Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 00:53
Behavioral task
behavioral1
Sample
3a4323961f72bbc9a6741277656f5dc0_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
3a4323961f72bbc9a6741277656f5dc0_NeikiAnalytics.exe
-
Size
214KB
-
MD5
3a4323961f72bbc9a6741277656f5dc0
-
SHA1
7e95e59bab8840d3bdbb96710620fd2681d036c2
-
SHA256
5dffff5210f8abd8702f918ea22d1fe33d991fc675057309db3e9328d3bf9221
-
SHA512
382ec781697d937b01bf05552f5bbdffee4187b8bfbf61b2738a2da74781abeacc214af81a27a5c9982b04cb5594c1dd726263783ed120a3cb70741a47ec4afb
-
SSDEEP
3072:ZhOm2sI93UufdC67ciEu0P5axvqdUmdznCvs7BuRoYFBg/gXVqPfSoi0yG24ePaP:Zcm7ImGddXEu0ucju6/4kf724Z
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/1992-9-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1664-12-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2592-27-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2696-37-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2852-46-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2968-63-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2480-66-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2604-81-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2656-90-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2456-101-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2368-99-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2792-110-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2800-127-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2396-145-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2388-156-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2384-164-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/536-192-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1424-202-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1212-243-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2164-253-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1628-277-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1668-313-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2976-327-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2732-352-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2848-359-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2620-367-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2824-374-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1604-407-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1936-426-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1268-433-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1704-541-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/612-567-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2480-670-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1560-695-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1540-898-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/3016-967-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2864-1087-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 35 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\tnbtbb.exe family_berbew C:\nnnbhn.exe family_berbew C:\jvjpd.exe family_berbew C:\nbtthn.exe family_berbew C:\dvddp.exe family_berbew C:\rfxxffl.exe family_berbew C:\3ttthn.exe family_berbew C:\jjdpd.exe family_berbew C:\llffllr.exe family_berbew C:\tnbntb.exe family_berbew C:\jvjdv.exe family_berbew \??