Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 09:23
Behavioral task
behavioral1
Sample
94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe
-
Size
192KB
-
MD5
5de02d80ceb5145cea521d80baf85a60
-
SHA1
543a2545e4e89132166e10bc420e20ddb7c10f08
-
SHA256
94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef
-
SHA512
2d6da6504ea834fccfccd1cf20041260105ea98d0fc5c9b33a4af319fb3b2d3961c14ba8c8591cc65c7b426996350721773581bda84e726e83618b00439ba41f
-
SSDEEP
3072:FhOmTsF93UYfwC6GIoutrVCfMoh52waAyiJ8mqtbfUVKty16hDsI/tSR:Fcm4FmowdHoS8fMoSVAHubPtyYxfk
Malware Config
Signatures
-
Detect Blackmoon payload 32 IoCs
resource yara_rule behavioral1/memory/332-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1612-18-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2804-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2588-37-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2592-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2480-73-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2904-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2452-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1956-101-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2184-126-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2352-137-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2228-140-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2252-155-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/780-157-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/540-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2984-226-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1836-258-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2072-292-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2136-306-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/332-307-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2972-322-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2732-341-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1584-360-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2664-373-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2480-375-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/896-415-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1680-442-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1104-532-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2076-577-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1628-606-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2728-643-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1960-831-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1612 9htthb.exe 2804 vjpvv.exe 2588 fxfffrf.exe 2592 pdpjj.exe 2292 jvddj.exe 2464 xlrllfx.exe 2480 3nbbbb.exe 2452 ddjpj.exe 2904 xxrxfrl.exe 1956 9lxffxx.exe 2708 jddpv.exe 2692 dvdvd.exe 2184 lfxxfxl.exe 2352 tbbhnh.exe 2228 7dppj.exe 2252 pdjvv.exe 780 bnbntt.exe 1608 hbhtnb.exe 1644 vpdvd.exe 2120 xlrxxff.exe 2836 rfrlrlr.exe 1160 1btbhb.exe 540 9pjvd.exe 812 lfxflrr.exe 2984 ttbtth.exe 844 ththnh.exe 1664 7lflrxf.exe 1836 xrflxrx.exe 1892 thtnnt.exe 788 vdjjj.exe 676 rrxfxxf.exe 2072 tnnnnn.exe 888 dpddd.exe 2136 jvvvv.exe 332 xlxllfr.exe 2204 bnbhhb.exe 2972 btnttb.exe 836 jdpjj.exe 2732 lfxxxxl.exe 2632 bntnnn.exe 2988 tbnbbt.exe 1584 jvppj.exe 2740 9jvdj.exe 2664 xxllrrx.exe 2480 btbbnn.exe 2456 dvpvj.exe 2920 pdjvv.exe 2676 rflffxf.exe 2680 htbntt.exe 2800 dpppv.exe 896 vjvdp.exe 2332 xflffxx.exe 2028 rfllrrf.exe 1680 thtttt.exe 2228 9pddj.exe 548 dvvvj.exe 1028 5rflrlr.exe 1448 rlrxlrr.exe 1608 hnbbhh.exe 1656 vdjpd.exe 2420 lfxlrxl.exe 1264 rfrxlll.exe 2276 nntttt.exe 592 hhhhtn.exe -
