Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 18:15
Behavioral task
behavioral1
Sample
27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe
Resource
win7-20240215-en
General
-
Target
27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe
-
Size
321KB
-
MD5
27d90fdad1f97a0138be4dd3f4eb4820
-
SHA1
a71a2742e5b3a4c678a792f20e52e4cab802e3dc
-
SHA256
eb51e323d080a602749b70160604e0f101ac3684ce1d3aab3643ede16a0adf3b
-
SHA512
eeaa41e86bbc9455369c849d414fe307329178904a6516777a2920537155ac659e135fad64d902bcae37d85e802ed25a68d3cb521ff70cd5d31cd8efbdbae1e7
-
SSDEEP
6144:9cm4FmowdHoSZrv9AEa3F2Y9iE9mJrtMsQBcqNLq3xk:/4wFHoSB969P9mJRMsfqV2K
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2760-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2872-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4436-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2956-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1156-36-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4948-42-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2560-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1884-64-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1088-68-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2024-56-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2140-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4900-79-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3124-85-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2988-86-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4964-97-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3112-114-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2240-120-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2196-126-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4520-133-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4384-135-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4788-141-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4568-154-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3900-175-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4356-162-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4372-184-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3608-195-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4600-201-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1624-209-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3484-219-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3500-223-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3064-227-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/888-242-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1980-249-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2984-256-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/960-260-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4588-264-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/692-268-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2052-276-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/972-283-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1944-291-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4824-303-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1424-313-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3292-329-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/396-340-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