Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 11:55
Behavioral task
behavioral1
Sample
44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe
Resource
win7-20240215-en
General
-
Target
44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe
-
Size
352KB
-
MD5
1382b1da38a9b96dbf4de51472b03f50
-
SHA1
840c3e04324f408acc54ef5ebea0c4ab3ebd161d
-
SHA256
44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6
-
SHA512
854d6a0e41723980dfd0255a5a5b1a6bd555c50fe7471651d00181f8bdbff656721eae772693398428999fb29a78c89b30e672d84612a9769d2f48af5e565b09
-
SSDEEP
6144:bcm4FmowdHoSgWrXD486jCpoAhlq1mEjBqLyOSlhNFF23e:h4wFHoSgWj168w1VjsyvhNFF2u
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2952-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/500-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/112-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-376-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1060-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1040-565-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1864-566-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/1724-575-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2684-682-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-688-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-734-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1572-769-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/328-828-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 34 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000c0000000155f6-7.dat family_berbew behavioral1/files/0x0030000000015c6f-16.dat family_berbew behavioral1/files/0x0007000000015cb0-25.dat family_berbew behavioral1/files/0x0007000000015cbd-33.dat family_berbew behavioral1/files/0x0007000000015cce-40.dat family_berbew behavioral1/files/0x0007000000015cd9-48.dat family_berbew behavioral1/files/0x0008000000015cf5-57.dat family_berbew behavioral1/files/0x000700000001654a-65.dat family_berbew behavioral1/files/0x00060000000165f0-73.dat family_berbew behavioral1/files/0x0006000000016813-82.dat family_berbew behavioral1/files/0x0006000000016a6f-89.dat family_berbew behavioral1/files/0x0006000000016c1d-99.dat family_berbew behavioral1/files/0x0006000000016c3a-107.dat family_berbew behavioral1/files/0x0006000000016c42-117.dat family_berbew behavioral1/files/0x0006000000016c8c-125.dat family_berbew behavioral1/files/0x0006000000016cb2-132.dat family_berbew behavioral1/files/0x0006000000016ce4-140.dat family_berbew behavioral1/files/0x0006000000016cf5-147.dat family_berbew behavioral1/files/0x0006000000016cfd-155.dat family_berbew behavioral1/files/0x0006000000016d05-162.dat family_berbew behavioral1/files/0x0006000000016d0e-170.dat family_berbew behavioral1/files/0x002e000000015c85-179.dat family_berbew behavioral1/files/0x0006000000016d16-187.dat family_berbew behavioral1/files/0x0006000000016d1f-194.dat family_berbew behavioral1/files/0x0006000000016d32-201.dat family_berbew behavioral1/files/0x0006000000016d36-211.dat family_berbew behavioral1/files/0x0006000000016d3a-219.dat family_berbew behavioral1/files/0x0006000000016d9f-226.dat family_berbew behavioral1/files/0x0006000000016da4-235.dat family_berbew behavioral1/files/0x0006000000016db3-242.dat family_berbew behavioral1/files/0x0006000000016e78-249.dat family_berbew behavioral1/files/0x0006000000016fe8-256.dat family_berbew behavioral1/memory/1864-23672-0x0000000077680000-0x000000007777A000-memory.dmp family_berbew behavioral1/memory/1864-26299-0x0000000077680000-0x000000007777A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2972 rfrxffr.exe 2900 lfxfxfr.exe 1340 tnbhnb.exe 2636 rflffrx.exe 