Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 02:59
Behavioral task
behavioral1
Sample
d7802181f57be93701be7f29cb7e6c00_NEIKI.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
-
Target
d7802181f57be93701be7f29cb7e6c00_NEIKI.exe
-
Size
221KB
-
MD5
d7802181f57be93701be7f29cb7e6c00
-
SHA1
7712eed21792defcf730acbe103270c813edd15f
-
SHA256
906ac2c42248bc9d9d3f85ae7e02b247211dd332c130fd733b55debaa5c2c83f
-
SHA512
1ab2f4ca2d32043c9c9c03fdab3181b45d5b91c2454fae36f75faceef553eacc9dbd65109b378106dec22b6f9596023a961933ee4a97b51515b8535772771cb1
-
SSDEEP
6144:Jcm4FmowdHoS3dGmS4Z1hraHcpOaKHpaztyzo:T4wFHoS3dJS4ZzeFaKHpCco
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/2208-7-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2252-16-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2760-20-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2832-40-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2080-37-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2528-56-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2548-59-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2540-76-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1192-92-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2876-110-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2948-118-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1596-128-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1628-132-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/324-146-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2580-156-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2504-199-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2984-208-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/540-218-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1784-237-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1156-252-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/804-270-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1576-319-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1712-326-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/3068-375-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2564-394-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2936-407-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2000-420-0x00000000001B0000-0x00000000001E5000-memory.dmp family_blackmoon behavioral1/memory/280-458-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/484-491-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1272-554-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2336-567-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1772-580-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2088-668-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/468-1064-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000c000000012263-8.dat family_berbew behavioral1/files/0x0031000000015cf5-18.dat family_berbew behavioral1/files/0x0008000000015d28-27.dat family_berbew behavioral1/files/0x0008000000015d99-34.dat family_berbew behavioral1/files/0x0007000000015fbb-47.dat family_berbew behavioral1/files/0x0007000000016020-57.dat family_berbew behavioral1/files/0x0007000000016126-66.dat family_berbew behavioral1/files/0x0008000000016d01-72.dat family_berbew behavioral1/files/0x0006000000016d21-83.dat family_berbew behavioral1/files/0x0006000000016d2d-90.dat family_berbew behavioral1/files/0x0006000000016d36-101.dat family_berbew behavioral1/files/0x0006000000016d3e-109.dat family_berbew behavioral1/files/0x0006000000016d46-119.dat family_berbew behavioral1/files/0x0006000000016d4f-126.dat family_berbew behavioral1/files/0x0006000000016d57-137.dat family_berbew behavioral1/files/0x0006000000016d5f-144.dat family_berbew behavioral1/files/0x0006000000016d73-154.dat family_berbew behavioral1/files/0x0006000000016d79-162.dat family_berbew behavioral1/files/0x0006000000016d7d-172.dat family_berbew behavioral1/files/0x0006000000016fa9-179.dat family_berbew behavioral1/files/0x000600000001708c-190.dat family_berbew