3192-368-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/892-384-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2140-398-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3816-426-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1420-431-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/208-441-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2160-445-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1120-455-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5072-494-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3980-495-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2272-554-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1568-562-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5080-575-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3988-621-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5088-628-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3100-638-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4588-667-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3328-677-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2120-687-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3112-692-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\jdjjj.exe family_berbew C:\hhtttt.exe family_berbew \??\c:\djppd.exe family_berbew C:\9flfxxx.exe family_berbew C:\djpvv.exe family_berbew C:\llxfffr.exe family_berbew \??\c:\5pvvv.exe family_berbew C:\rrxllll.exe family_berbew C:\jjvvp.exe family_berbew C:\lxffflf.exe family_berbew C:\bbbbhh.exe family_berbew C:\ntbhhh.exe family_berbew C:\tntntt.exe family_berbew C:\7pdvj.exe family_berbew \??\c:\llfxfrr.exe family_berbew C:\jjjjj.exe family_berbew \??\c:\7vvpd.exe family_berbew \??\c:\lflrlff.exe family_berbew C:\lxxxxrr.exe family_berbew C:\dvddd.exe family_berbew C:\rllfffx.exe family_berbew C:\nhtntt.exe family_berbew C:\vvvvv.exe family_berbew C:\ppddj.exe family_berbew C:\ttnnnh.exe family_berbew C:\9dvvp.exe family_berbew C:\rxxrrrx.exe family_berbew C:\htnhbn.exe family_berbew C:\dppjj.exe family_berbew C:\djjdv.exe family_berbew C:\dvjjj.exe family_berbew C:\dpvvv.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
jdjjj.exehhtttt.exedjppd.exe9flfxxx.exedjpvv.exellxfffr.exe5pvvv.exerrxllll.exejjvvp.exelxffflf.exebbbbhh.exentbhhh.exetntntt.exe7pdvj.exellfxfrr.exejjjjj.exe7vvpd.exelflrlff.exelxxxxrr.exedvddd.exerllfffx.exenhtntt.exevvvvv.exeppddj.exettnnnh.exe9dvvp.exerxxrrrx.exehtnhbn.exedppjj.exedjjdv.exedvjjj.exedpvvv.exexfrfrfl.exettbnnh.exepjvpp.exejdjdv.exexrxxxxr.exenhnnbb.exetbtbhb.exeddddd.exelrxxxfx.exebhbbtn.exenntnbb.exevvddj.exe5rfflrx.exelxxllfl.exehnhnnh.exeddppp.exebbbbbb.exevvddd.exelrxxxfl.exettbhtb.exedvvvv.exefxlflff.exetnbttt.exebtbbtb.exe1pvpj.exe1ffxxxx.exelflllrx.exehnttbb.exejvdpd.exelfxrxxr.exebhtbbn.exenhbhbn.exepid process 2872 jdjjj.exe 3484 hhtttt.exe 4436 djppd.exe 2956 9flfxxx.exe 1156 djpvv.exe 4948 llxfffr.exe 2560 5pvvv.exe 2140 rrxllll.exe 2024 jjvvp.exe 1884 lxffflf.exe 1088 bbbbhh.exe 4900 ntbhhh.exe 3124 tntntt.exe 2988 7pdvj.exe 4964 llfxfrr.exe 1696 jjjjj.exe 936 7vvpd.exe 3112 lflrlff.exe 2240 lxxxxrr.exe 2196 dvddd.exe 4520 rllfffx.exe 4384 nhtntt.exe 4788 vvvvv.exe 4568 ppddj.exe 904 ttnnnh.exe 3424 9dvvp.exe 4356 rxxrrrx.exe 4284 htnhbn.exe 3900 dppjj.exe 4372 djjdv.exe 1912 dvjjj.exe 4960 dpvvv.exe 3608 xfrfrfl.exe 4600 ttbnnh.exe 3192 pjvpp.exe 4408 jdjdv.exe 1624 xrxxxxr.exe 2152 nhnnbb.exe 1904 tbtbhb.exe 3484 ddddd.exe 3500 lrxxxfx.exe 3064 bhbbtn.exe 3100 nntnbb.exe 3920 vvddj.exe 5000 5rfflrx.exe 4140 lxxllfl.exe 888 hnhnnh.exe 1980 ddppp.exe 3996 bbbbbb.exe 2984 vvddd.exe 960 lrxxxfl.exe 4588 ttbhtb.exe 692 dvvvv.exe 4776 fxlflff.exe 2052 tnbttt.exe 2228 btbbtb.exe 3232 1pvpj.exe 972 1ffxxxx.exe 3004 lflllrx.exe 1944 hnttbb.exe 2160 jvdpd.exe 1480 lfxrxxr.exe 2352 bhtbbn.exe 4824 nhbhbn.exe -
