Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 23:26
Behavioral task
behavioral1
Sample
982e07baca30d70d224059ebb86c76a0_NEIKI.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
982e07baca30d70d224059ebb86c76a0_NEIKI.exe
-
Size
259KB
-
MD5
982e07baca30d70d224059ebb86c76a0
-
SHA1
a372c9bb4122103ce4473850ee211d0685ab6479
-
SHA256
623c74010e3e77d5b19dd5eba2a03159bde41b5ae7e76e26ef842599554dad3a
-
SHA512
489e1e73706f250a0ef8bc65572cde434eb317dbad1b40a8369fcc0ae0c45a6b9a705714272e6bb74999497e63b1435c06e3656f49f3efcd74d4f77a97002d7a
-
SSDEEP
6144:mcm4FmowdHoS1IOnHoDTmhraHcpOFltH4t0P4EhTKCi5RQc7F:I4wFHoSKOHYT6eFpguen5Sc7F
Malware Config
Signatures
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/1632-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1792-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2700-30-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2584-45-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2648-62-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2712-71-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2524-80-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2060-83-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1884-98-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2628-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/860-120-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1648-137-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2108-146-0x00000000002D0000-0x0000000000306000-memory.dmp family_blackmoon behavioral1/memory/2108-145-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1720-156-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/844-173-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1604-193-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/264-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1108-211-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/924-259-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1760-262-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1972-280-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2848-295-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1680-302-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2996-324-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2668-336-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2600-351-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1548-402-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1852-421-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2880-476-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2284-495-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/532-496-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2120-730-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2184-775-0x00000000002E0000-0x0000000000316000-memory.dmp family_blackmoon behavioral1/memory/2312-1106-0x00000000002A0000-0x00000000002D6000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000a000000012280-8.dat family_berbew behavioral1/files/0x0037000000014349-18.dat family_berbew behavioral1/files/0x00080000000144c0-26.dat family_berbew behavioral1/files/0x0007000000014531-35.dat family_berbew behavioral1/files/0x00070000000145be-43.dat family_berbew behavioral1/files/0x0007000000014691-52.dat family_berbew behavioral1/files/0x000700000001471a-60.dat family_berbew behavioral1/files/0x0007000000015693-70.dat family_berbew behavioral1/files/0x0006000000015b6e-78.dat family_berbew behavioral1/files/0x0006000000015bf4-90.dat family_berbew behavioral1/files/0x0006000000015cb8-99.dat family_berbew behavioral1/files/0x0006000000015cc7-106.dat family_berbew behavioral1/files/0x0006000000015cdf-115.dat family_berbew behavioral1/files/0x0006000000015ce8-127.dat family_berbew behavioral1/files/0x0006000000015cf0-136.dat family_berbew behavioral1/files/0x0006000000015d08-147.dat family_berbew behavioral1/files/0x0037000000014352-154.dat family_berbew behavioral1/files/0x0006000000015d12-164.dat family_berbew behavioral1/files/0x0006000000015d24-171.dat