Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 14:56
Behavioral task
behavioral1
Sample
0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe
-
Size
464KB
-
MD5
0b37aec59954ac81ab332ce9306598b0
-
SHA1
1109a45f235b6c8cf64c65c67fa399e3989b3e9c
-
SHA256
eb405e79ff2048c2d8e9a5b7c58157bb63521133e86e3fcfa139d2d2305d5448
-
SHA512
c8bd649470ba91ac20d37b14fcd47f37f3b2b9444bad3c7f9ec95f83c2d4465f2b985075909421d3d6dd95ec7a81caf6accfcf7bb293f8c4251562e9e609cd36
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VB:VeR0oykayRFp3lztP+OKaf1VB
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/2164-7-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3004-16-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2892-27-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2644-37-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2740-47-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2636-56-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2868-65-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2364-74-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2440-83-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2308-91-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2252-101-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/384-103-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1964-119-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1748-129-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1900-141-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1648-157-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2720-177-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1620-175-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1516-193-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/588-210-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1804-244-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2188-286-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1512-320-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1244-340-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2472-347-0x00000000003A0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2420-366-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1600-394-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2680-441-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2548-455-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1624-468-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1200-534-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2232-612-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2288-619-0x0000000000230000-0x000000000026A000-memory.dmp family_blackmoon behavioral1/memory/2832-670-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1432-784-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2452-890-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2164-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hhtthn.exe family_berbew behavioral1/memory/2164-7-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\fxxflrx.exe family_berbew behavioral1/memory/3004-16-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2892-18-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pjddd.exe