Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 22:53
Behavioral task
behavioral1
Sample
4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe
-
Size
252KB
-
MD5
4c5b2ce022f91db743432affd2b4e2d0
-
SHA1
69d21da3ada8265356e89c5c36baa2700286be43
-
SHA256
3fa421194294cf39afffac6db86e893c585ed71060b2f6519266b42c75fc7d58
-
SHA512
a8a7c2f47c2e0e25428febbdabdb926871c7d520877426ba5c2fbf5405181ad23b10fc47d0096fb110f13babbf2aac416ef4f5a2ea38ac8ed3590a5228d874f1
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+THkP:ccm4FmowdHoSi9EIBftapTs4WZazeEP
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2172-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1680-21-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2488-30-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2240-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2524-41-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2744-55-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2744-56-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2744-57-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2588-70-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2512-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2212-87-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2888-98-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/552-118-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2000-130-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2008-146-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2008-155-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2212-166-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2152-163-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2220-184-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2700-197-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2700-203-0x00000000003A0000-0x00000000003D6000-memory.dmp family_blackmoon behavioral1/memory/1932-221-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1088-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1352-258-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1952-267-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/896-278-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/896-277-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2196-304-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2268-314-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2260-321-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/840-356-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/840-357-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/664-403-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2516-402-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/276-428-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/276-435-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1120-444-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1468-536-0x00000000002A0000-0x00000000002D6000-memory.dmp family_blackmoon behavioral1/memory/1468-537-0x00000000002A0000-0x00000000002D6000-memory.dmp family_blackmoon behavioral1/memory/2124-551-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1364-552-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2800-593-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2084-618-0x0000000001B70000-0x0000000001BA6000-memory.dmp family_blackmoon behavioral1/memory/2084-617-0x0000000001B70000-0x0000000001BA6000-memory.dmp family_blackmoon behavioral1/memory/2028-689-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/940-728-0x0000000000250000-0x0000000000286000-memory.dmp family_blackmoon behavioral1/memory/2204-735-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000c000000012241-5.dat family_berbew behavioral1/files/0x000b000000015c3c-28.dat family_berbew behavioral1/files/0x000b000000015a2d-19.dat family_berbew behavioral1/files/0x0008000000015c87-38.dat family_berbew behavioral1/files/0x0007000000015cb9-47.dat family_berbew behavioral1/files/0x0007000000015d88-54.dat family_berbew behavioral1/memory/2744-56-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew behavioral1/files/0x0009000000015db4-68.dat