2568 nhtbnt.exe 2756 9jpvj.exe 2668 hbttbh.exe 2552 tthbhb.exe 2448 pdpvd.exe 2560 frflffr.exe 1312 bnthbh.exe 2876 jjdvv.exe 2476 9hbhhh.exe 2328 nbhtbt.exe 2496 xrrxfrr.exe 2692 nnhtnb.exe 2772 5jjjj.exe 500 rrlffrf.exe 2880 xlxxrrx.exe 1544 ddpdj.exe 1548 rrxfrfx.exe 1744 9btbbb.exe 2420 vvpvd.exe 2288 3jpdv.exe 1300 hbhhtt.exe 112 vvjjj.exe 1100 bbbbtn.exe 1420 dvdpp.exe 1652 lfrxrlr.exe 1656 ffrxrrf.exe 2372 5vpvd.exe 2916 lllrxxl.exe 2344 5bnhtt.exe 2348 dpvdp.exe 768 7dpdj.exe 2276 llflxxl.exe 2400 htbttt.exe 2976 ddppd.exe 2968 vpjvd.exe 2972 llllrrl.exe 1924 bbhnbh.exe 2024 9hhtbh.exe 1736 vpvvd.exe 1340 rxxlxrf.exe 2564 5bnttb.exe 2748 djjpj.exe 2728 1jpvd.exe 3032 rrrlxlx.exe 2492 hnnhbh.exe 2456 dpdjd.exe 2448 fxrlxrf.exe 2508 bnbhhh.exe 2560 1btnbh.exe 1312 jvpvd.exe 2104 7rfllxx.exe 2876 ththbn.exe 2476 pdvpp.exe 2768 jdjpp.exe 1636 1lrfrfr.exe 1464 7hbhnt.exe 2680 tnbnbh.exe 2536 jdvvv.exe 1520 rlfrxxf.exe 1468 ffxfxfr.exe -
resource yara_rule behavioral1/memory/2952-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c0000000155f6-7.dat upx behavioral1/memory/2952-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0030000000015c6f-16.dat upx behavioral1/files/0x0007000000015cb0-25.dat upx behavioral1/memory/2900-23-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/1340-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cbd-33.dat upx behavioral1/files/0x0007000000015cce-40.dat upx behavioral1/memory/2636-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cd9-48.dat upx behavioral1/memory/2568-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015cf5-57.dat upx behavioral1/files/0x000700000001654a-65.dat upx behavioral1/files/0x00060000000165f0-73.dat upx behavioral1/memory/2552-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016813-82.dat upx behavioral1/files/0x0006000000016a6f-89.dat upx behavioral1/memory/1312-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1312-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c1d-99.dat upx behavioral1/files/0x0006000000016c3a-107.dat upx behavioral1/memory/2876-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2476-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c42-117.dat upx behavioral1/memory/2328-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c8c-125.dat upx behavioral1/files/0x0006000000016cb2-132.dat upx behavioral1/files/0x0006000000016ce4-140.dat upx behavioral1/files/0x0006000000016cf5-147.dat upx behavioral1/memory/500-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cfd-155.dat upx behavioral1/files/0x0006000000016d05-162.dat upx behavioral1/memory/1544-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1544-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d0e-170.dat upx behavioral1/files/0x002e000000015c85-179.dat upx behavioral1/memory/1744-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d16-187.dat upx behavioral1/files/0x0006000000016d1f-194.dat upx behavioral1/memory/2288-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d32-201.dat upx behavioral1/memory/1300-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d36-211.dat upx behavioral1/files/0x0006000000016d3a-219.dat upx behavioral1/memory/112-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d9f-226.dat upx behavioral1/memory/1420-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1100-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016da4-235.dat upx behavioral1/files/0x0006000000016db3-242.dat upx behavioral1/files/0x0006000000016e78-249.dat upx behavioral1/files/0x0006000000016fe8-256.dat upx