Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 17:58
Behavioral task
behavioral1
Sample
0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe
-
Size
401KB
-
MD5
0d66425ee0b32c8d7016d2d8d1f6e8e0
-
SHA1
025569f002dd9c8f198a51754cb4a57900b3bf52
-
SHA256
bf445d3408c8881faa710c0e436f9484c5b217b4b65ead5415e4f6dcdb008651
-
SHA512
935eaeae21ec4097813f91db18519faf3adfbed9fa17cff56f91887ce98717ccbb47c68b065d62e21cbcedf4e36c1ed045d7f774ef16deca8379f21068d07662
-
SSDEEP
6144:Jcm4FmowdHoSEubDcAkOCOu0EajNVBZr6y2WXxLO1UqW9E33:T4wFHoSEubD2P33
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4808-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2196-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3360-24-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3560-35-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3460-42-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4236-221-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4424-280-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2924-287-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/588-278-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2120-267-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4296-260-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5088-228-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2288-217-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2800-213-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3548-206-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2760-202-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1216-186-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4920-175-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/552-169-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4520-157-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4640-148-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2616-145-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1528-136-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4916-124-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4220-114-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3664-111-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3304-101-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2652-99-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2612-89-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3424-83-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/60-77-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3800-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2784-64-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2924-54-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3292-30-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4444-9-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4020-307-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2068-318-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3436-328-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1168-350-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3708-361-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1576-379-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2028-389-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3844-391-