Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 09:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe
-
Size
482KB
-
MD5
e6e8126a99cba2319972df66287a5880
-
SHA1
9b8184788b48c39caeb4677cd5e29e9ca5446d89
-
SHA256
a0f23d771be6b235c965a7fc4f63e62fe842c5ff0b72d528754f091e6a0a319e
-
SHA512
d5d194a54c4c00bac4dc25fd0628f5754692ddee7a62256b8b58948fa82d98edd8e10de0e89bfbb0a561df983351a07b839690866b7667f0a7f6a469fda8a492
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjhtSizP:q7Tc2NYHUrAwqzc9
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1916-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-79-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2592-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-277-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2232-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-457-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2916-470-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1412-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-907-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-1145-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1916 1hntbh.exe 3060 thbnbh.exe 2932 thtttn.exe 2896 tbnhnh.exe 2704 3xrrllr.exe 2588 hhtthn.exe 2744 7dpvd.exe 2592 rxrxflx.exe 2460 jvjjj.exe 1984 frfflfr.exe 2068 7ntttb.exe 2556 7vjpv.exe 1632 xfrffff.exe 2756 jjpvj.exe 1816 lfrfllx.exe 2676 xxlxflx.exe 2836 ddppd.exe 1560 lxflrrx.exe 632 tnbbbb.exe 2104 9djjp.exe 856 3htbnn.exe 2032 thtbbn.exe 688 jdddv.exe 112 bthhnn.exe 1148 7pjjp.exe 2980 bnhbhb.exe 1684 ddvdj.exe 1116 fxffflx.exe 1836 nhnntt.exe 2312 3jpjp.exe 2232 1frffxx.exe 2380 vvpdp.exe 2024 rfrfxfl.exe 1828 7bhhhb.exe 2936 tnbttn.exe 1720 vjvpj.exe 3064 rllfxfl.exe 3000 ffflllf.exe 2540 hbbthb.exe 2604 bthbbt.exe 2596 1jvdd.exe 2952 3xxfrxl.exe 2580 hnnhhb.exe 2692 vvjpv.exe 2000 ddpvd.exe 2468 ffxrlrl.exe 2628 nbhhht.exe 2500 nhnttb.exe 3028 jpjjp.exe 2860 dvjjj.exe 1696 llfffxl.exe 1688 bthbbb.exe 1632 btnbhh.exe 2756 jdppv.exe 1212 fxxflfl.exe 1764 7frxlfl.exe 1996 tthnbh.exe 2836 tttbnn.exe 2828 jjvvd.exe 2916 xrflxfl.exe 1744 lfxxffr.exe 1724 thbhnt.exe 1748 5bttnn.exe 2220 5dpvv.exe -
resource yara_rule behavioral1/memory/1916-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-457-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/592-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-887-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-982-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-1001-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-1040-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-1107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-1132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-1145-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1980-1249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-1274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-1319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-1352-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 1916 2392 e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe 28 PID 2392 wrote to memory of 1916 2392 e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe 28 PID 2392 wrote to memory of 1916 2392 e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe 28 PID 2392 wrote to memory of 1916 2392 e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe 28 PID 1916 wrote to memory of 3060 1916 1hntbh.exe 29 PID 1916 wrote to memory of 3060 1916 1hntbh.exe 