Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 13:37
Behavioral task
behavioral1
Sample
46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe
-
Size
192KB
-
MD5
46504a4858501ee927f12bfe18c203c0
-
SHA1
51503b70a345f3acecc7ecf932d267b43ebc5ed0
-
SHA256
f953e6765ad7f9418587f3a0afe8c452827ff7839916dff17ffafd6c22b67b6e
-
SHA512
57cccca415734d3351cf86364d17f3c18385a8debb7c9cac1fe593eb428edcd4be390b4ea1ffba1ba86845135a60b83eadefb217f96fabfd447eaa920bf91ddd
-
SSDEEP
3072:FhOmTsF93UYfwC6GIoutrVCfMoh52waAyiJ8mqtbfUVKty16hDsI/tSa0:Fcm4FmowdHoS8fMoSVAHubPtyYxfP0
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4684-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2972-11-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3520-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3184-19-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1252-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2028-36-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3312-42-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4276-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3904-53-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1060-57-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3856-63-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1688-70-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4056-76-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4648-83-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1248-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1776-91-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1684-107-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/808-106-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1976-116-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4236-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/412-129-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4588-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4428-135-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2312-148-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4512-178-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3884-190-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4124-198-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5008-205-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4580-212-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4964-228-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3176-226-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3344-219-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4752-194-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3164-184-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5108-172-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4936-166-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5040-160-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3988-142-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2800-236-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/840-252-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2452-257-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3356-261-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3660-266-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1416-285-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4796-289-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2616-297-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4868-304-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/400-311-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