Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:19
Behavioral task
behavioral1
Sample
411a41c3a493d206c4d6b2a816b23fe0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
411a41c3a493d206c4d6b2a816b23fe0_NeikiAnalytics.exe
-
Size
294KB
-
MD5
411a41c3a493d206c4d6b2a816b23fe0
-
SHA1
d0430a2e09dc631b38364b2e258f50e679f1bda8
-
SHA256
911c293796a8e4925ac9168a7bf4d955145b6515150232dbbbe1e9239ff90255
-
SHA512
ffd2109e264f1be2ea42477b1c7a95fcf1004afd0920205b7d59f440b4f1efc592968ca3b363bf92ab5ba98a083f6b5766c76d0a9a7a53700319c63e8c551d5e
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftOm:K4wFHoSQkuUHk1zBR/pMT9XvEhdfp
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4440-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2624-5-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4204-18-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4428-20-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1528-27-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2132-31-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3500-38-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4088-49-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2308-53-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/828-60-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2216-72-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4996-78-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2632-89-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2176-96-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4908-109-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3612-107-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4528-118-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/560-134-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1704-145-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4188-139-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3956-128-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1984-125-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1552-165-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5084-174-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4144-171-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3180-183-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3992-196-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1420-214-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1416-223-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4052-224-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2848-228-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3232-240-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1212-247-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/740-258-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/900-261-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3628-269-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1344-276-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3368-278-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3900-290-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/468-306-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2680-323-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4936-336-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1848-338-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2504-344-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4448-360-