behavioral1/files/0x0032000000015d02-201.dat family_berbew behavioral1/files/0x00060000000171ad-209.dat family_berbew behavioral1/files/0x000600000001738e-215.dat family_berbew behavioral1/files/0x000600000001738f-228.dat family_berbew behavioral1/files/0x00060000000173e2-235.dat family_berbew behavioral1/files/0x00060000000173e5-244.dat family_berbew behavioral1/files/0x0006000000017436-254.dat family_berbew behavioral1/files/0x00060000000174ef-261.dat family_berbew behavioral1/files/0x0006000000017577-268.dat family_berbew behavioral1/files/0x00060000000175f7-278.dat family_berbew behavioral1/files/0x00060000000175fd-286.dat family_berbew behavioral1/memory/1728-3115-0x00000000005D0000-0x0000000000605000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2252 fxxllrl.exe 2760 jjddp.exe 2080 9lfrffx.exe 2832 dvppj.exe 2528 dvpvd.exe 2548 bbtbnn.exe 2636 jjjvp.exe 2540 fxffxxx.exe 1192 tnbbtb.exe 1764 vvddv.exe 2876 frrflrl.exe 2948 tnhnnh.exe 1596 7nhtbh.exe 1628 3xxfrxr.exe 324 hbbnbn.exe 2580 9vdjv.exe 2608 7lxlrrx.exe 1752 dvjjp.exe 1432 5dpvj.exe 3020 lxlrxlx.exe 2504 nhtnbh.exe 2984 ddvpj.exe 540 ffxflrl.exe 1612 jjvdj.exe 2464 7frflrx.exe 1784 ddjjd.exe 1156 xlrrfxf.exe 3016 hbhnnb.exe 804 ddpvj.exe 1992 9xlxlrx.exe 1720 tnbhnb.exe 2400 vvjdj.exe 1728 fxlfrlx.exe 2240 lfxxllr.exe 2212 thbhtt.exe 1576 vjddj.exe 1712 ppjvj.exe 2012 xxllllx.exe 2816 ttnthn.exe 2648 hbtbht.exe 2640 7dvdv.exe 2556 pvvvj.exe 2560 rrlfxlx.exe 2864 htbbnn.exe 2572 htbhnh.exe 3068 dpjjp.exe 2292 dpvvd.exe 2564 fxlxfrf.exe 1764 bbntbh.exe 2936 vpjpd.exe 3048 7jvdp.exe 2000 ffxrrrf.exe 1596 1rlxxff.exe 1340 ttnbnt.exe 1836 dpjpv.exe 2920 djvdv.exe 1980 3frfrxf.exe 280 tnbhnb.exe 1660 ttnbhn.exe 2616 ppjjv.exe 2988 lfxllrl.exe 2236 fxrlrrf.exe 2992 hbnbnb.exe 484 btthnn.exe -
resource yara_rule behavioral1/memory/2208-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2208-7-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000c000000012263-8.dat upx behavioral1/files/0x0031000000015cf5-18.dat upx behavioral1/memory/2252-16-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2760-20-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0008000000015d28-27.dat upx behavioral1/memory/2080-28-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0008000000015d99-34.dat upx behavioral1/memory/2832-40-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2080-37-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0007000000015fbb-47.dat upx behavioral1/memory/2528-56-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0007000000016020-57.dat upx behavioral1/memory/2548-59-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0007000000016126-66.dat upx behavioral1/files/0x0008000000016d01-72.dat upx behavioral1/memory/2540-76-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d21-83.dat upx behavioral1/files/0x0006000000016d2d-90.dat upx behavioral1/memory/1764-93-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1192-92-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d36-101.dat upx behavioral1/files/0x0006000000016d3e-109.dat upx behavioral1/memory/2876-110-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d46-119.dat upx behavioral1/memory/2948-118-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d4f-126.dat upx behavioral1/memory/1596-128-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1628-132-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d57-137.dat upx behavioral1/files/0x0006000000016d5f-144.dat upx behavioral1/memory/2580-148-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/324-146-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2580-156-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016d73-154.dat upx behavioral1/files/0x0006000000016d79-162.dat upx behavioral1/files/0x0006000000016d7d-172.dat upx behavioral1/files/0x0006000000016fa9-179.dat upx behavioral1/memory/3020-181-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000600000001708c-190.dat upx behavioral1/files/0x0032000000015d02-201.dat upx behavioral1/memory/2504-199-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00060000000171ad-209.dat