Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 11:07
Behavioral task
behavioral1
Sample
cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe
-
Size
252KB
-
MD5
cdd51d1b11ce82e65ef693b6d1996500
-
SHA1
3b2fdcc562bf752983c944a5d6a14a80cc641848
-
SHA256
2e7173ef01778541bd29e2d7cabebfb00c15de17175d8296ee01ab70f9dc0812
-
SHA512
49c320c1a002a0794f04f3dc47470089dae1a58f97ca9c40f7e069036b11299366925a9a3283fd4b639fb4741c01bfb16285120f5ff55ada82b5b8890815b386
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+THk8:ccm4FmowdHoSi9EIBftapTs4WZazeE8
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2964-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2100-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2352-31-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2432-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2748-40-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2540-55-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2908-65-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2708-74-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2472-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2776-107-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2884-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3040-125-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1948-128-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1132-152-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2604-160-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1876-170-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1876-169-0x00000000003A0000-0x00000000003D6000-memory.dmp family_blackmoon behavioral1/memory/548-180-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2928-191-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/380-213-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/588-231-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2016-240-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2376-276-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2124-292-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2432-329-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1596-336-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2700-367-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2224-381-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2024-443-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2300-483-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/624-512-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2648-657-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1704-676-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/956-808-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2648-952-0x0000000000230000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/2624-1019-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/584-1072-0x00000000002A0000-0x00000000002D6000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000e00000001226b-8.dat family_berbew behavioral1/files/0x0036000000015c7f-18.dat family_berbew behavioral1/files/0x0008000000015cc7-26.dat family_berbew behavioral1/files/0x0007000000015ce3-38.dat family_berbew behavioral1/files/0x0007000000015cf0-45.dat family_berbew behavioral1/files/0x0007000000015d02-56.dat family_berbew behavioral1/files/0x0008000000015d0c-63.dat family_berbew behavioral1/files/0x0008000000015d19-72.dat family_berbew behavioral1/files/0x00070000000165a8-81.dat family_berbew behavioral1/files/0x000600000001663f-90.dat family_berbew behavioral1/files/0x000600000001686d-97.dat family_berbew behavioral1/files/0x0006000000016abb-108.dat family_berbew behavioral1/files/0x0006000000016c56-115.dat family_berbew behavioral1/files/0x0006000000016c71-127.dat family_berbew behavioral1/files/0x0006000000016c7a-133.dat family_berbew behavioral1/files/0x0006000000016cc3-141.dat family_berbew behavioral1/files/0x0006000000016ce7-150.dat family_berbew behavioral1/files/0x0006000000016d1b-161.dat family_berbew