family_berbew behavioral1/files/0x0009000000015e02-79.dat family_berbew behavioral1/files/0x00060000000167db-90.dat family_berbew behavioral1/files/0x0006000000016b96-100.dat family_berbew behavioral1/files/0x0009000000015c52-107.dat family_berbew behavioral1/files/0x0006000000016c10-115.dat family_berbew behavioral1/files/0x0006000000016c1a-127.dat family_berbew behavioral1/files/0x0006000000016c23-138.dat family_berbew behavioral1/files/0x0006000000016c90-145.dat family_berbew behavioral1/files/0x0006000000016ca9-154.dat family_berbew behavioral1/files/0x0006000000016ccf-165.dat family_berbew behavioral1/files/0x0006000000016cd4-174.dat family_berbew behavioral1/files/0x0006000000016cf0-183.dat family_berbew behavioral1/files/0x0006000000016d01-195.dat family_berbew behavioral1/files/0x0006000000016d11-205.dat family_berbew behavioral1/files/0x0006000000016d24-213.dat family_berbew behavioral1/files/0x0006000000016d36-222.dat family_berbew behavioral1/files/0x0006000000016d41-230.dat family_berbew behavioral1/files/0x0006000000016d4a-240.dat family_berbew behavioral1/files/0x0006000000016d4f-251.dat family_berbew behavioral1/files/0x0006000000016d55-259.dat family_berbew behavioral1/files/0x0006000000016d84-268.dat family_berbew behavioral1/files/0x0006000000016d89-279.dat family_berbew behavioral1/files/0x0006000000016e56-288.dat family_berbew behavioral1/files/0x000600000001704f-295.dat family_berbew behavioral1/files/0x0006000000017090-305.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2240 xrxpj.exe 1680 jxjtlp.exe 2488 fnrphx.exe 2524 jdlpxt.exe 2744 jlfxrn.exe 2512 vbxjp.exe 2588 rddvvh.exe 2212 hjtxxbf.exe 2888 xjlplpb.exe 540 fhrrv.exe 552 ldvnx.exe 276 hhjxpvv.exe 2000 pftvn.exe 1552 brtpnhd.exe 2008 bjphb.exe 2152 fvrbx.exe 1644 nvxnlp.exe 2220 nhtnjv.exe 2644 xlxhtf.exe 2700 tnjvxr.exe 2120 vlvhfpj.exe 1932 rnrjnjb.exe 1260 vldppr.exe 2492 xrdhhrv.exe 1088 nxbnj.exe 1352 vvlrtdt.exe 1952 rflnh.exe 896 xxhhhxl.exe 2068 ddffvd.exe 2796 pvnffjd.exe 2196 lhhljt.exe 2268 hpldh.exe 2260 pblhxt.exe 2240 btvpd.exe 2080 lpjjnf.exe 2872 xfvbx.exe 3000 jtfxbb.exe 840 ndnfbp.exe 2604 tplrrtt.exe 2104 npfbh.exe 2884 nptvdv.exe 2656 prdlx.exe 2660 xtrnv.exe 2668 drplbh.exe 2516 dldlr.exe 664 tfbdftt.exe 1640 jhltl.exe 1616 fflbh.exe 1636 nxnjfj.exe 276 pjlvb.exe 1120 nvpnht.exe 560 tbvdj.exe 2040 hvftlt.exe 2008 djnhpr.exe 1944 pfxnbn.exe 2304 flvnj.exe 968 trpxrb.exe 2220 xltnl.exe 752 lvjjthv.exe 2644 dxpjhbf.exe 2700 nvdhfj.exe 1904 hjtlhd.exe 2112 htdtnlf.exe 1132 tjrll.exe -
resource yara_rule behavioral1/memory/2172-1-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2172-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000c000000012241-5.dat upx behavioral1/memory/2240-10-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1680-21-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000b000000015c3c-28.dat upx behavioral1/memory/2488-32-0x0000000000440000-0x0000000000476000-memory.dmp upx behavioral1/memory/2488-30-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000b000000015a2d-19.dat upx behavioral1/memory/2240-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000015c87-38.dat upx behavioral1/memory/2524-46-0x00000000002C0000-0x00000000002F6000-memory.dmp upx behavioral1/files/0x0007000000015cb9-47.dat upx behavioral1/memory/2524-41-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2744-55-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015d88-54.dat upx behavioral1/memory/2512-58-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0009000000015db4-68.dat upx behavioral1/memory/2588-70-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2512-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0009000000015e02-79.dat upx behavioral1/files/0x00060000000167db-90.dat upx behavioral1/memory/2212-87-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016b96-100.dat upx behavioral1/files/0x0009000000015c52-107.dat upx behavioral1/memory/540-99-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2888-98-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c10-115.dat upx behavioral1/memory/552-118-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c1a-127.dat