Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 04:00
Behavioral task
behavioral1
Sample
19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe
-
Size
350KB
-
MD5
19f0c4df6baab173de1da2b99a66f000
-
SHA1
c2981d384671fe029253d6f586bbeac34c2fc5a2
-
SHA256
da8778ac051ef64556d50b0bff656375a10b5dcdd9971e1faab742fdde6920bb
-
SHA512
bdce16985c5fdf97c7f6bd997cde552c4083414a160a57e701c74221797244947703b61d1ac81943558b44fc7a274105bee9934d5d8c1fe5b51d634e04bd6596
-
SSDEEP
6144:4cm7ImGddXvJuzyy/SfVFKpU/sien7NuOpo0HmtDKe0wKyKqiOfm8RCfDK4TrHo:+7TcBuGy/Sa+/sie0OpncKe/KFBOfmzg
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
Processes:
resource yara_rule behavioral1/memory/780-1-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1916-28-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2764-77-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2924-140-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1796-168-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2328-278-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/472-395-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1696-440-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1664-525-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1488-702-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2148-862-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2400-1224-0x00000000001B0000-0x00000000001DD000-memory.dmp family_blackmoon behavioral1/memory/2160-1071-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2236-1031-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2712-863-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1744-843-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/704-829-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2080-792-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2708-773-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2944-748-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2096-717-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2096-716-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2096-715-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1952-671-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1792-500-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1652-485-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/472-401-0x00000000001B0000-0x00000000001DD000-memory.dmp family_blackmoon behavioral1/memory/2820-394-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2536-362-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2980-337-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1628-306-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/884-287-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2372-261-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1132-241-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/848-226-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1612-192-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/952-166-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1188-130-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2808-121-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2696-111-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2688-75-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2832-65-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2592-56-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2672-47-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1608-38-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2036-18-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 