Analysis
-
max time kernel
144s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 05:43
Behavioral task
behavioral1
Sample
a78eb8c8ed59b6d1d26e62e38eb071d0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
a78eb8c8ed59b6d1d26e62e38eb071d0_NeikiAnalytics.exe
-
Size
276KB
-
MD5
a78eb8c8ed59b6d1d26e62e38eb071d0
-
SHA1
08317666333d87e915e2ea130fd43d249c015e94
-
SHA256
964c219a5ec620232fde237355f925c4a29ef338a4ef6247a601a76ba96f7fee
-
SHA512
4f1d2ce2067e981b52cd0cbf9737e7104ae543327c3436ee84d38c8efa970205a8d786ecd6ef49a30e7deb20ad1e6f404b7bfe09cca43568d615dc189a2f3e87
-
SSDEEP
6144:ncm4FmowdHoS6rW3NNTvBu6wo2J4JAgNXkArR/rtXOLtu4J6KvvLp3OKtUuuuTEr:14wFHoSeM/Tpu6w14JAOkIRhOBu4JhvC
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1616-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-153-0x0000000000250000-0x0000000000279000-memory.dmp family_blackmoon behavioral1/memory/332-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1064-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-388-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-457-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-483-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-491-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1112-507-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-546-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-959-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-966-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-979-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2740-992-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2420-1017-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/288-1108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-1210-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/1704-1325-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1716-1374-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1544-1395-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000d000000012334-8.dat family_berbew behavioral1/files/0x0008000000014971-29.dat family_berbew behavioral1/files/0x002f0000000146e6-20.dat family_berbew behavioral1/files/0x0007000000014b63-47.dat family_berbew behavioral1/files/0x0007000000014b27-39.dat family_berbew behavioral1/files/0x0007000000014baa-57.dat family_berbew behavioral1/memory/2608-54-0x00000000002A0000-0x00000000002C9000-memory.dmp family_berbew behavioral1/files/0x0009000000014e51-64.dat family_berbew behavioral1/files/0x0008000000015ce1-74.dat family_berbew behavioral1/files/0x0006000000015ceb-81.dat family_berbew behavioral1/files/0x0006000000015d07-91.dat family_berbew behavioral1/files/0x0006000000015d28-102.dat family_berbew behavioral1/files/0x0006000000015d4a-109.dat family_berbew behavioral1/files/0x0006000000015d56-118.dat family_berbew behavioral1/files/0x0006000000015d5e-126.dat family_berbew behavioral1/files/0x0006000000015d67-134.dat family_berbew behavioral1/files/0x0006000000015d6f-145.dat family_berbew behavioral1/files/0x002f000000014708-156.dat family_berbew behavioral1/files/0x0006000000015d79-164.dat family_berbew behavioral1/files/0x0006000000015d87-172.dat family_berbew behavioral1/files/0x0006000000015d8f-180.dat family_berbew behavioral1/files/0x0006000000015d9b-187.dat family_berbew behavioral1/files/0x0006000000015e3a-197.dat family_berbew behavioral1/files/0x0006000000015eaf-207.dat family_berbew behavioral1/files/0x0006000000015f6d-217.dat family_berbew behavioral1/files/0x0006000000015fe9-228.dat family_berbew behavioral1/files/0x0006000000016117-236.dat family_berbew behavioral1/files/0x00060000000161e7-245.dat family_berbew behavioral1/files/0x000600000001630b-254.dat family_berbew behavioral1/files/0x00060000000164b2-263.dat family_berbew behavioral1/files/0x0006000000016572-271.dat family_berbew behavioral1/files/0x000600000001661c-280.dat family_berbew behavioral1/files/0x0006000000016843-288.