Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 01:32
Behavioral task
behavioral1
Sample
6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe
-
Size
164KB
-
MD5
6e1b8d80fc75dfc92364fc9fc73bbec0
-
SHA1
bcc4b9b909e233dea2eada661ef6f275929d290c
-
SHA256
90cf4049488b01928353a1532bd34f5912f57d767f95199281104c05d42e339a
-
SHA512
3adaf765b7383d7acd6ae1a51a2915a34418224f08561597f3f10c995779544d0744cef82ce657d9f5b5f7f420c2e156af31f40d70e3f23095ae60ac0800de3d
-
SSDEEP
3072:0hOmTsF93UYfwC6GIoutXEnkeBahPmSBPt7ZY16E:0cm4FmowdHoSet4hPhTlY4E
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1712-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-70-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2576-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1140-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-163-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2760-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/584-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1084-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-251-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1028-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/908-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/356-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-685-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-684-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2192-745-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1672-772-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1644-843-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1808-1173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/752-1180-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2092 5tbttn.exe 2600 9pddv.exe 3032 ffxffrf.exe 2804 ttnhnt.exe 2676 5vpvj.exe 2680 vpvjv.exe 2544 xlffffx.exe 2576 1btbnn.exe 2592 dvpvp.exe 2980 5xxxflf.exe 1704 tnbtbb.exe 2580 7lllxfr.exe 1824 ttnbtb.exe 2196 djddv.exe 1140 lrlflfl.exe 1996 pdvdp.exe 2760 dpvjp.exe 584 hthbnh.exe 1092 1jdjv.exe 1620 rrfrxrl.exe 2956 hnhbhb.exe 2360 dvjvj.exe 1084 rlflffl.exe 2696 bbbbnt.exe 1496 5vdjv.exe 1776 pdjdd.exe 1540 3bnthn.exe 1880 dvvjj.exe 1028 pddpp.exe 752 9thhnt.exe 496 9jjpv.exe 1252 rlxflrf.exe 908 btthnt.exe 1724 jjpdv.exe 3040 1pjvp.exe 1328 1xxlfff.exe 1708 tbbbbt.exe 860 vvpdj.exe 2832 vvjpv.exe 2900 ffrfrfr.exe 2644 nthbht.exe 2896 jddjd.exe 2656 pjdvp.exe 2444 ffxlllf.exe 2520 bhntth.exe 2564 bhbtnh.exe 2596 jjjdd.exe 356 xxrllll.exe 1684 hnhnbb.exe 1704 vvvjj.exe 2720 flxfrll.exe 1284 3rllrfl.exe 1032 nnnbnb.exe 2196 nhnbbn.exe 1928 ppppj.exe 2000 5xlrxxl.exe 2412 xxrrxfr.exe 596 7bnnbh.exe 1168 nnbhnt.exe 2440 1dpvd.exe 2768 xxrxffl.exe 1544 9btbhn.exe 2340 bnhnth.exe 2304 9vddp.exe -
resource yara_rule behavioral1/memory/1712-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b00000001227b-5.dat upx behavioral1/memory/2092-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0039000000016255-17.dat upx behavioral1/memory/2600-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016abb-25.dat upx behavioral1/memory/3032-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c56-36.dat upx behavioral1/memory/3032-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c71-45.dat upx behavioral1/files/0x0009000000016c7a-53.dat upx behavioral1/memory/2680-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016cc3-63.dat upx behavioral1/files/0x0006000000016de7-82.dat upx behavioral1/memory/2576-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dde-74.dat upx behavioral1/files/0x0006000000016eb9-90.dat upx behavioral1/memory/2592-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017042-99.dat upx behavioral1/memory/1704-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1704-104-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000017477-107.dat upx behavioral1/memory/2580-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1704-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017486-120.dat upx behavioral1/memory/2580-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017495-127.dat upx