Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 16:30
Behavioral task
behavioral1
Sample
ed01159639bead6ea96053e222e943e0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
ed01159639bead6ea96053e222e943e0_NeikiAnalytics.exe
-
Size
350KB
-
MD5
ed01159639bead6ea96053e222e943e0
-
SHA1
438901e900c2d305f89f30208a2f01a2e4493c19
-
SHA256
ab9423a25082b20dab710f56a1f3ed8063b58e9e6d6a9cb5b7fdc4dd1b562ff3
-
SHA512
b9602853cbf48f8c8fd376d40f2c3514cba0adbcf72822cf9fe6a652cd6dc93142d80ab5340167f95ba027be294587d5dfd3f4ccef9ccba47f15099ac7616249
-
SSDEEP
6144:bcm4FmowdHoSgWrXD486jCpoAhlq1mEjBqLyOSlhNFF2p:h4wFHoSgWj168w1VjsyvhNFF2p
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/368-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1288-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/880-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/492-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3832-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2432-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/836-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/936-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-571-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/320-671-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-890-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\rrffrrx.exe family_berbew C:\5dpvp.exe family_berbew C:\7nnnhn.exe family_berbew C:\pdpjd.exe family_berbew C:\btnhbb.exe family_berbew C:\jdvpp.exe family_berbew C:\frlfrrl.exe family_berbew C:\vpvvv.exe family_berbew C:\flrllll.exe family_berbew \??\c:\pjjjd.exe family_berbew C:\tnbttt.exe family_berbew C:\dpvpp.exe family_berbew C:\3flfxxr.exe family_berbew C:\5djjd.exe family_berbew C:\9bbnht.exe family_berbew C:\ddvdd.exe family_berbew C:\hhtntn.exe family_berbew C:\vvvvv.exe family_berbew C:\llllfxr.exe family_berbew C:\djdvv.exe family_berbew C:\frxrlfx.exe family_berbew C:\vvjdv.exe family_berbew C:\lxfxxxx.exe family_berbew \??\c:\bnhhhh.exe family_berbew \??\c:\nbtbtb.exe family_berbew C:\htnhhh.exe family_berbew C:\xrfxrrl.exe family_berbew C:\vvjdd.exe family_berbew \??\c:\tnhbhh.exe family_berbew C:\jpddp.exe family_berbew \??\c:\xxlrxlx.exe family_berbew C:\lfrllxx.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
rrffrrx.exe5dpvp.exe7nnnhn.exepdpjd.exebtnhbb.exejdvpp.exefrlfrrl.exevpvvv.exeflrllll.exepjjjd.exetnbttt.exedpvpp.exe3flfxxr.exe5djjd.exe9bbnht.exeddvdd.exehhtntn.exevvvvv.exellllfxr.exedjdvv.exefrxrlfx.exevvjdv.exelxfxxxx.exebnhhhh.exenbtbtb.exehtnhhh.exexrfxrrl.exevvjdd.exetnhbhh.exejpddp.exexxlrxlx.exelfrllxx.exetnthhh.exe9nnhhh.exevvdjp.exelflfxxx.exebnnhhn.exepvdvp.exe5ppjd.exerfrrrrr.exetnhbtt.exedpvdp.exe5lrfxrf.exebbhhnn.exepjjdj.exe5lfxrrl.exerxlfxrr.exehbbtnn.exelfxrrlf.exennhhnh.exe5jvvv.exe5xxrlll.exebthbbb.exevpjdv.exerlfffrx.exerrllllr.exenbhbbb.exepjpjd.exedpvpp.exe3flllll.exepdpvv.exexxlrrxf.exenttnhn.exevdvvj.exepid process 3964 rrffrrx.exe 2116 5dpvp.exe 4012 