Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 04:53
Behavioral task
behavioral1
Sample
b21a87427457fbfa334a88366b4c3270_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b21a87427457fbfa334a88366b4c3270_NeikiAnalytics.exe
-
Size
198KB
-
MD5
b21a87427457fbfa334a88366b4c3270
-
SHA1
7f65cbbab2bc2f897af0f5be4fa95f84e7e41022
-
SHA256
d4b1a67b6cd530ab2d0f8612685d6ef66b734e24f660b4a67f07b1e0a2a62ef6
-
SHA512
bd2c02061e284a2faba9199716f811ebba385c5049680c29924556442f2cf1fa6e4a005de88837e1d533dcdba24f3cf800b2a609eb5f47fbec53e457d9b01d11
-
SSDEEP
3072:ZhOmTsF93UYfwC6GIoutFza6BhOmTsUm82xpi8rY9AABa1JePQKN1hJCh:Zcm4FmowdHoSha6Bcm4JddW7Y6XJCh
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1728-8-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1728-12-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1852-6-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3288-20-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3168-28-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3416-29-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3416-32-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2444-41-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2124-48-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/948-53-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/388-57-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3300-62-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3300-69-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1680-67-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/388-64-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4492-83-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1680-75-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3092-90-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4976-91-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4976-96-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1936-104-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2912-113-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1180-116-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4796-124-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4996-140-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2348-160-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1184-190-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4660-218-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2524-266-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3216-290-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4652-294-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1352-306-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3928-315-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4148-332-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/576-345-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2904-349-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2768-354-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3512-358-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1000-341-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4148-336-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4844-330-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3728-326-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3100-322-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