Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 00:57
Behavioral task
behavioral1
Sample
671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe
-
Size
120KB
-
MD5
671ab578608d3ccf4cd19b2ad2bda850
-
SHA1
3612c83454998d4de0260c5d79ba7c3481c8c048
-
SHA256
b012e9dd260dbf06dcf017a72c6ecccbcde039c8298c697f9b6ed6152ea14e2d
-
SHA512
dd8c406c3542ac0ef3f0e36b408ce6452542d0e4ccbc13a66b12181cffd958c17793c5e9ad949d8c9805b8fbd703ef412c5f4c1482cee1bb159da52c419c037f
-
SSDEEP
3072:/hOmTsF93UYfwC6GIoutKzdbr9XcMRwk6mNb5TcPeJipUPe:/cm4FmowdHoSKZf5cX5m7TNG
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2392-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/488-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1156-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1460-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/792-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-600-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-638-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-688-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2316-737-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-837-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-971-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/276-1089-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-1392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-1435-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2572-1459-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2572-1458-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1992 5bbnbn.exe 3012 3dddv.exe 2932 9xxfrrf.exe 2896 ttntnt.exe 2712 pdppv.exe 2052 rrffrxl.exe 2736 llrfxfr.exe 2568 nbttbb.exe 2472 pjvdd.exe 2900 ppdpd.exe 2272 rrrfxlx.exe 2796 hbhbnb.exe 1688 pjvdj.exe 2824 vpdpv.exe 1172 lrrlrrf.exe 2864 btnthh.exe 2880 bbtntt.exe 1592 vdjdv.exe 2056 lffxlrf.exe 3004 bbnnth.exe 1960 btnnbb.exe 1748 jddjv.exe 488 1lfrxfl.exe 1156 xfffllf.exe 572 nhbnbb.exe 2004 9tnthn.exe 1912 9dddv.exe 2216 lllrflx.exe 692 hhnbtb.exe 1312 pdjpp.exe 2972 ppppd.exe 896 xxrfrxr.exe 2360 nbtbnn.exe 1992 bbnbhn.exe 2992 7jjjv.exe 3008 rfxxlrf.exe 2928 fflrlfx.exe 2324 tnhhbh.exe 2704 hbhtnt.exe 2600 7vjjp.exe 2712 dvjdj.exe 2692 llrxrxl.exe 2732 fxffxfl.exe 1668 bnhntb.exe 2456 thnthb.exe 2472 pvjdd.exe 2064 vjjjv.exe 1396 rrfrffl.exe 2872 rxlrxlr.exe 2884 bbntbn.exe 1688 pjvdv.exe 2772 5llxrrf.exe 2776 xxllrrx.exe 2892 hbtnth.exe 852 hbnnbn.exe 1524 hhthhn.exe 1652 vpjvj.exe 1716 pjjvj.exe 2056 frxllrf.exe 2104 3llrrxf.exe 2108 btbnht.exe 1976 7httbt.exe 1728 jjvvj.exe 588 jdvjv.exe -
resource yara_rule behavioral1/memory/2392-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b0000000141a2-7.dat upx behavioral1/memory/2392-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1992-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1992-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000143ec-19.dat upx behavioral1/files/0x0008000000014539-25.dat upx behavioral1/memory/3012-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2932-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014667-36.dat upx behavioral1/memory/2896-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000146a2-43.dat upx behavioral1/memory/2896-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a0000000146b8-55.dat