Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 00:26
Behavioral task
behavioral1
Sample
5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe
-
Size
79KB
-
MD5
5c564f440fdf2cbff8f8288192ff6eb0
-
SHA1
6b43a548e106349e23c4f40e2d9ccba47eb41d13
-
SHA256
4f14a8811874722b45e093a72fc3a1678d4a8e7c65056fb803af396b5812fae5
-
SHA512
e9e50113bc4afdd220124dbe67e256f15a6961e483684f0fb7a2ee219037248cc28854672958113b26a7aafe0a760952ea8f808127cbac609cfe810e85dbd2b2
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7A:zhOmTsF93UYfwC6GIoutiTU2HVS63A
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2164-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/316-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1132-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1132-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-664-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-722-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-745-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2512-786-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1132-797-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1604-839-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2864-894-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-949-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1692-1080-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2572-1129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-22888-0x00000000774C0000-0x00000000775DF000-memory.dmp family_blackmoon behavioral1/memory/2064-24045-0x00000000774C0000-0x00000000775DF000-memory.dmp family_blackmoon behavioral1/memory/2064-26649-0x00000000774C0000-0x00000000775DF000-memory.dmp family_blackmoon behavioral1/memory/2064-28101-0x00000000773C0000-0x00000000774BA000-memory.dmp family_blackmoon behavioral1/memory/2064-28392-0x00000000774C0000-0x00000000775DF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2372 dpdjp.exe 3044 fxxxlxx.exe 2680 tnnntb.exe 2760 ddppd.exe 2688 7xfrlxl.exe 2828 bhhhtt.exe 2900 jdvvv.exe 2652 jdppv.exe 2580 5fllxxl.exe 3020 3nthht.exe 1812 pvpdp.exe 2876 llxlflr.exe 3008 1tbnbh.exe 1620 ppjjv.exe 316 7jpdj.exe 340 rrlxfrf.exe 1576 5tnnbh.exe 1524 tnnbnn.exe 2808 vdppp.exe 1376 5flrflx.exe 1236 lfxxfxl.exe 2324 nhbhnh.exe 2960 9ddvd.exe 3068 ddvdv.exe 2328 rllfrff.exe 1144 ntbbbn.exe 840 vpjvv.exe 1776 3ppjv.exe 964 9xfxrfr.exe 1724 nnnhtt.exe 912 jdvdj.exe 1132 jjjvj.exe 1200 1lflrrf.exe 1932 3nhbhn.exe 2268 vpjpp.exe 1692 pjdjp.exe 2060 9xxxffr.exe 2368 xrxlrxf.exe 2404 hhhtbh.exe 1248 pdvvj.exe 1604 lxxfflx.exe 2728 xxflxxr.exe 2748 btbnnh.exe 2304 jdvdp.exe 2840 3jvvd.exe 2688 lrlfxlr.exe 2564 ththbt.exe 2704 bbtbtb.exe 2708 5pppv.exe 2616 jvvvp.exe 2580 3xfrxfx.exe 3028 btthth.exe 2792 tttntn.exe 2788 1jjdj.exe 2896 xlflfff.exe 2576 bbnbnb.exe 3008 tnhtbn.exe 1752 jdpvd.exe 1828 pjdvj.exe 2020 rlfxllx.exe 296 rlffrrx.exe 1452 tbtbth.exe 2804 9tnttn.exe 1584 vpjpv.exe -
