Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 05:54
Behavioral task
behavioral1
Sample
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781_NeikiAnalytics.exe
-
Size
329KB
-
MD5
06b0facf85ce6ccf71cc9ea2c4b09400
-
SHA1
950a3307b8cf758a82b87906de6d0e5bbc44784b
-
SHA256
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781
-
SHA512
ba3e548704a1ddf6653cc0d36f541ab29c31c4342db19acd9c543667972358171e1fed0afecc770d1abe2127007bf36881d5af2011bd449d0f82223a77b0e6ef
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhY:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTI
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/2208-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-233-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1744-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-306-0x0000000077090000-0x00000000771AF000-memory.dmp family_blackmoon behavioral1/memory/2116-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-354-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-751-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/792-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-884-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-987-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2040-1046-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1588-1115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\hbhhhn.exe family_berbew \??\c:\ppjpd.exe family_berbew C:\fxrfrxl.exe family_berbew C:\flxxlxf.exe family_berbew \??\c:\7jvjj.exe family_berbew C:\1vjpv.exe family_berbew C:\hbntbb.exe family_berbew C:\dvjdp.exe family_berbew C:\rxxxfxl.exe family_berbew C:\hbhtbh.exe family_berbew C:\rxfrrff.exe family_berbew C:\5bbtbb.exe family_berbew C:\xlflfll.exe family_berbew C:\bbnbth.exe family_berbew C:\fxrxlxf.exe family_berbew C:\tnbnhn.exe family_berbew C:\fxrflll.exe family_berbew C:\htthtb.exe family_berbew \??\c:\ppjdp.exe family_berbew C:\frrxlxl.exe family_berbew C:\fxllflx.exe family_berbew C:\nhhthn.exe family_berbew C:\lxrfrxf.exe family_berbew C:\btnbhn.exe family_berbew C:\lfrxfrx.exe family_berbew C:\7bbbbn.exe family_berbew C:\xxfrllf.exe family_berbew C:\ppjpd.exe family_berbew C:\xxrfrfx.exe family_berbew C:\hnhnbb.exe family_berbew C:\lrxllxx.exe family_berbew C:\nnhhnh.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
