Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 13:37
Behavioral task
behavioral1
Sample
66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe
Resource
win7-20240508-en
7 signatures
150 seconds
General
-
Target
66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe
-
Size
169KB
-
MD5
5e832c1cf14a3dbd44c14e2616169af0
-
SHA1
66f568676d2d0e72dd86575b6855389e51d097e0
-
SHA256
66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f
-
SHA512
558f581ba47fe998c0c20e0c80ad58f9ba46d74473394883d993bc4684b6b1f84630f028248ade60b56fe6e5120d9780ace49d4695713822d094a65249896c6c
-
SSDEEP
1536:HvQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7FK4O8A1o4XEc3YtxD8/Ai2p:HhOmTsF93UYfwC6GIoutX8Ki3c3YT8V2
Score
10/10
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2228-8-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/3032-22-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2252-18-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2112-46-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2604-58-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2524-61-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2080-92-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1692-109-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1956-134-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2400-144-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1852-153-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1028-162-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2588-179-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/532-198-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/872-213-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1600-215-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1704-233-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/688-264-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1912-272-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/572-285-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1644-297-0x0000000077A40000-0x0000000077B5F000-memory.dmp family_blackmoon behavioral1/memory/1644-298-0x0000000077B60000-0x0000000077C5A000-memory.dmp family_blackmoon behavioral1/memory/1576-305-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2800-350-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2676-365-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2436-385-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2660-392-0x00000000003B0000-0x00000000003F6000-memory.dmp family_blackmoon behavioral1/memory/1620-438-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1852-445-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2360-477-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/336-529-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/916-542-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1724-570-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/572-573-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/2592-611-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2612-618-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/2636-626-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/2516-647-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2940-817-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1584-867-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2252 pjvjd.exe 3032 lfxlrfl.exe 2732 5xrxflx.exe 2112 fxllxxl.exe 2604 lxxlxlr.exe 2524 tnbtnt.exe 2480 dddjd.exe 2564 dvjpd.exe 2080 ppdpj.exe 884 jdvvj.exe 1692 9rrrrxr.exe 2148 tnbhth.exe 1968 vdjvd.exe 1956 5xllrfl.exe 2400 lxllxxf.exe 1852 5pjdp.exe 1028 lxrrlfr.exe 1264 bthnhh.exe 2588 ddvdd.exe 2328 vjpdj.exe 1232 xlxrflr.exe 532 9bbnbn.exe 872 pjdjj.exe 1600 5lflrfl.exe 1732 7xrrfll.exe 1704 tntnhn.exe 1756 vvpvd.exe 904 