Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 08:38
Behavioral task
behavioral1
Sample
a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe
-
Size
380KB
-
MD5
a944d804680a0a129c50abcde60ff690
-
SHA1
e6103d5435b3de6e6905b466ad027d1676fb7f51
-
SHA256
7c281221372c8c956741cbadd0c764fca7ac59678c1d203081646204dd1dab91
-
SHA512
86cc81511573da2c60e3ec307cf55ecc4808b24e0b92166d518e487f325f56ecdb55bac5c5b80e02c374632906cffdf1d6e6ffa4d2c37828222894cdbf595e16
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0Ibse:y4wFHoS3eFaKHpNKbbse
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4540-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1224-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2560-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1260-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2184-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3156-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/100-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1100-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/808-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/900-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2404-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-824-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-849-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3052 ttbtnh.exe 1884 htnbtn.exe 2016 tntnhb.exe 1944 jjvvd.exe 2560 nhbbtb.exe 1224 jdjdv.exe 5076 tnhbbb.exe 1324 bntnhh.exe 1260 vvjjp.exe 3964 bhbnnb.exe 1704 pddjd.exe 3676 rrxxrlf.exe 400 3pjdd.exe 4368 rlflllf.exe 4456 dddvv.exe 3064 fxfrlfx.exe 1932 vdppp.exe 4992 thnhbt.exe 2184 dddvv.exe 3420 xxxxrrl.exe 4948 djjdd.exe 2520 hhhtth.exe 2928 bbnhnb.exe 4496 dvpjj.exe 3156 bbhbbb.exe 5080 jvppj.exe 3300 nttthh.exe 3988 pvjdv.exe 1976 frlxrrl.exe 2760 1ddpd.exe 2096 xllllrr.exe 4824 pddpp.exe 1284 llxrxrr.exe 1532 jdjdp.exe 2836 3rxxfxf.exe 1464 xlrfxxl.exe 2612 nnhtnh.exe 4568 dpddv.exe 2316 lflfxxr.exe 4444 tbttnh.exe 3032 pjjdd.exe 2296 nnbbhb.exe 1152 jddvv.exe 3776 dpvpj.exe 2696 rlrfflx.exe 3036 jdjpp.exe 4684 fxxxrrl.exe 1940 thhnhb.exe 3952 dvjvp.exe 3576 llrllff.exe 2556 3nhbtn.exe 3836 pjppj.exe 4900 rffxrlf.exe 1340 rlfxrrl.exe 3964 5vvpd.exe 100 rlrrllf.exe 1160 ffxffxl.exe 1380 ththth.exe 1540 5vjdd.exe 432 xxxxxff.exe 4456 ttbbbh.exe 4544 ddvpj.exe 3716 7xfxrrx.exe 1932 hbhbnn.exe -
resource yara_rule behavioral2/memory/4540-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0005000000023276-4.dat upx behavioral2/memory/4540-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3052-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233f8-10.dat upx behavioral2/files/0x00070000000233f9-12.dat upx behavioral2/memory/2016-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1884-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fa-21.dat upx behavioral2/memory/1944-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fb-27.dat upx behavioral2/memory/1944-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2560-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-34.dat upx behavioral2/memory/1224-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fd-39.dat upx behavioral2/memory/2560-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fe-45.dat