Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:25
Behavioral task
behavioral1
Sample
d64692d61a03efb9d3f836f211f9b9f0_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
d64692d61a03efb9d3f836f211f9b9f0_NeikiAnalytics.exe
-
Size
294KB
-
MD5
d64692d61a03efb9d3f836f211f9b9f0
-
SHA1
b35d54915b9225686f44b4fad37d1e0aac1c3f4b
-
SHA256
38ae333826c44d95deb16e76acb94d31d19c677e4c23a8ad6c5c6bbb35e88833
-
SHA512
1d1725b2e5429dab45adc33dd0a227f797a5f098b3da41ae8266bcd42fe098c2880918233e8f0b4a0ccfe29ac1604801377dfcc14b07677291d69a31a8b54b43
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftOv:K4wFHoSQkuUHk1zBR/pMT9XvEhdfW
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/3036-11-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2148-9-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2640-21-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2688-31-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2748-46-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2524-56-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2508-73-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1584-92-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2476-102-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2856-110-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1364-127-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2288-137-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2844-154-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2980-162-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1788-172-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1548-181-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1728-223-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1540-246-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/900-255-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/556-264-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2868-273-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1428-290-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1496-305-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2648-318-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3032-325-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2752-346-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2492-353-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2548-372-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2580-430-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2176-445-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2704-606-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2828-673-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2024-715-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2996-817-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2756-885-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1720-1111-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2036-1125-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\rffrfrf.exe family_berbew C:\pdvvd.exe family_berbew \??\c:\tnthth.exe family_berbew \??