Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 18:57
Behavioral task
behavioral1
Sample
277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe
-
Size
226KB
-
MD5
277747026126aa2040686ebcbe81af50
-
SHA1
235969ac059178186a794d48b8003a13d7b767d2
-
SHA256
437c859ab9f84224bb98c6900dec49ba3753907499e67a611db56dc1b7c10623
-
SHA512
6838d22391a463dd509a247c257dc76095840ed609d0dd737826fceae06063084064f6d45efca3574329193f1850a007b5b202b68f8941a265692ca75e17e13a
-
SSDEEP
6144:Jcm4FmowdHoS3dGmS4Z1hraHcpOaKHpaztyzl+Si:T4wFHoS3dJS4ZzeFaKHpCcy
Malware Config
Signatures
-
Detect Blackmoon payload 56 IoCs
Processes:
resource yara_rule behavioral1/memory/2276-9-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1312-6-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2828-21-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2484-38-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2628-42-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2532-56-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2548-65-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2524-71-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2372-85-0x00000000005D0000-0x0000000000605000-memory.dmp family_blackmoon behavioral1/memory/2524-76-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2404-88-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1248-103-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2592-121-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1148-154-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/636-165-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1628-176-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1628-184-0x00000000002C0000-0x00000000002F5000-memory.dmp family_blackmoon behavioral1/memory/772-196-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1988-212-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2144-235-0x00000000002B0000-0x00000000002E5000-memory.dmp family_blackmoon behavioral1/memory/2796-261-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1548-282-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1652-291-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/288-300-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2068-309-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2316-307-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1604-321-0x0000000001BA0000-0x0000000001BD5000-memory.dmp family_blackmoon behavioral1/memory/1536-328-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2508-348-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2508-355-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2492-375-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2848-405-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2576-420-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1712-434-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2576-460-0x00000000003A0000-0x00000000003D5000-memory.dmp family_blackmoon behavioral1/memory/2708-461-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1712-475-0x00000000001B0000-0x00000000001E5000-memory.dmp family_blackmoon