Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 04:36
Behavioral task
behavioral1
Sample
753bd48781b42cea6614f8b73454c820_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
753bd48781b42cea6614f8b73454c820_NeikiAnalytics.exe
-
Size
320KB
-
MD5
753bd48781b42cea6614f8b73454c820
-
SHA1
0c944cbe24ee222a9baea1a36b9df329faf81264
-
SHA256
b9beae4dec64849f9cce65ec6810aeedb3c1d9a1a8e413a675d9173addf13569
-
SHA512
25bb1b8b2de248e9459e3a049de932ecc5dc27885553e35584499ad891b6f77d8918eae26d3f7a4debae0650807c8bdd4f8a3b66e6c1a1dbc35113bf2c1fbb02
-
SSDEEP
6144:9cm4FmowdHoSZrv9AEa3F2Y9iE9mJrtMsQBcqNLq3x5:/4wFHoSB969P9mJRMsfqV2r
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/2056-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2704-21-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1240-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2612-31-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2740-40-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2828-56-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2796-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2516-75-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2500-85-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2456-111-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2776-121-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2164-129-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1952-139-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/288-147-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2068-188-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2652-197-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1468-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1480-209-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1856-258-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2452-267-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/708-276-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1732-299-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2056-312-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2632-356-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2636-369-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2940-395-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/760-396-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2788-410-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1312-437-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1548-462-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2240-476-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/936-491-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/692-517-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2100-624-0x0000000000250000-0x0000000000286000-memory.dmp family_blackmoon behavioral1/memory/2964-663-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2772-688-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2772-695-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/3024-747-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2296-767-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\3rflrxl.exe family_berbew \??\c:\7htbhn.exe family_berbew C:\pjdvd.exe family_berbew \??