Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 13:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe
-
Size
180KB
-
MD5
b9d4929fbc98678f0c37d4096538e0b0
-
SHA1
3e7337fcc431611399e71c21d250f72ac6d9b4fb
-
SHA256
b552788a98c2fef1e6ad5c505bd2c5a0225be330b1fa0bbbf88ff50baee00831
-
SHA512
715a38db6278cf67585aed000cecbb3677573c7f8da8a7ed72a0a0c57942c5c495429b16c1840f38898aa13ca7fd2d50d452fb3d5d9837f14ae66fcd71f5fd55
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJPhbMB:PhOm2sI93UufdC67ciJTm5hIB
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2400-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2276-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-71-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/792-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/748-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/340-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1400-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1388-227-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1728-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-305-0x0000000077940000-0x0000000077A5F000-memory.dmp family_blackmoon behavioral1/memory/2276-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-354-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-423-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1692-428-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-454-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-518-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-517-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/564-1025-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1112-1140-0x00000000005C0000-0x00000000005E9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3052 lfxxlrf.exe 2276 nhtbhh.exe 2668 bbthtt.exe 2584 rlfrffr.exe 2732 9vpvj.exe 2456 flrllxx.exe 2476 xxrfrxl.exe 2448 nnhhbh.exe 2892 ddpjd.exe 792 ddvpd.exe 1552 lrrxfrr.exe 2500 thhnnb.exe 748 3pdjv.exe 1888 lllxllx.exe 340 nhtnhh.exe 1876 pjvpv.exe 532 xffrrrf.exe 1400 nhntbb.exe 1196 pjppp.exe 1440 fxrrfrx.exe 1628 nhbntt.exe 2184 7vjjp.exe 2996 lllxrrl.exe 1388 5dvdd.exe 1728 vpdpd.exe 1452 thttbb.exe 2872 7jjjv.exe 888 3rllrfl.exe 676 ttnbnt.exe 1980 9jdpp.exe 2908 ffrxlrl.exe 1416 bbtbtt.exe 1124 5jddp.exe 840 rrfrllx.exe 2276 fxrxllf.exe 1480 1bbtnb.exe 2708 pjvdj.exe 2676 5pjjp.exe 2564 frxrlxr.exe 2548 hbttbb.exe 2452 ddvjv.exe 2604 flfxrrl.exe 2484 rrflflf.exe 2328 tbbhbt.exe 2900 7dvvj.exe 1488 dvdjj.exe 1688 rlxlrfl.exe 2488 bhnhhb.exe 2684 ddvdp.exe 2652 jjdvd.exe 1692 lllflxl.exe 1888 rlxfrrx.exe 1716 nbnnbh.exe 1880 bbthnt.exe 760 jdddp.exe 580 xrrrfrx.exe 1400 nnbnbn.exe 1428 hbhbnn.exe 832 ddjvj.exe 1304 vpjpv.exe 3064 lffflrf.exe 828 lxrxrrx.exe 2220 hhbnth.exe 1384 hhbnbh.exe -
resource yara_rule behavioral1/memory/2400-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/340-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1400-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1196-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2276-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-423-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1888-429-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-454-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-485-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-510-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-518-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-549-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-596-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-603-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-628-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-653-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-721-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-728-