rfrrfff.exe 688 hbtntb.exe 1912 dvjpv.exe 1320 9frrxrx.exe 572 nhthth.exe 2288 pdppv.exe 1644 lflfxxl.exe 1576 9htthb.exe 2628 pdjdp.exe 2696 7fxfrxf.exe 2704 hbnnbh.exe 2492 jdvpv.exe 2672 7fxxfrx.exe 2800 fxflxfl.exe 2660 bntbhn.exe 2528 pjppv.exe 2676 5dvdj.exe 2900 flflrrr.exe 2436 nbnbnb.exe 1900 5thhnt.exe 1608 frxxllr.exe 1668 7tnbhn.exe 2204 7ntbhh.exe 2416 5jdvd.exe 1804 1rlfllr.exe 1768 5fxrffr.exe 1620 bthntb.exe 1852 3vpvd.exe 1136 rrfrfxf.exe 1372 xxxfrrf.exe 2764 hbhthh.exe 2588 pdpdv.exe 2360 vjvdp.exe 2372 xrxfllr.exe 2584 3nhntt.exe 484 7nhnhn.exe 2468 dpvpv.exe -
resource yara_rule behavioral1/memory/1560-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2228-1-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2228-8-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x000c00000001226d-6.dat upx behavioral1/memory/2252-10-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0035000000015c82-19.dat upx behavioral1/memory/3032-22-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0008000000015cd6-27.dat upx behavioral1/memory/2252-18-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0007000000015cea-35.dat upx behavioral1/memory/2112-37-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2112-46-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0007000000015cf3-45.dat upx behavioral1/memory/2604-58-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2524-61-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0007000000015cfd-59.dat upx behavioral1/files/0x0009000000015d13-68.dat upx behavioral1/memory/2604-56-0x0000000000220000-0x0000000000266000-memory.dmp upx behavioral1/memory/2604-55-0x0000000000220000-0x0000000000266000-memory.dmp upx behavioral1/files/0x0008000000016824-74.dat upx behavioral1/files/0x0006000000016a7d-83.dat upx behavioral1/memory/2080-92-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016c4a-91.dat upx behavioral1/files/0x0006000000016c5d-100.dat upx behavioral1/files/0x0006000000016c67-107.dat upx behavioral1/memory/1692-109-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016caf-117.dat upx behavioral1/files/0x0006000000016cde-124.dat upx behavioral1/memory/1956-127-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1956-134-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016d05-135.dat upx behavioral1/files/0x0006000000016d1a-142.dat upx behavioral1/memory/2400-144-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016d22-150.dat upx behavioral1/memory/1852-153-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016d2b-160.dat upx behavioral1/memory/1028-162-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016d33-169.dat upx behavioral1/files/0x0006000000016d3b-177.dat upx behavioral1/memory/2588-179-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016d44-187.dat upx behavioral1/files/0x0006000000016d4c-194.dat upx behavioral1/memory/532-198-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016d55-204.dat upx behavioral1/memory/872-213-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0034000000015c8c-212.dat upx behavioral1/memory/1600-215-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016d68-222.dat upx behavioral1/files/0x0006000000016d6c-230.dat upx behavioral1/memory/1704-233-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016d70-239.dat upx behavioral1/files/0x0006000000016d78-247.dat upx behavioral1/files/0x0006000000016da0-255.dat upx behavioral1/memory/688-264-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016db2-263.dat upx behavioral1/memory/1912-272-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/files/0x0006000000016dc8-273.dat upx behavioral1/files/0x0006000000016dd1-281.dat upx behavioral1/memory/572-285-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1644-297-0x0000000077A40000-0x0000000077B5F000-memory.dmp