Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 11:03
Behavioral task
behavioral1
Sample
d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe
-
Size
149KB
-
MD5
d2455368ec6b2b8ad238b5f70c7d6b50
-
SHA1
1fced3a52fec3a0d1a8dc27f5957fd05337749e7
-
SHA256
473a143992e66c610e862f0e0ee3a5a5dec6d94524e193628f5920d206d17b38
-
SHA512
333af17b9a8bbebdeeca4fcbebe502fd15b530ca2d06f9728b685cb970a87c49dbbf857128c8a8766536861401fbc05a36b40aafaacc2a4a3aeb240236e5890c
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4t7:kcm4FmowdHoSphraHcpOFltH4t7
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2824-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/540-203-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2116-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1216-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-466-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2116-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/384-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-640-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-712-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-839-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2980-1238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2064 xrlrxrf.exe 1996 3lfrrrf.exe 2312 vvvpd.exe 2932 3frxffr.exe 2632 3vpvj.exe 2720 rrxlrfr.exe 2688 xrfflfl.exe 2544 hbhbnt.exe 2464 jdjjp.exe 2484 frxlllr.exe 2804 tnbbbt.exe 1908 dpddp.exe 2188 lflrrrx.exe 2172 xxlrflx.exe 1824 9bbbnn.exe 2016 dvpvd.exe 2344 dvdjj.exe 1756 xflxffl.exe 1032 3hbbbh.exe 2968 pjpjv.exe 1628 rrrxlxl.exe 540 lffrrxr.exe 532 1btbhn.exe 2116 vvdpp.exe 1200 lllfrff.exe 2104 xrfflll.exe 1984 1pvdp.exe 1312 vjvjj.exe 1860 7xlrrrx.exe 1576 nhnbnt.exe 3064 jjjdv.exe 628 xrrfflr.exe 2124 7frxlrx.exe 2108 1bthnt.exe 912 1bnnbn.exe 2080 jdvdv.exe 2260 vpvjv.exe 1548 xxlllrf.exe 2872 tnbnnh.exe 1996 hbnttb.exe 2860 jdppp.exe 2536 7pddd.exe 2732 ffxfllr.exe 1580 5xrrrxf.exe 2568 btbnbh.exe 2620 bnhhhn.exe 2688 dvdpd.exe 2452 jpjpd.exe 2480 lrxrxrr.exe 2796 nnhttt.exe 1964 nnbhbb.exe 2804 vpvvv.exe 2168 vdjdv.exe 2304 frxxxfl.exe 1852 1btbtt.exe 1808 thhbbb.exe 1824 dvdjv.exe 2328 1lrrxrf.exe 1216 rlxxxxf.exe 1588 ttnthn.exe 320 ppdpp.exe 1032 pdvpv.exe 2476 3xrxxxf.exe 2656 hnnbbn.exe -
resource yara_rule behavioral1/memory/2824-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000015c85-5.dat upx behavioral1/memory/2824-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015cd9-18.dat upx behavioral1/memory/2064-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1996-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d24-27.dat upx behavioral1/memory/2312-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2312-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2932-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d44-38.dat upx behavioral1/memory/2932-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d4c-46.dat upx behavioral1/files/0x0007000000015e09-57.dat upx behavioral1/memory/2720-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e6d-64.dat upx behavioral1/files/0x0008000000016cb2-74.dat upx behavioral1/memory/2544-82-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2544-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ce4-83.dat