Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 05:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21e7170dd2bd8f8622c9166693d7c8b0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
21e7170dd2bd8f8622c9166693d7c8b0_NeikiAnalytics.exe
-
Size
205KB
-
MD5
21e7170dd2bd8f8622c9166693d7c8b0
-
SHA1
715bf39ac091a1156451514acae54b3cbcbef8cd
-
SHA256
af7eb6f688dadfb0595990dd66b48159b53b2531f474aed5de4bb91b664a24c2
-
SHA512
1b9f45877bda875e686cade782ad28dde8d0ac019ad9624e49c58a97e27c795d0c9132e134d6064eaadc2ad7e97c3f7489f5769d3d1e2affb7d50527baafec3e
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6TQpCih1:PhOm2sI93UufdC67ciJTU2HVS64h1
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/3076-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2652-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-364-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-395-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-402-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-431-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-454-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-470-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-477-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-487-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-507-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-525-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-538-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-564-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-584-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-777-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-827-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-925-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-947-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-1014-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-1085-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7ddvd.exepjvpd.exe3frlllr.exeddjpd.exelfxffrx.exe5hhhhb.exepjjdp.exefrrlrlr.exelrfxxxf.exennnnhn.exejvddd.exeffxffff.exerrlffff.exelrrxllr.exefrrlfrl.exelflfffx.exe1bbhtn.exe3jjdj.exehhhbnh.exe1jvjd.exe9frfrrf.exe3hntnh.exedjjvd.exerlfrrlx.exebnhttn.exe7pjvj.exefxlfrfx.exe9nhbtn.exe9pjdv.exerxlrfxf.exebhhbtn.exejdjdv.exebnntnb.exe3hhbnn.exerfrlxff.exeththht.exethhnnh.exedvjdv.exe7ffxrrr.exehhbbbb.exehtbntb.exejvvjv.exexfrlxxx.exe1hhhnh.exedpjjv.exe1lxxrrr.exentthth.exejvvpd.exerrrfxfl.exe7hbtnn.exedpjvp.exethnhtt.exevjdvp.exe9rllllr.exenbbbbt.exentnnbb.exeppjdp.exebtthtt.exettnhtt.exejdddj.exe9fxrlfx.exe7ttnhh.exevppjv.exe1vpjd.exepid process 4840 7ddvd.exe 3124 pjvpd.exe 1496 3frlllr.exe 1532 ddjpd.exe 3432 lfxffrx.exe 2072 5hhhhb.exe 4008 pjjdp.exe 3912 frrlrlr.exe 1180 lrfxxxf.exe 1228 nnnnhn.exe 3320 jvddd.exe 4648 ffxffff.exe 1528 rrlffff.exe 4320 lrrxllr.exe 