family_berbew behavioral1/memory/2892-27-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2644-28-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\llfrflf.exe family_berbew behavioral1/memory/2740-38-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2644-37-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vdpdj.exe family_berbew behavioral1/memory/2740-47-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lfxxrxx.exe family_berbew behavioral1/memory/2636-56-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hhhntb.exe family_berbew behavioral1/memory/2868-65-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xffrfxf.exe family_berbew behavioral1/memory/2364-74-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hnbnbb.exe family_berbew behavioral1/memory/2440-83-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2308-91-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vvjpd.exe family_berbew C:\rrrrxfl.exe family_berbew behavioral1/memory/2252-101-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/384-103-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bbnnbn.exe family_berbew C:\ffxfxlx.exe family_berbew behavioral1/memory/1964-119-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1748-129-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\btnthn.exe family_berbew \??\c:\llflxfx.exe family_berbew behavioral1/memory/1900-141-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tbthbh.exe family_berbew C:\llxlxxf.exe family_berbew behavioral1/memory/1648-157-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tttbnt.exe family_berbew behavioral1/memory/1620-166-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xlxxrrx.exe family_berbew behavioral1/memory/2720-177-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1620-175-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xfxfxfx.exe family_berbew behavioral1/memory/1516-193-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\dvpjp.exe family_berbew C:\nbnnnt.exe family_berbew C:\ppdvd.exe family_berbew behavioral1/memory/588-210-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\dvppd.exe family_berbew C:\ttbntb.exe family_berbew C:\3dppv.exe family_berbew C:\ttnnbb.exe family_berbew behavioral1/memory/1804-244-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vjdjv.exe family_berbew C:\rfxlxfr.exe family_berbew behavioral1/memory/2068-261-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bhhnbn.exe family_berbew C:\pjdpv.exe family_berbew C:\5rllxfl.exe family_berbew behavioral1/memory/2188-286-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/900-293-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2032-300-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2164-307-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1512-320-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
