Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 23:42
Behavioral task
behavioral1
Sample
27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe
-
Size
321KB
-
MD5
27d90fdad1f97a0138be4dd3f4eb4820
-
SHA1
a71a2742e5b3a4c678a792f20e52e4cab802e3dc
-
SHA256
eb51e323d080a602749b70160604e0f101ac3684ce1d3aab3643ede16a0adf3b
-
SHA512
eeaa41e86bbc9455369c849d414fe307329178904a6516777a2920537155ac659e135fad64d902bcae37d85e802ed25a68d3cb521ff70cd5d31cd8efbdbae1e7
-
SSDEEP
6144:9cm4FmowdHoSZrv9AEa3F2Y9iE9mJrtMsQBcqNLq3xk:/4wFHoSB969P9mJRMsfqV2K
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/5116-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3304-15-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4444-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3368-27-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3148-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4556-38-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5008-40-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/776-53-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1344-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1444-63-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3724-73-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5060-86-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4292-91-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4200-93-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2712-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1264-105-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2508-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3616-114-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4304-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2700-133-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3384-140-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4080-146-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4808-162-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4840-163-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1612-175-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/920-187-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2156-191-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3968-186-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4244-201-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/408-198-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4484-210-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1824-214-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4624-225-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4444-232-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2872-241-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4780-245-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2132-250-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1396-264-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4544-260-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4880-237-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/384-271-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3612-275-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5048-274-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2564-286-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2980-295-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4380-330-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