Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 18:01
Behavioral task
behavioral1
Sample
0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe
-
Size
400KB
-
MD5
0796a93ef6c63cdacc00d4f1e15442a0
-
SHA1
c99e9e53e241a149f0cb18d1a21df95d1275207c
-
SHA256
c83151cb9efce4dd25d26f27ba613ba4b1a55e95db6cd40ae198bb48d298b0a1
-
SHA512
c09fa5a7f4240600ae6df433c1f1579a69b9e72e7683cde9e5d83200d93032073bbc8449f01551636c5fcb3c0a7ebea732079f2f0be3df7f6c779a48cc4d4d03
-
SSDEEP
6144:Jcm4FmowdHoSEubDcAkOCOu0EajNVBZr6y2WXxLO1UqW9E3R:T4wFHoSEubD2P3R
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/2216-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1264-11-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2272-35-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2568-45-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2592-47-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1312-63-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2768-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2680-81-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2148-92-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2704-108-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2764-118-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1568-139-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1584-135-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1536-154-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2896-190-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/540-199-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1484-208-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1872-225-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2092-245-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1060-262-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1788-271-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2400-315-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2272-349-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2736-362-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2616-382-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2460-389-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2704-416-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/636-429-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1996-443-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1632-450-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2084-572-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/832-730-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2716-938-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3068-1207-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1264 nnhnhh.exe 1156 jjpjd.exe 2272 rrlxffl.exe 2568 bbtnbb.exe 2592 3flrffr.exe 1312 bbbntb.exe 2768 xrxxlrl.exe 2680 bttbtt.exe 2504 ppjvj.exe 2148 lfxxflr.exe 2704 ttttbn.exe 2764 vjddv.exe 2828 tnhtbh.exe 1584 jvjjj.exe 1568 bbtthn.exe 1536 tnbbhh.exe 2948 fxxlxfr.exe 2108 thtnbn.exe 2256 rlxlllx.exe 2896 hntbht.exe 540 jjjvj.exe 1484 nnnhht.exe 708 rfrflxf.exe 1872 hhtthn.exe 2408 5dppv.exe 2092 ttntht.exe 1556 3vdjd.exe 1060 llxlrlf.exe 1788 djjvj.exe 1800 1xxlflx.exe 2920 pppjv.exe 1696 xrlrrrx.exe 1724 9hbhtt.exe 1064 7jjdd.exe 2400 rxxfxfx.exe 1604 lfrllfx.exe 2992 3htbnt.exe 2196 vvpvp.exe 2156 llrxrfx.exe 2272 hhhhbb.exe 2636 ntnnhb.exe 2736 3ppdp.exe 2600 fxrrrxf.exe 2724 ntbnbb.exe 2616 pjddj.exe 2460 lxrrrrx.exe 2608 nntbnn.exe 2684 jjppv.exe 2148 vvvdp.exe 2704 rxrxlll.exe 2812 nhhhnn.exe 636 pddpd.exe 908 nnhthn.exe 1996 bbttht.exe 1644 pjdjv.exe 1632 llrrxrf.exe 1520 lrrxlxx.exe 2296 1bttnb.exe 2000 3jpjj.exe 1456 lfrxflr.exe 2300 nnhntb.exe 2904 7djvv.exe 596 jppjd.exe 2292 xlfrlrf.exe -
