Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 10:10
Behavioral task
behavioral1
Sample
e3cb1e7881114bf8cb727b1ffa2ac4e0_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
e3cb1e7881114bf8cb727b1ffa2ac4e0_NeikiAnalytics.exe
-
Size
294KB
-
MD5
e3cb1e7881114bf8cb727b1ffa2ac4e0
-
SHA1
2409383ce515d11087205392f9ccd2f57ce8063d
-
SHA256
23998f755974aa5758234d66d725a725b6867696140eca582d25c7480e59fc5e
-
SHA512
917ba0c301ced8597b265233d18a674c00968546a73f0a29ab8ef3dea9105d6d0ba4c813eb7c75b68d82c03c9d8921bab1eb0d6841995e6f9ad182c626994223
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftO4:K4wFHoSQkuUHk1zBR/pMT9XvEhdff
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2248-6-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4252-18-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3436-42-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3200-186-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1720-261-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2012-306-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3116-301-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1352-287-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3624-281-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4100-271-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/880-264-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4140-256-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3112-231-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1288-228-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4616-222-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4604-218-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5104-212-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4236-208-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1260-200-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4048-194-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4352-190-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5016-322-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2388-169-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2968-163-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1528-158-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5072-147-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1028-141-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1716-135-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4744-129-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4688-123-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4504-117-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1664-109-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4608-100-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4364-97-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4764-88-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2720-82-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1556-66-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3076-54-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3304-48-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5036-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/216-24-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4328-11-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