Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 10:44
Behavioral task
behavioral1
Sample
17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe
-
Size
294KB
-
MD5
17958f252c9338415228f912a9c0a450
-
SHA1
f5825500d10aa2452ebd5018c76b7a261c3a0afa
-
SHA256
d566b9730bb5d40e9c18c003f170d5d1a7e5a4222a56ef334713af83b705eacc
-
SHA512
71228b372ccd6655ad5cb868660ebfeed2332c564110c1182707aefe2421a703f70554a69ec7bb2a2273904a15f6afd0391f68bc14f0397f6dec79b80f0a6d85
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftOV:K4wFHoSQkuUHk1zBR/pMT9XvEhdfU
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/1888-9-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2964-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2544-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2548-47-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2704-56-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2424-66-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2564-75-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2416-84-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2880-92-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1216-102-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1536-105-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2456-119-0x0000000001B80000-0x0000000001BB4000-memory.dmp family_blackmoon behavioral1/memory/2456-121-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2124-131-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2316-148-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/312-168-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1452-177-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2748-185-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/532-212-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1588-230-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/468-245-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1220-255-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1728-290-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2164-298-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2292-361-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2416-381-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2880-388-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1540-402-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1844-427-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2744-459-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2744-466-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2068-473-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2120-720-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3024-824-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/3024-870-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2744-1022-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000b000000015cbd-6.dat family_berbew behavioral1/files/0x0030000000015d24-21.dat family_berbew behavioral1/files/0x0008000000015e6d-27.dat family_berbew behavioral1/files/0x0007000000015f3c-38.dat family_berbew behavioral1/files/0x0007000000015fa7-48.dat family_berbew behavioral1/files/0x00070000000160cc-57.dat family_berbew behavioral1/files/0x00070000000161b3-64.dat family_berbew behavioral1/files/0x0008000000016d05-74.dat family_berbew behavioral1/files/0x0006000000016d0e-82.dat family_berbew behavioral1/files/0x0006000000016d16-93.dat family_berbew behavioral1/files/0x0006000000016d1f-100.dat family_berbew behavioral1/files/0x0006000000016d32-111.dat family_berbew behavioral1/files/0x0006000000016d36-120.dat family_berbew behavioral1/memory/2124-129-0x0000000000220000-0x0000000000254000-memory.dmp family_berbew behavioral1/files/0x0006000000016d3a-130.dat family_berbew behavioral1/files/0x0006000000016d9f-138.dat family_berbew behavioral1/files/0x0006000000016da4-149.dat family_berbew behavioral1/files/0x0006000000016db3-157.dat family_berbew behavioral1/files/0x0006000000016e78-166.dat family_berbew behavioral1/files/0x0006000000016fe8-175.dat family_berbew