Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 11:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe
-
Size
521KB
-
MD5
100ffadba5aaf071814b14f9d8674a00
-
SHA1
5552cf5680cb7a3c6230b6864d6c5e47478aa6e6
-
SHA256
d2cc2f875c6c7190ae3d0bccc96cfc394d57be89e8517d57f78b7373827e22a1
-
SHA512
aec74afd0256c3c0b30024e41d567d940462123ebf01ae47488ee798d1006b0db110dc3c44d2051bb9d1030872d8c6e4bf10aef64b584a0bb3746c5006f57cbf
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H3r:q7Tc2NYHUrAwfMHNnpls4897
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1812-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-101-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2652-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-263-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/3024-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-282-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/1172-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-324-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1528-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-529-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/1944-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-1017-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/1240-1010-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-1039-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1648-1066-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/836-1122-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2332-1191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 jppjv.exe 2592 82402.exe 2544 20644.exe 2628 20480.exe 2416 48002.exe 2528 xrffflr.exe 2404 nnhnbh.exe 2944 nhttbh.exe 2708 004046.exe 2756 886862.exe 2824 1lrxlrx.exe 1904 82402.exe 2652 rlfflrr.exe 1604 a0042.exe 2688 22042.exe 784 080284.exe 984 20468.exe 696 btttnt.exe 1208 4046446.exe 2340 lrxxlff.exe 1920 06448.exe 2372 nhbtbt.exe 1424 5lfxffl.exe 1720 tnnnnt.exe 2100 bntttn.exe 1304 42240.exe 108 60884.exe 1480 0626648.exe 1068 48624.exe 3024 3btntt.exe 2888 602240.exe 2024 jpppd.exe 1172 llflrrf.exe 2364 fxrrffl.exe 1884 ppjpv.exe 2096 llrllfl.exe 1524 pjpjj.exe 1528 bbnbhh.exe 2592 fxxflrl.exe 2720 486060.exe 2628 488468.exe 2564 dvddj.exe 2448 xrfffxx.exe 2408 3hnnbh.exe 2940 02068.exe 2992 dpvvv.exe 2740 2848066.exe 2480 g2468.exe 2812 fflfrxx.exe 2928 jjddp.exe 2452 nnhhht.exe 2960 1ddpv.exe 1516 040080.exe 2140 20266.exe 540 8862266.exe 616 7lxffff.exe 580 rfrrxxf.exe 984 lfllrrx.exe 628 pjpjj.exe 2924 64666.exe 2080 o244480.exe 2964 8640846.exe 1748 pjjpp.exe 2008 ppdvv.exe -
resource yara_rule behavioral1/memory/1812-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-324-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1528-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-859-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-965-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-1010-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-1024-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2072 1812 100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe 28 PID 1812 wrote to memory of 2072 1812 100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe 28 PID 1812 wrote to memory of 2072 1812 100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe 28 PID 1812 wrote to memory of 2072 1812 100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe 28 PID 2072 wrote to memory of 2592 2072 jppjv.exe 29 