\c:\246046.exec:\246046.exe64⤵
- Executes dropped EXE
PID:1940 -
\??\c:\g4044.exec:\g4044.exe65⤵
- Executes dropped EXE
PID:4360 -
\??\c:\66482.exec:\66482.exe66⤵
- Executes dropped EXE
PID:4456 -
\??\c:\82482.exec:\82482.exe67⤵PID:3244
-
\??\c:\0486042.exec:\0486042.exe68⤵PID:4392
-
\??\c:\620882.exec:\620882.exe69⤵PID:2784
-
\??\c:\bbnhbb.exec:\bbnhbb.exe70⤵PID:4772
-
\??\c:\a4240.exec:\a4240.exe71⤵PID:3228
-
\??\c:\426600.exec:\426600.exe72⤵PID:4120
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe73⤵PID:4288
-
\??\c:\a0008.exec:\a0008.exe74⤵PID:4304
-
\??\c:\hbhhbb.exec:\hbhhbb.exe75⤵PID:3980
-
\??\c:\5pjjp.exec:\5pjjp.exe76⤵PID:4760
-
\??\c:\llxxxxx.exec:\llxxxxx.exe77⤵PID:4540
-
\??\c:\e06482.exec:\e06482.exe78⤵PID:3832
-
\??\c:\1xxlxxl.exec:\1xxlxxl.exe79⤵PID:4052
-
\??\c:\48860.exec:\48860.exe80⤵PID:4604
-
\??\c:\dpvvd.exec:\dpvvd.exe81⤵PID:4340
-
\??\c:\ttbbtt.exec:\ttbbtt.exe82⤵PID:2260
-
\??\c:\tnhttt.exec:\tnhttt.exe83⤵PID:4380
-
\??\c:\xxflfxl.exec:\xxflfxl.exe84⤵PID:2428
-
\??\c:\llfxrlx.exec:\llfxrlx.exe85⤵PID:244
-
\??\c:\fxfxrlx.exec:\fxfxrlx.exe86⤵PID:2484
-
\??\c:\466048.exec:\466048.exe87⤵PID:1124
-
\??\c:\pjjdd.exec:\pjjdd.exe88⤵PID:2608
-
\??\c:\80482.exec:\80482.exe89⤵PID:436
-
\??\c:\djdjd.exec:\djdjd.exe90⤵PID:2396
-
\??\c:\64068.exec:\64068.exe91⤵PID:4956
-
\??\c:\42666.exec:\42666.exe92⤵PID:3000
-
\??\c:\ppddd.exec:\ppddd.exe93⤵PID:624
-
\??\c:\tbtntn.exec:\tbtntn.exe94⤵PID:1080
-
\??\c:\80648.exec:\80648.exe95⤵PID:1800
-
\??\c:\k28266.exec:\k28266.exe96⤵PID:4876
-
\??\c:\048808.exec:\048808.exe97⤵PID:4024
-
\??\c:\ddjjp.exec:\ddjjp.exe98⤵PID:4992
-
\??\c:\3dvpj.exec:\3dvpj.exe99⤵PID:5080
-
\??\c:\rlxllff.exec:\rlxllff.exe100⤵PID:4676
-
\??\c:\ffrlxrl.exec:\ffrlxrl.exe101⤵PID:5020
-
\??\c:\lffrlfx.exec:\lffrlfx.exe102⤵PID:4564
-
\??\c:\pjjpj.exec:\pjjpj.exe103⤵PID:3500
-
\??\c:\266862.exec:\266862.exe104⤵PID:1244
-
\??\c:\6626448.exec:\6626448.exe105⤵PID:2964
-
\??\c:\bhhhtt.exec:\bhhhtt.exe106⤵PID:4628
-
\??\c:\6862222.exec:\6862222.exe107⤵PID:3188
-
\??\c:\dppvj.exec:\dppvj.exe108⤵PID:3812
-
\??\c:\888622.exec:\888622.exe109⤵PID:3828
-
\??\c:\bnhhtt.exec:\bnhhtt.exe110⤵PID:1100
-
\??\c:\266048.exec:\266048.exe111⤵PID:1044
-
\??\c:\9btnbt.exec:\9btnbt.exe112⤵PID:4300
-
\??\c:\q68402.exec:\q68402.exe113⤵PID:1976
-
\??\c:\824882.exec:\824882.exe114⤵PID:3540
-
\??\c:\vjpjd.exec:\vjpjd.exe115⤵PID:1132
-
\??\c:\6084004.exec:\6084004.exe116⤵PID:1896
-
\??\c:\488228.exec:\488228.exe117⤵PID:1684
-
\??\c:\a2882.exec:\a2882.exe118⤵PID:4120
-
\??\c:\2882642.exec:\2882642.exe119⤵PID:3636
-
\??\c:\866044.exec:\866044.exe120⤵PID:3980
-
\??\c:\dppdv.exec:\dppdv.exe121⤵PID:3052
-
\??\c:\9ddpp.exec:\9ddpp.exe122⤵PID:408
-
