Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 10:44
Behavioral task
behavioral1
Sample
17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe
-
Size
294KB
-
MD5
17958f252c9338415228f912a9c0a450
-
SHA1
f5825500d10aa2452ebd5018c76b7a261c3a0afa
-
SHA256
d566b9730bb5d40e9c18c003f170d5d1a7e5a4222a56ef334713af83b705eacc
-
SHA512
71228b372ccd6655ad5cb868660ebfeed2332c564110c1182707aefe2421a703f70554a69ec7bb2a2273904a15f6afd0391f68bc14f0397f6dec79b80f0a6d85
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftOV:K4wFHoSQkuUHk1zBR/pMT9XvEhdfU
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1776-6-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4996-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4820-54-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2772-272-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/404-296-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3068-290-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2640-283-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3200-263-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1480-259-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1420-251-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1216-235-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3312-228-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4228-221-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3344-215-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1692-211-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1432-207-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4880-204-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/916-201-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2600-194-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3868-179-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1936-163-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/884-157-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1604-146-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4188-140-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4892-124-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3560-118-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2532-112-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/404-106-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4972-96-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2640-84-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/876-78-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3520-72-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2368-66-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1052-60-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4696-48-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4720-43-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3692-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4700-30-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3624-24-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4872-13-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3760-315-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4736-316-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2184-326-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/408-334-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2856-357-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/444-370-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2616-380-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1776-405-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5088-437-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4136-444-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/760-454-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4088-483-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2984-508-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/444-527-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1960-557-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/560-623-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1140-655-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4516-768-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1324-782-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4820-847-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2756-911-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3484-921-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1828-939-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5044-957-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0007000000023276-3.dat