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1120-397-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1112-432-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3536-455-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3424-459-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3272-468-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3420-482-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2356-498-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2980-515-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4680-581-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1492-585-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1716-623-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2536-627-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4220-634-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1052-736-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2136-743-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/856-747-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1240-770-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4348-849-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3664-895-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4664-902-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvpjp.exerlffxlf.exerrfxrrx.exettttnn.exedvjpj.exerllflrf.exelffxffl.exehnbbbh.exexlxxxxr.exexflfxxr.exehbbbtt.exehntnhb.exevpdvv.exerffxffr.exerxfxfxr.exe3nnnbh.exe3vdvp.exe1pppp.exerrrllfx.exelrlfllr.exebttnnn.exejdjjj.exevjpjp.exexflffll.exenntnhb.exetbnbhn.exeddppj.exepdpjd.exerxrrllf.exe5bnhnt.exettthbb.exejvvvp.exe5xllfff.exerrrlxfx.exebbnntt.exejddvv.exejjjjd.exerrfxrrl.exennhhnn.exehbnhbb.exepjppj.exexxxrrrl.exerflrlll.exe3hnhbb.exehbtnnn.exevpdvp.exefffxrrr.exe1hnhtt.exenthhtt.exeppvpj.exeddddd.exexlxxrrl.exetbbhhn.exenhbbnn.exejdjjj.exepdpjd.exefrlfrrr.exetnbbbt.exebbbtbb.exe5pvpp.exedvjdp.exerrxxrfx.exe1ntnbb.exehhnhnh.exepid process 4444 dvpjp.exe 3828 rlffxlf.exe 2196 rrfxrrx.exe 3360 ttttnn.exe 3292 dvjpj.exe 3560 rllflrf.exe 3460 lffxffl.exe 2924 hnbbbh.exe 2784 xlxxxxr.exe 3800 xflfxxr.exe 3960 hbbbtt.exe 60 hntnhb.exe 3424 vpdvv.exe 2612 rffxffr.exe 2652 rxfxfxr.exe 3304 3nnnbh.exe 3664 3vdvp.exe 4220 1pppp.exe 2756 rrrllfx.exe 4916 lrlfllr.exe 2068 bttnnn.exe 1528 jdjjj.exe 2616 vjpjp.exe 4640 xflffll.exe 4520 nntnhb.exe 4256 tbnbhn.exe 116 ddppj.exe 552 pdpjd.exe 4920 rxrrllf.exe 3508 5bnhnt.exe 1216 ttthbb.exe 3956 jvvvp.exe 4992 5xllfff.exe 744 rrrlxfx.exe 4720 bbnntt.exe 2760 jddvv.exe 3548 jjjjd.exe 3112 rrfxrrl.exe 2800 nnhhnn.exe 2288 hbnhbb.exe 4236 pjppj.exe 4668 xxxrrrl.exe 5088 rflrlll.exe 1196 3hnhbb.exe 2372 hbtnnn.exe 3016 vpdvp.exe 4556 fffxrrr.exe 3060 1hnhtt.exe 4332 nthhtt.exe 3208 ppvpj.exe 4268 ddddd.exe 2440 xlxxrrl.exe 4296 tbbhhn.exe 632 nhbbnn.exe 2120 jdjjj.exe 3360 pdpjd.exe 3780 frlfrrr.exe 588 tnbbbt.exe 4424 bbbtbb.exe 2924 5pvpp.exe 1736 dvjdp.exe 2128 rrxxrfx.exe 3256 1ntnbb.exe 4004 hhnhnh.exe -
Processes:
