Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 17:54
Behavioral task
behavioral1
Sample
1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe
-
Size
192KB
-
MD5
1a5b21e0e0271c3a1f63c5234395fcf0
-
SHA1
f37fbbacbf931f335f6bfbe5233546ee6bcae76a
-
SHA256
3957371af7b8d003c018b1a7d71df6f2ad86175d0b363395a136e27465fe80f2
-
SHA512
2313f84727884a7f7b06ac835c30d1d6c1835e55118ac5a8d4674b0cd753a20ac4be58f9b05bed4c85aebd772a7cf70b407b62009fa012fad2a5f63b8e843f37
-
SSDEEP
3072:FhOmTsF93UYfwC6GIoutrVCfMoh52waAyiJ8mqtbfUVKty16hDsI/tSaF:Fcm4FmowdHoS8fMoSVAHubPtyYxfPF
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/2276-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2300-18-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2952-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2596-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2644-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2796-55-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2400-63-0x0000000000440000-0x0000000000476000-memory.dmp family_blackmoon behavioral1/memory/2400-65-0x0000000000440000-0x0000000000476000-memory.dmp family_blackmoon behavioral1/memory/2400-67-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2960-76-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2500-86-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2692-103-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2468-111-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1880-123-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2076-139-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1884-141-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1364-157-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1456-159-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/868-183-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2160-192-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/268-209-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1416-225-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1728-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1672-298-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1672-305-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2524-318-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2600-331-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2552-345-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/784-378-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2752-392-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1648-399-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1588-437-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2160-470-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1672-585-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2508-598-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2776-715-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2300-855-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2720-1000-0x0000000000230000-0x0000000000266000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\pddjd.exe family_berbew C:\7bbhnn.exe family_berbew C:\ddppj.exe family_berbew C:\pjvdj.exe family_berbew C:\fxrrfxf.exe family_berbew C:\7nbhbn.exe family_berbew C:\ppjpj.exe family_berbew C:\bnbntb.exe family_berbew C:\9vdpv.exe family_berbew C:\lfxxlxf.exe family_berbew C:\hbhtnt.exe family_berbew C:\9vpvd.exe family_berbew C:\lxflflf.exe family_berbew C:\hthhtn.exe family_berbew C:\tttbnb.exe family_berbew C:\jpjjj.exe family_berbew C:\xflrlfl.exe family_berbew C:\tnnhtn.exe family_berbew C:\nbnhtn.exe family_berbew C:\vvvjd.exe family_berbew C:\xrxrlrr.exe family_berbew C:\hbttnn.exe family_berbew C:\1pddj.exe family_berbew C:\rrxxfxl.exe family_berbew C:\lflflrf.exe family_berbew C:\3nbhhb.exe family_berbew C:\7rlxfrf.exe family_berbew C:\xxrrlxl.exe family_berbew \??