7nnnhn.exe 3004 pdpjd.exe 2580 btnhbb.exe 4524 jdvpp.exe 1324 frlfrrl.exe 5104 vpvvv.exe 5084 flrllll.exe 2204 pjjjd.exe 3220 tnbttt.exe 3328 dpvpp.exe 4596 3flfxxr.exe 4240 5djjd.exe 4712 9bbnht.exe 1920 ddvdd.exe 5036 hhtntn.exe 2696 vvvvv.exe 2256 llllfxr.exe 968 djdvv.exe 4188 frxrlfx.exe 1288 vvjdv.exe 1084 lxfxxxx.exe 3548 bnhhhh.exe 3484 nbtbtb.exe 880 htnhhh.exe 492 xrfxrrl.exe 2936 vvjdd.exe 1600 tnhbhh.exe 4104 jpddp.exe 3244 xxlrxlx.exe 4352 lfrllxx.exe 1204 tnthhh.exe 3832 9nnhhh.exe 3620 vvdjp.exe 3448 lflfxxx.exe 1020 bnnhhn.exe 3000 pvdvp.exe 468 5ppjd.exe 4480 rfrrrrr.exe 496 tnhbtt.exe 4792 dpvdp.exe 2292 5lrfxrf.exe 4316 bbhhnn.exe 228 pjjdj.exe 368 5lfxrrl.exe 3264 rxlfxrr.exe 1208 hbbtnn.exe 5056 lfxrrlf.exe 2432 nnhhnh.exe 4472 5jvvv.exe 4780 5xxrlll.exe 4908 bthbbb.exe 1488 vpjdv.exe 892 rlfffrx.exe 3040 rrllllr.exe 4544 nbhbbb.exe 1616 pjpjd.exe 2156 dpvpp.exe 2204 3flllll.exe 3976 pdpvv.exe 1984 xxlrrxf.exe 5072 nttnhn.exe 4596 vdvvj.exe -
Processes:
resource yara_rule behavioral2/memory/368-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/368-4-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrffrrx.exe upx behavioral2/memory/3964-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5dpvp.exe upx behavioral2/memory/2116-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7nnnhn.exe upx behavioral2/memory/4012-16-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdpjd.exe upx behavioral2/memory/3004-24-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnhbb.exe upx C:\jdvpp.exe upx C:\frlfrrl.exe upx C:\vpvvv.exe upx behavioral2/memory/1324-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flrllll.exe upx behavioral2/memory/5104-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5084-47-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjjjd.exe upx behavioral2/memory/2204-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbttt.exe upx C:\dpvpp.exe upx behavioral2/memory/3220-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3328-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3flfxxr.exe upx behavioral2/memory/4596-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5djjd.exe upx C:\9bbnht.exe upx behavioral2/memory/4240-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvdd.exe upx behavioral2/memory/4712-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1920-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhtntn.exe upx behavioral2/memory/5036-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvvv.exe upx behavioral2/memory/2696-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llllfxr.exe upx behavioral2/memory/2256-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djdvv.exe upx C:\frxrlfx.exe upx behavioral2/memory/968-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjdv.exe upx behavioral2/memory/1288-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxfxxxx.exe upx \??\c:\bnhhhh.exe upx \??