behavioral1/files/0x0006000000016d2c-171.dat family_berbew behavioral1/files/0x0035000000015c93-178.dat family_berbew behavioral1/files/0x0006000000016d34-187.dat family_berbew behavioral1/files/0x0006000000016d3d-197.dat family_berbew behavioral1/files/0x0006000000016d45-204.dat family_berbew behavioral1/files/0x0006000000016d4e-214.dat family_berbew behavioral1/files/0x0006000000016d61-223.dat family_berbew behavioral1/files/0x0006000000016d65-232.dat family_berbew behavioral1/files/0x0006000000016d69-241.dat family_berbew behavioral1/files/0x0006000000016d71-248.dat family_berbew behavioral1/files/0x0006000000016dda-256.dat family_berbew behavioral1/files/0x0006000000016dde-266.dat family_berbew behavioral1/files/0x0006000000016de7-277.dat family_berbew behavioral1/files/0x0006000000016eb9-284.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2100 vjvvj.exe 2432 nhtbhn.exe 2352 fxlrxxf.exe 2748 lflfllr.exe 2540 htnthh.exe 2908 pjdpv.exe 2708 bbntbb.exe 2588 pdvdj.exe 2608 3bhhnn.exe 2472 7tbhhn.exe 2776 vjdpd.exe 2884 xrxxxxf.exe 3040 nbbbtt.exe 1948 pjddj.exe 2412 xrllrrr.exe 1132 bthtbh.exe 2604 lfrxrrf.exe 1876 7bntbh.exe 548 jpdpj.exe 2076 fxlrrrf.exe 2928 ddpvv.exe 2212 7jddd.exe 380 9xxlrxf.exe 336 hbnthh.exe 588 xlxlrfx.exe 2016 jdpdv.exe 1556 fxrfxfr.exe 1880 thtnnn.exe 1544 1pjpj.exe 2376 lfrfxfx.exe 640 1dvpd.exe 2124 xlxfrxf.exe 284 3btnbh.exe 1596 vpppd.exe 2200 lxllxxr.exe 2160 rlxrxfr.exe 2184 9tttnb.exe 2240 jdjpd.exe 2432 9rlrlxf.exe 2684 xllxlxx.exe 2740 5hbnbn.exe 2780 9vpvd.exe 2812 3xlxfrx.exe 2556 frlrfxf.exe 2700 nhttbt.exe 2548 djjpv.exe 2224 lxxxxxl.exe 2096 nnbhtb.exe 2824 nhbhbb.exe 2712 5djjp.exe 2992 9pjjp.exe 2508 1rrfllr.exe 1964 nnbbht.exe 1952 hbnhhn.exe 1948 9ppdj.exe 2024 xrfrfll.exe 2520 tnhnhn.exe 1460 hhthtb.exe 1304 9jvpv.exe 2292 rlflrxl.exe 2084 tnnhtb.exe 2300 hhttnb.exe 1516 jddvj.exe 2116 jvdpd.exe -
resource yara_rule behavioral1/memory/2964-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000e00000001226b-8.dat upx behavioral1/memory/2100-9-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2964-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0036000000015c7f-18.dat upx behavioral1/memory/2100-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2432-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000015cc7-26.dat upx behavioral1/memory/2352-31-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2432-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2748-40-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015ce3-38.dat upx behavioral1/files/0x0007000000015cf0-45.dat upx behavioral1/memory/2540-48-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015d02-56.dat upx behavioral1/memory/2540-55-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000015d0c-63.dat upx behavioral1/memory/2908-65-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000015d19-72.dat upx behavioral1/memory/2708-74-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00070000000165a8-81.dat upx behavioral1/files/0x000600000001663f-90.dat upx behavioral1/files/0x000600000001686d-97.dat upx behavioral1/memory/2472-99-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016abb-108.dat upx behavioral1/memory/2776-107-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c56-115.dat upx behavioral1/memory/2884-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3040-125-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1948-128-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c71-127.dat upx behavioral1/files/0x0006000000016c7a-133.dat upx behavioral1/files/0x0006000000016cc3-141.dat upx behavioral1/files/0x0006000000016ce7-150.dat upx behavioral1/memory/1132-152-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d1b-161.dat upx behavioral1/memory/2604-160-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d2c-171.dat upx behavioral1/memory/1876-170-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0035000000015c93-178.dat upx