Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 01:50
Behavioral task
behavioral1
Sample
7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe
-
Size
365KB
-
MD5
7172126158ab77902e0f68a0eadba970
-
SHA1
0c935d475865024cfc7541a6472eccbb85e68e6a
-
SHA256
0754ec5a288c358ddd09cb7d9bac10492a38f649aca7e20ca24ed2e795661caf
-
SHA512
3a89f25de3f5c569ace4d9010a9dde7f741a9396fbea5d9b05cd3d18a3bbdd9da9fe7a8e5712bcf799f0ddd181583b14f6e7021baac8cbfe7a2076de45fada22
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwu1b26X1wjdgyPPBR:R4wFHoSHYHUrAwqzQ7PPr
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1736-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-65-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/2544-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1072-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1248-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-217-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/2904-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/644-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/904-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-831-0x0000000077950000-0x0000000077A6F000-memory.dmp family_blackmoon behavioral1/memory/3004-1104-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2864-1199-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3028-11314-0x0000000077950000-0x0000000077A6F000-memory.dmp family_blackmoon behavioral1/memory/3028-21992-0x0000000077950000-0x0000000077A6F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1692 fxlfrxf.exe 1744 tbtbnt.exe 1732 rlfrffr.exe 2992 hbntbn.exe 1636 rrlflrf.exe 2768 btnbnb.exe 2620 9dvdp.exe 2820 5ththn.exe 2544 fflxflx.exe 2788 rlfrxrf.exe 2240 hnbhth.exe 2968 bbthtt.exe 2984 dvdjp.exe 1316 lxxfffl.exe 1072 9hthnn.exe 1248 vjppv.exe 1032 hbtbth.exe 1328 pjvdp.exe 1808 xxxlflx.exe 2744 vpjvd.exe 1764 rlfflfl.exe 2844 xrflxfr.exe 1708 dvpdd.exe 1528 fxrlrxx.exe 2452 hbbhnt.exe 2032 ddvdp.exe 2904 5fflxfx.exe 644 bbbtnt.exe 1300 hbbnbn.exe 1984 vpjpd.exe 1880 hbbbnn.exe 572 djjpp.exe 2932 fflrfxf.exe 1516 tnntnt.exe 2940 bbtbtt.exe 1004 dpddd.exe 904 fflrxfl.exe 2220 rfrlrll.exe 1720 tnhntt.exe 1692 vppvj.exe 2268 xfxrfrl.exe 2360 fflrlxx.exe 2200 hntbbh.exe 2828 pdppv.exe 2252 ddpdp.exe 2876 rfxflrx.exe 2784 tnbtbh.exe 2760 9dpvv.exe 2648 ppdvp.exe 2892 fxrxflr.exe 2856 hbnhtb.exe 2816 ttthtb.exe 2800 9vpvv.exe 2532 xlxrlrf.exe 2588 flflflx.exe 2684 nhhbnt.exe 1100 jjdjv.exe 1668 rrlxrxl.exe 856 fffxrfx.exe 1656 5ttbhh.exe 1956 pdvdd.exe 1564 llrlxlf.exe 1948 rllfrff.exe 1456 ntnhnt.exe -
resource yara_rule behavioral1/memory/1736-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000012272-6.dat upx behavioral1/memory/1736-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015cb7-15.dat upx behavioral1/memory/1692-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1744-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015cea-23.dat upx behavioral1/memory/1744-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015cf3-32.dat upx behavioral1/files/0x0007000000015cfd-38.dat upx behavioral1/memory/1636-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d09-48.dat upx behavioral1/files/0x0007000000015d13-55.dat upx