2108-339-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2968-343-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4812-366-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3104-370-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3852-389-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3424-391-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3032-397-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3468-432-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3480-457-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/432-461-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1224-515-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4604-539-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2004-586-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4372-590-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1636-720-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4984-748-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2884-770-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5004-948-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/740-985-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4560-1057-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2728-1115-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3828-1264-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\frflrxf.exe family_berbew \??\c:\htnntt.exe family_berbew \??\c:\vjjpj.exe family_berbew \??\c:\rlfxxfx.exe family_berbew \??\c:\lfrfllf.exe family_berbew \??\c:\fxlfllf.exe family_berbew \??\c:\bbnttn.exe family_berbew \??\c:\9xlllxf.exe family_berbew \??\c:\vvpdd.exe family_berbew \??\c:\lflxrrf.exe family_berbew \??\c:\dpppj.exe family_berbew C:\dvdvp.exe family_berbew \??\c:\bthbhh.exe family_berbew \??\c:\frllxfl.exe family_berbew \??\c:\rxxxrxx.exe family_berbew \??\c:\bttnhh.exe family_berbew \??\c:\hbhhnn.exe family_berbew \??\c:\rrfxfxl.exe family_berbew \??\c:\ppppp.exe family_berbew \??\c:\nnnbtb.exe family_berbew \??\c:\7xrlflf.exe family_berbew \??\c:\pdjjj.exe family_berbew \??\c:\jvvpp.exe family_berbew \??\c:\tnntnt.exe family_berbew \??\c:\lrfxxxl.exe family_berbew \??\c:\tnnnhn.exe family_berbew \??\c:\lfflrxx.exe family_berbew \??\c:\jdddd.exe family_berbew \??\c:\nhhttn.exe family_berbew \??\c:\dpddv.exe family_berbew \??\c:\dvpjd.exe family_berbew \??\c:\ttnhtt.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
frflrxf.exehtnntt.exevjjpj.exerlfxxfx.exelfrfllf.exettnhtt.exedvpjd.exedpddv.exefxlfllf.exebbnttn.exenhhttn.exejdddd.exe9xlllxf.exelfflrxx.exetnnnhn.exevvpdd.exelrfxxxl.exelflxrrf.exetnntnt.exejvvpp.exepdjjj.exe7xrlflf.exennnbtb.exedpppj.exeppppp.exerrfxfxl.exehbhhnn.exebttnhh.exedvdvp.exerxxxrxx.exefrllxfl.exebthbhh.exepdpjj.exexrfffxx.exelxfllrr.exetnntnn.exejdddv.exeppppj.exexxfxrrl.exetthnhn.exebnbtth.exeppdvj.exexrxflll.exerlxrxxx.exebtbnhb.exebtbtnn.exevdppp.exelxxrrrr.exelxrlrrl.exenhbtbb.exevvpjj.exevppjp.exerrllfff.exebnttnn.exehhtttt.exepvjdp.exefxxlffl.exebhhhhh.exebhhhbb.exeppdpj.exefxfxffx.exerrxfffx.exebtbttt.exevjvpj.exepid process 2192 frflrxf.exe 4328 htnntt.exe 4252 vjjpj.exe 216 rlfxxfx.exe 5036 lfrfllf.exe 3436 ttnhtt.exe 3304 dvpjd.exe 3076 dpddv.exe 1160 fxlfllf.exe 1556 bbnttn.exe 