29 PID 1916 wrote to memory of 3060 1916 1hntbh.exe 29 PID 1916 wrote to memory of 3060 1916 1hntbh.exe 29 PID 3060 wrote to memory of 2932 3060 thbnbh.exe 30 PID 3060 wrote to memory of 2932 3060 thbnbh.exe 30 PID 3060 wrote to memory of 2932 3060 thbnbh.exe 30 PID 3060 wrote to memory of 2932 3060 thbnbh.exe 30 PID 2932 wrote to memory of 2896 2932 thtttn.exe 31 PID 2932 wrote to memory of 2896 2932 thtttn.exe 31 PID 2932 wrote to memory of 2896 2932 thtttn.exe 31 PID 2932 wrote to memory of 2896 2932 thtttn.exe 31 PID 2896 wrote to memory of 2704 2896 tbnhnh.exe 32 PID 2896 wrote to memory of 2704 2896 tbnhnh.exe 32 PID 2896 wrote to memory of 2704 2896 tbnhnh.exe 32 PID 2896 wrote to memory of 2704 2896 tbnhnh.exe 32 PID 2704 wrote to memory of 2588 2704 3xrrllr.exe 33 PID 2704 wrote to memory of 2588 2704 3xrrllr.exe 33 PID 2704 wrote to memory of 2588 2704 3xrrllr.exe 33 PID 2704 wrote to memory of 2588 2704 3xrrllr.exe 33 PID 2588 wrote to memory of 2744 2588 hhtthn.exe 34 PID 2588 wrote to memory of 2744 2588 hhtthn.exe 34 PID 2588 wrote to memory of 2744 2588 hhtthn.exe 34 PID 2588 wrote to memory of 2744 2588 hhtthn.exe 34 PID 2744 wrote to memory of 2592 2744 7dpvd.exe 35 PID 2744 wrote to memory of 2592 2744 7dpvd.exe 35 PID 2744 wrote to memory of 2592 2744 7dpvd.exe 35 PID 2744 wrote to memory of 2592 2744 7dpvd.exe 35 PID 2592 wrote to memory of 2460 2592 rxrxflx.exe 36 PID 2592 wrote to memory of 2460 2592 rxrxflx.exe 36 PID 2592 wrote to memory of 2460 2592 rxrxflx.exe 36 PID 2592 wrote to memory of 2460 2592 rxrxflx.exe 36 PID 2460 wrote to memory of 1984 2460 jvjjj.exe 37 PID 2460 wrote to memory of 1984 2460 jvjjj.exe 37 PID 2460 wrote to memory of 1984 2460 jvjjj.exe 37 PID 2460 wrote to memory of 1984 2460 jvjjj.exe 37 PID 1984 wrote to memory of 2068 1984 frfflfr.exe 38 PID 1984 wrote to memory of 2068 1984 frfflfr.exe 38 PID 1984 wrote to memory of 2068 1984 frfflfr.exe 38 PID 1984 wrote to memory of 2068 1984 frfflfr.exe 38 PID 2068 wrote to memory of 2556 2068 7ntttb.exe 39 PID 2068 wrote to memory of 2556 2068 7ntttb.exe 39 PID 2068 wrote to memory of 2556 2068 7ntttb.exe 39 PID 2068 wrote to memory of 2556 2068 7ntttb.exe 39 PID 2556 wrote to memory of 1632 2556 7vjpv.exe 40 PID 2556 wrote to memory of 1632 2556 7vjpv.exe 40 PID 2556 wrote to memory of 1632 2556 7vjpv.exe 40 PID 2556 wrote to memory of 1632 2556 7vjpv.exe 40 PID 1632 wrote to memory of 2756 1632 xfrffff.exe 41 PID 1632 wrote to memory of 2756 1632 xfrffff.exe 41 PID 1632 wrote to memory of 2756 1632 xfrffff.exe 41 PID 1632 wrote to memory of 2756 1632 xfrffff.exe 41 PID 2756 wrote to memory of 1816 2756 jjpvj.exe 42 PID 2756 wrote to memory of 1816 2756 jjpvj.exe 42 PID 2756 wrote to memory of 1816 2756 jjpvj.exe 42 PID 2756 wrote to memory of 1816 2756 jjpvj.exe 42 PID 1816 wrote to memory of 2676 1816 lfrfllx.exe 43 PID 1816 wrote to memory of 2676 1816 lfrfllx.exe 43 PID 1816 wrote to memory of 2676 1816 lfrfllx.exe 43 PID 1816 wrote to memory of 2676 1816 