Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 08:12
Behavioral task
behavioral1
Sample
c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe
-
Size
537KB
-
MD5
c580da6ec82171b892137234ef2d2280
-
SHA1
ee265d8c6504e4566e1e38ee8413740a5f24539a
-
SHA256
aada36086bc7822fbb827e231175390923f3227c32785402037d6bec5329f03f
-
SHA512
11faee45de96c41a0656047854d69ad5a7e6464475fd2ae632b0fc04e961f320e6e72e41be281ae9ec5cb230ae90ec09153324d4ec1569b2bf03b8cde25df70d
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZ6:HFp3lzZbGa5so6
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2860-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-60-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2540-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1188-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/660-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1388-201-0x0000000000360000-0x0000000000387000-memory.dmp family_blackmoon behavioral1/memory/2336-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/548-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1500-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/472-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/880-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1000-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-585-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-784-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2980-838-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-918-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-1107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-1204-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1520-1282-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1800 rlxfrxr.exe 2020 7jjpd.exe 2532 nbbthh.exe 2796 jjdpj.exe 2704 9xxflfl.exe 2688 nhtbnn.exe 2540 1dvvd.exe 2468 hhhnhn.exe 2488 llxfrxx.exe 1860 5btnhn.exe 2756 3pjpp.exe 2904 rlffxfl.exe 1188 hbnhnh.exe 1908 7dppv.exe 660 btnbnb.exe 1904 3nhhht.exe 808 rxrlrll.exe 2336 thhnbh.exe 1304 3vjjj.exe 2216 jdvvp.exe 1996 tttthh.exe 1388 dvppv.exe 2044 xlxfrrl.exe 548 7bbhnb.exe 3044 flfxrrx.exe 880 bthhnb.exe 1952 vjjvj.exe 2968 ffxfxrx.exe 332 7bnthb.exe 3028 3vdjp.exe 472 xlffxfl.exe 1500 nhttbh.exe 888 xlxxxff.exe 2852 nhtbhh.exe 1600 pdppd.exe 2204 vjjjd.exe 1960 frxfxxx.exe 3032 tntttb.exe 2568 dpvdd.exe 2644 3rllxxl.exe 2680 rfxrrlx.exe 2616 thbbhh.exe 2660 vpdjp.exe 2600 5xrlxff.exe 2692 btbbtb.exe 1804 7dddj.exe 2676 rrflrxf.exe 2868 nhbbnt.exe 2920 dpjvd.exe 2732 xllrxfl.exe 1940 5bbbhn.exe 1772 tbbnth.exe 2184 vjdpd.exe 360 1xfffll.exe 1852 hbtbnt.exe 1620 tnhnth.exe 1292 dvpvj.exe 1756 rrrfrxf.exe 2108 tnhtbn.exe 2804 thhnbb.exe 1392 7vpdd.exe 1420 lxxxlrf.exe 536 3thhnh.exe 688 bhtbnn.exe -
resource yara_rule behavioral1/memory/2860-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-3-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2860-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012350-7.dat upx behavioral1/memory/1800-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0037000000014712-18.dat upx behavioral1/files/0x0008000000014a9a-25.dat upx behavioral1/memory/2020-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014b18-35.dat upx behavioral1/files/0x0007000000014b4c-44.dat upx