Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 21:53
Behavioral task
behavioral1
Sample
43e0a7c13fe9be5c5ac825cb9e76c420_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
43e0a7c13fe9be5c5ac825cb9e76c420_NeikiAnalytics.exe
-
Size
191KB
-
MD5
43e0a7c13fe9be5c5ac825cb9e76c420
-
SHA1
7e17f32c2a98ccfba732f534f5bbbfd8beb5e98f
-
SHA256
db8f9030ea084cc821b6ac446114b7475ff614c87ba3fcc81dc00bb8c8cea5a1
-
SHA512
afbdf5553b069b0c8573d83962d4a0d23ab8e051500db9f99bbc13c423dac0628d45758200b02fdaac2d60f60d1a4c3cdaededfbf26f7121a2fee346117f5b0d
-
SSDEEP
3072:FhOmTsF93UYfwC6GIoutrVCfMoh52waAyiJ8mqtbfUVKty16hDsI/tSaD:Fcm4FmowdHoS8fMoSVAHubPtyYxfPD
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
Processes:
resource yara_rule behavioral2/memory/1488-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3752-9-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/244-14-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2572-30-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3548-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3120-42-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1616-43-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3128-55-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2360-62-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5056-64-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1228-69-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3256-81-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2772-80-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3848-86-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/544-97-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4092-98-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4928-109-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4564-116-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4516-131-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3452-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/464-142-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2668-148-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3828-151-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2408-160-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4744-169-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2020-163-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5048-174-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1392-180-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/560-187-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4224-193-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4520-200-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2400-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4008-203-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4592-218-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2520-222-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1552-246-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4316-253-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2972-264-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5056-270-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4472-288-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2472-289-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2216-327-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4408-325-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4408-331-