resource yara_rule behavioral2/memory/4808-0-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\dvpjp.exe upx behavioral2/memory/4808-7-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\rlffxlf.exe upx C:\rrfxrrx.exe upx behavioral2/memory/2196-18-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\ttttnn.exe upx behavioral2/memory/3360-24-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\dvjpj.exe upx C:\rllflrf.exe upx behavioral2/memory/3560-35-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\lffxffl.exe upx behavioral2/memory/3460-42-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\hnbbbh.exe upx \??\c:\xlxxxxr.exe upx \??\c:\xflfxxr.exe upx \??\c:\hbbbtt.exe upx \??\c:\hntnhb.exe upx \??\c:\vpdvv.exe upx \??\c:\rffxffr.exe upx \??\c:\rxfxfxr.exe upx \??\c:\1pppp.exe upx \??\c:\lrlfllr.exe upx \??\c:\jdjjj.exe upx \??\c:\xflffll.exe upx \??\c:\rxrrllf.exe upx \??\c:\jvvvp.exe upx behavioral2/memory/4236-221-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4424-280-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2924-287-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/588-278-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5000-295-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2120-267-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4296-260-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5088-228-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2288-217-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2800-213-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3548-206-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2760-202-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1216-186-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\ttthbb.exe upx behavioral2/memory/4920-175-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\5bnhnt.exe upx behavioral2/memory/552-169-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\pdpjd.exe upx behavioral2/memory/4520-157-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\ddppj.exe upx \??\c:\tbnbhn.exe upx behavioral2/memory/4640-148-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2616-145-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\nntnhb.exe upx behavioral2/memory/1528-136-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\vjpjp.exe upx behavioral2/memory/4916-124-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\bttnnn.exe upx behavioral2/memory/4220-114-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3664-111-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\rrrllfx.exe upx behavioral2/memory/3304-101-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2652-99-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\3vdvp.exe upx \??\c:\3nnnbh.exe upx behavioral2/memory/2612-89-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3424-83-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exedvpjp.exerlffxlf.exerrfxrrx.exettttnn.exedvjpj.exerllflrf.exelffxffl.exehnbbbh.exexlxxxxr.exexflfxxr.exehbbbtt.exehntnhb.exevpdvv.exerffxffr.exerxfxfxr.exe3nnnbh.exe3vdvp.exe1pppp.exerrrllfx.exelrlfllr.exebttnnn.exedescription pid process target process PID 4808 wrote to memory of 4444 4808 0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe dvpjp.exe PID 4808 wrote to memory of 4444 4808 0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe dvpjp.exe PID 4808 wrote to memory of 4444 4808 0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe dvpjp.exe PID 4444 wrote to memory of 3828 4444 dvpjp.exe rlffxlf.exe PID 4444 wrote to memory