3688-346-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1764-364-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4976-371-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1732-403-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3360-407-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3324-438-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2744-442-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3792-480-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3640-493-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3112-518-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3504-612-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3792-619-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3212-637-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4332-703-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4320-739-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3076-747-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022f51-3.dat family_berbew behavioral2/files/0x00080000000233ee-9.dat family_berbew behavioral2/files/0x00070000000233f2-13.dat family_berbew behavioral2/files/0x00070000000233f3-22.dat family_berbew behavioral2/files/0x00070000000233f4-29.dat family_berbew behavioral2/files/0x00070000000233f6-34.dat family_berbew behavioral2/files/0x00070000000233f7-40.dat family_berbew behavioral2/files/0x00070000000233f8-46.dat family_berbew behavioral2/files/0x00070000000233f9-51.dat family_berbew behavioral2/files/0x00070000000233fa-58.dat family_berbew behavioral2/files/0x00070000000233fb-62.dat family_berbew behavioral2/files/0x00070000000233fc-68.dat family_berbew behavioral2/files/0x00070000000233fd-74.dat family_berbew behavioral2/files/0x00070000000233fe-82.dat family_berbew behavioral2/files/0x00070000000233ff-87.dat family_berbew behavioral2/files/0x0007000000023400-94.dat family_berbew behavioral2/files/0x0007000000023402-98.dat family_berbew behavioral2/files/0x0007000000023403-103.dat family_berbew behavioral2/files/0x0007000000023404-111.dat family_berbew behavioral2/files/0x00080000000233ef-117.dat family_berbew behavioral2/files/0x0007000000023405-120.dat family_berbew behavioral2/files/0x0007000000023406-126.dat family_berbew behavioral2/files/0x0007000000023407-132.dat family_berbew behavioral2/files/0x0007000000023408-139.dat family_berbew behavioral2/files/0x0007000000023409-146.dat family_berbew behavioral2/files/0x000700000002340a-151.dat family_berbew behavioral2/files/0x000700000002340b-157.dat family_berbew behavioral2/files/0x000700000002340c-163.dat family_berbew behavioral2/files/0x000700000002340d-168.dat family_berbew behavioral2/files/0x0007000000023410-187.dat family_berbew behavioral2/files/0x000700000002340f-181.dat family_berbew behavioral2/files/0x000700000002340e-175.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2972 vjppp.exe 3184 fxxrllf.exe 3520 jpjdd.exe 1252 7jdpj.exe 2028 rrllfff.exe 3312 dvdvv.exe 4276 frfxlll.exe 3904 ntbbtt.exe 1060 htbttt.exe 3856 pvddd.exe 1688 xllfffl.exe 4056 pjvdv.exe 4648 5jpjd.exe 1248 bnbttt.exe 1776 rlllffx.exe 3292 ttbtnt.exe 808 jvvvv.exe 1684 7lrlffl.exe 1976 nbtthb.exe 4236 vpjdd.exe 412 5httnb.exe 4428 vdvvv.exe 4588 hnhbtb.exe 3988 jdpdd.exe 2312 flfxxxx.exe 5040 hthhht.exe 4936 vdvdd.exe 5108 jjjjj.exe 4512 lrxxffl.exe 3164 9lxxxff.exe 3884 tbnbbn.exe 4752 hhnnnn.exe 4124 1vvpp.exe 2652 ddddj.exe 5008 lffflrl.exe 4976 lrrrxxx.exe 4580 ntnnth.exe 976 nnbbbh.exe 3344 jjddd.exe 4412 ddddv.exe 3176 xfrxrrf.exe 4964 9htthn.exe 2972 tbhttn.exe 2800 ppddp.exe 4576 lflfrfr.exe 2284 bhnntt.exe 2028 7jjjp.exe 1996 jjvvv.exe 840 bhtttb.exe 2452 tnhhhh.exe 3356 jjddv.exe 4776 ffrrxff.exe 3660 ttbhbh.exe 1524 hnbbhh.exe 3324 jjjvj.exe 4056 lffffll.exe 3536 bbnnhn.exe 1416 jdpvv.exe 4796 xrffflf.exe 2300 9bntth.exe 3680 tthhhn.exe 2616 pvjjj.exe 60 lxlxxxf.exe 4868 fxlrflx.exe -