hhtthn.exefxxflrx.exepjddd.exellfrflf.exevdpdj.exelfxxrxx.exehhhntb.exexffrfxf.exehnbnbb.exevvjpd.exerrrrxfl.exebbnnbn.exeffxfxlx.exebtnthn.exellflxfx.exetbthbh.exellxlxxf.exetttbnt.exexlxxrrx.exexfxfxfx.exedvpjp.exenbnnnt.exeppdvd.exedvppd.exettbntb.exe3dppv.exettnnbb.exevjdjv.exerfxlxfr.exebhhnbn.exepjdpv.exe5rllxfl.exe1jddp.exerlxfrrx.exetbbhtt.exepvpdp.exelfllllx.exenbntbn.exennbhtb.exepjdjp.exerllxxxr.exennbhbn.exevvpdj.exeddvpd.exe1fflllr.exenhhtbt.exepdppd.exexxlfxll.exebbbtnb.exepjjpv.exexrflllr.exebtntbb.exevvpvj.exe9pjvv.exe1xrfxlr.exe3btbnn.exepppvp.exellxlrrx.exe7nnbhh.exehthhnt.exevdddp.exe9pjdd.exexxrxfrf.exenbtthh.exepid process 3004 hhtthn.exe 2892 fxxflrx.exe 2644 pjddd.exe 2740 llfrflf.exe 2636 vdpdj.exe 2868 lfxxrxx.exe 2364 hhhntb.exe 2440 xffrfxf.exe 2308 hnbnbb.exe 2252 vvjpd.exe 384 rrrrxfl.exe 1964 bbnnbn.exe 1748 ffxfxlx.exe 2020 btnthn.exe 1900 llflxfx.exe 1648 tbthbh.exe 2044 llxlxxf.exe 1620 tttbnt.exe 2720 xlxxrrx.exe 1516 xfxfxfx.exe 1560 dvpjp.exe 588 nbnnnt.exe 1000 ppdvd.exe 2344 dvppd.exe 1752 ttbntb.exe 1708 3dppv.exe 1804 ttnnbb.exe 1580 vjdjv.exe 2068 rfxlxfr.exe 2136 bhhnbn.exe 1680 pjdpv.exe 2188 5rllxfl.exe 900 1jddp.exe 2032 rlxfrrx.exe 2164 tbbhtt.exe 1512 pvpdp.exe 2508 lfllllx.exe 2656 nbntbn.exe 1244 nnbhtb.exe 2472 pjdjp.exe 2740 rllxxxr.exe 2672 nnbhbn.exe 2420 vvpdj.exe 2380 ddvpd.exe 2488 1fflllr.exe 2444 nhhtbt.exe 1600 pdppd.exe 2248 xxlfxll.exe 312 bbbtnb.exe 2576 pjjpv.exe 1604 xrflllr.exe 1720 btntbb.exe 1932 vvpvj.exe 1592 9pjvv.exe 2680 1xrfxlr.exe 1808 3btbnn.exe 2548 pppvp.exe 2808 llxlrrx.exe 1624 7nnbhh.exe 2720 hthhnt.exe 276 vdddp.exe 2100 9pjdd.exe 2464 xxrxfrf.exe 1420 nbtthh.exe -
Processes:
resource yara_rule behavioral1/memory/2164-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hhtthn.exe upx behavioral1/memory/2164-7-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\fxxflrx.exe upx behavioral1/memory/3004-16-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2892-18-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pjddd.exe upx behavioral1/memory/2892-27-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2644-28-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\llfrflf.exe upx behavioral1/memory/2740-38-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2644-37-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vdpdj.exe upx behavioral1/memory/2740-47-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lfxxrxx.exe upx behavioral1/memory/2636-56-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hhhntb.exe upx behavioral1/memory/2868-65-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xffrfxf.exe upx behavioral1/memory/2364-74-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hnbnbb.exe upx behavioral1/memory/2440-83-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2308-91-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vvjpd.exe upx C:\rrrrxfl.exe upx behavioral1/memory/2252-101-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/384-103-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bbnnbn.exe upx C:\ffxfxlx.exe upx behavioral1/memory/1964-119-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1748-129-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\btnthn.exe upx \??