Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 03:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe
-
Size
181KB
-
MD5
c6f02c59b49b45d68a56cc6296eaeed0
-
SHA1
a05a1821c4f31bcbec3df23cc40b27710fcba297
-
SHA256
74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671
-
SHA512
74f2ceca3d64096a36eeca50c02abf60654afec3dce478226aefeaf75c4df3e151b8a265e7f9f116bfb56b8346a55d216afa6ca05aa409ece66cef87defa93ac
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJPhbMX:PhOm2sI93UufdC67ciJTm5hIX
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2004-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1176-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1140-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-324-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-435-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1612-520-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-580-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-614-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-632-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-729-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-741-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-887-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-1177-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2784-1315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-1323-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2784-1321-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2004 xrfxrxf.exe 1140 bttttn.exe 2692 3jppd.exe 2600 lxllrlr.exe 2624 nbnnnh.exe 2484 3vppj.exe 2516 jvjdd.exe 2536 lffxrlf.exe 1668 3hnnnn.exe 1036 jdjdp.exe 1708 pdppp.exe 1576 frrffxf.exe 1260 nbhnnn.exe 1700 1pvvv.exe 1788 3pppd.exe 1720 1rfllrr.exe 2376 hbnhhb.exe 1444 pjddj.exe 2796 lflrxxf.exe 2828 3lrrxxl.exe 1992 9htbht.exe 2020 jdppv.exe 2216 lxllxxf.exe 2872 thhhhh.exe 1736 3thhnn.exe 1468 1dvdv.exe 1784 nhnbhn.exe 2228 nnbhtb.exe 1136 jjdjv.exe 848 9lxxxxx.exe 2288 5bnntt.exe 2308 7ddjj.exe 2160 ddjjv.exe 2064 frrrxxf.exe 2312 frrxlrx.exe 1512 hbttbt.exe 2592 7bbttn.exe 2868 dvdjv.exe 2732 lfrrffl.exe 2668 fxffllx.exe 2776 hthnnn.exe 2604 1jvvv.exe 2360 vppvp.exe 2492 7rrfflr.exe 2932 frfllll.exe 1624 nhtnhh.exe 348 1tnntt.exe 2352 7djjj.exe 2520 jddvd.exe 1220 lfrrxfl.exe 1572 fxxflrx.exe 1836 tntthh.exe 2108 tnhbbt.exe 2392 vpvdv.exe 2188 jdvdj.exe 1420 rfrllrr.exe 1440 rlrlxrx.exe 2376 nbntnn.exe 2792 bthhbh.exe 2796 vpdjp.exe 2244 jvdvd.exe 2440 xrffrrx.exe 2324 bbhhtb.exe 772 nhtnbb.exe -
resource yara_rule behavioral1/memory/1176-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1176-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1140-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1260-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-402-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-428-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-435-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-520-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-560-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-580-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-593-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-606-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-614-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-632-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-633-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-646-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-665-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-709-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-729-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-741-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/924-784-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-797-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-822-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-853-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-860-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-873-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-880-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-887-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-888-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-901-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-908-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1176 