1760-318-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3020-310-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2424-302-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3784-298-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/2656-287-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4800-282-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1288-278-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/5004-274-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4312-271-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1068-263-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3172-258-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4020-254-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4056-251-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/316-246-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/1996-242-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4452-238-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/220-234-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4388-230-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4856-226-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/4736-222-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral2/memory/3336-214-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nntnnn.exethbtbb.exetbtbbt.exepjjjj.exexrxrxxr.exetthttn.exelxxfxxr.exehnhbnb.exeddvpp.exerxxxxxx.exexxrrlxx.exenbhhbb.exexfxxxxx.exeppdpd.exejpjdv.exefrxrllr.exetnhhbh.exerlxrlrr.exeddjdj.exerlrlrll.exehthbbn.exe3tbbbb.exevvjdd.exeflrrlrl.exefxfrlll.exehnbbbb.exe9bbtnn.exe7vvjp.exe7ppjd.exelrflllx.exe7rlffff.exenhnhhh.exe5nnnht.exejpddd.exevpdjp.exelrfxxxf.exeflrlfll.exebtnnnh.exe5hnnhh.exedvpjp.exe5rxrrrl.exefxxrrrr.exe3rxrrxr.exenhthnh.exe5hnnht.exevjppp.exexlxlrxx.exexfffrlx.exehnbntb.exe1nhbtt.exepjvpp.exejdppd.exerfrlffr.exentnhhb.exe5nhbnn.exepjvpp.exelxflfxf.exexrxlfff.exebbhhbt.exe5hbnhb.exe7pdvj.exepjdvj.exefrffxxr.exennnnhn.exepid process 1728 nntnnn.exe 3288 thbtbb.exe 3168 tbtbbt.exe 3416 pjjjj.exe 2444 xrxrxxr.exe 2124 tthttn.exe 948 lxxfxxr.exe 388 hnhbnb.exe 3300 ddvpp.exe 1680 rxxxxxx.exe 4492 xxrrlxx.exe 3092 nbhhbb.exe 4976 xfxxxxx.exe 1936 ppdpd.exe 2912 jpjdv.exe 1180 frxrllr.exe 4796 tnhhbh.exe 1060 rlxrlrr.exe 4996 ddjdj.exe 2512 rlrlrll.exe 3156 hthbbn.exe 2348 3tbbbb.exe 3276 vvjdd.exe 2020 flrrlrl.exe 808 fxfrlll.exe 4888 hnbbbb.exe 1184 9bbtnn.exe 4384 7vvjp.exe 4620 7ppjd.exe 844 lrflllx.exe 3336 7rlffff.exe 4660 nhnhhh.exe 4736 5nnnht.exe 4856 jpddd.exe 4388 vpdjp.exe 220 lrfxxxf.exe 4452 flrlfll.exe 1996 btnnnh.exe 316 5hnnhh.exe 4056 dvpjp.exe 4020 5rxrrrl.exe 3172 fxxrrrr.exe 1068 3rxrrxr.exe 2524 nhthnh.exe 4312 5hnnht.exe 5004 vjppp.exe 1288 xlxlrxx.exe 4800 xfffrlx.exe 2656 hnbntb.exe 3216 1nhbtt.exe 4652 pjvpp.exe 3784 jdppd.exe 2424 rfrlffr.exe 1352 ntnhhb.exe 3020 5nhbnn.exe 3928 pjvpp.exe 1760 lxflfxf.exe 3100 xrxlfff.exe 3728 bbhhbt.exe 4844 5hbnhb.exe 4148 7pdvj.exe 1000 pjdvj.exe 576 frffxxr.exe 2904 nnnnhn.exe -
Processes:
