Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 22:38
Behavioral task
behavioral1
Sample
809624faf15f44e1dd36c92f119c9f40_NEIKI.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
809624faf15f44e1dd36c92f119c9f40_NEIKI.exe
-
Size
52KB
-
MD5
809624faf15f44e1dd36c92f119c9f40
-
SHA1
144cef5fc819fcbf3e8a967b720d4b30d2d5f90a
-
SHA256
c116710e1d8bcfd21f6bb0f57d3de32638d6824fb3acf3546b7526388d3781e8
-
SHA512
f26d4202d487ac22ec8de0e46f8b27b3e37182f5e9f4f6528fad9d065ec8f3db1985986f470ee261b79362b72813d05ac214fe4a90ffcfa65f9e74625b307d44
-
SSDEEP
1536:RvQBeOGtrYS3srx93UBWfwC6Ggnouy8Cp:RhOmTsF93UYfwC6GIoutc
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2896-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-51-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2840-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/764-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1572-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1896-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1392-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/740-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-653-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-843-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-1111-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1744-1137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-1254-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2848-1327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1688 hbbhht.exe 2176 jvjpd.exe 2604 5jvjd.exe 2300 xlflrlr.exe 2840 tthnht.exe 2628 vpdvv.exe 2536 1lxlrrl.exe 2184 3bbhnn.exe 2576 1tnhnt.exe 2908 vjjvd.exe 2044 lfrxxrf.exe 1936 frlrfxx.exe 2572 7btnhn.exe 1532 vpjjp.exe 1976 1dvdj.exe 1312 rlxffxx.exe 1492 nhhhth.exe 2236 bthbhn.exe 1624 pjdjd.exe 2328 xrlxffl.exe 2452 rlflxxf.exe 2364 nthhhh.exe 2856 hhbhtn.exe 764 9dvjp.exe 1476 3fxfflx.exe 2092 7lfflxx.exe 1640 btbbhh.exe 1584 dpdvp.exe 3052 xrflrxf.exe 2336 1lrlxrx.exe 3028 tttntb.exe 1792 jvjjj.exe 2204 3xxfxrf.exe 1800 fxfflxf.exe 1796 1htbnt.exe 1728 vpjpj.exe 3024 vdppv.exe 1572 7rrxffl.exe 2640 fxllrrx.exe 2724 bttbbt.exe 2664 vjvjj.exe 2520 jddvd.exe 2764 ffllrrr.exe 2808 5xlrxxf.exe 2560 tnbbtt.exe 2732 9ttbnh.exe 2184 1pvdd.exe 2944 1djpd.exe 2528 5flrxrl.exe 1648 fxfrllx.exe 1956 9hntbb.exe 1936 dvjvv.exe 1588 5pppp.exe 2484 xlxxfff.exe 1908 fxlrxxf.exe 1444 1bntbn.exe 2400 jvjvj.exe 2552 5jdjj.exe 2412 1ffxffr.exe 1868 xxflfrx.exe 2324 hbbbhb.exe 2268 9djdd.exe 2608 vjdvj.exe 392 fxlrrrf.exe -
resource yara_rule behavioral1/memory/2896-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000012286-11.dat upx behavioral1/memory/1688-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0037000000015693-19.dat upx behavioral1/files/0x0007000000015cc7-28.dat upx behavioral1/memory/2604-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2176-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1688-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015cdf-37.dat upx behavioral1/memory/2300-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cf0-44.dat upx behavioral1/memory/2840-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-51-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000015d08-57.dat upx behavioral1/memory/2840-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d12-64.dat