Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 22:22
Behavioral task
behavioral1
Sample
0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe
-
Size
173KB
-
MD5
0f4515cf3ade269e6ad0d81a0ee990f0
-
SHA1
5d8135c2abe989f50ee4cf2f706842a52f5886f3
-
SHA256
aae802b6232494f8ace0bb982dfc16844fd4cf1c414f9e4a28751e8b87dc4b54
-
SHA512
95a125c9eb3f7c279afc7b648282073103e7062461a9869611a57837aa401af7fc1b8199768d6f277484eed938dcef2ae644cd5621024baa215872ce53fe4def
-
SSDEEP
3072:ehOmTsF93UYfwC6GIout1sWRkVap3daVszyKd+XqQz0esujClt+zZ4dMovmW1q7M:ecm4FmowdHoSKWqoFdAszBd+aQz0IClL
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/1368-1-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2348-10-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2656-27-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2700-38-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2868-53-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2528-61-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2548-74-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2612-71-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2788-89-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/608-108-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1532-106-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1144-126-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1876-143-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2196-152-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/880-161-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1188-170-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2236-213-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/788-216-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2204-240-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/560-249-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1680-281-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1984-315-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2628-323-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2872-341-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2868-360-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2404-410-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/816-423-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1548-487-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1712-525-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2432-583-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1472-685-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2616-933-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2956-959-0x00000000001B0000-0x00000000001E0000-memory.dmp family_blackmoon behavioral1/memory/1868-1015-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 34 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000f00000001226b-5.dat family_berbew behavioral1/files/0x0036000000016c71-17.dat family_berbew behavioral1/files/0x0008000000016d1b-24.dat family_berbew behavioral1/files/0x0008000000016d2c-36.dat family_berbew behavioral1/files/0x0007000000016d3d-44.dat family_berbew behavioral1/files/0x0007000000016d45-54.dat family_berbew behavioral1/files/0x0007000000016d4e-62.dat family_berbew behavioral1/files/0x0008000000016d65-80.dat family_berbew behavioral1/files/0x0008000000016d61-72.dat family_berbew behavioral1/files/0x00050000000186f1-86.dat family_berbew behavioral1/files/0x00050000000186ff-97.dat family_berbew behavioral1/files/0x0005000000018739-103.dat family_berbew behavioral1/files/0x000500000001873f-116.dat family_berbew behavioral1/files/0x0005000000018787-124.dat family_berbew behavioral1/files/0x000500000001878d-132.dat family_berbew behavioral1/files/0x0006000000018bf0-145.dat family_berbew behavioral1/memory/1876-140-0x0000000000260000-0x0000000000290000-memory.dmp family_berbew behavioral1/files/0x0005000000019228-153.dat family_berbew behavioral1/files/0x000500000001923b-163.dat family_berbew behavioral1/files/0x000500000001925d-171.dat family_berbew behavioral1/files/0x0005000000019260-177.dat family_berbew