Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 17:29
Behavioral task
behavioral1
Sample
1c0eca07d5a23a0c2008f24d505fcc50_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1c0eca07d5a23a0c2008f24d505fcc50_NeikiAnalytics.exe
-
Size
92KB
-
MD5
1c0eca07d5a23a0c2008f24d505fcc50
-
SHA1
b9b678999f385c354c726633bb60f999f517cc7d
-
SHA256
0c28b2cba517ad5328f134503e67c37d1adfa82f03180c287c7204dd41fa949c
-
SHA512
68558d158e5777c57624399af512b8390643c3dee37b2c84355fd73c7c67706d3c39f2b501eca24f875668a0cd683133d4bc3fc1704da79662ce4f92d9d956d8
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpWm:8hOmTsF93UYfwC6GIout0fmCiiiXA6mP
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4628-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1864-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1280-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/992-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3864-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4132-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/424-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/692-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1096-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frlfxxr.exetbhbhh.exethhbbt.exeddjpv.exerxfxrrr.exexxxrlff.exenhhnbh.exejjppj.exefxxrffx.exebbnhhn.exevjpjp.exe1rfxrrf.exetnnnhh.exevpddv.exefxfxrrl.exentnnth.exe3hhbtb.exepvvpj.exe3frxrlf.exenbtnhb.exe9djdd.exe5flfxxr.exelllxrlf.exetbhbtt.exedddvv.exerlrlxrl.exethtnht.exevvvpj.exefrlfxrf.exetntnhh.exe3vvpp.exepvvjj.exebnnhtt.exetbhtbn.exeddjdp.exedpvpj.exeffxxlrx.exenthnnh.exe1hnnhb.exedppvd.exe5rlflfx.exenhhbtt.exehhhthb.exe5ddvv.exelffxrrl.exe3bnbnh.exehnnhhh.exedvjvd.exexrfxxxf.exetthhbb.exenhbnbn.exejddvv.exexflrrrl.exerrlllll.exentttnn.exehntthb.exevjpjd.exedjddp.exexlxrlll.exerfrlrlr.exetnthnh.exevvvvp.exejdvjd.exerlfxfxf.exepid process 4540 frlfxxr.exe 2748 tbhbhh.exe 3208 thhbbt.exe 2904 ddjpv.exe 1864 rxfxrrr.exe 660 xxxrlff.exe 4440 nhhnbh.exe 1692 jjppj.exe 1280 fxxrffx.exe 3672 bbnhhn.exe 4836 vjpjp.exe 4068 1rfxrrf.exe 2924 tnnnhh.exe 2372 vpddv.exe 4848 fxfxrrl.exe 3340 ntnnth.exe 992 3hhbtb.exe 5100 pvvpj.exe 2692 3frxrlf.exe 3996 nbtnhb.exe 1656 9djdd.exe 3780 5flfxxr.exe 2332 lllxrlf.exe 1440 tbhbtt.exe 60 dddvv.exe 1128 rlrlxrl.exe 4320 thtnht.exe 4120 vvvpj.exe 4284 frlfxrf.exe 1320 tntnhh.exe 424 3vvpp.exe 4180 pvvjj.exe 4856 bnnhtt.exe 4540 tbhtbn.exe 2684 ddjdp.exe 1536 dpvpj.exe 2860 ffxxlrx.exe 632 nthnnh.exe 1864 1hnnhb.exe 4984 dppvd.exe 2724 5rlflfx.exe 4424 nhhbtt.exe 1692 hhhthb.exe 2232 5ddvv.exe 1488 lffxrrl.exe 1512 3bnbnh.exe 3864 hnnhhh.exe 3748 dvjvd.exe 908 xrfxxxf.exe 648 tthhbb.exe 4132 nhbnbn.exe 964 jddvv.exe 956 xflrrrl.exe 4504 rrlllll.exe 2424 ntttnn.exe 4472 hntthb.exe 2192 vjpjd.exe 3388 djddp.exe 1136 xlxrlll.exe 2240 rfrlrlr.exe 224 tnthnh.exe 2760 vvvvp.exe 2016 jdvjd.exe 3640 rlfxfxf.exe -
