Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 17:00
Behavioral task
behavioral1
Sample
293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe
-
Size
350KB
-
MD5
293240fe27f10a1273bb502f7d9c8f30
-
SHA1
b340f23aa3daa34da8455476bc881f110c1054f7
-
SHA256
67caeabf4baf55e2b5d677b35a4cd15615f7680a566c9df269f48a7f435ff297
-
SHA512
e8ca2a58b1b90ac803599f688c7bc1f6f4f91b86f8de219c95b22584cca6db5c7a9e17ad0f450c7b553600fdc6993ad5991cd536e0afb399ef2e54f38a2e6e30
-
SSDEEP
6144:4cm7ImGddXvJuzyy/SfVFKpU/sien7NuOpo0HmtDKe0wKyKqiOfm8RCfDK4TrHI:+7TcBuGy/Sa+/sie0OpncKe/KFBOfmzQ
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2012-8-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1988-22-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2612-35-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2564-38-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2692-47-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2688-73-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2200-84-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2796-101-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2480-82-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2924-112-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1416-139-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1924-185-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1900-233-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2992-299-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1424-290-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2900-281-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1524-315-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1524-322-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2096-313-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1532-407-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2828-388-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2096-306-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2332-258-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2980-224-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1724-204-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2228-187-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2044-175-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1496-158-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2664-156-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/276-136-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2776-110-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2428-64-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2316-520-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2232-548-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1636-575-0x00000000001B0000-0x00000000001DD000-memory.dmp family_blackmoon behavioral1/memory/1984-591-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1320-789-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/312-833-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/848-946-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1428-1120-0x00000000001B0000-0x00000000001DD000-memory.dmp family_blackmoon behavioral1/memory/2580-1230-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000b00000001430e-5.dat family_berbew behavioral1/files/0x00350000000144e9-18.dat family_berbew behavioral1/files/0x0007000000014701-25.dat family_berbew behavioral1/files/0x000700000001470b-36.dat family_berbew behavioral1/files/0x0007000000014817-46.dat family_berbew behavioral1/files/0x0007000000014983-54.dat family_berbew behavioral1/files/0x0009000000014b12-65.dat family_berbew behavioral1/files/0x0007000000015c6d-72.dat family_berbew behavioral1/files/0x0006000000015c7c-83.dat family_berbew behavioral1/files/0x0006000000015c86-91.dat family_berbew behavioral1/files/0x0006000000015c9c-99.dat family_berbew behavioral1/files/0x0006000000015cad-118.dat family_berbew behavioral1/files/0x0006000000015cb9-127.dat family_berbew behavioral1/files/0x0006000000015cc1-137.dat family_berbew behavioral1/files/0x0006000000015cdb-154.dat family_berbew behavioral1/files/0x0006000000015cec-164.dat family_berbew behavioral1/files/0x0006000000015cf7-177.dat family_berbew