behavioral1/memory/2704-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014bbc-55.dat upx behavioral1/memory/2688-60-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000014e71-67.dat upx behavioral1/files/0x0008000000015cff-76.dat upx behavioral1/memory/2540-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d20-85.dat upx behavioral1/memory/2468-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d42-94.dat upx behavioral1/files/0x0006000000015d4e-100.dat upx behavioral1/files/0x0006000000015d56-108.dat upx behavioral1/memory/1188-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d5f-118.dat upx behavioral1/files/0x0006000000015d6b-125.dat upx behavioral1/files/0x0006000000015d7f-135.dat upx behavioral1/memory/660-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d87-141.dat upx behavioral1/files/0x0006000000015d93-150.dat upx behavioral1/memory/808-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e32-160.dat upx behavioral1/files/0x003700000001471a-168.dat upx behavioral1/files/0x0006000000015ecc-178.dat upx behavioral1/memory/2216-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015f65-184.dat upx behavioral1/files/0x0006000000015fe5-193.dat upx behavioral1/files/0x000600000001610f-205.dat upx behavioral1/memory/2336-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001621e-213.dat upx behavioral1/files/0x000600000001630a-221.dat upx behavioral1/memory/548-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000164aa-231.dat upx behavioral1/files/0x000600000001658a-238.dat upx behavioral1/memory/3044-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1904-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016616-248.dat upx behavioral1/memory/1952-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016851-255.dat upx behavioral1/files/0x0006000000016c44-271.dat upx behavioral1/files/0x0006000000016c5e-282.dat upx behavioral1/memory/1500-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1500-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/472-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016adc-264.dat upx behavioral1/memory/2204-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2204-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1960-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1960-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-330-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 1800 2860 c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe 28 PID 2860 wrote to memory of 1800 2860 c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe 28 PID 2860 wrote to memory of 1800 2860 c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe 28 PID 2860 wrote to memory of 1800 2860 c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe 28 PID 1800 wrote to memory of 2020 1800 rlxfrxr.exe 29 PID 1800 wrote to memory of 2020 1800 rlxfrxr.exe 29 PID 1800 wrote to memory of 2020 1800 rlxfrxr.exe 29 PID 1800 wrote to memory of 2020 1800 rlxfrxr.exe 29 PID 2020 wrote to memory of 2532 2020 7jjpd.exe 30 PID 2020 wrote to memory of 2532 2020 7jjpd.exe 30 PID 2020 wrote to memory of 2532 2020 7jjpd.exe 30 PID 2020 wrote to memory of 2532 2020 7jjpd.exe 30 PID 2532 wrote to memory of 2796 2532 nbbthh.exe 31 PID 2532 wrote to memory of 2796 2532 nbbthh.exe 31 PID 2532 wrote