behavioral1/files/0x0005000000019275-188.dat family_berbew behavioral1/files/0x0036000000016c7a-196.dat family_berbew behavioral1/files/0x0005000000019277-204.dat family_berbew behavioral1/files/0x0005000000019283-215.dat family_berbew behavioral1/files/0x000500000001933a-223.dat family_berbew behavioral1/files/0x0005000000019381-231.dat family_berbew behavioral1/files/0x000500000001939f-238.dat family_berbew behavioral1/files/0x00050000000193a5-248.dat family_berbew behavioral1/files/0x00050000000193b1-257.dat family_berbew behavioral1/files/0x0005000000019433-265.dat family_berbew behavioral1/files/0x000500000001943e-273.dat family_berbew behavioral1/files/0x0005000000019457-283.dat family_berbew behavioral1/memory/1876-455-0x0000000000260000-0x0000000000290000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2348 rrxxlff.exe 3040 7rlxxrf.exe 2656 hbbnbt.exe 2700 ppdpp.exe 2868 1xrxrlr.exe 2528 5djvj.exe 2612 rfffllr.exe 2548 bhtnbt.exe 2788 pjddj.exe 2420 hbbnbn.exe 1532 hbtnnt.exe 608 ddddj.exe 1856 7lllrrf.exe 1144 1hbhht.exe 1876 jpjpp.exe 2196 1xllfxf.exe 880 nnntht.exe 1188 bnhttb.exe 1372 tthtbh.exe 2840 7fxrxxf.exe 2740 5nbnbn.exe 2888 vjpvp.exe 2236 ttttnn.exe 788 ddjdp.exe 2900 frllrrr.exe 2204 ttntbh.exe 560 jjpjp.exe 324 lfflrfl.exe 2448 nbhthh.exe 2584 pjvdp.exe 1680 3fxlflx.exe 2932 ttnthn.exe 1420 pppvp.exe 2020 rlllrlx.exe 2356 hbthnt.exe 1984 1dddd.exe 3040 9frfrff.exe 2628 9bbhtn.exe 1492 pjdjp.exe 2872 jpvjj.exe 2660 xrflfll.exe 2388 nhnthb.exe 2868 vjdjj.exe 2500 lflxlrf.exe 2232 llxlrfr.exe 2548 vpddj.exe 2948 llrrflf.exe 2184 rrxlrxx.exe 1796 nnnbtb.exe 1504 jdvdd.exe 2404 xxlxfrf.exe 2476 fxrxlfr.exe 816 bbnntt.exe 1144 pjpdd.exe 1852 7vvjj.exe 1864 llxrlrf.exe 2196 5tntnn.exe 440 jddvp.exe 264 rfrlxrr.exe 1188 nhhbtn.exe 2844 tnhnbh.exe 2812 3vvjj.exe 1548 lxllrlx.exe 2852 btttbn.exe -
resource yara_rule behavioral1/memory/1368-1-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x000f00000001226b-5.dat upx behavioral1/memory/2348-10-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0036000000016c71-17.dat upx behavioral1/files/0x0008000000016d1b-24.dat upx behavioral1/memory/2656-27-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0008000000016d2c-36.dat upx behavioral1/files/0x0007000000016d3d-44.dat upx behavioral1/memory/2700-38-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/2656-32-0x0000000000230000-0x0000000000260000-memory.dmp upx behavioral1/files/0x0007000000016d45-54.dat upx behavioral1/memory/2868-53-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0007000000016d4e-62.dat upx behavioral1/memory/2528-61-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0008000000016d65-80.dat upx behavioral1/memory/2548-74-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0008000000016d61-72.dat upx behavioral1/memory/2612-71-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x00050000000186f1-86.dat upx behavioral1/memory/2788-89-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x00050000000186ff-97.dat upx behavioral1/files/0x0005000000018739-103.dat upx behavioral1/memory/608-108-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/1532-106-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x000500000001873f-116.dat upx behavioral1/memory/1144-126-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0005000000018787-124.dat upx behavioral1/files/0x000500000001878d-132.dat upx behavioral1/memory/1876-133-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0006000000018bf0-145.dat upx behavioral1/memory/2196-144-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/1876-143-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0005000000019228-153.dat upx behavioral1/memory/2196-152-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/880-161-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x000500000001923b-163.dat upx behavioral1/memory/1188-162-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x000500000001925d-171.dat upx behavioral1/memory/1188-170-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0005000000019260-177.dat