Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 18:54
Behavioral task
behavioral1
Sample
17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe
-
Size
453KB
-
MD5
17e05df9d9ee584cfea2c3cfdef02020
-
SHA1
3a966810076f4d28a0f79bda51672545cb755633
-
SHA256
bc483cb6e41a05ad89bcdd351126161cb4ae8822544e2bddcb04fe2344c5423b
-
SHA512
f9bafcdf900389260dcb87dad7ace8cd2c174f8d988ce87dcb9b42bdd9e1456a35a77f0619d50d66542a8abdacfc1356c0fba08d073e12df8bd142dbbd7af859
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNm8:x4wFHoS3eFaKHpv/VycgE81lgx
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4520-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2128-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3248-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/936-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1396-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2528-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3788-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-553-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-576-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-616-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-689-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-735-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4792 vppdd.exe 60 fxfxrrl.exe 4784 bntbbb.exe 3880 jvjdp.exe 1188 tbttnn.exe 1528 jjpjj.exe 2796 vvppd.exe 4828 3xllfff.exe 1220 9hhbth.exe 3716 9tnnnn.exe 2704 frlfxxf.exe 1648 xrxlfxr.exe 3972 dddpp.exe 5028 htnnth.exe 412 thbbhb.exe 2656 3pppp.exe 2232 jpjjp.exe 2128 fxllrrr.exe 888 xrlrfxl.exe 4912 vdvvp.exe 976 tnnnnn.exe 3248 llxxffl.exe 1008 vpppp.exe 3836 rflllrx.exe 1536 jpvpd.exe 4404 fxrlfxx.exe 4056 fxrrfxr.exe 4408 nntnnn.exe 4184 1vjjj.exe 1544 jvvvp.exe 1660 3djdv.exe 2284 dvvpd.exe 2092 tnttnn.exe 2124 dpjdd.exe 2116 ppjdv.exe 1572 9bthbt.exe 4608 7jddv.exe 4112 ffxrlfx.exe 5116 vvpvv.exe 4816 nthhnn.exe 936 jjdvv.exe 860 lrrlfxr.exe 4748 nhhbbb.exe 1396 pdpjd.exe 3844 dddvv.exe 2256 xxxrrrr.exe 1652 pppjj.exe 3976 fxllffl.exe 4168 hhhbtt.exe 2904 jdvpj.exe 2796 rlrxxrr.exe 2772 fxxxxfl.exe 3160 7bhhbb.exe 2324 vvvpd.exe 784 nntnbb.exe 2704 pppjj.exe 2528 pppjj.exe 3380 jpddd.exe 3012 nhtttb.exe 4976 9pdvv.exe 2692 5fxlxxl.exe 2312 1hnnnt.exe 2656 vpjjd.exe 2400 rxrrrxf.exe -
resource yara_rule behavioral2/memory/4520-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4520-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4792-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-6.dat upx behavioral2/files/0x0008000000023412-11.dat upx behavioral2/memory/60-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4792-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-15.dat upx behavioral2/memory/60-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4784-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-26.dat upx behavioral2/files/0x0007000000023415-30.dat upx behavioral2/memory/3880-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1188-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-36.dat upx behavioral2/files/0x0007000000023417-41.dat upx behavioral2/memory/2796-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1528-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4828-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-49.dat