Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 03:36
Behavioral task
behavioral1
Sample
8399c21a982a9afd857f12a727476740_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 8399c21a982a9afd857f12a727476740_NeikiAnalytics.exe
- Size 190KB
- Sample240518-d5zefaad24
- SHA256 7d26ca02f76a76709e33898e79cd4e7f7761cbb53ee72d6d3fd6e940990ea927
- MD5 8399c21a982a9afd857f12a727476740
- SHA1 e01f40a5060c7dfce1ba347e7937b9bd722cec30
- SHA512 89a8be8c403f30c220d2598ee558a61e8a6e6c56d0250db0a00d438523350d19d1cc80f351a25c6666b75ef82c1884353d18bd7369974e34a30360ac44cee008
- SSDEEP 3072:YhOmTsF93UYfwC6GIoutLmxHxae5yLpcgDE4JBuItR8pTsgnKbQFe3+F:Ycm4FmowdHoSLEaTBftapTsyFeOF
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/836-5-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3488-13-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4052-14-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2896-19-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4008-31-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/768-33-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1184-39-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2324-49-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5084-56-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4396-68-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4996-74-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4200-79-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2480-94-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4500-101-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2876-107-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2420-116-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3992-123-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1388-128-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4352-147-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2360-159-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/436-163-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4760-174-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3964-185-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3436-187-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2708-195-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3036-197-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2812-203-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1200-204-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2468-214-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4904-222-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4656-235-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2080-238-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3820-243-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1480-247-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/952-251-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1696-258-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1084-269-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2488-272-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4620-278-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4284-290-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2556-296-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2876-304-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4428-303-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/468-318-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1104-333-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2876-337-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1228-360-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3356-367-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/