behavioral1/memory/2948-489-0x00000000001B0000-0x00000000001E5000-memory.dmp family_blackmoon behavioral1/memory/2948-517-0x00000000001B0000-0x00000000001E5000-memory.dmp family_blackmoon behavioral1/memory/2812-530-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1120-557-0x00000000003C0000-0x00000000003F5000-memory.dmp family_blackmoon behavioral1/memory/2248-600-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2316-638-0x00000000001B0000-0x00000000001E5000-memory.dmp family_blackmoon behavioral1/memory/2980-645-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2668-652-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2516-655-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2992-694-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1368-701-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1824-746-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/1688-784-0x00000000001B0000-0x00000000001E5000-memory.dmp family_blackmoon behavioral1/memory/2156-810-0x00000000001B0000-0x00000000001E5000-memory.dmp family_blackmoon behavioral1/memory/1468-817-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/3016-825-0x00000000002C0000-0x00000000002F5000-memory.dmp family_blackmoon behavioral1/memory/1468-845-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/3016-858-0x00000000002C0000-0x00000000002F5000-memory.dmp family_blackmoon behavioral1/memory/956-865-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\vbtnxj.exe family_berbew \??\c:\dnrfdf.exe family_berbew C:\vplbldb.exe family_berbew C:\bldnb.exe family_berbew C:\fhlhbrx.exe family_berbew \??\c:\rjxpl.exe family_berbew behavioral1/memory/2532-55-0x00000000002B0000-0x00000000002E5000-memory.dmp family_berbew C:\tjrbb.exe family_berbew C:\vtrdhjx.exe family_berbew \??\c:\vbrjpbd.exe family_berbew C:\vnhdbl.exe family_berbew C:\jjnjxt.exe family_berbew C:\nrjjfj.exe family_berbew C:\jjvlph.exe family_berbew C:\vprhf.exe family_berbew C:\ntdrn.exe family_berbew \??\c:\fbldndl.exe family_berbew C:\ljjlp.exe family_berbew \??\c:\tvrrbv.exe family_berbew C:\jhhtn.exe family_berbew \??\c:\nnnprnr.exe family_berbew C:\nnhlx.exe family_berbew C:\jjnpnh.exe family_berbew C:\hvbvlb.exe family_berbew \??\c:\nhljj.exe family_berbew C:\rbhjvn.exe family_berbew \??\c:\jjjdb.exe family_berbew \??\c:\vjrlpl.exe family_berbew \??\c:\hvfpbf.exe family_berbew C:\hvdjtr.exe family_berbew \??\c:\lblvbxx.exe family_berbew C:\pbbflt.exe family_berbew C:\tnxbp.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
vbtnxj.exednrfdf.exevplbldb.exebldnb.exefhlhbrx.exerjxpl.exetjrbb.exevbrjpbd.exevtrdhjx.exevnhdbl.exejjnjxt.exenrjjfj.exejjvlph.exevprhf.exentdrn.exefbldndl.exeljjlp.exetvrrbv.exejhhtn.exennnprnr.exennhlx.exejjnpnh.exehvbvlb.exenhljj.exerbhjvn.exejjjdb.exevjrlpl.exehvfpbf.exehvdjtr.exelblvbxx.exepbbflt.exetnxbp.exelflrhr.exetpbpv.exehnvxhbn.exexnbjl.exedftjx.exeptnbvrb.exelrxlxh.exexlfrhr.exethbnbnt.exedthbdbb.exebnvln.exexfjfhv.exevfhbxtn.exebrvjp.exelflblx.exerjdxr.exebtrfdb.exerxtjvlb.exepttxlxb.exevxvdp.exevjjlrp.exepfprvx.exetnrbrlh.exetnfvt.exeptrfxlp.exehfbnv.exexvvnd.exefvxhtbx.exerjpvrf.exedxftjfv.exehhrbrll.exehprjj.exepid