\c:\3xxfrrx.exe family_berbew behavioral1/memory/2792-118-0x00000000003A0000-0x00000000003CD000-memory.dmp family_berbew C:\fxllrrf.exe family_berbew behavioral1/memory/2792-116-0x00000000003A0000-0x00000000003CD000-memory.dmp family_berbew C:\jjjjp.exe family_berbew C:\frrxrrf.exe family_berbew C:\hbttbh.exe family_berbew C:\pddvd.exe family_berbew C:\3fxxllx.exe family_berbew C:\jdvjv.exe family_berbew C:\7fxlfrl.exe family_berbew C:\hbnbht.exe family_berbew C:\5vpvp.exe family_berbew C:\rlxxffl.exe family_berbew C:\tnbnnn.exe family_berbew C:\jpvvv.exe family_berbew C:\xfrxlrx.exe family_berbew C:\bthnnt.exe family_berbew C:\pjdpv.exe family_berbew C:\fxllrxl.exe family_berbew C:\thnhhb.exe family_berbew C:\vjppj.exe family_berbew C:\fxfrrlf.exe family_berbew behavioral1/memory/1704-542-0x0000000000220000-0x000000000024D000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
tnbtbb.exennnbhn.exejvjpd.exenbtthn.exedvddp.exerfxxffl.exe3ttthn.exejjdpd.exellffllr.exetnbntb.exejvjdv.exe3xxfrrx.exefxllrrf.exejjjjp.exefrrxrrf.exehbttbh.exepddvd.exe3fxxllx.exejdvjv.exe7fxlfrl.exehbnbht.exe5vpvp.exerlxxffl.exetnbnnn.exejpvvv.exexfrxlrx.exebthnnt.exepjdpv.exefxllrxl.exethnhhb.exevjppj.exefxfrrlf.exe5btthn.exe9pdpv.exepjddj.exerllfxrl.exethttbh.exejdppp.exe7pjpd.exexxrrfrf.exebbtbtt.exe5pvpp.exejdvjd.exefxllxrf.exehhbtht.exevvpvj.exefxrlxlx.exexlxxllx.exenhbbnt.exennhbht.exevvpvp.exerlffxxf.exe3tntht.exe1hbbhb.exejdjvd.exe1lxlrlx.exennbnbh.exehhnhnn.exepdpdp.exe9jjvj.exelflrffr.exehbnthb.exedpjdd.exellfxlxl.exepid process 1664 tnbtbb.exe 2592 nnnbhn.exe 2696 jvjpd.exe 2852 nbtthn.exe 2760 dvddp.exe 2968 rfxxffl.exe 2480 3ttthn.exe 2604 jjdpd.exe 2656 llffllr.exe 2368 tnbntb.exe 2456 jvjdv.exe 2792 3xxfrrx.exe 2800 fxllrrf.exe 820 jjjjp.exe 2396 frrxrrf.exe 2388 hbttbh.exe 2384 pddvd.exe 2428 3fxxllx.exe 2784 jdvjv.exe 536 7fxlfrl.exe 1424 hbnbht.exe 808 5vpvp.exe 1116 rlxxffl.exe 3024 tnbnnn.exe 1076 jpvvv.exe 1212 xfrxlrx.exe 2164 bthnnt.exe 1856 pjdpv.exe 372 fxllrxl.exe 1628 thnhhb.exe 2264 vjppj.exe 2444 fxfrrlf.exe 2224 5btthn.exe 880 9pdpv.exe 1668 pjddj.exe 1524 rllfxrl.exe 2976 thttbh.exe 2628 jdppp.exe 2700 7pjpd.exe 2632 xxrrfrf.exe 2732 bbtbtt.exe 2848 5pvpp.exe 2620 jdvjd.exe 2824 fxllxrf.exe 2500 hhbtht.exe 2560 vvpvj.exe 2984 fxrlxlx.exe 1804 xlxxllx.exe 1604 nhbbnt.exe 2368 nnhbht.exe 1684 vvpvp.exe 1936 rlffxxf.exe 1268 3tntht.exe 1932 1hbbhb.exe 2144 jdjvd.exe 276 1lxlrlx.exe 1512 nnbnbh.exe 2388 hhnhnn.exe 2384 pdpdp.exe 2464 9jjvj.exe 2256 lflrffr.exe 484 hbnthb.exe 1408 dpjdd.exe 2880 llfxlxl.exe -
Processes:
resource yara_rule behavioral1/memory/1992-9-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1664-12-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2592-27-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2592-19-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2696-37-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2852-46-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2968-63-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2480-66-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2604-81-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2656-90-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2456-101-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2368-99-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2792-110-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2792-118-0x00000000003A0000-0x00000000003CD000-memory.dmp