hbhhhn.exeppjpd.exefxrfrxl.exeflxxlxf.exe7jvjj.exe1vjpv.exehbntbb.exedvjdp.exerxxxfxl.exehbhtbh.exerxfrrff.exe5bbtbb.exexlflfll.exebbnbth.exefxrxlxf.exetnbnhn.exefxrflll.exehtthtb.exeppjdp.exefrrxlxl.exefxllflx.exenhhthn.exelxrfrxf.exebtnbhn.exelfrxfrx.exe7bbbbn.exexxfrllf.exeppjpd.exexxrfrfx.exehnhnbb.exelrxllxx.exennhhnh.exevvvdp.exelrrffxf.exexrrffxx.exebnhnht.exejjjdv.exefxrxlxr.exennbbnt.exevvpdd.exe7frxlrf.exebthttn.exejpdpv.exepjpvv.exeflrflxr.exetnthth.exejvpjp.exe3lfrffl.exelfrflxl.exebtnbnt.exe5vppd.exexrflrfr.exexxlrfrl.exennhbnt.exe9djvd.exefrlrxxl.exexxxxflr.exenhntht.exedjppv.exe5rflxlx.exebbbhht.exeddpvv.exe1xrxlxl.exebtnthh.exepid process 2176 hbhhhn.exe 2192 ppjpd.exe 3052 fxrfrxl.exe 2712 flxxlxf.exe 2884 7jvjj.exe 2736 1vjpv.exe 1500 hbntbb.exe 2488 dvjdp.exe 2660 rxxxfxl.exe 3004 hbhtbh.exe 2852 rxfrrff.exe 2992 5bbtbb.exe 2724 xlflfll.exe 1920 bbnbth.exe 1420 fxrxlxf.exe 292 tnbnhn.exe 2824 fxrflll.exe 1224 htthtb.exe 1880 ppjdp.exe 1932 frrxlxl.exe 588 fxllflx.exe 836 nhhthn.exe 1076 lxrfrxf.exe 3068 btnbhn.exe 1744 lfrxfrx.exe 800 7bbbbn.exe 760 xxfrllf.exe 904 ppjpd.exe 1772 xxrfrfx.exe 1596 hnhnbb.exe 2396 lrxllxx.exe 1736 nnhhnh.exe 2944 vvvdp.exe 2412 lrrffxf.exe 2780 xrrffxx.exe 2116 bnhnht.exe 2632 jjjdv.exe 2700 fxrxlxr.exe 2716 nnbbnt.exe 3060 vvpdd.exe 2652 7frxlrf.exe 2528 bthttn.exe 2492 jpdpv.exe 2556 pjpvv.exe 2488 flrflxr.exe 2020 tnthth.exe 2764 jvpjp.exe 2988 3lfrffl.exe 2844 lfrflxl.exe 2024 btnbnt.exe 1564 5vppd.exe 300 xrflrfr.exe 1920 xxlrfrl.exe 2480 nnhbnt.exe 2804 9djvd.exe 1552 frlrxxl.exe 1200 xxxxflr.exe 1224 nhntht.exe 2060 djppv.exe 2084 5rflxlx.exe 1480 bbbhht.exe 552 ddpvv.exe 988 1xrxlxl.exe 1360 btnthh.exe -
Processes:
resource yara_rule behavioral1/memory/2208-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-306-0x0000000077090000-0x00000000771AF000-memory.dmp upx behavioral1/memory/2116-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-906-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-958-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/844-1006-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-1014-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-1089-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-1102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-1115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-1122-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781_NeikiAnalytics.exehbhhhn.exeppjpd.exefxrfrxl.exeflxxlxf.exe7jvjj.exe1vjpv.exehbntbb.exedvjdp.exerxxxfxl.exehbhtbh.exerxfrrff.exe5bbtbb.exexlflfll.exebbnbth.exefxrxlxf.exedescription pid process target process PID 2208 wrote to memory of 2176 2208 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781_NeikiAnalytics.exe hbhhhn.exe PID 2208 wrote to memory of 2176 2208 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781_NeikiAnalytics.exe hbhhhn.exe PID 2208 wrote to memory of 2176 2208 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781_NeikiAnalytics.exe hbhhhn.exe PID 2208 wrote to memory of 2176 2208 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781_NeikiAnalytics.exe