process 2276 vbtnxj.exe 2828 dnrfdf.exe 2484 vplbldb.exe 2628 bldnb.exe 2532 fhlhbrx.exe 2548 rjxpl.exe 2524 tjrbb.exe 2372 vbrjpbd.exe 2404 vtrdhjx.exe 1248 vnhdbl.exe 1012 jjnjxt.exe 2592 nrjjfj.exe 1488 jjvlph.exe 1980 vprhf.exe 1948 ntdrn.exe 1148 fbldndl.exe 636 ljjlp.exe 1768 tvrrbv.exe 1628 jhhtn.exe 2812 nnnprnr.exe 772 nnhlx.exe 2212 jjnpnh.exe 1988 hvbvlb.exe 2232 nhljj.exe 2144 rbhjvn.exe 2004 jjjdb.exe 800 vjrlpl.exe 2796 hvfpbf.exe 1952 hvdjtr.exe 1548 lblvbxx.exe 1652 pbbflt.exe 288 tnxbp.exe 2316 lflrhr.exe 2068 tpbpv.exe 1604 hnvxhbn.exe 1536 xnbjl.exe 2448 dftjx.exe 2996 ptnbvrb.exe 2660 lrxlxh.exe 2508 xlfrhr.exe 2652 thbnbnt.exe 2360 dthbdbb.exe 2548 bnvln.exe 2492 xfjfhv.exe 2524 vfhbxtn.exe 2428 brvjp.exe 2840 lflblx.exe 2848 rjdxr.exe 1008 btrfdb.exe 2576 rxtjvlb.exe 2596 pttxlxb.exe 1712 vxvdp.exe 1976 vjjlrp.exe 1524 pfprvx.exe 1252 tnrbrlh.exe 2708 tnfvt.exe 308 ptrfxlp.exe 1696 hfbnv.exe 2720 xvvnd.exe 2948 fvxhtbx.exe 2812 rjpvrf.exe 1504 dxftjfv.exe 2788 hhrbrll.exe 2212 hprjj.exe -
Processes:
resource yara_rule behavioral1/memory/1312-0-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\vbtnxj.exe upx behavioral1/memory/2276-9-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1312-6-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\dnrfdf.exe upx behavioral1/memory/2828-21-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2276-15-0x0000000000220000-0x0000000000255000-memory.dmp upx C:\vplbldb.exe upx behavioral1/memory/2484-29-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\bldnb.exe upx C:\fhlhbrx.exe upx behavioral1/memory/2484-38-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2628-42-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\rjxpl.exe upx behavioral1/memory/2532-56-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2548-65-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\tjrbb.exe upx C:\vtrdhjx.exe upx \??\c:\vbrjpbd.exe upx behavioral1/memory/2524-76-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2404-88-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\vnhdbl.exe upx C:\jjnjxt.exe upx behavioral1/memory/1248-103-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\nrjjfj.exe upx behavioral1/memory/2592-121-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\jjvlph.exe upx C:\vprhf.exe upx C:\ntdrn.exe upx behavioral1/memory/1148-147-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\fbldndl.exe upx C:\ljjlp.exe upx behavioral1/memory/1148-154-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\tvrrbv.exe upx behavioral1/memory/636-165-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\jhhtn.exe upx behavioral1/memory/1628-176-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\nnnprnr.exe upx C:\nnhlx.exe upx behavioral1/memory/772-196-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\jjnpnh.exe upx C:\hvbvlb.exe upx behavioral1/memory/1988-212-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\nhljj.exe upx C:\rbhjvn.exe upx \??\c:\jjjdb.exe upx behavioral1/memory/2004-237-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\vjrlpl.exe upx \??