Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 16:03
Behavioral task
behavioral1
Sample
ec511f347154cb133e593d97378df5c0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
ec511f347154cb133e593d97378df5c0_NeikiAnalytics.exe
-
Size
293KB
-
MD5
ec511f347154cb133e593d97378df5c0
-
SHA1
b9441417724ade19af63ad743d4475c748c53092
-
SHA256
6c9f60de57b33f6a03880231ed75955016a461be0de7e7940280d2b4895b8fcf
-
SHA512
c6636244b3da30cf39b36c97bd41a27fd85a0e1b2113cb909e61ff841e4bd91ec4b735548c7239411032afadcf7a076eb8a046d3d53751fce872f29d7001148f
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftOw:K4wFHoSQkuUHk1zBR/pMT9XvEhdff
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1196-3-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2744-16-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1012-23-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1216-18-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4644-30-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4904-40-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3128-42-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3688-53-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2408-57-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/804-65-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2012-67-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2932-74-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3440-84-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1628-86-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4752-106-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1156-114-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5036-101-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1208-120-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3868-130-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5016-143-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3476-162-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4348-169-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4100-181-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4644-190-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3644-199-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4904-198-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2788-206-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4904-194-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/228-211-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1644-214-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2768-219-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5024-226-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4392-233-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4288-243-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1960-256-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/392-267-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/324-272-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/396-268-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4696-277-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2516-285-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1120-288-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/620-302-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2756-339-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/224-349-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