2912 nhhttn.exe 1648 jdddd.exe 2720 9xlllxf.exe 4764 lfflrxx.exe 4364 tnnnhn.exe 4608 vvpdd.exe 1664 lrfxxxl.exe 4460 lflxrrf.exe 4504 tnntnt.exe 4688 jvvpp.exe 4744 pdjjj.exe 1716 7xrlflf.exe 1028 nnnbtb.exe 5072 dpppj.exe 1340 ppppp.exe 1528 rrfxfxl.exe 2968 hbhhnn.exe 2388 bttnhh.exe 4980 dvdvp.exe 32 rxxxrxx.exe 3200 frllxfl.exe 4352 bthbhh.exe 4048 pdpjj.exe 4380 xrfffxx.exe 1260 lxfllrr.exe 4464 tnntnn.exe 4236 jdddv.exe 5104 ppppj.exe 2688 xxfxrrl.exe 4604 tthnhn.exe 4616 bnbtth.exe 1288 ppdvj.exe 3112 xrxflll.exe 2392 rlxrxxx.exe 460 btbnhb.exe 1236 btbtnn.exe 4324 vdppp.exe 3032 lxxrrrr.exe 4724 lxrlrrl.exe 2164 nhbtbb.exe 4140 vvpjj.exe 1720 vppjp.exe 880 rrllfff.exe 4752 bnttnn.exe 4100 hhtttt.exe 1576 pvjdp.exe 3076 fxxlffl.exe 3624 bhhhhh.exe 1352 bhhhbb.exe 2912 ppdpj.exe 4816 fxfxffx.exe 1292 rrxfffx.exe 4740 btbttt.exe 3116 vjvpj.exe -
Processes:
resource yara_rule behavioral2/memory/2248-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\frflrxf.exe upx behavioral2/memory/2248-6-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\htnntt.exe upx \??\c:\vjjpj.exe upx behavioral2/memory/4252-18-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\rlfxxfx.exe upx \??\c:\lfrfllf.exe upx behavioral2/memory/3436-42-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\fxlfllf.exe upx \??\c:\bbnttn.exe upx \??\c:\9xlllxf.exe upx \??\c:\vvpdd.exe upx \??\c:\lflxrrf.exe upx \??\c:\dpppj.exe upx C:\dvdvp.exe upx behavioral2/memory/3200-186-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1720-261-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2012-306-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3116-301-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1352-287-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3624-281-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4100-271-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/880-264-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4140-256-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3112-231-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1288-228-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4616-222-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4604-218-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5104-212-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4236-208-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1260-200-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4048-194-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4352-190-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\bthbhh.exe upx behavioral2/memory/5016-322-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\frllxfl.exe upx \??\c:\rxxxrxx.exe upx behavioral2/memory/2388-169-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2968-163-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\bttnhh.exe upx behavioral2/memory/1528-158-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\hbhhnn.exe upx \??