Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 03:01
Behavioral task
behavioral1
Sample
cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe
-
Size
349KB
-
MD5
cfeb716a9ca10c4a5293eaf5ec521aa0
-
SHA1
348d8b870803825098b767092f2a68bcabfccad9
-
SHA256
00ff73b1e1520673ed2827d236dcf9d6562e08697142cfe5854fbe59d711c67e
-
SHA512
8962ce9ccb162c0941842fcb3dd739150a0e8987e1ea64a4f926bc6cef663f4644490465e86a59d5ea20c460ddbde834fb0902bb8bf5760ac2cc0fc9b5536608
-
SSDEEP
6144:bcm4FmowdHoSgWrXD486jCpoAhlq1mEjBqLyOSlhNFF25:h4wFHoSgWj168w1VjsyvhNFF25
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1408-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1896-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-361-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2596-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-468-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/2064-481-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1084-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-967-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-7323-0x0000000076D90000-0x0000000076EAF000-memory.dmp family_blackmoon behavioral1/memory/2212-7860-0x0000000076D90000-0x0000000076EAF000-memory.dmp family_blackmoon behavioral1/memory/2212-16239-0x0000000076D90000-0x0000000076EAF000-memory.dmp family_blackmoon behavioral1/memory/2212-22414-0x0000000076D90000-0x0000000076EAF000-memory.dmp family_blackmoon behavioral1/memory/2212-23301-0x0000000076D90000-0x0000000076EAF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2932 fxrxfxf.exe 1968 ttntnh.exe 2260 dpvdj.exe 2712 5ththt.exe 2288 3pjvd.exe 2780 rlrxffl.exe 2720 7thnbh.exe 2536 xfrxrxl.exe 2508 1frrrlr.exe 2584 vvjdj.exe 2312 rfrfxrf.exe 296 hbnbbh.exe 2912 pjvvp.exe 3060 rlxfrxl.exe 2188 nhtbbh.exe 1640 rllfffr.exe 1316 bbbhnt.exe 2748 jvvpd.exe 832 lxrrflx.exe 1772 7bhntb.exe 1564 vvvpv.exe 2448 9lrxxxf.exe 2964 nnbhtb.exe 2380 7vpvj.exe 1692 xxxfrxl.exe 1192 3hhhnt.exe 1896 vjvdp.exe 2464 nhnhth.exe 984 pvdpj.exe 1456 xrxxrrf.exe 2136 nbhbnh.exe 1784 jpvpv.exe 696 xxllxxl.exe 2116 5tbhhb.exe 868 htnttt.exe 292 jdppp.exe 2084 flrrxfx.exe 1752 hhtnth.exe 1716 1dvdj.exe 2420 fxlrfll.exe 1144 nbnnnb.exe 1576 7bthnt.exe 2700 jvvdp.exe 1304 lflxrrf.exe 2260 lfrrrxl.exe 2708 tnthth.exe 2620 jdpdp.exe 2660 fxrrxfr.exe 2672 1xrflrx.exe 2920 hbnnbb.exe 2648 vddvp.exe 2520 jdvdd.exe 2572 xrfrfxx.exe 3040 bbnntt.exe 1416 btntth.exe 464 jjdjv.exe 2596 fxrxflf.exe 2916 3xlrxfl.exe 3052 htntnt.exe 2496 dvpvd.exe 1980 7ppvd.exe 2576 rrxxlll.exe 1956 tnhthh.exe 2612 bttbhn.exe -
resource yara_rule behavioral1/memory/1408-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c0000000144e4-5.dat upx behavioral1/memory/2932-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0039000000016c9c-15.dat upx behavioral1/memory/1968-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cf1-22.dat upx behavioral1/memory/2260-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cfd-33.dat upx behavioral1/memory/2260-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2288-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016d05-40.dat upx behavioral1/files/0x0009000000016d0e-48.dat upx behavioral1/memory/2780-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017404-56.dat upx