3872-385-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3760-395-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3976-412-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3332-426-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1120-430-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4360-434-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/712-441-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2708-442-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1648-480-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3024-491-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5036-524-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4376-579-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1276-583-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/544-636-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/860-657-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/872-789-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3212-820-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5100-822-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2900-847-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1644-920-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\3dvpd.exe family_berbew \??\c:\9jjvd.exe family_berbew C:\7nbtnt.exe family_berbew \??\c:\pjvjv.exe family_berbew C:\xrlxlfr.exe family_berbew \??\c:\ttnhbt.exe family_berbew \??\c:\pjdpj.exe family_berbew C:\3jjdd.exe family_berbew C:\7tbbbb.exe family_berbew \??\c:\pppjd.exe family_berbew C:\9xrfrfr.exe family_berbew \??\c:\3llllll.exe family_berbew C:\bttnnt.exe family_berbew \??\c:\5fxrrrx.exe family_berbew C:\fxfxrlf.exe family_berbew C:\nhbbth.exe family_berbew C:\jddvv.exe family_berbew C:\3rxrlrl.exe family_berbew C:\tnbbhh.exe family_berbew C:\dpvvp.exe family_berbew C:\xxrlflf.exe family_berbew \??\c:\bbbtbb.exe family_berbew \??\c:\dvdjd.exe family_berbew \??\c:\3llxllr.exe family_berbew \??\c:\rxrrlll.exe family_berbew \??\c:\3nhtbt.exe family_berbew C:\7vdvv.exe family_berbew C:\frrlffx.exe family_berbew C:\bthhbn.exe family_berbew \??\c:\ppppp.exe family_berbew C:\lrfflxl.exe family_berbew \??\c:\1rflxfl.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
3dvpd.exe9jjvd.exe7nbtnt.exepjvjv.exexrlxlfr.exettnhbt.exepjdpj.exe3jjdd.exe7tbbbb.exepppjd.exe9xrfrfr.exe3llllll.exebttnnt.exe5fxrrrx.exefxfxrlf.exenhbbth.exejddvv.exe3rxrlrl.exetnbbhh.exedpvvp.exexxrlflf.exebbbtbb.exedvdjd.exe3llxllr.exerxrrlll.exe3nhtbt.exe7vdvv.exefrrlffx.exebthhbn.exeppppp.exe1rflxfl.exelrfflxl.exebtnhbb.exeppdvv.exexxxllll.exerlfxxxx.exehbnthh.exejdpjp.exevdjjp.exefrlfrrx.exehttnbn.exejjdvd.exellrlrxl.exelflfxxx.exenthbtn.exedvpjd.exe3vpjp.exeffrrrrf.exehhnntt.exe7bbbtb.exejpjdd.exexrrlxrl.exe5rxrllf.exenbhhht.exepjvpp.exevjpjd.exe1nbbtt.exetnbthh.exevpvjj.exejdjjj.exe5lrllrl.exebhhbtn.exehnnbtn.exeppvdd.exepid process 2484 3dvpd.exe 2744 9jjvd.exe 1216 7nbtnt.exe 1012 pjvjv.exe 4644 xrlxlfr.exe 4904 ttnhbt.exe 3128 pjdpj.exe 3688 3jjdd.exe 2408 7tbbbb.exe 804 pppjd.exe 2012 9xrfrfr.exe 2932 3llllll.exe 3440 bttnnt.exe 1628 5fxrrrx.exe 408 fxfxrlf.exe 5036 nhbbth.exe 4752 jddvv.exe 1156 3rxrlrl.exe 1476 tnbbhh.exe 1208 dpvvp.exe 3868 xxrlflf.exe 4356 bbbtbb.exe 324 dvdjd.exe 5016 3llxllr.exe 4016 rxrrlll.exe 4968 3nhtbt.exe 3476 7vdvv.exe 4348 frrlffx.exe 4964 bthhbn.exe 1664 ppppp.exe 4100 1rflxfl.exe 