\c:\thntbn.exe family_berbew C:\lfffrfx.exe family_berbew \??\c:\ttthtb.exe family_berbew behavioral1/memory/2112-279-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew C:\hthttb.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
pddjd.exe7bbhnn.exeddppj.exepjvdj.exefxrrfxf.exe7nbhbn.exeppjpj.exebnbntb.exe9vdpv.exelfxxlxf.exehbhtnt.exe9vpvd.exelxflflf.exehthhtn.exetttbnb.exejpjjj.exexflrlfl.exetnnhtn.exenbnhtn.exevvvjd.exexrxrlrr.exehbttnn.exe1pddj.exerrxxfxl.exelflflrf.exe3nbhhb.exe7rlxfrf.exexxrrlxl.exethntbn.exelfffrfx.exettthtb.exehthttb.exe5pddj.exerlrrfrl.exerlrxfff.exenhthnn.exe7dpdp.exeppvjj.exe7xffxxl.exehbntbh.exehbthtb.exedvvjp.exe1ppdp.exeffxfrrf.exehhtntt.exebtnntb.exedvjpv.exefxlxfrf.exetnhnbh.exetthbnn.exevvppj.exejdjpp.exexrxrlff.exentnhth.exe1bnhhh.exeppjpj.exerfrrxxl.exerlrxlrf.exebbtttt.exe5nbbhn.exe9vvpd.exejvpjp.exelfxfllr.exeththtt.exepid process 2300 pddjd.exe 2952 7bbhnn.exe 2596 ddppj.exe 2644 pjvdj.exe 2796 fxrrfxf.exe 2400 7nbhbn.exe 2960 ppjpj.exe 2500 bnbntb.exe 2036 9vdpv.exe 2692 lfxxlxf.exe 2468 hbhtnt.exe 1872 9vpvd.exe 1880 lxflflf.exe 2076 hthhtn.exe 1884 tttbnb.exe 1364 jpjjj.exe 1456 xflrlfl.exe 1276 tnnhtn.exe 868 nbnhtn.exe 2160 vvvjd.exe 2176 xrxrlrr.exe 268 hbttnn.exe 936 1pddj.exe 1416 rrxxfxl.exe 2248 lflflrf.exe 1724 3nbhhb.exe 1728 7rlxfrf.exe 756 xxrrlxl.exe 1744 thntbn.exe 1012 lfffrfx.exe 2112 ttthtb.exe 2280 hthttb.exe 2304 5pddj.exe 1672 rlrrfrl.exe 2472 rlrxfff.exe 2524 nhthnn.exe 2952 7dpdp.exe 2600 ppvjj.exe 2800 7xffxxl.exe 2984 hbntbh.exe 2552 hbthtb.exe 2400 dvvjp.exe 2440 1ppdp.exe 2392 ffxfrrf.exe 784 hhtntt.exe 2036 btnntb.exe 2704 dvjpv.exe 2752 fxlxfrf.exe 1648 tnhnbh.exe 1872 tthbnn.exe 1212 vvppj.exe 2264 jdjpp.exe 1612 xrxrlff.exe 1588 ntnhth.exe 1144 1bnhhh.exe 2152 ppjpj.exe 2888 rfrrxxl.exe 2416 rlrxlrf.exe 2024 bbtttt.exe 2160 5nbbhn.exe 600 9vvpd.exe 2192 jvpjp.exe 584 lfxfllr.exe 1788 ththtt.exe -
Processes:
resource yara_rule behavioral1/memory/2276-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pddjd.exe upx behavioral1/memory/2300-11-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2276-8-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\7bbhnn.exe upx behavioral1/memory/2300-18-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2952-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2952-29-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ddppj.exe upx behavioral1/memory/2596-32-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pjvdj.exe upx C:\fxrrfxf.exe upx behavioral1/memory/2644-47-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\7nbhbn.exe upx behavioral1/memory/2796-55-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2400-63-0x0000000000440000-0x0000000000476000-memory.dmp upx behavioral1/memory/2400-67-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ppjpj.exe upx