of 3828 4444 dvpjp.exe rlffxlf.exe PID 4444 wrote to memory of 3828 4444 dvpjp.exe rlffxlf.exe PID 3828 wrote to memory of 2196 3828 rlffxlf.exe rrfxrrx.exe PID 3828 wrote to memory of 2196 3828 rlffxlf.exe rrfxrrx.exe PID 3828 wrote to memory of 2196 3828 rlffxlf.exe rrfxrrx.exe PID 2196 wrote to memory of 3360 2196 rrfxrrx.exe pdpjd.exe PID 2196 wrote to memory of 3360 2196 rrfxrrx.exe pdpjd.exe PID 2196 wrote to memory of 3360 2196 rrfxrrx.exe pdpjd.exe PID 3360 wrote to memory of 3292 3360 ttttnn.exe dvjpj.exe PID 3360 wrote to memory of 3292 3360 ttttnn.exe dvjpj.exe PID 3360 wrote to memory of 3292 3360 ttttnn.exe dvjpj.exe PID 3292 wrote to memory of 3560 3292 dvjpj.exe rllflrf.exe PID 3292 wrote to memory of 3560 3292 dvjpj.exe rllflrf.exe PID 3292 wrote to memory of 3560 3292 dvjpj.exe rllflrf.exe PID 3560 wrote to memory of 3460 3560 rllflrf.exe lffxffl.exe PID 3560 wrote to memory of 3460 3560 rllflrf.exe lffxffl.exe PID 3560 wrote to memory of 3460 3560 rllflrf.exe lffxffl.exe PID 3460 wrote to memory of 2924 3460 lffxffl.exe 5pvpp.exe PID 3460 wrote to memory of 2924 3460 lffxffl.exe 5pvpp.exe PID 3460 wrote to memory of 2924 3460 lffxffl.exe 5pvpp.exe PID 2924 wrote to memory of 2784 2924 hnbbbh.exe xlxxxxr.exe PID 2924 wrote to memory of 2784 2924 hnbbbh.exe xlxxxxr.exe PID 2924 wrote to memory of 2784 2924 hnbbbh.exe xlxxxxr.exe PID 2784 wrote to memory of 3800 2784 xlxxxxr.exe xflfxxr.exe PID 2784 wrote to memory of 3800 2784 xlxxxxr.exe xflfxxr.exe PID 2784 wrote to memory of 3800 2784 xlxxxxr.exe xflfxxr.exe PID 3800 wrote to memory of 3960 3800 xflfxxr.exe hbbbtt.exe PID 3800 wrote to memory of 3960 3800 xflfxxr.exe hbbbtt.exe PID 3800 wrote to memory of 3960 3800 xflfxxr.exe hbbbtt.exe PID 3960 wrote to memory of 60 3960 hbbbtt.exe hntnhb.exe PID 3960 wrote to memory of 60 3960 hbbbtt.exe hntnhb.exe PID 3960 wrote to memory of 60 3960 hbbbtt.exe hntnhb.exe PID 60 wrote to memory of 3424 60 hntnhb.exe vpdvv.exe PID 60 wrote to memory of 3424 60 hntnhb.exe vpdvv.exe PID 60 wrote to memory of 3424 60 hntnhb.exe vpdvv.exe PID 3424 wrote to memory of 2612 3424 vpdvv.exe rffxffr.exe PID 3424 wrote to memory of 2612 3424 vpdvv.exe rffxffr.exe PID 3424 wrote to memory of 2612 3424 vpdvv.exe rffxffr.exe PID 2612 wrote to memory of 2652 2612 rffxffr.exe rxfxfxr.exe PID 2612 wrote to memory of 2652 2612 rffxffr.exe rxfxfxr.exe PID 2612 wrote to memory of 2652 2612 rffxffr.exe rxfxfxr.exe PID 2652 wrote to memory of 3304 2652 rxfxfxr.exe 3nnnbh.exe PID 2652 wrote to memory of 3304 2652 rxfxfxr.exe 3nnnbh.exe PID 2652 wrote to memory of 3304 2652 rxfxfxr.exe 3nnnbh.exe PID 3304 wrote to memory of 3664 3304 3nnnbh.exe 3vdvp.exe PID 3304 wrote to memory of 3664 3304 3nnnbh.exe 3vdvp.exe PID 3304 wrote to memory of 3664 3304 3nnnbh.exe 3vdvp.exe PID 3664 wrote to memory of 4220 3664 3vdvp.exe 1pppp.exe PID 3664 wrote to memory of 4220 3664 3vdvp.exe 1pppp.exe PID 3664 wrote to memory of 4220 3664 3vdvp.exe 1pppp.exe PID 4220 wrote to memory of 2756 4220 1pppp.exe rrrllfx.exe PID 4220 wrote to memory of 2756 4220 1pppp.exe rrrllfx.exe PID 4220 wrote to memory of 2756 4220 1pppp.exe rrrllfx.exe PID 2756 wrote to memory of 4916 2756 rrrllfx.exe 1btnnb.exe PID 2756 wrote to memory of 4916 2756 