Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 13:37
Behavioral task
behavioral1
Sample
46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe
-
Size
192KB
-
MD5
46504a4858501ee927f12bfe18c203c0
-
SHA1
51503b70a345f3acecc7ecf932d267b43ebc5ed0
-
SHA256
f953e6765ad7f9418587f3a0afe8c452827ff7839916dff17ffafd6c22b67b6e
-
SHA512
57cccca415734d3351cf86364d17f3c18385a8debb7c9cac1fe593eb428edcd4be390b4ea1ffba1ba86845135a60b83eadefb217f96fabfd447eaa920bf91ddd
-
SSDEEP
3072:FhOmTsF93UYfwC6GIoutrVCfMoh52waAyiJ8mqtbfUVKty16hDsI/tSa0:Fcm4FmowdHoS8fMoSVAHubPtyYxfP0
Malware Config
Signatures
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/2200-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2276-9-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1916-21-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2628-36-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2532-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2568-49-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2484-81-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3064-89-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/280-124-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1604-133-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/752-141-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2312-159-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2712-169-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1108-186-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/304-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1656-213-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1800-253-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2788-257-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3008-271-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1932-289-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1940-303-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2980-317-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2908-329-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2936-336-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3060-382-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/828-395-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1272-402-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1612-427-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1732-495-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1744-528-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/568-550-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2060-599-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2032-751-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/960-842-0x00000000002A0000-0x00000000002D6000-memory.dmp family_blackmoon behavioral1/memory/1680-1098-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000d00000001232c-5.dat family_berbew behavioral1/files/0x0032000000013a6e-19.dat family_berbew behavioral1/files/0x0008000000014186-27.dat family_berbew behavioral1/files/0x0007000000014207-37.dat family_berbew behavioral1/files/0x0007000000014228-45.dat family_berbew behavioral1/files/0x0007000000014246-56.dat family_berbew behavioral1/files/0x0007000000014312-63.dat family_berbew behavioral1/files/0x0008000000014a9a-71.dat family_berbew behavioral1/files/0x0006000000014b18-79.dat family_berbew behavioral1/files/0x0006000000014b4c-90.dat family_berbew behavioral1/files/0x0006000000014bbc-97.dat family_berbew behavioral1/files/0x0006000000014e71-106.dat family_berbew behavioral1/files/0x0006000000014fa2-114.dat family_berbew behavioral1/files/0x000600000001535e-123.dat family_berbew behavioral1/files/0x000600000001564f-131.dat family_berbew behavioral1/files/0x0006000000015653-142.dat family_berbew behavioral1/files/0x000600000001565d-149.dat family_berbew behavioral1/files/0x0006000000015677-157.dat family_berbew behavioral1/files/0x0006000000015684-168.dat family_berbew behavioral1/files/0x0006000000015c87-177.dat family_berbew behavioral1/files/0x0006000000015c9e-184.dat