resource yara_rule behavioral1/memory/2216-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2216-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x000b00000001565d-5.dat upx behavioral1/memory/1264-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0034000000015cb6-17.dat upx behavioral1/files/0x0007000000015cff-24.dat upx behavioral1/files/0x0007000000015d20-33.dat upx behavioral1/memory/2272-35-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2568-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0007000000015d42-43.dat upx behavioral1/memory/2568-45-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2592-47-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0007000000015d4e-54.dat upx behavioral1/files/0x0009000000015d56-61.dat upx behavioral1/memory/1312-63-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2768-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x000800000001658a-72.dat upx behavioral1/memory/2680-81-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016616-82.dat upx behavioral1/files/0x0006000000016851-90.dat upx behavioral1/memory/2148-92-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016adc-101.dat upx behavioral1/memory/2704-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2704-108-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016c44-109.dat upx behavioral1/files/0x0006000000016c5e-116.dat upx behavioral1/memory/2764-118-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016c64-125.dat upx behavioral1/files/0x0006000000016cb0-136.dat upx behavioral1/memory/1568-139-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016cdc-145.dat upx behavioral1/files/0x0006000000016d07-155.dat upx behavioral1/memory/1536-154-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016d18-163.dat upx behavioral1/files/0x0034000000015ccd-173.dat upx behavioral1/files/0x0006000000016d20-181.dat upx behavioral1/memory/2896-182-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2896-190-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016d34-191.dat upx behavioral1/memory/540-199-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016d3a-200.dat upx behavioral1/memory/1484-208-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016d3e-209.dat upx behavioral1/files/0x0006000000016d43-217.dat upx behavioral1/memory/1872-225-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016d5f-226.dat upx behavioral1/files/0x0006000000016d74-234.dat upx behavioral1/memory/2092-235-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016d8e-246.dat upx behavioral1/memory/2092-242-0x0000000000320000-0x0000000000348000-memory.dmp upx behavioral1/memory/2092-245-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016d9d-254.dat upx behavioral1/memory/1060-262-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016da5-263.dat upx behavioral1/files/0x0006000000016db1-272.dat upx behavioral1/memory/1788-271-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000016db9-280.dat upx behavioral1/files/0x0006000000016dbe-288.dat upx behavioral1/memory/2400-308-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2400-315-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2196-329-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2272-342-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2272-349-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2736-362-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 1264 2216 