\c:\nbtbtb.exe upx C:\htnhhh.exe upx behavioral2/memory/880-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3548-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrfxrrl.exe upx C:\vvjdd.exe upx behavioral2/memory/492-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2936-140-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnhbhh.exe upx C:\jpddp.exe upx \??\c:\xxlrxlx.exe upx C:\lfrllxx.exe upx behavioral2/memory/3244-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1204-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3832-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1020-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/468-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3264-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2432-197-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ed01159639bead6ea96053e222e943e0_NeikiAnalytics.exerrffrrx.exe5dpvp.exe7nnnhn.exepdpjd.exebtnhbb.exejdvpp.exefrlfrrl.exevpvvv.exeflrllll.exepjjjd.exetnbttt.exedpvpp.exe3flfxxr.exe5djjd.exe9bbnht.exeddvdd.exehhtntn.exevvvvv.exellllfxr.exedjdvv.exefrxrlfx.exedescription pid process target process PID 368 wrote to memory of 3964 368 ed01159639bead6ea96053e222e943e0_NeikiAnalytics.exe rrffrrx.exe PID 368 wrote to memory of 3964 368 ed01159639bead6ea96053e222e943e0_NeikiAnalytics.exe rrffrrx.exe PID 368 wrote to memory of 3964 368 ed01159639bead6ea96053e222e943e0_NeikiAnalytics.exe rrffrrx.exe PID 3964 wrote to memory of 2116 3964 rrffrrx.exe 5dpvp.exe PID 3964 wrote to memory of 2116 3964 rrffrrx.exe 5dpvp.exe PID 3964 wrote to memory of 2116 3964 rrffrrx.exe 5dpvp.exe PID 2116 wrote to memory of 4012 2116 5dpvp.exe 7nnnhn.exe PID 2116 wrote to memory of 4012 2116 5dpvp.exe 7nnnhn.exe PID 2116 wrote to memory of 4012 2116 5dpvp.exe 7nnnhn.exe PID 4012 wrote to memory of 3004 4012 7nnnhn.exe pdpjd.exe PID 4012 wrote to memory of 3004 4012 7nnnhn.exe pdpjd.exe PID 4012 wrote to memory of 3004 4012 7nnnhn.exe pdpjd.exe PID 3004 wrote to memory of 2580 3004 pdpjd.exe btnhbb.exe PID 3004 wrote to memory of 2580 3004 pdpjd.exe btnhbb.exe PID 3004 wrote to memory of 2580 3004 pdpjd.exe btnhbb.exe PID 2580 wrote to memory of 4524 2580 btnhbb.exe jdvpp.exe PID 2580 wrote to memory of 4524 2580 btnhbb.exe jdvpp.exe PID 2580 wrote to memory of 4524 2580 btnhbb.exe jdvpp.exe PID 4524 wrote to memory of 1324 4524 jdvpp.exe frlfrrl.exe PID 4524 wrote to memory of 1324 4524 jdvpp.exe frlfrrl.exe PID 4524 wrote to memory of 1324 4524 jdvpp.exe frlfrrl.exe PID 1324 wrote to memory of 5104 1324 frlfrrl.exe vpvvv.exe PID 1324 wrote to memory of 5104 1324 frlfrrl.exe vpvvv.exe PID 1324 wrote to memory of 5104 1324 frlfrrl.exe vpvvv.exe PID 5104 wrote to memory of 5084 5104 vpvvv.exe flrllll.exe PID 5104 wrote to memory of 5084 5104 vpvvv.exe flrllll.exe PID 5104 wrote to memory of 5084 5104 vpvvv.exe flrllll.exe PID 5084 wrote to memory of 2204 5084 flrllll.exe pjjjd.exe PID 5084 wrote to memory of 2204 5084 flrllll.exe pjjjd.exe PID 5084 wrote to