Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 04:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe
-
Size
210KB
-
MD5
7ae66d6d27607ddbb8e1fa885a6b5bd0
-
SHA1
4d89a67232429ee882bbd556892c53fb38eb4bfb
-
SHA256
c4c9872760cd660d0c47330b67e908cafab8fbee9b5c83eaa2b6f9ab808119f5
-
SHA512
030f0caa8ec2b0dfb82c5a3ce2ddd713fa5c7fefb63410d4440bac0b9dbe7458367779109f85d0ec875e082cc5f964f52be6c7d2e4483b0ea810951bdcc2a18e
-
SSDEEP
1536:wvQBeOGtrYSSsrc93UBIfdC67m6AJiqQfg3Cip8iXAsG5M0h:whOm2sI93UufdC67cizfmCiiiXAd
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2912-7-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2984-11-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/3048-20-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2532-36-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2492-45-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2472-53-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2336-79-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2116-88-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1792-97-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/296-105-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1444-116-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2400-125-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1544-134-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1776-152-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/856-176-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2580-185-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1200-202-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/536-211-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/348-253-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1592-288-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2980-301-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/3048-327-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2660-335-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2808-392-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2328-412-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2400-419-0x0000000000220000-0x000000000024C000-memory.dmp family_blackmoon behavioral1/memory/808-433-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/808-440-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2160-472-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/996-485-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1480-512-0x00000000002C0000-0x00000000002EC000-memory.dmp family_blackmoon behavioral1/memory/1476-519-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1716-579-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2480-611-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2064-662-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/2044-737-0x0000000000220000-0x000000000024C000-memory.dmp family_blackmoon behavioral1/memory/2696-749-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral1/memory/1292-1069-0x0000000000220000-0x000000000024C000-memory.dmp family_blackmoon behavioral1/memory/2768-1120-0x0000000000220000-0x000000000024C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2984 nhnhtt.exe 3048 3vjvj.exe 2532 9xrrflr.exe 2492 3bbnbh.exe 2472 vvpvj.exe 2664 9frllfl.exe 2512 7bnhnn.exe 2336 3htbbb.exe 2116 pjpdj.exe 1792 7bthbn.exe 296 5vdvd.exe 1444 lrflxll.exe 2400 ntbbnn.exe 1544 pppjv.exe 1796 rlflxxr.exe 1736 xrllflx.exe 1776 tnbnbt.exe 1248 dddjd.exe 856 lxlrxfl.exe 2580 3rxlllx.exe 1028 tthtnn.exe 1200 fxrxflr.exe 536 hththn.exe 1408 1bnnbn.exe 1712 7fllrrx.exe 1192 nntnth.exe 2224 vjvpv.exe 348 vjvdj.exe 2320 7nnbhh.exe 2008 dppvv.exe 1012 frfrxfr.exe 2280 1ttnhb.exe 1592 vpdpp.exe 2980 rffffxl.exe 2916 9nhhnt.exe 1632 tbhttn.exe 2520 jjvjp.exe 3048 rlrrllr.exe 2660 lxlxffr.exe 2720 hbnntn.exe 2528 1vjjp.exe 2636 5jvdv.exe 2368 7fxflrx.exe 2360 nbtntn.exe 2800 bhtttb.exe 2792 3djjp.exe 2632 5xlflrf.exe 2808 fxflfxl.exe 296 3bhthn.exe 1552 tntttt.exe 2328 vvpdp.exe 2400 5lxflll.exe 352 hhbbtb.exe 1796 nhtbnt.exe 808 jjddj.exe 1644 fxrrffl.exe 852 rrxfrxx.exe 2696 nhhnbh.exe 2604 jvdpj.exe 2160 ddvdv.exe 2164 7xrfrxf.exe 996 fxrfrxl.exe 1200 bbthth.exe 528 ddppv.exe -
