Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 18:24
Behavioral task
behavioral1
Sample
1442adef8eae33bd74f6f247612b4c20_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
1442adef8eae33bd74f6f247612b4c20_NeikiAnalytics.exe
-
Size
464KB
-
MD5
1442adef8eae33bd74f6f247612b4c20
-
SHA1
c8d65671a2130eedde5452519163156cc7933738
-
SHA256
a723bbac8baf6b3b94dd86d9a831b2d68f2dfee913df11c6dbd7636c5da6b8d7
-
SHA512
469633d5f9ee17338c183a78fb9e6a3101d1743cc6066181e57aa1249448730e36390f233a7a2b7fe4e9d400584404068ba91945cf4f4dcdab95f9facd496cb4
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VD:VeR0oykayRFp3lztP+OKaf1VD
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/1608-1-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1896-16-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3032-19-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2724-29-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2688-39-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2740-54-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2536-74-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2456-71-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1020-94-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1696-90-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1580-110-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1552-126-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2192-151-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1032-162-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1032-169-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2244-205-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/852-232-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2016-283-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/344-292-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2292-299-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1720-300-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1692-313-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2676-338-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2692-339-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2528-402-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2636-403-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1548-416-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1408-448-0x0000000000440000-0x000000000047A000-memory.dmp family_blackmoon behavioral1/memory/652-467-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1284-530-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1284-537-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2232-627-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2680-634-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2516-659-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1352-674-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/332-737-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/532-751-0x0000000001CA0000-0x0000000001CDA000-memory.dmp family_blackmoon behavioral1/memory/2004-764-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2660-955-0x0000000001C70000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/1304-1013-0x0000000000440000-0x000000000047A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/1608-1-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\7rfxxxf.exe family_berbew behavioral1/memory/1896-8-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1896-16-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/3032-19-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\7lfrxfl.exe family_berbew behavioral1/memory/2724-29-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\5rlxflx.exe family_berbew behavioral1/memory/2724-31-0x0000000000220000-0x000000000025A000-memory.dmp family_berbew C:\htnhbt.exe family_berbew behavioral1/memory/2688-39-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rrfffff.exe family_berbew \??