upx behavioral1/files/0x00090000000146c0-63.dat upx behavioral1/memory/2052-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000014825-75.dat upx behavioral1/memory/2736-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000149f5-82.dat upx behavioral1/memory/2568-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2472-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014abe-93.dat upx behavioral1/memory/2900-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014af6-100.dat upx behavioral1/memory/2272-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014b31-110.dat upx behavioral1/files/0x0006000000014b70-117.dat upx behavioral1/memory/2796-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1688-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014de9-129.dat upx behavioral1/memory/2824-136-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/memory/2824-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014ef8-140.dat upx behavioral1/files/0x0006000000015018-147.dat upx behavioral1/memory/2864-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155ed-154.dat upx behavioral1/files/0x00060000000155f3-164.dat upx behavioral1/memory/2056-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155f7-171.dat upx behavioral1/files/0x0006000000015605-181.dat upx behavioral1/memory/3004-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015616-188.dat upx behavioral1/files/0x0006000000015626-198.dat upx behavioral1/files/0x0006000000015b6f-204.dat upx behavioral1/files/0x0006000000015c3d-214.dat upx behavioral1/memory/488-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c52-221.dat upx behavioral1/memory/1156-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2004-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c6b-232.dat upx behavioral1/files/0x0006000000015c78-241.dat upx behavioral1/files/0x0006000000015c83-250.dat upx behavioral1/memory/1912-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c9f-258.dat upx behavioral1/files/0x0006000000015cb6-266.dat upx behavioral1/memory/1312-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1312-275-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x000900000001448a-276.dat upx behavioral1/memory/2972-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cce-285.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 1992 2392 671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe 28 PID 2392 wrote to memory of 1992 2392 671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe 28 PID 2392 wrote to memory of 1992 2392 671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe 28 PID 2392 wrote to memory of 1992 2392 671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 3012 1992 5bbnbn.exe 29 PID 1992 wrote to memory of 3012 1992 5bbnbn.exe 29 PID 1992 wrote to memory of 3012 1992 5bbnbn.exe 29 PID 1992 wrote to memory of 3012 1992 5bbnbn.exe 29 PID 3012 wrote to memory of 2932 3012 3dddv.exe 30 PID 3012 wrote to memory of 2932 3012 3dddv.exe 30 PID 3012 wrote to memory of 2932 3012 3dddv.exe 30 PID 3012 wrote to memory of 2932 3012 3dddv.exe 30 PID 2932 wrote to memory of 2896 2932 9xxfrrf.exe 31 PID 2932 wrote to memory of 2896 2932 9xxfrrf.exe 31 PID 2932 wrote to memory of 2896 2932 9xxfrrf.exe 31 PID 2932 