3500 frrlfrl.exe 2652 lflfffx.exe 1196 1bbhtn.exe 1304 3jjdj.exe 3456 hhhbnh.exe 4640 1jvjd.exe 2988 9frfrrf.exe 4488 3hntnh.exe 2600 djjvd.exe 3200 rlfrrlx.exe 4672 bnhttn.exe 2076 7pjvj.exe 924 fxlfrfx.exe 3168 9nhbtn.exe 3108 9pjdv.exe 720 rxlrfxf.exe 2264 bhhbtn.exe 3704 jdjdv.exe 4060 bnntnb.exe 1488 3hhbnn.exe 1584 rfrlxff.exe 3028 ththht.exe 1328 thhnnh.exe 4848 dvjdv.exe 3032 7ffxrrr.exe 4476 hhbbbb.exe 3816 htbntb.exe 2724 jvvjv.exe 3140 xfrlxxx.exe 2424 1hhhnh.exe 1188 dpjjv.exe 3708 1lxxrrr.exe 2012 ntthth.exe 628 jvvpd.exe 4000 rrrfxfl.exe 3784 7hbtnn.exe 4712 dpjvp.exe 4680 thnhtt.exe 1968 vjdvp.exe 1112 9rllllr.exe 2952 nbbbbt.exe 2228 ntnnbb.exe 2948 ppjdp.exe 2308 btthtt.exe 4872 ttnhtt.exe 4944 jdddj.exe 5072 9fxrlfx.exe 2840 7ttnhh.exe 4972 vppjv.exe 1608 1vpjd.exe -
Processes:
resource yara_rule behavioral2/memory/3076-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2652-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-395-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-402-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-407-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-427-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-431-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-454-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-470-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-477-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-487-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
21e7170dd2bd8f8622c9166693d7c8b0_NeikiAnalytics.exe7ddvd.exepjvpd.exe3frlllr.exeddjpd.exelfxffrx.exe5hhhhb.exepjjdp.exefrrlrlr.exelrfxxxf.exennnnhn.exejvddd.exeffxffff.exerrlffff.exelrrxllr.exefrrlfrl.exelflfffx.exe1bbhtn.exe3jjdj.exehhhbnh.exe1jvjd.exe9frfrrf.exedescription pid process target process PID 3076 wrote to memory of 4840 3076 21e7170dd2bd8f8622c9166693d7c8b0_NeikiAnalytics.exe 7ddvd.exe PID 3076 wrote to memory of 4840 3076 21e7170dd2bd8f8622c9166693d7c8b0_NeikiAnalytics.exe 7ddvd.exe PID 3076 wrote to memory of 4840 3076 21e7170dd2bd8f8622c9166693d7c8b0_NeikiAnalytics.exe 7ddvd.exe PID 4840 wrote to memory of 3124 4840 7ddvd.exe pjvpd.exe PID 4840 wrote to memory of 3124 4840 7ddvd.exe pjvpd.exe PID 4840 wrote to memory of 3124 4840 7ddvd.exe pjvpd.exe PID 3124 wrote to memory of 1496 3124 pjvpd.exe 3frlllr.exe PID 3124 wrote to memory of 1496 3124 pjvpd.exe 3frlllr.exe PID 3124 wrote to memory of 1496 3124 pjvpd.exe 3frlllr.exe PID 1496 wrote to memory of 1532 1496 3frlllr.exe ddjpd.exe PID 1496 wrote to memory of 1532 1496 3frlllr.exe ddjpd.exe PID 1496 wrote to memory of 1532 1496 3frlllr.exe ddjpd.exe PID 1532 wrote to memory of 3432 1532 ddjpd.exe lfxffrx.exe PID 1532 wrote to memory of 3432 1532 ddjpd.exe lfxffrx.exe PID 1532 wrote to memory of 3432 1532 ddjpd.exe lfxffrx.exe