wrote to memory of 2004 1176 74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe 28 PID 1176 wrote to memory of 2004 1176 74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe 28 PID 1176 wrote to memory of 2004 1176 74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe 28 PID 1176 wrote to memory of 2004 1176 74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe 28 PID 2004 wrote to memory of 1140 2004 xrfxrxf.exe 29 PID 2004 wrote to memory of 1140 2004 xrfxrxf.exe 29 PID 2004 wrote to memory of 1140 2004 xrfxrxf.exe 29 PID 2004 wrote to memory of 1140 2004 xrfxrxf.exe 29 PID 1140 wrote to memory of 2692 1140 bttttn.exe 30 PID 1140 wrote to memory of 2692 1140 bttttn.exe 30 PID 1140 wrote to memory of 2692 1140 bttttn.exe 30 PID 1140 wrote to memory of 2692 1140 bttttn.exe 30 PID 2692 wrote to memory of 2600 2692 3jppd.exe 31 PID 2692 wrote to memory of 2600 2692 3jppd.exe 31 PID 2692 wrote to memory of 2600 2692 3jppd.exe 31 PID 2692 wrote to memory of 2600 2692 3jppd.exe 31 PID 2600 wrote to memory of 2624 2600 lxllrlr.exe 32 PID 2600 wrote to memory of 2624 2600 lxllrlr.exe 32 PID 2600 wrote to memory of 2624 2600 lxllrlr.exe 32 PID 2600 wrote to memory of 2624 2600 lxllrlr.exe 32 PID 2624 wrote to memory of 2484 2624 nbnnnh.exe 33 PID 2624 wrote to memory of 2484 2624 nbnnnh.exe 33 PID 2624 wrote to memory of 2484 2624 nbnnnh.exe 33 PID 2624 wrote to memory of 2484 2624 nbnnnh.exe 33 PID 2484 wrote to memory of 2516 2484 3vppj.exe 34 PID 2484 wrote to memory of 2516 2484 3vppj.exe 34 PID 2484 wrote to memory of 2516 2484 3vppj.exe 34 PID 2484 wrote to memory of 2516 2484 3vppj.exe 34 PID 2516 wrote to memory of 2536 2516 jvjdd.exe 35 PID 2516 wrote to memory of 2536 2516 jvjdd.exe 35 PID 2516 wrote to memory of 2536 2516 jvjdd.exe 35 PID 2516 wrote to memory of 2536 2516 jvjdd.exe 35 PID 2536 wrote to memory of 1668 2536 lffxrlf.exe 36 PID 2536 wrote to memory of 1668 2536 lffxrlf.exe 36 PID 2536 wrote to memory of 1668 2536 lffxrlf.exe 36 PID 2536 wrote to memory of 1668 2536 lffxrlf.exe 36 PID 1668 wrote to memory of 1036 1668 3hnnnn.exe 37 PID 1668 wrote to memory of 1036 1668 3hnnnn.exe 37 PID 1668 wrote to memory of 1036 1668 3hnnnn.exe 37 PID 1668 wrote to memory of 1036 1668 3hnnnn.exe 37 PID 1036 wrote to memory of 1708 1036 jdjdp.exe 38 PID 1036 wrote to memory of 1708 1036 jdjdp.exe 38 PID 1036 wrote to memory of 1708 1036 jdjdp.exe 38 PID 1036 wrote to memory of 1708 1036 jdjdp.exe 38 PID 1708 wrote to memory of 1576 1708 pdppp.exe 39 PID 1708 wrote to memory of 1576 1708 pdppp.exe 39 PID 1708 wrote to memory of 1576 1708 pdppp.exe 39 PID 1708 wrote to memory of 1576 1708 pdppp.exe 39 PID 1576 wrote to memory of 1260 1576 frrffxf.exe 40 PID 1576 wrote to memory of 1260 1576 frrffxf.exe 40 PID 1576 wrote to memory of 1260 1576 frrffxf.exe 40 PID 1576 wrote to memory of 1260 1576 frrffxf.exe 40 PID 1260 wrote to memory of 1700 1260 nbhnnn.exe 41 PID 1260 wrote to memory of 1700 1260 nbhnnn.exe 41 PID 1260 wrote to memory of 1700 1260 nbhnnn.exe 41 PID 1260 wrote to memory of 1700 1260 nbhnnn.exe 41 PID 1700 wrote to memory of 1788 1700 1pvvv.exe 42 PID 1700 wrote to memory of 1788 1700 1pvvv.exe 42 PID 1700 wrote to memory of 1788 1700 1pvvv.exe 42 PID 1700 wrote to memory of 1788 1700 1pvvv.exe 42 PID 1788 