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1852-344-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4844-370-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1608-399-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4792-424-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4796-431-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4656-438-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5068-446-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/628-453-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3796-478-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1048-492-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4504-511-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3812-524-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2156-612-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1488-671-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1956-753-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4064-818-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1332-838-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2456-907-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\5vvpj.exe family_berbew \??\c:\fxxxllr.exe family_berbew C:\ttnbth.exe family_berbew \??\c:\tthtnh.exe family_berbew \??\c:\9hnnhn.exe family_berbew C:\dvjdd.exe family_berbew C:\pdpvd.exe family_berbew \??\c:\lflffxx.exe family_berbew C:\1xxrrrr.exe family_berbew C:\fllrfff.exe family_berbew C:\nhbhnb.exe family_berbew C:\vvjdv.exe family_berbew C:\rfllfrf.exe family_berbew C:\bbnntt.exe family_berbew C:\rlrrlll.exe family_berbew C:\bbhhbb.exe family_berbew C:\pdvpj.exe family_berbew C:\llrllxx.exe family_berbew C:\ttnnhn.exe family_berbew \??\c:\vpjpp.exe family_berbew C:\lfxrxxf.exe family_berbew C:\9pdvp.exe family_berbew C:\rllllll.exe family_berbew C:\nthbhh.exe family_berbew C:\9llflrl.exe family_berbew C:\llxrxxf.exe family_berbew \??\c:\jdjdj.exe family_berbew \??\c:\5bnhbb.exe family_berbew \??\c:\rfrrlrr.exe family_berbew \??\c:\3dvpj.exe family_berbew \??\c:\flfxrll.exe family_berbew \??\c:\bbnntt.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
9hnnhn.exe5vvpj.exefxxxllr.exettnbth.exetthtnh.exedvjdd.exepdpvd.exelflffxx.exe1xxrrrr.exefllrfff.exenhbhnb.exevvjdv.exerfllfrf.exebbnntt.exerlrrlll.exebbhhbb.exepdvpj.exellrllxx.exettnnhn.exevpjpp.exelfxrxxf.exe9pdvp.exerllllll.exenthbhh.exe9llflrl.exellxrxxf.exe5bnhbb.exejdjdj.exerfrrlrr.exe3dvpj.exeflfxrll.exebbnntt.exejdpjj.exerlffxrr.exehtbbtn.exetntnhh.exejvvdd.exefxlrlll.exelfllfff.exettntnt.exejdppv.exepdjvd.exelrlxrxr.exenbbtnn.exennnhbn.exejdjvj.exepjvvv.exefrxxxll.exennnbtb.exejjvjj.exe9pdvj.exerxrlflf.exetttttt.exevdjpp.exepjdjd.exerrxxrff.exenttttt.exevpjvp.exejvjjp.exelxfffrr.exehhtnnt.exebhtnhn.exejpdpj.exexlrlxxx.exepid process 3752 9hnnhn.exe 244 5vvpj.exe 5032 fxxxllr.exe 3548 ttnbth.exe 2572 tthtnh.exe 3120 dvjdd.exe 1616 pdpvd.exe 3128 lflffxx.exe 2360 1xxrrrr.exe 5056 fllrfff.exe 1228 nhbhnb.exe 3256 vvjdv.exe 2772 rfllfrf.exe 3848 bbnntt.exe 4092 rlrrlll.exe 544 bbhhbb.exe 5112 pdvpj.exe 4928 llrllxx.exe 4564 ttnnhn.exe 4352 vpjpp.exe 4516 lfxrxxf.exe 3452 9pdvp.exe 464 rllllll.exe 2668 nthbhh.exe 3828 9llflrl.exe 2408 llxrxxf.exe 2020 5bnhbb.exe 4744 jdjdj.exe 5048 rfrrlrr.exe 1392 3dvpj.exe 560 flfxrll.exe 4224 bbnntt.exe 4520 jdpjj.exe 2400 rlffxrr.exe 4008 htbbtn.exe 4924 tntnhh.exe 1256 jvvdd.exe 4592 fxlrlll.exe 2520 lfllfff.exe 1868 ttntnt.exe 3288 jdppv.exe 2896 pdjvd.exe 4304 lrlxrxr.exe 4804 nbbtnn.exe 3504 nnnhbn.exe 316 jdjvj.exe 1552 pjvvv.exe 4316 frxxxll.exe 1352 nnnbtb.exe 1184 jjvjj.exe 5096 9pdvj.exe 2972 rxrlflf.exe 5056 tttttt.exe 2340 vdjpp.exe 5068 pjdjd.exe 2308 rrxxrff.exe 1440 nttttt.exe 4472 vpjvp.exe 2472 jvjjp.exe 4588 lxfffrr.exe 4708 hhtnnt.exe 3140 bhtnhn.exe 4628 jpdpj.exe 4928 xlrlxxx.exe -
