Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 21:54
Behavioral task
behavioral1
Sample
69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe
-
Size
251KB
-
MD5
69d9be638f02536a48e42f4d1ef28960
-
SHA1
f962f39ce5e07410b9c255290b4f408e67829f51
-
SHA256
f9f19f07a5996f19be240df6c403f571898a2cdb9b2d379dd8d0966694b233c9
-
SHA512
e4302773a46cc376a12b8a397c7263cfdc5164c186c826133f1c8c08e9364a25eded2e0b293e6ee7efbc85a4f620dbe90ea1d183a628e44d7e3a55b93ca6c9a9
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+H:ccm4FmowdHoSi9EIBftapTs4WZazY
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2012-1-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1252-10-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2604-36-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2764-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2292-53-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2788-70-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2476-88-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3020-91-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1616-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2868-109-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2716-125-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1808-144-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1824-141-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2652-159-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2800-161-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2084-196-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/348-194-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/108-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/584-215-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/684-254-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2116-264-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2432-308-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2612-332-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2696-345-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2664-370-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2636-383-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2584-385-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2452-448-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2224-596-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2544-603-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1884-623-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2712-711-0x0000000000230000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/908-758-0x00000000001B0000-0x00000000001E6000-memory.dmp family_blackmoon behavioral1/memory/1772-772-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2344-848-0x00000000003C0000-0x00000000003F6000-memory.dmp family_blackmoon behavioral1/memory/2932-897-0x0000000000230000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/2684-902-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2684-906-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000b000000012301-5.dat family_berbew behavioral1/files/0x00360000000167e8-17.dat family_berbew behavioral1/files/0x0007000000016ccd-34.dat family_berbew behavioral1/files/0x0007000000016cf2-42.dat family_berbew behavioral1/files/0x0008000000016c5b-25.dat family_berbew behavioral1/files/0x0007000000016d01-52.dat family_berbew behavioral1/files/0x0009000000016d19-60.dat family_berbew behavioral1/files/0x000700000001708c-68.dat family_berbew behavioral1/files/0x00060000000171ad-78.dat family_berbew behavioral1/files/0x000600000001738e-89.dat family_berbew behavioral1/files/0x000600000001738f-98.dat family_berbew behavioral1/files/0x00060000000173e2-107.dat family_berbew behavioral1/files/0x00060000000173e5-115.dat family_berbew behavioral1/files/0x0006000000017436-122.dat family_berbew behavioral1/files/0x00060000000174ef-132.dat family_berbew behavioral1/files/0x0006000000017577-139.dat family_berbew behavioral1/files/0x00060000000175f7-150.dat family_berbew