behavioral1/files/0x0006000000015d06-186.dat family_berbew behavioral1/files/0x0006000000015d5d-193.dat family_berbew behavioral1/files/0x0006000000015f1b-210.dat family_berbew behavioral1/files/0x0006000000016056-241.dat family_berbew behavioral1/files/0x00060000000160f8-249.dat family_berbew behavioral1/files/0x0006000000016277-257.dat family_berbew behavioral1/files/0x0006000000016411-265.dat family_berbew behavioral1/files/0x0006000000016525-273.dat family_berbew behavioral1/files/0x0006000000016597-283.dat family_berbew behavioral1/files/0x00060000000167ef-292.dat family_berbew behavioral1/memory/2420-361-0x0000000000220000-0x000000000024D000-memory.dmp family_berbew behavioral1/files/0x0006000000015f9e-231.dat family_berbew behavioral1/files/0x003400000001450b-223.dat family_berbew behavioral1/files/0x0006000000015d6e-205.dat family_berbew behavioral1/files/0x0006000000015cca-147.dat family_berbew behavioral1/files/0x0006000000015ca5-111.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2100 nhtbtb.exe 1988 5pdjv.exe 2612 lfxflff.exe 2564 ppjdp.exe 2692 xrrxlfl.exe 2428 nnntth.exe 2688 vdvjj.exe 2480 9rflfxx.exe 2200 thntbb.exe 2796 vvpdp.exe 2776 lxxrxlr.exe 2924 7jpvv.exe 1208 ddpdj.exe 276 lrxxfff.exe 1416 5btbnt.exe 2664 jdjdj.exe 1496 xxlrrxl.exe 2044 5xllrxf.exe 1924 5tthtb.exe 2228 1jpdv.exe 1724 xfxrxfl.exe 268 nhtthh.exe 804 pjdjj.exe 2980 fxfllrx.exe 1900 ttthtb.exe 320 tntbnt.exe 1676 jdppj.exe 2332 fxlrrxx.exe 3004 ttbbbb.exe 2900 vjpdd.exe 1424 1xrlrlr.exe 2992 bnhbnh.exe 2084 pjppp.exe 2096 frfxfff.exe 1524 lxffllr.exe 1988 7bnhbh.exe 2620 jvjjp.exe 2700 7jjjj.exe 2440 frffffl.exe 2572 bnbbhb.exe 2420 nbtbhh.exe 2404 djddj.exe 2460 jjdjv.exe 2956 ffrflrx.exe 2736 nbntnt.exe 2828 hbtbhh.exe 356 vjdjp.exe 2976 dvjjp.exe 1532 lfrxflx.exe 1604 nnnbnb.exe 276 bttbbb.exe 2732 dddvv.exe 2648 jpddv.exe 1044 rfxffrl.exe 2504 bthtnt.exe 2044 pjdjp.exe 2936 tnnthn.exe 1856 jdpdj.exe 1680 llrxlxx.exe 988 7nntht.exe 544 9ddpj.exe 764 frxxxfl.exe 804 hbhbhh.exe 948 1vvdp.exe -
resource yara_rule behavioral1/memory/2012-0-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2100-9-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2012-8-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1988-22-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2612-35-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2564-38-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2692-47-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2428-55-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2688-73-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2200-84-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2796-101-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2480-82-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2924-112-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1416-139-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2664-148-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1924-185-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1900-233-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2992-299-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1424-290-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2900-281-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1524-315-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1524-322-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2700-335-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2096-313-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2572-348-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2736-381-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1532-407-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2828-388-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2096-306-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2332-258-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2980-224-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1724-204-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1724-195-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2228-187-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2044-175-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