Processes:
resource yara_rule behavioral2/memory/1488-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1488-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3752-9-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5vvpj.exe upx behavioral2/memory/244-14-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\fxxxllr.exe upx C:\ttnbth.exe upx behavioral2/memory/2572-30-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\tthtnh.exe upx behavioral2/memory/3548-24-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\9hnnhn.exe upx C:\dvjdd.exe upx behavioral2/memory/3120-36-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pdpvd.exe upx behavioral2/memory/3120-42-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1616-43-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lflffxx.exe upx behavioral2/memory/3128-48-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\1xxrrrr.exe upx behavioral2/memory/3128-55-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2360-56-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fllrfff.exe upx behavioral2/memory/2360-62-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5056-64-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nhbhnb.exe upx behavioral2/memory/1228-69-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vvjdv.exe upx C:\rfllfrf.exe upx behavioral2/memory/3256-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2772-80-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bbnntt.exe upx behavioral2/memory/3848-86-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rlrrlll.exe upx C:\bbhhbb.exe upx behavioral2/memory/544-97-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4092-98-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pdvpj.exe upx C:\llrllxx.exe upx behavioral2/memory/4928-109-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ttnnhn.exe upx behavioral2/memory/4564-116-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\vpjpp.exe upx C:\lfxrxxf.exe upx C:\9pdvp.exe upx behavioral2/memory/4516-131-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rllllll.exe upx behavioral2/memory/3452-136-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nthbhh.exe upx behavioral2/memory/464-142-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2668-148-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\9llflrl.exe upx behavioral2/memory/3828-151-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\llxrxxf.exe upx behavioral2/memory/2408-160-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\jdjdj.exe upx behavioral2/memory/4744-169-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2020-163-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\5bnhbb.exe upx \??\c:\rfrrlrr.exe upx behavioral2/memory/5048-174-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1392-180-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\3dvpj.exe upx \??\c:\flfxrll.exe upx behavioral2/memory/560-187-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