behavioral1/files/0x00060000000175fd-156.dat family_berbew behavioral1/files/0x0006000000017603-169.dat family_berbew behavioral1/files/0x000d000000018689-175.dat family_berbew behavioral1/files/0x00050000000186a2-185.dat family_berbew behavioral1/files/0x000500000001870e-192.dat family_berbew behavioral1/files/0x000500000001871c-204.dat family_berbew behavioral1/files/0x0005000000018749-213.dat family_berbew behavioral1/files/0x0036000000016a3a-221.dat family_berbew behavioral1/files/0x000500000001878f-231.dat family_berbew behavioral1/files/0x000600000001902f-238.dat family_berbew behavioral1/files/0x0005000000019254-246.dat family_berbew behavioral1/files/0x000500000001925a-255.dat family_berbew behavioral1/files/0x0005000000019276-265.dat family_berbew behavioral1/files/0x000500000001927b-272.dat family_berbew behavioral1/files/0x000500000001928e-280.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1252 nhntbb.exe 2544 jppjv.exe 2764 jdpvv.exe 2604 ffrlrrf.exe 2748 tnbbhn.exe 2292 lfxlrrf.exe 2788 5httbb.exe 2692 vvpvd.exe 2476 hbtbbh.exe 3020 1pddj.exe 1616 xlrrrxx.exe 2868 lfffrlr.exe 2876 5htnnh.exe 2716 lllfflr.exe 1824 rlxxflx.exe 1808 vpdpv.exe 2652 1jvdj.exe 2800 xrrrffl.exe 560 nhbhht.exe 1592 jjvdp.exe 348 xrlxlrf.exe 2084 nhbnbn.exe 108 3vdjv.exe 584 xrrxffl.exe 2092 tthntt.exe 2332 3rllllx.exe 1880 3xrrxxf.exe 684 pppdd.exe 2116 rlfrflx.exe 1312 hhbbnh.exe 2144 vpdvj.exe 988 1fxfllx.exe 556 hbntnn.exe 2024 dvvdp.exe 1540 jvjjp.exe 2432 xrfrrxf.exe 2936 btnbnn.exe 2764 vpdjp.exe 2612 vpddd.exe 1556 lfrlrrx.exe 2696 hbhthn.exe 2688 bthtth.exe 1588 pjddp.exe 2500 lfxfrrf.exe 2664 3rfxffl.exe 2512 5nttbh.exe 2636 pvvvp.exe 2584 9fffllx.exe 1192 rfxfllr.exe 2804 btbnhh.exe 2856 9dvjj.exe 2896 fxflxrx.exe 2656 fflrfxf.exe 1676 hbbnbt.exe 1664 1dvdp.exe 1692 7dpvv.exe 1808 lfxxffr.exe 2452 fxlrlfl.exe 2652 hbntbn.exe 1032 jvjpv.exe 1828 djjpj.exe 1284 frlfllx.exe 812 rlrrrfx.exe 324 3bhbht.exe -
resource yara_rule behavioral1/memory/2012-1-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000b000000012301-5.dat upx behavioral1/memory/1252-10-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00360000000167e8-17.dat upx behavioral1/memory/2604-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000016ccd-34.dat upx behavioral1/memory/2764-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2748-43-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000016cf2-42.dat upx behavioral1/files/0x0008000000016c5b-25.dat upx behavioral1/files/0x0007000000016d01-52.dat upx behavioral1/memory/2292-53-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0009000000016d19-60.dat upx behavioral1/memory/2788-61-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2788-70-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000700000001708c-68.dat upx behavioral1/files/0x00060000000171ad-78.dat upx behavioral1/memory/2476-86-0x00000000002E0000-0x0000000000316000-memory.dmp upx behavioral1/files/0x000600000001738e-89.dat upx behavioral1/memory/2476-88-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3020-91-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1616-99-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000600000001738f-98.dat upx behavioral1/memory/2868-109-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000173e2-107.dat upx behavioral1/files/0x00060000000173e5-115.dat upx behavioral1/files/0x0006000000017436-122.dat upx behavioral1/memory/2716-125-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000174ef-132.dat upx behavioral1/files/0x0006000000017577-139.dat upx behavioral1/memory/1808-144-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1824-141-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000175f7-150.dat upx behavioral1/files/0x00060000000175fd-156.dat upx behavioral1/memory/2652-159-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2800-161-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000017603-169.dat upx behavioral1/files/0x000d000000018689-175.dat upx