Processes:
resource yara_rule behavioral2/memory/2760-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jdjjj.exe upx behavioral2/memory/2760-5-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hhtttt.exe upx behavioral2/memory/2872-12-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\djppd.exe upx behavioral2/memory/4436-17-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\9flfxxx.exe upx behavioral2/memory/2956-24-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\djpvv.exe upx behavioral2/memory/2956-29-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\llxfffr.exe upx behavioral2/memory/1156-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4948-42-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\5pvvv.exe upx C:\rrxllll.exe upx behavioral2/memory/2560-48-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jjvvp.exe upx C:\lxffflf.exe upx C:\bbbbhh.exe upx behavioral2/memory/1884-64-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1088-68-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ntbhhh.exe upx behavioral2/memory/4900-73-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2024-56-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2140-54-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tntntt.exe upx behavioral2/memory/4900-79-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3124-85-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\7pdvj.exe upx \??\c:\llfxfrr.exe upx behavioral2/memory/4964-91-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2988-86-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jjjjj.exe upx \??\c:\7vvpd.exe upx behavioral2/memory/936-103-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4964-97-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lflrlff.exe upx C:\lxxxxrr.exe upx behavioral2/memory/3112-114-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2240-115-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dvddd.exe upx behavioral2/memory/2240-120-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rllfffx.exe upx behavioral2/memory/2196-126-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nhtntt.exe upx behavioral2/memory/4520-133-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4384-135-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vvvvv.exe upx behavioral2/memory/4788-141-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ppddj.exe upx C:\ttnnnh.exe upx C:\9dvvp.exe upx behavioral2/memory/3424-157-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4568-154-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rxxrrrx.exe upx C:\htnhbn.exe upx C:\dppjj.exe upx C:\djjdv.exe upx behavioral2/memory/3900-175-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4356-162-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dvjjj.exe upx behavioral2/memory/4372-184-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dpvvv.