Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 21:58
Behavioral task
behavioral1
Sample
0955b034185ede29391a9c4c2e484d70_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
0955b034185ede29391a9c4c2e484d70_NeikiAnalytics.exe
-
Size
273KB
-
MD5
0955b034185ede29391a9c4c2e484d70
-
SHA1
cf286377f1e78f0fefa182b014f0ddd4ca2789c0
-
SHA256
3f2647f59132238d4c5644bb2573c597c63569126f6b8b4e874e87b23b1e41aa
-
SHA512
e552c7386360a670af663adc0e6dace9b2a0931bd7557bae7509a33d61e648a67a5bcc007791c4b35374fb733760fc52c918eed3b5673867db8f72b3444d0a27
-
SSDEEP
6144:Ycm4FmowdHoSgWrXF5lpKGYV0aTk/BO0XJm4UEPOshN/xdKnvP48bm8:e4wFHoSgWjdpKGATTk/jYIOWN/KnnP3
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1812-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1596-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/836-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4132-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2840-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/592-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/716-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/848-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-634-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1596 5nbnbb.exe 1536 ddjdp.exe 3928 tthbnn.exe 3720 djjdp.exe 5036 1nhbth.exe 1232 nbthhb.exe 3244 pjjvj.exe 3024 ffffrll.exe 556 3pjdp.exe 2788 3rrrlxx.exe 4592 tbhbnh.exe 4040 jppdd.exe 3644 lfxlxrl.exe 836 tntnnn.exe 8 xllfxfx.exe 4672 nttnnh.exe 2244 ffrrlxr.exe 4132 thbthb.exe 2020 jdvdj.exe 4472 xrffflf.exe 3576 tnnhtn.exe 3016 pjvdd.exe 2476 lllxlfx.exe 4960 nbntbn.exe 2008 3xrlfxx.exe 1136 3rxrrrx.exe 4556 dpvdj.exe 1548 7llfrlx.exe 4328 3hntth.exe 624 bhnbnb.exe 5016 vpvvd.exe 4116 rfllxrr.exe 1456 btbnnn.exe 4644 jvpdp.exe 3456 flxlfxl.exe 1336 hhbhbt.exe 4224 thhnbt.exe 2528 vjvjv.exe 1992 xlxrxrl.exe 3064 lxxlfxr.exe 3608 bbbnht.exe 2224 jdppd.exe 4432 jdvvd.exe 2028 rrrllrl.exe 4764 nbbnbt.exe 3144 vjddp.exe 4988 jddvp.exe 3740 llffxfl.exe 340 bnhthb.exe 3848 nbbnhb.exe 972 jddjd.exe 3700 xlrxlrf.exe 2560 nnnnht.exe 228 pjdvj.exe 3228 jjpvv.exe 2840 lllxlxr.exe 4540 nhtnhh.exe 744 pjvvj.exe 2064 llxflrr.exe 1112 fxxxlfx.exe 3980 hbbnhb.exe 4868 pppdj.exe 836 rxxlxlf.exe 8 ffxlxfx.exe -
resource yara_rule behavioral2/memory/1812-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023298-3.dat upx behavioral2/memory/1596-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023410-9.dat upx behavioral2/memory/1596-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1536-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-12.dat upx behavioral2/memory/1536-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-19.dat upx behavioral2/memory/3928-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-24.dat upx behavioral2/memory/3720-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5036-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-30.dat upx behavioral2/memory/1232-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-35.dat upx behavioral2/memory/3244-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-40.dat upx behavioral2/files/0x000700000002341b-44.dat upx behavioral2/memory/3024-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-49.dat