upx behavioral1/memory/2628-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d3b-75.dat upx behavioral1/memory/2536-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016581-82.dat upx behavioral1/memory/2184-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000165e1-91.dat upx behavioral1/memory/2576-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016835-100.dat upx behavioral1/memory/2908-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a8a-110.dat upx behavioral1/files/0x0006000000016c52-117.dat upx behavioral1/memory/1936-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c6f-127.dat upx behavioral1/files/0x0006000000016c78-134.dat upx behavioral1/memory/1976-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cc1-144.dat upx behavioral1/memory/1312-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ceb-152.dat upx behavioral1/memory/1312-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d17-160.dat upx behavioral1/memory/1492-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d2a-169.dat upx behavioral1/memory/2236-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d32-179.dat upx behavioral1/files/0x0006000000016d3b-186.dat upx behavioral1/files/0x0006000000016d43-194.dat upx behavioral1/files/0x0006000000016d4b-202.dat upx behavioral1/memory/2856-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2364-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d5f-212.dat upx behavioral1/memory/764-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d64-223.dat upx behavioral1/files/0x0006000000016d68-230.dat upx behavioral1/files/0x0006000000016d6f-238.dat upx behavioral1/memory/1640-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d8b-247.dat upx behavioral1/memory/1584-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d9f-256.dat upx behavioral1/memory/3052-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dba-265.dat upx behavioral1/files/0x0006000000016dc8-273.dat upx behavioral1/files/0x0006000000016dd1-281.dat upx behavioral1/memory/2204-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3024-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1572-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2944-382-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2528-389-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 1688 2896 809624faf15f44e1dd36c92f119c9f40_NEIKI.exe 29 PID 2896 wrote to memory of 1688 2896 809624faf15f44e1dd36c92f119c9f40_NEIKI.exe 29 PID 2896 wrote to memory of 1688 2896 809624faf15f44e1dd36c92f119c9f40_NEIKI.exe 29 PID 2896 wrote to memory of 1688 2896 809624faf15f44e1dd36c92f119c9f40_NEIKI.exe 29 PID 1688 wrote to memory of 2176 1688 hbbhht.exe 30 PID 1688 wrote to memory of 2176 1688 hbbhht.exe 30 PID 1688 wrote to memory of 2176 1688 hbbhht.exe 30 PID 1688 wrote to memory of 2176 1688 hbbhht.exe 30 PID 2176 wrote to memory of 2604 2176 jvjpd.exe 31 PID 2176 wrote to memory of 2604 2176 jvjpd.exe 31 PID 2176 wrote to memory of 2604 2176 jvjpd.exe 31 PID 2176 wrote to memory of 2604 2176 jvjpd.exe 31 PID 2604 wrote to memory of 2300 2604 5jvjd.exe 32 PID 2604 wrote to memory of 2300 2604 5jvjd.exe 32 PID 2604 wrote to memory of 2300 2604 5jvjd.exe 32 PID 2604 wrote to memory of 2300 2604 5jvjd.exe 32 PID 2300 wrote to memory of 2840 2300 xlflrlr.exe 33 PID 2300 