rrrllfx.exe 1btnnb.exe PID 2756 wrote to memory of 4916 2756 rrrllfx.exe 1btnnb.exe PID 4916 wrote to memory of 2068 4916 lrlfllr.exe pjvpd.exe PID 4916 wrote to memory of 2068 4916 lrlfllr.exe pjvpd.exe PID 4916 wrote to memory of 2068 4916 lrlfllr.exe pjvpd.exe PID 2068 wrote to memory of 1528 2068 bttnnn.exe jdjjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0d66425ee0b32c8d7016d2d8d1f6e8e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\dvpjp.exec:\dvpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\rlffxlf.exec:\rlffxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\rrfxrrx.exec:\rrfxrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ttttnn.exec:\ttttnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\dvjpj.exec:\dvjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\rllflrf.exec:\rllflrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\lffxffl.exec:\lffxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\hnbbbh.exec:\hnbbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\xlxxxxr.exec:\xlxxxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\xflfxxr.exec:\xflfxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\hbbbtt.exec:\hbbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\hntnhb.exec:\hntnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\vpdvv.exec:\vpdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\rffxffr.exec:\rffxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\rxfxfxr.exec:\rxfxfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\3nnnbh.exec:\3nnnbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\3vdvp.exec:\3vdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\1pppp.exec:\1pppp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\rrrllfx.exec:\rrrllfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\lrlfllr.exec:\lrlfllr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\bttnnn.exec:\bttnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\jdjjj.exec:\jdjjj.exe23⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vjpjp.exec:\vjpjp.exe24⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xflffll.exec:\xflffll.exe25⤵
- Executes dropped EXE
PID:4640 -
\??\c:\nntnhb.exec:\nntnhb.exe26⤵
- Executes dropped EXE
PID:4520 -
\??\c:\tbnbhn.exec:\tbnbhn.exe27⤵
- Executes dropped EXE
PID:4256 -
\??\c:\ddppj.exec:\ddppj.exe28⤵
- Executes dropped EXE
PID:116 -
\??\c:\pdpjd.exec:\pdpjd.exe29⤵
- Executes dropped EXE
PID:552 -
\??\c:\rxrrllf.exec:\rxrrllf.exe30⤵
- Executes dropped EXE
PID:4920 -
\??\c:\5bnhnt.exec:\5bnhnt.exe31⤵
- Executes dropped EXE
PID:3508 -
\??\c:\ttthbb.exec:\ttthbb.exe32⤵
- Executes dropped EXE
PID:1216 -
\??\c:\jvvvp.exec:\jvvvp.exe33⤵
- Executes dropped EXE
PID:3956 -
\??\c:\5xllfff.exec:\5xllfff.exe34⤵
- Executes dropped EXE
PID:4992 -
\??\c:\rrrlxfx.exec:\rrrlxfx.exe35⤵
- Executes dropped EXE
PID:744 -
\??\c:\bbnntt.exec:\bbnntt.exe36⤵
- Executes dropped EXE
PID:4720 -
\??\c:\jddvv.exec:\jddvv.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jjjjd.exec:\jjjjd.exe38⤵
- Executes dropped EXE
PID:3548 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe39⤵
- Executes dropped EXE
PID:3112 -
\??\c:\nnhhnn.exec:\nnhhnn.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hbnhbb.exec:\hbnhbb.exe41⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pjppj.exec:\pjppj.exe42⤵
