Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 06:52
Behavioral task
behavioral1
Sample
b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe
-
Size
226KB
-
MD5
b5db5cb9cceb76898ade3123ac943d40
-
SHA1
8ac29c8be1e49e481afa9843880bdfa53eb0ec38
-
SHA256
c126a63b253799dedfd2c1c67b87ed7b66367df89e34828d01759fefeb8c0485
-
SHA512
d5b623e4198301806e35de7c6d4e1a49b0eca48d02950825638a4790c8f4affa18465536258399a6c9f99ea08ddf40538bb864a0bbd4a375c0f9bdbacac31deb
-
SSDEEP
6144:Jcm4FmowdHoS3dGmS4Z1hraHcpOaKHpaztyzl+SL:T4wFHoS3dJS4ZzeFaKHpCc7
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2184-11-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2192-8-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2092-28-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2548-41-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2660-37-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2696-55-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2800-66-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2512-74-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2432-83-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1992-100-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2788-108-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2588-119-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1344-135-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2296-151-0x00000000003C0000-0x00000000003F5000-memory.dmp family_blackmoon behavioral1/memory/2296-153-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/676-162-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2748-171-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2024-204-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2880-254-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1872-289-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/3000-291-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2484-303-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2592-310-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2668-324-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2792-343-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2688-356-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2936-369-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2448-382-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2448-389-0x0000000001B80000-0x0000000001BB5000-memory.dmp family_blackmoon behavioral1/memory/2964-396-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/540-434-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1968-545-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2400-648-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2580-661-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/312-817-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/312-824-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2164-1116-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2000-1117-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x00080000000122cd-5.dat family_berbew behavioral1/files/0x002d000000015eaf-18.dat family_berbew behavioral1/files/0x00080000000161e7-25.dat family_berbew behavioral1/files/0x000800000001630b-39.dat family_berbew behavioral1/files/0x0007000000016572-46.dat family_berbew behavioral1/files/0x000700000001661c-56.dat family_berbew behavioral1/files/0x0007000000016843-64.dat family_berbew behavioral1/files/0x0008000000016dbf-75.dat family_berbew behavioral1/files/0x0006000000016e94-82.dat family_berbew behavioral1/files/0x0006000000016eb2-91.dat family_berbew behavioral1/files/0x0006000000017052-98.dat family_berbew behavioral1/files/0x00060000000173d5-109.dat family_berbew behavioral1/files/0x00060000000173d8-116.dat family_berbew behavioral1/files/0x00060000000173e0-126.dat family_berbew behavioral1/files/0x0006000000017456-134.dat family_berbew behavioral1/files/0x002c000000015f6d-142.dat family_berbew behavioral1/memory/2296-151-0x00000000003C0000-0x00000000003F5000-memory.dmp family_berbew behavioral1/files/0x000600000001745e-152.dat