upx behavioral2/memory/5076-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ff-51.dat upx behavioral2/memory/1260-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023400-57.dat upx behavioral2/files/0x0007000000023401-62.dat upx behavioral2/memory/3964-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1704-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-70.dat upx behavioral2/memory/3676-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023403-75.dat upx behavioral2/memory/3676-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/400-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-83.dat upx behavioral2/files/0x00080000000233f6-87.dat upx behavioral2/memory/4456-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023405-94.dat upx behavioral2/files/0x0007000000023406-98.dat upx behavioral2/memory/3064-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1932-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-106.dat upx behavioral2/memory/1932-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4992-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233f6-113.dat upx behavioral2/memory/2184-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-118.dat upx behavioral2/files/0x0007000000023409-123.dat upx behavioral2/memory/4948-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022970-129.dat upx behavioral2/files/0x0005000000022974-134.dat upx behavioral2/files/0x000700000002340a-139.dat upx behavioral2/files/0x000700000002340b-144.dat upx behavioral2/memory/4496-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3156-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-152.dat upx behavioral2/files/0x000700000002340d-156.dat upx behavioral2/memory/5080-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-162.dat upx behavioral2/memory/3988-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-169.dat upx behavioral2/memory/1976-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002340f-174.dat upx behavioral2/memory/2760-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023412-181.dat upx behavioral2/files/0x000800000002336a-185.dat upx behavioral2/memory/4824-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1532-198-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4540 wrote to memory of 3052 4540 a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe 82 PID 4540 wrote to memory of 3052 4540 a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe 82 PID 4540 wrote to memory of 3052 4540 a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe 82 PID 3052 wrote to memory of 1884 3052 ttbtnh.exe 83 PID 3052 wrote to memory of 1884 3052 ttbtnh.exe 83 PID 3052 wrote to memory of 1884 3052 ttbtnh.exe 83 PID 1884 wrote to memory of 2016 1884 htnbtn.exe 84 PID 1884 wrote to memory of 2016 1884 htnbtn.exe 84 PID 1884 wrote to memory of 2016 1884 htnbtn.exe 84 PID 2016 wrote to memory of 1944 2016 tntnhb.exe 85 PID 2016 wrote to memory of 1944 2016 tntnhb.exe 85 PID 2016 wrote to memory of 1944 2016 tntnhb.exe 85 PID 1944 wrote to memory of 2560 1944 jjvvd.exe 88 PID 1944 wrote to memory of 2560 1944 jjvvd.exe 88 PID 1944 wrote to memory of 2560 1944 jjvvd.exe 88 PID 2560 wrote to memory of 1224 2560 nhbbtb.exe 