\c:\llflxfx.exe upx behavioral1/memory/2020-137-0x00000000002B0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/1900-141-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tbthbh.exe upx C:\llxlxxf.exe upx behavioral1/memory/1648-157-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tttbnt.exe upx behavioral1/memory/1620-166-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xlxxrrx.exe upx behavioral1/memory/2720-177-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1620-175-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xfxfxfx.exe upx behavioral1/memory/1516-193-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\dvpjp.exe upx C:\nbnnnt.exe upx C:\ppdvd.exe upx behavioral1/memory/588-210-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\dvppd.exe upx C:\ttbntb.exe upx C:\3dppv.exe upx C:\ttnnbb.exe upx behavioral1/memory/1804-244-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vjdjv.exe upx C:\rfxlxfr.exe upx behavioral1/memory/2068-261-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bhhnbn.exe upx C:\pjdpv.exe upx C:\5rllxfl.exe upx behavioral1/memory/2188-286-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/900-293-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2032-300-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2164-307-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exehhtthn.exefxxflrx.exepjddd.exellfrflf.exevdpdj.exelfxxrxx.exehhhntb.exexffrfxf.exehnbnbb.exevvjpd.exerrrrxfl.exebbnnbn.exeffxfxlx.exebtnthn.exellflxfx.exedescription pid process target process PID 2164 wrote to memory of 3004 2164 0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe hhtthn.exe PID 2164 wrote to memory of 3004 2164 0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe hhtthn.exe PID 2164 wrote to memory of 3004 2164 0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe hhtthn.exe PID 2164 wrote to memory of 3004 2164 0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe hhtthn.exe PID 3004 wrote to memory of 2892 3004 hhtthn.exe fxxflrx.exe PID 3004 wrote to memory of 2892 3004 hhtthn.exe fxxflrx.exe PID 3004 wrote to memory of 2892 3004 hhtthn.exe fxxflrx.exe PID 3004 wrote to memory of 2892 3004 hhtthn.exe fxxflrx.exe PID 2892 wrote to memory of 2644 2892 fxxflrx.exe pjddd.exe PID 2892 wrote to memory of 2644 2892 fxxflrx.exe pjddd.exe PID 2892 wrote to memory of 2644 2892 fxxflrx.exe pjddd.exe PID 2892 wrote to memory of 2644 2892 fxxflrx.exe pjddd.exe PID 2644 wrote to memory of 2740 2644 pjddd.exe llfrflf.exe PID 2644 wrote to memory of 2740 2644 pjddd.exe llfrflf.exe PID 2644 wrote to memory of 2740 2644 pjddd.exe llfrflf.exe PID 2644 wrote to memory of 2740 2644 pjddd.exe llfrflf.exe PID 2740 wrote to memory of 2636 2740 llfrflf.exe vdpdj.exe PID 2740 wrote to memory of 2636 2740 llfrflf.exe vdpdj.exe PID 2740 wrote to memory of 2636 2740 llfrflf.exe vdpdj.exe PID 2740 wrote to memory of 2636 2740 llfrflf.exe vdpdj.exe PID 2636 wrote to memory of 2868 2636 vdpdj.exe lfxxrxx.exe PID 2636 wrote to memory of 2868 2636 vdpdj.exe lfxxrxx.exe PID 2636 wrote to memory of 2868 2636 vdpdj.exe lfxxrxx.exe PID 2636 wrote to memory of 2868 2636 vdpdj.exe lfxxrxx.exe PID 2868 wrote to memory of 2364 2868 lfxxrxx.exe hhhntb.exe PID 2868 wrote to memory of 2364 2868 lfxxrxx.exe hhhntb.exe PID 2868 wrote to memory of 2364 2868 lfxxrxx.exe hhhntb.exe PID 2868 wrote to memory of 2364 2868 lfxxrxx.exe hhhntb.exe PID 2364 wrote to memory of 2440 2364 