upx behavioral2/memory/556-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-54.dat upx behavioral2/memory/2788-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4592-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-60.dat upx behavioral2/files/0x000700000002341f-64.dat upx behavioral2/memory/4040-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-69.dat upx behavioral2/memory/3644-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/836-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-80.dat upx behavioral2/memory/8-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-75.dat upx behavioral2/files/0x0007000000023423-84.dat upx behavioral2/memory/4672-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2244-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-90.dat upx behavioral2/memory/2244-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-95.dat upx behavioral2/memory/2020-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023411-101.dat upx behavioral2/memory/4132-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-105.dat upx behavioral2/memory/3576-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-110.dat upx behavioral2/memory/3016-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3576-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-116.dat upx behavioral2/files/0x000700000002342a-120.dat upx behavioral2/memory/4960-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-125.dat upx behavioral2/memory/2008-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-132.dat upx behavioral2/memory/4960-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-135.dat upx behavioral2/files/0x000700000002342e-139.dat upx behavioral2/memory/4556-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-144.dat upx behavioral2/files/0x0007000000023430-148.dat upx behavioral2/files/0x0007000000023431-153.dat upx behavioral2/memory/624-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-157.dat upx behavioral2/memory/5016-158-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 1596 1812 0955b034185ede29391a9c4c2e484d70_NeikiAnalytics.exe 82 PID 1812 wrote to memory of 1596 1812 0955b034185ede29391a9c4c2e484d70_NeikiAnalytics.exe 82 PID 1812 wrote to memory of 1596 1812 0955b034185ede29391a9c4c2e484d70_NeikiAnalytics.exe 82 PID 1596 wrote to memory of 1536 1596 5nbnbb.exe 83 PID 1596 wrote to memory of 1536 1596 5nbnbb.exe 83 PID 1596 wrote to memory of 1536 1596 5nbnbb.exe 83 PID 1536 wrote to memory of 3928 1536 ddjdp.exe 84 PID 1536 wrote to memory of 3928 1536 ddjdp.exe 84 PID 1536 wrote to memory of 3928 1536 ddjdp.exe 84 PID 3928 wrote to memory of 3720 3928 tthbnn.exe 85 PID 3928 wrote to memory of 3720 3928 tthbnn.exe 85 PID 3928 wrote to memory of 3720 3928 tthbnn.exe 85 PID 3720 wrote to memory of 5036 3720 djjdp.exe 86 PID 3720 wrote to memory of 5036 3720 djjdp.exe 86 PID 3720 wrote to memory of 5036 3720 djjdp.exe 86 PID 5036 wrote to memory of 1232 5036 1nhbth.exe 87 PID 5036 wrote to memory of 1232 5036 1nhbth.exe 87 PID 5036 wrote to memory of 1232 5036 1nhbth.exe 87 PID 1232 wrote to memory of 3244 1232 nbthhb.exe 88 PID 1232 wrote to memory of 3244 1232 nbthhb.exe 