Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 19:34
Behavioral task
behavioral1
Sample
2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe
-
Size
186KB
-
MD5
2fbb427b9269751db48c3c634d2334b0
-
SHA1
51215601716527cc60289292653fa4a93cbf0994
-
SHA256
e7c453e073ac2c846a288dc01c56749ac369be4735f2733bb7f7a179990030e8
-
SHA512
7f33bd554135921bdb6d4b2152b8fae776d7bb5a868db305a99e25903f4bd47eda662dcaa5d630422bd4ecaaa826aae1ebc8e9131b2ed3e7b4352aa035b09a8d
-
SSDEEP
3072:3hOmTsF93UYfwC6GIoutw8YcvrqrE66kropO6BWlPFH4tw1D43eMA:3cm4FmowdHoSzhraHcpOFltH4twl43vA
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/3028-8-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2316-22-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2036-18-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2652-68-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2416-301-0x00000000001B0000-0x00000000001E2000-memory.dmp family_blackmoon behavioral1/memory/2492-346-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2468-349-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/592-443-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/112-712-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1684-998-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2764-1039-0x00000000001B0000-0x00000000001E2000-memory.dmp family_blackmoon behavioral1/memory/1200-1019-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2888-1012-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2140-662-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/108-476-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/576-463-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1704-436-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1456-431-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1720-422-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1636-316-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2740-308-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2928-267-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1192-257-0x0000000000220000-0x0000000000252000-memory.dmp family_blackmoon behavioral1/memory/2612-239-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/712-231-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/784-205-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1068-197-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2328-177-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1556-161-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1320-134-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1880-125-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2820-107-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2068-105-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2784-95-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2488-85-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2504-66-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2148-56-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2616-38-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2036 7hbbbn.exe 2316 ppjdp.exe 2616 pjvdv.exe 2696 xxxllxr.exe 2148 3ntbhn.exe 2504 nhbhtt.exe 2652 jdvdp.exe 2488 jdvvj.exe 2784 rlfrflx.exe 2068 xrflxxl.exe 2820 7tntbb.exe 1880 nnhbbh.exe 1320 vpdpv.exe 2812 ffflflx.exe 2936 rlxflrx.exe 824 hbtthn.exe 1556 5nnbhh.exe 2328 9vvjd.exe 1088 jjdpd.exe 2452 llfrlxl.exe 1068 xxllfrx.exe 784 tnhntb.exe 672 nnhthh.exe 712 jjdpv.exe 2612 ddpjj.exe 1912 lfxxrrf.exe 1192 lfrxrlx.exe 2928 hbttbh.exe 1484 vpdjj.exe 2112 dppvj.exe 1788 lfflxxf.exe 2416 tnbbnn.exe 2740 9btbhn.exe 1624 vvjpd.exe 1636 xxlfflx.exe 2672 rlrxlrx.exe 2624 7thhtb.exe 2720 tnbhtb.exe 2492 pvdpd.exe 2468 vpdjv.exe 2544 vpjdp.exe 1760 llflxfx.exe 1612 ffxxrlf.exe 2656 tnnnbh.exe 1748 tthhnh.exe 1736 dvddd.exe 1320 5vppv.exe 2752 fxxxffx.exe 2596 llxfxfx.exe 1392 ffllrrf.exe 1720 1ttbtt.exe 2040 nhhbnn.exe 1456 pdppv.exe 1704 vvddj.exe 592 xxlxrll.exe 2908 xxxrfrf.exe 576 bnhnhh.exe 620 hbntht.exe 860 dvpdj.exe 108 jjdpd.exe 1572 llffrrf.exe 1072 rlflrrf.exe 312 tnhtbh.exe 2928 hbnbnt.exe -