43e0a7c13fe9be5c5ac825cb9e76c420_NeikiAnalytics.exe9hnnhn.exe5vvpj.exefxxxllr.exettnbth.exetthtnh.exedvjdd.exepdpvd.exelflffxx.exe1xxrrrr.exefllrfff.exenhbhnb.exevvjdv.exerfllfrf.exebbnntt.exerlrrlll.exebbhhbb.exepdvpj.exellrllxx.exettnnhn.exevpjpp.exelfxrxxf.exedescription pid process target process PID 1488 wrote to memory of 3752 1488 43e0a7c13fe9be5c5ac825cb9e76c420_NeikiAnalytics.exe 9hnnhn.exe PID 1488 wrote to memory of 3752 1488 43e0a7c13fe9be5c5ac825cb9e76c420_NeikiAnalytics.exe 9hnnhn.exe PID 1488 wrote to memory of 3752 1488 43e0a7c13fe9be5c5ac825cb9e76c420_NeikiAnalytics.exe 9hnnhn.exe PID 3752 wrote to memory of 244 3752 9hnnhn.exe 5vvpj.exe PID 3752 wrote to memory of 244 3752 9hnnhn.exe 5vvpj.exe PID 3752 wrote to memory of 244 3752 9hnnhn.exe 5vvpj.exe PID 244 wrote to memory of 5032 244 5vvpj.exe fxxxllr.exe PID 244 wrote to memory of 5032 244 5vvpj.exe fxxxllr.exe PID 244 wrote to memory of 5032 244 5vvpj.exe fxxxllr.exe PID 5032 wrote to memory of 3548 5032 fxxxllr.exe ttnbth.exe PID 5032 wrote to memory of 3548 5032 fxxxllr.exe ttnbth.exe PID 5032 wrote to memory of 3548 5032 fxxxllr.exe ttnbth.exe PID 3548 wrote to memory of 2572 3548 ttnbth.exe tthtnh.exe PID 3548 wrote to memory of 2572 3548 ttnbth.exe tthtnh.exe PID 3548 wrote to memory of 2572 3548 ttnbth.exe tthtnh.exe PID 2572 wrote to memory of 3120 2572 tthtnh.exe dvjdd.exe PID 2572 wrote to memory of 3120 2572 tthtnh.exe dvjdd.exe PID 2572 wrote to memory of 3120 2572 tthtnh.exe dvjdd.exe PID 3120 wrote to memory of 1616 3120 dvjdd.exe pdpvd.exe PID 3120 wrote to memory of 1616 3120 dvjdd.exe pdpvd.exe PID 3120 wrote to memory of 1616 3120 dvjdd.exe pdpvd.exe PID 1616 wrote to memory of 3128 1616 pdpvd.exe lflffxx.exe PID 1616 wrote to memory of 3128 1616 pdpvd.exe lflffxx.exe PID 1616 wrote to memory of 3128 1616 pdpvd.exe lflffxx.exe PID 3128 wrote to memory of 2360 3128 lflffxx.exe 1xxrrrr.exe PID 3128 wrote to memory of 2360 3128 lflffxx.exe 1xxrrrr.exe PID 3128 wrote to memory of 2360 3128 lflffxx.exe 1xxrrrr.exe PID 2360 wrote to memory of 5056 2360 1xxrrrr.exe fllrfff.exe PID 2360 wrote to memory of 5056 2360 1xxrrrr.exe fllrfff.exe PID 2360 wrote to memory of 5056 2360 1xxrrrr.exe fllrfff.exe PID 5056 wrote to memory of 1228 5056 fllrfff.exe nhbhnb.exe PID 5056 wrote to memory of 1228 5056 fllrfff.exe nhbhnb.exe PID 5056 wrote to memory of 1228 5056 fllrfff.exe nhbhnb.exe PID 1228 wrote to memory of 3256 1228 nhbhnb.exe vvjdv.exe PID 1228 wrote to memory of 3256 1228 nhbhnb.exe vvjdv.exe PID 1228 wrote to memory of 3256 1228 nhbhnb.exe vvjdv.exe PID 3256 wrote to memory of 2772 3256 vvjdv.exe rfllfrf.exe PID 3256 wrote to memory of 2772 3256 vvjdv.exe rfllfrf.exe PID 3256 wrote to memory of 2772 3256 vvjdv.exe rfllfrf.exe PID 2772 wrote to memory of 3848 2772 rfllfrf.exe bbnntt.exe PID 2772 wrote to memory of 3848 2772 rfllfrf.exe bbnntt.exe PID 2772 wrote to memory of 3848 2772 rfllfrf.exe bbnntt.exe PID 3848 wrote to memory of 4092 3848 bbnntt.exe rlrrlll.exe PID 3848 wrote to memory of 4092 3848 bbnntt.exe rlrrlll.exe PID 3848 wrote to memory of 4092 3848 bbnntt.exe rlrrlll.exe PID 4092 wrote to memory of 544 4092 rlrrlll.exe bbhhbb.exe PID 4092 wrote to memory of 544 4092 rlrrlll.exe bbhhbb.exe PID 4092 wrote to memory of 544 4092 rlrrlll.exe bbhhbb.exe PID 544 wrote to memory of 5112 544 bbhhbb.exe pdvpj.exe PID 544 wrote to memory of 