upx behavioral1/memory/2464-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cf5-92.dat upx behavioral1/files/0x0006000000016cfd-100.dat upx behavioral1/memory/2484-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d05-111.dat upx behavioral1/memory/2804-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d0e-119.dat upx behavioral1/files/0x0006000000016d16-127.dat upx behavioral1/files/0x0006000000016d1f-134.dat upx behavioral1/files/0x0006000000016d32-143.dat upx behavioral1/files/0x0006000000016d36-150.dat upx behavioral1/memory/2016-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2344-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d3a-161.dat upx behavioral1/files/0x0006000000016d9f-168.dat upx behavioral1/memory/1756-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016da4-179.dat upx behavioral1/memory/1032-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016db3-186.dat upx behavioral1/memory/2968-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016e78-196.dat upx behavioral1/files/0x0006000000016fe8-205.dat upx behavioral1/memory/532-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001739d-214.dat upx behavioral1/memory/2116-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173e5-223.dat upx behavioral1/memory/2116-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001744c-232.dat upx behavioral1/memory/2104-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015ce3-240.dat upx behavioral1/files/0x00060000000175ac-248.dat upx behavioral1/memory/1312-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1860-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175b2-258.dat upx behavioral1/files/0x00060000000175b8-265.dat upx behavioral1/files/0x001500000001863c-275.dat upx behavioral1/memory/1576-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3064-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018640-284.dat upx behavioral1/memory/2108-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1548-331-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2064 2824 d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe 28 PID 2824 wrote to memory of 2064 2824 d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe 28 PID 2824 wrote to memory of 2064 2824 d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe 28 PID 2824 wrote to memory of 2064 2824 d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe 28 PID 2064 wrote to memory of 1996 2064 xrlrxrf.exe 29 PID 2064 wrote to memory of 1996 2064 xrlrxrf.exe 29 PID 2064 wrote to memory of 1996 2064 xrlrxrf.exe 29 PID 2064 wrote to memory of 1996 2064 xrlrxrf.exe 29 PID 1996 wrote to memory of 2312 1996 3lfrrrf.exe 30 PID 1996 wrote to memory of 2312 1996 3lfrrrf.exe 30 PID 1996 wrote to memory of 2312 1996 3lfrrrf.exe 30 PID 1996 wrote to memory of 2312 1996 3lfrrrf.exe 30 PID 2312 wrote to memory of 2932 2312 vvvpd.exe 31 PID 2312 wrote to memory of 2932 2312 vvvpd.exe 31 PID 2312 wrote to memory of 2932 2312 vvvpd.exe 31 PID 2312 wrote to memory of 2932 2312 vvvpd.exe 31 PID 2932 wrote to memory of 2632 2932 3frxffr.exe 32 PID 2932 wrote to memory of 2632 2932 3frxffr.exe 32 PID 2932 wrote to memory of 