\c:\rrfxfxl.exe upx behavioral2/memory/5072-147-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ppppp.exe upx behavioral2/memory/1028-141-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1716-135-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\nnnbtb.exe upx behavioral2/memory/4744-129-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\7xrlflf.exe upx behavioral2/memory/4688-123-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\pdjjj.exe upx behavioral2/memory/4504-117-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\jvvpp.exe upx behavioral2/memory/1664-109-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\tnntnt.exe upx behavioral2/memory/4608-100-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4364-97-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\lrfxxxl.exe upx behavioral2/memory/4764-88-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\tnnnhn.exe upx behavioral2/memory/2720-82-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\lfflrxx.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e3cb1e7881114bf8cb727b1ffa2ac4e0_NeikiAnalytics.exefrflrxf.exehtnntt.exevjjpj.exerlfxxfx.exelfrfllf.exettnhtt.exedvpjd.exedpddv.exefxlfllf.exebbnttn.exenhhttn.exejdddd.exe9xlllxf.exelfflrxx.exetnnnhn.exevvpdd.exelrfxxxl.exelflxrrf.exetnntnt.exejvvpp.exepdjjj.exedescription pid process target process PID 2248 wrote to memory of 2192 2248 e3cb1e7881114bf8cb727b1ffa2ac4e0_NeikiAnalytics.exe frflrxf.exe PID 2248 wrote to memory of 2192 2248 e3cb1e7881114bf8cb727b1ffa2ac4e0_NeikiAnalytics.exe frflrxf.exe PID 2248 wrote to memory of 2192 2248 e3cb1e7881114bf8cb727b1ffa2ac4e0_NeikiAnalytics.exe frflrxf.exe PID 2192 wrote to memory of 4328 2192 frflrxf.exe htnntt.exe PID 2192 wrote to memory of 4328 2192 frflrxf.exe htnntt.exe PID 2192 wrote to memory of 4328 2192 frflrxf.exe htnntt.exe PID 4328 wrote to memory of 4252 4328 htnntt.exe vjjpj.exe PID 4328 wrote to memory of 4252 4328 htnntt.exe vjjpj.exe PID 4328 wrote to memory of 4252 4328 htnntt.exe vjjpj.exe PID 4252 wrote to memory of 216 4252 vjjpj.exe rlfxxfx.exe PID 4252 wrote to memory of 216 4252 vjjpj.exe rlfxxfx.exe PID 4252 wrote to memory of 216 4252 vjjpj.exe rlfxxfx.exe PID 216 wrote to memory of 5036 216 rlfxxfx.exe lfrfllf.exe PID 216 wrote to memory of 5036 216 rlfxxfx.exe lfrfllf.exe PID 216 wrote to memory of 5036 216 rlfxxfx.exe lfrfllf.exe PID 5036 wrote to memory of 3436 5036 lfrfllf.exe ttnhtt.exe PID 5036 wrote to memory of 3436 5036 lfrfllf.exe ttnhtt.exe PID 5036 wrote to memory of 3436 5036 lfrfllf.exe ttnhtt.exe PID 3436 wrote to memory of 3304 3436 ttnhtt.exe dvpjd.exe PID 3436 wrote to memory of 3304 3436 ttnhtt.exe dvpjd.exe PID 3436 wrote to memory of 3304 3436 ttnhtt.exe dvpjd.exe PID 3304 wrote to memory of 3076 3304 dvpjd.exe fxxlffl.exe PID 3304 wrote to memory of 3076 3304 dvpjd.exe fxxlffl.exe PID 3304 wrote to memory of 3076 3304 dvpjd.exe fxxlffl.exe PID 3076 wrote to memory of 1160 3076 dpddv.exe fxlfllf.exe PID 3076 wrote to memory of 1160 3076 dpddv.exe fxlfllf.exe PID 3076 wrote to memory of 1160 3076 dpddv.exe fxlfllf.exe PID 1160 wrote to memory of 1556 1160 fxlfllf.exe bbnttn.exe PID 1160 wrote to memory of 1556 1160 fxlfllf.exe bbnttn.exe PID 1160 wrote to memory of 1556 1160 fxlfllf.exe bbnttn.exe PID 1556 wrote to memory of 2912 1556 bbnttn.exe nhhttn.exe PID 1556 wrote to memory of 2912 1556 bbnttn.exe nhhttn.exe PID 1556 wrote to memory of 2912 1556 bbnttn.exe nhhttn.exe PID 2912 wrote to memory of 1648 2912 nhhttn.exe jdddd.exe