Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 19:41
Behavioral task
behavioral1
Sample
235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe
-
Size
293KB
-
MD5
235507aa5337ec878fa469519003aed0
-
SHA1
224fab2f9646c32b0c81afa3b3b95d4afc211a21
-
SHA256
f04a98632698e49d16c992dd6340521bae2cf7ea38ae67dd8be97fd480d85bdd
-
SHA512
1685155a98920dd76c43bbd7e009c5a63cd062b8fb2f26abc902b386403e8a3535b1d4c93dc915117b2fc80736fd5f361531d11eaca6133274c723d04892023c
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftOH:K4wFHoSQkuUHk1zBR/pMT9XvEhdfw
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/856-9-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1760-12-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/280-28-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2964-31-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2688-46-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2812-49-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2200-72-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2532-84-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2532-91-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/3056-100-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1560-132-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1364-143-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1460-154-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1956-170-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1548-178-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2948-204-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1512-223-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1048-238-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1056-242-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/288-256-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2232-265-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1884-275-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2860-284-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3040-332-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2772-352-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2628-359-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2888-366-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1628-385-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1772-410-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1364-430-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/540-493-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1188-500-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2772-626-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2904-653-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1188-781-0x0000000000440000-0x0000000000474000-memory.dmp family_blackmoon behavioral1/memory/2212-915-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2612-924-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1952-951-0x00000000001B0000-0x00000000001E4000-memory.dmp family_blackmoon behavioral1/memory/2788-964-0x00000000002E0000-0x0000000000314000-memory.dmp family_blackmoon behavioral1/memory/1700-990-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2856-1103-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000d0000000143fa-5.dat family_berbew behavioral1/files/0x0035000000014665-18.dat family_berbew behavioral1/files/0x0008000000014983-26.dat family_berbew behavioral1/files/0x00070000000149ea-36.dat family_berbew behavioral1/files/0x0007000000014b12-44.dat family_berbew behavioral1/files/0x0007000000014c25-54.dat family_berbew behavioral1/files/0x0007000000014e5a-63.dat family_berbew behavioral1/files/0x0008000000015ca5-73.dat family_berbew behavioral1/files/0x0006000000015cad-80.dat family_berbew behavioral1/files/0x0006000000015cb9-88.dat family_berbew behavioral1/files/0x0006000000015cc1-97.dat family_berbew behavioral1/files/0x0006000000015cca-107.dat family_berbew behavioral1/files/0x0006000000015cdb-117.dat family_berbew behavioral1/files/0x0006000000015cec-124.dat family_berbew behavioral1/files/0x0006000000015cf7-131.dat