wrote to memory of 2896 2932 9xxfrrf.exe 31 PID 2896 wrote to memory of 2712 2896 ttntnt.exe 32 PID 2896 wrote to memory of 2712 2896 ttntnt.exe 32 PID 2896 wrote to memory of 2712 2896 ttntnt.exe 32 PID 2896 wrote to memory of 2712 2896 ttntnt.exe 32 PID 2712 wrote to memory of 2052 2712 pdppv.exe 33 PID 2712 wrote to memory of 2052 2712 pdppv.exe 33 PID 2712 wrote to memory of 2052 2712 pdppv.exe 33 PID 2712 wrote to memory of 2052 2712 pdppv.exe 33 PID 2052 wrote to memory of 2736 2052 rrffrxl.exe 34 PID 2052 wrote to memory of 2736 2052 rrffrxl.exe 34 PID 2052 wrote to memory of 2736 2052 rrffrxl.exe 34 PID 2052 wrote to memory of 2736 2052 rrffrxl.exe 34 PID 2736 wrote to memory of 2568 2736 llrfxfr.exe 35 PID 2736 wrote to memory of 2568 2736 llrfxfr.exe 35 PID 2736 wrote to memory of 2568 2736 llrfxfr.exe 35 PID 2736 wrote to memory of 2568 2736 llrfxfr.exe 35 PID 2568 wrote to memory of 2472 2568 nbttbb.exe 36 PID 2568 wrote to memory of 2472 2568 nbttbb.exe 36 PID 2568 wrote to memory of 2472 2568 nbttbb.exe 36 PID 2568 wrote to memory of 2472 2568 nbttbb.exe 36 PID 2472 wrote to memory of 2900 2472 pjvdd.exe 37 PID 2472 wrote to memory of 2900 2472 pjvdd.exe 37 PID 2472 wrote to memory of 2900 2472 pjvdd.exe 37 PID 2472 wrote to memory of 2900 2472 pjvdd.exe 37 PID 2900 wrote to memory of 2272 2900 ppdpd.exe 38 PID 2900 wrote to memory of 2272 2900 ppdpd.exe 38 PID 2900 wrote to memory of 2272 2900 ppdpd.exe 38 PID 2900 wrote to memory of 2272 2900 ppdpd.exe 38 PID 2272 wrote to memory of 2796 2272 rrrfxlx.exe 39 PID 2272 wrote to memory of 2796 2272 rrrfxlx.exe 39 PID 2272 wrote to memory of 2796 2272 rrrfxlx.exe 39 PID 2272 wrote to memory of 2796 2272 rrrfxlx.exe 39 PID 2796 wrote to memory of 1688 2796 hbhbnb.exe 40 PID 2796 wrote to memory of 1688 2796 hbhbnb.exe 40 PID 2796 wrote to memory of 1688 2796 hbhbnb.exe 40 PID 2796 wrote to memory of 1688 2796 hbhbnb.exe 40 PID 1688 wrote to memory of 2824 1688 pjvdj.exe 41 PID 1688 wrote to memory of 2824 1688 pjvdj.exe 41 PID 1688 wrote to memory of 2824 1688 pjvdj.exe 41 PID 1688 wrote to memory of 2824 1688 pjvdj.exe 41 PID 2824 wrote to memory of 1172 2824 vpdpv.exe 42 PID 2824 wrote to memory of 1172 2824 vpdpv.exe 42 PID 2824 wrote to memory of 1172 2824 vpdpv.exe 42 PID 2824 wrote to memory of 1172 2824 vpdpv.exe 42 PID 1172 wrote to memory of 2864 1172 lrrlrrf.exe 43 PID 1172 wrote to memory of 2864 1172 lrrlrrf.exe 43 PID 1172 wrote to memory of 2864 1172 lrrlrrf.exe 43 PID 1172 wrote to memory of 2864 1172 lrrlrrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\5bbnbn.exec:\5bbnbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\3dddv.exec:\3dddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\9xxfrrf.exec:\9xxfrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\ttntnt.exec:\ttntnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\pdppv.exec:\pdppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\rrffrxl.exec:\rrffrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\llrfxfr.exec:\llrfxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nbttbb.exec:\nbttbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\pjvdd.exec:\pjvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\ppdpd.exec:\ppdpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