2632 2932 3frxffr.exe 32 PID 2932 wrote to memory of 2632 2932 3frxffr.exe 32 PID 2632 wrote to memory of 2720 2632 3vpvj.exe 33 PID 2632 wrote to memory of 2720 2632 3vpvj.exe 33 PID 2632 wrote to memory of 2720 2632 3vpvj.exe 33 PID 2632 wrote to memory of 2720 2632 3vpvj.exe 33 PID 2720 wrote to memory of 2688 2720 rrxlrfr.exe 34 PID 2720 wrote to memory of 2688 2720 rrxlrfr.exe 34 PID 2720 wrote to memory of 2688 2720 rrxlrfr.exe 34 PID 2720 wrote to memory of 2688 2720 rrxlrfr.exe 34 PID 2688 wrote to memory of 2544 2688 xrfflfl.exe 35 PID 2688 wrote to memory of 2544 2688 xrfflfl.exe 35 PID 2688 wrote to memory of 2544 2688 xrfflfl.exe 35 PID 2688 wrote to memory of 2544 2688 xrfflfl.exe 35 PID 2544 wrote to memory of 2464 2544 hbhbnt.exe 36 PID 2544 wrote to memory of 2464 2544 hbhbnt.exe 36 PID 2544 wrote to memory of 2464 2544 hbhbnt.exe 36 PID 2544 wrote to memory of 2464 2544 hbhbnt.exe 36 PID 2464 wrote to memory of 2484 2464 jdjjp.exe 37 PID 2464 wrote to memory of 2484 2464 jdjjp.exe 37 PID 2464 wrote to memory of 2484 2464 jdjjp.exe 37 PID 2464 wrote to memory of 2484 2464 jdjjp.exe 37 PID 2484 wrote to memory of 2804 2484 frxlllr.exe 38 PID 2484 wrote to memory of 2804 2484 frxlllr.exe 38 PID 2484 wrote to memory of 2804 2484 frxlllr.exe 38 PID 2484 wrote to memory of 2804 2484 frxlllr.exe 38 PID 2804 wrote to memory of 1908 2804 tnbbbt.exe 39 PID 2804 wrote to memory of 1908 2804 tnbbbt.exe 39 PID 2804 wrote to memory of 1908 2804 tnbbbt.exe 39 PID 2804 wrote to memory of 1908 2804 tnbbbt.exe 39 PID 1908 wrote to memory of 2188 1908 dpddp.exe 40 PID 1908 wrote to memory of 2188 1908 dpddp.exe 40 PID 1908 wrote to memory of 2188 1908 dpddp.exe 40 PID 1908 wrote to memory of 2188 1908 dpddp.exe 40 PID 2188 wrote to memory of 2172 2188 lflrrrx.exe 41 PID 2188 wrote to memory of 2172 2188 lflrrrx.exe 41 PID 2188 wrote to memory of 2172 2188 lflrrrx.exe 41 PID 2188 wrote to memory of 2172 2188 lflrrrx.exe 41 PID 2172 wrote to memory of 1824 2172 xxlrflx.exe 42 PID 2172 wrote to memory of 1824 2172 xxlrflx.exe 42 PID 2172 wrote to memory of 1824 2172 xxlrflx.exe 42 PID 2172 wrote to memory of 1824 2172 xxlrflx.exe 42 PID 1824 wrote to memory of 2016 1824 9bbbnn.exe 43 PID 1824 wrote to memory of 2016 1824 9bbbnn.exe 43 PID 1824 wrote to memory of 2016 1824 9bbbnn.exe 43 PID 1824 wrote to memory of 2016 1824 9bbbnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xrlrxrf.exec:\xrlrxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\3lfrrrf.exec:\3lfrrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\vvvpd.exec:\vvvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\3frxffr.exec:\3frxffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\3vpvj.exec:\3vpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\rrxlrfr.exec:\rrxlrfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xrfflfl.exec:\xrfflfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\hbhbnt.exec:\hbhbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jdjjp.exec:\jdjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\frxlllr.exec:\frxlllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\tnbbbt.exec:\tnbbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\dpddp.exec:\dpddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\lflrrrx.exec:\lflrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\xxlrflx.exec:\xxlrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\9bbbnn.exec:\9bbbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\dvpvd.exec:\dvpvd.exe17⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dvdjj.exec:\dvdjj.exe18⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xflxffl.exec:\xflxffl.exe19⤵