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/976-370-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2236-377-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3040-400-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/740-425-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4960-453-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2976-475-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4732-496-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1844-519-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4916-526-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4176-657-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/408-658-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4392-665-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/740-701-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3832-734-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4904-854-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/212-888-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5108-1057-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3612-1264-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5048-1382-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\nnhbbb.exe family_berbew \??\c:\vpppj.exe family_berbew C:\vjjdv.exe family_berbew C:\xxfxxrx.exe family_berbew \??\c:\vpvpj.exe family_berbew \??\c:\9rlfxxx.exe family_berbew C:\3bnbtb.exe family_berbew C:\llxxllx.exe family_berbew C:\dvjvp.exe family_berbew C:\llrrlll.exe family_berbew C:\vvjdv.exe family_berbew C:\dvvpp.exe family_berbew C:\3ffxrrr.exe family_berbew C:\hbhhtt.exe family_berbew C:\vdppv.exe family_berbew C:\lfrlrll.exe family_berbew C:\bhhhbb.exe family_berbew C:\7jpjd.exe family_berbew C:\hnnntt.exe family_berbew C:\3flfxff.exe family_berbew C:\ffxxxxr.exe family_berbew \??\c:\hnnnnt.exe family_berbew \??\c:\ddppp.exe family_berbew \??\c:\jdjjd.exe family_berbew C:\rlllfll.exe family_berbew C:\jjjpp.exe family_berbew C:\hntnnn.exe family_berbew C:\ffxlffx.exe family_berbew C:\ppjdd.exe family_berbew \??\c:\rlllffr.exe family_berbew C:\fxllllx.exe family_berbew C:\xxlrfxl.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
nnhbbb.exevpppj.exevjjdv.exexxfxxrx.exevpvpj.exe9rlfxxx.exe3bnbtb.exellxxllx.exedvjvp.exellrrlll.exevvjdv.exedvvpp.exe3ffxrrr.exehbhhtt.exevdppv.exelfrlrll.exebhhhbb.exe7jpjd.exehnnntt.exe3flfxff.exeffxxxxr.exehnnnnt.exeddppp.exejdjjd.exerlllfll.exejjjpp.exehntnnn.exeffxlffx.exeppjdd.exerlllffr.exefxllllx.exexxlrfxl.exenbhnhh.exejpjjv.exerxllxxl.exebbhnhb.exejddjj.exelfxflxl.exefxxrxrr.exe3htnnn.exejdppp.exe7thbtt.exehhhhtb.exevpvpj.exexxffxxx.exebhhtnt.exedpddv.exerffrfxr.exennhthh.exevjjjd.exelrffxxx.exerrxxxfl.exetthhth.exevppdj.exerllrrrr.exellfflrx.exepjjjp.exe1lllfxr.exetntbhn.exebnttnb.exepjvdd.exellrrrxf.exe9hnttn.exenthntb.exepid process 4440 nnhbbb.exe 4204 vpppj.exe 4428 vjjdv.exe 1528 xxfxxrx.exe 2132 vpvpj.exe 3500 9rlfxxx.exe 4088 3bnbtb.exe 2308 llxxllx.exe 828 dvjvp.exe 1908 llrrlll.exe 2216 vvjdv.exe 4964 dvvpp.exe 4996 3ffxrrr.exe 2632 hbhhtt.exe 2176 vdppv.exe 4312 lfrlrll.exe 4908 bhhhbb.exe 3612 7jpjd.exe 4528 hnnntt.exe 1984 3flfxff.exe 3956 ffxxxxr.exe 560 hnnnnt.exe 4188 ddppp.exe 1704 jdjjd.exe 3112 rlllfll.exe 2504 jjjpp.exe 1552 hntnnn.exe 4144 ffxlffx.exe 5084 ppjdd.exe 3180 rlllffr.exe 60 fxllllx.exe 4336 xxlrfxl.exe 3992 nbhnhh.exe 1004 jpjjv.exe 2824 rxllxxl.exe 1952 bbhnhb.exe 2784 jddjj.exe 2988 lfxflxl.exe 1420 fxxrxrr.exe 1572 3htnnn.exe 1416 jdppp.exe 4052 7thbtt.exe 2848 hhhhtb.exe 4300 vpvpj.exe 4368 xxffxxx.exe 4856 bhhtnt.exe 3232 dpddv.exe 1212 rffrfxr.exe 3792 nnhthh.exe 4516 vjjjd.exe 4560 lrffxxx.exe 740 rrxxxfl.exe 900 tthhth.exe 3628 vppdj.exe 2300 rllrrrr.exe 1344 llfflrx.exe 3368 pjjjp.exe 4900 1lllfxr.exe 3624 tntbhn.exe 3900 bnttnb.exe 4924 pjvdd.exe 5088 llrrrxf.exe 4848 9hnttn.exe 2176 nthntb.exe -