2248-337-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2820-341-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/528-345-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1740-352-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1032-374-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3304-378-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1120-394-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3612-434-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4312-448-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3648-455-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2276-493-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3024-533-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3472-573-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2724-721-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/440-752-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/372-756-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4080-845-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1900-959-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\dpvpj.exe family_berbew \??\c:\tnbhnb.exe family_berbew \??\c:\vvjdp.exe family_berbew \??\c:\xfllrrl.exe family_berbew \??\c:\lxfxlxx.exe family_berbew \??\c:\pdppp.exe family_berbew \??\c:\lxffffr.exe family_berbew \??\c:\vvjdj.exe family_berbew C:\1lrllxx.exe family_berbew \??\c:\xfxxxff.exe family_berbew \??\c:\pjjjd.exe family_berbew \??\c:\bthbbb.exe family_berbew \??\c:\rfxxxff.exe family_berbew \??\c:\htttnn.exe family_berbew C:\5pjjp.exe family_berbew C:\nhhnnn.exe family_berbew \??\c:\rlrrllr.exe family_berbew \??\c:\7frlffx.exe family_berbew C:\1jpdv.exe family_berbew \??\c:\lffxxrl.exe family_berbew \??\c:\bbhnnb.exe family_berbew \??\c:\rllfxfx.exe family_berbew \??\c:\tbhttb.exe family_berbew C:\rxlfxrf.exe family_berbew \??\c:\7hnhbb.exe family_berbew \??\c:\vpvpp.exe family_berbew \??\c:\ttbhtn.exe family_berbew C:\pdppd.exe family_berbew C:\fxrrfxr.exe family_berbew \??\c:\rrlrfrf.exe family_berbew \??\c:\xrlfrrx.exe family_berbew \??\c:\fxxlrxl.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
dpvpj.exexfllrrl.exetnbhnb.exevvjdp.exelxfxlxx.exepdppp.exelxffffr.exevvjdj.exe1lrllxx.exepjjjd.exexfxxxff.exebthbbb.exerfxxxff.exehtttnn.exe5pjjp.exenhhnnn.exerlrrllr.exe7frlffx.exe1jpdv.exelffxxrl.exebbhnnb.exerllfxfx.exetbhttb.exerxlfxrf.exe7hnhbb.exevpvpp.exefxxlrxl.exettbhtn.exexrlfrrx.exerrlrfrf.exepdppd.exefxrrfxr.exedvvpj.exerlflrxl.exedpjdj.exexlllxrr.exebtnntb.exevvdvj.exedvjvp.exexxrrllf.exetnnnnt.exevvpjp.exerrfffff.exenhnbnh.exedvjjd.exevpdjj.exerxffrfr.exe9hnnhn.exevpvpp.exejjdvp.exeflffffl.exebhthbb.exe7ttnnn.exejvvpp.exexrffxff.exerlrfxfx.exetthhbb.exepvjjj.exerxrxrlx.exerrxlfrr.exe7thbbb.exedvjvp.exeddppj.exellrrrrr.exepid process 3304 dpvpj.exe 3148 xfllrrl.exe 3368 tnbhnb.exe 4444 vvjdp.exe 4556 lxfxlxx.exe 5008 pdppp.exe 1344 lxffffr.exe 776 vvjdj.exe 1444 1lrllxx.exe 5104 pjjjd.exe 3724 xfxxxff.exe 780 bthbbb.exe 5060 rfxxxff.exe 4292 htttnn.exe 4200 5pjjp.exe 2712 nhhnnn.exe 1264 rlrrllr.exe 3616 7frlffx.exe 2508 1jpdv.exe 4304 lffxxrl.exe 2700 bbhnnb.exe 3384 rllfxfx.exe 1548 tbhttb.exe 4080 rxlfxrf.exe 4372 7hnhbb.exe 4808 vpvpp.exe 4840 fxxlrxl.exe 1612 ttbhtn.exe 1640 xrlfrrx.exe 3968 rrlrfrf.exe 920 pdppd.exe 2156 fxrrfxr.exe 4244 dvvpj.exe 408 rlflrxl.exe 636 dpjdj.exe 4484 xlllxrr.exe 1824 btnntb.exe 620 vvdvj.exe 1908 dvjvp.exe 4624 xxrrllf.exe 3128 tnnnnt.exe 4444 vvpjp.exe 4880 rrfffff.exe 2872 nhnbnh.exe 4780 dvjjd.exe 2132 vpdjj.exe 4804 rxffrfr.exe 4888 9hnnhn.exe 4544 vpvpp.exe 1396 jjdvp.exe 1644 flffffl.exe 384 bhthbb.exe 5048 7ttnnn.exe 3612 jvvpp.exe 4792 xrffxff.exe 1092 rlrfxfx.exe 2564 tthhbb.exe 1036 pvjjj.exe 2980 rxrxrlx.exe 2648 rrxlfrr.exe 3516 7thbbb.exe 3208 dvjvp.exe 1104 ddppj.exe 2112 llrrrrr.exe -