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exejdjjj.exehhtttt.exedjppd.exe9flfxxx.exedjpvv.exellxfffr.exe5pvvv.exerrxllll.exejjvvp.exelxffflf.exebbbbhh.exentbhhh.exetntntt.exe7pdvj.exellfxfrr.exejjjjj.exe7vvpd.exelflrlff.exelxxxxrr.exedvddd.exerllfffx.exedescription pid process target process PID 2760 wrote to memory of 2872 2760 27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe jdjjj.exe PID 2760 wrote to memory of 2872 2760 27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe jdjjj.exe PID 2760 wrote to memory of 2872 2760 27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe jdjjj.exe PID 2872 wrote to memory of 3484 2872 jdjjj.exe hhtttt.exe PID 2872 wrote to memory of 3484 2872 jdjjj.exe hhtttt.exe PID 2872 wrote to memory of 3484 2872 jdjjj.exe hhtttt.exe PID 3484 wrote to memory of 4436 3484 hhtttt.exe djppd.exe PID 3484 wrote to memory of 4436 3484 hhtttt.exe djppd.exe PID 3484 wrote to memory of 4436 3484 hhtttt.exe djppd.exe PID 4436 wrote to memory of 2956 4436 djppd.exe 9flfxxx.exe PID 4436 wrote to memory of 2956 4436 djppd.exe 9flfxxx.exe PID 4436 wrote to memory of 2956 4436 djppd.exe 9flfxxx.exe PID 2956 wrote to memory of 1156 2956 9flfxxx.exe djpvv.exe PID 2956 wrote to memory of 1156 2956 9flfxxx.exe djpvv.exe PID 2956 wrote to memory of 1156 2956 9flfxxx.exe djpvv.exe PID 1156 wrote to memory of 4948 1156 djpvv.exe llxfffr.exe PID 1156 wrote to memory of 4948 1156 djpvv.exe llxfffr.exe PID 1156 wrote to memory of 4948 1156 djpvv.exe llxfffr.exe PID 4948 wrote to memory of 2560 4948 llxfffr.exe 5pvvv.exe PID 4948 wrote to memory of 2560 4948 llxfffr.exe 5pvvv.exe PID 4948 wrote to memory of 2560 4948 llxfffr.exe 5pvvv.exe PID 2560 wrote to memory of 2140 2560 5pvvv.exe rrxllll.exe PID 2560 wrote to memory of 2140 2560 5pvvv.exe rrxllll.exe PID 2560 wrote to memory of 2140 2560 5pvvv.exe rrxllll.exe PID 2140 wrote to memory of 2024 2140 rrxllll.exe jjvvp.exe PID 2140 wrote to memory of 2024 2140 rrxllll.exe jjvvp.exe PID 2140 wrote to memory of 2024 2140 rrxllll.exe jjvvp.exe PID 2024 wrote to memory of 1884 2024 jjvvp.exe lxffflf.exe PID 2024 wrote to memory of 1884 2024 jjvvp.exe lxffflf.exe PID 2024 wrote to memory of 1884 2024 jjvvp.exe lxffflf.exe PID 1884 wrote to memory of 1088 1884 lxffflf.exe bbbbhh.exe PID 1884 wrote to memory of 1088 1884 lxffflf.exe bbbbhh.exe PID 1884 wrote to memory of 1088 1884 lxffflf.exe bbbbhh.exe PID 1088 wrote to memory of 4900 1088 bbbbhh.exe ntbhhh.exe PID 1088 wrote to memory of 4900 1088 bbbbhh.exe ntbhhh.exe PID 1088 wrote to memory of 4900 1088 bbbbhh.exe ntbhhh.exe PID 4900 wrote to memory of 3124 4900 ntbhhh.exe tntntt.exe PID 4900 wrote to memory of 3124 4900 ntbhhh.exe tntntt.exe PID 4900 wrote to memory of 3124 4900 ntbhhh.exe tntntt.exe PID 3124 wrote to memory of 2988 3124 tntntt.exe 7pdvj.exe PID 3124 wrote to memory of 2988 3124 tntntt.exe 7pdvj.exe PID 3124 wrote to memory of 2988 3124 tntntt.exe 7pdvj.exe PID 2988 wrote to memory of 4964 2988 7pdvj.exe llfxfrr.exe PID 2988 wrote to memory of 4964 2988 7pdvj.exe llfxfrr.exe PID 2988 wrote to memory of 4964 2988 7pdvj.exe llfxfrr.exe PID 4964 wrote to memory of 1696 4964 llfxfrr.exe jjjjj.exe PID 4964 wrote to memory of 1696 4964 llfxfrr.exe jjjjj.exe PID 4964 wrote to memory of 1696 4964 llfxfrr.exe jjjjj.exe PID 1696 wrote to memory of 936 