Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 10:49
Behavioral task
behavioral1
Sample
47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe
-
Size
328KB
-
MD5
47a611a6179a1a1cf8a30bc02b20cad0
-
SHA1
e53be27e43cf6d5632a9633ae87583fb524fc173
-
SHA256
0ac2d2b89bff167b4323ecd3ae7b7cd48e9372187c92d66bd32100c1a365708e
-
SHA512
8adf55dd97589c3c49afa57b088ad06153ede82c3c7505f3867a725a1ae8d0d60438e36424e1e3dc98ab58d1884e879dbe61f70d838bf527d05111c2c4d8dd78
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR:R4wFHoSHYHUrAwfMp3CDR
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2964-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/588-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/292-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-305-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2580-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/800-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-726-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-808-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2972-871-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1760-1150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-1166-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2352-13889-0x0000000077820000-0x000000007793F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2552 dpjdd.exe 2092 nhnhnn.exe 2560 pjppd.exe 2676 fxfflll.exe 2620 nhtntn.exe 2788 xlfflxr.exe 2876 pdjdp.exe 2640 xxffrrf.exe 2480 djjvd.exe 2856 fllfrlx.exe 2128 btntht.exe 2764 dpjvj.exe 2732 xllflfr.exe 1148 ddvdp.exe 2720 rxlflrf.exe 2896 bnttth.exe 828 jdvdv.exe 1800 hnnhth.exe 2144 fxrrxxx.exe 1616 3nthnn.exe 1976 ppvjj.exe 588 ntnnnn.exe 1128 djjjp.exe 1476 5lxfrfl.exe 1916 hbbnht.exe 1928 hhhnbt.exe 2432 fxlxfll.exe 2168 llflrrl.exe 1612 htnbtb.exe 856 dvvjd.exe 292 lfrrlfl.exe 1980 bnnbtt.exe 1752 frrrllr.exe 2088 bbtntb.exe 2076 5nhhbb.exe 1684 dvpdv.exe 1664 fffxlxl.exe 1952 bntbht.exe 2244 jjvvd.exe 2924 djjpd.exe 2148 ffrxllf.exe 2976 hbntbn.exe 2576 btbnbb.exe 2072 vddpd.exe 2680 lrxllxr.exe 2596 bbthtb.exe 1764 jjvpv.exe 1184 djjpd.exe 2804 lxllxrf.exe 2684 nntbht.exe 1940 dvpvv.exe 2580 jpdvv.exe 2032 lrfllll.exe 1112 nnhntn.exe 2064 dvjpd.exe 2484 rrrxfrf.exe 2528 hhnthh.exe 1956 tbtttn.exe 2340 dvpjd.exe 1148 ffrrfxr.exe 2864 nhbntn.exe 3052 9tbthb.exe 1376 1ppvd.exe 2104 lxfxxxx.exe -
resource yara_rule behavioral1/memory/2964-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000015f7a-5.dat upx behavioral1/memory/2552-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016a29-15.dat upx behavioral1/memory/2552-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c04-24.dat upx behavioral1/memory/2092-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c51-32.dat upx behavioral1/files/0x0007000000016c7c-38.dat upx behavioral1/memory/2620-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016ca5-48.dat upx behavioral1/files/0x000a000000016cb6-55.dat upx behavioral1/files/0x0008000000016cc6-61.dat upx behavioral1/memory/2876-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d16-70.dat upx behavioral1/memory/2640-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d1a-80.dat upx