Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 18:54
Behavioral task
behavioral1
Sample
17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe
-
Size
453KB
-
MD5
17e05df9d9ee584cfea2c3cfdef02020
-
SHA1
3a966810076f4d28a0f79bda51672545cb755633
-
SHA256
bc483cb6e41a05ad89bcdd351126161cb4ae8822544e2bddcb04fe2344c5423b
-
SHA512
f9bafcdf900389260dcb87dad7ace8cd2c174f8d988ce87dcb9b42bdd9e1456a35a77f0619d50d66542a8abdacfc1356c0fba08d073e12df8bd142dbbd7af859
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNm8:x4wFHoS3eFaKHpv/VycgE81lgx
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2356-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/400-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1364-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1840-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/672-208-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1048-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/112-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/268-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1896-823-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-1009-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-1061-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/636-1087-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1424-1156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 400 bnbhnb.exe 3044 pjddp.exe 2608 fxlrxfx.exe 2860 vvjjj.exe 1656 hhbbnt.exe 2536 rrlflrl.exe 2396 tnthnt.exe 2952 vvvjp.exe 2964 7thbnh.exe 2736 nbtbtb.exe 2488 frxlfxr.exe 2812 ntthbn.exe 2280 pdvvd.exe 1364 xxlrrff.exe 2008 3btnbh.exe 2616 7dppp.exe 272 bthntt.exe 1680 hhtbbh.exe 2984 lxxrlrl.exe 2192 ththnn.exe 1840 vvjvp.exe 672 bnnnbb.exe 1048 5pjjj.exe 2840 lfxlxlx.exe 1696 jpppp.exe 1692 5jvpd.exe 1552 9bttth.exe 1876 frxrffx.exe 1636 ppjpd.exe 2152 9vvvj.exe 2148 hbtnbb.exe 2268 jjjvv.exe 1724 5nnbnh.exe 2128 9dpvj.exe 1516 pvvvv.exe 1496 7rlrxfl.exe 2544 1bnthb.exe 2648 pjvjp.exe 3044 vvvjp.exe 2608 lfxlrfr.exe 2516 hhthnb.exe 2636 jdvpj.exe 2512 9dvpv.exe 2464 frlfrlr.exe 3012 bbthnb.exe 2572 dvpdp.exe 2696 9xllrxl.exe 2716 tttnbt.exe 2728 djdvd.exe 2776 frlrxrx.exe 1976 1nnbnt.exe 1192 9pdjv.exe 112 jdvvj.exe 1540 7xrlxlr.exe 2732 bttbht.exe 2836 vjddd.exe 2028 vpdpd.exe 2080 3xrxlfl.exe 2980 hthhnh.exe 1032 nhtbhn.exe 1340 7jdpd.exe 2232 frxrfff.exe 2184 7hbthn.exe 268 vjppj.exe -
resource yara_rule behavioral1/memory/2356-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000014502-5.dat upx behavioral1/memory/2356-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/400-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00330000000149e1-17.dat upx behavioral1/memory/3044-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014dae-28.dat upx behavioral1/memory/2608-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014eb9-37.dat upx behavioral1/memory/2860-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001502c-45.dat upx behavioral1/memory/1656-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000153c7-55.dat upx behavioral1/memory/2536-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000153d9-63.dat upx behavioral1/memory/2396-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015cd9-74.dat upx