Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 03:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7fa5aa3743333c20bb6d2633f2c16a90_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
7fa5aa3743333c20bb6d2633f2c16a90_NeikiAnalytics.exe
-
Size
483KB
-
MD5
7fa5aa3743333c20bb6d2633f2c16a90
-
SHA1
5d850b79226d9dde21a2a6f8338985aa53f6b0a0
-
SHA256
9e6d0380653449d6c1f0f8b5dd0a342f5d6ffd4a50641572d53a7244002391c3
-
SHA512
efbe41265c4c7ac7130d95b19987b53506489b265b10e8cc84704c166da692b0b75e1e436e0eb45be55de47fd95b33a9835a0867834d96a61b9f6338dd7900d3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjhtSizjE:q7Tc2NYHUrAwqzcy
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/388-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/508-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/780-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-1086-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjpvv.exejpvvv.exebtbhbb.exepvppp.exe9rrlrxf.exerlrlfff.exetnhhth.exexrxxrrr.exepddpd.exelllfxrl.exedjdpj.exehhbnnb.exe7xrllll.exedvdvp.exerfrfxxf.exevpjvv.exeffffxxx.exethhbbb.exexxlfllf.exejdjjj.exe5vdvd.exevpjjj.exelrrrllf.exebtbbbb.exetnnhhh.exedvddv.exehhbbhh.exetbttbh.exejpvvp.exe3dvdd.exevpdvv.exevvpvj.exefrxfxxx.exevppvv.exerflffxx.exehbhbtt.exehntnnt.exejdpjj.exefflfffx.exehnbtnn.exetthhhb.exedvdvv.exe7lfrlfx.exe3hbbbt.exevvjdj.exeffxxfrx.exennnbtb.exepdpjd.exelrxfffr.exerrlrrrx.exenhbthh.exejpvpj.exedpdvp.exe5frlxxr.exentbnhh.exebbbbbb.exepdjdd.exerrxrrrl.exe1hnntt.exehhtttt.exejpppp.exelrxrrll.exenbhhbh.exehhbtbb.exepid process 1348 jjpvv.exe 1972 jpvvv.exe 2816 btbhbb.exe 1372 pvppp.exe 3592 9rrlrxf.exe 1340 rlrlfff.exe 3936 tnhhth.exe 3844 xrxxrrr.exe 5104 pddpd.exe 2536 lllfxrl.exe 3268 djdpj.exe 4736 hhbnnb.exe 1752 7xrllll.exe 4740 dvdvp.exe 3680 rfrfxxf.exe 3656 vpjvv.exe 2668 ffffxxx.exe 1268 thhbbb.exe 976 xxlfllf.exe 1296 jdjjj.exe 4896 5vdvd.exe 2244 vpjjj.exe 1436 lrrrllf.exe 1540 btbbbb.exe 4636 tnnhhh.exe 4488 dvddv.exe 2680 hhbbhh.exe 4988 tbttbh.exe 5072 jpvvp.exe 4976 3dvdd.exe 3484 vpdvv.exe 2724 vvpvj.exe 4968 frxfxxx.exe 4464 vppvv.exe 1368 rflffxx.exe 3652 hbhbtt.exe 3480 hntnnt.exe 388 jdpjj.exe 3320 fflfffx.exe 956 hnbtnn.exe 5044 tthhhb.exe 508 dvdvv.exe 316 7lfrlfx.exe 456 3hbbbt.exe 1696 vvjdj.exe 1492 ffxxfrx.exe 1260 nnnbtb.exe 4732 pdpjd.exe 2456 lrxfffr.exe 1764 rrlrrrx.exe 4268 nhbthh.exe 932 jpvpj.exe 320 dpdvp.exe 2068 5frlxxr.exe 3240 ntbnhh.exe 4292 bbbbbb.exe 1752 pdjdd.exe 4008 rrxrrrl.exe 1596 1hnntt.exe 3684 hhtttt.exe 3764 jpppp.exe 1016 lrxrrll.exe 3152 nbhhbh.exe 4792 hhbtbb.exe -