upx behavioral1/memory/2000-130-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c23-138.dat upx behavioral1/memory/1552-137-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c90-145.dat upx behavioral1/memory/2008-146-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016ca9-154.dat upx behavioral1/memory/2008-155-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016ccf-165.dat upx behavioral1/memory/2152-163-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016cd4-174.dat upx behavioral1/memory/2220-184-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016cf0-183.dat upx behavioral1/memory/2644-192-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/memory/2700-197-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d01-195.dat upx behavioral1/files/0x0006000000016d11-205.dat upx behavioral1/files/0x0006000000016d24-213.dat upx behavioral1/memory/1932-221-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d36-222.dat upx behavioral1/files/0x0006000000016d41-230.dat upx behavioral1/files/0x0006000000016d4a-240.dat upx behavioral1/memory/1088-243-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d4f-251.dat upx behavioral1/files/0x0006000000016d55-259.dat upx behavioral1/memory/1352-258-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1952-267-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d84-268.dat upx behavioral1/files/0x0006000000016d89-279.dat upx behavioral1/memory/896-277-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016e56-288.dat upx behavioral1/files/0x000600000001704f-295.dat upx behavioral1/files/0x0006000000017090-305.dat upx behavioral1/memory/2196-304-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2268-314-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2240 2172 4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 2240 2172 4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 2240 2172 4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 2240 2172 4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe 28 PID 2240 wrote to memory of 1680 2240 xrxpj.exe 29 PID 2240 wrote to memory of 1680 2240 xrxpj.exe 29 PID 2240 wrote to memory of 1680 2240 xrxpj.exe 29 PID 2240 wrote to memory of 1680 2240 xrxpj.exe 29 PID 1680 wrote to memory of 2488 1680 jxjtlp.exe 30 PID 1680 wrote to memory of 2488 1680 jxjtlp.exe 30 PID 1680 wrote to memory of 2488 1680 jxjtlp.exe 30 PID 1680 wrote to memory of 2488 1680 jxjtlp.exe 30 PID 2488 wrote to memory of 2524 2488 fnrphx.exe 31 PID 2488 wrote to memory of 2524 2488 fnrphx.exe 31 PID 2488 wrote to memory of 2524 2488 fnrphx.exe 31 PID 2488 wrote to memory of 2524 2488 fnrphx.exe 31 PID 2524 wrote to memory of 2744 2524 jdlpxt.exe 32 PID 2524 wrote to memory of 2744 2524 jdlpxt.exe 32 PID 2524 wrote to memory of 2744 2524 jdlpxt.exe 32 PID 2524 wrote to memory of 2744 2524 jdlpxt.exe 32 PID 2744 wrote to memory of 2512 2744 jlfxrn.exe 33 PID 2744 wrote to memory of 2512 2744 jlfxrn.exe 33 PID 2744 wrote to memory of 2512 2744 jlfxrn.exe 33 PID 2744 wrote to memory of 2512 2744 jlfxrn.exe 33 PID 2512 wrote to memory of 2588 2512 vbxjp.exe 34 PID 2512 wrote to memory of 2588 2512 vbxjp.exe 34 PID 2512 wrote to memory of 2588 2512 vbxjp.exe 34 PID 2512 wrote to memory of 2588 2512 vbxjp.exe 34 PID 2588 wrote to memory of 2212 2588 rddvvh.exe 35 PID 2588 wrote to memory of 2212 2588 rddvvh.exe 35 PID 2588 wrote to memory of 2212 2588 rddvvh.exe 35 PID 2588 wrote to memory of 2212 2588 rddvvh.exe 35 PID 2212 wrote to memory of 2888 2212 hjtxxbf.exe 36 PID 2212 wrote to memory of 2888 2212 hjtxxbf.exe 36 PID 2212 wrote to memory of 2888 2212 hjtxxbf.exe 36 PID 2212 wrote to memory of 2888 2212 hjtxxbf.exe 36 PID 2888 wrote to memory of 540 2888 xjlplpb.exe 37 PID 2888 wrote to memory of 540 2888 xjlplpb.exe 37 PID 2888 wrote to memory of 540 2888 xjlplpb.exe 37 PID 2888 wrote to memory of 540 2888 xjlplpb.exe 37 PID 540 wrote to memory of 552 540 fhrrv.exe 38 PID 540 wrote to memory of 552 540 fhrrv.exe 38 PID 540 wrote to memory of 552 540 fhrrv.exe 38 PID 540 wrote to memory of 552 540 fhrrv.exe 38 PID 552 wrote to memory