Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 23:25
Behavioral task
behavioral1
Sample
1e137b509cf9e3e32fba57d9ff621080_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
1e137b509cf9e3e32fba57d9ff621080_NeikiAnalytics.exe
-
Size
320KB
-
MD5
1e137b509cf9e3e32fba57d9ff621080
-
SHA1
3dea7263b1bccaa4ac6b10a9f8d465d7c24d6b93
-
SHA256
0d0cd342a4a2a5763bb4ca2f0bba5b4fd753d887b8b07c4769d8766df2181b1f
-
SHA512
6c52a7c2cac35fac2aa7b39384cb65d6931376f4d19ea8e1c4ae32953020f2675b4cfbb5f18d402c147b23683a32ddc373ffa1cfed856d8934966ff417908aac
-
SSDEEP
6144:9cm4FmowdHoSZrv9AEa3F2Y9iE9mJrtMsQBcqNLq3xB:/4wFHoSB969P9mJRMsfqV2f
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2988-9-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2124-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2468-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2144-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2732-41-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2648-55-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2788-65-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2712-74-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2600-86-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2964-101-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1620-109-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1924-119-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2764-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1692-144-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1512-169-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2348-179-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2884-196-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2624-205-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1636-222-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1528-239-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1612-249-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2392-274-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2372-283-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2028-318-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2636-371-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3000-384-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2584-409-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2164-461-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1744-487-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2360-508-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2988-582-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2760-632-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/272-710-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1256-734-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1512-748-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1512-747-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2112-838-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2112-841-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2648-925-0x00000000001B0000-0x00000000001E6000-memory.dmp family_blackmoon behavioral1/memory/2648-924-0x00000000001B0000-0x00000000001E6000-memory.dmp family_blackmoon behavioral1/memory/2220-989-0x00000000002D0000-0x0000000000306000-memory.dmp family_blackmoon behavioral1/memory/2060-1102-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000e00000001226f-6.dat family_berbew behavioral1/files/0x0035000000016d61-18.dat family_berbew behavioral1/files/0x0008000000016dde-30.dat family_berbew behavioral1/files/0x0007000000016eb9-39.dat family_berbew behavioral1/files/0x0007000000017042-48.dat family_berbew behavioral1/files/0x0007000000017477-56.dat family_berbew behavioral1/files/0x0008000000017495-63.dat family_berbew behavioral1/files/0x0006000000019228-76.dat family_berbew behavioral1/files/0x000500000001923b-81.dat family_berbew behavioral1/files/0x000500000001925d-92.dat family_berbew behavioral1/files/0x0005000000019260-99.dat family_berbew behavioral1/files/0x0005000000019275-110.dat family_berbew behavioral1/files/0x0005000000019277-117.dat family_berbew behavioral1/files/0x0005000000019283-128.dat