Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 01:13
Behavioral task
behavioral1
Sample
2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe
-
Size
93KB
-
MD5
2aebcbdb10d9417faf0240a0e2bcb3c0
-
SHA1
68ed6ecf8c875f1e3b532475cdd8351332621657
-
SHA256
56b3d100bc4763e080af4662295a7e66d03c85c79e8021cd6a331ee4a589c57b
-
SHA512
b11c73292de23d92e3aaadc909e750bdecb14df72b11567bc90e317222be676a990bccefab40145390067d858bb6f16d554687aea36bd20d0711c033345df240
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWp8w:8hOmTsF93UYfwC6GIout0fmCiiiXA6mR
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/1408-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-677-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2500-1137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-985-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1816-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-623-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-421-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1440-415-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1332-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-298-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/968-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1168-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-4387-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/1736-4388-0x0000000077680000-0x000000007777A000-memory.dmp family_blackmoon behavioral1/memory/1736-9102-0x0000000077680000-0x000000007777A000-memory.dmp family_blackmoon behavioral1/memory/1736-19570-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/1736-29692-0x0000000077680000-0x000000007777A000-memory.dmp family_blackmoon behavioral1/memory/1736-30858-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3036 pvjjd.exe 1408 rfrrrrf.exe 3064 xxrxrfx.exe 2692 7thbhh.exe 2600 bhhbbt.exe 2128 dppjj.exe 2476 frfxlfr.exe 2736 thtbhn.exe 2480 bhhttb.exe 2976 jppvv.exe 2000 dvdpd.exe 2648 1fxfxlx.exe 2776 xxrlflx.exe 1772 thtntt.exe 2012 vdpvv.exe 2332 jdjdj.exe 2004 frlrrff.exe 1696 xfxxlrr.exe 2364 nthntt.exe 1632 tttnth.exe 2256 djjvv.exe 1168 lxflxrx.exe 2428 fxxlxfl.exe 2888 tbhhhh.exe 684 thnhbt.exe 1020 dpvvd.exe 2412 dvvvp.exe 1372 rxrlfrf.exe 1756 xfrxfff.exe 1628 bhnnnh.exe 1668 djdpd.exe 968 ppvdj.exe 1456 xxfxffr.exe 2920 nthhnt.exe 1700 pjvpv.exe 612 1rxllff.exe 1516 rrxrxfr.exe 2960 hthttn.exe 2356 hbtnbb.exe 3012 ppddp.exe 1612 jpvpv.exe 2988 xflxflf.exe 2716 xxrxrxx.exe 2780 htbbhn.exe 2172 nthhbt.exe 2560 jvppv.exe 2440 pvvdv.exe 2520 xfflxxl.exe 2740 3xllrrl.exe 2732 bnbnnh.exe 2660 vjdjd.exe 2764 5vvjj.exe 2636 9rlrrlr.exe 2772 7xflrxl.exe 1992 hhhtnb.exe 1332 vvppv.exe 760 djvjp.exe 2332 pjppd.exe 1440 xfrffxr.exe 2544 rrrrrfr.exe 2212 nhntnt.exe 1820 hnbnhb.exe 2612 jpvvj.exe 2876 pvjvj.exe -
resource yara_rule behavioral1/files/0x000b000000013a3f-8.dat upx behavioral1/memory/1408-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000143fb-34.dat upx behavioral1/files/0x0007000000014457-41.dat upx behavioral1/memory/2600-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-49-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00090000000144f1-64.dat upx behavioral1/files/0x0006000000015083-80.dat upx behavioral1/files/0x00060000000153ee-97.dat upx behavioral1/memory/2648-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ae3-127.dat upx behavioral1/memory/2332-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c9a-150.dat upx behavioral1/files/0x0006000000015cb1-167.dat upx behavioral1/files/0x0006000000015cd2-182.dat upx behavioral1/files/0x0006000000015cee-197.dat upx behavioral1/files/0x0006000000015d0a-214.dat upx behavioral1/files/0x0006000000015d39-229.dat upx behavioral1/files/0x0006000000015d61-242.dat upx behavioral1/files/0x0006000000015d85-250.dat upx