Processes:
resource yara_rule behavioral2/memory/2624-0-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\nnhbbb.exe upx behavioral2/memory/4440-8-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4204-12-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\vpppj.exe upx behavioral2/memory/2624-5-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vjjdv.exe upx behavioral2/memory/4204-18-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4428-20-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xxfxxrx.exe upx behavioral2/memory/1528-27-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\vpvpj.exe upx behavioral2/memory/2132-31-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\9rlfxxx.exe upx behavioral2/memory/3500-38-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3bnbtb.exe upx C:\llxxllx.exe upx behavioral2/memory/4088-49-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\dvjvp.exe upx behavioral2/memory/2308-53-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\llrrlll.exe upx behavioral2/memory/828-60-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vvjdv.exe upx behavioral2/memory/2216-66-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\dvvpp.exe upx behavioral2/memory/2216-72-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3ffxrrr.exe upx behavioral2/memory/4996-78-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\hbhhtt.exe upx behavioral2/memory/2632-83-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vdppv.exe upx behavioral2/memory/2632-89-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\lfrlrll.exe upx C:\bhhhbb.exe upx behavioral2/memory/4908-102-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2176-96-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\7jpjd.exe upx behavioral2/memory/4908-109-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3612-107-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\hnnntt.exe upx behavioral2/memory/4528-118-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3flfxff.exe upx C:\ffxxxxr.exe upx \??\c:\hnnnnt.exe upx behavioral2/memory/560-134-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ddppp.exe upx \??\c:\jdjjd.exe upx behavioral2/memory/1704-145-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4188-139-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3956-128-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1984-125-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rlllfll.exe upx C:\jjjpp.exe upx C:\hntnnn.exe upx C:\ffxlffx.exe upx behavioral2/memory/1552-165-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ppjdd.exe upx behavioral2/memory/5084-174-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4144-171-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\rlllffr.exe upx C:\fxllllx.exe upx behavioral2/memory/3180-183-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xxlrfxl.exe upx behavioral2/memory/3992-196-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
