Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 18:03
Behavioral task
behavioral1
Sample
06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe
-
Size
253KB
-
MD5
06aa51bee03cf4ec44c597248f9a7c40
-
SHA1
7baf638a17b10460be29ef1df2769e18e154160c
-
SHA256
f6d0f1845435dce3ad821655a27df61a39133467c2d7ca18004d3af727da888c
-
SHA512
efcc28ce20fc7ff9ea177ef9ee220ba0ac23bcd44ba2cb5286265d98642cbdfa8b718e76506f293a38da0fa290da2592e9d2284d3972505b708a7aa8bce85751
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+THkS:ccm4FmowdHoSi9EIBftapTs4WZazeES
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3120-0-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3988-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2492-18-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4012-19-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3424-25-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2296-35-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4716-42-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1212-51-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2608-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1808-58-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3140-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4248-72-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3280-77-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4508-83-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4560-85-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4300-95-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/540-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1448-107-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2104-109-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3720-114-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4084-124-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4668-129-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4064-133-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2448-151-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4276-157-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/676-163-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1940-172-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3324-183-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4976-194-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3452-198-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/384-202-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3732-215-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4440-219-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/632-230-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3748-234-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4588-245-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/752-263-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3752-268-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2720-271-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2776-277-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/864-278-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2028-294-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3712-305-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4372-311-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3584-315-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1072-338-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4464-343-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2168-362-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3668-366-