- Executes dropped EXE
PID:4236 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe43⤵
- Executes dropped EXE
PID:4668 -
\??\c:\rflrlll.exec:\rflrlll.exe44⤵
- Executes dropped EXE
PID:5088 -
\??\c:\3hnhbb.exec:\3hnhbb.exe45⤵
- Executes dropped EXE
PID:1196 -
\??\c:\hbtnnn.exec:\hbtnnn.exe46⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vpdvp.exec:\vpdvp.exe47⤵
- Executes dropped EXE
PID:3016 -
\??\c:\fffxrrr.exec:\fffxrrr.exe48⤵
- Executes dropped EXE
PID:4556 -
\??\c:\1hnhtt.exec:\1hnhtt.exe49⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nthhtt.exec:\nthhtt.exe50⤵
- Executes dropped EXE
PID:4332 -
\??\c:\ppvpj.exec:\ppvpj.exe51⤵
- Executes dropped EXE
PID:3208 -
\??\c:\ddddd.exec:\ddddd.exe52⤵
- Executes dropped EXE
PID:4268 -
\??\c:\xlxxrrl.exec:\xlxxrrl.exe53⤵
- Executes dropped EXE
PID:2440 -
\??\c:\tbbhhn.exec:\tbbhhn.exe54⤵
- Executes dropped EXE
PID:4296 -
\??\c:\nhbbnn.exec:\nhbbnn.exe55⤵
- Executes dropped EXE
PID:632 -
\??\c:\jdjjj.exec:\jdjjj.exe56⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pdpjd.exec:\pdpjd.exe57⤵
- Executes dropped EXE
PID:3360 -
\??\c:\frlfrrr.exec:\frlfrrr.exe58⤵
- Executes dropped EXE
PID:3780 -
\??\c:\tnbbbt.exec:\tnbbbt.exe59⤵
- Executes dropped EXE
PID:588 -
\??\c:\bbbtbb.exec:\bbbtbb.exe60⤵
- Executes dropped EXE
PID:4424 -
\??\c:\5pvpp.exec:\5pvpp.exe61⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dvjdp.exec:\dvjdp.exe62⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rrxxrfx.exec:\rrxxrfx.exe63⤵
- Executes dropped EXE
PID:2128 -
\??\c:\1ntnbb.exec:\1ntnbb.exe64⤵
- Executes dropped EXE
PID:3256 -
\??\c:\hhnhnh.exec:\hhnhnh.exe65⤵
- Executes dropped EXE
PID:4004 -
\??\c:\djpjj.exec:\djpjj.exe66⤵PID:5000
-
\??\c:\rlxxffl.exec:\rlxxffl.exe67⤵PID:752
-
\??\c:\bbhntt.exec:\bbhntt.exe68⤵PID:3140
-
\??\c:\pvddv.exec:\pvddv.exe69⤵PID:4020
-
\??\c:\xrllxxr.exec:\xrllxxr.exe70⤵PID:2260
-
\??\c:\1btnnb.exec:\1btnnb.exe71⤵PID:4916
-
\??\c:\pjvpd.exec:\pjvpd.exe72⤵PID:2068
-
\??\c:\vpddv.exec:\vpddv.exe73⤵PID:4356
-
\??\c:\rrxrrxx.exec:\rrxrrxx.exe74⤵PID:2356
-
\??\c:\nnttnb.exec:\nnttnb.exe75⤵PID:3436
-
\??\c:\5hhhbt.exec:\5hhhbt.exe76⤵PID:2328
-
\??\c:\vvjdv.exec:\vvjdv.exe77⤵PID:4256
-
\??\c:\lfrrfrl.exec:\lfrrfrl.exe78⤵PID:3684
-
\??\c:\rflxrrr.exec:\rflxrrr.exe79⤵PID:4984
-
\??\c:\nhtntt.exec:\nhtntt.exe80⤵PID:3640
-
\??\c:\pjvvp.exec:\pjvvp.exe81⤵PID:1168
-
\??\c:\ddpjj.exec:\ddpjj.exe82⤵PID:3756
-
\??\c:\vjppj.exec:\vjppj.exe83⤵PID:4924
-
\??\c:\pjvpp.exec:\pjvpp.exe84⤵PID:744
-
\??\c:\xfrlfxx.exec:\xfrlfxx.exe85⤵PID:3708
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe86⤵PID:4080
-
\??\c:\vppjd.exec:\vppjd.exe87⤵PID:3416
-
\??\c:\vppdv.exec:\vppdv.exe88⤵PID:2932
-
\??\c:\frxrxrr.exec:\frxrxrr.exe89⤵PID:2888
-
\??\c:\bbnnhh.exec:\bbnnhh.exe90⤵PID:1576
-
\??\c:\jpjdj.exec:\jpjdj.exe91⤵PID:768
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe92⤵PID:4876
-
\??\c:\xxlfxfx.exec:\xxlfxfx.exe93⤵PID:2028
-
\??\c:\nthhbb.exec:\nthhbb.exe94⤵PID:3844
-
\??\c:\thnhbb.exec:\thnhbb.exe95⤵PID:1120
-
\??\c:\jvjjd.exec:\jvjjd.exe96⤵PID:2956
-
\??\c:\5frlffx.exec:\5frlffx.exe97⤵PID:4940
-
\??\c:\1flxxxr.exec:\1flxxxr.exe98⤵PID:3264
-
\??\c:\tthhtt.exec:\tthhtt.exe99⤵PID:4268