behavioral1/memory/1824-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018663-138.dat upx behavioral1/memory/1996-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0014000000018669-148.dat upx behavioral1/memory/1140-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001100000001867a-156.dat upx behavioral1/memory/2760-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018686-165.dat upx behavioral1/files/0x00050000000186e6-175.dat upx behavioral1/memory/584-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186f1-181.dat upx behavioral1/memory/1620-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186ff-192.dat upx behavioral1/files/0x0005000000018739-199.dat upx behavioral1/memory/2360-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00390000000164a9-209.dat upx behavioral1/files/0x000500000001873f-216.dat upx behavioral1/memory/1084-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018787-227.dat upx behavioral1/files/0x000500000001878d-234.dat upx behavioral1/files/0x0006000000018bf0-242.dat upx behavioral1/files/0x0005000000019228-253.dat upx behavioral1/files/0x000500000001923b-261.dat upx behavioral1/files/0x000500000001925d-271.dat upx behavioral1/memory/1028-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019260-278.dat upx behavioral1/memory/1252-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019275-287.dat upx behavioral1/memory/1252-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/908-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1724-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1328-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2832-341-0x00000000001B0000-0x00000000001D7000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2092 1712 6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2092 1712 6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2092 1712 6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2092 1712 6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe 28 PID 2092 wrote to memory of 2600 2092 5tbttn.exe 29 PID 2092 wrote to memory of 2600 2092 5tbttn.exe 29 PID 2092 wrote to memory of 2600 2092 5tbttn.exe 29 PID 2092 wrote to memory of 2600 2092 5tbttn.exe 29 PID 2600 wrote to memory of 3032 2600 9pddv.exe 30 PID 2600 wrote to memory of 3032 2600 9pddv.exe 30 PID 2600 wrote to memory of 3032 2600 9pddv.exe 30 PID 2600 wrote to memory of 3032 2600 9pddv.exe 30 PID 3032 wrote to memory of 2804 3032 ffxffrf.exe 31 PID 3032 wrote to memory of 2804 3032 ffxffrf.exe 31 PID 3032 wrote to memory of 2804 3032 ffxffrf.exe 31 PID 3032 wrote to memory of 2804 3032 ffxffrf.exe 31 PID 2804 wrote to memory of 2676 2804 ttnhnt.exe 32 PID 2804 wrote to memory of 2676 2804 ttnhnt.exe 32 PID 2804 wrote to memory of 2676 2804 ttnhnt.exe 32 PID 2804 wrote to memory of 2676 2804 ttnhnt.exe 32 PID 2676 wrote to memory of 2680 2676 5vpvj.exe 33 PID 2676 wrote to memory of 2680 2676 5vpvj.exe 33 PID 2676 wrote to memory of 2680 2676 5vpvj.exe 33 PID 2676 wrote to memory of 2680 2676 5vpvj.exe 33 PID 2680 wrote to memory of 2544 2680 vpvjv.exe 34 PID 2680 wrote to memory of 2544 2680 vpvjv.exe 34 PID 2680 wrote to memory of 2544 2680 vpvjv.exe 34 PID 2680 wrote to memory of 2544 2680 vpvjv.exe 34 PID 2544 wrote to memory of 2576 2544 xlffffx.exe 35 PID 2544 wrote to memory of 2576 2544 xlffffx.exe 35 PID 2544 wrote to memory of 2576 2544 xlffffx.exe 35 PID 2544 wrote to memory of 2576 2544 xlffffx.exe 35 PID 2576 wrote to memory of 2592 2576 1btbnn.exe 36 PID 2576 wrote to memory of 2592 2576 1btbnn.exe 36 PID 2576 wrote to memory of 2592 2576 1btbnn.exe 36 PID 2576 wrote to memory of 2592 2576 1btbnn.exe 36 PID 2592 wrote to memory of 2980 2592 dvpvp.exe 37 PID 2592 wrote to memory of 2980 2592 dvpvp.exe 37 PID 2592 wrote to memory of 2980 2592 dvpvp.exe 37 PID 2592 wrote to memory of 2980 2592 dvpvp.exe 37 PID 2980 wrote to memory of 1704 2980 5xxxflf.exe 38 PID 2980 wrote to memory of 1704 2980 5xxxflf.exe 38 PID 2980 wrote to memory of 1704 2980 5xxxflf.exe 38 PID 2980 wrote to memory of 1704 2980 5xxxflf.exe 38 PID 1704 wrote to memory of 2580 1704 tnbtbb.exe 39 PID 1704 wrote to memory of 