family_berbew behavioral2/files/0x00070000000233ee-27.dat family_berbew behavioral2/files/0x00070000000233ef-33.dat family_berbew behavioral2/files/0x00070000000233f0-38.dat family_berbew behavioral2/files/0x00070000000233f1-45.dat family_berbew behavioral2/files/0x00070000000233f4-62.dat family_berbew behavioral2/files/0x00070000000233f5-69.dat family_berbew behavioral2/files/0x00070000000233f8-87.dat family_berbew behavioral2/files/0x00070000000233fb-103.dat family_berbew behavioral2/files/0x0007000000023400-131.dat family_berbew behavioral2/files/0x0007000000023406-166.dat family_berbew behavioral2/files/0x0007000000023409-182.dat family_berbew behavioral2/files/0x0007000000023408-176.dat family_berbew behavioral2/files/0x0007000000023407-171.dat family_berbew behavioral2/files/0x0007000000023405-160.dat family_berbew behavioral2/files/0x0007000000023404-154.dat family_berbew behavioral2/files/0x0007000000023403-149.dat family_berbew behavioral2/files/0x0007000000023402-142.dat family_berbew behavioral2/files/0x0007000000023401-136.dat family_berbew behavioral2/files/0x00070000000233ff-127.dat family_berbew behavioral2/files/0x00070000000233fe-121.dat family_berbew behavioral2/files/0x00070000000233fd-115.dat family_berbew behavioral2/files/0x00070000000233fc-109.dat family_berbew behavioral2/files/0x00070000000233fa-98.dat family_berbew behavioral2/files/0x00070000000233f9-92.dat family_berbew behavioral2/files/0x00070000000233f7-81.dat family_berbew behavioral2/files/0x00070000000233f6-75.dat family_berbew behavioral2/files/0x00070000000233f3-57.dat family_berbew behavioral2/files/0x00070000000233f2-51.dat family_berbew behavioral2/files/0x00070000000233ed-21.dat family_berbew behavioral2/files/0x00070000000233ec-16.dat family_berbew behavioral2/files/0x00080000000233e8-11.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 4996 vdpvv.exe 4872 3rrllll.exe 3624 rrxxffl.exe 4700 nhnhhh.exe 3692 hnbtnt.exe 4720 dvjdd.exe 4696 lxrllfx.exe 4820 lfxxflr.exe 1052 nhnnnn.exe 2368 bbthbh.exe 3520 pdpjj.exe 876 rflllll.exe 2640 rrfffff.exe 4968 ttbttn.exe 4972 ppvdd.exe 2276 djdjp.exe 404 rlxrrfx.exe 2532 llrrrrl.exe 3560 nnbtbb.exe 4892 bbttbb.exe 4684 dppvp.exe 4188 rxxxxlf.exe 1124 lxlrrrr.exe 1604 nthnth.exe 4900 nnthhh.exe 884 jdjdd.exe 1936 flrlxll.exe 4728 hnttnb.exe 3476 1nbthn.exe 3868 vjdvv.exe 4692 7rxxllf.exe 4752 lxfffxr.exe 1988 ttbttt.exe 2600 ddvvv.exe 916 pvdjd.exe 4880 9frrllf.exe 1432 lrxrlxx.exe 1692 bttnhb.exe 3344 nhnhhh.exe 2728 9jdpv.exe 4228 rfllxfl.exe 4452 ntbnnh.exe 3312 ddvjv.exe 4336 jdppp.exe 1216 flrrllx.exe 4308 nhtnnn.exe 1228 pvvdd.exe 3492 ppvvv.exe 1420 7xxrllr.exe 1704 nhnhht.exe 184 dpvdd.exe 1480 pppjp.exe 3200 rrlfxrx.exe 2744 nthtnb.exe 4108 jdjjj.exe 2772 7djjj.exe 3536 xrlxrrx.exe 1872 1nhhhh.exe 2640 nnhbhn.exe 3376 ppvjj.exe 3068 rlxxrfl.exe 2964 nnhtnb.exe 404 5vdvv.exe 2532 vppjj.exe -
resource yara_rule behavioral2/memory/1776-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023276-3.dat upx behavioral2/memory/1776-6-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4996-8-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000233ee-27.dat upx behavioral2/files/0x00070000000233ef-33.dat upx behavioral2/files/0x00070000000233f0-38.dat upx behavioral2/files/0x00070000000233f1-45.dat upx behavioral2/memory/4820-54-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000233f4-62.dat upx behavioral2/files/0x00070000000233f5-69.dat upx behavioral2/files/0x00070000000233f8-87.dat upx behavioral2/files/0x00070000000233fb-103.dat upx behavioral2/files/0x0007000000023400-131.dat upx behavioral2/files/0x0007000000023406-166.dat upx