34 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\llflrll.exe family_berbew \??\c:\bhtthb.exe family_berbew \??\c:\5dpjv.exe family_berbew \??\c:\hhbttb.exe family_berbew C:\3jdjv.exe family_berbew \??\c:\ffrxrrr.exe family_berbew C:\3bthtb.exe family_berbew \??\c:\ntnhbt.exe family_berbew C:\xxxxlrf.exe family_berbew \??\c:\nnhttb.exe family_berbew \??\c:\1jddj.exe family_berbew C:\llflxlx.exe family_berbew C:\bthtbn.exe family_berbew \??\c:\3jdjv.exe family_berbew C:\xxxlxfr.exe family_berbew behavioral1/memory/1944-511-0x0000000000220000-0x000000000024D000-memory.dmp family_berbew \??\c:\hhtthb.exe family_berbew \??\c:\bbthbh.exe family_berbew \??\c:\pjjdd.exe family_berbew \??\c:\9rfrfrx.exe family_berbew \??\c:\ttnbnn.exe family_berbew \??\c:\xxxxlrf.exe family_berbew \??\c:\dvvpd.exe family_berbew \??\c:\hbnnbn.exe family_berbew \??\c:\llffxfx.exe family_berbew \??\c:\9jpvd.exe family_berbew \??\c:\hnntnt.exe family_berbew \??\c:\1rrlffx.exe family_berbew \??\c:\bnbhhb.exe family_berbew \??\c:\3lfrlrf.exe family_berbew \??\c:\hhhnhn.exe family_berbew \??\c:\1jvpp.exe family_berbew \??\c:\hhbhbn.exe family_berbew \??\c:\hbnhtb.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
hbnhtb.exehhbhbn.exe1jvpp.exellflrll.exebhtthb.exehhhnhn.exe5dpjv.exe3lfrlrf.exebnbhhb.exehhbttb.exe3jdjv.exeffrxrrr.exe1rrlffx.exe3bthtb.exehnntnt.exe9jpvd.exellffxfx.exehbnnbn.exentnhbt.exedvvpd.exexxxxlrf.exennhttb.exettnbnn.exe1jddj.exellflxlx.exe9rfrfrx.exebthtbn.exe3jdjv.exepjjdd.exexxxlxfr.exebbthbh.exehhtthb.exepdvdv.exexfllxll.exellflfxr.exe7ttbnb.exe5btnhh.exepjddj.exe5rlxxrl.exe5rfrlxl.exenhhtnt.exepjjpj.exe5jvdj.exeffrffrx.exe5rrffff.exevpdjp.exepjpdj.exelfxlrlr.exelrllrlr.exetbhnhb.exevvvvp.exedpjpd.exeffrlxrl.exe5rllllf.exehbbthn.exebnhthn.exeppjpj.exexfrlrxf.exeffxrlll.exennhnnb.exe7vjjj.exeppjjj.exexxrxlxr.exebbnbth.exepid process 2036 hbnhtb.exe 1916 hhbhbn.exe 1608 1jvpp.exe 2672 llflrll.exe 2592 bhtthb.exe 2832 hhhnhn.exe 2688 5dpjv.exe 2764 3lfrlrf.exe 2588 bnbhhb.exe 2100 hhbttb.exe 2696 3jdjv.exe 2804 ffrxrrr.exe 2808 1rrlffx.exe 1188 3bthtb.exe 2924 hnntnt.exe 2956 9jpvd.exe 952 llffxfx.exe 1796 hbnnbn.exe 2192 ntnhbt.exe 1612 dvvpd.exe 2340 xxxxlrf.exe 324 nnhttb.exe 1236 ttnbnn.exe 2988 1jddj.exe 848 llflxlx.exe 1132 9rfrfrx.exe 2280 bthtbn.exe 1076 3jdjv.exe 2372 pjjdd.exe 3024 xxxlxfr.exe 2328 bbthbh.exe 884 hhtthb.exe 1936 pdvdv.exe 1628 xfllxll.exe 2552 llflfxr.exe 2936 7ttbnb.exe 2744 5btnhh.exe 2824 pjddj.exe 2980 5rlxxrl.exe 1760 5rfrlxl.exe 2464 nhhtnt.exe 2948 pjjpj.exe 2148 5jvdj.exe 2536 ffrffrx.exe 2916 5rrffff.exe 2788 vpdjp.exe 2180 pjpdj.exe 2820 lfxlrlr.exe 472 lrllrlr.exe 2740 tbhnhb.exe 1720 vvvvp.exe 2308 dpjpd.exe 1796 ffrlxrl.exe 2996 5rllllf.exe 1696 hbbthn.exe 2624 bnhthn.exe 1436 ppjpj.exe 1668 xfrlrxf.exe 852 ffxrlll.exe 1144 nnhnnb.exe 628 7vjjj.exe 1652 ppjjj.exe 976 xxrxlxr.exe 960 bbnbth.exe -