Processes:
resource yara_rule behavioral2/memory/4628-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frlfxxr.exe upx behavioral2/memory/4540-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2748-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddjpv.exe upx behavioral2/memory/2904-22-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxfxrrr.exe upx \??\c:\xxxrlff.exe upx behavioral2/memory/1864-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/660-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3208-17-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\thhbbt.exe upx behavioral2/memory/4540-10-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbhbhh.exe upx \??\c:\nhhnbh.exe upx behavioral2/memory/660-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjppj.exe upx behavioral2/memory/4440-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxxrffx.exe upx behavioral2/memory/1692-46-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbnhhn.exe upx behavioral2/memory/1280-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjpjp.exe upx behavioral2/memory/4836-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3672-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1rfxrrf.exe upx behavioral2/memory/4836-62-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnnnhh.exe upx behavioral2/memory/4068-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpddv.exe upx behavioral2/memory/2924-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2372-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxfxrrl.exe upx \??\c:\ntnnth.exe upx behavioral2/memory/4848-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3340-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3hhbtb.exe upx C:\pvvpj.exe upx behavioral2/memory/992-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5100-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3frxrlf.exe upx behavioral2/memory/2692-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbtnhb.exe upx behavioral2/memory/3996-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9djdd.exe upx C:\5flfxxr.exe upx C:\lllxrlf.exe upx behavioral2/memory/3780-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbhbtt.exe upx behavioral2/memory/2332-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1440-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/60-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrlxrl.exe upx \??