to memory of 2796 2532 nbbthh.exe 31 PID 2532 wrote to memory of 2796 2532 nbbthh.exe 31 PID 2796 wrote to memory of 2704 2796 jjdpj.exe 32 PID 2796 wrote to memory of 2704 2796 jjdpj.exe 32 PID 2796 wrote to memory of 2704 2796 jjdpj.exe 32 PID 2796 wrote to memory of 2704 2796 jjdpj.exe 32 PID 2704 wrote to memory of 2688 2704 9xxflfl.exe 33 PID 2704 wrote to memory of 2688 2704 9xxflfl.exe 33 PID 2704 wrote to memory of 2688 2704 9xxflfl.exe 33 PID 2704 wrote to memory of 2688 2704 9xxflfl.exe 33 PID 2688 wrote to memory of 2540 2688 nhtbnn.exe 34 PID 2688 wrote to memory of 2540 2688 nhtbnn.exe 34 PID 2688 wrote to memory of 2540 2688 nhtbnn.exe 34 PID 2688 wrote to memory of 2540 2688 nhtbnn.exe 34 PID 2540 wrote to memory of 2468 2540 1dvvd.exe 35 PID 2540 wrote to memory of 2468 2540 1dvvd.exe 35 PID 2540 wrote to memory of 2468 2540 1dvvd.exe 35 PID 2540 wrote to memory of 2468 2540 1dvvd.exe 35 PID 2468 wrote to memory of 2488 2468 hhhnhn.exe 36 PID 2468 wrote to memory of 2488 2468 hhhnhn.exe 36 PID 2468 wrote to memory of 2488 2468 hhhnhn.exe 36 PID 2468 wrote to memory of 2488 2468 hhhnhn.exe 36 PID 2488 wrote to memory of 1860 2488 llxfrxx.exe 37 PID 2488 wrote to memory of 1860 2488 llxfrxx.exe 37 PID 2488 wrote to memory of 1860 2488 llxfrxx.exe 37 PID 2488 wrote to memory of 1860 2488 llxfrxx.exe 37 PID 1860 wrote to memory of 2756 1860 5btnhn.exe 38 PID 1860 wrote to memory of 2756 1860 5btnhn.exe 38 PID 1860 wrote to memory of 2756 1860 5btnhn.exe 38 PID 1860 wrote to memory of 2756 1860 5btnhn.exe 38 PID 2756 wrote to memory of 2904 2756 3pjpp.exe 39 PID 2756 wrote to memory of 2904 2756 3pjpp.exe 39 PID 2756 wrote to memory of 2904 2756 3pjpp.exe 39 PID 2756 wrote to memory of 2904 2756 3pjpp.exe 39 PID 2904 wrote to memory of 1188 2904 rlffxfl.exe 40 PID 2904 wrote to memory of 1188 2904 rlffxfl.exe 40 PID 2904 wrote to memory of 1188 2904 rlffxfl.exe 40 PID 2904 wrote to memory of 1188 2904 rlffxfl.exe 40 PID 1188 wrote to memory of 1908 1188 hbnhnh.exe 41 PID 1188 wrote to memory of 1908 1188 hbnhnh.exe 41 PID 1188 wrote to memory of 1908 1188 hbnhnh.exe 41 PID 1188 wrote to memory of 1908 1188 hbnhnh.exe 41 PID 1908 wrote to memory of 660 1908 7dppv.exe 42 PID 1908 wrote to memory of 660 1908 7dppv.exe 42 PID 1908 wrote to memory of 660 1908 7dppv.exe 42 PID 1908 wrote to memory of 660 1908 7dppv.exe 42 PID 660 wrote to memory of 1904 660 btnbnb.exe 43 PID 660 wrote to memory of 1904 660 btnbnb.exe 43 PID 660 wrote to memory of 1904 660 btnbnb.exe 43 PID 660 wrote to memory of 1904 660 btnbnb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\rlxfrxr.exec:\rlxfrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\7jjpd.exec:\7jjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\nbbthh.exec:\nbbthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jjdpj.exec:\jjdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\9xxflfl.exec:\9xxflfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nhtbnn.exec:\nhtbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\1dvvd.exec:\1dvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hhhnhn.exec:\hhhnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\llxfrxx.exec:\llxfrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\5btnhn.exec:\5btnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\3pjpp.exec:\3pjpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\rlffxfl.exec:\rlffxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\hbnhnh.exec:\hbnhnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\7dppv.exec:\7dppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\btnbnb.exec:\btnbnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\3nhhht.exec:\3nhhht.exe17⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rxrlrll.exec:\rxrlrll.exe18⤵
- Executes dropped EXE
PID:808 -
\??\c:\thhnbh.exec:\thhnbh.exe19⤵
- Executes dropped EXE
PID:2336 -
\??\c:\3vjjj.exec:\3vjjj.exe20⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jdvvp.exec:\jdvvp.exe21⤵
- Executes dropped EXE
PID:2216 -
\??\c:\tttthh.exec:\tttthh.exe22⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dvppv.exec:\dvppv.exe23⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xlxfrrl.exec:\xlxfrrl.exe24⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7bbhnb.exec:\7bbhnb.exe25⤵
- Executes dropped EXE
PID:548 -
\??\c:\flfxrrx.exec:\flfxrrx.exe26⤵
- Executes dropped EXE
PID:3044 -
\??\c:\bthhnb.exec:\bthhnb.exe27⤵
- Executes dropped EXE
PID:880 -
\??\c:\vjjvj.exec:\vjjvj.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ffxfxrx.exec:\ffxfxrx.exe29⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7bnthb.exec:\7bnthb.exe30⤵
- Executes dropped EXE
PID:332 -
\??\c:\3vdjp.exec:\3vdjp.exe31⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xlffxfl.exec:\xlffxfl.exe32⤵
- Executes dropped EXE
PID:472 -
\??\c:\nhttbh.exec:\nhttbh.exe33⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xlxxxff.exec:\xlxxxff.exe34⤵
- Executes dropped EXE
PID:888 -
\??\c:\nhtbhh.exec:\nhtbhh.exe35⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pdppd.exec:\pdppd.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vjjjd.exec:\vjjjd.exe37⤵
- Executes dropped EXE
PID:2204 -
\??\c:\frxfxxx.exec:\frxfxxx.exe38⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tntttb.exec:\tntttb.exe39⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dpvdd.exec:\dpvdd.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\3rllxxl.exec:\3rllxxl.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rfxrrlx.exec:\rfxrrlx.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\thbbhh.exec:\thbbhh.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vpdjp.exec:\vpdjp.exe44⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5xrlxff.exec:\5xrlxff.exe45⤵
- Executes dropped EXE
PID:2600 -
\??\c:\btbbtb.exec:\btbbtb.exe46⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7dddj.exec:\7dddj.exe47⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rrflrxf.exec:\rrflrxf.exe48⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nhbbnt.exec:\nhbbnt.exe49⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dpjvd.exec:\dpjvd.exe50⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xllrxfl.exec:\xllrxfl.exe51⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5bbbhn.exec:\5bbbhn.exe52⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tbbnth.exec:\tbbnth.exe53⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vjdpd.exec:\vjdpd.exe54⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1xfffll.exec:\1xfffll.exe55⤵
- Executes dropped EXE