behavioral2/memory/2772-272-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/404-296-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3068-290-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2640-283-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3200-263-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1480-259-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1420-251-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1216-235-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3312-228-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4228-221-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3344-215-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1692-211-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1432-207-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4880-204-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/916-201-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2600-194-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023409-182.dat upx behavioral2/memory/3868-179-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023408-176.dat upx behavioral2/files/0x0007000000023407-171.dat upx behavioral2/memory/1936-163-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023405-160.dat upx behavioral2/memory/884-157-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023404-154.dat upx behavioral2/files/0x0007000000023403-149.dat upx behavioral2/memory/1604-146-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023402-142.dat upx behavioral2/memory/4188-140-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023401-136.dat upx behavioral2/files/0x00070000000233ff-127.dat upx behavioral2/memory/4892-124-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000233fe-121.dat upx behavioral2/memory/3560-118-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000233fd-115.dat upx behavioral2/memory/2532-112-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000233fc-109.dat upx behavioral2/memory/404-106-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000233fa-98.dat upx behavioral2/memory/4972-96-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000233f9-92.dat upx behavioral2/memory/2640-84-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000233f7-81.dat upx behavioral2/memory/876-78-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000233f6-75.dat upx behavioral2/memory/3520-72-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2368-66-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1052-60-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000233f3-57.dat upx behavioral2/files/0x00070000000233f2-51.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 4996 1776 17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe 83 PID 1776 wrote to memory of 4996 1776 17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe 83 PID 1776 wrote to memory of 4996 1776 17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe 83 PID 4996 wrote to memory of 4872 4996 vdpvv.exe 84 PID 4996 wrote to memory of 4872 4996 vdpvv.exe 84 PID 4996 wrote to memory of 4872 4996 vdpvv.exe 84 PID 4872 wrote to memory of 3624 4872 3rrllll.exe 85 PID 4872 wrote to memory of 3624 4872 3rrllll.exe 85 PID 4872 wrote to memory of 3624 4872 3rrllll.exe 85 PID 3624 wrote to memory of 4700 3624 rrxxffl.exe 86 PID 3624 wrote to memory of 4700 3624 rrxxffl.exe 86 PID 3624 wrote to memory of 4700 3624 rrxxffl.exe 86 PID 4700 wrote to memory of 3692 4700 nhnhhh.exe 87 PID 4700 wrote to memory of 3692 4700 nhnhhh.exe 87 PID 4700 wrote to memory of 3692 4700 nhnhhh.exe 87 PID 3692 wrote to memory of 4720 3692 hnbtnt.exe 88 PID 3692 wrote to memory of 4720 3692 hnbtnt.exe 88 PID 3692 wrote to memory of 4720 3692 hnbtnt.exe 88 PID 4720 wrote to memory of 4696 4720 dvjdd.exe 89 PID 4720 wrote to memory of 4696 4720 dvjdd.exe 89 PID 4720 wrote to memory of 4696 4720 dvjdd.exe 89 PID 4696 wrote to memory of 4820 4696 lxrllfx.exe 90 PID 4696 wrote to memory of 4820 4696 lxrllfx.exe 90 PID 4696 wrote to memory of 4820 4696 lxrllfx.exe 90 PID 4820 wrote to memory of 1052 4820 lfxxflr.exe 91 PID 4820 wrote to memory of 1052 4820 lfxxflr.exe 91 PID 4820 wrote to memory of 1052 4820 lfxxflr.exe 91 PID 1052 wrote to memory of 2368 1052 nhnnnn.exe 92 PID 1052 wrote to memory of 2368 1052 nhnnnn.exe 92 PID 1052 wrote to memory of 2368 1052 nhnnnn.exe 92 PID 2368 wrote to memory of 3520 2368 bbthbh.exe 93 PID 2368 wrote to memory of 3520 2368 bbthbh.exe 93 PID 2368 wrote to memory of 3520 2368 bbthbh.exe 93 PID 3520 wrote to memory of 876 3520 pdpjj.exe 94 PID 3520 wrote to memory of 876 3520 pdpjj.exe 94 PID 3520 wrote to memory of 876 3520 pdpjj.exe 94 PID 876 wrote to