upx behavioral1/memory/2984-208-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000600000001738e-215.dat upx behavioral1/memory/540-218-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000600000001738f-228.dat upx behavioral1/files/0x00060000000173e2-235.dat upx behavioral1/memory/1784-237-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00060000000173e5-244.dat upx behavioral1/memory/1156-252-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000017436-254.dat upx behavioral1/files/0x00060000000174ef-261.dat upx behavioral1/files/0x0006000000017577-268.dat upx behavioral1/memory/804-270-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00060000000175f7-278.dat upx behavioral1/files/0x00060000000175fd-286.dat upx behavioral1/memory/1728-294-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1576-319-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1712-326-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3068-375-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2564-394-0x0000000000220000-0x0000000000255000-memory.dmp upx behavioral1/memory/2936-407-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2252 2208 d7802181f57be93701be7f29cb7e6c00_NEIKI.exe 28 PID 2208 wrote to memory of 2252 2208 d7802181f57be93701be7f29cb7e6c00_NEIKI.exe 28 PID 2208 wrote to memory of 2252 2208 d7802181f57be93701be7f29cb7e6c00_NEIKI.exe 28 PID 2208 wrote to memory of 2252 2208 d7802181f57be93701be7f29cb7e6c00_NEIKI.exe 28 PID 2252 wrote to memory of 2760 2252 fxxllrl.exe 29 PID 2252 wrote to memory of 2760 2252 fxxllrl.exe 29 PID 2252 wrote to memory of 2760 2252 fxxllrl.exe 29 PID 2252 wrote to memory of 2760 2252 fxxllrl.exe 29 PID 2760 wrote to memory of 2080 2760 jjddp.exe 30 PID 2760 wrote to memory of 2080 2760 jjddp.exe 30 PID 2760 wrote to memory of 2080 2760 jjddp.exe 30 PID 2760 wrote to memory of 2080 2760 jjddp.exe 30 PID 2080 wrote to memory of 2832 2080 9lfrffx.exe 31 PID 2080 wrote to memory of 2832 2080 9lfrffx.exe 31 PID 2080 wrote to memory of 2832 2080 9lfrffx.exe 31 PID 2080 wrote to memory of 2832 2080 9lfrffx.exe 31 PID 2832 wrote to memory of 2528 2832 dvppj.exe 32 PID 2832 wrote to memory of 2528 2832 dvppj.exe 32 PID 2832 wrote to memory of 2528 2832 dvppj.exe 32 PID 2832 wrote to memory of 2528 2832 dvppj.exe 32 PID 2528 wrote to memory of 2548 2528 dvpvd.exe 33 PID 2528 wrote to memory of 2548 2528 dvpvd.exe 33 PID 2528 wrote to memory of 2548 2528 dvpvd.exe 33 PID 2528 wrote to memory of 2548 2528 dvpvd.exe 33 PID 2548 wrote to memory of 2636 2548 bbtbnn.exe 34 PID 2548 wrote to memory of 2636 2548 bbtbnn.exe 34 PID 2548 wrote to memory of 2636 2548 bbtbnn.exe 34 PID 2548 wrote to memory of 2636 2548 bbtbnn.exe 34 PID 2636 wrote to memory of 2540 2636 jjjvp.exe 35 PID 2636 wrote to memory of 2540 2636 jjjvp.exe 35 PID 2636 wrote to memory of 2540 2636 jjjvp.exe 35 PID 2636 wrote to memory of 2540 2636 jjjvp.exe 35 PID 2540 wrote to memory of 1192 2540 fxffxxx.exe 36 PID 2540 wrote to memory of 1192 2540 fxffxxx.exe 36 PID 2540 wrote to memory of 1192 2540 fxffxxx.exe 36 PID 2540 wrote to memory of 1192 2540 fxffxxx.exe 36 PID 1192 wrote to memory of 1764 1192 tnbbtb.exe 37 PID 1192 wrote to memory of 1764 1192 tnbbtb.exe 37 PID 1192 wrote to memory of 1764 1192 tnbbtb.exe 37 PID 1192 wrote to memory of 1764 1192 tnbbtb.exe 37 PID 1764 wrote to memory of 2876 1764 vvddv.exe 38 PID 1764 wrote to memory of 2876 1764 vvddv.exe 38 PID 1764 wrote to memory of 2876 1764 vvddv.exe 38 PID 1764 wrote to memory of 2876 1764 vvddv.exe 38 PID 2876 wrote to memory of 2948 2876 frrflrl.exe 39 PID 2876 wrote to memory of 2948 2876 frrflrl.exe 39 PID 2876 wrote to memory of 2948 2876 frrflrl.exe 39 PID 2876 wrote to memory of 2948 2876 frrflrl.exe 39 PID 2948 wrote to memory of 1596 2948 tnhnnh.exe 40 PID 2948 wrote to memory of 1596 2948 tnhnnh.exe 40 PID 2948 wrote to memory of 1596 2948 tnhnnh.exe 40 PID 2948 wrote to memory of 1596 2948 tnhnnh.exe 40 PID 1596 wrote to memory of 1628 1596 