Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 04:17
Behavioral task
behavioral1
Sample
7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe
-
Size
103KB
-
MD5
7a7f48809ec52685607d441572d7d3a0
-
SHA1
1d459fe86d385434bbe27080c088b9cc889c77b5
-
SHA256
c2a5cbf5883f5c22238d23ed0c6ce02f208cf996247df042a4a67601f1b02523
-
SHA512
eb2628ab15114c0c5c6077c915ac7dc7d463243ade3e74845b77104870e29ab3c4884ce8f3fd3fef1409b3087ff07b8432779848a7e59303bc9b10483d64dc48
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFbUZJjw5Ivov1d3ZdpQm6hx:9hOmTsF93UYfwC6GIoutz5yLpRDN6hx
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4552-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1096-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/988-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1700-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2564-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1268-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3356-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-724-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-734-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-744-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-837-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-1010-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4372 1vdvv.exe 4444 frrlfxx.exe 4136 rlfxxxx.exe 2448 ttttnt.exe 4040 pdjdv.exe 4744 rrxrxxf.exe 588 9frrllf.exe 4540 tbnnhh.exe 3628 ttnnnn.exe 4596 vdvpj.exe 448 ddjdv.exe 1328 fxxrrxr.exe 4788 xrxxrfx.exe 2568 bttttt.exe 1164 ddvpj.exe 1356 rrffllr.exe 388 llxrrrr.exe 2264 bbnntb.exe 1096 nhhbtt.exe 4500 vpjdj.exe 4460 vpppj.exe 3272 9ttttt.exe 764 nhttnh.exe 424 jdvjj.exe 988 xlllxxr.exe 2400 bhttnn.exe 4952 dpddp.exe 4300 jjjjd.exe 4016 fxxrlll.exe 4504 hbttbt.exe 528 xlrrlll.exe 3336 lfllflf.exe 4144 hnbbbb.exe 5112 1vvjj.exe 4980 ffffrff.exe 4764 bhtttn.exe 3368 ttbhbh.exe 1416 jdppp.exe 2844 vdjdv.exe 4336 3rlfxrr.exe 1340 lxrllll.exe 4556 htttnn.exe 1672 hnhtnn.exe 3848 vjvpj.exe 4136 pjjjd.exe 1700 rllfxll.exe 452 lffxffl.exe 3556 nbnnnn.exe 3916 jjpjj.exe 4744 jpvpv.exe 1284 fflxxxf.exe 1480 rfrllrr.exe 2312 thnhhh.exe 3312 nhthhh.exe 4780 5vjdd.exe 5008 vjvvp.exe 4120 flrlffx.exe 1460 flllffx.exe 3020 ttbbtt.exe 1640 hhbhtt.exe 368 pddvp.exe 2124 pjpvp.exe 1036 lllflrx.exe 1028 7xxxrrr.exe -
resource yara_rule behavioral2/memory/4552-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002328e-3.dat upx behavioral2/memory/4372-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233f0-10.dat upx behavioral2/memory/4372-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4444-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f1-16.dat upx behavioral2/memory/4136-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2448-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f3-29.dat upx behavioral2/files/0x00070000000233f2-23.dat upx behavioral2/files/0x00070000000233f5-40.dat upx behavioral2/memory/4540-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f6-47.dat upx behavioral2/files/0x00070000000233f7-53.dat upx behavioral2/memory/3628-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f8-59.dat upx behavioral2/memory/448-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4596-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fa-70.dat