behavioral1/memory/2768-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015f54-66.dat upx behavioral1/memory/2620-65-0x00000000001C0000-0x00000000001E7000-memory.dmp upx behavioral1/files/0x00070000000165d4-73.dat upx behavioral1/memory/2544-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016824-84.dat upx behavioral1/memory/2788-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a7d-90.dat upx behavioral1/files/0x0006000000016c4a-97.dat upx behavioral1/files/0x0006000000016c5d-104.dat upx behavioral1/memory/2968-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c67-113.dat upx behavioral1/files/0x0006000000016caf-119.dat upx behavioral1/memory/1072-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cde-128.dat upx behavioral1/files/0x0009000000015cbf-135.dat upx behavioral1/memory/1248-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d05-143.dat upx behavioral1/memory/1032-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d1a-151.dat upx behavioral1/files/0x0006000000016d22-158.dat upx behavioral1/files/0x0006000000016d2b-165.dat upx behavioral1/memory/1764-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d33-174.dat upx behavioral1/files/0x0006000000016d3b-181.dat upx behavioral1/memory/1708-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d44-190.dat upx behavioral1/memory/1528-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4c-197.dat upx behavioral1/files/0x0006000000016d55-205.dat upx behavioral1/memory/2904-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d6c-221.dat upx behavioral1/files/0x0006000000016d68-214.dat upx behavioral1/memory/2904-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d70-230.dat upx behavioral1/memory/644-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d78-237.dat upx behavioral1/files/0x0006000000016db2-244.dat upx behavioral1/files/0x0006000000016dc8-251.dat upx behavioral1/memory/1516-268-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/memory/904-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-365-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-376-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1692 1736 7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe 28 PID 1736 wrote to memory of 1692 1736 7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe 28 PID 1736 wrote to memory of 1692 1736 7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe 28 PID 1736 wrote to memory of 1692 1736 7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe 28 PID 1692 wrote to memory of 1744 1692 fxlfrxf.exe 29 PID 1692 wrote to memory of 1744 1692 fxlfrxf.exe 29 PID 1692 wrote to memory of 1744 1692 fxlfrxf.exe 29 PID 1692 wrote to memory of 1744 1692 fxlfrxf.exe 29 PID 1744 wrote to memory of 1732 1744 tbtbnt.exe 30 PID 1744 wrote to memory of 1732 1744 tbtbnt.exe 30 PID 1744 wrote to memory of 1732 1744 tbtbnt.exe 30 PID 1744 wrote to memory of 1732 1744 tbtbnt.exe 30 PID 1732 wrote to memory of 2992 1732 rlfrffr.exe 31 PID 1732 wrote to memory of 2992 1732 rlfrffr.exe 31 PID 1732 wrote to memory of 2992 1732 rlfrffr.exe 31 PID 1732 wrote to memory of 2992 1732 rlfrffr.exe 31 PID 2992 wrote to memory of 1636 2992 hbntbn.exe 32 PID 2992 wrote to memory of 1636 2992 hbntbn.exe 32 PID 2992 wrote to memory of 1636 2992 