5112 544 bbhhbb.exe pdvpj.exe PID 544 wrote to memory of 5112 544 bbhhbb.exe pdvpj.exe PID 5112 wrote to memory of 4928 5112 pdvpj.exe llrllxx.exe PID 5112 wrote to memory of 4928 5112 pdvpj.exe llrllxx.exe PID 5112 wrote to memory of 4928 5112 pdvpj.exe llrllxx.exe PID 4928 wrote to memory of 4564 4928 llrllxx.exe ttnnhn.exe PID 4928 wrote to memory of 4564 4928 llrllxx.exe ttnnhn.exe PID 4928 wrote to memory of 4564 4928 llrllxx.exe ttnnhn.exe PID 4564 wrote to memory of 4352 4564 ttnnhn.exe vpjpp.exe PID 4564 wrote to memory of 4352 4564 ttnnhn.exe vpjpp.exe PID 4564 wrote to memory of 4352 4564 ttnnhn.exe vpjpp.exe PID 4352 wrote to memory of 4516 4352 vpjpp.exe lfxrxxf.exe PID 4352 wrote to memory of 4516 4352 vpjpp.exe lfxrxxf.exe PID 4352 wrote to memory of 4516 4352 vpjpp.exe lfxrxxf.exe PID 4516 wrote to memory of 3452 4516 lfxrxxf.exe 9pdvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43e0a7c13fe9be5c5ac825cb9e76c420_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\43e0a7c13fe9be5c5ac825cb9e76c420_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\9hnnhn.exec:\9hnnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\5vvpj.exec:\5vvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\fxxxllr.exec:\fxxxllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\ttnbth.exec:\ttnbth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\tthtnh.exec:\tthtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\dvjdd.exec:\dvjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\pdpvd.exec:\pdpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\lflffxx.exec:\lflffxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\1xxrrrr.exec:\1xxrrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\fllrfff.exec:\fllrfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\nhbhnb.exec:\nhbhnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\vvjdv.exec:\vvjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\rfllfrf.exec:\rfllfrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\bbnntt.exec:\bbnntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\rlrrlll.exec:\rlrrlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\bbhhbb.exec:\bbhhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\pdvpj.exec:\pdvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\llrllxx.exec:\llrllxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\ttnnhn.exec:\ttnnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\vpjpp.exec:\vpjpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\9pdvp.exec:\9pdvp.exe23⤵
- Executes dropped EXE
PID:3452 -
\??\c:\rllllll.exec:\rllllll.exe24⤵
- Executes dropped EXE
PID:464 -
\??\c:\nthbhh.exec:\nthbhh.exe25⤵
- Executes dropped EXE
PID:2668 -
\??\c:\9llflrl.exec:\9llflrl.exe26⤵
- Executes dropped EXE
PID:3828 -
\??\c:\llxrxxf.exec:\llxrxxf.exe27⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5bnhbb.exec:\5bnhbb.exe28⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jdjdj.exec:\jdjdj.exe29⤵
- Executes dropped EXE
PID:4744 -
\??\c:\rfrrlrr.exec:\rfrrlrr.exe30⤵
- Executes dropped EXE
PID:5048 -
\??\c:\3dvpj.exec:\3dvpj.exe31⤵
- Executes dropped EXE
PID:1392 -
\??\c:\flfxrll.exec:\flfxrll.exe32⤵
- Executes dropped EXE
PID:560 -
\??\c:\bbnntt.exec:\bbnntt.exe33⤵
- Executes dropped EXE
PID:4224 -
\??\c:\jdpjj.exec:\jdpjj.exe34⤵
- Executes dropped EXE
PID:4520 -
\??\c:\rlffxrr.exec:\rlffxrr.exe35⤵
- Executes dropped EXE