upx behavioral1/memory/2792-116-0x00000000003A0000-0x00000000003CD000-memory.dmp upx behavioral1/memory/2800-127-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2396-145-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2388-147-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2388-156-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2384-164-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2428-166-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/536-184-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/536-192-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1424-202-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1212-243-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2164-253-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1628-277-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1668-313-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2976-320-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2976-327-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2732-352-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2848-359-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2620-362-0x0000000001B70000-0x0000000001B9D000-memory.dmp upx behavioral1/memory/2620-367-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2824-374-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1604-407-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1936-426-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1932-434-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1268-433-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/612-567-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1908-581-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3004-619-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2692-632-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2480-670-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1560-695-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2456-702-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2808-741-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/592-790-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3028-817-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1540-898-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1992-905-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2860-920-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2752-939-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2848-946-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3016-967-0x0000000000220000-0x000000000024D000-memory.dmp upx behavioral1/memory/2780-1004-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2232-1067-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/832-1112-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1276-1119-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/896-1140-0x0000000000220000-0x000000000024D000-memory.dmp upx behavioral1/memory/1432-1175-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2624-1200-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2508-1231-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2492-1250-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3a4323961f72bbc9a6741277656f5dc0_NeikiAnalytics.exetnbtbb.exennnbhn.exejvjpd.exenbtthn.exedvddp.exerfxxffl.exe3ttthn.exejjdpd.exellffllr.exetnbntb.exejvjdv.exe3xxfrrx.exefxllrrf.exejjjjp.exefrrxrrf.exedescription