family_berbew behavioral1/files/0x0006000000015d06-142.dat family_berbew behavioral1/files/0x0006000000015d5d-152.dat family_berbew behavioral1/files/0x0006000000015d6e-161.dat family_berbew behavioral1/files/0x0006000000015f1b-168.dat family_berbew behavioral1/files/0x0006000000015f9e-179.dat family_berbew behavioral1/files/0x0006000000016056-186.dat family_berbew behavioral1/files/0x00060000000160f8-194.dat family_berbew behavioral1/files/0x0035000000014701-202.dat family_berbew behavioral1/files/0x0006000000016277-213.dat family_berbew behavioral1/files/0x0006000000016411-220.dat family_berbew behavioral1/files/0x0006000000016525-231.dat family_berbew behavioral1/files/0x0006000000016597-239.dat family_berbew behavioral1/files/0x00060000000167ef-248.dat family_berbew behavioral1/files/0x0006000000016a45-257.dat family_berbew behavioral1/files/0x0006000000016c17-266.dat family_berbew behavioral1/files/0x0006000000016c26-276.dat family_berbew behavioral1/files/0x0006000000016c2e-285.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1760 7vppj.exe 280 9vvdp.exe 2964 hbhtbh.exe 2688 vpdvd.exe 2812 btnbnh.exe 2572 hbnhht.exe 2200 5xxlrxf.exe 2512 5nhhnn.exe 2532 ppjjv.exe 3056 pjvvd.exe 2764 hnbntn.exe 2880 nhbthb.exe 2088 jpddj.exe 1560 fxxfrxf.exe 1364 3nbbnn.exe 776 5vjjp.exe 1460 xxlfxxr.exe 1956 bbbtnt.exe 1548 vpddp.exe 2084 5llxrfx.exe 1924 tnbbnt.exe 2948 ddjpv.exe 2256 xxrlxfx.exe 488 3nhtth.exe 1512 9jddv.exe 1048 rrlrlxl.exe 1056 nbnhhb.exe 288 dvjpv.exe 2232 ffxxlxf.exe 1884 9hbntb.exe 2860 jpdpd.exe 1808 fxfxrrl.exe 1264 hbnbht.exe 2328 nthtnt.exe 2744 jdvvj.exe 2796 5lxfrxl.exe 2636 hbnbnn.exe 3040 jdpvd.exe 2660 ppvpd.exe 2808 ffrfrff.exe 2772 frffrxx.exe 2628 nnthtt.exe 2200 1jdvj.exe 2888 ddppv.exe 2508 xxlxlxr.exe 2976 tthhtb.exe 1628 tttbtt.exe 2764 jdppv.exe 2248 5pdpp.exe 2276 3rrlllf.exe 1772 nnhntn.exe 1476 bbtttt.exe 1364 dvjvp.exe 1456 xxlrxxr.exe 2184 tbbtnh.exe 2288 nnhhth.exe 852 bnnhhn.exe 1776 1jjvj.exe 880 xrllxxl.exe 2828 ffxlrxl.exe 2836 1nnhth.exe 1748 hthtbn.exe 540 7djdj.exe 1188 rfxrfll.exe -
resource yara_rule behavioral1/memory/856-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000d0000000143fa-5.dat upx behavioral1/memory/856-9-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1760-12-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0035000000014665-18.dat upx behavioral1/memory/280-22-0x00000000001B0000-0x00000000001E4000-memory.dmp upx behavioral1/files/0x0008000000014983-26.dat upx behavioral1/memory/280-28-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2964-31-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00070000000149ea-36.dat upx behavioral1/files/0x0007000000014b12-44.dat upx behavioral1/memory/2688-46-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2812-49-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000014c25-54.dat upx behavioral1/memory/2572-56-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000014e5a-63.dat upx behavioral1/files/0x0008000000015ca5-73.dat upx behavioral1/memory/2200-72-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015cad-80.dat upx behavioral1/memory/2532-84-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015cb9-88.dat upx behavioral1/files/0x0006000000015cc1-97.dat upx behavioral1/memory/3056-100-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015cca-107.dat upx behavioral1/files/0x0006000000015cdb-117.dat upx behavioral1/files/0x0006000000015cec-124.dat upx behavioral1/memory/1560-132-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015cf7-131.dat upx behavioral1/files/0x0006000000015d06-142.dat upx behavioral1/memory/1364-143-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d5d-152.dat upx behavioral1/memory/1460-154-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d6e-161.dat upx behavioral1/memory/1956-170-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015f1b-168.dat upx behavioral1/memory/1548-178-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015f9e-179.dat upx behavioral1/files/0x0006000000016056-186.dat upx behavioral1/files/0x00060000000160f8-194.dat