hbhhhn.exe PID 2176 wrote to memory of 2192 2176 hbhhhn.exe ppjpd.exe PID 2176 wrote to memory of 2192 2176 hbhhhn.exe ppjpd.exe PID 2176 wrote to memory of 2192 2176 hbhhhn.exe ppjpd.exe PID 2176 wrote to memory of 2192 2176 hbhhhn.exe ppjpd.exe PID 2192 wrote to memory of 3052 2192 ppjpd.exe fxrfrxl.exe PID 2192 wrote to memory of 3052 2192 ppjpd.exe fxrfrxl.exe PID 2192 wrote to memory of 3052 2192 ppjpd.exe fxrfrxl.exe PID 2192 wrote to memory of 3052 2192 ppjpd.exe fxrfrxl.exe PID 3052 wrote to memory of 2712 3052 fxrfrxl.exe flxxlxf.exe PID 3052 wrote to memory of 2712 3052 fxrfrxl.exe flxxlxf.exe PID 3052 wrote to memory of 2712 3052 fxrfrxl.exe flxxlxf.exe PID 3052 wrote to memory of 2712 3052 fxrfrxl.exe flxxlxf.exe PID 2712 wrote to memory of 2884 2712 flxxlxf.exe 7jvjj.exe PID 2712 wrote to memory of 2884 2712 flxxlxf.exe 7jvjj.exe PID 2712 wrote to memory of 2884 2712 flxxlxf.exe 7jvjj.exe PID 2712 wrote to memory of 2884 2712 flxxlxf.exe 7jvjj.exe PID 2884 wrote to memory of 2736 2884 7jvjj.exe 1vjpv.exe PID 2884 wrote to memory of 2736 2884 7jvjj.exe 1vjpv.exe PID 2884 wrote to memory of 2736 2884 7jvjj.exe 1vjpv.exe PID 2884 wrote to memory of 2736 2884 7jvjj.exe 1vjpv.exe PID 2736 wrote to memory of 1500 2736 1vjpv.exe hbntbb.exe PID 2736 wrote to memory of 1500 2736 1vjpv.exe hbntbb.exe PID 2736 wrote to memory of 1500 2736 1vjpv.exe hbntbb.exe PID 2736 wrote to memory of 1500 2736 1vjpv.exe hbntbb.exe PID 1500 wrote to memory of 2488 1500 hbntbb.exe dvjdp.exe PID 1500 wrote to memory of 2488 1500 hbntbb.exe dvjdp.exe PID 1500 wrote to memory of 2488 1500 hbntbb.exe dvjdp.exe PID 1500 wrote to memory of 2488 1500 hbntbb.exe dvjdp.exe PID 2488 wrote to memory of 2660 2488 dvjdp.exe rxxxfxl.exe PID 2488 wrote to memory of 2660 2488 dvjdp.exe rxxxfxl.exe PID 2488 wrote to memory of 2660 2488 dvjdp.exe rxxxfxl.exe PID 2488 wrote to memory of 2660 2488 dvjdp.exe rxxxfxl.exe PID 2660 wrote to memory of 3004 2660 rxxxfxl.exe hbhtbh.exe PID 2660 wrote to memory of 3004 2660 rxxxfxl.exe hbhtbh.exe PID 2660 wrote to memory of 3004 2660 rxxxfxl.exe hbhtbh.exe PID 2660 wrote to memory of 3004 2660 rxxxfxl.exe hbhtbh.exe PID 3004 wrote to memory of 2852 3004 hbhtbh.exe rxfrrff.exe PID 3004 wrote to memory of 2852 3004 hbhtbh.exe rxfrrff.exe PID 3004 wrote to memory of 2852 3004 hbhtbh.exe rxfrrff.exe PID 3004 wrote to memory of 2852 3004 hbhtbh.exe rxfrrff.exe PID 2852 wrote to memory of 2992 2852 rxfrrff.exe 5bbtbb.exe PID 2852 wrote to memory of 2992 2852 rxfrrff.exe 5bbtbb.exe PID 2852 wrote to memory of 2992 2852 rxfrrff.exe 5bbtbb.exe PID 2852 wrote to memory of 2992 2852 rxfrrff.exe 5bbtbb.exe PID 2992 wrote to memory of 2724 2992 