Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 04:07
Behavioral task
behavioral1
Sample
1ae466e8564aee7c6498f1e6e533dde0_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
1ae466e8564aee7c6498f1e6e533dde0_NeikiAnalytics.exe
-
Size
441KB
-
MD5
1ae466e8564aee7c6498f1e6e533dde0
-
SHA1
7923159b58bce1aaf5af11afebac476d5dab7c20
-
SHA256
03df51a6b1bf2723485e07381b545b7fdbad8e850e923e72c3efcd37386b68ba
-
SHA512
d375f1180a74ee25ca03884252b477df5cc0980a28cb6064789d771e1d3f6a67619858040b201d82bae83a97b087e156686994b1d1a48718bc014a6746bfaf18
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmH7:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMx
Malware Config
Signatures
-
Detect Blackmoon payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2060-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2384-17-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3024-30-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2604-45-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2640-54-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2632-72-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1672-83-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2492-92-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2956-102-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1632-104-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1460-124-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1572-139-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1448-142-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2832-164-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1080-174-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1964-191-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1876-194-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1012-216-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3016-306-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2628-307-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1944-314-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2636-333-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1436-408-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2736-427-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1192-454-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2104-540-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1780-547-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2556-611-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2460-642-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2524-655-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1964-747-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2668-871-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/956-1051-0x00000000003B0000-0x00000000003E4000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\lfrfrlf.exe family_berbew C:\vjpvp.exe family_berbew C:\nhhnnb.exe family_berbew C:\jdjjp.exe family_berbew C:\7nbhtb.exe family_berbew C:\9llxrxl.exe family_berbew C:\thtbhh.exe family_berbew C:\djpdj.exe family_berbew C:\nhnbbt.exe family_berbew C:\5ppvj.exe family_berbew C:\rfrrfxx.exe family_berbew C:\tthntt.exe family_berbew C:\lrfrffr.exe family_berbew C:\bttbnn.exe family_berbew C:\5lrrxfl.exe family_berbew C:\3nhhtb.exe family_berbew C:\dpjpj.exe family_berbew C:\hbthnt.exe family_berbew C:\vpjpd.exe family_berbew C:\xlrfxlf.exe family_berbew C:\htnthn.exe family_berbew C:\3dppv.exe family_berbew C:\1bnnnh.exe family_berbew C:\jdvvj.exe family_berbew \??\c:\5flrxxf.exe family_berbew C:\bbtbnb.exe family_berbew C:\rrllxfl.exe family_berbew C:\7httbb.exe family_berbew C:\ddjpv.exe family_berbew C:\nbhntb.exe family_berbew C:\5dvjd.exe family_berbew C:\hbttbn.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