\c:\nbnbht.exe family_berbew C:\vpdpd.exe family_berbew C:\9llxrxr.exe family_berbew C:\dpjdj.exe family_berbew C:\vvdvp.exe family_berbew C:\btbhtb.exe family_berbew C:\bnhhbt.exe family_berbew C:\9rxxffl.exe family_berbew C:\bnbbbn.exe family_berbew C:\jdpvj.exe family_berbew C:\xrxxllr.exe family_berbew C:\7hbhnn.exe family_berbew C:\7pddv.exe family_berbew C:\frrxrxf.exe family_berbew C:\bthhtb.exe family_berbew C:\1pddj.exe family_berbew C:\lfllxfl.exe family_berbew C:\jvppd.exe family_berbew \??\c:\rfxxffl.exe family_berbew C:\1httbh.exe family_berbew C:\dpdjv.exe family_berbew C:\lfxfrrf.exe family_berbew C:\frxxxrx.exe family_berbew C:\dvjjv.exe family_berbew C:\7rfxlrf.exe family_berbew C:\9bhnbh.exe family_berbew C:\7djjj.exe family_berbew C:\lflrxxl.exe family_berbew C:\nbtbhh.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
rffrfrf.exenbnbht.exetnthth.exepdvvd.exevpdpd.exe9llxrxr.exedpjdj.exevvdvp.exebtbhtb.exebnhhbt.exe9rxxffl.exebnbbbn.exejdpvj.exexrxxllr.exe7hbhnn.exe7pddv.exefrrxrxf.exebthhtb.exe1pddj.exelfllxfl.exejvppd.exerfxxffl.exe1httbh.exedpdjv.exelfxfrrf.exefrxxxrx.exedvjjv.exe7rfxlrf.exe9bhnbh.exe7djjj.exelflrxxl.exenbtbhh.exe1jdjp.exe3xxxlrr.exebbhhnh.exehbtbhb.exe3jpdd.exe7flflfl.exehbnnth.exevjppp.exepdpjp.exexrfxlrx.exebttbnb.exe7vjjp.exepjvjp.exelfffflr.exehbhhtt.exetnbhbh.exe5dpvv.exe7flrllx.exe9htthn.exebtbbhn.exedvjpd.exevjvvd.exelflffll.exethttbb.exevpdjp.exejdjdj.exe7lflrrx.exe5btbhn.exe9ppdp.exejdddj.exeffrrxff.exexlfxlrx.exepid process 3036 rffrfrf.exe 2640 nbnbht.exe 2688 tnthth.exe 2748 pdvvd.exe 2524 vpdpd.exe 2604 9llxrxr.exe 2508 dpjdj.exe 2964 vvdvp.exe 1584 btbhtb.exe 2476 bnhhbt.exe 2856 9rxxffl.exe 2376 bnbbbn.exe 1364 jdpvj.exe 2288 xrxxllr.exe 1900 7hbhnn.exe 2844 7pddv.exe 2980 frrxrxf.exe 1788 bthhtb.exe 1548 1pddj.exe 1748 lfllxfl.exe 2776 jvppd.exe 388 rfxxffl.exe 1072 1httbh.exe 2864 dpdjv.exe 1728 lfxfrrf.exe 1604 frxxxrx.exe 1540 dvjjv.exe 900 7rfxlrf.exe 556 9bhnbh.exe 2868 7djjj.exe 2932 lflrxxl.exe 1428 nbtbhh.exe 1888 1jdjp.exe 1536 3xxxlrr.exe 1496 bbhhnh.exe 2648 hbtbhb.exe 3032 3jpdd.exe 2744 7flflfl.exe 2712 hbnnth.exe 2748 vjppp.exe 2752 pdpjp.exe 2492 xrfxlrx.exe 2568 bttbnb.exe 2548 7vjjp.exe 3012 pjvjp.exe 1584 lfffflr.exe 2580 hbhhtt.exe 2476 tnbhbh.exe 2856 5dpvv.exe 1356 7flrllx.exe 1612 9htthn.exe 2420 btbbhn.exe 2288 dvjpd.exe 2452 vjvvd.exe 2176 lflffll.exe 352 thttbb.exe 1764 vpdjp.exe 2364 jdjdj.exe 308 7lflrrx.exe 2472 5btbhn.exe 2220 9ppdp.exe 2720 jdddj.exe 388 ffrrxff.exe 540 xlfxlrx.exe -
Processes:
resource yara_rule behavioral1/memory/2148-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rffrfrf.exe upx behavioral1/memory/3036-11-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2148-9-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2640-21-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2688-31-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pdvvd.exe upx \??\c:\tnthth.exe upx \??