Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 22:06
Behavioral task
behavioral1
Sample
26278839b1ab113ee99b0ebea3b7e110_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
26278839b1ab113ee99b0ebea3b7e110_NeikiAnalytics.exe
-
Size
333KB
-
MD5
26278839b1ab113ee99b0ebea3b7e110
-
SHA1
bb9e4214e26266ec6346d9b1a625b06ff7c3ff9b
-
SHA256
d91e093b406f39066df75832866af36614386af11d23e6ec7c5e1d22e91f92c5
-
SHA512
e94eee49478b2f7f9ee988560a5f54aba42513a53a888e3dc68c524b9ce3227b453a8d98d2b36094c019bb83795d43db3b67a6237d4223534811d54e31d69bb3
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1i/x:x4wFHoS3eFaKHpv/VycgE8ox
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/372-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1188-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-659-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-766-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-797-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1852 jvvpj.exe 3600 xfrrrrx.exe 5004 3htbtt.exe 1336 fxflrxf.exe 4648 5bbttt.exe 4956 pjddd.exe 5060 9jvpj.exe 644 lxxxrrl.exe 1020 xrlllxx.exe 3464 3hhhbb.exe 1424 djppj.exe 4988 xrrrllf.exe 1148 dpvpd.exe 2780 jvjdd.exe 3916 ffffllx.exe 4852 vvvpp.exe 2296 rrlffxx.exe 3780 5bhbtb.exe 3364 fxrllff.exe 3056 9hnhtt.exe 1188 ddppp.exe 5044 lxxrrrx.exe 4524 fffxxxr.exe 1004 bhnbnh.exe 3796 rfxrllf.exe 3524 rxfxrrx.exe 3888 hnnnhb.exe 3420 pdvpv.exe 3692 xxxllxl.exe 4544 thnnhh.exe 4580 1jvpv.exe 4244 ppvpp.exe 528 xlxxrrr.exe 4672 5nthnt.exe 4332 3vpdv.exe 2644 flrxlrx.exe 372 dpvjj.exe 3980 xflxlfl.exe 3600 nthbnn.exe 4324 1djvd.exe 1404 dpppj.exe 4748 llfrfxl.exe 1512 bhhnht.exe 3596 bhnhtn.exe 3244 7vdpj.exe 4760 lllxrfx.exe 1640 rrxlfxl.exe 2032 hbnhbt.exe 1684 jjpjd.exe 456 7pjvj.exe 3560 9fxlfxr.exe 4572 1xxllff.exe 2240 thbthh.exe 3252 vjjvp.exe 3080 vddpj.exe 4200 lxlxxrf.exe 5040 9tbthb.exe 1624 7tnnbt.exe 944 5pjdp.exe 5028 3dvjd.exe 2384 1ffxxrf.exe 4336 3nnhbt.exe 8 bnnhhh.exe 4012 jppjv.exe -
resource yara_rule behavioral2/memory/372-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b00000002340a-4.dat upx behavioral2/memory/372-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1852-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023413-9.dat upx behavioral2/files/0x0007000000023418-13.dat upx behavioral2/memory/3600-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5004-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-23.dat upx behavioral2/memory/1336-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4648-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-33.dat upx behavioral2/memory/4956-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-40.dat upx behavioral2/memory/5060-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-28.dat upx behavioral2/files/0x000700000002341d-45.dat upx behavioral2/memory/644-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-50.dat upx behavioral2/memory/1020-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-56.dat upx behavioral2/memory/3464-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-63.dat upx