lfrfrlf.exevjpvp.exenhhnnb.exejdjjp.exe7nbhtb.exe9llxrxl.exethtbhh.exedjpdj.exenhnbbt.exe5ppvj.exerfrrfxx.exetthntt.exelrfrffr.exebttbnn.exe5lrrxfl.exe3nhhtb.exedpjpj.exehbthnt.exevpjpd.exexlrfxlf.exehtnthn.exe3dppv.exe1bnnnh.exejdvvj.exe5flrxxf.exebbtbnb.exerrllxfl.exe7httbb.exeddjpv.exenbhntb.exe5dvjd.exehbttbn.exe1vvdj.exepjdpj.exexxrxlrf.exebbthth.exe5vppp.exelxlxllr.exefxrffxl.exettntnt.exejjvdj.exerxrrlrl.exelfrlrrx.exe3nhbbt.exedjpvp.exelffrrrl.exe1nbnnb.exehhhnnt.exejjddj.exefrllrrl.exetntbhh.exejvppp.exevvvpv.exelfxxxlr.exebnhnbb.exepddpp.exelllrxlf.exe3lxrrrx.exebbtbbh.exevjvpp.exefrlrrlr.exexlffrxx.exetnhbnn.exeddpdj.exepid process 2384 lfrfrlf.exe 3036 vjpvp.exe 3024 nhhnnb.exe 2604 jdjjp.exe 2640 7nbhtb.exe 2452 9llxrxl.exe 2632 thtbhh.exe 1672 djpdj.exe 2492 nhnbbt.exe 2956 5ppvj.exe 1632 rfrrfxx.exe 1396 tthntt.exe 1460 lrfrffr.exe 1572 bttbnn.exe 1448 5lrrxfl.exe 2752 3nhhtb.exe 2832 dpjpj.exe 1080 hbthnt.exe 2032 vpjpd.exe 1964 xlrfxlf.exe 1876 htnthn.exe 540 3dppv.exe 1012 1bnnnh.exe 2624 jdvvj.exe 1040 5flrxxf.exe 1972 bbtbnb.exe 952 rrllxfl.exe 588 7httbb.exe 1780 ddjpv.exe 2900 nbhntb.exe 2180 5dvjd.exe 1244 hbttbn.exe 1596 1vvdj.exe 3016 pjdpj.exe 2628 xxrxlrf.exe 1944 bbthth.exe 3004 5vppp.exe 2556 lxlxllr.exe 2636 fxrffxl.exe 2600 ttntnt.exe 2816 jjvdj.exe 2584 rxrrlrl.exe 2620 lfrlrrx.exe 2460 3nhbbt.exe 2524 djpvp.exe 1524 lffrrrl.exe 1644 1nbnnb.exe 2168 hhhnnt.exe 1676 jjddj.exe 1436 frllrrl.exe 2756 tntbhh.exe 2732 jvppp.exe 2736 vvvpv.exe 2768 lfxxxlr.exe 1932 bnhnbb.exe 1100 pddpp.exe 1192 lllrxlf.exe 2856 3lxrrrx.exe 2300 bbtbbh.exe 2240 vjvpp.exe 1952 frlrrlr.exe 2028 xlffrxx.exe 540 tnhbnn.exe 2424 ddpdj.exe -
Processes:
resource yara_rule behavioral1/memory/2060-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2060-8-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2384-9-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\lfrfrlf.exe upx C:\vjpvp.exe upx behavioral1/memory/2384-17-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/3036-19-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nhhnnb.exe upx behavioral1/memory/3024-30-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jdjjp.exe upx behavioral1/memory/2604-45-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\7nbhtb.exe upx C:\9llxrxl.exe upx behavioral1/memory/2640-54-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\thtbhh.exe upx behavioral1/memory/2632-64-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2632-72-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\djpdj.exe upx behavioral1/memory/1672-74-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1672-83-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nhnbbt.exe upx behavioral1/memory/2492-85-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2492-92-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\5ppvj.exe upx C:\rfrrfxx.exe