\c:\nhbhnb.exe family_berbew behavioral1/memory/2740-46-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew C:\pdjvj.exe family_berbew C:\7lxfllr.exe family_berbew C:\5jvdj.exe family_berbew C:\7lflrlr.exe family_berbew C:\pdpvj.exe family_berbew C:\fllrfrr.exe family_berbew C:\nbnnht.exe family_berbew C:\vvdpd.exe family_berbew C:\hthtbh.exe family_berbew C:\vpvvd.exe family_berbew C:\fxrfllx.exe family_berbew C:\dvvjv.exe family_berbew C:\lffxrfx.exe family_berbew C:\hnnbht.exe family_berbew C:\llxfrrf.exe family_berbew C:\rrlxxxl.exe family_berbew C:\ddvpd.exe family_berbew C:\lfxllrl.exe family_berbew C:\tbnnnb.exe family_berbew C:\jdppv.exe family_berbew C:\nbtbhh.exe family_berbew C:\hhhhbn.exe family_berbew C:\xrxlxfr.exe family_berbew C:\nbnbnb.exe family_berbew C:\lfxfllx.exe family_berbew \??\c:\fxlllrx.exe family_berbew C:\vjvvd.exe family_berbew C:\btnnnn.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
3rflrxl.exe7htbhn.exepjdvd.exenhbhnb.exepdjvj.exe7lxfllr.exe5jvdj.exe7lflrlr.exepdpvj.exefllrfrr.exenbnnht.exevvdpd.exehthtbh.exevpvvd.exefxrfllx.exedvvjv.exelffxrfx.exehnnbht.exellxfrrf.exerrlxxxl.exeddvpd.exelfxllrl.exetbnnnb.exejdppv.exenbtbhh.exehhhhbn.exexrxlxfr.exenbnbnb.exelfxfllx.exefxlllrx.exevjvvd.exebtnnnn.exejjppd.exexrllrxf.exettnbhn.exennbhbb.exe9pjjp.exelfxxlrf.exe9llxllx.exebbnbnt.exe9jpjd.exefxxfllx.exe5xlfrfr.exetnhhtt.exe7pjpj.exe9dpvd.exexrxfxlr.exe9htntb.exennhhtt.exe1ddjd.exerrxrlrx.exexxllxxf.exehbntbh.exepdppp.exexrlrxxl.exefllfxfx.exetnbntb.exedjpvv.exe5vpjv.exexrllxxf.exetnhhth.exettnhbh.exevpjvd.exexrlxffx.exepid process 1240 3rflrxl.exe 2704 7htbhn.exe 2612 pjdvd.exe 2740 nhbhnb.exe 2828 pdjvj.exe 2796 7lxfllr.exe 2516 5jvdj.exe 2500 7lflrlr.exe 2916 pdpvj.exe 1040 fllrfrr.exe 2456 nbnnht.exe 2776 vvdpd.exe 2164 hthtbh.exe 1952 vpvvd.exe 288 fxrfllx.exe 304 dvvjv.exe 268 lffxrfx.exe 2244 hnnbht.exe 2564 llxfrrf.exe 2068 rrlxxxl.exe 2652 ddvpd.exe 1468 lfxllrl.exe 1480 tbnnnb.exe 2300 jdppv.exe 2284 nbtbhh.exe 668 hhhhbn.exe 1088 xrxlxfr.exe 1856 nbnbnb.exe 2452 lfxfllx.exe 708 fxlllrx.exe 1252 vjvvd.exe 1960 btnnnn.exe 864 jjppd.exe 1732 xrllrxf.exe 2056 ttnbhn.exe 1544 nnbhbb.exe 1740 9pjjp.exe 2100 lfxxlrf.exe 2628 9llxllx.exe 2724 bbnbnt.exe 2688 9jpjd.exe 2632 fxxfllx.exe 2828 5xlfrfr.exe 2636 tnhhtt.exe 2472 7pjpj.exe 2544 9dpvd.exe 3040 xrxfxlr.exe 2940 9htntb.exe 760 nnhhtt.exe 2752 1ddjd.exe 2788 rrxrlrx.exe 2804 xxllxxf.exe 2016 hbntbh.exe 1312 pdppp.exe 2184 xrlrxxl.exe 1788 fllfxfx.exe 1676 tnbntb.exe 1548 djpvv.exe 1388 5vpjv.exe 2848 xrllxxf.exe 2240 tnhhth.exe 2208 ttnhbh.exe 936 vpjvd.exe 3064 xrlxffx.exe -
Processes:
resource yara_rule behavioral1/memory/2056-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1240-10-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\3rflrxl.exe upx behavioral1/memory/2056-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2704-21-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7htbhn.exe upx behavioral1/memory/1240-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2704-23-0x0000000000220000-0x0000000000256000-memory.dmp upx C:\pjdvd.exe upx behavioral1/memory/2612-31-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2740-40-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\nhbhnb.exe