behavioral2/memory/3464-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1424-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-70.dat upx behavioral2/memory/4988-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-76.dat upx behavioral2/memory/1148-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-83.dat upx behavioral2/memory/2780-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4988-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-89.dat upx behavioral2/memory/2780-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-94.dat upx behavioral2/memory/3916-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-102.dat upx behavioral2/memory/4852-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2296-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-107.dat upx behavioral2/files/0x0007000000023428-112.dat upx behavioral2/memory/3780-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023414-118.dat upx behavioral2/memory/3364-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-125.dat upx behavioral2/memory/1188-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-130.dat upx behavioral2/files/0x000700000002342b-136.dat upx behavioral2/files/0x000700000002342c-140.dat upx behavioral2/memory/1004-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-146.dat upx behavioral2/files/0x000700000002342e-153.dat upx behavioral2/memory/3796-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3524-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-159.dat upx behavioral2/files/0x0007000000023430-164.dat upx behavioral2/files/0x0007000000023432-168.dat upx behavioral2/memory/3420-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3692-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-175.dat upx behavioral2/memory/4544-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-181.dat upx behavioral2/memory/4580-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-188.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 372 wrote to memory of 1852 372 26278839b1ab113ee99b0ebea3b7e110_NeikiAnalytics.exe 83 PID 372 wrote to memory of 1852 372 26278839b1ab113ee99b0ebea3b7e110_NeikiAnalytics.exe 83 PID 372 wrote to memory of 1852 372 26278839b1ab113ee99b0ebea3b7e110_NeikiAnalytics.exe 83 PID 1852 wrote to memory of 3600 1852 jvvpj.exe 84 PID 1852 wrote to memory of 3600 1852 jvvpj.exe 84 PID 1852 wrote to memory of 3600 1852 jvvpj.exe 84 PID 3600 wrote to memory of 5004 3600 xfrrrrx.exe 85 PID 3600 wrote to memory of 5004 3600 xfrrrrx.exe 85 PID 3600 wrote to memory of 5004 3600 xfrrrrx.exe 85 PID 5004 wrote to memory of 1336 5004 3htbtt.exe 86 PID 5004 wrote to memory of 1336 5004 3htbtt.exe 86 PID 5004 wrote to memory of 1336 5004 3htbtt.exe 86 PID 1336 wrote to memory of 4648 1336 fxflrxf.exe 87 PID 1336 wrote to memory of 4648 1336 fxflrxf.exe 87 PID 1336 wrote to memory of 4648 1336 fxflrxf.exe 87 PID 4648 wrote to memory of 4956 4648 5bbttt.exe 88 PID 4648 wrote to memory of 4956 4648 5bbttt.exe 88 PID 4648 wrote to memory of 4956 4648 5bbttt.exe 88 PID 4956 wrote to memory of 5060 4956 pjddd.exe 89 PID 4956 wrote to memory of 5060 4956 pjddd.exe 89 PID 4956 wrote to memory of 5060 4956 pjddd.exe 89 PID 5060 wrote to memory of 644 5060 9jvpj.exe 