808-372-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3608-396-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3208-425-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4468-446-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2032-460-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4524-482-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3312-525-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4536-539-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4016-572-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1776-591-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3512-619-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/432-623-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3260-663-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4760-753-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2708-892-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4932-1049-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000500000002328f-3.dat family_berbew behavioral2/files/0x000800000002341d-9.dat family_berbew behavioral2/files/0x0007000000023421-12.dat family_berbew behavioral2/files/0x0007000000023422-23.dat family_berbew behavioral2/files/0x0007000000023424-30.dat family_berbew behavioral2/files/0x0007000000023425-35.dat family_berbew behavioral2/files/0x0007000000023426-42.dat family_berbew behavioral2/files/0x0007000000023427-50.dat family_berbew behavioral2/files/0x0007000000023428-53.dat family_berbew behavioral2/files/0x0007000000023429-59.dat family_berbew behavioral2/files/0x000700000002342a-64.dat family_berbew behavioral2/files/0x000700000002342b-70.dat family_berbew behavioral2/files/0x000700000002342c-76.dat family_berbew behavioral2/files/0x000700000002342d-82.dat family_berbew behavioral2/files/0x000700000002342e-87.dat family_berbew behavioral2/files/0x000700000002342f-95.dat family_berbew behavioral2/files/0x0007000000023430-98.dat family_berbew behavioral2/files/0x0007000000023431-104.dat family_berbew behavioral2/files/0x0007000000023432-110.dat family_berbew behavioral2/files/0x0007000000023433-117.dat family_berbew behavioral2/files/0x0007000000023434-121.dat family_berbew behavioral2/files/0x0007000000023435-130.dat family_berbew behavioral2/files/0x0007000000023436-134.dat family_berbew behavioral2/files/0x0007000000023437-139.dat family_berbew behavioral2/files/0x0007000000023438-144.dat family_berbew behavioral2/files/0x0007000000023439-150.dat family_berbew behavioral2/files/0x000700000002343a-154.dat family_berbew behavioral2/files/0x000700000002343b-162.dat family_berbew behavioral2/files/0x000700000002343c-166.dat family_berbew behavioral2/files/0x000700000002343d-172.dat family_berbew behavioral2/files/0x000700000002343e-177.dat family_berbew behavioral2/files/0x000700000002343f-183.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 3488 fllfxrr.exe 4052 7nnbtt.exe 2896 pjvdd.exe 4008 jdddp.exe 768 pjdvv.exe 1184 1djdj.exe 2324 lxxrllf.exe 5084 jjjdv.exe 1308 lfxrlrr.exe 4396 tnbttt.exe 4996 9jjdv.exe 4200 9lffxfx.exe 4016 hhhthb.exe 2176 xfffxxx.exe 2480 frxrllf.exe 4500 nhhbbb.exe 4420 9lllxxx.exe 2876 3bbbnn.exe 2420 1vvpj.exe 3992 rxxrrrl.exe 1388 1vddd.exe 876 xxrfxxf.exe 1656 ntnbhh.exe 5104 dvvvv.exe 4352 7fffffl.exe 2392 thnhht.exe 2360 tnnhbh.exe 436 7flllll.exe 4760 rxrllll.exe 1292 jjvpp.exe 3964 jvvvj.exe 3436 1hhbnn.exe 2708 pjjdd.exe 3036 5pvpd.exe 2812 lrlfxxl.exe 1200 bbbtbb.exe 3312 dvvjd.exe 2468 ddvvp.exe 1192 xlfxlfx.exe 4904 httntt.exe 388 hbhbbt.exe 2152 9jjjd.exe 3376 lrrlrlf.exe 4656 lrfrffx.exe 2080 3bnhhb.exe 3820 7jjdj.exe 1480 vpjdp.exe 952 xrrfxxr.exe 4232 tnbthn.exe 1696 tbbnbb.exe 400 pjjpp.exe 3196 rlxrfxl.exe 4988 rrfrrlx.exe 1084 9bnhbb.exe 2488 jvpdp.exe 4620 5dpdv.exe 1972 fxrfrrf.exe 4108 nbnbnh.exe 3948 1ppdp.exe 4284 flllfxx.exe 2556 5rrrlfx.exe 4216 tttnhb.exe 4428 djpjd.exe 2876 xxlxxrl.