Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 11:03
Behavioral task
behavioral1
Sample
d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe
-
Size
149KB
-
MD5
d2455368ec6b2b8ad238b5f70c7d6b50
-
SHA1
1fced3a52fec3a0d1a8dc27f5957fd05337749e7
-
SHA256
473a143992e66c610e862f0e0ee3a5a5dec6d94524e193628f5920d206d17b38
-
SHA512
333af17b9a8bbebdeeca4fcbebe502fd15b530ca2d06f9728b685cb970a87c49dbbf857128c8a8766536861401fbc05a36b40aafaacc2a4a3aeb240236e5890c
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4t7:kcm4FmowdHoSphraHcpOFltH4t7
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3264-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1268-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2816-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3388-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4280-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4176-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2260-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1416-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-674-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2632-683-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4176-787-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-813-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-846-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-1022-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4788 nbtnhb.exe 4816 7vdpp.exe 992 fxxrlxx.exe 5020 1xfrxfr.exe 4404 bbnnbb.exe 2900 5pvpj.exe 1868 fxlflll.exe 2328 thnhtb.exe 2956 3bhbnb.exe 4384 xffxrlf.exe 2592 hhbnhn.exe 4528 9dvpd.exe 3748 xllfxxr.exe 3716 bhhhtt.exe 5028 dpvvp.exe 3276 fxflfff.exe 2948 hbnhnn.exe 4872 7djjd.exe 3960 vvpjj.exe 4804 xxfxlfx.exe 3532 nbnhtt.exe 2636 ddvvj.exe 1268 3lxrrrx.exe 60 ntbthb.exe 3024 vjdvj.exe 1548 7jppj.exe 1412 9fxrllf.exe 2816 fxfxllr.exe 2316 jjdvp.exe 2224 fllffxr.exe 3740 bnhbtn.exe 3800 3ntttb.exe 3600 vpdvd.exe 3388 rxfrflf.exe 3268 5xxrlll.exe 4864 bnhbtt.exe 4968 9hbtnh.exe 2848 ddpjd.exe 1604 lxxrllf.exe 1236 rlfxrlf.exe 4280 btnhbh.exe 3264 7ppjv.exe 3300 3ffxrrl.exe 4816 xlfxxrr.exe 736 hhtnhh.exe 756 pvdvj.exe 1820 jddvv.exe 5092 fxxxxxr.exe 3012 tntnhh.exe 5004 5bhbhh.exe 4936 pjdpv.exe 2180 3pvpj.exe 4624 xxxlrrr.exe 4384 hhbhbb.exe 4596 tntnbt.exe 1072 pddvd.exe 4392 5dpjv.exe 2344 7lfxrll.exe 3040 xllfxrl.exe 5024 thnhnh.exe 2100 jddpp.exe 4576 7vpjp.exe 1956 xffxrlf.exe 4644 tttnhn.exe -
resource yara_rule behavioral2/memory/3264-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-5.dat upx behavioral2/memory/3264-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4788-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023406-10.dat upx behavioral2/memory/4788-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-14.dat upx behavioral2/memory/4816-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-22.dat upx behavioral2/memory/5020-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5020-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-30.dat upx behavioral2/files/0x000700000002340e-34.dat upx behavioral2/memory/4404-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2900-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-41.dat upx