upx behavioral1/memory/2948-204-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0035000000014701-202.dat upx behavioral1/memory/2256-205-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016277-213.dat upx behavioral1/files/0x0006000000016411-220.dat upx behavioral1/memory/1512-223-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016525-231.dat upx behavioral1/memory/1048-238-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016597-239.dat upx behavioral1/memory/1056-242-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00060000000167ef-248.dat upx behavioral1/memory/288-256-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016a45-257.dat upx behavioral1/files/0x0006000000016c17-266.dat upx behavioral1/memory/2232-265-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1884-267-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1884-275-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016c26-276.dat upx behavioral1/files/0x0006000000016c2e-285.dat upx behavioral1/memory/2860-284-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2636-317-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/3040-332-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2772-345-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2772-352-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2628-359-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 856 wrote to memory of 1760 856 235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe 28 PID 856 wrote to memory of 1760 856 235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe 28 PID 856 wrote to memory of 1760 856 235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe 28 PID 856 wrote to memory of 1760 856 235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe 28 PID 1760 wrote to memory of 280 1760 7vppj.exe 29 PID 1760 wrote to memory of 280 1760 7vppj.exe 29 PID 1760 wrote to memory of 280 1760 7vppj.exe 29 PID 1760 wrote to memory of 280 1760 7vppj.exe 29 PID 280 wrote to memory of 2964 280 9vvdp.exe 30 PID 280 wrote to memory of 2964 280 9vvdp.exe 30 PID 280 wrote to memory of 2964 280 9vvdp.exe 30 PID 280 wrote to memory of 2964 280 9vvdp.exe 30 PID 2964 wrote to memory of 2688 2964 hbhtbh.exe 31 PID 2964 wrote to memory of 2688 2964 hbhtbh.exe 31 PID 2964 wrote to memory of 2688 2964 hbhtbh.exe 31 PID 2964 wrote to memory of 2688 2964 hbhtbh.exe 31 PID 2688 wrote to memory of 2812 2688 vpdvd.exe 32 PID 2688 wrote to memory of 2812 2688 vpdvd.exe 32 PID 2688 wrote to memory of 2812 2688 vpdvd.exe 32 PID 2688 wrote to memory of 2812 2688 vpdvd.exe 32 PID 2812 wrote to memory of 2572 2812 btnbnh.exe 33 PID 2812 wrote to memory of 2572 2812 btnbnh.exe 33 PID 2812 wrote to memory of 2572 2812 btnbnh.exe 33 PID 2812 wrote to memory of 2572 2812 btnbnh.exe 33 PID 2572 wrote to memory of 2200 2572 hbnhht.exe 34 PID 2572 wrote to memory of 2200 2572 hbnhht.exe 34 PID 2572 wrote to memory of 2200 2572 hbnhht.exe 34 PID 2572 wrote to memory of 2200 2572 hbnhht.exe 34 PID 2200 wrote to memory of 2512 2200 5xxlrxf.exe 35 PID 2200 wrote to memory of 2512 2200 5xxlrxf.exe 35 PID 2200 wrote to memory of 2512 2200 5xxlrxf.exe 35 PID 2200 wrote to memory of 2512 2200 5xxlrxf.exe 35 PID 2512 wrote to memory of 2532 2512 5nhhnn.exe 36 PID 2512 wrote to memory of 2532 2512 5nhhnn.exe 36 PID 2512 wrote to memory of 2532 2512 5nhhnn.exe 36 PID 2512 wrote to memory of 2532 2512 5nhhnn.exe 36 PID 2532 wrote to memory of 3056 2532 ppjjv.exe 37 PID 2532 wrote to memory of 3056 2532 ppjjv.exe 37 PID 2532 wrote to memory of 3056 2532 ppjjv.exe 37 PID 2532 wrote to memory of 3056 2532 ppjjv.exe 37 PID 3056 wrote to memory of 2764 3056 pjvvd.exe 38 PID 3056 wrote to memory of 2764 3056 pjvvd.exe 38 PID 3056 wrote to memory of 2764 3056 pjvvd.exe 38 PID 3056 wrote to memory of 2764 3056 pjvvd.exe 38 PID 2764 wrote to memory of 2880 2764 hnbntn.exe 39 PID 2764 wrote to memory of 2880 2764 hnbntn.exe 39 PID 2764 wrote to memory of 2880 2764 hnbntn.exe 39 PID 2764 wrote to memory of 2880 2764 hnbntn.exe 39 PID 2880 wrote to memory of 2088 2880 nhbthb.exe 