behavioral1/files/0x00060000000175c6-65.dat upx behavioral1/memory/2536-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175cc-72.dat upx behavioral1/files/0x00060000000175d2-82.dat upx behavioral1/memory/2584-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2508-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2584-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018654-89.dat upx behavioral1/memory/2312-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0031000000018655-96.dat upx behavioral1/memory/296-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018670-106.dat upx behavioral1/memory/296-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2912-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186d7-115.dat upx behavioral1/memory/3060-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186e9-124.dat upx behavioral1/memory/3060-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018716-131.dat upx behavioral1/memory/1640-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1316-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018760-141.dat upx behavioral1/files/0x0005000000018762-151.dat upx behavioral1/files/0x000500000001922a-164.dat upx behavioral1/files/0x0006000000019018-158.dat upx behavioral1/files/0x0005000000019241-171.dat upx behavioral1/memory/1564-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0038000000016cbb-179.dat upx behavioral1/files/0x000500000001924d-186.dat upx behavioral1/memory/2964-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925c-194.dat upx behavioral1/memory/2380-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001935f-202.dat upx behavioral1/memory/1692-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019370-210.dat upx behavioral1/memory/1192-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019383-218.dat upx behavioral1/memory/1192-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019391-227.dat upx behavioral1/memory/1896-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2464-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193af-235.dat upx behavioral1/files/0x00050000000193c8-242.dat upx behavioral1/files/0x00050000000193f5-249.dat upx behavioral1/files/0x00050000000193f9-256.dat upx behavioral1/memory/2116-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/868-274-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1408 wrote to memory of 2932 1408 cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe 28 PID 1408 wrote to memory of 2932 1408 cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe 28 PID 1408 wrote to memory of 2932 1408 cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe 28 PID 1408 wrote to memory of 2932 1408 cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe 28 PID 2932 wrote to memory of 1968 2932 fxrxfxf.exe 29 PID 2932 wrote to memory of 1968 2932 fxrxfxf.exe 29 PID 2932 wrote to memory of 1968 2932 fxrxfxf.exe 29 PID 2932 wrote to memory of 1968 2932 fxrxfxf.exe 29 PID 1968 wrote to memory of 2260 1968 ttntnh.exe 30 PID 1968 wrote to memory of 2260 1968 ttntnh.exe 30 PID 1968 wrote to memory of 2260 1968 ttntnh.exe 30 PID 1968 wrote to memory of 2260 1968 ttntnh.exe 30 PID 2260 wrote to memory of 2712 2260 dpvdj.exe 31 PID 2260 wrote to memory of 2712 2260 dpvdj.exe 31 PID 2260 wrote to memory of 2712 2260 