4908 lrfflxl.exe 4644 btnhbb.exe 4904 ppdvv.exe 3644 xxxllll.exe 2788 rlfxxxx.exe 228 hbnthh.exe 1644 jdpjp.exe 2768 vdjjp.exe 3844 frlfrrx.exe 5024 httnbn.exe 3012 jjdvd.exe 2836 llrlrxl.exe 4392 lflfxxx.exe 860 nthbtn.exe 2016 dvpjd.exe 4288 3vpjp.exe 388 ffrrrrf.exe 4204 hhnntt.exe 1960 7bbbtb.exe 904 jpjdd.exe 3496 xrrlxrl.exe 392 5rxrllf.exe 396 nbhhht.exe 324 pjvpp.exe 4696 vjpjd.exe 5116 1nbbtt.exe 2516 tnbthh.exe 1120 vpvjj.exe 4500 jdjjj.exe 4868 5lrllrl.exe 620 bhhbtn.exe 3304 hnnbtn.exe 4348 ppvdd.exe -
Processes:
resource yara_rule behavioral2/memory/1196-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3dvpd.exe upx behavioral2/memory/1196-3-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\9jjvd.exe upx C:\7nbtnt.exe upx behavioral2/memory/2744-16-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\pjvjv.exe upx behavioral2/memory/1012-23-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1216-18-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xrlxlfr.exe upx behavioral2/memory/4644-30-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ttnhbt.exe upx behavioral2/memory/4904-40-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\pjdpj.exe upx behavioral2/memory/3128-42-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3jjdd.exe upx behavioral2/memory/3688-47-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\7tbbbb.exe upx behavioral2/memory/3688-53-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\pppjd.exe upx behavioral2/memory/804-59-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2408-57-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\9xrfrfr.exe upx behavioral2/memory/804-65-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2012-67-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\3llllll.exe upx C:\bttnnt.exe upx behavioral2/memory/2932-74-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3440-77-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\5fxrrrx.exe upx behavioral2/memory/3440-84-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1628-86-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\fxfxrlf.exe upx C:\nhbbth.exe upx C:\jddvv.exe upx C:\3rxrlrl.exe upx behavioral2/memory/4752-106-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1156-107-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\tnbbhh.exe upx behavioral2/memory/1156-114-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\dpvvp.exe upx behavioral2/memory/5036-101-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1208-120-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xxrlflf.exe upx behavioral2/memory/3868-130-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\bbbtbb.exe upx \??\c:\dvdjd.exe upx \??\c:\3llxllr.exe upx behavioral2/memory/5016-143-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\rxrrlll.exe upx \??\c:\3nhtbt.exe upx behavioral2/memory/4968-151-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\7vdvv.exe upx behavioral2/memory/3476-162-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\frrlffx.exe upx C:\bthhbn.exe upx behavioral2/memory/4348-169-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ppppp.exe upx C:\lrfflxl.exe upx behavioral2/memory/4100-181-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\1rflxfl.exe upx