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 836 wrote to memory of 3488 836 8399c21a982a9afd857f12a727476740_NeikiAnalytics.exe 83 PID 836 wrote to memory of 3488 836 8399c21a982a9afd857f12a727476740_NeikiAnalytics.exe 83 PID 836 wrote to memory of 3488 836 8399c21a982a9afd857f12a727476740_NeikiAnalytics.exe 83 PID 3488 wrote to memory of 4052 3488 fllfxrr.exe 84 PID 3488 wrote to memory of 4052 3488 fllfxrr.exe 84 PID 3488 wrote to memory of 4052 3488 fllfxrr.exe 84 PID 4052 wrote to memory of 2896 4052 7nnbtt.exe 85 PID 4052 wrote to memory of 2896 4052 7nnbtt.exe 85 PID 4052 wrote to memory of 2896 4052 7nnbtt.exe 85 PID 2896 wrote to memory of 4008 2896 pjvdd.exe 86 PID 2896 wrote to memory of 4008 2896 pjvdd.exe 86 PID 2896 wrote to memory of 4008 2896 pjvdd.exe 86 PID 4008 wrote to memory of 768 4008 jdddp.exe 87 PID 4008 wrote to memory of 768 4008 jdddp.exe 87 PID 4008 wrote to memory of 768 4008 jdddp.exe 87 PID 768 wrote to memory of 1184 768 pjdvv.exe 88 PID 768 wrote to memory of 1184 768 pjdvv.exe 88 PID 768 wrote to memory of 1184 768 pjdvv.exe 88 PID 1184 wrote to memory of 2324 1184 1djdj.exe 89 PID 1184 wrote to memory of 2324 1184 1djdj.exe 89 PID 1184 wrote to memory of 2324 1184 1djdj.exe 89 PID 2324 wrote to memory of 5084 2324 lxxrllf.exe 90 PID 2324 wrote to memory of 5084 2324 lxxrllf.exe 90 PID 2324 wrote to memory of 5084 2324 lxxrllf.exe 90 PID 5084 wrote to memory of 1308 5084 jjjdv.exe 92 PID 5084 wrote to memory of 1308 5084 jjjdv.exe 92 PID 5084 wrote to memory of 1308 5084 jjjdv.exe 92 PID 1308 wrote to memory of 4396 1308 lfxrlrr.exe 93 PID 1308 wrote to memory of 4396 1308 lfxrlrr.exe 93 PID 1308 wrote to memory of 4396 1308 lfxrlrr.exe 93 PID 4396 wrote to memory of 4996 4396 tnbttt.exe 94 PID 4396 wrote to memory of 4996 4396 tnbttt.exe 94 PID 4396 wrote to memory of 4996 4396 tnbttt.exe 94 PID 4996 wrote to memory of 4200 4996 9jjdv.exe 95 PID 4996 wrote to memory of 4200 4996 9jjdv.exe 95 PID 4996 wrote to memory of 4200 4996 9jjdv.exe 95 PID 4200 wrote to memory of 4016 4200 9lffxfx.exe 96 PID 4200 wrote to memory of 4016 4200 9lffxfx.exe 96 PID 4200 wrote to memory of 4016 4200 9lffxfx.exe 96 PID 4016 wrote to memory of 2176 4016 hhhthb.exe 98 PID 4016 wrote to memory of 2176 4016 hhhthb.exe 98 PID 4016 wrote to memory of 2176 4016 hhhthb.exe 98 PID 2176 wrote to memory of 2480 2176 xfffxxx.exe 99 PID 2176 wrote to memory of 2480 2176 xfffxxx.exe 99 PID 2176 wrote to memory of 2480 2176 xfffxxx.exe 99 PID 2480 wrote to memory of 4500 2480 frxrllf.exe 100 PID 2480 wrote to memory of 4500 2480 frxrllf.exe 100 PID 2480 wrote to memory of 4500 2480 frxrllf.exe 100 PID 4500 wrote to memory of 4420 4500 nhhbbb.exe 101 PID 4500 wrote to memory of 4420 4500 nhhbbb.exe 101 PID 4500 wrote to memory of 4420 4500 nhhbbb.exe 101 PID 4420 wrote to memory of 2876 4420 9lllxxx.exe 103 PID 4420 wrote to memory of 2876 4420 9lllxxx.exe 103 PID 4420 wrote to memory of 2876 4420 9lllxxx.exe 103 PID 2876 wrote to memory of 2420 2876 3bbbnn.exe 104 PID 2876 wrote to memory of 2420 2876 3bbbnn.exe 104 PID 2876 wrote to memory of 2420 2876 3bbbnn.exe 104 PID 2420 wrote to memory of 3992 2420 1vvpj.exe 105 PID 2420 wrote to memory of 3992 2420 1vvpj.exe 105 PID 2420 wrote to memory of 3992 2420 1vvpj.exe 105 PID 3992 wrote to memory of 1388 3992 rxxrrrl.exe 106 PID 3992 wrote to memory of 1388 3992 rxxrrrl.exe 106 PID 3992 wrote to memory of 1388 3992 rxxrrrl.exe 106 PID 1388 wrote to memory of 