family_berbew behavioral1/files/0x0006000000015cae-194.dat family_berbew behavioral1/files/0x0006000000015cb6-202.dat family_berbew behavioral1/files/0x0006000000015ccd-211.dat family_berbew behavioral1/files/0x0032000000013a84-220.dat family_berbew behavioral1/files/0x0006000000015cd9-228.dat family_berbew behavioral1/files/0x0006000000015ce3-237.dat family_berbew behavioral1/files/0x0006000000015cff-245.dat family_berbew behavioral1/files/0x0006000000015d20-254.dat family_berbew behavioral1/files/0x0006000000015d42-263.dat family_berbew behavioral1/files/0x0006000000015d4e-272.dat family_berbew behavioral1/files/0x0006000000015d56-280.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2200 ppvjj.exe 1916 7lrxrrx.exe 2628 1flfrxl.exe 2532 dvpvj.exe 2568 lfxflrf.exe 2544 ntbnnb.exe 2412 vvvpd.exe 2484 5rfxrrf.exe 3064 btbbnt.exe 1620 pvvvv.exe 852 9lllrrx.exe 2660 7frrfxl.exe 280 tnbntb.exe 1604 vvpdp.exe 752 xrlrflr.exe 1236 bbbhtt.exe 2312 3dvjp.exe 2712 9fffrrr.exe 2948 hbttbt.exe 1108 3dvvv.exe 580 xrfrrrf.exe 1788 1nhtbn.exe 304 5ddjd.exe 1656 7pdpj.exe 2376 xrrfxfx.exe 2916 hbnnth.exe 1708 jpdpj.exe 1800 3lflrxf.exe 2788 5thntt.exe 3008 jdpdd.exe 1848 rlffrrx.exe 2256 hnhhbb.exe 1932 7dppv.exe 1940 rlxxxrf.exe 2276 9tbhtt.exe 2592 bbtbnt.exe 2980 7dvvj.exe 2908 fllxfxx.exe 2936 hhtbtt.exe 2564 vdvjd.exe 1948 llfflxf.exe 2752 bhnhnh.exe 2644 nttbnt.exe 2424 vpvdj.exe 2404 flxlfxf.exe 3060 xxrfxlr.exe 2452 hhbhth.exe 828 5vpdj.exe 1272 1rxfrxl.exe 852 9rxrxxx.exe 2328 btnnbh.exe 1588 jjdjv.exe 1612 ppjjp.exe 1604 ffxlrfl.exe 752 bnntbh.exe 2308 hthbbt.exe 1684 1pjpv.exe 2020 rfrllff.exe 2712 rflllfr.exe 2212 bnhbnb.exe 2228 nhtbbh.exe 1912 pdppd.exe 2724 ppvvj.exe 1732 rxlrxrf.exe -
resource yara_rule behavioral1/memory/2276-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000d00000001232c-5.dat upx behavioral1/memory/2200-12-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2276-9-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1916-21-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0032000000013a6e-19.dat upx behavioral1/memory/1916-23-0x00000000001B0000-0x00000000001E6000-memory.dmp upx behavioral1/files/0x0008000000014186-27.dat upx behavioral1/memory/2628-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000014207-37.dat upx behavioral1/memory/2532-38-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000014228-45.dat upx behavioral1/memory/2532-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2568-49-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000014246-56.dat upx behavioral1/files/0x0007000000014312-63.dat upx behavioral1/files/0x0008000000014a9a-71.dat upx behavioral1/files/0x0006000000014b18-79.dat upx behavioral1/memory/2484-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014b4c-90.dat upx behavioral1/memory/3064-89-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014bbc-97.dat upx behavioral1/files/0x0006000000014e71-106.dat upx behavioral1/memory/2660-108-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000014fa2-114.dat upx behavioral1/files/0x000600000001535e-123.dat upx behavioral1/memory/280-124-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000600000001564f-131.dat upx behavioral1/memory/1604-133-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/752-141-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015653-142.dat upx behavioral1/files/0x000600000001565d-149.dat upx behavioral1/memory/2312-159-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015677-157.dat upx behavioral1/memory/2712-167-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/memory/2712-169-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015684-168.dat upx behavioral1/files/0x0006000000015c87-177.dat upx behavioral1/files/0x0006000000015c9e-184.dat upx behavioral1/memory/1108-186-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015cae-194.dat upx behavioral1/files/0x0006000000015cb6-202.dat upx behavioral1/memory/304-204-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015ccd-211.dat