hbntbn.exe 32 PID 2992 wrote to memory of 1636 2992 hbntbn.exe 32 PID 1636 wrote to memory of 2768 1636 rrlflrf.exe 33 PID 1636 wrote to memory of 2768 1636 rrlflrf.exe 33 PID 1636 wrote to memory of 2768 1636 rrlflrf.exe 33 PID 1636 wrote to memory of 2768 1636 rrlflrf.exe 33 PID 2768 wrote to memory of 2620 2768 btnbnb.exe 34 PID 2768 wrote to memory of 2620 2768 btnbnb.exe 34 PID 2768 wrote to memory of 2620 2768 btnbnb.exe 34 PID 2768 wrote to memory of 2620 2768 btnbnb.exe 34 PID 2620 wrote to memory of 2820 2620 9dvdp.exe 35 PID 2620 wrote to memory of 2820 2620 9dvdp.exe 35 PID 2620 wrote to memory of 2820 2620 9dvdp.exe 35 PID 2620 wrote to memory of 2820 2620 9dvdp.exe 35 PID 2820 wrote to memory of 2544 2820 5ththn.exe 36 PID 2820 wrote to memory of 2544 2820 5ththn.exe 36 PID 2820 wrote to memory of 2544 2820 5ththn.exe 36 PID 2820 wrote to memory of 2544 2820 5ththn.exe 36 PID 2544 wrote to memory of 2788 2544 fflxflx.exe 37 PID 2544 wrote to memory of 2788 2544 fflxflx.exe 37 PID 2544 wrote to memory of 2788 2544 fflxflx.exe 37 PID 2544 wrote to memory of 2788 2544 fflxflx.exe 37 PID 2788 wrote to memory of 2240 2788 rlfrxrf.exe 38 PID 2788 wrote to memory of 2240 2788 rlfrxrf.exe 38 PID 2788 wrote to memory of 2240 2788 rlfrxrf.exe 38 PID 2788 wrote to memory of 2240 2788 rlfrxrf.exe 38 PID 2240 wrote to memory of 2968 2240 hnbhth.exe 39 PID 2240 wrote to memory of 2968 2240 hnbhth.exe 39 PID 2240 wrote to memory of 2968 2240 hnbhth.exe 39 PID 2240 wrote to memory of 2968 2240 hnbhth.exe 39 PID 2968 wrote to memory of 2984 2968 bbthtt.exe 40 PID 2968 wrote to memory of 2984 2968 bbthtt.exe 40 PID 2968 wrote to memory of 2984 2968 bbthtt.exe 40 PID 2968 wrote to memory of 2984 2968 bbthtt.exe 40 PID 2984 wrote to memory of 1316 2984 dvdjp.exe 41 PID 2984 wrote to memory of 1316 2984 dvdjp.exe 41 PID 2984 wrote to memory of 1316 2984 dvdjp.exe 41 PID 2984 wrote to memory of 1316 2984 dvdjp.exe 41 PID 1316 wrote to memory of 1072 1316 lxxfffl.exe 42 PID 1316 wrote to memory of 1072 1316 lxxfffl.exe 42 PID 1316 wrote to memory of 1072 1316 lxxfffl.exe 42 PID 1316 wrote to memory of 1072 1316 lxxfffl.exe 42 PID 1072 wrote to memory of 1248 1072 9hthnn.exe 43 PID 1072 wrote to memory of 1248 1072 9hthnn.exe 43 PID 1072 wrote to memory of 1248 1072 9hthnn.exe 43 PID 1072 wrote to memory of 1248 1072 9hthnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\fxlfrxf.exec:\fxlfrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\tbtbnt.exec:\tbtbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\rlfrffr.exec:\rlfrffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\hbntbn.exec:\hbntbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\rrlflrf.exec:\rrlflrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\btnbnb.exec:\btnbnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\9dvdp.exec:\9dvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\5ththn.exec:\5ththn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\fflxflx.exec:\fflxflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\rlfrxrf.exec:\rlfrxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hnbhth.exec:\hnbhth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\bbthtt.exec:\bbthtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\dvdjp.exec:\dvdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\lxxfffl.exec:\lxxfffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\9hthnn.exec:\9hthnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\vjppv.exec:\vjppv.exe17⤵