upx behavioral1/memory/2740-46-0x0000000000220000-0x0000000000256000-memory.dmp upx C:\pdjvj.exe upx behavioral1/memory/2828-56-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\7lxfllr.exe upx C:\5jvdj.exe upx behavioral1/memory/2796-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2516-67-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2516-75-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\7lflrlr.exe upx C:\pdpvj.exe upx C:\fllrfrr.exe upx C:\nbnnht.exe upx behavioral1/memory/2456-111-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vvdpd.exe upx behavioral1/memory/2776-121-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hthtbh.exe upx C:\vpvvd.exe upx behavioral1/memory/2164-129-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1952-139-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxrfllx.exe upx behavioral1/memory/288-147-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dvvjv.exe upx C:\lffxrfx.exe upx C:\hnnbht.exe upx C:\llxfrrf.exe upx C:\rrlxxxl.exe upx C:\ddvpd.exe upx behavioral1/memory/2068-188-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\lfxllrl.exe upx behavioral1/memory/2652-197-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1468-206-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tbnnnb.exe upx behavioral1/memory/1480-209-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jdppv.exe upx C:\nbtbhh.exe upx C:\hhhhbn.exe upx C:\xrxlxfr.exe upx C:\nbnbnb.exe upx C:\lfxfllx.exe upx behavioral1/memory/1856-258-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\fxlllrx.exe upx behavioral1/memory/2452-267-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/708-276-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vjvvd.exe upx C:\btnnnn.exe upx behavioral1/memory/1732-299-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2056-312-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2632-356-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/memory/2636-369-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2940-388-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2940-395-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/760-396-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
753bd48781b42cea6614f8b73454c820_NeikiAnalytics.exe3rflrxl.exe7htbhn.exepjdvd.exenhbhnb.exepdjvj.exe7lxfllr.exe5jvdj.exe7lflrlr.exepdpvj.exefllrfrr.exenbnnht.exevvdpd.exehthtbh.exevpvvd.exefxrfllx.exedescription pid process target process PID 2056 wrote to memory of 1240 2056 753bd48781b42cea6614f8b73454c820_NeikiAnalytics.exe 3rflrxl.exe PID 2056 wrote to memory of 1240 2056 753bd48781b42cea6614f8b73454c820_NeikiAnalytics.exe 3rflrxl.exe PID 2056 wrote to memory of 1240 2056 753bd48781b42cea6614f8b73454c820_NeikiAnalytics.exe 3rflrxl.exe PID 2056 wrote to memory of 1240 2056 753bd48781b42cea6614f8b73454c820_NeikiAnalytics.exe 3rflrxl.exe PID 1240 wrote to memory of 2704 1240 3rflrxl.exe 7htbhn.exe PID 1240 wrote to memory of 2704 1240 3rflrxl.exe 7htbhn.exe PID 1240 wrote to memory of 2704 1240 3rflrxl.exe 7htbhn.exe PID 1240 wrote to memory of 2704 1240 3rflrxl.exe 7htbhn.exe PID 2704 wrote to memory of 2612 2704 7htbhn.exe pjdvd.exe PID 2704 wrote to memory of 2612 2704 7htbhn.exe