resource yara_rule behavioral2/memory/1852-0-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\nntnnn.exe upx behavioral2/memory/1728-8-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1728-12-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\thbtbb.exe upx behavioral2/memory/1852-6-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3288-13-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\tbtbbt.exe upx behavioral2/memory/3288-20-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3168-21-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\pjjjj.exe upx behavioral2/memory/3168-28-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3416-29-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\xrxrxxr.exe upx behavioral2/memory/2444-36-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3416-32-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2444-41-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\tthttn.exe upx behavioral2/memory/2124-43-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\lxxfxxr.exe upx behavioral2/memory/948-49-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2124-48-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/948-53-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\hnhbnb.exe upx behavioral2/memory/388-57-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\ddvpp.exe upx behavioral2/memory/3300-62-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3300-69-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1680-67-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\rxxxxxx.exe upx behavioral2/memory/388-64-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\xxrrlxx.exe upx \??\c:\nbhhbb.exe upx behavioral2/memory/4492-83-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3092-81-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4492-78-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1680-75-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\xfxxxxx.exe upx behavioral2/memory/3092-90-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4976-91-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\ppdpd.exe upx behavioral2/memory/4976-96-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1936-98-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\jpjdv.exe upx behavioral2/memory/2912-105-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1936-104-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\frxrllr.exe upx behavioral2/memory/2912-113-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1180-111-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\tnhhbh.exe upx behavioral2/memory/1180-116-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4796-120-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\rlxrlrr.exe upx behavioral2/memory/4796-124-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1060-126-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-133-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-140-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\3tbbbb.exe upx behavioral2/memory/2348-160-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1184-190-0x0000000000400000-0x000000000043F000-memory.dmp upx \??