89 PID 2560 wrote to memory of 1224 2560 nhbbtb.exe 89 PID 2560 wrote to memory of 1224 2560 nhbbtb.exe 89 PID 1224 wrote to memory of 5076 1224 jdjdv.exe 90 PID 1224 wrote to memory of 5076 1224 jdjdv.exe 90 PID 1224 wrote to memory of 5076 1224 jdjdv.exe 90 PID 5076 wrote to memory of 1324 5076 tnhbbb.exe 91 PID 5076 wrote to memory of 1324 5076 tnhbbb.exe 91 PID 5076 wrote to memory of 1324 5076 tnhbbb.exe 91 PID 1324 wrote to memory of 1260 1324 bntnhh.exe 93 PID 1324 wrote to memory of 1260 1324 bntnhh.exe 93 PID 1324 wrote to memory of 1260 1324 bntnhh.exe 93 PID 1260 wrote to memory of 3964 1260 vvjjp.exe 94 PID 1260 wrote to memory of 3964 1260 vvjjp.exe 94 PID 1260 wrote to memory of 3964 1260 vvjjp.exe 94 PID 3964 wrote to memory of 1704 3964 bhbnnb.exe 95 PID 3964 wrote to memory of 1704 3964 bhbnnb.exe 95 PID 3964 wrote to memory of 1704 3964 bhbnnb.exe 95 PID 1704 wrote to memory of 3676 1704 pddjd.exe 96 PID 1704 wrote to memory of 3676 1704 pddjd.exe 96 PID 1704 wrote to memory of 3676 1704 pddjd.exe 96 PID 3676 wrote to memory of 400 3676 rrxxrlf.exe 97 PID 3676 wrote to memory of 400 3676 rrxxrlf.exe 97 PID 3676 wrote to memory of 400 3676 rrxxrlf.exe 97 PID 400 wrote to memory of 4368 400 3pjdd.exe 98 PID 400 wrote to memory of 4368 400 3pjdd.exe 98 PID 400 wrote to memory of 4368 400 3pjdd.exe 98 PID 4368 wrote to memory of 4456 4368 rlflllf.exe 99 PID 4368 wrote to memory of 4456 4368 rlflllf.exe 99 PID 4368 wrote to memory of 4456 4368 rlflllf.exe 99 PID 4456 wrote to memory of 3064 4456 dddvv.exe 100 PID 4456 wrote to memory of 3064 4456 dddvv.exe 100 PID 4456 wrote to memory of 3064 4456 dddvv.exe 100 PID 3064 wrote to memory of 1932 3064 fxfrlfx.exe 101 PID 3064 wrote to memory of 1932 3064 fxfrlfx.exe 101 PID 3064 wrote to memory of 1932 3064 fxfrlfx.exe 101 PID 1932 wrote to memory of 4992 1932 vdppp.exe 102 PID 1932 wrote to memory of 4992 1932 vdppp.exe 102 PID 1932 wrote to memory of 4992 1932 vdppp.exe 102 PID 4992 wrote to memory of 2184 4992 thnhbt.exe 103 PID 4992 wrote to memory of 2184 4992 thnhbt.exe 103 PID 4992 wrote to memory of 2184 4992 thnhbt.exe 103 PID 2184 wrote to memory of 3420 2184 dddvv.exe 104 PID 2184 wrote to memory of 3420 2184 dddvv.exe 104 PID 2184 wrote to memory of 3420 2184 dddvv.exe 104 PID 3420 wrote to memory of 4948 3420 xxxxrrl.exe 105 PID 3420 wrote to memory of 4948 3420 xxxxrrl.exe 105 PID 3420 wrote to memory of 4948 3420 xxxxrrl.exe 105 PID 4948 wrote to memory of 2520 4948 djjdd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a944d804680a0a129c50abcde60ff690_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\ttbtnh.exec:\ttbtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\htnbtn.exec:\htnbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\tntnhb.exec:\tntnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\jjvvd.exec:\jjvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\nhbbtb.exec:\nhbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\jdjdv.exec:\jdjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\tnhbbb.exec:\tnhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\bntnhh.exec:\bntnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\vvjjp.exec:\vvjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\bhbnnb.exec:\bhbnnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\pddjd.exec:\pddjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\rrxxrlf.exec:\rrxxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\3pjdd.exec:\3pjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\rlflllf.exec:\rlflllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\dddvv.exec:\dddvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\fxfrlfx.exec:\fxfrlfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\vdppp.exec:\vdppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\thnhbt.exec:\thnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\dddvv.exec:\dddvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\djjdd.exec:\djjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\hhhtth.exec:\hhhtth.exe23⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bbnhnb.exec:\bbnhnb.exe24⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dvpjj.exec:\dvpjj.exe25⤵
- Executes dropped EXE
PID:4496 -
\??\c:\bbhbbb.exec:\bbhbbb.exe26⤵
- Executes dropped EXE
PID:3156 -
\??\c:\jvppj.exec:\jvppj.exe27⤵
- Executes dropped EXE
PID:5080 -
\??\c:\nttthh.exec:\nttthh.exe28⤵
- Executes dropped EXE
PID:3300 -
\??\c:\pvjdv.exec:\pvjdv.exe29⤵
- Executes dropped EXE
PID:3988 -
\??\c:\frlxrrl.exec:\frlxrrl.exe30⤵
- Executes dropped EXE
PID:1976 -
\??\c:\1ddpd.exec:\1ddpd.exe31⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xllllrr.exec:\xllllrr.exe32⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pddpp.exec:\pddpp.exe33⤵
- Executes dropped EXE
PID:4824 -
\??\c:\llxrxrr.exec:\llxrxrr.exe34⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jdjdp.exec:\jdjdp.exe35⤵
- Executes dropped EXE
PID:1532 -
\??\c:\3rxxfxf.exec:\3rxxfxf.exe36⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xlrfxxl.exec:\xlrfxxl.exe37⤵
- Executes dropped EXE
PID:1464 -
\??\c:\nnhtnh.exec:\nnhtnh.exe38⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dpddv.exec:\dpddv.exe39⤵
- Executes dropped EXE
PID:4568 -
\??\c:\lflfxxr.exec:\lflfxxr.exe40⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tbttnh.exec:\tbttnh.exe41⤵
- Executes dropped EXE
PID:4444 -
\??\c:\pjjdd.exec:\pjjdd.exe42⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nnbbhb.exec:\nnbbhb.exe43⤵
- Executes dropped EXE
PID:2296 -
\??\c:\jddvv.exec:\jddvv.exe44⤵
- Executes dropped EXE
PID:1152 -
\??\c:\dpvpj.exec:\dpvpj.exe45⤵
- Executes dropped EXE
PID:3776 -
\??\c:\rlrfflx.exec:\rlrfflx.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jdjpp.exec:\jdjpp.exe47⤵
- Executes dropped EXE
PID:3036 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe48⤵
- Executes dropped EXE
PID:4684 -
\??\c:\thhnhb.exec:\thhnhb.exe49⤵
- Executes dropped EXE
PID:1940 -
\??\c:\dvjvp.exec:\dvjvp.exe50⤵
- Executes dropped EXE
PID:3952 -
\??\c:\llrllff.exec:\llrllff.exe51⤵
- Executes dropped EXE
PID:3576 -
\??\c:\3nhbtn.exec:\3nhbtn.exe52⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pjppj.exec:\pjppj.exe53⤵
- Executes dropped EXE
PID:3836 -
\??\c:\rffxrlf.exec:\rffxrlf.exe54⤵
- Executes dropped EXE
PID:4900 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe55⤵
- Executes dropped EXE
PID:1340 -
\??\c:\5vvpd.exec:\5vvpd.exe56⤵