\c:\frrlfrl.exe family_berbew behavioral1/memory/2740-54-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xlxxllr.exe family_berbew C:\vpjpv.exe family_berbew behavioral1/memory/2536-74-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2456-71-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xlrrxrr.exe family_berbew \??\c:\htnthn.exe family_berbew behavioral1/memory/1020-94-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1696-90-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\dpddj.exe family_berbew C:\lxrrxxl.exe family_berbew C:\jvpjp.exe family_berbew behavioral1/memory/1580-110-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\5nhhhn.exe family_berbew behavioral1/memory/1552-126-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\7pvpv.exe family_berbew behavioral1/memory/2192-144-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\thtthn.exe family_berbew C:\jdjjd.exe family_berbew behavioral1/memory/2192-151-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nhbbnt.exe family_berbew behavioral1/memory/1032-162-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jvvdd.exe family_berbew behavioral1/memory/1032-169-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nhtthn.exe family_berbew C:\pjdpd.exe family_berbew C:\tnhnbb.exe family_berbew behavioral1/memory/2244-196-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2244-205-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1772-206-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vppvj.exe family_berbew C:\tttbnn.exe family_berbew behavioral1/memory/1776-216-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\9vvvd.exe family_berbew C:\nbhhnn.exe family_berbew behavioral1/memory/3052-234-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/852-232-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\pvvvj.exe family_berbew \??\c:\xfxfrrl.exe family_berbew C:\nhhttb.exe family_berbew C:\5lfxllr.exe family_berbew C:\bbbnhn.exe family_berbew behavioral1/memory/2016-275-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2016-283-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\dppvd.exe family_berbew behavioral1/memory/344-292-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2292-299-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1720-300-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1692-313-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2676-338-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2692-339-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
7rfxxxf.exe7lfrxfl.exe5rlxflx.exehtnhbt.exerrfffff.exefrrlfrl.exexlxxllr.exevpjpv.exexlrrxrr.exehtnthn.exedpddj.exelxrrxxl.exejvpjp.exe5nhhhn.exe7pvpv.exethtthn.exejdjjd.exenhbbnt.exejvvdd.exenhtthn.exepjdpd.exetnhnbb.exevppvj.exetttbnn.exe9vvvd.exenbhhnn.exepvvvj.exexfxfrrl.exenhhttb.exe5lfxllr.exebbbnhn.exedppvd.exerlxxllr.exeppjdd.exepdjpp.exefxrxrxl.exe5btbhh.exevpvvd.exedpjjp.exe7rfxxxx.exehhhnbh.exe7jdjd.exelfxfffx.exelfrxxlx.exetnhthn.exe1dpdd.exe3frxlxl.exerfxxflr.exebhbntt.exejvvdd.exe1fllrrr.exerlxrflr.exehbntbt.exevvpvd.exelfrxxxf.exetnnntb.exe7bntbt.exelfrflxx.exe3xffxfl.exe9htbhn.exepjdpd.exerlxrxlx.exetnbhtt.exe3nnthh.exepid