pid process target process PID 1992 wrote to memory of 1664 1992 3a4323961f72bbc9a6741277656f5dc0_NeikiAnalytics.exe tnbtbb.exe PID 1992 wrote to memory of 1664 1992 3a4323961f72bbc9a6741277656f5dc0_NeikiAnalytics.exe tnbtbb.exe PID 1992 wrote to memory of 1664 1992 3a4323961f72bbc9a6741277656f5dc0_NeikiAnalytics.exe tnbtbb.exe PID 1992 wrote to memory of 1664 1992 3a4323961f72bbc9a6741277656f5dc0_NeikiAnalytics.exe tnbtbb.exe PID 1664 wrote to memory of 2592 1664 tnbtbb.exe nnnbhn.exe PID 1664 wrote to memory of 2592 1664 tnbtbb.exe nnnbhn.exe PID 1664 wrote to memory of 2592 1664 tnbtbb.exe nnnbhn.exe PID 1664 wrote to memory of 2592 1664 tnbtbb.exe nnnbhn.exe PID 2592 wrote to memory of 2696 2592 nnnbhn.exe jvjpd.exe PID 2592 wrote to memory of 2696 2592 nnnbhn.exe jvjpd.exe PID 2592 wrote to memory of 2696 2592 nnnbhn.exe jvjpd.exe PID 2592 wrote to memory of 2696 2592 nnnbhn.exe jvjpd.exe PID 2696 wrote to memory of 2852 2696 jvjpd.exe nbtthn.exe PID 2696 wrote to memory of 2852 2696 jvjpd.exe nbtthn.exe PID 2696 wrote to memory of 2852 2696 jvjpd.exe nbtthn.exe PID 2696 wrote to memory of 2852 2696 jvjpd.exe nbtthn.exe PID 2852 wrote to memory of 2760 2852 nbtthn.exe dvddp.exe PID 2852 wrote to memory of 2760 2852 nbtthn.exe dvddp.exe PID 2852 wrote to memory of 2760 2852 nbtthn.exe dvddp.exe PID 2852 wrote to memory of 2760 2852 nbtthn.exe dvddp.exe PID 2760 wrote to memory of 2968 2760 dvddp.exe rfxxffl.exe PID 2760 wrote to memory of 2968 2760 dvddp.exe rfxxffl.exe PID 2760 wrote to memory of 2968 2760 dvddp.exe rfxxffl.exe PID 2760 wrote to memory of 2968 2760 dvddp.exe rfxxffl.exe PID 2968 wrote to memory of 2480 2968 rfxxffl.exe 3ttthn.exe PID 2968 wrote to memory of 2480 2968 rfxxffl.exe 3ttthn.exe PID 2968 wrote to memory of 2480 2968 rfxxffl.exe 3ttthn.exe PID 2968 wrote to memory of 2480 2968 rfxxffl.exe 3ttthn.exe PID 2480 wrote to memory of 2604 2480 3ttthn.exe jjdpd.exe PID 2480 wrote to memory of 2604 2480 3ttthn.exe jjdpd.exe PID 2480 wrote to memory of 2604 2480 3ttthn.exe jjdpd.exe PID 2480 wrote to memory of 2604 2480 3ttthn.exe jjdpd.exe PID 2604 wrote to memory of 2656 2604 jjdpd.exe llffllr.exe PID 2604 wrote to memory of 2656 2604 jjdpd.exe llffllr.exe PID 2604 wrote to memory of 2656 2604 jjdpd.exe llffllr.exe PID 2604 wrote to memory of 2656 2604 jjdpd.exe llffllr.exe PID 2656 wrote to memory of 2368 2656 llffllr.exe tnbntb.exe PID 2656 wrote to memory of 2368 2656 llffllr.exe tnbntb.exe PID 2656 wrote to memory of 2368 2656 llffllr.exe tnbntb.exe PID 2656 wrote to memory of 2368 2656 llffllr.exe tnbntb.exe PID 2368 wrote to memory of 2456 2368 tnbntb.exe jvjdv.exe PID 2368 wrote to memory of 2456 2368 tnbntb.exe jvjdv.exe PID 2368 wrote to memory of 2456 2368 tnbntb.exe jvjdv.exe PID 2368 wrote to memory of 2456 2368 tnbntb.exe jvjdv.exe PID 2456 wrote to memory of 2792 2456 jvjdv.exe 3xxfrrx.exe PID 2456 wrote to memory of 2792 2456 jvjdv.exe 3xxfrrx.exe PID 2456 wrote to memory of 2792 2456 jvjdv.exe 3xxfrrx.exe PID 2456 wrote to memory of 2792 2456 jvjdv.exe 3xxfrrx.exe PID 2792 wrote to memory of 2800 2792 3xxfrrx.exe fxllrrf.exe PID 2792 wrote to memory of 2800 2792 3xxfrrx.exe fxllrrf.exe PID 2792 wrote to memory of 2800 2792 3xxfrrx.exe fxllrrf.exe PID 2792 wrote to memory of 2800 2792 3xxfrrx.exe fxllrrf.exe PID 2800 wrote to