behavioral2/memory/1868-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-47.dat upx behavioral2/memory/2328-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2328-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-53.dat upx behavioral2/files/0x0007000000023412-59.dat upx behavioral2/memory/2956-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-65.dat upx behavioral2/memory/2592-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-71.dat upx behavioral2/memory/2592-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-77.dat upx behavioral2/memory/4528-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-83.dat upx behavioral2/memory/3748-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-89.dat upx behavioral2/files/0x0007000000023418-96.dat upx behavioral2/memory/5028-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3276-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-101.dat upx behavioral2/memory/3276-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-106.dat upx behavioral2/memory/4872-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-113.dat upx behavioral2/files/0x000700000002341c-117.dat upx behavioral2/files/0x000700000002341d-122.dat upx behavioral2/memory/4804-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-128.dat upx behavioral2/files/0x000700000002341f-134.dat upx behavioral2/memory/2636-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1268-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-140.dat upx behavioral2/memory/60-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-147.dat upx behavioral2/files/0x0007000000023423-151.dat upx behavioral2/memory/1548-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023407-158.dat upx behavioral2/memory/1412-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-164.dat upx behavioral2/memory/2816-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-168.dat upx behavioral2/files/0x0007000000023426-174.dat upx behavioral2/memory/2316-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2224-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-181.dat upx behavioral2/memory/3740-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-187.dat upx behavioral2/memory/3600-193-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3264 wrote to memory of 4788 3264 d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe 82 PID 3264 wrote to memory of 4788 3264 d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe 82 PID 3264 wrote to memory of 4788 3264 d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe 82 PID 4788 wrote to memory of 4816 4788 nbtnhb.exe 83 PID 4788 wrote to memory of 4816 4788 nbtnhb.exe 83 PID 4788 wrote to memory of 4816 4788 nbtnhb.exe 83 PID 4816 wrote to memory of 992 4816 7vdpp.exe 84 PID 4816 wrote to memory of 992 4816 7vdpp.exe 84 PID 4816 wrote to memory of 992 4816 7vdpp.exe 84 PID 992 wrote to memory of 5020 992 fxxrlxx.exe 85 PID 992 wrote to memory of 5020 992 fxxrlxx.exe 85 PID 992 wrote to memory of 5020 992 fxxrlxx.exe 85 PID 5020 wrote to memory of 4404 5020 1xfrxfr.exe 86 PID 5020 wrote to memory of 4404 5020 1xfrxfr.exe 86 PID 5020 wrote to memory of 4404 5020 1xfrxfr.exe 86 PID 4404 wrote to memory of 2900 4404 bbnnbb.exe 87 PID 4404 wrote to