Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 23:54
Behavioral task
behavioral1
Sample
2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe
-
Size
192KB
-
MD5
2512d4385e88b81fdffe82d7e38e95b0
-
SHA1
11bff0f6914b76390cf60765f23cd48ce8bb81b1
-
SHA256
7792a28004f9aca52ee2a87bb545ea49f8adba95f8b7a5a6a2db68a7d29a36ce
-
SHA512
e57797be0d03f44274555380e44941e5902e1837d2e01aac5398e947561ab13f3962c4b9ad64d6fa2ae2c1082fafc65aaa731b157446fe77bc03d00095e8de13
-
SSDEEP
3072:FhOmTsF93UYfwC6GIoutrVCfMoh52waAyiJ8mqtbfUVKty16hDsI/tSvv:Fcm4FmowdHoS8fMoSVAHubPtyYxfe
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2972-1-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2708-26-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2000-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2696-45-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2940-56-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2676-59-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2480-68-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2480-73-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2480-75-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2456-79-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3056-93-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1668-95-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1632-110-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1716-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1740-145-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/296-167-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/848-182-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2968-191-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2064-200-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1012-216-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1548-233-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1364-236-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1344-267-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2032-284-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2816-299-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2664-327-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1504-336-0x00000000002B0000-0x00000000002E6000-memory.dmp family_blackmoon behavioral1/memory/2448-366-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/764-417-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2204-430-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1432-455-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1756-456-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1756-463-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2292-561-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2692-611-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2544-624-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1688-768-0x00000000003A0000-0x00000000003D6000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000c000000012674-5.dat family_berbew behavioral1/files/0x0037000000014b4c-19.dat family_berbew behavioral1/files/0x000800000001564f-27.dat family_berbew behavioral1/files/0x0007000000015653-36.dat family_berbew behavioral1/files/0x000700000001565d-46.dat family_berbew behavioral1/files/0x0007000000015677-53.dat family_berbew behavioral1/files/0x0007000000015684-65.dat family_berbew