family_berbew behavioral1/files/0x0006000000015d3b-181.dat family_berbew behavioral1/files/0x0006000000015d53-189.dat family_berbew behavioral1/files/0x0006000000015d73-199.dat family_berbew behavioral1/files/0x0006000000015d7b-209.dat family_berbew behavioral1/files/0x0006000000015d83-218.dat family_berbew behavioral1/files/0x0006000000015d90-226.dat family_berbew behavioral1/files/0x0006000000015d9f-234.dat family_berbew behavioral1/files/0x0006000000015dca-243.dat family_berbew behavioral1/files/0x0006000000015e1d-251.dat family_berbew behavioral1/files/0x0006000000015f73-261.dat family_berbew behavioral1/files/0x0006000000015fef-269.dat family_berbew behavioral1/files/0x000600000001611e-276.dat family_berbew behavioral1/files/0x000600000001615c-287.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1792 hbbtbn.exe 3060 hnnbbn.exe 2700 dpjvd.exe 2584 ffxxllf.exe 2612 nbnhhb.exe 2648 djdvj.exe 2712 rrrfrfr.exe 2524 vvdvv.exe 2060 9lfxllx.exe 1884 bbthtt.exe 1524 jjjdj.exe 2628 xxllxfr.exe 860 jpvpp.exe 1648 5frrxfl.exe 2108 jddjv.exe 1720 lllxflx.exe 2092 jpdpd.exe 844 rrxrlfx.exe 2872 3nnttt.exe 2148 vvpvj.exe 1604 tntbnn.exe 264 ddvdd.exe 1108 ffxrxxf.exe 1516 tthtbh.exe 2000 llfffrf.exe 2224 htthhb.exe 2368 jdvjp.exe 924 rrrlxff.exe 1760 bbtbnh.exe 680 1vppd.exe 1972 tnbbbn.exe 2848 vpjjp.exe 1680 ttnbtb.exe 2964 pjdpj.exe 1932 lllxrll.exe 2404 tnhnbb.exe 2996 hbtnth.exe 2668 jjdpv.exe 2560 1xfrxfr.exe 2600 ffrfrfx.exe 2656 vppvj.exe 2472 lfrfrxx.exe 2496 thbhhn.exe 2460 jdddj.exe 2504 jjvvj.exe 2164 lxrfrrl.exe 992 9hbhnt.exe 1548 dvpvd.exe 1484 9dddv.exe 2640 xrrrlxl.exe 1852 5thntb.exe 2628 7dpdd.exe 348 3pvjj.exe 344 nhbbbh.exe 1868 nnhtht.exe 1912 ppvjv.exe 2244 5lxxlfr.exe 1280 bbtbhh.exe 2880 pjddj.exe 2916 rlxxfrr.exe 2212 nhnhbn.exe 2284 djdpj.exe 532 jjjvj.exe 880 frxrflf.exe -
resource yara_rule behavioral1/memory/1632-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000a000000012280-8.dat upx behavioral1/memory/1632-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1792-9-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1792-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0037000000014349-18.dat upx behavioral1/memory/3060-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00080000000144c0-26.dat upx behavioral1/memory/2700-30-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000014531-35.dat upx behavioral1/files/0x00070000000145be-43.dat upx behavioral1/memory/2584-45-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000014691-52.dat upx behavioral1/files/0x000700000001471a-60.dat upx behavioral1/memory/2648-62-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015693-70.dat upx behavioral1/memory/2712-71-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015b6e-78.dat upx behavioral1/memory/2524-80-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2060-83-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015bf4-90.dat upx behavioral1/memory/1884-98-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015cb8-99.dat upx behavioral1/files/0x0006000000015cc7-106.dat upx behavioral1/memory/2628-108-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015cdf-115.dat upx behavioral1/memory/2628-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/860-120-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015ce8-127.dat upx behavioral1/memory/1648-137-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015cf0-136.dat upx behavioral1/files/0x0006000000015d08-147.dat upx behavioral1/memory/2108-145-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0037000000014352-154.dat upx behavioral1/memory/1720-156-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015d12-164.dat upx behavioral1/files/0x0006000000015d24-171.dat upx behavioral1/memory/844-173-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015d3b-181.dat upx behavioral1/files/0x0006000000015d53-189.dat upx behavioral1/memory/1604-193-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015d73-199.dat upx