of 276 552 ldvnx.exe 39 PID 552 wrote to memory of 276 552 ldvnx.exe 39 PID 552 wrote to memory of 276 552 ldvnx.exe 39 PID 552 wrote to memory of 276 552 ldvnx.exe 39 PID 276 wrote to memory of 2000 276 hhjxpvv.exe 40 PID 276 wrote to memory of 2000 276 hhjxpvv.exe 40 PID 276 wrote to memory of 2000 276 hhjxpvv.exe 40 PID 276 wrote to memory of 2000 276 hhjxpvv.exe 40 PID 2000 wrote to memory of 1552 2000 pftvn.exe 41 PID 2000 wrote to memory of 1552 2000 pftvn.exe 41 PID 2000 wrote to memory of 1552 2000 pftvn.exe 41 PID 2000 wrote to memory of 1552 2000 pftvn.exe 41 PID 1552 wrote to memory of 2008 1552 brtpnhd.exe 42 PID 1552 wrote to memory of 2008 1552 brtpnhd.exe 42 PID 1552 wrote to memory of 2008 1552 brtpnhd.exe 42 PID 1552 wrote to memory of 2008 1552 brtpnhd.exe 42 PID 2008 wrote to memory of 2152 2008 bjphb.exe 43 PID 2008 wrote to memory of 2152 2008 bjphb.exe 43 PID 2008 wrote to memory of 2152 2008 bjphb.exe 43 PID 2008 wrote to memory of 2152 2008 bjphb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\xrxpj.exec:\xrxpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\jxjtlp.exec:\jxjtlp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\fnrphx.exec:\fnrphx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\jdlpxt.exec:\jdlpxt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jlfxrn.exec:\jlfxrn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vbxjp.exec:\vbxjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\rddvvh.exec:\rddvvh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hjtxxbf.exec:\hjtxxbf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\xjlplpb.exec:\xjlplpb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fhrrv.exec:\fhrrv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\ldvnx.exec:\ldvnx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\hhjxpvv.exec:\hhjxpvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\pftvn.exec:\pftvn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\brtpnhd.exec:\brtpnhd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\bjphb.exec:\bjphb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\fvrbx.exec:\fvrbx.exe17⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nvxnlp.exec:\nvxnlp.exe18⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nhtnjv.exec:\nhtnjv.exe19⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xlxhtf.exec:\xlxhtf.exe20⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tnjvxr.exec:\tnjvxr.exe21⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vlvhfpj.exec:\vlvhfpj.exe22⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rnrjnjb.exec:\rnrjnjb.exe23⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vldppr.exec:\vldppr.exe24⤵
- Executes dropped EXE
PID:1260 -
\??\c:\xrdhhrv.exec:\xrdhhrv.exe25⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nxbnj.exec:\nxbnj.exe26⤵
- Executes dropped EXE
PID:1088 -
\??\c:\vvlrtdt.exec:\vvlrtdt.exe27⤵
- Executes dropped EXE
PID:1352 -
\??\c:\rflnh.exec:\rflnh.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xxhhhxl.exec:\xxhhhxl.exe29⤵
- Executes dropped EXE
PID:896 -
\??\c:\ddffvd.exec:\ddffvd.exe30⤵
- Executes dropped EXE
PID:2068 -
\??\c:\pvnffjd.exec:\pvnffjd.exe31⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lhhljt.exec:\lhhljt.exe32⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hpldh.exec:\hpldh.exe33⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pblhxt.exec:\pblhxt.exe34⤵
- Executes dropped EXE
PID:2260 -
\??\c:\btvpd.exec:\btvpd.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lpjjnf.exec:\lpjjnf.exe36⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xfvbx.exec:\xfvbx.exe37⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jtfxbb.exec:\jtfxbb.exe38⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ndnfbp.exec:\ndnfbp.exe39⤵
- Executes dropped EXE
PID:840 -
\??\c:\tplrrtt.exec:\tplrrtt.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\npfbh.exec:\npfbh.exe41⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nptvdv.exec:\nptvdv.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\prdlx.exec:\prdlx.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xtrnv.exec:\xtrnv.exe44⤵
