Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 12:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe
-
Size
64KB
-
MD5
3a4f979748217fad0d1037f57d6adf20
-
SHA1
e23aeab9eb69dd2e5f57a005625e507a9e7c8776
-
SHA256
e9331d367e2516fd5251f68876c031db7c172bc28890bd9c4c91b302d7cc2c5d
-
SHA512
b09f22183f124fa52d17ec1b59ef23cb9fe284ab8d0476e57ed53be0da6e523f705c1988ddda6561d351249120dae0e78675ad4f05eedebcdb74a65eb89457dc
-
SSDEEP
1536:fvQBeOGtrYSSsrc93UBIfdC67m6AJiqsKzX7LWY6i3:fhOm2sI93UufdC67ciynd6i3
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1664-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2724-17-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3004-28-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2624-32-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2536-46-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2704-55-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2540-64-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2400-66-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2868-82-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2572-91-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2472-100-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2696-103-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1820-118-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2340-135-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1816-138-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2236-186-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2080-204-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1428-221-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1480-237-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1840-246-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/932-258-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2828-282-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1656-311-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2532-325-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2688-352-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2340-421-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1796-435-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2028-569-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1448-575-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1604-587-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2008-594-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2736-626-0x00000000002A0000-0x00000000002C8000-memory.dmp family_blackmoon behavioral1/memory/2688-647-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1380-740-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/668-787-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1652-867-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/296-1044-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2456-1211-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2384-1344-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2724 jvdjj.exe 3004 rrrxrrf.exe 2624 nhthnn.exe 2536 dvjjv.exe 2704 7dvjv.exe 2540 7fflxfl.exe 2400 nhhnhb.exe 2868 hhttbt.exe 2572 vvpvv.exe 2472 rlrrfll.exe 2696 llrrxrx.exe 1820 7bntbb.exe 2180 7nbhnt.exe 2340 jvdvp.exe 1816 fxlrfrx.exe 1368 frfxrxl.exe 2160 5tnhbn.exe 2112 nbtbtt.exe 2232 pjdjp.exe 2236 lrflfxl.exe 2204 xrrxrrf.exe 2080 thbhnb.exe 704 vppvv.exe 1428 jdpvj.exe 1828 lxrlllr.exe 1480 hthntt.exe 1840 jdjjj.exe 380 7pdvp.exe 932 7xrrlrx.exe 1668 btntht.exe 2828 9bnbnt.exe 2260 vpjpd.exe 2776 fxfflrf.exe 2592 lfrxfxf.exe 1656 tnhntt.exe 2936 bbhthb.exe 2532 jjdjj.exe 1344 5pppv.exe 2788 xrxxflx.exe 2740 rrllxxx.exe 2568 tnbtbn.exe 2688 hbbbtn.exe 2456 jddpp.exe 2648 ppjpp.exe 2476 lfxxflx.exe 1788 1lfllrx.exe 1964 rlxfxfr.exe 2664 nhtbhh.exe 2732 hhbhtb.exe 2176 vpdjp.exe 2772 ddddp.exe 1572 xrlrrlx.exe 2340 bnhnbh.exe 1464 bthhnn.exe 1796 ppjpv.exe 1336 jjppd.exe 1380 ffrfrlx.exe 2216 frxlxlf.exe 1264 llrfxfl.exe 2220 btntbb.exe 2100 3btthh.exe 1160 jdppd.exe 588 vpdjp.exe 1424 rfrrrfl.exe -