- Executes dropped EXE
PID:3964 -
\??\c:\rlrrllf.exec:\rlrrllf.exe57⤵
- Executes dropped EXE
PID:100 -
\??\c:\ffxffxl.exec:\ffxffxl.exe58⤵
- Executes dropped EXE
PID:1160 -
\??\c:\ththth.exec:\ththth.exe59⤵
- Executes dropped EXE
PID:1380 -
\??\c:\5vjdd.exec:\5vjdd.exe60⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xxxxxff.exec:\xxxxxff.exe61⤵
- Executes dropped EXE
PID:432 -
\??\c:\ttbbbh.exec:\ttbbbh.exe62⤵
- Executes dropped EXE
PID:4456 -
\??\c:\ddvpj.exec:\ddvpj.exe63⤵
- Executes dropped EXE
PID:4544 -
\??\c:\7xfxrrx.exec:\7xfxrrx.exe64⤵
- Executes dropped EXE
PID:3716 -
\??\c:\hbhbnn.exec:\hbhbnn.exe65⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nnhbbb.exec:\nnhbbb.exe66⤵PID:4896
-
\??\c:\pjpjd.exec:\pjpjd.exe67⤵PID:468
-
\??\c:\lfrllll.exec:\lfrllll.exe68⤵PID:3636
-
\??\c:\nbnhhb.exec:\nbnhhb.exe69⤵PID:4656
-
\??\c:\djvjj.exec:\djvjj.exe70⤵PID:2824
-
\??\c:\jdjjd.exec:\jdjjd.exe71⤵PID:3172
-
\??\c:\tbnhhb.exec:\tbnhhb.exe72⤵PID:4440
-
\??\c:\djddj.exec:\djddj.exe73⤵PID:3208
-
\??\c:\5ddpj.exec:\5ddpj.exe74⤵PID:4840
-
\??\c:\llffxxr.exec:\llffxxr.exe75⤵PID:1100
-
\??\c:\bbtnnn.exec:\bbtnnn.exe76⤵PID:2300
-
\??\c:\dvddv.exec:\dvddv.exe77⤵PID:840
-
\??\c:\xxrxlxr.exec:\xxrxlxr.exe78⤵PID:1008
-
\??\c:\nnbtnt.exec:\nnbtnt.exe79⤵PID:2368
-
\??\c:\vjjvj.exec:\vjjvj.exe80⤵PID:2608
-
\??\c:\xrxrlll.exec:\xrxrlll.exe81⤵PID:5008
-
\??\c:\rrxlxxf.exec:\rrxlxxf.exe82⤵PID:2096
-
\??\c:\1hbtnh.exec:\1hbtnh.exe83⤵PID:4288
-
\??\c:\5jvdp.exec:\5jvdp.exe84⤵PID:808
-
\??\c:\3xxrfxl.exec:\3xxrfxl.exe85⤵PID:3944
-
\??\c:\xrfrffx.exec:\xrfrffx.exe86⤵PID:4740
-
\??\c:\nhhbtn.exec:\nhhbtn.exe87⤵PID:3652
-
\??\c:\1djvd.exec:\1djvd.exe88⤵PID:4088
-
\??\c:\3lxlfxr.exec:\3lxlfxr.exe89⤵PID:2272
-
\??\c:\rflfxxr.exec:\rflfxxr.exe90⤵PID:4732
-
\??\c:\tnnbnh.exec:\tnnbnh.exe91⤵PID:2984
-
\??\c:\5pvpd.exec:\5pvpd.exe92⤵PID:3520
-
\??\c:\pvjdp.exec:\pvjdp.exe93⤵PID:2724
-
\??\c:\1lrlxxr.exec:\1lrlxxr.exe94⤵PID:2296
-
\??\c:\nhnnnh.exec:\nhnnnh.exe95⤵PID:1152
-
\??\c:\nnnbtn.exec:\nnnbtn.exe96⤵PID:2016
-
\??\c:\pdpjj.exec:\pdpjj.exe97⤵PID:2696
-
\??\c:\pdjjd.exec:\pdjjd.exe98⤵PID:2328
-
\??\c:\xlrffff.exec:\xlrffff.exe99⤵PID:4688
-
\??\c:\nthhtt.exec:\nthhtt.exe100⤵PID:3820
-
\??\c:\7ttnbb.exec:\7ttnbb.exe101⤵PID:1076
-
\??\c:\jdpjd.exec:\jdpjd.exe102⤵PID:3940
-
\??\c:\flrlffx.exec:\flrlffx.exe103⤵PID:3048
-
\??\c:\5llfrxl.exec:\5llfrxl.exe104⤵PID:4956
-
\??\c:\bnhbtt.exec:\bnhbtt.exe105⤵PID:1260
-
\??\c:\dvvvp.exec:\dvvvp.exe106⤵PID:4960
-
\??\c:\rxffxff.exec:\rxffxff.exe107⤵PID:960
-
\??\c:\hnthbt.exec:\hnthbt.exe108⤵PID:4460
-
\??\c:\7thtnb.exec:\7thtnb.exe109⤵PID:100
-
\??\c:\ddppj.exec:\ddppj.exe110⤵PID:1160
-
\??\c:\5lrlfxr.exec:\5lrlfxr.exe111⤵PID:2176
-
\??\c:\thnnnh.exec:\thnnnh.exe112⤵PID:2212
-
\??\c:\ntthtt.exec:\ntthtt.exe113⤵PID:4264
-
\??\c:\dvpjd.exec:\dvpjd.exe114⤵PID:4416
-
\??\c:\xrfxfxx.exec:\xrfxfxx.exe115⤵PID:5056
-
\??\c:\hnbbtn.exec:\hnbbtn.exe116⤵PID:748
-
\??\c:\nnthbb.exec:\nnthbb.exe117⤵PID:1912
-
\??\c:\dpppj.exec:\dpppj.exe118⤵PID:4992
-
\??\c:\frffllr.exec:\frffllr.exe119⤵PID:5068
-
\??\c:\hbnnbb.exec:\hbnnbb.exe120⤵PID:3396
-
\??\c:\bbbttt.exec:\bbbttt.exe121⤵PID:900
-
\??\c:\vjjdp.exec:\vjjdp.exe122⤵PID:4504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-