memory of 2204 5084 flrllll.exe pjjjd.exe PID 2204 wrote to memory of 3220 2204 pjjjd.exe tnbttt.exe PID 2204 wrote to memory of 3220 2204 pjjjd.exe tnbttt.exe PID 2204 wrote to memory of 3220 2204 pjjjd.exe tnbttt.exe PID 3220 wrote to memory of 3328 3220 tnbttt.exe dpvpp.exe PID 3220 wrote to memory of 3328 3220 tnbttt.exe dpvpp.exe PID 3220 wrote to memory of 3328 3220 tnbttt.exe dpvpp.exe PID 3328 wrote to memory of 4596 3328 dpvpp.exe 3flfxxr.exe PID 3328 wrote to memory of 4596 3328 dpvpp.exe 3flfxxr.exe PID 3328 wrote to memory of 4596 3328 dpvpp.exe 3flfxxr.exe PID 4596 wrote to memory of 4240 4596 3flfxxr.exe 5djjd.exe PID 4596 wrote to memory of 4240 4596 3flfxxr.exe 5djjd.exe PID 4596 wrote to memory of 4240 4596 3flfxxr.exe 5djjd.exe PID 4240 wrote to memory of 4712 4240 5djjd.exe 9bbnht.exe PID 4240 wrote to memory of 4712 4240 5djjd.exe 9bbnht.exe PID 4240 wrote to memory of 4712 4240 5djjd.exe 9bbnht.exe PID 4712 wrote to memory of 1920 4712 9bbnht.exe ddvdd.exe PID 4712 wrote to memory of 1920 4712 9bbnht.exe ddvdd.exe PID 4712 wrote to memory of 1920 4712 9bbnht.exe ddvdd.exe PID 1920 wrote to memory of 5036 1920 ddvdd.exe hhtntn.exe PID 1920 wrote to memory of 5036 1920 ddvdd.exe hhtntn.exe PID 1920 wrote to memory of 5036 1920 ddvdd.exe hhtntn.exe PID 5036 wrote to memory of 2696 5036 hhtntn.exe vvvvv.exe PID 5036 wrote to memory of 2696 5036 hhtntn.exe vvvvv.exe PID 5036 wrote to memory of 2696 5036 hhtntn.exe vvvvv.exe PID 2696 wrote to memory of 2256 2696 vvvvv.exe llllfxr.exe PID 2696 wrote to memory of 2256 2696 vvvvv.exe llllfxr.exe PID 2696 wrote to memory of 2256 2696 vvvvv.exe llllfxr.exe PID 2256 wrote to memory of 968 2256 llllfxr.exe djdvv.exe PID 2256 wrote to memory of 968 2256 llllfxr.exe djdvv.exe PID 2256 wrote to memory of 968 2256 llllfxr.exe djdvv.exe PID 968 wrote to memory of 4188 968 djdvv.exe frxrlfx.exe PID 968 wrote to memory of 4188 968 djdvv.exe frxrlfx.exe PID 968 wrote to memory of 4188 968 djdvv.exe frxrlfx.exe PID 4188 wrote to memory of 1288 4188 frxrlfx.exe vvjdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed01159639bead6ea96053e222e943e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ed01159639bead6ea96053e222e943e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\rrffrrx.exec:\rrffrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\5dpvp.exec:\5dpvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\7nnnhn.exec:\7nnnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\pdpjd.exec:\pdpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\btnhbb.exec:\btnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\jdvpp.exec:\jdvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\frlfrrl.exec:\frlfrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\vpvvv.exec:\vpvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\flrllll.exec:\flrllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\pjjjd.exec:\pjjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