PID 2072 wrote to memory of 2592 2072 jppjv.exe 29 PID 2072 wrote to memory of 2592 2072 jppjv.exe 29 PID 2072 wrote to memory of 2592 2072 jppjv.exe 29 PID 2592 wrote to memory of 2544 2592 82402.exe 30 PID 2592 wrote to memory of 2544 2592 82402.exe 30 PID 2592 wrote to memory of 2544 2592 82402.exe 30 PID 2592 wrote to memory of 2544 2592 82402.exe 30 PID 2544 wrote to memory of 2628 2544 20644.exe 31 PID 2544 wrote to memory of 2628 2544 20644.exe 31 PID 2544 wrote to memory of 2628 2544 20644.exe 31 PID 2544 wrote to memory of 2628 2544 20644.exe 31 PID 2628 wrote to memory of 2416 2628 20480.exe 32 PID 2628 wrote to memory of 2416 2628 20480.exe 32 PID 2628 wrote to memory of 2416 2628 20480.exe 32 PID 2628 wrote to memory of 2416 2628 20480.exe 32 PID 2416 wrote to memory of 2528 2416 48002.exe 33 PID 2416 wrote to memory of 2528 2416 48002.exe 33 PID 2416 wrote to memory of 2528 2416 48002.exe 33 PID 2416 wrote to memory of 2528 2416 48002.exe 33 PID 2528 wrote to memory of 2404 2528 xrffflr.exe 34 PID 2528 wrote to memory of 2404 2528 xrffflr.exe 34 PID 2528 wrote to memory of 2404 2528 xrffflr.exe 34 PID 2528 wrote to memory of 2404 2528 xrffflr.exe 34 PID 2404 wrote to memory of 2944 2404 nnhnbh.exe 35 PID 2404 wrote to memory of 2944 2404 nnhnbh.exe 35 PID 2404 wrote to memory of 2944 2404 nnhnbh.exe 35 PID 2404 wrote to memory of 2944 2404 nnhnbh.exe 35 PID 2944 wrote to memory of 2708 2944 nhttbh.exe 36 PID 2944 wrote to memory of 2708 2944 nhttbh.exe 36 PID 2944 wrote to memory of 2708 2944 nhttbh.exe 36 PID 2944 wrote to memory of 2708 2944 nhttbh.exe 36 PID 2708 wrote to memory of 2756 2708 004046.exe 37 PID 2708 wrote to memory of 2756 2708 004046.exe 37 PID 2708 wrote to memory of 2756 2708 004046.exe 37 PID 2708 wrote to memory of 2756 2708 004046.exe 37 PID 2756 wrote to memory of 2824 2756 886862.exe 38 PID 2756 wrote to memory of 2824 2756 886862.exe 38 PID 2756 wrote to memory of 2824 2756 886862.exe 38 PID 2756 wrote to memory of 2824 2756 886862.exe 38 PID 2824 wrote to memory of 1904 2824 1lrxlrx.exe 39 PID 2824 wrote to memory of 1904 2824 1lrxlrx.exe 39 PID 2824 wrote to memory of 1904 2824 1lrxlrx.exe 39 PID 2824 wrote to memory of 1904 2824 1lrxlrx.exe 39 PID 1904 wrote to memory of 2652 1904 82402.exe 40 PID 1904 wrote to memory of 2652 1904 82402.exe 40 PID 1904 wrote to memory of 2652 1904 82402.exe 40 PID 1904 wrote to memory of 2652 1904 82402.exe 40 PID 2652 wrote to memory of 1604 2652 rlfflrr.exe 41 PID 2652 wrote to memory of 1604 2652 rlfflrr.exe 41 PID 2652 wrote to memory of 1604 2652 rlfflrr.exe 41 PID 2652 wrote to memory of 1604 2652 rlfflrr.exe 41 PID 1604 wrote to memory of 2688 1604 a0042.exe 42 PID 1604 wrote to memory of 2688 1604 a0042.exe 42 PID 1604 wrote to memory of 2688 1604 a0042.exe 42 PID 1604 wrote to memory of 2688 1604 a0042.exe 42 PID 2688 wrote to memory of 784 2688 22042.exe 43 PID 2688 wrote to memory of 784 2688 22042.exe 43 PID 2688 wrote to memory of 784 2688 22042.exe 43 PID 2688 wrote to memory of 784 2688 22042.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\100ffadba5aaf071814b14f9d8674a00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\jppjv.exec:\jppjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\82402.exec:\82402.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\20644.exec:\20644.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\20480.exec:\20480.