behavioral1/files/0x0008000000015d7f-77.dat family_berbew behavioral1/files/0x0006000000015d87-85.dat family_berbew behavioral1/files/0x0006000000015d93-92.dat family_berbew behavioral1/files/0x0006000000015e32-102.dat family_berbew behavioral1/files/0x0006000000015ecc-109.dat family_berbew behavioral1/files/0x0006000000015f65-118.dat family_berbew behavioral1/files/0x0006000000015fe5-125.dat family_berbew behavioral1/files/0x000600000001610f-135.dat family_berbew behavioral1/files/0x000600000001621e-147.dat family_berbew behavioral1/memory/1740-144-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew behavioral1/files/0x000600000001630a-154.dat family_berbew behavioral1/files/0x00060000000164aa-165.dat family_berbew behavioral1/files/0x000600000001658a-173.dat family_berbew behavioral1/files/0x0006000000016616-180.dat family_berbew behavioral1/files/0x0006000000016851-190.dat family_berbew behavioral1/files/0x0006000000016adc-197.dat family_berbew behavioral1/files/0x0006000000016c44-208.dat family_berbew behavioral1/files/0x0006000000016c5e-217.dat family_berbew behavioral1/files/0x0036000000014bbc-225.dat family_berbew behavioral1/files/0x0006000000016cb0-243.dat family_berbew behavioral1/files/0x0006000000016c64-235.dat family_berbew behavioral1/files/0x0006000000016cdc-252.dat family_berbew behavioral1/files/0x0006000000016d07-259.dat family_berbew behavioral1/files/0x0006000000016d18-269.dat family_berbew behavioral1/files/0x0006000000016d20-276.dat family_berbew behavioral1/files/0x0006000000016d34-286.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2000 5ddpp.exe 2708 llllfxf.exe 2536 bbhntt.exe 2696 jjjpd.exe 2940 xxxlxlf.exe 2676 vpdvd.exe 2480 vjddv.exe 2456 7frrxxx.exe 3056 nbtbtt.exe 1668 vdvpv.exe 1632 7xrrflf.exe 2672 tthntt.exe 1804 djpdj.exe 1716 rfflxfl.exe 1740 lrrxrxx.exe 2216 nthtnb.exe 2252 pdvpj.exe 296 lfxflxx.exe 848 3nhhhh.exe 2968 5vpdj.exe 2064 xrlrxxl.exe 2800 hthbtb.exe 1012 jppdv.exe 3028 ffxlxll.exe 1548 5btbbb.exe 1364 vpjvd.exe 1288 7jpvv.exe 952 nnhtnh.exe 1344 9nbttt.exe 784 9jjdd.exe 2032 ffxfrrr.exe 1504 hbbbnt.exe 2816 bhbbtb.exe 2036 jjjpj.exe 1712 lxrxxfr.exe 2928 bbbtbb.exe 2944 vvdvv.exe 2664 dvjpp.exe 2580 9flllrf.exe 2772 thhttn.exe 2376 jdvvv.exe 2528 dvvpv.exe 2448 fxxlfrf.exe 2548 7lxflrf.exe 2600 ntnhnh.exe 2908 bbhbtn.exe 2352 vjvdj.exe 1220 9lffflx.exe 2516 3rlxfrf.exe 2736 nnhtnb.exe 764 9bnhtt.exe 2156 vpjpp.exe 2168 llrxxrf.exe 2204 5xlxxfl.exe 796 nthtbb.exe 2748 jjjpv.exe 1432 jvjdj.exe 1756 5rrxflx.exe 1324 1lrlllr.exe 2404 tntnnh.exe 2792 pjvjj.exe 336 vvpdp.exe 2800 9xfrrxl.exe 2996 7rlrrrl.exe -
resource yara_rule behavioral1/memory/2972-1-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000c000000012674-5.dat upx behavioral1/files/0x0037000000014b4c-19.dat upx behavioral1/memory/2708-18-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000800000001564f-27.dat upx behavioral1/memory/2708-26-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2000-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2000-8-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2536-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015653-36.dat upx behavioral1/memory/2696-37-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000700000001565d-46.dat upx behavioral1/memory/2696-45-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2940-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015677-53.dat