resource yara_rule behavioral1/memory/2164-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b0000000122ee-6.dat upx behavioral1/memory/2372-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2164-3-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0037000000015d02-15.dat upx behavioral1/memory/3044-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d89-23.dat upx behavioral1/files/0x0008000000015d99-30.dat upx behavioral1/memory/2760-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015fbb-37.dat upx behavioral1/files/0x0007000000016020-46.dat upx behavioral1/memory/2688-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016126-53.dat upx behavioral1/memory/2828-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001640f-63.dat upx behavioral1/memory/2900-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d21-70.dat upx behavioral1/memory/2580-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d2d-79.dat upx behavioral1/memory/3020-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d36-86.dat upx behavioral1/memory/3020-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d3e-95.dat upx behavioral1/memory/1812-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d46-103.dat upx behavioral1/memory/3008-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4f-112.dat upx behavioral1/files/0x0006000000016d57-119.dat upx behavioral1/memory/316-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1620-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d5f-128.dat upx behavioral1/files/0x0006000000016d73-135.dat upx behavioral1/memory/1576-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d79-143.dat upx behavioral1/files/0x0006000000016d7d-150.dat upx behavioral1/memory/2808-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016fa9-158.dat upx behavioral1/files/0x000600000001708c-165.dat upx behavioral1/files/0x00060000000171ad-172.dat upx behavioral1/memory/2324-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001738e-179.dat upx behavioral1/memory/2960-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001738f-189.dat upx behavioral1/memory/2960-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173e2-196.dat upx behavioral1/files/0x00060000000173e5-205.dat upx behavioral1/memory/2328-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017436-211.dat upx behavioral1/files/0x00060000000174ef-218.dat upx behavioral1/memory/1776-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0036000000015d13-226.dat upx behavioral1/files/0x0006000000017577-234.dat upx behavioral1/files/0x00060000000175f7-241.dat upx behavioral1/memory/1724-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175fd-250.dat upx behavioral1/memory/1132-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2060-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2368-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2564-333-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2372 2164 5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe 28 PID 2164 wrote to memory of 2372 2164 5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe 28 PID 2164 wrote to memory of 2372 2164 5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe 28 PID 2164 wrote to memory of 2372 2164 5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe 28 PID 2372 wrote to memory of 3044 2372 dpdjp.exe 29 PID 2372 wrote to memory of 3044 2372 dpdjp.exe 29 PID 2372 wrote to memory of 3044 2372 dpdjp.exe 29 PID 2372 wrote to memory of 3044 2372 dpdjp.exe 29 PID 3044 wrote to memory of 2680 3044 fxxxlxx.exe 30 PID 3044 wrote to memory of 2680 3044 fxxxlxx.exe 30 PID 3044 wrote to memory of 2680 3044 fxxxlxx.exe 30 PID 3044 wrote to memory of 2680 3044 fxxxlxx.exe 30 PID 2680 wrote