\??\c:\ntbbbb.exec:\ntbbbb.exe123⤵PID:4476
-
\??\c:\ppvpv.exec:\ppvpv.exe124⤵PID:4348
-
\??\c:\2608608.exec:\2608608.exe125⤵PID:1384
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe126⤵PID:4452
-
\??\c:\468860.exec:\468860.exe127⤵PID:4212
-
\??\c:\44482.exec:\44482.exe128⤵PID:1924
-
\??\c:\xrxlfrf.exec:\xrxlfrf.exe129⤵PID:1980
-
\??\c:\04882.exec:\04882.exe130⤵PID:3976
-
\??\c:\68464.exec:\68464.exe131⤵PID:532
-
\??\c:\4026448.exec:\4026448.exe132⤵PID:208
-
\??\c:\406868.exec:\406868.exe133⤵PID:1396
-
\??\c:\1jvjd.exec:\1jvjd.exe134⤵PID:1084
-
\??\c:\ntbhbh.exec:\ntbhbh.exe135⤵PID:2372
-
\??\c:\tbbbbb.exec:\tbbbbb.exe136⤵PID:3216
-
\??\c:\bnthbt.exec:\bnthbt.exe137⤵PID:1644
-
\??\c:\888488.exec:\888488.exe138⤵PID:4024
-
\??\c:\840044.exec:\840044.exe139⤵PID:3180
-
\??\c:\jvjjd.exec:\jvjjd.exe140⤵PID:2980
-
\??\c:\fllfxfx.exec:\fllfxfx.exe141⤵PID:4432
-
\??\c:\ffxlrxf.exec:\ffxlrxf.exe142⤵PID:4552
-
\??\c:\200266.exec:\200266.exe143⤵PID:4824
-
\??\c:\pjjdd.exec:\pjjdd.exe144⤵PID:4424
-
\??\c:\bhhbtt.exec:\bhhbtt.exe145⤵PID:1244
-
\??\c:\80884.exec:\80884.exe146⤵PID:2836
-
\??\c:\g6242.exec:\g6242.exe147⤵PID:4628
-
\??\c:\lfrfxrl.exec:\lfrfxrl.exe148⤵PID:1632
-
\??\c:\622266.exec:\622266.exe149⤵PID:3296
-
\??\c:\08204.exec:\08204.exe150⤵PID:5016
-
\??\c:\i446048.exec:\i446048.exe151⤵PID:3128
-
\??\c:\i226482.exec:\i226482.exe152⤵PID:2320
-
\??\c:\4206026.exec:\4206026.exe153⤵PID:4300
-
\??\c:\m4482.exec:\m4482.exe154⤵PID:1280
-
\??\c:\fxxlrlr.exec:\fxxlrlr.exe155⤵PID:4944
-
\??\c:\48828.exec:\48828.exe156⤵PID:4772
-
\??\c:\084284.exec:\084284.exe157⤵PID:4296
-
\??\c:\xflxrlx.exec:\xflxrlx.exe158⤵PID:1812
-
\??\c:\u620426.exec:\u620426.exe159⤵PID:4304
-
\??\c:\nttnhh.exec:\nttnhh.exe160⤵PID:948
-
\??\c:\0000426.exec:\0000426.exe161⤵PID:4908
-
\??\c:\u404888.exec:\u404888.exe162⤵PID:4988
-
\??\c:\rrlxrrl.exec:\rrlxrrl.exe163⤵PID:2156
-
\??\c:\vjvjv.exec:\vjvjv.exe164⤵PID:1652
-
\??\c:\40226.exec:\40226.exe165⤵PID:5028
-
\??\c:\442048.exec:\442048.exe166⤵PID:2016
-
\??\c:\hhbtbt.exec:\hhbtbt.exe167⤵PID:464
-
\??\c:\6408046.exec:\6408046.exe168⤵PID:4940
-
\??\c:\bhbhtb.exec:\bhbhtb.exe169⤵PID:3976
-
\??\c:\860488.exec:\860488.exe170⤵PID:4240
-
\??\c:\pdjdv.exec:\pdjdv.exe171⤵PID:4828
-
\??\c:\6602864.exec:\6602864.exe172⤵PID:624
-
\??\c:\pddvj.exec:\pddvj.exe173⤵PID:4464
-
\??\c:\86204.exec:\86204.exe174⤵PID:3216
-
\??\c:\vpppp.exec:\vpppp.exe175⤵PID:4872
-
\??\c:\nnbnht.exec:\nnbnht.exe176⤵PID:2772
-
\??\c:\86486.exec:\86486.exe177⤵PID:3808
-
\??\c:\648842.exec:\648842.exe178⤵PID:4720
-
\??\c:\264866.exec:\264866.exe179⤵PID:1592
-
\??\c:\hbtthb.exec:\hbtthb.exe180⤵PID:3620
-
\??\c:\60060.exec:\60060.exe181⤵PID:3360
-
\??\c:\vvjjv.exec:\vvjjv.exe182⤵PID:4316
-