behavioral1/memory/2480-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d3e-88.dat upx behavioral1/files/0x0006000000016d51-96.dat upx behavioral1/files/0x0006000000016d57-103.dat upx behavioral1/memory/2764-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016e24-111.dat upx behavioral1/memory/2732-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016e4a-120.dat upx behavioral1/files/0x0006000000016fed-128.dat upx behavioral1/memory/2720-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001735a-135.dat upx behavioral1/memory/828-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1800-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017371-143.dat upx behavioral1/memory/1800-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016be2-152.dat upx behavioral1/memory/2144-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017374-160.dat upx behavioral1/files/0x000600000001737c-167.dat upx behavioral1/memory/1976-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173f2-175.dat upx behavioral1/files/0x0006000000017407-182.dat upx behavioral1/memory/588-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017422-190.dat upx behavioral1/memory/1476-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174a5-197.dat upx behavioral1/files/0x00140000000185e9-206.dat upx behavioral1/files/0x000d0000000185f4-213.dat upx behavioral1/memory/2432-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2432-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001860c-222.dat upx behavioral1/memory/2168-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018717-230.dat upx behavioral1/memory/1612-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018ba1-239.dat upx behavioral1/files/0x0006000000018bab-246.dat upx behavioral1/memory/292-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018ed8-253.dat upx behavioral1/memory/1752-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1952-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2924-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2072-319-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2552 2964 47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe 28 PID 2964 wrote to memory of 2552 2964 47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe 28 PID 2964 wrote to memory of 2552 2964 47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe 28 PID 2964 wrote to memory of 2552 2964 47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe 28 PID 2552 wrote to memory of 2092 2552 dpjdd.exe 29 PID 2552 wrote to memory of 2092 2552 dpjdd.exe 29 PID 2552 wrote to memory of 2092 2552 dpjdd.exe 29 PID 2552 wrote to memory of 2092 2552 dpjdd.exe 29 PID 2092 wrote to memory of 2560 2092 nhnhnn.exe 30 PID 2092 wrote to memory of 2560 2092 nhnhnn.exe 30 PID 2092 wrote to memory of 2560 2092 nhnhnn.exe 30 PID 2092 wrote to memory of 2560 2092 nhnhnn.exe 30 PID 2560 wrote to memory of 2676 2560 pjppd.exe 31 PID 2560 wrote to memory of 2676 2560 pjppd.exe 31 PID 2560 wrote to memory of 2676 2560 pjppd.exe 31 PID 2560 wrote to memory of 2676 2560 pjppd.exe 31 PID 2676 wrote to memory of 2620 2676 fxfflll.exe 32 PID 2676 wrote to memory of 2620 2676 fxfflll.exe 32 PID 2676 wrote to memory of 2620 2676 fxfflll.exe 32 PID 2676 wrote