memory of 820 2800 fxllrrf.exe jjjjp.exe PID 2800 wrote to memory of 820 2800 fxllrrf.exe jjjjp.exe PID 2800 wrote to memory of 820 2800 fxllrrf.exe jjjjp.exe PID 2800 wrote to memory of 820 2800 fxllrrf.exe jjjjp.exe PID 820 wrote to memory of 2396 820 jjjjp.exe frrxrrf.exe PID 820 wrote to memory of 2396 820 jjjjp.exe frrxrrf.exe PID 820 wrote to memory of 2396 820 jjjjp.exe frrxrrf.exe PID 820 wrote to memory of 2396 820 jjjjp.exe frrxrrf.exe PID 2396 wrote to memory of 2388 2396 frrxrrf.exe hbttbh.exe PID 2396 wrote to memory of 2388 2396 frrxrrf.exe hbttbh.exe PID 2396 wrote to memory of 2388 2396 frrxrrf.exe hbttbh.exe PID 2396 wrote to memory of 2388 2396 frrxrrf.exe hbttbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a4323961f72bbc9a6741277656f5dc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3a4323961f72bbc9a6741277656f5dc0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\tnbtbb.exec:\tnbtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\nnnbhn.exec:\nnnbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jvjpd.exec:\jvjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nbtthn.exec:\nbtthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\dvddp.exec:\dvddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\rfxxffl.exec:\rfxxffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\3ttthn.exec:\3ttthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\jjdpd.exec:\jjdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\llffllr.exec:\llffllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\tnbntb.exec:\tnbntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jvjdv.exec:\jvjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\3xxfrrx.exec:\3xxfrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\fxllrrf.exec:\fxllrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jjjjp.exec:\jjjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\frrxrrf.exec:\frrxrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\hbttbh.exec:\hbttbh.exe17⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pddvd.exec:\pddvd.exe18⤵
- Executes dropped EXE
PID:2384 -
\??\c:\3fxxllx.exec:\3fxxllx.exe19⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jdvjv.exec:\jdvjv.exe20⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7fxlfrl.exec:\7fxlfrl.exe21⤵
- Executes dropped EXE
PID:536 -
\??\c:\hbnbht.exec:\hbnbht.exe22⤵
- Executes dropped EXE
PID:1424 -
\??\c:\5vpvp.exec:\5vpvp.exe23⤵
- Executes dropped EXE
PID:808 -
\??\c:\rlxxffl.exec:\rlxxffl.exe24⤵
- Executes dropped EXE
PID:1116 -
\??\c:\tnbnnn.exec:\tnbnnn.exe25⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jpvvv.exec:\jpvvv.exe26⤵
- Executes dropped EXE
PID:1076 -
\??\c:\xfrxlrx.exec:\xfrxlrx.exe27⤵
- Executes dropped EXE
PID:1212 -
\??\c:\bthnnt.exec:\bthnnt.exe28⤵
- Executes dropped EXE
PID:2164 -
\??\c:\pjdpv.exec:\pjdpv.exe29⤵
- Executes dropped EXE
PID:1856 -
\??\c:\fxllrxl.exec:\fxllrxl.exe30⤵
- Executes dropped EXE
PID:372 -
\??\c:\thnhhb.exec:\thnhhb.exe31⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vjppj.exec:\vjppj.exe32⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fxfrrlf.exec:\fxfrrlf.exe33⤵
- Executes dropped EXE
PID:2444 -
\??\c:\5btthn.exec:\5btthn.exe34⤵
- Executes dropped EXE
PID:2224 -
\??\c:\9pdpv.exec:\9pdpv.exe35⤵
- Executes dropped EXE
PID:880 -
\??\c:\pjddj.exec:\pjddj.exe36⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rllfxrl.exec:\rllfxrl.exe37⤵