behavioral2/memory/4644-190-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1664-175-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3644-199-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ec511f347154cb133e593d97378df5c0_NeikiAnalytics.exe3dvpd.exe9jjvd.exe7nbtnt.exepjvjv.exexrlxlfr.exettnhbt.exepjdpj.exe3jjdd.exe7tbbbb.exepppjd.exe9xrfrfr.exe3llllll.exebttnnt.exe5fxrrrx.exefxfxrlf.exenhbbth.exejddvv.exe3rxrlrl.exetnbbhh.exedpvvp.exexxrlflf.exedescription pid process target process PID 1196 wrote to memory of 2484 1196 ec511f347154cb133e593d97378df5c0_NeikiAnalytics.exe 3dvpd.exe PID 1196 wrote to memory of 2484 1196 ec511f347154cb133e593d97378df5c0_NeikiAnalytics.exe 3dvpd.exe PID 1196 wrote to memory of 2484 1196 ec511f347154cb133e593d97378df5c0_NeikiAnalytics.exe 3dvpd.exe PID 2484 wrote to memory of 2744 2484 3dvpd.exe 9jjvd.exe PID 2484 wrote to memory of 2744 2484 3dvpd.exe 9jjvd.exe PID 2484 wrote to memory of 2744 2484 3dvpd.exe 9jjvd.exe PID 2744 wrote to memory of 1216 2744 9jjvd.exe 7nbtnt.exe PID 2744 wrote to memory of 1216 2744 9jjvd.exe 7nbtnt.exe PID 2744 wrote to memory of 1216 2744 9jjvd.exe 7nbtnt.exe PID 1216 wrote to memory of 1012 1216 7nbtnt.exe pjvjv.exe PID 1216 wrote to memory of 1012 1216 7nbtnt.exe pjvjv.exe PID 1216 wrote to memory of 1012 1216 7nbtnt.exe pjvjv.exe PID 1012 wrote to memory of 4644 1012 pjvjv.exe xrlxlfr.exe PID 1012 wrote to memory of 4644 1012 pjvjv.exe xrlxlfr.exe PID 1012 wrote to memory of 4644 1012 pjvjv.exe xrlxlfr.exe PID 4644 wrote to memory of 4904 4644 xrlxlfr.exe ttnhbt.exe PID 4644 wrote to memory of 4904 4644 xrlxlfr.exe ttnhbt.exe PID 4644 wrote to memory of 4904 4644 xrlxlfr.exe ttnhbt.exe PID 4904 wrote to memory of 3128 4904 ttnhbt.exe pjdpj.exe PID 4904 wrote to memory of 3128 4904 ttnhbt.exe pjdpj.exe PID 4904 wrote to memory of 3128 4904 ttnhbt.exe pjdpj.exe PID 3128 wrote to memory of 3688 3128 pjdpj.exe 3jjdd.exe PID 3128 wrote to memory of 3688 3128 pjdpj.exe 3jjdd.exe PID 3128 wrote to memory of 3688 3128 pjdpj.exe 3jjdd.exe PID 3688 wrote to memory of 2408 3688 3jjdd.exe 7tbbbb.exe PID 3688 wrote to memory of 2408 3688 3jjdd.exe 7tbbbb.exe PID 3688 wrote to memory of 2408 3688 3jjdd.exe 7tbbbb.exe PID 2408 wrote to memory of 804 2408 7tbbbb.exe pppjd.exe PID 2408 wrote to memory of 804 2408 7tbbbb.exe pppjd.exe PID 2408 wrote to memory of 804 2408 7tbbbb.exe pppjd.exe PID 804 wrote to memory of 2012 804 pppjd.exe 9xrfrfr.exe PID 804 wrote to memory of 2012 804 pppjd.exe 9xrfrfr.exe PID 804 wrote to memory of 2012 804 pppjd.exe 9xrfrfr.exe PID 2012 wrote to memory of 2932 2012 9xrfrfr.exe 3llllll.exe PID 2012 wrote to memory of 2932 2012 9xrfrfr.exe 3llllll.exe PID 2012 wrote to memory of 2932 2012 9xrfrfr.exe 3llllll.exe PID 2932 wrote to memory of 3440 2932 3llllll.exe bttnnt.exe PID 2932 wrote to memory of 3440 2932 3llllll.exe bttnnt.exe PID 2932 wrote to memory of 3440 2932 3llllll.exe bttnnt.exe PID 3440 wrote to memory of 1628 3440 bttnnt.exe 5fxrrrx.exe PID 3440 wrote to memory of 1628 3440 bttnnt.exe 5fxrrrx.exe PID 3440 wrote to memory of 1628 3440 bttnnt.exe 5fxrrrx.exe PID 1628 wrote to memory of 408 1628 5fxrrrx.exe fxfxrlf.exe PID 1628 wrote to memory of 408 1628 5fxrrrx.exe fxfxrlf.exe PID 1628 wrote to memory of 408 1628 5fxrrrx.exe fxfxrlf.exe PID 408 wrote to memory of 5036 408 fxfxrlf.exe 5jppp.exe PID 408 wrote to memory of 5036 408 fxfxrlf.exe 5jppp.exe PID 408 wrote to memory of 5036 408 fxfxrlf.exe 5jppp.exe PID 5036 wrote