Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 22:52
Behavioral task
behavioral1
Sample
2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe
-
Size
122KB
-
MD5
2f1d4728c2b3de6ce52345da42eca630
-
SHA1
02c16126652fa0071038f8bf594d021fb50e13bf
-
SHA256
6b258e4a75493e5c3c68e0ff1102e6a1e627406edc4f2f23f57512ee620746c5
-
SHA512
cb263825bbe01353967d64620324fc164109bfd35fa66d0dec4ae6dc6a66fa5eceeddb82064f72a415d42839d27e77c4526edb3b466840f11359e404a6e28043
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcka62c+8+dRN1Gw:9cm4FmowdHoSZ6lCX9
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1492-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/804-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1296-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3076-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3408-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3864-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/444-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-701-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-728-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-801-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-1049-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-1078-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-1085-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3984 1hhbtt.exe 4092 dvdpv.exe 1060 1jvpj.exe 1960 lflffxl.exe 4200 9nhtnb.exe 1228 vdjjj.exe 4916 dpvpj.exe 3948 fxlrxrx.exe 3448 hnbbtt.exe 2092 jjjdv.exe 2344 rrlfxfr.exe 4072 flllfff.exe 4288 nhnhbt.exe 2928 dvvdd.exe 4580 rlffrxr.exe 5048 xflxrrl.exe 3052 bnhbtt.exe 3424 5dpjp.exe 4612 htnhht.exe 4924 bhbttn.exe 4108 jvdvp.exe 2368 vdpjd.exe 1164 9lfrxrr.exe 804 nbthbb.exe 2880 vpjjj.exe 3832 7vppd.exe 4260 fxrxffl.exe 3536 bbtnbt.exe 3124 nbtnbb.exe 888 jjppv.exe 1844 rlrlrrx.exe 4448 9ntntt.exe 1996 3vvjj.exe 1632 pvdvv.exe 1484 fxlfllr.exe 4200 hbnhhh.exe 860 hbtnhh.exe 4192 pvddv.exe 1604 jjjdd.exe 4416 fxrlxxr.exe 4636 fxfflrl.exe 2224 tnbbhh.exe 5088 nhhbbb.exe 1648 jppjj.exe 2932 vdvpj.exe 4308 3fxfxrl.exe 1296 fflfxxf.exe 1316 nttnhb.exe 1364 7vjvp.exe 1744 dvdvj.exe 4376 xxrrxxl.exe 668 hhnbtb.exe 1704 hbhnhb.exe 436 pjvdv.exe 4136 fflllxx.exe 3856 ffxxflr.exe 2368 nhnbhb.exe 1164 5nhhbb.exe 4820 dvvvv.exe 3076 5xrfxrl.exe 1968 bntntt.exe 3116 bhhtnh.exe 5100 dvvpd.exe 684 xxrlfxr.exe -
resource yara_rule behavioral2/memory/1492-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002350b-3.dat upx behavioral2/files/0x0008000000023511-9.dat upx behavioral2/files/0x0007000000023512-12.dat upx behavioral2/memory/3984-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4092-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023513-20.dat upx behavioral2/memory/1960-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1060-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023514-27.dat upx behavioral2/memory/1960-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023515-35.dat upx behavioral2/memory/4200-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023516-41.dat upx behavioral2/files/0x0007000000023517-45.dat upx behavioral2/memory/3948-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023518-51.dat upx