Processes:
resource yara_rule behavioral2/memory/5116-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5116-5-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dpvpj.exe upx behavioral2/memory/3304-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3304-15-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3368-20-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\tnbhnb.exe upx \??\c:\vvjdp.exe upx behavioral2/memory/4444-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3368-27-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3148-12-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\xfllrrl.exe upx behavioral2/memory/4556-33-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lxfxlxx.exe upx \??\c:\pdppp.exe upx behavioral2/memory/4556-38-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5008-40-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lxffffr.exe upx \??\c:\vvjdj.exe upx behavioral2/memory/776-53-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1344-50-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\1lrllxx.exe upx \??\c:\xfxxxff.exe upx behavioral2/memory/3724-68-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1444-63-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\pjjjd.exe upx behavioral2/memory/3724-73-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\bthbbb.exe upx behavioral2/memory/780-75-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rfxxxff.exe upx behavioral2/memory/5060-86-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\htttnn.exe upx C:\5pjjp.exe upx behavioral2/memory/4292-91-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4200-93-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nhhnnn.exe upx behavioral2/memory/2712-99-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rlrrllr.exe upx behavioral2/memory/1264-105-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7frlffx.exe upx C:\1jpdv.exe upx behavioral2/memory/2508-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3616-114-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lffxxrl.exe upx behavioral2/memory/4304-122-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\bbhnnb.exe upx \??\c:\rllfxfx.exe upx behavioral2/memory/2700-133-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3384-140-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\tbhttb.exe upx C:\rxlfxrf.exe upx behavioral2/memory/4080-146-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7hnhbb.exe upx \??\c:\vpvpp.exe upx behavioral2/memory/4808-162-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4840-163-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\ttbhtn.exe upx behavioral2/memory/1612-175-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pdppd.exe upx behavioral2/memory/920-187-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxrrfxr.exe upx behavioral2/memory/2156-191-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3968-186-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rrlrfrf.