behavioral1/files/0x000600000001739d-186.dat family_berbew behavioral1/files/0x00060000000173e5-193.dat family_berbew behavioral1/files/0x0030000000015d44-201.dat family_berbew behavioral1/files/0x000600000001744c-209.dat family_berbew behavioral1/files/0x00060000000175ac-221.dat family_berbew behavioral1/files/0x00060000000175b2-228.dat family_berbew behavioral1/files/0x00060000000175b8-237.dat family_berbew behavioral1/files/0x001500000001863c-246.dat family_berbew behavioral1/files/0x0009000000018640-253.dat family_berbew behavioral1/files/0x000500000001865a-264.dat family_berbew behavioral1/files/0x00050000000186c1-272.dat family_berbew behavioral1/files/0x00050000000186d3-281.dat family_berbew behavioral1/files/0x0005000000018700-288.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2964 pjvjv.exe 1620 rfrxffl.exe 2544 hthnhh.exe 2548 lxrlrfr.exe 2704 5nhhth.exe 2424 7djjp.exe 2564 xrxflrx.exe 2416 nhttth.exe 2880 pjppp.exe 1216 rfxfrrr.exe 1536 bntbnn.exe 2456 vpjvv.exe 2124 xrrrrrx.exe 1580 hhbtnt.exe 2316 7pjpd.exe 2320 fxflrrf.exe 312 ttnttb.exe 1452 3pjpd.exe 2748 xrxfrlx.exe 1160 1bntnn.exe 1176 pjdjv.exe 532 ffxlrfr.exe 988 ntnnth.exe 1784 dvddd.exe 1588 lxrxlrr.exe 468 tnhnth.exe 1220 7jddp.exe 976 3xfrfrx.exe 1912 htbthb.exe 2092 rllrlxr.exe 1728 nbbbtt.exe 2164 pdpjj.exe 1888 7rrlrxf.exe 1628 rllrflr.exe 2964 1hnhhb.exe 3028 ddvdp.exe 2540 rfxfxfx.exe 2680 frflxrr.exe 2800 tthntb.exe 2548 vdddj.exe 2612 vvvdv.exe 2688 rlfrrrx.exe 2292 xlxflfl.exe 2516 hbtttb.exe 2416 vvjpp.exe 2880 rlxflrx.exe 2348 1hbttt.exe 1540 btbbnn.exe 2484 7dvpd.exe 764 vpjvv.exe 308 5lrxxxf.exe 1844 7hbbhn.exe 2120 bhtnnb.exe 2276 1jvdd.exe 2304 rllrrxf.exe 1448 bththb.exe 312 1vpjv.exe 2744 pdpdd.exe 1208 5rrfrrf.exe 2068 3ttbtb.exe 2904 hhhthn.exe 1176 pjdvd.exe 1824 jjvpj.exe 2072 fllxlrf.exe -
resource yara_rule behavioral1/memory/1888-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1888-9-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000b000000015cbd-6.dat upx behavioral1/memory/2964-12-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1888-5-0x0000000000310000-0x0000000000344000-memory.dmp upx behavioral1/files/0x0030000000015d24-21.dat upx behavioral1/memory/2964-19-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0008000000015e6d-27.dat upx behavioral1/memory/2544-29-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2544-37-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000015f3c-38.dat upx behavioral1/memory/2548-39-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2548-47-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000015fa7-48.dat upx behavioral1/memory/2704-56-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00070000000160cc-57.dat upx behavioral1/files/0x00070000000161b3-64.dat upx behavioral1/memory/2424-66-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0008000000016d05-74.dat upx behavioral1/memory/2564-75-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d0e-82.dat upx behavioral1/memory/2416-84-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2880-92-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d16-93.dat upx behavioral1/files/0x0006000000016d1f-100.dat upx behavioral1/memory/1216-102-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1536-105-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d32-111.dat upx behavioral1/memory/2456-121-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d36-120.dat upx behavioral1/memory/2124-131-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d3a-130.dat upx behavioral1/memory/1580-132-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016d9f-138.dat upx behavioral1/files/0x0006000000016da4-149.dat upx behavioral1/memory/2316-148-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2320-150-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016db3-157.dat upx behavioral1/memory/312-159-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016e78-166.dat upx behavioral1/memory/312-168-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1452-177-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000016fe8-175.dat