upx behavioral1/files/0x0005000000019275-188.dat upx behavioral1/files/0x0036000000016c7a-196.dat upx behavioral1/files/0x0005000000019277-204.dat upx behavioral1/memory/2236-205-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/2236-213-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0005000000019283-215.dat upx behavioral1/memory/788-216-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x000500000001933a-223.dat upx behavioral1/files/0x0005000000019381-231.dat upx behavioral1/files/0x000500000001939f-238.dat upx behavioral1/memory/2204-240-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x00050000000193a5-248.dat upx behavioral1/memory/560-249-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x00050000000193b1-257.dat upx behavioral1/files/0x0005000000019433-265.dat upx behavioral1/files/0x000500000001943e-273.dat upx behavioral1/memory/1680-281-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/files/0x0005000000019457-283.dat upx behavioral1/memory/2356-302-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/1984-315-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/2628-323-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/2872-341-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/2868-360-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/2232-367-0x0000000000400000-0x0000000000430000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2348 1368 0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe 28 PID 1368 wrote to memory of 2348 1368 0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe 28 PID 1368 wrote to memory of 2348 1368 0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe 28 PID 1368 wrote to memory of 2348 1368 0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe 28 PID 2348 wrote to memory of 3040 2348 rrxxlff.exe 29 PID 2348 wrote to memory of 3040 2348 rrxxlff.exe 29 PID 2348 wrote to memory of 3040 2348 rrxxlff.exe 29 PID 2348 wrote to memory of 3040 2348 rrxxlff.exe 29 PID 3040 wrote to memory of 2656 3040 7rlxxrf.exe 30 PID 3040 wrote to memory of 2656 3040 7rlxxrf.exe 30 PID 3040 wrote to memory of 2656 3040 7rlxxrf.exe 30 PID 3040 wrote to memory of 2656 3040 7rlxxrf.exe 30 PID 2656 wrote to memory of 2700 2656 hbbnbt.exe 31 PID 2656 wrote to memory of 2700 2656 hbbnbt.exe 31 PID 2656 wrote to memory of 2700 2656 hbbnbt.exe 31 PID 2656 wrote to memory of 2700 2656 hbbnbt.exe 31 PID 2700 wrote to memory of 2868 2700 ppdpp.exe 32 PID 2700 wrote to memory of 2868 2700 ppdpp.exe 32 PID 2700 wrote to memory of 2868 2700 ppdpp.exe 32 PID 2700 wrote to memory of 2868 2700 ppdpp.exe 32 PID 2868 wrote to memory of 2528 2868 1xrxrlr.exe 33 PID 2868 wrote to memory of 2528 2868 1xrxrlr.exe 33 PID 2868 wrote to memory of 2528 2868 1xrxrlr.exe 33 PID 2868 wrote to memory of 2528 2868 1xrxrlr.exe 33 PID 2528 wrote to memory of 2612 2528 5djvj.exe 34 PID 2528 wrote to memory of 2612 2528 5djvj.exe 34 PID 2528 wrote to memory of 2612 2528 5djvj.exe 34 PID 2528 wrote to memory of 2612 2528 5djvj.exe 34 PID 2612 wrote to memory of 2548 2612 rfffllr.exe 35 PID 2612 wrote to memory of 2548 2612 rfffllr.exe 35 PID 2612 wrote to memory of 2548 2612 rfffllr.exe 35 PID 2612 wrote to memory of 2548 2612 rfffllr.exe 35 PID 2548 wrote to memory of 2788 2548 bhtnbt.exe 36 PID 2548 wrote to memory of 2788 2548 bhtnbt.exe 36 PID 2548 wrote to memory of 2788 2548 bhtnbt.exe 36 PID 2548 wrote to memory of 2788 2548 bhtnbt.exe 36 PID 2788 wrote to memory of 2420 2788 pjddj.exe 37 PID 2788 wrote to memory of 2420 2788 pjddj.exe 37 PID 2788 wrote to memory of 2420 2788 pjddj.exe 37 PID 2788 wrote to memory of 2420 2788 pjddj.exe 37 PID 2420 wrote to memory of 1532 2420 hbbnbn.exe 38 PID 2420 wrote to memory of 1532 2420 hbbnbn.exe 38 PID 2420 wrote to memory of 1532 2420 hbbnbn.exe 38 PID 2420 wrote to memory of 1532 2420 hbbnbn.exe 38 PID 1532 wrote to memory of 608 1532 hbtnnt.exe 39 PID 1532 wrote to memory of 608 1532 hbtnnt.exe 39 PID 1532 wrote to memory of 608 1532 hbtnnt.exe 39 PID 1532 wrote to memory of 608 1532 hbtnnt.exe 39 PID 608 