process 1896 7rfxxxf.exe 3032 7lfrxfl.exe 2724 5rlxflx.exe 2688 htnhbt.exe 2740 rrfffff.exe 2596 frrlfrl.exe 2456 xlxxllr.exe 2536 vpjpv.exe 1696 xlrrxrr.exe 1020 htnthn.exe 2764 dpddj.exe 1580 lxrrxxl.exe 1552 jvpjp.exe 1536 5nhhhn.exe 2372 7pvpv.exe 2192 thtthn.exe 1452 jdjjd.exe 1032 nhbbnt.exe 2044 jvvdd.exe 2988 nhtthn.exe 2836 pjdpd.exe 2244 tnhnbb.exe 1772 vppvj.exe 1776 tttbnn.exe 852 9vvvd.exe 3052 nbhhnn.exe 2376 pvvvj.exe 108 xfxfrrl.exe 1016 nhhttb.exe 3024 5lfxllr.exe 2016 bbbnhn.exe 344 dppvd.exe 2292 rlxxllr.exe 1720 ppjdd.exe 1692 pdjpp.exe 1524 fxrxrxl.exe 2568 5btbhh.exe 2232 vpvvd.exe 2676 dpjjp.exe 2692 7rfxxxx.exe 2620 hhhnbh.exe 2484 7jdjd.exe 2508 lfxfffx.exe 1636 lfrxxlx.exe 1352 tnhthn.exe 2536 1dpdd.exe 2956 3frxlxl.exe 2520 rfxxflr.exe 2528 bhbntt.exe 2636 jvvdd.exe 1548 1fllrrr.exe 1000 rlxrflr.exe 352 hbntbt.exe 1536 vvpvd.exe 2164 lfrxxxf.exe 1408 tnnntb.exe 532 7bntbt.exe 744 lfrflxx.exe 652 3xffxfl.exe 2012 9htbhn.exe 2044 pjdpd.exe 2976 rlxrxlx.exe 580 tnbhtt.exe 2836 3nnthh.exe -
Processes:
resource yara_rule behavioral1/memory/1608-1-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\7rfxxxf.exe upx behavioral1/memory/1896-8-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1896-16-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/3032-19-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\7lfrxfl.exe upx behavioral1/memory/2724-29-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\5rlxflx.exe upx behavioral1/memory/2724-31-0x0000000000220000-0x000000000025A000-memory.dmp upx C:\htnhbt.exe upx behavioral1/memory/2688-39-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rrfffff.exe upx \??\c:\frrlfrl.exe upx behavioral1/memory/2740-54-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xlxxllr.exe upx C:\vpjpv.exe upx behavioral1/memory/2536-74-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2456-71-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xlrrxrr.exe upx \??\c:\htnthn.exe upx behavioral1/memory/1020-94-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1696-90-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\dpddj.exe upx C:\lxrrxxl.exe upx C:\jvpjp.exe upx behavioral1/memory/1580-110-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\5nhhhn.exe upx behavioral1/memory/1552-126-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\7pvpv.exe upx behavioral1/memory/2192-144-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\thtthn.exe upx C:\jdjjd.exe upx behavioral1/memory/2192-151-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nhbbnt.exe upx behavioral1/memory/1032-162-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jvvdd.exe upx behavioral1/memory/1032-169-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nhtthn.exe upx C:\pjdpd.exe upx C:\tnhnbb.exe upx behavioral1/memory/2244-196-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2244-205-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1772-206-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vppvj.exe upx C:\tttbnn.exe upx behavioral1/memory/1776-216-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\9vvvd.exe upx C:\nbhhnn.exe upx behavioral1/memory/3052-234-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/852-232-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\pvvvj.exe upx \??