Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 08:25
Behavioral task
behavioral1
Sample
56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe
-
Size
92KB
-
MD5
dc9fdd20d3d133f9f31b41e16a7801b0
-
SHA1
dcd0c01d2c71fdfe0127f5150f3eea07541324ba
-
SHA256
56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1
-
SHA512
bb1a54aabb65017a740ffa67894e39f9902f4e892be54e1e03b41b6b7fc1fdc3a9881baf559b6c82d07cc19e27a1a313c44c147abb18d5d543b390e5c4d3ab4d
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpcw:8hOmTsF93UYfwC6GIout0fmCiiiXA6mR
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1248-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-48-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2724-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-67-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2472-66-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2480-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/620-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/476-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/708-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-292-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/2300-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1328-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-642-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-648-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-763-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-886-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-892-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/3016-1084-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1612-1106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-13560-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/1736-13817-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/1736-14075-0x0000000077680000-0x000000007777A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1312 thnnnh.exe 2628 vjvvv.exe 3004 dvpjj.exe 2708 fxllxrf.exe 2792 hhthhb.exe 2724 jdjvd.exe 2472 xxfflfl.exe 2560 xxlrxfr.exe 2480 nbhttt.exe 2976 vvpdp.exe 2000 ppdvv.exe 2648 5lffrrf.exe 2772 htnntb.exe 620 3hbnhn.exe 1936 jdvdv.exe 2176 frxrxfl.exe 1060 htnhnh.exe 1436 htbbhn.exe 1644 3jdjv.exe 1560 fxrrflf.exe 1292 3xlllfl.exe 2264 tnhhtt.exe 2152 9jjjj.exe 2296 3pjvj.exe 476 xfflllr.exe 2412 9ffxrlr.exe 1348 nhtbbt.exe 2032 pdppv.exe 552 rrlxxrr.exe 1804 hbtnbb.exe 708 btbbbh.exe 836 9pdjp.exe 2900 1vvdp.exe 1700 lfrrxlf.exe 1912 btbhbh.exe 3024 ttnnth.exe 2960 pjvvp.exe 1736 vppvv.exe 2300 ntbhnt.exe 1720 ppvdp.exe 2712 dvvvd.exe 3004 dppjj.exe 2572 fffllrr.exe 3008 nhtbbn.exe 2644 hbbbtt.exe 2724 1jpdj.exe 2964 vjpvp.exe 2736 flxxxrr.exe 2568 rlxflrx.exe 2944 hbbbnh.exe 1944 vppjv.exe 2676 jvjjd.exe 2672 lfxxffl.exe 2752 rfrllfx.exe 2828 1lffffl.exe 1780 9nhttt.exe 1812 nbnntb.exe 2340 jvvpv.exe 1968 pvvdp.exe 1808 frxffff.exe 2420 3rfflff.exe 2212 thnnbb.exe 2980 pvvpv.exe 2256 9jppv.exe -