dpvdj.exe 31 PID 2260 wrote to memory of 2712 2260 dpvdj.exe 31 PID 2712 wrote to memory of 2288 2712 5ththt.exe 32 PID 2712 wrote to memory of 2288 2712 5ththt.exe 32 PID 2712 wrote to memory of 2288 2712 5ththt.exe 32 PID 2712 wrote to memory of 2288 2712 5ththt.exe 32 PID 2288 wrote to memory of 2780 2288 3pjvd.exe 33 PID 2288 wrote to memory of 2780 2288 3pjvd.exe 33 PID 2288 wrote to memory of 2780 2288 3pjvd.exe 33 PID 2288 wrote to memory of 2780 2288 3pjvd.exe 33 PID 2780 wrote to memory of 2720 2780 rlrxffl.exe 34 PID 2780 wrote to memory of 2720 2780 rlrxffl.exe 34 PID 2780 wrote to memory of 2720 2780 rlrxffl.exe 34 PID 2780 wrote to memory of 2720 2780 rlrxffl.exe 34 PID 2720 wrote to memory of 2536 2720 7thnbh.exe 35 PID 2720 wrote to memory of 2536 2720 7thnbh.exe 35 PID 2720 wrote to memory of 2536 2720 7thnbh.exe 35 PID 2720 wrote to memory of 2536 2720 7thnbh.exe 35 PID 2536 wrote to memory of 2508 2536 xfrxrxl.exe 36 PID 2536 wrote to memory of 2508 2536 xfrxrxl.exe 36 PID 2536 wrote to memory of 2508 2536 xfrxrxl.exe 36 PID 2536 wrote to memory of 2508 2536 xfrxrxl.exe 36 PID 2508 wrote to memory of 2584 2508 1frrrlr.exe 37 PID 2508 wrote to memory of 2584 2508 1frrrlr.exe 37 PID 2508 wrote to memory of 2584 2508 1frrrlr.exe 37 PID 2508 wrote to memory of 2584 2508 1frrrlr.exe 37 PID 2584 wrote to memory of 2312 2584 vvjdj.exe 38 PID 2584 wrote to memory of 2312 2584 vvjdj.exe 38 PID 2584 wrote to memory of 2312 2584 vvjdj.exe 38 PID 2584 wrote to memory of 2312 2584 vvjdj.exe 38 PID 2312 wrote to memory of 296 2312 rfrfxrf.exe 39 PID 2312 wrote to memory of 296 2312 rfrfxrf.exe 39 PID 2312 wrote to memory of 296 2312 rfrfxrf.exe 39 PID 2312 wrote to memory of 296 2312 rfrfxrf.exe 39 PID 296 wrote to memory of 2912 296 hbnbbh.exe 40 PID 296 wrote to memory of 2912 296 hbnbbh.exe 40 PID 296 wrote to memory of 2912 296 hbnbbh.exe 40 PID 296 wrote to memory of 2912 296 hbnbbh.exe 40 PID 2912 wrote to memory of 3060 2912 pjvvp.exe 41 PID 2912 wrote to memory of 3060 2912 pjvvp.exe 41 PID 2912 wrote to memory of 3060 2912 pjvvp.exe 41 PID 2912 wrote to memory of 3060 2912 pjvvp.exe 41 PID 3060 wrote to memory of 2188 3060 rlxfrxl.exe 42 PID 3060 wrote to memory of 2188 3060 rlxfrxl.exe 42 PID 3060 wrote to memory of 2188 3060 rlxfrxl.exe 42 PID 3060 wrote to memory of 2188 3060 rlxfrxl.exe 42 PID 2188 wrote to memory of 1640 2188 nhtbbh.exe 43 PID 2188 wrote to memory of 1640 2188 nhtbbh.exe 43 PID 2188 wrote to memory of 1640 2188 nhtbbh.exe 43 PID 2188 wrote to memory of 1640 2188 nhtbbh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\fxrxfxf.exec:\fxrxfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\ttntnh.exec:\ttntnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\dpvdj.exec:\dpvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\5ththt.exec:\5ththt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\3pjvd.exec:\3pjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\rlrxffl.exec:\rlrxffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\7thnbh.exec:\7thnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xfrxrxl.exec:\xfrxrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\1frrrlr.exec:\1frrrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\vvjdj.exec:\vvjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