Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 01:32
Behavioral task
behavioral1
Sample
6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe
-
Size
164KB
-
MD5
6e1b8d80fc75dfc92364fc9fc73bbec0
-
SHA1
bcc4b9b909e233dea2eada661ef6f275929d290c
-
SHA256
90cf4049488b01928353a1532bd34f5912f57d767f95199281104c05d42e339a
-
SHA512
3adaf765b7383d7acd6ae1a51a2915a34418224f08561597f3f10c995779544d0744cef82ce657d9f5b5f7f420c2e156af31f40d70e3f23095ae60ac0800de3d
-
SSDEEP
3072:0hOmTsF93UYfwC6GIoutXEnkeBahPmSBPt7ZY16E:0cm4FmowdHoSet4hPhTlY4E
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2184-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3156-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3128-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-791-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-810-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-887-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1332-944-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-954-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/424-982-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-1047-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2184 xxrflrx.exe 2308 1nhbtt.exe 3368 nhhbnh.exe 3584 jppjv.exe 1128 dvpvv.exe 4480 lrllxxx.exe 4660 nnnnhn.exe 4892 5tbhtn.exe 4996 5pjdv.exe 3520 htnhhb.exe 1528 jvvpj.exe 3376 xffflll.exe 2756 fxrrrrx.exe 2792 dvdpv.exe 3536 rxxrlll.exe 4856 ppjjd.exe 4780 lrxlffx.exe 4932 hhnhtt.exe 4132 ddpjv.exe 3124 rlrrrll.exe 1740 1hnnnn.exe 1120 9vvvv.exe 5004 7fllfrl.exe 3272 ttnnnt.exe 2152 jdjjj.exe 4580 xrlffff.exe 3288 nhtttt.exe 3900 nbtnnn.exe 2980 ppppd.exe 940 lxlrrfl.exe 1984 nnhhhn.exe 3532 vjvvv.exe 4216 pdvvv.exe 1584 lfxxfxf.exe 1812 hhnnnt.exe 3048 ppvpp.exe 2408 ddjjj.exe 3828 1fllrxf.exe 4372 bbnnnt.exe 4624 nnnnnt.exe 4888 9djvp.exe 4028 fflrxfl.exe 4876 9nhhhn.exe 3144 jjppp.exe 2868 dpddv.exe 3688 frfrlrr.exe 968 tbnhth.exe 2192 vvpjj.exe 1640 7rrlfxr.exe 4072 tntttb.exe 1400 vvvjp.exe 4036 pdjjj.exe 892 5rlllrr.exe 2132 bhnntt.exe 3668 pppjp.exe 3128 9djvd.exe 3752 fxrrffr.exe 3376 hhhnnn.exe 4300 hthntn.exe 1004 7djjj.exe 3536 vjjdp.exe 464 1flfrrl.exe 2552 5hhhtb.exe 5100 nnnntt.exe -
resource yara_rule behavioral2/memory/3156-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-4.dat upx behavioral2/memory/2184-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a0000000233ea-9.dat upx behavioral2/files/0x00070000000233f4-21.dat upx behavioral2/files/0x00070000000233f6-34.dat upx behavioral2/files/0x00070000000233f7-40.dat upx behavioral2/files/0x00070000000233f8-45.dat upx behavioral2/files/0x00070000000233f9-52.dat upx behavioral2/memory/4660-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4892-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4996-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fa-57.dat upx behavioral2/memory/4480-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1128-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f5-28.dat upx behavioral2/memory/3368-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3584-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f3-16.dat upx