- Executes dropped EXE
PID:1248 -
\??\c:\hbtbth.exec:\hbtbth.exe18⤵
- Executes dropped EXE
PID:1032 -
\??\c:\pjvdp.exec:\pjvdp.exe19⤵
- Executes dropped EXE
PID:1328 -
\??\c:\xxxlflx.exec:\xxxlflx.exe20⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vpjvd.exec:\vpjvd.exe21⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rlfflfl.exec:\rlfflfl.exe22⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xrflxfr.exec:\xrflxfr.exe23⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dvpdd.exec:\dvpdd.exe24⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fxrlrxx.exec:\fxrlrxx.exe25⤵
- Executes dropped EXE
PID:1528 -
\??\c:\hbbhnt.exec:\hbbhnt.exe26⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ddvdp.exec:\ddvdp.exe27⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5fflxfx.exec:\5fflxfx.exe28⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bbbtnt.exec:\bbbtnt.exe29⤵
- Executes dropped EXE
PID:644 -
\??\c:\hbbnbn.exec:\hbbnbn.exe30⤵
- Executes dropped EXE
PID:1300 -
\??\c:\vpjpd.exec:\vpjpd.exe31⤵
- Executes dropped EXE
PID:1984 -
\??\c:\hbbbnn.exec:\hbbbnn.exe32⤵
- Executes dropped EXE
PID:1880 -
\??\c:\djjpp.exec:\djjpp.exe33⤵
- Executes dropped EXE
PID:572 -
\??\c:\fflrfxf.exec:\fflrfxf.exe34⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tnntnt.exec:\tnntnt.exe35⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bbtbtt.exec:\bbtbtt.exe36⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dpddd.exec:\dpddd.exe37⤵
- Executes dropped EXE
PID:1004 -
\??\c:\fflrxfl.exec:\fflrxfl.exe38⤵
- Executes dropped EXE
PID:904 -
\??\c:\rfrlrll.exec:\rfrlrll.exe39⤵
- Executes dropped EXE
PID:2220 -
\??\c:\tnhntt.exec:\tnhntt.exe40⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vppvj.exec:\vppvj.exe41⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xfxrfrl.exec:\xfxrfrl.exe42⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fflrlxx.exec:\fflrlxx.exe43⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hntbbh.exec:\hntbbh.exe44⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pdppv.exec:\pdppv.exe45⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ddpdp.exec:\ddpdp.exe46⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rfxflrx.exec:\rfxflrx.exe47⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tnbtbh.exec:\tnbtbh.exe48⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9dpvv.exec:\9dpvv.exe49⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ppdvp.exec:\ppdvp.exe50⤵
- Executes dropped EXE
PID:2648 -
\??\c:\fxrxflr.exec:\fxrxflr.exe51⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hbnhtb.exec:\hbnhtb.exe52⤵
- Executes dropped EXE
PID:2856 -
\??\c:\ttthtb.exec:\ttthtb.exe53⤵
- Executes dropped EXE
PID:2816 -
\??\c:\9vpvv.exec:\9vpvv.exe54⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xlxrlrf.exec:\xlxrlrf.exe55⤵
- Executes dropped EXE
PID:2532 -