90 PID 5060 wrote to memory of 644 5060 9jvpj.exe 90 PID 5060 wrote to memory of 644 5060 9jvpj.exe 90 PID 644 wrote to memory of 1020 644 lxxxrrl.exe 91 PID 644 wrote to memory of 1020 644 lxxxrrl.exe 91 PID 644 wrote to memory of 1020 644 lxxxrrl.exe 91 PID 1020 wrote to memory of 3464 1020 xrlllxx.exe 92 PID 1020 wrote to memory of 3464 1020 xrlllxx.exe 92 PID 1020 wrote to memory of 3464 1020 xrlllxx.exe 92 PID 3464 wrote to memory of 1424 3464 3hhhbb.exe 93 PID 3464 wrote to memory of 1424 3464 3hhhbb.exe 93 PID 3464 wrote to memory of 1424 3464 3hhhbb.exe 93 PID 1424 wrote to memory of 4988 1424 djppj.exe 94 PID 1424 wrote to memory of 4988 1424 djppj.exe 94 PID 1424 wrote to memory of 4988 1424 djppj.exe 94 PID 4988 wrote to memory of 1148 4988 xrrrllf.exe 95 PID 4988 wrote to memory of 1148 4988 xrrrllf.exe 95 PID 4988 wrote to memory of 1148 4988 xrrrllf.exe 95 PID 1148 wrote to memory of 2780 1148 dpvpd.exe 96 PID 1148 wrote to memory of 2780 1148 dpvpd.exe 96 PID 1148 wrote to memory of 2780 1148 dpvpd.exe 96 PID 2780 wrote to memory of 3916 2780 jvjdd.exe 97 PID 2780 wrote to memory of 3916 2780 jvjdd.exe 97 PID 2780 wrote to memory of 3916 2780 jvjdd.exe 97 PID 3916 wrote to memory of 4852 3916 ffffllx.exe 98 PID 3916 wrote to memory of 4852 3916 ffffllx.exe 98 PID 3916 wrote to memory of 4852 3916 ffffllx.exe 98 PID 4852 wrote to memory of 2296 4852 vvvpp.exe 100 PID 4852 wrote to memory of 2296 4852 vvvpp.exe 100 PID 4852 wrote to memory of 2296 4852 vvvpp.exe 100 PID 2296 wrote to memory of 3780 2296 rrlffxx.exe 102 PID 2296 wrote to memory of 3780 2296 rrlffxx.exe 102 PID 2296 wrote to memory of 3780 2296 rrlffxx.exe 102 PID 3780 wrote to memory of 3364 3780 5bhbtb.exe 103 PID 3780 wrote to memory of 3364 3780 5bhbtb.exe 103 PID 3780 wrote to memory of 3364 3780 5bhbtb.exe 103 PID 3364 wrote to memory of 3056 3364 fxrllff.exe 104 PID 3364 wrote to memory of 3056 3364 fxrllff.exe 104 PID 3364 wrote to memory of 3056 3364 fxrllff.exe 104 PID 3056 wrote to memory of 1188 3056 9hnhtt.exe 105 PID 3056 wrote to memory of 1188 3056 9hnhtt.exe 105 PID 3056 wrote to memory of 1188 3056 9hnhtt.exe 105 PID 1188 wrote to memory of 5044 1188 ddppp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\26278839b1ab113ee99b0ebea3b7e110_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\26278839b1ab113ee99b0ebea3b7e110_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\jvvpj.exec:\jvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\xfrrrrx.exec:\xfrrrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\3htbtt.exec:\3htbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\fxflrxf.exec:\fxflrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\5bbttt.exec:\5bbttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\pjddd.exec:\pjddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\9jvpj.exec:\9jvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\xrlllxx.exec:\xrlllxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\3hhhbb.exec:\3hhhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\djppj.exec:\djppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\xrrrllf.exec:\xrrrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\dpvpd.exec:\dpvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\jvjdd.exec:\jvjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ffffllx.exec:\ffffllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\vvvpp.exec:\vvvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\rrlffxx.exec:\rrlffxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\5bhbtb.exec:\5bhbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\fxrllff.exec:\fxrllff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\9hnhtt.exec:\9hnhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\ddppp.exec:\ddppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\lxxrrrx.exec:\lxxrrrx.exe23⤵
- Executes dropped EXE
PID:5044 -
\??\c:\fffxxxr.exec:\fffxxxr.exe24⤵
- Executes dropped EXE
PID:4524 -
\??\c:\bhnbnh.exec:\bhnbnh.exe25⤵
- Executes dropped EXE
PID:1004 -
\??\c:\rfxrllf.exec:\rfxrllf.exe26⤵
- Executes dropped EXE
PID:3796 -
\??\c:\rxfxrrx.exec:\rxfxrrx.exe27⤵
- Executes dropped EXE
PID:3524 -
\??\c:\hnnnhb.exec:\hnnnhb.exe28⤵
- Executes dropped EXE
PID:3888 -
\??\c:\pdvpv.exec:\pdvpv.exe29⤵
- Executes dropped EXE
PID:3420 -
\??\c:\xxxllxl.exec:\xxxllxl.exe30⤵
- Executes dropped EXE
PID:3692 -
\??\c:\thnnhh.exec:\thnnhh.exe31⤵
- Executes dropped EXE
PID:4544 -
\??\c:\1jvpv.exec:\1jvpv.exe32⤵
- Executes dropped EXE
PID:4580 -
\??\c:\ppvpp.exec:\ppvpp.exe33⤵
- Executes dropped EXE
PID:4244 -
\??\c:\xlxxrrr.exec:\xlxxrrr.exe34⤵
- Executes dropped EXE
PID:528 -
\??\c:\5nthnt.exec:\5nthnt.exe35⤵
- Executes dropped EXE
PID:4672 -
\??\c:\3vpdv.exec:\3vpdv.exe36⤵
- Executes dropped EXE
PID:4332 -
\??\c:\flrxlrx.exec:\flrxlrx.exe37⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hbbnhh.exec:\hbbnhh.exe38⤵PID:5024
-
\??\c:\dpvjj.exec:\dpvjj.exe39⤵
- Executes dropped EXE
PID:372 -
\??\c:\xflxlfl.exec:\xflxlfl.exe40⤵
- Executes dropped EXE
PID:3980 -
\??\c:\nthbnn.exec:\nthbnn.exe41⤵
- Executes dropped EXE
PID:3600 -
\??\c:\1djvd.exec:\1djvd.exe42⤵
- Executes dropped EXE
PID:4324 -
\??\c:\dpppj.exec:\dpppj.exe43⤵
- Executes dropped EXE
PID:1404 -
\??\c:\llfrfxl.exec:\llfrfxl.exe44⤵
- Executes dropped EXE
PID:4748 -
\??\c:\bhhnht.exec:\bhhnht.exe45⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bhnhtn.exec:\bhnhtn.exe46⤵
- Executes dropped EXE
PID:3596 -
\??\c:\7vdpj.exec:\7vdpj.exe47⤵
- Executes dropped EXE
PID:3244 -
\??\c:\lllxrfx.exec:\lllxrfx.exe48⤵
- Executes dropped EXE
PID:4760 -
\??\c:\rrxlfxl.exec:\rrxlfxl.exe49⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hbnhbt.exec:\hbnhbt.exe50⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jjpjd.exec:\jjpjd.exe51⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7pjvj.exec:\7pjvj.exe52⤵
- Executes dropped EXE
PID:456 -
\??\c:\9fxlfxr.exec:\9fxlfxr.exe53⤵
- Executes dropped EXE
PID:3560 -
\??\c:\1xxllff.exec:\1xxllff.exe54⤵
- Executes dropped EXE
PID:4572 -
\??\c:\thbthh.exec:\thbthh.exe55⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vjjvp.exec:\vjjvp.exe56⤵
- Executes dropped EXE
PID:3252 -
\??\c:\vddpj.exec:\vddpj.exe57⤵
- Executes dropped EXE
PID:3080 -
\??\c:\lxlxxrf.exec:\lxlxxrf.exe58⤵
- Executes dropped EXE
PID:4200 -