upx behavioral2/memory/448-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fb-77.dat upx behavioral2/memory/4788-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-84.dat upx behavioral2/files/0x00070000000233fd-89.dat upx behavioral2/memory/2568-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1328-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f9-64.dat upx behavioral2/memory/4744-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4744-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4040-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f4-34.dat upx behavioral2/files/0x00070000000233fe-94.dat upx behavioral2/memory/1164-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1356-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ff-101.dat upx behavioral2/files/0x0007000000023400-106.dat upx behavioral2/files/0x0007000000023401-113.dat upx behavioral2/files/0x0007000000023402-116.dat upx behavioral2/memory/1096-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023403-122.dat upx behavioral2/memory/4500-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4460-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-128.dat upx behavioral2/memory/4460-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023405-134.dat upx behavioral2/memory/764-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-141.dat upx behavioral2/files/0x0007000000023407-145.dat upx behavioral2/memory/988-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/988-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-151.dat upx behavioral2/memory/2400-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023409-158.dat upx behavioral2/files/0x000700000002340a-164.dat upx behavioral2/files/0x000700000002340b-169.dat upx behavioral2/files/0x000700000002340c-173.dat upx behavioral2/memory/4016-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-179.dat upx behavioral2/memory/528-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3336-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-186.dat upx behavioral2/memory/5112-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4764-203-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4552 wrote to memory of 4372 4552 7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe 81 PID 4552 wrote to memory of 4372 4552 7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe 81 PID 4552 wrote to memory of 4372 4552 7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe 81 PID 4372 wrote to memory of 4444 4372 1vdvv.exe 82 PID 4372 wrote to memory of 4444 4372 1vdvv.exe 82 PID 4372 wrote to memory of 4444 4372 1vdvv.exe 82 PID 4444 wrote to memory of 4136 4444 frrlfxx.exe 83 PID 4444 wrote to memory of 4136 4444 frrlfxx.exe 83 PID 4444 wrote to memory of 4136 4444 frrlfxx.exe 83 PID 4136 wrote to memory of 2448 4136 rlfxxxx.exe 84 PID 4136 wrote to memory of 2448 4136 rlfxxxx.exe 84 PID 4136 wrote to memory of 2448 4136 rlfxxxx.exe 84 PID 2448 wrote to memory of 4040 2448 ttttnt.exe 85 PID 2448 wrote to memory of 4040 2448 ttttnt.exe 85 PID 2448 wrote to memory of 4040 2448 ttttnt.exe 85 PID 4040 wrote to memory of 4744 4040 pdjdv.exe 86 PID 4040 wrote to memory of 4744 4040 