behavioral2/memory/2308-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3156-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fb-62.dat upx behavioral2/memory/1528-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-69.dat upx behavioral2/files/0x00070000000233fd-73.dat upx behavioral2/files/0x00070000000233fe-78.dat upx behavioral2/memory/2756-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ff-84.dat upx behavioral2/memory/2792-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023400-93.dat upx behavioral2/memory/3536-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-96.dat upx behavioral2/memory/4856-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4780-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-105.dat upx behavioral2/files/0x0007000000023403-108.dat upx behavioral2/files/0x0007000000023404-113.dat upx behavioral2/memory/3124-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023405-119.dat upx behavioral2/memory/3124-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-126.dat upx behavioral2/memory/1120-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-132.dat upx behavioral2/memory/1740-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-137.dat upx behavioral2/files/0x00080000000233ef-142.dat upx behavioral2/memory/3272-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023409-149.dat upx behavioral2/files/0x000700000002340a-153.dat upx behavioral2/memory/3288-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-159.dat upx behavioral2/memory/3900-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-167.dat upx behavioral2/files/0x000700000002340e-172.dat upx behavioral2/memory/940-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-178.dat upx behavioral2/memory/2980-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-182.dat upx behavioral2/memory/3532-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4216-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1812-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3048-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4372-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4888-220-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3156 wrote to memory of 2184 3156 6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe 83 PID 3156 wrote to memory of 2184 3156 6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe 83 PID 3156 wrote to memory of 2184 3156 6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe 83 PID 2184 wrote to memory of 2308 2184 xxrflrx.exe 84 PID 2184 wrote to memory of 2308 2184 xxrflrx.exe 84 PID 2184 wrote to memory of 2308 2184 xxrflrx.exe 84 PID 2308 wrote to memory of 3368 2308 1nhbtt.exe 85 PID 2308 wrote to memory of 3368 2308 1nhbtt.exe 85 PID 2308 wrote to memory of 3368 2308 1nhbtt.exe 85 PID 3368 wrote to memory of 3584 3368 nhhbnh.exe 86 PID 3368 wrote to memory of 3584 3368 nhhbnh.exe 86 PID 3368 wrote to memory of 3584 3368 nhhbnh.exe 86 PID 3584 wrote to memory of 1128 3584 jppjv.exe 87 PID 3584 wrote to memory of 1128 3584 jppjv.exe 87 PID 3584 wrote to memory of 1128 3584 jppjv.exe 87 PID 1128 wrote to memory of 4480 1128 dvpvv.exe 88 PID 1128 wrote to memory of 4480 1128 dvpvv.exe 88 PID 1128 wrote to memory of 