Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 19:34
Behavioral task
behavioral1
Sample
2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe
-
Size
186KB
-
MD5
2fbb427b9269751db48c3c634d2334b0
-
SHA1
51215601716527cc60289292653fa4a93cbf0994
-
SHA256
e7c453e073ac2c846a288dc01c56749ac369be4735f2733bb7f7a179990030e8
-
SHA512
7f33bd554135921bdb6d4b2152b8fae776d7bb5a868db305a99e25903f4bd47eda662dcaa5d630422bd4ecaaa826aae1ebc8e9131b2ed3e7b4352aa035b09a8d
-
SSDEEP
3072:3hOmTsF93UYfwC6GIoutw8YcvrqrE66kropO6BWlPFH4tw1D43eMA:3cm4FmowdHoSzhraHcpOFltH4twl43vA
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1844-4-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1556-13-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2680-19-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1236-30-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3340-47-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2748-41-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2388-52-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4020-40-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3508-12-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4544-66-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1712-71-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1552-68-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3972-75-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2004-87-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4892-92-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1188-99-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2928-102-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4688-112-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5044-122-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1472-135-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3140-131-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4588-130-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/448-148-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4832-154-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2696-161-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2016-166-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4672-172-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1420-188-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3048-199-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/924-205-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4172-212-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4384-213-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4980-220-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2344-224-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1916-227-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1556-229-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4800-241-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4788-242-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1576-255-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/928-259-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3684-273-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2292-277-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4892-283-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1268-292-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1936-313-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3204-323-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1780-333-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4216-338-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3188-358-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/940-362-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1524-368-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/924-381-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4972-386-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3580-392-