to memory of 4752 5036 nhbbth.exe bnbbbb.exe PID 5036 wrote to memory of 4752 5036 nhbbth.exe bnbbbb.exe PID 5036 wrote to memory of 4752 5036 nhbbth.exe bnbbbb.exe PID 4752 wrote to memory of 1156 4752 jddvv.exe 3rxrlrl.exe PID 4752 wrote to memory of 1156 4752 jddvv.exe 3rxrlrl.exe PID 4752 wrote to memory of 1156 4752 jddvv.exe 3rxrlrl.exe PID 1156 wrote to memory of 1476 1156 3rxrlrl.exe tnbbhh.exe PID 1156 wrote to memory of 1476 1156 3rxrlrl.exe tnbbhh.exe PID 1156 wrote to memory of 1476 1156 3rxrlrl.exe tnbbhh.exe PID 1476 wrote to memory of 1208 1476 tnbbhh.exe dpvvp.exe PID 1476 wrote to memory of 1208 1476 tnbbhh.exe dpvvp.exe PID 1476 wrote to memory of 1208 1476 tnbbhh.exe dpvvp.exe PID 1208 wrote to memory of 3868 1208 dpvvp.exe xxrlflf.exe PID 1208 wrote to memory of 3868 1208 dpvvp.exe xxrlflf.exe PID 1208 wrote to memory of 3868 1208 dpvvp.exe xxrlflf.exe PID 3868 wrote to memory of 4356 3868 xxrlflf.exe bbbtbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec511f347154cb133e593d97378df5c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ec511f347154cb133e593d97378df5c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\3dvpd.exec:\3dvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\9jjvd.exec:\9jjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\7nbtnt.exec:\7nbtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\pjvjv.exec:\pjvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\xrlxlfr.exec:\xrlxlfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\ttnhbt.exec:\ttnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\pjdpj.exec:\pjdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\3jjdd.exec:\3jjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\7tbbbb.exec:\7tbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\pppjd.exec:\pppjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\9xrfrfr.exec:\9xrfrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\3llllll.exec:\3llllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\bttnnt.exec:\bttnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\5fxrrrx.exec:\5fxrrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\nhbbth.exec:\nhbbth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\jddvv.exec:\jddvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\3rxrlrl.exec:\3rxrlrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\tnbbhh.exec:\tnbbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\dpvvp.exec:\dpvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\xxrlflf.exec:\xxrlflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\bbbtbb.exec:\bbbtbb.exe23⤵
- Executes dropped EXE
PID:4356 -
\??\c:\dvdjd.exec:\dvdjd.exe24⤵
- Executes dropped EXE
PID:324 -
\??\c:\3llxllr.exec:\3llxllr.exe25⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rxrrlll.exec:\rxrrlll.exe26⤵
- Executes dropped EXE
PID:4016 -
\??\c:\3nhtbt.exec:\3nhtbt.exe27⤵
- Executes dropped EXE
PID:4968 -
\??\c:\7vdvv.exec:\7vdvv.exe28⤵
- Executes dropped EXE
PID:3476 -
\??\c:\frrlffx.exec:\frrlffx.exe29⤵
- Executes dropped EXE
PID:4348 -
\??\c:\bthhbn.exec:\bthhbn.exe30⤵
- Executes dropped EXE
PID:4964 -
\??\c:\ppppp.exec:\ppppp.exe31⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1rflxfl.exec:\1rflxfl.exe32⤵
- Executes dropped EXE
PID:4100 -
\??\c:\lrfflxl.exec:\lrfflxl.exe33⤵
- Executes dropped EXE
PID:4908 -
\??\c:\btnhbb.exec:\btnhbb.exe34⤵