Processes:
resource yara_rule behavioral1/memory/780-1-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1916-28-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2764-77-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2924-140-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1796-168-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2328-278-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2916-369-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/472-395-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1696-440-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2924-644-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/808-651-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2416-664-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2148-862-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2324-908-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2480-1090-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2888-1115-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1652-1256-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1228-1182-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2160-1071-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2236-1031-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3024-1018-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3016-999-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1788-901-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2712-863-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1744-843-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/704-829-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2080-792-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2944-748-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2096-717-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1952-671-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/908-637-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2568-630-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2284-593-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2964-538-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1664-518-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1652-485-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1652-477-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1696-433-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2820-394-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2536-362-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2980-337-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1628-306-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/884-287-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3024-269-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2372-261-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1132-241-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/848-226-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1612-192-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/952-166-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/952-157-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1188-130-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2808-121-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2696-111-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2696-102-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2100-93-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2688-75-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2688-66-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2832-65-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2592-56-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2672-47-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1608-38-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1608-29-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1916-19-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2036-18-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exehbnhtb.exehhbhbn.exe1jvpp.exellflrll.exebhtthb.exehhhnhn.exe5dpjv.exe3lfrlrf.exebnbhhb.exehhbttb.exe3jdjv.exeffrxrrr.exe1rrlffx.exe3bthtb.exehnntnt.exedescription pid process target process PID 780 wrote to memory of 2036 780 19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe nnthnt.exe PID 780 wrote to memory of 2036 780 19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe nnthnt.exe PID 780 wrote to memory of 2036 780 19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe nnthnt.exe PID 780 wrote to memory of 2036 780 19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe nnthnt.exe PID 2036 wrote to memory of 1916 2036 hbnhtb.exe hhbhbn.exe PID 2036 wrote to memory of 1916 2036 hbnhtb.exe hhbhbn.exe PID 2036 wrote to memory of 1916 2036 hbnhtb.exe hhbhbn.exe PID 2036 wrote to memory of 1916 2036 hbnhtb.exe hhbhbn.exe PID 1916 wrote to memory of 1608 1916 hhbhbn.exe 1jvpp.exe PID 1916 wrote to memory of 1608 1916 hhbhbn.exe 1jvpp.exe PID 1916 wrote to memory of 1608 1916 hhbhbn.exe 1jvpp.exe PID 1916 wrote to memory of 1608 1916 hhbhbn.exe 1jvpp.exe PID 1608 wrote to memory of 2672 1608 1jvpp.exe llflrll.exe PID 1608 wrote to memory of 2672 1608 1jvpp.exe llflrll.exe PID 1608 wrote to memory of 2672 1608 1jvpp.exe llflrll.exe PID 1608 wrote to memory of 2672 1608 1jvpp.exe llflrll.exe PID 2672 wrote to memory of 2592 2672 llflrll.exe bhtthb.exe PID 2672 wrote to memory of 2592 2672 llflrll.exe bhtthb.exe PID 2672 wrote to memory of 2592 2672 llflrll.exe bhtthb.exe PID 2672 wrote to memory of 2592 2672 llflrll.exe bhtthb.exe PID 2592 wrote to memory of 2832 2592 bhtthb.exe hhhnhn.exe PID 2592 wrote to memory of 2832 2592 bhtthb.exe hhhnhn.exe PID 2592 wrote to memory of 2832 2592 bhtthb.exe hhhnhn.exe PID 2592 wrote to memory of 2832 2592 bhtthb.exe hhhnhn.exe PID 2832 wrote to memory of 2688 2832 hhhnhn.exe 5dpjv.exe PID 2832 wrote to memory of 2688 2832 hhhnhn.exe 5dpjv.exe PID 2832 wrote to memory of 2688 2832 hhhnhn.exe 5dpjv.exe PID 2832 wrote to memory of 2688 2832 hhhnhn.exe 5dpjv.exe PID 2688 wrote to memory of 2764 2688 5dpjv.exe 3lfrlrf.exe PID 2688 wrote to memory of 2764 2688 5dpjv.exe 3lfrlrf.exe PID 2688 wrote to memory of 2764 2688 5dpjv.exe 3lfrlrf.exe PID 2688 wrote to memory of 2764 2688 5dpjv.exe 