to memory of 2620 2676 fxfflll.exe 32 PID 2620 wrote to memory of 2788 2620 nhtntn.exe 33 PID 2620 wrote to memory of 2788 2620 nhtntn.exe 33 PID 2620 wrote to memory of 2788 2620 nhtntn.exe 33 PID 2620 wrote to memory of 2788 2620 nhtntn.exe 33 PID 2788 wrote to memory of 2876 2788 xlfflxr.exe 34 PID 2788 wrote to memory of 2876 2788 xlfflxr.exe 34 PID 2788 wrote to memory of 2876 2788 xlfflxr.exe 34 PID 2788 wrote to memory of 2876 2788 xlfflxr.exe 34 PID 2876 wrote to memory of 2640 2876 pdjdp.exe 35 PID 2876 wrote to memory of 2640 2876 pdjdp.exe 35 PID 2876 wrote to memory of 2640 2876 pdjdp.exe 35 PID 2876 wrote to memory of 2640 2876 pdjdp.exe 35 PID 2640 wrote to memory of 2480 2640 xxffrrf.exe 36 PID 2640 wrote to memory of 2480 2640 xxffrrf.exe 36 PID 2640 wrote to memory of 2480 2640 xxffrrf.exe 36 PID 2640 wrote to memory of 2480 2640 xxffrrf.exe 36 PID 2480 wrote to memory of 2856 2480 djjvd.exe 37 PID 2480 wrote to memory of 2856 2480 djjvd.exe 37 PID 2480 wrote to memory of 2856 2480 djjvd.exe 37 PID 2480 wrote to memory of 2856 2480 djjvd.exe 37 PID 2856 wrote to memory of 2128 2856 fllfrlx.exe 38 PID 2856 wrote to memory of 2128 2856 fllfrlx.exe 38 PID 2856 wrote to memory of 2128 2856 fllfrlx.exe 38 PID 2856 wrote to memory of 2128 2856 fllfrlx.exe 38 PID 2128 wrote to memory of 2764 2128 btntht.exe 39 PID 2128 wrote to memory of 2764 2128 btntht.exe 39 PID 2128 wrote to memory of 2764 2128 btntht.exe 39 PID 2128 wrote to memory of 2764 2128 btntht.exe 39 PID 2764 wrote to memory of 2732 2764 dpjvj.exe 40 PID 2764 wrote to memory of 2732 2764 dpjvj.exe 40 PID 2764 wrote to memory of 2732 2764 dpjvj.exe 40 PID 2764 wrote to memory of 2732 2764 dpjvj.exe 40 PID 2732 wrote to memory of 1148 2732 xllflfr.exe 41 PID 2732 wrote to memory of 1148 2732 xllflfr.exe 41 PID 2732 wrote to memory of 1148 2732 xllflfr.exe 41 PID 2732 wrote to memory of 1148 2732 xllflfr.exe 41 PID 1148 wrote to memory of 2720 1148 ddvdp.exe 42 PID 1148 wrote to memory of 2720 1148 ddvdp.exe 42 PID 1148 wrote to memory of 2720 1148 ddvdp.exe 42 PID 1148 wrote to memory of 2720 1148 ddvdp.exe 42 PID 2720 wrote to memory of 2896 2720 rxlflrf.exe 43 PID 2720 wrote to memory of 2896 2720 rxlflrf.exe 43 PID 2720 wrote to memory of 2896 2720 rxlflrf.exe 43 PID 2720 wrote to memory of 2896 2720 rxlflrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\47a611a6179a1a1cf8a30bc02b20cad0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\dpjdd.exec:\dpjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\nhnhnn.exec:\nhnhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\pjppd.exec:\pjppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\fxfflll.exec:\fxfflll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\nhtntn.exec:\nhtntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xlfflxr.exec:\xlfflxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\pdjdp.exec:\pdjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xxffrrf.exec:\xxffrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\djjvd.exec:\djjvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\fllfrlx.exec:\fllfrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\btntht.exec:\btntht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\dpjvj.exec:\dpjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xllflfr.exec:\xllflfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ddvdp.exec:\ddvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\rxlflrf.exec:\rxlflrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bnttth.exec:\bnttth.exe17⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jdvdv.exec:\jdvdv.exe18⤵