PID 2912 wrote to memory of 1648 2912 nhhttn.exe jdddd.exe PID 2912 wrote to memory of 1648 2912 nhhttn.exe jdddd.exe PID 1648 wrote to memory of 2720 1648 jdddd.exe 9xlllxf.exe PID 1648 wrote to memory of 2720 1648 jdddd.exe 9xlllxf.exe PID 1648 wrote to memory of 2720 1648 jdddd.exe 9xlllxf.exe PID 2720 wrote to memory of 4764 2720 9xlllxf.exe lfflrxx.exe PID 2720 wrote to memory of 4764 2720 9xlllxf.exe lfflrxx.exe PID 2720 wrote to memory of 4764 2720 9xlllxf.exe lfflrxx.exe PID 4764 wrote to memory of 4364 4764 lfflrxx.exe tnnnhn.exe PID 4764 wrote to memory of 4364 4764 lfflrxx.exe tnnnhn.exe PID 4764 wrote to memory of 4364 4764 lfflrxx.exe tnnnhn.exe PID 4364 wrote to memory of 4608 4364 tnnnhn.exe vvpdd.exe PID 4364 wrote to memory of 4608 4364 tnnnhn.exe vvpdd.exe PID 4364 wrote to memory of 4608 4364 tnnnhn.exe vvpdd.exe PID 4608 wrote to memory of 1664 4608 vvpdd.exe lrfxxxl.exe PID 4608 wrote to memory of 1664 4608 vvpdd.exe lrfxxxl.exe PID 4608 wrote to memory of 1664 4608 vvpdd.exe lrfxxxl.exe PID 1664 wrote to memory of 4460 1664 lrfxxxl.exe lflxrrf.exe PID 1664 wrote to memory of 4460 1664 lrfxxxl.exe lflxrrf.exe PID 1664 wrote to memory of 4460 1664 lrfxxxl.exe lflxrrf.exe PID 4460 wrote to memory of 4504 4460 lflxrrf.exe tnntnt.exe PID 4460 wrote to memory of 4504 4460 lflxrrf.exe tnntnt.exe PID 4460 wrote to memory of 4504 4460 lflxrrf.exe tnntnt.exe PID 4504 wrote to memory of 4688 4504 tnntnt.exe jvvpp.exe PID 4504 wrote to memory of 4688 4504 tnntnt.exe jvvpp.exe PID 4504 wrote to memory of 4688 4504 tnntnt.exe jvvpp.exe PID 4688 wrote to memory of 4744 4688 jvvpp.exe pdjjj.exe PID 4688 wrote to memory of 4744 4688 jvvpp.exe pdjjj.exe PID 4688 wrote to memory of 4744 4688 jvvpp.exe pdjjj.exe PID 4744 wrote to memory of 1716 4744 pdjjj.exe 7xrlflf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3cb1e7881114bf8cb727b1ffa2ac4e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e3cb1e7881114bf8cb727b1ffa2ac4e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\frflrxf.exec:\frflrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnntt.exec:\htnntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjjpj.exec:\vjjpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlfxxfx.exec:\rlfxxfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfrfllf.exec:\lfrfllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnhtt.exec:\ttnhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvpjd.exec:\dvpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpddv.exec:\dpddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxlfllf.exec:\fxlfllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnttn.exec:\bbnttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhttn.exec:\nhhttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdddd.exec:\jdddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xlllxf.exec:\9xlllxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfflrxx.exec:\lfflrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnnhn.exec:\tnnnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvpdd.exec:\vvpdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrfxxxl.exec:\lrfxxxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflxrrf.exec:\lflxrrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnntnt.exec:\tnntnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvpp.exec:\jvvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjjj.exec:\pdjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xrlflf.exec:\7xrlflf.exe23⤵