to memory of 2760 2680 tnnntb.exe 31 PID 2680 wrote to memory of 2760 2680 tnnntb.exe 31 PID 2680 wrote to memory of 2760 2680 tnnntb.exe 31 PID 2680 wrote to memory of 2760 2680 tnnntb.exe 31 PID 2760 wrote to memory of 2688 2760 ddppd.exe 32 PID 2760 wrote to memory of 2688 2760 ddppd.exe 32 PID 2760 wrote to memory of 2688 2760 ddppd.exe 32 PID 2760 wrote to memory of 2688 2760 ddppd.exe 32 PID 2688 wrote to memory of 2828 2688 7xfrlxl.exe 33 PID 2688 wrote to memory of 2828 2688 7xfrlxl.exe 33 PID 2688 wrote to memory of 2828 2688 7xfrlxl.exe 33 PID 2688 wrote to memory of 2828 2688 7xfrlxl.exe 33 PID 2828 wrote to memory of 2900 2828 bhhhtt.exe 34 PID 2828 wrote to memory of 2900 2828 bhhhtt.exe 34 PID 2828 wrote to memory of 2900 2828 bhhhtt.exe 34 PID 2828 wrote to memory of 2900 2828 bhhhtt.exe 34 PID 2900 wrote to memory of 2652 2900 jdvvv.exe 35 PID 2900 wrote to memory of 2652 2900 jdvvv.exe 35 PID 2900 wrote to memory of 2652 2900 jdvvv.exe 35 PID 2900 wrote to memory of 2652 2900 jdvvv.exe 35 PID 2652 wrote to memory of 2580 2652 jdppv.exe 36 PID 2652 wrote to memory of 2580 2652 jdppv.exe 36 PID 2652 wrote to memory of 2580 2652 jdppv.exe 36 PID 2652 wrote to memory of 2580 2652 jdppv.exe 36 PID 2580 wrote to memory of 3020 2580 5fllxxl.exe 37 PID 2580 wrote to memory of 3020 2580 5fllxxl.exe 37 PID 2580 wrote to memory of 3020 2580 5fllxxl.exe 37 PID 2580 wrote to memory of 3020 2580 5fllxxl.exe 37 PID 3020 wrote to memory of 1812 3020 3nthht.exe 38 PID 3020 wrote to memory of 1812 3020 3nthht.exe 38 PID 3020 wrote to memory of 1812 3020 3nthht.exe 38 PID 3020 wrote to memory of 1812 3020 3nthht.exe 38 PID 1812 wrote to memory of 2876 1812 pvpdp.exe 39 PID 1812 wrote to memory of 2876 1812 pvpdp.exe 39 PID 1812 wrote to memory of 2876 1812 pvpdp.exe 39 PID 1812 wrote to memory of 2876 1812 pvpdp.exe 39 PID 2876 wrote to memory of 3008 2876 llxlflr.exe 40 PID 2876 wrote to memory of 3008 2876 llxlflr.exe 40 PID 2876 wrote to memory of 3008 2876 llxlflr.exe 40 PID 2876 wrote to memory of 3008 2876 llxlflr.exe 40 PID 3008 wrote to memory of 1620 3008 1tbnbh.exe 41 PID 3008 wrote to memory of 1620 3008 1tbnbh.exe 41 PID 3008 wrote to memory of 1620 3008 1tbnbh.exe 41 PID 3008 wrote to memory of 1620 3008 1tbnbh.exe 41 PID 1620 wrote to memory of 316 1620 ppjjv.exe 42 PID 1620 wrote to memory of 316 1620 ppjjv.exe 42 PID 1620 wrote to memory of 316 1620 ppjjv.exe 42 PID 1620 wrote to memory of 316 1620 ppjjv.exe 42 PID 316 wrote to memory of 340 316 7jpdj.exe 43 PID 316 wrote to memory of 340 316 7jpdj.exe 43 PID 316 wrote to memory of 340 316 7jpdj.exe 43 PID 316 wrote to memory of 340 316 7jpdj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\dpdjp.exec:\dpdjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\fxxxlxx.exec:\fxxxlxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\tnnntb.exec:\tnnntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ddppd.exec:\ddppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\7xfrlxl.exec:\7xfrlxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\bhhhtt.exec:\bhhhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\jdvvv.exec:\jdvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\jdppv.exec:\jdppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5fllxxl.exec:\5fllxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\3nthht.exec:\3nthht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\pvpdp.exec:\pvpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\llxlflr.exec:\llxlflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\1tbnbh.exec:\1tbnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\ppjjv.exec:\ppjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\7jpdj.exec:\7jpdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\rrlxfrf.exec:\rrlxfrf.exe17⤵