pdjdv.exe 86 PID 4040 wrote to memory of 4744 4040 pdjdv.exe 86 PID 4744 wrote to memory of 588 4744 rrxrxxf.exe 87 PID 4744 wrote to memory of 588 4744 rrxrxxf.exe 87 PID 4744 wrote to memory of 588 4744 rrxrxxf.exe 87 PID 588 wrote to memory of 4540 588 9frrllf.exe 88 PID 588 wrote to memory of 4540 588 9frrllf.exe 88 PID 588 wrote to memory of 4540 588 9frrllf.exe 88 PID 4540 wrote to memory of 3628 4540 tbnnhh.exe 89 PID 4540 wrote to memory of 3628 4540 tbnnhh.exe 89 PID 4540 wrote to memory of 3628 4540 tbnnhh.exe 89 PID 3628 wrote to memory of 4596 3628 ttnnnn.exe 90 PID 3628 wrote to memory of 4596 3628 ttnnnn.exe 90 PID 3628 wrote to memory of 4596 3628 ttnnnn.exe 90 PID 4596 wrote to memory of 448 4596 vdvpj.exe 91 PID 4596 wrote to memory of 448 4596 vdvpj.exe 91 PID 4596 wrote to memory of 448 4596 vdvpj.exe 91 PID 448 wrote to memory of 1328 448 ddjdv.exe 92 PID 448 wrote to memory of 1328 448 ddjdv.exe 92 PID 448 wrote to memory of 1328 448 ddjdv.exe 92 PID 1328 wrote to memory of 4788 1328 fxxrrxr.exe 93 PID 1328 wrote to memory of 4788 1328 fxxrrxr.exe 93 PID 1328 wrote to memory of 4788 1328 fxxrrxr.exe 93 PID 4788 wrote to memory of 2568 4788 xrxxrfx.exe 94 PID 4788 wrote to memory of 2568 4788 xrxxrfx.exe 94 PID 4788 wrote to memory of 2568 4788 xrxxrfx.exe 94 PID 2568 wrote to memory of 1164 2568 bttttt.exe 95 PID 2568 wrote to memory of 1164 2568 bttttt.exe 95 PID 2568 wrote to memory of 1164 2568 bttttt.exe 95 PID 1164 wrote to memory of 1356 1164 ddvpj.exe 97 PID 1164 wrote to memory of 1356 1164 ddvpj.exe 97 PID 1164 wrote to memory of 1356 1164 ddvpj.exe 97 PID 1356 wrote to memory of 388 1356 rrffllr.exe 98 PID 1356 wrote to memory of 388 1356 rrffllr.exe 98 PID 1356 wrote to memory of 388 1356 rrffllr.exe 98 PID 388 wrote to memory of 2264 388 llxrrrr.exe 99 PID 388 wrote to memory of 2264 388 llxrrrr.exe 99 PID 388 wrote to memory of 2264 388 llxrrrr.exe 99 PID 2264 wrote to memory of 1096 2264 bbnntb.exe 100 PID 2264 wrote to memory of 1096 2264 bbnntb.exe 100 PID 2264 wrote to memory of 1096 2264 bbnntb.exe 100 PID 1096 wrote to memory of 4500 1096 nhhbtt.exe 101 PID 1096 wrote to memory of 4500 1096 nhhbtt.exe 101 PID 1096 wrote to memory of 4500 1096 nhhbtt.exe 101 PID 4500 wrote to memory of 4460 4500 vpjdj.exe 102 PID 4500 wrote to memory of 4460 4500 vpjdj.exe 102 PID 4500 wrote to memory of 4460 4500 vpjdj.exe 102 PID 4460 wrote to memory of 3272 4460 vpppj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7a7f48809ec52685607d441572d7d3a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\1vdvv.exec:\1vdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\frrlfxx.exec:\frrlfxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\rlfxxxx.exec:\rlfxxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\ttttnt.exec:\ttttnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\pdjdv.exec:\pdjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\rrxrxxf.exec:\rrxrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\9frrllf.exec:\9frrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\tbnnhh.exec:\tbnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\ttnnnn.exec:\ttnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\vdvpj.exec:\vdvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\ddjdv.exec:\ddjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\fxxrrxr.exec:\fxxrrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\xrxxrfx.exec:\xrxxrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\bttttt.exec:\bttttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\ddvpj.exec:\ddvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\rrffllr.exec:\rrffllr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\llxrrrr.exec:\llxrrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\bbnntb.exec:\bbnntb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\nhhbtt.exec:\nhhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\vpjdj.exec:\vpjdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\vpppj.exec:\vpppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\9ttttt.exec:\9ttttt.exe23⤵
- Executes dropped EXE
PID:3272 -
\??\c:\nhttnh.exec:\nhttnh.exe24⤵
- Executes dropped EXE
PID:764 -
\??\c:\jdvjj.exec:\jdvjj.exe25⤵
- Executes dropped EXE
PID:424 -
\??\c:\xlllxxr.exec:\xlllxxr.exe26⤵
- Executes dropped EXE
PID:988 -
\??\c:\bhttnn.exec:\bhttnn.exe27⤵
- Executes dropped EXE
PID:2400 -
\??\c:\dpddp.exec:\dpddp.exe28⤵
- Executes dropped EXE
PID:4952 -
\??\c:\jjjjd.exec:\jjjjd.exe29⤵
- Executes dropped EXE
PID:4300 -
\??\c:\fxxrlll.exec:\fxxrlll.exe30⤵
- Executes dropped EXE
PID:4016 -
\??\c:\hbttbt.exec:\hbttbt.exe31⤵
- Executes dropped EXE
PID:4504 -
\??\c:\xlrrlll.exec:\xlrrlll.exe32⤵
- Executes dropped EXE
PID:528 -
\??\c:\lfllflf.exec:\lfllflf.exe33⤵
- Executes dropped EXE
PID:3336 -
\??\c:\hnbbbb.exec:\hnbbbb.exe34⤵
- Executes dropped EXE
PID:4144 -
\??\c:\1vvjj.exec:\1vvjj.exe35⤵
- Executes dropped EXE
PID:5112 -
\??\c:\ffffrff.exec:\ffffrff.exe36⤵
- Executes dropped EXE
PID:4980 -
\??\c:\bhtttn.exec:\bhtttn.exe37⤵
- Executes dropped EXE
PID:4764 -
\??\c:\ttbhbh.exec:\ttbhbh.exe38⤵
- Executes dropped EXE
PID:3368 -
\??\c:\jdppp.exec:\jdppp.exe39⤵
- Executes dropped EXE
PID:1416 -
\??\c:\vdjdv.exec:\vdjdv.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3rlfxrr.exec:\3rlfxrr.exe41⤵
- Executes dropped EXE
PID:4336 -
\??\c:\lxrllll.exec:\lxrllll.exe42⤵
- Executes dropped EXE
PID:1340 -
\??\c:\htttnn.exec:\htttnn.exe43⤵
- Executes dropped EXE
PID:4556 -
\??\c:\hnhtnn.exec:\hnhtnn.exe44⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vjvpj.exec:\vjvpj.exe45⤵
- Executes dropped EXE
PID:3848 -
\??\c:\pjjjd.exec:\pjjjd.exe46⤵
- Executes dropped EXE
PID:4136 -
\??\c:\rllfxll.exec:\rllfxll.exe47⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lffxffl.exec:\lffxffl.exe48⤵
- Executes dropped EXE
PID:452 -
\??\c:\nbnnnn.exec:\nbnnnn.exe49⤵
- Executes dropped EXE
PID:3556 -
\??\c:\jjpjj.exec:\jjpjj.exe50⤵
- Executes dropped EXE
PID:3916 -
\??\c:\jpvpv.exec:\jpvpv.exe51⤵
- Executes dropped EXE
PID:4744 -
\??\c:\fflxxxf.exec:\fflxxxf.exe52⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rfrllrr.exec:\rfrllrr.exe53⤵
- Executes dropped EXE
PID:1480 -
\??\c:\thnhhh.exec:\thnhhh.exe54⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nhthhh.exec:\nhthhh.exe55⤵
- Executes dropped EXE
PID:3312 -
\??\c:\5vjdd.exec:\5vjdd.exe56⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vjvvp.exec:\vjvvp.exe57⤵
- Executes dropped EXE
PID:5008 -