3lfrlrf.exe PID 2764 wrote to memory of 2588 2764 3lfrlrf.exe bnbhhb.exe PID 2764 wrote to memory of 2588 2764 3lfrlrf.exe bnbhhb.exe PID 2764 wrote to memory of 2588 2764 3lfrlrf.exe bnbhhb.exe PID 2764 wrote to memory of 2588 2764 3lfrlrf.exe bnbhhb.exe PID 2588 wrote to memory of 2100 2588 bnbhhb.exe hhbttb.exe PID 2588 wrote to memory of 2100 2588 bnbhhb.exe hhbttb.exe PID 2588 wrote to memory of 2100 2588 bnbhhb.exe hhbttb.exe PID 2588 wrote to memory of 2100 2588 bnbhhb.exe hhbttb.exe PID 2100 wrote to memory of 2696 2100 hhbttb.exe 3jdjv.exe PID 2100 wrote to memory of 2696 2100 hhbttb.exe 3jdjv.exe PID 2100 wrote to memory of 2696 2100 hhbttb.exe 3jdjv.exe PID 2100 wrote to memory of 2696 2100 hhbttb.exe 3jdjv.exe PID 2696 wrote to memory of 2804 2696 3jdjv.exe ffrxrrr.exe PID 2696 wrote to memory of 2804 2696 3jdjv.exe ffrxrrr.exe PID 2696 wrote to memory of 2804 2696 3jdjv.exe ffrxrrr.exe PID 2696 wrote to memory of 2804 2696 3jdjv.exe ffrxrrr.exe PID 2804 wrote to memory of 2808 2804 ffrxrrr.exe 1rrlffx.exe PID 2804 wrote to memory of 2808 2804 ffrxrrr.exe 1rrlffx.exe PID 2804 wrote to memory of 2808 2804 ffrxrrr.exe 1rrlffx.exe PID 2804 wrote to memory of 2808 2804 ffrxrrr.exe 1rrlffx.exe PID 2808 wrote to memory of 1188 2808 1rrlffx.exe 3bthtb.exe PID 2808 wrote to memory of 1188 2808 1rrlffx.exe 3bthtb.exe PID 2808 wrote to memory of 1188 2808 1rrlffx.exe 3bthtb.exe PID 2808 wrote to memory of 1188 2808 1rrlffx.exe 3bthtb.exe PID 1188 wrote to memory of 2924 1188 3bthtb.exe hnntnt.exe PID 1188 wrote to memory of 2924 1188 3bthtb.exe hnntnt.exe PID 1188 wrote to memory of 2924 1188 3bthtb.exe hnntnt.exe PID 1188 wrote to memory of 2924 1188 3bthtb.exe hnntnt.exe PID 2924 wrote to memory of 2956 2924 hnntnt.exe 9jpvd.exe PID 2924 wrote to memory of 2956 2924 hnntnt.exe 9jpvd.exe PID 2924 wrote to memory of 2956 2924 hnntnt.exe 9jpvd.exe PID 2924 wrote to memory of 2956 2924 hnntnt.exe 9jpvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnhtb.exec:\hbnhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbhbn.exec:\hhbhbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1jvpp.exec:\1jvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llflrll.exec:\llflrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhtthb.exec:\bhtthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhnhn.exec:\hhhnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5dpjv.exec:\5dpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lfrlrf.exec:\3lfrlrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnbhhb.exec:\bnbhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbttb.exec:\hhbttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3jdjv.exec:\3jdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrxrrr.exec:\ffrxrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1rrlffx.exec:\1rrlffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bthtb.exec:\3bthtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnntnt.exec:\hnntnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jpvd.exec:\9jpvd.exe17⤵
- Executes dropped EXE
-
\??\c:\llffxfx.exec:\llffxfx.exe18⤵
- Executes dropped EXE
-
\??\c:\hbnnbn.exec:\hbnnbn.exe19⤵
- Executes dropped EXE