- Executes dropped EXE
PID:340 -
\??\c:\5tnnbh.exec:\5tnnbh.exe18⤵
- Executes dropped EXE
PID:1576 -
\??\c:\tnnbnn.exec:\tnnbnn.exe19⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vdppp.exec:\vdppp.exe20⤵
- Executes dropped EXE
PID:2808 -
\??\c:\5flrflx.exec:\5flrflx.exe21⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lfxxfxl.exec:\lfxxfxl.exe22⤵
- Executes dropped EXE
PID:1236 -
\??\c:\nhbhnh.exec:\nhbhnh.exe23⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9ddvd.exec:\9ddvd.exe24⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ddvdv.exec:\ddvdv.exe25⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rllfrff.exec:\rllfrff.exe26⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ntbbbn.exec:\ntbbbn.exe27⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vpjvv.exec:\vpjvv.exe28⤵
- Executes dropped EXE
PID:840 -
\??\c:\3ppjv.exec:\3ppjv.exe29⤵
- Executes dropped EXE
PID:1776 -
\??\c:\9xfxrfr.exec:\9xfxrfr.exe30⤵
- Executes dropped EXE
PID:964 -
\??\c:\nnnhtt.exec:\nnnhtt.exe31⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jdvdj.exec:\jdvdj.exe32⤵
- Executes dropped EXE
PID:912 -
\??\c:\jjjvj.exec:\jjjvj.exe33⤵
- Executes dropped EXE
PID:1132 -
\??\c:\1lflrrf.exec:\1lflrrf.exe34⤵
- Executes dropped EXE
PID:1200 -
\??\c:\3nhbhn.exec:\3nhbhn.exe35⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vpjpp.exec:\vpjpp.exe36⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pjdjp.exec:\pjdjp.exe37⤵
- Executes dropped EXE
PID:1692 -
\??\c:\9xxxffr.exec:\9xxxffr.exe38⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xrxlrxf.exec:\xrxlrxf.exe39⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hhhtbh.exec:\hhhtbh.exe40⤵
- Executes dropped EXE
PID:2404 -
\??\c:\pdvvj.exec:\pdvvj.exe41⤵
- Executes dropped EXE
PID:1248 -
\??\c:\lxxfflx.exec:\lxxfflx.exe42⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xxflxxr.exec:\xxflxxr.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\btbnnh.exec:\btbnnh.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jdvdp.exec:\jdvdp.exe45⤵
- Executes dropped EXE
PID:2304 -
\??\c:\3jvvd.exec:\3jvvd.exe46⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lrlfxlr.exec:\lrlfxlr.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ththbt.exec:\ththbt.exe48⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bbtbtb.exec:\bbtbtb.exe49⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5pppv.exec:\5pppv.exe50⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jvvvp.exec:\jvvvp.exe51⤵
- Executes dropped EXE
PID:2616 -
\??\c:\3xfrxfx.exec:\3xfrxfx.exe52⤵
- Executes dropped EXE
PID:2580 -
\??\c:\btthth.exec:\btthth.exe53⤵
- Executes dropped EXE
PID:3028 -