PID:2400 -
\??\c:\htbbtn.exec:\htbbtn.exe36⤵
- Executes dropped EXE
PID:4008 -
\??\c:\tntnhh.exec:\tntnhh.exe37⤵
- Executes dropped EXE
PID:4924 -
\??\c:\jvvdd.exec:\jvvdd.exe38⤵
- Executes dropped EXE
PID:1256 -
\??\c:\fxlrlll.exec:\fxlrlll.exe39⤵
- Executes dropped EXE
PID:4592 -
\??\c:\lfllfff.exec:\lfllfff.exe40⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ttntnt.exec:\ttntnt.exe41⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jdppv.exec:\jdppv.exe42⤵
- Executes dropped EXE
PID:3288 -
\??\c:\pdjvd.exec:\pdjvd.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lrlxrxr.exec:\lrlxrxr.exe44⤵
- Executes dropped EXE
PID:4304 -
\??\c:\nbbtnn.exec:\nbbtnn.exe45⤵
- Executes dropped EXE
PID:4804 -
\??\c:\nnnhbn.exec:\nnnhbn.exe46⤵
- Executes dropped EXE
PID:3504 -
\??\c:\jdjvj.exec:\jdjvj.exe47⤵
- Executes dropped EXE
PID:316 -
\??\c:\pjvvv.exec:\pjvvv.exe48⤵
- Executes dropped EXE
PID:1552 -
\??\c:\frxxxll.exec:\frxxxll.exe49⤵
- Executes dropped EXE
PID:4316 -
\??\c:\nnnbtb.exec:\nnnbtb.exe50⤵
- Executes dropped EXE
PID:1352 -
\??\c:\jjvjj.exec:\jjvjj.exe51⤵
- Executes dropped EXE
PID:1184 -
\??\c:\9pdvj.exec:\9pdvj.exe52⤵
- Executes dropped EXE
PID:5096 -
\??\c:\rxrlflf.exec:\rxrlflf.exe53⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tttttt.exec:\tttttt.exe54⤵
- Executes dropped EXE
PID:5056 -
\??\c:\vdjpp.exec:\vdjpp.exe55⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pjdjd.exec:\pjdjd.exe56⤵
- Executes dropped EXE
PID:5068 -
\??\c:\rrxxrff.exec:\rrxxrff.exe57⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nttttt.exec:\nttttt.exe58⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vpjvp.exec:\vpjvp.exe59⤵
- Executes dropped EXE
PID:4472 -
\??\c:\jvjjp.exec:\jvjjp.exe60⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lxfffrr.exec:\lxfffrr.exe61⤵
- Executes dropped EXE
PID:4588 -
\??\c:\hhtnnt.exec:\hhtnnt.exe62⤵
- Executes dropped EXE
PID:4708 -
\??\c:\bhtnhn.exec:\bhtnhn.exe63⤵
- Executes dropped EXE
PID:3140 -
\??\c:\jpdpj.exec:\jpdpj.exe64⤵
- Executes dropped EXE
PID:4628 -
\??\c:\xlrlxxx.exec:\xlrlxxx.exe65⤵
- Executes dropped EXE
PID:4928 -
\??\c:\rfxxfxx.exec:\rfxxfxx.exe66⤵PID:4676
-
\??\c:\btttnt.exec:\btttnt.exe67⤵PID:4044
-
\??\c:\dvvvp.exec:\dvvvp.exe68⤵PID:4352
-
\??\c:\1rxrrrl.exec:\1rxrrrl.exe69⤵PID:4000
-
\??\c:\5ffxxxf.exec:\5ffxxxf.exe70⤵PID:2216
-
\??\c:\nbhttt.exec:\nbhttt.exe71⤵PID:4408
-
\??\c:\ddvjj.exec:\ddvjj.exe72⤵PID:1048
-
\??\c:\7jdvp.exec:\7jdvp.exe73⤵PID:868
-
\??\c:\xlrrllx.exec:\xlrrllx.exe74⤵PID:2704
-
\??\c:\rrlffff.exec:\rrlffff.exe75⤵PID:1852
-
\??\c:\nhntnn.exec:\nhntnn.exe76⤵PID:232
-
\??\c:\jvvpj.exec:\jvvpj.exe77⤵PID:1848
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe78⤵PID:4552
-
\??\c:\xlxfflf.exec:\xlxfflf.exe79⤵PID:3204
-
\??\c:\htbbtb.exec:\htbbtb.exe80⤵PID:2012
-
\??\c:\9ppvj.exec:\9ppvj.exe81⤵PID:764
-
\??\c:\rffflrx.exec:\rffflrx.exe82⤵PID:4716
-
\??\c:\tbbbbb.exec:\tbbbbb.exe83⤵PID:4844
-
\??\c:\jddjj.exec:\jddjj.exe84⤵PID:560
-
\??\c:\dvpjd.exec:\dvpjd.exe85⤵PID:1364
-
\??\c:\lxxrllx.exec:\lxxrllx.exe86⤵PID:2788
-
\??\c:\9bbbbb.exec:\9bbbbb.exe87⤵PID:332
-
\??\c:\1hhhbn.exec:\1hhhbn.exe88⤵PID:4664
-
\??\c:\pjjpj.exec:\pjjpj.exe89⤵PID:640
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe90⤵PID:4592
-
\??\c:\rlrlllf.exec:\rlrlllf.exe91⤵PID:632
-
\??\c:\tnbnnh.exec:\tnbnnh.exe92⤵PID:1608
-
\??\c:\bhnnnn.exec:\bhnnnn.exe93⤵PID:2800