wrote to memory of 1720 1788 3pppd.exe 43 PID 1788 wrote to memory of 1720 1788 3pppd.exe 43 PID 1788 wrote to memory of 1720 1788 3pppd.exe 43 PID 1788 wrote to memory of 1720 1788 3pppd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\74b5996205fc2aa14cb1bc194a108b3ce8807bdbcf5ee6c99f93b2e5ceb89671_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\xrfxrxf.exec:\xrfxrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\bttttn.exec:\bttttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\3jppd.exec:\3jppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\lxllrlr.exec:\lxllrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nbnnnh.exec:\nbnnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\3vppj.exec:\3vppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\jvjdd.exec:\jvjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\lffxrlf.exec:\lffxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\3hnnnn.exec:\3hnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\jdjdp.exec:\jdjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\pdppp.exec:\pdppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\frrffxf.exec:\frrffxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\nbhnnn.exec:\nbhnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\1pvvv.exec:\1pvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\3pppd.exec:\3pppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\1rfllrr.exec:\1rfllrr.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hbnhhb.exec:\hbnhhb.exe18⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pjddj.exec:\pjddj.exe19⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lflrxxf.exec:\lflrxxf.exe20⤵
- Executes dropped EXE
PID:2796 -
\??\c:\3lrrxxl.exec:\3lrrxxl.exe21⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9htbht.exec:\9htbht.exe22⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jdppv.exec:\jdppv.exe23⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lxllxxf.exec:\lxllxxf.exe24⤵
- Executes dropped EXE
PID:2216 -
\??\c:\thhhhh.exec:\thhhhh.exe25⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3thhnn.exec:\3thhnn.exe26⤵
- Executes dropped EXE
PID:1736 -
\??\c:\1dvdv.exec:\1dvdv.exe27⤵
- Executes dropped EXE
PID:1468 -
\??\c:\nhnbhn.exec:\nhnbhn.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nnbhtb.exec:\nnbhtb.exe29⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jjdjv.exec:\jjdjv.exe30⤵
- Executes dropped EXE
PID:1136 -
\??\c:\9lxxxxx.exec:\9lxxxxx.exe31⤵
- Executes dropped EXE
PID:848 -
\??\c:\5bnntt.exec:\5bnntt.exe32⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7ddjj.exec:\7ddjj.exe33⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ddjjv.exec:\ddjjv.exe34⤵
- Executes dropped EXE
PID:2160 -
\??\c:\frrrxxf.exec:\frrrxxf.exe35⤵
- Executes dropped EXE
PID:2064 -
\??\c:\frrxlrx.exec:\frrxlrx.exe36⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hbttbt.exec:\hbttbt.exe37⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7bbttn.exec:\7bbttn.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dvdjv.exec:\dvdjv.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lfrrffl.exec:\lfrrffl.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\fxffllx.exec:\fxffllx.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hthnnn.exec:\hthnnn.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1jvvv.exec:\1jvvv.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vppvp.exec:\vppvp.exe44⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7rrfflr.exec:\7rrfflr.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\frfllll.exec:\frfllll.exe46⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nhtnhh.exec:\nhtnhh.exe47⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1tnntt.exec:\1tnntt.exe48⤵
- Executes dropped EXE
PID:348 -