\c:\dddvv.exe upx C:\thtnht.exe upx behavioral2/memory/4320-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvpj.exe upx C:\frlfxrf.exe upx C:\tntnhh.exe upx C:\3vvpp.exe upx C:\pvvjj.exe upx behavioral2/memory/4856-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4540-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4984-177-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1c0eca07d5a23a0c2008f24d505fcc50_NeikiAnalytics.exefrlfxxr.exetbhbhh.exethhbbt.exeddjpv.exerxfxrrr.exexxxrlff.exenhhnbh.exejjppj.exefxxrffx.exebbnhhn.exevjpjp.exe1rfxrrf.exetnnnhh.exevpddv.exefxfxrrl.exentnnth.exe3hhbtb.exepvvpj.exe3frxrlf.exenbtnhb.exe9djdd.exedescription pid process target process PID 4628 wrote to memory of 4540 4628 1c0eca07d5a23a0c2008f24d505fcc50_NeikiAnalytics.exe frlfxxr.exe PID 4628 wrote to memory of 4540 4628 1c0eca07d5a23a0c2008f24d505fcc50_NeikiAnalytics.exe frlfxxr.exe PID 4628 wrote to memory of 4540 4628 1c0eca07d5a23a0c2008f24d505fcc50_NeikiAnalytics.exe frlfxxr.exe PID 4540 wrote to memory of 2748 4540 frlfxxr.exe tbhbhh.exe PID 4540 wrote to memory of 2748 4540 frlfxxr.exe tbhbhh.exe PID 4540 wrote to memory of 2748 4540 frlfxxr.exe tbhbhh.exe PID 2748 wrote to memory of 3208 2748 tbhbhh.exe thhbbt.exe PID 2748 wrote to memory of 3208 2748 tbhbhh.exe thhbbt.exe PID 2748 wrote to memory of 3208 2748 tbhbhh.exe thhbbt.exe PID 3208 wrote to memory of 2904 3208 thhbbt.exe ddjpv.exe PID 3208 wrote to memory of 2904 3208 thhbbt.exe ddjpv.exe PID 3208 wrote to memory of 2904 3208 thhbbt.exe ddjpv.exe PID 2904 wrote to memory of 1864 2904 ddjpv.exe rxfxrrr.exe PID 2904 wrote to memory of 1864 2904 ddjpv.exe rxfxrrr.exe PID 2904 wrote to memory of 1864 2904 ddjpv.exe rxfxrrr.exe PID 1864 wrote to memory of 660 1864 rxfxrrr.exe xxxrlff.exe PID 1864 wrote to memory of 660 1864 rxfxrrr.exe xxxrlff.exe PID 1864 wrote to memory of 660 1864 rxfxrrr.exe xxxrlff.exe PID 660 wrote to memory of 4440 660 xxxrlff.exe nhhnbh.exe PID 660 wrote to memory of 4440 660 xxxrlff.exe nhhnbh.exe PID 660 wrote to memory of 4440 660 xxxrlff.exe nhhnbh.exe PID 4440 wrote to memory of 1692 4440 nhhnbh.exe jjppj.exe PID 4440 wrote to memory of 1692 4440 nhhnbh.exe jjppj.exe PID 4440 wrote to memory of 1692 4440 nhhnbh.exe jjppj.exe PID 1692 wrote to memory of 1280 1692 jjppj.exe fxxrffx.exe PID 1692 wrote to memory of 1280 1692 jjppj.exe fxxrffx.exe PID 1692 wrote to memory of 1280 1692 jjppj.exe fxxrffx.exe PID 1280 wrote to memory of 3672 1280 fxxrffx.exe bbnhhn.exe PID 1280 wrote to memory of 3672 1280 fxxrffx.exe bbnhhn.exe PID 1280 wrote to memory of 3672 1280 fxxrffx.exe bbnhhn.exe PID 3672 wrote to memory of 4836 3672 bbnhhn.exe vjpjp.exe PID 3672 wrote to memory of 4836 3672 bbnhhn.exe vjpjp.exe PID 3672 wrote to memory of 4836 3672 bbnhhn.exe vjpjp.exe PID 4836 wrote to memory of 4068 4836 vjpjp.exe 1rfxrrf.exe PID 4836 wrote to memory of 4068 4836 vjpjp.exe 1rfxrrf.exe PID 4836 wrote to memory of 4068 4836 vjpjp.exe 1rfxrrf.exe PID 4068 wrote to memory of 2924 4068 1rfxrrf.exe tnnnhh.exe PID 4068 wrote to memory of 2924 4068 1rfxrrf.exe tnnnhh.exe PID 4068 wrote to memory of 2924 4068 