upx behavioral1/memory/2956-102-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1632-104-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\tthntt.exe upx C:\lrfrffr.exe upx behavioral1/memory/1460-124-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bttbnn.exe upx C:\5lrrxfl.exe upx behavioral1/memory/1572-139-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1448-142-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3nhhtb.exe upx C:\dpjpj.exe upx C:\hbthnt.exe upx behavioral1/memory/2832-164-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vpjpd.exe upx behavioral1/memory/1080-174-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xlrfxlf.exe upx C:\htnthn.exe upx behavioral1/memory/1964-191-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1876-194-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3dppv.exe upx C:\1bnnnh.exe upx behavioral1/memory/1012-216-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jdvvj.exe upx \??\c:\5flrxxf.exe upx C:\bbtbnb.exe upx C:\rrllxfl.exe upx C:\7httbb.exe upx behavioral1/memory/588-250-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ddjpv.exe upx C:\nbhntb.exe upx behavioral1/memory/2900-267-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\5dvjd.exe upx C:\hbttbn.exe upx behavioral1/memory/1596-292-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/3016-306-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2628-307-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1944-314-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2636-333-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2460-364-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1ae466e8564aee7c6498f1e6e533dde0_NeikiAnalytics.exelfrfrlf.exevjpvp.exenhhnnb.exejdjjp.exe7nbhtb.exe9llxrxl.exethtbhh.exedjpdj.exenhnbbt.exe5ppvj.exerfrrfxx.exetthntt.exelrfrffr.exebttbnn.exe5lrrxfl.exedescription pid process target process PID 2060 wrote to memory of 2384 2060 1ae466e8564aee7c6498f1e6e533dde0_NeikiAnalytics.exe lfrfrlf.exe PID 2060 wrote to memory of 2384 2060 1ae466e8564aee7c6498f1e6e533dde0_NeikiAnalytics.exe lfrfrlf.exe PID 2060 wrote to memory of 2384 2060 1ae466e8564aee7c6498f1e6e533dde0_NeikiAnalytics.exe lfrfrlf.exe PID 2060 wrote to memory of 2384 2060 1ae466e8564aee7c6498f1e6e533dde0_NeikiAnalytics.exe lfrfrlf.exe PID 2384 wrote to memory of 3036 2384 lfrfrlf.exe vjpvp.exe PID 2384 wrote to memory of 3036 2384 lfrfrlf.exe vjpvp.exe PID 2384 wrote to memory of 3036 2384 lfrfrlf.exe vjpvp.exe PID 2384 wrote to memory of 3036 2384 lfrfrlf.exe vjpvp.exe PID 3036 wrote to memory of 3024 3036 vjpvp.exe nhhnnb.exe PID 3036 wrote to memory of 3024 3036 vjpvp.exe nhhnnb.exe PID 3036 wrote to memory of 3024 3036 vjpvp.exe nhhnnb.exe PID 3036 wrote to memory of 3024 3036 vjpvp.exe nhhnnb.exe PID 3024 wrote to memory of 2604 3024 nhhnnb.exe jdjjp.exe PID 3024 wrote to memory of 2604 3024 nhhnnb.exe jdjjp.exe PID 3024 wrote to memory of 2604 3024 nhhnnb.exe jdjjp.exe PID 3024 wrote to memory of 2604 3024 nhhnnb.exe jdjjp.exe PID 2604 wrote to memory of 2640 2604 jdjjp.exe 7nbhtb.exe PID 2604 wrote to memory of 2640 2604 jdjjp.exe 7nbhtb.exe PID 2604 wrote to memory of 2640 2604 jdjjp.exe 7nbhtb.exe PID 2604 wrote to memory of 2640 2604 jdjjp.exe 7nbhtb.exe PID 2640 wrote to memory of 2452 2640 7nbhtb.exe 9llxrxl.exe