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1712-442-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1456-511-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3968-534-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4648-540-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4980-552-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4820-659-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4976-789-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4844-1105-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4060-1184-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1152-1386-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3508 hhbbnt.exe 1556 xxlrflr.exe 2680 rrllxxx.exe 740 rlrxxff.exe 1236 nntttb.exe 2748 dpddd.exe 4020 jvvpp.exe 3340 rlrrrrx.exe 2388 7bhnnn.exe 4544 5lxxxff.exe 1552 nnbbbh.exe 1712 1thbbb.exe 3972 pjvvd.exe 2004 hhtttt.exe 4892 jdddv.exe 1188 bnnnnt.exe 2928 ddjvd.exe 4688 xrfffrr.exe 3596 7nnnnh.exe 5044 fflffll.exe 4588 fxlllrx.exe 3140 ddvvv.exe 1472 llrxxff.exe 4952 lfrrrrl.exe 448 pvddd.exe 4832 rrllxfx.exe 2696 flrrrrr.exe 2016 hhhntb.exe 4672 ppvvp.exe 4084 rfllrxf.exe 2116 thbbbh.exe 1420 pvvvd.exe 4420 7xllrrx.exe 3272 ffrrxxx.exe 3048 dpddd.exe 924 pjjpv.exe 4888 1rrrlrr.exe 4172 tttbbb.exe 4384 9pddv.exe 4980 vvdpp.exe 2344 ffxxlfx.exe 1916 3bhbtb.exe 1556 xxxrrrr.exe 4064 3xfxffl.exe 2772 hhntbn.exe 4800 bbbbtb.exe 4788 jjvvv.exe 2640 xrxrfff.exe 4020 nnttnn.exe 1576 7bbbbh.exe 928 vpddp.exe 3144 xxllffx.exe 3572 xlrxfff.exe 4504 bbtttb.exe 3328 jjddp.exe 3684 7ppvv.exe 2292 lllxxxf.exe 4112 fflfrrr.exe 4892 5nhhbn.exe 3352 tttttb.exe 1268 pjppj.exe 4472 frxxxff.exe 3676 lxllxll.exe 4688 bbnhhn.exe -
resource yara_rule behavioral2/memory/1844-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/1844-4-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000800000002340f-8.dat upx behavioral2/files/0x0007000000023410-10.dat upx behavioral2/memory/1556-13-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2680-19-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023411-21.dat upx behavioral2/files/0x0007000000023412-28.dat upx behavioral2/files/0x0007000000023413-33.dat upx behavioral2/memory/1236-30-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023414-38.dat upx behavioral2/files/0x0007000000023415-45.dat upx behavioral2/memory/3340-47-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2748-41-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023416-51.dat upx behavioral2/memory/2388-52-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4020-40-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3508-12-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023417-56.dat upx behavioral2/memory/4544-66-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023419-69.dat upx behavioral2/memory/1712-71-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1552-68-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341a-74.dat upx behavioral2/memory/3972-75-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023418-61.dat upx behavioral2/memory/2004-81-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341b-80.dat upx behavioral2/files/0x000700000002341c-85.dat upx behavioral2/memory/2004-87-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4892-92-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341d-91.dat upx behavioral2/memory/1188-94-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341e-97.dat upx behavioral2/memory/1188-99-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341f-105.dat upx behavioral2/memory/2928-102-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023420-109.dat upx behavioral2/memory/4688-112-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023421-115.dat upx behavioral2/memory/5044-118-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023422-121.dat upx behavioral2/memory/5044-122-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023423-127.dat