1rfxrrf.exe tnnnhh.exe PID 2924 wrote to memory of 2372 2924 tnnnhh.exe vpddv.exe PID 2924 wrote to memory of 2372 2924 tnnnhh.exe vpddv.exe PID 2924 wrote to memory of 2372 2924 tnnnhh.exe vpddv.exe PID 2372 wrote to memory of 4848 2372 vpddv.exe fxfxrrl.exe PID 2372 wrote to memory of 4848 2372 vpddv.exe fxfxrrl.exe PID 2372 wrote to memory of 4848 2372 vpddv.exe fxfxrrl.exe PID 4848 wrote to memory of 3340 4848 fxfxrrl.exe ntnnth.exe PID 4848 wrote to memory of 3340 4848 fxfxrrl.exe ntnnth.exe PID 4848 wrote to memory of 3340 4848 fxfxrrl.exe ntnnth.exe PID 3340 wrote to memory of 992 3340 ntnnth.exe 3hhbtb.exe PID 3340 wrote to memory of 992 3340 ntnnth.exe 3hhbtb.exe PID 3340 wrote to memory of 992 3340 ntnnth.exe 3hhbtb.exe PID 992 wrote to memory of 5100 992 3hhbtb.exe pvvpj.exe PID 992 wrote to memory of 5100 992 3hhbtb.exe pvvpj.exe PID 992 wrote to memory of 5100 992 3hhbtb.exe pvvpj.exe PID 5100 wrote to memory of 2692 5100 pvvpj.exe 3frxrlf.exe PID 5100 wrote to memory of 2692 5100 pvvpj.exe 3frxrlf.exe PID 5100 wrote to memory of 2692 5100 pvvpj.exe 3frxrlf.exe PID 2692 wrote to memory of 3996 2692 3frxrlf.exe nbtnhb.exe PID 2692 wrote to memory of 3996 2692 3frxrlf.exe nbtnhb.exe PID 2692 wrote to memory of 3996 2692 3frxrlf.exe nbtnhb.exe PID 3996 wrote to memory of 1656 3996 nbtnhb.exe 9djdd.exe PID 3996 wrote to memory of 1656 3996 nbtnhb.exe 9djdd.exe PID 3996 wrote to memory of 1656 3996 nbtnhb.exe 9djdd.exe PID 1656 wrote to memory of 3780 1656 9djdd.exe 5flfxxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c0eca07d5a23a0c2008f24d505fcc50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1c0eca07d5a23a0c2008f24d505fcc50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\frlfxxr.exec:\frlfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\tbhbhh.exec:\tbhbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\thhbbt.exec:\thhbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\ddjpv.exec:\ddjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\xxxrlff.exec:\xxxrlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\nhhnbh.exec:\nhhnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\jjppj.exec:\jjppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\fxxrffx.exec:\fxxrffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\bbnhhn.exec:\bbnhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\vjpjp.exec:\vjpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\1rfxrrf.exec:\1rfxrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\tnnnhh.exec:\tnnnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\vpddv.exec:\vpddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\ntnnth.exec:\ntnnth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\3hhbtb.exec:\3hhbtb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\pvvpj.exec:\pvvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\3frxrlf.exec:\3frxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nbtnhb.exec:\nbtnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\9djdd.exec:\9djdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\5flfxxr.exec:\5flfxxr.exe23⤵