behavioral1/memory/2396-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ce3-81.dat upx behavioral1/memory/2952-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cf5-91.dat upx behavioral1/memory/2736-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d0c-101.dat upx behavioral1/memory/2488-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d24-107.dat upx behavioral1/files/0x0006000000015d44-119.dat upx behavioral1/files/0x0006000000015d4c-128.dat upx behavioral1/files/0x0006000000015e09-135.dat upx behavioral1/memory/2008-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1364-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e6d-145.dat upx behavioral1/memory/2616-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015f3c-153.dat upx behavioral1/files/0x0006000000015fa7-163.dat upx behavioral1/files/0x0033000000014b10-170.dat upx behavioral1/memory/1680-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000160cc-179.dat upx behavioral1/memory/2984-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2192-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000161b3-188.dat upx behavioral1/files/0x00060000000162c9-197.dat upx behavioral1/memory/1840-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016476-209.dat upx behavioral1/memory/1048-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001654a-218.dat upx behavioral1/memory/2840-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000165f0-225.dat upx behavioral1/files/0x0006000000016813-237.dat upx behavioral1/memory/1696-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a6f-245.dat upx behavioral1/files/0x0006000000016c1d-254.dat upx behavioral1/files/0x0006000000016c3a-261.dat upx behavioral1/memory/1876-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c42-271.dat upx behavioral1/files/0x0006000000016c8c-279.dat upx behavioral1/memory/2148-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cb2-288.dat upx behavioral1/memory/1516-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-361-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2464-368-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-381-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2572-382-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-407-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 400 2356 17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe 28 PID 2356 wrote to memory of 400 2356 17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe 28 PID 2356 wrote to memory of 400 2356 17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe 28 PID 2356 wrote to memory of 400 2356 17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe 28 PID 400 wrote to memory of 3044 400 bnbhnb.exe 29 PID 400 wrote to memory of 3044 400 bnbhnb.exe 29 PID 400 wrote to memory of 3044 400 bnbhnb.exe 29 PID 400 wrote to memory of 3044 400 bnbhnb.exe 29 PID 3044 wrote to memory of 2608 3044 pjddp.exe 30 PID 3044 wrote to memory of 2608 3044 pjddp.exe 30 PID 3044 wrote to memory of 2608 3044 pjddp.exe 30 PID 3044 wrote to memory of 2608 3044 pjddp.exe 30 PID 2608 wrote to memory of 2860 2608 fxlrxfx.exe 31 PID 2608 wrote to memory of 2860 2608 fxlrxfx.exe 31 PID 2608 wrote to memory of 2860 2608 fxlrxfx.exe 31 PID 2608 wrote to memory of 2860 2608 fxlrxfx.exe 31 