behavioral1/memory/1456-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1700-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2440-349-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-388-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2852-1078-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1172-1089-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2500-1137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2468-1153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1816-1185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-1191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1596-1224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-1240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-1208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2412-1011-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1924-985-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1600-954-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-858-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1652-817-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-786-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-780-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1800-759-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/280-748-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2004-671-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1816-645-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-623-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-586-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-580-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2300-574-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-533-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2112-497-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/704-471-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1988-450-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1988-444-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-438-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2212-422-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1332-399-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-382-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-376-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-360-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2440-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-332-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1612-314-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 3036 2356 2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe 28 PID 2356 wrote to memory of 3036 2356 2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe 28 PID 2356 wrote to memory of 3036 2356 2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe 28 PID 2356 wrote to memory of 3036 2356 2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe 28 PID 3036 wrote to memory of 1408 3036 pvjjd.exe 29 PID 3036 wrote to memory of 1408 3036 pvjjd.exe 29 PID 3036 wrote to memory of 1408 3036 pvjjd.exe 29 PID 3036 wrote to memory of 1408 3036 pvjjd.exe 29 PID 1408 wrote to memory of 3064 1408 rfrrrrf.exe 30 PID 1408 wrote to memory of 3064 1408 rfrrrrf.exe 30 PID 1408 wrote to memory of 3064 1408 rfrrrrf.exe 30 PID 1408 wrote to memory of 3064 1408 rfrrrrf.exe 30 PID 3064 wrote to memory of 2692 3064 xxrxrfx.exe 31 PID 3064 wrote to memory of 2692 3064 xxrxrfx.exe 31 PID 3064 wrote to memory of 2692 3064 xxrxrfx.exe 31 PID 3064 wrote to memory of 2692 3064 xxrxrfx.exe 31 PID 2692 wrote to memory of 2600 2692 7thbhh.exe 32 PID 2692 wrote to memory of 2600 2692 7thbhh.exe 32 PID 2692 wrote to memory of 2600 2692 7thbhh.exe 32 PID 2692 wrote to memory of 2600 2692 7thbhh.exe 32 PID 2600 wrote to memory of 2128 2600 bhhbbt.exe 33 PID 2600 wrote to memory of 2128 2600 bhhbbt.exe 33 PID 2600 wrote to memory of 2128 2600 bhhbbt.exe 33 PID 2600 wrote to memory of 2128 2600 bhhbbt.exe 33 PID 2128 wrote to memory of 2476 2128 dppjj.exe 34 PID 2128 wrote to memory of 2476 2128 dppjj.exe 34 PID 2128 wrote to memory of 2476 2128 dppjj.exe 34 PID 2128 wrote to memory of 2476 2128 dppjj.exe 34 PID 2476 wrote to memory of 2736 2476 frfxlfr.exe 35 PID 2476 wrote to memory of 2736 2476 frfxlfr.exe 35 PID 2476 wrote to memory of 2736 2476 frfxlfr.exe 35 PID 2476 wrote to memory of 2736 2476 frfxlfr.exe 35 PID 2736 wrote to memory of 2480 2736 thtbhn.exe 36 PID 2736 wrote to memory of 2480 2736 thtbhn.exe 36 PID 2736 wrote to memory of 2480 2736 thtbhn.exe 36 PID 2736 wrote to memory of 2480 2736 thtbhn.exe 36 PID 2480 wrote to memory of 2976 2480 bhhttb.exe 37 PID 2480 wrote to memory of 2976 2480 bhhttb.exe 37 PID 2480 wrote to memory of 2976 2480 bhhttb.exe 37 PID 2480 wrote to memory of 2976 2480 bhhttb.exe 37 PID 2976 wrote