resource yara_rule behavioral1/memory/2912-7-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2984-11-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/3048-20-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2532-27-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2532-36-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2492-45-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2472-53-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2336-79-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2116-88-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1792-97-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/296-105-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1444-107-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1444-116-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2400-125-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1544-134-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1776-152-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/856-176-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2580-185-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1200-202-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/536-211-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/348-253-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2320-258-0x0000000000220000-0x000000000024C000-memory.dmp upx behavioral1/memory/2280-280-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1592-288-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2980-301-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/3048-327-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2660-328-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2660-335-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2720-336-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2368-355-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2808-392-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2328-412-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1796-426-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/808-433-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/808-440-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2160-472-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/996-485-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1624-498-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1480-505-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1476-519-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1232-526-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1988-545-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1716-572-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1716-579-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2544-598-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2480-611-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2064-662-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1360-669-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1060-676-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/328-690-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1504-697-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1560-716-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2044-737-0x0000000000220000-0x000000000024C000-memory.dmp upx behavioral1/memory/2696-742-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2696-749-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/648-774-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1708-781-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1948-848-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2640-898-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2348-905-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1928-918-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2572-1025-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1292-1062-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/2392-1201-0x0000000000400000-0x000000000042C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2984 2912 7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe 28 PID 2912 wrote to memory of 2984 2912 7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe 28 PID 2912 wrote to memory of 2984 2912 7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe 28 PID 2912 wrote to memory of 2984 2912 7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe 28 PID 2984 wrote to memory of 3048 2984 nhnhtt.exe 29 PID 2984 wrote to memory of 3048 2984 nhnhtt.exe 29 PID 2984 wrote to memory of 3048 2984 nhnhtt.exe 29 PID 2984 wrote to memory of 3048 2984 nhnhtt.exe 29 PID 3048 wrote to memory of 2532 3048 3vjvj.exe 30 PID 3048 wrote to memory of 2532 3048 3vjvj.exe 30 PID 3048 wrote to memory of 2532 3048 3vjvj.exe 30 PID 3048 wrote to memory of 2532 3048 3vjvj.exe 30 PID 2532 wrote to memory of 2492 2532 9xrrflr.exe 31 PID 2532 wrote to memory of 2492 2532 9xrrflr.exe 31 PID 2532 wrote to memory of 2492 2532 9xrrflr.exe 31 PID 2532 wrote to memory of 2492 2532 9xrrflr.exe 31 PID 2492 wrote to memory of 2472 2492 3bbnbh.exe 32 PID 2492 wrote to memory of 2472 2492 3bbnbh.exe 32 PID 2492 wrote to memory of 2472 2492 3bbnbh.exe 32 PID 2492 wrote to memory of 2472 2492 3bbnbh.exe 32 PID 2472 wrote to memory of 2664 2472 vvpvj.exe 33 PID 2472 wrote to memory of 2664 2472 vvpvj.exe 33 PID 2472 wrote to memory of 2664 2472 vvpvj.exe 33 PID 2472 wrote to memory of 2664 2472 vvpvj.exe 33 PID 2664 wrote to memory of 2512 2664 9frllfl.exe 34 PID 2664 wrote to memory of 2512 2664 9frllfl.exe 34 PID 2664 wrote to memory of 2512 2664 9frllfl.exe 34 PID 2664 wrote to memory of 2512 2664 9frllfl.exe 34 PID 2512 wrote to memory of 2336 2512 7bnhnn.exe 35 PID 2512 wrote to memory of 2336 2512 7bnhnn.exe 35 PID 2512 wrote to memory of 2336 2512 7bnhnn.exe 35 PID 2512 wrote to memory of 2336 2512 7bnhnn.exe 35 PID 2336 wrote to memory of 2116 2336 3htbbb.exe 36 PID 2336 wrote to memory of 2116 2336 3htbbb.exe 36 PID 2336 wrote to memory of 2116 2336 3htbbb.exe 36 PID 2336 wrote to memory of 2116 2336 3htbbb.exe 36 PID 2116 wrote to memory of 1792 2116 pjpdj.exe 37 PID 2116 wrote to memory of 1792 2116 pjpdj.exe 37 PID 2116 wrote to memory of 1792 2116 pjpdj.exe 37 PID 2116 wrote to memory of 1792 2116 pjpdj.exe 37 PID 1792 wrote to memory of 296 1792 7bthbn.exe 38 PID 1792 wrote to memory of 296 1792 7bthbn.exe 38 PID 1792 wrote to memory of 296 1792 7bthbn.exe 38 PID 1792 wrote to memory of 296 1792 7bthbn.exe 38 PID 296 wrote to memory of 1444 296 5vdvd.exe 39 PID 296 wrote to memory of 1444 296 5vdvd.exe 39 PID 296 wrote to memory of 1444 296 5vdvd.exe 39 PID 296 wrote to memory of 1444 296 5vdvd.exe 39 PID 1444 wrote to memory of 2400 1444 lrflxll.exe 40 PID 1444 wrote to memory of 2400 1444 lrflxll.exe 40 PID 1444 wrote to memory of 2400 1444 lrflxll.exe 40 PID 1444 wrote to memory of 2400 1444 lrflxll.exe 40 PID 2400 wrote to memory of 1544 2400 ntbbnn.exe 41 PID 2400 wrote to memory of 1544 2400 ntbbnn.exe 41 PID 2400 wrote to memory of 1544 2400 ntbbnn.exe 41 PID 2400 wrote to memory of 1544 2400 ntbbnn.exe 41 PID 1544 wrote to memory of 1796 1544 pppjv.exe 42 PID 1544 wrote to memory of 1796 1544 pppjv.exe 42 PID 1544 wrote to memory of 1796 1544 