\c:\nbnbht.exe upx C:\vpdpd.exe upx behavioral1/memory/2748-46-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2524-47-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2524-56-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\9llxrxr.exe upx C:\dpjdj.exe upx C:\vvdvp.exe upx behavioral1/memory/2508-73-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\btbhtb.exe upx behavioral1/memory/1584-83-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bnhhbt.exe upx behavioral1/memory/2476-93-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1584-92-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\9rxxffl.exe upx behavioral1/memory/2476-102-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bnbbbn.exe upx behavioral1/memory/2856-110-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jdpvj.exe upx behavioral1/memory/1364-127-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xrxxllr.exe upx C:\7hbhnn.exe upx behavioral1/memory/2288-137-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\7pddv.exe upx C:\frrxrxf.exe upx behavioral1/memory/2844-154-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bthhtb.exe upx behavioral1/memory/2980-162-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\1pddj.exe upx behavioral1/memory/1788-172-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1548-181-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\lfllxfl.exe upx C:\jvppd.exe upx \??\c:\rfxxffl.exe upx C:\1httbh.exe upx C:\dpdjv.exe upx C:\lfxfrrf.exe upx behavioral1/memory/1728-223-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\frxxxrx.exe upx C:\dvjjv.exe upx behavioral1/memory/1540-246-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\7rfxlrf.exe upx C:\9bhnbh.exe upx behavioral1/memory/900-255-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\7djjj.exe upx behavioral1/memory/556-264-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2868-273-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\lflrxxl.exe upx C:\nbtbhh.exe upx behavioral1/memory/1428-290-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1888-291-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1496-305-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2648-311-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2648-318-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/3032-325-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2744-326-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d64692d61a03efb9d3f836f211f9b9f0_NeikiAnalytics.exerffrfrf.exenbnbht.exetnthth.exepdvvd.exevpdpd.exe9llxrxr.exedpjdj.exevvdvp.exebtbhtb.exebnhhbt.exe9rxxffl.exebnbbbn.exejdpvj.exexrxxllr.exe7hbhnn.exedescription pid process target process PID 2148 wrote to memory of 3036 2148 d64692d61a03efb9d3f836f211f9b9f0_NeikiAnalytics.exe rffrfrf.exe PID 2148 wrote to memory of 3036 2148 d64692d61a03efb9d3f836f211f9b9f0_NeikiAnalytics.exe rffrfrf.exe PID 2148 wrote to memory of 3036 2148 d64692d61a03efb9d3f836f211f9b9f0_NeikiAnalytics.exe rffrfrf.exe PID 2148 wrote to memory of 3036 2148 d64692d61a03efb9d3f836f211f9b9f0_NeikiAnalytics.exe rffrfrf.exe PID 3036 wrote to memory of 2640 3036 rffrfrf.exe nbnbht.exe PID 3036 wrote to memory of 2640 3036 rffrfrf.exe nbnbht.exe PID 3036 wrote to memory of 2640 3036 rffrfrf.exe nbnbht.exe PID 3036 wrote to memory of 2640 3036 rffrfrf.exe nbnbht.exe PID 2640 wrote to memory of 2688 2640 nbnbht.exe tnthth.exe PID 2640 wrote to memory of 2688 2640 nbnbht.exe tnthth.exe PID 2640 wrote to memory of 2688 2640 nbnbht.exe tnthth.exe PID 2640 wrote to memory of 2688 2640 nbnbht.exe