7nhtbh.exe 41 PID 1596 wrote to memory of 1628 1596 7nhtbh.exe 41 PID 1596 wrote to memory of 1628 1596 7nhtbh.exe 41 PID 1596 wrote to memory of 1628 1596 7nhtbh.exe 41 PID 1628 wrote to memory of 324 1628 3xxfrxr.exe 42 PID 1628 wrote to memory of 324 1628 3xxfrxr.exe 42 PID 1628 wrote to memory of 324 1628 3xxfrxr.exe 42 PID 1628 wrote to memory of 324 1628 3xxfrxr.exe 42 PID 324 wrote to memory of 2580 324 hbbnbn.exe 43 PID 324 wrote to memory of 2580 324 hbbnbn.exe 43 PID 324 wrote to memory of 2580 324 hbbnbn.exe 43 PID 324 wrote to memory of 2580 324 hbbnbn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7802181f57be93701be7f29cb7e6c00_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\d7802181f57be93701be7f29cb7e6c00_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\fxxllrl.exec:\fxxllrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\jjddp.exec:\jjddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\9lfrffx.exec:\9lfrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\dvppj.exec:\dvppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\dvpvd.exec:\dvpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\bbtbnn.exec:\bbtbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\jjjvp.exec:\jjjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\fxffxxx.exec:\fxffxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\tnbbtb.exec:\tnbbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\vvddv.exec:\vvddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\frrflrl.exec:\frrflrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tnhnnh.exec:\tnhnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\7nhtbh.exec:\7nhtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\3xxfrxr.exec:\3xxfrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\hbbnbn.exec:\hbbnbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\9vdjv.exec:\9vdjv.exe17⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7lxlrrx.exec:\7lxlrrx.exe18⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dvjjp.exec:\dvjjp.exe19⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5dpvj.exec:\5dpvj.exe20⤵
- Executes dropped EXE
PID:1432 -
\??\c:\lxlrxlx.exec:\lxlrxlx.exe21⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nhtnbh.exec:\nhtnbh.exe22⤵
- Executes dropped EXE
PID:2504 -
\??\c:\ddvpj.exec:\ddvpj.exe23⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ffxflrl.exec:\ffxflrl.exe24⤵
- Executes dropped EXE
PID:540 -
\??\c:\jjvdj.exec:\jjvdj.exe25⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7frflrx.exec:\7frflrx.exe26⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ddjjd.exec:\ddjjd.exe27⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xlrrfxf.exec:\xlrrfxf.exe28⤵
- Executes dropped EXE
PID:1156 -
\??\c:\hbhnnb.exec:\hbhnnb.exe29⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ddpvj.exec:\ddpvj.exe30⤵
- Executes dropped EXE
PID:804 -
\??\c:\9xlxlrx.exec:\9xlxlrx.exe31⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tnbhnb.exec:\tnbhnb.exe32⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vvjdj.exec:\vvjdj.exe33⤵
- Executes dropped EXE
PID:2400 -
\??\c:\fxlfrlx.exec:\fxlfrlx.exe34⤵
- Executes dropped EXE
PID:1728 -
\??\c:\lfxxllr.exec:\lfxxllr.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\thbhtt.exec:\thbhtt.exe36⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vjddj.exec:\vjddj.exe37⤵
- Executes dropped EXE
PID:1576 -
\??\c:\ppjvj.exec:\ppjvj.exe38⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xxllllx.exec:\xxllllx.exe39⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ttnthn.exec:\ttnthn.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hbtbht.exec:\hbtbht.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7dvdv.exec:\7dvdv.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pvvvj.exec:\pvvvj.exe43⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rrlfxlx.exec:\rrlfxlx.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\htbbnn.exec:\htbbnn.exe45⤵
- Executes dropped EXE
PID:2864 -