\c:\xfxfrrl.exe upx C:\nhhttb.exe upx C:\5lfxllr.exe upx C:\bbbnhn.exe upx behavioral1/memory/2016-275-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2016-283-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\dppvd.exe upx behavioral1/memory/344-292-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2292-299-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1720-300-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1692-313-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2676-338-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2692-339-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1442adef8eae33bd74f6f247612b4c20_NeikiAnalytics.exe7rfxxxf.exe7lfrxfl.exe5rlxflx.exehtnhbt.exerrfffff.exefrrlfrl.exexlxxllr.exevpjpv.exexlrrxrr.exehtnthn.exedpddj.exelxrrxxl.exejvpjp.exe5nhhhn.exe7pvpv.exedescription pid process target process PID 1608 wrote to memory of 1896 1608 1442adef8eae33bd74f6f247612b4c20_NeikiAnalytics.exe 7rfxxxf.exe PID 1608 wrote to memory of 1896 1608 1442adef8eae33bd74f6f247612b4c20_NeikiAnalytics.exe 7rfxxxf.exe PID 1608 wrote to memory of 1896 1608 1442adef8eae33bd74f6f247612b4c20_NeikiAnalytics.exe 7rfxxxf.exe PID 1608 wrote to memory of 1896 1608 1442adef8eae33bd74f6f247612b4c20_NeikiAnalytics.exe 7rfxxxf.exe PID 1896 wrote to memory of 3032 1896 7rfxxxf.exe 7lfrxfl.exe PID 1896 wrote to memory of 3032 1896 7rfxxxf.exe 7lfrxfl.exe PID 1896 wrote to memory of 3032 1896 7rfxxxf.exe 7lfrxfl.exe PID 1896 wrote to memory of 3032 1896 7rfxxxf.exe 7lfrxfl.exe PID 3032 wrote to memory of 2724 3032 7lfrxfl.exe 5rlxflx.exe PID 3032 wrote to memory of 2724 3032 7lfrxfl.exe 5rlxflx.exe PID 3032 wrote to memory of 2724 3032 7lfrxfl.exe 5rlxflx.exe PID 3032 wrote to memory of 2724 3032 7lfrxfl.exe 5rlxflx.exe PID 2724 wrote to memory of 2688 2724 5rlxflx.exe htnhbt.exe PID 2724 wrote to memory of 2688 2724 5rlxflx.exe htnhbt.exe PID 2724 wrote to memory of 2688 2724 5rlxflx.exe htnhbt.exe PID 2724 wrote to memory of 2688 2724 5rlxflx.exe htnhbt.exe PID 2688 wrote to memory of 2740 2688 htnhbt.exe rrfffff.exe PID 2688 wrote to memory of 2740 2688 htnhbt.exe rrfffff.exe PID 2688 wrote to memory of 2740 2688 htnhbt.exe rrfffff.exe PID 2688 wrote to memory of 2740 2688 htnhbt.exe rrfffff.exe PID 2740 wrote to memory of 2596 2740 rrfffff.exe frrlfrl.exe PID 2740 wrote to memory of 2596 2740 rrfffff.exe frrlfrl.exe PID 2740 wrote to memory of 2596 2740 rrfffff.exe frrlfrl.exe PID 2740 wrote to memory of 2596 2740 rrfffff.exe frrlfrl.exe PID 2596 wrote to memory of 2456 2596 frrlfrl.exe xlxxllr.exe PID 2596 wrote to memory of 2456 2596 frrlfrl.exe xlxxllr.exe PID 2596 wrote to memory of 2456 2596 frrlfrl.exe xlxxllr.exe PID 2596 wrote to memory of 2456 2596 frrlfrl.exe xlxxllr.exe PID 2456 wrote to memory of 2536 2456 xlxxllr.exe vpjpv.exe PID 2456 wrote to memory of 2536 2456 xlxxllr.exe vpjpv.exe PID 2456 wrote to memory of 2536 2456 xlxxllr.exe vpjpv.exe PID 2456 wrote to memory of 2536 2456 xlxxllr.exe vpjpv.exe PID 2536 wrote to memory of 1696 2536 vpjpv.exe xlrrxrr.exe PID 2536 wrote to memory of 1696 2536 vpjpv.exe xlrrxrr.exe PID 2536 wrote to memory of 1696 2536 vpjpv.exe xlrrxrr.exe PID 2536 wrote to memory of 1696 2536 vpjpv.exe xlrrxrr.exe PID 1696 wrote to memory of 1020 1696 xlrrxrr.exe htnthn.exe PID 1696 wrote to memory of 1020 1696 xlrrxrr.exe htnthn.exe PID 1696 wrote to memory of 1020 1696 xlrrxrr.exe htnthn.exe PID 1696 wrote to memory of 1020 1696 xlrrxrr.exe htnthn.exe PID 1020 wrote to memory of 2764 1020 htnthn.exe dpddj.exe PID 1020 wrote to memory of 2764 1020 htnthn.exe dpddj.exe PID 1020 wrote to memory of 2764 1020 htnthn.exe