behavioral2/memory/3448-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023519-56.dat upx behavioral2/files/0x000700000002351a-61.dat upx behavioral2/memory/2092-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002351b-67.dat upx behavioral2/memory/4072-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002351c-73.dat upx behavioral2/files/0x000700000002351d-78.dat upx behavioral2/memory/4288-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2928-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002351e-85.dat upx behavioral2/memory/4580-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002351f-91.dat upx behavioral2/memory/5048-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023520-97.dat upx behavioral2/files/0x0007000000023521-102.dat upx behavioral2/memory/3052-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023522-109.dat upx behavioral2/files/0x0007000000023523-114.dat upx behavioral2/memory/4924-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023524-119.dat upx behavioral2/files/0x0007000000023525-124.dat upx behavioral2/memory/4108-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023526-130.dat upx behavioral2/files/0x0007000000023527-135.dat upx behavioral2/memory/804-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023528-143.dat upx behavioral2/memory/804-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2880-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023529-148.dat upx behavioral2/files/0x000700000002352a-153.dat upx behavioral2/memory/4260-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002352b-159.dat upx behavioral2/files/0x000800000002352c-164.dat upx behavioral2/memory/3536-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002350f-170.dat upx behavioral2/memory/3124-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002352e-177.dat upx behavioral2/files/0x000700000002352f-181.dat upx behavioral2/memory/1844-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1996-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1632-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4192-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1604-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4636-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4416-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2224-223-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 3984 1492 2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe 91 PID 1492 wrote to memory of 3984 1492 2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe 91 PID 1492 wrote to memory of 3984 1492 2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe 91 PID 3984 wrote to memory of 4092 3984 1hhbtt.exe 92 PID 3984 wrote to memory of 4092 3984 1hhbtt.exe 92 PID 3984 wrote to memory of 4092 3984 1hhbtt.exe 92 PID 4092 wrote to memory of 1060 4092 dvdpv.exe 93 PID 4092 wrote to memory of 1060 4092 dvdpv.exe 93 PID 4092 wrote to memory of 1060 4092 dvdpv.exe 93 PID 1060 wrote to memory of 1960 1060 1jvpj.exe 94 PID 1060 wrote to memory of 1960 1060 1jvpj.exe 94 PID 1060 wrote to memory of 1960 1060 1jvpj.exe 94 PID 1960 wrote to memory of 4200 1960 lflffxl.exe 95 PID 1960 wrote to memory of 4200 1960 lflffxl.exe 95 PID 1960 wrote to memory of 4200 1960 lflffxl.exe 95 PID 4200 wrote to memory of 1228 4200 9nhtnb.exe 