Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 01:50
Behavioral task
behavioral1
Sample
7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe
-
Size
365KB
-
MD5
7172126158ab77902e0f68a0eadba970
-
SHA1
0c935d475865024cfc7541a6472eccbb85e68e6a
-
SHA256
0754ec5a288c358ddd09cb7d9bac10492a38f649aca7e20ca24ed2e795661caf
-
SHA512
3a89f25de3f5c569ace4d9010a9dde7f741a9396fbea5d9b05cd3d18a3bbdd9da9fe7a8e5712bcf799f0ddd181583b14f6e7021baac8cbfe7a2076de45fada22
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwu1b26X1wjdgyPPBR:R4wFHoSHYHUrAwqzQ7PPr
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1776-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/696-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/928-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1296-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/724-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/472-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/948-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-763-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-876-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4600 ffrrlll.exe 1560 9bttth.exe 2436 dvjjv.exe 2700 vddvp.exe 2528 xlrlrlf.exe 1120 vdvvd.exe 696 vjjdv.exe 928 lxfflff.exe 1860 btbthn.exe 4276 jdjjj.exe 2792 hnnnhb.exe 3692 vpvjj.exe 4892 lxlllll.exe 3392 pjppj.exe 5080 fflxxlf.exe 4688 vpddd.exe 2080 rxlfxxx.exe 4196 9rxrllf.exe 3976 bbtntn.exe 1408 5rfxrrl.exe 2960 nntbtn.exe 4540 ddjdd.exe 2292 9bthbh.exe 1044 rllflfx.exe 3004 lrxrfff.exe 5048 djvjd.exe 216 pjvpd.exe 1596 xlfrfxr.exe 1296 frfflrr.exe 4256 nthbth.exe 2044 jvdvd.exe 4832 7flfxxr.exe 1212 ddddp.exe 2216 llrrfxl.exe 2584 tntnnh.exe 3308 vpjvv.exe 3384 fffflfl.exe 3164 rxxxxxr.exe 968 bhnhbn.exe 2944 ddddd.exe 908 xxfffrx.exe 2424 hbhhnn.exe 4336 djjdd.exe 4300 fxlfffl.exe 1400 5ntbtb.exe 2068 pjpjd.exe 1068 rxfffxr.exe 2704 tnnhht.exe 4452 9lllfff.exe 1660 vpvvp.exe 2912 xfrlffx.exe 336 hnhhbn.exe 1388 pppvv.exe 4120 btbbbt.exe 1160 bnhbbb.exe 3924 vpppv.exe 4356 lfffrrf.exe 4276 nttnhh.exe 4400 7bhbtt.exe 4416 dpddd.exe 3180 lflllll.exe 4412 tbttnh.exe 3996 hnnthh.exe 3392 5ppjd.exe -
resource yara_rule behavioral2/memory/1776-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233d8-3.dat upx behavioral2/memory/4600-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1776-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e4-11.dat upx behavioral2/memory/2436-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2700-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4600-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1560-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e3-10.dat upx behavioral2/files/0x00070000000233e5-21.dat upx behavioral2/files/0x00070000000233e6-25.dat upx behavioral2/files/0x00070000000233e7-30.dat upx behavioral2/memory/1120-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e8-35.dat upx behavioral2/memory/696-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2528-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e9-40.dat upx behavioral2/memory/928-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/928-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ea-46.dat