resource yara_rule behavioral1/memory/3028-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000a000000014120-5.dat upx behavioral1/memory/3028-8-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/3028-6-0x0000000001B70000-0x0000000001BA2000-memory.dmp upx behavioral1/memory/2316-22-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00090000000143ec-20.dat upx behavioral1/memory/2036-18-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2616-30-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00070000000146a2-45.dat upx behavioral1/memory/2652-68-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00070000000149f5-83.dat upx behavioral1/memory/2068-96-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0007000000014abe-97.dat upx behavioral1/memory/1880-115-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000014ef8-143.dat upx behavioral1/files/0x0006000000015018-150.dat upx behavioral1/memory/2328-169-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015605-187.dat upx behavioral1/files/0x0006000000015c52-232.dat upx behavioral1/files/0x0006000000015c78-249.dat upx behavioral1/files/0x0006000000015c83-258.dat upx behavioral1/files/0x0006000000015c9f-269.dat upx behavioral1/memory/2492-346-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2468-349-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/592-443-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/576-456-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/112-712-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2436-820-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1684-998-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/3044-1130-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2448-1026-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1200-1019-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2888-1012-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2028-1005-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/892-967-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/596-960-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1960-941-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/3052-813-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2192-761-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2972-675-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2140-662-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/108-476-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/576-463-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1704-436-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1456-431-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1720-422-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1720-415-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1736-384-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2672-322-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1636-316-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2740-308-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015cee-294.dat upx behavioral1/files/0x0006000000015cce-286.dat upx behavioral1/files/0x0006000000015cb6-278.dat upx behavioral1/memory/2112-277-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2928-267-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2928-259-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1192-257-0x0000000000220000-0x0000000000252000-memory.dmp upx behavioral1/files/0x0006000000015c6b-241.dat upx behavioral1/memory/2612-239-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/712-231-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015c3d-223.dat upx behavioral1/memory/712-222-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015b6f-214.