5bbtbb.exe xlflfll.exe PID 2992 wrote to memory of 2724 2992 5bbtbb.exe xlflfll.exe PID 2992 wrote to memory of 2724 2992 5bbtbb.exe xlflfll.exe PID 2992 wrote to memory of 2724 2992 5bbtbb.exe xlflfll.exe PID 2724 wrote to memory of 1920 2724 xlflfll.exe bbnbth.exe PID 2724 wrote to memory of 1920 2724 xlflfll.exe bbnbth.exe PID 2724 wrote to memory of 1920 2724 xlflfll.exe bbnbth.exe PID 2724 wrote to memory of 1920 2724 xlflfll.exe bbnbth.exe PID 1920 wrote to memory of 1420 1920 bbnbth.exe fxrxlxf.exe PID 1920 wrote to memory of 1420 1920 bbnbth.exe fxrxlxf.exe PID 1920 wrote to memory of 1420 1920 bbnbth.exe fxrxlxf.exe PID 1920 wrote to memory of 1420 1920 bbnbth.exe fxrxlxf.exe PID 1420 wrote to memory of 292 1420 fxrxlxf.exe tnbnhn.exe PID 1420 wrote to memory of 292 1420 fxrxlxf.exe tnbnhn.exe PID 1420 wrote to memory of 292 1420 fxrxlxf.exe tnbnhn.exe PID 1420 wrote to memory of 292 1420 fxrxlxf.exe tnbnhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\hbhhhn.exec:\hbhhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\ppjpd.exec:\ppjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\flxxlxf.exec:\flxxlxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\7jvjj.exec:\7jvjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\1vjpv.exec:\1vjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\hbntbb.exec:\hbntbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\dvjdp.exec:\dvjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rxxxfxl.exec:\rxxxfxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\hbhtbh.exec:\hbhtbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\rxfrrff.exec:\rxfrrff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\5bbtbb.exec:\5bbtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\xlflfll.exec:\xlflfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\bbnbth.exec:\bbnbth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\fxrxlxf.exec:\fxrxlxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\tnbnhn.exec:\tnbnhn.exe17⤵
- Executes dropped EXE
PID:292 -
\??\c:\fxrflll.exec:\fxrflll.exe18⤵
- Executes dropped EXE
PID:2824 -
\??\c:\htthtb.exec:\htthtb.exe19⤵
- Executes dropped EXE
PID:1224 -
\??\c:\ppjdp.exec:\ppjdp.exe20⤵
- Executes dropped EXE
PID:1880 -
\??\c:\frrxlxl.exec:\frrxlxl.exe21⤵
- Executes dropped EXE
PID:1932 -
\??\c:\fxllflx.exec:\fxllflx.exe22⤵
- Executes dropped EXE
PID:588 -
\??\c:\nhhthn.exec:\nhhthn.exe23⤵
- Executes dropped EXE
PID:836 -
\??\c:\lxrfrxf.exec:\lxrfrxf.exe24⤵
- Executes dropped EXE
PID:1076 -
\??\c:\btnbhn.exec:\btnbhn.exe25⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lfrxfrx.exec:\lfrxfrx.exe26⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7bbbbn.exec:\7bbbbn.exe27⤵