PID 2860 wrote to memory of 1656 2860 vvjjj.exe 32 PID 2860 wrote to memory of 1656 2860 vvjjj.exe 32 PID 2860 wrote to memory of 1656 2860 vvjjj.exe 32 PID 2860 wrote to memory of 1656 2860 vvjjj.exe 32 PID 1656 wrote to memory of 2536 1656 hhbbnt.exe 33 PID 1656 wrote to memory of 2536 1656 hhbbnt.exe 33 PID 1656 wrote to memory of 2536 1656 hhbbnt.exe 33 PID 1656 wrote to memory of 2536 1656 hhbbnt.exe 33 PID 2536 wrote to memory of 2396 2536 rrlflrl.exe 34 PID 2536 wrote to memory of 2396 2536 rrlflrl.exe 34 PID 2536 wrote to memory of 2396 2536 rrlflrl.exe 34 PID 2536 wrote to memory of 2396 2536 rrlflrl.exe 34 PID 2396 wrote to memory of 2952 2396 tnthnt.exe 35 PID 2396 wrote to memory of 2952 2396 tnthnt.exe 35 PID 2396 wrote to memory of 2952 2396 tnthnt.exe 35 PID 2396 wrote to memory of 2952 2396 tnthnt.exe 35 PID 2952 wrote to memory of 2964 2952 vvvjp.exe 36 PID 2952 wrote to memory of 2964 2952 vvvjp.exe 36 PID 2952 wrote to memory of 2964 2952 vvvjp.exe 36 PID 2952 wrote to memory of 2964 2952 vvvjp.exe 36 PID 2964 wrote to memory of 2736 2964 7thbnh.exe 37 PID 2964 wrote to memory of 2736 2964 7thbnh.exe 37 PID 2964 wrote to memory of 2736 2964 7thbnh.exe 37 PID 2964 wrote to memory of 2736 2964 7thbnh.exe 37 PID 2736 wrote to memory of 2488 2736 nbtbtb.exe 38 PID 2736 wrote to memory of 2488 2736 nbtbtb.exe 38 PID 2736 wrote to memory of 2488 2736 nbtbtb.exe 38 PID 2736 wrote to memory of 2488 2736 nbtbtb.exe 38 PID 2488 wrote to memory of 2812 2488 frxlfxr.exe 39 PID 2488 wrote to memory of 2812 2488 frxlfxr.exe 39 PID 2488 wrote to memory of 2812 2488 frxlfxr.exe 39 PID 2488 wrote to memory of 2812 2488 frxlfxr.exe 39 PID 2812 wrote to memory of 2280 2812 ntthbn.exe 40 PID 2812 wrote to memory of 2280 2812 ntthbn.exe 40 PID 2812 wrote to memory of 2280 2812 ntthbn.exe 40 PID 2812 wrote to memory of 2280 2812 ntthbn.exe 40 PID 2280 wrote to memory of 1364 2280 pdvvd.exe 41 PID 2280 wrote to memory of 1364 2280 pdvvd.exe 41 PID 2280 wrote to memory of 1364 2280 pdvvd.exe 41 PID 2280 wrote to memory of 1364 2280 pdvvd.exe 41 PID 1364 wrote to memory of 2008 1364 xxlrrff.exe 42 PID 1364 wrote to memory of 2008 1364 xxlrrff.exe 42 PID 1364 wrote to memory of 2008 1364 xxlrrff.exe 42 PID 1364 wrote to memory of 2008 1364 xxlrrff.exe 42 PID 2008 wrote to memory of 2616 2008 3btnbh.exe 43 PID 2008 wrote to memory of 2616 2008 3btnbh.exe 43 PID 2008 wrote to memory of 2616 2008 3btnbh.exe 43 PID 2008 wrote to memory of 2616 2008 3btnbh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\bnbhnb.exec:\bnbhnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\pjddp.exec:\pjddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\fxlrxfx.exec:\fxlrxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\vvjjj.exec:\vvjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\hhbbnt.exec:\hhbbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\rrlflrl.exec:\rrlflrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\tnthnt.exec:\tnthnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\vvvjp.exec:\vvvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\7thbnh.exec:\7thbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\nbtbtb.exec:\nbtbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\frxlfxr.exec:\frxlfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\ntthbn.exec:\ntthbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\pdvvd.exec:\pdvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\xxlrrff.exec:\xxlrrff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\3btnbh.exec:\3btnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\7dppp.exec:\7dppp.exe17⤵