upx behavioral1/memory/1576-305-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2704-325-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2800-350-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2676-365-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe" 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Serverx.exe 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Serverx.exe 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 2228 1560 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe 28 PID 1560 wrote to memory of 2228 1560 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe 28 PID 1560 wrote to memory of 2228 1560 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe 28 PID 1560 wrote to memory of 2228 1560 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe 28 PID 2228 wrote to memory of 2252 2228 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe 29 PID 2228 wrote to memory of 2252 2228 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe 29 PID 2228 wrote to memory of 2252 2228 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe 29 PID 2228 wrote to memory of 2252 2228 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe 29 PID 2252 wrote to memory of 3032 2252 pjvjd.exe 30 PID 2252 wrote to memory of 3032 2252 pjvjd.exe 30 PID 2252 wrote to memory of 3032 2252 pjvjd.exe 30 PID 2252 wrote to memory of 3032 2252 pjvjd.exe 30 PID 3032 wrote to memory of 2732 3032 lfxlrfl.exe 31 PID 3032 wrote to memory of 2732 3032 lfxlrfl.exe 31 PID 3032 wrote to memory of 2732 3032 lfxlrfl.exe 31 PID 3032 wrote to memory of 2732 3032 lfxlrfl.exe 31 PID 2732 wrote to memory of 2112 2732 5xrxflx.exe 32 PID 2732 wrote to memory of 2112 2732 5xrxflx.exe 32 PID 2732 wrote to memory of 2112 2732 5xrxflx.exe 32 PID 2732 wrote to memory of 2112 2732 5xrxflx.exe 32 PID 2112 wrote to memory of 2604 2112 fxllxxl.exe 33 PID 2112 wrote to memory of 2604 2112 fxllxxl.exe 33 PID 2112 wrote to memory of 2604 2112 fxllxxl.exe 33 PID 2112 wrote to memory of 2604 2112 fxllxxl.exe 33 PID 2604 wrote to memory of 2524 2604 lxxlxlr.exe 34 PID 2604 wrote to memory of 2524 2604 lxxlxlr.exe 34 PID 2604 wrote to memory of 2524 2604 lxxlxlr.exe 34 PID 2604 wrote to memory of 2524 2604 lxxlxlr.exe 34 PID 2524 wrote to memory of 2480 2524 tnbtnt.exe 35 PID 2524 wrote to memory of 2480 2524 tnbtnt.exe 35 PID 2524 wrote to memory of 2480 2524 tnbtnt.exe 35 PID 2524 wrote to memory of 2480 2524 tnbtnt.exe 35 PID 2480 wrote to memory of 2564 2480 dddjd.exe 36 PID 2480 wrote to memory of 2564 2480 dddjd.exe 36 PID 2480 wrote to memory of 2564 2480 dddjd.exe 36 PID 2480 wrote to memory of 2564 2480 dddjd.exe 36 PID 2564 wrote to memory of 2080 2564 dvjpd.exe 37 PID 2564 wrote to memory of 2080 2564 dvjpd.exe 37 PID 2564 wrote to memory of 2080 2564 dvjpd.exe 37 PID 2564 wrote to memory of 2080 2564 dvjpd.exe 37 PID 2080 wrote to memory of 884 2080 ppdpj.exe 38 PID 2080 wrote to memory of 884 2080 ppdpj.exe 38 PID 2080 wrote to memory of 884 2080 ppdpj.exe 38 PID 2080 wrote to memory of 884 2080 ppdpj.exe 38 PID 884 wrote to memory of 1692 884 jdvvj.exe 39 PID 884 wrote to memory of 1692 884 jdvvj.exe 39 PID 884 wrote to memory of 1692 884 jdvvj.exe 39 PID 884 wrote to memory of 1692 884 jdvvj.exe 39 PID 1692 wrote to memory of 2148 1692 9rrrrxr.exe 40 PID 1692 wrote to memory of 2148 1692 9rrrrxr.exe 40 PID 1692 wrote to memory of 2148 1692 9rrrrxr.exe 40 PID 1692 wrote to memory of 2148 1692 9rrrrxr.exe 40 PID 2148 wrote to memory of 1968 2148 tnbhth.exe 41 PID 2148 wrote to memory of 1968 2148 tnbhth.exe 41 PID 2148 wrote to memory of 1968 2148 tnbhth.exe 41 PID 2148 wrote to memory of 1968 2148 tnbhth.exe 41 PID 1968 wrote to memory of 1956 1968 vdjvd.exe 42 PID 1968 wrote to memory of 1956 1968 vdjvd.exe 42 PID 1968 wrote to memory of 1956 1968 vdjvd.exe 42 PID 1968 wrote to memory of 1956 1968 vdjvd.exe 42 PID 1956 wrote to memory of 2400 1956 5xllrfl.exe 43 PID 1956 wrote to memory of 2400 1956 5xllrfl.exe 43 PID 1956 wrote to memory of 2400 1956 5xllrfl.exe 43 PID 1956 wrote to memory of 2400 1956 5xllrfl.exe 43