behavioral1/memory/2916-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2344-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2348-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/768-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1340-323-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2972 2952 44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe 28 PID 2952 wrote to memory of 2972 2952 44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe 28 PID 2952 wrote to memory of 2972 2952 44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe 28 PID 2952 wrote to memory of 2972 2952 44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe 28 PID 2972 wrote to memory of 2900 2972 rfrxffr.exe 29 PID 2972 wrote to memory of 2900 2972 rfrxffr.exe 29 PID 2972 wrote to memory of 2900 2972 rfrxffr.exe 29 PID 2972 wrote to memory of 2900 2972 rfrxffr.exe 29 PID 2900 wrote to memory of 1340 2900 lfxfxfr.exe 30 PID 2900 wrote to memory of 1340 2900 lfxfxfr.exe 30 PID 2900 wrote to memory of 1340 2900 lfxfxfr.exe 30 PID 2900 wrote to memory of 1340 2900 lfxfxfr.exe 30 PID 1340 wrote to memory of 2636 1340 tnbhnb.exe 31 PID 1340 wrote to memory of 2636 1340 tnbhnb.exe 31 PID 1340 wrote to memory of 2636 1340 tnbhnb.exe 31 PID 1340 wrote to memory of 2636 1340 tnbhnb.exe 31 PID 2636 wrote to memory of 2568 2636 rflffrx.exe 32 PID 2636 wrote to memory of 2568 2636 rflffrx.exe 32 PID 2636 wrote to memory of 2568 2636 rflffrx.exe 32 PID 2636 wrote to memory of 2568 2636 rflffrx.exe 32 PID 2568 wrote to memory of 2756 2568 nhtbnt.exe 33 PID 2568 wrote to memory of 2756 2568 nhtbnt.exe 33 PID 2568 wrote to memory of 2756 2568 nhtbnt.exe 33 PID 2568 wrote to memory of 2756 2568 nhtbnt.exe 33 PID 2756 wrote to memory of 2668 2756 9jpvj.exe 34 PID 2756 wrote to memory of 2668 2756 9jpvj.exe 34 PID 2756 wrote to memory of 2668 2756 9jpvj.exe 34 PID 2756 wrote to memory of 2668 2756 9jpvj.exe 34 PID 2668 wrote to memory of 2552 2668 hbttbh.exe 35 PID 2668 wrote to memory of 2552 2668 hbttbh.exe 35 PID 2668 wrote to memory of 2552 2668 hbttbh.exe 35 PID 2668 wrote to memory of 2552 2668 hbttbh.exe 35 PID 2552 wrote to memory of 2448 2552 tthbhb.exe 36 PID 2552 wrote to memory of 2448 2552 tthbhb.exe 36 PID 2552 wrote to memory of 2448 2552 tthbhb.exe 36 PID 2552 wrote to memory of 2448 2552 tthbhb.exe 36 PID 2448 wrote to memory of 2560 2448 pdpvd.exe 37 PID 2448 wrote to memory of 2560 2448 pdpvd.exe 37 PID 2448 wrote to memory of 2560 2448 pdpvd.exe 37 PID 2448 wrote to memory of 2560 2448 pdpvd.exe 37 PID 2560 wrote to memory of 1312 2560 frflffr.exe 38 PID 2560 wrote to memory of 1312 2560 frflffr.exe 38 PID 2560 wrote to memory of 1312 2560 frflffr.exe 38 PID 2560 wrote to memory of 1312 2560 frflffr.exe 38 PID 1312 wrote to memory of 2876 1312 bnthbh.exe 39 PID 1312 wrote to memory of 2876 1312 bnthbh.exe 39 PID 1312 wrote to memory of 2876 1312 bnthbh.exe 39 PID 1312 wrote to memory of 2876 1312 bnthbh.exe 39 PID 2876 wrote to memory of 2476 2876 jjdvv.exe 40 PID 2876 wrote to memory of 2476 2876 jjdvv.exe 40 PID 2876 wrote to memory of 2476 2876 jjdvv.exe 40 PID 2876 wrote to memory of 2476 2876 jjdvv.exe 40 PID 2476 wrote to memory of 2328 2476 9hbhhh.exe 41 PID 2476 wrote to memory of 2328 2476 9hbhhh.exe 41 PID 2476 wrote to memory of 2328 2476 9hbhhh.exe 41 PID 2476 wrote to memory of 2328 2476 9hbhhh.exe 41 PID 2328 wrote to memory of 2496 2328 nbhtbt.exe 42 PID 2328 wrote to memory of 2496 2328 nbhtbt.exe 42 PID 2328 wrote to memory of 2496 2328 nbhtbt.exe 42 PID 2328 wrote to memory of 2496 2328 nbhtbt.exe 42 PID 2496 wrote to memory of 2692 2496 xrrxfrr.exe 43 PID 2496 wrote to memory of 2692 2496 xrrxfrr.exe 43 PID 2496 wrote to memory of 2692 2496 xrrxfrr.exe 43 PID 2496 wrote to memory