- Executes dropped EXE
PID:1524 -
\??\c:\thttbh.exec:\thttbh.exe38⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jdppp.exec:\jdppp.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\7pjpd.exec:\7pjpd.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\xxrrfrf.exec:\xxrrfrf.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\bbtbtt.exec:\bbtbtt.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5pvpp.exec:\5pvpp.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jdvjd.exec:\jdvjd.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fxllxrf.exec:\fxllxrf.exe45⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hhbtht.exec:\hhbtht.exe46⤵
- Executes dropped EXE
PID:2500 -
\??\c:\vvpvj.exec:\vvpvj.exe47⤵
- Executes dropped EXE
PID:2560 -
\??\c:\fxrlxlx.exec:\fxrlxlx.exe48⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xlxxllx.exec:\xlxxllx.exe49⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nhbbnt.exec:\nhbbnt.exe50⤵
- Executes dropped EXE
PID:1604 -
\??\c:\nnhbht.exec:\nnhbht.exe51⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vvpvp.exec:\vvpvp.exe52⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rlffxxf.exec:\rlffxxf.exe53⤵
- Executes dropped EXE
PID:1936 -
\??\c:\3tntht.exec:\3tntht.exe54⤵
- Executes dropped EXE
PID:1268 -
\??\c:\1hbbhb.exec:\1hbbhb.exe55⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jdjvd.exec:\jdjvd.exe56⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1lxlrlx.exec:\1lxlrlx.exe57⤵
- Executes dropped EXE
PID:276 -
\??\c:\nnbnbh.exec:\nnbnbh.exe58⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hhnhnn.exec:\hhnhnn.exe59⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pdpdp.exec:\pdpdp.exe60⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9jjvj.exec:\9jjvj.exe61⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lflrffr.exec:\lflrffr.exe62⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hbnthb.exec:\hbnthb.exe63⤵
- Executes dropped EXE
PID:484 -
\??\c:\dpjdd.exec:\dpjdd.exe64⤵
- Executes dropped EXE
PID:1408 -
\??\c:\llfxlxl.exec:\llfxlxl.exe65⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7frfrrf.exec:\7frfrrf.exe66⤵PID:1672
-
\??\c:\nnntbh.exec:\nnntbh.exe67⤵PID:640
-
\??\c:\vvdjj.exec:\vvdjj.exe68⤵PID:1168
-
\??\c:\jppvv.exec:\jppvv.exe69⤵PID:444
-
\??\c:\lfxrffl.exec:\lfxrffl.exe70⤵PID:1760
-
\??\c:\bbbhtb.exec:\bbbhtb.exe71⤵PID:1704
-
\??\c:\9bbhnn.exec:\9bbhnn.exe72⤵PID:1212
-
\??\c:\dvppj.exec:\dvppj.exe73⤵PID:300
-
\??\c:\7rrxllr.exec:\7rrxllr.exe74⤵PID:1988
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe75⤵PID:612
-
\??\c:\5hhtth.exec:\5hhtth.exe76⤵PID:2956
-
\??\c:\1jvjv.exec:\1jvjv.exe77⤵PID:1692
-
\??\c:\1xxrlxl.exec:\1xxrlxl.exe78⤵PID:1908
-
\??\c:\llxfrxr.exec:\llxfrxr.exe79⤵PID:2056
-
\??\c:\7tttnb.exec:\7tttnb.exe80⤵PID:2016
-
\??\c:\ppddv.exec:\ppddv.exe81⤵PID:1904
-
\??\c:\dvpdp.exec:\dvpdp.exe82⤵PID:1992
-
\??\c:\lllfllf.exec:\lllfllf.exe83⤵PID:1504
-
\??\c:\nhthnt.exec:\nhthnt.exe84⤵PID:3004
-
\??\c:\pvdpp.exec:\pvdpp.exe85⤵PID:2032
-
\??\c:\jdvdv.exec:\jdvdv.exe86⤵PID:2692
-
\??\c:\fxrfffl.exec:\fxrfffl.exe87⤵PID:2608
-
\??\c:\1btntt.exec:\1btntt.exe88⤵PID:2736
-
\??\c:\3pvvp.exec:\3pvvp.exe89⤵PID:2724
-
\??\c:\pddjd.exec:\pddjd.exe90⤵PID:2596
-
\??\c:\llxrrxf.exec:\llxrrxf.exe91⤵PID:2496
-
\??\c:\1nnhhb.exec:\1nnhhb.exe92⤵PID:2480
-
\??\c:\djpjv.exec:\djpjv.exe93⤵PID:2308