\??\c:\htbhnh.exec:\htbhnh.exe46⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dpjjp.exec:\dpjjp.exe47⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dpvvd.exec:\dpvvd.exe48⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fxlxfrf.exec:\fxlxfrf.exe49⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bbntbh.exec:\bbntbh.exe50⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vpjpd.exec:\vpjpd.exe51⤵
- Executes dropped EXE
PID:2936 -
\??\c:\7jvdp.exec:\7jvdp.exe52⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ffxrrrf.exec:\ffxrrrf.exe53⤵
- Executes dropped EXE
PID:2000 -
\??\c:\1rlxxff.exec:\1rlxxff.exe54⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ttnbnt.exec:\ttnbnt.exe55⤵
- Executes dropped EXE
PID:1340 -
\??\c:\dpjpv.exec:\dpjpv.exe56⤵
- Executes dropped EXE
PID:1836 -
\??\c:\djvdv.exec:\djvdv.exe57⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3frfrxf.exec:\3frfrxf.exe58⤵
- Executes dropped EXE
PID:1980 -
\??\c:\tnbhnb.exec:\tnbhnb.exe59⤵
- Executes dropped EXE
PID:280 -
\??\c:\ttnbhn.exec:\ttnbhn.exe60⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ppjjv.exec:\ppjjv.exe61⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lfxllrl.exec:\lfxllrl.exe62⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fxrlrrf.exec:\fxrlrrf.exe63⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hbnbnb.exec:\hbnbnb.exe64⤵
- Executes dropped EXE
PID:2992 -
\??\c:\btthnn.exec:\btthnn.exe65⤵
- Executes dropped EXE
PID:484 -
\??\c:\ppdjp.exec:\ppdjp.exe66⤵PID:1100
-
\??\c:\9rlrxxf.exec:\9rlrxxf.exe67⤵PID:584
-
\??\c:\llxrxfx.exec:\llxrxfx.exe68⤵PID:1612
-
\??\c:\thtttt.exec:\thtttt.exe69⤵PID:2296
-
\??\c:\9pdjd.exec:\9pdjd.exe70⤵PID:1988
-
\??\c:\1pjpv.exec:\1pjpv.exe71⤵PID:1388
-
\??\c:\rrrflrf.exec:\rrrflrf.exe72⤵PID:1796
-
\??\c:\fxllxlx.exec:\fxllxlx.exe73⤵PID:948
-
\??\c:\tnhbhb.exec:\tnhbhb.exe74⤵PID:1272
-
\??\c:\1vpvd.exec:\1vpvd.exe75⤵PID:2604
-
\??\c:\dvdvv.exec:\dvdvv.exe76⤵PID:2336
-
\??\c:\xrrllrf.exec:\xrrllrf.exe77⤵PID:1700
-
\??\c:\bbthnb.exec:\bbthnb.exe78⤵PID:1772
-
\??\c:\bnbntb.exec:\bnbntb.exe79⤵PID:1052
-
\??\c:\1dpvv.exec:\1dpvv.exe80⤵PID:1508
-
\??\c:\dpdjv.exec:\dpdjv.exe81⤵PID:1736
-
\??\c:\rrlxrxr.exec:\rrlxrxr.exe82⤵PID:1580
-
\??\c:\7bbnnt.exec:\7bbnnt.exe83⤵PID:2372
-
\??\c:\1hthhb.exec:\1hthhb.exe84⤵PID:2788
-
\??\c:\pvpdd.exec:\pvpdd.exe85⤵PID:2080
-
\??\c:\vvvdv.exec:\vvvdv.exe86⤵PID:2772
-
\??\c:\fxlrlfr.exec:\fxlrlfr.exe87⤵PID:2840
-
\??\c:\7tnnnt.exec:\7tnnnt.exe88⤵PID:2872
-
\??\c:\5jjpd.exec:\5jjpd.exe89⤵PID:1636
-
\??\c:\dvvjv.exec:\dvvjv.exe90⤵PID:2548
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe91⤵PID:2148
-
\??\c:\3fxxfxx.exec:\3fxxfxx.exe92⤵PID:2088
-
\??\c:\tthbhn.exec:\tthbhn.exe93⤵PID:1192
-
\??\c:\9nntnn.exec:\9nntnn.exe94⤵PID:2564
-
\??\c:\vvpvd.exec:\vvpvd.exe95⤵PID:3044
-
\??\c:\ffxllrf.exec:\ffxllrf.exe96⤵PID:2932
-
\??\c:\3llfxrl.exec:\3llfxrl.exe97⤵PID:2740
-
\??\c:\btnhnh.exec:\btnhnh.exe98⤵PID:1264
-
\??\c:\7jdjp.exec:\7jdjp.exe99⤵PID:1964
-
\??\c:\vvvdv.exec:\vvvdv.exe100⤵PID:544
-
\??\c:\1xrrfll.exec:\1xrrfll.exe101⤵PID:2904
-
\??\c:\nhnhht.exec:\nhnhht.exe102⤵PID:2912
-
\??\c:\pjjdd.exec:\pjjdd.exe103⤵PID:268
-
\??\c:\ddpjv.exec:\ddpjv.exe104⤵PID:1556
-
\??\c:\xrfrflx.exec:\xrfrflx.exe105⤵PID:2084
-
\??\c:\lfxflrx.exec:\lfxflrx.exe106⤵PID:2448
-
\??\c:\tnhnht.exec:\tnhnht.exe107⤵PID:3020
-
\??\c:\5ddvd.exec:\5ddvd.exe108⤵PID:2972
-
\??\c:\rrfrffr.exec:\rrfrffr.exe109⤵PID:380
-
\??\c:\rlxxxxl.exec:\rlxxxxl.exe110⤵PID:1152
-
\??\c:\tnbhtb.exec:\tnbhtb.exe111⤵PID:840
-
\??\c:\ntthnt.exec:\ntthnt.exe112⤵PID:1676
-
\??\c:\vpjjj.exec:\vpjjj.exe113⤵PID:836
-
\??\c:\fxrrllx.exec:\fxrrllx.exe114⤵PID:1872
-
\??\c:\rrrxrxl.exec:\rrrxrxl.exe115⤵PID:964
-
\??\c:\nhnthn.exec:\nhnthn.exe116⤵PID:1976
-
\??\c:\pjjdj.exec:\pjjdj.exe117⤵PID:1792
-
\??\c:\dvpvp.exec:\dvpvp.exe118⤵PID:2468
-
\??\c:\7lxrffx.exec:\7lxrffx.exe119⤵PID:2368
-
\??\c:\frfrlrx.exec:\frfrlrx.exe120⤵PID:1992
-
\??\c:\tnnnbb.exec:\tnnnbb.exe121⤵PID:1944
-
\??\c:\nnbtbn.exec:\nnbtbn.exe122⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-