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2036 3028 2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe 226 PID 3028 wrote to memory of 2036 3028 2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe 226 PID 3028 wrote to memory of 2036 3028 2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe 226 PID 3028 wrote to memory of 2036 3028 2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe 226 PID 2036 wrote to memory of 2316 2036 7hbbbn.exe 29 PID 2036 wrote to memory of 2316 2036 7hbbbn.exe 29 PID 2036 wrote to memory of 2316 2036 7hbbbn.exe 29 PID 2036 wrote to memory of 2316 2036 7hbbbn.exe 29 PID 2316 wrote to memory of 2616 2316 ppjdp.exe 100 PID 2316 wrote to memory of 2616 2316 ppjdp.exe 100 PID 2316 wrote to memory of 2616 2316 ppjdp.exe 100 PID 2316 wrote to memory of 2616 2316 ppjdp.exe 100 PID 2616 wrote to memory of 2696 2616 pjvdv.exe 31 PID 2616 wrote to memory of 2696 2616 pjvdv.exe 31 PID 2616 wrote to memory of 2696 2616 pjvdv.exe 31 PID 2616 wrote to memory of 2696 2616 pjvdv.exe 31 PID 2696 wrote to memory of 2148 2696 xxxllxr.exe 32 PID 2696 wrote to memory of 2148 2696 xxxllxr.exe 32 PID 2696 wrote to memory of 2148 2696 xxxllxr.exe 32 PID 2696 wrote to memory of 2148 2696 xxxllxr.exe 32 PID 2148 wrote to memory of 2504 2148 3ntbhn.exe 33 PID 2148 wrote to memory of 2504 2148 3ntbhn.exe 33 PID 2148 wrote to memory of 2504 2148 3ntbhn.exe 33 PID 2148 wrote to memory of 2504 2148 3ntbhn.exe 33 PID 2504 wrote to memory of 2652 2504 nhbhtt.exe 34 PID 2504 wrote to memory of 2652 2504 nhbhtt.exe 34 PID 2504 wrote to memory of 2652 2504 nhbhtt.exe 34 PID 2504 wrote to memory of 2652 2504 nhbhtt.exe 34 PID 2652 wrote to memory of 2488 2652 jdvdp.exe 35 PID 2652 wrote to memory of 2488 2652 jdvdp.exe 35 PID 2652 wrote to memory of 2488 2652 jdvdp.exe 35 PID 2652 wrote to memory of 2488 2652 jdvdp.exe 35 PID 2488 wrote to memory of 2784 2488 jdvvj.exe 36 PID 2488 wrote to memory of 2784 2488 jdvvj.exe 36 PID 2488 wrote to memory of 2784 2488 jdvvj.exe 36 PID 2488 wrote to memory of 2784 2488 jdvvj.exe 36 PID 2784 wrote to memory of 2068 2784 rlfrflx.exe 37 PID 2784 wrote to memory of 2068 2784 rlfrflx.exe 37 PID 2784 wrote to memory of 2068 2784 rlfrflx.exe 37 PID 2784 wrote to memory of 2068 2784 rlfrflx.exe 37 PID 2068 wrote to memory of 2820 2068 xrflxxl.exe 38 PID 2068 wrote to memory of 2820 2068 xrflxxl.exe 38 PID 2068 wrote to memory of 2820 2068 xrflxxl.exe 38 PID 2068 wrote to memory of 2820 2068 xrflxxl.exe 38 PID 2820 wrote to memory of 1880 2820 7tntbb.exe 39 PID 2820 wrote to memory of 1880 2820 7tntbb.exe 39 PID 2820 wrote to memory of 1880 2820 7tntbb.exe 39 PID 2820 wrote to memory of 1880 2820 7tntbb.exe 39 PID 1880 wrote to memory of 1320 1880 nnhbbh.exe 40 PID 1880 wrote to memory of 1320 1880 nnhbbh.exe 40 PID 1880 wrote to memory of 1320 1880 nnhbbh.exe 40 PID 1880 wrote to memory of 1320 1880 nnhbbh.exe 40 PID 1320 wrote to memory of 2812 1320 vpdpv.exe 41 PID 1320 wrote to memory of 2812 1320 vpdpv.exe 41 PID 1320 wrote to memory of 2812 1320 vpdpv.exe 41 PID 1320 wrote to memory of 2812 1320 vpdpv.exe 41 PID 2812 wrote to memory of 2936 2812 ffflflx.exe 42 PID 2812 wrote to memory of 2936 2812 ffflflx.exe 42 PID 2812 wrote to memory of 2936 2812 ffflflx.exe 42 PID 2812 wrote to memory of 2936 2812 ffflflx.exe 42 PID 2936 wrote to memory