- Executes dropped EXE
PID:800 -
\??\c:\xxfrllf.exec:\xxfrllf.exe28⤵
- Executes dropped EXE
PID:760 -
\??\c:\ppjpd.exec:\ppjpd.exe29⤵
- Executes dropped EXE
PID:904 -
\??\c:\xxrfrfx.exec:\xxrfrfx.exe30⤵
- Executes dropped EXE
PID:1772 -
\??\c:\hnhnbb.exec:\hnhnbb.exe31⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lrxllxx.exec:\lrxllxx.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nnhhnh.exec:\nnhhnh.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vvvdp.exec:\vvvdp.exe34⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7fflxfl.exec:\7fflxfl.exe35⤵PID:1580
-
\??\c:\lrrffxf.exec:\lrrffxf.exe36⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xrrffxx.exec:\xrrffxx.exe37⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bnhnht.exec:\bnhnht.exe38⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jjjdv.exec:\jjjdv.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\fxrxlxr.exec:\fxrxlxr.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nnbbnt.exec:\nnbbnt.exe41⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vvpdd.exec:\vvpdd.exe42⤵
- Executes dropped EXE
PID:3060 -
\??\c:\7frxlrf.exec:\7frxlrf.exe43⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bthttn.exec:\bthttn.exe44⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jpdpv.exec:\jpdpv.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pjpvv.exec:\pjpvv.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\flrflxr.exec:\flrflxr.exe47⤵
- Executes dropped EXE
PID:2488 -
\??\c:\tnthth.exec:\tnthth.exe48⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jvpjp.exec:\jvpjp.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3lfrffl.exec:\3lfrffl.exe50⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lfrflxl.exec:\lfrflxl.exe51⤵
- Executes dropped EXE
PID:2844 -
\??\c:\btnbnt.exec:\btnbnt.exe52⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5vppd.exec:\5vppd.exe53⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xrflrfr.exec:\xrflrfr.exe54⤵
- Executes dropped EXE
PID:300 -
\??\c:\xxlrfrl.exec:\xxlrfrl.exe55⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nnhbnt.exec:\nnhbnt.exe56⤵
- Executes dropped EXE
PID:2480 -
\??\c:\9djvd.exec:\9djvd.exe57⤵
- Executes dropped EXE
PID:2804 -
\??\c:\frlrxxl.exec:\frlrxxl.exe58⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xxxxflr.exec:\xxxxflr.exe59⤵
- Executes dropped EXE
PID:1200 -
\??\c:\nhntht.exec:\nhntht.exe60⤵
- Executes dropped EXE
PID:1224 -
\??\c:\djppv.exec:\djppv.exe61⤵
- Executes dropped EXE
PID:2060 -
\??\c:\5rflxlx.exec:\5rflxlx.exe62⤵
- Executes dropped EXE
PID:2084 -
\??\c:\bbbhht.exec:\bbbhht.exe63⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ddpvv.exec:\ddpvv.exe64⤵