resource yara_rule behavioral1/memory/332-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000b000000015ca5-5.dat upx behavioral1/memory/332-8-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/332-7-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/files/0x0033000000015cec-17.dat upx behavioral1/memory/1612-18-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2804-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015f1b-26.dat upx behavioral1/memory/2804-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2588-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2588-37-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015f9e-38.dat upx behavioral1/files/0x0007000000016056-45.dat upx behavioral1/memory/2592-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00070000000160f8-55.dat upx behavioral1/files/0x0008000000016411-64.dat upx behavioral1/files/0x0007000000016cf5-74.dat upx behavioral1/memory/2480-73-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016cfe-79.dat upx behavioral1/memory/2904-84-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2452-82-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d06-91.dat upx behavioral1/memory/1956-92-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1956-101-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d0e-99.dat upx behavioral1/files/0x0006000000016d17-109.dat upx behavioral1/files/0x0006000000016d1f-116.dat upx behavioral1/files/0x0006000000016d27-124.dat upx behavioral1/memory/2184-126-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d3b-138.dat upx behavioral1/memory/2352-137-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2228-140-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d40-146.dat upx behavioral1/files/0x0006000000016d44-153.dat upx behavioral1/memory/2252-155-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/780-157-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d4b-163.dat upx behavioral1/files/0x0006000000016d67-171.dat upx behavioral1/files/0x0006000000016f82-180.dat upx behavioral1/files/0x0006000000017060-188.dat upx behavioral1/memory/2836-196-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/files/0x0006000000017185-197.dat upx behavioral1/files/0x0006000000017384-204.dat upx behavioral1/memory/540-208-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000017387-215.dat upx behavioral1/files/0x0006000000017458-222.dat upx behavioral1/memory/2984-226-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0033000000015cf7-231.dat upx behavioral1/memory/844-233-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000017465-241.dat upx behavioral1/files/0x0006000000017474-249.dat upx behavioral1/memory/1836-250-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0009000000018648-259.dat upx behavioral1/memory/1836-258-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0031000000018649-267.dat upx behavioral1/memory/1892-263-0x00000000001B0000-0x00000000001E6000-memory.dmp upx behavioral1/files/0x000500000001865b-276.dat upx behavioral1/files/0x0005000000018664-284.dat upx behavioral1/memory/2072-292-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2136-299-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2136-306-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/332-307-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2972-322-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/836-328-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 332 wrote to memory of 1612 332 