\c:\hvfpbf.exe upx behavioral1/memory/2796-261-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1952-263-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\hvdjtr.exe upx behavioral1/memory/1548-275-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\lblvbxx.exe upx C:\pbbflt.exe upx behavioral1/memory/1548-282-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1652-291-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\tnxbp.exe upx behavioral1/memory/2068-309-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2316-307-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1536-328-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2508-348-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2508-355-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2492-375-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
277747026126aa2040686ebcbe81af50_NeikiAnalytics.exevbtnxj.exednrfdf.exevplbldb.exebldnb.exefhlhbrx.exerjxpl.exetjrbb.exevbrjpbd.exevtrdhjx.exevnhdbl.exejjnjxt.exenrjjfj.exejjvlph.exevprhf.exentdrn.exedescription pid process target process PID 1312 wrote to memory of 2276 1312 277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe vbtnxj.exe PID 1312 wrote to memory of 2276 1312 277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe vbtnxj.exe PID 1312 wrote to memory of 2276 1312 277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe vbtnxj.exe PID 1312 wrote to memory of 2276 1312 277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe vbtnxj.exe PID 2276 wrote to memory of 2828 2276 vbtnxj.exe dnrfdf.exe PID 2276 wrote to memory of 2828 2276 vbtnxj.exe dnrfdf.exe PID 2276 wrote to memory of 2828 2276 vbtnxj.exe dnrfdf.exe PID 2276 wrote to memory of 2828 2276 vbtnxj.exe dnrfdf.exe PID 2828 wrote to memory of 2484 2828 dnrfdf.exe vplbldb.exe PID 2828 wrote to memory of 2484 2828 dnrfdf.exe vplbldb.exe PID 2828 wrote to memory of 2484 2828 dnrfdf.exe vplbldb.exe PID 2828 wrote to memory of 2484 2828 dnrfdf.exe vplbldb.exe PID 2484 wrote to memory of 2628 2484 vplbldb.exe bldnb.exe PID 2484 wrote to memory of 2628 2484 vplbldb.exe bldnb.exe PID 2484 wrote to memory of 2628 2484 vplbldb.exe bldnb.exe PID 2484 wrote to memory of 2628 2484 vplbldb.exe bldnb.exe PID 2628 wrote to memory of 2532 2628 bldnb.exe fhlhbrx.exe PID 2628 wrote to memory of 2532 2628 bldnb.exe fhlhbrx.exe PID 2628 wrote to memory of 2532 2628 bldnb.exe fhlhbrx.exe PID 2628 wrote to memory of 2532 2628 bldnb.exe fhlhbrx.exe PID 2532 wrote to memory of 2548 2532 fhlhbrx.exe rjxpl.exe PID 2532 wrote to memory of 2548 2532 fhlhbrx.exe rjxpl.exe PID 2532 wrote to memory of 2548 2532 fhlhbrx.exe rjxpl.exe PID 2532 wrote to memory of 2548 2532 fhlhbrx.exe rjxpl.exe PID 2548 wrote to memory of 2524 2548 rjxpl.exe tjrbb.exe PID 2548 wrote to memory of 2524 2548 rjxpl.exe tjrbb.exe PID 2548 wrote to memory of 2524 2548 rjxpl.exe tjrbb.exe PID 2548 wrote to memory of 2524 2548 rjxpl.exe tjrbb.exe PID 2524 wrote to memory of 2372 2524 tjrbb.exe vbrjpbd.exe PID 2524 wrote to memory of 2372 2524 tjrbb.exe vbrjpbd.exe PID 2524 wrote to memory of 2372 2524 tjrbb.exe vbrjpbd.exe PID 2524 wrote to memory of 2372 