\c:\lrflllx.exe upx behavioral2/memory/4660-218-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2524-266-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3216-290-0x0000000000400000-0x000000000043F000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b21a87427457fbfa334a88366b4c3270_NeikiAnalytics.exenntnnn.exethbtbb.exetbtbbt.exepjjjj.exexrxrxxr.exetthttn.exelxxfxxr.exehnhbnb.exeddvpp.exerxxxxxx.exexxrrlxx.exenbhhbb.exexfxxxxx.exeppdpd.exejpjdv.exefrxrllr.exetnhhbh.exerlxrlrr.exeddjdj.exerlrlrll.exehthbbn.exedescription pid process target process PID 1852 wrote to memory of 1728 1852 b21a87427457fbfa334a88366b4c3270_NeikiAnalytics.exe nntnnn.exe PID 1852 wrote to memory of 1728 1852 b21a87427457fbfa334a88366b4c3270_NeikiAnalytics.exe nntnnn.exe PID 1852 wrote to memory of 1728 1852 b21a87427457fbfa334a88366b4c3270_NeikiAnalytics.exe nntnnn.exe PID 1728 wrote to memory of 3288 1728 nntnnn.exe thbtbb.exe PID 1728 wrote to memory of 3288 1728 nntnnn.exe thbtbb.exe PID 1728 wrote to memory of 3288 1728 nntnnn.exe thbtbb.exe PID 3288 wrote to memory of 3168 3288 thbtbb.exe tbtbbt.exe PID 3288 wrote to memory of 3168 3288 thbtbb.exe tbtbbt.exe PID 3288 wrote to memory of 3168 3288 thbtbb.exe tbtbbt.exe PID 3168 wrote to memory of 3416 3168 tbtbbt.exe pjjjj.exe PID 3168 wrote to memory of 3416 3168 tbtbbt.exe pjjjj.exe PID 3168 wrote to memory of 3416 3168 tbtbbt.exe pjjjj.exe PID 3416 wrote to memory of 2444 3416 pjjjj.exe xrxrxxr.exe PID 3416 wrote to memory of 2444 3416 pjjjj.exe xrxrxxr.exe PID 3416 wrote to memory of 2444 3416 pjjjj.exe xrxrxxr.exe PID 2444 wrote to memory of 2124 2444 xrxrxxr.exe tthttn.exe PID 2444 wrote to memory of 2124 2444 xrxrxxr.exe tthttn.exe PID 2444 wrote to memory of 2124 2444 xrxrxxr.exe tthttn.exe PID 2124 wrote to memory of 948 2124 tthttn.exe lxxfxxr.exe PID 2124 wrote to memory of 948 2124 tthttn.exe lxxfxxr.exe PID 2124 wrote to memory of 948 2124 tthttn.exe lxxfxxr.exe PID 948 wrote to memory of 388 948 lxxfxxr.exe hnhbnb.exe PID 948 wrote to memory of 388 948 lxxfxxr.exe hnhbnb.exe PID 948 wrote to memory of 388 948 lxxfxxr.exe hnhbnb.exe PID 388 wrote to memory of 3300 388 hnhbnb.exe ddvpp.exe PID 388 wrote to memory of 3300 388 hnhbnb.exe ddvpp.exe PID 388 wrote to memory of 3300 388 hnhbnb.exe ddvpp.exe PID 3300 wrote to memory of 1680 3300 ddvpp.exe rxxxxxx.exe PID 3300 wrote to memory of 1680 3300 ddvpp.exe rxxxxxx.exe PID 3300 wrote to memory of 1680 3300 ddvpp.exe rxxxxxx.exe PID 1680 wrote to memory of 4492 1680 rxxxxxx.exe xxrrlxx.exe PID 1680 wrote to memory of 4492 1680 rxxxxxx.exe xxrrlxx.exe PID 1680 wrote to memory of 4492 1680 rxxxxxx.exe xxrrlxx.exe PID 4492 wrote to memory of 3092 4492 xxrrlxx.exe nbhhbb.exe PID 4492 wrote to memory of 3092 4492 xxrrlxx.exe nbhhbb.exe PID 4492 wrote to memory of 3092 4492 xxrrlxx.exe nbhhbb.exe PID 3092 wrote to memory of 4976 3092 nbhhbb.exe xfxxxxx.exe PID 3092 wrote to memory of 4976 3092 nbhhbb.exe xfxxxxx.exe PID 3092 wrote to memory of 4976 3092 nbhhbb.exe xfxxxxx.exe PID 4976 wrote to memory of 1936 4976 xfxxxxx.exe ppdpd.exe PID 4976 wrote to memory of 1936 4976 xfxxxxx.exe ppdpd.exe PID 4976 wrote to memory of 1936 4976 xfxxxxx.exe ppdpd.exe PID 1936 wrote to memory of 2912 1936 ppdpd.exe jpjdv.exe PID 1936 wrote to memory of 2912 1936 ppdpd.exe jpjdv.exe PID 1936 wrote to memory of 2912 1936 ppdpd.exe jpjdv.exe PID 2912 wrote to memory of 1180 2912 jpjdv.exe frxrllr.exe PID 2912 wrote to memory of 1180 2912 jpjdv.exe frxrllr.exe PID 2912 wrote to memory of 1180 2912 jpjdv.exe frxrllr.exe PID 1180 wrote to memory of 4796 1180 frxrllr.exe tnhhbh.exe PID 1180 wrote to memory of 4796 1180 frxrllr.exe tnhhbh.exe PID 1180 wrote to memory of 4796 1180 frxrllr.exe tnhhbh.exe PID 4796 wrote to memory of 