family_berbew behavioral1/files/0x000600000001747d-160.dat family_berbew behavioral1/files/0x000600000001749c-169.dat family_berbew behavioral1/files/0x0006000000017556-179.dat family_berbew behavioral1/files/0x000900000001864e-186.dat family_berbew behavioral1/files/0x000500000001866b-195.dat family_berbew behavioral1/files/0x000500000001866d-203.dat family_berbew behavioral1/files/0x0005000000018778-212.dat family_berbew behavioral1/files/0x0006000000018c0a-219.dat family_berbew behavioral1/files/0x0006000000018c1a-230.dat family_berbew behavioral1/files/0x0006000000018f3a-237.dat family_berbew behavioral1/files/0x0006000000019021-245.dat family_berbew behavioral1/files/0x00060000000190b6-255.dat family_berbew behavioral1/files/0x00050000000191a7-263.dat family_berbew behavioral1/files/0x00050000000191cd-273.dat family_berbew behavioral1/files/0x00050000000191ed-281.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2184 40666.exe 2092 rlrxflr.exe 2660 0844062.exe 2548 s0244.exe 2696 rlxrxxl.exe 2800 646284.exe 2512 bththn.exe 2432 480066.exe 2452 tnbhnt.exe 1992 lrfrlll.exe 2788 7dppv.exe 2920 w80844.exe 2588 3fxrrxx.exe 1344 pjpjd.exe 2608 480682.exe 2296 7pddd.exe 676 bntnxx.exe 2748 rlrxrrx.exe 640 m2440.exe 2056 7jddj.exe 1188 c866884.exe 2024 bthnbb.exe 1984 3lxrxrf.exe 2264 3nnbhh.exe 1976 480688.exe 1356 68666.exe 816 8880824.exe 2880 pjddp.exe 1936 vjvdp.exe 2176 bnnhnh.exe 2328 8688426.exe 1872 q84222.exe 3000 6228668.exe 2484 20406.exe 2592 vpjdv.exe 3064 0800628.exe 2652 rlxxffl.exe 2668 3tbbbt.exe 2656 7vppv.exe 2824 pjddj.exe 2792 04280.exe 2688 lfrrffr.exe 768 02488.exe 2512 9rllllr.exe 2936 9dddj.exe 2148 2600840.exe 2448 20228.exe 2900 426404.exe 2964 jvdvv.exe 2576 028822.exe 632 jdjdv.exe 1656 u466606.exe 1536 jdjvp.exe 1640 0684484.exe 540 208028.exe 2128 fxlrlrx.exe 844 vjddj.exe 1628 vpddj.exe 1624 202844.exe 1160 1frxllx.exe 2040 vvppd.exe 1188 jdvvp.exe 2844 42802.exe 2348 nhbhbb.exe -
resource yara_rule behavioral1/memory/2192-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00080000000122cd-5.dat upx behavioral1/memory/2184-11-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2192-8-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x002d000000015eaf-18.dat upx behavioral1/memory/2092-19-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00080000000161e7-25.dat upx behavioral1/memory/2092-28-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2660-29-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2548-41-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000800000001630b-39.dat upx behavioral1/memory/2660-37-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0007000000016572-46.dat upx behavioral1/memory/2696-55-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000700000001661c-56.dat upx behavioral1/memory/2800-57-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0007000000016843-64.dat upx behavioral1/memory/2800-66-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0008000000016dbf-75.dat upx behavioral1/memory/2512-74-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2432-83-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000016e94-82.dat upx behavioral1/files/0x0006000000016eb2-91.dat upx behavioral1/files/0x0006000000017052-98.dat upx behavioral1/memory/1992-100-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00060000000173d5-109.dat upx behavioral1/memory/2788-108-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00060000000173d8-116.dat upx behavioral1/memory/2588-119-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00060000000173e0-126.dat upx behavioral1/files/0x0006000000017456-134.dat upx behavioral1/memory/1344-135-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x002c000000015f6d-142.dat upx behavioral1/memory/2296-153-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000600000001745e-152.dat upx behavioral1/memory/676-162-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000600000001747d-160.dat upx behavioral1/files/0x000600000001749c-169.dat upx