upx behavioral2/memory/1860-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233eb-51.dat upx behavioral2/files/0x00070000000233ec-55.dat upx behavioral2/memory/4276-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ed-60.dat upx behavioral2/memory/2792-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3692-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ee-66.dat upx behavioral2/files/0x00070000000233ef-70.dat upx behavioral2/files/0x00070000000233f0-74.dat upx behavioral2/memory/5080-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233da-80.dat upx behavioral2/memory/4688-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f2-85.dat upx behavioral2/files/0x00070000000233f3-88.dat upx behavioral2/files/0x00070000000233f4-92.dat upx behavioral2/memory/3976-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f5-98.dat upx behavioral2/memory/3976-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f6-102.dat upx behavioral2/files/0x00070000000233f7-108.dat upx behavioral2/memory/1408-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f8-111.dat upx behavioral2/files/0x00070000000233f9-115.dat upx behavioral2/files/0x00070000000233fa-119.dat upx behavioral2/files/0x00070000000233fb-123.dat upx behavioral2/memory/3004-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5048-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-130.dat upx behavioral2/memory/216-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fd-135.dat upx behavioral2/files/0x00070000000233fe-138.dat upx behavioral2/memory/1296-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ff-143.dat upx behavioral2/files/0x0007000000023400-147.dat upx behavioral2/memory/4256-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2044-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-153.dat upx behavioral2/memory/1212-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2216-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2584-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3384-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3164-173-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 4600 1776 7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe 83 PID 1776 wrote to memory of 4600 1776 7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe 83 PID 1776 wrote to memory of 4600 1776 7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe 83 PID 4600 wrote to memory of 1560 4600 ffrrlll.exe 84 PID 4600 wrote to memory of 1560 4600 ffrrlll.exe 84 PID 4600 wrote to memory of 1560 4600 ffrrlll.exe 84 PID 1560 wrote to memory of 2436 1560 9bttth.exe 85 PID 1560 wrote to memory of 2436 1560 9bttth.exe 85 PID 1560 wrote to memory of 2436 1560 9bttth.exe 85 PID 2436 wrote to memory of 2700 2436 dvjjv.exe 86 PID 2436 wrote to memory of 2700 2436 dvjjv.exe 86 PID 2436 wrote to memory of 2700 2436 dvjjv.exe 86 PID 2700 wrote to memory of 2528 2700 vddvp.exe 87 PID 2700 wrote to memory of 2528 2700 vddvp.exe 87 PID 2700 wrote to memory of 2528 2700 vddvp.exe 87 PID 2528 wrote to memory of 1120 2528 xlrlrlf.exe 88 PID 2528 wrote to memory of 1120 2528 xlrlrlf.exe 88 PID 2528 wrote to memory