1060 4796 tnhhbh.exe rlxrlrr.exe PID 4796 wrote to memory of 1060 4796 tnhhbh.exe rlxrlrr.exe PID 4796 wrote to memory of 1060 4796 tnhhbh.exe rlxrlrr.exe PID 1060 wrote to memory of 4996 1060 rlxrlrr.exe ddjdj.exe PID 1060 wrote to memory of 4996 1060 rlxrlrr.exe ddjdj.exe PID 1060 wrote to memory of 4996 1060 rlxrlrr.exe ddjdj.exe PID 4996 wrote to memory of 2512 4996 ddjdj.exe rlrlrll.exe PID 4996 wrote to memory of 2512 4996 ddjdj.exe rlrlrll.exe PID 4996 wrote to memory of 2512 4996 ddjdj.exe rlrlrll.exe PID 2512 wrote to memory of 3156 2512 rlrlrll.exe hthbbn.exe PID 2512 wrote to memory of 3156 2512 rlrlrll.exe hthbbn.exe PID 2512 wrote to memory of 3156 2512 rlrlrll.exe hthbbn.exe PID 3156 wrote to memory of 2348 3156 hthbbn.exe 3tbbbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b21a87427457fbfa334a88366b4c3270_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b21a87427457fbfa334a88366b4c3270_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\nntnnn.exec:\nntnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\thbtbb.exec:\thbtbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\tbtbbt.exec:\tbtbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\pjjjj.exec:\pjjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\xrxrxxr.exec:\xrxrxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\tthttn.exec:\tthttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\lxxfxxr.exec:\lxxfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\hnhbnb.exec:\hnhbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\ddvpp.exec:\ddvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\xxrrlxx.exec:\xxrrlxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\nbhhbb.exec:\nbhhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\ppdpd.exec:\ppdpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\jpjdv.exec:\jpjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\frxrllr.exec:\frxrllr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\tnhhbh.exec:\tnhhbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\rlxrlrr.exec:\rlxrlrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\ddjdj.exec:\ddjdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rlrlrll.exec:\rlrlrll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\hthbbn.exec:\hthbbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\3tbbbb.exec:\3tbbbb.exe23⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vvjdd.exec:\vvjdd.exe24⤵
- Executes dropped EXE
PID:3276 -
\??\c:\flrrlrl.exec:\flrrlrl.exe25⤵
- Executes dropped EXE
PID:2020 -
\??\c:\fxfrlll.exec:\fxfrlll.exe26⤵
- Executes dropped EXE
PID:808 -
\??\c:\hnbbbb.exec:\hnbbbb.exe27⤵
- Executes dropped EXE
PID:4888 -
\??\c:\9bbtnn.exec:\9bbtnn.exe28⤵
- Executes dropped EXE
PID:1184 -
\??\c:\7vvjp.exec:\7vvjp.exe29⤵
- Executes dropped EXE
PID:4384 -
\??\c:\7ppjd.exec:\7ppjd.exe30⤵
- Executes dropped EXE
PID:4620 -
\??\c:\lrflllx.exec:\lrflllx.exe31⤵
- Executes dropped EXE
PID:844 -
\??\c:\7rlffff.exec:\7rlffff.exe32⤵
- Executes dropped EXE
PID:3336 -
\??\c:\nhnhhh.exec:\nhnhhh.exe33⤵
- Executes dropped EXE
PID:4660 -
\??\c:\5nnnht.exec:\5nnnht.exe34⤵
- Executes dropped EXE
PID:4736 -
\??\c:\jpddd.exec:\jpddd.exe35⤵
- Executes dropped EXE
PID:4856 -
\??\c:\vpdjp.exec:\vpdjp.exe36⤵
- Executes dropped EXE
PID:4388 -
\??\c:\lrfxxxf.exec:\lrfxxxf.exe37⤵