-
\??\c:\djpvv.exec:\djpvv.exe100⤵PID:2440
-
\??\c:\rfxlxlx.exec:\rfxlxlx.exe101⤵PID:4656
-
\??\c:\hbtthh.exec:\hbtthh.exe102⤵PID:2116
-
\??\c:\vjvvd.exec:\vjvvd.exe103⤵PID:4136
-
\??\c:\pjdvj.exec:\pjdvj.exe104⤵PID:4228
-
\??\c:\fflfxlf.exec:\fflfxlf.exe105⤵PID:4620
-
\??\c:\htbbtn.exec:\htbbtn.exe106⤵PID:3592
-
\??\c:\jdjdv.exec:\jdjdv.exe107⤵PID:1112
-
\??\c:\dvjdv.exec:\dvjdv.exe108⤵PID:2324
-
\??\c:\1rflfll.exec:\1rflfll.exe109⤵PID:3772
-
\??\c:\hhntnn.exec:\hhntnn.exe110⤵PID:1500
-
\??\c:\nhhhtt.exec:\nhhhtt.exe111⤵PID:1736
-
\??\c:\vdpjd.exec:\vdpjd.exe112⤵PID:2784
-
\??\c:\jdjdj.exec:\jdjdj.exe113⤵PID:1988
-
\??\c:\rrrlffx.exec:\rrrlffx.exe114⤵PID:892
-
\??\c:\ffrlfff.exec:\ffrlfff.exe115⤵PID:3536
-
\??\c:\tbtbtt.exec:\tbtbtt.exe116⤵PID:3424
-
\??\c:\vvdvj.exec:\vvdvj.exe117⤵PID:560
-
\??\c:\1pddp.exec:\1pddp.exe118⤵PID:3272
-
\??\c:\lflfllf.exec:\lflfllf.exe119⤵PID:4360
-
\??\c:\btthth.exec:\btthth.exe120⤵PID:2244
-
\??\c:\pdjjj.exec:\pdjjj.exe121⤵PID:3140
-
\??\c:\vpdvp.exec:\vpdvp.exe122⤵PID:2756
-
\??\c:\lrrrffx.exec:\lrrrffx.exe123⤵PID:3420
-
\??\c:\btthbb.exec:\btthbb.exe124⤵PID:3704
-
\??\c:\1vddv.exec:\1vddv.exe125⤵PID:2068
-
\??\c:\rxllffl.exec:\rxllffl.exe126⤵PID:4356
-
\??\c:\rxlxxxr.exec:\rxlxxxr.exe127⤵PID:2356
-
\??\c:\bbhhbb.exec:\bbhhbb.exe128⤵PID:5056
-
\??\c:\djpjv.exec:\djpjv.exe129⤵PID:2328
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe130⤵PID:552
-
\??\c:\rrrrlll.exec:\rrrrlll.exe131⤵PID:452
-
\??\c:\hhbnbh.exec:\hhbnbh.exe132⤵PID:4880
-
\??\c:\pdjpj.exec:\pdjpj.exe133⤵PID:2980
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe134⤵PID:2572
-
\??\c:\hnbbtn.exec:\hnbbtn.exe135⤵PID:4716
-
\??\c:\hbtnnn.exec:\hbtnnn.exe136⤵PID:4720
-
\??\c:\3ppjv.exec:\3ppjv.exe137⤵PID:4904
-
\??\c:\lrlxxrl.exec:\lrlxxrl.exe138⤵PID:5012
-
\??\c:\btbbtb.exec:\btbbtb.exe139⤵PID:2352
-
\??\c:\bntttt.exec:\bntttt.exe140⤵PID:1648
-
\??\c:\dvjjj.exec:\dvjjj.exe141⤵PID:664
-
\??\c:\rlrlffl.exec:\rlrlffl.exe142⤵PID:4072
-
\??\c:\7htttt.exec:\7htttt.exe143⤵PID:2252
-
\??\c:\dvdvj.exec:\dvdvj.exe144⤵PID:4064
-
\??\c:\9jjdd.exec:\9jjdd.exe145⤵PID:4972
-
\??\c:\9fllrrx.exec:\9fllrrx.exe146⤵PID:3504
-
\??\c:\tbtttb.exec:\tbtttb.exe147⤵PID:4888
-
\??\c:\tnhhbb.exec:\tnhhbb.exe148⤵PID:3060
-
\??\c:\9vjvv.exec:\9vjvv.exe149⤵PID:1616
-
\??\c:\ffrlllr.exec:\ffrlllr.exe150⤵PID:2096
-
\??\c:\7flfxxx.exec:\7flfxxx.exe151⤵PID:2732
-
\??\c:\thbthh.exec:\thbthh.exe152⤵PID:2424
-
\??\c:\ppddj.exec:\ppddj.exe153⤵PID:4252
-
\??\c:\xlxrlll.exec:\xlxrlll.exe154⤵PID:4680
-
\??\c:\fflllff.exec:\fflllff.exe155⤵PID:1492
-
\??\c:\vddvp.exec:\vddvp.exe156⤵PID:2116
-
\??\c:\dddvp.exec:\dddvp.exe157⤵PID:3560
-
\??\c:\7rfrffx.exec:\7rfrffx.exe158⤵PID:4884
-
\??\c:\nbnbtt.exec:\nbnbtt.exe159⤵PID:4620
-
\??\c:\nhtnhh.exec:\nhtnhh.exe160⤵PID:3292
-
\??\c:\pdddv.exec:\pdddv.exe161⤵PID:3364
-
\??\c:\3fllfxx.exec:\3fllfxx.exe162⤵PID:1444
-
\??\c:\nhnttt.exec:\nhnttt.exe163⤵PID:2132
-
\??\c:\ddjjd.exec:\ddjjd.exe164⤵PID:3688
-
\??\c:\jvdjv.exec:\jvdjv.exe165⤵PID:3628
-
\??\c:\ffrlrfr.exec:\ffrlrfr.exe166⤵PID:3496
-
\??\c:\bntnnb.exec:\bntnnb.exe167⤵PID:1716
-
\??\c:\vjjdp.exec:\vjjdp.exe168⤵PID:2536
-
\??\c:\jvvvd.exec:\jvvvd.exe169⤵PID:3032
-
\??\c:\9flxrlx.exec:\9flxrlx.exe170⤵PID:4220
-
\??\c:\nbntnt.exec:\nbntnt.exe171⤵PID:2260