- Executes dropped EXE
PID:3780 -
\??\c:\lllxrlf.exec:\lllxrlf.exe24⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tbhbtt.exec:\tbhbtt.exe25⤵
- Executes dropped EXE
PID:1440 -
\??\c:\dddvv.exec:\dddvv.exe26⤵
- Executes dropped EXE
PID:60 -
\??\c:\rlrlxrl.exec:\rlrlxrl.exe27⤵
- Executes dropped EXE
PID:1128 -
\??\c:\thtnht.exec:\thtnht.exe28⤵
- Executes dropped EXE
PID:4320 -
\??\c:\vvvpj.exec:\vvvpj.exe29⤵
- Executes dropped EXE
PID:4120 -
\??\c:\frlfxrf.exec:\frlfxrf.exe30⤵
- Executes dropped EXE
PID:4284 -
\??\c:\tntnhh.exec:\tntnhh.exe31⤵
- Executes dropped EXE
PID:1320 -
\??\c:\3vvpp.exec:\3vvpp.exe32⤵
- Executes dropped EXE
PID:424 -
\??\c:\pvvjj.exec:\pvvjj.exe33⤵
- Executes dropped EXE
PID:4180 -
\??\c:\bnnhtt.exec:\bnnhtt.exe34⤵
- Executes dropped EXE
PID:4856 -
\??\c:\tbhtbn.exec:\tbhtbn.exe35⤵
- Executes dropped EXE
PID:4540 -
\??\c:\ddjdp.exec:\ddjdp.exe36⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dpvpj.exec:\dpvpj.exe37⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ffxxlrx.exec:\ffxxlrx.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nthnnh.exec:\nthnnh.exe39⤵
- Executes dropped EXE
PID:632 -
\??\c:\1hnnhb.exec:\1hnnhb.exe40⤵
- Executes dropped EXE
PID:1864 -
\??\c:\dppvd.exec:\dppvd.exe41⤵
- Executes dropped EXE
PID:4984 -
\??\c:\5rlflfx.exec:\5rlflfx.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nhhbtt.exec:\nhhbtt.exe43⤵
- Executes dropped EXE
PID:4424 -
\??\c:\hhhthb.exec:\hhhthb.exe44⤵
- Executes dropped EXE
PID:1692 -
\??\c:\5ddvv.exec:\5ddvv.exe45⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lffxrrl.exec:\lffxrrl.exe46⤵
- Executes dropped EXE
PID:1488 -
\??\c:\3bnbnh.exec:\3bnbnh.exe47⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hnnhhh.exec:\hnnhhh.exe48⤵
- Executes dropped EXE
PID:3864 -
\??\c:\dvjvd.exec:\dvjvd.exe49⤵
- Executes dropped EXE
PID:3748 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe50⤵
- Executes dropped EXE
PID:908 -
\??\c:\tthhbb.exec:\tthhbb.exe51⤵
- Executes dropped EXE
PID:648 -
\??\c:\nhbnbn.exec:\nhbnbn.exe52⤵
- Executes dropped EXE
PID:4132 -
\??\c:\jddvv.exec:\jddvv.exe53⤵
- Executes dropped EXE
PID:964 -
\??\c:\xflrrrl.exec:\xflrrrl.exe54⤵
- Executes dropped EXE
PID:956 -
\??\c:\rrlllll.exec:\rrlllll.exe55⤵
- Executes dropped EXE
PID:4504 -
\??\c:\ntttnn.exec:\ntttnn.exe56⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hntthb.exec:\hntthb.exe57⤵
- Executes dropped EXE
PID:4472 -
\??\c:\vjpjd.exec:\vjpjd.exe58⤵
- Executes dropped EXE
PID:2192 -
\??\c:\djddp.exec:\djddp.exe59⤵