4480 1128 dvpvv.exe 88 PID 4480 wrote to memory of 4660 4480 lrllxxx.exe 89 PID 4480 wrote to memory of 4660 4480 lrllxxx.exe 89 PID 4480 wrote to memory of 4660 4480 lrllxxx.exe 89 PID 4660 wrote to memory of 4892 4660 nnnnhn.exe 90 PID 4660 wrote to memory of 4892 4660 nnnnhn.exe 90 PID 4660 wrote to memory of 4892 4660 nnnnhn.exe 90 PID 4892 wrote to memory of 4996 4892 5tbhtn.exe 91 PID 4892 wrote to memory of 4996 4892 5tbhtn.exe 91 PID 4892 wrote to memory of 4996 4892 5tbhtn.exe 91 PID 4996 wrote to memory of 3520 4996 5pjdv.exe 92 PID 4996 wrote to memory of 3520 4996 5pjdv.exe 92 PID 4996 wrote to memory of 3520 4996 5pjdv.exe 92 PID 3520 wrote to memory of 1528 3520 htnhhb.exe 93 PID 3520 wrote to memory of 1528 3520 htnhhb.exe 93 PID 3520 wrote to memory of 1528 3520 htnhhb.exe 93 PID 1528 wrote to memory of 3376 1528 jvvpj.exe 94 PID 1528 wrote to memory of 3376 1528 jvvpj.exe 94 PID 1528 wrote to memory of 3376 1528 jvvpj.exe 94 PID 3376 wrote to memory of 2756 3376 xffflll.exe 95 PID 3376 wrote to memory of 2756 3376 xffflll.exe 95 PID 3376 wrote to memory of 2756 3376 xffflll.exe 95 PID 2756 wrote to memory of 2792 2756 fxrrrrx.exe 96 PID 2756 wrote to memory of 2792 2756 fxrrrrx.exe 96 PID 2756 wrote to memory of 2792 2756 fxrrrrx.exe 96 PID 2792 wrote to memory of 3536 2792 dvdpv.exe 97 PID 2792 wrote to memory of 3536 2792 dvdpv.exe 97 PID 2792 wrote to memory of 3536 2792 dvdpv.exe 97 PID 3536 wrote to memory of 4856 3536 rxxrlll.exe 98 PID 3536 wrote to memory of 4856 3536 rxxrlll.exe 98 PID 3536 wrote to memory of 4856 3536 rxxrlll.exe 98 PID 4856 wrote to memory of 4780 4856 ppjjd.exe 99 PID 4856 wrote to memory of 4780 4856 ppjjd.exe 99 PID 4856 wrote to memory of 4780 4856 ppjjd.exe 99 PID 4780 wrote to memory of 4932 4780 lrxlffx.exe 100 PID 4780 wrote to memory of 4932 4780 lrxlffx.exe 100 PID 4780 wrote to memory of 4932 4780 lrxlffx.exe 100 PID 4932 wrote to memory of 4132 4932 hhnhtt.exe 101 PID 4932 wrote to memory of 4132 4932 hhnhtt.exe 101 PID 4932 wrote to memory of 4132 4932 hhnhtt.exe 101 PID 4132 wrote to memory of 3124 4132 ddpjv.exe 102 PID 4132 wrote to memory of 3124 4132 ddpjv.exe 102 PID 4132 wrote to memory of 3124 4132 ddpjv.exe 102 PID 3124 wrote to memory of 1740 3124 rlrrrll.exe 103 PID 3124 wrote to memory of 1740 3124 rlrrrll.exe 103 PID 3124 wrote to memory of 1740 3124 rlrrrll.exe 103 PID 1740 wrote to memory of 1120 1740 1hnnnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6e1b8d80fc75dfc92364fc9fc73bbec0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\xxrflrx.exec:\xxrflrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\1nhbtt.exec:\1nhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\nhhbnh.exec:\nhhbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\jppjv.exec:\jppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\dvpvv.exec:\dvpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\lrllxxx.exec:\lrllxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\nnnnhn.exec:\nnnnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\5tbhtn.exec:\5tbhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\5pjdv.exec:\5pjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