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exedpvpj.exexfllrrl.exetnbhnb.exevvjdp.exelxfxlxx.exepdppp.exelxffffr.exevvjdj.exe1lrllxx.exepjjjd.exexfxxxff.exebthbbb.exerfxxxff.exehtttnn.exe5pjjp.exenhhnnn.exerlrrllr.exe7frlffx.exe1jpdv.exelffxxrl.exebbhnnb.exedescription pid process target process PID 5116 wrote to memory of 3304 5116 27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe 3bnntb.exe PID 5116 wrote to memory of 3304 5116 27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe 3bnntb.exe PID 5116 wrote to memory of 3304 5116 27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe 3bnntb.exe PID 3304 wrote to memory of 3148 3304 dpvpj.exe xfllrrl.exe PID 3304 wrote to memory of 3148 3304 dpvpj.exe xfllrrl.exe PID 3304 wrote to memory of 3148 3304 dpvpj.exe xfllrrl.exe PID 3148 wrote to memory of 3368 3148 xfllrrl.exe tnbhnb.exe PID 3148 wrote to memory of 3368 3148 xfllrrl.exe tnbhnb.exe PID 3148 wrote to memory of 3368 3148 xfllrrl.exe tnbhnb.exe PID 3368 wrote to memory of 4444 3368 tnbhnb.exe vvpjp.exe PID 3368 wrote to memory of 4444 3368 tnbhnb.exe vvpjp.exe PID 3368 wrote to memory of 4444 3368 tnbhnb.exe vvpjp.exe PID 4444 wrote to memory of 4556 4444 vvjdp.exe lxfxlxx.exe PID 4444 wrote to memory of 4556 4444 vvjdp.exe lxfxlxx.exe PID 4444 wrote to memory of 4556 4444 vvjdp.exe lxfxlxx.exe PID 4556 wrote to memory of 5008 4556 lxfxlxx.exe pdppp.exe PID 4556 wrote to memory of 5008 4556 lxfxlxx.exe pdppp.exe PID 4556 wrote to memory of 5008 4556 lxfxlxx.exe pdppp.exe PID 5008 wrote to memory of 1344 5008 pdppp.exe lxffffr.exe PID 5008 wrote to memory of 1344 5008 pdppp.exe lxffffr.exe PID 5008 wrote to memory of 1344 5008 pdppp.exe lxffffr.exe PID 1344 wrote to memory of 776 1344 lxffffr.exe vvjdj.exe PID 1344 wrote to memory of 776 1344 lxffffr.exe vvjdj.exe PID 1344 wrote to memory of 776 1344 lxffffr.exe vvjdj.exe PID 776 wrote to memory of 1444 776 vvjdj.exe 1lrllxx.exe PID 776 wrote to memory of 1444 776 vvjdj.exe 1lrllxx.exe PID 776 wrote to memory of 1444 776 vvjdj.exe 1lrllxx.exe PID 1444 wrote to memory of 5104 1444 1lrllxx.exe pjjjd.exe PID 1444 wrote to memory of 5104 1444 1lrllxx.exe pjjjd.exe PID 1444 wrote to memory of 5104 1444 1lrllxx.exe pjjjd.exe PID 5104 wrote to memory of 3724 5104 pjjjd.exe xfxxxff.exe PID 5104 wrote to memory of 3724 5104 pjjjd.exe xfxxxff.exe PID 5104 wrote to memory of 3724 5104 pjjjd.exe xfxxxff.exe PID 3724 wrote to memory of 780 3724 xfxxxff.exe bthbbb.exe PID 3724 wrote to memory of 780 3724 xfxxxff.exe bthbbb.exe PID 3724 wrote to memory of 780 3724 xfxxxff.exe bthbbb.exe PID 780 wrote to memory of 5060 780 bthbbb.exe rfxxxff.exe PID 780 wrote to memory of 5060 780 bthbbb.exe rfxxxff.exe PID 780 wrote to memory of 5060 780 bthbbb.exe rfxxxff.exe PID 5060 wrote to memory of 4292 5060 rfxxxff.exe htttnn.exe PID 5060 wrote to memory of 4292 5060 rfxxxff.exe htttnn.exe PID 5060 wrote to memory of 4292 5060 rfxxxff.exe htttnn.exe PID 4292 wrote to memory of 4200 4292 htttnn.exe 5pjjp.exe PID 4292 wrote to memory of 4200 4292 htttnn.exe 5pjjp.exe PID 4292 wrote to memory of 4200 4292 htttnn.exe 5pjjp.exe PID 4200 wrote to memory of 2712 4200 5pjjp.exe nhhnnn.exe PID 4200 wrote to memory of 2712 4200 5pjjp.exe nhhnnn.exe PID 4200 wrote to memory of 2712 4200 5pjjp.exe nhhnnn.exe PID 2712 wrote to memory