wrote to memory of 2840 2300 xlflrlr.exe 33 PID 2300 wrote to memory of 2840 2300 xlflrlr.exe 33 PID 2300 wrote to memory of 2840 2300 xlflrlr.exe 33 PID 2840 wrote to memory of 2628 2840 tthnht.exe 34 PID 2840 wrote to memory of 2628 2840 tthnht.exe 34 PID 2840 wrote to memory of 2628 2840 tthnht.exe 34 PID 2840 wrote to memory of 2628 2840 tthnht.exe 34 PID 2628 wrote to memory of 2536 2628 vpdvv.exe 35 PID 2628 wrote to memory of 2536 2628 vpdvv.exe 35 PID 2628 wrote to memory of 2536 2628 vpdvv.exe 35 PID 2628 wrote to memory of 2536 2628 vpdvv.exe 35 PID 2536 wrote to memory of 2184 2536 1lxlrrl.exe 36 PID 2536 wrote to memory of 2184 2536 1lxlrrl.exe 36 PID 2536 wrote to memory of 2184 2536 1lxlrrl.exe 36 PID 2536 wrote to memory of 2184 2536 1lxlrrl.exe 36 PID 2184 wrote to memory of 2576 2184 3bbhnn.exe 37 PID 2184 wrote to memory of 2576 2184 3bbhnn.exe 37 PID 2184 wrote to memory of 2576 2184 3bbhnn.exe 37 PID 2184 wrote to memory of 2576 2184 3bbhnn.exe 37 PID 2576 wrote to memory of 2908 2576 1tnhnt.exe 38 PID 2576 wrote to memory of 2908 2576 1tnhnt.exe 38 PID 2576 wrote to memory of 2908 2576 1tnhnt.exe 38 PID 2576 wrote to memory of 2908 2576 1tnhnt.exe 38 PID 2908 wrote to memory of 2044 2908 vjjvd.exe 39 PID 2908 wrote to memory of 2044 2908 vjjvd.exe 39 PID 2908 wrote to memory of 2044 2908 vjjvd.exe 39 PID 2908 wrote to memory of 2044 2908 vjjvd.exe 39 PID 2044 wrote to memory of 1936 2044 lfrxxrf.exe 40 PID 2044 wrote to memory of 1936 2044 lfrxxrf.exe 40 PID 2044 wrote to memory of 1936 2044 lfrxxrf.exe 40 PID 2044 wrote to memory of 1936 2044 lfrxxrf.exe 40 PID 1936 wrote to memory of 2572 1936 frlrfxx.exe 41 PID 1936 wrote to memory of 2572 1936 frlrfxx.exe 41 PID 1936 wrote to memory of 2572 1936 frlrfxx.exe 41 PID 1936 wrote to memory of 2572 1936 frlrfxx.exe 41 PID 2572 wrote to memory of 1532 2572 7btnhn.exe 42 PID 2572 wrote to memory of 1532 2572 7btnhn.exe 42 PID 2572 wrote to memory of 1532 2572 7btnhn.exe 42 PID 2572 wrote to memory of 1532 2572 7btnhn.exe 42 PID 1532 wrote to memory of 1976 1532 vpjjp.exe 43 PID 1532 wrote to memory of 1976 1532 vpjjp.exe 43 PID 1532 wrote to memory of 1976 1532 vpjjp.exe 43 PID 1532 wrote to memory of 1976 1532 vpjjp.exe 43 PID 1976 wrote to memory of 1312 1976 1dvdj.exe 44 PID 1976 wrote to memory of 1312 1976 1dvdj.exe 44 PID 1976 wrote to memory of 1312 1976 1dvdj.exe 44 PID 1976 wrote to memory of 1312 1976 1dvdj.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\809624faf15f44e1dd36c92f119c9f40_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\809624faf15f44e1dd36c92f119c9f40_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hbbhht.exec:\hbbhht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\jvjpd.exec:\jvjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\5jvjd.exec:\5jvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xlflrlr.exec:\xlflrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\tthnht.exec:\tthnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\vpdvv.exec:\vpdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\1lxlrrl.exec:\1lxlrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\3bbhnn.exec:\3bbhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\1tnhnt.exec:\1tnhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\vjjvd.exec:\vjjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\lfrxxrf.exec:\lfrxxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\frlrfxx.exec:\frlrfxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\7btnhn.exec:\7btnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\vpjjp.exec:\vpjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\1dvdj.exec:\1dvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\rlxffxx.exec:\rlxffxx.exe17⤵