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3332-385-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2516-404-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5076-424-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4972-454-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4696-543-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1636-562-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4676-598-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1448-656-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3712-660-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3456-714-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2100-721-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4432-740-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3712-849-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2104-855-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2548-1025-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x00090000000233fd-4.dat family_berbew behavioral2/files/0x0008000000023417-9.dat family_berbew behavioral2/files/0x0007000000023418-13.dat family_berbew behavioral2/files/0x0007000000023419-22.dat family_berbew behavioral2/files/0x000700000002341a-28.dat family_berbew behavioral2/files/0x000700000002341b-36.dat family_berbew behavioral2/files/0x000700000002341c-40.dat family_berbew behavioral2/files/0x000700000002341d-47.dat family_berbew behavioral2/files/0x000700000002341e-54.dat family_berbew behavioral2/files/0x000700000002341f-60.dat family_berbew behavioral2/files/0x0007000000023420-65.dat family_berbew behavioral2/files/0x0007000000023421-71.dat family_berbew behavioral2/files/0x0007000000023422-76.dat family_berbew behavioral2/files/0x0007000000023423-81.dat family_berbew behavioral2/files/0x0007000000023424-88.dat family_berbew behavioral2/files/0x0007000000023425-93.dat family_berbew behavioral2/files/0x0008000000023415-101.dat family_berbew behavioral2/files/0x0007000000023426-104.dat family_berbew behavioral2/files/0x0007000000023427-111.dat family_berbew behavioral2/files/0x0007000000023428-117.dat family_berbew behavioral2/files/0x0007000000023429-123.dat family_berbew behavioral2/files/0x000700000002342a-130.dat family_berbew behavioral2/files/0x000700000002342b-135.dat family_berbew behavioral2/files/0x000700000002342c-140.dat family_berbew behavioral2/files/0x000700000002342d-145.dat family_berbew behavioral2/files/0x000700000002342e-152.dat family_berbew behavioral2/files/0x000700000002342f-158.dat family_berbew behavioral2/files/0x0007000000023430-164.dat family_berbew behavioral2/files/0x0007000000023431-168.dat family_berbew behavioral2/files/0x0007000000023432-174.dat family_berbew behavioral2/files/0x0007000000023433-179.dat family_berbew behavioral2/files/0x0007000000023434-185.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 3988 llfxxrr.exe 2492 nhttnn.exe 4012 fxrxrrr.exe 3424 5xlfxxr.exe 2296 tbnhbt.exe 4716 tnnhhh.exe 2608 vjvpj.exe 1212 frrrlxx.exe 1808 tbnhbn.exe 3140 1ddvv.exe 4248 nbtnhb.exe 3280 jdppp.exe 4508 bnbnhn.exe 4560 lxlflff.exe 4300 nhnhtt.exe 540 rxfxrrl.exe 1448 bntnhh.exe 2104 3llxfxr.exe 3720 bhbbhn.exe 4084 pjvvd.exe 4668 hbnhnn.exe 4064 9jvpp.exe 2572 3flfxxr.exe 1072 bbnnhn.exe 2448 xlxrlll.exe 4276 nbhhbb.exe 676 jjjvp.exe 2300 tnbthh.exe 1940 nhnntt.exe 3188 xlffrrr.exe 3324 1hnnhh.exe 1392 5jdvp.exe 4976 llxrxxf.exe 3452 1hnhhn.exe 384 5pvvv.exe 736 1rxxxlf.exe 2884 lllffff.exe 4600 hthnbn.exe 1636 dvdvv.exe 3732 dddpd.exe 4440 flllfxr.exe 3480 nhbtnn.exe 632 7pvdv.exe 3748 lllflll.exe 4228 ffrflrl.exe 5024 htbhth.exe 5076 vjvvj.exe 4588 flflfxx.exe 4548 nhhhhh.exe 1580 thtnhh.exe 3232 ppppv.exe 536 vjvvp.exe 752 3rxrfrl.exe 2924 nhtnbt.exe 3752 htbbtb.exe 2720 ddvvp.exe 2776 lxrlxll.exe 864 nbhhbb.exe 5100 ttbtnh.exe 3692 pvjdv.exe 1904 xrfxrll.exe 4636 xffxlfx.exe 2028 bnhbtt.exe 2212 dvjjj.exe -