pjdvd.exe PID 2704 wrote to memory of 2612 2704 7htbhn.exe pjdvd.exe PID 2704 wrote to memory of 2612 2704 7htbhn.exe pjdvd.exe PID 2612 wrote to memory of 2740 2612 pjdvd.exe nhbhnb.exe PID 2612 wrote to memory of 2740 2612 pjdvd.exe nhbhnb.exe PID 2612 wrote to memory of 2740 2612 pjdvd.exe nhbhnb.exe PID 2612 wrote to memory of 2740 2612 pjdvd.exe nhbhnb.exe PID 2740 wrote to memory of 2828 2740 nhbhnb.exe pdjvj.exe PID 2740 wrote to memory of 2828 2740 nhbhnb.exe pdjvj.exe PID 2740 wrote to memory of 2828 2740 nhbhnb.exe pdjvj.exe PID 2740 wrote to memory of 2828 2740 nhbhnb.exe pdjvj.exe PID 2828 wrote to memory of 2796 2828 pdjvj.exe 7lxfllr.exe PID 2828 wrote to memory of 2796 2828 pdjvj.exe 7lxfllr.exe PID 2828 wrote to memory of 2796 2828 pdjvj.exe 7lxfllr.exe PID 2828 wrote to memory of 2796 2828 pdjvj.exe 7lxfllr.exe PID 2796 wrote to memory of 2516 2796 7lxfllr.exe 5jvdj.exe PID 2796 wrote to memory of 2516 2796 7lxfllr.exe 5jvdj.exe PID 2796 wrote to memory of 2516 2796 7lxfllr.exe 5jvdj.exe PID 2796 wrote to memory of 2516 2796 7lxfllr.exe 5jvdj.exe PID 2516 wrote to memory of 2500 2516 5jvdj.exe 7lflrlr.exe PID 2516 wrote to memory of 2500 2516 5jvdj.exe 7lflrlr.exe PID 2516 wrote to memory of 2500 2516 5jvdj.exe 7lflrlr.exe PID 2516 wrote to memory of 2500 2516 5jvdj.exe 7lflrlr.exe PID 2500 wrote to memory of 2916 2500 7lflrlr.exe pdpvj.exe PID 2500 wrote to memory of 2916 2500 7lflrlr.exe pdpvj.exe PID 2500 wrote to memory of 2916 2500 7lflrlr.exe pdpvj.exe PID 2500 wrote to memory of 2916 2500 7lflrlr.exe pdpvj.exe PID 2916 wrote to memory of 1040 2916 pdpvj.exe fllrfrr.exe PID 2916 wrote to memory of 1040 2916 pdpvj.exe fllrfrr.exe PID 2916 wrote to memory of 1040 2916 pdpvj.exe fllrfrr.exe PID 2916 wrote to memory of 1040 2916 pdpvj.exe fllrfrr.exe PID 1040 wrote to memory of 2456 1040 fllrfrr.exe nbnnht.exe PID 1040 wrote to memory of 2456 1040 fllrfrr.exe nbnnht.exe PID 1040 wrote to memory of 2456 1040 fllrfrr.exe nbnnht.exe PID 1040 wrote to memory of 2456 1040 fllrfrr.exe nbnnht.exe PID 2456 wrote to memory of 2776 2456 nbnnht.exe vvdpd.exe PID 2456 wrote to memory of 2776 2456 nbnnht.exe vvdpd.exe PID 2456 wrote to memory of 2776 2456 nbnnht.exe vvdpd.exe PID 2456 wrote to memory of 2776 2456 nbnnht.exe vvdpd.exe PID 2776 wrote to memory of 2164 2776 vvdpd.exe hthtbh.exe PID 2776 wrote to memory of 2164 2776 vvdpd.exe hthtbh.exe PID 2776 wrote to memory of 2164 2776 vvdpd.exe hthtbh.exe PID 2776 wrote to memory of 2164 2776 vvdpd.exe hthtbh.exe PID 2164 wrote to memory of 1952 2164 hthtbh.exe vpvvd.exe PID 2164 wrote to memory of 1952 2164 hthtbh.exe vpvvd.exe PID 2164 wrote to memory of 1952 2164 hthtbh.exe vpvvd.exe PID 2164 wrote to memory of 1952 2164 hthtbh.exe vpvvd.exe PID 1952 wrote to memory of 288 1952 vpvvd.exe fxrfllx.exe PID 1952 wrote to memory of 288 1952 vpvvd.exe fxrfllx.exe PID 1952 wrote to memory of 288 1952 vpvvd.exe fxrfllx.exe PID 1952 wrote to memory of 288 1952 vpvvd.exe fxrfllx.exe PID 288 wrote to memory of 304 288 fxrfllx.exe dvvjv.exe PID 288 wrote to memory of 304 288 fxrfllx.exe dvvjv.exe PID 288 wrote to memory of 304 288 fxrfllx.exe dvvjv.exe PID 288 wrote to memory of 304 288 fxrfllx.exe dvvjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\753bd48781b42cea6614f8b73454c820_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\753bd48781b42cea6614f8b73454c820_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\3rflrxl.exec:\3rflrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\7htbhn.exec:\7htbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\pjdvd.exec:\pjdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nhbhnb.exec:\nhbhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pdjvj.exec:\pdjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\7lxfllr.exec:\7lxfllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\5jvdj.exec:\5jvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\7lflrlr.exec:\7lflrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\pdpvj.exec:\pdpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\fllrfrr.exec:\fllrfrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\nbnnht.exec:\nbnnht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\vvdpd.exec:\vvdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\hthtbh.exec:\hthtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\vpvvd.exec:\vpvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\fxrfllx.exec:\fxrfllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\dvvjv.exec:\dvvjv.exe17⤵
- Executes dropped EXE
PID:304 -
\??\c:\lffxrfx.exec:\lffxrfx.exe18⤵
- Executes dropped EXE
PID:268 -
\??\c:\hnnbht.exec:\hnnbht.exe19⤵
- Executes dropped EXE
PID:2244 -
\??\c:\llxfrrf.exec:\llxfrrf.exe20⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rrlxxxl.exec:\rrlxxxl.exe21⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ddvpd.exec:\ddvpd.exe22⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lfxllrl.exec:\lfxllrl.exe23⤵
- Executes dropped EXE
PID:1468 -
\??\c:\tbnnnb.exec:\tbnnnb.exe24⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jdppv.exec:\jdppv.exe25⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nbtbhh.exec:\nbtbhh.exe26⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hhhhbn.exec:\hhhhbn.exe27⤵
- Executes dropped EXE
PID:668 -
\??\c:\xrxlxfr.exec:\xrxlxfr.exe28⤵
- Executes dropped EXE
PID:1088 -
\??\c:\nbnbnb.exec:\nbnbnb.exe29⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lfxfllx.exec:\lfxfllx.exe30⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fxlllrx.exec:\fxlllrx.exe31⤵
- Executes dropped EXE
PID:708 -
\??\c:\vjvvd.exec:\vjvvd.exe32⤵
- Executes dropped EXE
PID:1252 -
\??\c:\btnnnn.exec:\btnnnn.exe33⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jjppd.exec:\jjppd.exe34⤵
- Executes dropped EXE
PID:864 -
\??\c:\xrllrxf.exec:\xrllrxf.exe35⤵
- Executes dropped EXE
PID:1732 -
\??\c:\ttnbhn.exec:\ttnbhn.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nnbhbb.exec:\nnbhbb.exe37⤵
- Executes dropped EXE
PID:1544 -
\??\c:\9pjjp.exec:\9pjjp.exe38⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe39⤵
- Executes dropped EXE
PID:2100 -