resource yara_rule behavioral2/memory/4684-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/4684-5-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00080000000233ee-9.dat upx behavioral2/memory/2972-11-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f2-13.dat upx behavioral2/memory/3520-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3184-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1252-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f3-22.dat upx behavioral2/files/0x00070000000233f4-29.dat upx behavioral2/memory/2028-31-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f6-34.dat upx behavioral2/memory/2028-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f7-40.dat upx behavioral2/memory/3312-42-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f8-46.dat upx behavioral2/memory/4276-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f9-51.dat upx behavioral2/memory/3904-53-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fa-58.dat upx behavioral2/memory/1060-57-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fb-62.dat upx behavioral2/memory/3856-63-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1688-65-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1688-70-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fc-68.dat upx behavioral2/files/0x00070000000233fd-74.dat upx behavioral2/memory/4056-76-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4648-83-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fe-82.dat upx behavioral2/memory/1248-84-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233ff-87.dat upx behavioral2/files/0x0007000000023400-94.dat upx behavioral2/memory/1776-91-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023402-98.dat upx behavioral2/files/0x0007000000023403-103.dat upx behavioral2/memory/1684-107-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/808-106-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023404-111.dat upx behavioral2/files/0x00080000000233ef-117.dat upx behavioral2/memory/1976-116-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023405-120.dat upx behavioral2/memory/4236-122-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023406-126.dat upx behavioral2/memory/412-129-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023407-132.dat upx behavioral2/memory/4588-136-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4428-135-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023408-139.dat upx behavioral2/files/0x0007000000023409-146.dat upx behavioral2/memory/2312-148-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340a-151.dat upx behavioral2/files/0x000700000002340b-157.dat upx behavioral2/files/0x000700000002340c-163.dat upx behavioral2/files/0x000700000002340d-168.dat upx behavioral2/memory/4512-178-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023410-187.dat upx behavioral2/memory/3884-190-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4124-198-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5008-205-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4580-212-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4964-228-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3176-226-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4684 