tnthth.exe PID 2688 wrote to memory of 2748 2688 tnthth.exe pdvvd.exe PID 2688 wrote to memory of 2748 2688 tnthth.exe pdvvd.exe PID 2688 wrote to memory of 2748 2688 tnthth.exe pdvvd.exe PID 2688 wrote to memory of 2748 2688 tnthth.exe pdvvd.exe PID 2748 wrote to memory of 2524 2748 pdvvd.exe vpdpd.exe PID 2748 wrote to memory of 2524 2748 pdvvd.exe vpdpd.exe PID 2748 wrote to memory of 2524 2748 pdvvd.exe vpdpd.exe PID 2748 wrote to memory of 2524 2748 pdvvd.exe vpdpd.exe PID 2524 wrote to memory of 2604 2524 vpdpd.exe 9llxrxr.exe PID 2524 wrote to memory of 2604 2524 vpdpd.exe 9llxrxr.exe PID 2524 wrote to memory of 2604 2524 vpdpd.exe 9llxrxr.exe PID 2524 wrote to memory of 2604 2524 vpdpd.exe 9llxrxr.exe PID 2604 wrote to memory of 2508 2604 9llxrxr.exe dpjdj.exe PID 2604 wrote to memory of 2508 2604 9llxrxr.exe dpjdj.exe PID 2604 wrote to memory of 2508 2604 9llxrxr.exe dpjdj.exe PID 2604 wrote to memory of 2508 2604 9llxrxr.exe dpjdj.exe PID 2508 wrote to memory of 2964 2508 dpjdj.exe vvdvp.exe PID 2508 wrote to memory of 2964 2508 dpjdj.exe vvdvp.exe PID 2508 wrote to memory of 2964 2508 dpjdj.exe vvdvp.exe PID 2508 wrote to memory of 2964 2508 dpjdj.exe vvdvp.exe PID 2964 wrote to memory of 1584 2964 vvdvp.exe btbhtb.exe PID 2964 wrote to memory of 1584 2964 vvdvp.exe btbhtb.exe PID 2964 wrote to memory of 1584 2964 vvdvp.exe btbhtb.exe PID 2964 wrote to memory of 1584 2964 vvdvp.exe btbhtb.exe PID 1584 wrote to memory of 2476 1584 btbhtb.exe bnhhbt.exe PID 1584 wrote to memory of 2476 1584 btbhtb.exe bnhhbt.exe PID 1584 wrote to memory of 2476 1584 btbhtb.exe bnhhbt.exe PID 1584 wrote to memory of 2476 1584 btbhtb.exe bnhhbt.exe PID 2476 wrote to memory of 2856 2476 bnhhbt.exe 9rxxffl.exe PID 2476 wrote to memory of 2856 2476 bnhhbt.exe 9rxxffl.exe PID 2476 wrote to memory of 2856 2476 bnhhbt.exe 9rxxffl.exe PID 2476 wrote to memory of 2856 2476 bnhhbt.exe 9rxxffl.exe PID 2856 wrote to memory of 2376 2856 9rxxffl.exe bnbbbn.exe PID 2856 wrote to memory of 2376 2856 9rxxffl.exe bnbbbn.exe PID 2856 wrote to memory of 2376 2856 9rxxffl.exe bnbbbn.exe PID 2856 wrote to memory of 2376 2856 9rxxffl.exe bnbbbn.exe PID 2376 wrote to memory of 1364 2376 bnbbbn.exe jdpvj.exe PID 2376 wrote to memory of 1364 2376 bnbbbn.exe jdpvj.exe PID 2376 wrote to memory of 1364 2376 bnbbbn.exe jdpvj.exe PID 2376 wrote to memory of 1364 2376 bnbbbn.exe jdpvj.exe PID 1364 wrote to memory of 2288 1364 jdpvj.exe xrxxllr.exe PID 1364 wrote to memory of 2288 1364 jdpvj.exe xrxxllr.exe PID 1364 wrote to memory of 2288 1364 jdpvj.exe xrxxllr.exe PID 1364 wrote to memory of 2288 1364 jdpvj.exe xrxxllr.exe PID 2288 wrote to memory of 1900 2288 xrxxllr.exe 7hbhnn.exe PID 2288 wrote to memory of 1900 2288 xrxxllr.exe 7hbhnn.exe PID 2288 wrote to memory of 1900 2288 xrxxllr.exe 7hbhnn.exe PID 2288 wrote to memory of 1900 2288 xrxxllr.exe 7hbhnn.exe PID 1900 wrote to memory of 2844 1900 7hbhnn.exe 7pddv.exe PID 1900 wrote to memory of 2844 1900 7hbhnn.exe 7pddv.exe PID 1900 wrote to memory of 2844 1900 7hbhnn.exe 7pddv.exe PID 1900 wrote to memory of 2844 1900 7hbhnn.exe 