Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 22:52
Behavioral task
behavioral1
Sample
2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe
-
Size
122KB
-
MD5
2f1d4728c2b3de6ce52345da42eca630
-
SHA1
02c16126652fa0071038f8bf594d021fb50e13bf
-
SHA256
6b258e4a75493e5c3c68e0ff1102e6a1e627406edc4f2f23f57512ee620746c5
-
SHA512
cb263825bbe01353967d64620324fc164109bfd35fa66d0dec4ae6dc6a66fa5eceeddb82064f72a415d42839d27e77c4526edb3b466840f11359e404a6e28043
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcka62c+8+dRN1Gw:9cm4FmowdHoSZ6lCX9
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2976-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-34-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2628-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-75-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2548-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1892-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1084-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-437-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2492-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-671-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-787-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1896-817-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-968-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1564-1019-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1328-1032-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1860-1307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/908-1396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3048 bbtbnn.exe 2808 dvppj.exe 2708 ddvjv.exe 2628 7rxxfrl.exe 2524 dpvdv.exe 2816 rfrrlff.exe 2564 bbtbbb.exe 2548 vpdpd.exe 3056 3lrlllx.exe 1632 tnhnth.exe 2840 jjvdp.exe 2696 7dpjv.exe 3024 3rlrflr.exe 1808 bthbbn.exe 1892 jjddp.exe 1084 fflxxlx.exe 2504 rlfrxfr.exe 372 ntnnhb.exe 1340 pjpvd.exe 2100 llrrflx.exe 1964 tnhhnt.exe 2940 bnttth.exe 2148 3rrflrx.exe 604 rrlrrfx.exe 2996 nnbhbb.exe 1768 tbhnhb.exe 1360 lfxrxlx.exe 1776 xxxllrr.exe 900 pdjdj.exe 2324 5pddj.exe 1748 frfxflx.exe 880 btthtt.exe 1736 jjdjv.exe 1880 jjddp.exe 2976 7flxllx.exe 2176 lxflxxr.exe 2072 hbthtb.exe 2344 7thbhn.exe 2668 dpdvv.exe 2644 ppjvp.exe 2804 lflrflr.exe 2680 3bhbtb.exe 2540 1hbhnb.exe 1676 vdjdv.exe 2536 7xrrflr.exe 2196 rlrffrf.exe 2532 7bbhht.exe 1136 tnhtth.exe 2856 jjjvj.exe 2852 5pjjp.exe 2900 lxlrxfr.exe 1620 bnhnbh.exe 3024 tnbhbt.exe 1724 7dvpv.exe 2328 9pjvd.exe 1608 xrrlxff.exe 1084 lfffxfl.exe 2492 btbhtn.exe 1500 jvddj.exe 1752 dvdjp.exe 1340 fxflrfl.exe 2896 fxfflxf.exe 2944 nhhbbb.exe 2112 1dvjj.exe -
resource yara_rule behavioral1/memory/2976-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b00000001228a-8.dat upx behavioral1/memory/3048-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00360000000132f2-19.dat upx behavioral1/memory/3048-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000013457-30.dat upx behavioral1/memory/2808-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-34-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/files/0x00090000000134f5-39.dat upx behavioral1/memory/2628-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000013a15-47.dat upx behavioral1/memory/2628-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000013a65-58.dat