memory of 2900 4404 bbnnbb.exe 87 PID 4404 wrote to memory of 2900 4404 bbnnbb.exe 87 PID 2900 wrote to memory of 1868 2900 5pvpj.exe 88 PID 2900 wrote to memory of 1868 2900 5pvpj.exe 88 PID 2900 wrote to memory of 1868 2900 5pvpj.exe 88 PID 1868 wrote to memory of 2328 1868 fxlflll.exe 89 PID 1868 wrote to memory of 2328 1868 fxlflll.exe 89 PID 1868 wrote to memory of 2328 1868 fxlflll.exe 89 PID 2328 wrote to memory of 2956 2328 thnhtb.exe 90 PID 2328 wrote to memory of 2956 2328 thnhtb.exe 90 PID 2328 wrote to memory of 2956 2328 thnhtb.exe 90 PID 2956 wrote to memory of 4384 2956 3bhbnb.exe 91 PID 2956 wrote to memory of 4384 2956 3bhbnb.exe 91 PID 2956 wrote to memory of 4384 2956 3bhbnb.exe 91 PID 4384 wrote to memory of 2592 4384 xffxrlf.exe 92 PID 4384 wrote to memory of 2592 4384 xffxrlf.exe 92 PID 4384 wrote to memory of 2592 4384 xffxrlf.exe 92 PID 2592 wrote to memory of 4528 2592 hhbnhn.exe 93 PID 2592 wrote to memory of 4528 2592 hhbnhn.exe 93 PID 2592 wrote to memory of 4528 2592 hhbnhn.exe 93 PID 4528 wrote to memory of 3748 4528 9dvpd.exe 95 PID 4528 wrote to memory of 3748 4528 9dvpd.exe 95 PID 4528 wrote to memory of 3748 4528 9dvpd.exe 95 PID 3748 wrote to memory of 3716 3748 xllfxxr.exe 96 PID 3748 wrote to memory of 3716 3748 xllfxxr.exe 96 PID 3748 wrote to memory of 3716 3748 xllfxxr.exe 96 PID 3716 wrote to memory of 5028 3716 bhhhtt.exe 97 PID 3716 wrote to memory of 5028 3716 bhhhtt.exe 97 PID 3716 wrote to memory of 5028 3716 bhhhtt.exe 97 PID 5028 wrote to memory of 3276 5028 dpvvp.exe 98 PID 5028 wrote to memory of 3276 5028 dpvvp.exe 98 PID 5028 wrote to memory of 3276 5028 dpvvp.exe 98 PID 3276 wrote to memory of 2948 3276 fxflfff.exe 99 PID 3276 wrote to memory of 2948 3276 fxflfff.exe 99 PID 3276 wrote to memory of 2948 3276 fxflfff.exe 99 PID 2948 wrote to memory of 4872 2948 hbnhnn.exe 100 PID 2948 wrote to memory of 4872 2948 hbnhnn.exe 100 PID 2948 wrote to memory of 4872 2948 hbnhnn.exe 100 PID 4872 wrote to memory of 3960 4872 7djjd.exe 101 PID 4872 wrote to memory of 3960 4872 7djjd.exe 101 PID 4872 wrote to memory of 3960 4872 7djjd.exe 101 PID 3960 wrote to memory of 4804 3960 vvpjj.exe 102 PID 3960 wrote to memory of 4804 3960 vvpjj.exe 102 PID 3960 wrote to memory of 4804 3960 vvpjj.exe 102 PID 4804 wrote to memory of 3532 4804 xxfxlfx.exe 103 PID 4804 wrote to memory of 3532 4804 xxfxlfx.exe 103 PID 4804 wrote to memory of 3532 4804 xxfxlfx.exe 103 PID 3532 wrote to memory of 2636 3532 nbnhtt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d2455368ec6b2b8ad238b5f70c7d6b50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\nbtnhb.exec:\nbtnhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\7vdpp.exec:\7vdpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\fxxrlxx.exec:\fxxrlxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\1xfrxfr.exec:\1xfrxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\bbnnbb.exec:\bbnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\5pvpj.exec:\5pvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\fxlflll.exec:\fxlflll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\thnhtb.exec:\thnhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\3bhbnb.exec:\3bhbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\xffxrlf.exec:\xffxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\hhbnhn.exec:\hhbnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\9dvpd.exec:\9dvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\xllfxxr.exec:\xllfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\bhhhtt.exec:\bhhhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\dpvvp.exec:\dpvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\fxflfff.exec:\fxflfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\hbnhnn.exec:\hbnhnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\7djjd.exec:\7djjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\vvpjj.exec:\vvpjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\xxfxlfx.exec:\xxfxlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\nbnhtt.exec:\nbnhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\ddvvj.exec:\ddvvj.exe23⤵
- Executes dropped EXE
PID:2636 -
\??\c:\3lxrrrx.exec:\3lxrrrx.exe24⤵
- Executes dropped EXE
PID:1268 -
\??\c:\ntbthb.exec:\ntbthb.exe25⤵
- Executes dropped EXE
PID:60 -
\??\c:\vjdvj.exec:\vjdvj.exe26⤵
- Executes dropped EXE
PID:3024 -
\??\c:\7jppj.exec:\7jppj.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\9fxrllf.exec:\9fxrllf.exe28⤵
- Executes dropped EXE
PID:1412 -
\??\c:\fxfxllr.exec:\fxfxllr.exe29⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jjdvp.exec:\jjdvp.exe30⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fllffxr.exec:\fllffxr.exe31⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bnhbtn.exec:\bnhbtn.exe32⤵
- Executes dropped EXE
PID:3740 -
\??\c:\3ntttb.exec:\3ntttb.exe33⤵
- Executes dropped EXE
PID:3800 -
\??\c:\vpdvd.exec:\vpdvd.exe34⤵
- Executes dropped EXE
PID:3600 -
\??\c:\rxfrflf.exec:\rxfrflf.exe35⤵
- Executes dropped EXE
PID:3388 -
\??\c:\5xxrlll.exec:\5xxrlll.exe36⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bnhbtt.exec:\bnhbtt.exe37⤵
- Executes dropped EXE
PID:4864 -
\??\c:\9hbtnh.exec:\9hbtnh.exe38⤵
- Executes dropped EXE
PID:4968 -
\??\c:\ddpjd.exec:\ddpjd.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lxxrllf.exec:\lxxrllf.exe40⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe41⤵
- Executes dropped EXE
PID:1236 -
\??\c:\btnhbh.exec:\btnhbh.exe42⤵
- Executes dropped EXE
PID:4280 -
\??\c:\7ppjv.exec:\7ppjv.exe43⤵
- Executes dropped EXE
PID:3264 -
\??\c:\3ffxrrl.exec:\3ffxrrl.exe44⤵
- Executes dropped EXE
PID:3300 -
\??\c:\xlfxxrr.exec:\xlfxxrr.exe45⤵
- Executes dropped EXE
PID:4816 -
\??\c:\hhtnhh.exec:\hhtnhh.exe46⤵
- Executes dropped EXE
PID:736 -
\??\c:\pvdvj.exec:\pvdvj.exe47⤵
- Executes dropped EXE
PID:756 -
\??\c:\jddvv.exec:\jddvv.exe48⤵
- Executes dropped EXE
PID:1820 -
\??\c:\fxxxxxr.exec:\fxxxxxr.exe49⤵
- Executes dropped EXE
PID:5092 -
\??\c:\tntnhh.exec:\tntnhh.exe50⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5bhbhh.exec:\5bhbhh.exe51⤵
- Executes dropped EXE
PID:5004 -
\??\c:\pjdpv.exec:\pjdpv.exe52⤵
- Executes dropped EXE
PID:4936 -
\??\c:\3pvpj.exec:\3pvpj.exe53⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xxxlrrr.exec:\xxxlrrr.exe54⤵
- Executes dropped EXE
PID:4624 -
\??\c:\hhbhbb.exec:\hhbhbb.exe55⤵
- Executes dropped EXE
PID:4384 -
\??\c:\tntnbt.exec:\tntnbt.exe56⤵
- Executes dropped EXE