-
\??\c:\djdjd.exec:\djdjd.exe94⤵PID:2792
-
\??\c:\pjjjj.exec:\pjjjj.exe95⤵PID:4672
-
\??\c:\frrllfx.exec:\frrllfx.exe96⤵PID:4280
-
\??\c:\xflxfff.exec:\xflxfff.exe97⤵PID:1960
-
\??\c:\7bnnnh.exec:\7bnnnh.exe98⤵PID:1096
-
\??\c:\jvdjj.exec:\jvdjj.exe99⤵PID:4560
-
\??\c:\frrlfxr.exec:\frrlfxr.exe100⤵PID:3368
-
\??\c:\1lfxlrl.exec:\1lfxlrl.exe101⤵PID:4792
-
\??\c:\httbnn.exec:\httbnn.exe102⤵PID:4796
-
\??\c:\jdvpj.exec:\jdvpj.exe103⤵PID:1016
-
\??\c:\5xxrlrl.exec:\5xxrlrl.exe104⤵PID:4656
-
\??\c:\thnttt.exec:\thnttt.exe105⤵PID:1780
-
\??\c:\hbhhbt.exec:\hbhhbt.exe106⤵PID:5068
-
\??\c:\5vdvp.exec:\5vdvp.exe107⤵PID:5024
-
\??\c:\xlrlfff.exec:\xlrlfff.exe108⤵PID:628
-
\??\c:\ffrllrr.exec:\ffrllrr.exe109⤵PID:4472
-
\??\c:\bbnhbb.exec:\bbnhbb.exe110⤵PID:4396
-
\??\c:\vpvpj.exec:\vpvpj.exe111⤵PID:4808
-
\??\c:\vddpp.exec:\vddpp.exe112⤵PID:388
-
\??\c:\9ffxxxf.exec:\9ffxxxf.exe113⤵PID:5112
-
\??\c:\bbntnt.exec:\bbntnt.exe114⤵PID:4648
-
\??\c:\nbnnnn.exec:\nbnnnn.exe115⤵PID:4928
-
\??\c:\1vdpp.exec:\1vdpp.exe116⤵PID:3796
-
\??\c:\fffffxx.exec:\fffffxx.exe117⤵PID:4044
-
\??\c:\9fffflx.exec:\9fffflx.exe118⤵PID:4352
-
\??\c:\9bhbtt.exec:\9bhbtt.exe119⤵PID:464
-
\??\c:\hbtnhn.exec:\hbtnhn.exe120⤵PID:3268
-
\??\c:\3djjv.exec:\3djjv.exe121⤵PID:1048
-
\??\c:\xrfflfr.exec:\xrfflfr.exe122⤵PID:5016
-
\??\c:\1xxrlff.exec:\1xxrlff.exe123⤵PID:1852
-
\??\c:\hhnhbt.exec:\hhnhbt.exe124⤵PID:3304
-
\??\c:\dppjp.exec:\dppjp.exe125⤵PID:468
-
\??\c:\jjppj.exec:\jjppj.exe126⤵PID:4504
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe127⤵PID:2204
-
\??\c:\1flfxxr.exec:\1flfxxr.exe128⤵PID:4844
-
\??\c:\bhnnhh.exec:\bhnnhh.exe129⤵PID:560
-
\??\c:\vdjdd.exec:\vdjdd.exe130⤵PID:1356
-
\??\c:\pdjdj.exec:\pdjdj.exe131⤵PID:3812
-
\??\c:\xflfxrl.exec:\xflfxrl.exe132⤵PID:4484
-
\??\c:\rrxrlfr.exec:\rrxrlfr.exe133⤵PID:1536
-
\??\c:\3tbtnn.exec:\3tbtnn.exe134⤵PID:2520
-
\??\c:\pjpdv.exec:\pjpdv.exe135⤵PID:2460
-
\??\c:\jppjj.exec:\jppjj.exe136⤵PID:2016
-
\??\c:\fffxrff.exec:\fffxrff.exe137⤵PID:1152
-
\??\c:\nnnhtt.exec:\nnnhtt.exe138⤵PID:4700
-
\??\c:\dvvjd.exec:\dvvjd.exe139⤵PID:4672
-
\??\c:\lffrfrx.exec:\lffrfrx.exe140⤵PID:3600
-
\??\c:\7hntnn.exec:\7hntnn.exe141⤵PID:3100
-
\??\c:\7jdvj.exec:\7jdvj.exe142⤵PID:1884
-
\??\c:\ffrxfrx.exec:\ffrxfrx.exe143⤵PID:4560
-
\??\c:\9xfllll.exec:\9xfllll.exe144⤵PID:3128
-
\??\c:\jjddv.exec:\jjddv.exe145⤵PID:2052
-
\??\c:\xflfxxx.exec:\xflfxxx.exe146⤵PID:1060
-
\??\c:\htttnt.exec:\htttnt.exe147⤵PID:1228
-
\??\c:\pvdpv.exec:\pvdpv.exe148⤵PID:876
-
\??\c:\vpvpp.exec:\vpvpp.exe149⤵PID:3612
-
\??\c:\3rrxffl.exec:\3rrxffl.exe150⤵PID:1704
-
\??\c:\ppdpd.exec:\ppdpd.exe151⤵PID:1332
-
\??\c:\jvvvv.exec:\jvvvv.exe152⤵PID:2284
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe153⤵PID:2472
-
\??\c:\dpjdd.exec:\dpjdd.exe154⤵PID:3908
-
\??\c:\flrlffx.exec:\flrlffx.exe155⤵PID:3096
-
\??\c:\tnbhbt.exec:\tnbhbt.exe156⤵PID:1000
-
\??\c:\djjpv.exec:\djjpv.exe157⤵PID:2384
-
\??\c:\rrlxfrf.exec:\rrlxfrf.exe158⤵PID:4628
-
\??\c:\nbbtbt.exec:\nbbtbt.exe159⤵PID:2156
-
\??\c:\lffxxxr.exec:\lffxxxr.exe160⤵PID:3508
-
\??\c:\7bhbbb.exec:\7bhbbb.exe161⤵PID:4000
-
\??\c:\9ddvv.exec:\9ddvv.exe162⤵PID:2160
-
\??\c:\jppjp.exec:\jppjp.exe163⤵PID:3912
-
\??\c:\rfrfrrr.exec:\rfrfrrr.exe164⤵PID:2996
-
\??\c:\pjdvj.exec:\pjdvj.exe165⤵PID:2956
-
\??\c:\3btnhh.exec:\3btnhh.exe166⤵PID:4508
-
\??\c:\rrxfrff.exec:\rrxfrff.exe167⤵PID:2144
-
\??\c:\bntnnn.exec:\bntnnn.exe168⤵PID:1852