upx behavioral1/memory/2748-185-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000600000001739d-186.dat upx behavioral1/files/0x00060000000173e5-193.dat upx behavioral1/files/0x0030000000015d44-201.dat upx behavioral1/memory/532-212-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000600000001744c-209.dat upx behavioral1/files/0x00060000000175ac-221.dat upx behavioral1/files/0x00060000000175b2-228.dat upx behavioral1/memory/1588-230-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00060000000175b8-237.dat upx behavioral1/memory/468-245-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x001500000001863c-246.dat upx behavioral1/memory/1220-255-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0009000000018640-253.dat upx behavioral1/memory/976-256-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000500000001865a-264.dat upx behavioral1/memory/2092-273-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00050000000186c1-272.dat upx behavioral1/files/0x00050000000186d3-281.dat upx behavioral1/memory/1728-290-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000018700-288.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2964 1888 17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe 28 PID 1888 wrote to memory of 2964 1888 17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe 28 PID 1888 wrote to memory of 2964 1888 17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe 28 PID 1888 wrote to memory of 2964 1888 17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe 28 PID 2964 wrote to memory of 1620 2964 pjvjv.exe 29 PID 2964 wrote to memory of 1620 2964 pjvjv.exe 29 PID 2964 wrote to memory of 1620 2964 pjvjv.exe 29 PID 2964 wrote to memory of 1620 2964 pjvjv.exe 29 PID 1620 wrote to memory of 2544 1620 rfrxffl.exe 30 PID 1620 wrote to memory of 2544 1620 rfrxffl.exe 30 PID 1620 wrote to memory of 2544 1620 rfrxffl.exe 30 PID 1620 wrote to memory of 2544 1620 rfrxffl.exe 30 PID 2544 wrote to memory of 2548 2544 hthnhh.exe 31 PID 2544 wrote to memory of 2548 2544 hthnhh.exe 31 PID 2544 wrote to memory of 2548 2544 hthnhh.exe 31 PID 2544 wrote to memory of 2548 2544 hthnhh.exe 31 PID 2548 wrote to memory of 2704 2548 lxrlrfr.exe 32 PID 2548 wrote to memory of 2704 2548 lxrlrfr.exe 32 PID 2548 wrote to memory of 2704 2548 lxrlrfr.exe 32 PID 2548 wrote to memory of 2704 2548 lxrlrfr.exe 32 PID 2704 wrote to memory of 2424 2704 5nhhth.exe 33 PID 2704 wrote to memory of 2424 2704 5nhhth.exe 33 PID 2704 wrote to memory of 2424 2704 5nhhth.exe 33 PID 2704 wrote to memory of 2424 2704 5nhhth.exe 33 PID 2424 wrote to memory of 2564 2424 7djjp.exe 34 PID 2424 wrote to memory of 2564 2424 7djjp.exe 34 PID 2424 wrote to memory of 2564 2424 7djjp.exe 34 PID 2424 wrote to memory of 2564 2424 7djjp.exe 34 PID 2564 wrote to memory of 2416 2564 xrxflrx.exe 35 PID 2564 wrote to memory of 2416 2564 xrxflrx.exe 35 PID 2564 wrote to memory of 2416 2564 xrxflrx.exe 35 PID 2564 wrote to memory of 2416 2564 xrxflrx.exe 35 PID 2416 wrote to memory of 2880 2416 nhttth.exe 36 PID 2416 wrote to memory of 2880 2416 nhttth.exe 36 PID 2416 wrote to memory of 2880 2416 nhttth.exe 36 PID 2416 wrote to memory of 2880 2416 nhttth.exe 36 PID 2880 wrote to memory of 1216 2880 pjppp.exe 37 PID 2880 wrote to memory of 1216 2880 pjppp.exe 37 PID 2880 wrote to memory of 1216 2880 pjppp.exe 37 PID 2880 wrote to memory of 1216 2880 pjppp.exe 37 PID 1216 wrote to memory of 1536 1216 rfxfrrr.exe 38 PID 1216 wrote to memory of 1536 1216 rfxfrrr.exe 38 PID 1216 wrote to memory of 1536 1216 rfxfrrr.exe 38 PID 1216 wrote to memory of 1536 1216 rfxfrrr.exe 38 PID 1536 wrote to memory of 2456 1536 bntbnn.exe 39 PID 1536 wrote to memory of 2456 1536 bntbnn.exe 39 PID 1536 wrote to memory of 2456 1536 bntbnn.exe 39 PID 1536 wrote to memory of 2456 1536 bntbnn.exe 39 PID 2456 wrote to memory of 2124 2456 vpjvv.exe 40 PID 2456 wrote to memory of 2124 2456 vpjvv.exe 40 PID 2456 wrote to memory of 2124 