of 1264 2712 nhhnnn.exe rlrrllr.exe PID 2712 wrote to memory of 1264 2712 nhhnnn.exe rlrrllr.exe PID 2712 wrote to memory of 1264 2712 nhhnnn.exe rlrrllr.exe PID 1264 wrote to memory of 3616 1264 rlrrllr.exe 7frlffx.exe PID 1264 wrote to memory of 3616 1264 rlrrllr.exe 7frlffx.exe PID 1264 wrote to memory of 3616 1264 rlrrllr.exe 7frlffx.exe PID 3616 wrote to memory of 2508 3616 7frlffx.exe 1jpdv.exe PID 3616 wrote to memory of 2508 3616 7frlffx.exe 1jpdv.exe PID 3616 wrote to memory of 2508 3616 7frlffx.exe 1jpdv.exe PID 2508 wrote to memory of 4304 2508 1jpdv.exe lffxxrl.exe PID 2508 wrote to memory of 4304 2508 1jpdv.exe lffxxrl.exe PID 2508 wrote to memory of 4304 2508 1jpdv.exe lffxxrl.exe PID 4304 wrote to memory of 2700 4304 lffxxrl.exe bbhnnb.exe PID 4304 wrote to memory of 2700 4304 lffxxrl.exe bbhnnb.exe PID 4304 wrote to memory of 2700 4304 lffxxrl.exe bbhnnb.exe PID 2700 wrote to memory of 3384 2700 bbhnnb.exe rllfxfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\dpvpj.exec:\dpvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\xfllrrl.exec:\xfllrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\tnbhnb.exec:\tnbhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\vvjdp.exec:\vvjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\lxfxlxx.exec:\lxfxlxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\pdppp.exec:\pdppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\lxffffr.exec:\lxffffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\vvjdj.exec:\vvjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\1lrllxx.exec:\1lrllxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\pjjjd.exec:\pjjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\xfxxxff.exec:\xfxxxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\bthbbb.exec:\bthbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\rfxxxff.exec:\rfxxxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\htttnn.exec:\htttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\5pjjp.exec:\5pjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\nhhnnn.exec:\nhhnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\rlrrllr.exec:\rlrrllr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\7frlffx.exec:\7frlffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\1jpdv.exec:\1jpdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\lffxxrl.exec:\lffxxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\bbhnnb.exec:\bbhnnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rllfxfx.exec:\rllfxfx.exe23⤵
- Executes dropped EXE
PID:3384 -
\??\c:\tbhttb.exec:\tbhttb.exe24⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rxlfxrf.exec:\rxlfxrf.exe25⤵
- Executes dropped EXE
PID:4080 -
\??\c:\7hnhbb.exec:\7hnhbb.exe26⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vpvpp.exec:\vpvpp.exe27⤵
- Executes dropped EXE
PID:4808 -
\??\c:\fxxlrxl.exec:\fxxlrxl.exe28⤵
- Executes dropped EXE
PID:4840 -
\??\c:\ttbhtn.exec:\ttbhtn.exe29⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xrlfrrx.exec:\xrlfrrx.exe30⤵
- Executes dropped EXE
PID:1640 -
\??\c:\rrlrfrf.exec:\rrlrfrf.exe31⤵
- Executes dropped EXE
PID:3968 -
\??\c:\pdppd.exec:\pdppd.exe32⤵
- Executes dropped EXE
PID:920 -
\??\c:\fxrrfxr.exec:\fxrrfxr.exe33⤵
- Executes dropped EXE
PID:2156 -
\??\c:\dvvpj.exec:\dvvpj.exe34⤵
- Executes dropped EXE
PID:4244 -
\??\c:\rlflrxl.exec:\rlflrxl.exe35⤵
- Executes dropped EXE