resource yara_rule behavioral2/memory/3120-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00090000000233fd-4.dat upx behavioral2/memory/3988-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023417-9.dat upx behavioral2/memory/2492-12-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023418-13.dat upx behavioral2/memory/2492-18-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023419-22.dat upx behavioral2/memory/4012-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3424-25-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341a-28.dat upx behavioral2/memory/2296-30-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341b-36.dat upx behavioral2/memory/2296-35-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341c-40.dat upx behavioral2/memory/2608-44-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4716-42-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341d-47.dat upx behavioral2/memory/1212-51-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2608-50-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341e-54.dat upx behavioral2/memory/1808-58-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341f-60.dat upx behavioral2/files/0x0007000000023420-65.dat upx behavioral2/memory/3140-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4248-68-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4248-72-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023421-71.dat upx behavioral2/memory/3280-77-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023422-76.dat upx behavioral2/files/0x0007000000023423-81.dat upx behavioral2/memory/4508-83-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023424-88.dat upx behavioral2/memory/4560-85-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4300-95-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023425-93.dat upx behavioral2/memory/540-99-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023415-101.dat upx behavioral2/files/0x0007000000023426-104.dat upx behavioral2/memory/1448-107-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2104-109-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023427-111.dat upx behavioral2/memory/3720-114-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023428-117.dat upx behavioral2/files/0x0007000000023429-123.dat upx behavioral2/memory/4084-124-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4668-129-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342a-130.dat upx behavioral2/memory/4064-133-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342b-135.dat upx behavioral2/files/0x000700000002342c-140.dat upx behavioral2/files/0x000700000002342d-145.dat upx behavioral2/files/0x000700000002342e-152.dat upx behavioral2/memory/2448-151-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342f-158.dat upx behavioral2/memory/4276-157-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/676-163-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023430-164.dat upx behavioral2/files/0x0007000000023431-168.dat upx behavioral2/memory/1940-172-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023432-174.dat upx behavioral2/files/0x0007000000023433-179.dat upx behavioral2/memory/3324-183-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023434-185.