behavioral1/memory/548-180-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d34-187.dat upx behavioral1/memory/2928-191-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d3d-197.dat upx behavioral1/files/0x0006000000016d45-204.dat upx behavioral1/memory/380-213-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d4e-214.dat upx behavioral1/files/0x0006000000016d61-223.dat upx behavioral1/memory/588-231-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d65-232.dat upx behavioral1/memory/2016-240-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d69-241.dat upx behavioral1/files/0x0006000000016d71-248.dat upx behavioral1/files/0x0006000000016dda-256.dat upx behavioral1/files/0x0006000000016dde-266.dat upx behavioral1/files/0x0006000000016de7-277.dat upx behavioral1/memory/2376-276-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016eb9-284.dat upx behavioral1/memory/2124-292-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2432-329-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2700-367-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2548-374-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2224-381-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2824-394-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2100 2964 cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe 28 PID 2964 wrote to memory of 2100 2964 cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe 28 PID 2964 wrote to memory of 2100 2964 cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe 28 PID 2964 wrote to memory of 2100 2964 cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe 28 PID 2100 wrote to memory of 2432 2100 vjvvj.exe 29 PID 2100 wrote to memory of 2432 2100 vjvvj.exe 29 PID 2100 wrote to memory of 2432 2100 vjvvj.exe 29 PID 2100 wrote to memory of 2432 2100 vjvvj.exe 29 PID 2432 wrote to memory of 2352 2432 nhtbhn.exe 30 PID 2432 wrote to memory of 2352 2432 nhtbhn.exe 30 PID 2432 wrote to memory of 2352 2432 nhtbhn.exe 30 PID 2432 wrote to memory of 2352 2432 nhtbhn.exe 30 PID 2352 wrote to memory of 2748 2352 fxlrxxf.exe 31 PID 2352 wrote to memory of 2748 2352 fxlrxxf.exe 31 PID 2352 wrote to memory of 2748 2352 fxlrxxf.exe 31 PID 2352 wrote to memory of 2748 2352 fxlrxxf.exe 31 PID 2748 wrote to memory of 2540 2748 lflfllr.exe 32 PID 2748 wrote to memory of 2540 2748 lflfllr.exe 32 PID 2748 wrote to memory of 2540 2748 lflfllr.exe 32 PID 2748 wrote to memory of 2540 2748 lflfllr.exe 32 PID 2540 wrote to memory of 2908 2540 htnthh.exe 33 PID 2540 wrote to memory of 2908 2540 htnthh.exe 33 PID 2540 wrote to memory of 2908 2540 htnthh.exe 33 PID 2540 wrote to memory of 2908 2540 htnthh.exe 33 PID 2908 wrote to memory of 2708 2908 pjdpv.exe 34 PID 2908 wrote to memory of 2708 2908 pjdpv.exe 34 PID 2908 wrote to memory of 2708 2908 pjdpv.exe 34 PID 2908 wrote to memory of 2708 2908 pjdpv.exe 34 PID 2708 wrote to memory of 2588 2708 bbntbb.exe 35 PID 2708 wrote to memory of 2588 2708 bbntbb.exe 35 PID 2708 wrote to memory of 2588 2708 bbntbb.exe 35 PID 2708 wrote to memory of 2588 2708 bbntbb.exe 35 PID 2588 wrote to memory of 2608 2588 pdvdj.exe 36 PID 2588 wrote to memory of 2608 2588 pdvdj.exe 36 PID 2588 wrote to memory of 2608 2588 pdvdj.exe 36 PID 2588 wrote to memory of 2608 2588 pdvdj.exe 36 PID 2608 wrote to memory of 2472 2608 3bhhnn.exe 37 PID 2608 wrote to memory of 2472 2608 3bhhnn.exe 37 PID 2608 wrote to memory of 2472 2608 3bhhnn.exe 37 PID 2608 wrote to memory of 2472 2608 3bhhnn.exe 37 PID 2472 wrote to memory of 2776 2472 7tbhhn.exe 38 PID 2472 wrote to memory of 2776 2472 7tbhhn.exe 38 PID 2472 wrote to memory of 2776 2472 7tbhhn.exe 38 PID 2472 wrote to memory of 2776 2472 7tbhhn.exe 38 PID 2776 wrote to memory of 2884 2776 vjdpd.exe 39 PID 2776 wrote to memory of 2884 2776 vjdpd.exe 39 PID 2776 wrote to memory of 2884 2776 vjdpd.exe 39 PID 2776 wrote to memory of 2884 2776 vjdpd.exe 39 PID 2884 wrote to memory of 3040 2884 xrxxxxf.exe 40 PID 2884 wrote to memory of 3040 2884 xrxxxxf.exe 40 PID 2884 wrote to memory