\tnbttt.exec:\tnbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\dpvpp.exec:\dpvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\3flfxxr.exec:\3flfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\5djjd.exec:\5djjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\9bbnht.exec:\9bbnht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\ddvdd.exec:\ddvdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\hhtntn.exec:\hhtntn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\vvvvv.exec:\vvvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\llllfxr.exec:\llllfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\djdvv.exec:\djdvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\frxrlfx.exec:\frxrlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\vvjdv.exec:\vvjdv.exe23⤵
- Executes dropped EXE
PID:1288 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe24⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bnhhhh.exec:\bnhhhh.exe25⤵
- Executes dropped EXE
PID:3548 -
\??\c:\nbtbtb.exec:\nbtbtb.exe26⤵
- Executes dropped EXE
PID:3484 -
\??\c:\htnhhh.exec:\htnhhh.exe27⤵
- Executes dropped EXE
PID:880 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe28⤵
- Executes dropped EXE
PID:492 -
\??\c:\vvjdd.exec:\vvjdd.exe29⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tnhbhh.exec:\tnhbhh.exe30⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jpddp.exec:\jpddp.exe31⤵
- Executes dropped EXE
PID:4104 -
\??\c:\xxlrxlx.exec:\xxlrxlx.exe32⤵
- Executes dropped EXE
PID:3244 -
\??\c:\lfrllxx.exec:\lfrllxx.exe33⤵
- Executes dropped EXE
PID:4352 -
\??\c:\tnthhh.exec:\tnthhh.exe34⤵
- Executes dropped EXE
PID:1204 -
\??\c:\9nnhhh.exec:\9nnhhh.exe35⤵
- Executes dropped EXE
PID:3832 -
\??\c:\vvdjp.exec:\vvdjp.exe36⤵
- Executes dropped EXE
PID:3620 -
\??\c:\lflfxxx.exec:\lflfxxx.exe37⤵
- Executes dropped EXE
PID:3448 -
\??\c:\bnnhhn.exec:\bnnhhn.exe38⤵
- Executes dropped EXE
PID:1020 -
\??\c:\pvdvp.exec:\pvdvp.exe39⤵
- Executes dropped EXE
PID:3000 -
\??\c:\5ppjd.exec:\5ppjd.exe40⤵
- Executes dropped EXE
PID:468 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe41⤵
- Executes dropped EXE
PID:4480 -
\??\c:\tnhbtt.exec:\tnhbtt.exe42⤵
- Executes dropped EXE
PID:496 -
\??\c:\dpvdp.exec:\dpvdp.exe43⤵
- Executes dropped EXE
PID:4792 -
\??\c:\5lrfxrf.exec:\5lrfxrf.exe44⤵
- Executes dropped EXE
PID:2292 -
\??\c:\bbhhnn.exec:\bbhhnn.exe45⤵
- Executes dropped EXE
PID:4316 -
\??\c:\pjjdj.exec:\pjjdj.exe46⤵
- Executes dropped EXE
PID:228 -
\??\c:\5lfxrrl.exec:\5lfxrrl.exe47⤵
- Executes dropped EXE
PID:368 -
\??\c:\rxlfxrr.exec:\rxlfxrr.exe48⤵
- Executes dropped EXE
PID:3264 -
\??\c:\hbbtnn.exec:\hbbtnn.exe49⤵
- Executes dropped EXE
PID:1208 -
\??\c:\lfxrrlf.exec:\lfxrrlf.exe50⤵
- Executes dropped EXE
PID:5056 -
\??\c:\nnhhnh.exec:\nnhhnh.exe51⤵
- Executes dropped EXE
PID:2432 -
\??\c:\5jvvv.exec:\5jvvv.exe52⤵
- Executes dropped EXE
PID:4472 -
\??\c:\5xxrlll.exec:\5xxrlll.exe53⤵