upx behavioral1/memory/2524-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000013a85-65.dat upx behavioral1/memory/2816-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001451d-74.dat upx behavioral1/memory/2564-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2548-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014525-83.dat upx behavioral1/files/0x00060000000145c9-92.dat upx behavioral1/files/0x00060000000145d4-101.dat upx behavioral1/memory/1632-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000146a7-108.dat upx behavioral1/memory/2840-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014730-117.dat upx behavioral1/files/0x000600000001474b-126.dat upx behavioral1/files/0x000600000001475f-133.dat upx behavioral1/memory/1808-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000148af-141.dat upx behavioral1/memory/1892-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014a29-150.dat upx behavioral1/memory/1084-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014c0b-160.dat upx behavioral1/files/0x0006000000014d0f-169.dat upx behavioral1/memory/1340-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014fac-178.dat upx behavioral1/memory/1340-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2100-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015077-186.dat upx behavioral1/memory/1964-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000150aa-197.dat upx behavioral1/files/0x000600000001523e-206.dat upx behavioral1/memory/2940-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2148-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001543a-215.dat upx behavioral1/memory/604-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155e8-223.dat upx behavioral1/files/0x0006000000015a15-233.dat upx behavioral1/files/0x0036000000013362-240.dat upx behavioral1/files/0x0006000000015b37-248.dat upx behavioral1/files/0x0006000000015b72-257.dat upx behavioral1/files/0x0006000000015bb5-265.dat upx behavioral1/files/0x0006000000015c91-273.dat upx behavioral1/memory/1748-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c9b-282.dat upx behavioral1/memory/2976-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2176-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2176-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2344-329-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-336-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2976 wrote to memory of 3048 2976 2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe 28 PID 2976 wrote to memory of 3048 2976 2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe 28 PID 2976 wrote to memory of 3048 2976 2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe 28 PID 2976 wrote to memory of 3048 2976 2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe 28 PID 3048 wrote to memory of 2808 3048 bbtbnn.exe 29 PID 3048 wrote to memory of 2808 3048 bbtbnn.exe 29 PID 3048 wrote to memory of 2808 3048 bbtbnn.exe 29 PID 3048 wrote to memory of 2808 3048 bbtbnn.exe 29 PID 2808 wrote to memory of 2708 2808 dvppj.exe 30 PID 2808 wrote to memory of 2708 2808 dvppj.exe 30 PID 2808 wrote to memory of 2708 2808 dvppj.exe 30 PID 2808 wrote to memory of 2708 2808 dvppj.exe 30 PID 2708 wrote to memory of 2628 2708 ddvjv.exe 31 PID 