94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe 28 PID 332 wrote to memory of 1612 332 94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe 28 PID 332 wrote to memory of 1612 332 94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe 28 PID 332 wrote to memory of 1612 332 94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe 28 PID 1612 wrote to memory of 2804 1612 9htthb.exe 29 PID 1612 wrote to memory of 2804 1612 9htthb.exe 29 PID 1612 wrote to memory of 2804 1612 9htthb.exe 29 PID 1612 wrote to memory of 2804 1612 9htthb.exe 29 PID 2804 wrote to memory of 2588 2804 vjpvv.exe 30 PID 2804 wrote to memory of 2588 2804 vjpvv.exe 30 PID 2804 wrote to memory of 2588 2804 vjpvv.exe 30 PID 2804 wrote to memory of 2588 2804 vjpvv.exe 30 PID 2588 wrote to memory of 2592 2588 fxfffrf.exe 31 PID 2588 wrote to memory of 2592 2588 fxfffrf.exe 31 PID 2588 wrote to memory of 2592 2588 fxfffrf.exe 31 PID 2588 wrote to memory of 2592 2588 fxfffrf.exe 31 PID 2592 wrote to memory of 2292 2592 pdpjj.exe 32 PID 2592 wrote to memory of 2292 2592 pdpjj.exe 32 PID 2592 wrote to memory of 2292 2592 pdpjj.exe 32 PID 2592 wrote to memory of 2292 2592 pdpjj.exe 32 PID 2292 wrote to memory of 2464 2292 jvddj.exe 33 PID 2292 wrote to memory of 2464 2292 jvddj.exe 33 PID 2292 wrote to memory of 2464 2292 jvddj.exe 33 PID 2292 wrote to memory of 2464 2292 jvddj.exe 33 PID 2464 wrote to memory of 2480 2464 xlrllfx.exe 34 PID 2464 wrote to memory of 2480 2464 xlrllfx.exe 34 PID 2464 wrote to memory of 2480 2464 xlrllfx.exe 34 PID 2464 wrote to memory of 2480 2464 xlrllfx.exe 34 PID 2480 wrote to memory of 2452 2480 3nbbbb.exe 35 PID 2480 wrote to memory of 2452 2480 3nbbbb.exe 35 PID 2480 wrote to memory of 2452 2480 3nbbbb.exe 35 PID 2480 wrote to memory of 2452 2480 3nbbbb.exe 35 PID 2452 wrote to memory of 2904 2452 ddjpj.exe 36 PID 2452 wrote to memory of 2904 2452 ddjpj.exe 36 PID 2452 wrote to memory of 2904 2452 ddjpj.exe 36 PID 2452 wrote to memory of 2904 2452 ddjpj.exe 36 PID 2904 wrote to memory of 1956 2904 xxrxfrl.exe 37 PID 2904 wrote to memory of 1956 2904 xxrxfrl.exe 37 PID 2904 wrote to memory of 1956 2904 xxrxfrl.exe 37 PID 2904 wrote to memory of 1956 2904 xxrxfrl.exe 37 PID 1956 wrote to memory of 2708 1956 9lxffxx.exe 38 PID 1956 wrote to memory of 2708 1956 9lxffxx.exe 38 PID 1956 wrote to memory of 2708 1956 9lxffxx.exe 38 PID 1956 wrote to memory of 2708 1956 9lxffxx.exe 38 PID 2708 wrote to memory of 2692 2708 jddpv.exe 39 PID 2708 wrote to memory of 2692 2708 jddpv.exe 39 PID 2708 wrote to memory of 2692 2708 jddpv.exe 39 PID 2708 wrote to memory of 2692 2708 jddpv.exe 39 PID 2692 wrote to memory of 2184 2692 dvdvd.exe 40 PID 2692 wrote to memory of 2184 2692 dvdvd.exe 40 PID 2692 wrote to memory of 2184 2692 dvdvd.exe 40 PID 2692 wrote to memory of 2184 2692 dvdvd.exe 40 PID 2184 wrote to memory of 2352 2184 lfxxfxl.exe 41 PID 2184 wrote to memory of 2352 2184 lfxxfxl.exe 41 PID 2184 wrote to memory of 2352 2184 lfxxfxl.exe 41 PID 2184 wrote to memory of 2352 2184 lfxxfxl.exe 41 PID 2352 wrote to memory of 2228 2352 tbbhnh.exe 42 PID 2352 wrote to memory of 2228 2352 tbbhnh.exe 42 PID 2352 wrote to memory of 2228 2352 tbbhnh.exe 42 PID 2352 wrote to memory of 2228 2352 tbbhnh.exe 42 PID 2228 wrote to memory of 2252 2228 7dppj.exe 43 PID 2228 wrote to memory of 2252 2228 7dppj.exe 43 PID 2228 wrote to memory of 2252 2228 7dppj.exe 43 PID 2228 wrote to memory of 2252 2228 