behavioral1/memory/2960-68-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2960-76-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bnbntb.exe upx behavioral1/memory/2500-86-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\9vdpv.exe upx C:\lfxxlxf.exe upx behavioral1/memory/2692-103-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hbhtnt.exe upx behavioral1/memory/2468-111-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\9vpvd.exe upx behavioral1/memory/1872-113-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\lxflflf.exe upx behavioral1/memory/1880-123-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hthhtn.exe upx C:\tttbnb.exe upx behavioral1/memory/2076-139-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1884-141-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jpjjj.exe upx behavioral1/memory/1364-157-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xflrlfl.exe upx behavioral1/memory/1456-159-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tnnhtn.exe upx C:\nbnhtn.exe upx behavioral1/memory/868-183-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vvvjd.exe upx C:\xrxrlrr.exe upx behavioral1/memory/2160-192-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hbttnn.exe upx C:\1pddj.exe upx behavioral1/memory/268-209-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rrxxfxl.exe upx C:\lflflrf.exe upx behavioral1/memory/1416-225-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\3nbhhb.exe upx C:\7rlxfrf.exe upx behavioral1/memory/1728-243-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xxrrlxl.exe upx \??\c:\thntbn.exe upx behavioral1/memory/1744-262-0x0000000000220000-0x0000000000256000-memory.dmp upx C:\lfffrfx.exe upx \??\c:\ttthtb.exe upx behavioral1/memory/2112-279-0x0000000000220000-0x0000000000256000-memory.dmp upx C:\hthttb.exe upx behavioral1/memory/1672-298-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1672-305-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2524-318-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exepddjd.exe7bbhnn.exeddppj.exepjvdj.exefxrrfxf.exe7nbhbn.exeppjpj.exebnbntb.exe9vdpv.exelfxxlxf.exehbhtnt.exe9vpvd.exelxflflf.exehthhtn.exetttbnb.exedescription pid process target process PID 2276 wrote to memory of 2300 2276 1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe pddjd.exe PID 2276 wrote to memory of 2300 2276 1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe pddjd.exe PID 2276 wrote to memory of 2300 2276 1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe pddjd.exe PID 2276 wrote to memory of 2300 2276 1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe pddjd.exe PID 2300 wrote to memory of 2952 2300 pddjd.exe 7bbhnn.exe PID 2300 wrote to memory of 2952 2300 pddjd.exe 7bbhnn.exe PID 2300 wrote to memory of 2952 2300 pddjd.exe 7bbhnn.exe PID 2300 wrote to memory of 2952 2300 pddjd.exe 7bbhnn.exe PID 2952 wrote to memory of 2596 2952 7bbhnn.exe ddppj.exe PID 2952 wrote to memory of 2596 2952 7bbhnn.exe ddppj.exe PID 2952 wrote to memory of 2596 2952 7bbhnn.exe ddppj.exe PID 2952 wrote to memory of 2596 2952 7bbhnn.exe ddppj.exe PID 2596 wrote to memory of 2644 2596 ddppj.exe pjvdj.exe PID 2596 wrote to memory of 2644 2596 ddppj.exe pjvdj.exe PID 2596 wrote to memory of 2644 2596 ddppj.exe pjvdj.exe PID 2596 wrote to memory of 2644 2596 ddppj.exe pjvdj.exe PID 2644 wrote to memory of 2796 2644 