\??\c:\9llxllx.exec:\9llxllx.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bbnbnt.exec:\bbnbnt.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9jpjd.exec:\9jpjd.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxxfllx.exec:\fxxfllx.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5xlfrfr.exec:\5xlfrfr.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tnhhtt.exec:\tnhhtt.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\7pjpj.exec:\7pjpj.exe46⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9dpvd.exec:\9dpvd.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xrxfxlr.exec:\xrxfxlr.exe48⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9htntb.exec:\9htntb.exe49⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nnhhtt.exec:\nnhhtt.exe50⤵
- Executes dropped EXE
PID:760 -
\??\c:\1ddjd.exec:\1ddjd.exe51⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rrxrlrx.exec:\rrxrlrx.exe52⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xxllxxf.exec:\xxllxxf.exe53⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hbntbh.exec:\hbntbh.exe54⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pdppp.exec:\pdppp.exe55⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe56⤵
- Executes dropped EXE
PID:2184 -
\??\c:\fllfxfx.exec:\fllfxfx.exe57⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tnbntb.exec:\tnbntb.exe58⤵
- Executes dropped EXE
PID:1676 -
\??\c:\djpvv.exec:\djpvv.exe59⤵
- Executes dropped EXE
PID:1548 -
\??\c:\5vpjv.exec:\5vpjv.exe60⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xrllxxf.exec:\xrllxxf.exe61⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tnhhth.exec:\tnhhth.exe62⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ttnhbh.exec:\ttnhbh.exe63⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vpjvd.exec:\vpjvd.exe64⤵
- Executes dropped EXE
PID:936 -
\??\c:\xrlxffx.exec:\xrlxffx.exe65⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tnbhnn.exec:\tnbhnn.exe66⤵PID:1848
-
\??\c:\hthhtb.exec:\hthhtb.exe67⤵PID:1748
-
\??\c:\1ppvv.exec:\1ppvv.exe68⤵PID:692
-
\??\c:\5frflxl.exec:\5frflxl.exe69⤵PID:1392
-
\??\c:\rlrfllr.exec:\rlrfllr.exe70⤵PID:1764
-
\??\c:\nhnntt.exec:\nhnntt.exe71⤵PID:1348
-
\??\c:\ttttth.exec:\ttttth.exe72⤵PID:1088
-
\??\c:\1vpvv.exec:\1vpvv.exe73⤵PID:892
-
\??\c:\fxxflrx.exec:\fxxflrx.exe74⤵PID:980
-
\??\c:\xrfrlrx.exec:\xrfrlrx.exe75⤵PID:3060
-
\??\c:\bbhhhh.exec:\bbhhhh.exe76⤵PID:708
-
\??\c:\vvpvd.exec:\vvpvd.exe77⤵PID:2968
-
\??\c:\5ddjv.exec:\5ddjv.exe78⤵PID:2980
-
\??\c:\rrffllr.exec:\rrffllr.exe79⤵PID:2944
-
\??\c:\fxlxffr.exec:\fxlxffr.exe80⤵PID:2064
-
\??\c:\3bnnnn.exec:\3bnnnn.exe81⤵PID:1284
-
\??\c:\vvpdd.exec:\vvpdd.exe82⤵PID:2820
-
\??\c:\vvpjv.exec:\vvpjv.exe83⤵PID:1992
-
\??\c:\fxxfrxf.exec:\fxxfrxf.exe84⤵PID:3020
-
\??\c:\7lflrfr.exec:\7lflrfr.exe85⤵PID:2100
-
\??\c:\hhbntn.exec:\hhbntn.exe86⤵PID:2840
-
\??\c:\pppvv.exec:\pppvv.exe87⤵PID:2476
-
\??\c:\xxxlxfr.exec:\xxxlxfr.exe88⤵PID:2328
-
\??\c:\llrlxfl.exec:\llrlxfl.exe89⤵PID:2732
-
\??\c:\nhtbnh.exec:\nhtbnh.exe90⤵PID:2524
-
\??\c:\vvvjv.exec:\vvvjv.exe91⤵PID:2384
-
\??\c:\ddjvd.exec:\ddjvd.exe92⤵PID:2964
-
\??\c:\9lxrxxf.exec:\9lxrxxf.exe93⤵PID:2104
-
\??\c:\httbhh.exec:\httbhh.exe94⤵PID:744
-
\??\c:\nnbnbb.exec:\nnbnbb.exe95⤵PID:2940
-
\??\c:\dvdjd.exec:\dvdjd.exe96⤵PID:2772
-
\??\c:\vpdjj.exec:\vpdjj.exe97⤵PID:2752
-
\??\c:\5hnhhn.exec:\5hnhhn.exe98⤵PID:2812
-
\??\c:\3tnbbb.exec:\3tnbbb.exe99⤵PID:2164
-
\??\c:\vpjpv.exec:\vpjpv.exe100⤵PID:2016
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe101⤵PID:2116