1696 jjjjj.exe 7vvpd.exe PID 1696 wrote to memory of 936 1696 jjjjj.exe 7vvpd.exe PID 1696 wrote to memory of 936 1696 jjjjj.exe 7vvpd.exe PID 936 wrote to memory of 3112 936 7vvpd.exe lflrlff.exe PID 936 wrote to memory of 3112 936 7vvpd.exe lflrlff.exe PID 936 wrote to memory of 3112 936 7vvpd.exe lflrlff.exe PID 3112 wrote to memory of 2240 3112 lflrlff.exe lxxxxrr.exe PID 3112 wrote to memory of 2240 3112 lflrlff.exe lxxxxrr.exe PID 3112 wrote to memory of 2240 3112 lflrlff.exe lxxxxrr.exe PID 2240 wrote to memory of 2196 2240 lxxxxrr.exe dvddd.exe PID 2240 wrote to memory of 2196 2240 lxxxxrr.exe dvddd.exe PID 2240 wrote to memory of 2196 2240 lxxxxrr.exe dvddd.exe PID 2196 wrote to memory of 4520 2196 dvddd.exe rllfffx.exe PID 2196 wrote to memory of 4520 2196 dvddd.exe rllfffx.exe PID 2196 wrote to memory of 4520 2196 dvddd.exe rllfffx.exe PID 4520 wrote to memory of 4384 4520 rllfffx.exe nhtntt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\jdjjj.exec:\jdjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hhtttt.exec:\hhtttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\djppd.exec:\djppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\9flfxxx.exec:\9flfxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\djpvv.exec:\djpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\llxfffr.exec:\llxfffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\5pvvv.exec:\5pvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rrxllll.exec:\rrxllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\jjvvp.exec:\jjvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\lxffflf.exec:\lxffflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\bbbbhh.exec:\bbbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\ntbhhh.exec:\ntbhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\tntntt.exec:\tntntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\7pdvj.exec:\7pdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\llfxfrr.exec:\llfxfrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\jjjjj.exec:\jjjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\7vvpd.exec:\7vvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\lflrlff.exec:\lflrlff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\lxxxxrr.exec:\lxxxxrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\dvddd.exec:\dvddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\rllfffx.exec:\rllfffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\nhtntt.exec:\nhtntt.exe23⤵
- Executes dropped EXE
PID:4384 -
\??\c:\vvvvv.exec:\vvvvv.exe24⤵
- Executes dropped EXE
PID:4788 -
\??\c:\ppddj.exec:\ppddj.exe25⤵
- Executes dropped EXE
PID:4568 -
\??\c:\ttnnnh.exec:\ttnnnh.exe26⤵
- Executes dropped EXE
PID:904 -
\??\c:\9dvvp.exec:\9dvvp.exe27⤵
- Executes dropped EXE
PID:3424 -
\??\c:\rxxrrrx.exec:\rxxrrrx.exe28⤵
- Executes dropped EXE
PID:4356 -
\??\c:\htnhbn.exec:\htnhbn.exe29⤵
- Executes dropped EXE
PID:4284 -
\??\c:\dppjj.exec:\dppjj.exe30⤵
- Executes dropped EXE
PID:3900 -
\??\c:\djjdv.exec:\djjdv.exe31⤵
- Executes dropped EXE
PID:4372 -
\??\c:\dvjjj.exec:\dvjjj.exe32⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dpvvv.exec:\dpvvv.exe33⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xfrfrfl.exec:\xfrfrfl.exe34⤵
- Executes dropped EXE
PID:3608 -
\??\c:\ttbnnh.exec:\ttbnnh.exe35⤵
- Executes dropped EXE
PID:4600 -
\??\c:\pjvpp.exec:\pjvpp.exe36⤵