40 PID 2880 wrote to memory of 2088 2880 nhbthb.exe 40 PID 2880 wrote to memory of 2088 2880 nhbthb.exe 40 PID 2880 wrote to memory of 2088 2880 nhbthb.exe 40 PID 2088 wrote to memory of 1560 2088 jpddj.exe 41 PID 2088 wrote to memory of 1560 2088 jpddj.exe 41 PID 2088 wrote to memory of 1560 2088 jpddj.exe 41 PID 2088 wrote to memory of 1560 2088 jpddj.exe 41 PID 1560 wrote to memory of 1364 1560 fxxfrxf.exe 42 PID 1560 wrote to memory of 1364 1560 fxxfrxf.exe 42 PID 1560 wrote to memory of 1364 1560 fxxfrxf.exe 42 PID 1560 wrote to memory of 1364 1560 fxxfrxf.exe 42 PID 1364 wrote to memory of 776 1364 3nbbnn.exe 43 PID 1364 wrote to memory of 776 1364 3nbbnn.exe 43 PID 1364 wrote to memory of 776 1364 3nbbnn.exe 43 PID 1364 wrote to memory of 776 1364 3nbbnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\235507aa5337ec878fa469519003aed0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\7vppj.exec:\7vppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\9vvdp.exec:\9vvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
\??\c:\hbhtbh.exec:\hbhtbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vpdvd.exec:\vpdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\btnbnh.exec:\btnbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\hbnhht.exec:\hbnhht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\5xxlrxf.exec:\5xxlrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\5nhhnn.exec:\5nhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\ppjjv.exec:\ppjjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\pjvvd.exec:\pjvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\hnbntn.exec:\hnbntn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\nhbthb.exec:\nhbthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\jpddj.exec:\jpddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\fxxfrxf.exec:\fxxfrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\3nbbnn.exec:\3nbbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\5vjjp.exec:\5vjjp.exe17⤵
- Executes dropped EXE
PID:776 -
\??\c:\xxlfxxr.exec:\xxlfxxr.exe18⤵
- Executes dropped EXE
PID:1460 -
\??\c:\bbbtnt.exec:\bbbtnt.exe19⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vpddp.exec:\vpddp.exe20⤵
- Executes dropped EXE
PID:1548 -
\??\c:\5llxrfx.exec:\5llxrfx.exe21⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tnbbnt.exec:\tnbbnt.exe22⤵
- Executes dropped EXE
PID:1924 -
\??\c:\ddjpv.exec:\ddjpv.exe23⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xxrlxfx.exec:\xxrlxfx.exe24⤵
- Executes dropped EXE
PID:2256 -
\??\c:\3nhtth.exec:\3nhtth.exe25⤵
- Executes dropped EXE
PID:488 -
\??\c:\9jddv.exec:\9jddv.exe26⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rrlrlxl.exec:\rrlrlxl.exe27⤵
- Executes dropped EXE
PID:1048 -
\??\c:\nbnhhb.exec:\nbnhhb.exe28⤵
- Executes dropped EXE
PID:1056 -
\??\c:\dvjpv.exec:\dvjpv.exe29⤵
- Executes dropped EXE
PID:288 -
\??\c:\ffxxlxf.exec:\ffxxlxf.exe30⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9hbntb.exec:\9hbntb.exe31⤵
- Executes dropped EXE
PID:1884 -
\??\c:\jpdpd.exec:\jpdpd.exe32⤵
- Executes dropped EXE
PID:2860 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe33⤵
- Executes dropped EXE
PID:1808 -
\??\c:\hbnbht.exec:\hbnbht.exe34⤵
- Executes dropped EXE
PID:1264 -
\??\c:\nthtnt.exec:\nthtnt.exe35⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jdvvj.exec:\jdvvj.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\5lxfrxl.exec:\5lxfrxl.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hbnbnn.exec:\hbnbnn.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jdpvd.exec:\jdpvd.exe39⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ppvpd.exec:\ppvpd.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\ffrfrff.exec:\ffrfrff.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\frffrxx.exec:\frffrxx.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nnthtt.exec:\nnthtt.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1jdvj.exec:\1jdvj.exe44⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ddppv.exec:\ddppv.exe45⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xxlxlxr.exec:\xxlxlxr.exe46⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tthhtb.exec:\tthhtb.exe47⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tttbtt.exec:\tttbtt.exe48⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jdppv.exec:\jdppv.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5pdpp.exec:\5pdpp.exe50⤵