\??\c:\flrlffx.exec:\flrlffx.exe58⤵
- Executes dropped EXE
PID:4120 -
\??\c:\flllffx.exec:\flllffx.exe59⤵
- Executes dropped EXE
PID:1460 -
\??\c:\ttbbtt.exec:\ttbbtt.exe60⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hhbhtt.exec:\hhbhtt.exe61⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pddvp.exec:\pddvp.exe62⤵
- Executes dropped EXE
PID:368 -
\??\c:\pjpvp.exec:\pjpvp.exe63⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lllflrx.exec:\lllflrx.exe64⤵
- Executes dropped EXE
PID:1036 -
\??\c:\7xxxrrr.exec:\7xxxrrr.exe65⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hnnnhb.exec:\hnnnhb.exe66⤵PID:2916
-
\??\c:\tttbnt.exec:\tttbnt.exe67⤵PID:2432
-
\??\c:\5jddp.exec:\5jddp.exe68⤵PID:1856
-
\??\c:\ddjdv.exec:\ddjdv.exe69⤵PID:4440
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe70⤵PID:4500
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe71⤵PID:5036
-
\??\c:\nbhhbb.exec:\nbhhbb.exe72⤵PID:752
-
\??\c:\thbbtt.exec:\thbbtt.exe73⤵PID:1232
-
\??\c:\3pdvj.exec:\3pdvj.exe74⤵PID:3496
-
\??\c:\ppvvj.exec:\ppvvj.exe75⤵PID:1884
-
\??\c:\flrllrx.exec:\flrllrx.exe76⤵PID:1464
-
\??\c:\5ttnhb.exec:\5ttnhb.exe77⤵PID:2440
-
\??\c:\hhbhtn.exec:\hhbhtn.exe78⤵PID:4448
-
\??\c:\dpvpj.exec:\dpvpj.exe79⤵PID:3612
-
\??\c:\pddvj.exec:\pddvj.exe80⤵PID:4548
-
\??\c:\rfxrlxr.exec:\rfxrlxr.exe81⤵PID:2884
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe82⤵PID:2428
-
\??\c:\bbtttn.exec:\bbtttn.exe83⤵PID:2644
-
\??\c:\nbbtnn.exec:\nbbtnn.exe84⤵PID:4504
-
\??\c:\jdvpj.exec:\jdvpj.exe85⤵PID:4856
-
\??\c:\jdvpd.exec:\jdvpd.exe86⤵PID:3912
-
\??\c:\rlrrllf.exec:\rlrrllf.exe87⤵PID:3676
-
\??\c:\fllrrrr.exec:\fllrrrr.exe88⤵PID:3772
-
\??\c:\btbtnn.exec:\btbtnn.exe89⤵PID:232
-
\??\c:\nnnnnn.exec:\nnnnnn.exe90⤵PID:224
-
\??\c:\vddvd.exec:\vddvd.exe91⤵PID:1504
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe92⤵PID:216
-
\??\c:\nnnnnn.exec:\nnnnnn.exe93⤵PID:2936
-
\??\c:\thnttn.exec:\thnttn.exe94⤵PID:1948
-
\??\c:\ddvvv.exec:\ddvvv.exe95⤵PID:3472
-
\??\c:\ffflxxr.exec:\ffflxxr.exe96⤵PID:3376
-
\??\c:\fxffllf.exec:\fxffllf.exe97⤵PID:4844
-
\??\c:\tbhhbb.exec:\tbhhbb.exe98⤵PID:1776
-
\??\c:\3nbbnt.exec:\3nbbnt.exe99⤵PID:2564
-
\??\c:\vvvvj.exec:\vvvvj.exe100⤵PID:4972
-
\??\c:\vddpj.exec:\vddpj.exe101⤵PID:4184
-
\??\c:\flxxrxr.exec:\flxxrxr.exe102⤵PID:2140
-
\??\c:\btbtnn.exec:\btbtnn.exe103⤵PID:684
-
\??\c:\ttbthh.exec:\ttbthh.exe104⤵PID:4712
-
\??\c:\9vvvj.exec:\9vvvj.exe105⤵PID:3220
-
\??\c:\frxrllf.exec:\frxrllf.exe106⤵PID:2172
-
\??\c:\ffllfxl.exec:\ffllfxl.exe107⤵PID:3628
-
\??\c:\5nnbtt.exec:\5nnbtt.exe108⤵PID:3688
-
\??\c:\jppvp.exec:\jppvp.exe109⤵PID:4592
-
\??\c:\1rfxrxr.exec:\1rfxrxr.exe110⤵PID:4688
-
\??\c:\rflfxxr.exec:\rflfxxr.exe111⤵PID:3940
-
\??\c:\tnnnhh.exec:\tnnnhh.exe112⤵PID:4788
-
\??\c:\hntbnn.exec:\hntbnn.exe113⤵PID:2716
-
\??\c:\jddvd.exec:\jddvd.exe114⤵PID:4512
-
\??\c:\fxlxlxx.exec:\fxlxlxx.exe115⤵PID:1164
-
\??\c:\tttntt.exec:\tttntt.exe116⤵PID:3748
-
\??\c:\9hnhbb.exec:\9hnhbb.exe117⤵PID:552
-
\??\c:\vpppj.exec:\vpppj.exe118⤵PID:2916
-
\??\c:\jdpjj.exec:\jdpjj.exe119⤵PID:2432
-
\??\c:\xlfffff.exec:\xlfffff.exe120⤵PID:3480
-
\??\c:\rlffffx.exec:\rlffffx.exe121⤵PID:4440
-
\??\c:\hthhhn.exec:\hthhhn.exe122⤵PID:4500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-