- Executes dropped EXE
PID:552 -
\??\c:\1xrxlxl.exec:\1xrxlxl.exe65⤵
- Executes dropped EXE
PID:988 -
\??\c:\btnthh.exec:\btnthh.exe66⤵
- Executes dropped EXE
PID:1360 -
\??\c:\hthbth.exec:\hthbth.exe67⤵PID:2560
-
\??\c:\jjdjv.exec:\jjdjv.exe68⤵PID:1792
-
\??\c:\5rfxrxl.exec:\5rfxrxl.exe69⤵PID:1744
-
\??\c:\9tbhht.exec:\9tbhht.exe70⤵PID:1132
-
\??\c:\vddjd.exec:\vddjd.exe71⤵PID:288
-
\??\c:\9rlxrxl.exec:\9rlxrxl.exe72⤵PID:760
-
\??\c:\ntnnbh.exec:\ntnnbh.exe73⤵PID:2136
-
\??\c:\nhbthh.exec:\nhbthh.exe74⤵PID:1708
-
\??\c:\jjdpp.exec:\jjdpp.exe75⤵PID:1964
-
\??\c:\lrxlfrl.exec:\lrxlfrl.exe76⤵PID:1752
-
\??\c:\nhhnhb.exec:\nhhnhb.exe77⤵PID:1668
-
\??\c:\5ttbnn.exec:\5ttbnn.exe78⤵PID:2172
-
\??\c:\vddpp.exec:\vddpp.exe79⤵PID:2944
-
\??\c:\7xrflrl.exec:\7xrflrl.exe80⤵PID:1576
-
\??\c:\thbbhb.exec:\thbbhb.exe81⤵PID:2184
-
\??\c:\vvjdv.exec:\vvjdv.exe82⤵PID:2780
-
\??\c:\lxrflrl.exec:\lxrflrl.exe83⤵PID:2640
-
\??\c:\frlrxxr.exec:\frlrxxr.exe84⤵PID:2620
-
\??\c:\1tnnht.exec:\1tnnht.exe85⤵PID:2596
-
\??\c:\vpjpd.exec:\vpjpd.exe86⤵PID:2884
-
\??\c:\ntnntb.exec:\ntnntb.exe87⤵PID:2520
-
\??\c:\hbntbb.exec:\hbntbb.exe88⤵PID:2720
-
\??\c:\nhbhth.exec:\nhbhth.exe89⤵PID:2664
-
\??\c:\llxlfxx.exec:\llxlfxx.exe90⤵PID:2536
-
\??\c:\llflfrf.exec:\llflfrf.exe91⤵PID:2544
-
\??\c:\thhttb.exec:\thhttb.exe92⤵PID:568
-
\??\c:\jdvvj.exec:\jdvvj.exe93⤵PID:1944
-
\??\c:\jppdd.exec:\jppdd.exe94⤵PID:2972
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe95⤵PID:2340
-
\??\c:\hhbbtt.exec:\hhbbtt.exe96⤵PID:2592
-
\??\c:\pjddj.exec:\pjddj.exe97⤵PID:556
-
\??\c:\jddjv.exec:\jddjv.exe98⤵PID:1628
-
\??\c:\7xrrffl.exec:\7xrrffl.exe99⤵PID:1356
-
\??\c:\3btnhh.exec:\3btnhh.exe100⤵PID:1420
-
\??\c:\pjvjv.exec:\pjvjv.exe101⤵PID:1976
-
\??\c:\xxlxlrx.exec:\xxlxlrx.exe102⤵PID:1608
-
\??\c:\btntbt.exec:\btntbt.exe103⤵PID:2816
-
\??\c:\1dvjp.exec:\1dvjp.exe104⤵PID:2040
-
\??\c:\llxlrfr.exec:\llxlrfr.exe105⤵PID:2072
-
\??\c:\9bhtth.exec:\9bhtth.exe106⤵PID:1720
-
\??\c:\bbbnhh.exec:\bbbnhh.exe107⤵PID:1876
-
\??\c:\3jdjp.exec:\3jdjp.exe108⤵PID:2348
-
\??\c:\3frrrxf.exec:\3frrrxf.exe109⤵PID:1904
-
\??\c:\rlxxflx.exec:\rlxxflx.exe110⤵PID:684
-
\??\c:\nhntbb.exec:\nhntbb.exe111⤵PID:1352
-
\??\c:\9pjjp.exec:\9pjjp.exe112⤵PID:2448
-
\??\c:\7vjdj.exec:\7vjdj.exe113⤵PID:1128
-
\??\c:\7fffllr.exec:\7fffllr.exe114⤵PID:1592
-
\??\c:\5bbnbn.exec:\5bbnbn.exe115⤵PID:1588
-
\??\c:\9nhbnt.exec:\9nhbnt.exe116⤵PID:2876
-
\??\c:\ddvjj.exec:\ddvjj.exe117⤵PID:792
-
\??\c:\5rxflrf.exec:\5rxflrf.exe118⤵PID:856
-
\??\c:\bttbtt.exec:\bttbtt.exe119⤵PID:2204
-
\??\c:\hhnbnb.exec:\hhnbnb.exe120⤵PID:2304
-
\??\c:\pjvvp.exec:\pjvvp.exe121⤵PID:2928
-
\??\c:\flfxrll.exec:\flfxrll.exe122⤵PID:1596
-
\??\c:\9nbntb.exec:\9nbntb.exe123⤵PID:2220