-
\??\c:\rllfffx.exec:\rllfffx.exe169⤵PID:3768
-
\??\c:\hbbhbh.exec:\hbbhbh.exe170⤵PID:1628
-
\??\c:\dpjpd.exec:\dpjpd.exe171⤵PID:1136
-
\??\c:\dpvpp.exec:\dpvpp.exe172⤵PID:2204
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe173⤵PID:4968
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe174⤵PID:560
-
\??\c:\rrlrlrr.exec:\rrlrlrr.exe175⤵PID:1356
-
\??\c:\nnbntn.exec:\nnbntn.exe176⤵PID:4924
-
\??\c:\pvvvv.exec:\pvvvv.exe177⤵PID:4484
-
\??\c:\pjjjj.exec:\pjjjj.exe178⤵PID:1488
-
\??\c:\5xffxff.exec:\5xffxff.exe179⤵PID:4084
-
\??\c:\7nttnn.exec:\7nttnn.exe180⤵PID:1672
-
\??\c:\7btbth.exec:\7btbth.exe181⤵PID:3352
-
\??\c:\jjvpj.exec:\jjvpj.exe182⤵PID:2792
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe183⤵PID:4804
-
\??\c:\nnttnn.exec:\nnttnn.exe184⤵PID:4280
-
\??\c:\pdjdd.exec:\pdjdd.exe185⤵PID:1012
-
\??\c:\vvpjj.exec:\vvpjj.exe186⤵PID:3540
-
\??\c:\lrffrrx.exec:\lrffrrx.exe187⤵PID:4064
-
\??\c:\hbhtnt.exec:\hbhtnt.exe188⤵PID:1860
-
\??\c:\jdjvp.exec:\jdjvp.exe189⤵PID:2300
-
\??\c:\ppvpp.exec:\ppvpp.exe190⤵PID:4920
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe191⤵PID:4992
-
\??\c:\nnbtbb.exec:\nnbtbb.exe192⤵PID:2308
-
\??\c:\thnhbt.exec:\thnhbt.exe193⤵PID:2184
-
\??\c:\jjjdv.exec:\jjjdv.exe194⤵PID:3848
-
\??\c:\1lxlffr.exec:\1lxlffr.exe195⤵PID:3280
-
\??\c:\xrlllll.exec:\xrlllll.exe196⤵PID:3148
-
\??\c:\ttbttt.exec:\ttbttt.exe197⤵PID:3908
-
\??\c:\3jjvp.exec:\3jjvp.exe198⤵PID:3096
-
\??\c:\jjpjv.exec:\jjpjv.exe199⤵PID:1000
-
\??\c:\fflrxxx.exec:\fflrxxx.exe200⤵PID:1004
-
\??\c:\tnnnnt.exec:\tnnnnt.exe201⤵PID:3796
-
\??\c:\5bnhbb.exec:\5bnhbb.exe202⤵PID:4352
-
\??\c:\ppvpv.exec:\ppvpv.exe203⤵PID:4856
-
\??\c:\vpjjj.exec:\vpjjj.exe204⤵PID:4048
-
\??\c:\fxfffff.exec:\fxfffff.exe205⤵PID:1956
-
\??\c:\nbbhbb.exec:\nbbhbb.exe206⤵PID:1944
-
\??\c:\hthbbt.exec:\hthbbt.exe207⤵PID:1040
-
\??\c:\ddppj.exec:\ddppj.exe208⤵PID:1784
-
\??\c:\lxffxxx.exec:\lxffxxx.exe209⤵PID:4744
-
\??\c:\3rrrlrr.exec:\3rrrlrr.exe210⤵PID:4444
-
\??\c:\bthnbb.exec:\bthnbb.exe211⤵PID:2844
-
\??\c:\tntbtt.exec:\tntbtt.exe212⤵PID:392
-
\??\c:\xrxllff.exec:\xrxllff.exe213⤵PID:4052
-
\??\c:\nnbtnb.exec:\nnbtnb.exe214⤵PID:332
-
\??\c:\vvppj.exec:\vvppj.exe215⤵PID:4664
-
\??\c:\rllffxx.exec:\rllffxx.exe216⤵PID:4348
-
\??\c:\nhbttt.exec:\nhbttt.exe217⤵PID:4484
-
\??\c:\vjpvp.exec:\vjpvp.exe218⤵PID:1488
-
\??\c:\dvvpj.exec:\dvvpj.exe219⤵PID:808
-
\??\c:\xfrllrr.exec:\xfrllrr.exe220⤵PID:3472
-
\??\c:\bthhbn.exec:\bthhbn.exe221⤵PID:4432
-
\??\c:\hbtntt.exec:\hbtntt.exe222⤵PID:636
-
\??\c:\7dvdd.exec:\7dvdd.exe223⤵PID:1776
-
\??\c:\5lxxxxf.exec:\5lxxxxf.exe224⤵PID:1280
-
\??\c:\hnnhbh.exec:\hnnhbh.exe225⤵PID:2360
-
\??\c:\djdvv.exec:\djdvv.exe226⤵PID:4064
-
\??\c:\dvdvv.exec:\dvdvv.exe227⤵PID:1860
-
\??\c:\3rfxxll.exec:\3rfxxll.exe228⤵PID:2300
-
\??\c:\5nthhh.exec:\5nthhh.exe229⤵PID:2652
-
\??\c:\jdpjd.exec:\jdpjd.exe230⤵PID:3612
-
\??\c:\rfxrrxl.exec:\rfxrrxl.exe231⤵PID:5024
-
\??\c:\llfxxxx.exec:\llfxxxx.exe232⤵PID:1332
-
\??\c:\tnttnh.exec:\tnttnh.exe233⤵PID:3260
-
\??\c:\1ppvp.exec:\1ppvp.exe234⤵PID:904
-
\??\c:\ffffffr.exec:\ffffffr.exe235⤵PID:544
-
\??\c:\htthtb.exec:\htthtb.exe236⤵PID:5112
-
\??\c:\pdjpv.exec:\pdjpv.exe237⤵PID:388
-
\??\c:\rlrlfff.exec:\rlrlfff.exe238⤵PID:3116
-
\??\c:\7tbttb.exec:\7tbttb.exe239⤵PID:3796
-
\??\c:\5tnnbh.exec:\5tnnbh.exe240⤵PID:4352
-
\??\c:\jjppp.exec:\jjppp.exe241⤵PID:1524
-
\??\c:\jdppv.exec:\jdppv.exe242⤵PID:1540