Processes:
resource yara_rule behavioral2/memory/388-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/508-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/780-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-524-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7fa5aa3743333c20bb6d2633f2c16a90_NeikiAnalytics.exejjpvv.exejpvvv.exebtbhbb.exepvppp.exe9rrlrxf.exerlrlfff.exetnhhth.exexrxxrrr.exepddpd.exelllfxrl.exedjdpj.exehhbnnb.exe7xrllll.exedvdvp.exerfrfxxf.exevpjvv.exeffffxxx.exethhbbb.exexxlfllf.exejdjjj.exe5vdvd.exedescription pid process target process PID 388 wrote to memory of 1348 388 7fa5aa3743333c20bb6d2633f2c16a90_NeikiAnalytics.exe jjpvv.exe PID 388 wrote to memory of 1348 388 7fa5aa3743333c20bb6d2633f2c16a90_NeikiAnalytics.exe jjpvv.exe PID 388 wrote to memory of 1348 388 7fa5aa3743333c20bb6d2633f2c16a90_NeikiAnalytics.exe jjpvv.exe PID 1348 wrote to memory of 1972 1348 jjpvv.exe jpvvv.exe PID 1348 wrote to memory of 1972 1348 jjpvv.exe jpvvv.exe PID 1348 wrote to memory of 1972 1348 jjpvv.exe jpvvv.exe PID 1972 wrote to memory of 2816 1972 jpvvv.exe btbhbb.exe PID 1972 wrote to memory of 2816 1972 jpvvv.exe btbhbb.exe PID 1972 wrote to memory of 2816 1972 jpvvv.exe btbhbb.exe PID 2816 wrote to memory of 1372 2816 btbhbb.exe pvppp.exe PID 2816 wrote to memory of 1372 2816 btbhbb.exe pvppp.exe PID 2816 wrote to memory of 1372 2816 btbhbb.exe pvppp.exe PID 1372 wrote to memory of 3592 1372 pvppp.exe 9rrlrxf.exe PID 1372 wrote to memory of 3592 1372 pvppp.exe 9rrlrxf.exe PID 1372 wrote to memory of 3592 1372 pvppp.exe 9rrlrxf.exe PID 3592 wrote to memory of 1340 3592 9rrlrxf.exe rlrlfff.exe PID 3592 wrote to memory of 1340 3592 9rrlrxf.exe rlrlfff.exe PID 3592 wrote to memory of 1340 3592 9rrlrxf.exe rlrlfff.exe PID 1340 wrote to memory of 3936 1340 rlrlfff.exe tnhhth.exe PID 1340 wrote to memory of 3936 1340 rlrlfff.exe tnhhth.exe PID 1340 wrote to memory of 3936 1340 rlrlfff.exe tnhhth.exe PID 3936 wrote to memory of 3844 3936 tnhhth.exe xrxxrrr.exe PID 3936 wrote to memory of 3844 3936 tnhhth.exe xrxxrrr.exe PID 3936 wrote to memory of 3844 3936 tnhhth.exe xrxxrrr.exe PID 3844 wrote to memory of 5104 3844 xrxxrrr.exe pddpd.exe PID 3844 wrote to memory of 5104 3844 xrxxrrr.exe pddpd.exe PID 3844 wrote to memory of 5104 3844 xrxxrrr.exe pddpd.exe PID 5104 wrote to memory of 2536 5104 pddpd.exe lllfxrl.exe PID 5104 wrote to memory of 2536 5104 pddpd.exe lllfxrl.exe PID 5104 wrote to memory of 2536 5104 pddpd.exe lllfxrl.exe PID 2536 wrote to memory of 3268 2536 lllfxrl.exe djdpj.exe PID 2536 wrote to memory