-
\??\c:\5thtbh.exec:\5thtbh.exe124⤵PID:2000
-
\??\c:\pjjdj.exec:\pjjdj.exe125⤵PID:2944
-
\??\c:\llflffx.exec:\llflffx.exe126⤵PID:1576
-
\??\c:\5lfrxxf.exec:\5lfrxxf.exe127⤵PID:2576
-
\??\c:\3hnhtb.exec:\3hnhtb.exe128⤵PID:2116
-
\??\c:\dvjpv.exec:\dvjpv.exe129⤵PID:3052
-
\??\c:\llxxfrr.exec:\llxxfrr.exe130⤵PID:2616
-
\??\c:\rrfllrx.exec:\rrfllrx.exe131⤵PID:2728
-
\??\c:\nnntbh.exec:\nnntbh.exe132⤵PID:2740
-
\??\c:\pddpj.exec:\pddpj.exe133⤵PID:2540
-
\??\c:\xrlxxxf.exec:\xrlxxxf.exe134⤵PID:2528
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe135⤵PID:2492
-
\??\c:\nhtbhn.exec:\nhtbhn.exe136⤵PID:2508
-
\??\c:\pjdvd.exec:\pjdvd.exe137⤵PID:2660
-
\??\c:\xllxllx.exec:\xllxllx.exe138⤵PID:2828
-
\??\c:\5btntn.exec:\5btntn.exe139⤵PID:2860
-
\??\c:\bbnhnt.exec:\bbnhnt.exe140⤵PID:2980
-
\??\c:\pjvvj.exec:\pjvvj.exe141⤵PID:912
-
\??\c:\frflllr.exec:\frflllr.exe142⤵PID:2992
-
\??\c:\llxrflf.exec:\llxrflf.exe143⤵PID:2232
-
\??\c:\hhbhtb.exec:\hhbhtb.exe144⤵PID:1244
-
\??\c:\5ddpv.exec:\5ddpv.exe145⤵PID:844
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe146⤵PID:2668
-
\??\c:\nhtthn.exec:\nhtthn.exe147⤵PID:1204
-
\??\c:\hhbhnb.exec:\hhbhnb.exe148⤵PID:292
-
\??\c:\djjvv.exec:\djjvv.exe149⤵PID:2812
-
\??\c:\1lxflxf.exec:\1lxflxf.exe150⤵PID:2040
-
\??\c:\hhhhbn.exec:\hhhhbn.exe151⤵PID:2100
-
\??\c:\tnntbb.exec:\tnntbb.exe152⤵PID:1584
-
\??\c:\dvppp.exec:\dvppp.exe153⤵PID:1932
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe154⤵PID:2904
-
\??\c:\llfxlrl.exec:\llfxlrl.exe155⤵PID:2672
-
\??\c:\btntht.exec:\btntht.exe156⤵PID:2252
-
\??\c:\9pddp.exec:\9pddp.exe157⤵PID:2092
-
\??\c:\jpvjj.exec:\jpvjj.exe158⤵PID:1676
-
\??\c:\ffxllrf.exec:\ffxllrf.exe159⤵PID:1524
-
\??\c:\nnbhnb.exec:\nnbhnb.exe160⤵PID:2560
-
\??\c:\dpvpv.exec:\dpvpv.exe161⤵PID:1592
-
\??\c:\ddvpd.exec:\ddvpd.exe162⤵PID:1588
-
\??\c:\xflrrlf.exec:\xflrrlf.exe163⤵PID:348
-
\??\c:\httnhb.exec:\httnhb.exe164⤵PID:744
-
\??\c:\vvvpd.exec:\vvvpd.exe165⤵PID:2052
-
\??\c:\5pjpj.exec:\5pjpj.exe166⤵PID:1400
-
\??\c:\rlllllr.exec:\rlllllr.exe167⤵PID:3040
-
\??\c:\bthnbn.exec:\bthnbn.exe168⤵PID:2928
-
\??\c:\pvjvp.exec:\pvjvp.exe169⤵PID:1596
-
\??\c:\7rllrrx.exec:\7rllrrx.exe170⤵PID:2220
-
\??\c:\3xrlxfr.exec:\3xrlxfr.exe171⤵PID:1504
-
\??\c:\tnhntt.exec:\tnhntt.exe172⤵PID:2176
-
\??\c:\7dvjj.exec:\7dvjj.exe173⤵PID:1688
-
\??\c:\lrxfxrr.exec:\lrxfxrr.exe174⤵PID:2692
-
\??\c:\bhbthb.exec:\bhbthb.exe175⤵PID:2636
-
\??\c:\5httbh.exec:\5httbh.exe176⤵PID:3052
-
\??\c:\vvjvd.exec:\vvjvd.exe177⤵PID:2772
-
\??\c:\fffrlrf.exec:\fffrlrf.exe178⤵PID:2656
-
\??\c:\rllfrxr.exec:\rllfrxr.exe179⤵PID:2712
-
\??\c:\nbthnt.exec:\nbthnt.exe180⤵PID:2720
-
\??\c:\1jvdj.exec:\1jvdj.exe181⤵PID:2528
-
\??\c:\rlffrxf.exec:\rlffrxf.exe182⤵PID:2960