- Executes dropped EXE
PID:1312 -
\??\c:\nhhhth.exec:\nhhhth.exe18⤵
- Executes dropped EXE
PID:1492 -
\??\c:\bthbhn.exec:\bthbhn.exe19⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pjdjd.exec:\pjdjd.exe20⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xrlxffl.exec:\xrlxffl.exe21⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rlflxxf.exec:\rlflxxf.exe22⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nthhhh.exec:\nthhhh.exe23⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hhbhtn.exec:\hhbhtn.exe24⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9dvjp.exec:\9dvjp.exe25⤵
- Executes dropped EXE
PID:764 -
\??\c:\3fxfflx.exec:\3fxfflx.exe26⤵
- Executes dropped EXE
PID:1476 -
\??\c:\7lfflxx.exec:\7lfflxx.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\btbbhh.exec:\btbbhh.exe28⤵
- Executes dropped EXE
PID:1640 -
\??\c:\dpdvp.exec:\dpdvp.exe29⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xrflrxf.exec:\xrflrxf.exe30⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1lrlxrx.exec:\1lrlxrx.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tttntb.exec:\tttntb.exe32⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jvjjj.exec:\jvjjj.exe33⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3xxfxrf.exec:\3xxfxrf.exe34⤵
- Executes dropped EXE
PID:2204 -
\??\c:\fxfflxf.exec:\fxfflxf.exe35⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1htbnt.exec:\1htbnt.exe36⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vpjpj.exec:\vpjpj.exe37⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vdppv.exec:\vdppv.exe38⤵
- Executes dropped EXE
PID:3024 -
\??\c:\7rrxffl.exec:\7rrxffl.exe39⤵
- Executes dropped EXE
PID:1572 -
\??\c:\fxllrrx.exec:\fxllrrx.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bttbbt.exec:\bttbbt.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vjvjj.exec:\vjvjj.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jddvd.exec:\jddvd.exe43⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ffllrrr.exec:\ffllrrr.exe44⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5xlrxxf.exec:\5xlrxxf.exe45⤵
- Executes dropped EXE
PID:2808 -
\??\c:\tnbbtt.exec:\tnbbtt.exe46⤵
- Executes dropped EXE
PID:2560 -
\??\c:\9ttbnh.exec:\9ttbnh.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1pvdd.exec:\1pvdd.exe48⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1djpd.exec:\1djpd.exe49⤵
- Executes dropped EXE
PID:2944 -
\??\c:\5flrxrl.exec:\5flrxrl.exe50⤵
- Executes dropped EXE
PID:2528 -
\??\c:\fxfrllx.exec:\fxfrllx.exe51⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9hntbb.exec:\9hntbb.exe52⤵
- Executes dropped EXE
PID:1956 -
\??\c:\dvjvv.exec:\dvjvv.exe53⤵
- Executes dropped EXE
PID:1936 -
\??\c:\5pppp.exec:\5pppp.exe54⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xlxxfff.exec:\xlxxfff.exe55⤵
- Executes dropped EXE