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\pjvjd.exec:\pjvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\lfxlrfl.exec:\lfxlrfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\5xrxflx.exec:\5xrxflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\fxllxxl.exec:\fxllxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\lxxlxlr.exec:\lxxlxlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\tnbtnt.exec:\tnbtnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\dddjd.exec:\dddjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\dvjpd.exec:\dvjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ppdpj.exec:\ppdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\jdvvj.exec:\jdvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\9rrrrxr.exec:\9rrrrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\tnbhth.exec:\tnbhth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\vdjvd.exec:\vdjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\5xllrfl.exec:\5xllrfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\lxllxxf.exec:\lxllxxf.exe18⤵
- Executes dropped EXE
PID:2400 -
\??\c:\5pjdp.exec:\5pjdp.exe19⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lxrrlfr.exec:\lxrrlfr.exe20⤵
- Executes dropped EXE
PID:1028 -
\??\c:\bthnhh.exec:\bthnhh.exe21⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ddvdd.exec:\ddvdd.exe22⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vjpdj.exec:\vjpdj.exe23⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xlxrflr.exec:\xlxrflr.exe24⤵
- Executes dropped EXE
PID:1232 -
\??\c:\9bbnbn.exec:\9bbnbn.exe25⤵
- Executes dropped EXE
PID:532 -
\??\c:\pjdjj.exec:\pjdjj.exe26⤵
- Executes dropped EXE
PID:872 -
\??\c:\5lflrfl.exec:\5lflrfl.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\7xrrfll.exec:\7xrrfll.exe28⤵
- Executes dropped EXE
PID:1732 -
\??\c:\tntnhn.exec:\tntnhn.exe29⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vvpvd.exec:\vvpvd.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rfrrfff.exec:\rfrrfff.exe31⤵
- Executes dropped EXE
PID:904 -
\??\c:\hbtntb.exec:\hbtntb.exe32⤵
- Executes dropped EXE
PID:688 -
\??\c:\dvjpv.exec:\dvjpv.exe33⤵
- Executes dropped EXE
PID:1912 -
\??\c:\9frrxrx.exec:\9frrxrx.exe34⤵
- Executes dropped EXE
PID:1320 -
\??\c:\nhthth.exec:\nhthth.exe35⤵
- Executes dropped EXE
PID:572 -
\??\c:\pdppv.exec:\pdppv.exe36⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lflfxxl.exec:\lflfxxl.exe37⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lrffxxf.exec:\lrffxxf.exe38⤵PID:2164
-
\??\c:\9htthb.exec:\9htthb.exe39⤵
- Executes dropped EXE
PID:1576 -
\??\c:\pdjdp.exec:\pdjdp.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\7fxfrxf.exec:\7fxfrxf.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hbnnbh.exec:\hbnnbh.exe42⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jdvpv.exec:\jdvpv.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\7fxxfrx.exec:\7fxxfrx.exe44⤵
- Executes dropped EXE
PID:2672 -
\??\c:\fxflxfl.exec:\fxflxfl.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\bntbhn.exec:\bntbhn.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pjppv.exec:\pjppv.exe47⤵
- Executes dropped EXE
PID:2528 -
\??\c:\5dvdj.exec:\5dvdj.exe48⤵
- Executes dropped EXE
PID:2676 -
\??\c:\flflrrr.exec:\flflrrr.exe49⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nbnbnb.exec:\nbnbnb.exe50⤵
- Executes dropped EXE
PID:2436 -
\??\c:\5thhnt.exec:\5thhnt.exe51⤵