lfrfllx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e6e8126a99cba2319972df66287a5880_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\1hntbh.exec:\1hntbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\thbnbh.exec:\thbnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\thtttn.exec:\thtttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\tbnhnh.exec:\tbnhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\3xrrllr.exec:\3xrrllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hhtthn.exec:\hhtthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\7dpvd.exec:\7dpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rxrxflx.exec:\rxrxflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jvjjj.exec:\jvjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\frfflfr.exec:\frfflfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\7ntttb.exec:\7ntttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\7vjpv.exec:\7vjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\xfrffff.exec:\xfrffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\jjpvj.exec:\jjpvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\lfrfllx.exec:\lfrfllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\xxlxflx.exec:\xxlxflx.exe17⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ddppd.exec:\ddppd.exe18⤵
- Executes dropped EXE
PID:2836 -
\??\c:\lxflrrx.exec:\lxflrrx.exe19⤵
- Executes dropped EXE
PID:1560 -
\??\c:\tnbbbb.exec:\tnbbbb.exe20⤵
- Executes dropped EXE
PID:632 -
\??\c:\9djjp.exec:\9djjp.exe21⤵
- Executes dropped EXE
PID:2104 -
\??\c:\3htbnn.exec:\3htbnn.exe22⤵
- Executes dropped EXE
PID:856 -
\??\c:\thtbbn.exec:\thtbbn.exe23⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jdddv.exec:\jdddv.exe24⤵
- Executes dropped EXE
PID:688 -
\??\c:\bthhnn.exec:\bthhnn.exe25⤵
- Executes dropped EXE
PID:112 -
\??\c:\7pjjp.exec:\7pjjp.exe26⤵
- Executes dropped EXE
PID:1148 -
\??\c:\bnhbhb.exec:\bnhbhb.exe27⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ddvdj.exec:\ddvdj.exe28⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fxffflx.exec:\fxffflx.exe29⤵
- Executes dropped EXE
PID:1116 -
\??\c:\nhnntt.exec:\nhnntt.exe30⤵
- Executes dropped EXE
PID:1836 -
\??\c:\3jpjp.exec:\3jpjp.exe31⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1frffxx.exec:\1frffxx.exe32⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vvpdp.exec:\vvpdp.exe33⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rfrfxfl.exec:\rfrfxfl.exe34⤵
- Executes dropped EXE
PID:2024 -
\??\c:\7bhhhb.exec:\7bhhhb.exe35⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tnbttn.exec:\tnbttn.exe36⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vjvpj.exec:\vjvpj.exe37⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rllfxfl.exec:\rllfxfl.exe38⤵
- Executes dropped EXE
PID:3064 -
\??\c:\ffflllf.exec:\ffflllf.exe39⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hbbthb.exec:\hbbthb.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bthbbt.exec:\bthbbt.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1jvdd.exec:\1jvdd.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\3xxfrxl.exec:\3xxfrxl.exe43⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hnnhhb.exec:\hnnhhb.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vvjpv.exec:\vvjpv.exe45⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ddpvd.exec:\ddpvd.exe46⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ffxrlrl.exec:\ffxrlrl.exe47⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nbhhht.exec:\nbhhht.exe48⤵
- Executes dropped EXE
PID:2628 -
\??\c:\nhnttb.exec:\nhnttb.exe49⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jpjjp.exec:\jpjjp.exe50⤵
- Executes dropped EXE
PID:3028 -
\??\c:\dvjjj.exec:\dvjjj.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\llfffxl.exec:\llfffxl.exe52⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bthbbb.exec:\bthbbb.exe53⤵
- Executes dropped EXE
PID:1688 -