- Executes dropped EXE
PID:828 -
\??\c:\hnnhth.exec:\hnnhth.exe19⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxrrxxx.exec:\fxrrxxx.exe20⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3nthnn.exec:\3nthnn.exe21⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ppvjj.exec:\ppvjj.exe22⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ntnnnn.exec:\ntnnnn.exe23⤵
- Executes dropped EXE
PID:588 -
\??\c:\djjjp.exec:\djjjp.exe24⤵
- Executes dropped EXE
PID:1128 -
\??\c:\5lxfrfl.exec:\5lxfrfl.exe25⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hbbnht.exec:\hbbnht.exe26⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hhhnbt.exec:\hhhnbt.exe27⤵
- Executes dropped EXE
PID:1928 -
\??\c:\fxlxfll.exec:\fxlxfll.exe28⤵
- Executes dropped EXE
PID:2432 -
\??\c:\llflrrl.exec:\llflrrl.exe29⤵
- Executes dropped EXE
PID:2168 -
\??\c:\htnbtb.exec:\htnbtb.exe30⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dvvjd.exec:\dvvjd.exe31⤵
- Executes dropped EXE
PID:856 -
\??\c:\lfrrlfl.exec:\lfrrlfl.exe32⤵
- Executes dropped EXE
PID:292 -
\??\c:\bnnbtt.exec:\bnnbtt.exe33⤵
- Executes dropped EXE
PID:1980 -
\??\c:\frrrllr.exec:\frrrllr.exe34⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bbtntb.exec:\bbtntb.exe35⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5nhhbb.exec:\5nhhbb.exe36⤵
- Executes dropped EXE
PID:2076 -
\??\c:\dvpdv.exec:\dvpdv.exe37⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fffxlxl.exec:\fffxlxl.exe38⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bntbht.exec:\bntbht.exe39⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jjvvd.exec:\jjvvd.exe40⤵
- Executes dropped EXE
PID:2244 -
\??\c:\djjpd.exec:\djjpd.exe41⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ffrxllf.exec:\ffrxllf.exe42⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hbntbn.exec:\hbntbn.exe43⤵
- Executes dropped EXE
PID:2976 -
\??\c:\btbnbb.exec:\btbnbb.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vddpd.exec:\vddpd.exe45⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lrxllxr.exec:\lrxllxr.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bbthtb.exec:\bbthtb.exe47⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjvpv.exec:\jjvpv.exe48⤵
- Executes dropped EXE
PID:1764 -
\??\c:\djjpd.exec:\djjpd.exe49⤵
- Executes dropped EXE
PID:1184 -
\??\c:\lxllxrf.exec:\lxllxrf.exe50⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nntbht.exec:\nntbht.exe51⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dvpvv.exec:\dvpvv.exe52⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jpdvv.exec:\jpdvv.exe53⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lrfllll.exec:\lrfllll.exe54⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nnhntn.exec:\nnhntn.exe55⤵
- Executes dropped EXE
PID:1112 -