resource yara_rule behavioral1/memory/1664-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1664-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3004-19-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2724-17-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3004-28-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2624-32-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2536-46-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2704-55-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2540-64-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2400-66-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2868-82-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2572-91-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2472-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2696-103-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1820-118-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2340-135-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1816-138-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2160-153-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2236-186-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2204-187-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2080-204-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1428-221-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1480-237-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1840-246-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/932-258-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1668-265-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2828-274-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2828-282-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2776-292-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1656-311-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2532-325-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1344-326-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2688-352-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2176-402-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2340-421-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1796-435-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1264-459-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/668-496-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/980-515-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2124-524-0x00000000002B0000-0x00000000002D8000-memory.dmp upx behavioral1/memory/576-548-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2028-569-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1448-575-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1604-587-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2008-594-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2624-607-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2736-626-0x00000000002A0000-0x00000000002C8000-memory.dmp upx behavioral1/memory/2688-640-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2688-647-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2292-678-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2152-727-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1244-741-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2204-760-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/596-773-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/668-787-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/320-811-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1516-842-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1652-867-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/904-874-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2560-905-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2180-973-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1592-986-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1948-1018-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1436-1063-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2724 1664 3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe 28 PID 1664 wrote to memory of 2724 1664 3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe 28 PID 1664 wrote to memory of 2724 1664 3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe 28 PID 1664 wrote to memory of 2724 1664 3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe 28 PID 2724 wrote to memory of 3004 2724 jvdjj.exe 29 PID 2724 wrote to memory of 3004 2724 jvdjj.exe 29 PID 2724 wrote to memory of 3004 2724 jvdjj.exe 29 PID 2724 wrote to memory of 3004 2724 jvdjj.exe 29 PID 3004 wrote to memory of 2624 3004 rrrxrrf.exe 30 PID 3004 wrote to memory of 2624 3004 rrrxrrf.exe 30 PID 3004 wrote to memory of 2624 3004 rrrxrrf.exe 30 PID 3004 wrote to memory of 2624 3004 rrrxrrf.exe 30 PID 2624 wrote to memory of 2536 2624 nhthnn.exe 31 PID 2624 wrote to memory of 2536 2624 nhthnn.exe 31 PID 2624 wrote to memory of 2536 2624 nhthnn.exe 31 PID 2624 wrote to memory of 2536 2624 nhthnn.exe 31 PID 2536 wrote to memory of 2704 2536 dvjjv.exe 32 PID 2536 wrote to memory of 2704 2536 dvjjv.exe 32 PID 2536 wrote to memory of 2704 2536 dvjjv.exe 32 PID 2536 wrote to memory of 2704 2536 dvjjv.exe 32 PID 2704 wrote to memory of 2540 2704 7dvjv.exe 33 PID 2704 wrote to memory of 2540 2704 7dvjv.exe 33 PID 2704 wrote to memory of 2540 2704 7dvjv.exe 33 PID 2704 wrote to memory of 2540 2704 7dvjv.exe 33 PID 2540 wrote to memory of 2400 2540 7fflxfl.exe 34 PID 2540 wrote to memory of 2400 2540 7fflxfl.exe 34 PID 2540 wrote to memory of 2400 2540 7fflxfl.exe 34 PID 2540 wrote to memory of 2400 2540 7fflxfl.exe 34 PID 2400 wrote to memory of 2868 2400 nhhnhb.exe 35 PID 2400 wrote to memory of 2868 2400 nhhnhb.exe 35 PID 2400 wrote to memory of 2868 2400 nhhnhb.exe 35 PID 2400 wrote to memory of 2868 2400 nhhnhb.exe 35 PID 2868 wrote to memory of 2572 2868 hhttbt.exe 36 PID 2868 wrote to memory of 2572 2868 hhttbt.exe 36 PID 2868 wrote to memory of 2572 2868 hhttbt.exe 36 PID 2868 wrote to memory of 2572 2868 hhttbt.exe 36 PID 2572 wrote to memory of 2472 2572 vvpvv.exe 37 PID 2572 wrote to memory of 2472 2572 vvpvv.exe 37 PID 2572 wrote to memory of 2472 2572 vvpvv.exe 37 PID 2572 wrote to memory of 2472 2572 vvpvv.exe 37 PID 2472 wrote to memory of 2696 2472 rlrrfll.exe 38 PID 2472 wrote to memory of 2696 2472 rlrrfll.exe 38 PID 2472 wrote to memory of 2696 2472 rlrrfll.exe 38 PID 2472 wrote to memory of 2696 2472 rlrrfll.exe 38 PID 2696 wrote to memory of 1820 2696 llrrxrx.exe 39 PID 2696 wrote to memory of 1820 2696 llrrxrx.exe 39 PID 2696 wrote to memory of 1820 2696 llrrxrx.exe 39 PID 2696 wrote to memory of 1820 2696 llrrxrx.exe 39 PID 1820 wrote to memory of 2180 1820 7bntbb.exe 40 PID 1820 wrote to memory of 2180 1820 7bntbb.exe 40 PID 1820 wrote to memory of 2180 1820 7bntbb.exe 40 PID 1820 wrote to memory of 2180 1820 7bntbb.exe 40 PID 2180 wrote to memory of 2340 2180 7nbhnt.exe 41 PID 2180 wrote to memory of 2340 2180 7nbhnt.exe 41 PID 2180 wrote to memory of 2340 2180 7nbhnt.exe 41 PID 2180 wrote to memory of 2340 2180 7nbhnt.exe 41 PID 2340 wrote to memory of 1816 2340 jvdvp.exe 42 PID 2340 wrote to memory of 1816 2340 jvdvp.exe 42 PID 2340 wrote to memory of 1816 2340 jvdvp.exe 42 PID 2340 wrote to memory of 1816 2340 jvdvp.exe 42 PID 1816 wrote to memory