- Executes dropped EXE
-
\??\c:\nnnbtb.exec:\nnnbtb.exe24⤵
- Executes dropped EXE
-
\??\c:\dpppj.exec:\dpppj.exe25⤵
- Executes dropped EXE
-
\??\c:\ppppp.exec:\ppppp.exe26⤵
- Executes dropped EXE
-
\??\c:\rrfxfxl.exec:\rrfxfxl.exe27⤵
- Executes dropped EXE
-
\??\c:\hbhhnn.exec:\hbhhnn.exe28⤵
- Executes dropped EXE
-
\??\c:\bttnhh.exec:\bttnhh.exe29⤵
- Executes dropped EXE
-
\??\c:\dvdvp.exec:\dvdvp.exe30⤵
- Executes dropped EXE
-
\??\c:\rxxxrxx.exec:\rxxxrxx.exe31⤵
- Executes dropped EXE
-
\??\c:\frllxfl.exec:\frllxfl.exe32⤵
- Executes dropped EXE
-
\??\c:\bthbhh.exec:\bthbhh.exe33⤵
- Executes dropped EXE
-
\??\c:\pdpjj.exec:\pdpjj.exe34⤵
- Executes dropped EXE
-
\??\c:\xrfffxx.exec:\xrfffxx.exe35⤵
- Executes dropped EXE
-
\??\c:\lxfllrr.exec:\lxfllrr.exe36⤵
- Executes dropped EXE
-
\??\c:\tnntnn.exec:\tnntnn.exe37⤵
- Executes dropped EXE
-
\??\c:\jdddv.exec:\jdddv.exe38⤵
- Executes dropped EXE
-
\??\c:\ppppj.exec:\ppppj.exe39⤵
- Executes dropped EXE
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe40⤵
- Executes dropped EXE
-
\??\c:\tthnhn.exec:\tthnhn.exe41⤵
- Executes dropped EXE
-
\??\c:\bnbtth.exec:\bnbtth.exe42⤵
- Executes dropped EXE
-
\??\c:\ppdvj.exec:\ppdvj.exe43⤵
- Executes dropped EXE
-
\??\c:\xrxflll.exec:\xrxflll.exe44⤵
- Executes dropped EXE
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe45⤵
- Executes dropped EXE
-
\??\c:\btbnhb.exec:\btbnhb.exe46⤵
- Executes dropped EXE
-
\??\c:\btbtnn.exec:\btbtnn.exe47⤵
- Executes dropped EXE
-
\??\c:\vdppp.exec:\vdppp.exe48⤵
- Executes dropped EXE
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe49⤵
- Executes dropped EXE
-
\??\c:\lxrlrrl.exec:\lxrlrrl.exe50⤵
- Executes dropped EXE
-
\??\c:\nhbtbb.exec:\nhbtbb.exe51⤵
- Executes dropped EXE
-
\??\c:\vvpjj.exec:\vvpjj.exe52⤵
- Executes dropped EXE
-
\??\c:\vppjp.exec:\vppjp.exe53⤵
- Executes dropped EXE
-
\??\c:\rrllfff.exec:\rrllfff.exe54⤵
- Executes dropped EXE
-
\??\c:\bnttnn.exec:\bnttnn.exe55⤵
- Executes dropped EXE
-
\??\c:\hhtttt.exec:\hhtttt.exe56⤵
- Executes dropped EXE
-
\??\c:\pvjdp.exec:\pvjdp.exe57⤵
- Executes dropped EXE
-
\??\c:\fxxlffl.exec:\fxxlffl.exe58⤵
- Executes dropped EXE
-
\??\c:\bhhhhh.exec:\bhhhhh.exe59⤵
- Executes dropped EXE
-
\??\c:\bhhhbb.exec:\bhhhbb.exe60⤵
- Executes dropped EXE
-
\??\c:\ppdpj.exec:\ppdpj.exe61⤵
- Executes dropped EXE
-
\??\c:\fxfxffx.exec:\fxfxffx.exe62⤵
- Executes dropped EXE
-
\??\c:\rrxfffx.exec:\rrxfffx.exe63⤵
- Executes dropped EXE
-
\??\c:\btbttt.exec:\btbttt.exe64⤵
- Executes dropped EXE
-
\??\c:\vjvpj.exec:\vjvpj.exe65⤵
- Executes dropped EXE
-
\??\c:\1pjdv.exec:\1pjdv.exe66⤵
-
\??\c:\flrxrxr.exec:\flrxrxr.exe67⤵
-
\??\c:\nntnhn.exec:\nntnhn.exe68⤵
-
\??\c:\3vdvv.exec:\3vdvv.exe69⤵
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe70⤵
-
\??\c:\lfffxxx.exec:\lfffxxx.exe71⤵
-
\??\c:\bhnnhh.exec:\bhnnhh.exe72⤵
-
\??\c:\bhntnn.exec:\bhntnn.exe73⤵
-
\??\c:\djdpv.exec:\djdpv.exe74⤵
-
\??\c:\bhttbn.exec:\bhttbn.exe75⤵
-
\??\c:\9nhbhh.exec:\9nhbhh.exe76⤵
-