upx behavioral2/memory/1220-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-56.dat upx behavioral2/files/0x000700000002341a-60.dat upx behavioral2/memory/3716-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-68.dat upx behavioral2/memory/3716-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023410-72.dat upx behavioral2/memory/1648-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-80.dat upx behavioral2/files/0x000700000002341d-83.dat upx behavioral2/files/0x000700000002341e-88.dat upx behavioral2/files/0x0007000000023421-94.dat upx behavioral2/memory/412-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-100.dat upx behavioral2/memory/2232-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5028-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-105.dat upx behavioral2/files/0x0004000000022ac4-110.dat upx behavioral2/memory/888-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2128-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002341f-118.dat upx behavioral2/files/0x0008000000023424-125.dat upx behavioral2/memory/4912-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-128.dat upx behavioral2/memory/976-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-134.dat upx behavioral2/memory/3248-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-141.dat upx behavioral2/memory/1008-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-147.dat upx behavioral2/files/0x0007000000023429-151.dat upx behavioral2/memory/4404-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-158.dat upx behavioral2/files/0x000700000002342b-163.dat upx behavioral2/memory/4408-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4056-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-169.dat upx behavioral2/memory/4184-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-175.dat upx behavioral2/files/0x000700000002342e-180.dat upx behavioral2/memory/1660-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-187.dat upx behavioral2/memory/2284-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2116-199-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4520 wrote to memory of 4792 4520 17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe 82 PID 4520 wrote to memory of 4792 4520 17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe 82 PID 4520 wrote to memory of 4792 4520 17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe 82 PID 4792 wrote to memory of 60 4792 vppdd.exe 83 PID 4792 wrote to memory of 60 4792 vppdd.exe 83 PID 4792 wrote to memory of 60 4792 vppdd.exe 83 PID 60 wrote to memory of 4784 60 fxfxrrl.exe 84 PID 60 wrote to memory of 4784 60 fxfxrrl.exe 84 PID 60 wrote to memory of 4784 60 fxfxrrl.exe 84 PID 4784 wrote to memory of 3880 4784 bntbbb.exe 85 PID 4784 wrote to memory of 3880 4784 bntbbb.exe 85 PID 4784 wrote to memory of 3880 4784 bntbbb.exe 85 PID 3880 wrote to memory of 1188 3880 jvjdp.exe 87 PID 3880 wrote to memory of 1188 3880 jvjdp.exe 87 PID 3880 wrote to memory of 1188 3880 jvjdp.exe 87 PID 1188 wrote to memory of 1528 1188 tbttnn.exe 88 PID 1188 wrote to memory of 1528 1188 tbttnn.exe 88 PID 1188 wrote to