PID 3432 wrote to memory of 2072 3432 lfxffrx.exe 5hhhhb.exe PID 3432 wrote to memory of 2072 3432 lfxffrx.exe 5hhhhb.exe PID 3432 wrote to memory of 2072 3432 lfxffrx.exe 5hhhhb.exe PID 2072 wrote to memory of 4008 2072 5hhhhb.exe pjjdp.exe PID 2072 wrote to memory of 4008 2072 5hhhhb.exe pjjdp.exe PID 2072 wrote to memory of 4008 2072 5hhhhb.exe pjjdp.exe PID 4008 wrote to memory of 3912 4008 pjjdp.exe frrlrlr.exe PID 4008 wrote to memory of 3912 4008 pjjdp.exe frrlrlr.exe PID 4008 wrote to memory of 3912 4008 pjjdp.exe frrlrlr.exe PID 3912 wrote to memory of 1180 3912 frrlrlr.exe lrfxxxf.exe PID 3912 wrote to memory of 1180 3912 frrlrlr.exe lrfxxxf.exe PID 3912 wrote to memory of 1180 3912 frrlrlr.exe lrfxxxf.exe PID 1180 wrote to memory of 1228 1180 lrfxxxf.exe nnnnhn.exe PID 1180 wrote to memory of 1228 1180 lrfxxxf.exe nnnnhn.exe PID 1180 wrote to memory of 1228 1180 lrfxxxf.exe nnnnhn.exe PID 1228 wrote to memory of 3320 1228 nnnnhn.exe jvddd.exe PID 1228 wrote to memory of 3320 1228 nnnnhn.exe jvddd.exe PID 1228 wrote to memory of 3320 1228 nnnnhn.exe jvddd.exe PID 3320 wrote to memory of 4648 3320 jvddd.exe ffxffff.exe PID 3320 wrote to memory of 4648 3320 jvddd.exe ffxffff.exe PID 3320 wrote to memory of 4648 3320 jvddd.exe ffxffff.exe PID 4648 wrote to memory of 1528 4648 ffxffff.exe rrlffff.exe PID 4648 wrote to memory of 1528 4648 ffxffff.exe rrlffff.exe PID 4648 wrote to memory of 1528 4648 ffxffff.exe rrlffff.exe PID 1528 wrote to memory of 4320 1528 rrlffff.exe lrrxllr.exe PID 1528 wrote to memory of 4320 1528 rrlffff.exe lrrxllr.exe PID 1528 wrote to memory of 4320 1528 rrlffff.exe lrrxllr.exe PID 4320 wrote to memory of 3500 4320 lrrxllr.exe frrlfrl.exe PID 4320 wrote to memory of 3500 4320 lrrxllr.exe frrlfrl.exe PID 4320 wrote to memory of 3500 4320 lrrxllr.exe frrlfrl.exe PID 3500 wrote to memory of 2652 3500 frrlfrl.exe lflfffx.exe PID 3500 wrote to memory of 2652 3500 frrlfrl.exe lflfffx.exe PID 3500 wrote to memory of 2652 3500 frrlfrl.exe lflfffx.exe PID 2652 wrote to memory of 1196 2652 lflfffx.exe 1bbhtn.exe PID 2652 wrote to memory of 1196 2652 lflfffx.exe 1bbhtn.exe PID 2652 wrote to memory of 1196 2652 lflfffx.exe 1bbhtn.exe PID 1196 wrote to memory of 1304 1196 1bbhtn.exe 3jjdj.exe PID 1196 wrote to memory of 1304 1196 1bbhtn.exe 3jjdj.exe PID 1196 wrote to memory of 1304 1196 1bbhtn.exe 3jjdj.exe PID 1304 wrote to memory of 3456 1304 3jjdj.exe hhhbnh.exe PID 1304 wrote to memory of 3456 1304 3jjdj.exe hhhbnh.exe PID 1304 wrote to memory of 3456 1304 3jjdj.exe hhhbnh.exe PID 3456 wrote to memory of 4640 3456 hhhbnh.exe 1jvjd.exe PID 3456 wrote to memory of 4640 3456 hhhbnh.exe 1jvjd.exe PID 3456 wrote to memory of 4640 3456 hhhbnh.exe 1jvjd.exe PID 4640 wrote to memory of 2988 4640 1jvjd.exe 9frfrrf.exe PID 4640 