PID 2640 wrote to memory of 2452 2640 7nbhtb.exe 9llxrxl.exe PID 2640 wrote to memory of 2452 2640 7nbhtb.exe 9llxrxl.exe PID 2640 wrote to memory of 2452 2640 7nbhtb.exe 9llxrxl.exe PID 2452 wrote to memory of 2632 2452 9llxrxl.exe thtbhh.exe PID 2452 wrote to memory of 2632 2452 9llxrxl.exe thtbhh.exe PID 2452 wrote to memory of 2632 2452 9llxrxl.exe thtbhh.exe PID 2452 wrote to memory of 2632 2452 9llxrxl.exe thtbhh.exe PID 2632 wrote to memory of 1672 2632 thtbhh.exe djpdj.exe PID 2632 wrote to memory of 1672 2632 thtbhh.exe djpdj.exe PID 2632 wrote to memory of 1672 2632 thtbhh.exe djpdj.exe PID 2632 wrote to memory of 1672 2632 thtbhh.exe djpdj.exe PID 1672 wrote to memory of 2492 1672 djpdj.exe nhnbbt.exe PID 1672 wrote to memory of 2492 1672 djpdj.exe nhnbbt.exe PID 1672 wrote to memory of 2492 1672 djpdj.exe nhnbbt.exe PID 1672 wrote to memory of 2492 1672 djpdj.exe nhnbbt.exe PID 2492 wrote to memory of 2956 2492 nhnbbt.exe 5ppvj.exe PID 2492 wrote to memory of 2956 2492 nhnbbt.exe 5ppvj.exe PID 2492 wrote to memory of 2956 2492 nhnbbt.exe 5ppvj.exe PID 2492 wrote to memory of 2956 2492 nhnbbt.exe 5ppvj.exe PID 2956 wrote to memory of 1632 2956 5ppvj.exe rfrrfxx.exe PID 2956 wrote to memory of 1632 2956 5ppvj.exe rfrrfxx.exe PID 2956 wrote to memory of 1632 2956 5ppvj.exe rfrrfxx.exe PID 2956 wrote to memory of 1632 2956 5ppvj.exe rfrrfxx.exe PID 1632 wrote to memory of 1396 1632 rfrrfxx.exe tthntt.exe PID 1632 wrote to memory of 1396 1632 rfrrfxx.exe tthntt.exe PID 1632 wrote to memory of 1396 1632 rfrrfxx.exe tthntt.exe PID 1632 wrote to memory of 1396 1632 rfrrfxx.exe tthntt.exe PID 1396 wrote to memory of 1460 1396 tthntt.exe lrfrffr.exe PID 1396 wrote to memory of 1460 1396 tthntt.exe lrfrffr.exe PID 1396 wrote to memory of 1460 1396 tthntt.exe lrfrffr.exe PID 1396 wrote to memory of 1460 1396 tthntt.exe lrfrffr.exe PID 1460 wrote to memory of 1572 1460 lrfrffr.exe bttbnn.exe PID 1460 wrote to memory of 1572 1460 lrfrffr.exe bttbnn.exe PID 1460 wrote to memory of 1572 1460 lrfrffr.exe bttbnn.exe PID 1460 wrote to memory of 1572 1460 lrfrffr.exe bttbnn.exe PID 1572 wrote to memory of 1448 1572 bttbnn.exe 5lrrxfl.exe PID 1572 wrote to memory of 1448 1572 bttbnn.exe 5lrrxfl.exe PID 1572 wrote to memory of 1448 1572 bttbnn.exe 5lrrxfl.exe PID 1572 wrote to memory of 1448 1572 bttbnn.exe 5lrrxfl.exe PID 1448 wrote to memory of 2752 1448 5lrrxfl.exe 3nhhtb.exe PID 1448 wrote to memory of 2752 1448 5lrrxfl.exe 3nhhtb.exe PID 1448 wrote to memory of 2752 1448 5lrrxfl.exe 3nhhtb.exe PID 1448 wrote to memory of 2752 1448 5lrrxfl.exe 3nhhtb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ae466e8564aee7c6498f1e6e533dde0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1ae466e8564aee7c6498f1e6e533dde0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\lfrfrlf.exec:\lfrfrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vjpvp.exec:\vjpvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\nhhnnb.exec:\nhhnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jdjjp.exec:\jdjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\7nbhtb.exec:\7nbhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\9llxrxl.exec:\9llxrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\thtbhh.exec:\thtbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\djpdj.exec:\djpdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\nhnbbt.exec:\nhnbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\5ppvj.exec:\5ppvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rfrrfxx.exec:\rfrrfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\tthntt.exec:\tthntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\lrfrffr.exec:\lrfrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\bttbnn.exec:\bttbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\5lrrxfl.exec:\5lrrxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\3nhhtb.exec:\3nhhtb.exe17⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dpjpj.exec:\dpjpj.exe18⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hbthnt.exec:\hbthnt.exe19⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vpjpd.exec:\vpjpd.exe20⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xlrfxlf.exec:\xlrfxlf.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\htnthn.exec:\htnthn.exe22⤵
- Executes dropped EXE
PID:1876 -
\??\c:\3dppv.exec:\3dppv.exe23⤵
- Executes dropped EXE
PID:540 -
\??\c:\1bnnnh.exec:\1bnnnh.exe24⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jdvvj.exec:\jdvvj.exe25⤵
- Executes dropped EXE
PID:2624 -
\??\c:\5flrxxf.exec:\5flrxxf.exe26⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bbtbnb.exec:\bbtbnb.exe27⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rrllxfl.exec:\rrllxfl.exe28⤵
- Executes dropped EXE
PID:952 -
\??\c:\7httbb.exec:\7httbb.exe29⤵
- Executes dropped EXE
PID:588 -
\??\c:\ddjpv.exec:\ddjpv.exe30⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nbhntb.exec:\nbhntb.exe31⤵
- Executes dropped EXE
PID:2900 -
\??\c:\5dvjd.exec:\5dvjd.exe32⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hbttbn.exec:\hbttbn.exe33⤵
- Executes dropped EXE
PID:1244 -
\??\c:\1vvdj.exec:\1vvdj.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pjdpj.exec:\pjdpj.exe35⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe36⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bbthth.exec:\bbthth.exe37⤵
- Executes dropped EXE
PID:1944 -
\??\c:\5vppp.exec:\5vppp.exe38⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lxlxllr.exec:\lxlxllr.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxrffxl.exec:\fxrffxl.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ttntnt.exec:\ttntnt.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jjvdj.exec:\jjvdj.exe42⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rxrrlrl.exec:\rxrrlrl.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\3nhbbt.exec:\3nhbbt.exe45⤵
- Executes dropped EXE
PID:2460 -
\??\c:\djpvp.exec:\djpvp.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\lffrrrl.exec:\lffrrrl.exe47⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1nbnnb.exec:\1nbnnb.exe48⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hhhnnt.exec:\hhhnnt.exe49⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jjddj.exec:\jjddj.exe50⤵
- Executes dropped EXE
PID:1676 -
\??\c:\frllrrl.exec:\frllrrl.exe51⤵
- Executes dropped EXE
PID:1436 -
\??\c:\tntbhh.exec:\tntbhh.exe52⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jvppp.exec:\jvppp.exe53⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vvvpv.exec:\vvvpv.exe54⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lfxxxlr.exec:\lfxxxlr.exe55⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bnhnbb.exec:\bnhnbb.exe56⤵