family_berbew behavioral1/files/0x000500000001933a-134.dat family_berbew behavioral1/files/0x0034000000016d65-145.dat family_berbew behavioral1/files/0x0005000000019381-152.dat family_berbew behavioral1/files/0x000500000001939f-161.dat family_berbew behavioral1/files/0x00050000000193a5-170.dat family_berbew behavioral1/files/0x00050000000193b1-178.dat family_berbew behavioral1/memory/1104-187-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew behavioral1/files/0x0005000000019433-188.dat family_berbew behavioral1/files/0x000500000001943e-197.dat family_berbew behavioral1/files/0x0005000000019457-206.dat family_berbew behavioral1/files/0x0005000000019462-214.dat family_berbew behavioral1/files/0x0005000000019491-223.dat family_berbew behavioral1/files/0x00050000000194a8-231.dat family_berbew behavioral1/files/0x00050000000194b8-240.dat family_berbew behavioral1/files/0x00050000000194eb-246.dat family_berbew behavioral1/files/0x00050000000194ef-255.dat family_berbew behavioral1/files/0x0005000000019501-265.dat family_berbew behavioral1/files/0x0005000000019507-275.dat family_berbew behavioral1/files/0x000500000001954b-284.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2124 jjjvp.exe 2468 jjdjv.exe 2144 9nnnbn.exe 2732 pjpvp.exe 2648 fffxlxl.exe 2788 dvjvj.exe 2712 3llrflx.exe 2752 7hbtbb.exe 2600 lrffrxx.exe 2964 thtnnt.exe 1620 rllrxxl.exe 1924 nnbbht.exe 2764 xrrrfrx.exe 272 ffxlxfr.exe 1692 vpjvj.exe 1792 rrflffr.exe 2228 ddvjv.exe 1512 rrflfrf.exe 2348 hbthtt.exe 1104 xrrffxf.exe 2884 btbhtb.exe 2624 jvvpp.exe 1820 tttntb.exe 1636 jddjv.exe 1544 lxrrxlx.exe 1528 hbnbhh.exe 1612 pdpdj.exe 1824 tntbhh.exe 944 vpdjp.exe 2392 fxrxfrx.exe 2372 7dpvj.exe 2216 1ffxxrx.exe 1996 9dpdj.exe 2984 lfrxlfl.exe 1592 lfxxxfx.exe 2028 nbhbbn.exe 2848 5dvvd.exe 2664 rrllflx.exe 2672 9thhnh.exe 2748 5ppvj.exe 1324 1xrflfr.exe 2768 thbhhn.exe 2784 jjvjp.exe 1680 fxrxxfl.exe 2636 hthntb.exe 2208 jdvvj.exe 3000 fxrxrxx.exe 2416 xxxfxlx.exe 1552 ttnbnt.exe 2584 5vvvj.exe 1060 5lflrrr.exe 2828 9nbbhh.exe 2432 dvppd.exe 812 1vdvj.exe 1816 xlxfllr.exe 548 btbhtb.exe 1040 pdjjp.exe 2164 pjdjd.exe 2292 ttnbnb.exe 2376 7htnnb.exe 2872 1dpvj.exe 1744 lxxllxf.exe 3028 bthhnn.exe 1600 7jjjj.exe -
resource yara_rule behavioral1/memory/2988-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000e00000001226f-6.dat upx behavioral1/memory/2988-9-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2988-3-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/memory/2124-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0035000000016d61-18.dat upx behavioral1/memory/2468-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2468-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000016dde-30.dat upx behavioral1/memory/2144-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2732-41-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000016eb9-39.dat upx behavioral1/files/0x0007000000017042-48.dat upx behavioral1/memory/2648-55-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000017477-56.dat upx behavioral1/files/0x0008000000017495-63.dat upx behavioral1/memory/2788-65-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000019228-76.dat upx behavioral1/memory/2752-75-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2712-74-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001923b-81.dat upx behavioral1/memory/2600-86-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001925d-92.dat upx behavioral1/files/0x0005000000019260-99.dat upx behavioral1/memory/2964-101-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019275-110.dat upx behavioral1/memory/1620-109-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019277-117.dat upx behavioral1/memory/1924-119-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2764-122-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019283-128.dat upx behavioral1/files/0x000500000001933a-134.dat upx behavioral1/memory/1692-144-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0034000000016d65-145.dat upx behavioral1/files/0x0005000000019381-152.dat upx behavioral1/files/0x000500000001939f-161.dat upx