-
\??\c:\ddjvp.exec:\ddjvp.exe94⤵PID:1656
-
\??\c:\xrffllx.exec:\xrffllx.exe95⤵PID:2128
-
\??\c:\bttbtb.exec:\bttbtb.exe96⤵PID:1560
-
\??\c:\9hnbtn.exec:\9hnbtn.exe97⤵PID:2456
-
\??\c:\ppjvj.exec:\ppjvj.exe98⤵PID:1740
-
\??\c:\xxxlxrf.exec:\xxxlxrf.exe99⤵PID:2792
-
\??\c:\7rrfllx.exec:\7rrfllx.exe100⤵PID:1936
-
\??\c:\9nbbnb.exec:\9nbbnb.exe101⤵PID:348
-
\??\c:\vvppd.exec:\vvppd.exe102⤵PID:1924
-
\??\c:\dddjv.exec:\dddjv.exe103⤵PID:2808
-
\??\c:\3fxxlrl.exec:\3fxxlrl.exe104⤵PID:2820
-
\??\c:\bbtnhn.exec:\bbtnhn.exe105⤵PID:860
-
\??\c:\nhbnnb.exec:\nhbnnb.exe106⤵PID:2228
-
\??\c:\pppdp.exec:\pppdp.exe107⤵PID:2384
-
\??\c:\ppvpv.exec:\ppvpv.exe108⤵PID:2464
-
\??\c:\7lxlrff.exec:\7lxlrff.exe109⤵PID:772
-
\??\c:\btthth.exec:\btthth.exe110⤵PID:596
-
\??\c:\1tnntb.exec:\1tnntb.exe111⤵PID:592
-
\??\c:\3dpjj.exec:\3dpjj.exe112⤵PID:2880
-
\??\c:\pjpdv.exec:\pjpdv.exe113⤵PID:2168
-
\??\c:\rrxflxx.exec:\rrxflxx.exe114⤵PID:2996
-
\??\c:\1nhhtt.exec:\1nhhtt.exe115⤵PID:3028
-
\??\c:\7pjjv.exec:\7pjjv.exe116⤵PID:2104
-
\??\c:\jvpvd.exec:\jvpvd.exe117⤵PID:1724
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe118⤵PID:1568
-
\??\c:\7btttt.exec:\7btttt.exe119⤵PID:1752
-
\??\c:\nhbntb.exec:\nhbntb.exe120⤵PID:1184
-
\??\c:\3vjjp.exec:\3vjjp.exe121⤵PID:1748
-
\??\c:\1xrfrxr.exec:\1xrfrxr.exe122⤵PID:1984
-
\??\c:\3xxfffl.exec:\3xxfffl.exe123⤵PID:784
-
\??\c:\3btbnb.exec:\3btbnb.exe124⤵PID:1912
-
\??\c:\bbttbh.exec:\bbttbh.exe125⤵PID:1836
-
\??\c:\9ddvj.exec:\9ddvj.exe126⤵PID:2224
-
\??\c:\vppjp.exec:\vppjp.exe127⤵PID:1540
-
\??\c:\rllxrfl.exec:\rllxrfl.exe128⤵PID:2260
-
\??\c:\3nnnhh.exec:\3nnnhh.exe129⤵PID:1992
-
\??\c:\3pjvj.exec:\3pjvj.exe130⤵PID:1216
-
\??\c:\7ddpd.exec:\7ddpd.exe131⤵PID:2860
-
\??\c:\fxrlrxl.exec:\fxrlrxl.exe132⤵PID:2680
-
\??\c:\hthnhh.exec:\hthnhh.exe133⤵PID:1108
-
\??\c:\tnbhbn.exec:\tnbhbn.exe134⤵PID:2752
-
\??\c:\3vpdj.exec:\3vpdj.exe135⤵PID:2848
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe136⤵PID:2492
-
\??\c:\xrflrrf.exec:\xrflrrf.exe137⤵PID:2824
-
\??\c:\btbbhn.exec:\btbbhn.exe138⤵PID:3016
-
\??\c:\9hbnnt.exec:\9hbnnt.exe139⤵PID:2944
-
\??\c:\1dppv.exec:\1dppv.exe140⤵PID:2604
-
\??\c:\5tbnth.exec:\5tbnth.exe141⤵PID:1656
-
\??\c:\ppjpd.exec:\ppjpd.exe142⤵PID:1604
-
\??\c:\9rllllr.exec:\9rllllr.exe143⤵PID:1560
-
\??\c:\btnthh.exec:\btnthh.exe144⤵PID:2780
-
\??\c:\9ddvv.exec:\9ddvv.exe145⤵PID:1556
-
\??\c:\ddpdd.exec:\ddpdd.exe146⤵PID:1800
-
\??\c:\xfxllxx.exec:\xfxllxx.exe147⤵PID:316
-
\??\c:\hhtthn.exec:\hhtthn.exe148⤵PID:1712
-
\??\c:\bttnnn.exec:\bttnnn.exe149⤵PID:2288
-
\??\c:\pjjvd.exec:\pjjvd.exe150⤵PID:760
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe151⤵PID:2000
-
\??\c:\ffrxrrf.exec:\ffrxrrf.exe152⤵PID:2868
-
\??\c:\ttbhhb.exec:\ttbhhb.exe153⤵PID:2252
-
\??\c:\7jvdd.exec:\7jvdd.exe154⤵PID:2232
-
\??\c:\dvjjp.exec:\dvjjp.exe155⤵PID:572
-
\??\c:\xrflxlx.exec:\xrflxlx.exe156⤵PID:2864
-
\??\c:\bhtbtn.exec:\bhtbtn.exe157⤵PID:1848
-
\??\c:\tthhnn.exec:\tthhnn.exe158⤵PID:2448
-
\??\c:\9vdpd.exec:\9vdpd.exe159⤵PID:808
-
\??\c:\rrrxllx.exec:\rrrxllx.exe160⤵PID:1128
-
\??\c:\llflxlf.exec:\llflxlf.exe161⤵PID:832
-
\??\c:\nhbhtb.exec:\nhbhtb.exe162⤵PID:1276
-
\??\c:\vpdjv.exec:\vpdjv.exe163⤵PID:1208
-
\??\c:\vvpdd.exec:\vvpdd.exe164⤵PID:948
-
\??\c:\3ffrrrx.exec:\3ffrrrx.exe165⤵PID:896
-
\??\c:\tttbht.exec:\tttbht.exe166⤵PID:1856
-
\??\c:\9tnbnt.exec:\9tnbnt.exe167⤵PID:2216
-