hhhntb.exe xffrfxf.exe PID 2364 wrote to memory of 2440 2364 hhhntb.exe xffrfxf.exe PID 2364 wrote to memory of 2440 2364 hhhntb.exe xffrfxf.exe PID 2364 wrote to memory of 2440 2364 hhhntb.exe xffrfxf.exe PID 2440 wrote to memory of 2308 2440 xffrfxf.exe hnbnbb.exe PID 2440 wrote to memory of 2308 2440 xffrfxf.exe hnbnbb.exe PID 2440 wrote to memory of 2308 2440 xffrfxf.exe hnbnbb.exe PID 2440 wrote to memory of 2308 2440 xffrfxf.exe hnbnbb.exe PID 2308 wrote to memory of 2252 2308 hnbnbb.exe vvjpd.exe PID 2308 wrote to memory of 2252 2308 hnbnbb.exe vvjpd.exe PID 2308 wrote to memory of 2252 2308 hnbnbb.exe vvjpd.exe PID 2308 wrote to memory of 2252 2308 hnbnbb.exe vvjpd.exe PID 2252 wrote to memory of 384 2252 vvjpd.exe rrrrxfl.exe PID 2252 wrote to memory of 384 2252 vvjpd.exe rrrrxfl.exe PID 2252 wrote to memory of 384 2252 vvjpd.exe rrrrxfl.exe PID 2252 wrote to memory of 384 2252 vvjpd.exe rrrrxfl.exe PID 384 wrote to memory of 1964 384 rrrrxfl.exe bbnnbn.exe PID 384 wrote to memory of 1964 384 rrrrxfl.exe bbnnbn.exe PID 384 wrote to memory of 1964 384 rrrrxfl.exe bbnnbn.exe PID 384 wrote to memory of 1964 384 rrrrxfl.exe bbnnbn.exe PID 1964 wrote to memory of 1748 1964 bbnnbn.exe ffxfxlx.exe PID 1964 wrote to memory of 1748 1964 bbnnbn.exe ffxfxlx.exe PID 1964 wrote to memory of 1748 1964 bbnnbn.exe ffxfxlx.exe PID 1964 wrote to memory of 1748 1964 bbnnbn.exe ffxfxlx.exe PID 1748 wrote to memory of 2020 1748 ffxfxlx.exe btnthn.exe PID 1748 wrote to memory of 2020 1748 ffxfxlx.exe btnthn.exe PID 1748 wrote to memory of 2020 1748 ffxfxlx.exe btnthn.exe PID 1748 wrote to memory of 2020 1748 ffxfxlx.exe btnthn.exe PID 2020 wrote to memory of 1900 2020 btnthn.exe llflxfx.exe PID 2020 wrote to memory of 1900 2020 btnthn.exe llflxfx.exe PID 2020 wrote to memory of 1900 2020 btnthn.exe llflxfx.exe PID 2020 wrote to memory of 1900 2020 btnthn.exe llflxfx.exe PID 1900 wrote to memory of 1648 1900 llflxfx.exe tbthbh.exe PID 1900 wrote to memory of 1648 1900 llflxfx.exe tbthbh.exe PID 1900 wrote to memory of 1648 1900 llflxfx.exe tbthbh.exe PID 1900 wrote to memory of 1648 1900 llflxfx.exe tbthbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\hhtthn.exec:\hhtthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxflrx.exec:\fxxflrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjddd.exec:\pjddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfrflf.exec:\llfrflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdpdj.exec:\vdpdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhntb.exec:\hhhntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xffrfxf.exec:\xffrfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbnbb.exec:\hnbnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjpd.exec:\vvjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrrxfl.exec:\rrrrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnnbn.exec:\bbnnbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxfxlx.exec:\ffxfxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnthn.exec:\btnthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llflxfx.exec:\llflxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbthbh.exec:\tbthbh.exe17⤵
- Executes dropped EXE