upx behavioral1/memory/1656-213-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0032000000013a84-220.dat upx behavioral1/files/0x0006000000015cd9-228.dat upx behavioral1/memory/2916-229-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015ce3-237.dat upx behavioral1/files/0x0006000000015cff-245.dat upx behavioral1/memory/1800-253-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015d20-254.dat upx behavioral1/memory/2788-257-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015d42-263.dat upx behavioral1/memory/3008-271-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000015d4e-272.dat upx behavioral1/files/0x0006000000015d56-280.dat upx behavioral1/memory/2256-282-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1932-289-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1940-296-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1940-303-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2980-317-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2908-329-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2936-336-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2200 2276 46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe 28 PID 2276 wrote to memory of 2200 2276 46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe 28 PID 2276 wrote to memory of 2200 2276 46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe 28 PID 2276 wrote to memory of 2200 2276 46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe 28 PID 2200 wrote to memory of 1916 2200 ppvjj.exe 29 PID 2200 wrote to memory of 1916 2200 ppvjj.exe 29 PID 2200 wrote to memory of 1916 2200 ppvjj.exe 29 PID 2200 wrote to memory of 1916 2200 ppvjj.exe 29 PID 1916 wrote to memory of 2628 1916 7lrxrrx.exe 30 PID 1916 wrote to memory of 2628 1916 7lrxrrx.exe 30 PID 1916 wrote to memory of 2628 1916 7lrxrrx.exe 30 PID 1916 wrote to memory of 2628 1916 7lrxrrx.exe 30 PID 2628 wrote to memory of 2532 2628 1flfrxl.exe 31 PID 2628 wrote to memory of 2532 2628 1flfrxl.exe 31 PID 2628 wrote to memory of 2532 2628 1flfrxl.exe 31 PID 2628 wrote to memory of 2532 2628 1flfrxl.exe 31 PID 2532 wrote to memory of 2568 2532 dvpvj.exe 32 PID 2532 wrote to memory of 2568 2532 dvpvj.exe 32 PID 2532 wrote to memory of 2568 2532 dvpvj.exe 32 PID 2532 wrote to memory of 2568 2532 dvpvj.exe 32 PID 2568 wrote to memory of 2544 2568 lfxflrf.exe 33 PID 2568 wrote to memory of 2544 2568 lfxflrf.exe 33 PID 2568 wrote to memory of 2544 2568 lfxflrf.exe 33 PID 2568 wrote to memory of 2544 2568 lfxflrf.exe 33 PID 2544 wrote to memory of 2412 2544 ntbnnb.exe 34 PID 2544 wrote to memory of 2412 2544 ntbnnb.exe 34 PID 2544 wrote to memory of 2412 2544 ntbnnb.exe 34 PID 2544 wrote to memory of 2412 2544 ntbnnb.exe 34 PID 2412 wrote to memory of 2484 2412 vvvpd.exe 35 PID 2412 wrote to memory of 2484 2412 vvvpd.exe 35 PID 2412 wrote to memory of 2484 2412 vvvpd.exe 35 PID 2412 wrote to memory of 2484 2412 vvvpd.exe 35 PID 2484 wrote to memory of 3064 2484 5rfxrrf.exe 36 PID 2484 wrote to memory of 3064 2484 5rfxrrf.exe 36 PID 2484 wrote to memory of 3064 2484 5rfxrrf.exe 36 PID 2484 wrote to memory of 3064 2484 5rfxrrf.exe 36 PID 3064 wrote to memory of 1620 3064 btbbnt.exe 37 PID 3064 wrote to memory of 1620 3064 btbbnt.exe 37 PID 3064 wrote to memory of 1620 3064 btbbnt.exe 37 PID 3064 wrote to memory of 1620 3064 btbbnt.exe 37 PID 1620 wrote to memory of 852 1620 pvvvv.exe 38 PID 1620 wrote to memory of 852 1620 pvvvv.exe 38 PID 1620 wrote to memory of 852 1620 pvvvv.exe 38 PID 1620 wrote to memory of 852 1620 pvvvv.exe 38 PID 852 wrote to memory of 2660 852 9lllrrx.exe 39 PID 852 wrote to memory of 2660 852 9lllrrx.exe 39 PID 852 wrote to memory of 2660 852 9lllrrx.exe 39 PID 852 wrote to memory of 2660 852 9lllrrx.exe 39 PID 2660 wrote to memory of 280 2660 7frrfxl.exe 40 PID 2660 wrote to memory of 280 2660 7frrfxl.exe 40 PID 2660 wrote to memory of 280 2660 7frrfxl.exe 40 PID 2660 wrote to memory of 280 2660 7frrfxl.exe 40 PID 280 