\rrrfxlx.exec:\rrrfxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\hbhbnb.exec:\hbhbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\pjvdj.exec:\pjvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\vpdpv.exec:\vpdpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lrrlrrf.exec:\lrrlrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\btnthh.exec:\btnthh.exe17⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bbtntt.exec:\bbtntt.exe18⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vdjdv.exec:\vdjdv.exe19⤵
- Executes dropped EXE
PID:1592 -
\??\c:\lffxlrf.exec:\lffxlrf.exe20⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bbnnth.exec:\bbnnth.exe21⤵
- Executes dropped EXE
PID:3004 -
\??\c:\btnnbb.exec:\btnnbb.exe22⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jddjv.exec:\jddjv.exe23⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1lfrxfl.exec:\1lfrxfl.exe24⤵
- Executes dropped EXE
PID:488 -
\??\c:\xfffllf.exec:\xfffllf.exe25⤵
- Executes dropped EXE
PID:1156 -
\??\c:\nhbnbb.exec:\nhbnbb.exe26⤵
- Executes dropped EXE
PID:572 -
\??\c:\9tnthn.exec:\9tnthn.exe27⤵
- Executes dropped EXE
PID:2004 -
\??\c:\9dddv.exec:\9dddv.exe28⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lllrflx.exec:\lllrflx.exe29⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hhnbtb.exec:\hhnbtb.exe30⤵
- Executes dropped EXE
PID:692 -
\??\c:\pdjpp.exec:\pdjpp.exe31⤵
- Executes dropped EXE
PID:1312 -
\??\c:\ppppd.exec:\ppppd.exe32⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xxrfrxr.exec:\xxrfrxr.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\nbtbnn.exec:\nbtbnn.exe34⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bbnbhn.exec:\bbnbhn.exe35⤵
- Executes dropped EXE
PID:1992 -
\??\c:\7jjjv.exec:\7jjjv.exe36⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rfxxlrf.exec:\rfxxlrf.exe37⤵
- Executes dropped EXE
PID:3008 -
\??\c:\fflrlfx.exec:\fflrlfx.exe38⤵
- Executes dropped EXE
PID:2928 -
\??\c:\tnhhbh.exec:\tnhhbh.exe39⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hbhtnt.exec:\hbhtnt.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7vjjp.exec:\7vjjp.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\dvjdj.exec:\dvjdj.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\llrxrxl.exec:\llrxrxl.exe43⤵
- Executes dropped EXE
PID:2692 -
\??\c:\fxffxfl.exec:\fxffxfl.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bnhntb.exec:\bnhntb.exe45⤵
- Executes dropped EXE
PID:1668 -
\??\c:\thnthb.exec:\thnthb.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pvjdd.exec:\pvjdd.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vjjjv.exec:\vjjjv.exe48⤵
- Executes dropped EXE
PID:2064 -
\??\c:\rrfrffl.exec:\rrfrffl.exe49⤵
- Executes dropped EXE
PID:1396 -
\??\c:\rxlrxlr.exec:\rxlrxlr.exe50⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bbntbn.exec:\bbntbn.exe51⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pjvdv.exec:\pjvdv.exe52⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5llxrrf.exec:\5llxrrf.exe53⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xxllrrx.exec:\xxllrrx.exe54⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hbtnth.exec:\hbtnth.exe55⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hbnnbn.exec:\hbnnbn.exe56⤵