memory of 1528 1188 tbttnn.exe 88 PID 1528 wrote to memory of 2796 1528 jjpjj.exe 90 PID 1528 wrote to memory of 2796 1528 jjpjj.exe 90 PID 1528 wrote to memory of 2796 1528 jjpjj.exe 90 PID 2796 wrote to memory of 4828 2796 vvppd.exe 91 PID 2796 wrote to memory of 4828 2796 vvppd.exe 91 PID 2796 wrote to memory of 4828 2796 vvppd.exe 91 PID 4828 wrote to memory of 1220 4828 3xllfff.exe 93 PID 4828 wrote to memory of 1220 4828 3xllfff.exe 93 PID 4828 wrote to memory of 1220 4828 3xllfff.exe 93 PID 1220 wrote to memory of 3716 1220 9hhbth.exe 94 PID 1220 wrote to memory of 3716 1220 9hhbth.exe 94 PID 1220 wrote to memory of 3716 1220 9hhbth.exe 94 PID 3716 wrote to memory of 2704 3716 9tnnnn.exe 95 PID 3716 wrote to memory of 2704 3716 9tnnnn.exe 95 PID 3716 wrote to memory of 2704 3716 9tnnnn.exe 95 PID 2704 wrote to memory of 1648 2704 frlfxxf.exe 96 PID 2704 wrote to memory of 1648 2704 frlfxxf.exe 96 PID 2704 wrote to memory of 1648 2704 frlfxxf.exe 96 PID 1648 wrote to memory of 3972 1648 xrxlfxr.exe 97 PID 1648 wrote to memory of 3972 1648 xrxlfxr.exe 97 PID 1648 wrote to memory of 3972 1648 xrxlfxr.exe 97 PID 3972 wrote to memory of 5028 3972 dddpp.exe 98 PID 3972 wrote to memory of 5028 3972 dddpp.exe 98 PID 3972 wrote to memory of 5028 3972 dddpp.exe 98 PID 5028 wrote to memory of 412 5028 htnnth.exe 99 PID 5028 wrote to memory of 412 5028 htnnth.exe 99 PID 5028 wrote to memory of 412 5028 htnnth.exe 99 PID 412 wrote to memory of 2656 412 thbbhb.exe 100 PID 412 wrote to memory of 2656 412 thbbhb.exe 100 PID 412 wrote to memory of 2656 412 thbbhb.exe 100 PID 2656 wrote to memory of 2232 2656 3pppp.exe 101 PID 2656 wrote to memory of 2232 2656 3pppp.exe 101 PID 2656 wrote to memory of 2232 2656 3pppp.exe 101 PID 2232 wrote to memory of 2128 2232 jpjjp.exe 102 PID 2232 wrote to memory of 2128 2232 jpjjp.exe 102 PID 2232 wrote to memory of 2128 2232 jpjjp.exe 102 PID 2128 wrote to memory of 888 2128 fxllrrr.exe 103 PID 2128 wrote to memory of 888 2128 fxllrrr.exe 103 PID 2128 wrote to memory of 888 2128 fxllrrr.exe 103 PID 888 wrote to memory of 4912 888 xrlrfxl.exe 104 PID 888 wrote to memory of 4912 888 xrlrfxl.exe 104 PID 888 wrote to memory of 4912 888 xrlrfxl.exe 104 PID 4912 wrote to memory of 976 4912 vdvvp.exe 105 PID 4912 wrote to memory of 976 4912 vdvvp.exe 105 PID 4912 wrote to memory of 976 4912 vdvvp.exe 105 PID 976 wrote to memory of 3248 976 tnnnnn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17e05df9d9ee584cfea2c3cfdef02020_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\vppdd.exec:\vppdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\bntbbb.exec:\bntbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\jvjdp.exec:\jvjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\tbttnn.exec:\tbttnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\jjpjj.exec:\jjpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\vvppd.exec:\vvppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\3xllfff.exec:\3xllfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\9hhbth.exec:\9hhbth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\9tnnnn.exec:\9tnnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\frlfxxf.exec:\frlfxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xrxlfxr.exec:\xrxlfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\dddpp.exec:\dddpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\htnnth.exec:\htnnth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\thbbhb.exec:\thbbhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\3pppp.exec:\3pppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\jpjjp.exec:\jpjjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\fxllrrr.exec:\fxllrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\xrlrfxl.exec:\xrlrfxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\vdvvp.exec:\vdvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\tnnnnn.exec:\tnnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\llxxffl.exec:\llxxffl.exe23⤵
- Executes dropped EXE
PID:3248 -
\??\c:\vpppp.exec:\vpppp.exe24⤵
- Executes dropped EXE
PID:1008 -
\??\c:\rflllrx.exec:\rflllrx.exe25⤵
- Executes dropped EXE
PID:3836 -
\??\c:\jpvpd.exec:\jpvpd.exe26⤵
- Executes dropped EXE
PID:1536 -
\??\c:\fxrlfxx.exec:\fxrlfxx.exe27⤵
- Executes dropped EXE
PID:4404 -
\??\c:\fxrrfxr.exec:\fxrrfxr.exe28⤵
- Executes dropped EXE
PID:4056 -
\??\c:\nntnnn.exec:\nntnnn.exe29⤵
- Executes dropped EXE
PID:4408 -
\??\c:\1vjjj.exec:\1vjjj.exe30⤵
- Executes dropped EXE
PID:4184 -
\??\c:\jvvvp.exec:\jvvvp.exe31⤵
- Executes dropped EXE
PID:1544 -
\??\c:\3djdv.exec:\3djdv.exe32⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dvvpd.exec:\dvvpd.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tnttnn.exec:\tnttnn.exe34⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dpjdd.exec:\dpjdd.exe35⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ppjdv.exec:\ppjdv.exe36⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9bthbt.exec:\9bthbt.exe37⤵
- Executes dropped EXE
PID:1572 -
\??\c:\7jddv.exec:\7jddv.exe38⤵
- Executes dropped EXE
PID:4608 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe39⤵
- Executes dropped EXE
PID:4112 -
\??\c:\vvpvv.exec:\vvpvv.exe40⤵
- Executes dropped EXE
PID:5116 -
\??\c:\nthhnn.exec:\nthhnn.exe41⤵
- Executes dropped EXE
PID:4816 -
\??\c:\jjdvv.exec:\jjdvv.exe42⤵
- Executes dropped EXE
PID:936 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe43⤵
- Executes dropped EXE
PID:860 -
\??\c:\nhhbbb.exec:\nhhbbb.exe44⤵
- Executes dropped EXE
PID:4748 -
\??\c:\pdpjd.exec:\pdpjd.exe45⤵
- Executes dropped EXE
PID:1396 -
\??\c:\dddvv.exec:\dddvv.exe46⤵
- Executes dropped EXE
PID:3844 -
\??\c:\xxxrrrr.exec:\xxxrrrr.exe47⤵
- Executes dropped EXE
PID:2256 -
\??\c:\pppjj.exec:\pppjj.exe48⤵
- Executes dropped EXE
PID:1652 -
\??\c:\fxllffl.exec:\fxllffl.exe49⤵
- Executes dropped EXE
PID:3976 -
\??\c:\hhhbtt.exec:\hhhbtt.exe50⤵
- Executes dropped EXE
PID:4168 -
\??\c:\jdvpj.exec:\jdvpj.exe51⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rlrxxrr.exec:\rlrxxrr.exe52⤵
- Executes dropped EXE
PID:2796 -
\??\c:\fxxxxfl.exec:\fxxxxfl.exe53⤵
- Executes dropped EXE
PID:2772 -
\??\c:\7bhhbb.exec:\7bhhbb.exe54⤵
- Executes dropped EXE
PID:3160 -
\??\c:\vvvpd.exec:\vvvpd.exe55⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nntnbb.exec:\nntnbb.exe56⤵
- Executes dropped EXE
PID:784 -