- Executes dropped EXE
PID:4780 -
\??\c:\bthbbb.exec:\bthbbb.exe54⤵
- Executes dropped EXE
PID:4908 -
\??\c:\vpjdv.exec:\vpjdv.exe55⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rlfffrx.exec:\rlfffrx.exe56⤵
- Executes dropped EXE
PID:892 -
\??\c:\rrllllr.exec:\rrllllr.exe57⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nbhbbb.exec:\nbhbbb.exe58⤵
- Executes dropped EXE
PID:4544 -
\??\c:\pjpjd.exec:\pjpjd.exe59⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dpvpp.exec:\dpvpp.exe60⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3flllll.exec:\3flllll.exe61⤵
- Executes dropped EXE
PID:2204 -
\??\c:\pdpvv.exec:\pdpvv.exe62⤵
- Executes dropped EXE
PID:3976 -
\??\c:\xxlrrxf.exec:\xxlrrxf.exe63⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nttnhn.exec:\nttnhn.exe64⤵
- Executes dropped EXE
PID:5072 -
\??\c:\vdvvj.exec:\vdvvj.exe65⤵
- Executes dropped EXE
PID:4596 -
\??\c:\dddvp.exec:\dddvp.exe66⤵PID:2692
-
\??\c:\frlfxxx.exec:\frlfxxx.exe67⤵PID:980
-
\??\c:\thnnbn.exec:\thnnbn.exe68⤵PID:2684
-
\??\c:\hnbthb.exec:\hnbthb.exe69⤵PID:4576
-
\??\c:\vpvpj.exec:\vpvpj.exe70⤵PID:3036
-
\??\c:\xflfxfx.exec:\xflfxfx.exe71⤵PID:1812
-
\??\c:\7lfxxxx.exec:\7lfxxxx.exe72⤵PID:1124
-
\??\c:\nhthht.exec:\nhthht.exe73⤵PID:4828
-
\??\c:\3vdvj.exec:\3vdvj.exe74⤵PID:2372
-
\??\c:\dddjv.exec:\dddjv.exe75⤵PID:4980
-
\??\c:\9rllxlx.exec:\9rllxlx.exe76⤵PID:4460
-
\??\c:\1hhbth.exec:\1hhbth.exe77⤵PID:1948
-
\??\c:\nnhhnn.exec:\nnhhnn.exe78⤵PID:2244
-
\??\c:\pvpjj.exec:\pvpjj.exe79⤵PID:4852
-
\??\c:\bnhntt.exec:\bnhntt.exe80⤵PID:2108
-
\??\c:\thbnhn.exec:\thbnhn.exe81⤵PID:4824
-
\??\c:\3jjdv.exec:\3jjdv.exe82⤵PID:1424
-
\??\c:\rfrllll.exec:\rfrllll.exe83⤵PID:1420
-
\??\c:\5thhnn.exec:\5thhnn.exe84⤵PID:4032
-
\??\c:\dddvp.exec:\dddvp.exe85⤵PID:4612
-
\??\c:\7fxrfrl.exec:\7fxrfrl.exe86⤵PID:1216
-
\??\c:\9hhhhn.exec:\9hhhhn.exe87⤵PID:3244
-
\??\c:\nbbtnn.exec:\nbbtnn.exe88⤵PID:3576
-
\??\c:\dvjjj.exec:\dvjjj.exe89⤵PID:3308
-
\??\c:\9xfxrrl.exec:\9xfxrrl.exe90⤵PID:4528
-
\??\c:\hntthh.exec:\hntthh.exe91⤵PID:3700
-
\??\c:\5jjjd.exec:\5jjjd.exe92⤵PID:3744
-
\??\c:\vjpjj.exec:\vjpjj.exe93⤵PID:1020
-
\??\c:\xxffxfx.exec:\xxffxfx.exe94⤵PID:1660
-
\??\c:\5nhhnn.exec:\5nhhnn.exe95⤵PID:2236
-
\??\c:\vvpdv.exec:\vvpdv.exe96⤵PID:2572
-
\??\c:\5lxrlff.exec:\5lxrlff.exe97⤵PID:1536
-
\??\c:\9nnhtt.exec:\9nnhtt.exe98⤵PID:1916
-
\??\c:\7hnbtt.exec:\7hnbtt.exe99⤵PID:2536
-
\??\c:\xllxllx.exec:\xllxllx.exe100⤵PID:4556
-
\??\c:\btbthh.exec:\btbthh.exe101⤵PID:3760
-
\??\c:\9ttttt.exec:\9ttttt.exe102⤵PID:368
-
\??\c:\rflfxxx.exec:\rflfxxx.exe103⤵PID:3264
-
\??\c:\5jppp.exec:\5jppp.exe104⤵PID:1980
-
\??\c:\lrffflf.exec:\lrffflf.exe105⤵PID:4516
-
\??\c:\3xllrlr.exec:\3xllrlr.exe106⤵PID:4012
-
\??\c:\htthtt.exec:\htthtt.exe107⤵PID:3376
-
\??\c:\vpjpj.exec:\vpjpj.exe108⤵PID:316
-
\??\c:\5ppvp.exec:\5ppvp.exe109⤵PID:1404
-
\??\c:\nnhhtt.exec:\nnhhtt.exe110⤵PID:892
-
\??\c:\7bbnht.exec:\7bbnht.exe111⤵PID:500
-
\??\c:\jvpjv.exec:\jvpjv.exe112⤵PID:1616