7pddv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d64692d61a03efb9d3f836f211f9b9f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d64692d61a03efb9d3f836f211f9b9f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\rffrfrf.exec:\rffrfrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\nbnbht.exec:\nbnbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\tnthth.exec:\tnthth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pdvvd.exec:\pdvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vpdpd.exec:\vpdpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\9llxrxr.exec:\9llxrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\dpjdj.exec:\dpjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\vvdvp.exec:\vvdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\btbhtb.exec:\btbhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\bnhhbt.exec:\bnhhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\9rxxffl.exec:\9rxxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\bnbbbn.exec:\bnbbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\jdpvj.exec:\jdpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\xrxxllr.exec:\xrxxllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\7hbhnn.exec:\7hbhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\7pddv.exec:\7pddv.exe17⤵
- Executes dropped EXE
PID:2844 -
\??\c:\frrxrxf.exec:\frrxrxf.exe18⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bthhtb.exec:\bthhtb.exe19⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1pddj.exec:\1pddj.exe20⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lfllxfl.exec:\lfllxfl.exe21⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jvppd.exec:\jvppd.exe22⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rfxxffl.exec:\rfxxffl.exe23⤵
- Executes dropped EXE
PID:388 -
\??\c:\1httbh.exec:\1httbh.exe24⤵
- Executes dropped EXE
PID:1072 -
\??\c:\dpdjv.exec:\dpdjv.exe25⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe26⤵
- Executes dropped EXE
PID:1728 -
\??\c:\frxxxrx.exec:\frxxxrx.exe27⤵
- Executes dropped EXE
PID:1604 -
\??\c:\dvjjv.exec:\dvjjv.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7rfxlrf.exec:\7rfxlrf.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\9bhnbh.exec:\9bhnbh.exe30⤵
- Executes dropped EXE
PID:556 -
\??\c:\7djjj.exec:\7djjj.exe31⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lflrxxl.exec:\lflrxxl.exe32⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nbtbhh.exec:\nbtbhh.exe33⤵
- Executes dropped EXE
PID:1428 -
\??\c:\1jdjp.exec:\1jdjp.exe34⤵
- Executes dropped EXE
PID:1888 -
\??\c:\3xxxlrr.exec:\3xxxlrr.exe35⤵
- Executes dropped EXE
PID:1536 -
\??\c:\bbhhnh.exec:\bbhhnh.exe36⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hbtbhb.exec:\hbtbhb.exe37⤵
- Executes dropped EXE
PID:2648 -
\??\c:\3jpdd.exec:\3jpdd.exe38⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7flflfl.exec:\7flflfl.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hbnnth.exec:\hbnnth.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vjppp.exec:\vjppp.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pdpjp.exec:\pdpjp.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xrfxlrx.exec:\xrfxlrx.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bttbnb.exec:\bttbnb.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7vjjp.exec:\7vjjp.exe45⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pjvjp.exec:\pjvjp.exe46⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lfffflr.exec:\lfffflr.exe47⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hbhhtt.exec:\hbhhtt.exe48⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tnbhbh.exec:\tnbhbh.exe49⤵