-
\??\c:\llxlxxf.exec:\llxlxxf.exe18⤵
- Executes dropped EXE
-
\??\c:\tttbnt.exec:\tttbnt.exe19⤵
- Executes dropped EXE
-
\??\c:\xlxxrrx.exec:\xlxxrrx.exe20⤵
- Executes dropped EXE
-
\??\c:\xfxfxfx.exec:\xfxfxfx.exe21⤵
- Executes dropped EXE
-
\??\c:\dvpjp.exec:\dvpjp.exe22⤵
- Executes dropped EXE
-
\??\c:\nbnnnt.exec:\nbnnnt.exe23⤵
- Executes dropped EXE
-
\??\c:\ppdvd.exec:\ppdvd.exe24⤵
- Executes dropped EXE
-
\??\c:\dvppd.exec:\dvppd.exe25⤵
- Executes dropped EXE
-
\??\c:\ttbntb.exec:\ttbntb.exe26⤵
- Executes dropped EXE
-
\??\c:\3dppv.exec:\3dppv.exe27⤵
- Executes dropped EXE
-
\??\c:\ttnnbb.exec:\ttnnbb.exe28⤵
- Executes dropped EXE
-
\??\c:\vjdjv.exec:\vjdjv.exe29⤵
- Executes dropped EXE
-
\??\c:\rfxlxfr.exec:\rfxlxfr.exe30⤵
- Executes dropped EXE
-
\??\c:\bhhnbn.exec:\bhhnbn.exe31⤵
- Executes dropped EXE
-
\??\c:\pjdpv.exec:\pjdpv.exe32⤵
- Executes dropped EXE
-
\??\c:\5rllxfl.exec:\5rllxfl.exe33⤵
- Executes dropped EXE
-
\??\c:\1jddp.exec:\1jddp.exe34⤵
- Executes dropped EXE
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe35⤵
- Executes dropped EXE
-
\??\c:\tbbhtt.exec:\tbbhtt.exe36⤵
- Executes dropped EXE
-
\??\c:\pvpdp.exec:\pvpdp.exe37⤵
- Executes dropped EXE
-
\??\c:\lfllllx.exec:\lfllllx.exe38⤵
- Executes dropped EXE
-
\??\c:\nbntbn.exec:\nbntbn.exe39⤵
- Executes dropped EXE
-
\??\c:\nnbhtb.exec:\nnbhtb.exe40⤵
- Executes dropped EXE
-
\??\c:\pjdjp.exec:\pjdjp.exe41⤵
- Executes dropped EXE
-
\??\c:\rllxxxr.exec:\rllxxxr.exe42⤵
- Executes dropped EXE
-
\??\c:\nnbhbn.exec:\nnbhbn.exe43⤵
- Executes dropped EXE
-
\??\c:\vvpdj.exec:\vvpdj.exe44⤵
- Executes dropped EXE
-
\??\c:\ddvpd.exec:\ddvpd.exe45⤵
- Executes dropped EXE
-
\??\c:\1fflllr.exec:\1fflllr.exe46⤵
- Executes dropped EXE
-
\??\c:\nhhtbt.exec:\nhhtbt.exe47⤵
- Executes dropped EXE
-
\??\c:\pdppd.exec:\pdppd.exe48⤵
- Executes dropped EXE
-
\??\c:\xxlfxll.exec:\xxlfxll.exe49⤵
- Executes dropped EXE
-
\??\c:\bbbtnb.exec:\bbbtnb.exe50⤵
- Executes dropped EXE
-
\??\c:\pjjpv.exec:\pjjpv.exe51⤵
- Executes dropped EXE
-
\??\c:\xrflllr.exec:\xrflllr.exe52⤵
- Executes dropped EXE
-
\??\c:\btntbb.exec:\btntbb.exe53⤵
- Executes dropped EXE
-
\??\c:\vvpvj.exec:\vvpvj.exe54⤵
- Executes dropped EXE
-
\??\c:\9pjvv.exec:\9pjvv.exe55⤵
- Executes dropped EXE
-
\??\c:\1xrfxlr.exec:\1xrfxlr.exe56⤵
- Executes dropped EXE
-
\??\c:\3btbnn.exec:\3btbnn.exe57⤵
- Executes dropped EXE
-
\??\c:\pppvp.exec:\pppvp.exe58⤵
- Executes dropped EXE
-
\??\c:\llxlrrx.exec:\llxlrrx.exe59⤵
- Executes dropped EXE
-
\??\c:\7nnbhh.exec:\7nnbhh.exe60⤵
- Executes dropped EXE
-
\??\c:\hthhnt.exec:\hthhnt.exe61⤵
- Executes dropped EXE
-
\??\c:\vdddp.exec:\vdddp.exe62⤵
- Executes dropped EXE
-
\??\c:\9pjdd.exec:\9pjdd.exe63⤵
- Executes dropped EXE
-
\??\c:\xxrxfrf.exec:\xxrxfrf.exe64⤵
- Executes dropped EXE
-
\??\c:\nbtthh.exec:\nbtthh.exe65⤵
- Executes dropped EXE
-
\??\c:\pjvpv.exec:\pjvpv.exe66⤵
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe67⤵
-
\??\c:\nbhnbn.exec:\nbhnbn.exe68⤵
-
\??\c:\vdvjd.exec:\vdvjd.exe69⤵
-
\??\c:\llfxrlf.exec:\llfxrlf.exe70⤵
-
\??\c:\nhbtbb.exec:\nhbtbb.exe71⤵
-
\??\c:\tntnnn.exec:\tntnnn.exe72⤵
-
\??\c:\ppdpp.exec:\ppdpp.exe73⤵
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe74⤵