PID:2484 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe56⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1bntbn.exec:\1bntbn.exe57⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jvjvj.exec:\jvjvj.exe58⤵
- Executes dropped EXE
PID:2400 -
\??\c:\5jdjj.exec:\5jdjj.exe59⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1ffxffr.exec:\1ffxffr.exe60⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xxflfrx.exec:\xxflfrx.exe61⤵
- Executes dropped EXE
PID:1868 -
\??\c:\hbbbhb.exec:\hbbbhb.exe62⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9djdd.exec:\9djdd.exe63⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vjdvj.exec:\vjdvj.exe64⤵
- Executes dropped EXE
PID:2608 -
\??\c:\fxlrrrf.exec:\fxlrrrf.exe65⤵
- Executes dropped EXE
PID:392 -
\??\c:\9llrxlx.exec:\9llrxlx.exe66⤵PID:2364
-
\??\c:\rfllrxx.exec:\rfllrxx.exe67⤵PID:480
-
\??\c:\htbhhh.exec:\htbhhh.exe68⤵PID:264
-
\??\c:\5bhbbb.exec:\5bhbbb.exe69⤵PID:1896
-
\??\c:\ddpdp.exec:\ddpdp.exe70⤵PID:348
-
\??\c:\xrlrxff.exec:\xrlrxff.exe71⤵PID:2128
-
\??\c:\1rrfllf.exec:\1rrfllf.exe72⤵PID:1392
-
\??\c:\1hbbbb.exec:\1hbbbb.exe73⤵PID:740
-
\??\c:\htbthn.exec:\htbthn.exe74⤵PID:2956
-
\??\c:\pjjjp.exec:\pjjjp.exe75⤵PID:2872
-
\??\c:\fxxxfxf.exec:\fxxxfxf.exe76⤵PID:2336
-
\??\c:\rlxfrrr.exec:\rlxfrrr.exe77⤵PID:492
-
\??\c:\bnbhtt.exec:\bnbhtt.exe78⤵PID:872
-
\??\c:\httttb.exec:\httttb.exe79⤵PID:1744
-
\??\c:\jdvdv.exec:\jdvdv.exe80⤵PID:2900
-
\??\c:\jvpvv.exec:\jvpvv.exe81⤵PID:1332
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe82⤵PID:2948
-
\??\c:\rlflfrx.exec:\rlflfrx.exe83⤵PID:2616
-
\??\c:\tnbbht.exec:\tnbbht.exe84⤵PID:1684
-
\??\c:\hbttbt.exec:\hbttbt.exe85⤵PID:2820
-
\??\c:\pdpvd.exec:\pdpvd.exe86⤵PID:352
-
\??\c:\jvdpp.exec:\jvdpp.exe87⤵PID:2636
-
\??\c:\xxrflxf.exec:\xxrflxf.exe88⤵PID:2840
-
\??\c:\rlfxffl.exec:\rlfxffl.exe89⤵PID:2756
-
\??\c:\3tthnt.exec:\3tthnt.exe90⤵PID:2704
-
\??\c:\ttnhth.exec:\ttnhth.exe91⤵PID:2684
-
\??\c:\jdpvv.exec:\jdpvv.exe92⤵PID:2544
-
\??\c:\jdddp.exec:\jdddp.exe93⤵PID:2912
-
\??\c:\rlxflxr.exec:\rlxflxr.exe94⤵PID:2332
-
\??\c:\5xlrffl.exec:\5xlrffl.exe95⤵PID:2004
-
\??\c:\5thnbn.exec:\5thnbn.exe96⤵PID:1932
-
\??\c:\bnbtbt.exec:\bnbtbt.exe97⤵PID:1912
-
\??\c:\5vppd.exec:\5vppd.exe98⤵PID:2688
-
\??\c:\ppddv.exec:\ppddv.exe99⤵PID:2572
-
\??\c:\1xxxffr.exec:\1xxxffr.exe100⤵PID:2000
-
\??\c:\xrfxxff.exec:\xrfxxff.exe101⤵PID:880
-
\??\c:\nhnthn.exec:\nhnthn.exe102⤵PID:1908
-
\??\c:\hthntt.exec:\hthntt.exe103⤵PID:1312
-
\??\c:\dvdpv.exec:\dvdpv.exe104⤵PID:1944
-
\??\c:\jdvdp.exec:\jdvdp.exe105⤵PID:2420
-
\??\c:\lfrxlll.exec:\lfrxlll.exe106⤵PID:2404
-
\??\c:\rlxrfrf.exec:\rlxrfrf.exe107⤵PID:2380
-
\??\c:\tnbbnn.exec:\tnbbnn.exe108⤵PID:2296
-
\??\c:\tnhhtn.exec:\tnhhtn.exe109⤵PID:2276
-
\??\c:\1vjvp.exec:\1vjvp.exe110⤵PID:2848
-
\??\c:\jdppv.exec:\jdppv.exe111⤵PID:2852
-
\??\c:\1flrffx.exec:\1flrffx.exe112⤵PID:1008
-
\??\c:\lrllrfr.exec:\lrllrfr.exe113⤵PID:764
-
\??\c:\nbhbnt.exec:\nbhbnt.exe114⤵PID:1096
-
\??\c:\btnttt.exec:\btnttt.exe115⤵PID:568
-
\??\c:\dvpvv.exec:\dvpvv.exe116⤵PID:1144
-
\??\c:\vpjpp.exec:\vpjpp.exe117⤵PID:2092
-
\??\c:\xlfflrx.exec:\xlfflrx.exe118⤵PID:1392
-
\??\c:\fxfllxl.exec:\fxfllxl.exe119⤵PID:3044
-
\??\c:\ttnhhh.exec:\ttnhhh.exe120⤵PID:3052
-
\??\c:\pvvvj.exec:\pvvvj.exe121⤵PID:576
-
\??\c:\9dpdv.exec:\9dpdv.exe122⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-