- Executes dropped EXE
PID:852 -
\??\c:\hhthhn.exec:\hhthhn.exe57⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vpjvj.exec:\vpjvj.exe58⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pjjvj.exec:\pjjvj.exe59⤵
- Executes dropped EXE
PID:1716 -
\??\c:\frxllrf.exec:\frxllrf.exe60⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3llrrxf.exec:\3llrrxf.exe61⤵
- Executes dropped EXE
PID:2104 -
\??\c:\btbnht.exec:\btbnht.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\7httbt.exec:\7httbt.exe63⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jjvvj.exec:\jjvvj.exe64⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jdvjv.exec:\jdvjv.exe65⤵
- Executes dropped EXE
PID:588 -
\??\c:\dvjpv.exec:\dvjpv.exe66⤵PID:112
-
\??\c:\rxffrrf.exec:\rxffrrf.exe67⤵PID:1460
-
\??\c:\xrlxffl.exec:\xrlxffl.exe68⤵PID:980
-
\??\c:\hhtbtt.exec:\hhtbtt.exe69⤵PID:1876
-
\??\c:\bthnth.exec:\bthnth.exe70⤵PID:2968
-
\??\c:\djvpd.exec:\djvpd.exe71⤵PID:240
-
\??\c:\ddppv.exec:\ddppv.exe72⤵PID:328
-
\??\c:\xrllxxf.exec:\xrllxxf.exe73⤵PID:792
-
\??\c:\fflrllx.exec:\fflrllx.exe74⤵PID:2168
-
\??\c:\bhhhtb.exec:\bhhhtb.exe75⤵PID:1344
-
\??\c:\vvvjv.exec:\vvvjv.exe76⤵PID:1776
-
\??\c:\jvddj.exec:\jvddj.exe77⤵PID:896
-
\??\c:\5xrrxxl.exec:\5xrrxxl.exe78⤵PID:2360
-
\??\c:\xrfflrf.exec:\xrfflrf.exe79⤵PID:2984
-
\??\c:\1xlxflx.exec:\1xlxflx.exe80⤵PID:1604
-
\??\c:\htbhnn.exec:\htbhnn.exe81⤵PID:1704
-
\??\c:\tntnth.exec:\tntnth.exe82⤵PID:2540
-
\??\c:\vdppd.exec:\vdppd.exe83⤵PID:2604
-
\??\c:\jdvpv.exec:\jdvpv.exe84⤵PID:2956
-
\??\c:\lfxxrff.exec:\lfxxrff.exe85⤵PID:2464
-
\??\c:\xrxlxxf.exec:\xrxlxxf.exe86⤵PID:2572
-
\??\c:\9hbbhn.exec:\9hbbhn.exe87⤵PID:2484
-
\??\c:\nnhnhh.exec:\nnhnhh.exe88⤵PID:2520
-
\??\c:\9pdvj.exec:\9pdvj.exe89⤵PID:2488
-
\??\c:\jdjvj.exec:\jdjvj.exe90⤵PID:2576
-
\??\c:\xfxrxxr.exec:\xfxrxxr.exe91⤵PID:3024
-
\??\c:\7lxxxlx.exec:\7lxxxlx.exe92⤵PID:2472
-
\??\c:\nbttbt.exec:\nbttbt.exe93⤵PID:1980
-
\??\c:\tttbth.exec:\tttbth.exe94⤵PID:1396
-
\??\c:\vppdj.exec:\vppdj.exe95⤵PID:2672
-
\??\c:\ddvdd.exec:\ddvdd.exe96⤵PID:2884
-
\??\c:\rrrxfrf.exec:\rrrxfrf.exe97⤵PID:2752
-
\??\c:\flrfxll.exec:\flrfxll.exe98⤵PID:2772
-
\??\c:\ntttbt.exec:\ntttbt.exe99⤵PID:2868
-
\??\c:\bbnhbn.exec:\bbnhbn.exe100⤵PID:2892
-
\??\c:\vpjpp.exec:\vpjpp.exe101⤵PID:852
-
\??\c:\vjjjj.exec:\vjjjj.exe102⤵PID:2816
-
\??\c:\rlfflxf.exec:\rlfflxf.exe103⤵PID:1652
-
\??\c:\xrlrxff.exec:\xrlrxff.exe104⤵PID:2316
-
\??\c:\bnthbh.exec:\bnthbh.exe105⤵PID:1860
-
\??\c:\1dppd.exec:\1dppd.exe106⤵PID:1724
-
\??\c:\dvjjv.exec:\dvjjv.exe107⤵PID:2108
-
\??\c:\9frlrxl.exec:\9frlrxl.exe108⤵PID:2112
-
\??\c:\3rllrxl.exec:\3rllrxl.exe109⤵PID:1728
-
\??\c:\1nbntb.exec:\1nbntb.exe110⤵PID:1504
-
\??\c:\djvpp.exec:\djvpp.exe111⤵PID:1904
-
\??\c:\vjddd.exec:\vjddd.exe112⤵PID:1460
-
\??\c:\xrllrrx.exec:\xrllrrx.exe113⤵PID:980
-
\??\c:\rrrlfrl.exec:\rrrlfrl.exe114⤵PID:1064
-
\??\c:\nbttht.exec:\nbttht.exe115⤵PID:276
-
\??\c:\5hbhhb.exec:\5hbhhb.exe116⤵PID:2216
-
\??\c:\3dpvv.exec:\3dpvv.exe117⤵PID:692
-
\??\c:\1rrlrrx.exec:\1rrlrrx.exe118⤵PID:1312
-
\??\c:\lfrfxxl.exec:\lfrfxxl.exe119⤵PID:2364
-
\??\c:\hbtbbh.exec:\hbtbbh.exe120⤵PID:1768
-
\??\c:\5hthtt.exec:\5hthtt.exe121⤵PID:1756
-
\??\c:\vpvvj.exec:\vpvvj.exe122⤵PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-