resource yara_rule behavioral1/memory/1248-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000013a3f-6.dat upx behavioral1/memory/1312-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0036000000014183-15.dat upx behavioral1/memory/1312-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014367-23.dat upx behavioral1/memory/3004-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000143fb-30.dat upx behavioral1/memory/2708-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3004-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014457-41.dat upx behavioral1/memory/2708-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000144e9-50.dat upx behavioral1/memory/2792-48-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/memory/2724-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000144f1-59.dat upx behavioral1/files/0x000800000001507a-68.dat upx behavioral1/files/0x0006000000015083-75.dat upx behavioral1/memory/2480-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000150d9-83.dat upx behavioral1/memory/2976-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000153ee-92.dat upx behavioral1/files/0x000600000001565a-100.dat upx behavioral1/memory/2648-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2000-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015662-109.dat upx behavioral1/memory/2772-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000158d9-117.dat upx behavioral1/files/0x0006000000015ae3-125.dat upx behavioral1/memory/620-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1936-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015b50-133.dat upx behavioral1/memory/1936-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015b85-143.dat upx behavioral1/memory/2176-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c9a-149.dat upx behavioral1/memory/1436-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ca8-158.dat upx behavioral1/memory/1644-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cb1-168.dat upx behavioral1/memory/1644-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1560-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cc5-174.dat upx behavioral1/files/0x0006000000015cd2-182.dat upx behavioral1/memory/2264-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ce3-190.dat upx behavioral1/files/0x0006000000015cee-197.dat upx behavioral1/files/0x0006000000015cf8-204.dat upx behavioral1/memory/476-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d0a-212.dat upx behavioral1/files/0x0006000000015d21-219.dat upx behavioral1/files/0x0006000000015d39-227.dat upx behavioral1/files/0x0006000000015d59-234.dat upx behavioral1/memory/2032-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d61-241.dat upx behavioral1/files/0x0006000000015d85-248.dat upx behavioral1/files/0x0006000000015d9c-256.dat upx behavioral1/memory/708-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/836-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-264-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1248 wrote to memory of 1312 1248 56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe 28 PID 1248 wrote to memory of 1312 1248 56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe 28 PID 1248 wrote to memory of 1312 1248 56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe 28 PID 1248 wrote to memory of 1312 1248 56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe 28 PID 1312 wrote to memory of 2628 1312 thnnnh.exe 29 PID 1312 wrote to memory of 2628 1312 thnnnh.exe 29 PID 1312 wrote to memory of 2628 1312 thnnnh.exe 29 PID 1312 wrote to memory of 2628 1312 thnnnh.exe 29 PID 2628 wrote to memory of 3004 2628 vjvvv.exe 30 PID 2628 wrote to memory of 3004 2628 vjvvv.exe 30 PID 2628 wrote to memory of 3004 2628 