- Executes dropped EXE
PID:4644 -
\??\c:\ppdvv.exec:\ppdvv.exe35⤵
- Executes dropped EXE
PID:4904 -
\??\c:\xxxllll.exec:\xxxllll.exe36⤵
- Executes dropped EXE
PID:3644 -
\??\c:\rlfxxxx.exec:\rlfxxxx.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hbnthh.exec:\hbnthh.exe38⤵
- Executes dropped EXE
PID:228 -
\??\c:\jdpjp.exec:\jdpjp.exe39⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vdjjp.exec:\vdjjp.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\frlfrrx.exec:\frlfrrx.exe41⤵
- Executes dropped EXE
PID:3844 -
\??\c:\httnbn.exec:\httnbn.exe42⤵
- Executes dropped EXE
PID:5024 -
\??\c:\jjdvd.exec:\jjdvd.exe43⤵
- Executes dropped EXE
PID:3012 -
\??\c:\llrlrxl.exec:\llrlrxl.exe44⤵
- Executes dropped EXE
PID:2836 -
\??\c:\lflfxxx.exec:\lflfxxx.exe45⤵
- Executes dropped EXE
PID:4392 -
\??\c:\nthbtn.exec:\nthbtn.exe46⤵
- Executes dropped EXE
PID:860 -
\??\c:\dvpjd.exec:\dvpjd.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\3vpjp.exec:\3vpjp.exe48⤵
- Executes dropped EXE
PID:4288 -
\??\c:\ffrrrrf.exec:\ffrrrrf.exe49⤵
- Executes dropped EXE
PID:388 -
\??\c:\hhnntt.exec:\hhnntt.exe50⤵
- Executes dropped EXE
PID:4204 -
\??\c:\7bbbtb.exec:\7bbbtb.exe51⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jpjdd.exec:\jpjdd.exe52⤵
- Executes dropped EXE
PID:904 -
\??\c:\xrrlxrl.exec:\xrrlxrl.exe53⤵
- Executes dropped EXE
PID:3496 -
\??\c:\5rxrllf.exec:\5rxrllf.exe54⤵
- Executes dropped EXE
PID:392 -
\??\c:\nbhhht.exec:\nbhhht.exe55⤵
- Executes dropped EXE
PID:396 -
\??\c:\pjvpp.exec:\pjvpp.exe56⤵
- Executes dropped EXE
PID:324 -
\??\c:\vjpjd.exec:\vjpjd.exe57⤵
- Executes dropped EXE
PID:4696 -
\??\c:\1nbbtt.exec:\1nbbtt.exe58⤵
- Executes dropped EXE
PID:5116 -
\??\c:\tnbthh.exec:\tnbthh.exe59⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vpvjj.exec:\vpvjj.exe60⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jdjjj.exec:\jdjjj.exe61⤵
- Executes dropped EXE
PID:4500 -
\??\c:\5lrllrl.exec:\5lrllrl.exe62⤵
- Executes dropped EXE
PID:4868 -
\??\c:\bhhbtn.exec:\bhhbtn.exe63⤵
- Executes dropped EXE
PID:620 -
\??\c:\hnnbtn.exec:\hnnbtn.exe64⤵
- Executes dropped EXE
PID:3304 -
\??\c:\ppvdd.exec:\ppvdd.exe65⤵
- Executes dropped EXE
PID:4348 -
\??\c:\jdddv.exec:\jdddv.exe66⤵PID:3308
-
\??\c:\rllrxrx.exec:\rllrxrx.exe67⤵PID:2248
-
\??\c:\httttt.exec:\httttt.exe68⤵PID:996
-
\??\c:\5nthhh.exec:\5nthhh.exe69⤵PID:4532
-
\??\c:\3vdpd.exec:\3vdpd.exe70⤵PID:3712
-
\??\c:\dpvpj.exec:\dpvpj.exe71⤵PID:4628
-
\??\c:\xxfxlfx.exec:\xxfxlfx.exe72⤵PID:3628
-
\??\c:\fxllrrf.exec:\fxllrrf.exe73⤵PID:3472
-
\??\c:\hhnnnn.exec:\hhnnnn.exe74⤵PID:4884
-
\??\c:\vdddv.exec:\vdddv.exe75⤵PID:2756
-
\??\c:\vpjdd.exec:\vpjdd.exe76⤵PID:2456
-
\??\c:\jjvpp.exec:\jjvpp.exe77⤵PID:3024
-
\??\c:\5fxxrrr.exec:\5fxxrrr.exe78⤵PID:1456
-
\??\c:\xfllllr.exec:\xfllllr.exe79⤵PID:224
-
\??\c:\7hnhbb.exec:\7hnhbb.exe80⤵PID:460
-
\??\c:\7jjdd.exec:\7jjdd.exe81⤵PID:4900
-
\??\c:\dvvvv.exec:\dvvvv.exe82⤵PID:4788
-
\??\c:\lffflrr.exec:\lffflrr.exe83⤵PID:1100
-
\??\c:\5ffxrxx.exec:\5ffxrxx.exe84⤵PID:1164
-
\??\c:\nntnhh.exec:\nntnhh.exe85⤵PID:4560
-
\??\c:\tthbtt.exec:\tthbtt.exe86⤵PID:4876
-
\??\c:\dpvpp.exec:\dpvpp.exe87⤵PID:2488
-
\??\c:\jjppj.exec:\jjppj.exe88⤵PID:4288
-
\??\c:\fffrffr.exec:\fffrffr.exe89⤵PID:3872
-
\??\c:\3tnnhh.exec:\3tnnhh.exe90⤵PID:3136
-
\??\c:\bntnhh.exec:\bntnhh.exe91⤵PID:3216
-
\??\c:\vjjjd.exec:\vjjjd.exe92⤵PID:3760
-