411a41c3a493d206c4d6b2a816b23fe0_NeikiAnalytics.exennhbbb.exevpppj.exevjjdv.exexxfxxrx.exevpvpj.exe9rlfxxx.exe3bnbtb.exellxxllx.exedvjvp.exellrrlll.exevvjdv.exedvvpp.exe3ffxrrr.exehbhhtt.exevdppv.exelfrlrll.exebhhhbb.exe7jpjd.exehnnntt.exe3flfxff.exeffxxxxr.exedescription pid process target process PID 2624 wrote to memory of 4440 2624 411a41c3a493d206c4d6b2a816b23fe0_NeikiAnalytics.exe nnhbbb.exe PID 2624 wrote to memory of 4440 2624 411a41c3a493d206c4d6b2a816b23fe0_NeikiAnalytics.exe nnhbbb.exe PID 2624 wrote to memory of 4440 2624 411a41c3a493d206c4d6b2a816b23fe0_NeikiAnalytics.exe nnhbbb.exe PID 4440 wrote to memory of 4204 4440 nnhbbb.exe vpppj.exe PID 4440 wrote to memory of 4204 4440 nnhbbb.exe vpppj.exe PID 4440 wrote to memory of 4204 4440 nnhbbb.exe vpppj.exe PID 4204 wrote to memory of 4428 4204 vpppj.exe vjjdv.exe PID 4204 wrote to memory of 4428 4204 vpppj.exe vjjdv.exe PID 4204 wrote to memory of 4428 4204 vpppj.exe vjjdv.exe PID 4428 wrote to memory of 1528 4428 vjjdv.exe xxfxxrx.exe PID 4428 wrote to memory of 1528 4428 vjjdv.exe xxfxxrx.exe PID 4428 wrote to memory of 1528 4428 vjjdv.exe xxfxxrx.exe PID 1528 wrote to memory of 2132 1528 xxfxxrx.exe vpvpj.exe PID 1528 wrote to memory of 2132 1528 xxfxxrx.exe vpvpj.exe PID 1528 wrote to memory of 2132 1528 xxfxxrx.exe vpvpj.exe PID 2132 wrote to memory of 3500 2132 vpvpj.exe 9rlfxxx.exe PID 2132 wrote to memory of 3500 2132 vpvpj.exe 9rlfxxx.exe PID 2132 wrote to memory of 3500 2132 vpvpj.exe 9rlfxxx.exe PID 3500 wrote to memory of 4088 3500 9rlfxxx.exe 3bnbtb.exe PID 3500 wrote to memory of 4088 3500 9rlfxxx.exe 3bnbtb.exe PID 3500 wrote to memory of 4088 3500 9rlfxxx.exe 3bnbtb.exe PID 4088 wrote to memory of 2308 4088 3bnbtb.exe llxxllx.exe PID 4088 wrote to memory of 2308 4088 3bnbtb.exe llxxllx.exe PID 4088 wrote to memory of 2308 4088 3bnbtb.exe llxxllx.exe PID 2308 wrote to memory of 828 2308 llxxllx.exe dvjvp.exe PID 2308 wrote to memory of 828 2308 llxxllx.exe dvjvp.exe PID 2308 wrote to memory of 828 2308 llxxllx.exe dvjvp.exe PID 828 wrote to memory of 1908 828 dvjvp.exe llrrlll.exe PID 828 wrote to memory of 1908 828 dvjvp.exe llrrlll.exe PID 828 wrote to memory of 1908 828 dvjvp.exe llrrlll.exe PID 1908 wrote to memory of 2216 1908 llrrlll.exe vvjdv.exe PID 1908 wrote to memory of 2216 1908 llrrlll.exe vvjdv.exe PID 1908 wrote to memory of 2216 1908 llrrlll.exe vvjdv.exe PID 2216 wrote to memory of 4964 2216 vvjdv.exe dvvpp.exe PID 2216 wrote to memory of 4964 2216 vvjdv.exe dvvpp.exe PID 2216 wrote to memory of 4964 2216 vvjdv.exe dvvpp.exe PID 4964 wrote to memory of 4996 4964 dvvpp.exe 3ffxrrr.exe PID 4964 wrote to memory of 4996 4964 dvvpp.exe 3ffxrrr.exe PID 4964 wrote to memory of 4996 4964 dvvpp.exe 3ffxrrr.exe PID 4996 wrote to memory of 2632 4996 3ffxrrr.exe hbhhtt.exe PID 4996 wrote to memory of 2632 4996 3ffxrrr.exe hbhhtt.exe PID 4996 wrote to memory of 2632 4996 3ffxrrr.exe hbhhtt.exe PID 2632 wrote to memory of 2176 2632 hbhhtt.exe vdppv.exe PID 2632 wrote to memory of 2176 2632 hbhhtt.exe vdppv.exe PID 2632 wrote to memory of 2176 2632 hbhhtt.exe vdppv.exe PID 2176 wrote to memory of 4312 2176 vdppv.exe lfrlrll.exe PID 2176 wrote to memory of 4312 2176 vdppv.exe lfrlrll.exe PID 2176 wrote to memory of 4312 2176 vdppv.exe lfrlrll.exe PID 4312 wrote to memory of 4908 4312 lfrlrll.exe bhhhbb.exe PID 4312 wrote to memory of 