of 1368 1816 fxlrfrx.exe 43 PID 1816 wrote to memory of 1368 1816 fxlrfrx.exe 43 PID 1816 wrote to memory of 1368 1816 fxlrfrx.exe 43 PID 1816 wrote to memory of 1368 1816 fxlrfrx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3a4f979748217fad0d1037f57d6adf20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\jvdjj.exec:\jvdjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rrrxrrf.exec:\rrrxrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\nhthnn.exec:\nhthnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\dvjjv.exec:\dvjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\7dvjv.exec:\7dvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\7fflxfl.exec:\7fflxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\nhhnhb.exec:\nhhnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hhttbt.exec:\hhttbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\vvpvv.exec:\vvpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rlrrfll.exec:\rlrrfll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\llrrxrx.exec:\llrrxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7bntbb.exec:\7bntbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\7nbhnt.exec:\7nbhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\jvdvp.exec:\jvdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\fxlrfrx.exec:\fxlrfrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\frfxrxl.exec:\frfxrxl.exe17⤵
- Executes dropped EXE
PID:1368 -
\??\c:\5tnhbn.exec:\5tnhbn.exe18⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nbtbtt.exec:\nbtbtt.exe19⤵
- Executes dropped EXE
PID:2112 -
\??\c:\pjdjp.exec:\pjdjp.exe20⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lrflfxl.exec:\lrflfxl.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xrrxrrf.exec:\xrrxrrf.exe22⤵
- Executes dropped EXE
PID:2204 -
\??\c:\thbhnb.exec:\thbhnb.exe23⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vppvv.exec:\vppvv.exe24⤵
- Executes dropped EXE
PID:704 -
\??\c:\jdpvj.exec:\jdpvj.exe25⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lxrlllr.exec:\lxrlllr.exe26⤵
- Executes dropped EXE
PID:1828 -
\??\c:\hthntt.exec:\hthntt.exe27⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jdjjj.exec:\jdjjj.exe28⤵
- Executes dropped EXE
PID:1840 -
\??\c:\7pdvp.exec:\7pdvp.exe29⤵
- Executes dropped EXE
PID:380 -
\??\c:\7xrrlrx.exec:\7xrrlrx.exe30⤵
- Executes dropped EXE
PID:932 -
\??\c:\btntht.exec:\btntht.exe31⤵
- Executes dropped EXE
PID:1668 -
\??\c:\9bnbnt.exec:\9bnbnt.exe32⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vpjpd.exec:\vpjpd.exe33⤵
- Executes dropped EXE
PID:2260 -
\??\c:\fxfflrf.exec:\fxfflrf.exe34⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lfrxfxf.exec:\lfrxfxf.exe35⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tnhntt.exec:\tnhntt.exe36⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bbhthb.exec:\bbhthb.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jjdjj.exec:\jjdjj.exe38⤵
- Executes dropped EXE
PID:2532 -
\??\c:\5pppv.exec:\5pppv.exe39⤵
- Executes dropped EXE
PID:1344 -
\??\c:\xrxxflx.exec:\xrxxflx.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rrllxxx.exec:\rrllxxx.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tnbtbn.exec:\tnbtbn.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hbbbtn.exec:\hbbbtn.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jddpp.exec:\jddpp.exe44⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ppjpp.exec:\ppjpp.exe45⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lfxxflx.exec:\lfxxflx.exe46⤵
- Executes dropped EXE
PID:2476 -