of 2692 2496 xrrxfrr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\rfrxffr.exec:\rfrxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\lfxfxfr.exec:\lfxfxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\tnbhnb.exec:\tnbhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\rflffrx.exec:\rflffrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nhtbnt.exec:\nhtbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\9jpvj.exec:\9jpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\hbttbh.exec:\hbttbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\tthbhb.exec:\tthbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\pdpvd.exec:\pdpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\frflffr.exec:\frflffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\bnthbh.exec:\bnthbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\jjdvv.exec:\jjdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\9hbhhh.exec:\9hbhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\nbhtbt.exec:\nbhtbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\xrrxfrr.exec:\xrrxfrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\nnhtnb.exec:\nnhtnb.exe17⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5jjjj.exec:\5jjjj.exe18⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rrlffrf.exec:\rrlffrf.exe19⤵
- Executes dropped EXE
PID:500 -
\??\c:\xlxxrrx.exec:\xlxxrrx.exe20⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ddpdj.exec:\ddpdj.exe21⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rrxfrfx.exec:\rrxfrfx.exe22⤵
- Executes dropped EXE
PID:1548 -
\??\c:\9btbbb.exec:\9btbbb.exe23⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vvpvd.exec:\vvpvd.exe24⤵
- Executes dropped EXE
PID:2420 -
\??\c:\3jpdv.exec:\3jpdv.exe25⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hbhhtt.exec:\hbhhtt.exe26⤵
- Executes dropped EXE
PID:1300 -
\??\c:\vvjjj.exec:\vvjjj.exe27⤵
- Executes dropped EXE
PID:112 -
\??\c:\bbbbtn.exec:\bbbbtn.exe28⤵
- Executes dropped EXE
PID:1100 -
\??\c:\dvdpp.exec:\dvdpp.exe29⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lfrxrlr.exec:\lfrxrlr.exe30⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ffrxrrf.exec:\ffrxrrf.exe31⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5vpvd.exec:\5vpvd.exe32⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lllrxxl.exec:\lllrxxl.exe33⤵
- Executes dropped EXE
PID:2916 -
\??\c:\5bnhtt.exec:\5bnhtt.exe34⤵
- Executes dropped EXE
PID:2344 -
\??\c:\dpvdp.exec:\dpvdp.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7dpdj.exec:\7dpdj.exe36⤵
- Executes dropped EXE
PID:768 -
\??\c:\llflxxl.exec:\llflxxl.exe37⤵
- Executes dropped EXE
PID:2276 -
\??\c:\htbttt.exec:\htbttt.exe38⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ddppd.exec:\ddppd.exe39⤵
- Executes dropped EXE
PID:2976 -
\??\c:\vpjvd.exec:\vpjvd.exe40⤵
- Executes dropped EXE
PID:2968 -
\??\c:\llllrrl.exec:\llllrrl.exe41⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bbhnbh.exec:\bbhnbh.exe42⤵
- Executes dropped EXE
PID:1924 -
\??\c:\9hhtbh.exec:\9hhtbh.exe43⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vpvvd.exec:\vpvvd.exe44⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rxxlxrf.exec:\rxxlxrf.exe45⤵
- Executes dropped EXE
PID:1340 -
\??\c:\5bnttb.exec:\5bnttb.exe46⤵
- Executes dropped EXE
PID:2564 -
\??\c:\djjpj.exec:\djjpj.exe47⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1jpvd.exec:\1jpvd.exe48⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rrrlxlx.exec:\rrrlxlx.exe49⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hnnhbh.exec:\hnnhbh.exe50⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dpdjd.exec:\dpdjd.exe51⤵