-
\??\c:\5dpjj.exec:\5dpjj.exe113⤵PID:4296
-
\??\c:\fffffff.exec:\fffffff.exe114⤵PID:2304
-
\??\c:\bnttnh.exec:\bnttnh.exe115⤵PID:448
-
\??\c:\nhnhhh.exec:\nhnhhh.exe116⤵PID:4656
-
\??\c:\1vvdv.exec:\1vvdv.exe117⤵PID:2544
-
\??\c:\rllfxlf.exec:\rllfxlf.exe118⤵PID:2064
-
\??\c:\lfrffxf.exec:\lfrffxf.exe119⤵PID:4620
-
\??\c:\thnbth.exec:\thnbth.exe120⤵PID:1564
-
\??\c:\jpdjp.exec:\jpdjp.exe121⤵PID:5036
-
\??\c:\vpdvp.exec:\vpdvp.exe122⤵PID:4036
-
\??\c:\rlrxlfx.exec:\rlrxlfx.exe123⤵PID:4044
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe124⤵PID:3080
-
\??\c:\9ppjv.exec:\9ppjv.exe125⤵PID:1640
-
\??\c:\rllllll.exec:\rllllll.exe126⤵PID:2512
-
\??\c:\1ttnnn.exec:\1ttnnn.exe127⤵PID:1576
-
\??\c:\dpppj.exec:\dpppj.exe128⤵PID:3208
-
\??\c:\rrllfff.exec:\rrllfff.exe129⤵PID:2244
-
\??\c:\bnbbhh.exec:\bnbbhh.exe130⤵PID:2360
-
\??\c:\vvppv.exec:\vvppv.exe131⤵PID:1072
-
\??\c:\3rlffxx.exec:\3rlffxx.exe132⤵PID:1184
-
\??\c:\1ntnnh.exec:\1ntnnh.exe133⤵PID:1664
-
\??\c:\jvpjd.exec:\jvpjd.exe134⤵PID:4972
-
\??\c:\llxxxll.exec:\llxxxll.exe135⤵PID:4092
-
\??\c:\fllxrfx.exec:\fllxrfx.exe136⤵PID:836
-
\??\c:\bbbbbb.exec:\bbbbbb.exe137⤵PID:4104
-
\??\c:\dvvdv.exec:\dvvdv.exe138⤵PID:3440
-
\??\c:\3frlrrl.exec:\3frlrrl.exe139⤵PID:3244
-
\??\c:\llxfrrx.exec:\llxfrrx.exe140⤵PID:3576
-
\??\c:\3nhbbb.exec:\3nhbbb.exe141⤵PID:3308
-
\??\c:\jpvpv.exec:\jpvpv.exe142⤵PID:4528
-
\??\c:\jdjdv.exec:\jdjdv.exe143⤵PID:1684
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe144⤵PID:3344
-
\??\c:\htbhhn.exec:\htbhhn.exe145⤵PID:1020
-
\??\c:\ddddd.exec:\ddddd.exe146⤵PID:1296
-
\??\c:\fxffrxr.exec:\fxffrxr.exe147⤵PID:2388
-
\??\c:\btbbtb.exec:\btbbtb.exe148⤵PID:4840
-
\??\c:\tnhhnt.exec:\tnhhnt.exe149⤵PID:2732
-
\??\c:\ppdjj.exec:\ppdjj.exe150⤵PID:4308
-
\??\c:\fxllfff.exec:\fxllfff.exe151⤵PID:228
-
\??\c:\rfllrxf.exec:\rfllrxf.exe152⤵PID:1256
-
\??\c:\nntttb.exec:\nntttb.exe153⤵PID:368
-
\??\c:\dvjdj.exec:\dvjdj.exe154⤵PID:4416
-
\??\c:\9pvpp.exec:\9pvpp.exe155⤵PID:4516
-
\??\c:\9xxrlfx.exec:\9xxrlfx.exe156⤵PID:4780
-
\??\c:\3nhhbb.exec:\3nhhbb.exe157⤵PID:1852
-
\??\c:\hnnnth.exec:\hnnnth.exe158⤵PID:5104
-
\??\c:\jdvpv.exec:\jdvpv.exe159⤵PID:1992
-
\??\c:\pdjdv.exec:\pdjdv.exe160⤵PID:2044
-
\??\c:\xrlffff.exec:\xrlffff.exe161⤵PID:660
-
\??\c:\tbhhhh.exec:\tbhhhh.exe162⤵PID:3596
-
\??\c:\nbtnhb.exec:\nbtnhb.exe163⤵PID:1924
-
\??\c:\dpjdv.exec:\dpjdv.exe164⤵PID:4656
-
\??\c:\llfrlxx.exec:\llfrlxx.exe165⤵PID:3288
-
\??\c:\7ffrlll.exec:\7ffrlll.exe166⤵PID:4312
-
\??\c:\1tbttt.exec:\1tbttt.exe167⤵PID:4576
-
\??\c:\pvpjd.exec:\pvpjd.exe168⤵PID:2056
-
\??\c:\rlxrxlf.exec:\rlxrxlf.exe169⤵PID:1812
-
\??\c:\rflfxlf.exec:\rflfxlf.exe170⤵PID:4828
-
\??\c:\tnnhbh.exec:\tnnhbh.exe171⤵PID:2372
-
\??\c:\bthbtt.exec:\bthbtt.exe172⤵PID:4980
-
\??\c:\pjdvd.exec:\pjdvd.exe173⤵PID:4460
-
\??\c:\fllfrrx.exec:\fllfrrx.exe174⤵PID:2512
-
\??\c:\htbtnn.exec:\htbtnn.exe175⤵PID:1576
-
\??\c:\htbtnb.exec:\htbtnb.exe176⤵PID:3208
-
\??\c:\vjvpd.exec:\vjvpd.exe177⤵PID:1084