2524 tjrbb.exe vbrjpbd.exe PID 2372 wrote to memory of 2404 2372 vbrjpbd.exe vtrdhjx.exe PID 2372 wrote to memory of 2404 2372 vbrjpbd.exe vtrdhjx.exe PID 2372 wrote to memory of 2404 2372 vbrjpbd.exe vtrdhjx.exe PID 2372 wrote to memory of 2404 2372 vbrjpbd.exe vtrdhjx.exe PID 2404 wrote to memory of 1248 2404 vtrdhjx.exe vnhdbl.exe PID 2404 wrote to memory of 1248 2404 vtrdhjx.exe vnhdbl.exe PID 2404 wrote to memory of 1248 2404 vtrdhjx.exe vnhdbl.exe PID 2404 wrote to memory of 1248 2404 vtrdhjx.exe vnhdbl.exe PID 1248 wrote to memory of 1012 1248 vnhdbl.exe jjnjxt.exe PID 1248 wrote to memory of 1012 1248 vnhdbl.exe jjnjxt.exe PID 1248 wrote to memory of 1012 1248 vnhdbl.exe jjnjxt.exe PID 1248 wrote to memory of 1012 1248 vnhdbl.exe jjnjxt.exe PID 1012 wrote to memory of 2592 1012 jjnjxt.exe nrjjfj.exe PID 1012 wrote to memory of 2592 1012 jjnjxt.exe nrjjfj.exe PID 1012 wrote to memory of 2592 1012 jjnjxt.exe nrjjfj.exe PID 1012 wrote to memory of 2592 1012 jjnjxt.exe nrjjfj.exe PID 2592 wrote to memory of 1488 2592 nrjjfj.exe jjvlph.exe PID 2592 wrote to memory of 1488 2592 nrjjfj.exe jjvlph.exe PID 2592 wrote to memory of 1488 2592 nrjjfj.exe jjvlph.exe PID 2592 wrote to memory of 1488 2592 nrjjfj.exe jjvlph.exe PID 1488 wrote to memory of 1980 1488 jjvlph.exe vprhf.exe PID 1488 wrote to memory of 1980 1488 jjvlph.exe vprhf.exe PID 1488 wrote to memory of 1980 1488 jjvlph.exe vprhf.exe PID 1488 wrote to memory of 1980 1488 jjvlph.exe vprhf.exe PID 1980 wrote to memory of 1948 1980 vprhf.exe ntdrn.exe PID 1980 wrote to memory of 1948 1980 vprhf.exe ntdrn.exe PID 1980 wrote to memory of 1948 1980 vprhf.exe ntdrn.exe PID 1980 wrote to memory of 1948 1980 vprhf.exe ntdrn.exe PID 1948 wrote to memory of 1148 1948 ntdrn.exe fbldndl.exe PID 1948 wrote to memory of 1148 1948 ntdrn.exe fbldndl.exe PID 1948 wrote to memory of 1148 1948 ntdrn.exe fbldndl.exe PID 1948 wrote to memory of 1148 1948 ntdrn.exe fbldndl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\277747026126aa2040686ebcbe81af50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vbtnxj.exec:\vbtnxj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dnrfdf.exec:\dnrfdf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vplbldb.exec:\vplbldb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bldnb.exec:\bldnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fhlhbrx.exec:\fhlhbrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rjxpl.exec:\rjxpl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tjrbb.exec:\tjrbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vbrjpbd.exec:\vbrjpbd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vtrdhjx.exec:\vtrdhjx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vnhdbl.exec:\vnhdbl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjnjxt.exec:\jjnjxt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nrjjfj.exec:\nrjjfj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjvlph.exec:\jjvlph.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vprhf.exec:\vprhf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntdrn.exec:\ntdrn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fbldndl.exec:\fbldndl.exe17⤵