pppjv.exe 42 PID 1544 wrote to memory of 1796 1544 pppjv.exe 42 PID 1796 wrote to memory of 1736 1796 rlflxxr.exe 43 PID 1796 wrote to memory of 1736 1796 rlflxxr.exe 43 PID 1796 wrote to memory of 1736 1796 rlflxxr.exe 43 PID 1796 wrote to memory of 1736 1796 rlflxxr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7ae66d6d27607ddbb8e1fa885a6b5bd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nhnhtt.exec:\nhnhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\3vjvj.exec:\3vjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\9xrrflr.exec:\9xrrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\3bbnbh.exec:\3bbnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\vvpvj.exec:\vvpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\9frllfl.exec:\9frllfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7bnhnn.exec:\7bnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\3htbbb.exec:\3htbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\pjpdj.exec:\pjpdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\7bthbn.exec:\7bthbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\5vdvd.exec:\5vdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\lrflxll.exec:\lrflxll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\ntbbnn.exec:\ntbbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\pppjv.exec:\pppjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\rlflxxr.exec:\rlflxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\xrllflx.exec:\xrllflx.exe17⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tnbnbt.exec:\tnbnbt.exe18⤵
- Executes dropped EXE
PID:1776 -
\??\c:\dddjd.exec:\dddjd.exe19⤵
- Executes dropped EXE
PID:1248 -
\??\c:\lxlrxfl.exec:\lxlrxfl.exe20⤵
- Executes dropped EXE
PID:856 -
\??\c:\3rxlllx.exec:\3rxlllx.exe21⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tthtnn.exec:\tthtnn.exe22⤵
- Executes dropped EXE
PID:1028 -
\??\c:\fxrxflr.exec:\fxrxflr.exe23⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hththn.exec:\hththn.exe24⤵
- Executes dropped EXE
PID:536 -
\??\c:\1bnnbn.exec:\1bnnbn.exe25⤵
- Executes dropped EXE
PID:1408 -
\??\c:\7fllrrx.exec:\7fllrrx.exe26⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nntnth.exec:\nntnth.exe27⤵
- Executes dropped EXE
PID:1192 -
\??\c:\vjvpv.exec:\vjvpv.exe28⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vjvdj.exec:\vjvdj.exe29⤵
- Executes dropped EXE
PID:348 -
\??\c:\7nnbhh.exec:\7nnbhh.exe30⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dppvv.exec:\dppvv.exe31⤵
- Executes dropped EXE
PID:2008 -
\??\c:\frfrxfr.exec:\frfrxfr.exe32⤵
- Executes dropped EXE
PID:1012 -
\??\c:\1ttnhb.exec:\1ttnhb.exe33⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vpdpp.exec:\vpdpp.exe34⤵
- Executes dropped EXE
PID:1592 -
\??\c:\rffffxl.exec:\rffffxl.exe35⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9nhhnt.exec:\9nhhnt.exe36⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tbhttn.exec:\tbhttn.exe37⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jjvjp.exec:\jjvjp.exe38⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rlrrllr.exec:\rlrrllr.exe39⤵
- Executes dropped EXE
PID:3048 -
\??\c:\lxlxffr.exec:\lxlxffr.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbnntn.exec:\hbnntn.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\1vjjp.exec:\1vjjp.exe42⤵
- Executes dropped EXE
PID:2528 -
\??\c:\5jvdv.exec:\5jvdv.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\7fxflrx.exec:\7fxflrx.exe44⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nbtntn.exec:\nbtntn.exe45⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bhtttb.exec:\bhtttb.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3djjp.exec:\3djjp.exe47⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5xlflrf.exec:\5xlflrf.exe48⤵
- Executes dropped EXE