upx behavioral1/memory/2940-56-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2676-59-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015684-65.dat upx behavioral1/memory/2480-68-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000015d7f-77.dat upx behavioral1/files/0x0006000000015d87-85.dat upx behavioral1/memory/2456-79-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015d93-92.dat upx behavioral1/memory/3056-93-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1668-95-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015e32-102.dat upx behavioral1/memory/1632-110-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015ecc-109.dat upx behavioral1/files/0x0006000000015f65-118.dat upx behavioral1/files/0x0006000000015fe5-125.dat upx behavioral1/memory/1716-128-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1716-136-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000600000001610f-135.dat upx behavioral1/files/0x000600000001621e-147.dat upx behavioral1/memory/1740-145-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1740-144-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/files/0x000600000001630a-154.dat upx behavioral1/memory/296-167-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000164aa-165.dat upx behavioral1/files/0x000600000001658a-173.dat upx behavioral1/files/0x0006000000016616-180.dat upx behavioral1/memory/848-182-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2968-191-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016851-190.dat upx behavioral1/files/0x0006000000016adc-197.dat upx behavioral1/memory/2064-200-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c44-208.dat upx behavioral1/files/0x0006000000016c5e-217.dat upx behavioral1/memory/1012-216-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0036000000014bbc-225.dat upx behavioral1/memory/1548-233-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016cb0-243.dat upx behavioral1/memory/1364-236-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c64-235.dat upx behavioral1/files/0x0006000000016cdc-252.dat upx behavioral1/files/0x0006000000016d07-259.dat upx behavioral1/memory/1344-267-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d18-269.dat upx behavioral1/files/0x0006000000016d20-276.dat upx behavioral1/files/0x0006000000016d34-286.dat upx behavioral1/memory/2032-284-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2816-299-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2036-300-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1712-307-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2000 2972 2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe 28 PID 2972 wrote to memory of 2000 2972 2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe 28 PID 2972 wrote to memory of 2000 2972 2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe 28 PID 2972 wrote to memory of 2000 2972 2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe 28 PID 2000 wrote to memory of 2708 2000 5ddpp.exe 29 PID 2000 wrote to memory of 2708 2000 5ddpp.exe 29 PID 2000 wrote to memory of 2708 2000 5ddpp.exe 29 PID 2000 wrote to memory of 2708 2000 5ddpp.exe 29 PID 2708 wrote to memory of 2536 2708 llllfxf.exe 30 PID 2708 wrote to memory of 2536 2708 llllfxf.exe 30 PID 2708 wrote to memory of 2536 