-
\??\c:\xrlxflr.exec:\xrlxflr.exe102⤵PID:288
-
\??\c:\hbtnbt.exec:\hbtnbt.exe103⤵PID:284
-
\??\c:\vvpdp.exec:\vvpdp.exe104⤵PID:3024
-
\??\c:\ffflfxf.exec:\ffflfxf.exe105⤵PID:2316
-
\??\c:\btnbhn.exec:\btnbhn.exe106⤵PID:2236
-
\??\c:\vpjdj.exec:\vpjdj.exe107⤵PID:2848
-
\??\c:\vpdjp.exec:\vpdjp.exe108⤵PID:2296
-
\??\c:\frlrrfr.exec:\frlrrfr.exe109⤵PID:2068
-
\??\c:\7nnnhb.exec:\7nnnhb.exe110⤵PID:1796
-
\??\c:\hbhntb.exec:\hbhntb.exe111⤵PID:1772
-
\??\c:\jdvjj.exec:\jdvjj.exe112⤵PID:904
-
\??\c:\fxrxxfl.exec:\fxrxxfl.exe113⤵PID:1084
-
\??\c:\rrrrflx.exec:\rrrrflx.exe114⤵PID:2320
-
\??\c:\7tnttt.exec:\7tnttt.exe115⤵PID:1664
-
\??\c:\nbhhnn.exec:\nbhhnn.exe116⤵PID:668
-
\??\c:\pdjdd.exec:\pdjdd.exe117⤵PID:772
-
\??\c:\lrlffll.exec:\lrlffll.exe118⤵PID:2548
-
\??\c:\fxffrxf.exec:\fxffrxf.exe119⤵PID:604
-
\??\c:\1ttbhh.exec:\1ttbhh.exe120⤵PID:2836
-
\??\c:\nnnnnt.exec:\nnnnnt.exe121⤵PID:2824
-
\??\c:\7jvdd.exec:\7jvdd.exe122⤵PID:2868
-
\??\c:\1xllrxx.exec:\1xllrxx.exe123⤵PID:2092
-
\??\c:\rfrlllr.exec:\rfrlllr.exe124⤵PID:1680
-
\??\c:\nhtbbh.exec:\nhtbbh.exe125⤵PID:2884
-
\??\c:\3pvpv.exec:\3pvpv.exe126⤵PID:1532
-
\??\c:\3vjjv.exec:\3vjjv.exe127⤵PID:2076
-
\??\c:\xxrxfrf.exec:\xxrxfrf.exe128⤵PID:1240
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe129⤵PID:1356
-
\??\c:\bnbhtt.exec:\bnbhtt.exe130⤵PID:2600
-
\??\c:\7dpjj.exec:\7dpjj.exe131⤵PID:2612
-
\??\c:\rlffllr.exec:\rlffllr.exe132⤵PID:2744
-
\??\c:\rlxlfrx.exec:\rlxlfrx.exe133⤵PID:2256
-
\??\c:\9nbbht.exec:\9nbbht.exe134⤵PID:2728
-
\??\c:\5vddd.exec:\5vddd.exe135⤵PID:2696
-
\??\c:\vjvpv.exec:\vjvpv.exe136⤵PID:2732
-
\??\c:\3rrrrrf.exec:\3rrrrrf.exe137⤵PID:2516
-
\??\c:\tnbhtb.exec:\tnbhtb.exe138⤵PID:2500
-
\??\c:\9btbhn.exec:\9btbhn.exe139⤵PID:2936
-
\??\c:\jdvdd.exec:\jdvdd.exe140⤵PID:1860
-
\??\c:\vvpvp.exec:\vvpvp.exe141⤵PID:1836
-
\??\c:\fxllrrx.exec:\fxllrrx.exe142⤵PID:2764
-
\??\c:\nhnnnt.exec:\nhnnnt.exe143⤵PID:1040
-
\??\c:\nnbbnt.exec:\nnbbnt.exe144⤵PID:2800
-
\??\c:\jdppv.exec:\jdppv.exe145⤵PID:2812
-
\??\c:\rlrrfrl.exec:\rlrrfrl.exe146⤵PID:1804
-
\??\c:\xrxflfr.exec:\xrxflfr.exe147⤵PID:1776
-
\??\c:\nnbhtn.exec:\nnbhtn.exe148⤵PID:2156
-
\??\c:\pdvpv.exec:\pdvpv.exe149⤵PID:1648
-
\??\c:\pjpvd.exec:\pjpvd.exe150⤵PID:284
-
\??\c:\7fxrrxf.exec:\7fxrrxf.exe151⤵PID:1600
-
\??\c:\hbhbbb.exec:\hbhbbb.exe152⤵PID:1100
-
\??\c:\bbtnth.exec:\bbtnth.exe153⤵PID:1280
-
\??\c:\vvvjd.exec:\vvvjd.exe154⤵PID:2240
-
\??\c:\jpjpv.exec:\jpjpv.exe155⤵PID:600
-
\??\c:\xrlrxlx.exec:\xrlrxlx.exe156⤵PID:1672
-
\??\c:\bththh.exec:\bththh.exe157⤵PID:804
-
\??\c:\5btbhn.exec:\5btbhn.exe158⤵PID:648
-
\??\c:\vvvdd.exec:\vvvdd.exe159⤵PID:1132
-
\??\c:\rlrlffl.exec:\rlrlffl.exe160⤵PID:2700
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe161⤵PID:1928
-
\??\c:\hhbhtb.exec:\hhbhtb.exe162⤵PID:1392
-
\??\c:\thnntn.exec:\thnntn.exe163⤵PID:1764
-
\??\c:\ddpdd.exec:\ddpdd.exe164⤵PID:1348
-
\??\c:\fxrxxll.exec:\fxrxxll.exe165⤵PID:1088
-
\??\c:\ffrfrrf.exec:\ffrfrrf.exe166⤵PID:832
-
\??\c:\nbntbh.exec:\nbntbh.exe167⤵PID:2372
-
\??\c:\hbhhbb.exec:\hbhhbb.exe168⤵PID:3068
-
\??\c:\vpjvd.exec:\vpjvd.exe169⤵PID:2204
-
\??\c:\xxxxxxf.exec:\xxxxxxf.exe170⤵PID:1980
-
\??\c:\7rfxfff.exec:\7rfxfff.exe171⤵PID:880
-
\??\c:\1nbhth.exec:\1nbhth.exe172⤵PID:864