\rfrfxrf.exec:\rfrfxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\hbnbbh.exec:\hbnbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\pjvvp.exec:\pjvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rlxfrxl.exec:\rlxfrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\nhtbbh.exec:\nhtbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\rllfffr.exec:\rllfffr.exe17⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bbbhnt.exec:\bbbhnt.exe18⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jvvpd.exec:\jvvpd.exe19⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lxrrflx.exec:\lxrrflx.exe20⤵
- Executes dropped EXE
PID:832 -
\??\c:\7bhntb.exec:\7bhntb.exe21⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vvvpv.exec:\vvvpv.exe22⤵
- Executes dropped EXE
PID:1564 -
\??\c:\9lrxxxf.exec:\9lrxxxf.exe23⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nnbhtb.exec:\nnbhtb.exe24⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7vpvj.exec:\7vpvj.exe25⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe26⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3hhhnt.exec:\3hhhnt.exe27⤵
- Executes dropped EXE
PID:1192 -
\??\c:\vjvdp.exec:\vjvdp.exe28⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nhnhth.exec:\nhnhth.exe29⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pvdpj.exec:\pvdpj.exe30⤵
- Executes dropped EXE
PID:984 -
\??\c:\xrxxrrf.exec:\xrxxrrf.exe31⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nbhbnh.exec:\nbhbnh.exe32⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jpvpv.exec:\jpvpv.exe33⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xxllxxl.exec:\xxllxxl.exe34⤵
- Executes dropped EXE
PID:696 -
\??\c:\5tbhhb.exec:\5tbhhb.exe35⤵
- Executes dropped EXE
PID:2116 -
\??\c:\htnttt.exec:\htnttt.exe36⤵
- Executes dropped EXE
PID:868 -
\??\c:\jdppp.exec:\jdppp.exe37⤵
- Executes dropped EXE
PID:292 -
\??\c:\flrrxfx.exec:\flrrxfx.exe38⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hhtnth.exec:\hhtnth.exe39⤵
- Executes dropped EXE
PID:1752 -
\??\c:\1dvdj.exec:\1dvdj.exe40⤵
- Executes dropped EXE
PID:1716 -
\??\c:\fxlrfll.exec:\fxlrfll.exe41⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nbnnnb.exec:\nbnnnb.exe42⤵
- Executes dropped EXE
PID:1144 -
\??\c:\7bthnt.exec:\7bthnt.exe43⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jvvdp.exec:\jvvdp.exe44⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lflxrrf.exec:\lflxrrf.exe45⤵
- Executes dropped EXE
PID:1304 -
\??\c:\lfrrrxl.exec:\lfrrrxl.exe46⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tnthth.exec:\tnthth.exe47⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jdpdp.exec:\jdpdp.exe48⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe49⤵
- Executes dropped EXE
PID:2660 -
\??\c:\1xrflrx.exec:\1xrflrx.exe50⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hbnnbb.exec:\hbnnbb.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vddvp.exec:\vddvp.exe52⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jdvdd.exec:\jdvdd.exe53⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xrfrfxx.exec:\xrfrfxx.exe54⤵
- Executes dropped EXE
PID:2572 -
\??\c:\bbnntt.exec:\bbnntt.exe55⤵
- Executes dropped EXE
PID:3040 -
\??\c:\btntth.exec:\btntth.exe56⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jjdjv.exec:\jjdjv.exe57⤵