upx behavioral2/files/0x000800000002340d-133.dat upx behavioral2/memory/1472-135-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3140-131-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4588-130-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023424-139.dat upx behavioral2/files/0x0007000000023425-145.dat upx behavioral2/memory/448-148-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023426-150.dat upx behavioral2/memory/4832-154-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023427-156.dat upx behavioral2/memory/2696-161-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023428-163.dat upx behavioral2/memory/2016-166-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023429-168.dat upx behavioral2/memory/4672-172-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002342a-175.dat upx behavioral2/files/0x000700000002342b-180.dat upx behavioral2/files/0x000700000002342c-184.dat upx behavioral2/memory/1420-188-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1844 wrote to memory of 3508 1844 2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe 81 PID 1844 wrote to memory of 3508 1844 2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe 81 PID 1844 wrote to memory of 3508 1844 2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe 81 PID 3508 wrote to memory of 1556 3508 hhbbnt.exe 82 PID 3508 wrote to memory of 1556 3508 hhbbnt.exe 82 PID 3508 wrote to memory of 1556 3508 hhbbnt.exe 82 PID 1556 wrote to memory of 2680 1556 xxlrflr.exe 83 PID 1556 wrote to memory of 2680 1556 xxlrflr.exe 83 PID 1556 wrote to memory of 2680 1556 xxlrflr.exe 83 PID 2680 wrote to memory of 740 2680 rrllxxx.exe 84 PID 2680 wrote to memory of 740 2680 rrllxxx.exe 84 PID 2680 wrote to memory of 740 2680 rrllxxx.exe 84 PID 740 wrote to memory of 1236 740 rlrxxff.exe 85 PID 740 wrote to memory of 1236 740 rlrxxff.exe 85 PID 740 wrote to memory of 1236 740 rlrxxff.exe 85 PID 1236 wrote to memory of 2748 1236 nntttb.exe 86 PID 1236 wrote to memory of 2748 1236 nntttb.exe 86 PID 1236 wrote to memory of 2748 1236 nntttb.exe 86 PID 2748 wrote to memory of 4020 2748 dpddd.exe 87 PID 2748 wrote to memory of 4020 2748 dpddd.exe 87 PID 2748 wrote to memory of 4020 2748 dpddd.exe 87 PID 4020 wrote to memory of 3340 4020 jvvpp.exe 88 PID 4020 wrote to memory of 3340 4020 jvvpp.exe 88 PID 4020 wrote to memory of 3340 4020 jvvpp.exe 88 PID 3340 wrote to memory of 2388 3340 rlrrrrx.exe 89 PID 3340 wrote to memory of 2388 3340 rlrrrrx.exe 89 PID 3340 wrote to memory of 2388 3340 rlrrrrx.exe 89 PID 2388 wrote to memory of 4544 2388 7bhnnn.exe 90 PID 2388 wrote to memory of 4544 2388 7bhnnn.exe 90 PID 2388 wrote to memory of 4544 2388 7bhnnn.exe 90 PID 4544 wrote to memory of 1552 4544 5lxxxff.exe 92 PID 4544 wrote to memory of 1552 4544 5lxxxff.exe 92 PID 4544 wrote to memory of 1552 4544 5lxxxff.exe 92 PID 1552 wrote to memory of 1712 1552 nnbbbh.exe 93 PID 1552 wrote to memory of 1712 1552 nnbbbh.exe 93 PID 1552 wrote to memory of 1712 1552 nnbbbh.exe 93 PID 1712 wrote to memory of 3972 1712 1thbbb.exe 94 PID 1712 wrote to memory of 3972 1712 1thbbb.exe 94 PID 1712 wrote to memory of 3972 1712 1thbbb.exe 94 PID 3972 wrote to memory of 2004 3972 pjvvd.exe 96 PID 3972 wrote to memory of 2004 3972 pjvvd.exe 96 PID 3972 wrote to memory of 2004 3972 pjvvd.exe 96 PID 2004 wrote to memory of 4892 2004 hhtttt.exe 97 PID 2004 wrote to memory of 4892 2004 hhtttt.exe 97 PID 2004 wrote to memory of 4892 2004 hhtttt.exe 97 PID 4892 wrote to memory of 1188 4892 jdddv.exe 98 PID 4892 wrote to memory of 1188 4892 jdddv.exe 98 PID 4892 wrote to memory of 1188 4892 jdddv.exe 98 PID 1188 wrote to memory of 2928 1188 bnnnnt.exe 99 PID 1188 wrote to memory of 2928 1188 bnnnnt.exe 99 PID 1188 wrote to memory of 2928 1188 bnnnnt.exe 99 PID 2928 wrote to memory of 4688 2928 ddjvd.exe 101 PID 2928 wrote to memory of 4688 2928 ddjvd.exe 