of 3268 2536 lllfxrl.exe djdpj.exe PID 2536 wrote to memory of 3268 2536 lllfxrl.exe djdpj.exe PID 3268 wrote to memory of 4736 3268 djdpj.exe hhbnnb.exe PID 3268 wrote to memory of 4736 3268 djdpj.exe hhbnnb.exe PID 3268 wrote to memory of 4736 3268 djdpj.exe hhbnnb.exe PID 4736 wrote to memory of 1752 4736 hhbnnb.exe 7xrllll.exe PID 4736 wrote to memory of 1752 4736 hhbnnb.exe 7xrllll.exe PID 4736 wrote to memory of 1752 4736 hhbnnb.exe 7xrllll.exe PID 1752 wrote to memory of 4740 1752 7xrllll.exe dvdvp.exe PID 1752 wrote to memory of 4740 1752 7xrllll.exe dvdvp.exe PID 1752 wrote to memory of 4740 1752 7xrllll.exe dvdvp.exe PID 4740 wrote to memory of 3680 4740 dvdvp.exe rfrfxxf.exe PID 4740 wrote to memory of 3680 4740 dvdvp.exe rfrfxxf.exe PID 4740 wrote to memory of 3680 4740 dvdvp.exe rfrfxxf.exe PID 3680 wrote to memory of 3656 3680 rfrfxxf.exe vpjvv.exe PID 3680 wrote to memory of 3656 3680 rfrfxxf.exe vpjvv.exe PID 3680 wrote to memory of 3656 3680 rfrfxxf.exe vpjvv.exe PID 3656 wrote to memory of 2668 3656 vpjvv.exe ffffxxx.exe PID 3656 wrote to memory of 2668 3656 vpjvv.exe ffffxxx.exe PID 3656 wrote to memory of 2668 3656 vpjvv.exe ffffxxx.exe PID 2668 wrote to memory of 1268 2668 ffffxxx.exe thhbbb.exe PID 2668 wrote to memory of 1268 2668 ffffxxx.exe thhbbb.exe PID 2668 wrote to memory of 1268 2668 ffffxxx.exe thhbbb.exe PID 1268 wrote to memory of 976 1268 thhbbb.exe xxlfllf.exe PID 1268 wrote to memory of 976 1268 thhbbb.exe xxlfllf.exe PID 1268 wrote to memory of 976 1268 thhbbb.exe xxlfllf.exe PID 976 wrote to memory of 1296 976 xxlfllf.exe jdjjj.exe PID 976 wrote to memory of 1296 976 xxlfllf.exe jdjjj.exe PID 976 wrote to memory of 1296 976 xxlfllf.exe jdjjj.exe PID 1296 wrote to memory of 4896 1296 jdjjj.exe 5vdvd.exe PID 1296 wrote to memory of 4896 1296 jdjjj.exe 5vdvd.exe PID 1296 wrote to memory of 4896 1296 jdjjj.exe 5vdvd.exe PID 4896 wrote to memory of 2244 4896 5vdvd.exe vpjjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fa5aa3743333c20bb6d2633f2c16a90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7fa5aa3743333c20bb6d2633f2c16a90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\jjpvv.exec:\jjpvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvvv.exec:\jpvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbhbb.exec:\btbhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvppp.exec:\pvppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9rrlrxf.exec:\9rrlrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrlfff.exec:\rlrlfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnhhth.exec:\tnhhth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pddpd.exec:\pddpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lllfxrl.exec:\lllfxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djdpj.exec:\djdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbnnb.exec:\hhbnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xrllll.exec:\7xrllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdvp.exec:\dvdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfrfxxf.exec:\rfrfxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjvv.exec:\vpjvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffffxxx.exec:\ffffxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thhbbb.exec:\thhbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlfllf.exec:\xxlfllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjjj.exec:\jdjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5vdvd.exec:\5vdvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjjj.exec:\vpjjj.exe23⤵
- Executes dropped EXE
-
\??\c:\lrrrllf.exec:\lrrrllf.exe24⤵
- Executes dropped EXE
-
\??\c:\btbbbb.exec:\btbbbb.exe25⤵
- Executes dropped EXE
-
\??\c:\tnnhhh.exec:\tnnhhh.exe26⤵
- Executes dropped EXE
-
\??\c:\dvddv.exec:\dvddv.exe27⤵
- Executes dropped EXE
-
\??\c:\hhbbhh.exec:\hhbbhh.exe28⤵
- Executes dropped EXE
-
\??\c:\tbttbh.exec:\tbttbh.exe29⤵
- Executes dropped EXE
-
\??\c:\jpvvp.exec:\jpvvp.exe30⤵
- Executes dropped EXE
-
\??\c:\3dvdd.exec:\3dvdd.exe31⤵
- Executes dropped EXE
-
\??\c:\vpdvv.exec:\vpdvv.exe32⤵
- Executes dropped EXE
-
\??\c:\vvpvj.exec:\vvpvj.exe33⤵
- Executes dropped EXE
-
\??\c:\frxfxxx.exec:\frxfxxx.exe34⤵
- Executes dropped EXE
-
\??\c:\vppvv.exec:\vppvv.exe35⤵
- Executes dropped EXE
-
\??\c:\rflffxx.exec:\rflffxx.exe36⤵
- Executes dropped EXE
-
\??\c:\hbhbtt.exec:\hbhbtt.exe37⤵
- Executes dropped EXE
-
\??\c:\hntnnt.exec:\hntnnt.exe38⤵
- Executes dropped EXE
-
\??\c:\jdpjj.exec:\jdpjj.exe39⤵
- Executes dropped EXE
-
\??\c:\fflfffx.exec:\fflfffx.exe40⤵
- Executes dropped EXE
-
\??\c:\hnbtnn.exec:\hnbtnn.exe41⤵
- Executes dropped EXE
-
\??\c:\tthhhb.exec:\tthhhb.exe42⤵
- Executes dropped EXE
-
\??\c:\dvdvv.exec:\dvdvv.exe43⤵
- Executes dropped EXE
-
\??\c:\7lfrlfx.exec:\7lfrlfx.exe44⤵
- Executes dropped EXE
-
\??\c:\3hbbbt.exec:\3hbbbt.exe45⤵
- Executes dropped EXE
-
\??\c:\vvjdj.exec:\vvjdj.exe46⤵
- Executes dropped EXE
-
\??\c:\ffxxfrx.exec:\ffxxfrx.exe47⤵
- Executes dropped EXE
-
\??\c:\nnnbtb.exec:\nnnbtb.exe48⤵
- Executes dropped EXE
-
\??\c:\pdpjd.exec:\pdpjd.exe49⤵
- Executes dropped EXE
-
\??\c:\lrxfffr.exec:\lrxfffr.exe50⤵