pjvdj.exe fxrrfxf.exe PID 2644 wrote to memory of 2796 2644 pjvdj.exe fxrrfxf.exe PID 2644 wrote to memory of 2796 2644 pjvdj.exe fxrrfxf.exe PID 2644 wrote to memory of 2796 2644 pjvdj.exe fxrrfxf.exe PID 2796 wrote to memory of 2400 2796 fxrrfxf.exe 7nbhbn.exe PID 2796 wrote to memory of 2400 2796 fxrrfxf.exe 7nbhbn.exe PID 2796 wrote to memory of 2400 2796 fxrrfxf.exe 7nbhbn.exe PID 2796 wrote to memory of 2400 2796 fxrrfxf.exe 7nbhbn.exe PID 2400 wrote to memory of 2960 2400 7nbhbn.exe ppjpj.exe PID 2400 wrote to memory of 2960 2400 7nbhbn.exe ppjpj.exe PID 2400 wrote to memory of 2960 2400 7nbhbn.exe ppjpj.exe PID 2400 wrote to memory of 2960 2400 7nbhbn.exe ppjpj.exe PID 2960 wrote to memory of 2500 2960 ppjpj.exe bnbntb.exe PID 2960 wrote to memory of 2500 2960 ppjpj.exe bnbntb.exe PID 2960 wrote to memory of 2500 2960 ppjpj.exe bnbntb.exe PID 2960 wrote to memory of 2500 2960 ppjpj.exe bnbntb.exe PID 2500 wrote to memory of 2036 2500 bnbntb.exe 9vdpv.exe PID 2500 wrote to memory of 2036 2500 bnbntb.exe 9vdpv.exe PID 2500 wrote to memory of 2036 2500 bnbntb.exe 9vdpv.exe PID 2500 wrote to memory of 2036 2500 bnbntb.exe 9vdpv.exe PID 2036 wrote to memory of 2692 2036 9vdpv.exe lfxxlxf.exe PID 2036 wrote to memory of 2692 2036 9vdpv.exe lfxxlxf.exe PID 2036 wrote to memory of 2692 2036 9vdpv.exe lfxxlxf.exe PID 2036 wrote to memory of 2692 2036 9vdpv.exe lfxxlxf.exe PID 2692 wrote to memory of 2468 2692 lfxxlxf.exe hbhtnt.exe PID 2692 wrote to memory of 2468 2692 lfxxlxf.exe hbhtnt.exe PID 2692 wrote to memory of 2468 2692 lfxxlxf.exe hbhtnt.exe PID 2692 wrote to memory of 2468 2692 lfxxlxf.exe hbhtnt.exe PID 2468 wrote to memory of 1872 2468 hbhtnt.exe 9vpvd.exe PID 2468 wrote to memory of 1872 2468 hbhtnt.exe 9vpvd.exe PID 2468 wrote to memory of 1872 2468 hbhtnt.exe 9vpvd.exe PID 2468 wrote to memory of 1872 2468 hbhtnt.exe 9vpvd.exe PID 1872 wrote to memory of 1880 1872 9vpvd.exe lxflflf.exe PID 1872 wrote to memory of 1880 1872 9vpvd.exe lxflflf.exe PID 1872 wrote to memory of 1880 1872 9vpvd.exe lxflflf.exe PID 1872 wrote to memory of 1880 1872 9vpvd.exe lxflflf.exe PID 1880 wrote to memory of 2076 1880 lxflflf.exe hthhtn.exe PID 1880 wrote to memory of 2076 1880 lxflflf.exe hthhtn.exe PID 1880 wrote to memory of 2076 1880 lxflflf.exe hthhtn.exe PID 1880 wrote to memory of 2076 1880 lxflflf.exe hthhtn.exe PID 2076 wrote to memory of 1884 2076 hthhtn.exe tttbnb.exe PID 2076 wrote to memory of 1884 2076 hthhtn.exe tttbnb.exe PID 2076 wrote to memory of 1884 2076 hthhtn.exe tttbnb.exe PID 2076 wrote to memory of 1884 2076 hthhtn.exe tttbnb.exe PID 1884 wrote to memory of 1364 1884 tttbnb.exe jpjjj.exe PID 1884 wrote to memory of 1364 1884 tttbnb.exe jpjjj.exe PID 1884 wrote to memory of 1364 1884 tttbnb.exe jpjjj.exe PID 1884 wrote to memory of 1364 1884 tttbnb.exe jpjjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\pddjd.exec:\pddjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\7bbhnn.exec:\7bbhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ddppj.exec:\ddppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\pjvdj.exec:\pjvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\fxrrfxf.exec:\fxrrfxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\7nbhbn.exec:\7nbhbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\ppjpj.exec:\ppjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