wrote to memory of 2988 4640 1jvjd.exe 9frfrrf.exe PID 4640 wrote to memory of 2988 4640 1jvjd.exe 9frfrrf.exe PID 2988 wrote to memory of 4488 2988 9frfrrf.exe 3hntnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21e7170dd2bd8f8622c9166693d7c8b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\21e7170dd2bd8f8622c9166693d7c8b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\7ddvd.exec:\7ddvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvpd.exec:\pjvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3frlllr.exec:\3frlllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjpd.exec:\ddjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxffrx.exec:\lfxffrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5hhhhb.exec:\5hhhhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjjdp.exec:\pjjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrlrlr.exec:\frrlrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrfxxxf.exec:\lrfxxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnnnhn.exec:\nnnnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvddd.exec:\jvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxffff.exec:\ffxffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrlffff.exec:\rrlffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrxllr.exec:\lrrxllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrlfrl.exec:\frrlfrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflfffx.exec:\lflfffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1bbhtn.exec:\1bbhtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3jjdj.exec:\3jjdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhbnh.exec:\hhhbnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1jvjd.exec:\1jvjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9frfrrf.exec:\9frfrrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3hntnh.exec:\3hntnh.exe23⤵
- Executes dropped EXE
-
\??\c:\djjvd.exec:\djjvd.exe24⤵
- Executes dropped EXE
-
\??\c:\rlfrrlx.exec:\rlfrrlx.exe25⤵
- Executes dropped EXE
-
\??\c:\bnhttn.exec:\bnhttn.exe26⤵
- Executes dropped EXE
-
\??\c:\7pjvj.exec:\7pjvj.exe27⤵
- Executes dropped EXE
-
\??\c:\fxlfrfx.exec:\fxlfrfx.exe28⤵
- Executes dropped EXE
-
\??\c:\9nhbtn.exec:\9nhbtn.exe29⤵
- Executes dropped EXE
-
\??\c:\9pjdv.exec:\9pjdv.exe30⤵
- Executes dropped EXE
-
\??\c:\rxlrfxf.exec:\rxlrfxf.exe31⤵
- Executes dropped EXE
-
\??\c:\bhhbtn.exec:\bhhbtn.exe32⤵
- Executes dropped EXE
-
\??\c:\jdjdv.exec:\jdjdv.exe33⤵
- Executes dropped EXE
-
\??\c:\bnntnb.exec:\bnntnb.exe34⤵
- Executes dropped EXE
-
\??\c:\3hhbnn.exec:\3hhbnn.exe35⤵
- Executes dropped EXE
-
\??\c:\rfrlxff.exec:\rfrlxff.exe36⤵
- Executes dropped EXE
-
\??\c:\ththht.exec:\ththht.exe37⤵
- Executes dropped EXE
-
\??\c:\thhnnh.exec:\thhnnh.exe38⤵
- Executes dropped EXE
-