of 3040 2884 xrxxxxf.exe 40 PID 2884 wrote to memory of 3040 2884 xrxxxxf.exe 40 PID 3040 wrote to memory of 1948 3040 nbbbtt.exe 41 PID 3040 wrote to memory of 1948 3040 nbbbtt.exe 41 PID 3040 wrote to memory of 1948 3040 nbbbtt.exe 41 PID 3040 wrote to memory of 1948 3040 nbbbtt.exe 41 PID 1948 wrote to memory of 2412 1948 pjddj.exe 42 PID 1948 wrote to memory of 2412 1948 pjddj.exe 42 PID 1948 wrote to memory of 2412 1948 pjddj.exe 42 PID 1948 wrote to memory of 2412 1948 pjddj.exe 42 PID 2412 wrote to memory of 1132 2412 xrllrrr.exe 43 PID 2412 wrote to memory of 1132 2412 xrllrrr.exe 43 PID 2412 wrote to memory of 1132 2412 xrllrrr.exe 43 PID 2412 wrote to memory of 1132 2412 xrllrrr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cdd51d1b11ce82e65ef693b6d1996500_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vjvvj.exec:\vjvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\nhtbhn.exec:\nhtbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\lflfllr.exec:\lflfllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\htnthh.exec:\htnthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\pjdpv.exec:\pjdpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\bbntbb.exec:\bbntbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\pdvdj.exec:\pdvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\3bhhnn.exec:\3bhhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\7tbhhn.exec:\7tbhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\vjdpd.exec:\vjdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\nbbbtt.exec:\nbbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\pjddj.exec:\pjddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\xrllrrr.exec:\xrllrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\bthtbh.exec:\bthtbh.exe17⤵
- Executes dropped EXE
PID:1132 -
\??\c:\lfrxrrf.exec:\lfrxrrf.exe18⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7bntbh.exec:\7bntbh.exe19⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jpdpj.exec:\jpdpj.exe20⤵
- Executes dropped EXE
PID:548 -
\??\c:\fxlrrrf.exec:\fxlrrrf.exe21⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ddpvv.exec:\ddpvv.exe22⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7jddd.exec:\7jddd.exe23⤵
- Executes dropped EXE
PID:2212 -
\??\c:\9xxlrxf.exec:\9xxlrxf.exe24⤵
- Executes dropped EXE
PID:380 -
\??\c:\hbnthh.exec:\hbnthh.exe25⤵
- Executes dropped EXE
PID:336 -
\??\c:\xlxlrfx.exec:\xlxlrfx.exe26⤵
- Executes dropped EXE
PID:588 -
\??\c:\jdpdv.exec:\jdpdv.exe27⤵
- Executes dropped EXE
PID:2016 -
\??\c:\fxrfxfr.exec:\fxrfxfr.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\thtnnn.exec:\thtnnn.exe29⤵
- Executes dropped EXE
PID:1880 -
\??\c:\1pjpj.exec:\1pjpj.exe30⤵
- Executes dropped EXE
PID:1544 -
\??\c:\lfrfxfx.exec:\lfrfxfx.exe31⤵
- Executes dropped EXE
PID:2376 -
\??\c:\1dvpd.exec:\1dvpd.exe32⤵
- Executes dropped EXE
PID:640 -
\??\c:\xlxfrxf.exec:\xlxfrxf.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3btnbh.exec:\3btnbh.exe34⤵
- Executes dropped EXE
PID:284 -
\??\c:\vpppd.exec:\vpppd.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lxllxxr.exec:\lxllxxr.exe36⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rlxrxfr.exec:\rlxrxfr.exe37⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9tttnb.exec:\9tttnb.exe38⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jdjpd.exec:\jdjpd.exe39⤵
- Executes dropped EXE
PID:2240 -
\??\c:\9rlrlxf.exec:\9rlrlxf.exe40⤵
- Executes dropped EXE
PID:2432 -
\??\c:\xllxlxx.exec:\xllxlxx.exe41⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5hbnbn.exec:\5hbnbn.exe42⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9vpvd.exec:\9vpvd.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3xlxfrx.exec:\3xlxfrx.exe44⤵
- Executes dropped EXE
PID:2812 -
\??\c:\frlrfxf.exec:\frlrfxf.exe45⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nhttbt.exec:\nhttbt.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\djjpv.exec:\djjpv.exe47⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lxxxxxl.exec:\lxxxxxl.exe48⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nnbhtb.exec:\nnbhtb.exe49⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nhbhbb.exec:\nhbhbb.exe50⤵