wrote to memory of 2972 4684 46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe 83 PID 4684 wrote to memory of 2972 4684 46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe 83 PID 4684 wrote to memory of 2972 4684 46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe 83 PID 2972 wrote to memory of 3184 2972 vjppp.exe 84 PID 2972 wrote to memory of 3184 2972 vjppp.exe 84 PID 2972 wrote to memory of 3184 2972 vjppp.exe 84 PID 3184 wrote to memory of 3520 3184 fxxrllf.exe 85 PID 3184 wrote to memory of 3520 3184 fxxrllf.exe 85 PID 3184 wrote to memory of 3520 3184 fxxrllf.exe 85 PID 3520 wrote to memory of 1252 3520 jpjdd.exe 86 PID 3520 wrote to memory of 1252 3520 jpjdd.exe 86 PID 3520 wrote to memory of 1252 3520 jpjdd.exe 86 PID 1252 wrote to memory of 2028 1252 7jdpj.exe 87 PID 1252 wrote to memory of 2028 1252 7jdpj.exe 87 PID 1252 wrote to memory of 2028 1252 7jdpj.exe 87 PID 2028 wrote to memory of 3312 2028 rrllfff.exe 88 PID 2028 wrote to memory of 3312 2028 rrllfff.exe 88 PID 2028 wrote to memory of 3312 2028 rrllfff.exe 88 PID 3312 wrote to memory of 4276 3312 dvdvv.exe 89 PID 3312 wrote to memory of 4276 3312 dvdvv.exe 89 PID 3312 wrote to memory of 4276 3312 dvdvv.exe 89 PID 4276 wrote to memory of 3904 4276 frfxlll.exe 90 PID 4276 wrote to memory of 3904 4276 frfxlll.exe 90 PID 4276 wrote to memory of 3904 4276 frfxlll.exe 90 PID 3904 wrote to memory of 1060 3904 ntbbtt.exe 92 PID 3904 wrote to memory of 1060 3904 ntbbtt.exe 92 PID 3904 wrote to memory of 1060 3904 ntbbtt.exe 92 PID 1060 wrote to memory of 3856 1060 htbttt.exe 93 PID 1060 wrote to memory of 3856 1060 htbttt.exe 93 PID 1060 wrote to memory of 3856 1060 htbttt.exe 93 PID 3856 wrote to memory of 1688 3856 pvddd.exe 94 PID 3856 wrote to memory of 1688 3856 pvddd.exe 94 PID 3856 wrote to memory of 1688 3856 pvddd.exe 94 PID 1688 wrote to memory of 4056 1688 xllfffl.exe 95 PID 1688 wrote to memory of 4056 1688 xllfffl.exe 95 PID 1688 wrote to memory of 4056 1688 xllfffl.exe 95 PID 4056 wrote to memory of 4648 4056 pjvdv.exe 96 PID 4056 wrote to memory of 4648 4056 pjvdv.exe 96 PID 4056 wrote to memory of 4648 4056 pjvdv.exe 96 PID 4648 wrote to memory of 1248 4648 5jpjd.exe 97 PID 4648 wrote to memory of 1248 4648 5jpjd.exe 97 PID 4648 wrote to memory of 1248 4648 5jpjd.exe 97 PID 1248 wrote to memory of 1776 1248 bnbttt.exe 98 PID 1248 wrote to memory of 1776 1248 bnbttt.exe 98 PID 1248 wrote to memory of 1776 1248 bnbttt.exe 98 PID 1776 wrote to memory of 3292 1776 rlllffx.exe 99 PID 1776 wrote to memory of 3292 1776 rlllffx.exe 99 PID 1776 wrote to memory of 3292 1776 rlllffx.exe 99 PID 3292 wrote to memory of 808 3292 ttbtnt.exe 100 PID 3292 wrote to memory of 808 3292 ttbtnt.exe 100 PID 3292 wrote to memory of 808 3292 ttbtnt.exe 100 PID 808 wrote to memory of 1684 808 jvvvv.exe 101 PID 808 wrote to memory of 1684 808 jvvvv.exe 101 PID 808 wrote to memory of 1684 808 jvvvv.exe 101 PID 1684 wrote to memory of 1976 1684 7lrlffl.exe 102 PID 1684 wrote to memory of 1976 1684 7lrlffl.exe 102 PID 1684 wrote to memory of 1976 1684 7lrlffl.exe 102 PID 1976 wrote to memory of 4236 1976 nbtthb.exe 103 PID 1976 wrote to memory of 4236 1976 nbtthb.exe 103 PID 1976 wrote to memory of 4236 1976 nbtthb.exe 103 PID 4236 wrote to memory of 412 4236 vpjdd.exe 105 PID 4236 wrote to memory of 412 4236 vpjdd.exe 105 PID 4236 wrote to memory of 412 4236 vpjdd.exe 105 PID 412 wrote to memory of 4428 412 5httnb.