- Executes dropped EXE
PID:3388 -
\??\c:\xlxrlll.exec:\xlxrlll.exe60⤵
- Executes dropped EXE
PID:1136 -
\??\c:\rfrlrlr.exec:\rfrlrlr.exe61⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tnthnh.exec:\tnthnh.exe62⤵
- Executes dropped EXE
PID:224 -
\??\c:\vvvvp.exec:\vvvvp.exe63⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jdvjd.exec:\jdvjd.exe64⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlfxfxf.exec:\rlfxfxf.exe65⤵
- Executes dropped EXE
PID:3640 -
\??\c:\hntnhb.exec:\hntnhb.exe66⤵PID:2096
-
\??\c:\vjjvv.exec:\vjjvv.exe67⤵PID:1856
-
\??\c:\jjdpd.exec:\jjdpd.exe68⤵PID:1840
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe69⤵PID:5080
-
\??\c:\tnhhhb.exec:\tnhhhb.exe70⤵PID:2600
-
\??\c:\3vddv.exec:\3vddv.exe71⤵PID:4308
-
\??\c:\jdvpp.exec:\jdvpp.exe72⤵PID:4364
-
\??\c:\flffxxr.exec:\flffxxr.exe73⤵PID:5064
-
\??\c:\fffffff.exec:\fffffff.exe74⤵PID:424
-
\??\c:\nbbbtt.exec:\nbbbtt.exe75⤵PID:1924
-
\??\c:\9ppjj.exec:\9ppjj.exe76⤵PID:1296
-
\??\c:\bnnhbh.exec:\bnnhbh.exe77⤵PID:800
-
\??\c:\dpjpd.exec:\dpjpd.exe78⤵PID:2316
-
\??\c:\dvdvp.exec:\dvdvp.exe79⤵PID:3208
-
\??\c:\flrrffx.exec:\flrrffx.exe80⤵PID:3248
-
\??\c:\ffxlfrf.exec:\ffxlfrf.exe81⤵PID:3232
-
\??\c:\nhbhnh.exec:\nhbhnh.exe82⤵PID:4108
-
\??\c:\nhttht.exec:\nhttht.exe83⤵PID:208
-
\??\c:\dvdjv.exec:\dvdjv.exe84⤵PID:528
-
\??\c:\djjjv.exec:\djjjv.exe85⤵PID:4956
-
\??\c:\lflfrrl.exec:\lflfrrl.exe86⤵PID:4944
-
\??\c:\3tbhbh.exec:\3tbhbh.exe87⤵PID:3940
-
\??\c:\jpddv.exec:\jpddv.exe88⤵PID:4332
-
\??\c:\7djjv.exec:\7djjv.exe89⤵PID:2284
-
\??\c:\frfxxxf.exec:\frfxxxf.exe90⤵PID:4288
-
\??\c:\5ttthh.exec:\5ttthh.exe91⤵PID:3268
-
\??\c:\tbhnhb.exec:\tbhnhb.exe92⤵PID:4068
-
\??\c:\jvdvp.exec:\jvdvp.exe93⤵PID:2380
-
\??\c:\7pjvp.exec:\7pjvp.exe94⤵PID:908
-
\??\c:\1rrlllf.exec:\1rrlllf.exe95⤵PID:2212
-
\??\c:\7hbhbt.exec:\7hbhbt.exe96⤵PID:3908
-
\??\c:\jdjdp.exec:\jdjdp.exe97⤵PID:2280
-
\??\c:\jvpdv.exec:\jvpdv.exe98⤵PID:1276
-
\??\c:\lrxrffr.exec:\lrxrffr.exe99⤵PID:2276
-
\??\c:\htnhbn.exec:\htnhbn.exe100⤵PID:4056
-
\??\c:\vvvpd.exec:\vvvpd.exe101⤵PID:1660
-
\??\c:\flxlxrx.exec:\flxlxrx.exe102⤵PID:2248
-
\??\c:\vvddv.exec:\vvddv.exe103⤵PID:3468
-
\??\c:\1ppjj.exec:\1ppjj.exe104⤵PID:1440
-
\??\c:\xflfxxx.exec:\xflfxxx.exe105⤵PID:2608
-
\??\c:\tnbbnt.exec:\tnbbnt.exe106⤵PID:1256
-
\??\c:\hnhhht.exec:\hnhhht.exe107⤵PID:692
-
\??\c:\vppjp.exec:\vppjp.exe108⤵PID:64
-
\??\c:\fxrlffx.exec:\fxrlffx.exe109⤵PID:1432
-
\??\c:\xxrlrxr.exec:\xxrlrxr.exe110⤵PID:5080
-
\??\c:\ttbbtt.exec:\ttbbtt.exe111⤵PID:2600
-
\??\c:\dpppp.exec:\dpppp.exe112⤵PID:4308
-
\??\c:\7ppjd.exec:\7ppjd.exe113⤵PID:1096
-
\??\c:\7rxxrrx.exec:\7rxxrrx.exe114⤵PID:4464
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe115⤵PID:5112
-
\??\c:\bthhnt.exec:\bthhnt.exe116⤵PID:1924
-
\??\c:\jjjdv.exec:\jjjdv.exe117⤵PID:1296
-