1496-158-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2664-156-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2776-110-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2428-64-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/804-493-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2316-520-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2232-548-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2592-576-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2616-584-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1984-591-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1716-610-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2736-665-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2744-672-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2644-739-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2228-746-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1320-789-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1644-820-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1872-846-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2084-860-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2616-867-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2412-874-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1716-893-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2440-900-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2448-914-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2664-990-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1684-1009-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2240-1149-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2416-1186-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2792-1211-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2100 2012 293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe 28 PID 2012 wrote to memory of 2100 2012 293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe 28 PID 2012 wrote to memory of 2100 2012 293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe 28 PID 2012 wrote to memory of 2100 2012 293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe 28 PID 2100 wrote to memory of 1988 2100 nhtbtb.exe 63 PID 2100 wrote to memory of 1988 2100 nhtbtb.exe 63 PID 2100 wrote to memory of 1988 2100 nhtbtb.exe 63 PID 2100 wrote to memory of 1988 2100 nhtbtb.exe 63 PID 1988 wrote to memory of 2612 1988 5pdjv.exe 30 PID 1988 wrote to memory of 2612 1988 5pdjv.exe 30 PID 1988 wrote to memory of 2612 1988 5pdjv.exe 30 PID 1988 wrote to memory of 2612 1988 5pdjv.exe 30 PID 2612 wrote to memory of 2564 2612 lfxflff.exe 31 PID 2612 wrote to memory of 2564 2612 lfxflff.exe 31 PID 2612 wrote to memory of 2564 2612 lfxflff.exe 31 PID 2612 wrote to memory of 2564 2612 lfxflff.exe 31 PID 2564 wrote to memory of 2692 2564 ppjdp.exe 32 PID 2564 wrote to memory of 2692 2564 ppjdp.exe 32 PID 2564 wrote to memory of 2692 2564 ppjdp.exe 32 PID 2564 wrote to memory of 2692 2564 ppjdp.exe 32 PID 2692 wrote to memory of 2428 2692 xrrxlfl.exe 33 PID 2692 wrote to memory of 2428 2692 xrrxlfl.exe 33 PID 2692 wrote to memory of 2428 2692 xrrxlfl.exe 33 PID 2692 wrote to memory of 2428 2692 xrrxlfl.exe 33 PID 2428 wrote to memory of 2688 2428 nnntth.exe 34 PID 2428 wrote to memory of 2688 2428 nnntth.exe 34 PID 2428 wrote to memory of 2688 2428 nnntth.exe 34 PID 2428 wrote to memory of 2688 2428 nnntth.exe 34 PID 2688 wrote to memory of 2480 2688 vdvjj.exe 35 PID 2688 wrote to memory of 2480 2688 vdvjj.exe 35 PID 2688 wrote to memory of 2480 2688 vdvjj.exe 35 PID 2688 wrote to memory of 2480 2688 vdvjj.exe 35 PID 2480 wrote to memory of 2200 2480 9rflfxx.exe 36 PID 2480 wrote to memory of 2200 2480 9rflfxx.exe 36 PID 2480 wrote to memory of 2200 2480 9rflfxx.exe 36 PID 2480 wrote to memory of 2200 2480 9rflfxx.exe 36 PID 2200 wrote to memory of 2796 2200 thntbb.exe 37 PID 2200 wrote to memory of 2796 2200 thntbb.exe 37 PID 2200 wrote to memory of 2796 2200 thntbb.exe 37 PID 2200 wrote to memory of 2796 2200 thntbb.exe 37 PID 2796 wrote to memory of 2776 2796 vvpdp.exe 38 PID 2796 wrote to memory of 2776 2796 vvpdp.exe 38 PID 2796 wrote to memory of 