- Executes dropped EXE
PID:2616 -
\??\c:\bthntt.exec:\bthntt.exe18⤵
- Executes dropped EXE
PID:272 -
\??\c:\hhtbbh.exec:\hhtbbh.exe19⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lxxrlrl.exec:\lxxrlrl.exe20⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ththnn.exec:\ththnn.exe21⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vvjvp.exec:\vvjvp.exe22⤵
- Executes dropped EXE
PID:1840 -
\??\c:\bnnnbb.exec:\bnnnbb.exe23⤵
- Executes dropped EXE
PID:672 -
\??\c:\5pjjj.exec:\5pjjj.exe24⤵
- Executes dropped EXE
PID:1048 -
\??\c:\lfxlxlx.exec:\lfxlxlx.exe25⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jpppp.exec:\jpppp.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\5jvpd.exec:\5jvpd.exe27⤵
- Executes dropped EXE
PID:1692 -
\??\c:\9bttth.exec:\9bttth.exe28⤵
- Executes dropped EXE
PID:1552 -
\??\c:\frxrffx.exec:\frxrffx.exe29⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ppjpd.exec:\ppjpd.exe30⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9vvvj.exec:\9vvvj.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hbtnbb.exec:\hbtnbb.exe32⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jjjvv.exec:\jjjvv.exe33⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5nnbnh.exec:\5nnbnh.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\9dpvj.exec:\9dpvj.exe35⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pvvvv.exec:\pvvvv.exe36⤵
- Executes dropped EXE
PID:1516 -
\??\c:\7rlrxfl.exec:\7rlrxfl.exe37⤵
- Executes dropped EXE
PID:1496 -
\??\c:\1bnthb.exec:\1bnthb.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\pjvjp.exec:\pjvjp.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vvvjp.exec:\vvvjp.exe40⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lfxlrfr.exec:\lfxlrfr.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hhthnb.exec:\hhthnb.exe42⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jdvpj.exec:\jdvpj.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\9dvpv.exec:\9dvpv.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\frlfrlr.exec:\frlfrlr.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bbthnb.exec:\bbthnb.exe46⤵
- Executes dropped EXE
PID:3012 -
\??\c:\dvpdp.exec:\dvpdp.exe47⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9xllrxl.exec:\9xllrxl.exe48⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tttnbt.exec:\tttnbt.exe49⤵
- Executes dropped EXE
PID:2716 -
\??\c:\djdvd.exec:\djdvd.exe50⤵
- Executes dropped EXE
PID:2728 -
\??\c:\frlrxrx.exec:\frlrxrx.exe51⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1nnbnt.exec:\1nnbnt.exe52⤵
- Executes dropped EXE
PID:1976 -
\??\c:\9pdjv.exec:\9pdjv.exe53⤵
- Executes dropped EXE
PID:1192 -
\??\c:\jdvvj.exec:\jdvvj.exe54⤵
- Executes dropped EXE
PID:112 -