96 PID 4200 wrote to memory of 1228 4200 9nhtnb.exe 96 PID 4200 wrote to memory of 1228 4200 9nhtnb.exe 96 PID 1228 wrote to memory of 4916 1228 vdjjj.exe 98 PID 1228 wrote to memory of 4916 1228 vdjjj.exe 98 PID 1228 wrote to memory of 4916 1228 vdjjj.exe 98 PID 4916 wrote to memory of 3948 4916 dpvpj.exe 99 PID 4916 wrote to memory of 3948 4916 dpvpj.exe 99 PID 4916 wrote to memory of 3948 4916 dpvpj.exe 99 PID 3948 wrote to memory of 3448 3948 fxlrxrx.exe 100 PID 3948 wrote to memory of 3448 3948 fxlrxrx.exe 100 PID 3948 wrote to memory of 3448 3948 fxlrxrx.exe 100 PID 3448 wrote to memory of 2092 3448 hnbbtt.exe 101 PID 3448 wrote to memory of 2092 3448 hnbbtt.exe 101 PID 3448 wrote to memory of 2092 3448 hnbbtt.exe 101 PID 2092 wrote to memory of 2344 2092 jjjdv.exe 102 PID 2092 wrote to memory of 2344 2092 jjjdv.exe 102 PID 2092 wrote to memory of 2344 2092 jjjdv.exe 102 PID 2344 wrote to memory of 4072 2344 rrlfxfr.exe 103 PID 2344 wrote to memory of 4072 2344 rrlfxfr.exe 103 PID 2344 wrote to memory of 4072 2344 rrlfxfr.exe 103 PID 4072 wrote to memory of 4288 4072 flllfff.exe 104 PID 4072 wrote to memory of 4288 4072 flllfff.exe 104 PID 4072 wrote to memory of 4288 4072 flllfff.exe 104 PID 4288 wrote to memory of 2928 4288 nhnhbt.exe 105 PID 4288 wrote to memory of 2928 4288 nhnhbt.exe 105 PID 4288 wrote to memory of 2928 4288 nhnhbt.exe 105 PID 2928 wrote to memory of 4580 2928 dvvdd.exe 106 PID 2928 wrote to memory of 4580 2928 dvvdd.exe 106 PID 2928 wrote to memory of 4580 2928 dvvdd.exe 106 PID 4580 wrote to memory of 5048 4580 rlffrxr.exe 107 PID 4580 wrote to memory of 5048 4580 rlffrxr.exe 107 PID 4580 wrote to memory of 5048 4580 rlffrxr.exe 107 PID 5048 wrote to memory of 3052 5048 xflxrrl.exe 108 PID 5048 wrote to memory of 3052 5048 xflxrrl.exe 108 PID 5048 wrote to memory of 3052 5048 xflxrrl.exe 108 PID 3052 wrote to memory of 3424 3052 bnhbtt.exe 109 PID 3052 wrote to memory of 3424 3052 bnhbtt.exe 109 PID 3052 wrote to memory of 3424 3052 bnhbtt.exe 109 PID 3424 wrote to memory of 4612 3424 5dpjp.exe 110 PID 3424 wrote to memory of 4612 3424 5dpjp.exe 110 PID 3424 wrote to memory of 4612 3424 5dpjp.exe 110 PID 4612 wrote to memory of 4924 4612 htnhht.exe 111 PID 4612 wrote to memory of 4924 4612 htnhht.exe 111 PID 4612 wrote to memory of 4924 4612 htnhht.exe 111 PID 4924 wrote to memory of 4108 4924 bhbttn.exe 112 PID 4924 wrote to memory of 4108 4924 bhbttn.exe 112 PID 4924 wrote to memory of 4108 4924 bhbttn.exe 112 PID 4108 wrote to memory of 2368 4108 jvdvp.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2f1d4728c2b3de6ce52345da42eca630_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\1hhbtt.exec:\1hhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\dvdpv.exec:\dvdpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\1jvpj.exec:\1jvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\lflffxl.exec:\lflffxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\9nhtnb.exec:\9nhtnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\vdjjj.exec:\vdjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\dpvpj.exec:\dpvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\fxlrxrx.exec:\fxlrxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\hnbbtt.exec:\hnbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\jjjdv.exec:\jjjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\rrlfxfr.exec:\rrlfxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\flllfff.exec:\flllfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\nhnhbt.exec:\nhnhbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\dvvdd.exec:\dvvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rlffrxr.exec:\rlffrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\xflxrrl.exec:\xflxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\bnhbtt.exec:\bnhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\5dpjp.exec:\5dpjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\htnhht.exec:\htnhht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\bhbttn.exec:\bhbttn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\jvdvp.exec:\jvdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\vdpjd.exec:\vdpjd.exe23⤵
- Executes dropped EXE
PID:2368 -
\??\c:\9lfrxrr.exec:\9lfrxrr.exe24⤵
- Executes dropped EXE
PID:1164 -
\??\c:\nbthbb.exec:\nbthbb.exe25⤵
- Executes dropped EXE
PID:804 -
\??\c:\vpjjj.exec:\vpjjj.exe26⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7vppd.exec:\7vppd.exe27⤵
- Executes dropped EXE
PID:3832 -
\??\c:\fxrxffl.exec:\fxrxffl.exe28⤵
- Executes dropped EXE
PID:4260 -
\??\c:\bbtnbt.exec:\bbtnbt.exe29⤵
- Executes dropped EXE
PID:3536 -
\??\c:\nbtnbb.exec:\nbtnbb.exe30⤵
- Executes dropped EXE
PID:3124 -
\??\c:\jjppv.exec:\jjppv.exe31⤵
- Executes dropped EXE
PID:888 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe32⤵
- Executes dropped EXE
PID:1844 -
\??\c:\9ntntt.exec:\9ntntt.exe33⤵
- Executes dropped EXE
PID:4448 -
\??\c:\3vvjj.exec:\3vvjj.exe34⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pvdvv.exec:\pvdvv.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\fxlfllr.exec:\fxlfllr.exe36⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hbnhhh.exec:\hbnhhh.exe37⤵
- Executes dropped EXE
PID:4200 -
\??\c:\hbtnhh.exec:\hbtnhh.exe38⤵
- Executes dropped EXE
PID:860 -
\??\c:\pvddv.exec:\pvddv.exe39⤵
- Executes dropped EXE
PID:4192 -
\??\c:\jjjdd.exec:\jjjdd.exe40⤵
- Executes dropped EXE
PID:1604 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe41⤵
- Executes dropped EXE
PID:4416 -
\??\c:\fxfflrl.exec:\fxfflrl.exe42⤵
- Executes dropped EXE
PID:4636 -
\??\c:\tnbbhh.exec:\tnbbhh.exe43⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nhhbbb.exec:\nhhbbb.exe44⤵
- Executes dropped EXE
PID:5088 -
\??\c:\jppjj.exec:\jppjj.exe45⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vdvpj.exec:\vdvpj.exe46⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3fxfxrl.exec:\3fxfxrl.exe47⤵
- Executes dropped EXE
PID:4308 -
\??\c:\fflfxxf.exec:\fflfxxf.exe48⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nttnhb.exec:\nttnhb.exe49⤵
- Executes dropped EXE
PID:1316 -
\??\c:\7vjvp.exec:\7vjvp.exe50⤵
- Executes dropped EXE
PID:1364 -
\??\c:\dvdvj.exec:\dvdvj.exe51⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe52⤵
- Executes dropped EXE
PID:4376 -
\??\c:\hhnbtb.exec:\hhnbtb.exe53⤵
- Executes dropped EXE
PID:668 -
\??\c:\hbhnhb.exec:\hbhnhb.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pjvdv.exec:\pjvdv.exe55⤵
- Executes dropped EXE
PID:436 -
\??\c:\fflllxx.exec:\fflllxx.exe56⤵