wrote to memory of 1856 608 ddddj.exe 40 PID 608 wrote to memory of 1856 608 ddddj.exe 40 PID 608 wrote to memory of 1856 608 ddddj.exe 40 PID 608 wrote to memory of 1856 608 ddddj.exe 40 PID 1856 wrote to memory of 1144 1856 7lllrrf.exe 41 PID 1856 wrote to memory of 1144 1856 7lllrrf.exe 41 PID 1856 wrote to memory of 1144 1856 7lllrrf.exe 41 PID 1856 wrote to memory of 1144 1856 7lllrrf.exe 41 PID 1144 wrote to memory of 1876 1144 1hbhht.exe 42 PID 1144 wrote to memory of 1876 1144 1hbhht.exe 42 PID 1144 wrote to memory of 1876 1144 1hbhht.exe 42 PID 1144 wrote to memory of 1876 1144 1hbhht.exe 42 PID 1876 wrote to memory of 2196 1876 jpjpp.exe 43 PID 1876 wrote to memory of 2196 1876 jpjpp.exe 43 PID 1876 wrote to memory of 2196 1876 jpjpp.exe 43 PID 1876 wrote to memory of 2196 1876 jpjpp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\rrxxlff.exec:\rrxxlff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\7rlxxrf.exec:\7rlxxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\hbbnbt.exec:\hbbnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\ppdpp.exec:\ppdpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\1xrxrlr.exec:\1xrxrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\5djvj.exec:\5djvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\rfffllr.exec:\rfffllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\bhtnbt.exec:\bhtnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\pjddj.exec:\pjddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hbbnbn.exec:\hbbnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\hbtnnt.exec:\hbtnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\ddddj.exec:\ddddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\7lllrrf.exec:\7lllrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\1hbhht.exec:\1hbhht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\jpjpp.exec:\jpjpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\1xllfxf.exec:\1xllfxf.exe17⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nnntht.exec:\nnntht.exe18⤵
- Executes dropped EXE
PID:880 -
\??\c:\bnhttb.exec:\bnhttb.exe19⤵
- Executes dropped EXE
PID:1188 -
\??\c:\tthtbh.exec:\tthtbh.exe20⤵
- Executes dropped EXE
PID:1372 -
\??\c:\7fxrxxf.exec:\7fxrxxf.exe21⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5nbnbn.exec:\5nbnbn.exe22⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vjpvp.exec:\vjpvp.exe23⤵
- Executes dropped EXE
PID:2888 -
\??\c:\ttttnn.exec:\ttttnn.exe24⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ddjdp.exec:\ddjdp.exe25⤵
- Executes dropped EXE
PID:788 -
\??\c:\frllrrr.exec:\frllrrr.exe26⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ttntbh.exec:\ttntbh.exe27⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jjpjp.exec:\jjpjp.exe28⤵
- Executes dropped EXE
PID:560 -
\??\c:\lfflrfl.exec:\lfflrfl.exe29⤵
- Executes dropped EXE
PID:324 -
\??\c:\nbhthh.exec:\nbhthh.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pjvdp.exec:\pjvdp.exe31⤵
- Executes dropped EXE
PID:2584 -
\??\c:\3fxlflx.exec:\3fxlflx.exe32⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ttnthn.exec:\ttnthn.exe33⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pppvp.exec:\pppvp.exe34⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rlllrlx.exec:\rlllrlx.exe35⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hbthnt.exec:\hbthnt.exe36⤵
- Executes dropped EXE
PID:2356 -
\??\c:\1dddd.exec:\1dddd.exe37⤵
- Executes dropped EXE
PID:1984 -
\??\c:\9frfrff.exec:\9frfrff.exe38⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9bbhtn.exec:\9bbhtn.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pjdjp.exec:\pjdjp.exe40⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jpvjj.exec:\jpvjj.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xrflfll.exec:\xrflfll.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nhnthb.exec:\nhnthb.exe43⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vjdjj.exec:\vjdjj.exe44⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lflxlrf.exec:\lflxlrf.exe45⤵
- Executes dropped EXE
PID:2500 -