\??\c:\7xrlxlr.exec:\7xrlxlr.exe55⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bttbht.exec:\bttbht.exe56⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vjddd.exec:\vjddd.exe57⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vpdpd.exec:\vpdpd.exe58⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3xrxlfl.exec:\3xrxlfl.exe59⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hthhnh.exec:\hthhnh.exe60⤵
- Executes dropped EXE
PID:2980 -
\??\c:\nhtbhn.exec:\nhtbhn.exe61⤵
- Executes dropped EXE
PID:1032 -
\??\c:\7jdpd.exec:\7jdpd.exe62⤵
- Executes dropped EXE
PID:1340 -
\??\c:\frxrfff.exec:\frxrfff.exe63⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7hbthn.exec:\7hbthn.exe64⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vjppj.exec:\vjppj.exe65⤵
- Executes dropped EXE
PID:268 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe66⤵PID:1428
-
\??\c:\7lfflxf.exec:\7lfflxf.exe67⤵PID:2272
-
\??\c:\ntthhh.exec:\ntthhh.exe68⤵PID:2840
-
\??\c:\ddpdj.exec:\ddpdj.exe69⤵PID:1924
-
\??\c:\9lffffl.exec:\9lffffl.exe70⤵PID:1212
-
\??\c:\lffrxfl.exec:\lffrxfl.exe71⤵PID:1888
-
\??\c:\1nbhbb.exec:\1nbhbb.exe72⤵PID:2368
-
\??\c:\9dvjv.exec:\9dvjv.exe73⤵PID:888
-
\??\c:\xlxfflx.exec:\xlxfflx.exe74⤵PID:3040
-
\??\c:\xxrrxfx.exec:\xxrrxfx.exe75⤵PID:572
-
\??\c:\nbhbth.exec:\nbhbth.exe76⤵PID:2152
-
\??\c:\dvdjv.exec:\dvdjv.exe77⤵PID:836
-
\??\c:\hbnnnt.exec:\hbnnnt.exe78⤵PID:3032
-
\??\c:\lfxxlrl.exec:\lfxxlrl.exe79⤵PID:2912
-
\??\c:\hhthbn.exec:\hhthbn.exe80⤵PID:1864
-
\??\c:\jjpjp.exec:\jjpjp.exe81⤵PID:2128
-
\??\c:\dddjd.exec:\dddjd.exe82⤵PID:400
-
\??\c:\fflxlrr.exec:\fflxlrr.exe83⤵PID:1496
-
\??\c:\hnhhnh.exec:\hnhhnh.exe84⤵PID:2548
-
\??\c:\jdvdp.exec:\jdvdp.exe85⤵PID:2648
-
\??\c:\rxxxxrf.exec:\rxxxxrf.exe86⤵PID:2684
-
\??\c:\nnbnnt.exec:\nnbnnt.exe87⤵PID:2860
-
\??\c:\vvjpv.exec:\vvjpv.exe88⤵PID:2748
-
\??\c:\pvppj.exec:\pvppj.exe89⤵PID:2636
-
\??\c:\1lxrxfl.exec:\1lxrxfl.exe90⤵PID:2668
-
\??\c:\nttbtb.exec:\nttbtb.exe91⤵PID:2664
-
\??\c:\dddjv.exec:\dddjv.exe92⤵PID:2212
-
\??\c:\5lllrrf.exec:\5lllrrf.exe93⤵PID:2568
-
\??\c:\lfrrffr.exec:\lfrrffr.exe94⤵PID:2620
-
\??\c:\htbhhn.exec:\htbhhn.exe95⤵PID:2756
-
\??\c:\jvdpp.exec:\jvdpp.exe96⤵PID:2376
-
\??\c:\vjjvv.exec:\vjjvv.exe97⤵PID:2828
-
\??\c:\xrrflrf.exec:\xrrflrf.exe98⤵PID:2120
-
\??\c:\nnnhhn.exec:\nnnhhn.exe99⤵PID:1628
-
\??\c:\bbtbnb.exec:\bbtbnb.exe100⤵PID:2292
-
\??\c:\dpvjj.exec:\dpvjj.exe101⤵PID:2624
-
\??\c:\5rlxlxr.exec:\5rlxlxr.exe102⤵PID:2008
-
\??\c:\bhbnbn.exec:\bhbnbn.exe103⤵PID:1568
-
\??\c:\dvjpp.exec:\dvjpp.exe104⤵PID:2836
-
\??\c:\rrfrxfl.exec:\rrfrxfl.exe105⤵PID:760
-
\??\c:\tnhnbh.exec:\tnhnbh.exe106⤵PID:1644
-
\??\c:\nnbnhn.exec:\nnbnhn.exe107⤵PID:1308
-
\??\c:\vdvpj.exec:\vdvpj.exe108⤵PID:2248
-
\??\c:\7xrflrx.exec:\7xrflrx.exe109⤵PID:1632
-
\??\c:\btntbb.exec:\btntbb.exe110⤵PID:772
-
\??\c:\pdpjj.exec:\pdpjj.exe111⤵PID:1400
-
\??\c:\dvpjp.exec:\dvpjp.exe112⤵PID:1392
-
\??\c:\7jvdp.exec:\7jvdp.exe113⤵PID:984
-
\??\c:\xfflrrl.exec:\xfflrrl.exe114⤵PID:576
-
\??\c:\1hhnnn.exec:\1hhnnn.exe115⤵PID:1196
-
\??\c:\5pjjv.exec:\5pjjv.exe116⤵PID:2236
-
\??\c:\3rxxlrf.exec:\3rxxlrf.exe117⤵PID:1896
-
\??\c:\bntttt.exec:\bntttt.exe118⤵PID:1544
-
\??\c:\nhbbht.exec:\nhbbht.exe119⤵PID:692
-
\??\c:\jjjjp.exec:\jjjjp.exe120⤵PID:2136
-
\??\c:\xrrrlff.exec:\xrrrlff.exe121⤵PID:2360
-
\??\c:\fflrffx.exec:\fflrffx.exe122⤵PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-