-
\??\c:\ntnhbt.exec:\ntnhbt.exe20⤵
- Executes dropped EXE
-
\??\c:\dvvpd.exec:\dvvpd.exe21⤵
- Executes dropped EXE
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe22⤵
- Executes dropped EXE
-
\??\c:\nnhttb.exec:\nnhttb.exe23⤵
- Executes dropped EXE
-
\??\c:\ttnbnn.exec:\ttnbnn.exe24⤵
- Executes dropped EXE
-
\??\c:\1jddj.exec:\1jddj.exe25⤵
- Executes dropped EXE
-
\??\c:\llflxlx.exec:\llflxlx.exe26⤵
- Executes dropped EXE
-
\??\c:\9rfrfrx.exec:\9rfrfrx.exe27⤵
- Executes dropped EXE
-
\??\c:\bthtbn.exec:\bthtbn.exe28⤵
- Executes dropped EXE
-
\??\c:\3jdjv.exec:\3jdjv.exe29⤵
- Executes dropped EXE
-
\??\c:\pjjdd.exec:\pjjdd.exe30⤵
- Executes dropped EXE
-
\??\c:\xxxlxfr.exec:\xxxlxfr.exe31⤵
- Executes dropped EXE
-
\??\c:\bbthbh.exec:\bbthbh.exe32⤵
- Executes dropped EXE
-
\??\c:\hhtthb.exec:\hhtthb.exe33⤵
- Executes dropped EXE
-
\??\c:\pdvdv.exec:\pdvdv.exe34⤵
- Executes dropped EXE
-
\??\c:\xfllxll.exec:\xfllxll.exe35⤵
- Executes dropped EXE
-
\??\c:\llflfxr.exec:\llflfxr.exe36⤵
- Executes dropped EXE
-
\??\c:\7ttbnb.exec:\7ttbnb.exe37⤵
- Executes dropped EXE
-
\??\c:\5btnhh.exec:\5btnhh.exe38⤵
- Executes dropped EXE
-
\??\c:\pjddj.exec:\pjddj.exe39⤵
- Executes dropped EXE
-
\??\c:\5rlxxrl.exec:\5rlxxrl.exe40⤵
- Executes dropped EXE
-
\??\c:\5rfrlxl.exec:\5rfrlxl.exe41⤵
- Executes dropped EXE
-
\??\c:\nhhtnt.exec:\nhhtnt.exe42⤵
- Executes dropped EXE
-
\??\c:\pjjpj.exec:\pjjpj.exe43⤵
- Executes dropped EXE
-
\??\c:\5jvdj.exec:\5jvdj.exe44⤵
- Executes dropped EXE
-
\??\c:\ffrffrx.exec:\ffrffrx.exe45⤵
- Executes dropped EXE
-
\??\c:\5rrffff.exec:\5rrffff.exe46⤵
- Executes dropped EXE
-
\??\c:\vpdjp.exec:\vpdjp.exe47⤵
- Executes dropped EXE
-
\??\c:\pjpdj.exec:\pjpdj.exe48⤵
- Executes dropped EXE
-
\??\c:\lfxlrlr.exec:\lfxlrlr.exe49⤵
- Executes dropped EXE
-
\??\c:\lrllrlr.exec:\lrllrlr.exe50⤵
- Executes dropped EXE
-
\??\c:\tbhnhb.exec:\tbhnhb.exe51⤵
- Executes dropped EXE
-
\??\c:\vvvvp.exec:\vvvvp.exe52⤵
- Executes dropped EXE
-
\??\c:\dpjpd.exec:\dpjpd.exe53⤵
- Executes dropped EXE
-
\??\c:\ffrlxrl.exec:\ffrlxrl.exe54⤵
- Executes dropped EXE
-
\??\c:\5rllllf.exec:\5rllllf.exe55⤵
- Executes dropped EXE
-
\??\c:\hbbthn.exec:\hbbthn.exe56⤵
- Executes dropped EXE
-
\??\c:\bnhthn.exec:\bnhthn.exe57⤵
- Executes dropped EXE
-
\??\c:\ppjpj.exec:\ppjpj.exe58⤵
- Executes dropped EXE
-
\??\c:\xfrlrxf.exec:\xfrlrxf.exe59⤵
- Executes dropped EXE
-
\??\c:\ffxrlll.exec:\ffxrlll.exe60⤵
- Executes dropped EXE
-
\??\c:\nnhnnb.exec:\nnhnnb.exe61⤵
- Executes dropped EXE
-
\??\c:\7vjjj.exec:\7vjjj.exe62⤵
- Executes dropped EXE
-
\??\c:\ppjjj.exec:\ppjjj.exe63⤵
- Executes dropped EXE
-
\??\c:\xxrxlxr.exec:\xxrxlxr.exe64⤵
- Executes dropped EXE
-
\??\c:\bbnbth.exec:\bbnbth.exe65⤵
- Executes dropped EXE
-
\??\c:\tbbbhn.exec:\tbbbhn.exe66⤵
-
\??\c:\ppjvj.exec:\ppjvj.exe67⤵
-
\??\c:\9jvdp.exec:\9jvdp.exe68⤵
-
\??\c:\rllrxlx.exec:\rllrxlx.exe69⤵
-
\??\c:\bbtbnb.exec:\bbtbnb.exe70⤵
-
\??\c:\hbhntb.exec:\hbhntb.exe71⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe72⤵
-
\??\c:\jjvpj.exec:\jjvpj.exe73⤵
-
\??\c:\5rflxfl.exec:\5rflxfl.exe74⤵
-
\??\c:\rrlxrfr.exec:\rrlxrfr.exe75⤵
-
\??\c:\bbhbhn.exec:\bbhbhn.exe76⤵
-