- Executes dropped EXE
PID:1756 -
\??\c:\3hbbbh.exec:\3hbbbh.exe20⤵
- Executes dropped EXE
PID:1032 -
\??\c:\pjpjv.exec:\pjpjv.exe21⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rrrxlxl.exec:\rrrxlxl.exe22⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lffrrxr.exec:\lffrrxr.exe23⤵
- Executes dropped EXE
PID:540 -
\??\c:\1btbhn.exec:\1btbhn.exe24⤵
- Executes dropped EXE
PID:532 -
\??\c:\vvdpp.exec:\vvdpp.exe25⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lllfrff.exec:\lllfrff.exe26⤵
- Executes dropped EXE
PID:1200 -
\??\c:\xrfflll.exec:\xrfflll.exe27⤵
- Executes dropped EXE
PID:2104 -
\??\c:\1pvdp.exec:\1pvdp.exe28⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vjvjj.exec:\vjvjj.exe29⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7xlrrrx.exec:\7xlrrrx.exe30⤵
- Executes dropped EXE
PID:1860 -
\??\c:\nhnbnt.exec:\nhnbnt.exe31⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jjjdv.exec:\jjjdv.exe32⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xrrfflr.exec:\xrrfflr.exe33⤵
- Executes dropped EXE
PID:628 -
\??\c:\7frxlrx.exec:\7frxlrx.exe34⤵
- Executes dropped EXE
PID:2124 -
\??\c:\1bthnt.exec:\1bthnt.exe35⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1bnnbn.exec:\1bnnbn.exe36⤵
- Executes dropped EXE
PID:912 -
\??\c:\jdvdv.exec:\jdvdv.exe37⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vpvjv.exec:\vpvjv.exe38⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xxlllrf.exec:\xxlllrf.exe39⤵
- Executes dropped EXE
PID:1548 -
\??\c:\tnbnnh.exec:\tnbnnh.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hbnttb.exec:\hbnttb.exe41⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jdppp.exec:\jdppp.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\7pddd.exec:\7pddd.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ffxfllr.exec:\ffxfllr.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5xrrrxf.exec:\5xrrrxf.exe45⤵
- Executes dropped EXE
PID:1580 -
\??\c:\btbnbh.exec:\btbnbh.exe46⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bnhhhn.exec:\bnhhhn.exe47⤵
- Executes dropped EXE
PID:2620 -
\??\c:\dvdpd.exec:\dvdpd.exe48⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jpjpd.exec:\jpjpd.exe49⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lrxrxrr.exec:\lrxrxrr.exe50⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nnhttt.exec:\nnhttt.exe51⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nnbhbb.exec:\nnbhbb.exe52⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vpvvv.exec:\vpvvv.exe53⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vdjdv.exec:\vdjdv.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\frxxxfl.exec:\frxxxfl.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\1btbtt.exec:\1btbtt.exe56⤵
- Executes dropped EXE