dpddj.exe PID 1020 wrote to memory of 2764 1020 htnthn.exe dpddj.exe PID 2764 wrote to memory of 1580 2764 dpddj.exe lxrrxxl.exe PID 2764 wrote to memory of 1580 2764 dpddj.exe lxrrxxl.exe PID 2764 wrote to memory of 1580 2764 dpddj.exe lxrrxxl.exe PID 2764 wrote to memory of 1580 2764 dpddj.exe lxrrxxl.exe PID 1580 wrote to memory of 1552 1580 lxrrxxl.exe jvpjp.exe PID 1580 wrote to memory of 1552 1580 lxrrxxl.exe jvpjp.exe PID 1580 wrote to memory of 1552 1580 lxrrxxl.exe jvpjp.exe PID 1580 wrote to memory of 1552 1580 lxrrxxl.exe jvpjp.exe PID 1552 wrote to memory of 1536 1552 jvpjp.exe 5nhhhn.exe PID 1552 wrote to memory of 1536 1552 jvpjp.exe 5nhhhn.exe PID 1552 wrote to memory of 1536 1552 jvpjp.exe 5nhhhn.exe PID 1552 wrote to memory of 1536 1552 jvpjp.exe 5nhhhn.exe PID 1536 wrote to memory of 2372 1536 5nhhhn.exe 7pvpv.exe PID 1536 wrote to memory of 2372 1536 5nhhhn.exe 7pvpv.exe PID 1536 wrote to memory of 2372 1536 5nhhhn.exe 7pvpv.exe PID 1536 wrote to memory of 2372 1536 5nhhhn.exe 7pvpv.exe PID 2372 wrote to memory of 2192 2372 7pvpv.exe thtthn.exe PID 2372 wrote to memory of 2192 2372 7pvpv.exe thtthn.exe PID 2372 wrote to memory of 2192 2372 7pvpv.exe thtthn.exe PID 2372 wrote to memory of 2192 2372 7pvpv.exe thtthn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1442adef8eae33bd74f6f247612b4c20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1442adef8eae33bd74f6f247612b4c20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\7rfxxxf.exec:\7rfxxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\7lfrxfl.exec:\7lfrxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\5rlxflx.exec:\5rlxflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\htnhbt.exec:\htnhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rrfffff.exec:\rrfffff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\frrlfrl.exec:\frrlfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\xlxxllr.exec:\xlxxllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\vpjpv.exec:\vpjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\xlrrxrr.exec:\xlrrxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\htnthn.exec:\htnthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\dpddj.exec:\dpddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\lxrrxxl.exec:\lxrrxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\jvpjp.exec:\jvpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\5nhhhn.exec:\5nhhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\7pvpv.exec:\7pvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\thtthn.exec:\thtthn.exe17⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jdjjd.exec:\jdjjd.exe18⤵
- Executes dropped EXE
PID:1452 -
\??\c:\nhbbnt.exec:\nhbbnt.exe19⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jvvdd.exec:\jvvdd.exe20⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nhtthn.exec:\nhtthn.exe21⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pjdpd.exec:\pjdpd.exe22⤵
- Executes dropped EXE
PID:2836 -
\??\c:\tnhnbb.exec:\tnhnbb.exe23⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vppvj.exec:\vppvj.exe24⤵
- Executes dropped EXE
PID:1772 -
\??\c:\tttbnn.exec:\tttbnn.exe25⤵
- Executes dropped EXE
PID:1776 -
\??\c:\9vvvd.exec:\9vvvd.exe26⤵
- Executes dropped EXE
PID:852 -
\??\c:\nbhhnn.exec:\nbhhnn.exe27⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pvvvj.exec:\pvvvj.exe28⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xfxfrrl.exec:\xfxfrrl.exe29⤵
- Executes dropped EXE
PID:108 -
\??\c:\nhhttb.exec:\nhhttb.exe30⤵