wrote to memory of 1604 280 tnbntb.exe 41 PID 280 wrote to memory of 1604 280 tnbntb.exe 41 PID 280 wrote to memory of 1604 280 tnbntb.exe 41 PID 280 wrote to memory of 1604 280 tnbntb.exe 41 PID 1604 wrote to memory of 752 1604 vvpdp.exe 42 PID 1604 wrote to memory of 752 1604 vvpdp.exe 42 PID 1604 wrote to memory of 752 1604 vvpdp.exe 42 PID 1604 wrote to memory of 752 1604 vvpdp.exe 42 PID 752 wrote to memory of 1236 752 xrlrflr.exe 43 PID 752 wrote to memory of 1236 752 xrlrflr.exe 43 PID 752 wrote to memory of 1236 752 xrlrflr.exe 43 PID 752 wrote to memory of 1236 752 xrlrflr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\46504a4858501ee927f12bfe18c203c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\ppvjj.exec:\ppvjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\7lrxrrx.exec:\7lrxrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\1flfrxl.exec:\1flfrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\dvpvj.exec:\dvpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\lfxflrf.exec:\lfxflrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\ntbnnb.exec:\ntbnnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\vvvpd.exec:\vvvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\5rfxrrf.exec:\5rfxrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\btbbnt.exec:\btbbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\pvvvv.exec:\pvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\9lllrrx.exec:\9lllrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\7frrfxl.exec:\7frrfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\tnbntb.exec:\tnbntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
\??\c:\vvpdp.exec:\vvpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\xrlrflr.exec:\xrlrflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\bbbhtt.exec:\bbbhtt.exe17⤵
- Executes dropped EXE
PID:1236 -
\??\c:\3dvjp.exec:\3dvjp.exe18⤵
- Executes dropped EXE
PID:2312 -
\??\c:\9fffrrr.exec:\9fffrrr.exe19⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hbttbt.exec:\hbttbt.exe20⤵
- Executes dropped EXE
PID:2948 -
\??\c:\3dvvv.exec:\3dvvv.exe21⤵
- Executes dropped EXE
PID:1108 -
\??\c:\xrfrrrf.exec:\xrfrrrf.exe22⤵
- Executes dropped EXE
PID:580 -
\??\c:\1nhtbn.exec:\1nhtbn.exe23⤵
- Executes dropped EXE
PID:1788 -
\??\c:\5ddjd.exec:\5ddjd.exe24⤵
- Executes dropped EXE
PID:304 -
\??\c:\7pdpj.exec:\7pdpj.exe25⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xrrfxfx.exec:\xrrfxfx.exe26⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hbnnth.exec:\hbnnth.exe27⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jpdpj.exec:\jpdpj.exe28⤵
- Executes dropped EXE
PID:1708 -
\??\c:\3lflrxf.exec:\3lflrxf.exe29⤵
- Executes dropped EXE
PID:1800 -
\??\c:\5thntt.exec:\5thntt.exe30⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jdpdd.exec:\jdpdd.exe31⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rlffrrx.exec:\rlffrrx.exe32⤵
- Executes dropped EXE
PID:1848 -
\??\c:\hnhhbb.exec:\hnhhbb.exe33⤵
- Executes dropped EXE
PID:2256 -
\??\c:\7dppv.exec:\7dppv.exe34⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rlxxxrf.exec:\rlxxxrf.exe35⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9tbhtt.exec:\9tbhtt.exe36⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bbtbnt.exec:\bbtbnt.exe37⤵
- Executes dropped EXE
PID:2592 -
\??\c:\7dvvj.exec:\7dvvj.exe38⤵
- Executes dropped EXE
PID:2980 -
\??\c:\fllxfxx.exec:\fllxfxx.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hhtbtt.exec:\hhtbtt.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vdvjd.exec:\vdvjd.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\llfflxf.exec:\llfflxf.exe42⤵
- Executes dropped EXE
PID:1948 -
\??\c:\bhnhnh.exec:\bhnhnh.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nttbnt.exec:\nttbnt.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vpvdj.exec:\vpvdj.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\flxlfxf.exec:\flxlfxf.exe46⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xxrfxlr.exec:\xxrfxlr.exe47⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hhbhth.exec:\hhbhth.exe48⤵