4908 4312 lfrlrll.exe bhhhbb.exe PID 4312 wrote to memory of 4908 4312 lfrlrll.exe bhhhbb.exe PID 4908 wrote to memory of 3612 4908 bhhhbb.exe 7jpjd.exe PID 4908 wrote to memory of 3612 4908 bhhhbb.exe 7jpjd.exe PID 4908 wrote to memory of 3612 4908 bhhhbb.exe 7jpjd.exe PID 3612 wrote to memory of 4528 3612 7jpjd.exe hnnntt.exe PID 3612 wrote to memory of 4528 3612 7jpjd.exe hnnntt.exe PID 3612 wrote to memory of 4528 3612 7jpjd.exe hnnntt.exe PID 4528 wrote to memory of 1984 4528 hnnntt.exe 3flfxff.exe PID 4528 wrote to memory of 1984 4528 hnnntt.exe 3flfxff.exe PID 4528 wrote to memory of 1984 4528 hnnntt.exe 3flfxff.exe PID 1984 wrote to memory of 3956 1984 3flfxff.exe ffxxxxr.exe PID 1984 wrote to memory of 3956 1984 3flfxff.exe ffxxxxr.exe PID 1984 wrote to memory of 3956 1984 3flfxff.exe ffxxxxr.exe PID 3956 wrote to memory of 560 3956 ffxxxxr.exe hnnnnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\411a41c3a493d206c4d6b2a816b23fe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\411a41c3a493d206c4d6b2a816b23fe0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\nnhbbb.exec:\nnhbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\vpppj.exec:\vpppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\vjjdv.exec:\vjjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\xxfxxrx.exec:\xxfxxrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\vpvpj.exec:\vpvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\9rlfxxx.exec:\9rlfxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\3bnbtb.exec:\3bnbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\llxxllx.exec:\llxxllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\dvjvp.exec:\dvjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\llrrlll.exec:\llrrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\vvjdv.exec:\vvjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\dvvpp.exec:\dvvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\3ffxrrr.exec:\3ffxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\hbhhtt.exec:\hbhhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vdppv.exec:\vdppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\lfrlrll.exec:\lfrlrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\bhhhbb.exec:\bhhhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\7jpjd.exec:\7jpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\hnnntt.exec:\hnnntt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\3flfxff.exec:\3flfxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\ffxxxxr.exec:\ffxxxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\hnnnnt.exec:\hnnnnt.exe23⤵
- Executes dropped EXE
PID:560 -
\??\c:\ddppp.exec:\ddppp.exe24⤵
- Executes dropped EXE
PID:4188 -
\??\c:\jdjjd.exec:\jdjjd.exe25⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rlllfll.exec:\rlllfll.exe26⤵
- Executes dropped EXE
PID:3112 -
\??\c:\jjjpp.exec:\jjjpp.exe27⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hntnnn.exec:\hntnnn.exe28⤵
- Executes dropped EXE
PID:1552 -
\??\c:\ffxlffx.exec:\ffxlffx.exe29⤵
- Executes dropped EXE
PID:4144 -
\??\c:\ppjdd.exec:\ppjdd.exe30⤵
- Executes dropped EXE
PID:5084 -
\??\c:\rlllffr.exec:\rlllffr.exe31⤵
- Executes dropped EXE
PID:3180 -
\??\c:\fxllllx.exec:\fxllllx.exe32⤵
- Executes dropped EXE
PID:60 -
\??\c:\xxlrfxl.exec:\xxlrfxl.exe33⤵
- Executes dropped EXE
PID:4336 -
\??\c:\nbhnhh.exec:\nbhnhh.exe34⤵
- Executes dropped EXE