- Executes dropped EXE
PID:1016 -
\??\c:\5lfxllr.exec:\5lfxllr.exe31⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bbbnhn.exec:\bbbnhn.exe32⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dppvd.exec:\dppvd.exe33⤵
- Executes dropped EXE
PID:344 -
\??\c:\rlxxllr.exec:\rlxxllr.exe34⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ppjdd.exec:\ppjdd.exe35⤵
- Executes dropped EXE
PID:1720 -
\??\c:\pdjpp.exec:\pdjpp.exe36⤵
- Executes dropped EXE
PID:1692 -
\??\c:\fxrxrxl.exec:\fxrxrxl.exe37⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5btbhh.exec:\5btbhh.exe38⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vpvvd.exec:\vpvvd.exe39⤵
- Executes dropped EXE
PID:2232 -
\??\c:\dpjjp.exec:\dpjjp.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7rfxxxx.exec:\7rfxxxx.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hhhnbh.exec:\hhhnbh.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7jdjd.exec:\7jdjd.exe43⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lfxfffx.exec:\lfxfffx.exe44⤵
- Executes dropped EXE
PID:2508 -
\??\c:\lfrxxlx.exec:\lfrxxlx.exe45⤵
- Executes dropped EXE
PID:1636 -
\??\c:\tnhthn.exec:\tnhthn.exe46⤵
- Executes dropped EXE
PID:1352 -
\??\c:\1dpdd.exec:\1dpdd.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\3frxlxl.exec:\3frxlxl.exe48⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rfxxflr.exec:\rfxxflr.exe49⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bhbntt.exec:\bhbntt.exe50⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jvvdd.exec:\jvvdd.exe51⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1fllrrr.exec:\1fllrrr.exe52⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rlxrflr.exec:\rlxrflr.exe53⤵
- Executes dropped EXE
PID:1000 -
\??\c:\hbntbt.exec:\hbntbt.exe54⤵
- Executes dropped EXE
PID:352 -
\??\c:\vvpvd.exec:\vvpvd.exe55⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tnnntb.exec:\tnnntb.exe57⤵
- Executes dropped EXE
PID:1408 -
\??\c:\7bntbt.exec:\7bntbt.exe58⤵
- Executes dropped EXE
PID:532 -
\??\c:\lfrflxx.exec:\lfrflxx.exe59⤵
- Executes dropped EXE
PID:744 -
\??\c:\3xffxfl.exec:\3xffxfl.exe60⤵
- Executes dropped EXE
PID:652 -
\??\c:\9htbhn.exec:\9htbhn.exe61⤵
- Executes dropped EXE
PID:2012 -
\??\c:\pjdpd.exec:\pjdpd.exe62⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rlxrxlx.exec:\rlxrxlx.exe63⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tnbhtt.exec:\tnbhtt.exe64⤵
- Executes dropped EXE
PID:580 -
\??\c:\3nnthh.exec:\3nnthh.exe65⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vpjdp.exec:\vpjdp.exe66⤵PID:1108
-
\??\c:\ffrfflx.exec:\ffrfflx.exe67⤵PID:1908
-
\??\c:\nbnntn.exec:\nbnntn.exe68⤵PID:1036
-
\??\c:\bbtthh.exec:\bbtthh.exe69⤵PID:2404
-
\??\c:\pdppd.exec:\pdppd.exe70⤵PID:980
-
\??\c:\5rflrrf.exec:\5rflrrf.exe71⤵PID:1284
-
\??\c:\hhbtbb.exec:\hhbtbb.exe72⤵PID:2640
-
\??\c:\7vddd.exec:\7vddd.exe73⤵PID:2128
-
\??\c:\llfrxxx.exec:\llfrxxx.exe74⤵PID:2112
-
\??\c:\bbnbht.exec:\bbnbht.exe75⤵PID:1016
-
\??\c:\nnbhtn.exec:\nnbhtn.exe76⤵PID:1864
-
\??\c:\dvjdj.exec:\dvjdj.exe77⤵PID:3012
-
\??\c:\fxrlxfl.exec:\fxrlxfl.exe78⤵PID:2928
-
\??\c:\5frxxxf.exec:\5frxxxf.exe79⤵PID:1992
-
\??\c:\9tbbbh.exec:\9tbbbh.exe80⤵PID:1652
-
\??\c:\dpddj.exec:\dpddj.exe81⤵PID:1720
-
\??\c:\frfffff.exec:\frfffff.exe82⤵PID:2980
-
\??\c:\htbbbn.exec:\htbbbn.exe83⤵PID:1524
-
\??\c:\hbntbb.exec:\hbntbb.exe84⤵PID:2604
-
\??\c:\5jpjp.exec:\5jpjp.exe85⤵PID:2232
-
\??\c:\ffrlrlx.exec:\ffrlrlx.exe86⤵PID:2680
-
\??\c:\hhbbnt.exec:\hhbbnt.exe87⤵PID:2468
-