\??\c:\ddvdp.exec:\ddvdp.exe168⤵PID:1016
-
\??\c:\fxffllx.exec:\fxffllx.exe169⤵PID:1316
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe170⤵PID:1852
-
\??\c:\hhbnnt.exec:\hhbnnt.exe171⤵PID:1432
-
\??\c:\dpjvj.exec:\dpjvj.exe172⤵PID:1976
-
\??\c:\fffrflx.exec:\fffrflx.exe173⤵PID:2204
-
\??\c:\fllflfl.exec:\fllflfl.exe174⤵PID:1676
-
\??\c:\tnhnbn.exec:\tnhnbn.exe175⤵PID:2624
-
\??\c:\jdvjj.exec:\jdvjj.exe176⤵PID:2592
-
\??\c:\7vvdd.exec:\7vvdd.exe177⤵PID:2684
-
\??\c:\7lflflr.exec:\7lflflr.exe178⤵PID:2588
-
\??\c:\btbthh.exec:\btbthh.exe179⤵PID:3056
-
\??\c:\bbnbnt.exec:\bbnbnt.exe180⤵PID:2508
-
\??\c:\pdpvj.exec:\pdpvj.exe181⤵PID:2600
-
\??\c:\7llfxfr.exec:\7llfxfr.exe182⤵PID:2848
-
\??\c:\lflrfrx.exec:\lflrfrx.exe183⤵PID:2492
-
\??\c:\nhbbnn.exec:\nhbbnn.exe184⤵PID:2332
-
\??\c:\dppdv.exec:\dppdv.exe185⤵PID:2560
-
\??\c:\dvjpd.exec:\dvjpd.exe186⤵PID:1596
-
\??\c:\rfllrll.exec:\rfllrll.exe187⤵PID:2604
-
\??\c:\ffxrlrf.exec:\ffxrlrf.exe188⤵PID:2728
-
\??\c:\3nhbnb.exec:\3nhbnb.exe189⤵PID:2172
-
\??\c:\1pvvd.exec:\1pvvd.exe190⤵PID:1472
-
\??\c:\pjvjv.exec:\pjvjv.exe191⤵PID:2552
-
\??\c:\fxrfxrf.exec:\fxrfxrf.exe192⤵PID:2572
-
\??\c:\1hhnhh.exec:\1hhnhh.exe193⤵PID:1548
-
\??\c:\bbhtbh.exec:\bbhtbh.exe194⤵PID:900
-
\??\c:\ddddj.exec:\ddddj.exe195⤵PID:2404
-
\??\c:\ppjvd.exec:\ppjvd.exe196⤵PID:1944
-
\??\c:\ffffrfx.exec:\ffffrfx.exe197⤵PID:804
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe198⤵PID:760
-
\??\c:\9nnthh.exec:\9nnthh.exe199⤵PID:1900
-
\??\c:\dvjpp.exec:\dvjpp.exe200⤵PID:2428
-
\??\c:\vvpvp.exec:\vvpvp.exe201⤵PID:780
-
\??\c:\5fxflxr.exec:\5fxflxr.exe202⤵PID:872
-
\??\c:\nnnnbt.exec:\nnnnbt.exe203⤵PID:1412
-
\??\c:\bbbhhh.exec:\bbbhhh.exe204⤵PID:1036
-
\??\c:\pjddj.exec:\pjddj.exe205⤵PID:1764
-
\??\c:\3dvdj.exec:\3dvdj.exe206⤵PID:3032
-
\??\c:\rrlflrf.exec:\rrlflrf.exe207⤵PID:3000
-
\??\c:\bhntnh.exec:\bhntnh.exe208⤵PID:2996
-
\??\c:\3bnthb.exec:\3bnthb.exe209⤵PID:1680
-
\??\c:\jpddj.exec:\jpddj.exe210⤵PID:2116
-
\??\c:\lrxrxrr.exec:\lrxrxrr.exe211⤵PID:1276
-
\??\c:\llfrrff.exec:\llfrrff.exe212⤵PID:1568
-
\??\c:\btnntb.exec:\btnntb.exe213⤵PID:300
-
\??\c:\5hnthn.exec:\5hnthn.exe214⤵PID:896
-
\??\c:\dvpjd.exec:\dvpjd.exe215⤵PID:1856
-
\??\c:\lrxxfrf.exec:\lrxxfrf.exe216⤵PID:612
-
\??\c:\ttnntb.exec:\ttnntb.exe217⤵PID:1016
-
\??\c:\3ttnhn.exec:\3ttnhn.exe218⤵PID:1316
-
\??\c:\pvjpd.exec:\pvjpd.exe219⤵PID:2264
-
\??\c:\7vjvj.exec:\7vjvj.exe220⤵PID:1100
-
\??\c:\9xrfflr.exec:\9xrfflr.exe221⤵PID:1976
-
\??\c:\tnbnht.exec:\tnbnht.exe222⤵PID:1668
-
\??\c:\5hbnhn.exec:\5hbnhn.exe223⤵PID:1676
-
\??\c:\7jpvj.exec:\7jpvj.exe224⤵PID:3004
-
\??\c:\rlffffr.exec:\rlffffr.exe225⤵PID:2708
-
\??\c:\3frxffr.exec:\3frxffr.exe226⤵PID:2640
-
\??\c:\nbnttt.exec:\nbnttt.exe227⤵PID:2336
-
\??\c:\7hbhtt.exec:\7hbhtt.exe228⤵PID:2756
-
\??\c:\djpdj.exec:\djpdj.exe229⤵PID:2528
-
\??\c:\rlxxxlr.exec:\rlxxxlr.exe230⤵PID:2760
-
\??\c:\fxfffxf.exec:\fxfffxf.exe231⤵PID:2620
-
\??\c:\bhhttn.exec:\bhhttn.exe232⤵PID:2824
-
\??\c:\bthnhb.exec:\bthnhb.exe233⤵PID:2480
-
\??\c:\7vpdd.exec:\7vpdd.exe234⤵PID:2044
-
\??\c:\xxrxxfl.exec:\xxrxxfl.exe235⤵PID:1804
-
\??\c:\9rflxxx.exec:\9rflxxx.exe236⤵PID:1508
-
\??\c:\7bnbth.exec:\7bnbth.exe237⤵PID:2408
-
\??\c:\jdjjp.exec:\jdjjp.exe238⤵PID:1660
-
\??\c:\7vjpv.exec:\7vjpv.exe239⤵PID:1684
-
\??\c:\5rllxxx.exec:\5rllxxx.exe240⤵PID:236
-
\??\c:\bhnhhb.exec:\bhnhhb.exe241⤵PID:1232
-
\??\c:\bbtbnt.exec:\bbtbnt.exe242⤵PID:2136