- Executes dropped EXE
PID:220 -
\??\c:\flrlfll.exec:\flrlfll.exe38⤵
- Executes dropped EXE
PID:4452 -
\??\c:\btnnnh.exec:\btnnnh.exe39⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5hnnhh.exec:\5hnnhh.exe40⤵
- Executes dropped EXE
PID:316 -
\??\c:\dvpjp.exec:\dvpjp.exe41⤵
- Executes dropped EXE
PID:4056 -
\??\c:\5rxrrrl.exec:\5rxrrrl.exe42⤵
- Executes dropped EXE
PID:4020 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe43⤵
- Executes dropped EXE
PID:3172 -
\??\c:\3rxrrxr.exec:\3rxrrxr.exe44⤵
- Executes dropped EXE
PID:1068 -
\??\c:\nhthnh.exec:\nhthnh.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\5hnnht.exec:\5hnnht.exe46⤵
- Executes dropped EXE
PID:4312 -
\??\c:\vjppp.exec:\vjppp.exe47⤵
- Executes dropped EXE
PID:5004 -
\??\c:\xlxlrxx.exec:\xlxlrxx.exe48⤵
- Executes dropped EXE
PID:1288 -
\??\c:\xfffrlx.exec:\xfffrlx.exe49⤵
- Executes dropped EXE
PID:4800 -
\??\c:\hnbntb.exec:\hnbntb.exe50⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1nhbtt.exec:\1nhbtt.exe51⤵
- Executes dropped EXE
PID:3216 -
\??\c:\pjvpp.exec:\pjvpp.exe52⤵
- Executes dropped EXE
PID:4652 -
\??\c:\jdppd.exec:\jdppd.exe53⤵
- Executes dropped EXE
PID:3784 -
\??\c:\rfrlffr.exec:\rfrlffr.exe54⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ntnhhb.exec:\ntnhhb.exe55⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5nhbnn.exec:\5nhbnn.exe56⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pjvpp.exec:\pjvpp.exe57⤵
- Executes dropped EXE
PID:3928 -
\??\c:\lxflfxf.exec:\lxflfxf.exe58⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xrxlfff.exec:\xrxlfff.exe59⤵
- Executes dropped EXE
PID:3100 -
\??\c:\bbhhbt.exec:\bbhhbt.exe60⤵
- Executes dropped EXE
PID:3728 -
\??\c:\5hbnhb.exec:\5hbnhb.exe61⤵
- Executes dropped EXE
PID:4844 -
\??\c:\7pdvj.exec:\7pdvj.exe62⤵
- Executes dropped EXE
PID:4148 -
\??\c:\pjdvj.exec:\pjdvj.exe63⤵
- Executes dropped EXE
PID:1000 -
\??\c:\frffxxr.exec:\frffxxr.exe64⤵
- Executes dropped EXE
PID:576 -
\??\c:\nnnnhn.exec:\nnnnhn.exe65⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vpdjd.exec:\vpdjd.exe66⤵PID:2768
-
\??\c:\pdjdv.exec:\pdjdv.exe67⤵PID:3512
-
\??\c:\rfrlxrl.exec:\rfrlxrl.exe68⤵PID:1916
-
\??\c:\9nhhbb.exec:\9nhhbb.exe69⤵PID:3276
-
\??\c:\vpppj.exec:\vpppj.exe70⤵PID:2276
-
\??\c:\xrrfxfx.exec:\xrrfxfx.exe71⤵PID:3480
-
\??\c:\hththn.exec:\hththn.exe72⤵PID:2316
-
\??\c:\djjdd.exec:\djjdd.exe73⤵PID:3772
-
\??\c:\xffxxrl.exec:\xffxxrl.exe74⤵PID:1224
-
\??\c:\hbnhhh.exec:\hbnhhh.exe75⤵PID:4036
-
\??\c:\9pvpd.exec:\9pvpd.exe76⤵PID:2956
-
\??\c:\frxxlrl.exec:\frxxlrl.exe77⤵PID:208
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe78⤵PID:4452
-
\??\c:\thhhbt.exec:\thhhbt.exe79⤵PID:5104
-
\??\c:\9jjjv.exec:\9jjjv.exe80⤵PID:2188
-
\??\c:\dppjv.exec:\dppjv.exe81⤵PID:1636
-
\??\c:\fllfxrl.exec:\fllfxrl.exe82⤵PID:3776
-
\??\c:\lxrrlfx.exec:\lxrrlfx.exe83⤵PID:4212
-
\??\c:\bhnnhb.exec:\bhnnhb.exe84⤵PID:5024
-
\??\c:\nntthb.exec:\nntthb.exe85⤵PID:3524
-
\??\c:\7jjvd.exec:\7jjvd.exe86⤵PID:4312
-
\??\c:\xfxrffx.exec:\xfxrffx.exe87⤵PID:4948
-
\??\c:\9xrlfxx.exec:\9xrlfxx.exe88⤵PID:948
-
\??\c:\httnhh.exec:\httnhh.exe89⤵PID:4584
-
\??\c:\tnnbtn.exec:\tnnbtn.exe90⤵PID:2772
-
\??\c:\vdddd.exec:\vdddd.exe91⤵PID:1324
-
\??\c:\7djjv.exec:\7djjv.exe92⤵PID:1256
-
\??\c:\rfxrfrr.exec:\rfxrfrr.exe93⤵PID:4892
-
\??\c:\nhnbtn.exec:\nhnbtn.exe94⤵PID:3260