- Executes dropped EXE
PID:3192 -
\??\c:\jdjdv.exec:\jdjdv.exe37⤵
- Executes dropped EXE
PID:4408 -
\??\c:\xrxxxxr.exec:\xrxxxxr.exe38⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nhnnbb.exec:\nhnnbb.exe39⤵
- Executes dropped EXE
PID:2152 -
\??\c:\tbtbhb.exec:\tbtbhb.exe40⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ddddd.exec:\ddddd.exe41⤵
- Executes dropped EXE
PID:3484 -
\??\c:\lrxxxfx.exec:\lrxxxfx.exe42⤵
- Executes dropped EXE
PID:3500 -
\??\c:\bhbbtn.exec:\bhbbtn.exe43⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nntnbb.exec:\nntnbb.exe44⤵
- Executes dropped EXE
PID:3100 -
\??\c:\vvddj.exec:\vvddj.exe45⤵
- Executes dropped EXE
PID:3920 -
\??\c:\5rfflrx.exec:\5rfflrx.exe46⤵
- Executes dropped EXE
PID:5000 -
\??\c:\lxxllfl.exec:\lxxllfl.exe47⤵
- Executes dropped EXE
PID:4140 -
\??\c:\hnhnnh.exec:\hnhnnh.exe48⤵
- Executes dropped EXE
PID:888 -
\??\c:\ddppp.exec:\ddppp.exe49⤵
- Executes dropped EXE
PID:1980 -
\??\c:\bbbbbb.exec:\bbbbbb.exe50⤵
- Executes dropped EXE
PID:3996 -
\??\c:\vvddd.exec:\vvddd.exe51⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lrxxxfl.exec:\lrxxxfl.exe52⤵
- Executes dropped EXE
PID:960 -
\??\c:\ttbhtb.exec:\ttbhtb.exe53⤵
- Executes dropped EXE
PID:4588 -
\??\c:\dvvvv.exec:\dvvvv.exe54⤵
- Executes dropped EXE
PID:692 -
\??\c:\fxlflff.exec:\fxlflff.exe55⤵
- Executes dropped EXE
PID:4776 -
\??\c:\tnbttt.exec:\tnbttt.exe56⤵
- Executes dropped EXE
PID:2052 -
\??\c:\btbbtb.exec:\btbbtb.exe57⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1pvpj.exec:\1pvpj.exe58⤵
- Executes dropped EXE
PID:3232 -
\??\c:\1ffxxxx.exec:\1ffxxxx.exe59⤵
- Executes dropped EXE
PID:972 -
\??\c:\lflllrx.exec:\lflllrx.exe60⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hnttbb.exec:\hnttbb.exe61⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jvdpd.exec:\jvdpd.exe62⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lfxrxxr.exec:\lfxrxxr.exe63⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bhtbbn.exec:\bhtbbn.exe64⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nhbhbn.exec:\nhbhbn.exe65⤵
- Executes dropped EXE
PID:4824 -
\??\c:\vdpvv.exec:\vdpvv.exe66⤵PID:2644
-
\??\c:\rllfxff.exec:\rllfxff.exe67⤵PID:3272
-
\??\c:\thhhbb.exec:\thhhbb.exe68⤵PID:1424
-
\??\c:\pjddj.exec:\pjddj.exe69⤵PID:4788
-
\??\c:\frxffxf.exec:\frxffxf.exe70⤵PID:4760
-
\??\c:\thnnnb.exec:\thnnnb.exe71⤵PID:3444
-
\??\c:\ddppj.exec:\ddppj.exe72⤵PID:3292
-
\??\c:\flflflr.exec:\flflflr.exe73⤵PID:3680
-
\??\c:\rfffrrf.exec:\rfffrrf.exe74⤵PID:3976
-
\??\c:\7nthhh.exec:\7nthhh.exe75⤵PID:396
-
\??\c:\vjppv.exec:\vjppv.exe76⤵PID:3096
-
\??\c:\llflrrx.exec:\llflrrx.exe77⤵PID:684
-
\??\c:\7btttt.exec:\7btttt.exe78⤵PID:4372
-
\??\c:\5nhhhh.exec:\5nhhhh.exe79⤵PID:3700
-
\??\c:\jvjvp.exec:\jvjvp.exe80⤵PID:5072
-
\??\c:\lfrffff.exec:\lfrffff.exe81⤵PID:4472
-
\??\c:\nhthbb.exec:\nhthbb.exe82⤵PID:1520
-
\??\c:\ddppj.exec:\ddppj.exe83⤵PID:4420
-
\??\c:\djppj.exec:\djppj.exe84⤵PID:3192
-
\??\c:\5pvjd.exec:\5pvjd.exe85⤵PID:3744
-
\??\c:\lrxrxll.exec:\lrxrxll.exe86⤵PID:2960
-
\??\c:\xxlrxlr.exec:\xxlrxlr.exe87⤵PID:2976
-
\??\c:\hbtttt.exec:\hbtttt.exe88⤵PID:2956
-
\??\c:\vjddv.exec:\vjddv.exe89⤵PID:892
-
\??\c:\djjdp.exec:\djjdp.exe90⤵PID:5028
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe91⤵PID:4948
-
\??\c:\ntbhtb.exec:\ntbhtb.exe92⤵PID:4152
-
\??\c:\vpdvp.exec:\vpdvp.exe93⤵PID:2860