\??\c:\7djdd.exec:\7djdd.exe118⤵PID:4880
-
\??\c:\lllffll.exec:\lllffll.exe119⤵PID:4488
-
\??\c:\lrfllll.exec:\lrfllll.exe120⤵PID:1536
-
\??\c:\nhbbtt.exec:\nhbbtt.exe121⤵PID:2860
-
\??\c:\vpdvp.exec:\vpdvp.exe122⤵PID:3232
-
\??\c:\vdppv.exec:\vdppv.exe123⤵PID:4108
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe124⤵PID:3216
-
\??\c:\nthhhh.exec:\nthhhh.exe125⤵PID:1004
-
\??\c:\bnttnh.exec:\bnttnh.exe126⤵PID:2992
-
\??\c:\1pvpj.exec:\1pvpj.exe127⤵PID:1280
-
\??\c:\vdjdv.exec:\vdjdv.exe128⤵PID:2232
-
\??\c:\rffrfrl.exec:\rffrfrl.exe129⤵PID:1488
-
\??\c:\flllffx.exec:\flllffx.exe130⤵PID:4292
-
\??\c:\bhhbhb.exec:\bhhbhb.exe131⤵PID:2576
-
\??\c:\nhnhhb.exec:\nhnhhb.exe132⤵PID:3600
-
\??\c:\3jdjj.exec:\3jdjj.exe133⤵PID:4036
-
\??\c:\9lrlfrr.exec:\9lrlfrr.exe134⤵PID:4960
-
\??\c:\5xxrlfx.exec:\5xxrlfx.exe135⤵PID:3032
-
\??\c:\bbtnbb.exec:\bbtnbb.exe136⤵PID:3168
-
\??\c:\5bthtn.exec:\5bthtn.exe137⤵PID:2276
-
\??\c:\5dvvp.exec:\5dvvp.exe138⤵PID:2636
-
\??\c:\pvjdj.exec:\pvjdj.exe139⤵PID:2240
-
\??\c:\rxfllff.exec:\rxfllff.exe140⤵PID:3188
-
\??\c:\ntnhht.exec:\ntnhht.exe141⤵PID:540
-
\??\c:\1vjvp.exec:\1vjvp.exe142⤵PID:4648
-
\??\c:\rrlfxrf.exec:\rrlfxrf.exe143⤵PID:4724
-
\??\c:\ffffxxr.exec:\ffffxxr.exe144⤵PID:2360
-
\??\c:\hntnhh.exec:\hntnhh.exe145⤵PID:1432
-
\??\c:\vpjdv.exec:\vpjdv.exe146⤵PID:2568
-
\??\c:\jjjdp.exec:\jjjdp.exe147⤵PID:4364
-
\??\c:\9xlfffx.exec:\9xlfffx.exe148⤵PID:4628
-
\??\c:\tbhbtn.exec:\tbhbtn.exe149⤵PID:728
-
\??\c:\7bhhnn.exec:\7bhhnn.exe150⤵PID:4552
-
\??\c:\ddvvj.exec:\ddvvj.exe151⤵PID:4880
-
\??\c:\pjvpj.exec:\pjvpj.exe152⤵PID:4488
-
\??\c:\5frrllr.exec:\5frrllr.exe153⤵PID:3204
-
\??\c:\7jppd.exec:\7jppd.exe154⤵PID:2908
-
\??\c:\pddvp.exec:\pddvp.exe155⤵PID:1864
-
\??\c:\xfxfrrl.exec:\xfxfrrl.exe156⤵PID:888
-
\??\c:\3fxxrrl.exec:\3fxxrrl.exe157⤵PID:4704
-
\??\c:\nhnnnn.exec:\nhnnnn.exe158⤵PID:2824
-
\??\c:\vdjjv.exec:\vdjjv.exe159⤵PID:3692
-
\??\c:\pddvp.exec:\pddvp.exe160⤵PID:4288
-
\??\c:\frrrxrf.exec:\frrrxrf.exe161⤵PID:4292
-
\??\c:\5rxxrrl.exec:\5rxxrrl.exe162⤵PID:4188
-
\??\c:\5bnhhb.exec:\5bnhhb.exe163⤵PID:908
-
\??\c:\thnhbb.exec:\thnhbb.exe164⤵PID:5100
-
\??\c:\jjdvj.exec:\jjdvj.exe165⤵PID:4604
-
\??\c:\3lxrllx.exec:\3lxrllx.exe166⤵PID:3996
-
\??\c:\1rxxrrf.exec:\1rxxrrf.exe167⤵PID:3756
-
\??\c:\tnttnt.exec:\tnttnt.exe168⤵PID:3468
-
\??\c:\bttnbn.exec:\bttnbn.exe169⤵PID:3564
-
\??\c:\dpvpp.exec:\dpvpp.exe170⤵PID:2364
-
\??\c:\3vjdp.exec:\3vjdp.exe171⤵PID:3556
-
\??\c:\xrrllll.exec:\xrrllll.exe172⤵PID:1856
-
\??\c:\hbttht.exec:\hbttht.exe173⤵PID:1800
-
\??\c:\jvpvp.exec:\jvpvp.exe174⤵PID:2360
-
\??\c:\dpppd.exec:\dpppd.exe175⤵PID:1432
-
\??\c:\xlfxrxr.exec:\xlfxrxr.exe176⤵PID:2568
-
\??\c:\bnnhbb.exec:\bnnhbb.exe177⤵PID:4364
-
\??\c:\5pddd.exec:\5pddd.exe178⤵PID:3772
-
\??\c:\vpvpj.exec:\vpvpj.exe179⤵PID:728
-
\??\c:\xflffff.exec:\xflffff.exe180⤵PID:1484