- Executes dropped EXE
PID:2824 -
\??\c:\5djjp.exec:\5djjp.exe51⤵
- Executes dropped EXE
PID:2712 -
\??\c:\9pjjp.exec:\9pjjp.exe52⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1rrfllr.exec:\1rrfllr.exe53⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nnbbht.exec:\nnbbht.exe54⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hbnhhn.exec:\hbnhhn.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\9ppdj.exec:\9ppdj.exe56⤵
- Executes dropped EXE
PID:1948 -
\??\c:\xrfrfll.exec:\xrfrfll.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnhnhn.exec:\tnhnhn.exe58⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hhthtb.exec:\hhthtb.exe59⤵
- Executes dropped EXE
PID:1460 -
\??\c:\9jvpv.exec:\9jvpv.exe60⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rlflrxl.exec:\rlflrxl.exe61⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tnnhtb.exec:\tnnhtb.exe62⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hhttnb.exec:\hhttnb.exe63⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jddvj.exec:\jddvj.exe64⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jvdpd.exec:\jvdpd.exe65⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ffxrffl.exec:\ffxrffl.exe66⤵PID:2212
-
\??\c:\bbnbnt.exec:\bbnbnt.exe67⤵PID:624
-
\??\c:\dvpjd.exec:\dvpjd.exe68⤵PID:1256
-
\??\c:\dvjjp.exec:\dvjjp.exe69⤵PID:1140
-
\??\c:\fxffllx.exec:\fxffllx.exe70⤵PID:1788
-
\??\c:\bnttbt.exec:\bnttbt.exe71⤵PID:1380
-
\??\c:\jdpdj.exec:\jdpdj.exe72⤵PID:1044
-
\??\c:\dpvvj.exec:\dpvvj.exe73⤵PID:1984
-
\??\c:\rfrrlfl.exec:\rfrrlfl.exe74⤵PID:876
-
\??\c:\tbnhbh.exec:\tbnhbh.exe75⤵PID:2216
-
\??\c:\pjvvd.exec:\pjvvd.exe76⤵PID:2356
-
\??\c:\vpdjp.exec:\vpdjp.exe77⤵PID:1332
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe78⤵PID:1252
-
\??\c:\nbnnhh.exec:\nbnnhh.exe79⤵PID:892
-
\??\c:\jjjvj.exec:\jjjvj.exe80⤵PID:1604
-
\??\c:\3ppjj.exec:\3ppjj.exe81⤵PID:1752
-
\??\c:\fxxrxfr.exec:\fxxrxfr.exe82⤵PID:1608
-
\??\c:\htbbbh.exec:\htbbbh.exe83⤵PID:2424
-
\??\c:\1pjvj.exec:\1pjvj.exe84⤵PID:2240
-
\??\c:\jvdpd.exec:\jvdpd.exe85⤵PID:1196
-
\??\c:\lfrxfrf.exec:\lfrxfrf.exe86⤵PID:2664
-
\??\c:\rfrxfxf.exec:\rfrxfxf.exe87⤵PID:2540
-
\??\c:\nhtttb.exec:\nhtttb.exe88⤵PID:2560
-
\??\c:\vjvjv.exec:\vjvjv.exe89⤵PID:2908
-
\??\c:\5djvp.exec:\5djvp.exe90⤵PID:2648
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe91⤵PID:2596
-
\??\c:\tnhhhh.exec:\tnhhhh.exe92⤵PID:1704
-
\??\c:\vpppj.exec:\vpppj.exe93⤵PID:3060
-
\??\c:\fxrlflr.exec:\fxrlflr.exe94⤵PID:2840
-
\??\c:\9lxfffr.exec:\9lxfffr.exe95⤵PID:2772
-
\??\c:\bbhtbh.exec:\bbhtbh.exe96⤵PID:2712
-
\??\c:\thntbt.exec:\thntbt.exe97⤵PID:1676
-
\??\c:\vvpdp.exec:\vvpdp.exe98⤵PID:3004
-
\??\c:\lxrxffr.exec:\lxrxffr.exe99⤵PID:1808
-
\??\c:\rlxxffl.exec:\rlxxffl.exe100⤵PID:1952
-
\??\c:\3tbhbh.exec:\3tbhbh.exe101⤵PID:1944
-
\??\c:\jjdpd.exec:\jjdpd.exe102⤵PID:2836
-
\??\c:\1jdjj.exec:\1jdjj.exe103⤵PID:316
-
\??\c:\9rlxflr.exec:\9rlxflr.exe104⤵PID:1460
-
\??\c:\nbbnhb.exec:\nbbnhb.exe105⤵PID:2104
-
\??\c:\htbtbb.exec:\htbtbb.exe106⤵PID:2292
-
\??\c:\vdpdd.exec:\vdpdd.exe107⤵PID:2088
-
\??\c:\ffxrffr.exec:\ffxrffr.exe108⤵PID:2280
-
\??\c:\fxrxrlr.exec:\fxrxrlr.exe109⤵PID:1516
-
\??\c:\nttbtn.exec:\nttbtn.exe110⤵PID:2228
-
\??\c:\nnnbnt.exec:\nnnbnt.exe111⤵PID:380
-
\??\c:\ddvjd.exec:\ddvjd.exe112⤵PID:1496
-
\??\c:\pdvvd.exec:\pdvvd.exe113⤵PID:956
-
\??\c:\3rfxxlf.exec:\3rfxxlf.exe114⤵PID:344
-
\??\c:\tttbnn.exec:\tttbnn.exe115⤵PID:1568
-
\??\c:\jdvjj.exec:\jdvjj.exe116⤵PID:620
-
\??\c:\1vvjp.exec:\1vvjp.exe117⤵PID:2000
-
\??\c:\5fxxxxl.exec:\5fxxxxl.exe118⤵PID:912
-
\??\c:\frxfflr.exec:\frxfflr.exe119⤵PID:1652
-
\??\c:\bnbtht.exec:\bnbtht.exe120⤵PID:2296
-
\??\c:\pdjpd.exec:\pdjpd.exe121⤵PID:2216
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe122⤵PID:2164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-