2708 llllfxf.exe 30 PID 2708 wrote to memory of 2536 2708 llllfxf.exe 30 PID 2536 wrote to memory of 2696 2536 bbhntt.exe 31 PID 2536 wrote to memory of 2696 2536 bbhntt.exe 31 PID 2536 wrote to memory of 2696 2536 bbhntt.exe 31 PID 2536 wrote to memory of 2696 2536 bbhntt.exe 31 PID 2696 wrote to memory of 2940 2696 jjjpd.exe 32 PID 2696 wrote to memory of 2940 2696 jjjpd.exe 32 PID 2696 wrote to memory of 2940 2696 jjjpd.exe 32 PID 2696 wrote to memory of 2940 2696 jjjpd.exe 32 PID 2940 wrote to memory of 2676 2940 xxxlxlf.exe 33 PID 2940 wrote to memory of 2676 2940 xxxlxlf.exe 33 PID 2940 wrote to memory of 2676 2940 xxxlxlf.exe 33 PID 2940 wrote to memory of 2676 2940 xxxlxlf.exe 33 PID 2676 wrote to memory of 2480 2676 vpdvd.exe 34 PID 2676 wrote to memory of 2480 2676 vpdvd.exe 34 PID 2676 wrote to memory of 2480 2676 vpdvd.exe 34 PID 2676 wrote to memory of 2480 2676 vpdvd.exe 34 PID 2480 wrote to memory of 2456 2480 vjddv.exe 35 PID 2480 wrote to memory of 2456 2480 vjddv.exe 35 PID 2480 wrote to memory of 2456 2480 vjddv.exe 35 PID 2480 wrote to memory of 2456 2480 vjddv.exe 35 PID 2456 wrote to memory of 3056 2456 7frrxxx.exe 36 PID 2456 wrote to memory of 3056 2456 7frrxxx.exe 36 PID 2456 wrote to memory of 3056 2456 7frrxxx.exe 36 PID 2456 wrote to memory of 3056 2456 7frrxxx.exe 36 PID 3056 wrote to memory of 1668 3056 nbtbtt.exe 37 PID 3056 wrote to memory of 1668 3056 nbtbtt.exe 37 PID 3056 wrote to memory of 1668 3056 nbtbtt.exe 37 PID 3056 wrote to memory of 1668 3056 nbtbtt.exe 37 PID 1668 wrote to memory of 1632 1668 vdvpv.exe 38 PID 1668 wrote to memory of 1632 1668 vdvpv.exe 38 PID 1668 wrote to memory of 1632 1668 vdvpv.exe 38 PID 1668 wrote to memory of 1632 1668 vdvpv.exe 38 PID 1632 wrote to memory of 2672 1632 7xrrflf.exe 39 PID 1632 wrote to memory of 2672 1632 7xrrflf.exe 39 PID 1632 wrote to memory of 2672 1632 7xrrflf.exe 39 PID 1632 wrote to memory of 2672 1632 7xrrflf.exe 39 PID 2672 wrote to memory of 1804 2672 tthntt.exe 40 PID 2672 wrote to memory of 1804 2672 tthntt.exe 40 PID 2672 wrote to memory of 1804 2672 tthntt.exe 40 PID 2672 wrote to memory of 1804 2672 tthntt.exe 40 PID 1804 wrote to memory of 1716 1804 djpdj.exe 41 PID 1804 wrote to memory of 1716 1804 djpdj.exe 41 PID 1804 wrote to memory of 1716 1804 djpdj.exe 41 PID 1804 wrote to memory of 1716 1804 djpdj.exe 41 PID 1716 wrote to memory of 1740 1716 rfflxfl.exe 42 PID 1716 wrote to memory of 1740 1716 rfflxfl.exe 42 PID 1716 wrote to memory of 1740 1716 rfflxfl.exe 42 PID 1716 wrote to memory of 1740 1716 rfflxfl.exe 42 PID 1740 wrote to memory of 2216 1740 lrrxrxx.exe 43 PID 1740 wrote to memory of 2216 1740 lrrxrxx.exe 43 PID 1740 wrote to memory of 2216 1740 lrrxrxx.exe 43 PID 1740 wrote to memory of 2216 1740 lrrxrxx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2512d4385e88b81fdffe82d7e38e95b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\5ddpp.exec:\5ddpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\llllfxf.exec:\llllfxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\bbhntt.exec:\bbhntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jjjpd.exec:\jjjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xxxlxlf.exec:\xxxlxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\vpdvd.exec:\vpdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vjddv.exec:\vjddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\7frrxxx.exec:\7frrxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\nbtbtt.exec:\nbtbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\vdvpv.exec:\vdvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\7xrrflf.exec:\7xrrflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\tthntt.exec:\tthntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\djpdj.exec:\djpdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\rfflxfl.exec:\rfflxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\lrrxrxx.exec:\lrrxrxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\nthtnb.exec:\nthtnb.exe17⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pdvpj.exec:\pdvpj.exe18⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lfxflxx.exec:\lfxflxx.exe19⤵
- Executes dropped EXE
PID:296 -
\??\c:\3nhhhh.exec:\3nhhhh.exe20⤵
- Executes dropped EXE
PID:848 -
\??\c:\5vpdj.exec:\5vpdj.exe21⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe22⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hthbtb.exec:\hthbtb.exe23⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jppdv.exec:\jppdv.exe24⤵
- Executes dropped EXE
PID:1012 -
\??\c:\ffxlxll.exec:\ffxlxll.exe25⤵
- Executes dropped EXE
PID:3028 -
\??\c:\5btbbb.exec:\5btbbb.exe26⤵
- Executes dropped EXE
PID:1548 -
\??\c:\vpjvd.exec:\vpjvd.exe27⤵
- Executes dropped EXE
PID:1364 -
\??\c:\7jpvv.exec:\7jpvv.exe28⤵
- Executes dropped EXE
PID:1288 -
\??\c:\nnhtnh.exec:\nnhtnh.exe29⤵
- Executes dropped EXE
PID:952 -
\??\c:\9nbttt.exec:\9nbttt.exe30⤵
- Executes dropped EXE
PID:1344 -
\??\c:\9jjdd.exec:\9jjdd.exe31⤵
- Executes dropped EXE
PID:784 -
\??\c:\ffxfrrr.exec:\ffxfrrr.exe32⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hbbbnt.exec:\hbbbnt.exe33⤵
- Executes dropped EXE
PID:1504 -
\??\c:\bhbbtb.exec:\bhbbtb.exe34⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jjjpj.exec:\jjjpj.exe35⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lxrxxfr.exec:\lxrxxfr.exe36⤵
- Executes dropped EXE
PID:1712 -
\??\c:\bbbtbb.exec:\bbbtbb.exe37⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vvdvv.exec:\vvdvv.exe38⤵
- Executes dropped EXE
PID:2944 -
\??\c:\dvjpp.exec:\dvjpp.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9flllrf.exec:\9flllrf.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\thhttn.exec:\thhttn.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jdvvv.exec:\jdvvv.exe42⤵
- Executes dropped EXE
PID:2376 -
\??\c:\dvvpv.exec:\dvvpv.exe43⤵
- Executes dropped EXE
PID:2528 -
\??\c:\fxxlfrf.exec:\fxxlfrf.exe44⤵
- Executes dropped EXE
PID:2448 -
\??\c:\7lxflrf.exec:\7lxflrf.exe45⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ntnhnh.exec:\ntnhnh.exe46⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bbhbtn.exec:\bbhbtn.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vjvdj.exec:\vjvdj.exe48⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9lffflx.exec:\9lffflx.exe49⤵
- Executes dropped EXE
PID:1220 -
\??\c:\3rlxfrf.exec:\3rlxfrf.exe50⤵
- Executes dropped EXE
PID:2516 -
\??\c:\nnhtnb.exec:\nnhtnb.exe51⤵
- Executes dropped EXE
PID:2736 -
\??\c:\9bnhtt.exec:\9bnhtt.exe52⤵
- Executes dropped EXE
PID:764 -
\??\c:\vpjpp.exec:\vpjpp.exe53⤵
- Executes dropped EXE
PID:2156 -
\??\c:\llrxxrf.exec:\llrxxrf.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5xlxxfl.exec:\5xlxxfl.exe55⤵