0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe 28 PID 2216 wrote to memory of 1264 2216 0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe 28 PID 2216 wrote to memory of 1264 2216 0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe 28 PID 2216 wrote to memory of 1264 2216 0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe 28 PID 1264 wrote to memory of 1156 1264 nnhnhh.exe 29 PID 1264 wrote to memory of 1156 1264 nnhnhh.exe 29 PID 1264 wrote to memory of 1156 1264 nnhnhh.exe 29 PID 1264 wrote to memory of 1156 1264 nnhnhh.exe 29 PID 1156 wrote to memory of 2272 1156 jjpjd.exe 30 PID 1156 wrote to memory of 2272 1156 jjpjd.exe 30 PID 1156 wrote to memory of 2272 1156 jjpjd.exe 30 PID 1156 wrote to memory of 2272 1156 jjpjd.exe 30 PID 2272 wrote to memory of 2568 2272 rrlxffl.exe 31 PID 2272 wrote to memory of 2568 2272 rrlxffl.exe 31 PID 2272 wrote to memory of 2568 2272 rrlxffl.exe 31 PID 2272 wrote to memory of 2568 2272 rrlxffl.exe 31 PID 2568 wrote to memory of 2592 2568 bbtnbb.exe 32 PID 2568 wrote to memory of 2592 2568 bbtnbb.exe 32 PID 2568 wrote to memory of 2592 2568 bbtnbb.exe 32 PID 2568 wrote to memory of 2592 2568 bbtnbb.exe 32 PID 2592 wrote to memory of 1312 2592 3flrffr.exe 33 PID 2592 wrote to memory of 1312 2592 3flrffr.exe 33 PID 2592 wrote to memory of 1312 2592 3flrffr.exe 33 PID 2592 wrote to memory of 1312 2592 3flrffr.exe 33 PID 1312 wrote to memory of 2768 1312 bbbntb.exe 34 PID 1312 wrote to memory of 2768 1312 bbbntb.exe 34 PID 1312 wrote to memory of 2768 1312 bbbntb.exe 34 PID 1312 wrote to memory of 2768 1312 bbbntb.exe 34 PID 2768 wrote to memory of 2680 2768 xrxxlrl.exe 35 PID 2768 wrote to memory of 2680 2768 xrxxlrl.exe 35 PID 2768 wrote to memory of 2680 2768 xrxxlrl.exe 35 PID 2768 wrote to memory of 2680 2768 xrxxlrl.exe 35 PID 2680 wrote to memory of 2504 2680 bttbtt.exe 36 PID 2680 wrote to memory of 2504 2680 bttbtt.exe 36 PID 2680 wrote to memory of 2504 2680 bttbtt.exe 36 PID 2680 wrote to memory of 2504 2680 bttbtt.exe 36 PID 2504 wrote to memory of 2148 2504 ppjvj.exe 37 PID 2504 wrote to memory of 2148 2504 ppjvj.exe 37 PID 2504 wrote to memory of 2148 2504 ppjvj.exe 37 PID 2504 wrote to memory of 2148 2504 ppjvj.exe 37 PID 2148 wrote to memory of 2704 2148 lfxxflr.exe 38 PID 2148 wrote to memory of 2704 2148 lfxxflr.exe 38 PID 2148 wrote to memory of 2704 2148 lfxxflr.exe 38 PID 2148 wrote to memory of 2704 2148 lfxxflr.exe 38 PID 2704 wrote to memory of 2764 2704 ttttbn.exe 39 PID 2704 wrote to memory of 2764 2704 ttttbn.exe 39 PID 2704 wrote to memory of 2764 2704 ttttbn.exe 39 PID 2704 wrote to memory of 2764 2704 ttttbn.exe 39 PID 2764 wrote to memory of 2828 2764 vjddv.exe 40 PID 2764 wrote to memory of 2828 2764 vjddv.exe 40 PID 2764 wrote to memory of 2828 2764 vjddv.exe 40 PID 2764 wrote to memory of 2828 2764 vjddv.exe 40 PID 2828 wrote to memory of 1584 2828 tnhtbh.exe 41 PID 2828 wrote to memory of 1584 2828 tnhtbh.exe 41 PID 2828 wrote to memory of 1584 2828 tnhtbh.exe 41 PID 2828 wrote to memory of 1584 2828 tnhtbh.exe 41 PID 1584 wrote to memory of 1568 1584 jvjjj.exe 42 PID 1584 wrote to memory of 1568 1584 jvjjj.exe 42 PID 1584 wrote to memory of 1568 1584 jvjjj.exe 42 PID 1584 wrote to memory of 1568 1584 jvjjj.exe 42 PID 1568 wrote to memory of 1536 1568 bbtthn.exe 43 PID 1568 wrote to memory of 1536 1568 bbtthn.exe 43 PID 1568 wrote to memory of 1536 1568 bbtthn.exe 43 PID 1568 wrote to memory of 1536 1568 