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-735-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-793-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-844-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-875-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-882-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-923-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-960-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-973-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-988-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-1038-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-1058-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/284-1089-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-1102-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 3052 2400 b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe 28 PID 2400 wrote to memory of 3052 2400 b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe 28 PID 2400 wrote to memory of 3052 2400 b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe 28 PID 2400 wrote to memory of 3052 2400 b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe 28 PID 3052 wrote to memory of 2276 3052 lfxxlrf.exe 29 PID 3052 wrote to memory of 2276 3052 lfxxlrf.exe 29 PID 3052 wrote to memory of 2276 3052 lfxxlrf.exe 29 PID 3052 wrote to memory of 2276 3052 lfxxlrf.exe 29 PID 2276 wrote to memory of 2668 2276 nhtbhh.exe 30 PID 2276 wrote to memory of 2668 2276 nhtbhh.exe 30 PID 2276 wrote to memory of 2668 2276 nhtbhh.exe 30 PID 2276 wrote to memory of 2668 2276 nhtbhh.exe 30 PID 2668 wrote to memory of 2584 2668 bbthtt.exe 31 PID 2668 wrote to memory of 2584 2668 bbthtt.exe 31 PID 2668 wrote to memory of 2584 2668 bbthtt.exe 31 PID 2668 wrote to memory of 2584 2668 bbthtt.exe 31 PID 2584 wrote to memory of 2732 2584 rlfrffr.exe 32 PID 2584 wrote to memory of 2732 2584 rlfrffr.exe 32 PID 2584 wrote to memory of 2732 2584 rlfrffr.exe 32 PID 2584 wrote to memory of 2732 2584 rlfrffr.exe 32 PID 2732 wrote to memory of 2456 2732 9vpvj.exe 33 PID 2732 wrote to memory of 2456 2732 9vpvj.exe 33 PID 2732 wrote to memory of 2456 2732 9vpvj.exe 33 PID 2732 wrote to memory of 2456 2732 9vpvj.exe 33 PID 2456 wrote to memory of 2476 2456 flrllxx.exe 34 PID 2456 wrote to memory of 2476 2456 flrllxx.exe 34 PID 2456 wrote to memory of 2476 2456 flrllxx.exe 34 PID 2456 wrote to memory of 2476 2456 flrllxx.exe 34 PID 2476 wrote to memory of 2448 2476 xxrfrxl.exe 35 PID 2476 wrote to memory of 2448 2476 xxrfrxl.exe 35 PID 2476 wrote to memory of 2448 2476 xxrfrxl.exe 35 PID 2476 wrote to memory of 2448 2476 xxrfrxl.exe 35 PID 2448 wrote to memory of 2892 2448 nnhhbh.exe 36 PID 2448 wrote to memory of 2892 2448 nnhhbh.exe 36 PID 2448 wrote to memory of 2892 2448 nnhhbh.exe 36 PID 2448 wrote to memory of 2892 2448 nnhhbh.exe 36 PID 2892 wrote to memory of 792 2892 ddpjd.exe 37 PID 2892 wrote to memory of 792 2892 ddpjd.exe 37 PID 2892 wrote to memory of 792 2892 ddpjd.exe 37 PID 2892 wrote to memory of 792 2892 ddpjd.exe 37 PID 792 wrote to memory of 1552 792 ddvpd.exe 38 PID 792 wrote to memory of 1552 792 ddvpd.exe 38 PID 792 wrote to memory of 1552 792 ddvpd.exe 38 PID 792 wrote to memory of 1552 792 ddvpd.exe 38 PID 1552 wrote to memory of 2500 1552 lrrxfrr.exe 39 PID 1552 wrote to memory of 2500 1552 lrrxfrr.exe 39 PID 1552 wrote to memory of 2500 1552 lrrxfrr.exe 39 PID 1552 wrote to memory of 2500 1552 lrrxfrr.exe 39 PID 2500 wrote to memory of 748 2500 thhnnb.exe 40 PID 2500 wrote to memory of 748 2500 thhnnb.exe 40 PID 2500 wrote to memory of 748 2500 thhnnb.exe 40 PID 2500 wrote to memory of 748 2500 thhnnb.exe 40 PID 748 wrote to memory of 1888 748 3pdjv.exe 41 PID 748 wrote to memory of 1888 748 3pdjv.exe 41 PID 748 wrote to memory of 1888 