\??\c:\dvjdv.exec:\dvjdv.exe39⤵
- Executes dropped EXE
-
\??\c:\7ffxrrr.exec:\7ffxrrr.exe40⤵
- Executes dropped EXE
-
\??\c:\hhbbbb.exec:\hhbbbb.exe41⤵
- Executes dropped EXE
-
\??\c:\htbntb.exec:\htbntb.exe42⤵
- Executes dropped EXE
-
\??\c:\jvvjv.exec:\jvvjv.exe43⤵
- Executes dropped EXE
-
\??\c:\xfrlxxx.exec:\xfrlxxx.exe44⤵
- Executes dropped EXE
-
\??\c:\1hhhnh.exec:\1hhhnh.exe45⤵
- Executes dropped EXE
-
\??\c:\dpjjv.exec:\dpjjv.exe46⤵
- Executes dropped EXE
-
\??\c:\1lxxrrr.exec:\1lxxrrr.exe47⤵
- Executes dropped EXE
-
\??\c:\ntthth.exec:\ntthth.exe48⤵
- Executes dropped EXE
-
\??\c:\jvvpd.exec:\jvvpd.exe49⤵
- Executes dropped EXE
-
\??\c:\rrrfxfl.exec:\rrrfxfl.exe50⤵
- Executes dropped EXE
-
\??\c:\7hbtnn.exec:\7hbtnn.exe51⤵
- Executes dropped EXE
-
\??\c:\dpjvp.exec:\dpjvp.exe52⤵
- Executes dropped EXE
-
\??\c:\thnhtt.exec:\thnhtt.exe53⤵
- Executes dropped EXE
-
\??\c:\vjdvp.exec:\vjdvp.exe54⤵
- Executes dropped EXE
-
\??\c:\9rllllr.exec:\9rllllr.exe55⤵
- Executes dropped EXE
-
\??\c:\nbbbbt.exec:\nbbbbt.exe56⤵
- Executes dropped EXE
-
\??\c:\ntnnbb.exec:\ntnnbb.exe57⤵
- Executes dropped EXE
-
\??\c:\ppjdp.exec:\ppjdp.exe58⤵
- Executes dropped EXE
-
\??\c:\btthtt.exec:\btthtt.exe59⤵
- Executes dropped EXE
-
\??\c:\ttnhtt.exec:\ttnhtt.exe60⤵
- Executes dropped EXE
-
\??\c:\jdddj.exec:\jdddj.exe61⤵
- Executes dropped EXE
-
\??\c:\9fxrlfx.exec:\9fxrlfx.exe62⤵
- Executes dropped EXE
-
\??\c:\7ttnhh.exec:\7ttnhh.exe63⤵
- Executes dropped EXE
-
\??\c:\vppjv.exec:\vppjv.exe64⤵
- Executes dropped EXE
-
\??\c:\1vpjd.exec:\1vpjd.exe65⤵
- Executes dropped EXE
-
\??\c:\lffrfll.exec:\lffrfll.exe66⤵
-
\??\c:\ntbnht.exec:\ntbnht.exe67⤵
-
\??\c:\bhhnbt.exec:\bhhnbt.exe68⤵
-
\??\c:\jdjvj.exec:\jdjvj.exe69⤵
-
\??\c:\lxfrffx.exec:\lxfrffx.exe70⤵
-
\??\c:\bntttn.exec:\bntttn.exe71⤵
-
\??\c:\dvddd.exec:\dvddd.exe72⤵
-
\??\c:\rxrlffx.exec:\rxrlffx.exe73⤵
-
\??\c:\xllfxlf.exec:\xllfxlf.exe74⤵
-
\??\c:\hbhnhh.exec:\hbhnhh.exe75⤵
-
\??\c:\vvpjj.exec:\vvpjj.exe76⤵
-
\??\c:\rrrxrrl.exec:\rrrxrrl.exe77⤵
-
\??\c:\bttnhh.exec:\bttnhh.exe78⤵
-
\??\c:\nhnnnh.exec:\nhnnnh.exe79⤵
-
\??\c:\3jpjp.exec:\3jpjp.exe80⤵
-
\??\c:\1rxfrrl.exec:\1rxfrrl.exe81⤵
-
\??\c:\3llfrrr.exec:\3llfrrr.exe82⤵
-
\??\c:\1vvvv.exec:\1vvvv.exe83⤵
-
\??\c:\ppddv.exec:\ppddv.exe84⤵
-
\??\c:\rffxrlf.exec:\rffxrlf.exe85⤵
-
\??\c:\7bthbb.exec:\7bthbb.exe86⤵
-
\??\c:\pjjvj.exec:\pjjvj.exe87⤵
-
\??\c:\lrrlrxf.exec:\lrrlrxf.exe88⤵
-
\??\c:\3hbthh.exec:\3hbthh.exe89⤵
-
\??\c:\vvdpp.exec:\vvdpp.exe90⤵
-
\??\c:\rlxxfrl.exec:\rlxxfrl.exe91⤵
-
\??\c:\tnnhhh.exec:\tnnhhh.exe92⤵
-
\??\c:\1pppv.exec:\1pppv.exe93⤵
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe94⤵
-
\??\c:\tttbnt.exec:\tttbnt.exe95⤵
-
\??\c:\1tnnbh.exec:\1tnnbh.exe96⤵
-
\??\c:\jjdjd.exec:\jjdjd.exe97⤵
-
\??\c:\xlfffll.exec:\xlfffll.exe98⤵
-