\??\c:\tttntn.exec:\tttntn.exe54⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1jjdj.exec:\1jjdj.exe55⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xlflfff.exec:\xlflfff.exe56⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bbnbnb.exec:\bbnbnb.exe57⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tnhtbn.exec:\tnhtbn.exe58⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jdpvd.exec:\jdpvd.exe59⤵
- Executes dropped EXE
PID:1752 -
\??\c:\pjdvj.exec:\pjdvj.exe60⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rlfxllx.exec:\rlfxllx.exe61⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rlffrrx.exec:\rlffrrx.exe62⤵
- Executes dropped EXE
PID:296 -
\??\c:\tbtbth.exec:\tbtbth.exe63⤵
- Executes dropped EXE
PID:1452 -
\??\c:\9tnttn.exec:\9tnttn.exe64⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vpjpv.exec:\vpjpv.exe65⤵
- Executes dropped EXE
PID:1584 -
\??\c:\dvjpv.exec:\dvjpv.exe66⤵PID:2808
-
\??\c:\rllrxfr.exec:\rllrxfr.exe67⤵PID:880
-
\??\c:\3nbhnb.exec:\3nbhnb.exe68⤵PID:2340
-
\??\c:\thhthn.exec:\thhthn.exe69⤵PID:1236
-
\??\c:\pvppp.exec:\pvppp.exe70⤵PID:2312
-
\??\c:\llfxllx.exec:\llfxllx.exe71⤵PID:2836
-
\??\c:\9xxxlrf.exec:\9xxxlrf.exe72⤵PID:2636
-
\??\c:\5nhhnh.exec:\5nhhnh.exe73⤵PID:484
-
\??\c:\ttbbtn.exec:\ttbbtn.exe74⤵PID:2328
-
\??\c:\1vpdv.exec:\1vpdv.exe75⤵PID:1268
-
\??\c:\xrlxfrl.exec:\xrlxfrl.exe76⤵PID:2168
-
\??\c:\xxlrflx.exec:\xxlrflx.exe77⤵PID:1780
-
\??\c:\9bbbtn.exec:\9bbbtn.exe78⤵PID:1348
-
\??\c:\dddpj.exec:\dddpj.exe79⤵PID:1708
-
\??\c:\3vddp.exec:\3vddp.exe80⤵PID:2964
-
\??\c:\5rrxrfx.exec:\5rrxrfx.exe81⤵PID:2192
-
\??\c:\fllrfrl.exec:\fllrfrl.exe82⤵PID:912
-
\??\c:\1btnbb.exec:\1btnbb.exe83⤵PID:1124
-
\??\c:\ppvdp.exec:\ppvdp.exe84⤵PID:1132
-
\??\c:\djpdd.exec:\djpdd.exe85⤵PID:1884
-
\??\c:\llrxllf.exec:\llrxllf.exe86⤵PID:1932
-
\??\c:\nnbbnn.exec:\nnbbnn.exe87⤵PID:2504
-
\??\c:\hhbbbt.exec:\hhbbbt.exe88⤵PID:876
-
\??\c:\dvjdp.exec:\dvjdp.exe89⤵PID:2384
-
\??\c:\fxxrlrf.exec:\fxxrlrf.exe90⤵PID:2164
-
\??\c:\hbnhtn.exec:\hbnhtn.exe91⤵PID:2096
-
\??\c:\nnnbnb.exec:\nnnbnb.exe92⤵PID:2416
-
\??\c:\dddvp.exec:\dddvp.exe93⤵PID:2220
-
\??\c:\pjjpp.exec:\pjjpp.exe94⤵PID:2684
-
\??\c:\thbhtb.exec:\thbhtb.exe95⤵PID:2696
-
\??\c:\htbbbt.exec:\htbbbt.exe96⤵PID:2760
-
\??\c:\pddvd.exec:\pddvd.exe97⤵PID:2852
-
\??\c:\fxrlrfr.exec:\fxrlrfr.exe98⤵PID:2572
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe99⤵PID:2500
-
\??\c:\9httnh.exec:\9httnh.exe100⤵PID:2900
-
\??\c:\jjpvj.exec:\jjpvj.exe101⤵PID:2536
-
\??\c:\lxrfflx.exec:\lxrfflx.exe102⤵PID:2532
-
\??\c:\5rrxrfr.exec:\5rrxrfr.exe103⤵PID:2284
-
\??\c:\tbnnhh.exec:\tbnnhh.exe104⤵PID:2588
-
\??\c:\djvjv.exec:\djvjv.exe105⤵PID:2888
-
\??\c:\jpddj.exec:\jpddj.exe106⤵PID:2772
-
\??\c:\frlfxrx.exec:\frlfxrx.exe107⤵PID:3036
-
\??\c:\tthtnt.exec:\tthtnt.exe108⤵PID:2896
-
\??\c:\bhnhnb.exec:\bhnhnb.exe109⤵PID:376
-
\??\c:\pjdvp.exec:\pjdvp.exe110⤵PID:1964
-
\??\c:\dddvp.exec:\dddvp.exe111⤵PID:1220
-
\??\c:\5ffxrxf.exec:\5ffxrxf.exe112⤵PID:1828
-
\??\c:\bbbnbb.exec:\bbbnbb.exe113⤵PID:2508
-
\??\c:\tntnhn.exec:\tntnhn.exe114⤵PID:1676
-
\??\c:\jpdpd.exec:\jpdpd.exe115⤵PID:2820
-
\??\c:\5llfxfr.exec:\5llfxfr.exe116⤵PID:2148
-
\??\c:\rxfrlfx.exec:\rxfrlfx.exe117⤵PID:624
-
\??\c:\7bbhtb.exec:\7bbhtb.exe118⤵PID:2016
-
\??\c:\bbhhbn.exec:\bbhhbn.exe119⤵PID:2032
-
\??\c:\vpvpv.exec:\vpvpv.exe120⤵PID:1608
-
\??\c:\5lfxxxx.exec:\5lfxxxx.exe121⤵PID:2908
-
\??\c:\lrlffxf.exec:\lrlffxf.exe122⤵PID:2968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-