748 3pdjv.exe 41 PID 748 wrote to memory of 1888 748 3pdjv.exe 41 PID 1888 wrote to memory of 340 1888 lllxllx.exe 42 PID 1888 wrote to memory of 340 1888 lllxllx.exe 42 PID 1888 wrote to memory of 340 1888 lllxllx.exe 42 PID 1888 wrote to memory of 340 1888 lllxllx.exe 42 PID 340 wrote to memory of 1876 340 nhtnhh.exe 43 PID 340 wrote to memory of 1876 340 nhtnhh.exe 43 PID 340 wrote to memory of 1876 340 nhtnhh.exe 43 PID 340 wrote to memory of 1876 340 nhtnhh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b9d4929fbc98678f0c37d4096538e0b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\nhtbhh.exec:\nhtbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\bbthtt.exec:\bbthtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rlfrffr.exec:\rlfrffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\9vpvj.exec:\9vpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\flrllxx.exec:\flrllxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\nnhhbh.exec:\nnhhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\ddpjd.exec:\ddpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\ddvpd.exec:\ddvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\lrrxfrr.exec:\lrrxfrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\thhnnb.exec:\thhnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\3pdjv.exec:\3pdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\lllxllx.exec:\lllxllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\nhtnhh.exec:\nhtnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\pjvpv.exec:\pjvpv.exe17⤵
- Executes dropped EXE
PID:1876 -
\??\c:\xffrrrf.exec:\xffrrrf.exe18⤵
- Executes dropped EXE
PID:532 -
\??\c:\nhntbb.exec:\nhntbb.exe19⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pjppp.exec:\pjppp.exe20⤵
- Executes dropped EXE
PID:1196 -
\??\c:\fxrrfrx.exec:\fxrrfrx.exe21⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nhbntt.exec:\nhbntt.exe22⤵
- Executes dropped EXE
PID:1628 -
\??\c:\7vjjp.exec:\7vjjp.exe23⤵
- Executes dropped EXE
PID:2184 -
\??\c:\lllxrrl.exec:\lllxrrl.exe24⤵
- Executes dropped EXE
PID:2996 -
\??\c:\5dvdd.exec:\5dvdd.exe25⤵
- Executes dropped EXE
PID:1388 -
\??\c:\vpdpd.exec:\vpdpd.exe26⤵
- Executes dropped EXE
PID:1728 -
\??\c:\thttbb.exec:\thttbb.exe27⤵
- Executes dropped EXE
PID:1452 -
\??\c:\7jjjv.exec:\7jjjv.exe28⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3rllrfl.exec:\3rllrfl.exe29⤵
- Executes dropped EXE
PID:888 -
\??\c:\ttnbnt.exec:\ttnbnt.exe30⤵
- Executes dropped EXE
PID:676 -
\??\c:\9jdpp.exec:\9jdpp.exe31⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ffrxlrl.exec:\ffrxlrl.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bbtbtt.exec:\bbtbtt.exe33⤵
- Executes dropped EXE
PID:1416 -
\??\c:\5jddp.exec:\5jddp.exe34⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rrfrllx.exec:\rrfrllx.exe35⤵
- Executes dropped EXE
PID:840 -
\??\c:\tnhnbt.exec:\tnhnbt.exe36⤵PID:2740
-
\??\c:\fxrxllf.exec:\fxrxllf.exe37⤵
- Executes dropped EXE
PID:2276 -
\??\c:\1bbtnb.exec:\1bbtnb.exe38⤵
- Executes dropped EXE
PID:1480 -
\??\c:\pjvdj.exec:\pjvdj.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5pjjp.exec:\5pjjp.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\frxrlxr.exec:\frxrlxr.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hbttbb.exec:\hbttbb.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ddvjv.exec:\ddvjv.exe43⤵
- Executes dropped EXE
PID:2452 -
\??\c:\flfxrrl.exec:\flfxrrl.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rrflflf.exec:\rrflflf.exe45⤵
- Executes dropped EXE
PID:2484 -
\??\c:\tbbhbt.exec:\tbbhbt.exe46⤵
- Executes dropped EXE
PID:2328 -
\??\c:\7dvvj.exec:\7dvvj.exe47⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dvdjj.exec:\dvdjj.exe48⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rlxlrfl.exec:\rlxlrfl.exe49⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bhnhhb.exec:\bhnhhb.exe50⤵