876 1388 1vddd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\8399c21a982a9afd857f12a727476740_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8399c21a982a9afd857f12a727476740_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\fllfxrr.exec:\fllfxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\7nnbtt.exec:\7nnbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\pjvdd.exec:\pjvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\jdddp.exec:\jdddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\pjdvv.exec:\pjdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\1djdj.exec:\1djdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\lxxrllf.exec:\lxxrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jjjdv.exec:\jjjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\lfxrlrr.exec:\lfxrlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\tnbttt.exec:\tnbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\9jjdv.exec:\9jjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\9lffxfx.exec:\9lffxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\hhhthb.exec:\hhhthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\xfffxxx.exec:\xfffxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\frxrllf.exec:\frxrllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nhhbbb.exec:\nhhbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\9lllxxx.exec:\9lllxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\3bbbnn.exec:\3bbbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\1vvpj.exec:\1vvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\1vddd.exec:\1vddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\xxrfxxf.exec:\xxrfxxf.exe23⤵
- Executes dropped EXE
PID:876 -
\??\c:\ntnbhh.exec:\ntnbhh.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dvvvv.exec:\dvvvv.exe25⤵
- Executes dropped EXE
PID:5104 -
\??\c:\7fffffl.exec:\7fffffl.exe26⤵
- Executes dropped EXE
PID:4352 -
\??\c:\thnhht.exec:\thnhht.exe27⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tnnhbh.exec:\tnnhbh.exe28⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7flllll.exec:\7flllll.exe29⤵
- Executes dropped EXE
PID:436 -
\??\c:\rxrllll.exec:\rxrllll.exe30⤵
- Executes dropped EXE
PID:4760 -
\??\c:\jjvpp.exec:\jjvpp.exe31⤵
- Executes dropped EXE
PID:1292 -
\??\c:\jvvvj.exec:\jvvvj.exe32⤵
- Executes dropped EXE
PID:3964 -
\??\c:\1hhbnn.exec:\1hhbnn.exe33⤵
- Executes dropped EXE
PID:3436 -
\??\c:\pjjdd.exec:\pjjdd.exe34⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5pvpd.exec:\5pvpd.exe35⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lrlfxxl.exec:\lrlfxxl.exe36⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bbbtbb.exec:\bbbtbb.exe37⤵
- Executes dropped EXE
PID:1200 -
\??\c:\dvvjd.exec:\dvvjd.exe38⤵
- Executes dropped EXE
PID:3312 -
\??\c:\ddvvp.exec:\ddvvp.exe39⤵
- Executes dropped EXE
PID:2468 -
\??\c:\xlfxlfx.exec:\xlfxlfx.exe40⤵
- Executes dropped EXE
PID:1192 -
\??\c:\httntt.exec:\httntt.exe41⤵
- Executes dropped EXE
PID:4904 -
\??\c:\hbhbbt.exec:\hbhbbt.exe42⤵
- Executes dropped EXE
PID:388 -
\??\c:\9jjjd.exec:\9jjjd.exe43⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lrrlrlf.exec:\lrrlrlf.exe44⤵
- Executes dropped EXE
PID:3376 -
\??\c:\lrfrffx.exec:\lrfrffx.exe45⤵
- Executes dropped EXE
PID:4656 -
\??\c:\3bnhhb.exec:\3bnhhb.exe46⤵
- Executes dropped EXE
PID:2080 -
\??\c:\7jjdj.exec:\7jjdj.exe47⤵
- Executes dropped EXE
PID:3820 -
\??\c:\vpjdp.exec:\vpjdp.exe48⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe49⤵
- Executes dropped EXE
PID:952 -
\??\c:\tnbthn.exec:\tnbthn.exe50⤵
- Executes dropped EXE
PID:4232 -
\??\c:\tbbnbb.exec:\tbbnbb.exe51⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pjjpp.exec:\pjjpp.exe52⤵