-
\??\c:\7bthnn.exec:\7bthnn.exe173⤵PID:1576
-
\??\c:\5pjvp.exec:\5pjvp.exe174⤵PID:2560
-
\??\c:\djdvj.exec:\djdvj.exe175⤵PID:844
-
\??\c:\rrrxfrx.exec:\rrrxfrx.exe176⤵PID:2704
-
\??\c:\9httbn.exec:\9httbn.exe177⤵PID:3020
-
\??\c:\bbtbbh.exec:\bbtbbh.exe178⤵PID:2832
-
\??\c:\jdjpp.exec:\jdjpp.exe179⤵PID:2740
-
\??\c:\9rlllrr.exec:\9rlllrr.exe180⤵PID:2632
-
\??\c:\llxllrr.exec:\llxllrr.exe181⤵PID:2496
-
\??\c:\btthtt.exec:\btthtt.exe182⤵PID:2692
-
\??\c:\bttttb.exec:\bttttb.exe183⤵PID:2060
-
\??\c:\jvdvv.exec:\jvdvv.exe184⤵PID:2484
-
\??\c:\5xrlxfr.exec:\5xrlxfr.exe185⤵PID:2472
-
\??\c:\lfxffll.exec:\lfxffll.exe186⤵PID:2464
-
\??\c:\ttttbh.exec:\ttttbh.exe187⤵PID:2348
-
\??\c:\5bhtbh.exec:\5bhtbh.exe188⤵PID:1968
-
\??\c:\jdvvj.exec:\jdvvj.exe189⤵PID:2568
-
\??\c:\3pdpp.exec:\3pdpp.exe190⤵PID:2012
-
\??\c:\rrfxfxf.exec:\rrfxfxf.exe191⤵PID:1440
-
\??\c:\nththb.exec:\nththb.exe192⤵PID:1612
-
\??\c:\7tbthn.exec:\7tbthn.exe193⤵PID:2028
-
\??\c:\vpvjv.exec:\vpvjv.exe194⤵PID:1952
-
\??\c:\ffrxffl.exec:\ffrxffl.exe195⤵PID:1804
-
\??\c:\3rlxxxx.exec:\3rlxxxx.exe196⤵PID:1776
-
\??\c:\bthnnt.exec:\bthnnt.exe197⤵PID:2156
-
\??\c:\tnhhbn.exec:\tnhhbn.exe198⤵PID:1648
-
\??\c:\3vdpv.exec:\3vdpv.exe199⤵PID:284
-
\??\c:\rlxlrfl.exec:\rlxlrfl.exe200⤵PID:1600
-
\??\c:\1lllxxf.exec:\1lllxxf.exe201⤵PID:944
-
\??\c:\5nhnbb.exec:\5nhnbb.exe202⤵PID:1280
-
\??\c:\tththn.exec:\tththn.exe203⤵PID:2264
-
\??\c:\9vvjj.exec:\9vvjj.exe204⤵PID:600
-
\??\c:\lfrxffr.exec:\lfrxffr.exe205⤵PID:1672
-
\??\c:\lfrxffl.exec:\lfrxffl.exe206⤵PID:804
-
\??\c:\hhbnnn.exec:\hhbnnn.exe207⤵PID:648
-
\??\c:\tttnth.exec:\tttnth.exe208⤵PID:1132
-
\??\c:\1jjdd.exec:\1jjdd.exe209⤵PID:1640
-
\??\c:\rrlrxxl.exec:\rrlrxxl.exe210⤵PID:1156
-
\??\c:\9xlrxfl.exec:\9xlrxfl.exe211⤵PID:1940
-
\??\c:\tnhbtt.exec:\tnhbtt.exe212⤵PID:1336
-
\??\c:\1bntnb.exec:\1bntnb.exe213⤵PID:1348
-
\??\c:\dpddd.exec:\dpddd.exe214⤵PID:1932
-
\??\c:\vppjp.exec:\vppjp.exe215⤵PID:832
-
\??\c:\xrlflxf.exec:\xrlflxf.exe216⤵PID:2372
-
\??\c:\5tntnt.exec:\5tntnt.exe217⤵PID:1988
-
\??\c:\3bbntt.exec:\3bbntt.exe218⤵PID:2204
-
\??\c:\vvppv.exec:\vvppv.exe219⤵PID:1620
-
\??\c:\jvjjd.exec:\jvjjd.exe220⤵PID:880
-
\??\c:\3xrxfxf.exec:\3xrxfxf.exe221⤵PID:1580
-
\??\c:\lfflxfr.exec:\lfflxfr.exe222⤵PID:2904
-
\??\c:\thntbt.exec:\thntbt.exe223⤵PID:1240
-
\??\c:\jdpvd.exec:\jdpvd.exe224⤵PID:2648
-
\??\c:\vvvdp.exec:\vvvdp.exe225⤵PID:2600
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe226⤵PID:2840
-
\??\c:\bnbtbb.exec:\bnbtbb.exe227⤵PID:2744
-
\??\c:\hhbntt.exec:\hhbntt.exe228⤵PID:2604
-
\??\c:\vpjpv.exec:\vpjpv.exe229⤵PID:2476
-
\??\c:\5lxxxfx.exec:\5lxxxfx.exe230⤵PID:2496
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe231⤵PID:2692
-
\??\c:\nhbhnt.exec:\nhbhnt.exe232⤵PID:2060
-
\??\c:\nhbttt.exec:\nhbttt.exe233⤵PID:2484
-
\??\c:\jdvvj.exec:\jdvvj.exe234⤵PID:2384
-
\??\c:\5llrfrf.exec:\5llrfrf.exe235⤵PID:2464
-
\??\c:\xlrrxxx.exec:\xlrrxxx.exe236⤵PID:2520
-
\??\c:\tnhntt.exec:\tnhntt.exe237⤵PID:2940
-
\??\c:\ttntnn.exec:\ttntnn.exe238⤵PID:2568
-
\??\c:\pjdjj.exec:\pjdjj.exe239⤵PID:2908
-
\??\c:\rfrxxff.exec:\rfrxxff.exe240⤵PID:1440
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe241⤵PID:1612
-
\??\c:\hnhbnt.exec:\hnhbnt.exe242⤵PID:2028