memory of 2640 876 rflllll.exe 95 PID 876 wrote to memory of 2640 876 rflllll.exe 95 PID 876 wrote to memory of 2640 876 rflllll.exe 95 PID 2640 wrote to memory of 4968 2640 rrfffff.exe 96 PID 2640 wrote to memory of 4968 2640 rrfffff.exe 96 PID 2640 wrote to memory of 4968 2640 rrfffff.exe 96 PID 4968 wrote to memory of 4972 4968 ttbttn.exe 97 PID 4968 wrote to memory of 4972 4968 ttbttn.exe 97 PID 4968 wrote to memory of 4972 4968 ttbttn.exe 97 PID 4972 wrote to memory of 2276 4972 ppvdd.exe 98 PID 4972 wrote to memory of 2276 4972 ppvdd.exe 98 PID 4972 wrote to memory of 2276 4972 ppvdd.exe 98 PID 2276 wrote to memory of 404 2276 djdjp.exe 99 PID 2276 wrote to memory of 404 2276 djdjp.exe 99 PID 2276 wrote to memory of 404 2276 djdjp.exe 99 PID 404 wrote to memory of 2532 404 rlxrrfx.exe 100 PID 404 wrote to memory of 2532 404 rlxrrfx.exe 100 PID 404 wrote to memory of 2532 404 rlxrrfx.exe 100 PID 2532 wrote to memory of 3560 2532 llrrrrl.exe 101 PID 2532 wrote to memory of 3560 2532 llrrrrl.exe 101 PID 2532 wrote to memory of 3560 2532 llrrrrl.exe 101 PID 3560 wrote to memory of 4892 3560 nnbtbb.exe 102 PID 3560 wrote to memory of 4892 3560 nnbtbb.exe 102 PID 3560 wrote to memory of 4892 3560 nnbtbb.exe 102 PID 4892 wrote to memory of 4684 4892 bbttbb.exe 103 PID 4892 wrote to memory of 4684 4892 bbttbb.exe 103 PID 4892 wrote to memory of 4684 4892 bbttbb.exe 103 PID 4684 wrote to memory of 4188 4684 dppvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\vdpvv.exec:\vdpvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\3rrllll.exec:\3rrllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\rrxxffl.exec:\rrxxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\nhnhhh.exec:\nhnhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\hnbtnt.exec:\hnbtnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\dvjdd.exec:\dvjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\lxrllfx.exec:\lxrllfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\lfxxflr.exec:\lfxxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\nhnnnn.exec:\nhnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\bbthbh.exec:\bbthbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\pdpjj.exec:\pdpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\rflllll.exec:\rflllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\rrfffff.exec:\rrfffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ttbttn.exec:\ttbttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\ppvdd.exec:\ppvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\djdjp.exec:\djdjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\rlxrrfx.exec:\rlxrrfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\llrrrrl.exec:\llrrrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\nnbtbb.exec:\nnbtbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\bbttbb.exec:\bbttbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\dppvp.exec:\dppvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\rxxxxlf.exec:\rxxxxlf.exe23⤵
- Executes dropped EXE
PID:4188 -
\??\c:\lxlrrrr.exec:\lxlrrrr.exe24⤵
- Executes dropped EXE
PID:1124 -
\??\c:\nthnth.exec:\nthnth.exe25⤵
- Executes dropped EXE
PID:1604 -
\??\c:\nnthhh.exec:\nnthhh.exe26⤵
- Executes dropped EXE
PID:4900 -
\??\c:\jdjdd.exec:\jdjdd.exe27⤵
- Executes dropped EXE
PID:884 -
\??\c:\flrlxll.exec:\flrlxll.exe28⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hnttnb.exec:\hnttnb.exe29⤵
- Executes dropped EXE
PID:4728 -
\??\c:\1nbthn.exec:\1nbthn.exe30⤵
- Executes dropped EXE
PID:3476 -
\??\c:\vjdvv.exec:\vjdvv.exe31⤵
- Executes dropped EXE
PID:3868 -
\??\c:\7rxxllf.exec:\7rxxllf.exe32⤵
- Executes dropped EXE
PID:4692 -
\??\c:\lxfffxr.exec:\lxfffxr.exe33⤵
- Executes dropped EXE
PID:4752 -
\??\c:\ttbttt.exec:\ttbttt.exe34⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ddvvv.exec:\ddvvv.exe35⤵
- Executes dropped EXE
PID:2600 -
\??\c:\pvdjd.exec:\pvdjd.exe36⤵
- Executes dropped EXE
PID:916 -
\??\c:\9frrllf.exec:\9frrllf.exe37⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lrxrlxx.exec:\lrxrlxx.exe38⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bttnhb.exec:\bttnhb.exe39⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nhnhhh.exec:\nhnhhh.exe40⤵
- Executes dropped EXE
PID:3344 -