-
\??\c:\nnnnnb.exec:\nnnnnb.exe75⤵
-
\??\c:\ddpjp.exec:\ddpjp.exe76⤵
-
\??\c:\5vdjj.exec:\5vdjj.exe77⤵
-
\??\c:\9flrxrr.exec:\9flrxrr.exe78⤵
-
\??\c:\3bthbt.exec:\3bthbt.exe79⤵
-
\??\c:\7pdvd.exec:\7pdvd.exe80⤵
-
\??\c:\9lxlxfx.exec:\9lxlxfx.exe81⤵
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe82⤵
-
\??\c:\5ttttb.exec:\5ttttb.exe83⤵
-
\??\c:\jpvjj.exec:\jpvjj.exe84⤵
-
\??\c:\lfxxlfx.exec:\lfxxlfx.exe85⤵
-
\??\c:\nbnhhh.exec:\nbnhhh.exe86⤵
-
\??\c:\pjvjp.exec:\pjvjp.exe87⤵
-
\??\c:\3jjvj.exec:\3jjvj.exe88⤵
-
\??\c:\3lrxxff.exec:\3lrxxff.exe89⤵
-
\??\c:\5hhhnt.exec:\5hhhnt.exe90⤵
-
\??\c:\hhhbnn.exec:\hhhbnn.exe91⤵
-
\??\c:\jdvpd.exec:\jdvpd.exe92⤵
-
\??\c:\1fffrxl.exec:\1fffrxl.exe93⤵
-
\??\c:\thnbtb.exec:\thnbtb.exe94⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe95⤵
-
\??\c:\5fxflrf.exec:\5fxflrf.exe96⤵
-
\??\c:\5frrxfl.exec:\5frrxfl.exe97⤵
-
\??\c:\7nhnbh.exec:\7nhnbh.exe98⤵
-
\??\c:\5pjvd.exec:\5pjvd.exe99⤵
-
\??\c:\fffrllf.exec:\fffrllf.exe100⤵
-
\??\c:\hbhthn.exec:\hbhthn.exe101⤵
-
\??\c:\nnhhtb.exec:\nnhhtb.exe102⤵
-
\??\c:\jdvdj.exec:\jdvdj.exe103⤵
-
\??\c:\rxlrfrl.exec:\rxlrfrl.exe104⤵
-
\??\c:\nhbhnn.exec:\nhbhnn.exe105⤵
-
\??\c:\hbttnn.exec:\hbttnn.exe106⤵
-
\??\c:\ppjjp.exec:\ppjjp.exe107⤵
-
\??\c:\flllfxf.exec:\flllfxf.exe108⤵
-
\??\c:\7fxlrrx.exec:\7fxlrrx.exe109⤵
-
\??\c:\hnnbhn.exec:\hnnbhn.exe110⤵
-
\??\c:\djjpj.exec:\djjpj.exe111⤵
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe112⤵
-
\??\c:\nnntnb.exec:\nnntnb.exe113⤵
-
\??\c:\xlrfrxl.exec:\xlrfrxl.exe114⤵
-
\??\c:\tbbtbh.exec:\tbbtbh.exe115⤵
-
\??\c:\pvdpv.exec:\pvdpv.exe116⤵
-
\??\c:\rlxlxlx.exec:\rlxlxlx.exe117⤵
-
\??\c:\bnnttn.exec:\bnnttn.exe118⤵
-
\??\c:\vpjdj.exec:\vpjdj.exe119⤵
-
\??\c:\jjjpv.exec:\jjjpv.exe120⤵
-
\??\c:\llfxflx.exec:\llfxflx.exe121⤵
-
\??\c:\1hbhnh.exec:\1hbhnh.exe122⤵
-
\??\c:\1nhttb.exec:\1nhttb.exe123⤵
-
\??\c:\pvdjj.exec:\pvdjj.exe124⤵
-
\??\c:\rllrffl.exec:\rllrffl.exe125⤵
-
\??\c:\tnnhtn.exec:\tnnhtn.exe126⤵
-
\??\c:\7vdvj.exec:\7vdvj.exe127⤵
-
\??\c:\xfffrlx.exec:\xfffrlx.exe128⤵
-
\??\c:\lrrxlxr.exec:\lrrxlxr.exe129⤵
-
\??\c:\tttntb.exec:\tttntb.exe130⤵
-
\??\c:\9jpvd.exec:\9jpvd.exe131⤵
-
\??\c:\xrxxlrx.exec:\xrxxlrx.exe132⤵
-
\??\c:\1hnbnb.exec:\1hnbnb.exe133⤵
-
\??\c:\thbbnn.exec:\thbbnn.exe134⤵
-
\??\c:\vpppd.exec:\vpppd.exe135⤵
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe136⤵
-
\??\c:\xxrxflr.exec:\xxrxflr.exe137⤵
-
\??\c:\nntnhh.exec:\nntnhh.exe138⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe139⤵
-
\??\c:\5xxxlrf.exec:\5xxxlrf.exe140⤵
-
\??\c:\rlfrflf.exec:\rlfrflf.exe141⤵
-
\??\c:\btnbnn.exec:\btnbnn.exe142⤵
-
\??\c:\jdvjp.exec:\jdvjp.exe143⤵
-
\??\c:\rrlrlrf.exec:\rrlrlrf.exe144⤵
-
\??\c:\9rrrflx.exec:\9rrrflx.exe145⤵
-
\??\c:\hnnttb.exec:\hnnttb.exe146⤵
-
\??\c:\ddvjp.exec:\ddvjp.exe147⤵
-
\??\c:\xlrfxlx.exec:\xlrfxlx.exe148⤵
-
\??\c:\rxllffx.exec:\rxllffx.exe149⤵
-
\??\c:\bbbnbn.exec:\bbbnbn.exe150⤵
-
\??\c:\jpjvp.exec:\jpjvp.exe151⤵
-
\??\c:\ffflrrx.exec:\ffflrrx.exe152⤵
-
\??\c:\fxrfrxr.exec:\fxrfrxr.exe153⤵
-
\??\c:\hhhthn.exec:\hhhthn.exe154⤵
-
\??\c:\jdvvd.exec:\jdvvd.exe155⤵
-
\??\c:\9jvjp.exec:\9jvjp.exe156⤵
-
\??\c:\llllffx.exec:\llllffx.exe157⤵
-