behavioral1/files/0x0006000000015d7b-209.dat upx behavioral1/memory/264-208-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1108-211-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015d83-218.dat upx behavioral1/files/0x0006000000015d90-226.dat upx behavioral1/files/0x0006000000015d9f-234.dat upx behavioral1/memory/2224-235-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015dca-243.dat upx behavioral1/files/0x0006000000015e1d-251.dat upx behavioral1/memory/924-259-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015f73-261.dat upx behavioral1/memory/1760-262-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015fef-269.dat upx behavioral1/files/0x000600000001611e-276.dat upx behavioral1/memory/1972-280-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000600000001615c-287.dat upx behavioral1/memory/2848-295-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1680-302-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1932-310-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2996-324-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2668-336-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2600-351-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1792 1632 982e07baca30d70d224059ebb86c76a0_NEIKI.exe 28 PID 1632 wrote to memory of 1792 1632 982e07baca30d70d224059ebb86c76a0_NEIKI.exe 28 PID 1632 wrote to memory of 1792 1632 982e07baca30d70d224059ebb86c76a0_NEIKI.exe 28 PID 1632 wrote to memory of 1792 1632 982e07baca30d70d224059ebb86c76a0_NEIKI.exe 28 PID 1792 wrote to memory of 3060 1792 hbbtbn.exe 29 PID 1792 wrote to memory of 3060 1792 hbbtbn.exe 29 PID 1792 wrote to memory of 3060 1792 hbbtbn.exe 29 PID 1792 wrote to memory of 3060 1792 hbbtbn.exe 29 PID 3060 wrote to memory of 2700 3060 hnnbbn.exe 30 PID 3060 wrote to memory of 2700 3060 hnnbbn.exe 30 PID 3060 wrote to memory of 2700 3060 hnnbbn.exe 30 PID 3060 wrote to memory of 2700 3060 hnnbbn.exe 30 PID 2700 wrote to memory of 2584 2700 dpjvd.exe 31 PID 2700 wrote to memory of 2584 2700 dpjvd.exe 31 PID 2700 wrote to memory of 2584 2700 dpjvd.exe 31 PID 2700 wrote to memory of 2584 2700 dpjvd.exe 31 PID 2584 wrote to memory of 2612 2584 ffxxllf.exe 32 PID 2584 wrote to memory of 2612 2584 ffxxllf.exe 32 PID 2584 wrote to memory of 2612 2584 ffxxllf.exe 32 PID 2584 wrote to memory of 2612 2584 ffxxllf.exe 32 PID 2612 wrote to memory of 2648 2612 nbnhhb.exe 33 PID 2612 wrote to memory of 2648 2612 nbnhhb.exe 33 PID 2612 wrote to memory of 2648 2612 nbnhhb.exe 33 PID 2612 wrote to memory of 2648 2612 nbnhhb.exe 33 PID 2648 wrote to memory of 2712 2648 djdvj.exe 34 PID 2648 wrote to memory of 2712 2648 djdvj.exe 34 PID 2648 wrote to memory of 2712 2648 djdvj.exe 34 PID 2648 wrote to memory of 2712 2648 djdvj.exe 34 PID 2712 wrote to memory of 2524 2712 rrrfrfr.exe 35 PID 2712 wrote to memory of 2524 2712 rrrfrfr.exe 35 PID 2712 wrote to memory of 2524 2712 rrrfrfr.exe 35 PID 2712 wrote to memory of 2524 2712 rrrfrfr.exe 35 PID 2524 wrote to memory of 2060 2524 vvdvv.exe 36 PID 2524 wrote to memory of 2060 2524 vvdvv.exe 36 PID 2524 wrote to memory of 2060 2524 vvdvv.exe 36 PID 2524 wrote to memory of 2060 2524 vvdvv.exe 36 PID 2060 wrote to memory of 1884 2060 9lfxllx.exe 37 PID 2060 wrote to memory of 1884 2060 9lfxllx.exe 37 PID 2060 wrote to memory of 1884 2060 9lfxllx.exe 37 PID 2060 wrote to memory of 1884 2060 9lfxllx.exe 37 PID 1884 wrote to memory of 1524 1884 bbthtt.exe 38 PID 1884 wrote to memory of 1524 1884 bbthtt.exe 38 PID 1884 wrote to memory of 1524 1884 bbthtt.exe 38 PID 1884 wrote to memory of 1524 1884 bbthtt.exe 38 PID 1524 wrote to memory of 2628 1524 jjjdj.exe 39 PID 1524 wrote to memory of 2628 1524 jjjdj.exe 39 PID 1524 wrote to memory of 2628 1524 jjjdj.exe 39 PID 1524 wrote to memory of 2628 1524 jjjdj.exe 39 PID 2628 wrote to memory of 860 2628 xxllxfr.exe 40 PID 2628 wrote to memory of 860 2628 xxllxfr.exe 40 PID 2628 wrote to memory of 860 2628 xxllxfr.exe 40 PID 2628 wrote to memory of 860 2628 xxllxfr.exe 40 PID 860 