PID:360 -
\??\c:\hbtbnt.exec:\hbtbnt.exe56⤵
- Executes dropped EXE
PID:1852 -
\??\c:\tnhnth.exec:\tnhnth.exe57⤵
- Executes dropped EXE
PID:1620 -
\??\c:\dvpvj.exec:\dvpvj.exe58⤵
- Executes dropped EXE
PID:1292 -
\??\c:\rrrfrxf.exec:\rrrfrxf.exe59⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tnhtbn.exec:\tnhtbn.exe60⤵
- Executes dropped EXE
PID:2108 -
\??\c:\thhnbb.exec:\thhnbb.exe61⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7vpdd.exec:\7vpdd.exe62⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lxxxlrf.exec:\lxxxlrf.exe63⤵
- Executes dropped EXE
PID:1420 -
\??\c:\3thhnh.exec:\3thhnh.exe64⤵
- Executes dropped EXE
PID:536 -
\??\c:\bhtbnn.exec:\bhtbnn.exe65⤵
- Executes dropped EXE
PID:688 -
\??\c:\vdpjp.exec:\vdpjp.exe66⤵PID:548
-
\??\c:\9rlrxxf.exec:\9rlrxxf.exe67⤵PID:268
-
\??\c:\7tnnnt.exec:\7tnnnt.exe68⤵PID:344
-
\??\c:\bnbhhh.exec:\bnbhhh.exe69⤵PID:880
-
\??\c:\vjvdd.exec:\vjvdd.exe70⤵PID:3056
-
\??\c:\flxrrlf.exec:\flxrrlf.exe71⤵PID:320
-
\??\c:\rlrllff.exec:\rlrllff.exe72⤵PID:2968
-
\??\c:\httbhn.exec:\httbhn.exe73⤵PID:2016
-
\??\c:\pdjdj.exec:\pdjdj.exe74⤵PID:1584
-
\??\c:\lfxxfxf.exec:\lfxxfxf.exe75⤵PID:1000
-
\??\c:\5thnnt.exec:\5thnnt.exe76⤵PID:1988
-
\??\c:\htbhtb.exec:\htbhtb.exe77⤵PID:1040
-
\??\c:\jddpd.exec:\jddpd.exe78⤵PID:888
-
\??\c:\1rfflff.exec:\1rfflff.exe79⤵PID:2948
-
\??\c:\ntntbn.exec:\ntntbn.exe80⤵PID:2280
-
\??\c:\dpppv.exec:\dpppv.exe81⤵PID:2520
-
\??\c:\rlxxfll.exec:\rlxxfll.exe82⤵PID:2572
-
\??\c:\3xrfrrr.exec:\3xrfrrr.exe83⤵PID:1184
-
\??\c:\nhhnbh.exec:\nhhnbh.exe84⤵PID:2788
-
\??\c:\pddjv.exec:\pddjv.exe85⤵PID:2624
-
\??\c:\lfxlrrx.exec:\lfxlrrx.exe86⤵PID:2644
-
\??\c:\bntbhh.exec:\bntbhh.exe87⤵PID:2960
-
\??\c:\djppp.exec:\djppp.exe88⤵PID:2356
-
\??\c:\vvppd.exec:\vvppd.exe89⤵PID:2660
-
\??\c:\xlffllf.exec:\xlffllf.exe90⤵PID:2592
-
\??\c:\tnbhtb.exec:\tnbhtb.exe91⤵PID:2264
-
\??\c:\jjdpj.exec:\jjdpj.exe92⤵PID:2420
-
\??\c:\vvdjd.exec:\vvdjd.exe93⤵PID:2668
-
\??\c:\rfxrxff.exec:\rfxrxff.exe94⤵PID:2856
-
\??\c:\bthntb.exec:\bthntb.exe95⤵PID:844
-
\??\c:\7nhnbh.exec:\7nhnbh.exe96⤵PID:2912
-
\??\c:\3jddj.exec:\3jddj.exe97⤵PID:2880
-
\??\c:\9dvpv.exec:\9dvpv.exe98⤵PID:2036
-
\??\c:\hhbthh.exec:\hhbthh.exe99⤵PID:1672
-
\??\c:\btnthh.exec:\btnthh.exe100⤵PID:1912
-
\??\c:\pjdpj.exec:\pjdpj.exe101⤵PID:2124
-
\??\c:\frrfxfr.exec:\frrfxfr.exe102⤵PID:1732
-
\??\c:\3xrfxlr.exec:\3xrfxlr.exe103⤵PID:1316
-
\??\c:\5nhhbt.exec:\5nhhbt.exe104⤵PID:1280
-
\??\c:\vjpvd.exec:\vjpvd.exe105⤵PID:2272
-
\??\c:\llxrlrl.exec:\llxrlrl.exe106⤵PID:848
-
\??\c:\1lflllr.exec:\1lflllr.exe107⤵PID:2736
-
\??\c:\9bbntb.exec:\9bbntb.exe108⤵PID:2800
-
\??\c:\pjdpj.exec:\pjdpj.exe109⤵PID:2524
-
\??\c:\jdddv.exec:\jdddv.exe110⤵PID:1132
-
\??\c:\5rflfll.exec:\5rflfll.exe111⤵PID:2276
-
\??\c:\tnhtht.exec:\tnhtht.exe112⤵PID:3064
-
\??\c:\pdpvd.exec:\pdpvd.exe113⤵PID:3068
-
\??\c:\dvdjp.exec:\dvdjp.exe114⤵PID:760
-
\??\c:\rrrfrfl.exec:\rrrfrfl.exe115⤵PID:1472
-
\??\c:\tntbnt.exec:\tntbnt.exe116⤵PID:764
-
\??\c:\3dvdj.exec:\3dvdj.exe117⤵PID:1340
-
\??\c:\jvppd.exec:\jvppd.exe118⤵PID:684
-
\??\c:\7llxllx.exec:\7llxllx.exe119⤵PID:2352
-
\??\c:\dvjpv.exec:\dvjpv.exe120⤵PID:2980
-
\??\c:\xlfflrf.exec:\xlfflrf.exe121⤵PID:984
-
\??\c:\nbtthb.exec:\nbtthb.exe122⤵PID:2252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-