\??\c:\lrrffff.exec:\lrrffff.exe158⤵
-
\??\c:\bbbnbb.exec:\bbbnbb.exe159⤵
-
\??\c:\jjdpj.exec:\jjdpj.exe160⤵
-
\??\c:\1xrrflr.exec:\1xrrflr.exe161⤵
-
\??\c:\3rflrxl.exec:\3rflrxl.exe162⤵
-
\??\c:\1thnnt.exec:\1thnnt.exe163⤵
-
\??\c:\jjvpd.exec:\jjvpd.exe164⤵
-
\??\c:\9jddd.exec:\9jddd.exe165⤵
-
\??\c:\rflfrll.exec:\rflfrll.exe166⤵
-
\??\c:\tthntt.exec:\tthntt.exe167⤵
-
\??\c:\jjppp.exec:\jjppp.exe168⤵
-
\??\c:\rflllfx.exec:\rflllfx.exe169⤵
-
\??\c:\fxrxffr.exec:\fxrxffr.exe170⤵
-
\??\c:\9btbnn.exec:\9btbnn.exe171⤵
-
\??\c:\3tbnnt.exec:\3tbnnt.exe172⤵
-
\??\c:\pvjjd.exec:\pvjjd.exe173⤵
-
\??\c:\ffrfllx.exec:\ffrfllx.exe174⤵
-
\??\c:\nnbbhn.exec:\nnbbhn.exe175⤵
-
\??\c:\bnttbb.exec:\bnttbb.exe176⤵
-
\??\c:\pvjvv.exec:\pvjvv.exe177⤵
-
\??\c:\ffxrxfr.exec:\ffxrxfr.exe178⤵
-
\??\c:\3rlrrrr.exec:\3rlrrrr.exe179⤵
-
\??\c:\3httbn.exec:\3httbn.exe180⤵
-
\??\c:\dvppp.exec:\dvppp.exe181⤵
-
\??\c:\djdvj.exec:\djdvj.exe182⤵
-
\??\c:\xrxffxf.exec:\xrxffxf.exe183⤵
-
\??\c:\bntbbt.exec:\bntbbt.exe184⤵
-
\??\c:\nttbnb.exec:\nttbnb.exe185⤵
-
\??\c:\dvppd.exec:\dvppd.exe186⤵
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe187⤵
-
\??\c:\5xlfxxx.exec:\5xlfxxx.exe188⤵
-
\??\c:\hbtbhh.exec:\hbtbhh.exe189⤵
-
\??\c:\vvjpv.exec:\vvjpv.exe190⤵
-
\??\c:\ddppd.exec:\ddppd.exe191⤵
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe192⤵
-
\??\c:\hbbnbt.exec:\hbbnbt.exe193⤵
-
\??\c:\thnhtb.exec:\thnhtb.exe194⤵
-
\??\c:\pjvjd.exec:\pjvjd.exe195⤵
-
\??\c:\rrflxrr.exec:\rrflxrr.exe196⤵
-
\??\c:\xxxlrlx.exec:\xxxlrlx.exe197⤵
-
\??\c:\nntnbh.exec:\nntnbh.exe198⤵
-
\??\c:\jdvjv.exec:\jdvjv.exe199⤵
-
\??\c:\pjdpv.exec:\pjdpv.exe200⤵
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe201⤵
-
\??\c:\bbbntb.exec:\bbbntb.exe202⤵
-
\??\c:\nbthbb.exec:\nbthbb.exe203⤵
-
\??\c:\dvppv.exec:\dvppv.exe204⤵
-
\??\c:\llfrlxx.exec:\llfrlxx.exe205⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe206⤵
-
\??\c:\bbntbh.exec:\bbntbh.exe207⤵
-
\??\c:\dvpdj.exec:\dvpdj.exe208⤵
-
\??\c:\flxxrxf.exec:\flxxrxf.exe209⤵
-
\??\c:\rfxfrrf.exec:\rfxfrrf.exe210⤵
-
\??\c:\nbhhhh.exec:\nbhhhh.exe211⤵
-
\??\c:\ddvdp.exec:\ddvdp.exe212⤵
-
\??\c:\5dvjv.exec:\5dvjv.exe213⤵
-
\??\c:\xxlrxlx.exec:\xxlrxlx.exe214⤵
-
\??\c:\7tbnhn.exec:\7tbnhn.exe215⤵
-
\??\c:\ppvpv.exec:\ppvpv.exe216⤵
-
\??\c:\vjpvp.exec:\vjpvp.exe217⤵
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe218⤵
-
\??\c:\5btnnn.exec:\5btnnn.exe219⤵
-
\??\c:\jddjp.exec:\jddjp.exe220⤵
-
\??\c:\jdvdd.exec:\jdvdd.exe221⤵
-
\??\c:\1rxfrxr.exec:\1rxfrxr.exe222⤵
-
\??\c:\ntnbht.exec:\ntnbht.exe223⤵
-
\??\c:\5bhbtb.exec:\5bhbtb.exe224⤵
-
\??\c:\3jpvj.exec:\3jpvj.exe225⤵
-
\??\c:\fxrffrl.exec:\fxrffrl.exe226⤵
-
\??\c:\3ffrfff.exec:\3ffrfff.exe227⤵
-
\??\c:\5thttb.exec:\5thttb.exe228⤵
-
\??\c:\vvjjp.exec:\vvjjp.exe229⤵
-
\??\c:\jjjpj.exec:\jjjpj.exe230⤵
-
\??\c:\7lfrxxl.exec:\7lfrxxl.exe231⤵
-
\??\c:\bnbbhb.exec:\bnbbhb.exe232⤵
-
\??\c:\ppjjj.exec:\ppjjj.exe233⤵
-
\??\c:\pvvjv.exec:\pvvjv.exe234⤵
-
\??\c:\rfxxffl.exec:\rfxxffl.exe235⤵
-
\??\c:\hbbhtt.exec:\hbbhtt.exe236⤵
-
\??\c:\jpddv.exec:\jpddv.exe237⤵
-
\??\c:\xxfrflx.exec:\xxfrflx.exe238⤵
-
\??\c:\llrrxfl.exec:\llrrxfl.exe239⤵
-
\??\c:\tnbnnb.exec:\tnbnnb.exe240⤵
-
\??\c:\jvjpv.exec:\jvjpv.exe241⤵