\??\c:\dvjpd.exec:\dvjpd.exe56⤵
- Executes dropped EXE
PID:2064 -
\??\c:\rrrxfrf.exec:\rrrxfrf.exe57⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hhnthh.exec:\hhnthh.exe58⤵
- Executes dropped EXE
PID:2528 -
\??\c:\tbtttn.exec:\tbtttn.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\dvpjd.exec:\dvpjd.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\ffrrfxr.exec:\ffrrfxr.exe61⤵
- Executes dropped EXE
PID:1148 -
\??\c:\nhbntn.exec:\nhbntn.exe62⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9tbthb.exec:\9tbthb.exe63⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1ppvd.exec:\1ppvd.exe64⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\llxlllr.exec:\llxlllr.exe66⤵PID:1768
-
\??\c:\pjdpd.exec:\pjdpd.exe67⤵PID:1800
-
\??\c:\dvpdp.exec:\dvpdp.exe68⤵PID:1276
-
\??\c:\lxrlrxx.exec:\lxrlrxx.exe69⤵PID:2388
-
\??\c:\tthtnh.exec:\tthtnh.exe70⤵PID:2252
-
\??\c:\ddppv.exec:\ddppv.exe71⤵PID:1976
-
\??\c:\ddpvj.exec:\ddpvj.exe72⤵PID:716
-
\??\c:\5rrlfrr.exec:\5rrlfrr.exe73⤵PID:1192
-
\??\c:\ntbbhn.exec:\ntbbhn.exe74⤵PID:1480
-
\??\c:\htbhbt.exec:\htbhbt.exe75⤵PID:800
-
\??\c:\dvjvv.exec:\dvjvv.exe76⤵PID:1140
-
\??\c:\rlllfrl.exec:\rlllfrl.exe77⤵PID:1284
-
\??\c:\nbnnnn.exec:\nbnnnn.exe78⤵PID:2308
-
\??\c:\pvpjp.exec:\pvpjp.exe79⤵PID:2448
-
\??\c:\vvdjp.exec:\vvdjp.exe80⤵PID:1560
-
\??\c:\xffrlrf.exec:\xffrlrf.exe81⤵PID:1512
-
\??\c:\thhhbt.exec:\thhhbt.exe82⤵PID:376
-
\??\c:\pdpdd.exec:\pdpdd.exe83⤵PID:856
-
\??\c:\frffrxl.exec:\frffrxl.exe84⤵PID:292
-
\??\c:\xfffxrr.exec:\xfffxrr.exe85⤵PID:2012
-
\??\c:\btnhhh.exec:\btnhhh.exe86⤵PID:948
-
\??\c:\dpvjv.exec:\dpvjv.exe87⤵PID:2040
-
\??\c:\xlxrflr.exec:\xlxrflr.exe88⤵PID:2288
-
\??\c:\tnnnbt.exec:\tnnnbt.exe89⤵PID:1468
-
\??\c:\vjvvv.exec:\vjvvv.exe90⤵PID:2240
-
\??\c:\9vdjp.exec:\9vdjp.exe91⤵PID:1440
-
\??\c:\xrrrffl.exec:\xrrrffl.exe92⤵PID:1156
-
\??\c:\nhtbhn.exec:\nhtbhn.exe93⤵PID:2656
-
\??\c:\ttntht.exec:\ttntht.exe94⤵PID:2972
-
\??\c:\3pddj.exec:\3pddj.exe95⤵PID:2296
-
\??\c:\xxflfrf.exec:\xxflfrf.exe96⤵PID:2920
-
\??\c:\lxfxlrf.exec:\lxfxlrf.exe97⤵PID:1624
-
\??\c:\hbtthh.exec:\hbtthh.exe98⤵PID:2072
-
\??\c:\ddvjp.exec:\ddvjp.exe99⤵PID:2680
-
\??\c:\5rxrrxr.exec:\5rxrrxr.exe100⤵PID:2596
-
\??\c:\hhhhhb.exec:\hhhhhb.exe101⤵PID:2772
-
\??\c:\jjdjd.exec:\jjdjd.exe102⤵PID:2784
-
\??\c:\jjvdj.exec:\jjvdj.exe103⤵PID:2804
-
\??\c:\flffrxr.exec:\flffrxr.exe104⤵PID:2292
-
\??\c:\ttbbnb.exec:\ttbbnb.exe105⤵PID:2532
-
\??\c:\vpjpd.exec:\vpjpd.exe106⤵PID:2640
-
\??\c:\lrrrrfx.exec:\lrrrrfx.exe107⤵PID:3024
-
\??\c:\htthhh.exec:\htthhh.exe108⤵PID:2636
-
\??\c:\vdjdj.exec:\vdjdj.exe109⤵PID:1740
-
\??\c:\jpjpv.exec:\jpjpv.exe110⤵PID:2888
-
\??\c:\lxfxlxl.exec:\lxfxlxl.exe111⤵PID:3064
-
\??\c:\ttbtnn.exec:\ttbtnn.exe112⤵PID:1100
-
\??\c:\ppvdp.exec:\ppvdp.exe113⤵PID:2736
-
\??\c:\9jvjj.exec:\9jvjj.exe114⤵PID:2556
-
\??\c:\lfxrflr.exec:\lfxrflr.exe115⤵PID:1548
-
\??\c:\bbhhbn.exec:\bbhhbn.exe116⤵PID:964
-
\??\c:\7pdpv.exec:\7pdpv.exe117⤵PID:1376
-
\??\c:\jvvdp.exec:\jvvdp.exe118⤵PID:1660
-
\??\c:\xlflllr.exec:\xlflllr.exe119⤵PID:1564
-
\??\c:\bttnbb.exec:\bttnbb.exe120⤵PID:1908
-
\??\c:\1ddjv.exec:\1ddjv.exe121⤵PID:1276
-
\??\c:\ttnthh.exec:\ttnthh.exe122⤵PID:2204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-