- Executes dropped EXE
PID:2660 -
\??\c:\drplbh.exec:\drplbh.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\dldlr.exec:\dldlr.exe46⤵
- Executes dropped EXE
PID:2516 -
\??\c:\tfbdftt.exec:\tfbdftt.exe47⤵
- Executes dropped EXE
PID:664 -
\??\c:\jhltl.exec:\jhltl.exe48⤵
- Executes dropped EXE
PID:1640 -
\??\c:\fflbh.exec:\fflbh.exe49⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nxnjfj.exec:\nxnjfj.exe50⤵
- Executes dropped EXE
PID:1636 -
\??\c:\pjlvb.exec:\pjlvb.exe51⤵
- Executes dropped EXE
PID:276 -
\??\c:\nvpnht.exec:\nvpnht.exe52⤵
- Executes dropped EXE
PID:1120 -
\??\c:\tbvdj.exec:\tbvdj.exe53⤵
- Executes dropped EXE
PID:560 -
\??\c:\hvftlt.exec:\hvftlt.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\djnhpr.exec:\djnhpr.exe55⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pfxnbn.exec:\pfxnbn.exe56⤵
- Executes dropped EXE
PID:1944 -
\??\c:\flvnj.exec:\flvnj.exe57⤵
- Executes dropped EXE
PID:2304 -
\??\c:\trpxrb.exec:\trpxrb.exe58⤵
- Executes dropped EXE
PID:968 -
\??\c:\xltnl.exec:\xltnl.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lvjjthv.exec:\lvjjthv.exe60⤵
- Executes dropped EXE
PID:752 -
\??\c:\dxpjhbf.exec:\dxpjhbf.exe61⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nvdhfj.exec:\nvdhfj.exe62⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hjtlhd.exec:\hjtlhd.exe63⤵
- Executes dropped EXE
PID:1904 -
\??\c:\htdtnlf.exec:\htdtnlf.exe64⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tjrll.exec:\tjrll.exe65⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pvjldl.exec:\pvjldl.exe66⤵PID:2912
-
\??\c:\rvbvv.exec:\rvbvv.exe67⤵PID:1468
-
\??\c:\lvhttl.exec:\lvhttl.exe68⤵PID:1480
-
\??\c:\dndxljj.exec:\dndxljj.exe69⤵PID:2124
-
\??\c:\tvltbr.exec:\tvltbr.exe70⤵PID:1364
-
\??\c:\ndxbdpj.exec:\ndxbdpj.exe71⤵PID:1960
-
\??\c:\nvxtd.exec:\nvxtd.exe72⤵PID:2800
-
\??\c:\lfnbftl.exec:\lfnbftl.exe73⤵PID:3064
-
\??\c:\bbpvx.exec:\bbpvx.exe74⤵PID:2064
-
\??\c:\hrjddnd.exec:\hrjddnd.exe75⤵PID:2832
-
\??\c:\hddxtxp.exec:\hddxtxp.exe76⤵PID:880
-
\??\c:\pbhvvld.exec:\pbhvvld.exe77⤵PID:1320
-
\??\c:\thdlhxt.exec:\thdlhxt.exe78⤵PID:2776
-
\??\c:\jrnrb.exec:\jrnrb.exe79⤵PID:2084
-
\??\c:\fptttl.exec:\fptttl.exe80⤵PID:2680
-
\??\c:\dfnrhn.exec:\dfnrhn.exe81⤵PID:2088
-
\??\c:\lbrdhr.exec:\lbrdhr.exe82⤵PID:2868
-
\??\c:\vnjplv.exec:\vnjplv.exe83⤵PID:3000
-
\??\c:\dppbfr.exec:\dppbfr.exe84⤵PID:2548
-
\??\c:\lnvnjr.exec:\lnvnjr.exe85⤵PID:2600
-
\??\c:\rldfj.exec:\rldfj.exe86⤵PID:2664
-
\??\c:\jdffrvr.exec:\jdffrvr.exe87⤵PID:844
-
\??\c:\vnvhnft.exec:\vnvhnft.exe88⤵PID:2400
-
\??\c:\pnjbl.exec:\pnjbl.exe89⤵PID:2420
-
\??\c:\jntdd.exec:\jntdd.exe90⤵PID:2028
-
\??\c:\tvtdxxl.exec:\tvtdxxl.exe91⤵PID:2456
-
\??\c:\ffpbb.exec:\ffpbb.exe92⤵PID:2668
-
\??\c:\flxxjvd.exec:\flxxjvd.exe93⤵PID:772
-
\??\c:\tptjbrp.exec:\tptjbrp.exe94⤵PID:1536
-
\??\c:\nfrxdtn.exec:\nfrxdtn.exe95⤵PID:1048
-
\??\c:\ltptb.exec:\ltptb.exe96⤵PID:940
-
\??\c:\tvhvltb.exec:\tvhvltb.exe97⤵PID:2204
-
\??\c:\rtfbp.exec:\rtfbp.exe98⤵PID:1652
-
\??\c:\lvdhxl.exec:\lvdhxl.exe99⤵PID:2000
-
\??\c:\nvprhrj.exec:\nvprhrj.exe100⤵PID:2020
-
\??\c:\rnxvxx.exec:\rnxvxx.exe101⤵PID:2012
-
\??\c:\lphnb.exec:\lphnb.exe102⤵PID:1632
-
\??\c:\tjhrpb.exec:\tjhrpb.exe103⤵PID:1308
-
\??\c:\bnnvl.exec:\bnnvl.exe104⤵PID:1312
-
\??\c:\hnnjn.exec:\hnnjn.exe105⤵PID:2464
-
\??\c:\fhjvvp.exec:\fhjvvp.exe106⤵PID:1784
-
\??\c:\vvblp.exec:\vvblp.exe107⤵PID:752
-
\??\c:\hrhll.exec:\hrhll.exe108⤵PID:3044
-
\??\c:\jbphhj.exec:\jbphhj.exe109⤵PID:2700
-
\??\c:\tthtj.exec:\tthtj.exe110⤵PID:1904
-
\??\c:\rnhhfp.exec:\rnhhfp.exe111⤵PID:2176
-
\??\c:\ppvdn.exec:\ppvdn.exe112⤵PID:1260
-
\??\c:\ntnjp.exec:\ntnjp.exe113⤵PID:2492
-
\??\c:\dfrbtf.exec:\dfrbtf.exe114⤵PID:1860
-
\??\c:\dxxvph.exec:\dxxvph.exe115⤵PID:1760
-
\??\c:\xlttxld.exec:\xlttxld.exe116⤵PID:936
-
\??\c:\rhfbf.exec:\rhfbf.exe117⤵PID:888
-
\??\c:\fvtrpbv.exec:\fvtrpbv.exe118⤵PID:1984
-
\??\c:\xxlbr.exec:\xxlbr.exe119⤵PID:1052
-
\??\c:\pdfdvj.exec:\pdfdvj.exe120⤵PID:2900
-
\??\c:\vrdpfrd.exec:\vrdpfrd.exe121⤵PID:2836
-
\??\c:\txfnt.exec:\txfnt.exe122⤵PID:1016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-