- Executes dropped EXE
-
\??\c:\rrlrrrx.exec:\rrlrrrx.exe51⤵
- Executes dropped EXE
-
\??\c:\nhbthh.exec:\nhbthh.exe52⤵
- Executes dropped EXE
-
\??\c:\jpvpj.exec:\jpvpj.exe53⤵
- Executes dropped EXE
-
\??\c:\dpdvp.exec:\dpdvp.exe54⤵
- Executes dropped EXE
-
\??\c:\5frlxxr.exec:\5frlxxr.exe55⤵
- Executes dropped EXE
-
\??\c:\ntbnhh.exec:\ntbnhh.exe56⤵
- Executes dropped EXE
-
\??\c:\bbbbbb.exec:\bbbbbb.exe57⤵
- Executes dropped EXE
-
\??\c:\pdjdd.exec:\pdjdd.exe58⤵
- Executes dropped EXE
-
\??\c:\rrxrrrl.exec:\rrxrrrl.exe59⤵
- Executes dropped EXE
-
\??\c:\1hnntt.exec:\1hnntt.exe60⤵
- Executes dropped EXE
-
\??\c:\hhtttt.exec:\hhtttt.exe61⤵
- Executes dropped EXE
-
\??\c:\jpppp.exec:\jpppp.exe62⤵
- Executes dropped EXE
-
\??\c:\lrxrrll.exec:\lrxrrll.exe63⤵
- Executes dropped EXE
-
\??\c:\nbhhbh.exec:\nbhhbh.exe64⤵
- Executes dropped EXE
-
\??\c:\hhbtbb.exec:\hhbtbb.exe65⤵
- Executes dropped EXE
-
\??\c:\vdppv.exec:\vdppv.exe66⤵
-
\??\c:\rlrlflf.exec:\rlrlflf.exe67⤵
-
\??\c:\tnbttt.exec:\tnbttt.exe68⤵
-
\??\c:\thttbn.exec:\thttbn.exe69⤵
-
\??\c:\dpddv.exec:\dpddv.exe70⤵
-
\??\c:\lrxxrxx.exec:\lrxxrxx.exe71⤵
-
\??\c:\3xrrrxx.exec:\3xrrrxx.exe72⤵
-
\??\c:\nhnbtb.exec:\nhnbtb.exe73⤵
-
\??\c:\djjjd.exec:\djjjd.exe74⤵
-
\??\c:\pdddd.exec:\pdddd.exe75⤵
-
\??\c:\ntbttt.exec:\ntbttt.exe76⤵
-
\??\c:\7jjdv.exec:\7jjdv.exe77⤵
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe78⤵
-
\??\c:\hthtth.exec:\hthtth.exe79⤵
-
\??\c:\nnbbbb.exec:\nnbbbb.exe80⤵
-
\??\c:\dvddd.exec:\dvddd.exe81⤵
-
\??\c:\fffxrxx.exec:\fffxrxx.exe82⤵
-
\??\c:\bbbnth.exec:\bbbnth.exe83⤵
-
\??\c:\ntbbbh.exec:\ntbbbh.exe84⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe85⤵
-
\??\c:\xrffxff.exec:\xrffxff.exe86⤵
-
\??\c:\thnhhn.exec:\thnhhn.exe87⤵
-
\??\c:\nbbttt.exec:\nbbttt.exe88⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe89⤵
-
\??\c:\rxfxrrf.exec:\rxfxrrf.exe90⤵
-
\??\c:\rrffxxx.exec:\rrffxxx.exe91⤵
-
\??\c:\nhnhbb.exec:\nhnhbb.exe92⤵
-
\??\c:\fxxxxfx.exec:\fxxxxfx.exe93⤵
-
\??\c:\nnbbtt.exec:\nnbbtt.exe94⤵
-
\??\c:\nhnhhh.exec:\nhnhhh.exe95⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe96⤵
-
\??\c:\hnthtt.exec:\hnthtt.exe97⤵
-
\??\c:\7flllrr.exec:\7flllrr.exe98⤵
-
\??\c:\nbnnhn.exec:\nbnnhn.exe99⤵
-
\??\c:\1jddd.exec:\1jddd.exe100⤵
-
\??\c:\rxlfrlf.exec:\rxlfrlf.exe101⤵
-
\??\c:\lxfflrr.exec:\lxfflrr.exe102⤵
-
\??\c:\bnhbbh.exec:\bnhbbh.exe103⤵
-
\??\c:\llrfxxr.exec:\llrfxxr.exe104⤵
-
\??\c:\xfxxxll.exec:\xfxxxll.exe105⤵
-
\??\c:\ttntbb.exec:\ttntbb.exe106⤵
-
\??\c:\1vvvv.exec:\1vvvv.exe107⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe108⤵
-