88 PID 1232 wrote to memory of 3244 1232 nbthhb.exe 88 PID 3244 wrote to memory of 3024 3244 pjjvj.exe 89 PID 3244 wrote to memory of 3024 3244 pjjvj.exe 89 PID 3244 wrote to memory of 3024 3244 pjjvj.exe 89 PID 3024 wrote to memory of 556 3024 ffffrll.exe 90 PID 3024 wrote to memory of 556 3024 ffffrll.exe 90 PID 3024 wrote to memory of 556 3024 ffffrll.exe 90 PID 556 wrote to memory of 2788 556 3pjdp.exe 91 PID 556 wrote to memory of 2788 556 3pjdp.exe 91 PID 556 wrote to memory of 2788 556 3pjdp.exe 91 PID 2788 wrote to memory of 4592 2788 3rrrlxx.exe 93 PID 2788 wrote to memory of 4592 2788 3rrrlxx.exe 93 PID 2788 wrote to memory of 4592 2788 3rrrlxx.exe 93 PID 4592 wrote to memory of 4040 4592 tbhbnh.exe 94 PID 4592 wrote to memory of 4040 4592 tbhbnh.exe 94 PID 4592 wrote to memory of 4040 4592 tbhbnh.exe 94 PID 4040 wrote to memory of 3644 4040 jppdd.exe 95 PID 4040 wrote to memory of 3644 4040 jppdd.exe 95 PID 4040 wrote to memory of 3644 4040 jppdd.exe 95 PID 3644 wrote to memory of 836 3644 lfxlxrl.exe 96 PID 3644 wrote to memory of 836 3644 lfxlxrl.exe 96 PID 3644 wrote to memory of 836 3644 lfxlxrl.exe 96 PID 836 wrote to memory of 8 836 tntnnn.exe 98 PID 836 wrote to memory of 8 836 tntnnn.exe 98 PID 836 wrote to memory of 8 836 tntnnn.exe 98 PID 8 wrote to memory of 4672 8 xllfxfx.exe 99 PID 8 wrote to memory of 4672 8 xllfxfx.exe 99 PID 8 wrote to memory of 4672 8 xllfxfx.exe 99 PID 4672 wrote to memory of 2244 4672 nttnnh.exe 100 PID 4672 wrote to memory of 2244 4672 nttnnh.exe 100 PID 4672 wrote to memory of 2244 4672 nttnnh.exe 100 PID 2244 wrote to memory of 4132 2244 ffrrlxr.exe 101 PID 2244 wrote to memory of 4132 2244 ffrrlxr.exe 101 PID 2244 wrote to memory of 4132 2244 ffrrlxr.exe 101 PID 4132 wrote to memory of 2020 4132 thbthb.exe 102 PID 4132 wrote to memory of 2020 4132 thbthb.exe 102 PID 4132 wrote to memory of 2020 4132 thbthb.exe 102 PID 2020 wrote to memory of 4472 2020 jdvdj.exe 104 PID 2020 wrote to memory of 4472 2020 jdvdj.exe 104 PID 2020 wrote to memory of 4472 2020 jdvdj.exe 104 PID 4472 wrote to memory of 3576 4472 xrffflf.exe 105 PID 4472 wrote to memory of 3576 4472 xrffflf.exe 105 PID 4472 wrote to memory of 3576 4472 xrffflf.exe 105 PID 3576 wrote to memory of 3016 3576 tnnhtn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0955b034185ede29391a9c4c2e484d70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0955b034185ede29391a9c4c2e484d70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\5nbnbb.exec:\5nbnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\ddjdp.exec:\ddjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\tthbnn.exec:\tthbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\djjdp.exec:\djjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\1nhbth.exec:\1nhbth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\nbthhb.exec:\nbthhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\pjjvj.exec:\pjjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\ffffrll.exec:\ffffrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\3pjdp.exec:\3pjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\3rrrlxx.exec:\3rrrlxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\tbhbnh.exec:\tbhbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\jppdd.exec:\jppdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\tntnnn.exec:\tntnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\xllfxfx.exec:\xllfxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\nttnnh.exec:\nttnnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\ffrrlxr.exec:\ffrrlxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\thbthb.exec:\thbthb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\jdvdj.exec:\jdvdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\xrffflf.exec:\xrffflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\tnnhtn.exec:\tnnhtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\pjvdd.exec:\pjvdd.exe23⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lllxlfx.exec:\lllxlfx.exe24⤵
- Executes dropped EXE
PID:2476 -
\??\c:\nbntbn.exec:\nbntbn.exe25⤵
- Executes dropped EXE
PID:4960 -
\??\c:\3xrlfxx.exec:\3xrlfxx.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\3rxrrrx.exec:\3rxrrrx.exe27⤵
- Executes dropped EXE
PID:1136 -
\??\c:\dpvdj.exec:\dpvdj.exe28⤵
- Executes dropped EXE
PID:4556 -
\??\c:\7llfrlx.exec:\7llfrlx.exe29⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3hntth.exec:\3hntth.exe30⤵
- Executes dropped EXE
PID:4328 -
\??\c:\bhnbnb.exec:\bhnbnb.exe31⤵
- Executes dropped EXE
PID:624 -
\??\c:\vpvvd.exec:\vpvvd.exe32⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rfllxrr.exec:\rfllxrr.exe33⤵
- Executes dropped EXE
PID:4116 -
\??\c:\btbnnn.exec:\btbnnn.exe34⤵
- Executes dropped EXE
PID:1456 -
\??\c:\jvpdp.exec:\jvpdp.exe35⤵
- Executes dropped EXE
PID:4644 -
\??\c:\flxlfxl.exec:\flxlfxl.exe36⤵
- Executes dropped EXE
PID:3456 -
\??\c:\hhbhbt.exec:\hhbhbt.exe37⤵
- Executes dropped EXE
PID:1336 -
\??\c:\thhnbt.exec:\thhnbt.exe38⤵
- Executes dropped EXE
PID:4224 -
\??\c:\vjvjv.exec:\vjvjv.exe39⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xlxrxrl.exec:\xlxrxrl.exe40⤵
- Executes dropped EXE
PID:1992 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe41⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bbbnht.exec:\bbbnht.exe42⤵
- Executes dropped EXE
PID:3608 -
\??\c:\jdppd.exec:\jdppd.exe43⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jdvvd.exec:\jdvvd.exe44⤵
- Executes dropped EXE
PID:4432 -
\??\c:\rrrllrl.exec:\rrrllrl.exe45⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nbbnbt.exec:\nbbnbt.exe46⤵
- Executes dropped EXE
PID:4764 -
\??\c:\vjddp.exec:\vjddp.exe47⤵
- Executes dropped EXE
PID:3144 -
\??\c:\jddvp.exec:\jddvp.exe48⤵
- Executes dropped EXE
PID:4988 -
\??\c:\llffxfl.exec:\llffxfl.exe49⤵
- Executes dropped EXE
PID:3740 -
\??\c:\bnhthb.exec:\bnhthb.exe50⤵
- Executes dropped EXE
PID:340 -
\??\c:\nbbnhb.exec:\nbbnhb.exe51⤵
- Executes dropped EXE
PID:3848 -
\??\c:\jddjd.exec:\jddjd.exe52⤵
- Executes dropped EXE
PID:972 -
\??\c:\xlrxlrf.exec:\xlrxlrf.exe53⤵
- Executes dropped EXE
PID:3700 -
\??\c:\nnnnht.exec:\nnnnht.exe54⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pjdvj.exec:\pjdvj.exe55⤵
- Executes dropped EXE
PID:228 -
\??\c:\jjpvv.exec:\jjpvv.exe56⤵
- Executes dropped EXE
PID:3228 -
\??\c:\lllxlxr.exec:\lllxlxr.exe57⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nhtnhh.exec:\nhtnhh.exe58⤵