\??\c:\dpdjp.exec:\dpdjp.exe88⤵PID:2052
-
\??\c:\7rlllxl.exec:\7rlllxl.exe89⤵PID:2484
-
\??\c:\xlrllrx.exec:\xlrllrx.exe90⤵PID:2516
-
\??\c:\btnthb.exec:\btnthb.exe91⤵PID:1636
-
\??\c:\vvjdp.exec:\vvjdp.exe92⤵PID:1352
-
\??\c:\5xrffxf.exec:\5xrffxf.exe93⤵PID:1304
-
\??\c:\hnnhbb.exec:\hnnhbb.exe94⤵PID:1204
-
\??\c:\pjddp.exec:\pjddp.exe95⤵PID:2776
-
\??\c:\3pjpd.exec:\3pjpd.exe96⤵PID:608
-
\??\c:\xxxxxfl.exec:\xxxxxfl.exe97⤵PID:1580
-
\??\c:\hthbhn.exec:\hthbhn.exe98⤵PID:1504
-
\??\c:\hbhhbh.exec:\hbhhbh.exe99⤵PID:1888
-
\??\c:\dvpvd.exec:\dvpvd.exe100⤵PID:352
-
\??\c:\5lfllrx.exec:\5lfllrx.exe101⤵PID:2184
-
\??\c:\3flflrx.exec:\3flflrx.exe102⤵PID:2124
-
\??\c:\3nhnbn.exec:\3nhnbn.exe103⤵PID:332
-
\??\c:\dvppv.exec:\dvppv.exe104⤵PID:532
-
\??\c:\7lllrrf.exec:\7lllrrf.exe105⤵PID:2820
-
\??\c:\5nhbhb.exec:\5nhbhb.exe106⤵PID:2004
-
\??\c:\bthbht.exec:\bthbht.exe107⤵PID:2964
-
\??\c:\5pppj.exec:\5pppj.exe108⤵PID:1396
-
\??\c:\xxxxflx.exec:\xxxxflx.exe109⤵PID:2228
-
\??\c:\rrlrrlr.exec:\rrlrrlr.exe110⤵PID:1872
-
\??\c:\bhbhnn.exec:\bhbhnn.exe111⤵PID:2420
-
\??\c:\dvvdp.exec:\dvvdp.exe112⤵PID:1108
-
\??\c:\dvjdp.exec:\dvjdp.exe113⤵PID:1460
-
\??\c:\xfxllfr.exec:\xfxllfr.exe114⤵PID:3064
-
\??\c:\9dpjj.exec:\9dpjj.exe115⤵PID:3028
-
\??\c:\pjppv.exec:\pjppv.exe116⤵PID:1680
-
\??\c:\frrflxr.exec:\frrflxr.exe117⤵PID:1284
-
\??\c:\9tthtb.exec:\9tthtb.exe118⤵PID:848
-
\??\c:\htntbb.exec:\htntbb.exe119⤵PID:3016
-
\??\c:\jjddv.exec:\jjddv.exe120⤵PID:1944
-
\??\c:\lrrlxfr.exec:\lrrlxfr.exe121⤵PID:3004
-
\??\c:\bnhntb.exec:\bnhntb.exe122⤵PID:2016
-
\??\c:\ntnnnn.exec:\ntnnnn.exe123⤵PID:2068
-
\??\c:\dpvvj.exec:\dpvvj.exe124⤵PID:1852
-
\??\c:\rlllrxl.exec:\rlllrxl.exe125⤵PID:1608
-
\??\c:\bbbtnh.exec:\bbbtnh.exe126⤵PID:2552
-
\??\c:\nhthtb.exec:\nhthtb.exe127⤵PID:1628
-
\??\c:\jdppp.exec:\jdppp.exe128⤵PID:2616
-
\??\c:\frrlxxf.exec:\frrlxxf.exe129⤵PID:2612
-
\??\c:\nbttbb.exec:\nbttbb.exe130⤵PID:2600
-
\??\c:\htnthn.exec:\htnthn.exe131⤵PID:2864
-
\??\c:\9jpvj.exec:\9jpvj.exe132⤵PID:2680
-
\??\c:\xxxflrf.exec:\xxxflrf.exe133⤵PID:2468
-
\??\c:\fxrxxfl.exec:\fxrxxfl.exe134⤵PID:2052
-
\??\c:\9tntbh.exec:\9tntbh.exe135⤵PID:2512
-
\??\c:\7dvdj.exec:\7dvdj.exe136⤵PID:2660
-
\??\c:\rlllrxl.exec:\rlllrxl.exe137⤵PID:1236
-
\??\c:\nbntbb.exec:\nbntbb.exe138⤵PID:2312
-
\??\c:\jvjvv.exec:\jvjvv.exe139⤵PID:1304
-
\??\c:\vpppp.exec:\vpppp.exe140⤵PID:2448
-
\??\c:\rfrlrlx.exec:\rfrlrlx.exe141⤵PID:2776
-
\??\c:\ntthbn.exec:\ntthbn.exe142⤵PID:1784
-
\??\c:\5dpdp.exec:\5dpdp.exe143⤵PID:1744
-
\??\c:\7jppv.exec:\7jppv.exe144⤵PID:1596
-
\??\c:\frlrxlx.exec:\frlrxlx.exe145⤵PID:1888
-
\??\c:\5nhhnt.exec:\5nhhnt.exe146⤵PID:1436
-
\??\c:\dvpdj.exec:\dvpdj.exe147⤵PID:876
-
\??\c:\dddvv.exec:\dddvv.exe148⤵PID:768
-
\??\c:\7xrxffr.exec:\7xrxffr.exe149⤵PID:2160
-
\??\c:\bbtbtb.exec:\bbtbtb.exe150⤵PID:532
-
\??\c:\9vppv.exec:\9vppv.exe151⤵PID:2032
-
\??\c:\pjdpv.exec:\pjdpv.exe152⤵PID:2988
-
\??\c:\9fffxlr.exec:\9fffxlr.exe153⤵PID:2920
-
\??\c:\7nhnhn.exec:\7nhnhn.exe154⤵PID:2240
-
\??\c:\9jpvj.exec:\9jpvj.exe155⤵PID:2252
-
\??\c:\vpdjj.exec:\vpdjj.exe156⤵PID:1684
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe157⤵PID:2416
-
\??\c:\hbtttn.exec:\hbtttn.exe158⤵PID:1092
-
\??\c:\9nbbbb.exec:\9nbbbb.exe159⤵PID:1932
-
\??\c:\jdvjp.exec:\jdvjp.exe160⤵PID:2404
-
\??\c:\xlfxffl.exec:\xlfxffl.exe161⤵PID:1540
-
\??\c:\xrlflfl.exec:\xrlflfl.exe162⤵PID:340
-
\??\c:\hbnthh.exec:\hbnthh.exe163⤵PID:1668
-
\??\c:\jdvdp.exec:\jdvdp.exe164⤵PID:2132
-
\??\c:\1vvpp.exec:\1vvpp.exe165⤵PID:1112
-