vjvvv.exe 30 PID 2628 wrote to memory of 3004 2628 vjvvv.exe 30 PID 3004 wrote to memory of 2708 3004 dvpjj.exe 31 PID 3004 wrote to memory of 2708 3004 dvpjj.exe 31 PID 3004 wrote to memory of 2708 3004 dvpjj.exe 31 PID 3004 wrote to memory of 2708 3004 dvpjj.exe 31 PID 2708 wrote to memory of 2792 2708 fxllxrf.exe 32 PID 2708 wrote to memory of 2792 2708 fxllxrf.exe 32 PID 2708 wrote to memory of 2792 2708 fxllxrf.exe 32 PID 2708 wrote to memory of 2792 2708 fxllxrf.exe 32 PID 2792 wrote to memory of 2724 2792 hhthhb.exe 33 PID 2792 wrote to memory of 2724 2792 hhthhb.exe 33 PID 2792 wrote to memory of 2724 2792 hhthhb.exe 33 PID 2792 wrote to memory of 2724 2792 hhthhb.exe 33 PID 2724 wrote to memory of 2472 2724 jdjvd.exe 34 PID 2724 wrote to memory of 2472 2724 jdjvd.exe 34 PID 2724 wrote to memory of 2472 2724 jdjvd.exe 34 PID 2724 wrote to memory of 2472 2724 jdjvd.exe 34 PID 2472 wrote to memory of 2560 2472 xxfflfl.exe 35 PID 2472 wrote to memory of 2560 2472 xxfflfl.exe 35 PID 2472 wrote to memory of 2560 2472 xxfflfl.exe 35 PID 2472 wrote to memory of 2560 2472 xxfflfl.exe 35 PID 2560 wrote to memory of 2480 2560 xxlrxfr.exe 36 PID 2560 wrote to memory of 2480 2560 xxlrxfr.exe 36 PID 2560 wrote to memory of 2480 2560 xxlrxfr.exe 36 PID 2560 wrote to memory of 2480 2560 xxlrxfr.exe 36 PID 2480 wrote to memory of 2976 2480 nbhttt.exe 37 PID 2480 wrote to memory of 2976 2480 nbhttt.exe 37 PID 2480 wrote to memory of 2976 2480 nbhttt.exe 37 PID 2480 wrote to memory of 2976 2480 nbhttt.exe 37 PID 2976 wrote to memory of 2000 2976 vvpdp.exe 38 PID 2976 wrote to memory of 2000 2976 vvpdp.exe 38 PID 2976 wrote to memory of 2000 2976 vvpdp.exe 38 PID 2976 wrote to memory of 2000 2976 vvpdp.exe 38 PID 2000 wrote to memory of 2648 2000 ppdvv.exe 39 PID 2000 wrote to memory of 2648 2000 ppdvv.exe 39 PID 2000 wrote to memory of 2648 2000 ppdvv.exe 39 PID 2000 wrote to memory of 2648 2000 ppdvv.exe 39 PID 2648 wrote to memory of 2772 2648 5lffrrf.exe 40 PID 2648 wrote to memory of 2772 2648 5lffrrf.exe 40 PID 2648 wrote to memory of 2772 2648 5lffrrf.exe 40 PID 2648 wrote to memory of 2772 2648 5lffrrf.exe 40 PID 2772 wrote to memory of 620 2772 htnntb.exe 41 PID 2772 wrote to memory of 620 2772 htnntb.exe 41 PID 2772 wrote to memory of 620 2772 htnntb.exe 41 PID 2772 wrote to memory of 620 2772 htnntb.exe 41 PID 620 wrote to memory of 1936 620 3hbnhn.exe 42 PID 620 wrote to memory of 1936 620 3hbnhn.exe 42 PID 620 wrote to memory of 1936 620 3hbnhn.exe 42 PID 620 wrote to memory of 1936 620 3hbnhn.exe 42 PID 1936 wrote to memory of 2176 1936 jdvdv.exe 43 PID 1936 wrote to memory of 2176 1936 jdvdv.exe 43 PID 1936 wrote to memory of 2176 1936 jdvdv.exe 43 PID 1936 wrote to memory of 2176 1936 jdvdv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\thnnnh.exec:\thnnnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\vjvvv.exec:\vjvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\dvpjj.exec:\dvpjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\fxllxrf.exec:\fxllxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hhthhb.exec:\hhthhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jdjvd.exec:\jdjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xxfflfl.exec:\xxfflfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\xxlrxfr.exec:\xxlrxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