- Executes dropped EXE
PID:4136 -
\??\c:\ffxxflr.exec:\ffxxflr.exe57⤵
- Executes dropped EXE
PID:3856 -
\??\c:\nhnbhb.exec:\nhnbhb.exe58⤵
- Executes dropped EXE
PID:2368 -
\??\c:\5nhhbb.exec:\5nhhbb.exe59⤵
- Executes dropped EXE
PID:1164 -
\??\c:\dvvvv.exec:\dvvvv.exe60⤵
- Executes dropped EXE
PID:4820 -
\??\c:\5xrfxrl.exec:\5xrfxrl.exe61⤵
- Executes dropped EXE
PID:3076 -
\??\c:\bntntt.exec:\bntntt.exe62⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bhhtnh.exec:\bhhtnh.exe63⤵
- Executes dropped EXE
PID:3116 -
\??\c:\dvvpd.exec:\dvvpd.exe64⤵
- Executes dropped EXE
PID:5100 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe65⤵
- Executes dropped EXE
PID:684 -
\??\c:\vddvj.exec:\vddvj.exe66⤵PID:4884
-
\??\c:\jvdvp.exec:\jvdvp.exe67⤵PID:4476
-
\??\c:\rlfrlff.exec:\rlfrlff.exe68⤵PID:3408
-
\??\c:\btbttt.exec:\btbttt.exe69⤵PID:4460
-
\??\c:\ddpdj.exec:\ddpdj.exe70⤵PID:4644
-
\??\c:\xrlffff.exec:\xrlffff.exe71⤵PID:2212
-
\??\c:\ttnhbh.exec:\ttnhbh.exe72⤵PID:3388
-
\??\c:\pdvdv.exec:\pdvdv.exe73⤵PID:2876
-
\??\c:\9jpdp.exec:\9jpdp.exe74⤵PID:3864
-
\??\c:\rrxlxrl.exec:\rrxlxrl.exe75⤵PID:1216
-
\??\c:\bbbnth.exec:\bbbnth.exe76⤵PID:3628
-
\??\c:\vjjjd.exec:\vjjjd.exe77⤵PID:4736
-
\??\c:\fffxrrl.exec:\fffxrrl.exe78⤵PID:2292
-
\??\c:\9hhtnh.exec:\9hhtnh.exe79⤵PID:4764
-
\??\c:\ddjvp.exec:\ddjvp.exe80⤵PID:1816
-
\??\c:\nhtnnh.exec:\nhtnnh.exe81⤵PID:2180
-
\??\c:\hbhbtt.exec:\hbhbtt.exe82⤵PID:3664
-
\??\c:\jjjjd.exec:\jjjjd.exe83⤵PID:5060
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe84⤵PID:2396
-
\??\c:\ntbtnh.exec:\ntbtnh.exe85⤵PID:1684
-
\??\c:\9xrlfff.exec:\9xrlfff.exe86⤵PID:4580
-
\??\c:\9rrlxfx.exec:\9rrlxfx.exe87⤵PID:1316
-
\??\c:\nhnnbt.exec:\nhnnbt.exe88⤵PID:3772
-
\??\c:\dpvpd.exec:\dpvpd.exe89⤵PID:2580
-
\??\c:\xfxfrff.exec:\xfxfrff.exe90⤵PID:1200
-
\??\c:\lfxlrfr.exec:\lfxlrfr.exe91⤵PID:3392
-
\??\c:\tbhbtn.exec:\tbhbtn.exe92⤵PID:1780
-
\??\c:\tntnnn.exec:\tntnnn.exe93⤵PID:980
-
\??\c:\dvdvp.exec:\dvdvp.exe94⤵PID:3416
-
\??\c:\vpddv.exec:\vpddv.exe95⤵PID:3812
-
\??\c:\lllfxxf.exec:\lllfxxf.exe96⤵PID:2160
-
\??\c:\bbhnhh.exec:\bbhnhh.exe97⤵PID:2916
-
\??\c:\htttnh.exec:\htttnh.exe98⤵PID:832
-
\??\c:\dpjdv.exec:\dpjdv.exe99⤵PID:864
-
\??\c:\djpjv.exec:\djpjv.exe100⤵PID:1420
-
\??\c:\lllfrxr.exec:\lllfrxr.exe101⤵PID:1760
-
\??\c:\1fffxxx.exec:\1fffxxx.exe102⤵PID:1360
-
\??\c:\3rxrllx.exec:\3rxrllx.exe103⤵PID:4752
-
\??\c:\3httbt.exec:\3httbt.exe104⤵PID:444
-
\??\c:\7tnhtb.exec:\7tnhtb.exe105⤵PID:2680
-
\??\c:\dvdvj.exec:\dvdvj.exe106⤵PID:460
-
\??\c:\1jdvp.exec:\1jdvp.exe107⤵PID:760
-
\??\c:\lfrrxfx.exec:\lfrrxfx.exe108⤵PID:3528
-
\??\c:\rfrlfff.exec:\rfrlfff.exe109⤵PID:1228
-
\??\c:\5ntnnn.exec:\5ntnnn.exe110⤵PID:428
-
\??\c:\5tnhbb.exec:\5tnhbb.exe111⤵PID:3612
-
\??\c:\vpvjv.exec:\vpvjv.exe112⤵PID:4916
-
\??\c:\jdvpd.exec:\jdvpd.exe113⤵PID:4832
-
\??\c:\xfxlffx.exec:\xfxlffx.exe114⤵PID:4944
-
\??\c:\rfxxrlf.exec:\rfxxrlf.exe115⤵PID:528
-
\??\c:\hnbthh.exec:\hnbthh.exe116⤵PID:3676
-
\??\c:\nhbbtn.exec:\nhbbtn.exe117⤵PID:5088
-
\??\c:\7djdj.exec:\7djdj.exe118⤵PID:2364
-
\??\c:\ddvvv.exec:\ddvvv.exe119⤵PID:4876
-
\??\c:\pjddv.exec:\pjddv.exe120⤵PID:2608
-
\??\c:\9rlxrfr.exec:\9rlxrfr.exe121⤵PID:2832
-
\??\c:\ffxxffx.exec:\ffxxffx.exe122⤵PID:4628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-