Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 21:49
Behavioral task
behavioral1
Sample
07280948dbbbb63677bf33481c3abd30_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
07280948dbbbb63677bf33481c3abd30_NeikiAnalytics.exe
-
Size
333KB
-
MD5
07280948dbbbb63677bf33481c3abd30
-
SHA1
b5ef76637a2776d34c14838b43f065040ebf20ec
-
SHA256
74fbbd5fe1fa75660b1cc11f50d4e9766b4aec8c8141a49d831a0d5a5c94f23a
-
SHA512
d610a97ad818d5169cb3d0dd2d6052214400521e7b30616d7064801af78d469857afb1351a7021d1de2b980b28fa0d5827b49186a9201ec2afb7e6960613f7d6
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1i/t:x4wFHoS3eFaKHpv/VycgE8ot
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/1992-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1056-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1236-157-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1700-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1884-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/820-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1884-557-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-572-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1268-579-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-634-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-744-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2320-763-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2016-814-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2784-928-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1992 hbtbtn.exe 2084 5vvdp.exe 2672 xxxxflx.exe 2596 7bnhth.exe 2644 ffxfrxf.exe 2764 nnbhtb.exe 2248 jvjjp.exe 2524 rfrfffr.exe 2888 tnbhhh.exe 1444 pjvpp.exe 2752 rlflxlr.exe 2180 3hhthn.exe 2140 ddvjp.exe 1056 xlrxllr.exe 1812 hthbht.exe 1236 7jpvv.exe 2348 rfrrxxl.exe 1700 3bnbbn.exe 2088 ppvjp.exe 2804 rflffxl.exe 2632 hbhhtt.exe 656 xlrlllx.exe 296 nbtnnb.exe 2424 bthbhn.exe 2016 dvpvd.exe 1140 rlxrxxl.exe 1712 ttnnbb.exe 1884 9dvvd.exe 1948 7fxxffl.exe 944 5htnnh.exe 1780 3lrlffl.exe 1640 rxfrrrr.exe 1512 btbntb.exe 1660 9pjjd.exe 2380 7djdv.exe 1624 rffrlfx.exe 1648 tnbhnh.exe 2540 pdpjd.exe 2084 pdvjd.exe 2720 rfrxrrx.exe 2552 frrrrrx.exe 2708 hbhttn.exe 2748 3jvdd.exe 2448 xrrrrrr.exe 2560 lxxfrlf.exe 2864 9nbbth.exe 2868 jjvvv.exe 2032 dvjdj.exe 2676 ffxlfrl.exe 1444 nhthnt.exe 2760 htbtnh.exe 820 pjppd.exe 2188 jdvpv.exe 2376 ffrrllr.exe 1508 nhtbnt.exe 2412 pjjjj.exe 1336 pvvvd.exe 344 xlrxflr.exe 2136 nhnthn.exe 1596 ppvdj.exe 2112 pjvpp.exe 2776 rlrrxfl.exe 2628 1lllxff.exe 1996 1ttbnt.exe -
resource yara_rule behavioral1/memory/1724-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1724-6-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000c0000000136fc-5.dat upx behavioral1/memory/1992-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1724-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0036000000015d06-18.dat upx behavioral1/files/0x0008000000016056-25.dat upx behavioral1/memory/2084-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000160f8-37.dat upx behavioral1/memory/2596-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016277-44.dat upx behavioral1/memory/2644-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016411-56.dat upx behavioral1/memory/2764-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2764-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016525-65.dat