\nbhttt.exec:\nbhttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\vvpdp.exec:\vvpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\ppdvv.exec:\ppdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\5lffrrf.exec:\5lffrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\htnntb.exec:\htnntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3hbnhn.exec:\3hbnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\jdvdv.exec:\jdvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\frxrxfl.exec:\frxrxfl.exe17⤵
- Executes dropped EXE
PID:2176 -
\??\c:\htnhnh.exec:\htnhnh.exe18⤵
- Executes dropped EXE
PID:1060 -
\??\c:\htbbhn.exec:\htbbhn.exe19⤵
- Executes dropped EXE
PID:1436 -
\??\c:\3jdjv.exec:\3jdjv.exe20⤵
- Executes dropped EXE
PID:1644 -
\??\c:\fxrrflf.exec:\fxrrflf.exe21⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3xlllfl.exec:\3xlllfl.exe22⤵
- Executes dropped EXE
PID:1292 -
\??\c:\tnhhtt.exec:\tnhhtt.exe23⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9jjjj.exec:\9jjjj.exe24⤵
- Executes dropped EXE
PID:2152 -
\??\c:\3pjvj.exec:\3pjvj.exe25⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xfflllr.exec:\xfflllr.exe26⤵
- Executes dropped EXE
PID:476 -
\??\c:\9ffxrlr.exec:\9ffxrlr.exe27⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nhtbbt.exec:\nhtbbt.exe28⤵
- Executes dropped EXE
PID:1348 -
\??\c:\pdppv.exec:\pdppv.exe29⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rrlxxrr.exec:\rrlxxrr.exe30⤵
- Executes dropped EXE
PID:552 -
\??\c:\hbtnbb.exec:\hbtnbb.exe31⤵
- Executes dropped EXE
PID:1804 -
\??\c:\btbbbh.exec:\btbbbh.exe32⤵
- Executes dropped EXE
PID:708 -
\??\c:\9pdjp.exec:\9pdjp.exe33⤵
- Executes dropped EXE
PID:836 -
\??\c:\1vvdp.exec:\1vvdp.exe34⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lfrrxlf.exec:\lfrrxlf.exe35⤵
- Executes dropped EXE
PID:1700 -
\??\c:\btbhbh.exec:\btbhbh.exe36⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ttnnth.exec:\ttnnth.exe37⤵
- Executes dropped EXE
PID:3024 -
\??\c:\pjvvp.exec:\pjvvp.exe38⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vppvv.exec:\vppvv.exe39⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xllxxrx.exec:\xllxxrx.exe40⤵PID:2208
-
\??\c:\ntbhnt.exec:\ntbhnt.exe41⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ppvdp.exec:\ppvdp.exe42⤵
- Executes dropped EXE
PID:1720 -
\??\c:\dvvvd.exec:\dvvvd.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\dppjj.exec:\dppjj.exe44⤵
- Executes dropped EXE
PID:3004 -
\??\c:\fffllrr.exec:\fffllrr.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nhtbbn.exec:\nhtbbn.exe46⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hbbbtt.exec:\hbbbtt.exe47⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1jpdj.exec:\1jpdj.exe48⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vjpvp.exec:\vjpvp.exe49⤵
- Executes dropped EXE
PID:2964 -
\??\c:\flxxxrr.exec:\flxxxrr.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rlxflrx.exec:\rlxflrx.exe51⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hbbbnh.exec:\hbbbnh.exe52⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vppjv.exec:\vppjv.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jvjjd.exec:\jvjjd.exe54⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lfxxffl.exec:\lfxxffl.exe55⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rfrllfx.exec:\rfrllfx.exe56⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1lffffl.exec:\1lffffl.exe57⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9nhttt.exec:\9nhttt.exe58⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nbnntb.exec:\nbnntb.exe59⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jvvpv.exec:\jvvpv.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pvvdp.exec:\pvvdp.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\frxffff.exec:\frxffff.exe62⤵