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1616 0848668.exe 2544 1flfxxr.exe 2596 bnnnhb.exe 2652 646080.exe 2608 208262.exe 2476 nhtthh.exe 2676 268800.exe 2500 446288.exe 2912 nnbhnh.exe 2240 jdjdd.exe 1520 9jdjp.exe 2752 3pvvv.exe 2848 08064.exe 1768 frxrrxf.exe 500 fxlrxxf.exe 1964 u644006.exe 332 i462440.exe 1336 tnbbnt.exe 1948 08002.exe 2160 pjvpp.exe 684 6026824.exe 1040 6462284.exe 1716 vvjpp.exe 1836 608866.exe 2112 htbbnn.exe 1544 s8008.exe 1064 lfxfrxl.exe 1316 ttnthh.exe 916 g6846.exe 2028 48662.exe 1732 dvjjv.exe 1720 3pddv.exe 2532 frxfxxf.exe 2332 nhnnbh.exe 1984 48884.exe 2544 jdppv.exe 1584 42002.exe 2792 jjjvj.exe 2660 thbttb.exe 2668 042400.exe 2592 bttntt.exe 2712 pdppd.exe 2472 20224.exe 2448 42444.exe 2528 vjppp.exe 2872 646284.exe 1268 fxrxlrr.exe 1536 424404.exe 776 lfllrrx.exe 2740 fxrxrxf.exe 2348 c648040.exe 2552 860028.exe 1808 1tbbhn.exe 1060 0246888.exe 2184 w86684.exe 1976 5djjp.exe 908 nhthnn.exe 1824 0462844.exe 2224 vvjjv.exe 2816 nnbbhh.exe 2548 btbbnn.exe 1052 3thbbh.exe 1624 k46200.exe 1112 i428840.exe -
resource yara_rule behavioral1/memory/1984-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-3-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/files/0x000d000000012334-8.dat upx behavioral1/memory/1616-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0008000000014971-29.dat upx behavioral1/memory/2596-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x002f0000000146e6-20.dat upx behavioral1/files/0x0007000000014b63-47.dat upx behavioral1/memory/2652-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000014b27-39.dat upx behavioral1/memory/2608-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000014baa-57.dat upx behavioral1/memory/2608-54-0x00000000002A0000-0x00000000002C9000-memory.dmp upx behavioral1/files/0x0009000000014e51-64.dat upx behavioral1/memory/2476-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0008000000015ce1-74.dat upx behavioral1/files/0x0006000000015ceb-81.dat upx behavioral1/files/0x0006000000015d07-91.dat upx behavioral1/memory/2240-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015d28-102.dat upx behavioral1/files/0x0006000000015d4a-109.dat upx behavioral1/files/0x0006000000015d56-118.dat upx behavioral1/memory/2848-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015d5e-126.dat upx behavioral1/memory/1768-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015d67-134.dat upx behavioral1/memory/1768-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015d6f-145.dat upx behavioral1/files/0x002f000000014708-156.dat upx behavioral1/memory/332-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015d79-164.dat upx behavioral1/files/0x0006000000015d87-172.dat upx behavioral1/files/0x0006000000015d8f-180.dat upx behavioral1/memory/2160-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015d9b-187.dat upx behavioral1/files/0x0006000000015e3a-197.dat upx behavioral1/memory/1040-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015eaf-207.dat upx behavioral1/memory/1716-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015f6d-217.dat upx behavioral1/memory/1836-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000015fe9-228.dat upx behavioral1/files/0x0006000000016117-236.dat upx behavioral1/files/0x00060000000161e7-245.dat upx behavioral1/memory/1544-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000600000001630b-254.dat upx behavioral1/memory/1316-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x00060000000164b2-263.dat