upx behavioral1/memory/2248-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2248-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000167ef-76.dat upx behavioral1/memory/2524-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d17-84.dat upx behavioral1/memory/2888-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d1f-94.dat upx behavioral1/files/0x0006000000016d27-101.dat upx behavioral1/memory/1444-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d3b-110.dat upx behavioral1/files/0x0006000000016d40-122.dat upx behavioral1/memory/2180-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d44-130.dat upx behavioral1/memory/1056-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4b-137.dat upx behavioral1/files/0x0006000000016d67-148.dat upx behavioral1/files/0x0006000000016f82-155.dat upx behavioral1/files/0x0006000000017060-165.dat upx behavioral1/memory/1700-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017185-173.dat upx behavioral1/memory/2088-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017384-184.dat upx behavioral1/files/0x0036000000015d5d-191.dat upx behavioral1/memory/2804-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017387-200.dat upx behavioral1/files/0x0006000000017458-208.dat upx behavioral1/memory/296-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017465-218.dat upx behavioral1/files/0x0006000000017474-226.dat upx behavioral1/files/0x0009000000018648-234.dat upx behavioral1/files/0x0031000000018649-242.dat upx behavioral1/files/0x000500000001865b-249.dat upx behavioral1/memory/1884-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018664-260.dat upx behavioral1/files/0x00050000000186c4-267.dat upx behavioral1/files/0x00050000000186cf-278.dat upx behavioral1/files/0x00050000000186dd-285.dat upx behavioral1/memory/1640-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1660-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1660-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2380-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1624-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1648-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-352-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-359-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1444-402-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1992 1724 07280948dbbbb63677bf33481c3abd30_NeikiAnalytics.exe 28 PID 1724 wrote to memory of 1992 1724 07280948dbbbb63677bf33481c3abd30_NeikiAnalytics.exe 28 PID 1724 wrote to memory of 1992 1724 07280948dbbbb63677bf33481c3abd30_NeikiAnalytics.exe 28 PID 1724 wrote to memory of 1992 1724 07280948dbbbb63677bf33481c3abd30_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 2084 1992 hbtbtn.exe 29 PID 1992 wrote to memory of 2084 1992 hbtbtn.exe 29 PID 1992 wrote to memory of 2084 1992 hbtbtn.exe 29 PID 1992 wrote to memory of 2084 1992 hbtbtn.exe 29 PID 2084 wrote to memory of 2672 2084 5vvdp.exe 30 PID 2084 wrote to memory of 2672 2084 5vvdp.exe 30 PID 2084 wrote to memory of 2672 2084 5vvdp.exe 30 PID 2084 wrote to memory of 2672 2084 5vvdp.exe 30 PID 2672 wrote to memory of 2596 2672 xxxxflx.exe 31 PID 2672 wrote to memory of 2596 2672 xxxxflx.exe 31 PID 2672 wrote to memory of 2596 2672 xxxxflx.exe 31 PID 2672 