- Executes dropped EXE
PID:1808 -
\??\c:\3rfflff.exec:\3rfflff.exe63⤵
- Executes dropped EXE
PID:2420 -
\??\c:\thnnbb.exec:\thnnbb.exe64⤵
- Executes dropped EXE
PID:2212 -
\??\c:\pvvpv.exec:\pvvpv.exe65⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9jppv.exec:\9jppv.exe66⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe67⤵PID:1540
-
\??\c:\fflxxll.exec:\fflxxll.exe68⤵PID:1256
-
\??\c:\thhhnh.exec:\thhhnh.exe69⤵PID:2428
-
\??\c:\3bhnhh.exec:\3bhnhh.exe70⤵PID:2248
-
\??\c:\vdvvv.exec:\vdvvv.exe71⤵PID:2884
-
\??\c:\5vddv.exec:\5vddv.exe72⤵PID:2296
-
\??\c:\3lrlffl.exec:\3lrlffl.exe73⤵PID:776
-
\??\c:\9fllxrx.exec:\9fllxrx.exe74⤵PID:1640
-
\??\c:\hhbbnt.exec:\hhbbnt.exe75⤵PID:2412
-
\??\c:\tnbntn.exec:\tnbntn.exe76⤵PID:924
-
\??\c:\jdjjv.exec:\jdjjv.exe77⤵PID:1328
-
\??\c:\vddvp.exec:\vddvp.exe78⤵PID:2084
-
\??\c:\ffrlffl.exec:\ffrlffl.exe79⤵PID:912
-
\??\c:\xrlffff.exec:\xrlffff.exe80⤵PID:896
-
\??\c:\3ththh.exec:\3ththh.exe81⤵PID:1456
-
\??\c:\bnhtnh.exec:\bnhtnh.exe82⤵PID:2904
-
\??\c:\vdpdj.exec:\vdpdj.exe83⤵PID:2120
-
\??\c:\jdjdj.exec:\jdjdj.exe84⤵PID:1752
-
\??\c:\lfffrxl.exec:\lfffrxl.exe85⤵PID:1516
-
\??\c:\rlxrxrf.exec:\rlxrxrf.exe86⤵PID:2892
-
\??\c:\thhthb.exec:\thhthb.exe87⤵PID:2392
-
\??\c:\hthhhh.exec:\hthhhh.exe88⤵PID:1408
-
\??\c:\3pdjp.exec:\3pdjp.exe89⤵PID:2988
-
\??\c:\5jpdd.exec:\5jpdd.exe90⤵PID:2304
-
\??\c:\7djvp.exec:\7djvp.exe91⤵PID:2552
-
\??\c:\7rlrxfx.exec:\7rlrxfx.exe92⤵PID:2576
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe93⤵PID:2692
-
\??\c:\3tbthb.exec:\3tbthb.exe94⤵PID:2860
-
\??\c:\tnbhnn.exec:\tnbhnn.exe95⤵PID:2128
-
\??\c:\bnnnnn.exec:\bnnnnn.exe96⤵PID:2744
-
\??\c:\jdvjj.exec:\jdvjj.exe97⤵PID:2344
-
\??\c:\5vvvp.exec:\5vvvp.exe98⤵PID:2620
-
\??\c:\xxflrrx.exec:\xxflrrx.exe99⤵PID:2216
-
\??\c:\xrxfflr.exec:\xrxfflr.exe100⤵PID:2520
-
\??\c:\xrflrrx.exec:\xrflrrx.exe101⤵PID:2736
-
\??\c:\3bbthh.exec:\3bbthh.exe102⤵PID:2568
-
\??\c:\hbhhnn.exec:\hbhhnn.exe103⤵PID:2140
-
\??\c:\dvjjp.exec:\dvjjp.exe104⤵PID:1944
-
\??\c:\lfrxxfr.exec:\lfrxxfr.exe105⤵PID:2676
-
\??\c:\frllrfr.exec:\frllrfr.exe106⤵PID:2760
-
\??\c:\hhtbtt.exec:\hhtbtt.exe107⤵PID:2752
-
\??\c:\jdjjj.exec:\jdjjj.exe108⤵PID:2020
-
\??\c:\7vjpv.exec:\7vjpv.exe109⤵PID:1448
-
\??\c:\jpddd.exec:\jpddd.exe110⤵PID:1976
-
\??\c:\1ffrxxl.exec:\1ffrxxl.exe111⤵PID:2176
-
\??\c:\fxrlrxf.exec:\fxrlrxf.exe112⤵PID:1952
-
\??\c:\ttbbhh.exec:\ttbbhh.exe113⤵PID:2364
-
\??\c:\hbhbbh.exec:\hbhbbh.exe114⤵PID:1440
-
\??\c:\djppj.exec:\djppj.exe115⤵PID:1964
-
\??\c:\9lfxxrr.exec:\9lfxxrr.exe116⤵PID:2284
-
\??\c:\lfllrrf.exec:\lfllrrf.exe117⤵PID:2256
-
\??\c:\llxllrx.exec:\llxllrx.exe118⤵PID:2272
-
\??\c:\ttnbnb.exec:\ttnbnb.exe119⤵PID:2880
-
\??\c:\nntttn.exec:\nntttn.exe120⤵PID:2428
-
\??\c:\7dpvv.exec:\7dpvv.exe121⤵PID:2872
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe122⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-