of 1120 2528 xlrlrlf.exe 88 PID 1120 wrote to memory of 696 1120 vdvvd.exe 89 PID 1120 wrote to memory of 696 1120 vdvvd.exe 89 PID 1120 wrote to memory of 696 1120 vdvvd.exe 89 PID 696 wrote to memory of 928 696 vjjdv.exe 90 PID 696 wrote to memory of 928 696 vjjdv.exe 90 PID 696 wrote to memory of 928 696 vjjdv.exe 90 PID 928 wrote to memory of 1860 928 lxfflff.exe 91 PID 928 wrote to memory of 1860 928 lxfflff.exe 91 PID 928 wrote to memory of 1860 928 lxfflff.exe 91 PID 1860 wrote to memory of 4276 1860 btbthn.exe 92 PID 1860 wrote to memory of 4276 1860 btbthn.exe 92 PID 1860 wrote to memory of 4276 1860 btbthn.exe 92 PID 4276 wrote to memory of 2792 4276 jdjjj.exe 93 PID 4276 wrote to memory of 2792 4276 jdjjj.exe 93 PID 4276 wrote to memory of 2792 4276 jdjjj.exe 93 PID 2792 wrote to memory of 3692 2792 hnnnhb.exe 94 PID 2792 wrote to memory of 3692 2792 hnnnhb.exe 94 PID 2792 wrote to memory of 3692 2792 hnnnhb.exe 94 PID 3692 wrote to memory of 4892 3692 vpvjj.exe 95 PID 3692 wrote to memory of 4892 3692 vpvjj.exe 95 PID 3692 wrote to memory of 4892 3692 vpvjj.exe 95 PID 4892 wrote to memory of 3392 4892 lxlllll.exe 96 PID 4892 wrote to memory of 3392 4892 lxlllll.exe 96 PID 4892 wrote to memory of 3392 4892 lxlllll.exe 96 PID 3392 wrote to memory of 5080 3392 pjppj.exe 97 PID 3392 wrote to memory of 5080 3392 pjppj.exe 97 PID 3392 wrote to memory of 5080 3392 pjppj.exe 97 PID 5080 wrote to memory of 4688 5080 fflxxlf.exe 98 PID 5080 wrote to memory of 4688 5080 fflxxlf.exe 98 PID 5080 wrote to memory of 4688 5080 fflxxlf.exe 98 PID 4688 wrote to memory of 2080 4688 vpddd.exe 99 PID 4688 wrote to memory of 2080 4688 vpddd.exe 99 PID 4688 wrote to memory of 2080 4688 vpddd.exe 99 PID 2080 wrote to memory of 4196 2080 rxlfxxx.exe 101 PID 2080 wrote to memory of 4196 2080 rxlfxxx.exe 101 PID 2080 wrote to memory of 4196 2080 rxlfxxx.exe 101 PID 4196 wrote to memory of 3976 4196 9rxrllf.exe 102 PID 4196 wrote to memory of 3976 4196 9rxrllf.exe 102 PID 4196 wrote to memory of 3976 4196 9rxrllf.exe 102 PID 3976 wrote to memory of 1408 3976 bbtntn.exe 103 PID 3976 wrote to memory of 1408 3976 bbtntn.exe 103 PID 3976 wrote to memory of 1408 3976 bbtntn.exe 103 PID 1408 wrote to memory of 2960 1408 5rfxrrl.exe 104 PID 1408 wrote to memory of 2960 1408 5rfxrrl.exe 104 PID 1408 wrote to memory of 2960 1408 5rfxrrl.exe 104 PID 2960 wrote to memory of 4540 2960 nntbtn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\ffrrlll.exec:\ffrrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\9bttth.exec:\9bttth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\dvjjv.exec:\dvjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\vddvp.exec:\vddvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xlrlrlf.exec:\xlrlrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vdvvd.exec:\vdvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\vjjdv.exec:\vjjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\lxfflff.exec:\lxfflff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\btbthn.exec:\btbthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\jdjjj.exec:\jdjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\hnnnhb.exec:\hnnnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vpvjj.exec:\vpvjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\lxlllll.exec:\lxlllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\pjppj.exec:\pjppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\fflxxlf.exec:\fflxxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\vpddd.exec:\vpddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\9rxrllf.exec:\9rxrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\bbtntn.exec:\bbtntn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\5rfxrrl.exec:\5rfxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\nntbtn.exec:\nntbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\ddjdd.exec:\ddjdd.exe23⤵
- Executes dropped EXE
PID:4540 -
\??\c:\9bthbh.exec:\9bthbh.exe24⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rllflfx.exec:\rllflfx.exe25⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lrxrfff.exec:\lrxrfff.exe26⤵
- Executes dropped EXE
PID:3004 -
\??\c:\djvjd.exec:\djvjd.exe27⤵
- Executes dropped EXE
PID:5048 -
\??\c:\pjvpd.exec:\pjvpd.exe28⤵
- Executes dropped EXE
PID:216 -
\??\c:\xlfrfxr.exec:\xlfrfxr.exe29⤵
- Executes dropped EXE
PID:1596 -
\??\c:\frfflrr.exec:\frfflrr.exe30⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nthbth.exec:\nthbth.exe31⤵
- Executes dropped EXE
PID:4256 -
\??\c:\jvdvd.exec:\jvdvd.exe32⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7flfxxr.exec:\7flfxxr.exe33⤵
- Executes dropped EXE
PID:4832 -
\??\c:\ddddp.exec:\ddddp.exe34⤵
- Executes dropped EXE
PID:1212 -
\??\c:\llrrfxl.exec:\llrrfxl.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\tntnnh.exec:\tntnnh.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vpjvv.exec:\vpjvv.exe37⤵
- Executes dropped EXE
PID:3308 -
\??\c:\fffflfl.exec:\fffflfl.exe38⤵
- Executes dropped EXE
PID:3384 -
\??\c:\rxxxxxr.exec:\rxxxxxr.exe39⤵
- Executes dropped EXE
PID:3164 -
\??\c:\bhnhbn.exec:\bhnhbn.exe40⤵
- Executes dropped EXE
PID:968 -
\??\c:\ddddd.exec:\ddddd.exe41⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xxfffrx.exec:\xxfffrx.exe42⤵
- Executes dropped EXE
PID:908 -
\??\c:\hbhhnn.exec:\hbhhnn.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\djjdd.exec:\djjdd.exe44⤵
- Executes dropped EXE
PID:4336 -
\??\c:\fxlfffl.exec:\fxlfffl.exe45⤵
- Executes dropped EXE
PID:4300 -
\??\c:\5ntbtb.exec:\5ntbtb.exe46⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pjpjd.exec:\pjpjd.exe47⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rxfffxr.exec:\rxfffxr.exe48⤵
- Executes dropped EXE
PID:1068 -
\??\c:\tnnhht.exec:\tnnhht.exe49⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9lllfff.exec:\9lllfff.exe50⤵
- Executes dropped EXE
PID:4452 -
\??\c:\vpvvp.exec:\vpvvp.exe51⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xfrlffx.exec:\xfrlffx.exe52⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hnhhbn.exec:\hnhhbn.exe53⤵
- Executes dropped EXE
PID:336 -
\??\c:\pppvv.exec:\pppvv.exe54⤵
- Executes dropped EXE
PID:1388 -
\??\c:\btbbbt.exec:\btbbbt.exe55⤵
- Executes dropped EXE
PID:4120 -
\??\c:\bnhbbb.exec:\bnhbbb.exe56⤵
- Executes dropped EXE
PID:1160 -
\??\c:\vpppv.exec:\vpppv.exe57⤵