wrote to memory of 2596 2672 xxxxflx.exe 31 PID 2596 wrote to memory of 2644 2596 7bnhth.exe 32 PID 2596 wrote to memory of 2644 2596 7bnhth.exe 32 PID 2596 wrote to memory of 2644 2596 7bnhth.exe 32 PID 2596 wrote to memory of 2644 2596 7bnhth.exe 32 PID 2644 wrote to memory of 2764 2644 ffxfrxf.exe 33 PID 2644 wrote to memory of 2764 2644 ffxfrxf.exe 33 PID 2644 wrote to memory of 2764 2644 ffxfrxf.exe 33 PID 2644 wrote to memory of 2764 2644 ffxfrxf.exe 33 PID 2764 wrote to memory of 2248 2764 nnbhtb.exe 34 PID 2764 wrote to memory of 2248 2764 nnbhtb.exe 34 PID 2764 wrote to memory of 2248 2764 nnbhtb.exe 34 PID 2764 wrote to memory of 2248 2764 nnbhtb.exe 34 PID 2248 wrote to memory of 2524 2248 jvjjp.exe 35 PID 2248 wrote to memory of 2524 2248 jvjjp.exe 35 PID 2248 wrote to memory of 2524 2248 jvjjp.exe 35 PID 2248 wrote to memory of 2524 2248 jvjjp.exe 35 PID 2524 wrote to memory of 2888 2524 rfrfffr.exe 36 PID 2524 wrote to memory of 2888 2524 rfrfffr.exe 36 PID 2524 wrote to memory of 2888 2524 rfrfffr.exe 36 PID 2524 wrote to memory of 2888 2524 rfrfffr.exe 36 PID 2888 wrote to memory of 1444 2888 tnbhhh.exe 37 PID 2888 wrote to memory of 1444 2888 tnbhhh.exe 37 PID 2888 wrote to memory of 1444 2888 tnbhhh.exe 37 PID 2888 wrote to memory of 1444 2888 tnbhhh.exe 37 PID 1444 wrote to memory of 2752 1444 pjvpp.exe 38 PID 1444 wrote to memory of 2752 1444 pjvpp.exe 38 PID 1444 wrote to memory of 2752 1444 pjvpp.exe 38 PID 1444 wrote to memory of 2752 1444 pjvpp.exe 38 PID 2752 wrote to memory of 2180 2752 rlflxlr.exe 39 PID 2752 wrote to memory of 2180 2752 rlflxlr.exe 39 PID 2752 wrote to memory of 2180 2752 rlflxlr.exe 39 PID 2752 wrote to memory of 2180 2752 rlflxlr.exe 39 PID 2180 wrote to memory of 2140 2180 3hhthn.exe 40 PID 2180 wrote to memory of 2140 2180 3hhthn.exe 40 PID 2180 wrote to memory of 2140 2180 3hhthn.exe 40 PID 2180 wrote to memory of 2140 2180 3hhthn.exe 40 PID 2140 wrote to memory of 1056 2140 ddvjp.exe 41 PID 2140 wrote to memory of 1056 2140 ddvjp.exe 41 PID 2140 wrote to memory of 1056 2140 ddvjp.exe 41 PID 2140 wrote to memory of 1056 2140 ddvjp.exe 41 PID 1056 wrote to memory of 1812 1056 xlrxllr.exe 42 PID 1056 wrote to memory of 1812 1056 xlrxllr.exe 42 PID 1056 wrote to memory of 1812 1056 xlrxllr.exe 42 PID 1056 wrote to memory of 1812 1056 xlrxllr.exe 42 PID 1812 wrote to memory of 1236 1812 hthbht.exe 43 PID 1812 wrote to memory of 1236 1812 hthbht.exe 43 PID 1812 wrote to memory of 1236 1812 hthbht.exe 43 PID 1812 wrote to memory of 1236 1812 hthbht.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\07280948dbbbb63677bf33481c3abd30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\07280948dbbbb63677bf33481c3abd30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\hbtbtn.exec:\hbtbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\5vvdp.exec:\5vvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\xxxxflx.exec:\xxxxflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\7bnhth.exec:\7bnhth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\ffxfrxf.exec:\ffxfrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nnbhtb.exec:\nnbhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jvjjp.exec:\jvjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\rfrfffr.exec:\rfrfffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