- Executes dropped EXE
PID:2488 -
\??\c:\ddvdp.exec:\ddvdp.exe51⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jjdvd.exec:\jjdvd.exe52⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lllflxl.exec:\lllflxl.exe53⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe54⤵
- Executes dropped EXE
PID:1888 -
\??\c:\nbnnbh.exec:\nbnnbh.exe55⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bbthnt.exec:\bbthnt.exe56⤵
- Executes dropped EXE
PID:1880 -
\??\c:\jdddp.exec:\jdddp.exe57⤵
- Executes dropped EXE
PID:760 -
\??\c:\xrrrfrx.exec:\xrrrfrx.exe58⤵
- Executes dropped EXE
PID:580 -
\??\c:\nnbnbn.exec:\nnbnbn.exe59⤵
- Executes dropped EXE
PID:1400 -
\??\c:\hbhbnn.exec:\hbhbnn.exe60⤵
- Executes dropped EXE
PID:1428 -
\??\c:\ddjvj.exec:\ddjvj.exe61⤵
- Executes dropped EXE
PID:832 -
\??\c:\vpjpv.exec:\vpjpv.exe62⤵
- Executes dropped EXE
PID:1304 -
\??\c:\lffflrf.exec:\lffflrf.exe63⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lxrxrrx.exec:\lxrxrrx.exe64⤵
- Executes dropped EXE
PID:828 -
\??\c:\hhbnth.exec:\hhbnth.exe65⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hhbnbh.exec:\hhbnbh.exe66⤵
- Executes dropped EXE
PID:1384 -
\??\c:\vvjjj.exec:\vvjjj.exe67⤵PID:2948
-
\??\c:\lllrxfr.exec:\lllrxfr.exe68⤵PID:344
-
\??\c:\nhbhbb.exec:\nhbhbb.exe69⤵PID:1728
-
\??\c:\tbtntn.exec:\tbtntn.exe70⤵PID:764
-
\??\c:\djppv.exec:\djppv.exe71⤵PID:1900
-
\??\c:\pjddv.exec:\pjddv.exe72⤵PID:2832
-
\??\c:\rrlxrxr.exec:\rrlxrxr.exe73⤵PID:888
-
\??\c:\nbntbh.exec:\nbntbh.exe74⤵PID:2052
-
\??\c:\tnbnbt.exec:\tnbnbt.exe75⤵PID:3016
-
\??\c:\jjvdp.exec:\jjvdp.exe76⤵PID:2860
-
\??\c:\ddpdd.exec:\ddpdd.exe77⤵PID:2848
-
\??\c:\llrxxlf.exec:\llrxxlf.exe78⤵PID:1720
-
\??\c:\hhbhth.exec:\hhbhth.exe79⤵PID:2060
-
\??\c:\tnhnnn.exec:\tnhnnn.exe80⤵PID:840
-
\??\c:\5pjjp.exec:\5pjjp.exe81⤵PID:2560
-
\??\c:\jdjvp.exec:\jdjvp.exe82⤵PID:1528
-
\??\c:\9lflrxf.exec:\9lflrxf.exe83⤵PID:2660
-
\??\c:\rlffrrx.exec:\rlffrrx.exe84⤵PID:2540
-
\??\c:\tbtbth.exec:\tbtbth.exe85⤵PID:2960
-
\??\c:\jjdjp.exec:\jjdjp.exe86⤵PID:2728
-
\??\c:\jvpvp.exec:\jvpvp.exe87⤵PID:2324
-
\??\c:\lffflrx.exec:\lffflrx.exe88⤵PID:2928
-
\??\c:\5lllrrx.exec:\5lllrrx.exe89⤵PID:2428
-
\??\c:\tnnbbh.exec:\tnnbbh.exe90⤵PID:2504
-
\??\c:\9bhnnt.exec:\9bhnnt.exe91⤵PID:2888
-
\??\c:\vvpdv.exec:\vvpdv.exe92⤵PID:2448
-
\??\c:\jpvjj.exec:\jpvjj.exe93⤵PID:2148
-
\??\c:\1lrrfrf.exec:\1lrrfrf.exe94⤵PID:1556
-
\??\c:\tbthht.exec:\tbthht.exe95⤵PID:2532
-
\??\c:\9bbnbt.exec:\9bbnbt.exe96⤵PID:1472
-
\??\c:\btnthh.exec:\btnthh.exe97⤵PID:2684
-
\??\c:\5ppdv.exec:\5ppdv.exe98⤵PID:2652
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe99⤵PID:1708
-
\??\c:\fffxlrf.exec:\fffxlrf.exe100⤵PID:372
-
\??\c:\hhnthn.exec:\hhnthn.exe101⤵PID:1696
-
\??\c:\3hbnbn.exec:\3hbnbn.exe102⤵PID:264
-
\??\c:\7vpdd.exec:\7vpdd.exe103⤵PID:532
-
\??\c:\rrrffrr.exec:\rrrffrr.exe104⤵PID:1852
-
\??\c:\llxlxxl.exec:\llxlxxl.exe105⤵PID:1400
-
\??\c:\nnbbht.exec:\nnbbht.exe106⤵PID:2744
-
\??\c:\vppvv.exec:\vppvv.exe107⤵PID:832
-
\??\c:\vdpjv.exec:\vdpjv.exe108⤵PID:1440
-
\??\c:\5frrxxf.exec:\5frrxxf.exe109⤵PID:2208
-
\??\c:\1xxlfrr.exec:\1xxlfrr.exe110⤵PID:2528
-
\??\c:\nhhtbh.exec:\nhhtbh.exe111⤵PID:2204
-
\??\c:\hhbhbh.exec:\hhbhbh.exe112⤵PID:932
-
\??\c:\vpjvd.exec:\vpjvd.exe113⤵PID:1208
-
\??\c:\9xrrrrr.exec:\9xrrrrr.exe114⤵PID:1284
-
\??\c:\xrfrrrl.exec:\xrfrrrl.exe115⤵PID:1728
-
\??\c:\tntttt.exec:\tntttt.exe116⤵PID:1736
-
\??\c:\vvjpp.exec:\vvjpp.exe117⤵PID:300
-
\??\c:\djdpd.exec:\djdpd.exe118⤵PID:1512
-
\??\c:\fxxrxlx.exec:\fxxrxlx.exe119⤵PID:1844
-
\??\c:\1lfxllx.exec:\1lfxllx.exe120⤵PID:2180
-
\??\c:\tthhtb.exec:\tthhtb.exe121⤵PID:2164
-
\??\c:\jjdpj.exec:\jjdpj.exe122⤵PID:980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-