- Executes dropped EXE
PID:2452 -
\??\c:\5vpdj.exec:\5vpdj.exe49⤵
- Executes dropped EXE
PID:828 -
\??\c:\1rxfrxl.exec:\1rxfrxl.exe50⤵
- Executes dropped EXE
PID:1272 -
\??\c:\9rxrxxx.exec:\9rxrxxx.exe51⤵
- Executes dropped EXE
PID:852 -
\??\c:\btnnbh.exec:\btnnbh.exe52⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jjdjv.exec:\jjdjv.exe53⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ppjjp.exec:\ppjjp.exe54⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ffxlrfl.exec:\ffxlrfl.exe55⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bnntbh.exec:\bnntbh.exe56⤵
- Executes dropped EXE
PID:752 -
\??\c:\hthbbt.exec:\hthbbt.exe57⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1pjpv.exec:\1pjpv.exe58⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rfrllff.exec:\rfrllff.exe59⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rflllfr.exec:\rflllfr.exe60⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bnhbnb.exec:\bnhbnb.exe61⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nhtbbh.exec:\nhtbbh.exe62⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pdppd.exec:\pdppd.exe63⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ppvvj.exec:\ppvvj.exe64⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rxlrxrf.exec:\rxlrxrf.exe65⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nnbthn.exec:\nnbthn.exe66⤵PID:2372
-
\??\c:\nbnnbt.exec:\nbnnbt.exe67⤵PID:1928
-
\??\c:\dvjpd.exec:\dvjpd.exe68⤵PID:1052
-
\??\c:\vddpp.exec:\vddpp.exe69⤵PID:1956
-
\??\c:\frlfllr.exec:\frlfllr.exe70⤵PID:1744
-
\??\c:\hhthbb.exec:\hhthbb.exe71⤵PID:964
-
\??\c:\vvvvd.exec:\vvvvd.exe72⤵PID:1688
-
\??\c:\jvjdp.exec:\jvjdp.exe73⤵PID:912
-
\??\c:\ffrxfxl.exec:\ffrxfxl.exe74⤵PID:568
-
\??\c:\xflflll.exec:\xflflll.exe75⤵PID:2760
-
\??\c:\nnhhth.exec:\nnhhth.exe76⤵PID:1696
-
\??\c:\nnbhbb.exec:\nnbhbb.exe77⤵PID:2764
-
\??\c:\vvjvp.exec:\vvjvp.exe78⤵PID:2256
-
\??\c:\7pddv.exec:\7pddv.exe79⤵PID:2204
-
\??\c:\llfflrf.exec:\llfflrf.exe80⤵PID:2272
-
\??\c:\nthbhb.exec:\nthbhb.exe81⤵PID:2060
-
\??\c:\htnttt.exec:\htnttt.exe82⤵PID:2200
-
\??\c:\3jvpp.exec:\3jvpp.exe83⤵PID:2600
-
\??\c:\llflffr.exec:\llflffr.exe84⤵PID:2672
-
\??\c:\xrxlrfl.exec:\xrxlrfl.exe85⤵PID:2616
-
\??\c:\xrxxlrx.exec:\xrxxlrx.exe86⤵PID:2540
-
\??\c:\5hbnnt.exec:\5hbnnt.exe87⤵PID:2436
-
\??\c:\hbnntt.exec:\hbnntt.exe88⤵PID:2680
-
\??\c:\ddvvv.exec:\ddvvv.exe89⤵PID:2508
-
\??\c:\lxrfxfr.exec:\lxrfxfr.exe90⤵PID:2428
-
\??\c:\3rlrlrx.exec:\3rlrlrx.exe91⤵PID:2884
-
\??\c:\bbtbtb.exec:\bbtbtb.exe92⤵PID:2484
-
\??\c:\nhbtnn.exec:\nhbtnn.exe93⤵PID:1552
-
\??\c:\ddvjp.exec:\ddvjp.exe94⤵PID:1360
-
\??\c:\dvvjj.exec:\dvvjj.exe95⤵PID:1248
-
\??\c:\xxxfxlf.exec:\xxxfxlf.exe96⤵PID:356
-
\??\c:\1xfrlrf.exec:\1xfrlrf.exe97⤵PID:1028
-
\??\c:\3tnnth.exec:\3tnnth.exe98⤵PID:2704
-
\??\c:\9tntbh.exec:\9tntbh.exe99⤵PID:1572
-
\??\c:\ppjjd.exec:\ppjjd.exe100⤵PID:1464
-
\??\c:\7rlfrfx.exec:\7rlfrfx.exe101⤵PID:1592
-
\??\c:\fffrlxl.exec:\fffrlxl.exe102⤵PID:2288
-
\??\c:\hhbhbh.exec:\hhbhbh.exe103⤵PID:2036
-
\??\c:\hnhthb.exec:\hnhthb.exe104⤵PID:1684
-
\??\c:\vvvjp.exec:\vvvjp.exe105⤵PID:2032
-
\??\c:\djdvj.exec:\djdvj.exe106⤵PID:2948
-
\??\c:\ffxrxfr.exec:\ffxrxfr.exe107⤵PID:2112
-
\??\c:\nnntht.exec:\nnntht.exe108⤵PID:872
-
\??\c:\nbntbh.exec:\nbntbh.exe109⤵PID:608
-
\??\c:\vvpdj.exec:\vvpdj.exe110⤵PID:1920
-
\??\c:\rflrfll.exec:\rflrfll.exe111⤵PID:1044
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe112⤵PID:1656
-
\??\c:\bbbtth.exec:\bbbtth.exe113⤵PID:456
-
\??\c:\1hbnhn.exec:\1hbnhn.exe114⤵PID:1748
-
\??\c:\vddpv.exec:\vddpv.exe115⤵PID:1728
-
\??\c:\vvvpv.exec:\vvvpv.exe116⤵PID:1472
-
\??\c:\rffxxlf.exec:\rffxxlf.exe117⤵PID:812
-
\??\c:\ntbbhb.exec:\ntbbhb.exe118⤵PID:376
-
\??\c:\nbhhbn.exec:\nbhhbn.exe119⤵PID:960
-
\??\c:\dvppp.exec:\dvppp.exe120⤵PID:568
-
\??\c:\xfxrrrx.exec:\xfxrrrx.exe121⤵PID:2760
-
\??\c:\5rxxxxx.exec:\5rxxxxx.exe122⤵PID:1696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-