\bnbntb.exec:\bnbntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\9vdpv.exec:\9vdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\lfxxlxf.exec:\lfxxlxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\hbhtnt.exec:\hbhtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\9vpvd.exec:\9vpvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\lxflflf.exec:\lxflflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\hthhtn.exec:\hthhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\tttbnb.exec:\tttbnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\jpjjj.exec:\jpjjj.exe17⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xflrlfl.exec:\xflrlfl.exe18⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tnnhtn.exec:\tnnhtn.exe19⤵
- Executes dropped EXE
PID:1276 -
\??\c:\nbnhtn.exec:\nbnhtn.exe20⤵
- Executes dropped EXE
PID:868 -
\??\c:\vvvjd.exec:\vvvjd.exe21⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xrxrlrr.exec:\xrxrlrr.exe22⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hbttnn.exec:\hbttnn.exe23⤵
- Executes dropped EXE
PID:268 -
\??\c:\1pddj.exec:\1pddj.exe24⤵
- Executes dropped EXE
PID:936 -
\??\c:\rrxxfxl.exec:\rrxxfxl.exe25⤵
- Executes dropped EXE
PID:1416 -
\??\c:\lflflrf.exec:\lflflrf.exe26⤵
- Executes dropped EXE
PID:2248 -
\??\c:\3nbhhb.exec:\3nbhhb.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\7rlxfrf.exec:\7rlxfrf.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xxrrlxl.exec:\xxrrlxl.exe29⤵
- Executes dropped EXE
PID:756 -
\??\c:\thntbn.exec:\thntbn.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lfffrfx.exec:\lfffrfx.exe31⤵
- Executes dropped EXE
PID:1012 -
\??\c:\ttthtb.exec:\ttthtb.exe32⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hthttb.exec:\hthttb.exe33⤵
- Executes dropped EXE
PID:2280 -
\??\c:\5pddj.exec:\5pddj.exe34⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rlrrfrl.exec:\rlrrfrl.exe35⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rlrxfff.exec:\rlrxfff.exe36⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nhthnn.exec:\nhthnn.exe37⤵
- Executes dropped EXE
PID:2524 -
\??\c:\7dpdp.exec:\7dpdp.exe38⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ppvjj.exec:\ppvjj.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\7xffxxl.exec:\7xffxxl.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hbntbh.exec:\hbntbh.exe41⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hbthtb.exec:\hbthtb.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dvvjp.exec:\dvvjp.exe43⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1ppdp.exec:\1ppdp.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe45⤵
- Executes dropped EXE
PID:2392 -
\??\c:\hhtntt.exec:\hhtntt.exe46⤵
- Executes dropped EXE
PID:784 -
\??\c:\btnntb.exec:\btnntb.exe47⤵
- Executes dropped EXE
PID:2036 -
\??\c:\dvjpv.exec:\dvjpv.exe48⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fxlxfrf.exec:\fxlxfrf.exe49⤵
- Executes dropped EXE
PID:2752 -
\??\c:\tnhnbh.exec:\tnhnbh.exe50⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tthbnn.exec:\tthbnn.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\vvppj.exec:\vvppj.exe52⤵
- Executes dropped EXE
PID:1212 -
\??\c:\jdjpp.exec:\jdjpp.exe53⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xrxrlff.exec:\xrxrlff.exe54⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ntnhth.exec:\ntnhth.exe55⤵