7dppj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\9htthb.exec:\9htthb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\vjpvv.exec:\vjpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\fxfffrf.exec:\fxfffrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pdpjj.exec:\pdpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jvddj.exec:\jvddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\xlrllfx.exec:\xlrllfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\3nbbbb.exec:\3nbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\ddjpj.exec:\ddjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\xxrxfrl.exec:\xxrxfrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\9lxffxx.exec:\9lxffxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\jddpv.exec:\jddpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\dvdvd.exec:\dvdvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\lfxxfxl.exec:\lfxxfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\tbbhnh.exec:\tbbhnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\7dppj.exec:\7dppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\pdjvv.exec:\pdjvv.exe17⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bnbntt.exec:\bnbntt.exe18⤵
- Executes dropped EXE
PID:780 -
\??\c:\hbhtnb.exec:\hbhtnb.exe19⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vpdvd.exec:\vpdvd.exe20⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xlrxxff.exec:\xlrxxff.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rfrlrlr.exec:\rfrlrlr.exe22⤵
- Executes dropped EXE
PID:2836 -
\??\c:\1btbhb.exec:\1btbhb.exe23⤵
- Executes dropped EXE
PID:1160 -
\??\c:\9pjvd.exec:\9pjvd.exe24⤵
- Executes dropped EXE
PID:540 -
\??\c:\lfxflrr.exec:\lfxflrr.exe25⤵
- Executes dropped EXE
PID:812 -
\??\c:\ttbtth.exec:\ttbtth.exe26⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ththnh.exec:\ththnh.exe27⤵
- Executes dropped EXE
PID:844 -
\??\c:\7lflrxf.exec:\7lflrxf.exe28⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xrflxrx.exec:\xrflxrx.exe29⤵
- Executes dropped EXE
PID:1836 -
\??\c:\thtnnt.exec:\thtnnt.exe30⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vdjjj.exec:\vdjjj.exe31⤵
- Executes dropped EXE
PID:788 -
\??\c:\rrxfxxf.exec:\rrxfxxf.exe32⤵
- Executes dropped EXE
PID:676 -
\??\c:\tnnnnn.exec:\tnnnnn.exe33⤵
- Executes dropped EXE
PID:2072 -
\??\c:\dpddd.exec:\dpddd.exe34⤵
- Executes dropped EXE
PID:888 -
\??\c:\jvvvv.exec:\jvvvv.exe35⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xlxllfr.exec:\xlxllfr.exe36⤵
- Executes dropped EXE
PID:332 -
\??\c:\bnbhhb.exec:\bnbhhb.exe37⤵
- Executes dropped EXE
PID:2204 -
\??\c:\btnttb.exec:\btnttb.exe38⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jdpjj.exec:\jdpjj.exe39⤵
- Executes dropped EXE
PID:836 -
\??\c:\lfxxxxl.exec:\lfxxxxl.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bntnnn.exec:\bntnnn.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tbnbbt.exec:\tbnbbt.exe42⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jvppj.exec:\jvppj.exe43⤵
- Executes dropped EXE
PID:1584 -
\??\c:\9jvdj.exec:\9jvdj.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xxllrrx.exec:\xxllrrx.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\btbbnn.exec:\btbbnn.exe46⤵
- Executes dropped EXE
PID:2480 -
\??\c:\dvpvj.exec:\dvpvj.exe47⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pdjvv.exec:\pdjvv.exe48⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rflffxf.exec:\rflffxf.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\htbntt.exec:\htbntt.exe50⤵
- Executes dropped EXE
PID:2680 -
\??\c:\dpppv.exec:\dpppv.exe51⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vjvdp.exec:\vjvdp.exe52⤵
- Executes dropped EXE