2580 1704 tnbtbb.exe 39 PID 1704 wrote to memory of 2580 1704 tnbtbb.exe 39 PID 1704 wrote to memory of 2580 1704 tnbtbb.exe 39 PID 2580 wrote to memory of 1824 2580 7lllxfr.exe 40 PID 2580 wrote to memory of 1824 2580 7lllxfr.exe 40 PID 2580 wrote to memory of 1824 2580 7lllxfr.exe 40 PID 2580 wrote to memory of 1824 2580 7lllxfr.exe 40 PID 1824 wrote to memory of 2196 1824 ttnbtb.exe 41 PID 1824 wrote to memory of 2196 1824 ttnbtb.exe 41 PID 1824 wrote to memory of 2196 1824 ttnbtb.exe 41 PID 1824 wrote to memory of 2196 1824 ttnbtb.exe 41 PID 2196 wrote to memory of 1140 2196 djddv.exe 42 PID 2196 wrote to memory of 1140 2196 djddv.exe 42 PID 2196 wrote to memory of 1140 2196 djddv.exe 42 PID 2196 wrote to memory of 1140 2196 djddv.exe 42 PID 1140 wrote to memory of 1996 1140 lrlflfl.exe 43 PID 1140 wrote to memory of 1996 1140 lrlflfl.exe 43 PID 1140 wrote to memory of 1996 1140 lrlflfl.exe 43 PID 1140 wrote to memory of 1996 1140 lrlflfl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\5tbttn.exec:\5tbttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\9pddv.exec:\9pddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\ffxffrf.exec:\ffxffrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\ttnhnt.exec:\ttnhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\5vpvj.exec:\5vpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vpvjv.exec:\vpvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xlffffx.exec:\xlffffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\1btbnn.exec:\1btbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\dvpvp.exec:\dvpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\5xxxflf.exec:\5xxxflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\tnbtbb.exec:\tnbtbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\7lllxfr.exec:\7lllxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ttnbtb.exec:\ttnbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\djddv.exec:\djddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\lrlflfl.exec:\lrlflfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\pdvdp.exec:\pdvdp.exe17⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dpvjp.exec:\dpvjp.exe18⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hthbnh.exec:\hthbnh.exe19⤵
- Executes dropped EXE
PID:584 -
\??\c:\1jdjv.exec:\1jdjv.exe20⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rrfrxrl.exec:\rrfrxrl.exe21⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hnhbhb.exec:\hnhbhb.exe22⤵
- Executes dropped EXE
PID:2956 -
\??\c:\dvjvj.exec:\dvjvj.exe23⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rlflffl.exec:\rlflffl.exe24⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bbbbnt.exec:\bbbbnt.exe25⤵
- Executes dropped EXE
PID:2696 -
\??\c:\5vdjv.exec:\5vdjv.exe26⤵
- Executes dropped EXE
PID:1496 -
\??\c:\pdjdd.exec:\pdjdd.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\3bnthn.exec:\3bnthn.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\dvvjj.exec:\dvvjj.exe29⤵
- Executes dropped EXE
PID:1880 -
\??\c:\pddpp.exec:\pddpp.exe30⤵
- Executes dropped EXE
PID:1028 -
\??\c:\9thhnt.exec:\9thhnt.exe31⤵
- Executes dropped EXE
PID:752 -
\??\c:\9jjpv.exec:\9jjpv.exe32⤵
- Executes dropped EXE
PID:496 -
\??\c:\rlxflrf.exec:\rlxflrf.exe33⤵
- Executes dropped EXE
PID:1252 -
\??\c:\btthnt.exec:\btthnt.exe34⤵
- Executes dropped EXE
PID:908 -
\??\c:\jjpdv.exec:\jjpdv.exe35⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1pjvp.exec:\1pjvp.exe36⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1xxlfff.exec:\1xxlfff.exe37⤵
- Executes dropped EXE
PID:1328 -
\??\c:\tbbbbt.exec:\tbbbbt.exe38⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vvpdj.exec:\vvpdj.exe39⤵
- Executes dropped EXE
PID:860 -
\??\c:\vvjpv.exec:\vvjpv.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nthbht.exec:\nthbht.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\jddjd.exec:\jddjd.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pjdvp.exec:\pjdvp.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ffxlllf.exec:\ffxlllf.exe45⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bhntth.exec:\bhntth.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bhbtnh.exec:\bhbtnh.exe47⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jjjdd.exec:\jjjdd.exe48⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xxrllll.exec:\xxrllll.exe49⤵