-
\??\c:\hbthtt.exec:\hbthtt.exe183⤵PID:1344
-
\??\c:\ttnhtt.exec:\ttnhtt.exe184⤵PID:2952
-
\??\c:\jdvdp.exec:\jdvdp.exe185⤵PID:2828
-
\??\c:\lxrfffl.exec:\lxrfffl.exe186⤵PID:2836
-
\??\c:\llrrrxl.exec:\llrrrxl.exe187⤵PID:1184
-
\??\c:\hbhhbb.exec:\hbhhbb.exe188⤵PID:1648
-
\??\c:\bbbthn.exec:\bbbthn.exe189⤵PID:1616
-
\??\c:\vvpvd.exec:\vvpvd.exe190⤵PID:2380
-
\??\c:\3ffflxl.exec:\3ffflxl.exe191⤵PID:2784
-
\??\c:\nnhthn.exec:\nnhthn.exe192⤵PID:2796
-
\??\c:\btnhnh.exec:\btnhnh.exe193⤵PID:1240
-
\??\c:\dpjdp.exec:\dpjdp.exe194⤵PID:1204
-
\??\c:\5vpdj.exec:\5vpdj.exe195⤵PID:1200
-
\??\c:\3xxlrrx.exec:\3xxlrrx.exe196⤵PID:464
-
\??\c:\bnbtbt.exec:\bnbtbt.exe197⤵PID:1888
-
\??\c:\jjjpp.exec:\jjjpp.exe198⤵PID:1808
-
\??\c:\ppvvd.exec:\ppvvd.exe199⤵PID:2096
-
\??\c:\5xxxrxl.exec:\5xxxrxl.exe200⤵PID:1996
-
\??\c:\3lfxflx.exec:\3lfxflx.exe201⤵PID:552
-
\??\c:\bhbhnt.exec:\bhbhnt.exe202⤵PID:836
-
\??\c:\ppjvp.exec:\ppjvp.exe203⤵PID:2368
-
\??\c:\rlflxfr.exec:\rlflxfr.exe204⤵PID:1372
-
\??\c:\xrrxllx.exec:\xrrxllx.exe205⤵PID:1676
-
\??\c:\tnnbnt.exec:\tnnbnt.exe206⤵PID:1912
-
\??\c:\ddvjv.exec:\ddvjv.exe207⤵PID:2560
-
\??\c:\jpppv.exec:\jpppv.exe208⤵PID:1728
-
\??\c:\xxxlxxf.exec:\xxxlxxf.exe209⤵PID:1588
-
\??\c:\btntbb.exec:\btntbb.exe210⤵PID:1664
-
\??\c:\hhbtht.exec:\hhbtht.exe211⤵PID:2456
-
\??\c:\djjdd.exec:\djjdd.exe212⤵PID:2916
-
\??\c:\xxlrrff.exec:\xxlrrff.exe213⤵PID:1740
-
\??\c:\tnhnbt.exec:\tnhnbt.exe214⤵PID:2396
-
\??\c:\1bntbn.exec:\1bntbn.exe215⤵PID:2424
-
\??\c:\ppjvj.exec:\ppjvj.exe216⤵PID:2172
-
\??\c:\frflrxf.exec:\frflrxf.exe217⤵PID:1736
-
\??\c:\flfrxlr.exec:\flfrxlr.exe218⤵PID:2420
-
\??\c:\bbbnbb.exec:\bbbnbb.exe219⤵PID:2648
-
\??\c:\vdpjj.exec:\vdpjj.exe220⤵PID:2576
-
\??\c:\lxxfrfl.exec:\lxxfrfl.exe221⤵PID:2644
-
\??\c:\lllllrx.exec:\lllllrx.exe222⤵PID:2744
-
\??\c:\tnbhtn.exec:\tnbhtn.exe223⤵PID:2616
-
\??\c:\vpjdj.exec:\vpjdj.exe224⤵PID:2884
-
\??\c:\3fflxxr.exec:\3fflxxr.exe225⤵PID:2832
-
\??\c:\rrffrlr.exec:\rrffrlr.exe226⤵PID:2628
-
\??\c:\hnhbtn.exec:\hnhbtn.exe227⤵PID:2664
-
\??\c:\vddpj.exec:\vddpj.exe228⤵PID:2344
-
\??\c:\9flffxx.exec:\9flffxx.exe229⤵PID:2508
-
\??\c:\7xlxfxx.exec:\7xlxfxx.exe230⤵PID:3000
-
\??\c:\tnhnbn.exec:\tnhnbn.exe231⤵PID:1944
-
\??\c:\vvppj.exec:\vvppj.exe232⤵PID:2764
-
\??\c:\llrllxr.exec:\llrllxr.exe233⤵PID:2988
-
\??\c:\hhbnbt.exec:\hhbnbt.exe234⤵PID:2836
-
\??\c:\hhbthh.exec:\hhbthh.exe235⤵PID:620
-
\??\c:\pjppv.exec:\pjppv.exe236⤵PID:1628
-
\??\c:\ffllffx.exec:\ffllffx.exe237⤵PID:340
-
\??\c:\3nbhbh.exec:\3nbhbh.exe238⤵PID:1920
-
\??\c:\nhbntb.exec:\nhbntb.exe239⤵PID:2760
-
\??\c:\ddjpd.exec:\ddjpd.exe240⤵PID:1976
-
\??\c:\ddvdv.exec:\ddvdv.exe241⤵PID:2148
-
\??\c:\7xrlxfl.exec:\7xrlxfl.exe242⤵PID:1272