\??\c:\pppjj.exec:\pppjj.exe57⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pppjj.exec:\pppjj.exe58⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jpddd.exec:\jpddd.exe59⤵
- Executes dropped EXE
PID:3380 -
\??\c:\nhtttb.exec:\nhtttb.exe60⤵
- Executes dropped EXE
PID:3012 -
\??\c:\9pdvv.exec:\9pdvv.exe61⤵
- Executes dropped EXE
PID:4976 -
\??\c:\5fxlxxl.exec:\5fxlxxl.exe62⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1hnnnt.exec:\1hnnnt.exe63⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vpjjd.exec:\vpjjd.exe64⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rxrrrxf.exec:\rxrrrxf.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\thnttt.exec:\thnttt.exe66⤵PID:2128
-
\??\c:\1jjjj.exec:\1jjjj.exe67⤵PID:856
-
\??\c:\rxlrfll.exec:\rxlrfll.exe68⤵PID:1168
-
\??\c:\hhthbh.exec:\hhthbh.exe69⤵PID:1192
-
\??\c:\bhhtnb.exec:\bhhtnb.exe70⤵PID:2296
-
\??\c:\jpdvv.exec:\jpdvv.exe71⤵PID:2756
-
\??\c:\lxrxxfr.exec:\lxrxxfr.exe72⤵PID:1172
-
\??\c:\llffflr.exec:\llffflr.exe73⤵PID:4372
-
\??\c:\bnhthn.exec:\bnhthn.exe74⤵PID:1084
-
\??\c:\vjvvv.exec:\vjvvv.exe75⤵PID:3800
-
\??\c:\jpjjd.exec:\jpjjd.exe76⤵PID:3792
-
\??\c:\3xrrrxl.exec:\3xrrrxl.exe77⤵PID:3612
-
\??\c:\bhtthn.exec:\bhtthn.exe78⤵PID:3212
-
\??\c:\pjvvp.exec:\pjvvp.exe79⤵PID:4452
-
\??\c:\vdpjd.exec:\vdpjd.exe80⤵PID:1604
-
\??\c:\fxrllll.exec:\fxrllll.exe81⤵PID:1904
-
\??\c:\llfllfx.exec:\llfllfx.exe82⤵PID:3268
-
\??\c:\5nntnt.exec:\5nntnt.exe83⤵PID:2224
-
\??\c:\jdvpd.exec:\jdvpd.exe84⤵PID:3968
-
\??\c:\llrrlll.exec:\llrrlll.exe85⤵PID:3520
-
\??\c:\lllrxxr.exec:\lllrxxr.exe86⤵PID:4384
-
\??\c:\tntttt.exec:\tntttt.exe87⤵PID:1764
-
\??\c:\ddppp.exec:\ddppp.exe88⤵PID:4336
-
\??\c:\jjjjv.exec:\jjjjv.exe89⤵PID:4112
-
\??\c:\1rrrrxr.exec:\1rrrrxr.exe90⤵PID:4324
-
\??\c:\tbhhhh.exec:\tbhhhh.exe91⤵PID:4888
-
\??\c:\bthhnn.exec:\bthhnn.exe92⤵PID:936
-
\??\c:\jjpjj.exec:\jjpjj.exe93⤵PID:860
-
\??\c:\9dvvj.exec:\9dvvj.exe94⤵PID:2112
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe95⤵PID:3376
-
\??\c:\bbtbtt.exec:\bbtbtt.exe96⤵PID:2416
-
\??\c:\pdvvp.exec:\pdvvp.exe97⤵PID:3260
-
\??\c:\xllllfx.exec:\xllllfx.exe98⤵PID:5040
-
\??\c:\ttbhhh.exec:\ttbhhh.exe99⤵PID:4804
-
\??\c:\3jvvv.exec:\3jvvv.exe100⤵PID:3732
-
\??\c:\xfrflrr.exec:\xfrflrr.exe101⤵PID:4688
-
\??\c:\rflrxxr.exec:\rflrxxr.exe102⤵PID:2368
-
\??\c:\nntbht.exec:\nntbht.exe103⤵PID:4032
-
\??\c:\djpvd.exec:\djpvd.exe104⤵PID:5080
-
\??\c:\ffxrffx.exec:\ffxrffx.exe105⤵PID:1964
-
\??\c:\nhttbn.exec:\nhttbn.exe106⤵PID:4532
-
\??\c:\htbbbh.exec:\htbbbh.exe107⤵PID:2344
-
\??\c:\ppvvv.exec:\ppvvv.exe108⤵PID:1648
-
\??\c:\rxxxxff.exec:\rxxxxff.exe109⤵PID:4696
-
\??\c:\tntttt.exec:\tntttt.exe110⤵PID:3380
-
\??\c:\htbnbh.exec:\htbnbh.exe111⤵PID:412
-
\??\c:\1jpjj.exec:\1jpjj.exe112⤵PID:1148
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe113⤵PID:2692
-
\??\c:\htbtnh.exec:\htbtnh.exe114⤵PID:1160
-
\??\c:\9djjj.exec:\9djjj.exe115⤵PID:2636
-
\??\c:\7rrlfff.exec:\7rrlfff.exe116⤵PID:4808
-
\??\c:\nhtbbt.exec:\nhtbbt.exe117⤵PID:888
-
\??\c:\jdjdj.exec:\jdjdj.exe118⤵PID:3788
-
\??\c:\rrrrrrf.exec:\rrrrrrf.exe119⤵PID:1168
-
\??\c:\tbbbtb.exec:\tbbbtb.exe120⤵PID:4620
-
\??\c:\ntbbbh.exec:\ntbbbh.exe121⤵PID:448
-
\??\c:\dpvjj.exec:\dpvjj.exe122⤵PID:5000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-