bbtthn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\nnhnhh.exec:\nnhnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\jjpjd.exec:\jjpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\rrlxffl.exec:\rrlxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\bbtnbb.exec:\bbtnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\3flrffr.exec:\3flrffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\bbbntb.exec:\bbbntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\xrxxlrl.exec:\xrxxlrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\bttbtt.exec:\bttbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ppjvj.exec:\ppjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lfxxflr.exec:\lfxxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\ttttbn.exec:\ttttbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vjddv.exec:\vjddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\tnhtbh.exec:\tnhtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\jvjjj.exec:\jvjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\bbtthn.exec:\bbtthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\tnbbhh.exec:\tnbbhh.exe17⤵
- Executes dropped EXE
PID:1536 -
\??\c:\fxxlxfr.exec:\fxxlxfr.exe18⤵
- Executes dropped EXE
PID:2948 -
\??\c:\thtnbn.exec:\thtnbn.exe19⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rlxlllx.exec:\rlxlllx.exe20⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hntbht.exec:\hntbht.exe21⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jjjvj.exec:\jjjvj.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\nnnhht.exec:\nnnhht.exe23⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rfrflxf.exec:\rfrflxf.exe24⤵
- Executes dropped EXE
PID:708 -
\??\c:\hhtthn.exec:\hhtthn.exe25⤵
- Executes dropped EXE
PID:1872 -
\??\c:\5dppv.exec:\5dppv.exe26⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ttntht.exec:\ttntht.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3vdjd.exec:\3vdjd.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\llxlrlf.exec:\llxlrlf.exe29⤵
- Executes dropped EXE
PID:1060 -
\??\c:\djjvj.exec:\djjvj.exe30⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1xxlflx.exec:\1xxlflx.exe31⤵
- Executes dropped EXE
PID:1800 -
\??\c:\pppjv.exec:\pppjv.exe32⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xrlrrrx.exec:\xrlrrrx.exe33⤵
- Executes dropped EXE
PID:1696 -
\??\c:\9hbhtt.exec:\9hbhtt.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\7jjdd.exec:\7jjdd.exe35⤵
- Executes dropped EXE
PID:1064 -
\??\c:\rxxfxfx.exec:\rxxfxfx.exe36⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lfrllfx.exec:\lfrllfx.exe37⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3htbnt.exec:\3htbnt.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vvpvp.exec:\vvpvp.exe39⤵
- Executes dropped EXE
PID:2196 -
\??\c:\llrxrfx.exec:\llrxrfx.exe40⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hhhhbb.exec:\hhhhbb.exe41⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ntnnhb.exec:\ntnnhb.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\3ppdp.exec:\3ppdp.exe43⤵
- Executes dropped EXE
PID:2736 -
\??\c:\fxrrrxf.exec:\fxrrrxf.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ntbnbb.exec:\ntbnbb.exe45⤵
- Executes dropped EXE
PID:2724 -
\??\c:\pjddj.exec:\pjddj.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe47⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nntbnn.exec:\nntbnn.exe48⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jjppv.exec:\jjppv.exe49⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vvvdp.exec:\vvvdp.exe50⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rxrxlll.exec:\rxrxlll.exe51⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nhhhnn.exec:\nhhhnn.exe52⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pddpd.exec:\pddpd.exe53⤵