- Executes dropped EXE
PID:1588 -
\??\c:\1bnhhh.exec:\1bnhhh.exe56⤵
- Executes dropped EXE
PID:1144 -
\??\c:\ppjpj.exec:\ppjpj.exe57⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe58⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rlrxlrf.exec:\rlrxlrf.exe59⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bbtttt.exec:\bbtttt.exe60⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5nbbhn.exec:\5nbbhn.exe61⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9vvpd.exec:\9vvpd.exe62⤵
- Executes dropped EXE
PID:600 -
\??\c:\jvpjp.exec:\jvpjp.exe63⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lfxfllr.exec:\lfxfllr.exe64⤵
- Executes dropped EXE
PID:584 -
\??\c:\ththtt.exec:\ththtt.exe65⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nttbnn.exec:\nttbnn.exe66⤵PID:1120
-
\??\c:\7dpvj.exec:\7dpvj.exe67⤵PID:2992
-
\??\c:\xrflxlr.exec:\xrflxlr.exe68⤵PID:712
-
\??\c:\xrflxfr.exec:\xrflxfr.exe69⤵PID:1724
-
\??\c:\hbnthn.exec:\hbnthn.exe70⤵PID:1928
-
\??\c:\1djjp.exec:\1djjp.exe71⤵PID:804
-
\??\c:\dvpdp.exec:\dvpdp.exe72⤵PID:2912
-
\??\c:\3xflrfl.exec:\3xflrfl.exe73⤵PID:1036
-
\??\c:\9tbttb.exec:\9tbttb.exe74⤵PID:1232
-
\??\c:\hnnnnh.exec:\hnnnnh.exe75⤵PID:1608
-
\??\c:\7vddv.exec:\7vddv.exe76⤵PID:1924
-
\??\c:\rlfrxxr.exec:\rlfrxxr.exe77⤵PID:1548
-
\??\c:\xlfflxf.exec:\xlfflxf.exe78⤵PID:1520
-
\??\c:\htbttn.exec:\htbttn.exe79⤵PID:1672
-
\??\c:\1dpvd.exec:\1dpvd.exe80⤵PID:2072
-
\??\c:\dpvdd.exec:\dpvdd.exe81⤵PID:2508
-
\??\c:\fflfxrf.exec:\fflfxrf.exe82⤵PID:2952
-
\??\c:\nhhnnt.exec:\nhhnnt.exe83⤵PID:2596
-
\??\c:\pjpvj.exec:\pjpvj.exe84⤵PID:2796
-
\??\c:\dvpdp.exec:\dvpdp.exe85⤵PID:2652
-
\??\c:\3xlfrfr.exec:\3xlfrfr.exe86⤵PID:2928
-
\??\c:\rlxffll.exec:\rlxffll.exe87⤵PID:2420
-
\??\c:\9thhnh.exec:\9thhnh.exe88⤵PID:2432
-
\??\c:\9pjdj.exec:\9pjdj.exe89⤵PID:2392
-
\??\c:\ppjdp.exec:\ppjdp.exe90⤵PID:2688
-
\??\c:\xrffffl.exec:\xrffffl.exe91⤵PID:2036
-
\??\c:\3httbh.exec:\3httbh.exe92⤵PID:2724
-
\??\c:\btnbtn.exec:\btnbtn.exe93⤵PID:1620
-
\??\c:\djjjd.exec:\djjjd.exe94⤵PID:2768
-
\??\c:\5jjvp.exec:\5jjvp.exe95⤵PID:1652
-
\??\c:\xlxxflr.exec:\xlxxflr.exe96⤵PID:1932
-
\??\c:\bbnbnt.exec:\bbnbnt.exe97⤵PID:2352
-
\??\c:\jjvvd.exec:\jjvvd.exe98⤵PID:404
-
\??\c:\dpjjd.exec:\dpjjd.exe99⤵PID:2776
-
\??\c:\fxlxflr.exec:\fxlxflr.exe100⤵PID:1536
-
\??\c:\lllfxrl.exec:\lllfxrl.exe101⤵PID:2892
-
\??\c:\bhthnt.exec:\bhthnt.exe102⤵PID:1504
-
\??\c:\ddvjd.exec:\ddvjd.exe103⤵PID:2016
-
\??\c:\9dppp.exec:\9dppp.exe104⤵PID:2236
-
\??\c:\xrlxfrx.exec:\xrlxfrx.exe105⤵PID:2748
-
\??\c:\bbhntt.exec:\bbhntt.exe106⤵PID:2148
-
\??\c:\tttnnt.exec:\tttnnt.exe107⤵PID:2816
-
\??\c:\dvvdp.exec:\dvvdp.exe108⤵PID:2828
-
\??\c:\ffxllrx.exec:\ffxllrx.exe109⤵PID:1732
-
\??\c:\rxxrxxr.exec:\rxxrxxr.exe110⤵PID:1416
-
\??\c:\hbhnnt.exec:\hbhnnt.exe111⤵PID:1028
-
\??\c:\jdvjj.exec:\jdvjj.exe112⤵PID:844
-
\??\c:\vjjvv.exec:\vjjvv.exe113⤵PID:928
-
\??\c:\xllrxlr.exec:\xllrxlr.exe114⤵PID:2908
-
\??\c:\llfxllx.exec:\llfxllx.exe115⤵PID:1844
-
\??\c:\1bhtbh.exec:\1bhtbh.exe116⤵PID:380
-
\??\c:\jvjdv.exec:\jvjdv.exe117⤵PID:1444
-
\??\c:\vdjdj.exec:\vdjdj.exe118⤵PID:1556
-
\??\c:\7flxfxf.exec:\7flxfxf.exe119⤵PID:1608
-
\??\c:\lrffxll.exec:\lrffxll.exe120⤵PID:1924
-
\??\c:\nhtthn.exec:\nhtthn.exe121⤵PID:1664
-
\??\c:\djddj.exec:\djddj.exe122⤵PID:2300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-