-
\??\c:\xrrllrl.exec:\xrrllrl.exe94⤵PID:2140
-
\??\c:\ffffxxx.exec:\ffffxxx.exe95⤵PID:4068
-
\??\c:\1ttnnn.exec:\1ttnnn.exe96⤵PID:2648
-
\??\c:\jvdpp.exec:\jvdpp.exe97⤵PID:2984
-
\??\c:\lfxlffx.exec:\lfxlffx.exe98⤵PID:944
-
\??\c:\hhnnnn.exec:\hhnnnn.exe99⤵PID:220
-
\??\c:\jdjjd.exec:\jdjjd.exe100⤵PID:2636
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe101⤵PID:4364
-
\??\c:\hnbhbt.exec:\hnbhbt.exe102⤵PID:3816
-
\??\c:\pvdjp.exec:\pvdjp.exe103⤵PID:1420
-
\??\c:\vjjdd.exec:\vjjdd.exe104⤵PID:2120
-
\??\c:\7lfrllf.exec:\7lfrllf.exe105⤵PID:4340
-
\??\c:\nbhbnn.exec:\nbhbnn.exe106⤵PID:208
-
\??\c:\jvdvj.exec:\jvdvj.exe107⤵PID:4052
-
\??\c:\frrlxxr.exec:\frrlxxr.exe108⤵PID:2160
-
\??\c:\xlxrlll.exec:\xlxrlll.exe109⤵PID:1480
-
\??\c:\ttbbtt.exec:\ttbbtt.exe110⤵PID:2352
-
\??\c:\5jdvj.exec:\5jdvj.exe111⤵PID:1120
-
\??\c:\vvjjd.exec:\vvjjd.exe112⤵PID:2012
-
\??\c:\bntntb.exec:\bntntb.exe113⤵PID:228
-
\??\c:\hbbbtn.exec:\hbbbtn.exe114⤵PID:4788
-
\??\c:\jdjvv.exec:\jdjvv.exe115⤵PID:4944
-
\??\c:\5fllrfx.exec:\5fllrfx.exe116⤵PID:4220
-
\??\c:\9thbtn.exec:\9thbtn.exe117⤵PID:4356
-
\??\c:\btnhbn.exec:\btnhbn.exe118⤵PID:4144
-
\??\c:\jjdvv.exec:\jjdvv.exe119⤵PID:1248
-
\??\c:\xlxxlrl.exec:\xlxxlrl.exe120⤵PID:1720
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe121⤵PID:4372
-
\??\c:\1tttnn.exec:\1tttnn.exe122⤵PID:5072
-
\??\c:\dvjdp.exec:\dvjdp.exe123⤵PID:3980
-
\??\c:\jvddv.exec:\jvddv.exe124⤵PID:1496
-
\??\c:\7xxxrxx.exec:\7xxxrxx.exe125⤵PID:216
-
\??\c:\nbnhhh.exec:\nbnhhh.exe126⤵PID:2672
-
\??\c:\tnnnnb.exec:\tnnnnb.exe127⤵PID:3448
-
\??\c:\pjpjd.exec:\pjpjd.exe128⤵PID:5008
-
\??\c:\rlxxfll.exec:\rlxxfll.exe129⤵PID:4892
-
\??\c:\ttnnnn.exec:\ttnnnn.exe130⤵PID:4360
-
\??\c:\jdvpp.exec:\jdvpp.exe131⤵PID:4948
-
\??\c:\rxffrff.exec:\rxffrff.exe132⤵PID:4140
-
\??\c:\ppjjj.exec:\ppjjj.exe133⤵PID:2860
-
\??\c:\frrlffx.exec:\frrlffx.exe134⤵PID:1980
-
\??\c:\vvddd.exec:\vvddd.exe135⤵PID:1740
-
\??\c:\vvjjv.exec:\vvjjv.exe136⤵PID:1088
-
\??\c:\rfrlfff.exec:\rfrlfff.exe137⤵PID:5012
-
\??\c:\thbbhn.exec:\thbbhn.exe138⤵PID:4588
-
\??\c:\jddjd.exec:\jddjd.exe139⤵PID:2388
-
\??\c:\xxlflll.exec:\xxlflll.exe140⤵PID:3812
-
\??\c:\nhbbtb.exec:\nhbbtb.exe141⤵PID:2200
-
\??\c:\tbnbbn.exec:\tbnbbn.exe142⤵PID:2272
-
\??\c:\vjvpj.exec:\vjvpj.exe143⤵PID:1568
-
\??\c:\xrllrrf.exec:\xrllrrf.exe144⤵PID:2120
-
\??\c:\rfrffff.exec:\rfrffff.exe145⤵PID:4036
-
\??\c:\bttnhb.exec:\bttnhb.exe146⤵PID:208
-
\??\c:\1djvv.exec:\1djvv.exe147⤵PID:1500
-
\??\c:\rlxrlrl.exec:\rlxrlrl.exe148⤵PID:5080
-
\??\c:\tnbnhb.exec:\tnbnhb.exe149⤵PID:1480
-
\??\c:\jjjvj.exec:\jjjvj.exe150⤵PID:2352
-
\??\c:\3xfxxxx.exec:\3xfxxxx.exe151⤵PID:3104
-
\??\c:\1xxrrxr.exec:\1xxrrxr.exe152⤵PID:4592
-
\??\c:\bttbhh.exec:\bttbhh.exe153⤵PID:2256
-
\??\c:\thhbtt.exec:\thhbtt.exe154⤵PID:4568
-
\??\c:\dpvpd.exec:\dpvpd.exe155⤵PID:1708
-
\??\c:\1fflffx.exec:\1fflffx.exe156⤵PID:3956
-
\??\c:\xfrrxxx.exec:\xfrrxxx.exe157⤵PID:2028
-
\??\c:\bbtbtt.exec:\bbtbtt.exe158⤵PID:4696
-
\??\c:\nthhbt.exec:\nthhbt.exe159⤵PID:2444
-
\??\c:\vvjjp.exec:\vvjjp.exe160⤵PID:1224
-
\??\c:\lllfllf.exec:\lllfllf.exe161⤵PID:2376
-
\??\c:\btbbbb.exec:\btbbbb.exe162⤵PID:3988
-
\??\c:\jpjjp.exec:\jpjjp.exe163⤵PID:4408
-
\??\c:\fxffxxf.exec:\fxffxxf.exe164⤵PID:5088
-
\??\c:\lflfxxx.exec:\lflfxxx.exe165⤵PID:3360
-
\??\c:\5hnbtt.exec:\5hnbtt.exe166⤵PID:2956
-
\??\c:\pppjv.exec:\pppjv.exe167⤵PID:3100
-