2456 vpjvv.exe 40 PID 2456 wrote to memory of 2124 2456 vpjvv.exe 40 PID 2124 wrote to memory of 1580 2124 xrrrrrx.exe 41 PID 2124 wrote to memory of 1580 2124 xrrrrrx.exe 41 PID 2124 wrote to memory of 1580 2124 xrrrrrx.exe 41 PID 2124 wrote to memory of 1580 2124 xrrrrrx.exe 41 PID 1580 wrote to memory of 2316 1580 hhbtnt.exe 42 PID 1580 wrote to memory of 2316 1580 hhbtnt.exe 42 PID 1580 wrote to memory of 2316 1580 hhbtnt.exe 42 PID 1580 wrote to memory of 2316 1580 hhbtnt.exe 42 PID 2316 wrote to memory of 2320 2316 7pjpd.exe 43 PID 2316 wrote to memory of 2320 2316 7pjpd.exe 43 PID 2316 wrote to memory of 2320 2316 7pjpd.exe 43 PID 2316 wrote to memory of 2320 2316 7pjpd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17958f252c9338415228f912a9c0a450_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\pjvjv.exec:\pjvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\rfrxffl.exec:\rfrxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\hthnhh.exec:\hthnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\lxrlrfr.exec:\lxrlrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\5nhhth.exec:\5nhhth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\7djjp.exec:\7djjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\xrxflrx.exec:\xrxflrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nhttth.exec:\nhttth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\pjppp.exec:\pjppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rfxfrrr.exec:\rfxfrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\bntbnn.exec:\bntbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\vpjvv.exec:\vpjvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\xrrrrrx.exec:\xrrrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\hhbtnt.exec:\hhbtnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\7pjpd.exec:\7pjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\fxflrrf.exec:\fxflrrf.exe17⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ttnttb.exec:\ttnttb.exe18⤵
- Executes dropped EXE
PID:312 -
\??\c:\3pjpd.exec:\3pjpd.exe19⤵
- Executes dropped EXE
PID:1452 -
\??\c:\xrxfrlx.exec:\xrxfrlx.exe20⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1bntnn.exec:\1bntnn.exe21⤵
- Executes dropped EXE
PID:1160 -
\??\c:\pjdjv.exec:\pjdjv.exe22⤵
- Executes dropped EXE
PID:1176 -
\??\c:\ffxlrfr.exec:\ffxlrfr.exe23⤵
- Executes dropped EXE
PID:532 -
\??\c:\ntnnth.exec:\ntnnth.exe24⤵
- Executes dropped EXE
PID:988 -
\??\c:\dvddd.exec:\dvddd.exe25⤵
- Executes dropped EXE
PID:1784 -
\??\c:\lxrxlrr.exec:\lxrxlrr.exe26⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tnhnth.exec:\tnhnth.exe27⤵
- Executes dropped EXE
PID:468 -
\??\c:\7jddp.exec:\7jddp.exe28⤵
- Executes dropped EXE
PID:1220 -
\??\c:\3xfrfrx.exec:\3xfrfrx.exe29⤵
- Executes dropped EXE
PID:976 -
\??\c:\htbthb.exec:\htbthb.exe30⤵
- Executes dropped EXE
PID:1912 -
\??\c:\rllrlxr.exec:\rllrlxr.exe31⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nbbbtt.exec:\nbbbtt.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pdpjj.exec:\pdpjj.exe33⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7rrlrxf.exec:\7rrlrxf.exe34⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rllrflr.exec:\rllrflr.exe35⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1hnhhb.exec:\1hnhhb.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ddvdp.exec:\ddvdp.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\rfxfxfx.exec:\rfxfxfx.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\frflxrr.exec:\frflxrr.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tthntb.exec:\tthntb.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vdddj.exec:\vdddj.exe41⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vvvdv.exec:\vvvdv.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rlfrrrx.exec:\rlfrrrx.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xlxflfl.exec:\xlxflfl.exe44⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hbtttb.exec:\hbtttb.exe45⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vvjpp.exec:\vvjpp.exe46⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rlxflrx.exec:\rlxflrx.exe47⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1hbttt.exec:\1hbttt.exe48⤵