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3120 wrote to memory of 3988 3120 06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe 81 PID 3120 wrote to memory of 3988 3120 06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe 81 PID 3120 wrote to memory of 3988 3120 06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe 81 PID 3988 wrote to memory of 2492 3988 llfxxrr.exe 82 PID 3988 wrote to memory of 2492 3988 llfxxrr.exe 82 PID 3988 wrote to memory of 2492 3988 llfxxrr.exe 82 PID 2492 wrote to memory of 4012 2492 nhttnn.exe 83 PID 2492 wrote to memory of 4012 2492 nhttnn.exe 83 PID 2492 wrote to memory of 4012 2492 nhttnn.exe 83 PID 4012 wrote to memory of 3424 4012 fxrxrrr.exe 84 PID 4012 wrote to memory of 3424 4012 fxrxrrr.exe 84 PID 4012 wrote to memory of 3424 4012 fxrxrrr.exe 84 PID 3424 wrote to memory of 2296 3424 5xlfxxr.exe 86 PID 3424 wrote to memory of 2296 3424 5xlfxxr.exe 86 PID 3424 wrote to memory of 2296 3424 5xlfxxr.exe 86 PID 2296 wrote to memory of 4716 2296 tbnhbt.exe 88 PID 2296 wrote to memory of 4716 2296 tbnhbt.exe 88 PID 2296 wrote to memory of 4716 2296 tbnhbt.exe 88 PID 4716 wrote to memory of 2608 4716 tnnhhh.exe 89 PID 4716 wrote to memory of 2608 4716 tnnhhh.exe 89 PID 4716 wrote to memory of 2608 4716 tnnhhh.exe 89 PID 2608 wrote to memory of 1212 2608 vjvpj.exe 91 PID 2608 wrote to memory of 1212 2608 vjvpj.exe 91 PID 2608 wrote to memory of 1212 2608 vjvpj.exe 91 PID 1212 wrote to memory of 1808 1212 frrrlxx.exe 92 PID 1212 wrote to memory of 1808 1212 frrrlxx.exe 92 PID 1212 wrote to memory of 1808 1212 frrrlxx.exe 92 PID 1808 wrote to memory of 3140 1808 tbnhbn.exe 93 PID 1808 wrote to memory of 3140 1808 tbnhbn.exe 93 PID 1808 wrote to memory of 3140 1808 tbnhbn.exe 93 PID 3140 wrote to memory of 4248 3140 1ddvv.exe 94 PID 3140 wrote to memory of 4248 3140 1ddvv.exe 94 PID 3140 wrote to memory of 4248 3140 1ddvv.exe 94 PID 4248 wrote to memory of 3280 4248 nbtnhb.exe 95 PID 4248 wrote to memory of 3280 4248 nbtnhb.exe 95 PID 4248 wrote to memory of 3280 4248 nbtnhb.exe 95 PID 3280 wrote to memory of 4508 3280 jdppp.exe 96 PID 3280 wrote to memory of 4508 3280 jdppp.exe 96 PID 3280 wrote to memory of 4508 3280 jdppp.exe 96 PID 4508 wrote to memory of 4560 4508 bnbnhn.exe 97 PID 4508 wrote to memory of 4560 4508 bnbnhn.exe 97 PID 4508 wrote to memory of 4560 4508 bnbnhn.exe 97 PID 4560 wrote to memory of 4300 4560 lxlflff.exe 98 PID 4560 wrote to memory of 4300 4560 lxlflff.exe 98 PID 4560 wrote to memory of 4300 4560 lxlflff.exe 98 PID 4300 wrote to memory of 540 4300 nhnhtt.exe 99 PID 4300 wrote to memory of 540 4300 nhnhtt.exe 99 PID 4300 wrote to memory of 540 4300 nhnhtt.exe 99 PID 540 wrote to memory of 1448 540 rxfxrrl.exe 100 PID 540 wrote to memory of 1448 540 rxfxrrl.exe 100 PID 540 wrote to memory of 1448 540 rxfxrrl.exe 100 PID 1448 wrote to memory of 2104 1448 bntnhh.exe 101 PID 1448 wrote to memory of 2104 1448 bntnhh.exe 101 PID 1448 wrote to memory of 2104 1448 bntnhh.exe 101 PID 2104 wrote to memory of 3720 2104 3llxfxr.exe 102 PID 2104 wrote to memory of 3720 2104 3llxfxr.exe 102 PID 2104 wrote to memory of 3720 2104 3llxfxr.exe 102 PID 3720 wrote to memory of 4084 3720 bhbbhn.exe 103 PID 3720 wrote to memory of 4084 3720 bhbbhn.exe 103 PID 3720 wrote to memory of 4084 3720 bhbbhn.exe 103 PID 4084 wrote to memory of 4668 4084 pjvvd.exe 104 PID 4084 wrote to memory of 4668 4084 pjvvd.exe 104 PID 4084 wrote to memory of 4668 4084 pjvvd.exe 104 PID 4668 wrote to memory of 4064 4668 hbnhnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06aa51bee03cf4ec44c597248f9a7c40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\llfxxrr.exec:\llfxxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\nhttnn.exec:\nhttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\fxrxrrr.exec:\fxrxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\5xlfxxr.exec:\5xlfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\tbnhbt.exec:\tbnhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\tnnhhh.exec:\tnnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\vjvpj.exec:\vjvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\frrrlxx.exec:\frrrlxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\tbnhbn.exec:\tbnhbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\1ddvv.exec:\1ddvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\nbtnhb.exec:\nbtnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\jdppp.exec:\jdppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\bnbnhn.exec:\bnbnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\lxlflff.exec:\lxlflff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\nhnhtt.exec:\nhnhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\bntnhh.exec:\bntnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\3llxfxr.exec:\3llxfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\bhbbhn.exec:\bhbbhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\pjvvd.exec:\pjvvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\hbnhnn.exec:\hbnhnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\9jvpp.exec:\9jvpp.exe23⤵
- Executes dropped EXE
PID:4064 -
\??\c:\3flfxxr.exec:\3flfxxr.exe24⤵
- Executes dropped EXE
PID:2572 -
\??\c:\bbnnhn.exec:\bbnnhn.exe25⤵
- Executes dropped EXE
PID:1072 -
\??\c:\xlxrlll.exec:\xlxrlll.exe26⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nbhhbb.exec:\nbhhbb.exe27⤵
- Executes dropped EXE
PID:4276 -
\??\c:\jjjvp.exec:\jjjvp.exe28⤵
- Executes dropped EXE
PID:676 -
\??\c:\tnbthh.exec:\tnbthh.exe29⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nhnntt.exec:\nhnntt.exe30⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xlffrrr.exec:\xlffrrr.exe31⤵
- Executes dropped EXE
PID:3188 -
\??\c:\1hnnhh.exec:\1hnnhh.exe32⤵
- Executes dropped EXE
PID:3324 -
\??\c:\5jdvp.exec:\5jdvp.exe33⤵
- Executes dropped EXE
PID:1392 -
\??\c:\llxrxxf.exec:\llxrxxf.exe34⤵
- Executes dropped EXE
PID:4976 -
\??\c:\1hnhhn.exec:\1hnhhn.exe35⤵
- Executes dropped EXE
PID:3452 -
\??\c:\5pvvv.exec:\5pvvv.exe36⤵
- Executes dropped EXE
PID:384 -
\??\c:\1rxxxlf.exec:\1rxxxlf.exe37⤵
- Executes dropped EXE
PID:736 -
\??\c:\lllffff.exec:\lllffff.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hthnbn.exec:\hthnbn.exe39⤵
- Executes dropped EXE
PID:4600 -
\??\c:\dvdvv.exec:\dvdvv.exe40⤵
- Executes dropped EXE
PID:1636 -
\??\c:\dddpd.exec:\dddpd.exe41⤵
- Executes dropped EXE
PID:3732 -
\??\c:\flllfxr.exec:\flllfxr.exe42⤵
- Executes dropped EXE
PID:4440 -
\??\c:\htbbbb.exec:\htbbbb.exe43⤵PID:2684
-
\??\c:\nhbtnn.exec:\nhbtnn.exe44⤵
- Executes dropped EXE
PID:3480 -
\??\c:\7pvdv.exec:\7pvdv.exe45⤵
- Executes dropped EXE
PID:632 -
\??\c:\lllflll.exec:\lllflll.exe46⤵
- Executes dropped EXE
PID:3748 -
\??\c:\ffrflrl.exec:\ffrflrl.exe47⤵
- Executes dropped EXE
PID:4228 -
\??\c:\htbhth.exec:\htbhth.exe48⤵
- Executes dropped EXE
PID:5024 -
\??\c:\vjvvj.exec:\vjvvj.exe49⤵
- Executes dropped EXE
PID:5076 -
\??\c:\flflfxx.exec:\flflfxx.exe50⤵
- Executes dropped EXE
PID:4588 -
\??\c:\nhhhhh.exec:\nhhhhh.exe51⤵
- Executes dropped EXE
PID:4548 -
\??\c:\thtnhh.exec:\thtnhh.exe52⤵
- Executes dropped EXE
PID:1580 -
\??\c:\ppppv.exec:\ppppv.exe53⤵
- Executes dropped EXE
PID:3232 -