- Executes dropped EXE
PID:1900 -
\??\c:\frxxllr.exec:\frxxllr.exe52⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7tnbhn.exec:\7tnbhn.exe53⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7ntbhh.exec:\7ntbhh.exe54⤵
- Executes dropped EXE
PID:2204 -
\??\c:\5jdvd.exec:\5jdvd.exe55⤵
- Executes dropped EXE
PID:2416 -
\??\c:\1rlfllr.exec:\1rlfllr.exe56⤵
- Executes dropped EXE
PID:1804 -
\??\c:\5fxrffr.exec:\5fxrffr.exe57⤵
- Executes dropped EXE
PID:1768 -
\??\c:\bthntb.exec:\bthntb.exe58⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3vpvd.exec:\3vpvd.exe59⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rrfrfxf.exec:\rrfrfxf.exe60⤵
- Executes dropped EXE
PID:1136 -
\??\c:\xxxfrrf.exec:\xxxfrrf.exe61⤵
- Executes dropped EXE
PID:1372 -
\??\c:\hbhthh.exec:\hbhthh.exe62⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pdpdv.exec:\pdpdv.exe63⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vjvdp.exec:\vjvdp.exe64⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xrxfllr.exec:\xrxfllr.exe65⤵
- Executes dropped EXE
PID:2372 -
\??\c:\3nhntt.exec:\3nhntt.exe66⤵
- Executes dropped EXE
PID:2584 -
\??\c:\7nhnhn.exec:\7nhnhn.exe67⤵
- Executes dropped EXE
PID:484 -
\??\c:\dpvpv.exec:\dpvpv.exe68⤵
- Executes dropped EXE
PID:2468 -
\??\c:\1rflrrx.exec:\1rflrrx.exe69⤵PID:1760
-
\??\c:\3htttn.exec:\3htttn.exe70⤵PID:812
-
\??\c:\bthntb.exec:\bthntb.exe71⤵PID:2408
-
\??\c:\dpdjd.exec:\dpdjd.exe72⤵PID:336
-
\??\c:\xrxfffr.exec:\xrxfffr.exe73⤵PID:920
-
\??\c:\1ttthb.exec:\1ttthb.exe74⤵PID:916
-
\??\c:\tnhthb.exec:\tnhthb.exe75⤵PID:564
-
\??\c:\vpjpd.exec:\vpjpd.exe76⤵PID:340
-
\??\c:\xxfrllf.exec:\xxfrllf.exe77⤵PID:2096
-
\??\c:\5frrflr.exec:\5frrflr.exe78⤵PID:1724
-
\??\c:\tntbnn.exec:\tntbnn.exe79⤵PID:572
-
\??\c:\jvjvv.exec:\jvjvv.exe80⤵PID:2860
-
\??\c:\1fxxxxx.exec:\1fxxxxx.exe81⤵PID:2092
-
\??\c:\nbntbh.exec:\nbntbh.exe82⤵PID:2252
-
\??\c:\1vpdj.exec:\1vpdj.exe83⤵PID:2712
-
\??\c:\lllrflx.exec:\lllrflx.exe84⤵PID:2592
-
\??\c:\3hbhtt.exec:\3hbhtt.exe85⤵PID:2612
-
\??\c:\ththnn.exec:\ththnn.exe86⤵PID:2636
-
\??\c:\3frrrrx.exec:\3frrrrx.exe87⤵PID:2720
-
\??\c:\xlfrlfr.exec:\xlfrlfr.exe88⤵PID:2624
-
\??\c:\9htbhh.exec:\9htbhh.exe89⤵PID:2516
-
\??\c:\pjvpd.exec:\pjvpd.exe90⤵PID:2480
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe91⤵PID:2920
-
\??\c:\btnnhn.exec:\btnnhn.exe92⤵PID:2276
-
\??\c:\hhtbhh.exec:\hhtbhh.exe93⤵PID:1916
-
\??\c:\dvpvj.exec:\dvpvj.exe94⤵PID:1892
-
\??\c:\7xllrxr.exec:\7xllrxr.exe95⤵PID:468
-
\??\c:\tnbbhn.exec:\tnbbhn.exe96⤵PID:2140
-
\??\c:\nhtbnn.exec:\nhtbnn.exe97⤵PID:1188
-
\??\c:\pddpd.exec:\pddpd.exe98⤵PID:2204
-
\??\c:\flxxlll.exec:\flxxlll.exe99⤵PID:1672
-
\??\c:\rfrrfxx.exec:\rfrrfxx.exe100⤵PID:764
-
\??\c:\hbnntt.exec:\hbnntt.exe101⤵PID:1920
-
\??\c:\ppddd.exec:\ppddd.exe102⤵PID:296
-
\??\c:\dvpvd.exec:\dvpvd.exe103⤵PID:1028
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe104⤵PID:1136
-
\??\c:\3nhhnn.exec:\3nhhnn.exe105⤵PID:2788
-
\??\c:\hthhtb.exec:\hthhtb.exe106⤵PID:2336
-
\??\c:\7dvjp.exec:\7dvjp.exe107⤵PID:1888
-
\??\c:\9jdvd.exec:\9jdvd.exe108⤵PID:672
-
\??\c:\xrflxfl.exec:\xrflxfl.exe109⤵PID:380
-
\??\c:\9hnhnt.exec:\9hnhnt.exe110⤵PID:1416
-
\??\c:\pdpdv.exec:\pdpdv.exe111⤵PID:1632
-
\??\c:\1djvv.exec:\1djvv.exe112⤵PID:1600
-
\??\c:\lfrrxlr.exec:\lfrrxlr.exe113⤵PID:2848
-
\??\c:\5lfrxfr.exec:\5lfrxfr.exe114⤵PID:1488
-
\??\c:\tntbth.exec:\tntbth.exe115⤵PID:2804
-
\??\c:\pjvjd.exec:\pjvjd.exe116⤵PID:1756
-
\??\c:\7rlrxxl.exec:\7rlrxxl.exe117⤵PID:2940
-
\??\c:\lflrxff.exec:\lflrxff.exe118⤵PID:2132
-
\??\c:\bbnhtt.exec:\bbnhtt.exe119⤵PID:1444
-
\??\c:\tnbhhh.exec:\tnbhhh.exe120⤵PID:1860
-
\??\c:\pjddp.exec:\pjddp.exe121⤵PID:352
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe122⤵PID:2396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-