2776 2796 vvpdp.exe 38 PID 2796 wrote to memory of 2776 2796 vvpdp.exe 38 PID 2776 wrote to memory of 2924 2776 lxxrxlr.exe 39 PID 2776 wrote to memory of 2924 2776 lxxrxlr.exe 39 PID 2776 wrote to memory of 2924 2776 lxxrxlr.exe 39 PID 2776 wrote to memory of 2924 2776 lxxrxlr.exe 39 PID 2924 wrote to memory of 1208 2924 7jpvv.exe 40 PID 2924 wrote to memory of 1208 2924 7jpvv.exe 40 PID 2924 wrote to memory of 1208 2924 7jpvv.exe 40 PID 2924 wrote to memory of 1208 2924 7jpvv.exe 40 PID 1208 wrote to memory of 276 1208 ddpdj.exe 41 PID 1208 wrote to memory of 276 1208 ddpdj.exe 41 PID 1208 wrote to memory of 276 1208 ddpdj.exe 41 PID 1208 wrote to memory of 276 1208 ddpdj.exe 41 PID 276 wrote to memory of 1416 276 lrxxfff.exe 42 PID 276 wrote to memory of 1416 276 lrxxfff.exe 42 PID 276 wrote to memory of 1416 276 lrxxfff.exe 42 PID 276 wrote to memory of 1416 276 lrxxfff.exe 42 PID 1416 wrote to memory of 2664 1416 5btbnt.exe 43 PID 1416 wrote to memory of 2664 1416 5btbnt.exe 43 PID 1416 wrote to memory of 2664 1416 5btbnt.exe 43 PID 1416 wrote to memory of 2664 1416 5btbnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\nhtbtb.exec:\nhtbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\5pdjv.exec:\5pdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\lfxflff.exec:\lfxflff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\ppjdp.exec:\ppjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\xrrxlfl.exec:\xrrxlfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nnntth.exec:\nnntth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\vdvjj.exec:\vdvjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\9rflfxx.exec:\9rflfxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\thntbb.exec:\thntbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\vvpdp.exec:\vvpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\lxxrxlr.exec:\lxxrxlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\7jpvv.exec:\7jpvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\ddpdj.exec:\ddpdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\lrxxfff.exec:\lrxxfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\5btbnt.exec:\5btbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\jdjdj.exec:\jdjdj.exe17⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xxlrrxl.exec:\xxlrrxl.exe18⤵
- Executes dropped EXE
PID:1496 -
\??\c:\5xllrxf.exec:\5xllrxf.exe19⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5tthtb.exec:\5tthtb.exe20⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1jpdv.exec:\1jpdv.exe21⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xfxrxfl.exec:\xfxrxfl.exe22⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nhtthh.exec:\nhtthh.exe23⤵
- Executes dropped EXE
PID:268 -
\??\c:\pjdjj.exec:\pjdjj.exe24⤵
- Executes dropped EXE
PID:804 -
\??\c:\fxfllrx.exec:\fxfllrx.exe25⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ttthtb.exec:\ttthtb.exe26⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tntbnt.exec:\tntbnt.exe27⤵
- Executes dropped EXE
PID:320 -
\??\c:\jdppj.exec:\jdppj.exe28⤵
- Executes dropped EXE
PID:1676 -
\??\c:\fxlrrxx.exec:\fxlrrxx.exe29⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ttbbbb.exec:\ttbbbb.exe30⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vjpdd.exec:\vjpdd.exe31⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1xrlrlr.exec:\1xrlrlr.exe32⤵
- Executes dropped EXE
PID:1424 -
\??\c:\bnhbnh.exec:\bnhbnh.exe33⤵
- Executes dropped EXE
PID:2992 -
\??\c:\pjppp.exec:\pjppp.exe34⤵
- Executes dropped EXE
PID:2084 -
\??\c:\frfxfff.exec:\frfxfff.exe35⤵
- Executes dropped EXE
PID:2096 -
\??\c:\lxffllr.exec:\lxffllr.exe36⤵
- Executes dropped EXE
PID:1524 -
\??\c:\7bnhbh.exec:\7bnhbh.exe37⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jvjjp.exec:\jvjjp.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7jjjj.exec:\7jjjj.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\frffffl.exec:\frffffl.exe40⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bnbbhb.exec:\bnbbhb.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nbtbhh.exec:\nbtbhh.exe42⤵
- Executes dropped EXE
PID:2420 -
\??\c:\djddj.exec:\djddj.exe43⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jjdjv.exec:\jjdjv.exe44⤵