\??\c:\pjvdv.exec:\pjvdv.exe77⤵
-
\??\c:\rrlffxx.exec:\rrlffxx.exe78⤵
-
\??\c:\5bnntt.exec:\5bnntt.exe79⤵
-
\??\c:\bthbtb.exec:\bthbtb.exe80⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe81⤵
-
\??\c:\vdpjd.exec:\vdpjd.exe82⤵
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe83⤵
-
\??\c:\nhhhbb.exec:\nhhhbb.exe84⤵
-
\??\c:\ppjjd.exec:\ppjjd.exe85⤵
-
\??\c:\lrrlffx.exec:\lrrlffx.exe86⤵
-
\??\c:\rlrlfxl.exec:\rlrlfxl.exe87⤵
-
\??\c:\9nhhhn.exec:\9nhhhn.exe88⤵
-
\??\c:\vdppd.exec:\vdppd.exe89⤵
-
\??\c:\rlllfff.exec:\rlllfff.exe90⤵
-
\??\c:\ntnnhh.exec:\ntnnhh.exe91⤵
-
\??\c:\dvddd.exec:\dvddd.exe92⤵
-
\??\c:\pvdpp.exec:\pvdpp.exe93⤵
-
\??\c:\flrlxxl.exec:\flrlxxl.exe94⤵
-
\??\c:\btnhtn.exec:\btnhtn.exe95⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe96⤵
-
\??\c:\ddpjd.exec:\ddpjd.exe97⤵
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe98⤵
-
\??\c:\nbnhbb.exec:\nbnhbb.exe99⤵
-
\??\c:\vpppp.exec:\vpppp.exe100⤵
-
\??\c:\xlfllll.exec:\xlfllll.exe101⤵
-
\??\c:\btttnt.exec:\btttnt.exe102⤵
-
\??\c:\bhtnnh.exec:\bhtnnh.exe103⤵
-
\??\c:\jjppj.exec:\jjppj.exe104⤵
-
\??\c:\fxrlffl.exec:\fxrlffl.exe105⤵
-
\??\c:\7thbth.exec:\7thbth.exe106⤵
-
\??\c:\nttnhn.exec:\nttnhn.exe107⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe108⤵
-
\??\c:\jjddv.exec:\jjddv.exe109⤵
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe110⤵
-
\??\c:\nbtbnb.exec:\nbtbnb.exe111⤵
-
\??\c:\pppvp.exec:\pppvp.exe112⤵
-
\??\c:\rlfxffx.exec:\rlfxffx.exe113⤵
-
\??\c:\bthhbh.exec:\bthhbh.exe114⤵
-
\??\c:\jjdvp.exec:\jjdvp.exe115⤵
-
\??\c:\rrxffrr.exec:\rrxffrr.exe116⤵
-
\??\c:\thbhhn.exec:\thbhhn.exe117⤵
-
\??\c:\pvjdv.exec:\pvjdv.exe118⤵
-
\??\c:\frfrrll.exec:\frfrrll.exe119⤵
-
\??\c:\nnnbnt.exec:\nnnbnt.exe120⤵
-
\??\c:\bnhnhh.exec:\bnhnhh.exe121⤵
-
\??\c:\vppjj.exec:\vppjj.exe122⤵
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe123⤵
-
\??\c:\tntntt.exec:\tntntt.exe124⤵
-
\??\c:\dpdpp.exec:\dpdpp.exe125⤵
-
\??\c:\1ffrlxr.exec:\1ffrlxr.exe126⤵
-
\??\c:\frfxxll.exec:\frfxxll.exe127⤵
-
\??\c:\nbttnn.exec:\nbttnn.exe128⤵
-
\??\c:\btttnn.exec:\btttnn.exe129⤵
-
\??\c:\djvpd.exec:\djvpd.exe130⤵
-
\??\c:\lflfffx.exec:\lflfffx.exe131⤵
-
\??\c:\xxxrlrl.exec:\xxxrlrl.exe132⤵
-
\??\c:\hnbbtt.exec:\hnbbtt.exe133⤵
-
\??\c:\jpppj.exec:\jpppj.exe134⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe135⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe136⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe137⤵
-
\??\c:\pvddj.exec:\pvddj.exe138⤵
-
\??\c:\7xrrlrl.exec:\7xrrlrl.exe139⤵
-
\??\c:\btnbtn.exec:\btnbtn.exe140⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe141⤵
-
\??\c:\rrffxxx.exec:\rrffxxx.exe142⤵
-
\??\c:\thtttt.exec:\thtttt.exe143⤵
-
\??\c:\tthbnn.exec:\tthbnn.exe144⤵
-
\??\c:\pjddd.exec:\pjddd.exe145⤵
-
\??\c:\5rlfflr.exec:\5rlfflr.exe146⤵
-
\??\c:\bbbtbt.exec:\bbbtbt.exe147⤵
-
\??\c:\hnnhhb.exec:\hnnhhb.exe148⤵
-
\??\c:\fxxrlll.exec:\fxxrlll.exe149⤵
-
\??\c:\jjjvp.exec:\jjjvp.exe150⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe151⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe152⤵
-
\??\c:\bttttn.exec:\bttttn.exe153⤵
-
\??\c:\ppvpv.exec:\ppvpv.exe154⤵
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe155⤵
-
\??\c:\bthbbt.exec:\bthbbt.exe156⤵
-
\??\c:\thttnn.exec:\thttnn.exe157⤵