behavioral1/memory/1512-169-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00050000000193a5-170.dat upx behavioral1/memory/2348-179-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00050000000193b1-178.dat upx behavioral1/files/0x0005000000019433-188.dat upx behavioral1/files/0x000500000001943e-197.dat upx behavioral1/memory/2884-196-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2624-205-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019457-206.dat upx behavioral1/files/0x0005000000019462-214.dat upx behavioral1/memory/1636-222-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019491-223.dat upx behavioral1/files/0x00050000000194a8-231.dat upx behavioral1/memory/1528-239-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00050000000194b8-240.dat upx behavioral1/files/0x00050000000194eb-246.dat upx behavioral1/memory/1612-249-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00050000000194ef-255.dat upx behavioral1/files/0x0005000000019501-265.dat upx behavioral1/memory/2392-266-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019507-275.dat upx behavioral1/memory/2392-274-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2372-283-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001954b-284.dat upx behavioral1/memory/2984-298-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1592-305-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2028-318-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2848-319-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2124 2988 1e137b509cf9e3e32fba57d9ff621080_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 2124 2988 1e137b509cf9e3e32fba57d9ff621080_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 2124 2988 1e137b509cf9e3e32fba57d9ff621080_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 2124 2988 1e137b509cf9e3e32fba57d9ff621080_NeikiAnalytics.exe 28 PID 2124 wrote to memory of 2468 2124 jjjvp.exe 29 PID 2124 wrote to memory of 2468 2124 jjjvp.exe 29 PID 2124 wrote to memory of 2468 2124 jjjvp.exe 29 PID 2124 wrote to memory of 2468 2124 jjjvp.exe 29 PID 2468 wrote to memory of 2144 2468 jjdjv.exe 30 PID 2468 wrote to memory of 2144 2468 jjdjv.exe 30 PID 2468 wrote to memory of 2144 2468 jjdjv.exe 30 PID 2468 wrote to memory of 2144 2468 jjdjv.exe 30 PID 2144 wrote to memory of 2732 2144 9nnnbn.exe 31 PID 2144 wrote to memory of 2732 2144 9nnnbn.exe 31 PID 2144 wrote to memory of 2732 2144 9nnnbn.exe 31 PID 2144 wrote to memory of 2732 2144 9nnnbn.exe 31 PID 2732 wrote to memory of 2648 2732 pjpvp.exe 32 PID 2732 wrote to memory of 2648 2732 pjpvp.exe 32 PID 2732 wrote to memory of 2648 2732 pjpvp.exe 32 PID 2732 wrote to memory of 2648 2732 pjpvp.exe 32 PID 2648 wrote to memory of 2788 2648 fffxlxl.exe 33 PID 2648 wrote to memory of 2788 2648 fffxlxl.exe 33 PID 2648 wrote to memory of 2788 2648 fffxlxl.exe 33 PID 2648 wrote to memory of 2788 2648 fffxlxl.exe 33 PID 2788 wrote to memory of 2712 2788 dvjvj.exe 34 PID 2788 wrote to memory of 2712 2788 dvjvj.exe 34 PID 2788 wrote to memory of 2712 2788 dvjvj.exe 34 PID 2788 wrote to memory of 2712 2788 dvjvj.exe 34 PID 2712 wrote to memory of 2752 2712 3llrflx.exe 35 PID 2712 wrote to memory of 2752 2712 3llrflx.exe 35 PID 2712 wrote to memory of 2752 2712 3llrflx.exe 35 PID 2712 wrote to memory of 2752 2712 3llrflx.exe 35 PID 2752 wrote to memory of 2600 2752 7hbtbb.exe 36 PID 2752 wrote to memory of 2600 2752 7hbtbb.exe 36 PID 2752 wrote to memory of 2600 2752 7hbtbb.exe 36 PID 2752 wrote to memory of 2600 2752 7hbtbb.exe 36 PID 2600 wrote to memory of 2964 2600 lrffrxx.exe 37 PID 2600 wrote to memory of 2964 2600 lrffrxx.exe 37 PID 2600 wrote to memory of 2964 2600 lrffrxx.exe 37 PID 2600 wrote to memory of 2964 2600 lrffrxx.exe 37 PID 2964 wrote to memory of 1620 2964 thtnnt.exe 38 PID 2964 wrote to memory of 1620 2964 thtnnt.exe 38 PID 2964 wrote to memory of 1620 2964 thtnnt.exe 38 PID 2964 wrote to memory of 1620 2964 thtnnt.exe 38 PID 1620 wrote to memory of 1924 1620 rllrxxl.exe 39 PID 1620 wrote to memory of 1924 1620 rllrxxl.exe 39 PID 1620 wrote to memory of 1924 1620 rllrxxl.exe 39 PID 1620 wrote to memory of 1924 1620 