PID:3992 -
\??\c:\jpjjv.exec:\jpjjv.exe35⤵
- Executes dropped EXE
PID:1004 -
\??\c:\rxllxxl.exec:\rxllxxl.exe36⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bbhnhb.exec:\bbhnhb.exe37⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jddjj.exec:\jddjj.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lfxflxl.exec:\lfxflxl.exe39⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fxxrxrr.exec:\fxxrxrr.exe40⤵
- Executes dropped EXE
PID:1420 -
\??\c:\3htnnn.exec:\3htnnn.exe41⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jdppp.exec:\jdppp.exe42⤵
- Executes dropped EXE
PID:1416 -
\??\c:\7thbtt.exec:\7thbtt.exe43⤵
- Executes dropped EXE
PID:4052 -
\??\c:\hhhhtb.exec:\hhhhtb.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vpvpj.exec:\vpvpj.exe45⤵
- Executes dropped EXE
PID:4300 -
\??\c:\xxffxxx.exec:\xxffxxx.exe46⤵
- Executes dropped EXE
PID:4368 -
\??\c:\bhhtnt.exec:\bhhtnt.exe47⤵
- Executes dropped EXE
PID:4856 -
\??\c:\dpddv.exec:\dpddv.exe48⤵
- Executes dropped EXE
PID:3232 -
\??\c:\rffrfxr.exec:\rffrfxr.exe49⤵
- Executes dropped EXE
PID:1212 -
\??\c:\nnhthh.exec:\nnhthh.exe50⤵
- Executes dropped EXE
PID:3792 -
\??\c:\vjjjd.exec:\vjjjd.exe51⤵
- Executes dropped EXE
PID:4516 -
\??\c:\lrffxxx.exec:\lrffxxx.exe52⤵
- Executes dropped EXE
PID:4560 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe53⤵
- Executes dropped EXE
PID:740 -
\??\c:\tthhth.exec:\tthhth.exe54⤵
- Executes dropped EXE
PID:900 -
\??\c:\vppdj.exec:\vppdj.exe55⤵
- Executes dropped EXE
PID:3628 -
\??\c:\rllrrrr.exec:\rllrrrr.exe56⤵
- Executes dropped EXE
PID:2300 -
\??\c:\llfflrx.exec:\llfflrx.exe57⤵
- Executes dropped EXE
PID:1344 -
\??\c:\pjjjp.exec:\pjjjp.exe58⤵
- Executes dropped EXE
PID:3368 -
\??\c:\1lllfxr.exec:\1lllfxr.exe59⤵
- Executes dropped EXE
PID:4900 -
\??\c:\tntbhn.exec:\tntbhn.exe60⤵
- Executes dropped EXE
PID:3624 -
\??\c:\bnttnb.exec:\bnttnb.exe61⤵
- Executes dropped EXE
PID:3900 -
\??\c:\pjvdd.exec:\pjvdd.exe62⤵
- Executes dropped EXE
PID:4924 -
\??\c:\llrrrxf.exec:\llrrrxf.exe63⤵
- Executes dropped EXE
PID:5088 -
\??\c:\9hnttn.exec:\9hnttn.exe64⤵
- Executes dropped EXE
PID:4848 -
\??\c:\nthntb.exec:\nthntb.exe65⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jvddd.exec:\jvddd.exe66⤵PID:468
-
\??\c:\frrlxrf.exec:\frrlxrf.exe67⤵PID:4544
-
\??\c:\tbhntb.exec:\tbhntb.exe68⤵PID:3612
-
\??\c:\dvddj.exec:\dvddj.exe69⤵PID:5008
-
\??\c:\xlrxxff.exec:\xlrxxff.exe70⤵PID:1984
-
\??\c:\tbthbt.exec:\tbthbt.exe71⤵PID:4852
-
\??\c:\djvjp.exec:\djvjp.exe72⤵PID:2680
-
\??\c:\ppddj.exec:\ppddj.exe73⤵PID:3036
-
\??\c:\xfxxrlr.exec:\xfxxrlr.exe74⤵PID:3872
-
\??\c:\dpvdj.exec:\dpvdj.exe75⤵PID:4936
-
\??\c:\ppjjj.exec:\ppjjj.exe76⤵PID:1848
-
\??\c:\xrrxxff.exec:\xrrxxff.exe77⤵PID:2504
-
\??\c:\nnnhhb.exec:\nnnhhb.exe78⤵PID:3944
-
\??\c:\jjjjp.exec:\jjjjp.exe79⤵PID:4144
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe80⤵PID:2540
-
\??\c:\bbtbtt.exec:\bbtbtt.exe81⤵PID:2980
-
\??\c:\bbnnnt.exec:\bbnnnt.exe82⤵PID:4448
-
\??\c:\fffllll.exec:\fffllll.exe83⤵PID:4480
-
\??\c:\tbhhhn.exec:\tbhhhn.exe84⤵PID:1196
-
\??\c:\hbhbbb.exec:\hbhbbb.exe85⤵PID:2844
-
\??\c:\pvpvv.exec:\pvpvv.exe86⤵PID:976
-
\??\c:\flrllxx.exec:\flrllxx.exe87⤵PID:2236
-
\??\c:\xrfrxfr.exec:\xrfrxfr.exe88⤵PID:4596
-
\??\c:\bnbttb.exec:\bnbttb.exe89⤵PID:2100
-
\??\c:\rfllrxf.exec:\rfllrxf.exe90⤵PID:376
-
\??\c:\9tbnnt.exec:\9tbnnt.exe91⤵PID:1420
-
\??\c:\jdvjv.exec:\jdvjv.exe92⤵PID:4532