PID:408 -
\??\c:\dpjdj.exec:\dpjdj.exe36⤵
- Executes dropped EXE
PID:636 -
\??\c:\xlllxrr.exec:\xlllxrr.exe37⤵
- Executes dropped EXE
PID:4484 -
\??\c:\btnntb.exec:\btnntb.exe38⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vvdvj.exec:\vvdvj.exe39⤵
- Executes dropped EXE
PID:620 -
\??\c:\dvjvp.exec:\dvjvp.exe40⤵
- Executes dropped EXE
PID:1908 -
\??\c:\xxrrllf.exec:\xxrrllf.exe41⤵
- Executes dropped EXE
PID:4624 -
\??\c:\tnnnnt.exec:\tnnnnt.exe42⤵
- Executes dropped EXE
PID:3128 -
\??\c:\vvpjp.exec:\vvpjp.exe43⤵
- Executes dropped EXE
PID:4444 -
\??\c:\rrfffff.exec:\rrfffff.exe44⤵
- Executes dropped EXE
PID:4880 -
\??\c:\nhnbnh.exec:\nhnbnh.exe45⤵
- Executes dropped EXE
PID:2872 -
\??\c:\dvjjd.exec:\dvjjd.exe46⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vpdjj.exec:\vpdjj.exe47⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rxffrfr.exec:\rxffrfr.exe48⤵
- Executes dropped EXE
PID:4804 -
\??\c:\9hnnhn.exec:\9hnnhn.exe49⤵
- Executes dropped EXE
PID:4888 -
\??\c:\vpvpp.exec:\vpvpp.exe50⤵
- Executes dropped EXE
PID:4544 -
\??\c:\jjdvp.exec:\jjdvp.exe51⤵
- Executes dropped EXE
PID:1396 -
\??\c:\flffffl.exec:\flffffl.exe52⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bhthbb.exec:\bhthbb.exe53⤵
- Executes dropped EXE
PID:384 -
\??\c:\7ttnnn.exec:\7ttnnn.exe54⤵
- Executes dropped EXE
PID:5048 -
\??\c:\jvvpp.exec:\jvvpp.exe55⤵
- Executes dropped EXE
PID:3612 -
\??\c:\xrffxff.exec:\xrffxff.exe56⤵
- Executes dropped EXE
PID:4792 -
\??\c:\rlrfxfx.exec:\rlrfxfx.exe57⤵
- Executes dropped EXE
PID:1092 -
\??\c:\tthhbb.exec:\tthhbb.exe58⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pvjjj.exec:\pvjjj.exe59⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rxrxrlx.exec:\rxrxrlx.exe60⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rrxlfrr.exec:\rrxlfrr.exe61⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7thbbb.exec:\7thbbb.exe62⤵
- Executes dropped EXE
PID:3516 -
\??\c:\dvjvp.exec:\dvjvp.exe63⤵
- Executes dropped EXE
PID:3208 -
\??\c:\ddppj.exec:\ddppj.exe64⤵
- Executes dropped EXE
PID:1104 -
\??\c:\llrrrrr.exec:\llrrrrr.exe65⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bbbbtt.exec:\bbbbtt.exe66⤵PID:4384
-
\??\c:\1nnhhh.exec:\1nnhhh.exe67⤵PID:4640
-
\??\c:\vddpj.exec:\vddpj.exe68⤵PID:4388
-
\??\c:\rrfxlxx.exec:\rrfxlxx.exe69⤵PID:1548
-
\??\c:\bhbhhh.exec:\bhbhhh.exe70⤵PID:4432
-
\??\c:\bbthnh.exec:\bbthnh.exe71⤵PID:4380
-
\??\c:\ppvvp.exec:\ppvvp.exe72⤵PID:4456
-
\??\c:\xlfrrff.exec:\xlfrrff.exe73⤵PID:2248
-
\??\c:\llllxxx.exec:\llllxxx.exe74⤵PID:2820
-
\??\c:\hthhbh.exec:\hthhbh.exe75⤵PID:528
-
\??\c:\dpvvp.exec:\dpvvp.exe76⤵PID:2544
-
\??\c:\9lxrrrl.exec:\9lxrrrl.exe77⤵PID:1640
-
\??\c:\llrrrxf.exec:\llrrrxf.exe78⤵PID:1740
-
\??\c:\llxxxfx.exec:\llxxxfx.exe79⤵PID:440
-
\??\c:\1tbttn.exec:\1tbttn.exe80⤵PID:4244
-
\??\c:\9jddd.exec:\9jddd.exe81⤵PID:648
-
\??\c:\vpdjj.exec:\vpdjj.exe82⤵PID:2836
-
\??\c:\ffllfff.exec:\ffllfff.exe83⤵PID:1032
-
\??\c:\3bnntb.exec:\3bnntb.exe84⤵PID:3304
-
\??\c:\vjpjd.exec:\vjpjd.exe85⤵PID:620
-
\??\c:\dvjpp.exec:\dvjpp.exe86⤵PID:3456
-
\??\c:\lxffxxr.exec:\lxffxxr.exe87⤵PID:4624
-
\??\c:\hnhbbh.exec:\hnhbbh.exe88⤵PID:4800
-
\??\c:\dvppv.exec:\dvppv.exe89⤵PID:1120
-
\??\c:\5lffflr.exec:\5lffflr.exe90⤵PID:2736
-
\??\c:\hbnhbb.exec:\hbnhbb.exe91⤵PID:3468
-
\??\c:\ppjdj.exec:\ppjdj.exe92⤵PID:4856
-
\??\c:\rfxffxf.exec:\rfxffxf.exe93⤵PID:4892
-