\??\c:\fxffrrr.exec:\fxffrrr.exe109⤵
-
\??\c:\nhnhtn.exec:\nhnhtn.exe110⤵
-
\??\c:\jdddd.exec:\jdddd.exe111⤵
-
\??\c:\9flflrr.exec:\9flflrr.exe112⤵
-
\??\c:\tthtnb.exec:\tthtnb.exe113⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe114⤵
-
\??\c:\xxrrlfx.exec:\xxrrlfx.exe115⤵
-
\??\c:\lrfllll.exec:\lrfllll.exe116⤵
-
\??\c:\hbbbbb.exec:\hbbbbb.exe117⤵
-
\??\c:\dppjj.exec:\dppjj.exe118⤵
-
\??\c:\xlrlflr.exec:\xlrlflr.exe119⤵
-
\??\c:\nbnnnn.exec:\nbnnnn.exe120⤵
-
\??\c:\hnbtnn.exec:\hnbtnn.exe121⤵
-
\??\c:\jjvpj.exec:\jjvpj.exe122⤵
-
\??\c:\xlxffrr.exec:\xlxffrr.exe123⤵
-
\??\c:\tthhbb.exec:\tthhbb.exe124⤵
-
\??\c:\hbhbbb.exec:\hbhbbb.exe125⤵
-
\??\c:\ppppp.exec:\ppppp.exe126⤵
-
\??\c:\5xfxrrr.exec:\5xfxrrr.exe127⤵
-
\??\c:\nbnnhh.exec:\nbnnhh.exe128⤵
-
\??\c:\nnhhbh.exec:\nnhhbh.exe129⤵
-
\??\c:\pjpdd.exec:\pjpdd.exe130⤵
-
\??\c:\rrlfrlf.exec:\rrlfrlf.exe131⤵
-
\??\c:\rlxrxxr.exec:\rlxrxxr.exe132⤵
-
\??\c:\7nbbnt.exec:\7nbbnt.exe133⤵
-
\??\c:\dvjvv.exec:\dvjvv.exe134⤵
-
\??\c:\1xfxxxl.exec:\1xfxxxl.exe135⤵
-
\??\c:\xxffrxx.exec:\xxffrxx.exe136⤵
-
\??\c:\3hhbbb.exec:\3hhbbb.exe137⤵
-
\??\c:\3pvvv.exec:\3pvvv.exe138⤵
-
\??\c:\frflrrr.exec:\frflrrr.exe139⤵
-
\??\c:\9rrllrr.exec:\9rrllrr.exe140⤵
-
\??\c:\bhnhhn.exec:\bhnhhn.exe141⤵
-
\??\c:\1pjjd.exec:\1pjjd.exe142⤵
-
\??\c:\ffxrrrx.exec:\ffxrrrx.exe143⤵
-
\??\c:\tthhnt.exec:\tthhnt.exe144⤵
-
\??\c:\btntnh.exec:\btntnh.exe145⤵
-
\??\c:\djvvp.exec:\djvvp.exe146⤵
-
\??\c:\fllrlrr.exec:\fllrlrr.exe147⤵
-
\??\c:\ntntnt.exec:\ntntnt.exe148⤵
-
\??\c:\tntttt.exec:\tntttt.exe149⤵
-
\??\c:\7ddjp.exec:\7ddjp.exe150⤵
-
\??\c:\xrfflll.exec:\xrfflll.exe151⤵
-
\??\c:\hhhbbh.exec:\hhhbbh.exe152⤵
-
\??\c:\pvvvv.exec:\pvvvv.exe153⤵
-
\??\c:\jddjd.exec:\jddjd.exe154⤵
-
\??\c:\xfffxff.exec:\xfffxff.exe155⤵
-
\??\c:\tnbtbb.exec:\tnbtbb.exe156⤵
-
\??\c:\hbbtnt.exec:\hbbtnt.exe157⤵
-
\??\c:\dpvvd.exec:\dpvvd.exe158⤵
-
\??\c:\rxrxrff.exec:\rxrxrff.exe159⤵
-
\??\c:\7tnnhn.exec:\7tnnhn.exe160⤵
-
\??\c:\nhbtnn.exec:\nhbtnn.exe161⤵
-
\??\c:\9vjdj.exec:\9vjdj.exe162⤵
-
\??\c:\7xrlfff.exec:\7xrlfff.exe163⤵
-
\??\c:\hntttt.exec:\hntttt.exe164⤵
-
\??\c:\dvpvd.exec:\dvpvd.exe165⤵
-
\??\c:\ddddj.exec:\ddddj.exe166⤵
-
\??\c:\lxrxxxr.exec:\lxrxxxr.exe167⤵
-
\??\c:\bhhnbb.exec:\bhhnbb.exe168⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe169⤵
-
\??\c:\jvjjp.exec:\jvjjp.exe170⤵
-
\??\c:\llfxrrl.exec:\llfxrrl.exe171⤵
-
\??\c:\hbnhhh.exec:\hbnhhh.exe172⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe173⤵
-
\??\c:\vpjjd.exec:\vpjjd.exe174⤵
-
\??\c:\lllxxxf.exec:\lllxxxf.exe175⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe176⤵