\??\c:\btnbhh.exec:\btnbhh.exe54⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jdppv.exec:\jdppv.exe55⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fxxflfl.exec:\fxxflfl.exe56⤵
- Executes dropped EXE
PID:1212 -
\??\c:\7frxlfl.exec:\7frxlfl.exe57⤵
- Executes dropped EXE
PID:1764 -
\??\c:\tthnbh.exec:\tthnbh.exe58⤵
- Executes dropped EXE
PID:1996 -
\??\c:\tttbnn.exec:\tttbnn.exe59⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jjvvd.exec:\jjvvd.exe60⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xrflxfl.exec:\xrflxfl.exe61⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lfxxffr.exec:\lfxxffr.exe62⤵
- Executes dropped EXE
PID:1744 -
\??\c:\thbhnt.exec:\thbhnt.exe63⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5bttnn.exec:\5bttnn.exe64⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5dpvv.exec:\5dpvv.exe65⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xllrxfr.exec:\xllrxfr.exe66⤵PID:592
-
\??\c:\tnhntb.exec:\tnhntb.exe67⤵PID:588
-
\??\c:\pjpdj.exec:\pjpdj.exe68⤵PID:1656
-
\??\c:\vdpvj.exec:\vdpvj.exe69⤵PID:1844
-
\??\c:\frlllll.exec:\frlllll.exe70⤵PID:1412
-
\??\c:\bnhnbt.exec:\bnhnbt.exe71⤵PID:2980
-
\??\c:\jvdpj.exec:\jvdpj.exe72⤵PID:976
-
\??\c:\jjpvd.exec:\jjpvd.exe73⤵PID:1856
-
\??\c:\frxrxfl.exec:\frxrxfl.exe74⤵PID:908
-
\??\c:\hhbbhh.exec:\hhbbhh.exe75⤵PID:1232
-
\??\c:\dpddd.exec:\dpddd.exe76⤵PID:2192
-
\??\c:\rrllrrf.exec:\rrllrrf.exe77⤵PID:2232
-
\??\c:\hbbhtb.exec:\hbbhtb.exe78⤵PID:896
-
\??\c:\hthnnt.exec:\hthnnt.exe79⤵PID:1872
-
\??\c:\vjpjj.exec:\vjpjj.exe80⤵PID:2024
-
\??\c:\xlffllr.exec:\xlffllr.exe81⤵PID:768
-
\??\c:\nhbntb.exec:\nhbntb.exe82⤵PID:2936
-
\??\c:\tthntt.exec:\tthntt.exe83⤵PID:1720
-
\??\c:\9pvvv.exec:\9pvvv.exe84⤵PID:772
-
\??\c:\pjvpv.exec:\pjvpv.exe85⤵PID:2668
-
\??\c:\7xfffll.exec:\7xfffll.exe86⤵PID:1972
-
\??\c:\tnbtbt.exec:\tnbtbt.exe87⤵PID:2644
-
\??\c:\bbnntt.exec:\bbnntt.exe88⤵PID:2896
-
\??\c:\5dpjj.exec:\5dpjj.exe89⤵PID:2808
-
\??\c:\lxrrlll.exec:\lxrrlll.exe90⤵PID:2336
-
\??\c:\bntbbb.exec:\bntbbb.exe91⤵PID:2724
-
\??\c:\bbhbhh.exec:\bbhbhh.exe92⤵PID:2472
-
\??\c:\dvjdd.exec:\dvjdd.exe93⤵PID:2516
-
\??\c:\lxfrrll.exec:\lxfrrll.exe94⤵PID:2904
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe95⤵PID:2576
-
\??\c:\ntnnbt.exec:\ntnnbt.exe96⤵PID:3036
-
\??\c:\9dddp.exec:\9dddp.exe97⤵PID:2876
-
\??\c:\jjvpp.exec:\jjvpp.exe98⤵PID:2176
-
\??\c:\lxffffr.exec:\lxffffr.exe99⤵PID:2780
-
\??\c:\tnhthh.exec:\tnhthh.exe100⤵PID:2824
-
\??\c:\ppdjp.exec:\ppdjp.exe101⤵PID:1456
-
\??\c:\djvdv.exec:\djvdv.exe102⤵PID:2852
-
\??\c:\1lrllff.exec:\1lrllff.exe103⤵PID:2892
-
\??\c:\bbnbhh.exec:\bbnbhh.exe104⤵PID:1524
-
\??\c:\nnbtbb.exec:\nnbtbb.exe105⤵PID:1652
-
\??\c:\jvjjj.exec:\jvjjj.exe106⤵PID:1560
-
\??\c:\1lrfxll.exec:\1lrfxll.exe107⤵PID:3040
-
\??\c:\rfrllfl.exec:\rfrllfl.exe108⤵PID:2316
-
\??\c:\3tnhnh.exec:\3tnhnh.exe109⤵PID:2036
-
\??\c:\dpvvd.exec:\dpvvd.exe110⤵PID:2116
-
\??\c:\pjpjj.exec:\pjpjj.exe111⤵PID:1748
-
\??\c:\rfllrrx.exec:\rfllrrx.exe112⤵PID:540
-
\??\c:\9thttt.exec:\9thttt.exe113⤵PID:640
-
\??\c:\nnttnn.exec:\nnttnn.exe114⤵PID:1004
-
\??\c:\5pjvv.exec:\5pjvv.exe115⤵PID:1712
-
\??\c:\rlfxrxx.exec:\rlfxrxx.exe116⤵PID:1580
-
\??\c:\llfxfrf.exec:\llfxfrf.exe117⤵PID:1352
-
\??\c:\bnbtbt.exec:\bnbtbt.exe118⤵PID:1912
-
\??\c:\vppjp.exec:\vppjp.exe119⤵PID:1116
-
\??\c:\vpvvd.exec:\vpvvd.exe120⤵PID:1864
-
\??\c:\1frxllx.exec:\1frxllx.exe121⤵PID:568
-
\??\c:\hthhtb.exec:\hthhtb.exe122⤵PID:792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-