rllrxxl.exe 39 PID 1924 wrote to memory of 2764 1924 nnbbht.exe 40 PID 1924 wrote to memory of 2764 1924 nnbbht.exe 40 PID 1924 wrote to memory of 2764 1924 nnbbht.exe 40 PID 1924 wrote to memory of 2764 1924 nnbbht.exe 40 PID 2764 wrote to memory of 272 2764 xrrrfrx.exe 41 PID 2764 wrote to memory of 272 2764 xrrrfrx.exe 41 PID 2764 wrote to memory of 272 2764 xrrrfrx.exe 41 PID 2764 wrote to memory of 272 2764 xrrrfrx.exe 41 PID 272 wrote to memory of 1692 272 ffxlxfr.exe 42 PID 272 wrote to memory of 1692 272 ffxlxfr.exe 42 PID 272 wrote to memory of 1692 272 ffxlxfr.exe 42 PID 272 wrote to memory of 1692 272 ffxlxfr.exe 42 PID 1692 wrote to memory of 1792 1692 vpjvj.exe 43 PID 1692 wrote to memory of 1792 1692 vpjvj.exe 43 PID 1692 wrote to memory of 1792 1692 vpjvj.exe 43 PID 1692 wrote to memory of 1792 1692 vpjvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e137b509cf9e3e32fba57d9ff621080_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1e137b509cf9e3e32fba57d9ff621080_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jjjvp.exec:\jjjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\jjdjv.exec:\jjdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\9nnnbn.exec:\9nnnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\pjpvp.exec:\pjpvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\fffxlxl.exec:\fffxlxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\dvjvj.exec:\dvjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\3llrflx.exec:\3llrflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\7hbtbb.exec:\7hbtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\lrffrxx.exec:\lrffrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\thtnnt.exec:\thtnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\rllrxxl.exec:\rllrxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\nnbbht.exec:\nnbbht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\xrrrfrx.exec:\xrrrfrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\vpjvj.exec:\vpjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\rrflffr.exec:\rrflffr.exe17⤵
- Executes dropped EXE
PID:1792 -
\??\c:\ddvjv.exec:\ddvjv.exe18⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rrflfrf.exec:\rrflfrf.exe19⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hbthtt.exec:\hbthtt.exe20⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xrrffxf.exec:\xrrffxf.exe21⤵
- Executes dropped EXE
PID:1104 -
\??\c:\btbhtb.exec:\btbhtb.exe22⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jvvpp.exec:\jvvpp.exe23⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tttntb.exec:\tttntb.exe24⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jddjv.exec:\jddjv.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lxrrxlx.exec:\lxrrxlx.exe26⤵
- Executes dropped EXE
PID:1544 -
\??\c:\hbnbhh.exec:\hbnbhh.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\pdpdj.exec:\pdpdj.exe28⤵
- Executes dropped EXE
PID:1612 -
\??\c:\tntbhh.exec:\tntbhh.exe29⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vpdjp.exec:\vpdjp.exe30⤵
- Executes dropped EXE
PID:944 -
\??\c:\fxrxfrx.exec:\fxrxfrx.exe31⤵
- Executes dropped EXE
PID:2392 -
\??\c:\7dpvj.exec:\7dpvj.exe32⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1ffxxrx.exec:\1ffxxrx.exe33⤵
- Executes dropped EXE
PID:2216 -
\??\c:\9dpdj.exec:\9dpdj.exe34⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lfrxlfl.exec:\lfrxlfl.exe35⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lfxxxfx.exec:\lfxxxfx.exe36⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nbhbbn.exec:\nbhbbn.exe37⤵
- Executes dropped EXE
PID:2028 -
\??\c:\5dvvd.exec:\5dvvd.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rrllflx.exec:\rrllflx.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9thhnh.exec:\9thhnh.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5ppvj.exec:\5ppvj.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1xrflfr.exec:\1xrflfr.exe42⤵
- Executes dropped EXE
PID:1324 -
\??\c:\thbhhn.exec:\thbhhn.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jjvjp.exec:\jjvjp.exe44⤵
- Executes dropped EXE