-
\??\c:\rrrfxxx.exec:\rrrfxxx.exe178⤵PID:3704
-
\??\c:\ffffxrl.exec:\ffffxrl.exe179⤵PID:1584
-
\??\c:\htnhbt.exec:\htnhbt.exe180⤵PID:2440
-
\??\c:\vpdjj.exec:\vpdjj.exe181⤵PID:1336
-
\??\c:\vpvvp.exec:\vpvvp.exe182⤵PID:2264
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe183⤵PID:2108
-
\??\c:\fxxrllf.exec:\fxxrllf.exe184⤵PID:4336
-
\??\c:\nbhhtb.exec:\nbhhtb.exe185⤵PID:3228
-
\??\c:\dvdvp.exec:\dvdvp.exe186⤵PID:1420
-
\??\c:\ddjdd.exec:\ddjdd.exe187⤵PID:4032
-
\??\c:\xfrfllf.exec:\xfrfllf.exe188⤵PID:1116
-
\??\c:\rlxrxrr.exec:\rlxrxrr.exe189⤵PID:5052
-
\??\c:\7thbhh.exec:\7thbhh.exe190⤵PID:2956
-
\??\c:\vvpjv.exec:\vvpjv.exe191⤵PID:1720
-
\??\c:\vpjdv.exec:\vpjdv.exe192⤵PID:3968
-
\??\c:\5rxxrrr.exec:\5rxxrrr.exe193⤵PID:1248
-
\??\c:\xrlfrxr.exec:\xrlfrxr.exe194⤵PID:4936
-
\??\c:\5tnbbb.exec:\5tnbbb.exe195⤵PID:848
-
\??\c:\xlfxffl.exec:\xlfxffl.exe196⤵PID:4464
-
\??\c:\9xlffxl.exec:\9xlffxl.exe197⤵PID:2236
-
\??\c:\1tttnt.exec:\1tttnt.exe198⤵PID:496
-
\??\c:\ddjjd.exec:\ddjjd.exe199⤵PID:2388
-
\??\c:\xfllfll.exec:\xfllfll.exe200⤵PID:4840
-
\??\c:\tnhhhb.exec:\tnhhhb.exe201⤵PID:4112
-
\??\c:\vjpjd.exec:\vjpjd.exe202⤵PID:4904
-
\??\c:\dppvj.exec:\dppvj.exe203⤵PID:2492
-
\??\c:\3xxrrlf.exec:\3xxrrlf.exe204⤵PID:3420
-
\??\c:\thnhbb.exec:\thnhbb.exe205⤵PID:4512
-
\??\c:\1jdjd.exec:\1jdjd.exe206⤵PID:4084
-
\??\c:\vdjjd.exec:\vdjjd.exe207⤵PID:4232
-
\??\c:\9ffrlll.exec:\9ffrlll.exe208⤵PID:3376
-
\??\c:\bnnbbb.exec:\bnnbbb.exe209⤵PID:936
-
\??\c:\1hbtbb.exec:\1hbtbb.exe210⤵PID:4016
-
\??\c:\3jjdd.exec:\3jjdd.exe211⤵PID:3720
-
\??\c:\lfflfxf.exec:\lfflfxf.exe212⤵PID:712
-
\??\c:\nhbbhh.exec:\nhbbhh.exe213⤵PID:5084
-
\??\c:\ppddd.exec:\ppddd.exe214⤵PID:3280
-
\??\c:\7vvpp.exec:\7vvpp.exe215⤵PID:2304
-
\??\c:\1fllflf.exec:\1fllflf.exe216⤵PID:448
-
\??\c:\1thnbt.exec:\1thnbt.exe217⤵PID:1692
-
\??\c:\3nttbh.exec:\3nttbh.exe218⤵PID:1924
-
\??\c:\jvddv.exec:\jvddv.exe219⤵PID:4656
-
\??\c:\fxllfff.exec:\fxllfff.exe220⤵PID:3288
-
\??\c:\3btnhn.exec:\3btnhn.exe221⤵PID:1920
-
\??\c:\bbhbbb.exec:\bbhbbb.exe222⤵PID:4800
-
\??\c:\rxrrrxl.exec:\rxrrrxl.exe223⤵PID:1252
-
\??\c:\thtnbn.exec:\thtnbn.exe224⤵PID:2256
-
\??\c:\3hhbtt.exec:\3hhbtt.exe225⤵PID:3080
-
\??\c:\7vvpj.exec:\7vvpj.exe226⤵PID:3140
-
\??\c:\1ffxfff.exec:\1ffxfff.exe227⤵PID:3528
-
\??\c:\bbbtnb.exec:\bbbtnb.exe228⤵PID:2308
-
\??\c:\vvvvv.exec:\vvvvv.exe229⤵PID:456
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe230⤵PID:3220
-
\??\c:\1rrxxxx.exec:\1rrxxxx.exe231⤵PID:3092
-
\??\c:\9bhhbb.exec:\9bhhbb.exe232⤵PID:208
-
\??\c:\3hnhnn.exec:\3hnhnn.exe233⤵PID:2600
-
\??\c:\jpjvp.exec:\jpjvp.exe234⤵PID:4476
-
\??\c:\7llllll.exec:\7llllll.exe235⤵PID:1228
-
\??\c:\rxrlfxr.exec:\rxrlfxr.exe236⤵PID:4440
-
\??\c:\bnbhhb.exec:\bnbhhb.exe237⤵PID:1828
-
\??\c:\9vvpp.exec:\9vvpp.exe238⤵PID:4272
-
\??\c:\xlrrlxl.exec:\xlrrlxl.exe239⤵PID:1600
-
\??\c:\3xfffxx.exec:\3xfffxx.exe240⤵PID:3480
-
\??\c:\nnbbhh.exec:\nnbbhh.exe241⤵PID:836
-
\??\c:\pddjj.exec:\pddjj.exe242⤵PID:4612