-
\??\c:\hhnhbt.exec:\hhnhbt.exe95⤵PID:2120
-
\??\c:\pjjvp.exec:\pjjvp.exe96⤵PID:432
-
\??\c:\rflxrll.exec:\rflxrll.exe97⤵PID:3020
-
\??\c:\xrrllfx.exec:\xrrllfx.exe98⤵PID:3092
-
\??\c:\hntnhh.exec:\hntnhh.exe99⤵PID:2616
-
\??\c:\djjdv.exec:\djjdv.exe100⤵PID:3052
-
\??\c:\jvvpj.exec:\jvvpj.exe101⤵PID:388
-
\??\c:\5ffxlfx.exec:\5ffxlfx.exe102⤵PID:3588
-
\??\c:\rxxfxrl.exec:\rxxfxrl.exe103⤵PID:1008
-
\??\c:\nnnnnn.exec:\nnnnnn.exe104⤵PID:4224
-
\??\c:\9vppp.exec:\9vppp.exe105⤵PID:440
-
\??\c:\3xxrlfx.exec:\3xxrlfx.exe106⤵PID:4048
-
\??\c:\tbbbtt.exec:\tbbbtt.exe107⤵PID:2572
-
\??\c:\pjdvd.exec:\pjdvd.exe108⤵PID:2068
-
\??\c:\5jjdv.exec:\5jjdv.exe109⤵PID:2768
-
\??\c:\frfflrx.exec:\frfflrx.exe110⤵PID:1964
-
\??\c:\vpdvv.exec:\vpdvv.exe111⤵PID:4080
-
\??\c:\ddpjd.exec:\ddpjd.exe112⤵PID:1592
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe113⤵PID:2788
-
\??\c:\tntttn.exec:\tntttn.exe114⤵PID:2180
-
\??\c:\nbbttt.exec:\nbbttt.exe115⤵PID:4688
-
\??\c:\1rxlrlf.exec:\1rxlrlf.exe116⤵PID:5028
-
\??\c:\bhtnbb.exec:\bhtnbb.exe117⤵PID:4724
-
\??\c:\bnhtbn.exec:\bnhtbn.exe118⤵PID:2624
-
\??\c:\jpjvj.exec:\jpjvj.exe119⤵PID:3344
-
\??\c:\ttbbhb.exec:\ttbbhb.exe120⤵PID:3548
-
\??\c:\vjvpd.exec:\vjvpd.exe121⤵PID:4452
-
\??\c:\tnbhht.exec:\tnbhht.exe122⤵PID:1328
-
\??\c:\hnnnnt.exec:\hnnnnt.exe123⤵PID:4424
-
\??\c:\hbhntt.exec:\hbhntt.exe124⤵PID:3196
-
\??\c:\vvvvd.exec:\vvvvd.exe125⤵PID:4332
-
\??\c:\fffxxxx.exec:\fffxxxx.exe126⤵PID:3956
-
\??\c:\bhnnbb.exec:\bhnnbb.exe127⤵PID:4264
-
\??\c:\btnnhh.exec:\btnnhh.exe128⤵PID:3388
-
\??\c:\jddvv.exec:\jddvv.exe129⤵PID:4312
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe130⤵PID:1148
-
\??\c:\bbbbtt.exec:\bbbbtt.exe131⤵PID:1600
-
\??\c:\pjpjd.exec:\pjpjd.exe132⤵PID:560
-
\??\c:\lffxxll.exec:\lffxxll.exe133⤵PID:2772
-
\??\c:\nbttbb.exec:\nbttbb.exe134⤵PID:4268
-
\??\c:\ddpjv.exec:\ddpjv.exe135⤵PID:3596
-
\??\c:\1rxxxll.exec:\1rxxxll.exe136⤵PID:4344
-
\??\c:\nhnnnn.exec:\nhnnnn.exe137⤵PID:4464
-
\??\c:\vpvjd.exec:\vpvjd.exe138⤵PID:4492
-
\??\c:\pjpjv.exec:\pjpjv.exe139⤵PID:1840
-
\??\c:\xxrlfff.exec:\xxrlfff.exe140⤵PID:1208
-
\??\c:\lxrrlrl.exec:\lxrrlrl.exe141⤵PID:1936
-
\??\c:\ntttht.exec:\ntttht.exe142⤵PID:388
-
\??\c:\btnhbb.exec:\btnhbb.exe143⤵PID:3896
-
\??\c:\ppppj.exec:\ppppj.exe144⤵PID:2900
-
\??\c:\5dvpp.exec:\5dvpp.exe145⤵PID:2492
-
\??\c:\1xxxrxr.exec:\1xxxrxr.exe146⤵PID:2632
-
\??\c:\htbttn.exec:\htbttn.exe147⤵PID:788
-
\??\c:\nhtnhh.exec:\nhtnhh.exe148⤵PID:1520
-
\??\c:\htttnt.exec:\htttnt.exe149⤵PID:3192
-
\??\c:\vjjpp.exec:\vjjpp.exe150⤵PID:2000
-
\??\c:\rlxrxrr.exec:\rlxrxrr.exe151⤵PID:5112
-
\??\c:\llllfff.exec:\llllfff.exe152⤵PID:4108
-
\??\c:\thnbbb.exec:\thnbbb.exe153⤵PID:3644
-
\??\c:\ddppj.exec:\ddppj.exe154⤵PID:2476
-
\??\c:\jdpjv.exec:\jdpjv.exe155⤵PID:4724
-
\??\c:\nnntht.exec:\nnntht.exe156⤵PID:2624
-
\??\c:\nbhhht.exec:\nbhhht.exe157⤵PID:3344
-
\??\c:\jvppj.exec:\jvppj.exe158⤵PID:3548
-
\??\c:\7djdv.exec:\7djdv.exe159⤵PID:316
-
\??\c:\hhttnn.exec:\hhttnn.exe160⤵PID:1328
-
\??\c:\vvddv.exec:\vvddv.exe161⤵PID:1392
-
\??\c:\rfxrrxx.exec:\rfxrrxx.exe162⤵PID:4936
-
\??\c:\xrfflfl.exec:\xrfflfl.exe163⤵PID:5024
-
\??\c:\1tbbbh.exec:\1tbbbh.exe164⤵PID:4440
-
\??\c:\nnnbnt.exec:\nnnbnt.exe165⤵PID:3524
-
\??\c:\vjvvp.exec:\vjvvp.exe166⤵PID:3164
-
\??\c:\frrrlrl.exec:\frrrlrl.exe167⤵PID:2124
-
\??\c:\5bthbt.exec:\5bthbt.exe168⤵PID:5060