of 824 2936 rlxflrx.exe 43 PID 2936 wrote to memory of 824 2936 rlxflrx.exe 43 PID 2936 wrote to memory of 824 2936 rlxflrx.exe 43 PID 2936 wrote to memory of 824 2936 rlxflrx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\7hbbbn.exec:\7hbbbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\ppjdp.exec:\ppjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\pjvdv.exec:\pjvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xxxllxr.exec:\xxxllxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3ntbhn.exec:\3ntbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\nhbhtt.exec:\nhbhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jdvdp.exec:\jdvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jdvvj.exec:\jdvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rlfrflx.exec:\rlfrflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\xrflxxl.exec:\xrflxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\7tntbb.exec:\7tntbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\nnhbbh.exec:\nnhbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\vpdpv.exec:\vpdpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\ffflflx.exec:\ffflflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\rlxflrx.exec:\rlxflrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\hbtthn.exec:\hbtthn.exe17⤵
- Executes dropped EXE
PID:824 -
\??\c:\5nnbhh.exec:\5nnbhh.exe18⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9vvjd.exec:\9vvjd.exe19⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jjdpd.exec:\jjdpd.exe20⤵
- Executes dropped EXE
PID:1088 -
\??\c:\llfrlxl.exec:\llfrlxl.exe21⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xxllfrx.exec:\xxllfrx.exe22⤵
- Executes dropped EXE
PID:1068 -
\??\c:\tnhntb.exec:\tnhntb.exe23⤵
- Executes dropped EXE
PID:784 -
\??\c:\nnhthh.exec:\nnhthh.exe24⤵
- Executes dropped EXE
PID:672 -
\??\c:\jjdpv.exec:\jjdpv.exe25⤵
- Executes dropped EXE
PID:712 -
\??\c:\ddpjj.exec:\ddpjj.exe26⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lfxxrrf.exec:\lfxxrrf.exe27⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lfrxrlx.exec:\lfrxrlx.exe28⤵
- Executes dropped EXE
PID:1192 -
\??\c:\hbttbh.exec:\hbttbh.exe29⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vpdjj.exec:\vpdjj.exe30⤵
- Executes dropped EXE
PID:1484 -
\??\c:\dppvj.exec:\dppvj.exe31⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lfflxxf.exec:\lfflxxf.exe32⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tnbbnn.exec:\tnbbnn.exe33⤵
- Executes dropped EXE
PID:2416 -
\??\c:\9btbhn.exec:\9btbhn.exe34⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vvjpd.exec:\vvjpd.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xxlfflx.exec:\xxlfflx.exe36⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rlrxlrx.exec:\rlrxlrx.exe37⤵
- Executes dropped EXE
PID:2672 -
\??\c:\7thhtb.exec:\7thhtb.exe38⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tnbhtb.exec:\tnbhtb.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pvdpd.exec:\pvdpd.exe40⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vpdjv.exec:\vpdjv.exe41⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vpjdp.exec:\vpjdp.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\llflxfx.exec:\llflxfx.exe43⤵
- Executes dropped EXE
PID:1760 -
\??\c:\ffxxrlf.exec:\ffxxrlf.exe44⤵
- Executes dropped EXE
PID:1612 -
\??\c:\tnnnbh.exec:\tnnnbh.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tthhnh.exec:\tthhnh.exe46⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dvddd.exec:\dvddd.exe47⤵
- Executes dropped EXE
PID:1736 -
\??\c:\5vppv.exec:\5vppv.exe48⤵
- Executes dropped EXE
PID:1320 -
\??\c:\fxxxffx.exec:\fxxxffx.exe49⤵
- Executes dropped EXE
PID:2752 -