behavioral1/memory/1592-177-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00050000000186a2-185.dat upx behavioral1/files/0x000500000001870e-192.dat upx behavioral1/memory/2084-196-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/348-194-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/108-206-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001871c-204.dat upx behavioral1/files/0x0005000000018749-213.dat upx behavioral1/memory/584-215-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0036000000016a3a-221.dat upx behavioral1/memory/2092-222-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001878f-231.dat upx behavioral1/files/0x000600000001902f-238.dat upx behavioral1/files/0x0005000000019254-246.dat upx behavioral1/memory/684-254-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001925a-255.dat upx behavioral1/files/0x0005000000019276-265.dat upx behavioral1/memory/2116-264-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001927b-272.dat upx behavioral1/files/0x000500000001928e-280.dat upx behavioral1/memory/556-288-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2432-308-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2612-332-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2696-345-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2664-370-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2636-383-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1252 2012 69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe 28 PID 2012 wrote to memory of 1252 2012 69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe 28 PID 2012 wrote to memory of 1252 2012 69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe 28 PID 2012 wrote to memory of 1252 2012 69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 2544 1252 nhntbb.exe 29 PID 1252 wrote to memory of 2544 1252 nhntbb.exe 29 PID 1252 wrote to memory of 2544 1252 nhntbb.exe 29 PID 1252 wrote to memory of 2544 1252 nhntbb.exe 29 PID 2544 wrote to memory of 2764 2544 jppjv.exe 30 PID 2544 wrote to memory of 2764 2544 jppjv.exe 30 PID 2544 wrote to memory of 2764 2544 jppjv.exe 30 PID 2544 wrote to memory of 2764 2544 jppjv.exe 30 PID 2764 wrote to memory of 2604 2764 jdpvv.exe 31 PID 2764 wrote to memory of 2604 2764 jdpvv.exe 31 PID 2764 wrote to memory of 2604 2764 jdpvv.exe 31 PID 2764 wrote to memory of 2604 2764 jdpvv.exe 31 PID 2604 wrote to memory of 2748 2604 ffrlrrf.exe 32 PID 2604 wrote to memory of 2748 2604 ffrlrrf.exe 32 PID 2604 wrote to memory of 2748 2604 ffrlrrf.exe 32 PID 2604 wrote to memory of 2748 2604 ffrlrrf.exe 32 PID 2748 wrote to memory of 2292 2748 tnbbhn.exe 33 PID 2748 wrote to memory of 2292 2748 tnbbhn.exe 33 PID 2748 wrote to memory of 2292 2748 tnbbhn.exe 33 PID 2748 wrote to memory of 2292 2748 tnbbhn.exe 33 PID 2292 wrote to memory of 2788 2292 lfxlrrf.exe 34 PID 2292 wrote to memory of 2788 2292 lfxlrrf.exe 34 PID 2292 wrote to memory of 2788 2292 lfxlrrf.exe 34 PID 2292 wrote to memory of 2788 2292 lfxlrrf.exe 34 PID 2788 wrote to memory of 2692 2788 5httbb.exe 35 PID 2788 wrote to memory of 2692 2788 5httbb.exe 35 PID 2788 wrote to memory of 2692 2788 5httbb.exe 35 PID 2788 wrote to memory of 2692 2788 5httbb.exe 35 PID 2692 wrote to memory of 2476 2692 vvpvd.exe 36 PID 2692 wrote to memory of 2476 2692 vvpvd.exe 36 PID 2692 wrote to memory of 2476 2692 vvpvd.exe 36 PID 2692 wrote to memory of 2476 2692 vvpvd.exe 36 PID 2476 wrote to memory of 3020 2476 hbtbbh.exe 37 PID 2476 wrote to memory of 3020 2476 hbtbbh.exe 37 PID 2476 wrote to memory of 3020 2476 hbtbbh.exe 37 PID 2476 wrote to memory of 3020 2476 hbtbbh.exe 37 PID 3020 wrote to memory of 1616 3020 1pddj.exe 38 PID 3020 wrote to memory of 1616 3020 1pddj.exe 38 PID 3020 wrote to memory of 1616 3020 1pddj.exe 38 PID 3020 wrote to memory of 1616 3020 1pddj.exe 38 PID 1616 wrote to memory of 2868 1616 xlrrrxx.exe 39 PID 1616 wrote to memory of 2868 1616 xlrrrxx.exe 39 PID 1616 wrote to memory of 2868 1616 xlrrrxx.exe 39 PID 1616 wrote to memory of 2868 1616 xlrrrxx.exe 