-
\??\c:\tnhtbb.exec:\tnhtbb.exe181⤵PID:4880
-
\??\c:\bbnttt.exec:\bbnttt.exe182⤵PID:4488
-
\??\c:\pvjjv.exec:\pvjjv.exe183⤵PID:1448
-
\??\c:\xflfrff.exec:\xflfrff.exe184⤵PID:4904
-
\??\c:\tbhhhh.exec:\tbhhhh.exe185⤵PID:4572
-
\??\c:\1btntt.exec:\1btntt.exe186⤵PID:528
-
\??\c:\9dppj.exec:\9dppj.exe187⤵PID:888
-
\??\c:\flffxxl.exec:\flffxxl.exe188⤵PID:1280
-
\??\c:\thnnhn.exec:\thnnhn.exe189⤵PID:1496
-
\??\c:\djvvd.exec:\djvvd.exe190⤵PID:4332
-
\??\c:\jdjdv.exec:\jdjdv.exe191⤵PID:3864
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe192⤵PID:4456
-
\??\c:\ttbbhn.exec:\ttbbhn.exe193⤵PID:4684
-
\??\c:\thnnbb.exec:\thnnbb.exe194⤵PID:2440
-
\??\c:\xxxxxrr.exec:\xxxxxrr.exe195⤵PID:4472
-
\??\c:\bhthhh.exec:\bhthhh.exe196⤵PID:4828
-
\??\c:\pvdpd.exec:\pvdpd.exe197⤵PID:2276
-
\??\c:\flffrrr.exec:\flffrrr.exe198⤵PID:1000
-
\??\c:\nbnnhn.exec:\nbnnhn.exe199⤵PID:2332
-
\??\c:\pvdpj.exec:\pvdpj.exe200⤵PID:5048
-
\??\c:\lflxrrr.exec:\lflxrrr.exe201⤵PID:540
-
\??\c:\lflxrll.exec:\lflxrll.exe202⤵PID:3464
-
\??\c:\bnbttt.exec:\bnbttt.exe203⤵PID:3284
-
\??\c:\tbnhnn.exec:\tbnhnn.exe204⤵PID:3144
-
\??\c:\vpjpv.exec:\vpjpv.exe205⤵PID:4912
-
\??\c:\pvvjp.exec:\pvvjp.exe206⤵PID:1320
-
\??\c:\9nbthb.exec:\9nbthb.exe207⤵PID:2960
-
\??\c:\hhttnt.exec:\hhttnt.exe208⤵PID:4856
-
\??\c:\jdddv.exec:\jdddv.exe209⤵PID:972
-
\??\c:\9lrlxrf.exec:\9lrlxrf.exe210⤵PID:3248
-
\??\c:\bnttnt.exec:\bnttnt.exe211⤵PID:1552
-
\??\c:\3ttntb.exec:\3ttntb.exe212⤵PID:1472
-
\??\c:\jpddv.exec:\jpddv.exe213⤵PID:3884
-
\??\c:\1frfxll.exec:\1frfxll.exe214⤵PID:660
-
\??\c:\bntnnh.exec:\bntnnh.exe215⤵PID:736
-
\??\c:\djvpv.exec:\djvpv.exe216⤵PID:740
-
\??\c:\5fxrrxx.exec:\5fxrrxx.exe217⤵PID:3216
-
\??\c:\9tbtnn.exec:\9tbtnn.exe218⤵PID:4536
-
\??\c:\hntbtt.exec:\hntbtt.exe219⤵PID:2040
-
\??\c:\5ddvj.exec:\5ddvj.exe220⤵PID:4332
-
\??\c:\fffxllr.exec:\fffxllr.exe221⤵PID:3244
-
\??\c:\7thbhn.exec:\7thbhn.exe222⤵PID:2424
-
\??\c:\tnbbtb.exec:\tnbbtb.exe223⤵PID:4684
-
\??\c:\vpvvp.exec:\vpvvp.exe224⤵PID:3168
-
\??\c:\lrxxllf.exec:\lrxxllf.exe225⤵PID:2248
-
\??\c:\nnhbhh.exec:\nnhbhh.exe226⤵PID:2636
-
\??\c:\tnnhbb.exec:\tnnhbb.exe227⤵PID:2136
-
\??\c:\3vpjv.exec:\3vpjv.exe228⤵PID:3188
-
\??\c:\pvvpp.exec:\pvvpp.exe229⤵PID:2332
-
\??\c:\1rlrrlx.exec:\1rlrrlx.exe230⤵PID:1512
-
\??\c:\hbtnbt.exec:\hbtnbt.exe231⤵PID:2364
-
\??\c:\ppvdd.exec:\ppvdd.exe232⤵PID:3556
-
\??\c:\llrlffr.exec:\llrlffr.exe233⤵PID:3284
-
\??\c:\xfrlrfl.exec:\xfrlrfl.exe234⤵PID:4404
-
\??\c:\bhnhhh.exec:\bhnhhh.exe235⤵PID:4912
-
\??\c:\nhtttb.exec:\nhtttb.exe236⤵PID:4624
-
\??\c:\vdjdv.exec:\vdjdv.exe237⤵PID:2696
-
\??\c:\5jppj.exec:\5jppj.exe238⤵PID:2292
-
\??\c:\fllfxxx.exec:\fllfxxx.exe239⤵PID:728
-
\??\c:\tnnhtn.exec:\tnnhtn.exe240⤵PID:4552
-
\??\c:\bbbttt.exec:\bbbttt.exe241⤵PID:1552
-
\??\c:\vpjjd.exec:\vpjjd.exe242⤵PID:1472