101 PID 2928 wrote to memory of 4688 2928 ddjvd.exe 101 PID 4688 wrote to memory of 3596 4688 xrfffrr.exe 102 PID 4688 wrote to memory of 3596 4688 xrfffrr.exe 102 PID 4688 wrote to memory of 3596 4688 xrfffrr.exe 102 PID 3596 wrote to memory of 5044 3596 7nnnnh.exe 103 PID 3596 wrote to memory of 5044 3596 7nnnnh.exe 103 PID 3596 wrote to memory of 5044 3596 7nnnnh.exe 103 PID 5044 wrote to memory of 4588 5044 fflffll.exe 104 PID 5044 wrote to memory of 4588 5044 fflffll.exe 104 PID 5044 wrote to memory of 4588 5044 fflffll.exe 104 PID 4588 wrote to memory of 3140 4588 fxlllrx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2fbb427b9269751db48c3c634d2334b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\hhbbnt.exec:\hhbbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\xxlrflr.exec:\xxlrflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\rrllxxx.exec:\rrllxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rlrxxff.exec:\rlrxxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\nntttb.exec:\nntttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\dpddd.exec:\dpddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\jvvpp.exec:\jvvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\7bhnnn.exec:\7bhnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\5lxxxff.exec:\5lxxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\nnbbbh.exec:\nnbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\1thbbb.exec:\1thbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\pjvvd.exec:\pjvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\hhtttt.exec:\hhtttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\jdddv.exec:\jdddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\bnnnnt.exec:\bnnnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\ddjvd.exec:\ddjvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xrfffrr.exec:\xrfffrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\7nnnnh.exec:\7nnnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\fflffll.exec:\fflffll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\fxlllrx.exec:\fxlllrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\ddvvv.exec:\ddvvv.exe23⤵
- Executes dropped EXE
PID:3140 -
\??\c:\llrxxff.exec:\llrxxff.exe24⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lfrrrrl.exec:\lfrrrrl.exe25⤵
- Executes dropped EXE
PID:4952 -
\??\c:\pvddd.exec:\pvddd.exe26⤵
- Executes dropped EXE
PID:448 -
\??\c:\rrllxfx.exec:\rrllxfx.exe27⤵
- Executes dropped EXE
PID:4832 -
\??\c:\flrrrrr.exec:\flrrrrr.exe28⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hhhntb.exec:\hhhntb.exe29⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ppvvp.exec:\ppvvp.exe30⤵
- Executes dropped EXE
PID:4672 -
\??\c:\rfllrxf.exec:\rfllrxf.exe31⤵
- Executes dropped EXE
PID:4084 -
\??\c:\thbbbh.exec:\thbbbh.exe32⤵
- Executes dropped EXE
PID:2116 -
\??\c:\pvvvd.exec:\pvvvd.exe33⤵
- Executes dropped EXE
PID:1420 -
\??\c:\7xllrrx.exec:\7xllrrx.exe34⤵
- Executes dropped EXE
PID:4420 -
\??\c:\ffrrxxx.exec:\ffrrxxx.exe35⤵
- Executes dropped EXE
PID:3272 -
\??\c:\dpddd.exec:\dpddd.exe36⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pjjpv.exec:\pjjpv.exe37⤵
- Executes dropped EXE
PID:924 -
\??\c:\1rrrlrr.exec:\1rrrlrr.exe38⤵
- Executes dropped EXE
PID:4888 -
\??\c:\tttbbb.exec:\tttbbb.exe39⤵
- Executes dropped EXE
PID:4172 -
\??\c:\9pddv.exec:\9pddv.exe40⤵
- Executes dropped EXE
PID:4384 -
\??\c:\vvdpp.exec:\vvdpp.exe41⤵
- Executes dropped EXE
PID:4980 -
\??\c:\ffxxlfx.exec:\ffxxlfx.exe42⤵
- Executes dropped EXE
PID:2344 -
\??\c:\3bhbtb.exec:\3bhbtb.exe43⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xxxrrrr.exec:\xxxrrrr.exe44⤵
- Executes dropped EXE
PID:1556 -
\??\c:\3xfxffl.exec:\3xfxffl.exe45⤵
- Executes dropped EXE
PID:4064 -
\??\c:\hhntbn.exec:\hhntbn.exe46⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bbbbtb.exec:\bbbbtb.exe47⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jjvvv.exec:\jjvvv.exe48⤵