-
\??\c:\nbhhhh.exec:\nbhhhh.exe172⤵PID:2868
-
\??\c:\jpvdv.exec:\jpvdv.exe173⤵PID:2152
-
\??\c:\xrfflfl.exec:\xrfflfl.exe174⤵PID:3764
-
\??\c:\btbttb.exec:\btbttb.exe175⤵PID:2356
-
\??\c:\nnbttt.exec:\nnbttt.exe176⤵PID:4160
-
\??\c:\dpvpd.exec:\dpvpd.exe177⤵PID:552
-
\??\c:\7rxrxxr.exec:\7rxrxxr.exe178⤵PID:392
-
\??\c:\tbtnth.exec:\tbtnth.exe179⤵PID:4880
-
\??\c:\vdpjj.exec:\vdpjj.exe180⤵PID:3756
-
\??\c:\xxrrlxr.exec:\xxrrlxr.exe181⤵PID:2336
-
\??\c:\3bnhbb.exec:\3bnhbb.exe182⤵PID:928
-
\??\c:\jjvvd.exec:\jjvvd.exe183⤵PID:3548
-
\??\c:\9rxrlrr.exec:\9rxrlrr.exe184⤵PID:3112
-
\??\c:\lrxxrxr.exec:\lrxxrxr.exe185⤵PID:5028
-
\??\c:\bthbhn.exec:\bthbhn.exe186⤵PID:2932
-
\??\c:\7ddvp.exec:\7ddvp.exe187⤵PID:2888
-
\??\c:\thnntt.exec:\thnntt.exe188⤵PID:384
-
\??\c:\tnbbhb.exec:\tnbbhb.exe189⤵PID:1196
-
\??\c:\1pvpd.exec:\1pvpd.exe190⤵PID:2252
-
\??\c:\3xxrffx.exec:\3xxrffx.exe191⤵PID:4064
-
\??\c:\nntnnn.exec:\nntnnn.exe192⤵PID:4972
-
\??\c:\jjjvp.exec:\jjjvp.exe193⤵PID:3824
-
\??\c:\vvvpp.exec:\vvvpp.exe194⤵PID:1628
-
\??\c:\nbhbtn.exec:\nbhbtn.exe195⤵PID:3788
-
\??\c:\jjpjv.exec:\jjpjv.exe196⤵PID:3264
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe197⤵PID:1600
-
\??\c:\hbhhbb.exec:\hbhhbb.exe198⤵PID:3080
-
\??\c:\jjjpj.exec:\jjjpj.exe199⤵PID:2580
-
\??\c:\9xxrrrx.exec:\9xxrrrx.exe200⤵PID:2948
-
\??\c:\flrrlll.exec:\flrrlll.exe201⤵PID:2120
-
\??\c:\hbhbtt.exec:\hbhbtt.exe202⤵PID:1492
-
\??\c:\vpvdv.exec:\vpvdv.exe203⤵PID:1052
-
\??\c:\flrxrrl.exec:\flrxrrl.exe204⤵PID:588
-
\??\c:\lfxxxxf.exec:\lfxxxxf.exe205⤵PID:2136
-
\??\c:\bnbnnn.exec:\bnbnnn.exe206⤵PID:4476
-
\??\c:\pjpjd.exec:\pjpjd.exe207⤵PID:856
-
\??\c:\pjpjd.exec:\pjpjd.exe208⤵PID:1564
-
\??\c:\xrxfrrr.exec:\xrxfrrr.exe209⤵PID:3196
-
\??\c:\xlxrlll.exec:\xlxrlll.exe210⤵PID:3256
-
\??\c:\bbbbtt.exec:\bbbbtt.exe211⤵PID:3424
-
\??\c:\nbhbtt.exec:\nbhbtt.exe212⤵PID:4004
-
\??\c:\ppdjd.exec:\ppdjd.exe213⤵PID:2532
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe214⤵PID:1240
-
\??\c:\xrxxrll.exec:\xrxxrll.exe215⤵PID:1344
-
\??\c:\nhbttt.exec:\nhbttt.exe216⤵PID:3632
-
\??\c:\vpjdp.exec:\vpjdp.exe217⤵PID:4524
-
\??\c:\pdjvv.exec:\pdjvv.exe218⤵PID:2152
-
\??\c:\lllfxxx.exec:\lllfxxx.exe219⤵PID:4816
-
\??\c:\tnbbhb.exec:\tnbbhb.exe220⤵PID:4256
-
\??\c:\nhhbtn.exec:\nhhbtn.exe221⤵PID:2332
-
\??\c:\vvjdp.exec:\vvjdp.exe222⤵PID:552
-
\??\c:\dvdvp.exec:\dvdvp.exe223⤵PID:392
-
\??\c:\7xffffl.exec:\7xffffl.exe224⤵PID:1788
-
\??\c:\hbttnn.exec:\hbttnn.exe225⤵PID:4804
-
\??\c:\3bnhbb.exec:\3bnhbb.exe226⤵PID:2336
-
\??\c:\vvvdp.exec:\vvvdp.exe227⤵PID:3908
-
\??\c:\lllfrlf.exec:\lllfrlf.exe228⤵PID:3112
-
\??\c:\lxxrfxr.exec:\lxxrfxr.exe229⤵PID:1836
-
\??\c:\tnhbhh.exec:\tnhbhh.exe230⤵PID:1920
-
\??\c:\vdvpj.exec:\vdvpj.exe231⤵PID:1576
-
\??\c:\frlffff.exec:\frlffff.exe232⤵PID:648
-
\??\c:\nhtnhb.exec:\nhtnhb.exe233⤵PID:1196
-
\??\c:\thnbtt.exec:\thnbtt.exe234⤵PID:908
-
\??\c:\jdjdp.exec:\jdjdp.exe235⤵PID:4064
-
\??\c:\xfxrlll.exec:\xfxrlll.exe236⤵PID:4888
-
\??\c:\hhnhbb.exec:\hhnhbb.exe237⤵PID:3060
-
\??\c:\5thbbb.exec:\5thbbb.exe238⤵PID:3208
-
\??\c:\7jjdp.exec:\7jjdp.exe239⤵PID:4116
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe240⤵PID:4348
-
\??\c:\bttnhh.exec:\bttnhh.exe241⤵PID:896
-
\??\c:\nhnbtb.exec:\nhnbtb.exe242⤵PID:2228