\??\c:\thnhhb.exec:\thnhhb.exe94⤵PID:1808
-
\??\c:\rrfrfxl.exec:\rrfrfxl.exe95⤵PID:1832
-
\??\c:\tnbbnt.exec:\tnbbnt.exe96⤵PID:3668
-
\??\c:\ddvpj.exec:\ddvpj.exe97⤵PID:3356
-
\??\c:\5hbbtn.exec:\5hbbtn.exe98⤵PID:1396
-
\??\c:\jdpjv.exec:\jdpjv.exe99⤵PID:3280
-
\??\c:\3flfllr.exec:\3flfllr.exe100⤵PID:384
-
\??\c:\ntbttb.exec:\ntbttb.exe101⤵PID:1304
-
\??\c:\dvvvv.exec:\dvvvv.exe102⤵PID:3612
-
\??\c:\5ppjj.exec:\5ppjj.exe103⤵PID:4792
-
\??\c:\1rxrlll.exec:\1rxrlll.exe104⤵PID:1092
-
\??\c:\nbnnnn.exec:\nbnnnn.exe105⤵PID:2524
-
\??\c:\7vjdj.exec:\7vjdj.exe106⤵PID:4312
-
\??\c:\djdjp.exec:\djdjp.exe107⤵PID:3636
-
\??\c:\xfxrllf.exec:\xfxrllf.exe108⤵PID:3648
-
\??\c:\nbhhnb.exec:\nbhhnb.exe109⤵PID:2508
-
\??\c:\pddjj.exec:\pddjj.exe110⤵PID:3140
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe111⤵PID:628
-
\??\c:\rxxxrff.exec:\rxxxrff.exe112⤵PID:4384
-
\??\c:\jjvpj.exec:\jjvpj.exe113⤵PID:3384
-
\??\c:\vpvjj.exec:\vpvjj.exe114⤵PID:2396
-
\??\c:\7fffxrr.exec:\7fffxrr.exe115⤵PID:1840
-
\??\c:\hbhhbb.exec:\hbhhbb.exe116⤵PID:4432
-
\??\c:\dvvpj.exec:\dvvpj.exe117⤵PID:4808
-
\??\c:\jjvvj.exec:\jjvvj.exe118⤵PID:4840
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe119⤵PID:1624
-
\??\c:\fffrxrf.exec:\fffrxrf.exe120⤵PID:2276
-
\??\c:\nhhbtt.exec:\nhhbtt.exe121⤵PID:3660
-
\??\c:\jvvpj.exec:\jvvpj.exe122⤵PID:4912
-
\??\c:\rrflxfx.exec:\rrflxfx.exe123⤵PID:764
-
\??\c:\hbtbnt.exec:\hbtbnt.exe124⤵PID:2384
-
\??\c:\1bbbth.exec:\1bbbth.exe125⤵PID:2156
-
\??\c:\dpjdj.exec:\dpjdj.exe126⤵PID:3984
-
\??\c:\rxlfxrr.exec:\rxlfxrr.exe127⤵PID:3496
-
\??\c:\tbttnn.exec:\tbttnn.exe128⤵PID:3608
-
\??\c:\dpvvd.exec:\dpvvd.exe129⤵PID:1744
-
\??\c:\llfffrr.exec:\llfffrr.exe130⤵PID:5116
-
\??\c:\tbbbbb.exec:\tbbbbb.exe131⤵PID:3368
-
\??\c:\vddvj.exec:\vddvj.exe132⤵PID:3936
-
\??\c:\3pvpj.exec:\3pvpj.exe133⤵PID:3312
-
\??\c:\frxrxrr.exec:\frxrxrr.exe134⤵PID:3024
-
\??\c:\5nnhnn.exec:\5nnhnn.exe135⤵PID:5004
-
\??\c:\vpddp.exec:\vpddp.exe136⤵PID:4868
-
\??\c:\xlllfff.exec:\xlllfff.exe137⤵PID:1344
-
\??\c:\hhnhhh.exec:\hhnhhh.exe138⤵PID:3288
-
\??\c:\5tthbb.exec:\5tthbb.exe139⤵PID:3484
-
\??\c:\pppjd.exec:\pppjd.exe140⤵PID:780
-
\??\c:\xllfffr.exec:\xllfffr.exe141⤵PID:1980
-
\??\c:\9nhbbb.exec:\9nhbbb.exe142⤵PID:5080
-
\??\c:\jvdjp.exec:\jvdjp.exe143⤵PID:724
-
\??\c:\9jpjd.exec:\9jpjd.exe144⤵PID:3080
-
\??\c:\xrxrllf.exec:\xrxrllf.exe145⤵PID:3872
-
\??\c:\5nnhbn.exec:\5nnhbn.exe146⤵PID:3472
-
\??\c:\vjjvp.exec:\vjjvp.exe147⤵PID:3616
-
\??\c:\fxfxffx.exec:\fxfxffx.exe148⤵PID:3108
-
\??\c:\nhtnnn.exec:\nhtnnn.exe149⤵PID:952
-
\??\c:\9ddvv.exec:\9ddvv.exe150⤵PID:4304
-
\??\c:\rrflffr.exec:\rrflffr.exe151⤵PID:2112
-
\??\c:\nhbbhb.exec:\nhbbhb.exe152⤵PID:2036
-
\??\c:\ddvjp.exec:\ddvjp.exe153⤵PID:3740
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe154⤵PID:4064
-
\??\c:\hbnhnn.exec:\hbnhnn.exe155⤵PID:228
-
\??\c:\jvppj.exec:\jvppj.exe156⤵PID:3600
-
\??\c:\lfrlffl.exec:\lfrlffl.exe157⤵PID:1068
-
\??\c:\bnnbbb.exec:\bnnbbb.exe158⤵PID:4820
-
\??\c:\ppddv.exec:\ppddv.exe159⤵PID:2828
-
\??\c:\jdddv.exec:\jdddv.exe160⤵PID:2820
-
\??\c:\llxrffl.exec:\llxrffl.exe161⤵PID:2600
-
\??\c:\nnbttn.exec:\nnbttn.exe162⤵PID:5108
-
\??\c:\jjjvp.exec:\jjjvp.exe163⤵PID:3452
-
\??\c:\rfxrrxx.exec:\rfxrrxx.exe164⤵PID:1640
-
\??\c:\httthn.exec:\httthn.exe165⤵PID:3524
-
\??\c:\lllxfrf.exec:\lllxfrf.exe166⤵PID:372
-
\??\c:\dvdvv.exec:\dvdvv.exe167⤵PID:1940
-
\??\c:\ppdvd.exec:\ppdvd.exe168⤵PID:648