- Executes dropped EXE
PID:1932 -
\??\c:\pddpp.exec:\pddpp.exe57⤵
- Executes dropped EXE
PID:1100 -
\??\c:\lllrxlf.exec:\lllrxlf.exe58⤵
- Executes dropped EXE
PID:1192 -
\??\c:\3lxrrrx.exec:\3lxrrrx.exe59⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bbtbbh.exec:\bbtbbh.exe60⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vjvpp.exec:\vjvpp.exe61⤵
- Executes dropped EXE
PID:2240 -
\??\c:\frlrrlr.exec:\frlrrlr.exe62⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xlffrxx.exec:\xlffrxx.exe63⤵
- Executes dropped EXE
PID:2028 -
\??\c:\tnhbnn.exec:\tnhbnn.exe64⤵
- Executes dropped EXE
PID:540 -
\??\c:\ddpdj.exec:\ddpdj.exe65⤵
- Executes dropped EXE
PID:2424 -
\??\c:\frllxxf.exec:\frllxxf.exe66⤵PID:1700
-
\??\c:\1rlrxfr.exec:\1rlrxfr.exe67⤵PID:1188
-
\??\c:\hhhnnb.exec:\hhhnnb.exe68⤵PID:2940
-
\??\c:\vpjjd.exec:\vpjjd.exe69⤵PID:1972
-
\??\c:\5fflffl.exec:\5fflffl.exe70⤵PID:1708
-
\??\c:\bbbtht.exec:\bbbtht.exe71⤵PID:1392
-
\??\c:\ntnbth.exec:\ntnbth.exe72⤵PID:2104
-
\??\c:\djvdd.exec:\djvdd.exe73⤵PID:1780
-
\??\c:\rlflllr.exec:\rlflllr.exe74⤵PID:892
-
\??\c:\9nhnbb.exec:\9nhnbb.exe75⤵PID:2208
-
\??\c:\nbnthh.exec:\nbnthh.exe76⤵PID:1608
-
\??\c:\3dvvd.exec:\3dvvd.exe77⤵PID:2052
-
\??\c:\rfxrxxf.exec:\rfxrxxf.exe78⤵PID:2744
-
\??\c:\1lllrrr.exec:\1lllrrr.exe79⤵PID:3016
-
\??\c:\pvpdd.exec:\pvpdd.exe80⤵PID:2628
-
\??\c:\1rlxxfl.exec:\1rlxxfl.exe81⤵PID:2576
-
\??\c:\lfrlrxl.exec:\lfrlrxl.exe82⤵PID:3004
-
\??\c:\3tbthb.exec:\3tbthb.exe83⤵PID:2556
-
\??\c:\djvvj.exec:\djvvj.exe84⤵PID:2636
-
\??\c:\xrfxfxl.exec:\xrfxfxl.exe85⤵PID:2600
-
\??\c:\fxrflrf.exec:\fxrflrf.exe86⤵PID:2480
-
\??\c:\hnhhtt.exec:\hnhhtt.exe87⤵PID:2584
-
\??\c:\pjddj.exec:\pjddj.exe88⤵PID:2620
-
\??\c:\7jddp.exec:\7jddp.exe89⤵PID:2460
-
\??\c:\llflllr.exec:\llflllr.exe90⤵PID:2524
-
\??\c:\hhhnnn.exec:\hhhnnn.exe91⤵PID:1524
-
\??\c:\pdvdj.exec:\pdvdj.exe92⤵PID:1632
-
\??\c:\pvpjd.exec:\pvpjd.exe93⤵PID:1620
-
\??\c:\lfrrrlx.exec:\lfrrrlx.exe94⤵PID:1180
-
\??\c:\nhhthh.exec:\nhhthh.exe95⤵PID:2020
-
\??\c:\ddpjv.exec:\ddpjv.exe96⤵PID:772
-
\??\c:\rxrrfxr.exec:\rxrrfxr.exe97⤵PID:1448
-
\??\c:\xxlxlxr.exec:\xxlxlxr.exe98⤵PID:2736
-
\??\c:\bnthhb.exec:\bnthhb.exe99⤵PID:1136
-
\??\c:\pjpvd.exec:\pjpvd.exe100⤵PID:860
-
\??\c:\vpdvd.exec:\vpdvd.exe101⤵PID:1984
-
\??\c:\5rllxlr.exec:\5rllxlr.exe102⤵PID:2944
-
\??\c:\ttbtbn.exec:\ttbtbn.exe103⤵PID:2948
-
\??\c:\jpjdv.exec:\jpjdv.exe104⤵PID:1964
-
\??\c:\1rfllxx.exec:\1rfllxx.exe105⤵PID:600
-
\??\c:\hhbtnt.exec:\hhbtnt.exe106⤵PID:240
-
\??\c:\7nbhhh.exec:\7nbhhh.exe107⤵PID:1120
-
\??\c:\pdpvd.exec:\pdpvd.exe108⤵PID:572
-
\??\c:\fxrxrxr.exec:\fxrxrxr.exe109⤵PID:2624
-
\??\c:\hbnhnn.exec:\hbnhnn.exe110⤵PID:664
-
\??\c:\vvvjv.exec:\vvvjv.exe111⤵PID:820
-
\??\c:\ffrrlll.exec:\ffrrlll.exe112⤵PID:968
-
\??\c:\7rlfllr.exec:\7rlfllr.exe113⤵PID:984
-
\??\c:\nnbhth.exec:\nnbhth.exe114⤵PID:2084
-
\??\c:\dvppp.exec:\dvppp.exe115⤵PID:2896
-
\??\c:\9vdvv.exec:\9vdvv.exe116⤵PID:2328
-
\??\c:\xlllrrx.exec:\xlllrrx.exe117⤵PID:1688
-
\??\c:\dpddv.exec:\dpddv.exe118⤵PID:2528
-
\??\c:\ppdjp.exec:\ppdjp.exe119⤵PID:2176
-
\??\c:\xxxlxrf.exec:\xxxlxrf.exe120⤵PID:2860
-
\??\c:\htnbhh.exec:\htnbhh.exe121⤵PID:3052
-
\??\c:\jpjpj.exec:\jpjpj.exe122⤵PID:2152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-