\htnhhb.exec:\htnhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\jvvpj.exec:\jvvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\xffflll.exec:\xffflll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\dvdpv.exec:\dvdpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rxxrlll.exec:\rxxrlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\ppjjd.exec:\ppjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\lrxlffx.exec:\lrxlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\hhnhtt.exec:\hhnhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\ddpjv.exec:\ddpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\rlrrrll.exec:\rlrrrll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\1hnnnn.exec:\1hnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\9vvvv.exec:\9vvvv.exe23⤵
- Executes dropped EXE
PID:1120 -
\??\c:\7fllfrl.exec:\7fllfrl.exe24⤵
- Executes dropped EXE
PID:5004 -
\??\c:\ttnnnt.exec:\ttnnnt.exe25⤵
- Executes dropped EXE
PID:3272 -
\??\c:\jdjjj.exec:\jdjjj.exe26⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xrlffff.exec:\xrlffff.exe27⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nhtttt.exec:\nhtttt.exe28⤵
- Executes dropped EXE
PID:3288 -
\??\c:\nbtnnn.exec:\nbtnnn.exe29⤵
- Executes dropped EXE
PID:3900 -
\??\c:\ppppd.exec:\ppppd.exe30⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lxlrrfl.exec:\lxlrrfl.exe31⤵
- Executes dropped EXE
PID:940 -
\??\c:\nnhhhn.exec:\nnhhhn.exe32⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vjvvv.exec:\vjvvv.exe33⤵
- Executes dropped EXE
PID:3532 -
\??\c:\pdvvv.exec:\pdvvv.exe34⤵
- Executes dropped EXE
PID:4216 -
\??\c:\lfxxfxf.exec:\lfxxfxf.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hhnnnt.exec:\hhnnnt.exe36⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ppvpp.exec:\ppvpp.exe37⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ddjjj.exec:\ddjjj.exe38⤵
- Executes dropped EXE
PID:2408 -
\??\c:\1fllrxf.exec:\1fllrxf.exe39⤵
- Executes dropped EXE
PID:3828 -
\??\c:\bbnnnt.exec:\bbnnnt.exe40⤵
- Executes dropped EXE
PID:4372 -
\??\c:\nnnnnt.exec:\nnnnnt.exe41⤵
- Executes dropped EXE
PID:4624 -
\??\c:\9djvp.exec:\9djvp.exe42⤵
- Executes dropped EXE
PID:4888 -
\??\c:\fflrxfl.exec:\fflrxfl.exe43⤵
- Executes dropped EXE
PID:4028 -
\??\c:\9nhhhn.exec:\9nhhhn.exe44⤵
- Executes dropped EXE
PID:4876 -
\??\c:\jjppp.exec:\jjppp.exe45⤵
- Executes dropped EXE
PID:3144 -
\??\c:\dpddv.exec:\dpddv.exe46⤵
- Executes dropped EXE
PID:2868 -
\??\c:\frfrlrr.exec:\frfrlrr.exe47⤵
- Executes dropped EXE
PID:3688 -
\??\c:\tbnhth.exec:\tbnhth.exe48⤵
- Executes dropped EXE
PID:968 -
\??\c:\vvpjj.exec:\vvpjj.exe49⤵
- Executes dropped EXE
PID:2192 -
\??\c:\7rrlfxr.exec:\7rrlfxr.exe50⤵
- Executes dropped EXE
PID:1640 -
\??\c:\tntttb.exec:\tntttb.exe51⤵
- Executes dropped EXE
PID:4072 -
\??\c:\vvvjp.exec:\vvvjp.exe52⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pdjjj.exec:\pdjjj.exe53⤵
- Executes dropped EXE
PID:4036 -
\??\c:\5rlllrr.exec:\5rlllrr.exe54⤵
- Executes dropped EXE
PID:892 -
\??\c:\bhnntt.exec:\bhnntt.exe55⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pppjp.exec:\pppjp.exe56⤵
- Executes dropped EXE
PID:3668 -
\??\c:\9djvd.exec:\9djvd.exe57⤵