upx behavioral1/files/0x0006000000016572-271.dat upx behavioral1/files/0x000600000001661c-280.dat upx behavioral1/memory/2028-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016843-288.dat upx behavioral1/memory/1584-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-348-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1616 1984 a78eb8c8ed59b6d1d26e62e38eb071d0_NeikiAnalytics.exe 28 PID 1984 wrote to memory of 1616 1984 a78eb8c8ed59b6d1d26e62e38eb071d0_NeikiAnalytics.exe 28 PID 1984 wrote to memory of 1616 1984 a78eb8c8ed59b6d1d26e62e38eb071d0_NeikiAnalytics.exe 28 PID 1984 wrote to memory of 1616 1984 a78eb8c8ed59b6d1d26e62e38eb071d0_NeikiAnalytics.exe 28 PID 1616 wrote to memory of 2544 1616 0848668.exe 29 PID 1616 wrote to memory of 2544 1616 0848668.exe 29 PID 1616 wrote to memory of 2544 1616 0848668.exe 29 PID 1616 wrote to memory of 2544 1616 0848668.exe 29 PID 2544 wrote to memory of 2596 2544 1flfxxr.exe 30 PID 2544 wrote to memory of 2596 2544 1flfxxr.exe 30 PID 2544 wrote to memory of 2596 2544 1flfxxr.exe 30 PID 2544 wrote to memory of 2596 2544 1flfxxr.exe 30 PID 2596 wrote to memory of 2652 2596 bnnnhb.exe 31 PID 2596 wrote to memory of 2652 2596 bnnnhb.exe 31 PID 2596 wrote to memory of 2652 2596 bnnnhb.exe 31 PID 2596 wrote to memory of 2652 2596 bnnnhb.exe 31 PID 2652 wrote to memory of 2608 2652 646080.exe 32 PID 2652 wrote to memory of 2608 2652 646080.exe 32 PID 2652 wrote to memory of 2608 2652 646080.exe 32 PID 2652 wrote to memory of 2608 2652 646080.exe 32 PID 2608 wrote to memory of 2476 2608 208262.exe 33 PID 2608 wrote to memory of 2476 2608 208262.exe 33 PID 2608 wrote to memory of 2476 2608 208262.exe 33 PID 2608 wrote to memory of 2476 2608 208262.exe 33 PID 2476 wrote to memory of 2676 2476 nhtthh.exe 34 PID 2476 wrote to memory of 2676 2476 nhtthh.exe 34 PID 2476 wrote to memory of 2676 2476 nhtthh.exe 34 PID 2476 wrote to memory of 2676 2476 nhtthh.exe 34 PID 2676 wrote to memory of 2500 2676 268800.exe 35 PID 2676 wrote to memory of 2500 2676 268800.exe 35 PID 2676 wrote to memory of 2500 2676 268800.exe 35 PID 2676 wrote to memory of 2500 2676 268800.exe 35 PID 2500 wrote to memory of 2912 2500 446288.exe 36 PID 2500 wrote to memory of 2912 2500 446288.exe 36 PID 2500 wrote to memory of 2912 2500 446288.exe 36 PID 2500 wrote to memory of 2912 2500 446288.exe 36 PID 2912 wrote to memory of 2240 2912 nnbhnh.exe 37 PID 2912 wrote to memory of 2240 2912 nnbhnh.exe 37 PID 2912 wrote to memory of 2240 2912 nnbhnh.exe 37 PID 2912 wrote to memory of 2240 2912 nnbhnh.exe 37 PID 2240 wrote to memory of 1520 2240 jdjdd.exe 38 PID 2240 wrote to memory of 1520 2240 jdjdd.exe 38 PID 2240 wrote to memory of 1520 2240 jdjdd.exe 38 PID 2240 wrote to memory of 1520 2240 jdjdd.exe 38 PID 1520 wrote to memory of 2752 1520 9jdjp.exe 39 PID 1520 wrote to memory of 2752 1520 9jdjp.exe 39 PID 1520 wrote to memory of 2752 1520 9jdjp.exe 39 PID 1520 wrote to memory of 2752 1520 9jdjp.exe 39 PID 2752 wrote to memory of 2848 2752 3pvvv.exe 40 PID 2752 wrote to memory of 2848 2752 3pvvv.exe 40 PID 2752 wrote to memory of 2848 2752 3pvvv.exe 40 PID 2752 wrote to memory of 2848 2752 3pvvv.exe 40 PID 2848 wrote to memory of 1768 2848 08064.exe 41 PID 2848 wrote to memory of 1768 2848 08064.exe 41 PID 2848 wrote to memory of 1768 2848 08064.exe 41 PID 2848 wrote to memory of 1768 2848 08064.exe 41 PID 1768 wrote to memory of 500 1768 frxrrxf.exe 42 PID 1768 wrote to memory of 500 1768 frxrrxf.exe 42 PID 1768 wrote to memory of 500 1768 frxrrxf.exe 42 PID 1768 wrote to memory of 500 1768 frxrrxf.exe 42 PID 500 wrote to memory of 1964 500 fxlrxxf.exe 43 PID 500 wrote to memory of 1964 500 fxlrxxf.exe 43 PID 500 wrote to memory of 1964 500 fxlrxxf.exe 43 PID 500 wrote to memory of 1964 500 fxlrxxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a78eb8c8ed59b6d1d26e62e38eb071d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a78eb8c8ed59b6d1d26e62e38eb071d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\0848668.exec:\0848668.