2708 wrote to memory of 2628 2708 ddvjv.exe 31 PID 2708 wrote to memory of 2628 2708 ddvjv.exe 31 PID 2708 wrote to memory of 2628 2708 ddvjv.exe 31 PID 2628 wrote to memory of 2524 2628 7rxxfrl.exe 32 PID 2628 wrote to memory of 2524 2628 7rxxfrl.exe 32 PID 2628 wrote to memory of 2524 2628 7rxxfrl.exe 32 PID 2628 wrote to memory of 2524 2628 7rxxfrl.exe 32 PID 2524 wrote to memory of 2816 2524 dpvdv.exe 33 PID 2524 wrote to memory of 2816 2524 dpvdv.exe 33 PID 2524 wrote to memory of 2816 2524 dpvdv.exe 33 PID 2524 wrote to memory of 2816 2524 dpvdv.exe 33 PID 2816 wrote to memory of 2564 2816 rfrrlff.exe 34 PID 2816 wrote to memory of 2564 2816 rfrrlff.exe 34 PID 2816 wrote to memory of 2564 2816 rfrrlff.exe 34 PID 2816 wrote to memory of 2564 2816 rfrrlff.exe 34 PID 2564 wrote to memory of 2548 2564 bbtbbb.exe 35 PID 2564 wrote to memory of 2548 2564 bbtbbb.exe 35 PID 2564 wrote to memory of 2548 2564 bbtbbb.exe 35 PID 2564 wrote to memory of 2548 2564 bbtbbb.exe 35 PID 2548 wrote to memory of 3056 2548 vpdpd.exe 36 PID 2548 wrote to memory of 3056 2548 vpdpd.exe 36 PID 2548 wrote to memory of 3056 2548 vpdpd.exe 36 PID 2548 wrote to memory of 3056 2548 vpdpd.exe 36 PID 3056 wrote to memory of 1632 3056 3lrlllx.exe 37 PID 3056 wrote to memory of 1632 3056 3lrlllx.exe 37 PID 3056 wrote to memory of 1632 3056 3lrlllx.exe 37 PID 3056 wrote to memory of 1632 3056 3lrlllx.exe 37 PID 1632 wrote to memory of 2840 1632 tnhnth.exe 38 PID 1632 wrote to memory of 2840 1632 tnhnth.exe 38 PID 1632 wrote to memory of 2840 1632 tnhnth.exe 38 PID 1632 wrote to memory of 2840 1632 tnhnth.exe 38 PID 2840 wrote to memory of 2696 2840 jjvdp.exe 39 PID 2840 wrote to memory of 2696 2840 jjvdp.exe 39 PID 2840 wrote to memory of 2696 2840 jjvdp.exe 39 PID 2840 wrote to memory of 2696 2840 jjvdp.exe 39 PID 2696 wrote to memory of 3024 2696 7dpjv.exe 40 PID 2696 wrote to memory of 3024 2696 7dpjv.exe 40 PID 2696 wrote to memory of 3024 2696 7dpjv.exe 40 PID 2696 wrote to memory of 3024 2696 7dpjv.exe 40 PID 3024 wrote to memory of 1808 3024 3rlrflr.exe 41 PID 3024 wrote to memory of 1808 3024 3rlrflr.exe 41 PID 3024 wrote to memory of 1808 3024 3rlrflr.exe 41 PID 3024 wrote to memory of 1808 3024 3rlrflr.exe 41 PID 1808 wrote to memory of 1892 1808 bthbbn.exe 42 PID 1808 wrote to memory of 1892 1808 bthbbn.exe 42 PID 1808 wrote to memory of 1892 1808 bthbbn.exe 42 PID 1808 wrote to memory of 1892 1808 bthbbn.exe 42 PID 1892 wrote to memory of 1084 1892 jjddp.exe 43 PID 1892 wrote to memory of 1084 1892 jjddp.exe 43 PID 1892 wrote to memory of 1084 1892 jjddp.exe 43 PID 1892 wrote to memory of 1084 1892 jjddp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\bbtbnn.exec:\bbtbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\dvppj.exec:\dvppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\ddvjv.exec:\ddvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\7rxxfrl.exec:\7rxxfrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\dpvdv.exec:\dpvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\rfrrlff.exec:\rfrrlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\bbtbbb.exec:\bbtbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\vpdpd.exec:\vpdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\3lrlllx.exec:\3lrlllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\tnhnth.exec:\tnhnth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\jjvdp.exec:\jjvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\7dpjv.exec:\7dpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3rlrflr.exec:\3rlrflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\bthbbn.exec:\bthbbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\jjddp.exec:\jjddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\fflxxlx.exec:\fflxxlx.exe17⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rlfrxfr.exec:\rlfrxfr.exe18⤵
- Executes dropped EXE
PID:2504 -
\??\c:\ntnnhb.exec:\ntnnhb.exe19⤵
- Executes dropped EXE
PID:372 -
\??\c:\pjpvd.exec:\pjpvd.exe20⤵
- Executes dropped EXE
PID:1340 -
\??\c:\llrrflx.exec:\llrrflx.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tnhhnt.exec:\tnhhnt.exe22⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bnttth.exec:\bnttth.exe23⤵
- Executes dropped EXE
PID:2940 -
\??\c:\3rrflrx.exec:\3rrflrx.exe24⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rrlrrfx.exec:\rrlrrfx.exe25⤵
- Executes dropped EXE
PID:604 -
\??\c:\nnbhbb.exec:\nnbhbb.exe26⤵
- Executes dropped EXE
PID:2996 -
\??\c:\tbhnhb.exec:\tbhnhb.exe27⤵
- Executes dropped EXE
PID:1768 -
\??\c:\lfxrxlx.exec:\lfxrxlx.exe28⤵
- Executes dropped EXE
PID:1360 -
\??\c:\xxxllrr.exec:\xxxllrr.exe29⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pdjdj.exec:\pdjdj.exe30⤵
- Executes dropped EXE
PID:900 -
\??\c:\5pddj.exec:\5pddj.exe31⤵
- Executes dropped EXE
PID:2324 -
\??\c:\frfxflx.exec:\frfxflx.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\btthtt.exec:\btthtt.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\jjdjv.exec:\jjdjv.exe34⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jjddp.exec:\jjddp.exe35⤵
- Executes dropped EXE
PID:1880 -
\??\c:\7flxllx.exec:\7flxllx.exe36⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lxflxxr.exec:\lxflxxr.exe37⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hbthtb.exec:\hbthtb.exe38⤵
- Executes dropped EXE
PID:2072 -
\??\c:\7thbhn.exec:\7thbhn.exe39⤵
- Executes dropped EXE
PID:2344 -
\??\c:\dpdvv.exec:\dpdvv.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ppjvp.exec:\ppjvp.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\lflrflr.exec:\lflrflr.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3bhbtb.exec:\3bhbtb.exe43⤵
- Executes dropped EXE
PID:2680 -
\??\c:\1hbhnb.exec:\1hbhnb.exe44⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vdjdv.exec:\vdjdv.exe45⤵
- Executes dropped EXE
PID:1676 -
\??\c:\7xrrflr.exec:\7xrrflr.exe46⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rlrffrf.exec:\rlrffrf.exe47⤵
- Executes dropped EXE
PID:2196 -
\??\c:\7bbhht.exec:\7bbhht.exe48⤵
- Executes dropped EXE
PID:2532 -
\??\c:\tnhtth.exec:\tnhtth.exe49⤵
- Executes dropped EXE
PID:1136 -
\??\c:\jjjvj.exec:\jjjvj.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5pjjp.exec:\5pjjp.exe51⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lxlrxfr.exec:\lxlrxfr.exe52⤵
- Executes dropped EXE
PID:2900 -
\??\c:\bnhnbh.exec:\bnhnbh.exe53⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tnbhbt.exec:\tnbhbt.exe54⤵
- Executes dropped EXE
PID:3024 -
\??\c:\7dvpv.exec:\7dvpv.exe55⤵
- Executes dropped EXE
PID:1724 -