PID:2784 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe45⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hthntb.exec:\hthntb.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jdvvj.exec:\jdvvj.exe47⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fxrxrxx.exec:\fxrxrxx.exe48⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xxxfxlx.exec:\xxxfxlx.exe49⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ttnbnt.exec:\ttnbnt.exe50⤵
- Executes dropped EXE
PID:1552 -
\??\c:\5vvvj.exec:\5vvvj.exe51⤵
- Executes dropped EXE
PID:2584 -
\??\c:\5lflrrr.exec:\5lflrrr.exe52⤵
- Executes dropped EXE
PID:1060 -
\??\c:\9nbbhh.exec:\9nbbhh.exe53⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dvppd.exec:\dvppd.exe54⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1vdvj.exec:\1vdvj.exe55⤵
- Executes dropped EXE
PID:812 -
\??\c:\xlxfllr.exec:\xlxfllr.exe56⤵
- Executes dropped EXE
PID:1816 -
\??\c:\btbhtb.exec:\btbhtb.exe57⤵
- Executes dropped EXE
PID:548 -
\??\c:\pdjjp.exec:\pdjjp.exe58⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pjdjd.exec:\pjdjd.exe59⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ttnbnb.exec:\ttnbnb.exe60⤵
- Executes dropped EXE
PID:2292 -
\??\c:\7htnnb.exec:\7htnnb.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\1dpvj.exec:\1dpvj.exe62⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lxxllxf.exec:\lxxllxf.exe63⤵
- Executes dropped EXE
PID:1744 -
\??\c:\bthhnn.exec:\bthhnn.exe64⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7jjjj.exec:\7jjjj.exe65⤵
- Executes dropped EXE
PID:1600 -
\??\c:\3rllxfr.exec:\3rllxfr.exe66⤵PID:2360
-
\??\c:\tnbhnb.exec:\tnbhnb.exe67⤵PID:2100
-
\??\c:\5pdjj.exec:\5pdjj.exe68⤵PID:1048
-
\??\c:\ffrxlxf.exec:\ffrxlxf.exe69⤵PID:1840
-
\??\c:\3lxfxfr.exec:\3lxfxfr.exe70⤵PID:772
-
\??\c:\bttthh.exec:\bttthh.exe71⤵PID:896
-
\??\c:\jppjj.exec:\jppjj.exe72⤵PID:888
-
\??\c:\xrlrflx.exec:\xrlrflx.exe73⤵PID:2900
-
\??\c:\tnhntt.exec:\tnhntt.exe74⤵PID:1516
-
\??\c:\7dpvv.exec:\7dpvv.exe75⤵PID:3016
-
\??\c:\1rllxfr.exec:\1rllxfr.exe76⤵PID:1756
-
\??\c:\ttbhtn.exec:\ttbhtn.exe77⤵PID:1288
-
\??\c:\ppppv.exec:\ppppv.exe78⤵PID:2988
-
\??\c:\fxxfxxr.exec:\fxxfxxr.exe79⤵PID:1688
-
\??\c:\xrllxrl.exec:\xrllxrl.exe80⤵PID:1208
-
\??\c:\nbhbnt.exec:\nbhbnt.exe81⤵PID:2616
-
\??\c:\5ddjj.exec:\5ddjj.exe82⤵PID:3024
-
\??\c:\xrfrrxx.exec:\xrfrrxx.exe83⤵PID:2772
-
\??\c:\nbhbnt.exec:\nbhbnt.exe84⤵PID:2744
-
\??\c:\ppvjj.exec:\ppvjj.exe85⤵PID:2528
-
\??\c:\3dpdj.exec:\3dpdj.exe86⤵PID:2760
-
\??\c:\1lxfrfl.exec:\1lxfrfl.exe87⤵PID:2992
-
\??\c:\nntttt.exec:\nntttt.exe88⤵PID:2756
-
\??\c:\pdjdd.exec:\pdjdd.exe89⤵PID:2524
-
\??\c:\9fxflrr.exec:\9fxflrr.exe90⤵PID:2940
-
\??\c:\thhhbb.exec:\thhhbb.exe91⤵PID:2644
-
\??\c:\jdpdj.exec:\jdpdj.exe92⤵PID:2420
-
\??\c:\lfrxrxl.exec:\lfrxrxl.exe93⤵PID:2968
-
\??\c:\rrrflrf.exec:\rrrflrf.exe94⤵PID:1620
-
\??\c:\bbtntb.exec:\bbtntb.exe95⤵PID:2700
-
\??\c:\jdvjp.exec:\jdvjp.exe96⤵PID:2816
-
\??\c:\llxxflr.exec:\llxxflr.exe97⤵PID:1672
-
\??\c:\tnbtnt.exec:\tnbtnt.exe98⤵PID:272
-
\??\c:\vpjvj.exec:\vpjvj.exe99⤵PID:268
-
\??\c:\xxrrlrl.exec:\xxrrlrl.exe100⤵PID:2244
-
\??\c:\hnhthn.exec:\hnhthn.exe101⤵PID:1256
-
\??\c:\3jvvj.exec:\3jvvj.exe102⤵PID:584
-
\??\c:\xrxlrfr.exec:\xrxlrfr.exe103⤵PID:1512
-
\??\c:\hbthbh.exec:\hbthbh.exe104⤵PID:2476
-
\??\c:\jjvpj.exec:\jjvpj.exe105⤵PID:2888
-
\??\c:\tbnnnb.exec:\tbnnnb.exe106⤵PID:2328
-
\??\c:\vvvvj.exec:\vvvvj.exe107⤵PID:852
-
\??\c:\xrrfflf.exec:\xrrfflf.exe108⤵PID:572
-
\??\c:\5htbht.exec:\5htbht.exe109⤵PID:2408
-
\??\c:\pdpvv.exec:\pdpvv.exe110⤵PID:448
-
\??\c:\xrfrfll.exec:\xrfrfll.exe111⤵PID:1360
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe112⤵PID:1964
-
\??\c:\9nbnbn.exec:\9nbnbn.exe113⤵PID:1528
-
\??\c:\dvdjp.exec:\dvdjp.exe114⤵PID:2400
-
\??\c:\5xxxflx.exec:\5xxxflx.exe115⤵PID:1296
-
\??\c:\9lxxlll.exec:\9lxxlll.exe116⤵PID:2824
-
\??\c:\9nhhbn.exec:\9nhhbn.exe117⤵PID:2016
-
\??\c:\jjpvv.exec:\jjpvv.exe118⤵PID:2112
-
\??\c:\5jvdp.exec:\5jvdp.exe119⤵PID:1752
-
\??\c:\nnbbhn.exec:\nnbbhn.exe120⤵PID:3004
-
\??\c:\jpvvv.exec:\jpvvv.exe121⤵PID:1992
-
\??\c:\ffxlxfx.exec:\ffxlxfx.exe122⤵PID:2132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-