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\1flfxxr.exec:\1flfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\bnnnhb.exec:\bnnnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\646080.exec:\646080.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\208262.exec:\208262.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\nhtthh.exec:\nhtthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\268800.exec:\268800.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\446288.exec:\446288.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\nnbhnh.exec:\nnbhnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\jdjdd.exec:\jdjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\9jdjp.exec:\9jdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\3pvvv.exec:\3pvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\08064.exec:\08064.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\frxrrxf.exec:\frxrrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
\??\c:\u644006.exec:\u644006.exe17⤵
- Executes dropped EXE
PID:1964 -
\??\c:\i462440.exec:\i462440.exe18⤵
- Executes dropped EXE
PID:332 -
\??\c:\tnbbnt.exec:\tnbbnt.exe19⤵
- Executes dropped EXE
PID:1336 -
\??\c:\08002.exec:\08002.exe20⤵
- Executes dropped EXE
PID:1948 -
\??\c:\pjvpp.exec:\pjvpp.exe21⤵
- Executes dropped EXE
PID:2160 -
\??\c:\6026824.exec:\6026824.exe22⤵
- Executes dropped EXE
PID:684 -
\??\c:\6462284.exec:\6462284.exe23⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vvjpp.exec:\vvjpp.exe24⤵
- Executes dropped EXE
PID:1716 -
\??\c:\608866.exec:\608866.exe25⤵
- Executes dropped EXE
PID:1836 -
\??\c:\htbbnn.exec:\htbbnn.exe26⤵
- Executes dropped EXE
PID:2112 -
\??\c:\s8008.exec:\s8008.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe28⤵
- Executes dropped EXE
PID:1064 -
\??\c:\ttnthh.exec:\ttnthh.exe29⤵
- Executes dropped EXE
PID:1316 -
\??\c:\g6846.exec:\g6846.exe30⤵
- Executes dropped EXE
PID:916 -
\??\c:\48662.exec:\48662.exe31⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dvjjv.exec:\dvjjv.exe32⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3pddv.exec:\3pddv.exe33⤵
- Executes dropped EXE
PID:1720 -
\??\c:\frxfxxf.exec:\frxfxxf.exe34⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nhnnbh.exec:\nhnnbh.exe35⤵
- Executes dropped EXE
PID:2332 -
\??\c:\48884.exec:\48884.exe36⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jdppv.exec:\jdppv.exe37⤵
- Executes dropped EXE
PID:2544 -
\??\c:\42002.exec:\42002.exe38⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jjjvj.exec:\jjjvj.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\thbttb.exec:\thbttb.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\042400.exec:\042400.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bttntt.exec:\bttntt.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pdppd.exec:\pdppd.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\20224.exec:\20224.exe44⤵
- Executes dropped EXE
PID:2472 -
\??\c:\42444.exec:\42444.exe45⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vjppp.exec:\vjppp.exe46⤵
- Executes dropped EXE
PID:2528 -
\??\c:\646284.exec:\646284.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fxrxlrr.exec:\fxrxlrr.exe48⤵
- Executes dropped EXE
PID:1268 -
\??\c:\424404.exec:\424404.exe49⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lfllrrx.exec:\lfllrrx.exe50⤵