\??\c:\bththn.exec:\bththn.exe77⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe78⤵
-
\??\c:\lfxflrf.exec:\lfxflrf.exe79⤵
-
\??\c:\tnhhtb.exec:\tnhhtb.exe80⤵
-
\??\c:\hbtbtb.exec:\hbtbtb.exe81⤵
-
\??\c:\vdjvd.exec:\vdjvd.exe82⤵
-
\??\c:\1jdjd.exec:\1jdjd.exe83⤵
-
\??\c:\lfrxllr.exec:\lfrxllr.exe84⤵
-
\??\c:\3xrrrrx.exec:\3xrrrrx.exe85⤵
-
\??\c:\bbnbtb.exec:\bbnbtb.exe86⤵
-
\??\c:\jjjpd.exec:\jjjpd.exe87⤵
-
\??\c:\frfrrrf.exec:\frfrrrf.exe88⤵
-
\??\c:\lfflfrl.exec:\lfflfrl.exe89⤵
-
\??\c:\ttnbbt.exec:\ttnbbt.exe90⤵
-
\??\c:\7dvjj.exec:\7dvjj.exe91⤵
-
\??\c:\llfrflf.exec:\llfrflf.exe92⤵
-
\??\c:\rxrrrll.exec:\rxrrrll.exe93⤵
-
\??\c:\nbtbbt.exec:\nbtbbt.exe94⤵
-
\??\c:\pjppp.exec:\pjppp.exe95⤵
-
\??\c:\7pjpv.exec:\7pjpv.exe96⤵
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe97⤵
-
\??\c:\xllllll.exec:\xllllll.exe98⤵
-
\??\c:\nbnbnt.exec:\nbnbnt.exe99⤵
-
\??\c:\vvpdd.exec:\vvpdd.exe100⤵
-
\??\c:\rrrxlrl.exec:\rrrxlrl.exe101⤵
-
\??\c:\7htttt.exec:\7htttt.exe102⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe103⤵
-
\??\c:\jvdpd.exec:\jvdpd.exe104⤵
-
\??\c:\xlrxrrl.exec:\xlrxrrl.exe105⤵
-
\??\c:\htnbth.exec:\htnbth.exe106⤵
-
\??\c:\bbnhnt.exec:\bbnhnt.exe107⤵
-
\??\c:\9pjdd.exec:\9pjdd.exe108⤵
-
\??\c:\vvjdv.exec:\vvjdv.exe109⤵
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe110⤵
-
\??\c:\bnbttn.exec:\bnbttn.exe111⤵
-
\??\c:\1bthbh.exec:\1bthbh.exe112⤵
-
\??\c:\pvvpj.exec:\pvvpj.exe113⤵
-
\??\c:\ddvjv.exec:\ddvjv.exe114⤵
-
\??\c:\ffffrfr.exec:\ffffrfr.exe115⤵
-
\??\c:\xrrflfl.exec:\xrrflfl.exe116⤵
-
\??\c:\nhnbhb.exec:\nhnbhb.exe117⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe118⤵
-
\??\c:\pppdp.exec:\pppdp.exe119⤵
-
\??\c:\xrfxfrl.exec:\xrfxfrl.exe120⤵
-
\??\c:\rrrfrrl.exec:\rrrfrrl.exe121⤵
-
\??\c:\hhbhhh.exec:\hhbhhh.exe122⤵
-
\??\c:\7jvjp.exec:\7jvjp.exe123⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe124⤵
-
\??\c:\ffrfxlf.exec:\ffrfxlf.exe125⤵
-
\??\c:\rlrrllx.exec:\rlrrllx.exe126⤵
-
\??\c:\5btbtt.exec:\5btbtt.exe127⤵
-
\??\c:\nnbtbt.exec:\nnbtbt.exe128⤵
-
\??\c:\5vjpd.exec:\5vjpd.exe129⤵
-
\??\c:\jvpdv.exec:\jvpdv.exe130⤵
-
\??\c:\rxfxlfl.exec:\rxfxlfl.exe131⤵
-
\??\c:\5htbbn.exec:\5htbbn.exe132⤵
-
\??\c:\nhbhth.exec:\nhbhth.exe133⤵
-
\??\c:\1vvdd.exec:\1vvdd.exe134⤵
-
\??\c:\pvvdj.exec:\pvvdj.exe135⤵
-
\??\c:\xxrlrfx.exec:\xxrlrfx.exe136⤵
-
\??\c:\bththn.exec:\bththn.exe137⤵
-
\??\c:\ddvvd.exec:\ddvvd.exe138⤵
-
\??\c:\jjdjj.exec:\jjdjj.exe139⤵
-
\??\c:\9xlrlfr.exec:\9xlrlfr.exe140⤵
-
\??\c:\httnth.exec:\httnth.exe141⤵
-
\??\c:\7htnnn.exec:\7htnnn.exe142⤵
-
\??\c:\jddvv.exec:\jddvv.exe143⤵
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe144⤵
-
\??\c:\lfrrllr.exec:\lfrrllr.exe145⤵
-
\??\c:\nthnbh.exec:\nthnbh.exe146⤵
-
\??\c:\ntnttb.exec:\ntnttb.exe147⤵
-
\??\c:\vvppp.exec:\vvppp.exe148⤵
-
\??\c:\rrrxrll.exec:\rrrxrll.exe149⤵
-
\??\c:\btbttn.exec:\btbttn.exe150⤵
-
\??\c:\hbbbnb.exec:\hbbbnb.exe151⤵
-
\??\c:\dpjvj.exec:\dpjvj.exe152⤵
-
\??\c:\lfrlfrl.exec:\lfrlfrl.exe153⤵
-
\??\c:\rlxfflr.exec:\rlxfflr.exe154⤵
-
\??\c:\bthhnn.exec:\bthhnn.exe155⤵
-
\??\c:\bhntbb.exec:\bhntbb.exe156⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe157⤵
-
\??\c:\jpdpj.exec:\jpdpj.exe158⤵
-
\??\c:\xrffflr.exec:\xrffflr.exe159⤵