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\vjppp.exec:\vjppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\fxxrllf.exec:\fxxrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\jpjdd.exec:\jpjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\7jdpj.exec:\7jdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\rrllfff.exec:\rrllfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\dvdvv.exec:\dvdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\frfxlll.exec:\frfxlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\ntbbtt.exec:\ntbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\htbttt.exec:\htbttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\pvddd.exec:\pvddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\xllfffl.exec:\xllfffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\pjvdv.exec:\pjvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\5jpjd.exec:\5jpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\bnbttt.exec:\bnbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\rlllffx.exec:\rlllffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\ttbtnt.exec:\ttbtnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\jvvvv.exec:\jvvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\7lrlffl.exec:\7lrlffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\nbtthb.exec:\nbtthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\vpjdd.exec:\vpjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\5httnb.exec:\5httnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\vdvvv.exec:\vdvvv.exe23⤵
- Executes dropped EXE
PID:4428 -
\??\c:\hnhbtb.exec:\hnhbtb.exe24⤵
- Executes dropped EXE
PID:4588 -
\??\c:\jdpdd.exec:\jdpdd.exe25⤵
- Executes dropped EXE
PID:3988 -
\??\c:\flfxxxx.exec:\flfxxxx.exe26⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hthhht.exec:\hthhht.exe27⤵
- Executes dropped EXE
PID:5040 -
\??\c:\vdvdd.exec:\vdvdd.exe28⤵
- Executes dropped EXE
PID:4936 -
\??\c:\jjjjj.exec:\jjjjj.exe29⤵
- Executes dropped EXE
PID:5108 -
\??\c:\lrxxffl.exec:\lrxxffl.exe30⤵
- Executes dropped EXE
PID:4512 -
\??\c:\9lxxxff.exec:\9lxxxff.exe31⤵
- Executes dropped EXE
PID:3164 -
\??\c:\tbnbbn.exec:\tbnbbn.exe32⤵
- Executes dropped EXE
PID:3884 -
\??\c:\hhnnnn.exec:\hhnnnn.exe33⤵
- Executes dropped EXE
PID:4752 -
\??\c:\1vvpp.exec:\1vvpp.exe34⤵
- Executes dropped EXE
PID:4124 -
\??\c:\ddddj.exec:\ddddj.exe35⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lffflrl.exec:\lffflrl.exe36⤵
- Executes dropped EXE
PID:5008 -
\??\c:\lrrrxxx.exec:\lrrrxxx.exe37⤵
- Executes dropped EXE
PID:4976 -
\??\c:\ntnnth.exec:\ntnnth.exe38⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nnbbbh.exec:\nnbbbh.exe39⤵
- Executes dropped EXE
PID:976 -
\??\c:\jjddd.exec:\jjddd.exe40⤵
- Executes dropped EXE
PID:3344 -
\??\c:\ddddv.exec:\ddddv.exe41⤵
- Executes dropped EXE
PID:4412 -
\??\c:\xfrxrrf.exec:\xfrxrrf.exe42⤵
- Executes dropped EXE
PID:3176 -
\??\c:\9htthn.exec:\9htthn.exe43⤵
- Executes dropped EXE
PID:4964 -
\??\c:\tbhttn.exec:\tbhttn.exe44⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ppddp.exec:\ppddp.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lflfrfr.exec:\lflfrfr.exe46⤵
- Executes dropped EXE
PID:4576 -
\??\c:\bhnntt.exec:\bhnntt.exe47⤵
- Executes dropped EXE
PID:2284 -
\??\c:\7jjjp.exec:\7jjjp.exe48⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jjvvv.exec:\jjvvv.exe49⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bhtttb.exec:\bhtttb.exe50⤵
- Executes dropped EXE
PID:840 -
\??\c:\tnhhhh.exec:\tnhhhh.exe51⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jjddv.exec:\jjddv.exe52⤵