\??\c:\9pjvd.exec:\9pjvd.exe56⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xrrlxff.exec:\xrrlxff.exe57⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lfffxfl.exec:\lfffxfl.exe58⤵
- Executes dropped EXE
PID:1084 -
\??\c:\btbhtn.exec:\btbhtn.exe59⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jvddj.exec:\jvddj.exe60⤵
- Executes dropped EXE
PID:1500 -
\??\c:\dvdjp.exec:\dvdjp.exe61⤵
- Executes dropped EXE
PID:1752 -
\??\c:\fxflrfl.exec:\fxflrfl.exe62⤵
- Executes dropped EXE
PID:1340 -
\??\c:\fxfflxf.exec:\fxfflxf.exe63⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nhhbbb.exec:\nhhbbb.exe64⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1dvjj.exec:\1dvjj.exe65⤵
- Executes dropped EXE
PID:2112 -
\??\c:\7dvdj.exec:\7dvdj.exe66⤵PID:692
-
\??\c:\fxllffr.exec:\fxllffr.exe67⤵PID:1028
-
\??\c:\lfxfllf.exec:\lfxfllf.exe68⤵PID:2992
-
\??\c:\nhtbbt.exec:\nhtbbt.exe69⤵PID:780
-
\??\c:\jdpdj.exec:\jdpdj.exe70⤵PID:1760
-
\??\c:\1pjpp.exec:\1pjpp.exe71⤵PID:1356
-
\??\c:\rrlfrxl.exec:\rrlfrxl.exe72⤵PID:1140
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe73⤵PID:548
-
\??\c:\5hhnhb.exec:\5hhnhb.exe74⤵PID:1616
-
\??\c:\nbhnbh.exec:\nbhnbh.exe75⤵PID:3068
-
\??\c:\pvjjp.exec:\pvjjp.exe76⤵PID:1972
-
\??\c:\1vjvj.exec:\1vjvj.exe77⤵PID:2392
-
\??\c:\lfflrll.exec:\lfflrll.exe78⤵PID:2956
-
\??\c:\btbbhh.exec:\btbbhh.exe79⤵PID:1848
-
\??\c:\tttbnn.exec:\tttbnn.exe80⤵PID:3032
-
\??\c:\pvvdj.exec:\pvvdj.exe81⤵PID:1688
-
\??\c:\ddppp.exec:\ddppp.exe82⤵PID:2480
-
\??\c:\jdvpv.exec:\jdvpv.exe83⤵PID:1664
-
\??\c:\rfrxfxf.exec:\rfrxfxf.exe84⤵PID:2228
-
\??\c:\tbbbhh.exec:\tbbbhh.exe85⤵PID:2712
-
\??\c:\nbtthn.exec:\nbtthn.exe86⤵PID:2668
-
\??\c:\7vvvj.exec:\7vvvj.exe87⤵PID:2728
-
\??\c:\lfxrrxl.exec:\lfxrrxl.exe88⤵PID:840
-
\??\c:\xrrfrrf.exec:\xrrfrrf.exe89⤵PID:2552
-
\??\c:\7bbntb.exec:\7bbntb.exe90⤵PID:3052
-
\??\c:\tbnhht.exec:\tbnhht.exe91⤵PID:2580
-
\??\c:\jdjdj.exec:\jdjdj.exe92⤵PID:2592
-
\??\c:\1jjdj.exec:\1jjdj.exe93⤵PID:1252
-
\??\c:\lfxxlff.exec:\lfxxlff.exe94⤵PID:3056
-
\??\c:\5frrxxl.exec:\5frrxxl.exe95⤵PID:2832
-
\??\c:\hthnhn.exec:\hthnhn.exe96⤵PID:2868
-
\??\c:\pjpvd.exec:\pjpvd.exe97⤵PID:2904
-
\??\c:\pjddv.exec:\pjddv.exe98⤵PID:2696
-
\??\c:\lfrxllx.exec:\lfrxllx.exe99⤵PID:1644
-
\??\c:\xrllrxf.exec:\xrllrxf.exe100⤵PID:1156
-
\??\c:\nhbhnn.exec:\nhbhnn.exe101⤵PID:2332
-
\??\c:\hbhtnb.exec:\hbhtnb.exe102⤵PID:1600
-
\??\c:\vpjvd.exec:\vpjvd.exe103⤵PID:1508
-
\??\c:\pjvpv.exec:\pjvpv.exe104⤵PID:756
-
\??\c:\xrlxfrx.exec:\xrlxfrx.exe105⤵PID:1416
-
\??\c:\fxfflfr.exec:\fxfflfr.exe106⤵PID:836
-
\??\c:\9tthnt.exec:\9tthnt.exe107⤵PID:2248
-
\??\c:\thtntt.exec:\thtntt.exe108⤵PID:2108
-
\??\c:\vvjvj.exec:\vvjvj.exe109⤵PID:2052
-
\??\c:\xxxrlrf.exec:\xxxrlrf.exe110⤵PID:1268
-
\??\c:\ffflrxx.exec:\ffflrxx.exe111⤵PID:2356
-
\??\c:\hbttht.exec:\hbttht.exe112⤵PID:2112
-
\??\c:\vppjd.exec:\vppjd.exe113⤵PID:2148
-
\??\c:\pjdjv.exec:\pjdjv.exe114⤵PID:580
-
\??\c:\xrffrrx.exec:\xrffrrx.exe115⤵PID:1824
-
\??\c:\5hbthh.exec:\5hbthh.exe116⤵PID:1780
-
\??\c:\hbbnhh.exec:\hbbnhh.exe117⤵PID:1896
-
\??\c:\3dppv.exec:\3dppv.exe118⤵PID:1032
-
\??\c:\vpjvd.exec:\vpjvd.exe119⤵PID:1300
-
\??\c:\xrxrffl.exec:\xrxrffl.exe120⤵PID:2144
-
\??\c:\7xxlrxf.exec:\7xxlrxf.exe121⤵PID:1704
-
\??\c:\bntntt.exec:\bntntt.exe122⤵PID:2928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-