to memory of 2000 2976 jppvv.exe 38 PID 2976 wrote to memory of 2000 2976 jppvv.exe 38 PID 2976 wrote to memory of 2000 2976 jppvv.exe 38 PID 2976 wrote to memory of 2000 2976 jppvv.exe 38 PID 2000 wrote to memory of 2648 2000 dvdpd.exe 39 PID 2000 wrote to memory of 2648 2000 dvdpd.exe 39 PID 2000 wrote to memory of 2648 2000 dvdpd.exe 39 PID 2000 wrote to memory of 2648 2000 dvdpd.exe 39 PID 2648 wrote to memory of 2776 2648 1fxfxlx.exe 40 PID 2648 wrote to memory of 2776 2648 1fxfxlx.exe 40 PID 2648 wrote to memory of 2776 2648 1fxfxlx.exe 40 PID 2648 wrote to memory of 2776 2648 1fxfxlx.exe 40 PID 2776 wrote to memory of 1772 2776 xxrlflx.exe 41 PID 2776 wrote to memory of 1772 2776 xxrlflx.exe 41 PID 2776 wrote to memory of 1772 2776 xxrlflx.exe 41 PID 2776 wrote to memory of 1772 2776 xxrlflx.exe 41 PID 1772 wrote to memory of 2012 1772 thtntt.exe 42 PID 1772 wrote to memory of 2012 1772 thtntt.exe 42 PID 1772 wrote to memory of 2012 1772 thtntt.exe 42 PID 1772 wrote to memory of 2012 1772 thtntt.exe 42 PID 2012 wrote to memory of 2332 2012 vdpvv.exe 43 PID 2012 wrote to memory of 2332 2012 vdpvv.exe 43 PID 2012 wrote to memory of 2332 2012 vdpvv.exe 43 PID 2012 wrote to memory of 2332 2012 vdpvv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pvjjd.exec:\pvjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\rfrrrrf.exec:\rfrrrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\xxrxrfx.exec:\xxrxrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\7thbhh.exec:\7thbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\bhhbbt.exec:\bhhbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\dppjj.exec:\dppjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\frfxlfr.exec:\frfxlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\thtbhn.exec:\thtbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\bhhttb.exec:\bhhttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\jppvv.exec:\jppvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\dvdpd.exec:\dvdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\1fxfxlx.exec:\1fxfxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\xxrlflx.exec:\xxrlflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\thtntt.exec:\thtntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\vdpvv.exec:\vdpvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\jdjdj.exec:\jdjdj.exe17⤵
- Executes dropped EXE
PID:2332 -
\??\c:\frlrrff.exec:\frlrrff.exe18⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xfxxlrr.exec:\xfxxlrr.exe19⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nthntt.exec:\nthntt.exe20⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tttnth.exec:\tttnth.exe21⤵
- Executes dropped EXE
PID:1632 -
\??\c:\djjvv.exec:\djjvv.exe22⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lxflxrx.exec:\lxflxrx.exe23⤵
- Executes dropped EXE
PID:1168 -
\??\c:\fxxlxfl.exec:\fxxlxfl.exe24⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tbhhhh.exec:\tbhhhh.exe25⤵
- Executes dropped EXE
PID:2888 -
\??\c:\thnhbt.exec:\thnhbt.exe26⤵
- Executes dropped EXE
PID:684 -
\??\c:\dpvvd.exec:\dpvvd.exe27⤵
- Executes dropped EXE
PID:1020 -
\??\c:\dvvvp.exec:\dvvvp.exe28⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rxrlfrf.exec:\rxrlfrf.exe29⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xfrxfff.exec:\xfrxfff.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bhnnnh.exec:\bhnnnh.exe31⤵
- Executes dropped EXE
PID:1628 -
\??\c:\djdpd.exec:\djdpd.exe32⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ppvdj.exec:\ppvdj.exe33⤵
- Executes dropped EXE
PID:968 -
\??\c:\xxfxffr.exec:\xxfxffr.exe34⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nthhnt.exec:\nthhnt.exe35⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pjvpv.exec:\pjvpv.exe36⤵
- Executes dropped EXE
PID:1700 -
\??\c:\1rxllff.exec:\1rxllff.exe37⤵
- Executes dropped EXE
PID:612 -
\??\c:\rrxrxfr.exec:\rrxrxfr.exe38⤵
- Executes dropped EXE
PID:1516 -
\??\c:\hthttn.exec:\hthttn.exe39⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hbtnbb.exec:\hbtnbb.exe40⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ppddp.exec:\ppddp.exe41⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jpvpv.exec:\jpvpv.exe42⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xflxflf.exec:\xflxflf.exe43⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xxrxrxx.exec:\xxrxrxx.exe44⤵