-
\??\c:\jjppj.exec:\jjppj.exe158⤵
-
\??\c:\jvddd.exec:\jvddd.exe159⤵
-
\??\c:\frrrrlx.exec:\frrrrlx.exe160⤵
-
\??\c:\tthhbb.exec:\tthhbb.exe161⤵
-
\??\c:\btbtnn.exec:\btbtnn.exe162⤵
-
\??\c:\jvvpp.exec:\jvvpp.exe163⤵
-
\??\c:\5pjdv.exec:\5pjdv.exe164⤵
-
\??\c:\xlxfxrr.exec:\xlxfxrr.exe165⤵
-
\??\c:\hhbhhn.exec:\hhbhhn.exe166⤵
-
\??\c:\nhtttb.exec:\nhtttb.exe167⤵
-
\??\c:\vpddj.exec:\vpddj.exe168⤵
-
\??\c:\llrlxxl.exec:\llrlxxl.exe169⤵
-
\??\c:\xllrrrl.exec:\xllrrrl.exe170⤵
-
\??\c:\nhnttb.exec:\nhnttb.exe171⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe172⤵
-
\??\c:\dpdpj.exec:\dpdpj.exe173⤵
-
\??\c:\lflffrf.exec:\lflffrf.exe174⤵
-
\??\c:\bnhbnn.exec:\bnhbnn.exe175⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe176⤵
-
\??\c:\djvpp.exec:\djvpp.exe177⤵
-
\??\c:\ffxrfll.exec:\ffxrfll.exe178⤵
-
\??\c:\bbnthb.exec:\bbnthb.exe179⤵
-
\??\c:\ttthbb.exec:\ttthbb.exe180⤵
-
\??\c:\dvpjp.exec:\dvpjp.exe181⤵
-
\??\c:\frfrfrf.exec:\frfrfrf.exe182⤵
-
\??\c:\rrlxlll.exec:\rrlxlll.exe183⤵
-
\??\c:\bbhnht.exec:\bbhnht.exe184⤵
-
\??\c:\vdvvd.exec:\vdvvd.exe185⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe186⤵
-
\??\c:\rxrrllf.exec:\rxrrllf.exe187⤵
-
\??\c:\nntnnn.exec:\nntnnn.exe188⤵
-
\??\c:\1nthtn.exec:\1nthtn.exe189⤵
-
\??\c:\vdddv.exec:\vdddv.exe190⤵
-
\??\c:\rrrllxr.exec:\rrrllxr.exe191⤵
-
\??\c:\rfxxlff.exec:\rfxxlff.exe192⤵
-
\??\c:\thnhhh.exec:\thnhhh.exe193⤵
-
\??\c:\vppjj.exec:\vppjj.exe194⤵
-
\??\c:\jddvp.exec:\jddvp.exe195⤵
-
\??\c:\fxfxrfx.exec:\fxfxrfx.exe196⤵
-
\??\c:\bnhbbt.exec:\bnhbbt.exe197⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe198⤵
-
\??\c:\1pjjv.exec:\1pjjv.exe199⤵
-
\??\c:\xfllrrf.exec:\xfllrrf.exe200⤵
-
\??\c:\hhnnnh.exec:\hhnnnh.exe201⤵
-
\??\c:\dddvv.exec:\dddvv.exe202⤵
-
\??\c:\dpjjv.exec:\dpjjv.exe203⤵
-
\??\c:\frlrrrr.exec:\frlrrrr.exe204⤵
-
\??\c:\tntbhh.exec:\tntbhh.exe205⤵
-
\??\c:\1tbbnb.exec:\1tbbnb.exe206⤵
-
\??\c:\llfflrf.exec:\llfflrf.exe207⤵
-
\??\c:\xfrrxff.exec:\xfrrxff.exe208⤵
-
\??\c:\httbbh.exec:\httbbh.exe209⤵
-
\??\c:\jpppj.exec:\jpppj.exe210⤵
-
\??\c:\xxlfrrr.exec:\xxlfrrr.exe211⤵
-
\??\c:\xxrrxff.exec:\xxrrxff.exe212⤵
-
\??\c:\llxxrll.exec:\llxxrll.exe213⤵
-
\??\c:\btbtht.exec:\btbtht.exe214⤵
-
\??\c:\tttbhn.exec:\tttbhn.exe215⤵
-
\??\c:\9vvpp.exec:\9vvpp.exe216⤵
-
\??\c:\lrlxlfx.exec:\lrlxlfx.exe217⤵
-
\??\c:\hbttnn.exec:\hbttnn.exe218⤵
-
\??\c:\bhbtnn.exec:\bhbtnn.exe219⤵
-
\??\c:\djpjd.exec:\djpjd.exe220⤵
-
\??\c:\fxfllrx.exec:\fxfllrx.exe221⤵
-
\??\c:\rlrrlfx.exec:\rlrrlfx.exe222⤵
-
\??\c:\thhbbb.exec:\thhbbb.exe223⤵
-
\??\c:\7rlffxr.exec:\7rlffxr.exe224⤵
-
\??\c:\bbnnnn.exec:\bbnnnn.exe225⤵
-
\??\c:\3jdpj.exec:\3jdpj.exe226⤵
-
\??\c:\xxxlxrr.exec:\xxxlxrr.exe227⤵
-
\??\c:\bttntb.exec:\bttntb.exe228⤵
-
\??\c:\fflfrrr.exec:\fflfrrr.exe229⤵
-
\??\c:\hhttbh.exec:\hhttbh.exe230⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe231⤵
-
\??\c:\9flrrxx.exec:\9flrrxx.exe232⤵
-
\??\c:\tbnnhn.exec:\tbnnhn.exe233⤵
-
\??\c:\1bbtnn.exec:\1bbtnn.exe234⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe235⤵
-
\??\c:\lrxrrxr.exec:\lrxrrxr.exe236⤵
-
\??\c:\flffllf.exec:\flffllf.exe237⤵
-
\??\c:\hntnhh.exec:\hntnhh.exe238⤵
-
\??\c:\htnnbt.exec:\htnnbt.exe239⤵
-
\??\c:\dpvdv.exec:\dpvdv.exe240⤵
-
\??\c:\lxrxfxx.exec:\lxrxfxx.exe241⤵