\??\c:\rrlffff.exec:\rrlffff.exe168⤵PID:5028
-
\??\c:\hbnnnt.exec:\hbnnnt.exe169⤵PID:5092
-
\??\c:\hbtttt.exec:\hbtttt.exe170⤵PID:4240
-
\??\c:\ddddd.exec:\ddddd.exe171⤵PID:4228
-
\??\c:\vdvvj.exec:\vdvvj.exe172⤵PID:3660
-
\??\c:\3fllfff.exec:\3fllfff.exe173⤵PID:2648
-
\??\c:\tbbbbt.exec:\tbbbbt.exe174⤵PID:1088
-
\??\c:\vdjjd.exec:\vdjjd.exe175⤵PID:5012
-
\??\c:\xrfffff.exec:\xrfffff.exe176⤵PID:4588
-
\??\c:\bhhnhb.exec:\bhhnhb.exe177⤵PID:2388
-
\??\c:\jvvvp.exec:\jvvvp.exe178⤵PID:4964
-
\??\c:\fllrlxr.exec:\fllrlxr.exe179⤵PID:1560
-
\??\c:\rxlxxrr.exec:\rxlxxrr.exe180⤵PID:3328
-
\??\c:\5hhbht.exec:\5hhbht.exe181⤵PID:2032
-
\??\c:\pjpjd.exec:\pjpjd.exe182⤵PID:2120
-
\??\c:\rfxrlrf.exec:\rfxrlrf.exe183⤵PID:4036
-
\??\c:\lflfxxr.exec:\lflfxxr.exe184⤵PID:3112
-
\??\c:\nhhbnn.exec:\nhhbnn.exe185⤵PID:112
-
\??\c:\jjvvj.exec:\jjvvj.exe186⤵PID:1316
-
\??\c:\hhttbh.exec:\hhttbh.exe187⤵PID:1480
-
\??\c:\nnttbb.exec:\nnttbb.exe188⤵PID:824
-
\??\c:\ddppd.exec:\ddppd.exe189⤵PID:4120
-
\??\c:\frrrrrr.exec:\frrrrrr.exe190⤵PID:228
-
\??\c:\bnbttb.exec:\bnbttb.exe191⤵PID:4760
-
\??\c:\jdjjp.exec:\jdjjp.exe192⤵PID:4020
-
\??\c:\vvvpd.exec:\vvvpd.exe193⤵PID:2620
-
\??\c:\1lrlllr.exec:\1lrlllr.exe194⤵PID:3956
-
\??\c:\tttnhb.exec:\tttnhb.exe195⤵PID:684
-
\??\c:\thnbnb.exec:\thnbnb.exe196⤵PID:1132
-
\??\c:\pvvjd.exec:\pvvjd.exe197⤵PID:2444
-
\??\c:\fxxfffx.exec:\fxxfffx.exe198⤵PID:5048
-
\??\c:\tnbhht.exec:\tnbhht.exe199⤵PID:2872
-
\??\c:\bthnhh.exec:\bthnhh.exe200⤵PID:4408
-
\??\c:\5vdjj.exec:\5vdjj.exe201⤵PID:1156
-
\??\c:\ppppj.exec:\ppppj.exe202⤵PID:3360
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe203⤵PID:2956
-
\??\c:\thtnnn.exec:\thtnnn.exe204⤵PID:4360
-
\??\c:\pjjjd.exec:\pjjjd.exe205⤵PID:5028
-
\??\c:\lxrlxrr.exec:\lxrlxrr.exe206⤵PID:2140
-
\??\c:\hnnnhb.exec:\hnnnhb.exe207⤵PID:3996
-
\??\c:\bhtnnt.exec:\bhtnnt.exe208⤵PID:4228
-
\??\c:\pppjd.exec:\pppjd.exe209⤵PID:3660
-
\??\c:\llxxlll.exec:\llxxlll.exe210⤵PID:2648
-
\??\c:\fxlllrl.exec:\fxlllrl.exe211⤵PID:4988
-
\??\c:\nbbtnn.exec:\nbbtnn.exe212⤵PID:4776
-
\??\c:\hhtnnn.exec:\hhtnnn.exe213⤵PID:3464
-
\??\c:\ppdvp.exec:\ppdvp.exe214⤵PID:4964
-
\??\c:\vjdvp.exec:\vjdvp.exe215⤵PID:4388
-
\??\c:\lfxlrlf.exec:\lfxlrlf.exe216⤵PID:3328
-
\??\c:\btnnnb.exec:\btnnnb.exe217⤵PID:2032
-
\??\c:\dddjd.exec:\dddjd.exe218⤵PID:2120
-
\??\c:\5vvdd.exec:\5vvdd.exe219⤵PID:4036
-
\??\c:\lfrxfll.exec:\lfrxfll.exe220⤵PID:440
-
\??\c:\jddpj.exec:\jddpj.exe221⤵PID:2404
-
\??\c:\jvjdd.exec:\jvjdd.exe222⤵PID:3272
-
\??\c:\lfrlxxf.exec:\lfrlxxf.exe223⤵PID:4236
-
\??\c:\hhnbbh.exec:\hhnbbh.exe224⤵PID:4548
-
\??\c:\vdvdp.exec:\vdvdp.exe225⤵PID:4120
-
\??\c:\vvvvp.exec:\vvvvp.exe226⤵PID:228
-
\??\c:\lxrlxrx.exec:\lxrlxrx.exe227⤵PID:4760
-
\??\c:\bttnhb.exec:\bttnhb.exe228⤵PID:4016
-
\??\c:\dvvjv.exec:\dvvjv.exe229⤵PID:4356
-
\??\c:\rfrlfff.exec:\rfrlfff.exe230⤵PID:3956
-
\??\c:\xlfxrll.exec:\xlfxrll.exe231⤵PID:3740
-
\??\c:\hhntnt.exec:\hhntnt.exe232⤵PID:1132
-
\??\c:\vvdvv.exec:\vvdvv.exe233⤵PID:4420
-
\??\c:\flxfrll.exec:\flxfrll.exe234⤵PID:2928
-
\??\c:\bbbbtt.exec:\bbbbtt.exe235⤵PID:5068
-
\??\c:\bttnnn.exec:\bttnnn.exe236⤵PID:2672
-
\??\c:\jpjjj.exec:\jpjjj.exe237⤵PID:4328
-
\??\c:\rxxfxxx.exec:\rxxfxxx.exe238⤵PID:5008
-
\??\c:\1xrlllf.exec:\1xrlllf.exe239⤵PID:4640
-
\??\c:\5tttbb.exec:\5tttbb.exe240⤵PID:64
-
\??\c:\jvvdv.exec:\jvvdv.exe241⤵PID:1604
-
\??\c:\dvjdp.exec:\dvjdp.exe242⤵PID:2024