\??\c:\xfxrffl.exec:\xfxrffl.exe99⤵
-
\??\c:\nhbhtt.exec:\nhbhtt.exe100⤵
-
\??\c:\jppvp.exec:\jppvp.exe101⤵
-
\??\c:\lllflll.exec:\lllflll.exe102⤵
-
\??\c:\ttbbnn.exec:\ttbbnn.exe103⤵
-
\??\c:\btnhbn.exec:\btnhbn.exe104⤵
-
\??\c:\5jpvp.exec:\5jpvp.exe105⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe106⤵
-
\??\c:\lfxrllf.exec:\lfxrllf.exe107⤵
-
\??\c:\xrllfff.exec:\xrllfff.exe108⤵
-
\??\c:\3bhbhh.exec:\3bhbhh.exe109⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe110⤵
-
\??\c:\ppppj.exec:\ppppj.exe111⤵
-
\??\c:\1rlxxrx.exec:\1rlxxrx.exe112⤵
-
\??\c:\rlrlffx.exec:\rlrlffx.exe113⤵
-
\??\c:\5hbbhh.exec:\5hbbhh.exe114⤵
-
\??\c:\hnbtnn.exec:\hnbtnn.exe115⤵
-
\??\c:\jpvvd.exec:\jpvvd.exe116⤵
-
\??\c:\dvvpv.exec:\dvvpv.exe117⤵
-
\??\c:\flrflfl.exec:\flrflfl.exe118⤵
-
\??\c:\bnhhbh.exec:\bnhhbh.exe119⤵
-
\??\c:\dvvvj.exec:\dvvvj.exe120⤵
-
\??\c:\vjjdd.exec:\vjjdd.exe121⤵
-
\??\c:\rlrxrxx.exec:\rlrxrxx.exe122⤵
-
\??\c:\llffffx.exec:\llffffx.exe123⤵
-
\??\c:\bhhtnn.exec:\bhhtnn.exe124⤵
-
\??\c:\jvvvv.exec:\jvvvv.exe125⤵
-
\??\c:\3jjdv.exec:\3jjdv.exe126⤵
-
\??\c:\lfxfffx.exec:\lfxfffx.exe127⤵
-
\??\c:\ttbttb.exec:\ttbttb.exe128⤵
-
\??\c:\bbnnbb.exec:\bbnnbb.exe129⤵
-
\??\c:\jpppv.exec:\jpppv.exe130⤵
-
\??\c:\rfllllf.exec:\rfllllf.exe131⤵
-
\??\c:\5lrrlrr.exec:\5lrrlrr.exe132⤵
-
\??\c:\tbnnbb.exec:\tbnnbb.exe133⤵
-
\??\c:\hthhnn.exec:\hthhnn.exe134⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe135⤵
-
\??\c:\7jpjd.exec:\7jpjd.exe136⤵
-
\??\c:\xlxxxfx.exec:\xlxxxfx.exe137⤵
-
\??\c:\rrffxxr.exec:\rrffxxr.exe138⤵
-
\??\c:\hbbbtt.exec:\hbbbtt.exe139⤵
-
\??\c:\nbnhbb.exec:\nbnhbb.exe140⤵
-
\??\c:\jdppv.exec:\jdppv.exe141⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe142⤵
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe143⤵
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe144⤵
-
\??\c:\3bbbbb.exec:\3bbbbb.exe145⤵
-
\??\c:\ddpjj.exec:\ddpjj.exe146⤵
-
\??\c:\jdvpp.exec:\jdvpp.exe147⤵
-
\??\c:\lrxrlll.exec:\lrxrlll.exe148⤵
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe149⤵
-
\??\c:\nhbhhh.exec:\nhbhhh.exe150⤵
-
\??\c:\pppjj.exec:\pppjj.exe151⤵
-
\??\c:\xxflxfl.exec:\xxflxfl.exe152⤵
-
\??\c:\xrxfxll.exec:\xrxfxll.exe153⤵
-
\??\c:\ntnnhh.exec:\ntnnhh.exe154⤵
-
\??\c:\tbthnb.exec:\tbthnb.exe155⤵
-
\??\c:\dvpjv.exec:\dvpjv.exe156⤵
-
\??\c:\vdjjp.exec:\vdjjp.exe157⤵
-
\??\c:\3fxxflr.exec:\3fxxflr.exe158⤵
-
\??\c:\hbtnnh.exec:\hbtnnh.exe159⤵
-
\??\c:\hhntbh.exec:\hhntbh.exe160⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe161⤵
-
\??\c:\lflxrxf.exec:\lflxrxf.exe162⤵
-
\??\c:\hnhhht.exec:\hnhhht.exe163⤵
-
\??\c:\pjdjj.exec:\pjdjj.exe164⤵
-
\??\c:\xlfxrrx.exec:\xlfxrrx.exe165⤵
-
\??\c:\hnhtht.exec:\hnhtht.exe166⤵
-
\??\c:\nhhnbn.exec:\nhhnbn.exe167⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe168⤵
-
\??\c:\rxffrff.exec:\rxffrff.exe169⤵