- Executes dropped EXE
PID:3924 -
\??\c:\lfffrrf.exec:\lfffrrf.exe58⤵
- Executes dropped EXE
PID:4356 -
\??\c:\nttnhh.exec:\nttnhh.exe59⤵
- Executes dropped EXE
PID:4276 -
\??\c:\7bhbtt.exec:\7bhbtt.exe60⤵
- Executes dropped EXE
PID:4400 -
\??\c:\dpddd.exec:\dpddd.exe61⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lflllll.exec:\lflllll.exe62⤵
- Executes dropped EXE
PID:3180 -
\??\c:\tbttnh.exec:\tbttnh.exe63⤵
- Executes dropped EXE
PID:4412 -
\??\c:\hnnthh.exec:\hnnthh.exe64⤵
- Executes dropped EXE
PID:3996 -
\??\c:\5ppjd.exec:\5ppjd.exe65⤵
- Executes dropped EXE
PID:3392 -
\??\c:\lllrxxl.exec:\lllrxxl.exe66⤵PID:2380
-
\??\c:\htbbbn.exec:\htbbbn.exe67⤵PID:2220
-
\??\c:\ttnnbh.exec:\ttnnbh.exe68⤵PID:4028
-
\??\c:\ddppv.exec:\ddppv.exe69⤵PID:2412
-
\??\c:\rlrxxxr.exec:\rlrxxxr.exe70⤵PID:1436
-
\??\c:\hnbbtt.exec:\hnbbtt.exe71⤵PID:868
-
\??\c:\jdvvd.exec:\jdvvd.exe72⤵PID:4512
-
\??\c:\7lrllll.exec:\7lrllll.exe73⤵PID:2864
-
\??\c:\hbhbtn.exec:\hbhbtn.exe74⤵PID:2644
-
\??\c:\pjpjj.exec:\pjpjj.exe75⤵PID:2300
-
\??\c:\1rxfxxf.exec:\1rxfxxf.exe76⤵PID:2292
-
\??\c:\tnnbtn.exec:\tnnbtn.exe77⤵PID:724
-
\??\c:\nnbbbb.exec:\nnbbbb.exe78⤵PID:1240
-
\??\c:\jpvdd.exec:\jpvdd.exe79⤵PID:5036
-
\??\c:\fxrlrfl.exec:\fxrlrfl.exe80⤵PID:4468
-
\??\c:\nthhbb.exec:\nthhbb.exe81⤵PID:4156
-
\??\c:\9nhnhn.exec:\9nhnhn.exe82⤵PID:4588
-
\??\c:\pdvpd.exec:\pdvpd.exe83⤵PID:2296
-
\??\c:\rxrlffl.exec:\rxrlffl.exe84⤵PID:1284
-
\??\c:\hbbtnt.exec:\hbbtnt.exe85⤵PID:1556
-
\??\c:\vjvvp.exec:\vjvvp.exe86⤵PID:472
-
\??\c:\pjddj.exec:\pjddj.exe87⤵PID:628
-
\??\c:\lflfxxr.exec:\lflfxxr.exe88⤵PID:2640
-
\??\c:\bhttnn.exec:\bhttnn.exe89⤵PID:4352
-
\??\c:\tthtnn.exec:\tthtnn.exe90⤵PID:4948
-
\??\c:\jdjjj.exec:\jdjjj.exe91⤵PID:1692
-
\??\c:\xfffllf.exec:\xfffllf.exe92⤵PID:4940
-
\??\c:\xlxrlll.exec:\xlxrlll.exe93⤵PID:1004
-
\??\c:\5tbbbb.exec:\5tbbbb.exe94⤵PID:3788
-
\??\c:\7bhhtt.exec:\7bhhtt.exe95⤵PID:4364
-
\??\c:\vdppv.exec:\vdppv.exe96⤵PID:4904
-
\??\c:\xrlfrll.exec:\xrlfrll.exe97⤵PID:4300
-
\??\c:\hbtttt.exec:\hbtttt.exe98⤵PID:1824
-
\??\c:\jvdpj.exec:\jvdpj.exe99⤵PID:2068
-
\??\c:\tnbtbb.exec:\tnbtbb.exe100⤵PID:1068
-
\??\c:\nbhhbb.exec:\nbhhbb.exe101⤵PID:2704
-
\??\c:\dvvjp.exec:\dvvjp.exe102⤵PID:2700
-
\??\c:\9flfflf.exec:\9flfflf.exe103⤵PID:2440
-
\??\c:\bbnbtt.exec:\bbnbtt.exe104⤵PID:1392
-
\??\c:\ntbtnn.exec:\ntbtnn.exe105⤵PID:2688
-
\??\c:\djvpj.exec:\djvpj.exe106⤵PID:2364
-
\??\c:\rllfrlf.exec:\rllfrlf.exe107⤵PID:928
-
\??\c:\7hhhbb.exec:\7hhhbb.exe108⤵PID:5020
-
\??\c:\3hhhbb.exec:\3hhhbb.exe109⤵PID:3588
-
\??\c:\djppj.exec:\djppj.exe110⤵PID:5060
-
\??\c:\9xfrflf.exec:\9xfrflf.exe111⤵PID:2896
-
\??\c:\1fxrrxr.exec:\1fxrrxr.exe112⤵PID:2792
-
\??\c:\bnnbtn.exec:\bnnbtn.exe113⤵PID:2828
-
\??\c:\pjjdd.exec:\pjjdd.exe114⤵PID:3248
-
\??\c:\flllfff.exec:\flllfff.exe115⤵PID:4644
-
\??\c:\bhhhbt.exec:\bhhhbt.exe116⤵PID:1032
-
\??\c:\pddvj.exec:\pddvj.exe117⤵PID:1060
-
\??\c:\7xrxrfx.exec:\7xrxrfx.exe118⤵PID:4848
-
\??\c:\bhtnnb.exec:\bhtnnb.exe119⤵PID:4104
-
\??\c:\3jjjd.exec:\3jjjd.exe120⤵PID:4772
-
\??\c:\dvvjd.exec:\dvvjd.exe121⤵PID:5108
-
\??\c:\xflrrxr.exec:\xflrrxr.exe122⤵PID:3076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-