behavioral1/memory/2748-171-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000017556-179.dat upx behavioral1/files/0x000900000001864e-186.dat upx behavioral1/files/0x000500000001866b-195.dat upx behavioral1/memory/2024-204-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x000500000001866d-203.dat upx behavioral1/files/0x0005000000018778-212.dat upx behavioral1/files/0x0006000000018c0a-219.dat upx behavioral1/files/0x0006000000018c1a-230.dat upx behavioral1/memory/1356-229-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x0006000000018f3a-237.dat upx behavioral1/files/0x0006000000019021-245.dat upx behavioral1/memory/2880-246-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2880-254-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/files/0x00060000000190b6-255.dat upx behavioral1/files/0x00050000000191a7-263.dat upx behavioral1/files/0x00050000000191cd-273.dat upx behavioral1/files/0x00050000000191ed-281.dat upx behavioral1/memory/1872-289-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3000-291-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2484-303-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2592-310-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2652-317-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2668-324-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2792-343-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2688-356-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2184 2192 b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe 28 PID 2192 wrote to memory of 2184 2192 b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe 28 PID 2192 wrote to memory of 2184 2192 b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe 28 PID 2192 wrote to memory of 2184 2192 b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe 28 PID 2184 wrote to memory of 2092 2184 40666.exe 29 PID 2184 wrote to memory of 2092 2184 40666.exe 29 PID 2184 wrote to memory of 2092 2184 40666.exe 29 PID 2184 wrote to memory of 2092 2184 40666.exe 29 PID 2092 wrote to memory of 2660 2092 rlrxflr.exe 30 PID 2092 wrote to memory of 2660 2092 rlrxflr.exe 30 PID 2092 wrote to memory of 2660 2092 rlrxflr.exe 30 PID 2092 wrote to memory of 2660 2092 rlrxflr.exe 30 PID 2660 wrote to memory of 2548 2660 0844062.exe 31 PID 2660 wrote to memory of 2548 2660 0844062.exe 31 PID 2660 wrote to memory of 2548 2660 0844062.exe 31 PID 2660 wrote to memory of 2548 2660 0844062.exe 31 PID 2548 wrote to memory of 2696 2548 s0244.exe 32 PID 2548 wrote to memory of 2696 2548 s0244.exe 32 PID 2548 wrote to memory of 2696 2548 s0244.exe 32 PID 2548 wrote to memory of 2696 2548 s0244.exe 32 PID 2696 wrote to memory of 2800 2696 rlxrxxl.exe 33 PID 2696 wrote to memory of 2800 2696 rlxrxxl.exe 33 PID 2696 wrote to memory of 2800 2696 rlxrxxl.exe 33 PID 2696 wrote to memory of 2800 2696 rlxrxxl.exe 33 PID 2800 wrote to memory of 2512 2800 646284.exe 34 PID 2800 wrote to memory of 2512 2800 646284.exe 34 PID 2800 wrote to memory of 2512 2800 646284.exe 34 PID 2800 wrote to memory of 2512 2800 646284.exe 34 PID 2512 wrote to memory of 2432 2512 bththn.exe 35 PID 2512 wrote to memory of 2432 2512 bththn.exe 35 PID 2512 wrote to memory of 2432 2512 bththn.exe 35 PID 2512 wrote to memory of 2432 2512 bththn.exe 35 PID 2432 wrote to memory of 2452 2432 480066.exe 36 PID 2432 wrote to memory of 2452 2432 480066.exe 36 PID 2432 wrote to memory of 2452 2432 480066.exe 36 PID 2432 wrote to memory of 2452 2432 480066.exe 36 PID 2452 wrote to memory of 1992 2452 tnbhnt.exe 37 PID 2452 wrote to memory of 1992 2452 tnbhnt.exe 37 PID 2452 wrote to memory of 1992 2452 tnbhnt.exe 37 PID 2452 wrote to memory of 1992 2452 tnbhnt.exe 37 PID 1992 wrote to memory of 2788 1992 lrfrlll.exe 38 PID 1992 wrote to memory of 2788 1992 lrfrlll.exe 38 PID 1992 wrote to memory of 2788 1992 lrfrlll.exe 38 PID 1992 wrote to memory of 2788 1992 lrfrlll.exe 38 PID 2788 wrote to memory of 2920 2788 7dppv.exe 39 PID 2788 wrote to memory of 2920 2788 7dppv.exe 39 PID 2788 wrote to memory of 2920 2788 7dppv.exe 