- Executes dropped EXE
PID:2460 -
\??\c:\ffrflrx.exec:\ffrflrx.exe45⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nbntnt.exec:\nbntnt.exe46⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hbtbhh.exec:\hbtbhh.exe47⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vjdjp.exec:\vjdjp.exe48⤵
- Executes dropped EXE
PID:356 -
\??\c:\dvjjp.exec:\dvjjp.exe49⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lfrxflx.exec:\lfrxflx.exe50⤵
- Executes dropped EXE
PID:1532 -
\??\c:\nnnbnb.exec:\nnnbnb.exe51⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bttbbb.exec:\bttbbb.exe52⤵
- Executes dropped EXE
PID:276 -
\??\c:\dddvv.exec:\dddvv.exe53⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jpddv.exec:\jpddv.exe54⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rfxffrl.exec:\rfxffrl.exe55⤵
- Executes dropped EXE
PID:1044 -
\??\c:\bthtnt.exec:\bthtnt.exe56⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pjdjp.exec:\pjdjp.exe57⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tnnthn.exec:\tnnthn.exe58⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jdpdj.exec:\jdpdj.exe59⤵
- Executes dropped EXE
PID:1856 -
\??\c:\llrxlxx.exec:\llrxlxx.exe60⤵
- Executes dropped EXE
PID:1680 -
\??\c:\7nntht.exec:\7nntht.exe61⤵
- Executes dropped EXE
PID:988 -
\??\c:\9ddpj.exec:\9ddpj.exe62⤵
- Executes dropped EXE
PID:544 -
\??\c:\frxxxfl.exec:\frxxxfl.exe63⤵
- Executes dropped EXE
PID:764 -
\??\c:\hbhbhh.exec:\hbhbhh.exe64⤵
- Executes dropped EXE
PID:804 -
\??\c:\1vvdp.exec:\1vvdp.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\5nhbnt.exec:\5nhbnt.exe66⤵PID:1320
-
\??\c:\7jpvd.exec:\7jpvd.exe67⤵PID:2316
-
\??\c:\lfxxfxr.exec:\lfxxfxr.exe68⤵PID:1860
-
\??\c:\nbnnnn.exec:\nbnnnn.exe69⤵PID:1812
-
\??\c:\vpjpd.exec:\vpjpd.exe70⤵PID:1056
-
\??\c:\dvjjj.exec:\dvjjj.exe71⤵PID:2232
-
\??\c:\ffffxrx.exec:\ffffxrx.exe72⤵PID:1736
-
\??\c:\hbnntt.exec:\hbnntt.exe73⤵PID:896
-
\??\c:\3dppv.exec:\3dppv.exe74⤵PID:1668
-
\??\c:\9flffff.exec:\9flffff.exe75⤵PID:1636
-
\??\c:\rrllxfl.exec:\rrllxfl.exe76⤵PID:2592
-
\??\c:\7httbb.exec:\7httbb.exe77⤵PID:2616
-
\??\c:\vpjpv.exec:\vpjpv.exe78⤵PID:1984
-
\??\c:\9frrrxf.exec:\9frrrxf.exe79⤵PID:2088
-
\??\c:\xlxflrx.exec:\xlxflrx.exe80⤵PID:2532
-
\??\c:\5htbhh.exec:\5htbhh.exe81⤵PID:1716
-
\??\c:\vppvd.exec:\vppvd.exe82⤵PID:2708
-
\??\c:\jddjv.exec:\jddjv.exe83⤵PID:2848
-
\??\c:\xrflrrf.exec:\xrflrrf.exe84⤵PID:2364
-
\??\c:\bbbnnb.exec:\bbbnnb.exe85⤵PID:1808
-
\??\c:\ppvjp.exec:\ppvjp.exe86⤵PID:380
-
\??\c:\5dvdd.exec:\5dvdd.exe87⤵PID:2452
-
\??\c:\rlrrrxl.exec:\rlrrrxl.exe88⤵PID:3052
-
\??\c:\ttnbnt.exec:\ttnbnt.exe89⤵PID:2956
-
\??\c:\5bnntb.exec:\5bnntb.exe90⤵PID:2736
-
\??\c:\5dvdd.exec:\5dvdd.exe91⤵PID:2744
-
\??\c:\rrrxflr.exec:\rrrxflr.exe92⤵PID:2476
-
\??\c:\1frfrlx.exec:\1frfrlx.exe93⤵PID:1576
-
\??\c:\3btttn.exec:\3btttn.exe94⤵PID:2292
-
\??\c:\vpvdj.exec:\vpvdj.exe95⤵PID:1348
-
\??\c:\pjpdj.exec:\pjpdj.exe96⤵PID:624
-
\??\c:\lxrrfff.exec:\lxrrfff.exe97⤵PID:1184
-
\??\c:\7hbbnt.exec:\7hbbnt.exe98⤵PID:1264
-
\??\c:\tnttbh.exec:\tnttbh.exe99⤵PID:2964
-
\??\c:\jdvdj.exec:\jdvdj.exe100⤵PID:1732
-
\??\c:\fxllxff.exec:\fxllxff.exe101⤵PID:2968
-
\??\c:\tntbhh.exec:\tntbhh.exe102⤵PID:2644
-
\??\c:\hhhbnt.exec:\hhhbnt.exe103⤵PID:2228
-
\??\c:\vpdpv.exec:\vpdpv.exe104⤵PID:484
-
\??\c:\7frxflr.exec:\7frxflr.exe105⤵PID:1000
-
\??\c:\fxlxffr.exec:\fxlxffr.exe106⤵PID:808
-
\??\c:\hthhhh.exec:\hthhhh.exe107⤵PID:764
-
\??\c:\5vvjp.exec:\5vvjp.exe108⤵PID:804
-
\??\c:\5dvdj.exec:\5dvdj.exe109⤵PID:772
-
\??\c:\rllxrxx.exec:\rllxrxx.exe110⤵PID:1320
-
\??\c:\3nhnhn.exec:\3nhnhn.exe111⤵PID:2316
-
\??\c:\btnttb.exec:\btnttb.exe112⤵PID:2260
-
\??\c:\vvdpd.exec:\vvdpd.exe113⤵PID:912
-
\??\c:\ffxflrx.exec:\ffxflrx.exe114⤵PID:2332
-
\??\c:\fxrflrf.exec:\fxrflrf.exe115⤵PID:1644
-
\??\c:\hhbhnn.exec:\hhbhnn.exe116⤵PID:312
-
\??\c:\thbbhn.exec:\thbbhn.exe117⤵PID:2040
-
\??\c:\7pvvv.exec:\7pvvv.exe118⤵PID:1936
-
\??\c:\rlfxflr.exec:\rlfxflr.exe119⤵PID:1872
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe120⤵PID:2516
-
\??\c:\5bnhnt.exec:\5bnhnt.exe121⤵PID:2084
-
\??\c:\9jddp.exec:\9jddp.exe122⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-