PID:896 -
\??\c:\xflffxx.exec:\xflffxx.exe53⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rfllrrf.exec:\rfllrrf.exe54⤵
- Executes dropped EXE
PID:2028 -
\??\c:\thtttt.exec:\thtttt.exe55⤵
- Executes dropped EXE
PID:1680 -
\??\c:\9pddj.exec:\9pddj.exe56⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dvvvj.exec:\dvvvj.exe57⤵
- Executes dropped EXE
PID:548 -
\??\c:\5rflrlr.exec:\5rflrlr.exe58⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rlrxlrr.exec:\rlrxlrr.exe59⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hnbbhh.exec:\hnbbhh.exe60⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vdjpd.exec:\vdjpd.exe61⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe62⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rfrxlll.exec:\rfrxlll.exe63⤵
- Executes dropped EXE
PID:1264 -
\??\c:\nntttt.exec:\nntttt.exe64⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hhhhtn.exec:\hhhhtn.exe65⤵
- Executes dropped EXE
PID:592 -
\??\c:\vpjjv.exec:\vpjjv.exe66⤵PID:336
-
\??\c:\lfllrlr.exec:\lfllrlr.exe67⤵PID:1516
-
\??\c:\rfrfrrx.exec:\rfrfrrx.exe68⤵PID:1924
-
\??\c:\ttnntt.exec:\ttnntt.exe69⤵PID:1800
-
\??\c:\bntbbh.exec:\bntbbh.exe70⤵PID:1104
-
\??\c:\ddppp.exec:\ddppp.exe71⤵PID:652
-
\??\c:\xxrrxfr.exec:\xxrrxfr.exe72⤵PID:1916
-
\??\c:\rfxxlff.exec:\rfxxlff.exe73⤵PID:960
-
\??\c:\bnhnhh.exec:\bnhnhh.exe74⤵PID:704
-
\??\c:\bthhnh.exec:\bthhnh.exe75⤵PID:2000
-
\??\c:\jvpdj.exec:\jvpdj.exe76⤵PID:1204
-
\??\c:\xrlrllr.exec:\xrlrllr.exe77⤵PID:2076
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe78⤵PID:1528
-
\??\c:\ntbbtt.exec:\ntbbtt.exe79⤵PID:3044
-
\??\c:\1hnhnh.exec:\1hnhnh.exe80⤵PID:2064
-
\??\c:\dvddd.exec:\dvddd.exe81⤵PID:1628
-
\??\c:\rxrllfr.exec:\rxrllfr.exe82⤵PID:2520
-
\??\c:\frxfrlr.exec:\frxfrlr.exe83⤵PID:2544
-
\??\c:\hbhhtt.exec:\hbhhtt.exe84⤵PID:2652
-
\??\c:\vjvjj.exec:\vjvjj.exe85⤵PID:2824
-
\??\c:\ppjpv.exec:\ppjpv.exe86⤵PID:2744
-
\??\c:\lrffxff.exec:\lrffxff.exe87⤵PID:2632
-
\??\c:\ntnhnt.exec:\ntnhnt.exe88⤵PID:2728
-
\??\c:\1nbhhn.exec:\1nbhhn.exe89⤵PID:2576
-
\??\c:\jjddp.exec:\jjddp.exe90⤵PID:2440
-
\??\c:\9pjdv.exec:\9pjdv.exe91⤵PID:2492
-
\??\c:\frxxflr.exec:\frxxflr.exe92⤵PID:2900
-
\??\c:\3hthtn.exec:\3hthtn.exe93⤵PID:2456
-
\??\c:\nnbhnb.exec:\nnbhnb.exe94⤵PID:2684
-
\??\c:\vvdpd.exec:\vvdpd.exe95⤵PID:2676
-
\??\c:\jdpjd.exec:\jdpjd.exe96⤵PID:2680
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe97⤵PID:2392
-
\??\c:\7fxxfxf.exec:\7fxxfxf.exe98⤵PID:896
-
\??\c:\bhnnhh.exec:\bhnnhh.exe99⤵PID:1820
-
\??\c:\tbbtbt.exec:\tbbtbt.exe100⤵PID:2028
-
\??\c:\jvppp.exec:\jvppp.exe101⤵PID:1032
-
\??\c:\pdjjp.exec:\pdjjp.exe102⤵PID:2380
-
\??\c:\llxlrfl.exec:\llxlrfl.exe103⤵PID:556
-
\??\c:\tntnnt.exec:\tntnnt.exe104⤵PID:1720
-
\??\c:\bthhth.exec:\bthhth.exe105⤵PID:1648
-
\??\c:\pdpvj.exec:\pdpvj.exe106⤵PID:2300
-
\??\c:\dvjjv.exec:\dvjjv.exe107⤵PID:1280
-
\??\c:\lfrrxrr.exec:\lfrrxrr.exe108⤵PID:2980
-
\??\c:\hthntn.exec:\hthntn.exe109⤵PID:2832
-
\??\c:\thhntt.exec:\thhntt.exe110⤵PID:2308
-
\??\c:\pdpjv.exec:\pdpjv.exe111⤵PID:1100
-
\??\c:\dddjv.exec:\dddjv.exe112⤵PID:1000
-
\??\c:\7rfxxrr.exec:\7rfxxrr.exe113⤵PID:908
-
\??\c:\ffxllxx.exec:\ffxllxx.exe114⤵PID:2984
-
\??\c:\ttbhtb.exec:\ttbhtb.exe115⤵PID:1692
-
\??\c:\jvdvv.exec:\jvdvv.exe116⤵PID:1324
-
\??\c:\5vddj.exec:\5vddj.exe117⤵PID:1960
-
\??\c:\lxrrffr.exec:\lxrrffr.exe118⤵PID:652
-
\??\c:\nhtntn.exec:\nhtntn.exe119⤵PID:2372
-
\??\c:\9bbbnb.exec:\9bbbnb.exe120⤵PID:2032
-
\??\c:\7vppp.exec:\7vppp.exe121⤵PID:2260
-
\??\c:\pdppv.exec:\pdppv.exe122⤵PID:792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-