\??\c:\jpdvj.exec:\jpdvj.exe93⤵PID:3496
-
\??\c:\3flfrrr.exec:\3flfrrr.exe94⤵PID:4136
-
\??\c:\1rrllxr.exec:\1rrllxr.exe95⤵PID:396
-
\??\c:\hhhbbb.exec:\hhhbbb.exe96⤵PID:1620
-
\??\c:\nnhnhh.exec:\nnhnhh.exe97⤵PID:3976
-
\??\c:\pjvjv.exec:\pjvjv.exe98⤵PID:3896
-
\??\c:\5pvdp.exec:\5pvdp.exe99⤵PID:3604
-
\??\c:\lxrfrll.exec:\lxrfrll.exe100⤵PID:4968
-
\??\c:\jpjpv.exec:\jpjpv.exe101⤵PID:3332
-
\??\c:\vjpjj.exec:\vjpjj.exe102⤵PID:1096
-
\??\c:\rflflrx.exec:\rflflrx.exe103⤵PID:1120
-
\??\c:\xllffxx.exec:\xllffxx.exe104⤵PID:4360
-
\??\c:\1tbbtt.exec:\1tbbtt.exe105⤵PID:712
-
\??\c:\5jjvd.exec:\5jjvd.exe106⤵PID:2708
-
\??\c:\vddpp.exec:\vddpp.exe107⤵PID:1260
-
\??\c:\xlxlxlx.exec:\xlxlxlx.exe108⤵PID:2484
-
\??\c:\5fffxxx.exec:\5fffxxx.exe109⤵PID:4964
-
\??\c:\htbhhh.exec:\htbhhh.exe110⤵PID:1924
-
\??\c:\nhtbhn.exec:\nhtbhn.exe111⤵PID:4100
-
\??\c:\5vddd.exec:\5vddd.exe112⤵PID:1060
-
\??\c:\vpvpd.exec:\vpvpd.exe113⤵PID:4908
-
\??\c:\xrxrrxr.exec:\xrxrrxr.exe114⤵PID:1804
-
\??\c:\rlxrfll.exec:\rlxrfll.exe115⤵PID:4768
-
\??\c:\5hnnnn.exec:\5hnnnn.exe116⤵PID:4156
-
\??\c:\bnttnh.exec:\bnttnh.exe117⤵PID:1648
-
\??\c:\jpdpv.exec:\jpdpv.exe118⤵PID:1524
-
\??\c:\3dddd.exec:\3dddd.exe119⤵PID:216
-
\??\c:\flfrflf.exec:\flfrflf.exe120⤵PID:3024
-
\??\c:\bhhhth.exec:\bhhhth.exe121⤵PID:3436
-
\??\c:\bbtbbb.exec:\bbtbbb.exe122⤵PID:5024
-
\??\c:\jdvvv.exec:\jdvvv.exe123⤵PID:4848
-
\??\c:\djvpj.exec:\djvpj.exe124⤵PID:4912
-
\??\c:\rllfxrr.exec:\rllfxrr.exe125⤵PID:3984
-
\??\c:\3xxxrrl.exec:\3xxxrrl.exe126⤵PID:1660
-
\??\c:\bthnnn.exec:\bthnnn.exe127⤵PID:3148
-
\??\c:\bnbbbb.exec:\bnbbbb.exe128⤵PID:4752
-
\??\c:\dpddd.exec:\dpddd.exe129⤵PID:3812
-
\??\c:\5jppp.exec:\5jppp.exe130⤵PID:5036
-
\??\c:\frfxxxf.exec:\frfxxxf.exe131⤵PID:3100
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe132⤵PID:4200
-
\??\c:\tnbbtt.exec:\tnbbtt.exe133⤵PID:2364
-
\??\c:\bttntt.exec:\bttntt.exe134⤵PID:2404
-
\??\c:\9pjdv.exec:\9pjdv.exe135⤵PID:4992
-
\??\c:\7djdp.exec:\7djdp.exe136⤵PID:4776
-
\??\c:\7llfxxr.exec:\7llfxxr.exe137⤵PID:5016
-
\??\c:\lflfxrl.exec:\lflfxrl.exe138⤵PID:3228
-
\??\c:\hhtnnb.exec:\hhtnnb.exe139⤵PID:1620
-
\??\c:\tttnhh.exec:\tttnhh.exe140⤵PID:2780
-
\??\c:\jpvvp.exec:\jpvvp.exe141⤵PID:3896
-
\??\c:\vvpjj.exec:\vvpjj.exe142⤵PID:3344
-
\??\c:\ffllrxf.exec:\ffllrxf.exe143⤵PID:5064
-
\??\c:\xrlffff.exec:\xrlffff.exe144⤵PID:1484
-
\??\c:\hhnnhh.exec:\hhnnhh.exe145⤵PID:2020
-
\??\c:\hhhhbb.exec:\hhhhbb.exe146⤵PID:1636
-
\??\c:\ddvpp.exec:\ddvpp.exe147⤵PID:4376
-
\??\c:\djvpp.exec:\djvpp.exe148⤵PID:620
-
\??\c:\7rflflf.exec:\7rflflf.exe149⤵PID:1276
-
\??\c:\btnhbb.exec:\btnhbb.exe150⤵PID:5040
-
\??\c:\jdvdj.exec:\jdvdj.exe151⤵PID:4348
-
\??\c:\xlxlxrx.exec:\xlxlxrx.exe152⤵PID:2484
-
\??\c:\hhhtnb.exec:\hhhtnb.exe153⤵PID:4812
-
\??\c:\7djvp.exec:\7djvp.exe154⤵PID:3624
-
\??\c:\1dvpd.exec:\1dvpd.exe155⤵PID:1448
-
\??\c:\frlfrrl.exec:\frlfrrl.exe156⤵PID:1904
-
\??\c:\1xxlxxl.exec:\1xxlxxl.exe157⤵PID:4644
-
\??\c:\hbnbth.exec:\hbnbth.exe158⤵PID:3628
-
\??\c:\thtttt.exec:\thtttt.exe159⤵PID:3472
-
\??\c:\xfllllx.exec:\xfllllx.exe160⤵PID:2788
-
\??\c:\nbbnhb.exec:\nbbnhb.exe161⤵PID:2676
-
\??\c:\nnnbtn.exec:\nnnbtn.exe162⤵PID:1248
-
\??\c:\flfffxx.exec:\flfffxx.exe163⤵PID:3808
-
\??\c:\5nnhbb.exec:\5nnhbb.exe164⤵PID:116
-
\??\c:\nttnbb.exec:\nttnbb.exe165⤵PID:2340
-
\??\c:\pdpjd.exec:\pdpjd.exe166⤵PID:544
-
\??\c:\xrlfrlx.exec:\xrlfrlx.exe167⤵PID:1956
-