\??\c:\9tbthb.exec:\9tbthb.exe59⤵
- Executes dropped EXE
PID:5040 -
\??\c:\7tnnbt.exec:\7tnnbt.exe60⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5pjdp.exec:\5pjdp.exe61⤵
- Executes dropped EXE
PID:944 -
\??\c:\3dvjd.exec:\3dvjd.exe62⤵
- Executes dropped EXE
PID:5028 -
\??\c:\1ffxxrf.exec:\1ffxxrf.exe63⤵
- Executes dropped EXE
PID:2384 -
\??\c:\3nnhbt.exec:\3nnhbt.exe64⤵
- Executes dropped EXE
PID:4336 -
\??\c:\bnnhhh.exec:\bnnhhh.exe65⤵
- Executes dropped EXE
PID:8 -
\??\c:\jppjv.exec:\jppjv.exe66⤵
- Executes dropped EXE
PID:4012 -
\??\c:\pjjvd.exec:\pjjvd.exe67⤵PID:936
-
\??\c:\fxxrfxl.exec:\fxxrfxl.exe68⤵PID:2768
-
\??\c:\3rfrfxl.exec:\3rfrfxl.exe69⤵PID:3872
-
\??\c:\btntnb.exec:\btntnb.exe70⤵PID:4960
-
\??\c:\vddvj.exec:\vddvj.exe71⤵PID:3552
-
\??\c:\jdvpp.exec:\jdvpp.exe72⤵PID:628
-
\??\c:\xlflfxf.exec:\xlflfxf.exe73⤵PID:3604
-
\??\c:\ntnhhh.exec:\ntnhhh.exe74⤵PID:5092
-
\??\c:\pdjdv.exec:\pdjdv.exe75⤵PID:1744
-
\??\c:\9pdvj.exec:\9pdvj.exe76⤵PID:1872
-
\??\c:\rflfrlf.exec:\rflfrlf.exe77⤵PID:760
-
\??\c:\ttbttn.exec:\ttbttn.exe78⤵PID:4244
-
\??\c:\tbhhbt.exec:\tbhhbt.exe79⤵PID:1000
-
\??\c:\vdjvp.exec:\vdjvp.exe80⤵PID:348
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe81⤵PID:4880
-
\??\c:\flfrlfr.exec:\flfrlfr.exe82⤵PID:4512
-
\??\c:\tbthhn.exec:\tbthhn.exe83⤵PID:2816
-
\??\c:\jvpdj.exec:\jvpdj.exe84⤵PID:1288
-
\??\c:\jpjvj.exec:\jpjvj.exe85⤵PID:4328
-
\??\c:\9rrlfxl.exec:\9rrlfxl.exe86⤵PID:1856
-
\??\c:\xrrllfr.exec:\xrrllfr.exe87⤵PID:4260
-
\??\c:\bhbbhn.exec:\bhbbhn.exe88⤵PID:2656
-
\??\c:\djpjj.exec:\djpjj.exe89⤵PID:4320
-
\??\c:\dpvjj.exec:\dpvjj.exe90⤵PID:4304
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe91⤵PID:4596
-
\??\c:\xlfrlxr.exec:\xlfrlxr.exe92⤵PID:3596
-
\??\c:\nhbthb.exec:\nhbthb.exe93⤵PID:1020
-
\??\c:\jjpdp.exec:\jjpdp.exe94⤵PID:5000
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe95⤵PID:3464
-
\??\c:\9ttnbt.exec:\9ttnbt.exe96⤵PID:4400
-
\??\c:\pjvjv.exec:\pjvjv.exe97⤵PID:4712
-
\??\c:\flfrfrx.exec:\flfrfrx.exe98⤵PID:456
-
\??\c:\rllffrf.exec:\rllffrf.exe99⤵PID:4572
-
\??\c:\bntttn.exec:\bntttn.exe100⤵PID:2976
-
\??\c:\jvvjv.exec:\jvvjv.exe101⤵PID:3252
-
\??\c:\vpvjv.exec:\vpvjv.exe102⤵PID:4504
-
\??\c:\3rfxxrr.exec:\3rfxxrr.exe103⤵PID:4396
-
\??\c:\lrlfxrf.exec:\lrlfxrf.exe104⤵PID:3156
-
\??\c:\hhnnhb.exec:\hhnnhb.exe105⤵PID:3780
-
\??\c:\hbhthh.exec:\hbhthh.exe106⤵PID:3028
-
\??\c:\7vpjp.exec:\7vpjp.exe107⤵PID:1264
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe108⤵PID:5028
-
\??\c:\7lflrlr.exec:\7lflrlr.exe109⤵PID:2384
-
\??\c:\1thbnt.exec:\1thbnt.exe110⤵PID:4548
-
\??\c:\httnbt.exec:\httnbt.exe111⤵PID:1236
-
\??\c:\pdvdv.exec:\pdvdv.exe112⤵PID:4524
-
\??\c:\ddvjv.exec:\ddvjv.exe113⤵PID:2804
-
\??\c:\1xrfrlx.exec:\1xrfrlx.exe114⤵PID:3152
-
\??\c:\frrfxrf.exec:\frrfxrf.exe115⤵PID:3700
-
\??\c:\nbbthb.exec:\nbbthb.exe116⤵PID:1216
-
\??\c:\nbthbt.exec:\nbthbt.exe117⤵PID:1260
-
\??\c:\vpvjv.exec:\vpvjv.exe118⤵PID:5016
-
\??\c:\9dvpv.exec:\9dvpv.exe119⤵PID:2972
-
\??\c:\1rrxlxr.exec:\1rrxlxr.exe120⤵PID:1964
-
\??\c:\bbttbh.exec:\bbttbh.exe121⤵PID:1572
-
\??\c:\dpjdd.exec:\dpjdd.exe122⤵PID:2892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-