39 PID 2788 wrote to memory of 2920 2788 7dppv.exe 39 PID 2920 wrote to memory of 2588 2920 w80844.exe 40 PID 2920 wrote to memory of 2588 2920 w80844.exe 40 PID 2920 wrote to memory of 2588 2920 w80844.exe 40 PID 2920 wrote to memory of 2588 2920 w80844.exe 40 PID 2588 wrote to memory of 1344 2588 3fxrrxx.exe 41 PID 2588 wrote to memory of 1344 2588 3fxrrxx.exe 41 PID 2588 wrote to memory of 1344 2588 3fxrrxx.exe 41 PID 2588 wrote to memory of 1344 2588 3fxrrxx.exe 41 PID 1344 wrote to memory of 2608 1344 pjpjd.exe 42 PID 1344 wrote to memory of 2608 1344 pjpjd.exe 42 PID 1344 wrote to memory of 2608 1344 pjpjd.exe 42 PID 1344 wrote to memory of 2608 1344 pjpjd.exe 42 PID 2608 wrote to memory of 2296 2608 480682.exe 43 PID 2608 wrote to memory of 2296 2608 480682.exe 43 PID 2608 wrote to memory of 2296 2608 480682.exe 43 PID 2608 wrote to memory of 2296 2608 480682.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b5db5cb9cceb76898ade3123ac943d40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\40666.exec:\40666.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\rlrxflr.exec:\rlrxflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\0844062.exec:\0844062.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\s0244.exec:\s0244.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\646284.exec:\646284.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bththn.exec:\bththn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\480066.exec:\480066.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\tnbhnt.exec:\tnbhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\lrfrlll.exec:\lrfrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\7dppv.exec:\7dppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\w80844.exec:\w80844.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\3fxrrxx.exec:\3fxrrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pjpjd.exec:\pjpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\480682.exec:\480682.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\7pddd.exec:\7pddd.exe17⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bntnxx.exec:\bntnxx.exe18⤵
- Executes dropped EXE
PID:676 -
\??\c:\rlrxrrx.exec:\rlrxrrx.exe19⤵
- Executes dropped EXE
PID:2748 -
\??\c:\m2440.exec:\m2440.exe20⤵
- Executes dropped EXE
PID:640 -
\??\c:\7jddj.exec:\7jddj.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\c866884.exec:\c866884.exe22⤵
- Executes dropped EXE
PID:1188 -
\??\c:\bthnbb.exec:\bthnbb.exe23⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3lxrxrf.exec:\3lxrxrf.exe24⤵
- Executes dropped EXE
PID:1984 -
\??\c:\3nnbhh.exec:\3nnbhh.exe25⤵
- Executes dropped EXE
PID:2264 -
\??\c:\480688.exec:\480688.exe26⤵
- Executes dropped EXE
PID:1976 -
\??\c:\68666.exec:\68666.exe27⤵
- Executes dropped EXE
PID:1356 -
\??\c:\8880824.exec:\8880824.exe28⤵
- Executes dropped EXE
PID:816 -
\??\c:\pjddp.exec:\pjddp.exe29⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vjvdp.exec:\vjvdp.exe30⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bnnhnh.exec:\bnnhnh.exe31⤵
- Executes dropped EXE
PID:2176 -
\??\c:\8688426.exec:\8688426.exe32⤵
- Executes dropped EXE
PID:2328 -
\??\c:\q84222.exec:\q84222.exe33⤵
- Executes dropped EXE
PID:1872 -
\??\c:\6228668.exec:\6228668.exe34⤵
- Executes dropped EXE
PID:3000 -
\??\c:\20406.exec:\20406.exe35⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpjdv.exec:\vpjdv.exe36⤵
- Executes dropped EXE
PID:2592 -
\??\c:\0800628.exec:\0800628.exe37⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rlxxffl.exec:\rlxxffl.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\3tbbbt.exec:\3tbbbt.exe39⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7vppv.exec:\7vppv.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pjddj.exec:\pjddj.exe41⤵
- Executes dropped EXE
PID:2824 -
\??\c:\04280.exec:\04280.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lfrrffr.exec:\lfrrffr.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\02488.exec:\02488.exe44⤵
- Executes dropped EXE
PID:768 -