PID:2632 -
\??\c:\fxflfxl.exec:\fxflfxl.exe49⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3bhthn.exec:\3bhthn.exe50⤵
- Executes dropped EXE
PID:296 -
\??\c:\tntttt.exec:\tntttt.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vvpdp.exec:\vvpdp.exe52⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5lxflll.exec:\5lxflll.exe53⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hhbbtb.exec:\hhbbtb.exe54⤵
- Executes dropped EXE
PID:352 -
\??\c:\nhtbnt.exec:\nhtbnt.exe55⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jjddj.exec:\jjddj.exe56⤵
- Executes dropped EXE
PID:808 -
\??\c:\fxrrffl.exec:\fxrrffl.exe57⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rrxfrxx.exec:\rrxfrxx.exe58⤵
- Executes dropped EXE
PID:852 -
\??\c:\nhhnbh.exec:\nhhnbh.exe59⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jvdpj.exec:\jvdpj.exe60⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ddvdv.exec:\ddvdv.exe61⤵
- Executes dropped EXE
PID:2160 -
\??\c:\7xrfrxf.exec:\7xrfrxf.exe62⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe63⤵
- Executes dropped EXE
PID:996 -
\??\c:\bbthth.exec:\bbthth.exe64⤵
- Executes dropped EXE
PID:1200 -
\??\c:\ddppv.exec:\ddppv.exe65⤵
- Executes dropped EXE
PID:528 -
\??\c:\pppjv.exec:\pppjv.exe66⤵PID:1624
-
\??\c:\7rfrxfl.exec:\7rfrxfl.exe67⤵PID:1480
-
\??\c:\xflrlfr.exec:\xflrlfr.exe68⤵PID:1280
-
\??\c:\tthhtb.exec:\tthhtb.exe69⤵PID:1476
-
\??\c:\bhhbbn.exec:\bhhbbn.exe70⤵PID:1232
-
\??\c:\vvpdv.exec:\vvpdv.exe71⤵PID:3060
-
\??\c:\ddjjv.exec:\ddjjv.exe72⤵PID:2208
-
\??\c:\rxlfrxr.exec:\rxlfrxr.exe73⤵PID:1988
-
\??\c:\hbhthh.exec:\hbhthh.exe74⤵PID:2196
-
\??\c:\1jdpv.exec:\1jdpv.exe75⤵PID:1012
-
\??\c:\9xrxllr.exec:\9xrxllr.exe76⤵PID:1636
-
\??\c:\rfllllr.exec:\rfllllr.exe77⤵PID:1716
-
\??\c:\7tbbhb.exec:\7tbbhb.exe78⤵PID:2888
-
\??\c:\btbnbb.exec:\btbnbb.exe79⤵PID:112
-
\??\c:\vpdvj.exec:\vpdvj.exe80⤵PID:2852
-
\??\c:\lfxfllx.exec:\lfxfllx.exe81⤵PID:2544
-
\??\c:\lrrlfrx.exec:\lrrlfrx.exe82⤵PID:2480
-
\??\c:\1hhnbh.exec:\1hhnbh.exe83⤵PID:2484
-
\??\c:\pdpvd.exec:\pdpvd.exe84⤵PID:2716
-
\??\c:\fxrxrlr.exec:\fxrxrlr.exe85⤵PID:2456
-
\??\c:\llxflxx.exec:\llxflxx.exe86⤵PID:2528
-
\??\c:\3thntb.exec:\3thntb.exe87⤵PID:2396
-
\??\c:\vvddj.exec:\vvddj.exe88⤵PID:2404
-
\??\c:\jdpdd.exec:\jdpdd.exe89⤵PID:2372
-
\??\c:\vpvdj.exec:\vpvdj.exe90⤵PID:1556
-
\??\c:\djdpd.exec:\djdpd.exe91⤵PID:2064
-
\??\c:\rlflrxr.exec:\rlflrxr.exe92⤵PID:1360
-
\??\c:\xlrlrfr.exec:\xlrlrfr.exe93⤵PID:1060
-
\??\c:\bntttb.exec:\bntttb.exe94⤵PID:1436
-
\??\c:\hbbnth.exec:\hbbnth.exe95⤵PID:328
-
\??\c:\pjjvj.exec:\pjjvj.exe96⤵PID:1504
-
\??\c:\lrlfllx.exec:\lrlfllx.exe97⤵PID:1016
-
\??\c:\xlrxlff.exec:\xlrxlff.exe98⤵PID:1780
-
\??\c:\hhbthh.exec:\hhbthh.exe99⤵PID:1560
-
\??\c:\ddpdj.exec:\ddpdj.exe100⤵PID:1268
-
\??\c:\xrlrrxl.exec:\xrlrrxl.exe101⤵PID:868
-
\??\c:\llfrfrx.exec:\llfrfrx.exe102⤵PID:2044
-
\??\c:\hbbhnb.exec:\hbbhnb.exe103⤵PID:2696
-
\??\c:\jjpdv.exec:\jjpdv.exe104⤵PID:2564
-
\??\c:\fxlxlrf.exec:\fxlxlrf.exe105⤵PID:2148
-
\??\c:\fxrlllx.exec:\fxrlllx.exe106⤵PID:336
-
\??\c:\bbthth.exec:\bbthth.exe107⤵PID:692
-
\??\c:\hbntnt.exec:\hbntnt.exe108⤵PID:648
-
\??\c:\9pjvj.exec:\9pjvj.exe109⤵PID:1708
-
\??\c:\flfrrlr.exec:\flfrrlr.exe110⤵PID:1812
-
\??\c:\xxlrfrf.exec:\xxlrfrf.exe111⤵PID:2016
-
\??\c:\3hbhnn.exec:\3hbhnn.exe112⤵PID:2056
-
\??\c:\pjvdp.exec:\pjvdp.exe113⤵PID:2192
-
\??\c:\dddpj.exec:\dddpj.exe114⤵PID:2028
-
\??\c:\lxrrlfr.exec:\lxrrlfr.exe115⤵PID:2568
-
\??\c:\bbhhtb.exec:\bbhhtb.exe116⤵PID:1688
-
\??\c:\ttbbhn.exec:\ttbbhn.exe117⤵PID:2176
-
\??\c:\5vpvj.exec:\5vpvj.exe118⤵PID:1424
-
\??\c:\pjdvp.exec:\pjdvp.exe119⤵PID:1948
-
\??\c:\rlfrxlf.exec:\rlfrxlf.exe120⤵PID:1636
-
\??\c:\hhhthn.exec:\hhhthn.exe121⤵PID:2980
-
\??\c:\ttnbbn.exec:\ttnbbn.exe122⤵PID:1524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-