-
\??\c:\lxffrxf.exec:\lxffrxf.exe93⤵PID:2656
-
\??\c:\nttbbb.exec:\nttbbb.exe94⤵PID:2848
-
\??\c:\vjjvp.exec:\vjjvp.exe95⤵PID:3040
-
\??\c:\ffffxxx.exec:\ffffxxx.exe96⤵PID:2224
-
\??\c:\fflfxlr.exec:\fflfxlr.exe97⤵PID:4856
-
\??\c:\hbtttb.exec:\hbtttb.exe98⤵PID:1992
-
\??\c:\jdpvd.exec:\jdpvd.exe99⤵PID:1672
-
\??\c:\vvvvv.exec:\vvvvv.exe100⤵PID:748
-
\??\c:\xxrrrxf.exec:\xxrrrxf.exe101⤵PID:4816
-
\??\c:\lxlrrxx.exec:\lxlrrxx.exe102⤵PID:1168
-
\??\c:\bbhhht.exec:\bbhhht.exe103⤵PID:740
-
\??\c:\9djjj.exec:\9djjj.exe104⤵PID:1712
-
\??\c:\ppppj.exec:\ppppj.exe105⤵PID:1800
-
\??\c:\llrrxff.exec:\llrrxff.exe106⤵PID:1432
-
\??\c:\bhtbhh.exec:\bhtbhh.exe107⤵PID:3296
-
\??\c:\vvppp.exec:\vvppp.exe108⤵PID:636
-
\??\c:\xrxrlrr.exec:\xrxrlrr.exe109⤵PID:3712
-
\??\c:\dpdjv.exec:\dpdjv.exe110⤵PID:1472
-
\??\c:\djvvd.exec:\djvvd.exe111⤵PID:3952
-
\??\c:\1frffll.exec:\1frffll.exe112⤵PID:4960
-
\??\c:\tnbbbh.exec:\tnbbbh.exe113⤵PID:516
-
\??\c:\5tnttb.exec:\5tnttb.exe114⤵PID:2496
-
\??\c:\djddv.exec:\djddv.exe115⤵PID:696
-
\??\c:\ppjdd.exec:\ppjdd.exe116⤵PID:5048
-
\??\c:\rrxxxfl.exec:\rrxxxfl.exe117⤵PID:468
-
\??\c:\ntbnbh.exec:\ntbnbh.exe118⤵PID:4544
-
\??\c:\nnbhht.exec:\nnbhht.exe119⤵PID:3844
-
\??\c:\pdvvv.exec:\pdvvv.exe120⤵PID:2976
-
\??\c:\fxxxrrx.exec:\fxxxrrx.exe121⤵PID:2144
-
\??\c:\rxrrflx.exec:\rxrrflx.exe122⤵PID:944
-
\??\c:\bntttt.exec:\bntttt.exe123⤵PID:3492
-
\??\c:\jddvv.exec:\jddvv.exe124⤵PID:2516
-
\??\c:\dvdvp.exec:\dvdvp.exe125⤵PID:4732
-
\??\c:\xllrfxl.exec:\xllrfxl.exe126⤵PID:2136
-
\??\c:\9tnnnh.exec:\9tnnnh.exe127⤵PID:2504
-
\??\c:\nnbbbn.exec:\nnbbbn.exe128⤵PID:5016
-
\??\c:\7pdvp.exec:\7pdvp.exe129⤵PID:3180
-
\??\c:\ffffxxx.exec:\ffffxxx.exe130⤵PID:4480
-
\??\c:\xxllflx.exec:\xxllflx.exe131⤵PID:1196
-
\??\c:\tntttb.exec:\tntttb.exe132⤵PID:4452
-
\??\c:\jdvjj.exec:\jdvjj.exe133⤵PID:1844
-
\??\c:\lxrxlfr.exec:\lxrxlfr.exe134⤵PID:408
-
\??\c:\htttbb.exec:\htttbb.exe135⤵PID:4916
-
\??\c:\thtnhh.exec:\thtnhh.exe136⤵PID:376
-
\??\c:\pdppp.exec:\pdppp.exe137⤵PID:4616
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe138⤵PID:2676
-
\??\c:\9lllrxx.exec:\9lllrxx.exe139⤵PID:2624
-
\??\c:\bbnttn.exec:\bbnttn.exe140⤵PID:4368
-
\??\c:\jdpvd.exec:\jdpvd.exe141⤵PID:3040
-
\??\c:\pjjjj.exec:\pjjjj.exe142⤵PID:2224
-
\??\c:\rlffrxl.exec:\rlffrxl.exe143⤵PID:1428
-
\??\c:\hbhhhn.exec:\hbhhhn.exe144⤵PID:1528
-
\??\c:\jjvvj.exec:\jjvvj.exe145⤵PID:3252
-
\??\c:\bbbhhn.exec:\bbbhhn.exe146⤵PID:4484
-
\??\c:\jjvvj.exec:\jjvvj.exe147⤵PID:4816
-
\??\c:\rlxfflf.exec:\rlxfflf.exe148⤵PID:3608
-
\??\c:\xxrrflr.exec:\xxrrflr.exe149⤵PID:4876
-
\??\c:\nhhhnt.exec:\nhhhnt.exe150⤵PID:3512
-
\??\c:\5rffxxl.exec:\5rffxxl.exe151⤵PID:1180
-
\??\c:\bntbhh.exec:\bntbhh.exe152⤵PID:4504
-
\??\c:\1xfllxf.exec:\1xfllxf.exe153⤵PID:3328
-
\??\c:\thtnnt.exec:\thtnnt.exe154⤵PID:4964
-
\??\c:\9vvdd.exec:\9vvdd.exe155⤵PID:2280
-
\??\c:\5flllxf.exec:\5flllxf.exe156⤵PID:4008
-
\??\c:\lxfrfff.exec:\lxfrfff.exe157⤵PID:2628
-
\??\c:\bhbnhh.exec:\bhbnhh.exe158⤵PID:4832
-
\??\c:\jdddv.exec:\jdddv.exe159⤵PID:4312
-
\??\c:\flllfxl.exec:\flllfxl.exe160⤵PID:1556
-
\??\c:\tbnhhb.exec:\tbnhhb.exe161⤵PID:5048
-
\??\c:\nthtnt.exec:\nthtnt.exe162⤵PID:1448
-
\??\c:\vppjv.exec:\vppjv.exe163⤵PID:4544
-
\??\c:\xlrrlll.exec:\xlrrlll.exe164⤵PID:3844
-
\??\c:\lfffxxr.exec:\lfffxxr.exe165⤵PID:5008
-
\??\c:\hnnhhb.exec:\hnnhhb.exe166⤵PID:1984
-
\??\c:\djddp.exec:\djddp.exe167⤵PID:944
-