wrote to memory of 1648 860 jpvpp.exe 41 PID 860 wrote to memory of 1648 860 jpvpp.exe 41 PID 860 wrote to memory of 1648 860 jpvpp.exe 41 PID 860 wrote to memory of 1648 860 jpvpp.exe 41 PID 1648 wrote to memory of 2108 1648 5frrxfl.exe 42 PID 1648 wrote to memory of 2108 1648 5frrxfl.exe 42 PID 1648 wrote to memory of 2108 1648 5frrxfl.exe 42 PID 1648 wrote to memory of 2108 1648 5frrxfl.exe 42 PID 2108 wrote to memory of 1720 2108 jddjv.exe 43 PID 2108 wrote to memory of 1720 2108 jddjv.exe 43 PID 2108 wrote to memory of 1720 2108 jddjv.exe 43 PID 2108 wrote to memory of 1720 2108 jddjv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\982e07baca30d70d224059ebb86c76a0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\982e07baca30d70d224059ebb86c76a0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\hbbtbn.exec:\hbbtbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\hnnbbn.exec:\hnnbbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\dpjvd.exec:\dpjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ffxxllf.exec:\ffxxllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\nbnhhb.exec:\nbnhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\djdvj.exec:\djdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\rrrfrfr.exec:\rrrfrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\vvdvv.exec:\vvdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\9lfxllx.exec:\9lfxllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\bbthtt.exec:\bbthtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\jjjdj.exec:\jjjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\xxllxfr.exec:\xxllxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jpvpp.exec:\jpvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\5frrxfl.exec:\5frrxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\jddjv.exec:\jddjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\lllxflx.exec:\lllxflx.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jpdpd.exec:\jpdpd.exe18⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe19⤵
- Executes dropped EXE
PID:844 -
\??\c:\3nnttt.exec:\3nnttt.exe20⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vvpvj.exec:\vvpvj.exe21⤵
- Executes dropped EXE
PID:2148 -
\??\c:\tntbnn.exec:\tntbnn.exe22⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ddvdd.exec:\ddvdd.exe23⤵
- Executes dropped EXE
PID:264 -
\??\c:\ffxrxxf.exec:\ffxrxxf.exe24⤵
- Executes dropped EXE
PID:1108 -
\??\c:\tthtbh.exec:\tthtbh.exe25⤵
- Executes dropped EXE
PID:1516 -
\??\c:\llfffrf.exec:\llfffrf.exe26⤵
- Executes dropped EXE
PID:2000 -
\??\c:\htthhb.exec:\htthhb.exe27⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jdvjp.exec:\jdvjp.exe28⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rrrlxff.exec:\rrrlxff.exe29⤵
- Executes dropped EXE
PID:924 -
\??\c:\bbtbnh.exec:\bbtbnh.exe30⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1vppd.exec:\1vppd.exe31⤵
- Executes dropped EXE
PID:680 -
\??\c:\tnbbbn.exec:\tnbbbn.exe32⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vpjjp.exec:\vpjjp.exe33⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ttnbtb.exec:\ttnbtb.exe34⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pjdpj.exec:\pjdpj.exe35⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lllxrll.exec:\lllxrll.exe36⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tnhnbb.exec:\tnhnbb.exe37⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hbtnth.exec:\hbtnth.exe38⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jjdpv.exec:\jjdpv.exe39⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1xfrxfr.exec:\1xfrxfr.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ffrfrfx.exec:\ffrfrfx.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vppvj.exec:\vppvj.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lfrfrxx.exec:\lfrfrxx.exe43⤵
- Executes dropped EXE
PID:2472 -
\??\c:\thbhhn.exec:\thbhhn.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jdddj.exec:\jdddj.exe45⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jjvvj.exec:\jjvvj.exe46⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lxrfrrl.exec:\lxrfrrl.exe47⤵