- Executes dropped EXE
PID:2476 -
\??\c:\5dpvv.exec:\5dpvv.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7flrllx.exec:\7flrllx.exe51⤵
- Executes dropped EXE
PID:1356 -
\??\c:\9htthn.exec:\9htthn.exe52⤵
- Executes dropped EXE
PID:1612 -
\??\c:\btbbhn.exec:\btbbhn.exe53⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dvjpd.exec:\dvjpd.exe54⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vjvvd.exec:\vjvvd.exe55⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lflffll.exec:\lflffll.exe56⤵
- Executes dropped EXE
PID:2176 -
\??\c:\thttbb.exec:\thttbb.exe57⤵
- Executes dropped EXE
PID:352 -
\??\c:\vpdjp.exec:\vpdjp.exe58⤵
- Executes dropped EXE
PID:1764 -
\??\c:\jdjdj.exec:\jdjdj.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\7lflrrx.exec:\7lflrrx.exe60⤵
- Executes dropped EXE
PID:308 -
\??\c:\5btbhn.exec:\5btbhn.exe61⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9ppdp.exec:\9ppdp.exe62⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jdddj.exec:\jdddj.exe63⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ffrrxff.exec:\ffrrxff.exe64⤵
- Executes dropped EXE
PID:388 -
\??\c:\xlfxlrx.exec:\xlfxlrx.exe65⤵
- Executes dropped EXE
PID:540 -
\??\c:\bnbtbb.exec:\bnbtbb.exe66⤵PID:816
-
\??\c:\5tttbb.exec:\5tttbb.exe67⤵PID:1908
-
\??\c:\pjppv.exec:\pjppv.exe68⤵PID:1296
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe69⤵PID:1604
-
\??\c:\frxxfxf.exec:\frxxfxf.exe70⤵PID:1576
-
\??\c:\5ntbbb.exec:\5ntbbb.exe71⤵PID:944
-
\??\c:\tnttbb.exec:\tnttbb.exe72⤵PID:1636
-
\??\c:\dvpvd.exec:\dvpvd.exe73⤵PID:2432
-
\??\c:\lrfxrll.exec:\lrfxrll.exe74⤵PID:288
-
\??\c:\xlxlxxx.exec:\xlxlxxx.exe75⤵PID:848
-
\??\c:\tnnntt.exec:\tnnntt.exe76⤵PID:2920
-
\??\c:\htbhbn.exec:\htbhbn.exe77⤵PID:2060
-
\??\c:\3jddj.exec:\3jddj.exe78⤵PID:1640
-
\??\c:\jdpvj.exec:\jdpvj.exe79⤵PID:2640
-
\??\c:\rfxlrll.exec:\rfxlrll.exe80⤵PID:2688
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe81⤵PID:2704
-
\??\c:\btbhnn.exec:\btbhnn.exe82⤵PID:2608
-
\??\c:\3vpvv.exec:\3vpvv.exe83⤵PID:3064
-
\??\c:\9djvv.exec:\9djvv.exe84⤵PID:2512
-
\??\c:\frrxfrx.exec:\frrxfrx.exe85⤵PID:2748
-
\??\c:\hbhntt.exec:\hbhntt.exe86⤵PID:2520
-
\??\c:\bnbtbt.exec:\bnbtbt.exe87⤵PID:2492
-
\??\c:\dpdjv.exec:\dpdjv.exe88⤵PID:2332
-
\??\c:\9xxrrrl.exec:\9xxrrrl.exe89⤵PID:2548
-
\??\c:\frllrrx.exec:\frllrrx.exe90⤵PID:1816
-
\??\c:\bnbhtn.exec:\bnbhtn.exe91⤵PID:1584
-
\??\c:\jdvvj.exec:\jdvvj.exe92⤵PID:2828
-
\??\c:\9jvpp.exec:\9jvpp.exe93⤵PID:1284
-
\??\c:\lxlrlfl.exec:\lxlrlfl.exe94⤵PID:2856
-
\??\c:\9rrxllr.exec:\9rrxllr.exe95⤵PID:1272
-
\??\c:\bnbbbb.exec:\bnbbbb.exe96⤵PID:1612
-
\??\c:\hhthbt.exec:\hhthbt.exe97⤵PID:2160
-
\??\c:\5jpjj.exec:\5jpjj.exe98⤵PID:2288
-
\??\c:\9djdv.exec:\9djdv.exe99⤵PID:2024
-
\??\c:\llfrxxl.exec:\llfrxxl.exe100⤵PID:1020
-
\??\c:\tnttbb.exec:\tnttbb.exe101⤵PID:2188
-