- Executes dropped EXE
PID:2456 -
\??\c:\fxrlxrf.exec:\fxrlxrf.exe52⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bnbhhh.exec:\bnbhhh.exe53⤵
- Executes dropped EXE
PID:2508 -
\??\c:\1btnbh.exec:\1btnbh.exe54⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jvpvd.exec:\jvpvd.exe55⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7rfllxx.exec:\7rfllxx.exe56⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ththbn.exec:\ththbn.exe57⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pdvpp.exec:\pdvpp.exe58⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jdjpp.exec:\jdjpp.exe59⤵
- Executes dropped EXE
PID:2768 -
\??\c:\1lrfrfr.exec:\1lrfrfr.exe60⤵
- Executes dropped EXE
PID:1636 -
\??\c:\7hbhnt.exec:\7hbhnt.exe61⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tnbnbh.exec:\tnbnbh.exe62⤵
- Executes dropped EXE
PID:2680 -
\??\c:\jdvvv.exec:\jdvvv.exe63⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rlfrxxf.exec:\rlfrxxf.exe64⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ffxfxfr.exec:\ffxfxfr.exe65⤵
- Executes dropped EXE
PID:1468 -
\??\c:\bbnhtt.exec:\bbnhtt.exe66⤵PID:2828
-
\??\c:\5pdjd.exec:\5pdjd.exe67⤵PID:1640
-
\??\c:\rlrxlfl.exec:\rlrxlfl.exe68⤵PID:2056
-
\??\c:\rrllrfr.exec:\rrllrfr.exe69⤵PID:1232
-
\??\c:\bnbbhh.exec:\bnbbhh.exe70⤵PID:2936
-
\??\c:\dvvdj.exec:\dvvdj.exe71⤵PID:2248
-
\??\c:\pjvpv.exec:\pjvpv.exe72⤵PID:2368
-
\??\c:\rrflxff.exec:\rrflxff.exe73⤵PID:2288
-
\??\c:\3tnnnh.exec:\3tnnnh.exe74⤵PID:1572
-
\??\c:\djdvj.exec:\djdvj.exe75⤵PID:412
-
\??\c:\vpjjp.exec:\vpjjp.exe76⤵PID:2208
-
\??\c:\rfrrrrf.exec:\rfrrrrf.exe77⤵PID:2132
-
\??\c:\7thhhb.exec:\7thhhb.exe78⤵PID:1560
-
\??\c:\nhbhnh.exec:\nhbhnh.exe79⤵PID:1420
-
\??\c:\ppjdp.exec:\ppjdp.exe80⤵PID:1952
-
\??\c:\jvvdv.exec:\jvvdv.exe81⤵PID:1060
-
\??\c:\rrfxxrf.exec:\rrfxxrf.exe82⤵PID:1040
-
\??\c:\nbbntt.exec:\nbbntt.exe83⤵PID:920
-
\??\c:\jdpjv.exec:\jdpjv.exe84⤵PID:2080
-
\??\c:\jjddj.exec:\jjddj.exe85⤵PID:1244
-
\??\c:\rlfflll.exec:\rlfflll.exe86⤵PID:1524
-
\??\c:\9ntnbb.exec:\9ntnbb.exe87⤵PID:900
-
\??\c:\pjvpp.exec:\pjvpp.exe88⤵PID:1864
-
\??\c:\7ppjd.exec:\7ppjd.exe89⤵PID:1608
-
\??\c:\tthntb.exec:\tthntb.exe90⤵PID:1724
-
\??\c:\vvpvp.exec:\vvpvp.exe91⤵PID:2764
-
\??\c:\3vpjp.exec:\3vpjp.exe92⤵PID:1976
-
\??\c:\lxrfrxl.exec:\lxrfrxl.exe93⤵PID:2528
-
\??\c:\ttnnbt.exec:\ttnnbt.exe94⤵PID:2548
-
\??\c:\3thhhn.exec:\3thhhn.exe95⤵PID:2628
-
\??\c:\pjdvd.exec:\pjdvd.exe96⤵PID:2596
-
\??\c:\lxllrrx.exec:\lxllrrx.exe97⤵PID:2908
-
\??\c:\xrxfrrf.exec:\xrxfrrf.exe98⤵PID:2660
-
\??\c:\bnthhh.exec:\bnthhh.exe99⤵PID:2728
-
\??\c:\jdpvd.exec:\jdpvd.exe100⤵PID:2668
-
\??\c:\pdjjp.exec:\pdjjp.exe101⤵PID:2552
-
\??\c:\7lfxlrr.exec:\7lfxlrr.exe102⤵PID:1988
-
\??\c:\lfffllr.exec:\lfffllr.exe103⤵PID:3004
-
\??\c:\tbbtbt.exec:\tbbtbt.exe104⤵PID:2608
-
\??\c:\5dvdp.exec:\5dvdp.exe105⤵PID:1960
-
\??\c:\jdpdj.exec:\jdpdj.exe106⤵PID:2884
-
\??\c:\9fllfff.exec:\9fllfff.exe107⤵PID:2980
-
\??\c:\3thnnn.exec:\3thnnn.exe108⤵PID:2040
-
\??\c:\nhbhhb.exec:\nhbhhb.exe109⤵PID:2708
-
\??\c:\jvjpd.exec:\jvjpd.exe110⤵PID:2824
-
\??\c:\pjpvv.exec:\pjpvv.exe111⤵PID:2684
-
\??\c:\1fxfxxf.exec:\1fxfxxf.exe112⤵PID:2688
-
\??\c:\1htbnt.exec:\1htbnt.exe113⤵PID:2424
-
\??\c:\nhbhhn.exec:\nhbhhn.exe114⤵PID:2872
-
\??\c:\ppjpd.exec:\ppjpd.exe115⤵PID:2164
-
\??\c:\3xlrrxf.exec:\3xlrrxf.exe116⤵PID:1644
-
\??\c:\nbbbhn.exec:\nbbbhn.exe117⤵PID:644
-
\??\c:\hbnntb.exec:\hbnntb.exe118⤵PID:1544
-
\??\c:\dvjdd.exec:\dvjdd.exe119⤵PID:2020
-
\??\c:\xrrrffx.exec:\xrrrffx.exe120⤵PID:2932
-
\??\c:\xlfrxff.exec:\xlfrxff.exe121⤵PID:1944
-
\??\c:\hbnnth.exec:\hbnnth.exe122⤵PID:2088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-