\tnbhhh.exec:\tnbhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\pjvpp.exec:\pjvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\rlflxlr.exec:\rlflxlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3hhthn.exec:\3hhthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\ddvjp.exec:\ddvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\xlrxllr.exec:\xlrxllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\hthbht.exec:\hthbht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\7jpvv.exec:\7jpvv.exe17⤵
- Executes dropped EXE
PID:1236 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe18⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3bnbbn.exec:\3bnbbn.exe19⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ppvjp.exec:\ppvjp.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rflffxl.exec:\rflffxl.exe21⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hbhhtt.exec:\hbhhtt.exe22⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xlrlllx.exec:\xlrlllx.exe23⤵
- Executes dropped EXE
PID:656 -
\??\c:\nbtnnb.exec:\nbtnnb.exe24⤵
- Executes dropped EXE
PID:296 -
\??\c:\bthbhn.exec:\bthbhn.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\dvpvd.exec:\dvpvd.exe26⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe27⤵
- Executes dropped EXE
PID:1140 -
\??\c:\ttnnbb.exec:\ttnnbb.exe28⤵
- Executes dropped EXE
PID:1712 -
\??\c:\9dvvd.exec:\9dvvd.exe29⤵
- Executes dropped EXE
PID:1884 -
\??\c:\7fxxffl.exec:\7fxxffl.exe30⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5htnnh.exec:\5htnnh.exe31⤵
- Executes dropped EXE
PID:944 -
\??\c:\3lrlffl.exec:\3lrlffl.exe32⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rxfrrrr.exec:\rxfrrrr.exe33⤵
- Executes dropped EXE
PID:1640 -
\??\c:\btbntb.exec:\btbntb.exe34⤵
- Executes dropped EXE
PID:1512 -
\??\c:\9pjjd.exec:\9pjjd.exe35⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7djdv.exec:\7djdv.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rffrlfx.exec:\rffrlfx.exe37⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tnbhnh.exec:\tnbhnh.exe38⤵
- Executes dropped EXE
PID:1648 -
\??\c:\pdpjd.exec:\pdpjd.exe39⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pdvjd.exec:\pdvjd.exe40⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\frrrrrx.exec:\frrrrrx.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hbhttn.exec:\hbhttn.exe43⤵
- Executes dropped EXE
PID:2708 -
\??\c:\3jvdd.exec:\3jvdd.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe45⤵
- Executes dropped EXE
PID:2448 -
\??\c:\lxxfrlf.exec:\lxxfrlf.exe46⤵
- Executes dropped EXE
PID:2560 -
\??\c:\9nbbth.exec:\9nbbth.exe47⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jjvvv.exec:\jjvvv.exe48⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dvjdj.exec:\dvjdj.exe49⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ffxlfrl.exec:\ffxlfrl.exe50⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nhthnt.exec:\nhthnt.exe51⤵
- Executes dropped EXE
PID:1444 -
\??\c:\htbtnh.exec:\htbtnh.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pjppd.exec:\pjppd.exe53⤵
- Executes dropped EXE
PID:820 -