39 PID 2868 wrote to memory of 2876 2868 lfffrlr.exe 40 PID 2868 wrote to memory of 2876 2868 lfffrlr.exe 40 PID 2868 wrote to memory of 2876 2868 lfffrlr.exe 40 PID 2868 wrote to memory of 2876 2868 lfffrlr.exe 40 PID 2876 wrote to memory of 2716 2876 5htnnh.exe 41 PID 2876 wrote to memory of 2716 2876 5htnnh.exe 41 PID 2876 wrote to memory of 2716 2876 5htnnh.exe 41 PID 2876 wrote to memory of 2716 2876 5htnnh.exe 41 PID 2716 wrote to memory of 1824 2716 lllfflr.exe 42 PID 2716 wrote to memory of 1824 2716 lllfflr.exe 42 PID 2716 wrote to memory of 1824 2716 lllfflr.exe 42 PID 2716 wrote to memory of 1824 2716 lllfflr.exe 42 PID 1824 wrote to memory of 1808 1824 rlxxflx.exe 43 PID 1824 wrote to memory of 1808 1824 rlxxflx.exe 43 PID 1824 wrote to memory of 1808 1824 rlxxflx.exe 43 PID 1824 wrote to memory of 1808 1824 rlxxflx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\nhntbb.exec:\nhntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\jppjv.exec:\jppjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jdpvv.exec:\jdpvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\ffrlrrf.exec:\ffrlrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\tnbbhn.exec:\tnbbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\lfxlrrf.exec:\lfxlrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\5httbb.exec:\5httbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vvpvd.exec:\vvpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\hbtbbh.exec:\hbtbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\1pddj.exec:\1pddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\lfffrlr.exec:\lfffrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\5htnnh.exec:\5htnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\lllfflr.exec:\lllfflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rlxxflx.exec:\rlxxflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\vpdpv.exec:\vpdpv.exe17⤵
- Executes dropped EXE
PID:1808 -
\??\c:\1jvdj.exec:\1jvdj.exe18⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xrrrffl.exec:\xrrrffl.exe19⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nhbhht.exec:\nhbhht.exe20⤵
- Executes dropped EXE
PID:560 -
\??\c:\jjvdp.exec:\jjvdp.exe21⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xrlxlrf.exec:\xrlxlrf.exe22⤵
- Executes dropped EXE
PID:348 -
\??\c:\nhbnbn.exec:\nhbnbn.exe23⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3vdjv.exec:\3vdjv.exe24⤵
- Executes dropped EXE
PID:108 -
\??\c:\xrrxffl.exec:\xrrxffl.exe25⤵
- Executes dropped EXE
PID:584 -
\??\c:\tthntt.exec:\tthntt.exe26⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3rllllx.exec:\3rllllx.exe27⤵
- Executes dropped EXE
PID:2332 -
\??\c:\3xrrxxf.exec:\3xrrxxf.exe28⤵
- Executes dropped EXE
PID:1880 -
\??\c:\pppdd.exec:\pppdd.exe29⤵
- Executes dropped EXE
PID:684 -
\??\c:\rlfrflx.exec:\rlfrflx.exe30⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hhbbnh.exec:\hhbbnh.exe31⤵
- Executes dropped EXE
PID:1312 -
\??\c:\vpdvj.exec:\vpdvj.exe32⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1fxfllx.exec:\1fxfllx.exe33⤵
- Executes dropped EXE
PID:988 -
\??\c:\hbntnn.exec:\hbntnn.exe34⤵
- Executes dropped EXE
PID:556 -
\??\c:\dvvdp.exec:\dvvdp.exe35⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jvjjp.exec:\jvjjp.exe36⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xrfrrxf.exec:\xrfrrxf.exe37⤵
- Executes dropped EXE
PID:2432 -
\??\c:\btnbnn.exec:\btnbnn.exe38⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vpdjp.exec:\vpdjp.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vpddd.exec:\vpddd.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe41⤵
- Executes dropped EXE
PID:1556 -
\??\c:\hbhthn.exec:\hbhthn.exe42⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bthtth.exec:\bthtth.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjddp.exec:\pjddp.exe44⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe45⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3rfxffl.exec:\3rfxffl.exe46⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5nttbh.exec:\5nttbh.exe47⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pvvvp.exec:\pvvvp.exe48⤵