- Executes dropped EXE
-
\??\c:\ljjlp.exec:\ljjlp.exe18⤵
- Executes dropped EXE
-
\??\c:\tvrrbv.exec:\tvrrbv.exe19⤵
- Executes dropped EXE
-
\??\c:\jhhtn.exec:\jhhtn.exe20⤵
- Executes dropped EXE
-
\??\c:\nnnprnr.exec:\nnnprnr.exe21⤵
- Executes dropped EXE
-
\??\c:\nnhlx.exec:\nnhlx.exe22⤵
- Executes dropped EXE
-
\??\c:\jjnpnh.exec:\jjnpnh.exe23⤵
- Executes dropped EXE
-
\??\c:\hvbvlb.exec:\hvbvlb.exe24⤵
- Executes dropped EXE
-
\??\c:\nhljj.exec:\nhljj.exe25⤵
- Executes dropped EXE
-
\??\c:\rbhjvn.exec:\rbhjvn.exe26⤵
- Executes dropped EXE
-
\??\c:\jjjdb.exec:\jjjdb.exe27⤵
- Executes dropped EXE
-
\??\c:\vjrlpl.exec:\vjrlpl.exe28⤵
- Executes dropped EXE
-
\??\c:\hvfpbf.exec:\hvfpbf.exe29⤵
- Executes dropped EXE
-
\??\c:\hvdjtr.exec:\hvdjtr.exe30⤵
- Executes dropped EXE
-
\??\c:\lblvbxx.exec:\lblvbxx.exe31⤵
- Executes dropped EXE
-
\??\c:\pbbflt.exec:\pbbflt.exe32⤵
- Executes dropped EXE
-
\??\c:\tnxbp.exec:\tnxbp.exe33⤵
- Executes dropped EXE
-
\??\c:\lflrhr.exec:\lflrhr.exe34⤵
- Executes dropped EXE
-
\??\c:\tpbpv.exec:\tpbpv.exe35⤵
- Executes dropped EXE
-
\??\c:\hnvxhbn.exec:\hnvxhbn.exe36⤵
- Executes dropped EXE
-
\??\c:\xnbjl.exec:\xnbjl.exe37⤵
- Executes dropped EXE
-
\??\c:\dftjx.exec:\dftjx.exe38⤵
- Executes dropped EXE
-
\??\c:\ptnbvrb.exec:\ptnbvrb.exe39⤵
- Executes dropped EXE
-
\??\c:\lrxlxh.exec:\lrxlxh.exe40⤵
- Executes dropped EXE
-
\??\c:\xlfrhr.exec:\xlfrhr.exe41⤵
- Executes dropped EXE
-
\??\c:\thbnbnt.exec:\thbnbnt.exe42⤵
- Executes dropped EXE
-
\??\c:\dthbdbb.exec:\dthbdbb.exe43⤵
- Executes dropped EXE
-
\??\c:\bnvln.exec:\bnvln.exe44⤵
- Executes dropped EXE
-
\??\c:\xfjfhv.exec:\xfjfhv.exe45⤵
- Executes dropped EXE
-
\??\c:\vfhbxtn.exec:\vfhbxtn.exe46⤵
- Executes dropped EXE
-
\??\c:\brvjp.exec:\brvjp.exe47⤵
- Executes dropped EXE
-
\??\c:\lflblx.exec:\lflblx.exe48⤵
- Executes dropped EXE
-
\??\c:\rjdxr.exec:\rjdxr.exe49⤵
- Executes dropped EXE
-
\??\c:\btrfdb.exec:\btrfdb.exe50⤵
- Executes dropped EXE
-
\??\c:\rxtjvlb.exec:\rxtjvlb.exe51⤵
- Executes dropped EXE
-
\??\c:\pttxlxb.exec:\pttxlxb.exe52⤵
- Executes dropped EXE
-
\??\c:\vxvdp.exec:\vxvdp.exe53⤵
- Executes dropped EXE
-
\??\c:\vjjlrp.exec:\vjjlrp.exe54⤵
- Executes dropped EXE
-
\??\c:\pfprvx.exec:\pfprvx.exe55⤵
- Executes dropped EXE
-
\??\c:\tnrbrlh.exec:\tnrbrlh.exe56⤵
- Executes dropped EXE
-
\??\c:\tnfvt.exec:\tnfvt.exe57⤵
- Executes dropped EXE
-
\??\c:\ptrfxlp.exec:\ptrfxlp.exe58⤵
- Executes dropped EXE
-
\??\c:\hfbnv.exec:\hfbnv.exe59⤵
- Executes dropped EXE
-
\??\c:\xvvnd.exec:\xvvnd.exe60⤵
- Executes dropped EXE
-
\??\c:\fvxhtbx.exec:\fvxhtbx.exe61⤵
- Executes dropped EXE
-
\??\c:\rjpvrf.exec:\rjpvrf.exe62⤵
- Executes dropped EXE
-
\??\c:\dxftjfv.exec:\dxftjfv.exe63⤵
- Executes dropped EXE
-
\??\c:\hhrbrll.exec:\hhrbrll.exe64⤵
- Executes dropped EXE
-
\??\c:\hprjj.exec:\hprjj.exe65⤵
- Executes dropped EXE
-
\??\c:\tnlbjt.exec:\tnlbjt.exe66⤵
-
\??\c:\lvhlnl.exec:\lvhlnl.exe67⤵
-
\??\c:\lndjld.exec:\lndjld.exe68⤵
-
\??\c:\vfhxv.exec:\vfhxv.exe69⤵
-
\??\c:\phttdpp.exec:\phttdpp.exe70⤵
-
\??\c:\jfndx.exec:\jfndx.exe71⤵
-