\??\c:\vjvvp.exec:\vjvvp.exe54⤵
- Executes dropped EXE
PID:536 -
\??\c:\3rxrfrl.exec:\3rxrfrl.exe55⤵
- Executes dropped EXE
PID:752 -
\??\c:\nhtnbt.exec:\nhtnbt.exe56⤵
- Executes dropped EXE
PID:2924 -
\??\c:\htbbtb.exec:\htbbtb.exe57⤵
- Executes dropped EXE
PID:3752 -
\??\c:\ddvvp.exec:\ddvvp.exe58⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lxrlxll.exec:\lxrlxll.exe59⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nbhhbb.exec:\nbhhbb.exe60⤵
- Executes dropped EXE
PID:864 -
\??\c:\ttbtnh.exec:\ttbtnh.exe61⤵
- Executes dropped EXE
PID:5100 -
\??\c:\pvjdv.exec:\pvjdv.exe62⤵
- Executes dropped EXE
PID:3692 -
\??\c:\xrfxrll.exec:\xrfxrll.exe63⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xffxlfx.exec:\xffxlfx.exe64⤵
- Executes dropped EXE
PID:4636 -
\??\c:\bnhbtt.exec:\bnhbtt.exe65⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dvjjj.exec:\dvjjj.exe66⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vjppd.exec:\vjppd.exe67⤵PID:2192
-
\??\c:\7lxlxrl.exec:\7lxlxrl.exe68⤵PID:3712
-
\??\c:\bnbbbb.exec:\bnbbbb.exe69⤵PID:4372
-
\??\c:\pvdvp.exec:\pvdvp.exe70⤵PID:3584
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe71⤵PID:2704
-
\??\c:\rrlfffx.exec:\rrlfffx.exe72⤵PID:1932
-
\??\c:\nnbttt.exec:\nnbttt.exe73⤵PID:4828
-
\??\c:\vvjjp.exec:\vvjjp.exe74⤵PID:2744
-
\??\c:\fllrrxr.exec:\fllrrxr.exe75⤵PID:5040
-
\??\c:\hhttbb.exec:\hhttbb.exe76⤵PID:4744
-
\??\c:\bhhbnn.exec:\bhhbnn.exe77⤵PID:1072
-
\??\c:\ddpjj.exec:\ddpjj.exe78⤵PID:744
-
\??\c:\lfrrlrl.exec:\lfrrlrl.exe79⤵PID:4464
-
\??\c:\hbtntt.exec:\hbtntt.exe80⤵PID:4460
-
\??\c:\dvddv.exec:\dvddv.exe81⤵PID:2536
-
\??\c:\ppjpv.exec:\ppjpv.exe82⤵PID:3200
-
\??\c:\frrllff.exec:\frrllff.exe83⤵PID:4968
-
\??\c:\htbhnn.exec:\htbhnn.exe84⤵PID:1368
-
\??\c:\bntnbb.exec:\bntnbb.exe85⤵PID:2168
-
\??\c:\pdjjj.exec:\pdjjj.exe86⤵PID:3668
-
\??\c:\ffrrxff.exec:\ffrrxff.exe87⤵PID:4056
-
\??\c:\7vjdv.exec:\7vjdv.exe88⤵PID:1144
-
\??\c:\frxrllf.exec:\frxrllf.exe89⤵PID:2156
-
\??\c:\lfllfff.exec:\lfllfff.exe90⤵PID:2076
-
\??\c:\nbhnhh.exec:\nbhnhh.exe91⤵PID:3332
-
\??\c:\vdpjd.exec:\vdpjd.exe92⤵PID:3792
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe93⤵PID:4044
-
\??\c:\nntbhn.exec:\nntbhn.exe94⤵PID:316
-
\??\c:\ntbbbt.exec:\ntbbbt.exe95⤵PID:4360
-
\??\c:\jvvvp.exec:\jvvvp.exe96⤵PID:4568
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe97⤵PID:2516
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe98⤵PID:2452
-
\??\c:\5nnhbh.exec:\5nnhbh.exe99⤵PID:2404
-
\??\c:\vjppj.exec:\vjppj.exe100⤵PID:4864
-
\??\c:\3pvpj.exec:\3pvpj.exe101⤵PID:1540
-
\??\c:\llxlffx.exec:\llxlffx.exe102⤵PID:1584
-
\??\c:\bbbbbb.exec:\bbbbbb.exe103⤵PID:3132
-
\??\c:\tnbtht.exec:\tnbtht.exe104⤵PID:5076
-
\??\c:\1jddv.exec:\1jddv.exe105⤵PID:3660
-
\??\c:\1llfxrr.exec:\1llfxrr.exe106⤵PID:544
-
\??\c:\flffrlx.exec:\flffrlx.exe107⤵PID:3232
-
\??\c:\9nbhnn.exec:\9nbhnn.exe108⤵PID:4216
-
\??\c:\bthhbb.exec:\bthhbb.exe109⤵PID:4436
-
\??\c:\jjvvd.exec:\jjvvd.exe110⤵PID:1808
-
\??\c:\lllfffx.exec:\lllfffx.exe111⤵PID:3140
-
\??\c:\bhntnn.exec:\bhntnn.exe112⤵PID:4248
-
\??\c:\hbnnnn.exec:\hbnnnn.exe113⤵PID:4972
-
\??\c:\vpdvp.exec:\vpdvp.exe114⤵PID:5068
-
\??\c:\xxffxxr.exec:\xxffxxr.exe115⤵PID:4508
-
\??\c:\fxfxlff.exec:\fxfxlff.exe116⤵PID:4692
-
\??\c:\hntnnt.exec:\hntnnt.exe117⤵PID:3488
-
\??\c:\hhhhbb.exec:\hhhhbb.exe118⤵PID:2312
-
\??\c:\jjvpp.exec:\jjvpp.exe119⤵PID:3256
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe120⤵PID:2752
-
\??\c:\flrrllf.exec:\flrrllf.exe121⤵PID:1660
-
\??\c:\tthhtb.exec:\tthhtb.exe122⤵PID:2104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-