-
\??\c:\tnnhhh.exec:\tnnhhh.exe170⤵
-
\??\c:\hbbbbh.exec:\hbbbbh.exe171⤵
-
\??\c:\dddjd.exec:\dddjd.exe172⤵
-
\??\c:\9xrrlrf.exec:\9xrrlrf.exe173⤵
-
\??\c:\ththtn.exec:\ththtn.exe174⤵
-
\??\c:\jjdpp.exec:\jjdpp.exe175⤵
-
\??\c:\pjjvp.exec:\pjjvp.exe176⤵
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe177⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe178⤵
-
\??\c:\jvjdd.exec:\jvjdd.exe179⤵
-
\??\c:\7xrrlrr.exec:\7xrrlrr.exe180⤵
-
\??\c:\btbtbh.exec:\btbtbh.exe181⤵
-
\??\c:\djjdv.exec:\djjdv.exe182⤵
-
\??\c:\pjvdv.exec:\pjvdv.exe183⤵
-
\??\c:\3lllfll.exec:\3lllfll.exe184⤵
-
\??\c:\nntbtb.exec:\nntbtb.exe185⤵
-
\??\c:\vdvpp.exec:\vdvpp.exe186⤵
-
\??\c:\lxrllxx.exec:\lxrllxx.exe187⤵
-
\??\c:\rlllrrx.exec:\rlllrrx.exe188⤵
-
\??\c:\ttbbbn.exec:\ttbbbn.exe189⤵
-
\??\c:\jvddd.exec:\jvddd.exe190⤵
-
\??\c:\3pddd.exec:\3pddd.exe191⤵
-
\??\c:\nbnhbb.exec:\nbnhbb.exe192⤵
-
\??\c:\btbbbb.exec:\btbbbb.exe193⤵
-
\??\c:\ddddd.exec:\ddddd.exe194⤵
-
\??\c:\7fffrrr.exec:\7fffrrr.exe195⤵
-
\??\c:\hthhtt.exec:\hthhtt.exe196⤵
-
\??\c:\bbhnnt.exec:\bbhnnt.exe197⤵
-
\??\c:\djjjj.exec:\djjjj.exe198⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe199⤵
-
\??\c:\rffxrlf.exec:\rffxrlf.exe200⤵
-
\??\c:\9hntbb.exec:\9hntbb.exe201⤵
-
\??\c:\3vpdv.exec:\3vpdv.exe202⤵
-
\??\c:\llffxxr.exec:\llffxxr.exe203⤵
-
\??\c:\7rxfxxx.exec:\7rxfxxx.exe204⤵
-
\??\c:\bhbbbb.exec:\bhbbbb.exe205⤵
-
\??\c:\hbntbn.exec:\hbntbn.exe206⤵
-
\??\c:\jpppv.exec:\jpppv.exe207⤵
-
\??\c:\fxxrrrx.exec:\fxxrrrx.exe208⤵
-
\??\c:\llrrlxr.exec:\llrrlxr.exe209⤵
-
\??\c:\bnbnbh.exec:\bnbnbh.exe210⤵
-
\??\c:\hhttnn.exec:\hhttnn.exe211⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe212⤵
-
\??\c:\dpdvv.exec:\dpdvv.exe213⤵
-
\??\c:\rrrllll.exec:\rrrllll.exe214⤵
-
\??\c:\nthnnt.exec:\nthnnt.exe215⤵
-
\??\c:\bnntnb.exec:\bnntnb.exe216⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe217⤵
-
\??\c:\rllxxxx.exec:\rllxxxx.exe218⤵
-
\??\c:\fxxxrfr.exec:\fxxxrfr.exe219⤵
-
\??\c:\tnnbhh.exec:\tnnbhh.exe220⤵
-
\??\c:\ddddd.exec:\ddddd.exe221⤵
-
\??\c:\3djdd.exec:\3djdd.exe222⤵
-
\??\c:\frffflf.exec:\frffflf.exe223⤵
-
\??\c:\ttttnb.exec:\ttttnb.exe224⤵
-
\??\c:\btnbnt.exec:\btnbnt.exe225⤵
-
\??\c:\7jvdd.exec:\7jvdd.exe226⤵
-
\??\c:\jvddv.exec:\jvddv.exe227⤵
-
\??\c:\7rffrrr.exec:\7rffrrr.exe228⤵
-
\??\c:\nttttt.exec:\nttttt.exe229⤵
-
\??\c:\nntttb.exec:\nntttb.exe230⤵
-
\??\c:\vddjv.exec:\vddjv.exe231⤵
-
\??\c:\xflllrr.exec:\xflllrr.exe232⤵
-
\??\c:\3tbbbb.exec:\3tbbbb.exe233⤵
-
\??\c:\dvpvp.exec:\dvpvp.exe234⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe235⤵
-
\??\c:\llxxxrf.exec:\llxxxrf.exe236⤵
-
\??\c:\hnhhhh.exec:\hnhhhh.exe237⤵
-
\??\c:\5bbtbb.exec:\5bbtbb.exe238⤵
-
\??\c:\pdddp.exec:\pdddp.exe239⤵
-
\??\c:\lfflflf.exec:\lfflflf.exe240⤵
-
\??\c:\5fllfll.exec:\5fllfll.exe241⤵