- Executes dropped EXE
PID:3356 -
\??\c:\ffrrxff.exec:\ffrrxff.exe53⤵
- Executes dropped EXE
PID:4776 -
\??\c:\ttbhbh.exec:\ttbhbh.exe54⤵
- Executes dropped EXE
PID:3660 -
\??\c:\hnbbhh.exec:\hnbbhh.exe55⤵
- Executes dropped EXE
PID:1524 -
\??\c:\jjjvj.exec:\jjjvj.exe56⤵
- Executes dropped EXE
PID:3324 -
\??\c:\lffffll.exec:\lffffll.exe57⤵
- Executes dropped EXE
PID:4056 -
\??\c:\bbnnhn.exec:\bbnnhn.exe58⤵
- Executes dropped EXE
PID:3536 -
\??\c:\jdpvv.exec:\jdpvv.exe59⤵
- Executes dropped EXE
PID:1416 -
\??\c:\xrffflf.exec:\xrffflf.exe60⤵
- Executes dropped EXE
PID:4796 -
\??\c:\9bntth.exec:\9bntth.exe61⤵
- Executes dropped EXE
PID:2300 -
\??\c:\tthhhn.exec:\tthhhn.exe62⤵
- Executes dropped EXE
PID:3680 -
\??\c:\pvjjj.exec:\pvjjj.exe63⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lxlxxxf.exec:\lxlxxxf.exe64⤵
- Executes dropped EXE
PID:60 -
\??\c:\fxlrflx.exec:\fxlrflx.exe65⤵
- Executes dropped EXE
PID:4868 -
\??\c:\hbnthh.exec:\hbnthh.exe66⤵PID:4188
-
\??\c:\pdjjj.exec:\pdjjj.exe67⤵PID:400
-
\??\c:\djvvv.exec:\djvvv.exe68⤵PID:412
-
\??\c:\1xlfxfx.exec:\1xlfxfx.exe69⤵PID:4624
-
\??\c:\bbttbb.exec:\bbttbb.exe70⤵PID:2676
-
\??\c:\9bhhhh.exec:\9bhhhh.exe71⤵PID:3608
-
\??\c:\jjjpp.exec:\jjjpp.exe72⤵PID:2164
-
\??\c:\djpjj.exec:\djpjj.exe73⤵PID:5040
-
\??\c:\rlrrllr.exec:\rlrrllr.exe74⤵PID:5076
-
\??\c:\bbhnnt.exec:\bbhnnt.exe75⤵PID:548
-
\??\c:\tnnnbh.exec:\tnnnbh.exe76⤵PID:4688
-
\??\c:\djppp.exec:\djppp.exe77⤵PID:816
-
\??\c:\vpdjp.exec:\vpdjp.exe78⤵PID:3688
-
\??\c:\xlxffll.exec:\xlxffll.exe79⤵PID:2112
-
\??\c:\hhbhhn.exec:\hhbhhn.exe80⤵PID:3512
-
\??\c:\3bttht.exec:\3bttht.exe81⤵PID:2084
-
\??\c:\pjppv.exec:\pjppv.exe82⤵PID:2592
-
\??\c:\djdjj.exec:\djdjj.exe83⤵PID:1764
-
\??\c:\flrrrxx.exec:\flrrrxx.exe84⤵PID:4136
-
\??\c:\htbtnt.exec:\htbtnt.exe85⤵PID:4976
-
\??\c:\jdppv.exec:\jdppv.exe86⤵PID:976
-
\??\c:\9pdjp.exec:\9pdjp.exe87⤵PID:3344
-
\??\c:\lflrrxx.exec:\lflrrxx.exe88⤵PID:436
-
\??\c:\9bhhhn.exec:\9bhhhn.exe89⤵PID:1880
-
\??\c:\5pvdv.exec:\5pvdv.exe90⤵PID:4412
-
\??\c:\jdpdd.exec:\jdpdd.exe91⤵PID:380
-
\??\c:\lffxxlr.exec:\lffxxlr.exe92⤵PID:3196
-
\??\c:\3xlllfr.exec:\3xlllfr.exe93⤵PID:1196
-
\??\c:\ttbhbb.exec:\ttbhbb.exe94⤵PID:4356
-
\??\c:\ttttnn.exec:\ttttnn.exe95⤵PID:3032
-
\??\c:\jjvvd.exec:\jjvvd.exe96⤵PID:1732
-
\??\c:\llfrrrl.exec:\llfrrrl.exe97⤵PID:3360
-
\??\c:\tbbbtt.exec:\tbbbtt.exe98⤵PID:2244
-
\??\c:\djdjd.exec:\djdjd.exe99⤵PID:2792
-
\??\c:\1rxrflf.exec:\1rxrflf.exe100⤵PID:4440
-
\??\c:\nnnhhh.exec:\nnnhhh.exe101⤵PID:3864
-
\??\c:\btnnhb.exec:\btnnhb.exe102⤵PID:3200
-
\??\c:\pjvjv.exec:\pjvjv.exe103⤵PID:2140
-
\??\c:\rfrrrrl.exec:\rfrrrrl.exe104⤵PID:4776
-
\??\c:\tnthhn.exec:\tnthhn.exe105⤵PID:2488
-
\??\c:\ppvdv.exec:\ppvdv.exe106⤵PID:4016
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe107⤵PID:3324
-
\??\c:\nhhhhh.exec:\nhhhhh.exe108⤵PID:2744
-
\??\c:\vpjvv.exec:\vpjvv.exe109⤵PID:3896
-
\??\c:\pdvpp.exec:\pdvpp.exe110⤵PID:1416
-
\??\c:\rxxrlrx.exec:\rxxrlrx.exe111⤵PID:1448
-
\??\c:\tbhhhb.exec:\tbhhhb.exe112⤵PID:1140
-
\??\c:\jpvjd.exec:\jpvjd.exe113⤵PID:3680
-
\??\c:\1dvvd.exec:\1dvvd.exe114⤵PID:1208
-
\??\c:\fffrrxf.exec:\fffrrxf.exe115⤵PID:1420
-
\??\c:\tttntt.exec:\tttntt.exe116⤵PID:1976
-
\??\c:\nttttb.exec:\nttttb.exe117⤵PID:4984
-
\??\c:\dvddv.exec:\dvddv.exe118⤵PID:3504
-
\??\c:\7xfxfxl.exec:\7xfxfxl.exe119⤵PID:4428
-
\??\c:\ntnhhh.exec:\ntnhhh.exe120⤵PID:3792
-
\??\c:\vvjdd.exec:\vvjdd.exe121⤵PID:4668
-
\??\c:\xlrlrff.exec:\xlrlrff.exe122⤵PID:3608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-