\??\c:\9rllllr.exec:\9rllllr.exe45⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9dddj.exec:\9dddj.exe46⤵
- Executes dropped EXE
PID:2936 -
\??\c:\2600840.exec:\2600840.exe47⤵
- Executes dropped EXE
PID:2148 -
\??\c:\20228.exec:\20228.exe48⤵
- Executes dropped EXE
PID:2448 -
\??\c:\426404.exec:\426404.exe49⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jvdvv.exec:\jvdvv.exe50⤵
- Executes dropped EXE
PID:2964 -
\??\c:\028822.exec:\028822.exe51⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jdjdv.exec:\jdjdv.exe52⤵
- Executes dropped EXE
PID:632 -
\??\c:\u466606.exec:\u466606.exe53⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jdjvp.exec:\jdjvp.exe54⤵
- Executes dropped EXE
PID:1536 -
\??\c:\0684484.exec:\0684484.exe55⤵
- Executes dropped EXE
PID:1640 -
\??\c:\208028.exec:\208028.exe56⤵
- Executes dropped EXE
PID:540 -
\??\c:\fxlrlrx.exec:\fxlrlrx.exe57⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vjddj.exec:\vjddj.exe58⤵
- Executes dropped EXE
PID:844 -
\??\c:\vpddj.exec:\vpddj.exe59⤵
- Executes dropped EXE
PID:1628 -
\??\c:\202844.exec:\202844.exe60⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1frxllx.exec:\1frxllx.exe61⤵
- Executes dropped EXE
PID:1160 -
\??\c:\vvppd.exec:\vvppd.exe62⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jdvvp.exec:\jdvvp.exe63⤵
- Executes dropped EXE
PID:1188 -
\??\c:\42802.exec:\42802.exe64⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nhbhbb.exec:\nhbhbb.exe65⤵
- Executes dropped EXE
PID:2348 -
\??\c:\824066.exec:\824066.exe66⤵PID:1896
-
\??\c:\9vddj.exec:\9vddj.exe67⤵PID:3028
-
\??\c:\bnbhnh.exec:\bnbhnh.exe68⤵PID:1976
-
\??\c:\3bbbbn.exec:\3bbbbn.exe69⤵PID:1328
-
\??\c:\ttnbhb.exec:\ttnbhb.exe70⤵PID:808
-
\??\c:\w24444.exec:\w24444.exe71⤵PID:948
-
\??\c:\xrxffff.exec:\xrxffff.exe72⤵PID:312
-
\??\c:\0244284.exec:\0244284.exe73⤵PID:1968
-
\??\c:\nbnnnb.exec:\nbnnnb.exe74⤵PID:1104
-
\??\c:\9bnbtn.exec:\9bnbtn.exe75⤵PID:2868
-
\??\c:\pdpjj.exec:\pdpjj.exe76⤵PID:2860
-
\??\c:\ttthtn.exec:\ttthtn.exe77⤵PID:2320
-
\??\c:\8624448.exec:\8624448.exe78⤵PID:1716
-
\??\c:\e46448.exec:\e46448.exe79⤵PID:2216
-
\??\c:\00222.exec:\00222.exe80⤵PID:1604
-
\??\c:\9jppp.exec:\9jppp.exe81⤵PID:1996
-
\??\c:\s8628.exec:\s8628.exe82⤵PID:2504
-
\??\c:\dvjpv.exec:\dvjpv.exe83⤵PID:2652
-
\??\c:\fxflrlr.exec:\fxflrlr.exe84⤵PID:3068
-
\??\c:\486828.exec:\486828.exe85⤵PID:2524
-
\??\c:\8022206.exec:\8022206.exe86⤵PID:2440
-
\??\c:\084844.exec:\084844.exe87⤵PID:2456
-
\??\c:\a2002.exec:\a2002.exe88⤵PID:1520
-
\??\c:\7rlllfl.exec:\7rlllfl.exe89⤵PID:2400
-
\??\c:\a8066.exec:\a8066.exe90⤵PID:2464
-
\??\c:\tnhhhh.exec:\tnhhhh.exe91⤵PID:2580
-
\??\c:\c602444.exec:\c602444.exe92⤵PID:1664
-
\??\c:\680406.exec:\680406.exe93⤵PID:2788
-
\??\c:\486226.exec:\486226.exe94⤵PID:2628
-
\??\c:\6800600.exec:\6800600.exe95⤵PID:564
-
\??\c:\86600.exec:\86600.exe96⤵PID:2588
-
\??\c:\fxlfffl.exec:\fxlfffl.exe97⤵PID:1344
-
\??\c:\844460.exec:\844460.exe98⤵PID:2632
-
\??\c:\64222.exec:\64222.exe99⤵PID:1060
-
\??\c:\48826.exec:\48826.exe100⤵PID:2744
-
\??\c:\20284.exec:\20284.exe101⤵PID:676
-
\??\c:\lxllllr.exec:\lxllllr.exe102⤵PID:756
-
\??\c:\6468824.exec:\6468824.exe103⤵PID:852
-
\??\c:\u228222.exec:\u228222.exe104⤵PID:1132
-
\??\c:\a8668.exec:\a8668.exe105⤵PID:1672
-
\??\c:\1pppd.exec:\1pppd.exe106⤵PID:2040
-
\??\c:\q84826.exec:\q84826.exe107⤵PID:2340
-
\??\c:\nbnnbb.exec:\nbnnbb.exe108⤵PID:1948
-
\??\c:\3dppv.exec:\3dppv.exe109⤵PID:2348
-
\??\c:\xlxrrll.exec:\xlxrrll.exe110⤵PID:1896
-
\??\c:\8066284.exec:\8066284.exe111⤵PID:1396
-
\??\c:\48006.exec:\48006.exe112⤵PID:2820
-
\??\c:\w80244.exec:\w80244.exe113⤵PID:1816
-
\??\c:\i422884.exec:\i422884.exe114⤵PID:916
-
\??\c:\frxrrrx.exec:\frxrrrx.exe115⤵PID:948
-
\??\c:\vpjjp.exec:\vpjjp.exe116⤵PID:312
-
\??\c:\frfxfff.exec:\frfxfff.exe117⤵PID:2080
-
\??\c:\642622.exec:\642622.exe118⤵PID:1956
-
\??\c:\lfxlrxr.exec:\lfxlrxr.exe119⤵PID:2816
-
\??\c:\80408.exec:\80408.exe120⤵PID:1196
-
\??\c:\e64404.exec:\e64404.exe121⤵PID:2192
-
\??\c:\lfxxllx.exec:\lfxxllx.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-