-
\??\c:\7vddd.exec:\7vddd.exe169⤵PID:3600
-
\??\c:\bbnhnh.exec:\bbnhnh.exe170⤵PID:2128
-
\??\c:\tnnbtt.exec:\tnnbtt.exe171⤵PID:3784
-
\??\c:\jvpjp.exec:\jvpjp.exe172⤵PID:2728
-
\??\c:\vpdvj.exec:\vpdvj.exe173⤵PID:1352
-
\??\c:\1rlxrlf.exec:\1rlxrlf.exe174⤵PID:3992
-
\??\c:\bntnhh.exec:\bntnhh.exe175⤵PID:4720
-
\??\c:\1ddvp.exec:\1ddvp.exe176⤵PID:3092
-
\??\c:\hhhhhn.exec:\hhhhhn.exe177⤵PID:1208
-
\??\c:\pvdpp.exec:\pvdpp.exe178⤵PID:1936
-
\??\c:\lrxxrxx.exec:\lrxxrxx.exe179⤵PID:4908
-
\??\c:\xlrlfff.exec:\xlrlfff.exe180⤵PID:1000
-
\??\c:\bttnnh.exec:\bttnnh.exe181⤵PID:3732
-
\??\c:\ddpjp.exec:\ddpjp.exe182⤵PID:1576
-
\??\c:\jjdvv.exec:\jjdvv.exe183⤵PID:3676
-
\??\c:\rfrlxrr.exec:\rfrlxrr.exe184⤵PID:368
-
\??\c:\lffxxxx.exec:\lffxxxx.exe185⤵PID:2020
-
\??\c:\3bbhbb.exec:\3bbhbb.exe186⤵PID:2116
-
\??\c:\dvvpj.exec:\dvvpj.exe187⤵PID:4384
-
\??\c:\9dddj.exec:\9dddj.exe188⤵PID:4880
-
\??\c:\frxrrlr.exec:\frxrrlr.exe189⤵PID:3312
-
\??\c:\nhnnnn.exec:\nhnnnn.exe190⤵PID:628
-
\??\c:\bthhnn.exec:\bthhnn.exe191⤵PID:220
-
\??\c:\7vvpj.exec:\7vvpj.exe192⤵PID:4624
-
\??\c:\dvdvp.exec:\dvdvp.exe193⤵PID:400
-
\??\c:\llrlfxr.exec:\llrlfxr.exe194⤵PID:3712
-
\??\c:\1hnnnn.exec:\1hnnnn.exe195⤵PID:4896
-
\??\c:\vpdpv.exec:\vpdpv.exe196⤵PID:3740
-
\??\c:\3jjjd.exec:\3jjjd.exe197⤵PID:2404
-
\??\c:\fffxrfx.exec:\fffxrfx.exe198⤵PID:1984
-
\??\c:\flrllff.exec:\flrllff.exe199⤵PID:1396
-
\??\c:\nnhhbb.exec:\nnhhbb.exe200⤵PID:5004
-
\??\c:\dpddv.exec:\dpddv.exe201⤵PID:4412
-
\??\c:\pjjpj.exec:\pjjpj.exe202⤵PID:1868
-
\??\c:\lrxxrfr.exec:\lrxxrfr.exe203⤵PID:3552
-
\??\c:\7bbbtt.exec:\7bbbtt.exe204⤵PID:1472
-
\??\c:\vvvvd.exec:\vvvvd.exe205⤵PID:396
-
\??\c:\9vvvp.exec:\9vvvp.exe206⤵PID:3300
-
\??\c:\rfxlflf.exec:\rfxlflf.exe207⤵PID:4260
-
\??\c:\rlllxxx.exec:\rlllxxx.exe208⤵PID:4872
-
\??\c:\hhtntt.exec:\hhtntt.exe209⤵PID:1324
-
\??\c:\5nnhhn.exec:\5nnhhn.exe210⤵PID:2128
-
\??\c:\7pvpj.exec:\7pvpj.exe211⤵PID:3784
-
\??\c:\llxfxxl.exec:\llxfxxl.exe212⤵PID:4172
-
\??\c:\flrrlrl.exec:\flrrlrl.exe213⤵PID:2792
-
\??\c:\hhhhhb.exec:\hhhhhb.exe214⤵PID:1840
-
\??\c:\ppdjp.exec:\ppdjp.exe215⤵PID:4976
-
\??\c:\pjpjp.exec:\pjpjp.exe216⤵PID:756
-
\??\c:\xrxrffx.exec:\xrxrffx.exe217⤵PID:2604
-
\??\c:\5bbhbb.exec:\5bbhbb.exe218⤵PID:576
-
\??\c:\pdddv.exec:\pdddv.exe219⤵PID:440
-
\??\c:\jdddp.exec:\jdddp.exe220⤵PID:1000
-
\??\c:\xrffxrr.exec:\xrffxrr.exe221⤵PID:3156
-
\??\c:\ttnnbb.exec:\ttnnbb.exe222⤵PID:2916
-
\??\c:\hbbttn.exec:\hbbttn.exe223⤵PID:3676
-
\??\c:\vdppj.exec:\vdppj.exe224⤵PID:1964
-
\??\c:\pvvvp.exec:\pvvvp.exe225⤵PID:3480
-
\??\c:\flxrlll.exec:\flxrlll.exe226⤵PID:4704
-
\??\c:\rxlrrrl.exec:\rxlrrrl.exe227⤵PID:4616
-
\??\c:\3hbbbh.exec:\3hbbbh.exe228⤵PID:4880
-
\??\c:\hnhhbb.exec:\hnhhbb.exe229⤵PID:4628
-
\??\c:\jdpvp.exec:\jdpvp.exe230⤵PID:208
-
\??\c:\fxrllrr.exec:\fxrllrr.exe231⤵PID:4900
-
\??\c:\1flfxxr.exec:\1flfxxr.exe232⤵PID:1388
-
\??\c:\nnhhbb.exec:\nnhhbb.exe233⤵PID:3712
-
\??\c:\vpppp.exec:\vpppp.exe234⤵PID:4896
-
\??\c:\jjjdp.exec:\jjjdp.exe235⤵PID:3740
-
\??\c:\ffrlxxx.exec:\ffrlxxx.exe236⤵PID:2340
-
\??\c:\tbtttt.exec:\tbtttt.exe237⤵PID:4676
-
\??\c:\bbnhnn.exec:\bbnhnn.exe238⤵PID:4700
-
\??\c:\pjddv.exec:\pjddv.exe239⤵PID:4588
-
\??\c:\xxxrrfl.exec:\xxxrrfl.exe240⤵PID:4412
-
\??\c:\lxffffx.exec:\lxffffx.exe241⤵PID:3388
-
\??\c:\bhbntn.exec:\bhbntn.exe242⤵PID:4800