- Executes dropped EXE
PID:356 -
\??\c:\hnhnbb.exec:\hnhnbb.exe50⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vvvjj.exec:\vvvjj.exe51⤵
- Executes dropped EXE
PID:1704 -
\??\c:\flxfrll.exec:\flxfrll.exe52⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3rllrfl.exec:\3rllrfl.exe53⤵
- Executes dropped EXE
PID:1284 -
\??\c:\nnnbnb.exec:\nnnbnb.exe54⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nhnbbn.exec:\nhnbbn.exe55⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ppppj.exec:\ppppj.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\5xlrxxl.exec:\5xlrxxl.exe57⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xxrrxfr.exec:\xxrrxfr.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7bnnbh.exec:\7bnnbh.exe59⤵
- Executes dropped EXE
PID:596 -
\??\c:\nnbhnt.exec:\nnbhnt.exe60⤵
- Executes dropped EXE
PID:1168 -
\??\c:\1dpvd.exec:\1dpvd.exe61⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xxrxffl.exec:\xxrxffl.exe62⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9btbhn.exec:\9btbhn.exe63⤵
- Executes dropped EXE
PID:1544 -
\??\c:\bnhnth.exec:\bnhnth.exe64⤵
- Executes dropped EXE
PID:2340 -
\??\c:\9vddp.exec:\9vddp.exe65⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ddpvj.exec:\ddpvj.exe66⤵PID:2052
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe67⤵PID:1308
-
\??\c:\tbhtbb.exec:\tbhtbb.exe68⤵PID:964
-
\??\c:\bthnbb.exec:\bthnbb.exe69⤵PID:3052
-
\??\c:\vpjjp.exec:\vpjjp.exe70⤵PID:1388
-
\??\c:\1xxlllr.exec:\1xxlllr.exe71⤵PID:1536
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe72⤵PID:2012
-
\??\c:\bbnbtt.exec:\bbnbtt.exe73⤵PID:1880
-
\??\c:\7pjdj.exec:\7pjdj.exe74⤵PID:1104
-
\??\c:\7llxlrf.exec:\7llxlrf.exe75⤵PID:1028
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe76⤵PID:2032
-
\??\c:\hhtnhn.exec:\hhtnhn.exe77⤵PID:1312
-
\??\c:\nbnthb.exec:\nbnthb.exe78⤵PID:904
-
\??\c:\ddvpd.exec:\ddvpd.exe79⤵PID:2024
-
\??\c:\rlrxxll.exec:\rlrxxll.exe80⤵PID:1464
-
\??\c:\tbnhht.exec:\tbnhht.exe81⤵PID:3020
-
\??\c:\vvppj.exec:\vvppj.exe82⤵PID:1572
-
\??\c:\vvpdv.exec:\vvpdv.exe83⤵PID:2604
-
\??\c:\flfrlxr.exec:\flfrlxr.exe84⤵PID:2624
-
\??\c:\hbbnnn.exec:\hbbnnn.exe85⤵PID:2660
-
\??\c:\nhnhtn.exec:\nhnhtn.exe86⤵PID:2676
-
\??\c:\jjddp.exec:\jjddp.exe87⤵PID:2556
-
\??\c:\lllxrxr.exec:\lllxrxr.exe88⤵PID:2680
-
\??\c:\7llxrxl.exec:\7llxrxl.exe89⤵PID:2684
-
\??\c:\ttnbtt.exec:\ttnbtt.exe90⤵PID:2780
-
\??\c:\hnbhbb.exec:\hnbhbb.exe91⤵PID:2572
-
\??\c:\ppjvd.exec:\ppjvd.exe92⤵PID:2984
-
\??\c:\flrfrlf.exec:\flrfrlf.exe93⤵PID:1804
-
\??\c:\1lfxrrx.exec:\1lfxrrx.exe94⤵PID:2980
-
\??\c:\hbtnhn.exec:\hbtnhn.exe95⤵PID:2508
-
\??\c:\vvpvd.exec:\vvpvd.exe96⤵PID:2580
-
\??\c:\jddpd.exec:\jddpd.exe97⤵PID:1944
-
\??\c:\llxfxfr.exec:\llxfxfr.exe98⤵PID:2456
-
\??\c:\bbtbtb.exec:\bbtbtb.exe99⤵PID:2452
-
\??\c:\jdpjd.exec:\jdpjd.exe100⤵PID:2236
-
\??\c:\vdvpp.exec:\vdvpp.exe101⤵PID:1956
-
\??\c:\rxxrlxr.exec:\rxxrlxr.exe102⤵PID:2192
-
\??\c:\9lfrrrl.exec:\9lfrrrl.exe103⤵PID:2412
-
\??\c:\1hbnhh.exec:\1hbnhh.exe104⤵PID:1004
-
\??\c:\jjvvd.exec:\jjvvd.exe105⤵PID:1168
-
\??\c:\pdvvv.exec:\pdvvv.exe106⤵PID:1672
-
\??\c:\fxrxxxx.exec:\fxrxxxx.exe107⤵PID:2768
-
\??\c:\thbbbh.exec:\thbbbh.exe108⤵PID:2872
-
\??\c:\vpvdp.exec:\vpvdp.exe109⤵PID:2340
-
\??\c:\pdpjp.exec:\pdpjp.exe110⤵PID:2148
-
\??\c:\3rrllfl.exec:\3rrllfl.exe111⤵PID:2740
-
\??\c:\3thnbh.exec:\3thnbh.exe112⤵PID:2188
-
\??\c:\thhbhb.exec:\thhbhb.exe113⤵PID:656
-
\??\c:\7pppv.exec:\7pppv.exe114⤵PID:1664
-
\??\c:\3xrfxrx.exec:\3xrfxrx.exe115⤵PID:1612
-
\??\c:\tthhhh.exec:\tthhhh.exe116⤵PID:2244
-
\??\c:\5tbtbb.exec:\5tbtbb.exe117⤵PID:1644
-
\??\c:\5dvdv.exec:\5dvdv.exe118⤵PID:1788
-
\??\c:\9rffrxf.exec:\9rffrxf.exe119⤵PID:2096
-
\??\c:\llfrflf.exec:\llfrflf.exe120⤵PID:1188
-
\??\c:\ttthbh.exec:\ttthbh.exe121⤵PID:2208
-
\??\c:\jdvdv.exec:\jdvdv.exe122⤵PID:1768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-