\??\c:\rlflrlx.exec:\rlflrlx.exe166⤵PID:896
-
\??\c:\tnbbbn.exec:\tnbbbn.exe167⤵PID:2080
-
\??\c:\nnbnnb.exec:\nnbnnb.exe168⤵PID:3044
-
\??\c:\jpdjj.exec:\jpdjj.exe169⤵PID:3004
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe170⤵PID:2060
-
\??\c:\rflllfx.exec:\rflllfx.exe171⤵PID:2928
-
\??\c:\htnntt.exec:\htnntt.exe172⤵PID:1648
-
\??\c:\3bnhhb.exec:\3bnhhb.exe173⤵PID:1728
-
\??\c:\pjvpp.exec:\pjvpp.exe174⤵PID:1936
-
\??\c:\7llrxxf.exec:\7llrxxf.exe175⤵PID:1692
-
\??\c:\9lrxxrr.exec:\9lrxxrr.exe176⤵PID:2736
-
\??\c:\9hhhnn.exec:\9hhhnn.exe177⤵PID:2568
-
\??\c:\dvjdj.exec:\dvjdj.exe178⤵PID:1192
-
\??\c:\pjvdj.exec:\pjvdj.exe179⤵PID:2600
-
\??\c:\flxrrfl.exec:\flxrrfl.exe180⤵PID:1632
-
\??\c:\7nnhnh.exec:\7nnhnh.exe181⤵PID:2628
-
\??\c:\thtthh.exec:\thtthh.exe182⤵PID:2120
-
\??\c:\dvpdj.exec:\dvpdj.exe183⤵PID:2508
-
\??\c:\xrflrrx.exec:\xrflrrx.exe184⤵PID:2524
-
\??\c:\rfrrxxr.exec:\rfrrxxr.exe185⤵PID:2536
-
\??\c:\nnhhnb.exec:\nnhhnb.exe186⤵PID:1236
-
\??\c:\jdjpv.exec:\jdjpv.exe187⤵PID:2696
-
\??\c:\dvdjp.exec:\dvdjp.exe188⤵PID:1304
-
\??\c:\xrffllx.exec:\xrffllx.exe189⤵PID:2448
-
\??\c:\btnbhb.exec:\btnbhb.exe190⤵PID:1544
-
\??\c:\7nnhnn.exec:\7nnhnn.exe191⤵PID:1532
-
\??\c:\9vppp.exec:\9vppp.exe192⤵PID:1504
-
\??\c:\jvpjd.exec:\jvpjd.exe193⤵PID:1476
-
\??\c:\fxrfflx.exec:\fxrfflx.exe194⤵PID:2352
-
\??\c:\hbbbhh.exec:\hbbbhh.exe195⤵PID:1408
-
\??\c:\5ddvv.exec:\5ddvv.exe196⤵PID:1916
-
\??\c:\9jddp.exec:\9jddp.exe197⤵PID:744
-
\??\c:\7xrllll.exec:\7xrllll.exe198⤵PID:2024
-
\??\c:\tnnnbb.exec:\tnnnbb.exe199⤵PID:1032
-
\??\c:\btntnh.exec:\btntnh.exe200⤵PID:2032
-
\??\c:\dvjpp.exec:\dvjpp.exe201⤵PID:1672
-
\??\c:\lxlflfl.exec:\lxlflfl.exe202⤵PID:2964
-
\??\c:\1flxxrx.exec:\1flxxrx.exe203⤵PID:628
-
\??\c:\9ntttt.exec:\9ntttt.exe204⤵PID:2228
-
\??\c:\jvdvp.exec:\jvdvp.exe205⤵PID:2092
-
\??\c:\jdjdd.exec:\jdjdd.exe206⤵PID:2416
-
\??\c:\lxlrrxx.exec:\lxlrrxx.exe207⤵PID:1776
-
\??\c:\nhtbbh.exec:\nhtbbh.exe208⤵PID:1932
-
\??\c:\3jdjp.exec:\3jdjp.exe209⤵PID:2404
-
\??\c:\9pddd.exec:\9pddd.exe210⤵PID:1540
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe211⤵PID:2376
-
\??\c:\hthbhn.exec:\hthbhn.exe212⤵PID:1668
-
\??\c:\bhttbb.exec:\bhttbb.exe213⤵PID:1600
-
\??\c:\ppjvd.exec:\ppjvd.exe214⤵PID:1112
-
\??\c:\7lrxxrr.exec:\7lrxxrr.exe215⤵PID:1472
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe216⤵PID:2080
-
\??\c:\bntntn.exec:\bntntn.exe217⤵PID:2316
-
\??\c:\3tbbnt.exec:\3tbbnt.exe218⤵PID:3004
-
\??\c:\jpdvv.exec:\jpdvv.exe219⤵PID:2016
-
\??\c:\rrxllff.exec:\rrxllff.exe220⤵PID:2928
-
\??\c:\9rlxllr.exec:\9rlxllr.exe221⤵PID:1416
-
\??\c:\hthnnn.exec:\hthnnn.exe222⤵PID:2648
-
\??\c:\9vpvv.exec:\9vpvv.exe223⤵PID:3056
-
\??\c:\5dpjp.exec:\5dpjp.exe224⤵PID:2704
-
\??\c:\9lxxxxr.exec:\9lxxxxr.exe225⤵PID:2736
-
\??\c:\btnnnn.exec:\btnnnn.exe226⤵PID:2652
-
\??\c:\nhnhht.exec:\nhnhht.exe227⤵PID:1192
-
\??\c:\vjjdj.exec:\vjjdj.exe228⤵PID:2740
-
\??\c:\xrlrflf.exec:\xrlrflf.exe229⤵PID:2468
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe230⤵PID:2484
-
\??\c:\9bnttn.exec:\9bnttn.exe231⤵PID:2516
-
\??\c:\pdjdd.exec:\pdjdd.exe232⤵PID:1636
-
\??\c:\pppvd.exec:\pppvd.exe233⤵PID:2348
-
\??\c:\frfrffl.exec:\frfrffl.exe234⤵PID:1228
-
\??\c:\nhbhnn.exec:\nhbhnn.exe235⤵PID:2720
-
\??\c:\vpjpd.exec:\vpjpd.exe236⤵PID:2788
-
\??\c:\7pddd.exec:\7pddd.exe237⤵PID:748
-
\??\c:\rrlxxfl.exec:\rrlxxfl.exe238⤵PID:1620
-
\??\c:\nbhtbt.exec:\nbhtbt.exe239⤵PID:1544
-
\??\c:\nbnhbh.exec:\nbnhbh.exe240⤵PID:2180
-
\??\c:\vpjjp.exec:\vpjjp.exe241⤵PID:1504
-
\??\c:\dvppp.exec:\dvppp.exe242⤵PID:2372