\??\c:\llxlrfr.exec:\llxlrfr.exe46⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vpddj.exec:\vpddj.exe47⤵
- Executes dropped EXE
PID:2548 -
\??\c:\llrrflf.exec:\llrrflf.exe48⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rrxlrxx.exec:\rrxlrxx.exe49⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nnnbtb.exec:\nnnbtb.exe50⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jdvdd.exec:\jdvdd.exe51⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xxlxfrf.exec:\xxlxfrf.exe52⤵
- Executes dropped EXE
PID:2404 -
\??\c:\fxrxlfr.exec:\fxrxlfr.exe53⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bbnntt.exec:\bbnntt.exe54⤵
- Executes dropped EXE
PID:816 -
\??\c:\pjpdd.exec:\pjpdd.exe55⤵
- Executes dropped EXE
PID:1144 -
\??\c:\7vvjj.exec:\7vvjj.exe56⤵
- Executes dropped EXE
PID:1852 -
\??\c:\llxrlrf.exec:\llxrlrf.exe57⤵
- Executes dropped EXE
PID:1864 -
\??\c:\5tntnn.exec:\5tntnn.exe58⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jddvp.exec:\jddvp.exe59⤵
- Executes dropped EXE
PID:440 -
\??\c:\rfrlxrr.exec:\rfrlxrr.exe60⤵
- Executes dropped EXE
PID:264 -
\??\c:\nhhbtn.exec:\nhhbtn.exe61⤵
- Executes dropped EXE
PID:1188 -
\??\c:\tnhnbh.exec:\tnhnbh.exe62⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3vvjj.exec:\3vvjj.exe63⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lxllrlx.exec:\lxllrlx.exe64⤵
- Executes dropped EXE
PID:1548 -
\??\c:\btttbn.exec:\btttbn.exe65⤵
- Executes dropped EXE
PID:2852 -
\??\c:\3hbbnn.exec:\3hbbnn.exe66⤵PID:2364
-
\??\c:\dvppp.exec:\dvppp.exe67⤵PID:3008
-
\??\c:\xlfllrl.exec:\xlfllrl.exe68⤵PID:2456
-
\??\c:\3bntnn.exec:\3bntnn.exe69⤵PID:1096
-
\??\c:\bbtthh.exec:\bbtthh.exe70⤵PID:1712
-
\??\c:\1ddjv.exec:\1ddjv.exe71⤵PID:1328
-
\??\c:\lfxlflf.exec:\lfxlflf.exe72⤵PID:1920
-
\??\c:\nhhnbh.exec:\nhhnbh.exe73⤵PID:908
-
\??\c:\3htbnn.exec:\3htbnn.exe74⤵PID:680
-
\??\c:\rxfxxrl.exec:\rxfxxrl.exe75⤵PID:2448
-
\??\c:\ffxfxlx.exec:\ffxfxlx.exe76⤵PID:1952
-
\??\c:\tbbtbt.exec:\tbbtbt.exe77⤵PID:340
-
\??\c:\vpdpj.exec:\vpdpj.exe78⤵PID:2124
-
\??\c:\3pjvj.exec:\3pjvj.exe79⤵PID:2432
-
\??\c:\fxxlxlf.exec:\fxxlxlf.exe80⤵PID:2084
-
\??\c:\tnbthh.exec:\tnbthh.exe81⤵PID:2140
-
\??\c:\tbhtht.exec:\tbhtht.exe82⤵PID:2356
-
\??\c:\dvpjj.exec:\dvpjj.exe83⤵PID:3044
-
\??\c:\frxxlrl.exec:\frxxlrl.exe84⤵PID:3040
-
\??\c:\3nthbn.exec:\3nthbn.exe85⤵PID:2592
-
\??\c:\hhnhbt.exec:\hhnhbt.exe86⤵PID:2632
-
\??\c:\vvddj.exec:\vvddj.exe87⤵PID:2768
-
\??\c:\xxrrllx.exec:\xxrrllx.exe88⤵PID:2684
-
\??\c:\9xxflfr.exec:\9xxflfr.exe89⤵PID:2616
-
\??\c:\tntthh.exec:\tntthh.exe90⤵PID:2784
-
\??\c:\ddvvv.exec:\ddvvv.exe91⤵PID:2516
-
\??\c:\jvvdp.exec:\jvvdp.exe92⤵PID:1552
-
\??\c:\9xrrxfl.exec:\9xrrxfl.exe93⤵PID:1932
-
\??\c:\thhhtt.exec:\thhhtt.exe94⤵PID:1976
-
\??\c:\nnhhbn.exec:\nnhhbn.exe95⤵PID:2024
-
\??\c:\vvpjp.exec:\vvpjp.exe96⤵PID:1472
-
\??\c:\ffrfrlr.exec:\ffrfrlr.exe97⤵PID:1844
-
\??\c:\xxrfrff.exec:\xxrfrff.exe98⤵PID:760
-
\??\c:\5hbhbb.exec:\5hbhbb.exe99⤵PID:1496
-
\??\c:\1pjvd.exec:\1pjvd.exe100⤵PID:1856
-
\??\c:\vppdv.exec:\vppdv.exe101⤵PID:2412
-
\??\c:\fffrflf.exec:\fffrflf.exe102⤵PID:1876
-
\??\c:\thbthh.exec:\thbthh.exe103⤵PID:1868
-
\??\c:\jddjd.exec:\jddjd.exe104⤵PID:480
-
\??\c:\xxxfxfx.exec:\xxxfxfx.exe105⤵PID:1332
-
\??\c:\lllllxl.exec:\lllllxl.exe106⤵PID:2732
-
\??\c:\ttnhbn.exec:\ttnhbn.exe107⤵PID:1688
-
\??\c:\pppdp.exec:\pppdp.exe108⤵PID:2676
-
\??\c:\fxrrlxx.exec:\fxrrlxx.exe109⤵PID:580
-
\??\c:\frlrfxr.exec:\frlrfxr.exe110⤵PID:2712
-
\??\c:\hhbhtb.exec:\hhbhtb.exe111⤵PID:684
-
\??\c:\jdppd.exec:\jdppd.exe112⤵PID:3016
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe113⤵PID:2460
-
\??\c:\llrllrf.exec:\llrllrf.exe114⤵PID:2332
-
\??\c:\ttnnnt.exec:\ttnnnt.exe115⤵PID:1464
-
\??\c:\btnbnh.exec:\btnbnh.exe116⤵PID:348
-
\??\c:\lfllxfr.exec:\lfllxfr.exe117⤵PID:1204
-
\??\c:\3lflrxr.exec:\3lflrxr.exe118⤵PID:1716
-
\??\c:\nthnhn.exec:\nthnhn.exe119⤵PID:2088
-
\??\c:\vdjpd.exec:\vdjpd.exe120⤵PID:1224
-
\??\c:\lllrllf.exec:\lllrllf.exe121⤵PID:1888
-
\??\c:\rlfrflf.exec:\rlfrflf.exe122⤵PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-