-
\??\c:\llxflll.exec:\llxflll.exe160⤵
-
\??\c:\tbntnn.exec:\tbntnn.exe161⤵
-
\??\c:\btnbtb.exec:\btnbtb.exe162⤵
-
\??\c:\vjpdd.exec:\vjpdd.exe163⤵
-
\??\c:\vppjp.exec:\vppjp.exe164⤵
-
\??\c:\llxlxfl.exec:\llxlxfl.exe165⤵
-
\??\c:\rlffxrr.exec:\rlffxrr.exe166⤵
-
\??\c:\tnnnhn.exec:\tnnnhn.exe167⤵
-
\??\c:\9bhbnh.exec:\9bhbnh.exe168⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe169⤵
-
\??\c:\7dvdd.exec:\7dvdd.exe170⤵
-
\??\c:\xlxxllr.exec:\xlxxllr.exe171⤵
-
\??\c:\rlffrrf.exec:\rlffrrf.exe172⤵
-
\??\c:\tnntnb.exec:\tnntnb.exe173⤵
-
\??\c:\5pjpj.exec:\5pjpj.exe174⤵
-
\??\c:\xrflxxf.exec:\xrflxxf.exe175⤵
-
\??\c:\5hbbtt.exec:\5hbbtt.exe176⤵
-
\??\c:\tthhhb.exec:\tthhhb.exe177⤵
-
\??\c:\dvpvd.exec:\dvpvd.exe178⤵
-
\??\c:\1rffxfl.exec:\1rffxfl.exe179⤵
-
\??\c:\frlrxlx.exec:\frlrxlx.exe180⤵
-
\??\c:\hbnbtt.exec:\hbnbtt.exe181⤵
-
\??\c:\5hhhtt.exec:\5hhhtt.exe182⤵
-
\??\c:\ppjpv.exec:\ppjpv.exe183⤵
-
\??\c:\9vdjp.exec:\9vdjp.exe184⤵
-
\??\c:\xrflxrx.exec:\xrflxrx.exe185⤵
-
\??\c:\7xfxlrr.exec:\7xfxlrr.exe186⤵
-
\??\c:\1bthhn.exec:\1bthhn.exe187⤵
-
\??\c:\tnbhnn.exec:\tnbhnn.exe188⤵
-
\??\c:\dpjjj.exec:\dpjjj.exe189⤵
-
\??\c:\dpjpv.exec:\dpjpv.exe190⤵
-
\??\c:\rfxlrrf.exec:\rfxlrrf.exe191⤵
-
\??\c:\5lxxxrx.exec:\5lxxxrx.exe192⤵
-
\??\c:\htbbnn.exec:\htbbnn.exe193⤵
-
\??\c:\hbnnbh.exec:\hbnnbh.exe194⤵
-
\??\c:\dvpvp.exec:\dvpvp.exe195⤵
-
\??\c:\xxlflxf.exec:\xxlflxf.exe196⤵
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe197⤵
-
\??\c:\hnbhnn.exec:\hnbhnn.exe198⤵
-
\??\c:\nnbnnn.exec:\nnbnnn.exe199⤵
-
\??\c:\jpjpp.exec:\jpjpp.exe200⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe201⤵
-
\??\c:\7llrxlx.exec:\7llrxlx.exe202⤵
-
\??\c:\tnhhtt.exec:\tnhhtt.exe203⤵
-
\??\c:\3nthbt.exec:\3nthbt.exe204⤵
-
\??\c:\pjddv.exec:\pjddv.exe205⤵
-
\??\c:\jvddv.exec:\jvddv.exe206⤵
-
\??\c:\xfxxflx.exec:\xfxxflx.exe207⤵
-
\??\c:\hnhnbh.exec:\hnhnbh.exe208⤵
-
\??\c:\bnthnb.exec:\bnthnb.exe209⤵
-
\??\c:\7jpjp.exec:\7jpjp.exe210⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe211⤵
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe212⤵
-
\??\c:\llxxlfl.exec:\llxxlfl.exe213⤵
-
\??\c:\nhbbht.exec:\nhbbht.exe214⤵
-
\??\c:\tnbbtt.exec:\tnbbtt.exe215⤵
-
\??\c:\pvvpj.exec:\pvvpj.exe216⤵
-
\??\c:\dpjpp.exec:\dpjpp.exe217⤵
-
\??\c:\lrfrxlf.exec:\lrfrxlf.exe218⤵
-
\??\c:\xffrlxr.exec:\xffrlxr.exe219⤵
-
\??\c:\nnhhhh.exec:\nnhhhh.exe220⤵
-
\??\c:\vvvjj.exec:\vvvjj.exe221⤵
-
\??\c:\pvjdv.exec:\pvjdv.exe222⤵
-
\??\c:\lfxflfr.exec:\lfxflfr.exe223⤵
-
\??\c:\hntbhb.exec:\hntbhb.exe224⤵
-
\??\c:\7bbhnb.exec:\7bbhnb.exe225⤵
-
\??\c:\vjjpv.exec:\vjjpv.exe226⤵
-
\??\c:\djpvp.exec:\djpvp.exe227⤵
-
\??\c:\xxxllxl.exec:\xxxllxl.exe228⤵
-
\??\c:\llrrfxl.exec:\llrrfxl.exe229⤵
-
\??\c:\1ththb.exec:\1ththb.exe230⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe231⤵
-
\??\c:\ppppv.exec:\ppppv.exe232⤵
-
\??\c:\xlxflrx.exec:\xlxflrx.exe233⤵
-
\??\c:\1rffrxl.exec:\1rffrxl.exe234⤵
-
\??\c:\btbthh.exec:\btbthh.exe235⤵
-
\??\c:\nhttnn.exec:\nhttnn.exe236⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe237⤵
-
\??\c:\dpdjj.exec:\dpdjj.exe238⤵
-
\??\c:\xxlxllr.exec:\xxlxllr.exe239⤵
-
\??\c:\lrlrxlx.exec:\lrlrxlx.exe240⤵
-
\??\c:\tbthtt.exec:\tbthtt.exe241⤵