\??\c:\bnbhtb.exec:\bnbhtb.exe102⤵PID:1788
-
\??\c:\5jdjv.exec:\5jdjv.exe103⤵PID:1456
-
\??\c:\jdddj.exec:\jdddj.exe104⤵PID:1548
-
\??\c:\xrffrlr.exec:\xrffrlr.exe105⤵PID:1684
-
\??\c:\hthntb.exec:\hthntb.exe106⤵PID:2776
-
\??\c:\hhtthh.exec:\hhtthh.exe107⤵PID:1416
-
\??\c:\pdppd.exec:\pdppd.exe108⤵PID:1404
-
\??\c:\1jvvj.exec:\1jvvj.exe109⤵PID:984
-
\??\c:\5lrrxxl.exec:\5lrrxxl.exe110⤵PID:2464
-
\??\c:\lffflxf.exec:\lffflxf.exe111⤵PID:1212
-
\??\c:\tttthh.exec:\tttthh.exe112⤵PID:1216
-
\??\c:\nhnbhh.exec:\nhnbhh.exe113⤵PID:1296
-
\??\c:\ddvdj.exec:\ddvdj.exe114⤵PID:956
-
\??\c:\rlrrffx.exec:\rlrrffx.exe115⤵PID:2996
-
\??\c:\rfxxlfr.exec:\rfxxlfr.exe116⤵PID:580
-
\??\c:\bntntn.exec:\bntntn.exe117⤵PID:2348
-
\??\c:\tttbtb.exec:\tttbtb.exe118⤵PID:2136
-
\??\c:\vpjvd.exec:\vpjvd.exe119⤵PID:884
-
\??\c:\rlxlrxx.exec:\rlxlrxx.exe120⤵PID:1556
-
\??\c:\7lllxxl.exec:\7lllxxl.exe121⤵PID:2148
-
\??\c:\tnhhbb.exec:\tnhhbb.exe122⤵PID:2352
-
\??\c:\thbbnn.exec:\thbbnn.exe123⤵PID:1496
-
\??\c:\vpvvj.exec:\vpvvj.exe124⤵PID:3056
-
\??\c:\jdppd.exec:\jdppd.exe125⤵PID:2724
-
\??\c:\xrfflfl.exec:\xrfflfl.exe126⤵PID:2756
-
\??\c:\hbtbhn.exec:\hbtbhn.exe127⤵PID:2516
-
\??\c:\7nbhnt.exec:\7nbhnt.exe128⤵PID:3008
-
\??\c:\dpjvj.exec:\dpjvj.exe129⤵PID:2656
-
\??\c:\ddvvd.exec:\ddvvd.exe130⤵PID:2660
-
\??\c:\rxlllxf.exec:\rxlllxf.exe131⤵PID:2960
-
\??\c:\nntnbt.exec:\nntnbt.exe132⤵PID:2492
-
\??\c:\9thhtt.exec:\9thhtt.exe133⤵PID:1344
-
\??\c:\dvdjp.exec:\dvdjp.exe134⤵PID:2548
-
\??\c:\7vjjj.exec:\7vjjj.exe135⤵PID:2592
-
\??\c:\9xxxxxf.exec:\9xxxxxf.exe136⤵PID:2116
-
\??\c:\lfrxffl.exec:\lfrxffl.exe137⤵PID:2784
-
\??\c:\tnhhhh.exec:\tnhhhh.exe138⤵PID:836
-
\??\c:\jdpvp.exec:\jdpvp.exe139⤵PID:1864
-
\??\c:\jdppd.exec:\jdppd.exe140⤵PID:1884
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe141⤵PID:1856
-
\??\c:\5hnbbn.exec:\5hnbbn.exe142⤵PID:1208
-
\??\c:\tnnbnb.exec:\tnnbnb.exe143⤵PID:1204
-
\??\c:\9vdjp.exec:\9vdjp.exe144⤵PID:2024
-
\??\c:\pjvdp.exec:\pjvdp.exe145⤵PID:2168
-
\??\c:\frffllr.exec:\frffllr.exe146⤵PID:1768
-
\??\c:\nhtbnn.exec:\nhtbnn.exe147⤵PID:1788
-
\??\c:\hbhhbt.exec:\hbhhbt.exe148⤵PID:1456
-
\??\c:\7jvdp.exec:\7jvdp.exe149⤵PID:1628
-
\??\c:\xrflrxf.exec:\xrflrxf.exe150⤵PID:2220
-
\??\c:\hbnnnn.exec:\hbnnnn.exe151⤵PID:320
-
\??\c:\dvjpd.exec:\dvjpd.exe152⤵PID:1416
-
\??\c:\lxlrfll.exec:\lxlrfll.exe153⤵PID:584
-
\??\c:\bbbhbh.exec:\bbbhbh.exe154⤵PID:984
-
\??\c:\jvddd.exec:\jvddd.exe155⤵PID:1544
-
\??\c:\jvvpp.exec:\jvvpp.exe156⤵PID:1212
-
\??\c:\frxrxrx.exec:\frxrxrx.exe157⤵PID:1216
-
\??\c:\3xlrxfl.exec:\3xlrxfl.exe158⤵PID:1296
-
\??\c:\bntbhh.exec:\bntbhh.exe159⤵PID:944
-
\??\c:\bttntn.exec:\bttntn.exe160⤵PID:1636
-
\??\c:\jvpjv.exec:\jvpjv.exe161⤵PID:1720
-
\??\c:\fxllrxf.exec:\fxllrxf.exe162⤵PID:2348
-
\??\c:\xrflxxf.exec:\xrflxxf.exe163⤵PID:1112
-
\??\c:\nhtntn.exec:\nhtntn.exe164⤵PID:2036
-
\??\c:\9pjpp.exec:\9pjpp.exe165⤵PID:2984
-
\??\c:\jdddp.exec:\jdddp.exe166⤵PID:2680
-
\??\c:\llxxlfr.exec:\llxxlfr.exe167⤵PID:1044
-
\??\c:\9fxxllr.exec:\9fxxllr.exe168⤵PID:2596
-
\??\c:\hbnnbb.exec:\hbnnbb.exe169⤵PID:3032
-
\??\c:\nhbtth.exec:\nhbtth.exe170⤵PID:2724
-
\??\c:\dpvpv.exec:\dpvpv.exe171⤵PID:2760
-
\??\c:\dpddj.exec:\dpddj.exe172⤵PID:2224
-