-
\??\c:\1vppp.exec:\1vppp.exe177⤵
-
\??\c:\3ppjj.exec:\3ppjj.exe178⤵
-
\??\c:\fxxfflr.exec:\fxxfflr.exe179⤵
-
\??\c:\nbntnt.exec:\nbntnt.exe180⤵
-
\??\c:\vdvvv.exec:\vdvvv.exe181⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe182⤵
-
\??\c:\ffrlfll.exec:\ffrlfll.exe183⤵
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe184⤵
-
\??\c:\5ttttt.exec:\5ttttt.exe185⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe186⤵
-
\??\c:\fxrllrl.exec:\fxrllrl.exe187⤵
-
\??\c:\1rrllrr.exec:\1rrllrr.exe188⤵
-
\??\c:\7tbttb.exec:\7tbttb.exe189⤵
-
\??\c:\pdjjj.exec:\pdjjj.exe190⤵
-
\??\c:\llxrxxf.exec:\llxrxxf.exe191⤵
-
\??\c:\nhhbtn.exec:\nhhbtn.exe192⤵
-
\??\c:\vdppj.exec:\vdppj.exe193⤵
-
\??\c:\jjddj.exec:\jjddj.exe194⤵
-
\??\c:\xfxrxxr.exec:\xfxrxxr.exe195⤵
-
\??\c:\hbhhnb.exec:\hbhhnb.exe196⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe197⤵
-
\??\c:\9vdvv.exec:\9vdvv.exe198⤵
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe199⤵
-
\??\c:\5nttnt.exec:\5nttnt.exe200⤵
-
\??\c:\pjvjp.exec:\pjvjp.exe201⤵
-
\??\c:\ppddd.exec:\ppddd.exe202⤵
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe203⤵
-
\??\c:\nntntn.exec:\nntntn.exe204⤵
-
\??\c:\jvpvp.exec:\jvpvp.exe205⤵
-
\??\c:\rfllllr.exec:\rfllllr.exe206⤵
-
\??\c:\5rxrrxx.exec:\5rxrrxx.exe207⤵
-
\??\c:\bnbbbb.exec:\bnbbbb.exe208⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe209⤵
-
\??\c:\xfrlfff.exec:\xfrlfff.exe210⤵
-
\??\c:\7lrllll.exec:\7lrllll.exe211⤵
-
\??\c:\5htntt.exec:\5htntt.exe212⤵
-
\??\c:\dpdvv.exec:\dpdvv.exe213⤵
-
\??\c:\ddddp.exec:\ddddp.exe214⤵
-
\??\c:\rxlxrxr.exec:\rxlxrxr.exe215⤵
-
\??\c:\ttbbnn.exec:\ttbbnn.exe216⤵
-
\??\c:\bhnhnn.exec:\bhnhnn.exe217⤵
-
\??\c:\jjdvj.exec:\jjdvj.exe218⤵
-
\??\c:\rxlfffl.exec:\rxlfffl.exe219⤵
-
\??\c:\ttttnt.exec:\ttttnt.exe220⤵
-
\??\c:\hhnntt.exec:\hhnntt.exe221⤵
-
\??\c:\djjjp.exec:\djjjp.exe222⤵
-
\??\c:\llrlfll.exec:\llrlfll.exe223⤵
-
\??\c:\rlffxff.exec:\rlffxff.exe224⤵
-
\??\c:\htbttt.exec:\htbttt.exe225⤵
-
\??\c:\vvvdp.exec:\vvvdp.exe226⤵
-
\??\c:\xfrrfll.exec:\xfrrfll.exe227⤵
-
\??\c:\3ttnhh.exec:\3ttnhh.exe228⤵
-
\??\c:\nnnnhh.exec:\nnnnhh.exe229⤵
-
\??\c:\ddjdj.exec:\ddjdj.exe230⤵
-
\??\c:\flrfrrr.exec:\flrfrrr.exe231⤵
-
\??\c:\bbnnnn.exec:\bbnnnn.exe232⤵
-
\??\c:\nhnhhn.exec:\nhnhhn.exe233⤵
-
\??\c:\ddjjd.exec:\ddjjd.exe234⤵
-
\??\c:\1rfxffl.exec:\1rfxffl.exe235⤵
-
\??\c:\ffflxxr.exec:\ffflxxr.exe236⤵
-
\??\c:\bbhbbb.exec:\bbhbbb.exe237⤵
-
\??\c:\dpjdd.exec:\dpjdd.exe238⤵
-
\??\c:\lrffrrf.exec:\lrffrrf.exe239⤵
-
\??\c:\xlfrlfr.exec:\xlfrlfr.exe240⤵
-
\??\c:\7nnbtt.exec:\7nnbtt.exe241⤵