- Executes dropped EXE
PID:2636 -
\??\c:\9fffllx.exec:\9fffllx.exe49⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rfxfllr.exec:\rfxfllr.exe50⤵
- Executes dropped EXE
PID:1192 -
\??\c:\btbnhh.exec:\btbnhh.exe51⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9dvjj.exec:\9dvjj.exe52⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fxflxrx.exec:\fxflxrx.exe53⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fflrfxf.exec:\fflrfxf.exe54⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hbbnbt.exec:\hbbnbt.exe55⤵
- Executes dropped EXE
PID:1676 -
\??\c:\1dvdp.exec:\1dvdp.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\7dpvv.exec:\7dpvv.exe57⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lfxxffr.exec:\lfxxffr.exe58⤵
- Executes dropped EXE
PID:1808 -
\??\c:\fxlrlfl.exec:\fxlrlfl.exe59⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hbntbn.exec:\hbntbn.exe60⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jvjpv.exec:\jvjpv.exe61⤵
- Executes dropped EXE
PID:1032 -
\??\c:\djjpj.exec:\djjpj.exe62⤵
- Executes dropped EXE
PID:1828 -
\??\c:\frlfllx.exec:\frlfllx.exe63⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rlrrrfx.exec:\rlrrrfx.exe64⤵
- Executes dropped EXE
PID:812 -
\??\c:\3bhbht.exec:\3bhbht.exe65⤵
- Executes dropped EXE
PID:324 -
\??\c:\hbntbh.exec:\hbntbh.exe66⤵PID:2084
-
\??\c:\jdvvd.exec:\jdvvd.exe67⤵PID:2008
-
\??\c:\dvvjp.exec:\dvvjp.exe68⤵PID:1464
-
\??\c:\rxxxllf.exec:\rxxxllf.exe69⤵PID:1196
-
\??\c:\5hhbhn.exec:\5hhbhn.exe70⤵PID:1308
-
\??\c:\7tbbhn.exec:\7tbbhn.exe71⤵PID:836
-
\??\c:\9vjdj.exec:\9vjdj.exe72⤵PID:1624
-
\??\c:\pdvvp.exec:\pdvvp.exe73⤵PID:1940
-
\??\c:\xrrfrfr.exec:\xrrfrfr.exe74⤵PID:1096
-
\??\c:\9xrxflr.exec:\9xrxflr.exe75⤵PID:884
-
\??\c:\bnhnth.exec:\bnhnth.exe76⤵PID:1040
-
\??\c:\5tttbh.exec:\5tttbh.exe77⤵PID:1564
-
\??\c:\pjjvd.exec:\pjjvd.exe78⤵PID:2060
-
\??\c:\vpvvj.exec:\vpvvj.exe79⤵PID:2280
-
\??\c:\fxrxffl.exec:\fxrxffl.exe80⤵PID:892
-
\??\c:\1llrxfl.exec:\1llrxfl.exe81⤵PID:2300
-
\??\c:\hhnthh.exec:\hhnthh.exe82⤵PID:2164
-
\??\c:\pjddp.exec:\pjddp.exe83⤵PID:2224
-
\??\c:\9jjvv.exec:\9jjvv.exe84⤵PID:2544
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe85⤵PID:1628
-
\??\c:\9bbhbt.exec:\9bbhbt.exe86⤵PID:1884
-
\??\c:\7bhhtt.exec:\7bhhtt.exe87⤵PID:1560
-
\??\c:\dvdjp.exec:\dvdjp.exe88⤵PID:2680
-
\??\c:\fxrlrrx.exec:\fxrlrrx.exe89⤵PID:2748
-
\??\c:\bthbhn.exec:\bthbhn.exe90⤵PID:2944
-
\??\c:\nbnbth.exec:\nbnbth.exe91⤵PID:2812
-
\??\c:\1pvvd.exec:\1pvvd.exe92⤵PID:2788
-
\??\c:\9lffrrf.exec:\9lffrrf.exe93⤵PID:2820
-
\??\c:\lflflff.exec:\lflflff.exe94⤵PID:2692
-
\??\c:\tnhtht.exec:\tnhtht.exe95⤵PID:3024
-
\??\c:\hntnht.exec:\hntnht.exe96⤵PID:1888
-
\??\c:\pjppd.exec:\pjppd.exe97⤵PID:2844
-
\??\c:\ffrrrlr.exec:\ffrrrlr.exe98⤵PID:2848
-
\??\c:\xrxlrxf.exec:\xrxlrxf.exe99⤵PID:2904
-
\??\c:\ttnhtt.exec:\ttnhtt.exe100⤵PID:2712
-
\??\c:\5vjpp.exec:\5vjpp.exe101⤵PID:2716
-
\??\c:\9vppv.exec:\9vppv.exe102⤵PID:1688
-
\??\c:\lxlrrxf.exec:\lxlrrxf.exe103⤵PID:1672
-
\??\c:\rfrxflf.exec:\rfrxflf.exe104⤵PID:1704
-
\??\c:\1htbhn.exec:\1htbhn.exe105⤵PID:2836
-
\??\c:\5hbhtn.exec:\5hbhtn.exe106⤵PID:2800
-
\??\c:\7jdjv.exec:\7jdjv.exe107⤵PID:908
-
\??\c:\jjvpd.exec:\jjvpd.exe108⤵PID:3068
-
\??\c:\lfxxffr.exec:\lfxxffr.exe109⤵PID:1772
-
\??\c:\9bhhnt.exec:\9bhhnt.exe110⤵PID:372
-
\??\c:\pdpvj.exec:\pdpvj.exe111⤵PID:348
-
\??\c:\pjvjd.exec:\pjvjd.exe112⤵PID:2208
-
\??\c:\xxlrxfl.exec:\xxlrxfl.exe113⤵PID:2008
-
\??\c:\3lxflrf.exec:\3lxflrf.exe114⤵PID:2412
-
\??\c:\nhtbnn.exec:\nhtbnn.exe115⤵PID:1196
-
\??\c:\vdvdv.exec:\vdvdv.exe116⤵PID:2252
-
\??\c:\9ddpv.exec:\9ddpv.exe117⤵PID:836
-
\??\c:\lxlxffx.exec:\lxlxffx.exe118⤵PID:1880
-
\??\c:\3hbhnh.exec:\3hbhnh.exe119⤵PID:1848
-
\??\c:\nhhbnb.exec:\nhhbnb.exe120⤵PID:684
-
\??\c:\jdvdd.exec:\jdvdd.exe121⤵PID:936
-
\??\c:\vjpvd.exec:\vjpvd.exe122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-