\??\c:\fxlflll.exec:\fxlflll.exe168⤵PID:2640
-
\??\c:\hnntnb.exec:\hnntnb.exe169⤵PID:872
-
\??\c:\jdddp.exec:\jdddp.exe170⤵PID:2864
-
\??\c:\5flffrx.exec:\5flffrx.exe171⤵PID:860
-
\??\c:\llfxrrl.exec:\llfxrrl.exe172⤵PID:3432
-
\??\c:\thhtnh.exec:\thhtnh.exe173⤵PID:1576
-
\??\c:\ddvvp.exec:\ddvvp.exe174⤵PID:1444
-
\??\c:\dpdvp.exec:\dpdvp.exe175⤵PID:3872
-
\??\c:\lffxrrl.exec:\lffxrrl.exe176⤵PID:3576
-
\??\c:\tbbnnb.exec:\tbbnnb.exe177⤵PID:5100
-
\??\c:\hntnhh.exec:\hntnhh.exe178⤵PID:1020
-
\??\c:\9jjdv.exec:\9jjdv.exe179⤵PID:588
-
\??\c:\vvpjd.exec:\vvpjd.exe180⤵PID:2404
-
\??\c:\lrrfxrf.exec:\lrrfxrf.exe181⤵PID:4992
-
\??\c:\tnbnhb.exec:\tnbnhb.exe182⤵PID:680
-
\??\c:\htthbn.exec:\htthbn.exe183⤵PID:4016
-
\??\c:\dpvjv.exec:\dpvjv.exe184⤵PID:1428
-
\??\c:\xfxxrxr.exec:\xfxxrxr.exe185⤵PID:3396
-
\??\c:\lllllll.exec:\lllllll.exe186⤵PID:4708
-
\??\c:\tthbth.exec:\tthbth.exe187⤵PID:1756
-
\??\c:\vpjjj.exec:\vpjjj.exe188⤵PID:3220
-
\??\c:\7rlfrxx.exec:\7rlfrxx.exe189⤵PID:2312
-
\??\c:\xffxrrl.exec:\xffxrrl.exe190⤵PID:4396
-
\??\c:\7hbnbt.exec:\7hbnbt.exe191⤵PID:2440
-
\??\c:\vvjpv.exec:\vvjpv.exe192⤵PID:4360
-
\??\c:\5rlfxxr.exec:\5rlfxxr.exe193⤵PID:4416
-
\??\c:\xllxrlf.exec:\xllxrlf.exe194⤵PID:2288
-
\??\c:\jdvjj.exec:\jdvjj.exe195⤵PID:1276
-
\??\c:\htbbbh.exec:\htbbbh.exe196⤵PID:1132
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe197⤵PID:1000
-
\??\c:\lffxrlf.exec:\lffxrlf.exe198⤵PID:4212
-
\??\c:\tbbhhb.exec:\tbbhhb.exe199⤵PID:3408
-
\??\c:\rxfffll.exec:\rxfffll.exe200⤵PID:2988
-
\??\c:\lxrlfll.exec:\lxrlfll.exe201⤵PID:4532
-
\??\c:\htntbh.exec:\htntbh.exe202⤵PID:4020
-
\??\c:\pjjjd.exec:\pjjjd.exe203⤵PID:3480
-
\??\c:\lxffxxf.exec:\lxffxxf.exe204⤵PID:720
-
\??\c:\5tttnn.exec:\5tttnn.exe205⤵PID:4640
-
\??\c:\jvjdv.exec:\jvjdv.exe206⤵PID:4444
-
\??\c:\jdppp.exec:\jdppp.exe207⤵PID:1524
-
\??\c:\jjjdd.exec:\jjjdd.exe208⤵PID:2824
-
\??\c:\5xrlffr.exec:\5xrlffr.exe209⤵PID:4600
-
\??\c:\hbntth.exec:\hbntth.exe210⤵PID:460
-
\??\c:\lfxxxff.exec:\lfxxxff.exe211⤵PID:4556
-
\??\c:\vvvvp.exec:\vvvvp.exe212⤵PID:3440
-
\??\c:\rlxfllf.exec:\rlxfllf.exe213⤵PID:4848
-
\??\c:\bntttb.exec:\bntttb.exe214⤵PID:2640
-
\??\c:\vdvvv.exec:\vdvvv.exe215⤵PID:872
-
\??\c:\5xfxxxx.exec:\5xfxxxx.exe216⤵PID:4916
-
\??\c:\thnnhn.exec:\thnnhn.exe217⤵PID:4792
-
\??\c:\ddvvp.exec:\ddvvp.exe218⤵PID:1640
-
\??\c:\5thbtt.exec:\5thbtt.exe219⤵PID:832
-
\??\c:\rrrlfff.exec:\rrrlfff.exe220⤵PID:1312
-
\??\c:\btbhnn.exec:\btbhnn.exe221⤵PID:3652
-
\??\c:\jppjj.exec:\jppjj.exe222⤵PID:388
-
\??\c:\7nntnt.exec:\7nntnt.exe223⤵PID:4204
-
\??\c:\7bhtnn.exec:\7bhtnn.exe224⤵PID:3212
-
\??\c:\jdvvj.exec:\jdvvj.exe225⤵PID:5100
-
\??\c:\lfllflf.exec:\lfllflf.exe226⤵PID:1020
-
\??\c:\3xxrllf.exec:\3xxrllf.exe227⤵PID:1888
-
\??\c:\nhhhhh.exec:\nhhhhh.exe228⤵PID:8
-
\??\c:\5djdd.exec:\5djdd.exe229⤵PID:1476
-
\??\c:\ppvjd.exec:\ppvjd.exe230⤵PID:3580
-
\??\c:\fxlllrr.exec:\fxlllrr.exe231⤵PID:324
-
\??\c:\hbnhhn.exec:\hbnhhn.exe232⤵PID:3604
-
\??\c:\tbbttt.exec:\tbbttt.exe233⤵PID:2900
-
\??\c:\5jdvj.exec:\5jdvj.exe234⤵PID:3332
-
\??\c:\dvvjj.exec:\dvvjj.exe235⤵PID:3336
-
\??\c:\rlrrlll.exec:\rlrrlll.exe236⤵PID:2492
-
\??\c:\bttbtt.exec:\bttbtt.exe237⤵PID:2000
-
\??\c:\bnhbbb.exec:\bnhbbb.exe238⤵PID:4868
-
\??\c:\9dpjj.exec:\9dpjj.exe239⤵PID:3816
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe240⤵PID:4376
-
\??\c:\frxrlll.exec:\frxrlll.exe241⤵PID:1892
-
\??\c:\bntnhh.exec:\bntnhh.exe242⤵PID:4568