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe169⤵PID:4320
-
\??\c:\btnhnn.exec:\btnhnn.exe170⤵PID:3304
-
\??\c:\jvdvv.exec:\jvdvv.exe171⤵PID:3368
-
\??\c:\9rrllff.exec:\9rrllff.exe172⤵PID:3796
-
\??\c:\ttttbb.exec:\ttttbb.exe173⤵PID:2000
-
\??\c:\httbtt.exec:\httbtt.exe174⤵PID:4444
-
\??\c:\jvdjj.exec:\jvdjj.exe175⤵PID:5008
-
\??\c:\3rllfll.exec:\3rllfll.exe176⤵PID:4868
-
\??\c:\xfxrlll.exec:\xfxrlll.exe177⤵PID:3288
-
\??\c:\btbbbb.exec:\btbbbb.exe178⤵PID:3484
-
\??\c:\dvvvv.exec:\dvvvv.exe179⤵PID:3300
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe180⤵PID:4988
-
\??\c:\rrffxxx.exec:\rrffxxx.exe181⤵PID:3800
-
\??\c:\bbbhtt.exec:\bbbhtt.exe182⤵PID:4200
-
\??\c:\vdvdv.exec:\vdvdv.exe183⤵PID:2236
-
\??\c:\5flxfrx.exec:\5flxfrx.exe184⤵PID:4796
-
\??\c:\rxllfff.exec:\rxllfff.exe185⤵PID:3516
-
\??\c:\nhnttb.exec:\nhnttb.exe186⤵PID:3108
-
\??\c:\jdjdv.exec:\jdjdv.exe187⤵PID:2240
-
\??\c:\xxfrrrr.exec:\xxfrrrr.exe188⤵PID:2728
-
\??\c:\nhtthb.exec:\nhtthb.exe189⤵PID:1384
-
\??\c:\pjjdj.exec:\pjjdj.exe190⤵PID:1416
-
\??\c:\jdjjd.exec:\jdjjd.exe191⤵PID:3944
-
\??\c:\rfllfll.exec:\rfllfll.exe192⤵PID:4812
-
\??\c:\thhbbb.exec:\thhbbb.exe193⤵PID:4072
-
\??\c:\hbtnnh.exec:\hbtnnh.exe194⤵PID:2724
-
\??\c:\ddpjj.exec:\ddpjj.exe195⤵PID:3600
-
\??\c:\bttnbb.exec:\bttnbb.exe196⤵PID:1364
-
\??\c:\5jjvp.exec:\5jjvp.exe197⤵PID:1804
-
\??\c:\djjdv.exec:\djjdv.exe198⤵PID:3504
-
\??\c:\7lfllrf.exec:\7lfllrf.exe199⤵PID:2820
-
\??\c:\9nnnnb.exec:\9nnnnb.exe200⤵PID:536
-
\??\c:\jvjdv.exec:\jvjdv.exe201⤵PID:5108
-
\??\c:\3fllllr.exec:\3fllllr.exe202⤵PID:3452
-
\??\c:\rrxffrr.exec:\rrxffrr.exe203⤵PID:1640
-
\??\c:\bttnnn.exec:\bttnnn.exe204⤵PID:440
-
\??\c:\7jjjj.exec:\7jjjj.exe205⤵PID:372
-
\??\c:\dvvvp.exec:\dvvvp.exe206⤵PID:4972
-
\??\c:\xrllfff.exec:\xrllfff.exe207⤵PID:4484
-
\??\c:\bhhbbb.exec:\bhhbbb.exe208⤵PID:5116
-
\??\c:\5dvjj.exec:\5dvjj.exe209⤵PID:3936
-
\??\c:\vdjdv.exec:\vdjdv.exe210⤵PID:4772
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe211⤵PID:3992
-
\??\c:\hbnnbt.exec:\hbnnbt.exe212⤵PID:2872
-
\??\c:\vvdjp.exec:\vvdjp.exe213⤵PID:2000
-
\??\c:\lrlllll.exec:\lrlllll.exe214⤵PID:3920
-
\??\c:\xlrxrrr.exec:\xlrxrrr.exe215⤵PID:1344
-
\??\c:\ttnhbb.exec:\ttnhbb.exe216⤵PID:4868
-
\??\c:\pdddv.exec:\pdddv.exe217⤵PID:3288
-
\??\c:\3jvvj.exec:\3jvvj.exe218⤵PID:544
-
\??\c:\ffllffx.exec:\ffllffx.exe219⤵PID:868
-
\??\c:\7nnhhh.exec:\7nnhhh.exe220⤵PID:4872
-
\??\c:\htnnnt.exec:\htnnnt.exe221⤵PID:1304
-
\??\c:\5rxrllf.exec:\5rxrllf.exe222⤵PID:2712
-
\??\c:\htbtnh.exec:\htbtnh.exe223⤵PID:1036
-
\??\c:\pdvvd.exec:\pdvvd.exe224⤵PID:4928
-
\??\c:\flrllfr.exec:\flrllfr.exe225⤵PID:3632
-
\??\c:\ddjdd.exec:\ddjdd.exe226⤵PID:1960
-
\??\c:\thtnhh.exec:\thtnhh.exe227⤵PID:5044
-
\??\c:\xxflrxr.exec:\xxflrxr.exe228⤵PID:4076
-
\??\c:\hhhtbt.exec:\hhhtbt.exe229⤵PID:4520
-
\??\c:\lfrllrl.exec:\lfrllrl.exe230⤵PID:1384
-
\??\c:\tttbbn.exec:\tttbbn.exe231⤵PID:1040
-
\??\c:\nbnhbb.exec:\nbnhbb.exe232⤵PID:1104
-
\??\c:\pdpjd.exec:\pdpjd.exe233⤵PID:4080
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe234⤵PID:4240
-
\??\c:\ppjjj.exec:\ppjjj.exe235⤵PID:4072
-
\??\c:\xxxrffl.exec:\xxxrffl.exe236⤵PID:3120
-
\??\c:\ddvvp.exec:\ddvvp.exe237⤵PID:4372
-
\??\c:\dpdvp.exec:\dpdvp.exe238⤵PID:4808
-
\??\c:\xxxrlrl.exec:\xxxrlrl.exe239⤵PID:1624
-
\??\c:\tnbtnt.exec:\tnbtnt.exe240⤵PID:1488
-
\??\c:\dvddd.exec:\dvddd.exe241⤵PID:528
-
\??\c:\jddpv.exec:\jddpv.exe242⤵PID:920