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\48002.exec:\48002.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\xrffflr.exec:\xrffflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\nnhnbh.exec:\nnhnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\nhttbh.exec:\nhttbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\004046.exec:\004046.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\886862.exec:\886862.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\1lrxlrx.exec:\1lrxlrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\82402.exec:\82402.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\rlfflrr.exec:\rlfflrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\a0042.exec:\a0042.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\22042.exec:\22042.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\080284.exec:\080284.exe17⤵
- Executes dropped EXE
PID:784 -
\??\c:\20468.exec:\20468.exe18⤵
- Executes dropped EXE
PID:984 -
\??\c:\btttnt.exec:\btttnt.exe19⤵
- Executes dropped EXE
PID:696 -
\??\c:\4046446.exec:\4046446.exe20⤵
- Executes dropped EXE
PID:1208 -
\??\c:\lrxxlff.exec:\lrxxlff.exe21⤵
- Executes dropped EXE
PID:2340 -
\??\c:\06448.exec:\06448.exe22⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nhbtbt.exec:\nhbtbt.exe23⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5lfxffl.exec:\5lfxffl.exe24⤵
- Executes dropped EXE
PID:1424 -
\??\c:\tnnnnt.exec:\tnnnnt.exe25⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bntttn.exec:\bntttn.exe26⤵
- Executes dropped EXE
PID:2100 -
\??\c:\42240.exec:\42240.exe27⤵
- Executes dropped EXE
PID:1304 -
\??\c:\60884.exec:\60884.exe28⤵
- Executes dropped EXE
PID:108 -
\??\c:\0626648.exec:\0626648.exe29⤵
- Executes dropped EXE
PID:1480 -
\??\c:\48624.exec:\48624.exe30⤵
- Executes dropped EXE
PID:1068 -
\??\c:\3btntt.exec:\3btntt.exe31⤵
- Executes dropped EXE
PID:3024 -
\??\c:\602240.exec:\602240.exe32⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jpppd.exec:\jpppd.exe33⤵
- Executes dropped EXE
PID:2024 -
\??\c:\llflrrf.exec:\llflrrf.exe34⤵
- Executes dropped EXE
PID:1172 -
\??\c:\fxrrffl.exec:\fxrrffl.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\ppjpv.exec:\ppjpv.exe36⤵
- Executes dropped EXE
PID:1884 -
\??\c:\llrllfl.exec:\llrllfl.exe37⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjpjj.exec:\pjpjj.exe38⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bbnbhh.exec:\bbnbhh.exe39⤵
- Executes dropped EXE
PID:1528 -
\??\c:\fxxflrl.exec:\fxxflrl.exe40⤵
- Executes dropped EXE
PID:2592 -
\??\c:\486060.exec:\486060.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\488468.exec:\488468.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\dvddj.exec:\dvddj.exe43⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xrfffxx.exec:\xrfffxx.exe44⤵
- Executes dropped EXE
PID:2448 -
\??\c:\3hnnbh.exec:\3hnnbh.exe45⤵
- Executes dropped EXE
PID:2408 -
\??\c:\02068.exec:\02068.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dpvvv.exec:\dpvvv.exe47⤵
- Executes dropped EXE
PID:2992 -
\??\c:\2848066.exec:\2848066.exe48⤵
- Executes dropped EXE
PID:2740 -
\??\c:\g2468.exec:\g2468.exe49⤵
- Executes dropped EXE
PID:2480 -
\??\c:\fflfrxx.exec:\fflfrxx.exe50⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jjddp.exec:\jjddp.exe51⤵
- Executes dropped EXE
PID:2928 -
\??\c:\nnhhht.exec:\nnhhht.exe52⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1ddpv.exec:\1ddpv.exe53⤵
- Executes dropped EXE