\??\c:\ftldl.exec:\ftldl.exe72⤵
-
\??\c:\djjrhjd.exec:\djjrhjd.exe73⤵
-
\??\c:\lxpxtj.exec:\lxpxtj.exe74⤵
-
\??\c:\bhfpdlp.exec:\bhfpdlp.exe75⤵
-
\??\c:\btffpfj.exec:\btffpfj.exe76⤵
-
\??\c:\xdrlt.exec:\xdrlt.exe77⤵
-
\??\c:\vxjbf.exec:\vxjbf.exe78⤵
-
\??\c:\bxvrvd.exec:\bxvrvd.exe79⤵
-
\??\c:\btvbj.exec:\btvbj.exe80⤵
-
\??\c:\fbpfv.exec:\fbpfv.exe81⤵
-
\??\c:\bxxbrxp.exec:\bxxbrxp.exe82⤵
-
\??\c:\bfxvrfx.exec:\bfxvrfx.exe83⤵
-
\??\c:\vxtrvn.exec:\vxtrvn.exe84⤵
-
\??\c:\xfhjtrp.exec:\xfhjtrp.exe85⤵
-
\??\c:\dxhlfll.exec:\dxhlfll.exe86⤵
-
\??\c:\njdvjv.exec:\njdvjv.exe87⤵
-
\??\c:\jvdbbp.exec:\jvdbbp.exe88⤵
-
\??\c:\tlllbdh.exec:\tlllbdh.exe89⤵
-
\??\c:\tbbhxr.exec:\tbbhxr.exe90⤵
-
\??\c:\hrhfbr.exec:\hrhfbr.exe91⤵
-
\??\c:\lhbxb.exec:\lhbxb.exe92⤵
-
\??\c:\vrfvrjx.exec:\vrfvrjx.exe93⤵
-
\??\c:\jbdfjrn.exec:\jbdfjrn.exe94⤵
-
\??\c:\tbrdfbb.exec:\tbrdfbb.exe95⤵
-
\??\c:\bxffbx.exec:\bxffbx.exe96⤵
-
\??\c:\txfjtvj.exec:\txfjtvj.exe97⤵
-
\??\c:\pdjxp.exec:\pdjxp.exe98⤵
-
\??\c:\pdrpfvt.exec:\pdrpfvt.exe99⤵
-
\??\c:\pldfv.exec:\pldfv.exe100⤵
-
\??\c:\xbhjrbt.exec:\xbhjrbt.exe101⤵
-
\??\c:\hjnxd.exec:\hjnxd.exe102⤵
-
\??\c:\bhbphd.exec:\bhbphd.exe103⤵
-
\??\c:\ljprhxl.exec:\ljprhxl.exe104⤵
-
\??\c:\xxhtd.exec:\xxhtd.exe105⤵
-
\??\c:\hfnfxjj.exec:\hfnfxjj.exe106⤵
-
\??\c:\jdhjtb.exec:\jdhjtb.exe107⤵
-
\??\c:\hdbtxt.exec:\hdbtxt.exe108⤵
-
\??\c:\djxjdp.exec:\djxjdp.exe109⤵
-
\??\c:\nvvhd.exec:\nvvhd.exe110⤵
-
\??\c:\tpbtvl.exec:\tpbtvl.exe111⤵
-
\??\c:\dpbjt.exec:\dpbjt.exe112⤵
-
\??\c:\bjflv.exec:\bjflv.exe113⤵
-
\??\c:\ldrdn.exec:\ldrdn.exe114⤵
-
\??\c:\jtbbj.exec:\jtbbj.exe115⤵
-
\??\c:\nfpfn.exec:\nfpfn.exe116⤵
-
\??\c:\nvnpx.exec:\nvnpx.exe117⤵
-
\??\c:\vtndjvd.exec:\vtndjvd.exe118⤵
-
\??\c:\rlbjhpl.exec:\rlbjhpl.exe119⤵
-
\??\c:\jfvdnx.exec:\jfvdnx.exe120⤵
-
\??\c:\jdrtjr.exec:\jdrtjr.exe121⤵
-
\??\c:\bhxjtdl.exec:\bhxjtdl.exe122⤵
-
\??\c:\xrxhd.exec:\xrxhd.exe123⤵
-
\??\c:\dbxbjr.exec:\dbxbjr.exe124⤵
-
\??\c:\hbvtd.exec:\hbvtd.exe125⤵
-
\??\c:\jhpbt.exec:\jhpbt.exe126⤵
-
\??\c:\vhdjxr.exec:\vhdjxr.exe127⤵
-
\??\c:\vhxff.exec:\vhxff.exe128⤵
-
\??\c:\tthdnhd.exec:\tthdnhd.exe129⤵
-
\??\c:\hrvdpbx.exec:\hrvdpbx.exe130⤵
-
\??\c:\ftfrd.exec:\ftfrd.exe131⤵
-
\??\c:\dvjjrv.exec:\dvjjrv.exe132⤵
-
\??\c:\nbjjnfb.exec:\nbjjnfb.exe133⤵
-
\??\c:\fjxrjp.exec:\fjxrjp.exe134⤵
-
\??\c:\htrxfjp.exec:\htrxfjp.exe135⤵
-
\??\c:\dnvvj.exec:\dnvvj.exe136⤵
-
\??\c:\tjhxt.exec:\tjhxt.exe137⤵
-
\??\c:\vttltj.exec:\vttltj.exe138⤵
-
\??\c:\jvvjjr.exec:\jvvjjr.exe139⤵
-
\??\c:\fjpfb.exec:\fjpfb.exe140⤵
-
\??\c:\bpjjhth.exec:\bpjjhth.exe141⤵
-
\??\c:\pjjhlfx.exec:\pjjhlfx.exe142⤵
-
\??\c:\djfbnx.exec:\djfbnx.exe143⤵
-
\??\c:\fjhrb.exec:\fjhrb.exe144⤵
-
\??\c:\dhhfvpb.exec:\dhhfvpb.exe145⤵
-
\??\c:\jvvrj.exec:\jvvrj.exe146⤵
-
\??\c:\bxjtldb.exec:\bxjtldb.exe147⤵
-
\??\c:\ldtvlbj.exec:\ldtvlbj.exe148⤵
-
\??\c:\rvvjxl.exec:\rvvjxl.exe149⤵
-
\??\c:\pvjnbjt.exec:\pvjnbjt.exe150⤵
-
\??\c:\bbnjjxh.exec:\bbnjjxh.exe151⤵
-
\??\c:\vphxnn.exec:\vphxnn.exe152⤵
-
\??\c:\nrlvr.exec:\nrlvr.exe153⤵
-
\??\c:\dpthjp.exec:\dpthjp.exe154⤵
-
\??\c:\ltbht.exec:\ltbht.exe155⤵
-
\??\c:\pjxlft.exec:\pjxlft.exe156⤵
-
\??\c:\rfrrnj.exec:\rfrrnj.exe157⤵