\??\c:\pvdvp.exec:\pvdvp.exe168⤵PID:3416
-
\??\c:\xxxlxlf.exec:\xxxlxlf.exe169⤵PID:2516
-
\??\c:\xfllrrl.exec:\xfllrrl.exe170⤵PID:4552
-
\??\c:\vvjdd.exec:\vvjdd.exe171⤵PID:1848
-
\??\c:\jddjj.exec:\jddjj.exe172⤵PID:1920
-
\??\c:\flffxxr.exec:\flffxxr.exe173⤵PID:456
-
\??\c:\bhbbnt.exec:\bhbbnt.exe174⤵PID:1028
-
\??\c:\vdjjj.exec:\vdjjj.exe175⤵PID:392
-
\??\c:\jdvpj.exec:\jdvpj.exe176⤵PID:4452
-
\??\c:\rxxxrfx.exec:\rxxxrfx.exe177⤵PID:4176
-
\??\c:\7tbtth.exec:\7tbtth.exe178⤵PID:408
-
\??\c:\1bhhbh.exec:\1bhhbh.exe179⤵PID:4392
-
\??\c:\jjpjd.exec:\jjpjd.exe180⤵PID:1420
-
\??\c:\xxrlxrf.exec:\xxrlxrf.exe181⤵PID:752
-
\??\c:\ntnhtn.exec:\ntnhtn.exe182⤵PID:2848
-
\??\c:\dddvj.exec:\dddvj.exe183⤵PID:2800
-
\??\c:\7dvvj.exec:\7dvvj.exe184⤵PID:3496
-
\??\c:\lrrxrfr.exec:\lrrxrfr.exe185⤵PID:860
-
\??\c:\bnttnh.exec:\bnttnh.exe186⤵PID:1224
-
\??\c:\pddpp.exec:\pddpp.exe187⤵PID:3792
-
\??\c:\dppdv.exec:\dppdv.exe188⤵PID:3692
-
\??\c:\xrrlfff.exec:\xrrlfff.exe189⤵PID:5112
-
\??\c:\7bnhtt.exec:\7bnhtt.exe190⤵PID:4048
-
\??\c:\vppjd.exec:\vppjd.exe191⤵PID:740
-
\??\c:\ddppj.exec:\ddppj.exe192⤵PID:3892
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe193⤵PID:2024
-
\??\c:\1nnnnt.exec:\1nnnnt.exe194⤵PID:1344
-
\??\c:\nbbbnn.exec:\nbbbnn.exe195⤵PID:3060
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe196⤵PID:3712
-
\??\c:\bbbbtb.exec:\bbbbtb.exe197⤵PID:1384
-
\??\c:\dvdvv.exec:\dvdvv.exe198⤵PID:4108
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe199⤵PID:3384
-
\??\c:\9hnbtt.exec:\9hnbtt.exe200⤵PID:4896
-
\??\c:\9nbntn.exec:\9nbntn.exe201⤵PID:3832
-
\??\c:\9jdvd.exec:\9jdvd.exe202⤵PID:3668
-
\??\c:\thhbtn.exec:\thhbtn.exe203⤵PID:2384
-
\??\c:\tnhtnn.exec:\tnhtnn.exe204⤵PID:1260
-
\??\c:\vvvdd.exec:\vvvdd.exe205⤵PID:3644
-
\??\c:\fxffxff.exec:\fxffxff.exe206⤵PID:3068
-
\??\c:\1bbbnt.exec:\1bbbnt.exe207⤵PID:4648
-
\??\c:\nhttbt.exec:\nhttbt.exe208⤵PID:5064
-
\??\c:\vpjpv.exec:\vpjpv.exe209⤵PID:4636
-
\??\c:\lxlrrll.exec:\lxlrrll.exe210⤵PID:2388
-
\??\c:\httttb.exec:\httttb.exe211⤵PID:4732
-
\??\c:\btthbt.exec:\btthbt.exe212⤵PID:212
-
\??\c:\jjdvp.exec:\jjdvp.exe213⤵PID:2504
-
\??\c:\xrrfxrf.exec:\xrrfxrf.exe214⤵PID:5084
-
\??\c:\rfxxxfl.exec:\rfxxxfl.exe215⤵PID:4244
-
\??\c:\nntbnn.exec:\nntbnn.exe216⤵PID:2864
-
\??\c:\rrfrllr.exec:\rrfrllr.exe217⤵PID:2724
-
\??\c:\xrfflfl.exec:\xrfflfl.exe218⤵PID:3740
-
\??\c:\hthbnn.exec:\hthbnn.exe219⤵PID:4596
-
\??\c:\9pdjj.exec:\9pdjj.exe220⤵PID:644
-
\??\c:\jdvpj.exec:\jdvpj.exe221⤵PID:4052
-
\??\c:\rrxflrx.exec:\rrxflrx.exe222⤵PID:4772
-
\??\c:\rlxlrrx.exec:\rlxlrrx.exe223⤵PID:3272
-
\??\c:\ttnthh.exec:\ttnthh.exe224⤵PID:3380
-
\??\c:\djppp.exec:\djppp.exe225⤵PID:2096
-
\??\c:\vjpvp.exec:\vjpvp.exe226⤵PID:3040
-
\??\c:\ffxxrxr.exec:\ffxxrxr.exe227⤵PID:4064
-
\??\c:\lxxrxxx.exec:\lxxrxxx.exe228⤵PID:2132
-
\??\c:\tnhhht.exec:\tnhhht.exe229⤵PID:1856
-
\??\c:\dvjjd.exec:\dvjjd.exe230⤵PID:4516
-
\??\c:\vpjvp.exec:\vpjvp.exe231⤵PID:1168
-
\??\c:\fxllfrr.exec:\fxllfrr.exe232⤵PID:4472
-
\??\c:\tttbbh.exec:\tttbbh.exe233⤵PID:3608
-
\??\c:\bhttbn.exec:\bhttbn.exe234⤵PID:1908
-
\??\c:\dpddj.exec:\dpddj.exe235⤵PID:3552
-
\??\c:\pjdvv.exec:\pjdvv.exe236⤵PID:4564
-
\??\c:\ffrlfll.exec:\ffrlfll.exe237⤵PID:3328
-
\??\c:\httnnn.exec:\httnnn.exe238⤵PID:3900
-
\??\c:\hnbhnn.exec:\hnbhnn.exe239⤵PID:3568
-
\??\c:\7jvvj.exec:\7jvvj.exe240⤵PID:832
-
\??\c:\flrllrl.exec:\flrllrl.exe241⤵PID:4904
-
\??\c:\fxfflrr.exec:\fxfflrr.exe242⤵PID:4312