- Executes dropped EXE
PID:636 -
\??\c:\nnhthn.exec:\nnhthn.exe54⤵
- Executes dropped EXE
PID:908 -
\??\c:\bbttht.exec:\bbttht.exe55⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pjdjv.exec:\pjdjv.exe56⤵
- Executes dropped EXE
PID:1644 -
\??\c:\llrrxrf.exec:\llrrxrf.exe57⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lrrxlxx.exec:\lrrxlxx.exe58⤵
- Executes dropped EXE
PID:1520 -
\??\c:\1bttnb.exec:\1bttnb.exe59⤵
- Executes dropped EXE
PID:2296 -
\??\c:\3jpjj.exec:\3jpjj.exe60⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lfrxflr.exec:\lfrxflr.exe61⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nnhntb.exec:\nnhntb.exe62⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7djvv.exec:\7djvv.exe63⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jppjd.exec:\jppjd.exe64⤵
- Executes dropped EXE
PID:596 -
\??\c:\xlfrlrf.exec:\xlfrlrf.exe65⤵
- Executes dropped EXE
PID:2292 -
\??\c:\bbtbhh.exec:\bbtbhh.exe66⤵PID:2004
-
\??\c:\9jdjp.exec:\9jdjp.exe67⤵PID:1004
-
\??\c:\ffxrlrf.exec:\ffxrlrf.exe68⤵PID:1872
-
\??\c:\bhhbnb.exec:\bhhbnb.exe69⤵PID:2412
-
\??\c:\1vppv.exec:\1vppv.exe70⤵PID:2100
-
\??\c:\jjdpv.exec:\jjdpv.exe71⤵PID:1068
-
\??\c:\9xlllrx.exec:\9xlllrx.exe72⤵PID:1344
-
\??\c:\hhtbnt.exec:\hhtbnt.exe73⤵PID:660
-
\??\c:\vvjvj.exec:\vvjvj.exe74⤵PID:928
-
\??\c:\djdpp.exec:\djdpp.exe75⤵PID:1224
-
\??\c:\lffrflf.exec:\lffrflf.exe76⤵PID:2084
-
\??\c:\bhnhnh.exec:\bhnhnh.exe77⤵PID:2072
-
\??\c:\ppppj.exec:\ppppj.exe78⤵PID:2944
-
\??\c:\xfxllfr.exec:\xfxllfr.exe79⤵PID:892
-
\??\c:\thntnh.exec:\thntnh.exe80⤵PID:2996
-
\??\c:\5vvdd.exec:\5vvdd.exe81⤵PID:1608
-
\??\c:\fxxllxf.exec:\fxxllxf.exe82⤵PID:1576
-
\??\c:\nbhhnn.exec:\nbhhnn.exe83⤵PID:3048
-
\??\c:\tbttnh.exec:\tbttnh.exe84⤵PID:2880
-
\??\c:\vvpdd.exec:\vvpdd.exe85⤵PID:2196
-
\??\c:\lfflrlr.exec:\lfflrlr.exe86⤵PID:3044
-
\??\c:\bttnth.exec:\bttnth.exe87⤵PID:2664
-
\??\c:\dvpvj.exec:\dvpvj.exe88⤵PID:2572
-
\??\c:\fxffrlx.exec:\fxffrlx.exe89⤵PID:2832
-
\??\c:\tntthn.exec:\tntthn.exe90⤵PID:1312
-
\??\c:\jpvdv.exec:\jpvdv.exe91⤵PID:2440
-
\??\c:\rlrrllx.exec:\rlrrllx.exe92⤵PID:2552
-
\??\c:\nhtntt.exec:\nhtntt.exe93⤵PID:2680
-
\??\c:\7bnthn.exec:\7bnthn.exe94⤵PID:2064
-
\??\c:\pdvvj.exec:\pdvvj.exe95⤵PID:2972
-
\??\c:\lxrxffr.exec:\lxrxffr.exe96⤵PID:2684
-
\??\c:\nhbtbh.exec:\nhbtbh.exe97⤵PID:2700
-
\??\c:\ppjjj.exec:\ppjjj.exe98⤵PID:2796
-
\??\c:\rlrrfrf.exec:\rlrrfrf.exe99⤵PID:2864
-
\??\c:\nnhhnt.exec:\nnhhnt.exe100⤵PID:2784
-
\??\c:\btbbnh.exec:\btbbnh.exe101⤵PID:832
-
\??\c:\5jdjd.exec:\5jdjd.exe102⤵PID:1568
-
\??\c:\lfxxffl.exec:\lfxxffl.exe103⤵PID:1640
-
\??\c:\thnhtt.exec:\thnhtt.exe104⤵PID:1536
-
\??\c:\vpddd.exec:\vpddd.exe105⤵PID:2076
-
\??\c:\pvdpv.exec:\pvdpv.exe106⤵PID:2976
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe107⤵PID:1912
-
\??\c:\bhnthn.exec:\bhnthn.exe108⤵PID:2892
-
\??\c:\vvpdp.exec:\vvpdp.exe109⤵PID:2900
-
\??\c:\rlxrrlx.exec:\rlxrrlx.exe110⤵PID:1368
-
\??\c:\tnhhbt.exec:\tnhhbt.exe111⤵PID:588
-
\??\c:\pjdpv.exec:\pjdpv.exe112⤵PID:2852
-
\??\c:\3lffxxr.exec:\3lffxxr.exe113⤵PID:1792
-
\??\c:\fxlllrf.exec:\fxlllrf.exe114⤵PID:1140
-
\??\c:\ttbbht.exec:\ttbbht.exe115⤵PID:2320
-
\??\c:\3vjdp.exec:\3vjdp.exe116⤵PID:2376
-
\??\c:\jjddv.exec:\jjddv.exe117⤵PID:1772
-
\??\c:\llrlffx.exec:\llrlffx.exe118⤵PID:1556
-
\??\c:\btntbb.exec:\btntbb.exe119⤵PID:1824
-
\??\c:\jdddj.exec:\jdddj.exe120⤵PID:404
-
\??\c:\1vpjp.exec:\1vpjp.exe121⤵PID:928
-
\??\c:\xrlllfl.exec:\xrlllfl.exe122⤵PID:1788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-