- Executes dropped EXE
PID:2348 -
\??\c:\btbbnn.exec:\btbbnn.exe49⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7dvpd.exec:\7dvpd.exe50⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpjvv.exec:\vpjvv.exe51⤵
- Executes dropped EXE
PID:764 -
\??\c:\5lrxxxf.exec:\5lrxxxf.exe52⤵
- Executes dropped EXE
PID:308 -
\??\c:\7hbbhn.exec:\7hbbhn.exe53⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bhtnnb.exec:\bhtnnb.exe54⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1jvdd.exec:\1jvdd.exe55⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rllrrxf.exec:\rllrrxf.exe56⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bththb.exec:\bththb.exe57⤵
- Executes dropped EXE
PID:1448 -
\??\c:\1vpjv.exec:\1vpjv.exe58⤵
- Executes dropped EXE
PID:312 -
\??\c:\pdpdd.exec:\pdpdd.exe59⤵
- Executes dropped EXE
PID:2744 -
\??\c:\5rrfrrf.exec:\5rrfrrf.exe60⤵
- Executes dropped EXE
PID:1208 -
\??\c:\3ttbtb.exec:\3ttbtb.exe61⤵
- Executes dropped EXE
PID:2068 -
\??\c:\hhhthn.exec:\hhhthn.exe62⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pjdvd.exec:\pjdvd.exe63⤵
- Executes dropped EXE
PID:1176 -
\??\c:\jjvpj.exec:\jjvpj.exe64⤵
- Executes dropped EXE
PID:1824 -
\??\c:\fllxlrf.exec:\fllxlrf.exe65⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1hhnbb.exec:\1hhnbb.exe66⤵PID:952
-
\??\c:\9jvdp.exec:\9jvdp.exe67⤵PID:1784
-
\??\c:\3dpvv.exec:\3dpvv.exe68⤵PID:2840
-
\??\c:\5lffrfl.exec:\5lffrfl.exe69⤵PID:1312
-
\??\c:\1btttt.exec:\1btttt.exe70⤵PID:748
-
\??\c:\3tbntb.exec:\3tbntb.exe71⤵PID:2244
-
\??\c:\ppjjv.exec:\ppjjv.exe72⤵PID:1944
-
\??\c:\xxrxflx.exec:\xxrxflx.exe73⤵PID:1904
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe74⤵PID:3060
-
\??\c:\tnbbhn.exec:\tnbbhn.exe75⤵PID:2092
-
\??\c:\nhttbh.exec:\nhttbh.exe76⤵PID:2952
-
\??\c:\vvjjp.exec:\vvjjp.exe77⤵PID:2204
-
\??\c:\lfflrxl.exec:\lfflrxl.exe78⤵PID:1520
-
\??\c:\nbtbnt.exec:\nbtbnt.exe79⤵PID:2976
-
\??\c:\bnthhh.exec:\bnthhh.exe80⤵PID:2968
-
\??\c:\jdppd.exec:\jdppd.exe81⤵PID:2488
-
\??\c:\rflxxxx.exec:\rflxxxx.exe82⤵PID:3028
-
\??\c:\3ffxrrr.exec:\3ffxrrr.exe83⤵PID:2544
-
\??\c:\9hbbhn.exec:\9hbbhn.exe84⤵PID:2700
-
\??\c:\vddpd.exec:\vddpd.exe85⤵PID:2708
-
\??\c:\ffxfxfl.exec:\ffxfxfl.exe86⤵PID:2436
-
\??\c:\1xxlxxl.exec:\1xxlxxl.exe87⤵PID:2508
-
\??\c:\nbnntb.exec:\nbnntb.exe88⤵PID:2444
-
\??\c:\pjdpv.exec:\pjdpv.exe89⤵PID:2692
-
\??\c:\vpjpv.exec:\vpjpv.exe90⤵PID:2884
-
\??\c:\5xxrfrl.exec:\5xxrfrl.exe91⤵PID:1500
-
\??\c:\hbhnbh.exec:\hbhnbh.exe92⤵PID:1216
-
\??\c:\hbnnbn.exec:\hbnnbn.exe93⤵PID:2464
-
\??\c:\jvjdd.exec:\jvjdd.exe94⤵PID:1540
-
\??\c:\3lxlrfl.exec:\3lxlrfl.exe95⤵PID:2660
-
\??\c:\hthnnh.exec:\hthnnh.exe96⤵PID:764
-
\??\c:\hbnntt.exec:\hbnntt.exe97⤵PID:1892
-
\??\c:\ppjpj.exec:\ppjpj.exe98⤵PID:2324
-
\??\c:\vvjjv.exec:\vvjjv.exe99⤵PID:2120
-
\??\c:\frlxrxx.exec:\frlxrxx.exe100⤵PID:2276
-
\??\c:\xxxfllr.exec:\xxxfllr.exe101⤵PID:872
-
\??\c:\1bbhnb.exec:\1bbhnb.exe102⤵PID:2760
-
\??\c:\vjvvj.exec:\vjvvj.exe103⤵PID:2736
-
\??\c:\jppdv.exec:\jppdv.exe104⤵PID:2100
-
\??\c:\xfxfllx.exec:\xfxfllx.exe105⤵PID:2108
-
\??\c:\rrfrflx.exec:\rrfrflx.exe106⤵PID:1244
-
\??\c:\bhhbbn.exec:\bhhbbn.exe107⤵PID:2856
-
\??\c:\vvvpd.exec:\vvvpd.exe108⤵PID:1004
-
\??\c:\vvjvd.exec:\vvjvd.exe109⤵PID:2816
-
\??\c:\llrrrlr.exec:\llrrrlr.exe110⤵PID:2072
-
\??\c:\9hnbtt.exec:\9hnbtt.exe111⤵PID:692
-
\??\c:\hbhbnt.exec:\hbhbnt.exe112⤵PID:2252
-
\??\c:\9jjpd.exec:\9jjpd.exe113⤵PID:2340
-
\??\c:\xllrxfl.exec:\xllrxfl.exe114⤵PID:1052
-
\??\c:\xrxxlrx.exec:\xrxxlrx.exe115⤵PID:3024
-
\??\c:\nhttbh.exec:\nhttbh.exe116⤵PID:2244
-
\??\c:\5hbntn.exec:\5hbntn.exe117⤵PID:2240
-
\??\c:\jvddd.exec:\jvddd.exe118⤵PID:1300
-
\??\c:\ddpdj.exec:\ddpdj.exe119⤵PID:2000
-
\??\c:\xrffflr.exec:\xrffflr.exe120⤵PID:1428
-
\??\c:\bthntb.exec:\bthntb.exe121⤵PID:1516
-
\??\c:\jdpjd.exec:\jdpjd.exe122⤵PID:2988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-