- Executes dropped EXE
PID:4540 -
\??\c:\pjvvj.exec:\pjvvj.exe59⤵
- Executes dropped EXE
PID:744 -
\??\c:\llxflrr.exec:\llxflrr.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\fxxxlfx.exec:\fxxxlfx.exe61⤵
- Executes dropped EXE
PID:1112 -
\??\c:\hbbnhb.exec:\hbbnhb.exe62⤵
- Executes dropped EXE
PID:3980 -
\??\c:\pppdj.exec:\pppdj.exe63⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rxxlxlf.exec:\rxxlxlf.exe64⤵
- Executes dropped EXE
PID:836 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe65⤵
- Executes dropped EXE
PID:8 -
\??\c:\hbtnhb.exec:\hbtnhb.exe66⤵PID:1116
-
\??\c:\djjpj.exec:\djjpj.exe67⤵PID:4672
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe68⤵PID:4024
-
\??\c:\ntbbnh.exec:\ntbbnh.exe69⤵PID:3140
-
\??\c:\jpvpp.exec:\jpvpp.exe70⤵PID:628
-
\??\c:\pjjdv.exec:\pjjdv.exe71⤵PID:1980
-
\??\c:\ffxrffx.exec:\ffxrffx.exe72⤵PID:592
-
\??\c:\nbnbth.exec:\nbnbth.exe73⤵PID:716
-
\??\c:\pvvjp.exec:\pvvjp.exe74⤵PID:1616
-
\??\c:\rffrflf.exec:\rffrflf.exe75⤵PID:4140
-
\??\c:\xxfxffl.exec:\xxfxffl.exe76⤵PID:1356
-
\??\c:\bnnnbt.exec:\bnnnbt.exe77⤵PID:1060
-
\??\c:\dpdvv.exec:\dpdvv.exe78⤵PID:2472
-
\??\c:\jjjdp.exec:\jjjdp.exe79⤵PID:1792
-
\??\c:\1rfllxr.exec:\1rfllxr.exe80⤵PID:3284
-
\??\c:\httnnb.exec:\httnnb.exe81⤵PID:760
-
\??\c:\vvjdp.exec:\vvjdp.exe82⤵PID:1192
-
\??\c:\lxlllfx.exec:\lxlllfx.exe83⤵PID:3476
-
\??\c:\bbbtnb.exec:\bbbtnb.exe84⤵PID:3592
-
\??\c:\bhhhtn.exec:\bhhhtn.exe85⤵PID:2084
-
\??\c:\pvpvj.exec:\pvpvj.exe86⤵PID:4576
-
\??\c:\rffxllf.exec:\rffxllf.exe87⤵PID:5108
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe88⤵PID:4864
-
\??\c:\hbbttb.exec:\hbbttb.exe89⤵PID:4072
-
\??\c:\pppjd.exec:\pppjd.exe90⤵PID:3152
-
\??\c:\vddvp.exec:\vddvp.exe91⤵PID:3976
-
\??\c:\lrfllrr.exec:\lrfllrr.exe92⤵PID:4596
-
\??\c:\btbttn.exec:\btbttn.exe93⤵PID:4700
-
\??\c:\ppvvv.exec:\ppvvv.exe94⤵PID:1440
-
\??\c:\vvddd.exec:\vvddd.exe95⤵PID:4624
-
\??\c:\1fxxxlf.exec:\1fxxxlf.exe96⤵PID:4216
-
\??\c:\bnhnhh.exec:\bnhnhh.exe97⤵PID:2452
-
\??\c:\hhtnhn.exec:\hhtnhn.exe98⤵PID:4436
-
\??\c:\nhbbbb.exec:\nhbbbb.exe99⤵PID:848
-
\??\c:\jjppj.exec:\jjppj.exe100⤵PID:3172
-
\??\c:\fflfffx.exec:\fflfffx.exe101⤵PID:540
-
\??\c:\rlrlffx.exec:\rlrlffx.exe102⤵PID:3144
-
\??\c:\thnhhh.exec:\thnhhh.exe103⤵PID:4740
-
\??\c:\vpvpj.exec:\vpvpj.exe104⤵PID:3712
-
\??\c:\rllflll.exec:\rllflll.exe105⤵PID:4980
-
\??\c:\rfffxrf.exec:\rfffxrf.exe106⤵PID:3848
-
\??\c:\btbbbn.exec:\btbbbn.exe107⤵PID:972
-
\??\c:\pvddd.exec:\pvddd.exe108⤵PID:2608
-
\??\c:\pjpvv.exec:\pjpvv.exe109⤵PID:2560
-
\??\c:\rllfrrf.exec:\rllfrrf.exe110⤵PID:228
-
\??\c:\thtnnn.exec:\thtnnn.exe111⤵PID:3228
-
\??\c:\pdppd.exec:\pdppd.exe112⤵PID:452
-
\??\c:\jvjvv.exec:\jvjvv.exe113⤵PID:2828
-
\??\c:\lxlffff.exec:\lxlffff.exe114⤵PID:4584
-
\??\c:\nbtttt.exec:\nbtttt.exe115⤵PID:3448
-
\??\c:\htbttt.exec:\htbttt.exe116⤵PID:404
-
\??\c:\5pvdv.exec:\5pvdv.exe117⤵PID:4940
-
\??\c:\pjjdv.exec:\pjjdv.exe118⤵PID:3752
-
\??\c:\fffxxrr.exec:\fffxxrr.exe119⤵PID:1088
-
\??\c:\bhhhhn.exec:\bhhhhn.exe120⤵PID:976
-
\??\c:\nbhbtn.exec:\nbhbtn.exe121⤵PID:1644
-
\??\c:\ppppj.exec:\ppppj.exe122⤵PID:3196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-