\??\c:\9jdpv.exec:\9jdpv.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rfllxfl.exec:\rfllxfl.exe42⤵
- Executes dropped EXE
PID:4228 -
\??\c:\ntbnnh.exec:\ntbnnh.exe43⤵
- Executes dropped EXE
PID:4452 -
\??\c:\ddvjv.exec:\ddvjv.exe44⤵
- Executes dropped EXE
PID:3312 -
\??\c:\jdppp.exec:\jdppp.exe45⤵
- Executes dropped EXE
PID:4336 -
\??\c:\flrrllx.exec:\flrrllx.exe46⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nhtnnn.exec:\nhtnnn.exe47⤵
- Executes dropped EXE
PID:4308 -
\??\c:\pvvdd.exec:\pvvdd.exe48⤵
- Executes dropped EXE
PID:1228 -
\??\c:\ppvvv.exec:\ppvvv.exe49⤵
- Executes dropped EXE
PID:3492 -
\??\c:\7xxrllr.exec:\7xxrllr.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\nhnhht.exec:\nhnhht.exe51⤵
- Executes dropped EXE
PID:1704 -
\??\c:\dpvdd.exec:\dpvdd.exe52⤵
- Executes dropped EXE
PID:184 -
\??\c:\pppjp.exec:\pppjp.exe53⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rrlfxrx.exec:\rrlfxrx.exe54⤵
- Executes dropped EXE
PID:3200 -
\??\c:\nthtnb.exec:\nthtnb.exe55⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jdjjj.exec:\jdjjj.exe56⤵
- Executes dropped EXE
PID:4108 -
\??\c:\7djjj.exec:\7djjj.exe57⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xrlxrrx.exec:\xrlxrrx.exe58⤵
- Executes dropped EXE
PID:3536 -
\??\c:\1nhhhh.exec:\1nhhhh.exe59⤵
- Executes dropped EXE
PID:1872 -
\??\c:\nnhbhn.exec:\nnhbhn.exe60⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ppvjj.exec:\ppvjj.exe61⤵
- Executes dropped EXE
PID:3376 -
\??\c:\rlxxrfl.exec:\rlxxrfl.exe62⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nnhtnb.exec:\nnhtnb.exe63⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5vdvv.exec:\5vdvv.exe64⤵
- Executes dropped EXE
PID:404 -
\??\c:\vppjj.exec:\vppjj.exe65⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lrlxrlx.exec:\lrlxrlx.exe66⤵PID:2512
-
\??\c:\hbtbbb.exec:\hbtbbb.exe67⤵PID:3212
-
\??\c:\jjppp.exec:\jjppp.exe68⤵PID:3608
-
\??\c:\frxllrx.exec:\frxllrx.exe69⤵PID:1124
-
\??\c:\pddvd.exec:\pddvd.exe70⤵PID:3760
-
\??\c:\nnbtnb.exec:\nnbtnb.exe71⤵PID:4736
-
\??\c:\vvddd.exec:\vvddd.exe72⤵PID:1936
-
\??\c:\9xlllfr.exec:\9xlllfr.exe73⤵PID:2184
-
\??\c:\ntbttt.exec:\ntbttt.exe74⤵PID:3340
-
\??\c:\9vvpd.exec:\9vvpd.exe75⤵PID:408
-
\??\c:\xllfxxr.exec:\xllfxxr.exe76⤵PID:1324
-
\??\c:\nnhhbh.exec:\nnhhbh.exe77⤵PID:3708
-
\??\c:\3jdvp.exec:\3jdvp.exe78⤵PID:4568
-
\??\c:\lrlffff.exec:\lrlffff.exe79⤵PID:3644
-
\??\c:\hhnnnn.exec:\hhnnnn.exe80⤵PID:4704
-
\??\c:\djpvp.exec:\djpvp.exe81⤵PID:1432
-
\??\c:\lrxfxlf.exec:\lrxfxlf.exe82⤵PID:2856
-
\??\c:\bbtttt.exec:\bbtttt.exe83⤵PID:4988
-
\??\c:\pvvvv.exec:\pvvvv.exe84⤵PID:1800
-
\??\c:\rfllxxx.exec:\rfllxxx.exe85⤵PID:4560
-
\??\c:\3bttnn.exec:\3bttnn.exe86⤵PID:444
-
\??\c:\vddvv.exec:\vddvv.exe87⤵PID:2596
-
\??\c:\fflfxfl.exec:\fflfxfl.exe88⤵PID:1216
-
\??\c:\thtbbt.exec:\thtbbt.exe89⤵PID:2616
-
\??\c:\vpjdj.exec:\vpjdj.exe90⤵PID:2148
-
\??\c:\3xfxrrx.exec:\3xfxrrx.exe91⤵PID:4432
-
\??\c:\9bhnhh.exec:\9bhnhh.exe92⤵PID:3492
-
\??\c:\jddvp.exec:\jddvp.exe93⤵PID:4112
-
\??\c:\fflfxxx.exec:\fflfxxx.exe94⤵PID:2684
-
\??\c:\bhnnhb.exec:\bhnnhb.exe95⤵PID:4316
-
\??\c:\djdjj.exec:\djdjj.exe96⤵PID:3204
-
\??\c:\pdvpp.exec:\pdvpp.exe97⤵PID:1776
-
\??\c:\hhhhbb.exec:\hhhhbb.exe98⤵PID:4140
-
\??\c:\5ppjj.exec:\5ppjj.exe99⤵PID:4224
-
\??\c:\jvvpj.exec:\jvvpj.exe100⤵PID:224
-
\??\c:\ffxxffr.exec:\ffxxffr.exe101⤵PID:4852
-
\??\c:\hhnnnh.exec:\hhnnnh.exe102⤵PID:4040
-
\??\c:\dpppj.exec:\dpppj.exe103⤵PID:4284
-
\??\c:\dvvjd.exec:\dvvjd.exe104⤵PID:668
-
\??\c:\hnhnhn.exec:\hnhnhn.exe105⤵PID:1996
-
\??\c:\1thbht.exec:\1thbht.exe106⤵PID:5068
-
\??\c:\pdpjj.exec:\pdpjj.exe107⤵PID:5088
-
\??\c:\rllfffx.exec:\rllfffx.exe108⤵PID:4972
-
\??\c:\bthbtt.exec:\bthbtt.exe109⤵PID:4136
-
\??\c:\5vddv.exec:\5vddv.exe110⤵PID:4544
-
\??\c:\xfrlrlx.exec:\xfrlrlx.exe111⤵PID:2764
-
\??\c:\3hbtnt.exec:\3hbtnt.exe112⤵PID:760
-
\??\c:\jjvvd.exec:\jjvvd.exe113⤵PID:2328
-
\??\c:\3jdpj.exec:\3jdpj.exe114⤵PID:440
-
\??\c:\rxxrllf.exec:\rxxrllf.exe115⤵PID:456
-
\??\c:\7thhbb.exec:\7thhbb.exe116⤵PID:1696
-
\??\c:\ffrrffr.exec:\ffrrffr.exe117⤵PID:3608
-
\??\c:\fxfllxx.exec:\fxfllxx.exe118⤵PID:2672
-
\??\c:\htbbbb.exec:\htbbbb.exe119⤵PID:3760
-
\??\c:\jpddj.exec:\jpddj.exe120⤵PID:5004
-
\??\c:\lxrlxff.exec:\lxrlxff.exe121⤵PID:4088
-
\??\c:\frxxllx.exec:\frxxllx.exe122⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-