PID:1852 -
\??\c:\thhbbb.exec:\thhbbb.exe57⤵
- Executes dropped EXE
PID:1808 -
\??\c:\dvdjv.exec:\dvdjv.exe58⤵
- Executes dropped EXE
PID:1824 -
\??\c:\1lrrxrf.exec:\1lrrxrf.exe59⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe60⤵
- Executes dropped EXE
PID:1216 -
\??\c:\ttnthn.exec:\ttnthn.exe61⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ppdpp.exec:\ppdpp.exe62⤵
- Executes dropped EXE
PID:320 -
\??\c:\pdvpv.exec:\pdvpv.exe63⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3xrxxxf.exec:\3xrxxxf.exe64⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hnnbbn.exec:\hnnbbn.exe65⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bbtthn.exec:\bbtthn.exe66⤵PID:2112
-
\??\c:\jvvpv.exec:\jvvpv.exe67⤵PID:800
-
\??\c:\vpvdj.exec:\vpvdj.exe68⤵PID:1232
-
\??\c:\rrfrlxr.exec:\rrfrlxr.exe69⤵PID:600
-
\??\c:\btnthh.exec:\btnthh.exe70⤵PID:2116
-
\??\c:\tntnnn.exec:\tntnnn.exe71⤵PID:852
-
\??\c:\jpdpp.exec:\jpdpp.exe72⤵PID:2348
-
\??\c:\rlrflrx.exec:\rlrflrx.exe73⤵PID:356
-
\??\c:\5rflxff.exec:\5rflxff.exe74⤵PID:1500
-
\??\c:\hbhntt.exec:\hbhntt.exe75⤵PID:1312
-
\??\c:\ddpvj.exec:\ddpvj.exe76⤵PID:1856
-
\??\c:\jvvjp.exec:\jvvjp.exe77⤵PID:3016
-
\??\c:\llflfxl.exec:\llflfxl.exe78⤵PID:1576
-
\??\c:\tthnbn.exec:\tthnbn.exe79⤵PID:3064
-
\??\c:\thntnn.exec:\thntnn.exe80⤵PID:384
-
\??\c:\dpjjj.exec:\dpjjj.exe81⤵PID:108
-
\??\c:\rrxrxll.exec:\rrxrxll.exe82⤵PID:1840
-
\??\c:\hbnnbn.exec:\hbnnbn.exe83⤵PID:2364
-
\??\c:\ntbnht.exec:\ntbnht.exe84⤵PID:2276
-
\??\c:\1jdjj.exec:\1jdjj.exe85⤵PID:1468
-
\??\c:\lfllllr.exec:\lfllllr.exe86⤵PID:856
-
\??\c:\rlffflx.exec:\rlffflx.exe87⤵PID:1336
-
\??\c:\bhthbt.exec:\bhthbt.exe88⤵PID:2624
-
\??\c:\vjvjj.exec:\vjvjj.exe89⤵PID:1996
-
\??\c:\vppdp.exec:\vppdp.exe90⤵PID:2980
-
\??\c:\rrllxfx.exec:\rrllxfx.exe91⤵PID:2604
-
\??\c:\tnbnht.exec:\tnbnht.exe92⤵PID:2876
-
\??\c:\7httbn.exec:\7httbn.exe93⤵PID:2524
-
\??\c:\vpddd.exec:\vpddd.exe94⤵PID:2580
-
\??\c:\3ddjd.exec:\3ddjd.exe95⤵PID:2448
-
\??\c:\bbhnnb.exec:\bbhnnb.exe96⤵PID:2424
-
\??\c:\vvjpv.exec:\vvjpv.exe97⤵PID:2316
-
\??\c:\lxrxrxx.exec:\lxrxrxx.exe98⤵PID:2460
-
\??\c:\lxlxffx.exec:\lxlxffx.exe99⤵PID:2176
-
\??\c:\bbbhtb.exec:\bbbhtb.exe100⤵PID:1820
-
\??\c:\9hnbbb.exec:\9hnbbb.exe101⤵PID:2340
-
\??\c:\jjjpv.exec:\jjjpv.exe102⤵PID:2188
-
\??\c:\jjvvv.exec:\jjvvv.exe103⤵PID:2372
-
\??\c:\fxxxxff.exec:\fxxxxff.exe104⤵PID:2004
-
\??\c:\thtntt.exec:\thtntt.exe105⤵PID:2164
-
\??\c:\9tttbt.exec:\9tttbt.exe106⤵PID:776
-
\??\c:\vjpvj.exec:\vjpvj.exe107⤵PID:292
-
\??\c:\pvvjv.exec:\pvvjv.exe108⤵PID:300
-
\??\c:\rrrxfrl.exec:\rrrxfrl.exe109⤵PID:1572
-
\??\c:\tbtbhh.exec:\tbtbhh.exe110⤵PID:1584
-
\??\c:\hbntth.exec:\hbntth.exe111⤵PID:3020
-
\??\c:\3ppjd.exec:\3ppjd.exe112⤵PID:2468
-
\??\c:\rrxrrll.exec:\rrxrrll.exe113⤵PID:1028
-
\??\c:\rlrrffl.exec:\rlrrffl.exe114⤵PID:336
-
\??\c:\bthntt.exec:\bthntt.exe115⤵PID:1416
-
\??\c:\9djvv.exec:\9djvv.exe116⤵PID:272
-
\??\c:\vvvpv.exec:\vvvpv.exe117⤵PID:2248
-
\??\c:\3fxlllr.exec:\3fxlllr.exe118⤵PID:2272
-
\??\c:\9xflrrf.exec:\9xflrrf.exe119⤵PID:1904
-
\??\c:\3bnhhb.exec:\3bnhhb.exe120⤵PID:1912
-
\??\c:\9dvvd.exec:\9dvvd.exe121⤵PID:1868
-
\??\c:\ddpjd.exec:\ddpjd.exe122⤵PID:2924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-