-
\??\c:\nffjvjt.exec:\nffjvjt.exe158⤵
-
\??\c:\bxrpxff.exec:\bxrpxff.exe159⤵
-
\??\c:\nddbth.exec:\nddbth.exe160⤵
-
\??\c:\ldjtrth.exec:\ldjtrth.exe161⤵
-
\??\c:\xtddtx.exec:\xtddtx.exe162⤵
-
\??\c:\hnppnr.exec:\hnppnr.exe163⤵
-
\??\c:\fvttjdr.exec:\fvttjdr.exe164⤵
-
\??\c:\bnxdp.exec:\bnxdp.exe165⤵
-
\??\c:\lbbltff.exec:\lbbltff.exe166⤵
-
\??\c:\htxfv.exec:\htxfv.exe167⤵
-
\??\c:\jbhjvt.exec:\jbhjvt.exe168⤵
-
\??\c:\dthjtdt.exec:\dthjtdt.exe169⤵
-
\??\c:\hrxtndp.exec:\hrxtndp.exe170⤵
-
\??\c:\rhpjhf.exec:\rhpjhf.exe171⤵
-
\??\c:\nddjff.exec:\nddjff.exe172⤵
-
\??\c:\xjhhjp.exec:\xjhhjp.exe173⤵
-
\??\c:\bptnv.exec:\bptnv.exe174⤵
-
\??\c:\djdfvr.exec:\djdfvr.exe175⤵
-
\??\c:\vxfxb.exec:\vxfxb.exe176⤵
-
\??\c:\ltnfl.exec:\ltnfl.exe177⤵
-
\??\c:\jvxdtnr.exec:\jvxdtnr.exe178⤵
-
\??\c:\dtdjnlt.exec:\dtdjnlt.exe179⤵
-
\??\c:\hdhtdrt.exec:\hdhtdrt.exe180⤵
-
\??\c:\vlrrlfj.exec:\vlrrlfj.exe181⤵
-
\??\c:\htvdb.exec:\htvdb.exe182⤵
-
\??\c:\lvhnnvp.exec:\lvhnnvp.exe183⤵
-
\??\c:\nnjjfxl.exec:\nnjjfxl.exe184⤵
-
\??\c:\jthlnj.exec:\jthlnj.exe185⤵
-
\??\c:\dtthr.exec:\dtthr.exe186⤵
-
\??\c:\nbjdhrr.exec:\nbjdhrr.exe187⤵
-
\??\c:\prhrrv.exec:\prhrrv.exe188⤵
-
\??\c:\fnvbbx.exec:\fnvbbx.exe189⤵
-
\??\c:\flnphb.exec:\flnphb.exe190⤵
-
\??\c:\xnpjnj.exec:\xnpjnj.exe191⤵
-
\??\c:\dpjxtd.exec:\dpjxtd.exe192⤵
-
\??\c:\tlfhdjb.exec:\tlfhdjb.exe193⤵
-
\??\c:\hhjrjv.exec:\hhjrjv.exe194⤵
-
\??\c:\dbjrvx.exec:\dbjrvx.exe195⤵
-
\??\c:\pbnfx.exec:\pbnfx.exe196⤵
-
\??\c:\hjlpd.exec:\hjlpd.exe197⤵
-
\??\c:\lbbpb.exec:\lbbpb.exe198⤵
-
\??\c:\dbvfrj.exec:\dbvfrj.exe199⤵
-
\??\c:\vrfjxf.exec:\vrfjxf.exe200⤵
-
\??\c:\dxlfhl.exec:\dxlfhl.exe201⤵
-
\??\c:\pfdjn.exec:\pfdjn.exe202⤵
-
\??\c:\bjjlvxj.exec:\bjjlvxj.exe203⤵
-
\??\c:\bljrpt.exec:\bljrpt.exe204⤵
-
\??\c:\pvxpnll.exec:\pvxpnll.exe205⤵
-
\??\c:\jdxtr.exec:\jdxtr.exe206⤵
-
\??\c:\ltvhr.exec:\ltvhr.exe207⤵
-
\??\c:\nrrhp.exec:\nrrhp.exe208⤵
-
\??\c:\rvbnd.exec:\rvbnd.exe209⤵
-
\??\c:\pprpxl.exec:\pprpxl.exe210⤵
-
\??\c:\lpnxdf.exec:\lpnxdf.exe211⤵
-
\??\c:\rbvxjx.exec:\rbvxjx.exe212⤵
-
\??\c:\vhxnhft.exec:\vhxnhft.exe213⤵
-
\??\c:\dxhnfh.exec:\dxhnfh.exe214⤵
-
\??\c:\jpfhb.exec:\jpfhb.exe215⤵
-
\??\c:\thtntd.exec:\thtntd.exe216⤵
-
\??\c:\tfnxblt.exec:\tfnxblt.exe217⤵
-
\??\c:\njlld.exec:\njlld.exe218⤵
-
\??\c:\fxtrblp.exec:\fxtrblp.exe219⤵
-
\??\c:\dprjl.exec:\dprjl.exe220⤵
-
\??\c:\hrdrfbh.exec:\hrdrfbh.exe221⤵
-
\??\c:\rfxxxp.exec:\rfxxxp.exe222⤵
-
\??\c:\nhrfndr.exec:\nhrfndr.exe223⤵
-
\??\c:\brptdl.exec:\brptdl.exe224⤵
-
\??\c:\xhnxndt.exec:\xhnxndt.exe225⤵
-
\??\c:\xvxtrp.exec:\xvxtrp.exe226⤵
-
\??\c:\vnxttlf.exec:\vnxttlf.exe227⤵
-
\??\c:\rtjpjn.exec:\rtjpjn.exe228⤵
-
\??\c:\vvbrdh.exec:\vvbrdh.exe229⤵
-
\??\c:\phtjvtj.exec:\phtjvtj.exe230⤵
-
\??\c:\bfnvnpv.exec:\bfnvnpv.exe231⤵
-
\??\c:\rjjjlj.exec:\rjjjlj.exe232⤵
-
\??\c:\fxxjp.exec:\fxxjp.exe233⤵
-
\??\c:\tbfnhnl.exec:\tbfnhnl.exe234⤵
-
\??\c:\jdlrd.exec:\jdlrd.exe235⤵
-
\??\c:\drpfbxr.exec:\drpfbxr.exe236⤵
-
\??\c:\rrxbfp.exec:\rrxbfp.exe237⤵
-
\??\c:\dhjdrt.exec:\dhjdrt.exe238⤵
-
\??\c:\nvnvrv.exec:\nvnvrv.exe239⤵
-
\??\c:\rbphvnb.exec:\rbphvnb.exe240⤵
-
\??\c:\vflnvn.exec:\vflnvn.exe241⤵