- Executes dropped EXE
PID:464 -
\??\c:\fxrxflf.exec:\fxrxflf.exe58⤵
- Executes dropped EXE
PID:2596 -
\??\c:\3xlrxfl.exec:\3xlrxfl.exe59⤵
- Executes dropped EXE
PID:2916 -
\??\c:\htntnt.exec:\htntnt.exe60⤵
- Executes dropped EXE
PID:3052 -
\??\c:\dvpvd.exec:\dvpvd.exe61⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7ppvd.exec:\7ppvd.exe62⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rrxxlll.exec:\rrxxlll.exe63⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tnhthh.exec:\tnhthh.exe64⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bttbhn.exec:\bttbhn.exe65⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ppjpp.exec:\ppjpp.exe66⤵PID:1324
-
\??\c:\xxxxxxr.exec:\xxxxxxr.exe67⤵PID:2040
-
\??\c:\5hbhhh.exec:\5hbhhh.exe68⤵PID:1476
-
\??\c:\nbnhhh.exec:\nbnhhh.exe69⤵PID:1352
-
\??\c:\dpdpv.exec:\dpdpv.exe70⤵PID:1772
-
\??\c:\lfrxflx.exec:\lfrxflx.exe71⤵PID:1668
-
\??\c:\7llxlfr.exec:\7llxlfr.exe72⤵PID:1320
-
\??\c:\hbnbnn.exec:\hbnbnn.exe73⤵PID:2064
-
\??\c:\pjvpp.exec:\pjvpp.exe74⤵PID:1076
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe75⤵PID:820
-
\??\c:\1bnnnn.exec:\1bnnnn.exe76⤵PID:2140
-
\??\c:\5vdjj.exec:\5vdjj.exe77⤵PID:1572
-
\??\c:\vjvdj.exec:\vjvdj.exe78⤵PID:1648
-
\??\c:\frfflfr.exec:\frfflfr.exe79⤵PID:1084
-
\??\c:\nbtnnh.exec:\nbtnnh.exe80⤵PID:1016
-
\??\c:\tnhbbb.exec:\tnhbbb.exe81⤵PID:280
-
\??\c:\vjdpv.exec:\vjdpv.exe82⤵PID:872
-
\??\c:\xrlfxxf.exec:\xrlfxxf.exe83⤵PID:1776
-
\??\c:\frffrlf.exec:\frffrlf.exe84⤵PID:688
-
\??\c:\btnbbb.exec:\btnbbb.exe85⤵PID:1608
-
\??\c:\3pjpd.exec:\3pjpd.exe86⤵PID:2220
-
\??\c:\ffxflrr.exec:\ffxflrr.exe87⤵PID:1588
-
\??\c:\bbnnnn.exec:\bbnnnn.exe88⤵PID:868
-
\??\c:\dddjd.exec:\dddjd.exe89⤵PID:2032
-
\??\c:\pjdvd.exec:\pjdvd.exe90⤵PID:1088
-
\??\c:\7xfxflr.exec:\7xfxflr.exe91⤵PID:2212
-
\??\c:\hnntnh.exec:\hnntnh.exe92⤵PID:2432
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe93⤵PID:2808
-
\??\c:\tnhbht.exec:\tnhbht.exe94⤵PID:1684
-
\??\c:\hthhht.exec:\hthhht.exe95⤵PID:2156
-
\??\c:\1vvdv.exec:\1vvdv.exe96⤵PID:2640
-
\??\c:\lfxflxf.exec:\lfxflxf.exe97⤵PID:2772
-
\??\c:\1nhhnt.exec:\1nhhnt.exe98⤵PID:2784
-
\??\c:\bnthth.exec:\bnthth.exe99⤵PID:2688
-
\??\c:\pjvjp.exec:\pjvjp.exe100⤵PID:2340
-
\??\c:\xrfrlff.exec:\xrfrlff.exe101⤵PID:2888
-
\??\c:\nnhntb.exec:\nnhntb.exe102⤵PID:1508
-
\??\c:\ththtt.exec:\ththtt.exe103⤵PID:2788
-
\??\c:\dvjpj.exec:\dvjpj.exe104⤵PID:2540
-
\??\c:\1dppp.exec:\1dppp.exe105⤵PID:3036
-
\??\c:\xrrrxrx.exec:\xrrrxrx.exe106⤵PID:848
-
\??\c:\nbnhnn.exec:\nbnhnn.exe107⤵PID:1948
-
\??\c:\dvdvd.exec:\dvdvd.exe108⤵PID:2816
-
\??\c:\pjpvd.exec:\pjpvd.exe109⤵PID:296
-
\??\c:\5rlrxxx.exec:\5rlrxxx.exe110⤵PID:3020
-
\??\c:\xxlflrx.exec:\xxlflrx.exe111⤵PID:2848
-
\??\c:\hhtttb.exec:\hhtttb.exe112⤵PID:1912
-
\??\c:\1ddpp.exec:\1ddpp.exe113⤵PID:1944
-
\??\c:\vvjdj.exec:\vvjdj.exe114⤵PID:1824
-
\??\c:\flfrlfl.exec:\flfrlfl.exe115⤵PID:2576
-
\??\c:\9rxffrx.exec:\9rxffrx.exe116⤵PID:2864
-
\??\c:\ttnbbt.exec:\ttnbbt.exe117⤵PID:2872
-
\??\c:\pjddd.exec:\pjddd.exe118⤵PID:568
-
\??\c:\pvvdj.exec:\pvvdj.exe119⤵PID:832
-
\??\c:\fxllrll.exec:\fxllrll.exe120⤵PID:1656
-
\??\c:\hthnnh.exec:\hthnnh.exe121⤵PID:1812
-
\??\c:\5jppp.exec:\5jppp.exe122⤵PID:1772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-