- Executes dropped EXE
PID:2716 -
\??\c:\htbbhn.exec:\htbbhn.exe45⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nthhbt.exec:\nthhbt.exe46⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jvppv.exec:\jvppv.exe47⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pvvdv.exec:\pvvdv.exe48⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xfflxxl.exec:\xfflxxl.exe49⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3xllrrl.exec:\3xllrrl.exe50⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bnbnnh.exec:\bnbnnh.exe51⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vjdjd.exec:\vjdjd.exe52⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5vvjj.exec:\5vvjj.exe53⤵
- Executes dropped EXE
PID:2764 -
\??\c:\9rlrrlr.exec:\9rlrrlr.exe54⤵
- Executes dropped EXE
PID:2636 -
\??\c:\7xflrxl.exec:\7xflrxl.exe55⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hhhtnb.exec:\hhhtnb.exe56⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vvppv.exec:\vvppv.exe57⤵
- Executes dropped EXE
PID:1332 -
\??\c:\djvjp.exec:\djvjp.exe58⤵
- Executes dropped EXE
PID:760 -
\??\c:\pjppd.exec:\pjppd.exe59⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xfrffxr.exec:\xfrffxr.exe60⤵
- Executes dropped EXE
PID:1440 -
\??\c:\rrrrrfr.exec:\rrrrrfr.exe61⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nhntnt.exec:\nhntnt.exe62⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hnbnhb.exec:\hnbnhb.exe63⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jpvvj.exec:\jpvvj.exe64⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pvjvj.exec:\pvjvj.exe65⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rffrffl.exec:\rffrffl.exe66⤵PID:1988
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe67⤵PID:2872
-
\??\c:\nbhtbt.exec:\nbhtbt.exe68⤵PID:2752
-
\??\c:\bthbhh.exec:\bthbhh.exe69⤵PID:992
-
\??\c:\pjjjp.exec:\pjjjp.exe70⤵PID:688
-
\??\c:\pjvpd.exec:\pjvpd.exe71⤵PID:704
-
\??\c:\frfxxrf.exec:\frfxxrf.exe72⤵PID:2088
-
\??\c:\rffxfrx.exec:\rffxfrx.exe73⤵PID:1552
-
\??\c:\hnhthb.exec:\hnhthb.exe74⤵PID:924
-
\??\c:\btbtbb.exec:\btbtbb.exe75⤵PID:1864
-
\??\c:\pvpjp.exec:\pvpjp.exe76⤵PID:2112
-
\??\c:\vvpvd.exec:\vvpvd.exe77⤵PID:1164
-
\??\c:\flrlxfr.exec:\flrlxfr.exe78⤵PID:2756
-
\??\c:\fxfrxrr.exec:\fxfrxrr.exe79⤵PID:2224
-
\??\c:\hhbhth.exec:\hhbhth.exe80⤵PID:968
-
\??\c:\tbthbn.exec:\tbthbn.exe81⤵PID:2820
-
\??\c:\hbhhbt.exec:\hbhhbt.exe82⤵PID:1456
-
\??\c:\9dvjv.exec:\9dvjv.exe83⤵PID:2268
-
\??\c:\jjvvj.exec:\jjvvj.exe84⤵PID:2852
-
\??\c:\flfxxxx.exec:\flfxxxx.exe85⤵PID:1700
-
\??\c:\rxxxxrx.exec:\rxxxxrx.exe86⤵PID:3068
-
\??\c:\lrfxffl.exec:\lrfxffl.exe87⤵PID:2896
-
\??\c:\nbtnth.exec:\nbtnth.exe88⤵PID:2188
-
\??\c:\hthnhn.exec:\hthnhn.exe89⤵PID:1676
-
\??\c:\bnthnt.exec:\bnthnt.exe90⤵PID:1244
-
\??\c:\djppv.exec:\djppv.exe91⤵PID:2300
-
\??\c:\pdddj.exec:\pdddj.exe92⤵PID:2708
-
\??\c:\lxllrrf.exec:\lxllrrf.exe93⤵PID:2748
-
\??\c:\xxxrxrf.exec:\xxxrxrf.exe94⤵PID:2856
-
\??\c:\frfrxfr.exec:\frfrxfr.exe95⤵PID:2536
-
\??\c:\hthbbn.exec:\hthbbn.exe96⤵PID:2948
-
\??\c:\hnhtnh.exec:\hnhtnh.exe97⤵PID:2324
-
\??\c:\1pvpd.exec:\1pvpd.exe98⤵PID:2540
-
\??\c:\jjvpd.exec:\jjvpd.exe99⤵PID:1920
-
\??\c:\ppdvd.exec:\ppdvd.exe100⤵PID:2508
-
\??\c:\1rfxlfl.exec:\1rfxlfl.exe101⤵PID:2672
-
\??\c:\xxlfllx.exec:\xxlfllx.exe102⤵PID:2640
-
\??\c:\bthhhh.exec:\bthhhh.exe103⤵PID:2764
-
\??\c:\tnhtbh.exec:\tnhtbh.exe104⤵PID:1816
-
\??\c:\bhtbhb.exec:\bhtbhb.exe105⤵PID:2772
-
\??\c:\jpdpv.exec:\jpdpv.exe106⤵PID:1976
-
\??\c:\ppjdj.exec:\ppjdj.exe107⤵PID:1968
-
\??\c:\9lxflrl.exec:\9lxflrl.exe108⤵PID:2744
-
\??\c:\rfffxxf.exec:\rfffxxf.exe109⤵PID:2004
-
\??\c:\7xxxxfx.exec:\7xxxxfx.exe110⤵PID:1732
-
\??\c:\tbhnhb.exec:\tbhnhb.exe111⤵PID:1600
-
\??\c:\9bbnth.exec:\9bbnth.exe112⤵PID:1796
-
\??\c:\pjvpv.exec:\pjvpv.exe113⤵PID:2064
-
\??\c:\pdjjp.exec:\pdjjp.exe114⤵PID:1744
-
\??\c:\rfrxfrx.exec:\rfrxfrx.exe115⤵PID:2264
-
\??\c:\9lfxflr.exec:\9lfxflr.exe116⤵PID:632
-
\??\c:\nnhnbb.exec:\nnhnbb.exe117⤵PID:2276
-
\??\c:\3htbbb.exec:\3htbbb.exe118⤵PID:2872
-
\??\c:\1hnntn.exec:\1hnntn.exe119⤵PID:2752
-
\??\c:\ddvpv.exec:\ddvpv.exe120⤵PID:992
-
\??\c:\vvvjp.exec:\vvvjp.exe121⤵PID:684
-
\??\c:\pjvdj.exec:\pjvdj.exe122⤵PID:1780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-