\??\c:\llxfxfx.exec:\llxfxfx.exe50⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ffllrrf.exec:\ffllrrf.exe51⤵
- Executes dropped EXE
PID:1392 -
\??\c:\1ttbtt.exec:\1ttbtt.exe52⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nhhbnn.exec:\nhhbnn.exe53⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pdppv.exec:\pdppv.exe54⤵
- Executes dropped EXE
PID:1456 -
\??\c:\vvddj.exec:\vvddj.exe55⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xxlxrll.exec:\xxlxrll.exe56⤵
- Executes dropped EXE
PID:592 -
\??\c:\xxxrfrf.exec:\xxxrfrf.exe57⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bnhnhh.exec:\bnhnhh.exe58⤵
- Executes dropped EXE
PID:576 -
\??\c:\hbntht.exec:\hbntht.exe59⤵
- Executes dropped EXE
PID:620 -
\??\c:\dvpdj.exec:\dvpdj.exe60⤵
- Executes dropped EXE
PID:860 -
\??\c:\jjdpd.exec:\jjdpd.exe61⤵
- Executes dropped EXE
PID:108 -
\??\c:\llffrrf.exec:\llffrrf.exe62⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rlflrrf.exec:\rlflrrf.exe63⤵
- Executes dropped EXE
PID:1072 -
\??\c:\tnhtbh.exec:\tnhtbh.exe64⤵
- Executes dropped EXE
PID:312 -
\??\c:\hbnbnt.exec:\hbnbnt.exe65⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vvvdd.exec:\vvvdd.exe66⤵PID:2868
-
\??\c:\vdjdj.exec:\vdjdj.exe67⤵PID:1108
-
\??\c:\jvdpp.exec:\jvdpp.exe68⤵PID:2108
-
\??\c:\5xrfllr.exec:\5xrfllr.exe69⤵PID:2228
-
\??\c:\fxfxxxl.exec:\fxfxxxl.exe70⤵PID:2692
-
\??\c:\9fxfrxl.exec:\9fxfrxl.exe71⤵PID:2152
-
\??\c:\ttntbh.exec:\ttntbh.exe72⤵PID:1628
-
\??\c:\5hhthh.exec:\5hhthh.exe73⤵PID:1104
-
\??\c:\3jpdd.exec:\3jpdd.exe74⤵PID:2616
-
\??\c:\jjvdp.exec:\jjvdp.exe75⤵PID:2520
-
\??\c:\5rrlfrf.exec:\5rrlfrf.exe76⤵PID:2896
-
\??\c:\xrlrrxr.exec:\xrlrrxr.exe77⤵PID:2816
-
\??\c:\nnbnbb.exec:\nnbnbb.exe78⤵PID:2708
-
\??\c:\httnhh.exec:\httnhh.exe79⤵PID:1060
-
\??\c:\bthtnb.exec:\bthtnb.exe80⤵PID:1648
-
\??\c:\9jdpd.exec:\9jdpd.exe81⤵PID:3044
-
\??\c:\pjdpv.exec:\pjdpv.exe82⤵PID:2132
-
\??\c:\lfxllrf.exec:\lfxllrf.exe83⤵PID:2976
-
\??\c:\xxrfflx.exec:\xxrfflx.exe84⤵PID:2508
-
\??\c:\bbbtnn.exec:\bbbtnn.exe85⤵PID:2820
-
\??\c:\bbthhn.exec:\bbthhn.exe86⤵PID:1880
-
\??\c:\tntthh.exec:\tntthh.exe87⤵PID:2456
-
\??\c:\jjjpj.exec:\jjjpj.exe88⤵PID:1832
-
\??\c:\pjdjp.exec:\pjdjp.exe89⤵PID:2472
-
\??\c:\fxllflx.exec:\fxllflx.exe90⤵PID:1584
-
\??\c:\xrlxllx.exec:\xrlxllx.exe91⤵PID:2140
-
\??\c:\hhbbnb.exec:\hhbbnb.exe92⤵PID:1836
-
\??\c:\nhnhnb.exec:\nhnhnb.exe93⤵PID:1092
-
\??\c:\vpjvj.exec:\vpjvj.exe94⤵PID:2972
-
\??\c:\pjvvp.exec:\pjvvp.exe95⤵PID:2180
-
\??\c:\dvvvd.exec:\dvvvd.exe96⤵PID:596
-
\??\c:\7xxfrxl.exec:\7xxfrxl.exe97⤵PID:1460
-
\??\c:\rrlrfxl.exec:\rrlrfxl.exe98⤵PID:1672
-
\??\c:\nhbbtt.exec:\nhbbtt.exe99⤵PID:112
-
\??\c:\hnhntb.exec:\hnhntb.exe100⤵PID:2836
-
\??\c:\1tnntn.exec:\1tnntn.exe101⤵PID:1696
-
\??\c:\dvppd.exec:\dvppd.exe102⤵PID:2588
-
\??\c:\jdvjj.exec:\jdvjj.exe103⤵PID:1452
-
\??\c:\jddpd.exec:\jddpd.exe104⤵PID:2888
-
\??\c:\1rrrxxf.exec:\1rrrxxf.exe105⤵PID:968
-
\??\c:\1flrxlx.exec:\1flrxlx.exe106⤵PID:2448
-
\??\c:\7tnbnb.exec:\7tnbnb.exe107⤵PID:952
-
\??\c:\hbttht.exec:\hbttht.exe108⤵PID:2192
-
\??\c:\btntbn.exec:\btntbn.exe109⤵PID:1108
-
\??\c:\vpvvv.exec:\vpvvv.exe110⤵PID:2108
-
\??\c:\pdvvp.exec:\pdvvp.exe111⤵PID:2228
-
\??\c:\llflfrf.exec:\llflfrf.exe112⤵PID:2400
-
\??\c:\9xrxlrf.exec:\9xrxlrf.exe113⤵PID:1984
-
\??\c:\rlfflrf.exec:\rlfflrf.exe114⤵PID:2440
-
\??\c:\tntttb.exec:\tntttb.exe115⤵PID:1604
-
\??\c:\hhnhtt.exec:\hhnhtt.exe116⤵PID:1104
-
\??\c:\1bbbhn.exec:\1bbbhn.exe117⤵PID:3052
-
\??\c:\9vppv.exec:\9vppv.exe118⤵PID:2436
-
\??\c:\7ppdp.exec:\7ppdp.exe119⤵PID:2712
-
\??\c:\lxllxff.exec:\lxllxff.exe120⤵PID:2956
-
\??\c:\5llfrrf.exec:\5llfrrf.exe121⤵PID:2500
-
\??\c:\5xrfllx.exec:\5xrfllx.exe122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-