- Executes dropped EXE
PID:4788 -
\??\c:\xrxrfff.exec:\xrxrfff.exe49⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nnttnn.exec:\nnttnn.exe50⤵
- Executes dropped EXE
PID:4020 -
\??\c:\7bbbbh.exec:\7bbbbh.exe51⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vpddp.exec:\vpddp.exe52⤵
- Executes dropped EXE
PID:928 -
\??\c:\xxllffx.exec:\xxllffx.exe53⤵
- Executes dropped EXE
PID:3144 -
\??\c:\xlrxfff.exec:\xlrxfff.exe54⤵
- Executes dropped EXE
PID:3572 -
\??\c:\bbtttb.exec:\bbtttb.exe55⤵
- Executes dropped EXE
PID:4504 -
\??\c:\jjddp.exec:\jjddp.exe56⤵
- Executes dropped EXE
PID:3328 -
\??\c:\7ppvv.exec:\7ppvv.exe57⤵
- Executes dropped EXE
PID:3684 -
\??\c:\lllxxxf.exec:\lllxxxf.exe58⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fflfrrr.exec:\fflfrrr.exe59⤵
- Executes dropped EXE
PID:4112 -
\??\c:\5nhhbn.exec:\5nhhbn.exe60⤵
- Executes dropped EXE
PID:4892 -
\??\c:\tttttb.exec:\tttttb.exe61⤵
- Executes dropped EXE
PID:3352 -
\??\c:\pjppj.exec:\pjppj.exe62⤵
- Executes dropped EXE
PID:1268 -
\??\c:\frxxxff.exec:\frxxxff.exe63⤵
- Executes dropped EXE
PID:4472 -
\??\c:\lxllxll.exec:\lxllxll.exe64⤵
- Executes dropped EXE
PID:3676 -
\??\c:\bbnhhn.exec:\bbnhhn.exe65⤵
- Executes dropped EXE
PID:4688 -
\??\c:\nbhhbh.exec:\nbhhbh.exe66⤵PID:1136
-
\??\c:\dvvpd.exec:\dvvpd.exe67⤵PID:668
-
\??\c:\lfllflr.exec:\lfllflr.exe68⤵PID:1936
-
\??\c:\rllllrr.exec:\rllllrr.exe69⤵PID:4512
-
\??\c:\bbbbbh.exec:\bbbbbh.exe70⤵PID:2428
-
\??\c:\bbnnhh.exec:\bbnnhh.exe71⤵PID:4760
-
\??\c:\ddpjj.exec:\ddpjj.exe72⤵PID:3204
-
\??\c:\dvpvv.exec:\dvpvv.exe73⤵PID:2700
-
\??\c:\rflrrxx.exec:\rflrrxx.exe74⤵PID:1780
-
\??\c:\lrxxxxf.exec:\lrxxxxf.exe75⤵PID:3768
-
\??\c:\btnnhn.exec:\btnnhn.exe76⤵PID:4216
-
\??\c:\7nbbtt.exec:\7nbbtt.exe77⤵PID:1540
-
\??\c:\jjppj.exec:\jjppj.exe78⤵PID:1456
-
\??\c:\vpvvv.exec:\vpvvv.exe79⤵PID:4708
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe80⤵PID:5072
-
\??\c:\hnhhtb.exec:\hnhhtb.exe81⤵PID:3188
-
\??\c:\ttbtnt.exec:\ttbtnt.exe82⤵PID:2116
-
\??\c:\ddvvv.exec:\ddvvv.exe83⤵PID:940
-
\??\c:\vvvdd.exec:\vvvdd.exe84⤵PID:1524
-
\??\c:\fxxrlfr.exec:\fxxrlfr.exe85⤵PID:1244
-
\??\c:\hbnhhn.exec:\hbnhhn.exe86⤵PID:2896
-
\??\c:\hnnhnt.exec:\hnnhnt.exe87⤵PID:2448
-
\??\c:\pppvv.exec:\pppvv.exe88⤵PID:924
-
\??\c:\djpjj.exec:\djpjj.exe89⤵PID:3228
-
\??\c:\rrxxllr.exec:\rrxxllr.exe90⤵PID:4972
-
\??\c:\bbtnnt.exec:\bbtnnt.exe91⤵PID:3580
-
\??\c:\thttnb.exec:\thttnb.exe92⤵PID:528
-
\??\c:\vjppv.exec:\vjppv.exe93⤵PID:2344
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe94⤵PID:740
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe95⤵PID:3260
-
\??\c:\nnntbb.exec:\nnntbb.exe96⤵PID:1220
-
\??\c:\jpjdd.exec:\jpjdd.exe97⤵PID:3672
-
\??\c:\jpjjv.exec:\jpjjv.exe98⤵PID:3732
-
\??\c:\lrllflf.exec:\lrllflf.exe99⤵PID:2384
-
\??\c:\lrlllll.exec:\lrlllll.exe100⤵PID:4896
-
\??\c:\hhhhnn.exec:\hhhhnn.exe101⤵PID:5052
-
\??\c:\hnttnt.exec:\hnttnt.exe102⤵PID:4228
-
\??\c:\vvppj.exec:\vvppj.exe103⤵PID:32
-
\??\c:\7dvjj.exec:\7dvjj.exe104⤵PID:2088
-
\??\c:\xlfxrxr.exec:\xlfxrxr.exe105⤵PID:1552
-
\??\c:\xxllxlx.exec:\xxllxlx.exe106⤵PID:3572
-
\??\c:\ntttbt.exec:\ntttbt.exe107⤵PID:2932
-
\??\c:\bbbttb.exec:\bbbttb.exe108⤵PID:1712
-
\??\c:\dvddd.exec:\dvddd.exe109⤵PID:3684
-
\??\c:\xrrrrxx.exec:\xrrrrxx.exe110⤵PID:4044
-
\??\c:\xrxxxff.exec:\xrxxxff.exe111⤵PID:400
-
\??\c:\hbnnnn.exec:\hbnnnn.exe112⤵PID:2052
-
\??\c:\hthhnb.exec:\hthhnb.exe113⤵PID:1028
-
\??\c:\7djjd.exec:\7djjd.exe114⤵PID:3584
-
\??\c:\pjjjp.exec:\pjjjp.exe115⤵PID:4408
-
\??\c:\frxxxff.exec:\frxxxff.exe116⤵PID:4472
-
\??\c:\ffllrrx.exec:\ffllrrx.exe117⤵PID:4308
-
\??\c:\9ffrrxx.exec:\9ffrrxx.exe118⤵PID:2032
-
\??\c:\9bnttt.exec:\9bnttt.exe119⤵PID:1092
-
\??\c:\nbbhbn.exec:\nbbhbn.exe120⤵PID:4908
-
\??\c:\pvjjp.exec:\pvjjp.exe121⤵PID:1416
-
\??\c:\xxlxrlr.exec:\xxlxrlr.exe122⤵PID:1192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-