- Executes dropped EXE
PID:3128 -
\??\c:\fxrrffr.exec:\fxrrffr.exe58⤵
- Executes dropped EXE
PID:3752 -
\??\c:\hhhnnn.exec:\hhhnnn.exe59⤵
- Executes dropped EXE
PID:3376 -
\??\c:\hthntn.exec:\hthntn.exe60⤵
- Executes dropped EXE
PID:4300 -
\??\c:\7djjj.exec:\7djjj.exe61⤵
- Executes dropped EXE
PID:1004 -
\??\c:\vjjdp.exec:\vjjdp.exe62⤵
- Executes dropped EXE
PID:3536 -
\??\c:\1flfrrl.exec:\1flfrrl.exe63⤵
- Executes dropped EXE
PID:464 -
\??\c:\5hhhtb.exec:\5hhhtb.exe64⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nnnntt.exec:\nnnntt.exe65⤵
- Executes dropped EXE
PID:5100 -
\??\c:\rrfffll.exec:\rrfffll.exe66⤵PID:3316
-
\??\c:\5xrrlll.exec:\5xrrlll.exe67⤵PID:748
-
\??\c:\hbhbbb.exec:\hbhbbb.exe68⤵PID:4428
-
\??\c:\nbhhhn.exec:\nbhhhn.exe69⤵PID:3108
-
\??\c:\ppdjv.exec:\ppdjv.exe70⤵PID:4224
-
\??\c:\xrflfxx.exec:\xrflfxx.exe71⤵PID:4620
-
\??\c:\fflllrr.exec:\fflllrr.exe72⤵PID:3616
-
\??\c:\hhhhhb.exec:\hhhhhb.exe73⤵PID:4920
-
\??\c:\bbtnnt.exec:\bbtnnt.exe74⤵PID:2152
-
\??\c:\dvdjp.exec:\dvdjp.exe75⤵PID:1632
-
\??\c:\rfllrxf.exec:\rfllrxf.exe76⤵PID:1152
-
\??\c:\flflrxx.exec:\flflrxx.exe77⤵PID:3036
-
\??\c:\1hbhhn.exec:\1hbhhn.exe78⤵PID:2096
-
\??\c:\nbnnbt.exec:\nbnnbt.exe79⤵PID:1880
-
\??\c:\vdppv.exec:\vdppv.exe80⤵PID:4592
-
\??\c:\7frxflx.exec:\7frxflx.exe81⤵PID:916
-
\??\c:\tnbbtt.exec:\tnbbtt.exe82⤵PID:860
-
\??\c:\7bnnnn.exec:\7bnnnn.exe83⤵PID:4120
-
\??\c:\pjvvj.exec:\pjvvj.exe84⤵PID:4216
-
\??\c:\frxffll.exec:\frxffll.exe85⤵PID:3588
-
\??\c:\5hhnbn.exec:\5hhnbn.exe86⤵PID:1584
-
\??\c:\dvddd.exec:\dvddd.exe87⤵PID:4116
-
\??\c:\dvddd.exec:\dvddd.exe88⤵PID:3048
-
\??\c:\llfffll.exec:\llfffll.exe89⤵PID:4840
-
\??\c:\htbbbh.exec:\htbbbh.exe90⤵PID:4372
-
\??\c:\ppvdj.exec:\ppvdj.exe91⤵PID:2056
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe92⤵PID:1384
-
\??\c:\nnttnh.exec:\nnttnh.exe93⤵PID:4596
-
\??\c:\ntnnbh.exec:\ntnnbh.exe94⤵PID:1824
-
\??\c:\pdpjp.exec:\pdpjp.exe95⤵PID:1112
-
\??\c:\vpppv.exec:\vpppv.exe96⤵PID:4200
-
\??\c:\9rlllff.exec:\9rlllff.exe97⤵PID:3600
-
\??\c:\tbhhnt.exec:\tbhhnt.exe98⤵PID:1640
-
\??\c:\hhhttt.exec:\hhhttt.exe99⤵PID:2820
-
\??\c:\jjjvd.exec:\jjjvd.exe100⤵PID:4380
-
\??\c:\pdpvd.exec:\pdpvd.exe101⤵PID:2596
-
\??\c:\lrfxffx.exec:\lrfxffx.exe102⤵PID:1008
-
\??\c:\llfxxxx.exec:\llfxxxx.exe103⤵PID:2068
-
\??\c:\jpvvj.exec:\jpvvj.exe104⤵PID:3116
-
\??\c:\jpdpv.exec:\jpdpv.exe105⤵PID:1744
-
\??\c:\5xxflxr.exec:\5xxflxr.exe106⤵PID:3764
-
\??\c:\7bttnt.exec:\7bttnt.exe107⤵PID:4680
-
\??\c:\thnttt.exec:\thnttt.exe108⤵PID:428
-
\??\c:\ddjpp.exec:\ddjpp.exe109⤵PID:992
-
\??\c:\jdjdj.exec:\jdjdj.exe110⤵PID:3720
-
\??\c:\9jjdd.exec:\9jjdd.exe111⤵PID:3892
-
\??\c:\5vddj.exec:\5vddj.exe112⤵PID:2552
-
\??\c:\xxffxll.exec:\xxffxll.exe113⤵PID:5100
-
\??\c:\bbtnhb.exec:\bbtnhb.exe114⤵PID:4180
-
\??\c:\nthhhh.exec:\nthhhh.exe115⤵PID:376
-
\??\c:\fxxxllf.exec:\fxxxllf.exe116⤵PID:4712
-
\??\c:\1rxrrxr.exec:\1rxrrxr.exe117⤵PID:1120
-
\??\c:\tbhhhh.exec:\tbhhhh.exe118⤵PID:5004
-
\??\c:\1dddd.exec:\1dddd.exe119⤵PID:3616
-
\??\c:\xxfllrr.exec:\xxfllrr.exe120⤵PID:1732
-
\??\c:\llrxrlf.exec:\llrxrlf.exe121⤵PID:2668
-
\??\c:\ntnhhn.exec:\ntnhhn.exe122⤵PID:1948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-