PID:4596 -
\??\c:\pddvd.exec:\pddvd.exe57⤵
- Executes dropped EXE
PID:1072 -
\??\c:\5dpjv.exec:\5dpjv.exe58⤵
- Executes dropped EXE
PID:4392 -
\??\c:\7lfxrll.exec:\7lfxrll.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xllfxrl.exec:\xllfxrl.exe60⤵
- Executes dropped EXE
PID:3040 -
\??\c:\thnhnh.exec:\thnhnh.exe61⤵
- Executes dropped EXE
PID:5024 -
\??\c:\jddpp.exec:\jddpp.exe62⤵
- Executes dropped EXE
PID:2100 -
\??\c:\7vpjp.exec:\7vpjp.exe63⤵
- Executes dropped EXE
PID:4576 -
\??\c:\xffxrlf.exec:\xffxrlf.exe64⤵
- Executes dropped EXE
PID:1956 -
\??\c:\tttnhn.exec:\tttnhn.exe65⤵
- Executes dropped EXE
PID:4644 -
\??\c:\jdjvp.exec:\jdjvp.exe66⤵PID:3412
-
\??\c:\jdvpj.exec:\jdvpj.exe67⤵PID:3960
-
\??\c:\lfxfxlf.exec:\lfxfxlf.exe68⤵PID:1768
-
\??\c:\nnbbtt.exec:\nnbbtt.exe69⤵PID:220
-
\??\c:\tnbtnn.exec:\tnbtnn.exe70⤵PID:5060
-
\??\c:\pvdpp.exec:\pvdpp.exe71⤵PID:2636
-
\??\c:\ddddv.exec:\ddddv.exe72⤵PID:2156
-
\??\c:\7fxxrrx.exec:\7fxxrrx.exe73⤵PID:60
-
\??\c:\lrflrxf.exec:\lrflrxf.exe74⤵PID:2256
-
\??\c:\vvppp.exec:\vvppp.exe75⤵PID:2040
-
\??\c:\dpppp.exec:\dpppp.exe76⤵PID:3208
-
\??\c:\pvpjj.exec:\pvpjj.exe77⤵PID:4176
-
\??\c:\rrllxxl.exec:\rrllxxl.exe78⤵PID:3292
-
\??\c:\tttttn.exec:\tttttn.exe79⤵PID:4840
-
\??\c:\bntbbb.exec:\bntbbb.exe80⤵PID:2552
-
\??\c:\djppp.exec:\djppp.exe81⤵PID:776
-
\??\c:\llxlrrx.exec:\llxlrrx.exe82⤵PID:4932
-
\??\c:\hnbnbb.exec:\hnbnbb.exe83⤵PID:2932
-
\??\c:\jvjjj.exec:\jvjjj.exe84⤵PID:3800
-
\??\c:\vvddd.exec:\vvddd.exe85⤵PID:4072
-
\??\c:\lrlrffl.exec:\lrlrffl.exe86⤵PID:3388
-
\??\c:\lflffff.exec:\lflffff.exe87⤵PID:3140
-
\??\c:\nbnnhh.exec:\nbnnhh.exe88⤵PID:432
-
\??\c:\htbhbb.exec:\htbhbb.exe89⤵PID:1392
-
\??\c:\ppvvv.exec:\ppvvv.exe90⤵PID:4048
-
\??\c:\fflfxff.exec:\fflfxff.exe91⤵PID:1604
-
\??\c:\rxxxxfx.exec:\rxxxxfx.exe92⤵PID:2044
-
\??\c:\btbbhh.exec:\btbbhh.exe93⤵PID:1976
-
\??\c:\5vddj.exec:\5vddj.exe94⤵PID:4028
-
\??\c:\lxxrfff.exec:\lxxrfff.exe95⤵PID:1180
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe96⤵PID:4248
-
\??\c:\nhhbhh.exec:\nhhbhh.exe97⤵PID:2260
-
\??\c:\ppvvv.exec:\ppvvv.exe98⤵PID:3488
-
\??\c:\vpvjd.exec:\vpvjd.exe99⤵PID:3152
-
\??\c:\7xrlrrr.exec:\7xrlrrr.exe100⤵PID:4952
-
\??\c:\bnnhbt.exec:\bnnhbt.exe101⤵PID:1616
-
\??\c:\hnnhbt.exec:\hnnhbt.exe102⤵PID:4208
-
\??\c:\pjjpp.exec:\pjjpp.exe103⤵PID:2328
-
\??\c:\vdjdp.exec:\vdjdp.exe104⤵PID:1524
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe105⤵PID:2668
-
\??\c:\5rfxxrl.exec:\5rfxxrl.exe106⤵PID:2524
-
\??\c:\7bhbth.exec:\7bhbth.exe107⤵PID:2452
-
\??\c:\vppjd.exec:\vppjd.exe108⤵PID:4384
-
\??\c:\jpdpd.exec:\jpdpd.exe109⤵PID:4596
-
\??\c:\frrfxlf.exec:\frrfxlf.exe110⤵PID:5000
-
\??\c:\9lllfxr.exec:\9lllfxr.exe111⤵PID:3748
-
\??\c:\1hnhhb.exec:\1hnhhb.exe112⤵PID:3236
-
\??\c:\nhnhbh.exec:\nhnhbh.exe113⤵PID:3716
-
\??\c:\pjddp.exec:\pjddp.exe114⤵PID:3016
-
\??\c:\jpddd.exec:\jpddd.exe115⤵PID:2100
-
\??\c:\fffxllf.exec:\fffxllf.exe116⤵PID:2948
-
\??\c:\htbbtt.exec:\htbbtt.exe117⤵PID:552
-
\??\c:\ttttnh.exec:\ttttnh.exe118⤵PID:4564
-
\??\c:\1vjvp.exec:\1vjvp.exe119⤵PID:2032
-
\??\c:\ddvjd.exec:\ddvjd.exe120⤵PID:1608
-
\??\c:\rllfxrl.exec:\rllfxrl.exe121⤵PID:2676
-
\??\c:\1tbtbb.exec:\1tbtbb.exe122⤵PID:4076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-