\??\c:\flflflx.exec:\flflflx.exe56⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nhhbnt.exec:\nhhbnt.exe57⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jjdjv.exec:\jjdjv.exe58⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rrlxrxl.exec:\rrlxrxl.exe59⤵
- Executes dropped EXE
PID:1668 -
\??\c:\fffxrfx.exec:\fffxrfx.exe60⤵
- Executes dropped EXE
PID:856 -
\??\c:\5ttbhh.exec:\5ttbhh.exe61⤵
- Executes dropped EXE
PID:1656 -
\??\c:\pdvdd.exec:\pdvdd.exe62⤵
- Executes dropped EXE
PID:1956 -
\??\c:\llrlxlf.exec:\llrlxlf.exe63⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rllfrff.exec:\rllfrff.exe64⤵
- Executes dropped EXE
PID:1948 -
\??\c:\ntnhnt.exec:\ntnhnt.exe65⤵
- Executes dropped EXE
PID:1456 -
\??\c:\jddvj.exec:\jddvj.exe66⤵PID:1972
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe67⤵PID:340
-
\??\c:\3nhtbh.exec:\3nhtbh.exe68⤵PID:772
-
\??\c:\tbbtbt.exec:\tbbtbt.exe69⤵PID:2604
-
\??\c:\7vpjp.exec:\7vpjp.exe70⤵PID:2556
-
\??\c:\lflrrlr.exec:\lflrrlr.exe71⤵PID:324
-
\??\c:\nnnbbh.exec:\nnnbbh.exe72⤵PID:2292
-
\??\c:\1dpvj.exec:\1dpvj.exe73⤵PID:2612
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe74⤵PID:1484
-
\??\c:\nhnntb.exec:\nhnntb.exe75⤵PID:1544
-
\??\c:\jdpvj.exec:\jdpvj.exe76⤵PID:2208
-
\??\c:\jvdjd.exec:\jvdjd.exe77⤵PID:2904
-
\??\c:\rlflrrr.exec:\rlflrrr.exe78⤵PID:1364
-
\??\c:\7bnbbb.exec:\7bnbbb.exe79⤵PID:2436
-
\??\c:\5jjvd.exec:\5jjvd.exe80⤵PID:1336
-
\??\c:\lxrrlxf.exec:\lxrrlxf.exe81⤵PID:1996
-
\??\c:\nbtbht.exec:\nbtbht.exe82⤵PID:2164
-
\??\c:\hhhhbn.exec:\hhhhbn.exe83⤵PID:1168
-
\??\c:\9pjpd.exec:\9pjpd.exe84⤵PID:1676
-
\??\c:\3lfxlrf.exec:\3lfxlrf.exe85⤵PID:2412
-
\??\c:\3lxflxf.exec:\3lxflxf.exe86⤵PID:2368
-
\??\c:\nbntnb.exec:\nbntnb.exe87⤵PID:1512
-
\??\c:\jjpdp.exec:\jjpdp.exe88⤵PID:1200
-
\??\c:\fxlxfrf.exec:\fxlxfrf.exe89⤵PID:2320
-
\??\c:\5xxxxxf.exec:\5xxxxxf.exe90⤵PID:2128
-
\??\c:\tntnbt.exec:\tntnbt.exe91⤵PID:1532
-
\??\c:\vvvdj.exec:\vvvdj.exe92⤵PID:1604
-
\??\c:\7xxfrlr.exec:\7xxfrlr.exe93⤵PID:1612
-
\??\c:\rrrxllx.exec:\rrrxllx.exe94⤵PID:2248
-
\??\c:\tnhthn.exec:\tnhthn.exe95⤵PID:2456
-
\??\c:\1vjvv.exec:\1vjvv.exe96⤵PID:2104
-
\??\c:\pjjvj.exec:\pjjvj.exe97⤵PID:2772
-
\??\c:\rlxrrlx.exec:\rlxrrlx.exe98⤵PID:2644
-
\??\c:\nthbbn.exec:\nthbbn.exe99⤵PID:2640
-
\??\c:\nhtnbh.exec:\nhtnbh.exe100⤵PID:2272
-
\??\c:\jdppd.exec:\jdppd.exe101⤵PID:2120
-
\??\c:\fxrfxlx.exec:\fxrfxlx.exe102⤵PID:2960
-
\??\c:\7tthnb.exec:\7tthnb.exe103⤵PID:2628
-
\??\c:\ntthbn.exec:\ntthbn.exe104⤵PID:2520
-
\??\c:\9dvvd.exec:\9dvvd.exe105⤵PID:2788
-
\??\c:\rlflllx.exec:\rlflllx.exe106⤵PID:2972
-
\??\c:\nhbbnt.exec:\nhbbnt.exe107⤵PID:2980
-
\??\c:\hhhthn.exec:\hhhthn.exe108⤵PID:2724
-
\??\c:\dvjpd.exec:\dvjpd.exe109⤵PID:1292
-
\??\c:\fxrrffl.exec:\fxrrffl.exe110⤵PID:2484
-
\??\c:\ttbbhn.exec:\ttbbhn.exe111⤵PID:2324
-
\??\c:\hhbnth.exec:\hhbnth.exe112⤵PID:2328
-
\??\c:\jjdvv.exec:\jjdvv.exe113⤵PID:1068
-
\??\c:\1ffxlrx.exec:\1ffxlrx.exe114⤵PID:1344
-
\??\c:\htnntt.exec:\htnntt.exe115⤵PID:1032
-
\??\c:\pvjpj.exec:\pvjpj.exe116⤵PID:1328
-
\??\c:\5vpjv.exec:\5vpjv.exe117⤵PID:2740
-
\??\c:\lllrflx.exec:\lllrflx.exe118⤵PID:820
-
\??\c:\bthtbn.exec:\bthtbn.exe119⤵PID:912
-
\??\c:\ppjpd.exec:\ppjpd.exe120⤵PID:1764
-
\??\c:\nnnnbn.exec:\nnnnbn.exe121⤵PID:2868
-
\??\c:\hbtttt.exec:\hbtttt.exe122⤵PID:2312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-