\??\c:\46648.exec:\46648.exe183⤵PID:1528
-
\??\c:\668884.exec:\668884.exe184⤵PID:3088
-
\??\c:\2020488.exec:\2020488.exe185⤵PID:588
-
\??\c:\44828.exec:\44828.exe186⤵PID:1632
-
\??\c:\240022.exec:\240022.exe187⤵PID:216
-
\??\c:\826688.exec:\826688.exe188⤵PID:2464
-
\??\c:\000448.exec:\000448.exe189⤵PID:4388
-
\??\c:\4444822.exec:\4444822.exe190⤵PID:4744
-
\??\c:\rfrlxxf.exec:\rfrlxxf.exe191⤵PID:4900
-
\??\c:\vpdvd.exec:\vpdvd.exe192⤵PID:3136
-
\??\c:\u226000.exec:\u226000.exe193⤵PID:1352
-
\??\c:\q46480.exec:\q46480.exe194⤵PID:4120
-
\??\c:\htbbtt.exec:\htbbtt.exe195⤵PID:3024
-
\??\c:\606600.exec:\606600.exe196⤵PID:2012
-
\??\c:\60888.exec:\60888.exe197⤵PID:4540
-
\??\c:\0880448.exec:\0880448.exe198⤵PID:1548
-
\??\c:\684888.exec:\684888.exe199⤵PID:844
-
\??\c:\8226044.exec:\8226044.exe200⤵PID:116
-
\??\c:\4882604.exec:\4882604.exe201⤵PID:244
-
\??\c:\jjvpv.exec:\jjvpv.exe202⤵PID:4212
-
\??\c:\nbhhbb.exec:\nbhhbb.exe203⤵PID:4672
-
\??\c:\hthhhh.exec:\hthhhh.exe204⤵PID:1620
-
\??\c:\ppjpj.exec:\ppjpj.exe205⤵PID:1672
-
\??\c:\6228262.exec:\6228262.exe206⤵PID:5100
-
\??\c:\nntbhn.exec:\nntbhn.exe207⤵PID:4828
-
\??\c:\frrlfxr.exec:\frrlfxr.exe208⤵PID:2096
-
\??\c:\hhtnhh.exec:\hhtnhh.exe209⤵PID:2124
-
\??\c:\g6260.exec:\g6260.exe210⤵PID:1560
-
\??\c:\xrllffx.exec:\xrllffx.exe211⤵PID:4872
-
\??\c:\642042.exec:\642042.exe212⤵PID:2772
-
\??\c:\84448.exec:\84448.exe213⤵PID:4676
-
\??\c:\vjjdv.exec:\vjjdv.exe214⤵PID:4720
-
\??\c:\8804882.exec:\8804882.exe215⤵PID:1484
-
\??\c:\xllfxxr.exec:\xllfxxr.exe216⤵PID:3620
-
\??\c:\xffxlrl.exec:\xffxlrl.exe217⤵PID:3360
-
\??\c:\lxfffxr.exec:\lxfffxr.exe218⤵PID:1984
-
\??\c:\8206662.exec:\8206662.exe219⤵PID:3188
-
\??\c:\btntnn.exec:\btntnn.exe220⤵PID:4964
-
\??\c:\9dvvp.exec:\9dvvp.exe221⤵PID:2944
-
\??\c:\262xxxf.exec:\262xxxf.exe222⤵PID:888
-
\??\c:\e08266.exec:\e08266.exe223⤵PID:1940
-
\??\c:\hbbbnn.exec:\hbbbnn.exe224⤵PID:5072
-
\??\c:\lrxxxlr.exec:\lrxxxlr.exe225⤵PID:1880
-
\??\c:\24000.exec:\24000.exe226⤵PID:812
-
\??\c:\ttbtnn.exec:\ttbtnn.exe227⤵PID:4944
-
\??\c:\860484.exec:\860484.exe228⤵PID:4252
-
\??\c:\llfrfff.exec:\llfrfff.exe229⤵PID:3100
-
\??\c:\62040.exec:\62040.exe230⤵PID:3880
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe231⤵PID:4140
-
\??\c:\26484.exec:\26484.exe232⤵PID:948
-
\??\c:\4600684.exec:\4600684.exe233⤵PID:4068
-
\??\c:\bthhnn.exec:\bthhnn.exe234⤵PID:4604
-
\??\c:\dvvpv.exec:\dvvpv.exe235⤵PID:3668
-
\??\c:\rlrxlrl.exec:\rlrxlrl.exe236⤵PID:2260
-
\??\c:\2000442.exec:\2000442.exe237⤵PID:3200
-
\??\c:\httnnn.exec:\httnnn.exe238⤵PID:1948
-
\??\c:\404204.exec:\404204.exe239⤵PID:4400
-
\??\c:\060488.exec:\060488.exe240⤵PID:1636
-
\??\c:\jvdpj.exec:\jvdpj.exe241⤵PID:4940
-
\??\c:\82044.exec:\82044.exe242⤵PID:4956