- Executes dropped EXE
PID:400 -
\??\c:\rlxrfxl.exec:\rlxrfxl.exe53⤵
- Executes dropped EXE
PID:3196 -
\??\c:\rrfrrlx.exec:\rrfrrlx.exe54⤵
- Executes dropped EXE
PID:4988 -
\??\c:\9bnhbb.exec:\9bnhbb.exe55⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jvpdp.exec:\jvpdp.exe56⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5dpdv.exec:\5dpdv.exe57⤵
- Executes dropped EXE
PID:4620 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe58⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nbnbnh.exec:\nbnbnh.exe59⤵
- Executes dropped EXE
PID:4108 -
\??\c:\1ppdp.exec:\1ppdp.exe60⤵
- Executes dropped EXE
PID:3948 -
\??\c:\flllfxx.exec:\flllfxx.exe61⤵
- Executes dropped EXE
PID:4284 -
\??\c:\5rrrlfx.exec:\5rrrlfx.exe62⤵
- Executes dropped EXE
PID:2556 -
\??\c:\tttnhb.exec:\tttnhb.exe63⤵
- Executes dropped EXE
PID:4216 -
\??\c:\djpjd.exec:\djpjd.exe64⤵
- Executes dropped EXE
PID:4428 -
\??\c:\xxlxxrl.exec:\xxlxxrl.exe65⤵
- Executes dropped EXE
PID:2876 -
\??\c:\frrrllf.exec:\frrrllf.exe66⤵PID:4564
-
\??\c:\1thbtt.exec:\1thbtt.exe67⤵PID:2144
-
\??\c:\pdjdd.exec:\pdjdd.exe68⤵PID:644
-
\??\c:\3rxlfxr.exec:\3rxlfxr.exe69⤵PID:468
-
\??\c:\tntnhb.exec:\tntnhb.exe70⤵PID:876
-
\??\c:\9hbnnb.exec:\9hbnnb.exe71⤵PID:3180
-
\??\c:\dvdvp.exec:\dvdvp.exe72⤵PID:1004
-
\??\c:\rflfxrl.exec:\rflfxrl.exe73⤵PID:1104
-
\??\c:\3bbttt.exec:\3bbttt.exe74⤵PID:4524
-
\??\c:\5hnbnh.exec:\5hnbnh.exe75⤵PID:3060
-
\??\c:\vddpd.exec:\vddpd.exe76⤵PID:436
-
\??\c:\rfxlrlx.exec:\rfxlrlx.exe77⤵PID:2020
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe78⤵PID:3520
-
\??\c:\btnbnn.exec:\btnbnn.exe79⤵PID:4312
-
\??\c:\tntnhb.exec:\tntnhb.exe80⤵PID:2280
-
\??\c:\5xfxrrr.exec:\5xfxrrr.exe81⤵PID:1228
-
\??\c:\1nnhtt.exec:\1nnhtt.exe82⤵PID:3128
-
\??\c:\7jpjj.exec:\7jpjj.exe83⤵PID:3356
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe84⤵PID:4272
-
\??\c:\ntthbt.exec:\ntthbt.exe85⤵PID:808
-
\??\c:\nnnhbb.exec:\nnnhbb.exe86⤵PID:4384
-
\??\c:\djdpj.exec:\djdpj.exe87⤵PID:3312
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe88⤵PID:1512
-
\??\c:\rlfrlfr.exec:\rlfrlfr.exe89⤵PID:3092
-
\??\c:\jvddv.exec:\jvddv.exe90⤵PID:2148
-
\??\c:\xrrlrrl.exec:\xrrlrrl.exe91⤵PID:3388
-
\??\c:\nhhbbt.exec:\nhhbbt.exe92⤵PID:3608
-
\??\c:\dvvpj.exec:\dvvpj.exe93⤵PID:4488
-
\??\c:\xflxllx.exec:\xflxllx.exe94⤵PID:1012
-
\??\c:\nhbtht.exec:\nhbtht.exe95⤵PID:5048
-
\??\c:\5thbnh.exec:\5thbnh.exe96⤵PID:888
-
\??\c:\dvddj.exec:\dvddj.exe97⤵PID:3664
-
\??\c:\nttnbt.exec:\nttnbt.exe98⤵PID:1592
-
\??\c:\9dpdj.exec:\9dpdj.exe99⤵PID:2416
-
\??\c:\xxlfxfx.exec:\xxlfxfx.exe100⤵PID:2092
-
\??\c:\tbtnbt.exec:\tbtnbt.exe101⤵PID:3208
-
\??\c:\btnbtt.exec:\btnbtt.exe102⤵PID:3100
-
\??\c:\jjvjv.exec:\jjvjv.exe103⤵PID:4376
-
\??\c:\rrxrlll.exec:\rrxrlll.exe104⤵PID:5028
-
\??\c:\bnnnhh.exec:\bnnnhh.exe105⤵PID:1364
-
\??\c:\ntnntt.exec:\ntnntt.exe106⤵PID:860
-
\??\c:\ntbhhh.exec:\ntbhhh.exe107⤵PID:3948
-
\??\c:\dvdvd.exec:\dvdvd.exe108⤵PID:2556
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe109⤵PID:4468
-
\??\c:\xrxxxlf.exec:\xrxxxlf.exe110⤵PID:2076
-
\??\c:\ntbbtb.exec:\ntbbtb.exe111⤵PID:2420
-
\??\c:\5hbttt.exec:\5hbttt.exe112⤵PID:2032
-
\??\c:\jdpdv.exec:\jdpdv.exe113⤵PID:2440
-
\??\c:\3vvpd.exec:\3vvpd.exe114⤵PID:1956
-
\??\c:\lxfxlll.exec:\lxfxlll.exe115⤵PID:4360
-
\??\c:\fxrlllf.exec:\fxrlllf.exe116⤵PID:756
-
\??\c:\bbttnn.exec:\bbttnn.exe117⤵PID:1004
-
\??\c:\dvppp.exec:\dvppp.exe118⤵PID:3204
-
\??\c:\9bhbnh.exec:\9bhbnh.exe119⤵PID:4524
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe120⤵PID:2344
-
\??\c:\1tnhnh.exec:\1tnhnh.exe121⤵PID:3908
-
\??\c:\1nbtnn.exec:\1nbtnn.exe122⤵PID:4288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-