- Executes dropped EXE
PID:776 -
\??\c:\fxrxrxf.exec:\fxrxrxf.exe51⤵
- Executes dropped EXE
PID:2740 -
\??\c:\c648040.exec:\c648040.exe52⤵
- Executes dropped EXE
PID:2348 -
\??\c:\860028.exec:\860028.exe53⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1tbbhn.exec:\1tbbhn.exe54⤵
- Executes dropped EXE
PID:1808 -
\??\c:\0246888.exec:\0246888.exe55⤵
- Executes dropped EXE
PID:1060 -
\??\c:\w86684.exec:\w86684.exe56⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5djjp.exec:\5djjp.exe57⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nhthnn.exec:\nhthnn.exe58⤵
- Executes dropped EXE
PID:908 -
\??\c:\0462844.exec:\0462844.exe59⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vvjjv.exec:\vvjjv.exe60⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nnbbhh.exec:\nnbbhh.exe61⤵
- Executes dropped EXE
PID:2816 -
\??\c:\btbbnn.exec:\btbbnn.exe62⤵
- Executes dropped EXE
PID:2548 -
\??\c:\3thbbh.exec:\3thbbh.exe63⤵
- Executes dropped EXE
PID:1052 -
\??\c:\k46200.exec:\k46200.exe64⤵
- Executes dropped EXE
PID:1624 -
\??\c:\i428840.exec:\i428840.exe65⤵
- Executes dropped EXE
PID:1112 -
\??\c:\264022.exec:\264022.exe66⤵PID:2180
-
\??\c:\888404.exec:\888404.exe67⤵PID:952
-
\??\c:\vpvdp.exec:\vpvdp.exe68⤵PID:1836
-
\??\c:\1lrlllr.exec:\1lrlllr.exe69⤵PID:1788
-
\??\c:\424426.exec:\424426.exe70⤵PID:288
-
\??\c:\dvddj.exec:\dvddj.exe71⤵PID:1404
-
\??\c:\04444.exec:\04444.exe72⤵PID:348
-
\??\c:\hbnhnn.exec:\hbnhnn.exe73⤵PID:904
-
\??\c:\3rlrxfl.exec:\3rlrxfl.exe74⤵PID:916
-
\??\c:\86446.exec:\86446.exe75⤵PID:1036
-
\??\c:\6082888.exec:\6082888.exe76⤵PID:2072
-
\??\c:\w20622.exec:\w20622.exe77⤵PID:2016
-
\??\c:\860624.exec:\860624.exe78⤵PID:1756
-
\??\c:\btbbnt.exec:\btbbnt.exe79⤵PID:1752
-
\??\c:\m6884.exec:\m6884.exe80⤵PID:2252
-
\??\c:\82464.exec:\82464.exe81⤵PID:2936
-
\??\c:\486244.exec:\486244.exe82⤵PID:1292
-
\??\c:\8240606.exec:\8240606.exe83⤵PID:1592
-
\??\c:\820688.exec:\820688.exe84⤵PID:2584
-
\??\c:\jdvdj.exec:\jdvdj.exe85⤵PID:2792
-
\??\c:\xrflxxx.exec:\xrflxxx.exe86⤵PID:2720
-
\??\c:\424066.exec:\424066.exe87⤵PID:2612
-
\??\c:\7rllffr.exec:\7rllffr.exe88⤵PID:2644
-
\??\c:\2028884.exec:\2028884.exe89⤵PID:2736
-
\??\c:\g0802.exec:\g0802.exe90⤵PID:2476
-
\??\c:\dvdvd.exec:\dvdvd.exe91⤵PID:1748
-
\??\c:\pdjjp.exec:\pdjjp.exe92⤵PID:2528
-
\??\c:\w42802.exec:\w42802.exe93⤵PID:2864
-
\??\c:\084848.exec:\084848.exe94⤵PID:2420
-
\??\c:\82402.exec:\82402.exe95⤵PID:1848
-
\??\c:\pdjjp.exec:\pdjjp.exe96⤵PID:1608
-
\??\c:\5nhhtn.exec:\5nhhtn.exe97⤵PID:2692
-
\??\c:\1nnntb.exec:\1nnntb.exe98⤵PID:2488
-
\??\c:\xrflrrf.exec:\xrflrrf.exe99⤵PID:2280
-
\??\c:\042800.exec:\042800.exe100⤵PID:2000
-
\??\c:\64006.exec:\64006.exe101⤵PID:1572
-
\??\c:\hbntbh.exec:\hbntbh.exe102⤵PID:704
-
\??\c:\a2224.exec:\a2224.exe103⤵PID:1812
-
\??\c:\xrfllrx.exec:\xrfllrx.exe104⤵PID:332
-
\??\c:\u262284.exec:\u262284.exe105⤵PID:1332
-
\??\c:\rlxfxfl.exec:\rlxfxfl.exe106⤵PID:2144
-
\??\c:\rrfflrl.exec:\rrfflrl.exe107⤵PID:1948
-
\??\c:\vpvdj.exec:\vpvdj.exe108⤵PID:2824
-
\??\c:\jdjjj.exec:\jdjjj.exe109⤵PID:992
-
\??\c:\xlfxlrx.exec:\xlfxlrx.exe110⤵PID:1740
-
\??\c:\424400.exec:\424400.exe111⤵PID:1040
-
\??\c:\bbnttb.exec:\bbnttb.exe112⤵PID:1684
-
\??\c:\pdppv.exec:\pdppv.exe113⤵PID:2400
-
\??\c:\tnhnbt.exec:\tnhnbt.exe114⤵PID:3028
-
\??\c:\dvjdj.exec:\dvjdj.exe115⤵PID:1460
-
\??\c:\dvjjp.exec:\dvjjp.exe116⤵PID:1760
-
\??\c:\ddpjj.exec:\ddpjj.exe117⤵PID:1016
-
\??\c:\c600224.exec:\c600224.exe118⤵PID:1904
-
\??\c:\046644.exec:\046644.exe119⤵PID:1308
-
\??\c:\5xfxxfl.exec:\5xfxxfl.exe120⤵PID:1500
-
\??\c:\426248.exec:\426248.exe121⤵PID:2020
-
\??\c:\2022228.exec:\2022228.exe122⤵PID:2004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-