- Executes dropped EXE
PID:2164 -
\??\c:\9hbhnt.exec:\9hbhnt.exe48⤵
- Executes dropped EXE
PID:992 -
\??\c:\dvpvd.exec:\dvpvd.exe49⤵
- Executes dropped EXE
PID:1548 -
\??\c:\9dddv.exec:\9dddv.exe50⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xrrrlxl.exec:\xrrrlxl.exe51⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5thntb.exec:\5thntb.exe52⤵
- Executes dropped EXE
PID:1852 -
\??\c:\7dpdd.exec:\7dpdd.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3pvjj.exec:\3pvjj.exe54⤵
- Executes dropped EXE
PID:348 -
\??\c:\nhbbbh.exec:\nhbbbh.exe55⤵
- Executes dropped EXE
PID:344 -
\??\c:\nnhtht.exec:\nnhtht.exe56⤵
- Executes dropped EXE
PID:1868 -
\??\c:\ppvjv.exec:\ppvjv.exe57⤵
- Executes dropped EXE
PID:1912 -
\??\c:\5lxxlfr.exec:\5lxxlfr.exe58⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bbtbhh.exec:\bbtbhh.exe59⤵
- Executes dropped EXE
PID:1280 -
\??\c:\pjddj.exec:\pjddj.exe60⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rlxxfrr.exec:\rlxxfrr.exe61⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nhnhbn.exec:\nhnhbn.exe62⤵
- Executes dropped EXE
PID:2212 -
\??\c:\djdpj.exec:\djdpj.exe63⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jjjvj.exec:\jjjvj.exe64⤵
- Executes dropped EXE
PID:532 -
\??\c:\frxrflf.exec:\frxrflf.exe65⤵
- Executes dropped EXE
PID:880 -
\??\c:\nhbnbn.exec:\nhbnbn.exe66⤵PID:1440
-
\??\c:\xfrlrrx.exec:\xfrlrrx.exe67⤵PID:1108
-
\??\c:\xrxfxrx.exec:\xrxfxrx.exe68⤵PID:1180
-
\??\c:\bbtbnt.exec:\bbtbnt.exe69⤵PID:2980
-
\??\c:\vpjpd.exec:\vpjpd.exe70⤵PID:1228
-
\??\c:\lxlxllf.exec:\lxlxllf.exe71⤵PID:2224
-
\??\c:\xlfflxf.exec:\xlfflxf.exe72⤵PID:2368
-
\??\c:\bbhbbh.exec:\bbhbbh.exe73⤵PID:2380
-
\??\c:\3vvjv.exec:\3vvjv.exe74⤵PID:752
-
\??\c:\vpvjp.exec:\vpvjp.exe75⤵PID:1928
-
\??\c:\5rxrrfx.exec:\5rxrrfx.exe76⤵PID:556
-
\??\c:\9bnhhb.exec:\9bnhhb.exe77⤵PID:2536
-
\??\c:\ppjjv.exec:\ppjjv.exe78⤵PID:2728
-
\??\c:\5jdjv.exec:\5jdjv.exe79⤵PID:888
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe80⤵PID:1680
-
\??\c:\tttbnt.exec:\tttbnt.exe81⤵PID:2632
-
\??\c:\jdppv.exec:\jdppv.exe82⤵PID:1508
-
\??\c:\vpvjp.exec:\vpvjp.exe83⤵PID:2040
-
\??\c:\rflfxxx.exec:\rflfxxx.exe84⤵PID:2596
-
\??\c:\5htntt.exec:\5htntt.exe85⤵PID:2720
-
\??\c:\hnbtnh.exec:\hnbtnh.exe86⤵PID:2556
-
\??\c:\pppjd.exec:\pppjd.exe87⤵PID:2708
-
\??\c:\lllxlfr.exec:\lllxlfr.exe88⤵PID:2664
-
\??\c:\bbthbt.exec:\bbthbt.exe89⤵PID:1652
-
\??\c:\ddvvj.exec:\ddvvj.exe90⤵PID:2448
-
\??\c:\llxlrlx.exec:\llxlrlx.exe91⤵PID:2492
-
\??\c:\ttntht.exec:\ttntht.exe92⤵PID:2960
-
\??\c:\5bntnb.exec:\5bntnb.exe93⤵PID:1600
-
\??\c:\pdvjj.exec:\pdvjj.exe94⤵PID:1716
-
\??\c:\5lrffrf.exec:\5lrffrf.exe95⤵PID:1576
-
\??\c:\9bnnbh.exec:\9bnnbh.exe96⤵PID:2436
-
\??\c:\hhhthn.exec:\hhhthn.exe97⤵PID:2748
-
\??\c:\ddvjv.exec:\ddvjv.exe98⤵PID:2740
-
\??\c:\rlxfxxr.exec:\rlxfxxr.exe99⤵PID:1260
-
\??\c:\9tbbtb.exec:\9tbbtb.exe100⤵PID:1624
-
\??\c:\7ddpd.exec:\7ddpd.exe101⤵PID:2120
-
\??\c:\7vppv.exec:\7vppv.exe102⤵PID:2108
-
\??\c:\ffxfrrx.exec:\ffxfrrx.exe103⤵PID:2096
-
\??\c:\nhnhnn.exec:\nhnhnn.exe104⤵PID:1428
-
\??\c:\3vjpv.exec:\3vjpv.exe105⤵PID:1692
-
\??\c:\jdjpd.exec:\jdjpd.exe106⤵PID:2876
-
\??\c:\rfxlrxf.exec:\rfxlrxf.exe107⤵PID:2184
-
\??\c:\nhtbth.exec:\nhtbth.exe108⤵PID:2916
-
\??\c:\1ttnbt.exec:\1ttnbt.exe109⤵PID:2064
-
\??\c:\1ddpd.exec:\1ddpd.exe110⤵PID:572
-
\??\c:\rlfrfrr.exec:\rlfrfrr.exe111⤵PID:772
-
\??\c:\hhbnbn.exec:\hhbnbn.exe112⤵PID:1104
-
\??\c:\hhntbn.exec:\hhntbn.exe113⤵PID:404
-
\??\c:\9jdvd.exec:\9jdvd.exe114⤵PID:1516
-
\??\c:\rrrllxf.exec:\rrrllxf.exe115⤵PID:1180
-
\??\c:\dvjpv.exec:\dvjpv.exe116⤵PID:1220
-
\??\c:\7jvjp.exec:\7jvjp.exe117⤵PID:1796
-
\??\c:\rrlrrrf.exec:\rrlrrrf.exe118⤵PID:3052
-
\??\c:\7htnht.exec:\7htnht.exe119⤵PID:688
-
\??\c:\7bnhnt.exec:\7bnhnt.exe120⤵PID:1760
-
\??\c:\pppjv.exec:\pppjv.exe121⤵PID:1968
-
\??\c:\llxlxlx.exec:\llxlxlx.exe122⤵PID:980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-