\??\c:\7djjj.exec:\7djjj.exe49⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jddvd.exec:\jddvd.exe50⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe51⤵
- Executes dropped EXE
PID:1220 -
\??\c:\fxxflrx.exec:\fxxflrx.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tntthh.exec:\tntthh.exe53⤵
- Executes dropped EXE
PID:1836 -
\??\c:\tnhbbt.exec:\tnhbbt.exe54⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vpvdv.exec:\vpvdv.exe55⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jdvdj.exec:\jdvdj.exe56⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rfrllrr.exec:\rfrllrr.exe57⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rlrlxrx.exec:\rlrlxrx.exe58⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nbntnn.exec:\nbntnn.exe59⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bthhbh.exec:\bthhbh.exe60⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vpdjp.exec:\vpdjp.exe61⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jvdvd.exec:\jvdvd.exe62⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xrffrrx.exec:\xrffrrx.exe63⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bbhhtb.exec:\bbhhtb.exe64⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nhtnbb.exec:\nhtnbb.exe65⤵
- Executes dropped EXE
PID:772 -
\??\c:\jvddj.exec:\jvddj.exe66⤵PID:588
-
\??\c:\3rrrrrf.exec:\3rrrrrf.exe67⤵PID:584
-
\??\c:\rffxlfl.exec:\rffxlfl.exe68⤵PID:2420
-
\??\c:\tnhbnt.exec:\tnhbnt.exe69⤵PID:1612
-
\??\c:\nhtbht.exec:\nhtbht.exe70⤵PID:1284
-
\??\c:\pdpvj.exec:\pdpvj.exe71⤵PID:1020
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe72⤵PID:1208
-
\??\c:\7rxfrrx.exec:\7rxfrrx.exe73⤵PID:2056
-
\??\c:\bbnbbb.exec:\bbnbbb.exe74⤵PID:1136
-
\??\c:\hbnntn.exec:\hbnntn.exe75⤵PID:1232
-
\??\c:\5vjpp.exec:\5vjpp.exe76⤵PID:608
-
\??\c:\vpjvd.exec:\vpjvd.exe77⤵PID:2012
-
\??\c:\xrlrffl.exec:\xrlrffl.exe78⤵PID:1428
-
\??\c:\1frrrrx.exec:\1frrrrx.exe79⤵PID:2124
-
\??\c:\3htthh.exec:\3htthh.exe80⤵PID:2696
-
\??\c:\ddvdj.exec:\ddvdj.exe81⤵PID:2004
-
\??\c:\dpvdv.exec:\dpvdv.exe82⤵PID:1520
-
\??\c:\5xrlllr.exec:\5xrlllr.exe83⤵PID:2728
-
\??\c:\1fxxxfr.exec:\1fxxxfr.exe84⤵PID:2680
-
\??\c:\btntbh.exec:\btntbh.exe85⤵PID:3024
-
\??\c:\ddjjj.exec:\ddjjj.exe86⤵PID:2580
-
\??\c:\pjppp.exec:\pjppp.exe87⤵PID:2772
-
\??\c:\3rffxfr.exec:\3rffxfr.exe88⤵PID:2504
-
\??\c:\xrxfllx.exec:\xrxfllx.exe89⤵PID:2480
-
\??\c:\hbnbnn.exec:\hbnbnn.exe90⤵PID:2516
-
\??\c:\tthhnt.exec:\tthhnt.exe91⤵PID:2528
-
\??\c:\dvpdp.exec:\dvpdp.exe92⤵PID:1600
-
\??\c:\vjpjp.exec:\vjpjp.exe93⤵PID:2292
-
\??\c:\lxffffl.exec:\lxffffl.exe94⤵PID:1476
-
\??\c:\lxllrlr.exec:\lxllrlr.exe95⤵PID:2120
-
\??\c:\9ttthh.exec:\9ttthh.exe96⤵PID:1704
-
\??\c:\hhbnnt.exec:\hhbnnt.exe97⤵PID:808
-
\??\c:\jjvdp.exec:\jjvdp.exe98⤵PID:800
-
\??\c:\vppvd.exec:\vppvd.exe99⤵PID:1860
-
\??\c:\5lflxff.exec:\5lflxff.exe100⤵PID:1980
-
\??\c:\rfllxrr.exec:\rfllxrr.exe101⤵PID:2736
-
\??\c:\thhtbt.exec:\thhtbt.exe102⤵PID:1672
-
\??\c:\5nbhbh.exec:\5nbhbh.exe103⤵PID:1256
-
\??\c:\9vpjv.exec:\9vpjv.exe104⤵PID:2788
-
\??\c:\7rlrfrl.exec:\7rlrfrl.exe105⤵PID:2640
-
\??\c:\rxllxxf.exec:\rxllxxf.exe106⤵PID:2248
-
\??\c:\hbnbtb.exec:\hbnbtb.exe107⤵PID:2332
-
\??\c:\5hnnnn.exec:\5hnnnn.exe108⤵PID:1828
-
\??\c:\jvjpd.exec:\jvjpd.exe109⤵PID:2304
-
\??\c:\pjvvd.exec:\pjvvd.exe110⤵PID:924
-
\??\c:\fxffflr.exec:\fxffflr.exe111⤵PID:2644
-
\??\c:\3xlfrrf.exec:\3xlfrrf.exe112⤵PID:2812
-
\??\c:\5ttnbn.exec:\5ttnbn.exe113⤵PID:1280
-
\??\c:\bttbhb.exec:\bttbhb.exe114⤵PID:1692
-
\??\c:\vpddj.exec:\vpddj.exe115⤵PID:696
-
\??\c:\vpjvp.exec:\vpjvp.exe116⤵PID:752
-
\??\c:\xxrxllx.exec:\xxrxllx.exe117⤵PID:904
-
\??\c:\hbbbhh.exec:\hbbbhh.exe118⤵PID:2032
-
\??\c:\1nhhth.exec:\1nhhth.exe119⤵PID:1936
-
\??\c:\jvdjp.exec:\jvdjp.exe120⤵PID:2988
-
\??\c:\9jjdp.exec:\9jjdp.exe121⤵PID:2288
-
\??\c:\frxxxxx.exec:\frxxxxx.exe122⤵PID:2396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-