\??\c:\jdvpv.exec:\jdvpv.exe54⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ffrrllr.exec:\ffrrllr.exe55⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nhtbnt.exec:\nhtbnt.exe56⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pjjjj.exec:\pjjjj.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pvvvd.exec:\pvvvd.exe58⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xlrxflr.exec:\xlrxflr.exe59⤵
- Executes dropped EXE
PID:344 -
\??\c:\nhnthn.exec:\nhnthn.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ppvdj.exec:\ppvdj.exe61⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pjvpp.exec:\pjvpp.exe62⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe63⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1lllxff.exec:\1lllxff.exe64⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1ttbnt.exec:\1ttbnt.exe65⤵
- Executes dropped EXE
PID:1996 -
\??\c:\tnthhn.exec:\tnthhn.exe66⤵PID:1160
-
\??\c:\3ddvv.exec:\3ddvv.exe67⤵PID:1020
-
\??\c:\ffrfrxl.exec:\ffrfrxl.exe68⤵PID:448
-
\??\c:\7fffllx.exec:\7fffllx.exe69⤵PID:3056
-
\??\c:\thbhtn.exec:\thbhtn.exe70⤵PID:1708
-
\??\c:\jjvvj.exec:\jjvvj.exe71⤵PID:2400
-
\??\c:\jvppp.exec:\jvppp.exe72⤵PID:1712
-
\??\c:\lfxllxf.exec:\lfxllxf.exe73⤵PID:1884
-
\??\c:\tnhttt.exec:\tnhttt.exe74⤵PID:928
-
\??\c:\hthhtt.exec:\hthhtt.exe75⤵PID:2120
-
\??\c:\dvpvd.exec:\dvpvd.exe76⤵PID:1268
-
\??\c:\7rxxxxf.exec:\7rxxxxf.exe77⤵PID:2160
-
\??\c:\thtntt.exec:\thtntt.exe78⤵PID:376
-
\??\c:\hnhnnt.exec:\hnhnnt.exe79⤵PID:1512
-
\??\c:\9djjj.exec:\9djjj.exe80⤵PID:2820
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe81⤵PID:1740
-
\??\c:\lxlfllr.exec:\lxlfllr.exe82⤵PID:1620
-
\??\c:\hthbbh.exec:\hthbbh.exe83⤵PID:2592
-
\??\c:\9vjpd.exec:\9vjpd.exe84⤵PID:2716
-
\??\c:\5pjdv.exec:\5pjdv.exe85⤵PID:2300
-
\??\c:\frxxxff.exec:\frxxxff.exe86⤵PID:2604
-
\??\c:\9nhbbb.exec:\9nhbbb.exe87⤵PID:2724
-
\??\c:\3tbbnn.exec:\3tbbnn.exe88⤵PID:2644
-
\??\c:\pjvvv.exec:\pjvvv.exe89⤵PID:2956
-
\??\c:\rrflffr.exec:\rrflffr.exe90⤵PID:2460
-
\??\c:\xrxxlll.exec:\xrxxlll.exe91⤵PID:2468
-
\??\c:\bthntn.exec:\bthntn.exe92⤵PID:2688
-
\??\c:\vpdjj.exec:\vpdjj.exe93⤵PID:2892
-
\??\c:\xxlflfl.exec:\xxlflfl.exe94⤵PID:776
-
\??\c:\9rfrxff.exec:\9rfrxff.exe95⤵PID:2844
-
\??\c:\btbbhn.exec:\btbbhn.exe96⤵PID:2856
-
\??\c:\hbtnnn.exec:\hbtnnn.exe97⤵PID:2488
-
\??\c:\3jdvv.exec:\3jdvv.exe98⤵PID:2004
-
\??\c:\pdpvd.exec:\pdpvd.exe99⤵PID:1968
-
\??\c:\rfxxflx.exec:\rfxxflx.exe100⤵PID:2372
-
\??\c:\9tnnhn.exec:\9tnnhn.exe101⤵PID:2368
-
\??\c:\thtttt.exec:\thtttt.exe102⤵PID:2272
-
\??\c:\pdddd.exec:\pdddd.exe103⤵PID:772
-
\??\c:\vjppp.exec:\vjppp.exe104⤵PID:2092
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe105⤵PID:2320
-
\??\c:\nbtntn.exec:\nbtntn.exe106⤵PID:2296
-
\??\c:\hbttbb.exec:\hbttbb.exe107⤵PID:2304
-
\??\c:\dvdvj.exec:\dvdvj.exe108⤵PID:1760
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe109⤵PID:2420
-
\??\c:\1btnnb.exec:\1btnnb.exe110⤵PID:588
-
\??\c:\nhttbt.exec:\nhttbt.exe111⤵PID:1852
-
\??\c:\dvvpv.exec:\dvvpv.exe112⤵PID:1792
-
\??\c:\vpjjj.exec:\vpjjj.exe113⤵PID:1944
-
\??\c:\ffrfrfx.exec:\ffrfrfx.exe114⤵PID:2016
-
\??\c:\xrflrrf.exec:\xrflrrf.exe115⤵PID:2172
-
\??\c:\thntbh.exec:\thntbh.exe116⤵PID:976
-
\??\c:\ppvjd.exec:\ppvjd.exe117⤵PID:2400
-
\??\c:\dvpvd.exec:\dvpvd.exe118⤵PID:916
-
\??\c:\xxxfllx.exec:\xxxfllx.exe119⤵PID:2220
-
\??\c:\rlflxfl.exec:\rlflxfl.exe120⤵PID:988
-
\??\c:\bnbbnn.exec:\bnbbnn.exe121⤵PID:960
-
\??\c:\pjpvv.exec:\pjpvv.exe122⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-