PID:2960 -
\??\c:\040080.exec:\040080.exe54⤵
- Executes dropped EXE
PID:1516 -
\??\c:\20266.exec:\20266.exe55⤵
- Executes dropped EXE
PID:2140 -
\??\c:\8862266.exec:\8862266.exe56⤵
- Executes dropped EXE
PID:540 -
\??\c:\7lxffff.exec:\7lxffff.exe57⤵
- Executes dropped EXE
PID:616 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe58⤵
- Executes dropped EXE
PID:580 -
\??\c:\lfllrrx.exec:\lfllrrx.exe59⤵
- Executes dropped EXE
PID:984 -
\??\c:\pjpjj.exec:\pjpjj.exe60⤵
- Executes dropped EXE
PID:628 -
\??\c:\64666.exec:\64666.exe61⤵
- Executes dropped EXE
PID:2924 -
\??\c:\o244480.exec:\o244480.exe62⤵
- Executes dropped EXE
PID:2080 -
\??\c:\8640846.exec:\8640846.exe63⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pjjpp.exec:\pjjpp.exe64⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ppdvv.exec:\ppdvv.exe65⤵
- Executes dropped EXE
PID:2008 -
\??\c:\s4000.exec:\s4000.exe66⤵PID:2852
-
\??\c:\lfxfrrr.exec:\lfxfrrr.exe67⤵PID:1800
-
\??\c:\9htnnn.exec:\9htnnn.exe68⤵PID:2916
-
\??\c:\66666.exec:\66666.exe69⤵PID:1116
-
\??\c:\60228.exec:\60228.exe70⤵PID:2100
-
\??\c:\6866262.exec:\6866262.exe71⤵PID:708
-
\??\c:\0604684.exec:\0604684.exe72⤵PID:2264
-
\??\c:\0844400.exec:\0844400.exe73⤵PID:948
-
\??\c:\lflllfl.exec:\lflllfl.exe74⤵PID:1292
-
\??\c:\642282.exec:\642282.exe75⤵PID:112
-
\??\c:\6462400.exec:\6462400.exe76⤵PID:1768
-
\??\c:\02668.exec:\02668.exe77⤵PID:3048
-
\??\c:\o808406.exec:\o808406.exe78⤵PID:2148
-
\??\c:\02824.exec:\02824.exe79⤵PID:2136
-
\??\c:\xlfxffl.exec:\xlfxffl.exe80⤵PID:2344
-
\??\c:\08484.exec:\08484.exe81⤵PID:1944
-
\??\c:\vpddp.exec:\vpddp.exe82⤵PID:2332
-
\??\c:\4644040.exec:\4644040.exe83⤵PID:3040
-
\??\c:\rfrxrrr.exec:\rfrxrrr.exe84⤵PID:1500
-
\??\c:\pdjpv.exec:\pdjpv.exe85⤵PID:2536
-
\??\c:\4800628.exec:\4800628.exe86⤵PID:2600
-
\??\c:\rxllxfl.exec:\rxllxfl.exe87⤵PID:2552
-
\??\c:\thntbb.exec:\thntbb.exe88⤵PID:2692
-
\??\c:\082644.exec:\082644.exe89⤵PID:2632
-
\??\c:\422248.exec:\422248.exe90⤵PID:2400
-
\??\c:\bbtbnn.exec:\bbtbnn.exe91⤵PID:2456
-
\??\c:\46062.exec:\46062.exe92⤵PID:2388
-
\??\c:\djjjd.exec:\djjjd.exe93⤵PID:2392
-
\??\c:\266240.exec:\266240.exe94⤵PID:2768
-
\??\c:\42828.exec:\42828.exe95⤵PID:2824
-
\??\c:\8284406.exec:\8284406.exe96⤵PID:2512
-
\??\c:\ffrxffl.exec:\ffrxffl.exe97⤵PID:1632
-
\??\c:\lrrlrfl.exec:\lrrlrfl.exe98⤵PID:2800
-
\??\c:\tnbnbh.exec:\tnbnbh.exe99⤵PID:2284
-
\??\c:\480066.exec:\480066.exe100⤵PID:1852
-
\??\c:\1xlrxlr.exec:\1xlrxlr.exe101⤵PID:1516
-
\??\c:\4248006.exec:\4248006.exe102⤵PID:692
-
\??\c:\3btbnn.exec:\3btbnn.exe103⤵PID:772
-
\??\c:\8688040.exec:\8688040.exe104⤵PID:2212
-
\??\c:\82040.exec:\82040.exe105⤵PID:1276
-
\??\c:\jdppv.exec:\jdppv.exe106⤵PID:1260
-
\??\c:\080066.exec:\080066.exe107⤵PID:2012
-
\??\c:\s2002.exec:\s2002.exe108⤵PID:2488
-
\??\c:\g6284.exec:\g6284.exe109⤵PID:2864
-
\??\c:\8802048.exec:\8802048.exe110⤵PID:1176
-
\??\c:\vjdjv.exec:\vjdjv.exe111⤵PID:2372
-
\??\c:\hthhnn.exec:\hthhnn.exe112⤵PID:2984
-
\??\c:\hthntt.exec:\hthntt.exe113⤵PID:2348
-
\??\c:\frlxrlx.exec:\frlxrlx.exe114⤵PID:452
-
\??\c:\04662.exec:\04662.exe115⤵PID:1204
-
\??\c:\0488404.exec:\0488404.exe116⤵PID:284
-
\??\c:\vjdvj.exec:\vjdvj.exe117⤵PID:1940
-
\??\c:\vvjjv.exec:\vvjjv.exe118⤵PID:392
-
\??\c:\7lfxffl.exec:\7lfxffl.exe119⤵PID:2092
-
\??\c:\6082884.exec:\6082884.exe120⤵PID:1036
-
\??\c:\64440.exec:\64440.exe121⤵PID:1292
-
\??\c:\dvjjp.exec:\dvjjp.exe122⤵PID:3016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-