- Executes dropped EXE
PID:2204 -
\??\c:\nthtbb.exec:\nthtbb.exe56⤵
- Executes dropped EXE
PID:796 -
\??\c:\jjjpv.exec:\jjjpv.exe57⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jvjdj.exec:\jvjdj.exe58⤵
- Executes dropped EXE
PID:1432 -
\??\c:\5rrxflx.exec:\5rrxflx.exe59⤵
- Executes dropped EXE
PID:1756 -
\??\c:\1lrlllr.exec:\1lrlllr.exe60⤵
- Executes dropped EXE
PID:1324 -
\??\c:\tntnnh.exec:\tntnnh.exe61⤵
- Executes dropped EXE
PID:2404 -
\??\c:\pjvjj.exec:\pjvjj.exe62⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vvpdp.exec:\vvpdp.exe63⤵
- Executes dropped EXE
PID:336 -
\??\c:\9xfrrxl.exec:\9xfrrxl.exe64⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7rlrrrl.exec:\7rlrrrl.exe65⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bbtbth.exec:\bbtbth.exe66⤵PID:3020
-
\??\c:\9vpjd.exec:\9vpjd.exe67⤵PID:1964
-
\??\c:\pddvd.exec:\pddvd.exe68⤵PID:740
-
\??\c:\9rlrfrf.exec:\9rlrfrf.exe69⤵PID:1276
-
\??\c:\tnhbhh.exec:\tnhbhh.exe70⤵PID:1644
-
\??\c:\bbhtnn.exec:\bbhtnn.exe71⤵PID:2916
-
\??\c:\9jdjd.exec:\9jdjd.exe72⤵PID:1972
-
\??\c:\ddvjp.exec:\ddvjp.exe73⤵PID:2004
-
\??\c:\xxrxrlx.exec:\xxrxrlx.exe74⤵PID:2292
-
\??\c:\5nbnht.exec:\5nbnht.exe75⤵PID:2192
-
\??\c:\jddjj.exec:\jddjj.exe76⤵PID:892
-
\??\c:\dvjpv.exec:\dvjpv.exe77⤵PID:2972
-
\??\c:\lrfrlxx.exec:\lrfrlxx.exe78⤵PID:1568
-
\??\c:\5rlrffl.exec:\5rlrffl.exe79⤵PID:2888
-
\??\c:\htnthn.exec:\htnthn.exe80⤵PID:2520
-
\??\c:\hhbhbb.exec:\hhbhbb.exe81⤵PID:2532
-
\??\c:\pjvdd.exec:\pjvdd.exe82⤵PID:2648
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe83⤵PID:2692
-
\??\c:\fxrlrxf.exec:\fxrlrxf.exe84⤵PID:2700
-
\??\c:\7hbntt.exec:\7hbntt.exe85⤵PID:2544
-
\??\c:\hbbntb.exec:\hbbntb.exe86⤵PID:1720
-
\??\c:\pjpdd.exec:\pjpdd.exe87⤵PID:2676
-
\??\c:\jjjvj.exec:\jjjvj.exe88⤵PID:2504
-
\??\c:\lfrxllf.exec:\lfrxllf.exe89⤵PID:2420
-
\??\c:\hbbtht.exec:\hbbtht.exe90⤵PID:2852
-
\??\c:\bbbhbh.exec:\bbbhbh.exe91⤵PID:3056
-
\??\c:\dvdvd.exec:\dvdvd.exe92⤵PID:320
-
\??\c:\3lxrxxl.exec:\3lxrxxl.exe93⤵PID:1580
-
\??\c:\1xxlfrf.exec:\1xxlfrf.exe94⤵PID:2716
-
\??\c:\btnbnt.exec:\btnbnt.exe95⤵PID:2012
-
\??\c:\jdvvd.exec:\jdvvd.exe96⤵PID:1576
-
\??\c:\ffrxxlr.exec:\ffrxxlr.exe97⤵PID:1848
-
\??\c:\ttnbtt.exec:\ttnbtt.exe98⤵PID:1740
-
\??\c:\hbhnth.exec:\hbhnth.exe99⤵PID:1980
-
\??\c:\dvpvj.exec:\dvpvj.exe100⤵PID:2172
-
\??\c:\rlfrxlx.exec:\rlfrxlx.exe101⤵PID:996
-
\??\c:\lllxrrf.exec:\lllxrrf.exe102⤵PID:1432
-
\??\c:\9nhntb.exec:\9nhntb.exe103⤵PID:1756
-
\??\c:\bnnbtb.exec:\bnnbtb.exe104⤵PID:3064
-
\??\c:\vpjjd.exec:\vpjjd.exe105⤵PID:1216
-
\??\c:\pjppp.exec:\pjppp.exe106⤵PID:1688
-
\??\c:\rlrlxfl.exec:\rlrlxfl.exe107⤵PID:2092
-
\??\c:\thbntb.exec:\thbntb.exe108⤵PID:324
-
\??\c:\nhthbt.exec:\nhthbt.exe109⤵PID:2996
-
\??\c:\jjdjp.exec:\jjdjp.exe110⤵PID:3020
-
\??\c:\rxrfrfl.exec:\rxrfrfl.exe111⤵PID:1548
-
\??\c:\rrxrfxr.exec:\rrxrfxr.exe112⤵PID:1768
-
\??\c:\thbnbb.exec:\thbnbb.exe113⤵PID:960
-
\??\c:\htbnnn.exec:\htbnnn.exe114⤵PID:568
-
\??\c:\dpppd.exec:\dpppd.exe115⤵PID:1424
-
\??\c:\llrxlrl.exec:\llrxlrl.exe116⤵PID:1344
-
\??\c:\rlxlrrf.exec:\rlxlrrf.exe117⤵PID:1924
-
\??\c:\3nbbnt.exec:\3nbbnt.exe118⤵PID:1304
-
\??\c:\jjvjd.exec:\jjvjd.exe119⤵PID:2280
-
\??\c:\7dvpv.exec:\7dvpv.exe120⤵PID:1264
-
\??\c:\ffrfrxf.exec:\ffrfrxf.exe121⤵PID:2244
-
\??\c:\7ntttb.exec:\7ntttb.exe122⤵PID:2036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-