\??\c:\1lfllrx.exec:\1lfllrx.exe47⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rlxfxfr.exec:\rlxfxfr.exe48⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nhtbhh.exec:\nhtbhh.exe49⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hhbhtb.exec:\hhbhtb.exe50⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vpdjp.exec:\vpdjp.exe51⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ddddp.exec:\ddddp.exe52⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xrlrrlx.exec:\xrlrrlx.exe53⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bnhnbh.exec:\bnhnbh.exe54⤵
- Executes dropped EXE
PID:2340 -
\??\c:\bthhnn.exec:\bthhnn.exe55⤵
- Executes dropped EXE
PID:1464 -
\??\c:\ppjpv.exec:\ppjpv.exe56⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jjppd.exec:\jjppd.exe57⤵
- Executes dropped EXE
PID:1336 -
\??\c:\ffrfrlx.exec:\ffrfrlx.exe58⤵
- Executes dropped EXE
PID:1380 -
\??\c:\frxlxlf.exec:\frxlxlf.exe59⤵
- Executes dropped EXE
PID:2216 -
\??\c:\llrfxfl.exec:\llrfxfl.exe60⤵
- Executes dropped EXE
PID:1264 -
\??\c:\btntbb.exec:\btntbb.exe61⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3btthh.exec:\3btthh.exe62⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jdppd.exec:\jdppd.exe63⤵
- Executes dropped EXE
PID:1160 -
\??\c:\vpdjp.exec:\vpdjp.exe64⤵
- Executes dropped EXE
PID:588 -
\??\c:\rfrrrfl.exec:\rfrrrfl.exe65⤵
- Executes dropped EXE
PID:1424 -
\??\c:\fflrffl.exec:\fflrffl.exe66⤵PID:668
-
\??\c:\nhnntt.exec:\nhnntt.exe67⤵PID:564
-
\??\c:\tnbbnn.exec:\tnbbnn.exe68⤵PID:808
-
\??\c:\ppvdd.exec:\ppvdd.exe69⤵PID:980
-
\??\c:\5rllrrf.exec:\5rllrrf.exe70⤵PID:2124
-
\??\c:\lfllxrx.exec:\lfllxrx.exe71⤵PID:1276
-
\??\c:\1llfrxf.exec:\1llfrxf.exe72⤵PID:572
-
\??\c:\1nhntb.exec:\1nhntb.exe73⤵PID:1632
-
\??\c:\7hbhtn.exec:\7hbhtn.exe74⤵PID:576
-
\??\c:\jvjjd.exec:\jvjjd.exe75⤵PID:1516
-
\??\c:\jjvjv.exec:\jjvjv.exe76⤵PID:2084
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe77⤵PID:2028
-
\??\c:\xxflflx.exec:\xxflflx.exe78⤵PID:1448
-
\??\c:\bttbnh.exec:\bttbnh.exe79⤵PID:1604
-
\??\c:\nnbnbb.exec:\nnbnbb.exe80⤵PID:2008
-
\??\c:\btbbnt.exec:\btbbnt.exe81⤵PID:2724
-
\??\c:\jdppv.exec:\jdppv.exe82⤵PID:2636
-
\??\c:\pjddj.exec:\pjddj.exe83⤵PID:2624
-
\??\c:\ffxxfxf.exec:\ffxxfxf.exe84⤵PID:2244
-
\??\c:\7llrlxl.exec:\7llrlxl.exe85⤵PID:2736
-
\??\c:\hbbntb.exec:\hbbntb.exe86⤵PID:2620
-
\??\c:\1thnhn.exec:\1thnhn.exe87⤵PID:2420
-
\??\c:\nhhnnh.exec:\nhhnnh.exe88⤵PID:2688
-
\??\c:\1jdpd.exec:\1jdpd.exe89⤵PID:1992
-
\??\c:\pjjvj.exec:\pjjvj.exe90⤵PID:2868
-
\??\c:\lfrxllr.exec:\lfrxllr.exe91⤵PID:2572
-
\??\c:\xrfrrxf.exec:\xrfrrxf.exe92⤵PID:1364
-
\??\c:\9lrlfrx.exec:\9lrlfrx.exe93⤵PID:2756
-
\??\c:\hbtbtt.exec:\hbtbtt.exe94⤵PID:2292
-
\??\c:\ddpvd.exec:\ddpvd.exe95⤵PID:1820
-
\??\c:\3jvdj.exec:\3jvdj.exe96⤵PID:1588
-
\??\c:\fxllrxf.exec:\fxllrxf.exe97⤵PID:2772
-
\??\c:\5rfrffx.exec:\5rfrffx.exe98⤵PID:1572
-
\??\c:\tntttb.exec:\tntttb.exe99⤵PID:2340
-
\??\c:\bthbtb.exec:\bthbtb.exe100⤵PID:2168
-
\??\c:\nhttbt.exec:\nhttbt.exe101⤵PID:1032
-
\??\c:\1dvjp.exec:\1dvjp.exe102⤵PID:2152
-
\??\c:\pjddd.exec:\pjddd.exe103⤵PID:1380
-
\??\c:\3rlrxxl.exec:\3rlrxxl.exe104⤵PID:1244
-
\??\c:\3lrxxfl.exec:\3lrxxfl.exe105⤵PID:2056
-
\??\c:\bntbnb.exec:\bntbnb.exe106⤵PID:1340
-
\??\c:\3thtbh.exec:\3thtbh.exe107⤵PID:2204
-
\??\c:\ddpdj.exec:\ddpdj.exe108⤵PID:2052
-
\??\c:\dvjdp.exec:\dvjdp.exe109⤵PID:596
-
\??\c:\lllrxfl.exec:\lllrxfl.exe110⤵PID:580
-
\??\c:\lfflrll.exec:\lfflrll.exe111⤵PID:668
-
\??\c:\7thhnh.exec:\7thhnh.exe112⤵PID:600
-
\??\c:\hbnhhn.exec:\hbnhhn.exe113⤵PID:808
-
\??\c:\pjddj.exec:\pjddj.exe114⤵PID:344
-
\??\c:\1pdpv.exec:\1pdpv.exe115⤵PID:320
-
\??\c:\1jvpv.exec:\1jvpv.exe116⤵PID:1092
-
\??\c:\lllrxfl.exec:\lllrxfl.exe117⤵PID:3020
-
\??\c:\xxrxffx.exec:\xxrxffx.exe118⤵PID:1632
-
\??\c:\bbhthn.exec:\bbhthn.exe119⤵PID:936
-
\??\c:\3nhthh.exec:\3nhthh.exe120⤵PID:1516
-
\??\c:\ddvjd.exec:\ddvjd.exe121⤵PID:2004
-
\??\c:\ddjdj.exec:\ddjdj.exe122⤵PID:2028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-