- Executes dropped EXE
PID:2248 -
\??\c:\3rrlllf.exec:\3rrlllf.exe51⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nnhntn.exec:\nnhntn.exe52⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bbtttt.exec:\bbtttt.exe53⤵
- Executes dropped EXE
PID:1476 -
\??\c:\dvjvp.exec:\dvjvp.exe54⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xxlrxxr.exec:\xxlrxxr.exe55⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tbbtnh.exec:\tbbtnh.exe56⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nnhhth.exec:\nnhhth.exe57⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bnnhhn.exec:\bnnhhn.exe58⤵
- Executes dropped EXE
PID:852 -
\??\c:\1jjvj.exec:\1jjvj.exe59⤵
- Executes dropped EXE
PID:1776 -
\??\c:\xrllxxl.exec:\xrllxxl.exe60⤵
- Executes dropped EXE
PID:880 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe61⤵
- Executes dropped EXE
PID:2828 -
\??\c:\1nnhth.exec:\1nnhth.exe62⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hthtbn.exec:\hthtbn.exe63⤵
- Executes dropped EXE
PID:1748 -
\??\c:\7djdj.exec:\7djdj.exe64⤵
- Executes dropped EXE
PID:540 -
\??\c:\rfxrfll.exec:\rfxrfll.exe65⤵
- Executes dropped EXE
PID:1188 -
\??\c:\xxrxfrx.exec:\xxrxfrx.exe66⤵PID:804
-
\??\c:\hhbnbh.exec:\hhbnbh.exe67⤵PID:1372
-
\??\c:\bttbnn.exec:\bttbnn.exe68⤵PID:3064
-
\??\c:\jjvvj.exec:\jjvvj.exe69⤵PID:1848
-
\??\c:\3lfrxxl.exec:\3lfrxxl.exe70⤵PID:1176
-
\??\c:\xxflflx.exec:\xxflflx.exe71⤵PID:380
-
\??\c:\nhnnbb.exec:\nhnnbb.exe72⤵PID:1288
-
\??\c:\bnhhnn.exec:\bnhhnn.exe73⤵PID:2380
-
\??\c:\dvjvd.exec:\dvjvd.exe74⤵PID:912
-
\??\c:\vpjdj.exec:\vpjdj.exe75⤵PID:1724
-
\??\c:\1xxrxlx.exec:\1xxrxlx.exe76⤵PID:1524
-
\??\c:\5bhnhh.exec:\5bhnhh.exe77⤵PID:1732
-
\??\c:\tnthbh.exec:\tnthbh.exe78⤵PID:2536
-
\??\c:\pjpvj.exec:\pjpvj.exe79⤵PID:2328
-
\??\c:\1pvjp.exec:\1pvjp.exe80⤵PID:2104
-
\??\c:\1xffflr.exec:\1xffflr.exe81⤵PID:2596
-
\??\c:\hhbhtb.exec:\hhbhtb.exe82⤵PID:2612
-
\??\c:\nnbhtt.exec:\nnbhtt.exe83⤵PID:2740
-
\??\c:\9jjjv.exec:\9jjjv.exe84⤵PID:2464
-
\??\c:\9dpvj.exec:\9dpvj.exe85⤵PID:1332
-
\??\c:\frlrxxl.exec:\frlrxxl.exe86⤵PID:2772
-
\??\c:\9llxxrr.exec:\9llxxrr.exe87⤵PID:2628
-
\??\c:\bttthn.exec:\bttthn.exe88⤵PID:2460
-
\??\c:\nthhbb.exec:\nthhbb.exe89⤵PID:2904
-
\??\c:\jdpvj.exec:\jdpvj.exe90⤵PID:1996
-
\??\c:\jdppd.exec:\jdppd.exe91⤵PID:2776
-
\??\c:\xrflxlr.exec:\xrflxlr.exe92⤵PID:1628
-
\??\c:\7lllxrf.exec:\7lllxrf.exe93⤵PID:1304
-
\??\c:\nhhtbb.exec:\nhhtbb.exe94⤵PID:1656
-
\??\c:\jjvpj.exec:\jjvpj.exe95⤵PID:2276
-
\??\c:\vjppp.exec:\vjppp.exe96⤵PID:2304
-
\??\c:\1lxrxxf.exec:\1lxrxxf.exe97⤵PID:1704
-
\??\c:\ffxfrfr.exec:\ffxfrfr.exe98⤵PID:784
-
\??\c:\tnhntt.exec:\tnhntt.exe99⤵PID:2724
-
\??\c:\nnnnhn.exec:\nnnnhn.exe100⤵PID:1636
-
\??\c:\ppvdj.exec:\ppvdj.exe101⤵PID:1540
-
\??\c:\rllrffr.exec:\rllrffr.exe102⤵PID:852
-
\??\c:\fllxlll.exec:\fllxlll.exe103⤵PID:2052
-
\??\c:\tntbhn.exec:\tntbhn.exe104⤵PID:2084
-
\??\c:\pjvvp.exec:\pjvvp.exe105⤵PID:2756
-
\??\c:\dpjjj.exec:\dpjjj.exe106⤵PID:2836
-
\??\c:\ddvpv.exec:\ddvpv.exe107⤵PID:2256
-
\??\c:\rlxlxrf.exec:\rlxlxrf.exe108⤵PID:688
-
\??\c:\nhttbb.exec:\nhttbb.exe109⤵PID:1188
-
\??\c:\tnbbnh.exec:\tnbbnh.exe110⤵PID:488
-
\??\c:\pjvjv.exec:\pjvjv.exe111⤵PID:1372
-
\??\c:\jjjdp.exec:\jjjdp.exe112⤵PID:2852
-
\??\c:\rlllfxx.exec:\rlllfxx.exe113⤵PID:1848
-
\??\c:\7hthnn.exec:\7hthnn.exe114⤵PID:2120
-
\??\c:\5htttt.exec:\5htttt.exe115⤵PID:2844
-
\??\c:\7dddj.exec:\7dddj.exe116⤵PID:2856
-
\??\c:\rlxxrrf.exec:\rlxxrrf.exe117⤵PID:1884
-
\??\c:\9lxfrxf.exec:\9lxfrxf.exe118⤵PID:3036
-
\??\c:\hbtthh.exec:\hbtthh.exe119⤵PID:1620
-
\??\c:\1bhnht.exec:\1bhnht.exe120⤵PID:1764
-
\??\c:\jdpdj.exec:\jdpdj.exe121⤵PID:2908
-
\??\c:\lffrflr.exec:\lffrflr.exe122⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-