\??\c:\rlffxfl.exec:\rlffxfl.exe173⤵PID:2728
-
\??\c:\xrffrlr.exec:\xrffrlr.exe174⤵PID:2556
-
\??\c:\3ttthh.exec:\3ttthh.exe175⤵PID:2520
-
\??\c:\bbnttn.exec:\bbnttn.exe176⤵PID:2956
-
\??\c:\5pddd.exec:\5pddd.exe177⤵PID:1144
-
\??\c:\fxxrffl.exec:\fxxrffl.exe178⤵PID:1800
-
\??\c:\llflxxf.exec:\llflxxf.exe179⤵PID:1816
-
\??\c:\hbhntn.exec:\hbhntn.exe180⤵PID:1584
-
\??\c:\hbttbh.exec:\hbttbh.exe181⤵PID:2828
-
\??\c:\5jvvv.exec:\5jvvv.exe182⤵PID:1248
-
\??\c:\7pjdp.exec:\7pjdp.exe183⤵PID:844
-
\??\c:\lxrrflf.exec:\lxrrflf.exe184⤵PID:1444
-
\??\c:\hhtbbb.exec:\hhtbbb.exe185⤵PID:1588
-
\??\c:\9bhtnn.exec:\9bhtnn.exe186⤵PID:1148
-
\??\c:\dvddd.exec:\dvddd.exe187⤵PID:1348
-
\??\c:\vpddj.exec:\vpddj.exe188⤵PID:2948
-
\??\c:\5fxlxff.exec:\5fxlxff.exe189⤵PID:1808
-
\??\c:\tnnthh.exec:\tnnthh.exe190⤵PID:352
-
\??\c:\hhtntt.exec:\hhtntt.exe191⤵PID:2240
-
\??\c:\dvppd.exec:\dvppd.exe192⤵PID:2904
-
\??\c:\7djpp.exec:\7djpp.exe193⤵PID:1772
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe194⤵PID:2900
-
\??\c:\frlrxxf.exec:\frlrxxf.exe195⤵PID:1068
-
\??\c:\hhbtbn.exec:\hhbtbn.exe196⤵PID:1568
-
\??\c:\hhtbnn.exec:\hhtbnn.exe197⤵PID:1880
-
\??\c:\dvvjp.exec:\dvvjp.exe198⤵PID:2720
-
\??\c:\vpddp.exec:\vpddp.exe199⤵PID:340
-
\??\c:\rlrlllr.exec:\rlrlllr.exe200⤵PID:540
-
\??\c:\3ntnnh.exec:\3ntnnh.exe201⤵PID:2072
-
\??\c:\7hhntn.exec:\7hhntn.exe202⤵PID:804
-
\??\c:\9vppp.exec:\9vppp.exe203⤵PID:2248
-
\??\c:\dpdvj.exec:\dpdvj.exe204⤵PID:2404
-
\??\c:\5rllfxf.exec:\5rllfxf.exe205⤵PID:608
-
\??\c:\3rffflr.exec:\3rffflr.exe206⤵PID:2388
-
\??\c:\ttbntt.exec:\ttbntt.exe207⤵PID:580
-
\??\c:\nhthhn.exec:\nhthhn.exe208⤵PID:3004
-
\??\c:\1jpjp.exec:\1jpjp.exe209⤵PID:288
-
\??\c:\fxrfrxr.exec:\fxrfrxr.exe210⤵PID:1668
-
\??\c:\lxlrxfr.exec:\lxlrxfr.exe211⤵PID:1556
-
\??\c:\hbtbnn.exec:\hbtbnn.exe212⤵PID:2092
-
\??\c:\hbnnnn.exec:\hbnnnn.exe213⤵PID:2984
-
\??\c:\9ppvd.exec:\9ppvd.exe214⤵PID:2680
-
\??\c:\djvpj.exec:\djvpj.exe215⤵PID:3056
-
\??\c:\frfrfxf.exec:\frfrfxf.exe216⤵PID:2708
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe217⤵PID:3032
-
\??\c:\btbbbb.exec:\btbbbb.exe218⤵PID:2848
-
\??\c:\nthhtn.exec:\nthhtn.exe219⤵PID:2760
-
\??\c:\jdpdp.exec:\jdpdp.exe220⤵PID:2224
-
\??\c:\pdjdd.exec:\pdjdd.exe221⤵PID:2728
-
\??\c:\lxfxflx.exec:\lxfxflx.exe222⤵PID:2604
-
\??\c:\xrlrllx.exec:\xrlrllx.exe223⤵PID:2520
-
\??\c:\btbhhh.exec:\btbhhh.exe224⤵PID:2956
-
\??\c:\vjppp.exec:\vjppp.exe225⤵PID:1144
-
\??\c:\dvjpd.exec:\dvjpd.exe226⤵PID:1800
-
\??\c:\jvpjv.exec:\jvpjv.exe227⤵PID:1816
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe228⤵PID:2816
-
\??\c:\lfxxrlr.exec:\lfxxrlr.exe229⤵PID:2828
-
\??\c:\hhtbtb.exec:\hhtbtb.exe230⤵PID:1624
-
\??\c:\vpjpp.exec:\vpjpp.exe231⤵PID:844
-
\??\c:\jdppp.exec:\jdppp.exe232⤵PID:1612
-
\??\c:\lxllxxx.exec:\lxllxxx.exe233⤵PID:1588
-
\??\c:\fxllxxf.exec:\fxllxxf.exe234⤵PID:2420
-
\??\c:\htbbhn.exec:\htbbhn.exe235⤵PID:1348
-
\??\c:\nnbbnt.exec:\nnbbnt.exe236⤵PID:2980
-
\??\c:\9vvvv.exec:\9vvvv.exe237⤵PID:2588
-
\??\c:\fxrrfll.exec:\fxrrfll.exe238⤵PID:1768
-
\??\c:\rfrrxff.exec:\rfrrxff.exe239⤵PID:292
-
\??\c:\hbhbhn.exec:\hbhbhn.exe240⤵PID:2472
-
\??\c:\5bbtbh.exec:\5bbtbh.exe241⤵PID:1776
-
\??\c:\vjvvj.exec:\vjvvj.exe242⤵PID:2004