Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 18:23
Behavioral task
behavioral1
Sample
b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe
-
Size
441KB
-
MD5
b6227b51478fc50c793c1097f9a25270
-
SHA1
3cc4c3e0c12515ffe4a2b48934db399039ba516a
-
SHA256
004ab26c1eee3145a14af87d783262944abb7fd17de982d202e44f046a13c58c
-
SHA512
151b11fe654b43b815c7ec4fe8f6f60ec8073fcb75fa50348a12e94db63779b69bcf14e099973ec5b268f12108e9aea858697675e5d42b1b41bb7cb26a562cb9
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wluz:UrR/nPs
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/644-10-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4400-9-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1612-32-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5100-34-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4104-39-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5064-61-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3440-415-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5032-427-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2696-438-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5072-446-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4796-472-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2928-489-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1960-536-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4204-569-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3208-561-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/816-558-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2172-551-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1508-543-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3912-540-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1408-532-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2760-525-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3372-521-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4808-516-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4856-513-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3908-509-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3956-505-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2960-500-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4056-496-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3872-493-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4640-485-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4724-480-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4448-477-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1316-468-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1368-465-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2596-458-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1728-453-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4616-450-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2872-442-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1000-433-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3820-423-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2236-419-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/860-411-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4524-406-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3196-397-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1216-392-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1456-383-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3372-364-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1836-351-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1480-344-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1668-340-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1920-332-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2456-308-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4880-297-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4052-287-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3980-277-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/680-264-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1560-260-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2428-244-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2912-240-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4204-233-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/440-229-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4648-225-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3104-218-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2084-214-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4400 flxxxrx.exe 3176 3bbbnt.exe 4496 thhthb.exe 5100 dppjj.exe 1612 rllllrx.exe 4104 htthht.exe 512 jvppp.exe 5064 xrffrxl.exe 3612 htntbb.exe 1384 vddvp.exe 3820 djpjj.exe 1872 rfrlllf.exe 4156 btthhn.exe 4984 htnntt.exe 2696 pdppp.exe 2752 xrrxxlx.exe 1344 bnhhbt.exe 2528 7dddd.exe 3616 vvddd.exe 3248 rlllxxl.exe 5052 bbhtbb.exe 1460 ddvvd.exe 3908 1ddpd.exe 4856 7fffrff.exe 3628 tttbht.exe 4452 jjjjp.exe 3076 lxxrllf.exe 4084 xfxxlfx.exe 4672 bhbbbb.exe 1480 7dppj.exe 1956 llffffl.exe 2960 rxlrlxf.exe 2560 tbbbhh.exe 4488 3dvpp.exe 820 fxrrrxx.exe 2084 thnhhh.exe 3104 pjvvj.exe 4660 jpddd.exe 4648 frrllll.exe 440 hnnhbh.exe 4204 djppj.exe 4404 ffllrrx.exe 2912 9httnn.exe 2428 pjvjd.exe 3580 3jpjd.exe 1268 xffflfr.exe 3196 bbbhbb.exe 3384 pjvvd.exe 1560 rfxxrrl.exe 680 7ntttt.exe 3804 djjdp.exe 4480 xfxrlrl.exe 2988 rfxxrrf.exe 3980 nhhbtt.exe 2240 1pdvp.exe 4432 fllxxxr.exe 4052 nbhbbt.exe 2888 3nnhbb.exe 4984 jvvvp.exe 4880 lllxxrl.exe 2176 ntntbt.exe 4136 pvvjv.exe 2456 fllxrrl.exe 3248 hbtttb.exe -
resource yara_rule behavioral2/memory/644-0-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/files/0x0008000000023402-12.dat upx behavioral2/memory/3176-13-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/644-10-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4400-9-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023407-14.dat upx behavioral2/memory/4496-20-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023408-23.dat upx behavioral2/files/0x0007000000023409-29.dat upx behavioral2/memory/1612-32-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5100-34-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002340a-38.dat upx behavioral2/memory/4104-39-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002340b-45.dat upx behavioral2/memory/5064-61-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002340f-70.dat upx behavioral2/files/0x0007000000023414-100.dat upx behavioral2/files/0x0007000000023417-118.dat upx behavioral2/files/0x000700000002341a-134.dat upx behavioral2/files/0x0007000000023422-181.dat upx behavioral2/memory/3440-415-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5032-427-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2696-438-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5072-446-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4796-472-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2928-489-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1960-536-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4204-569-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3208-561-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/816-558-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2172-551-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1508-543-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3912-540-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1408-532-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2760-525-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3372-521-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4808-516-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4856-513-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3908-509-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3956-505-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2960-500-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4056-496-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3872-493-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4640-485-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4724-480-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4448-477-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1316-468-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1368-465-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2596-458-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1728-453-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4616-450-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2872-442-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1000-433-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3820-423-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2236-419-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/860-411-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4524-406-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3196-397-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1216-392-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1456-383-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3372-364-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1836-351-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1480-344-0x0000000000400000-0x000000000048C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 644 wrote to memory of 4400 644 b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe 83 PID 644 wrote to memory of 4400 644 b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe 83 PID 644 wrote to memory of 4400 644 b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe 83 PID 4400 wrote to memory of 3176 4400 flxxxrx.exe 84 PID 4400 wrote to memory of 3176 4400 flxxxrx.exe 84 PID 4400 wrote to memory of 3176 4400 flxxxrx.exe 84 PID 3176 wrote to memory of 4496 3176 3bbbnt.exe 85 PID 3176 wrote to memory of 4496 3176 3bbbnt.exe 85 PID 3176 wrote to memory of 4496 3176 3bbbnt.exe 85 PID 4496 wrote to memory of 5100 4496 thhthb.exe 86 PID 4496 wrote to memory of 5100 4496 thhthb.exe 86 PID 4496 wrote to memory of 5100 4496 thhthb.exe 86 PID 5100 wrote to memory of 1612 5100 dppjj.exe 87 PID 5100 wrote to memory of 1612 5100 dppjj.exe 87 PID 5100 wrote to memory of 1612 5100 dppjj.exe 87 PID 1612 wrote to memory of 4104 1612 rllllrx.exe 88 PID 1612 wrote to memory of 4104 1612 rllllrx.exe 88 PID 1612 wrote to memory of 4104 1612 rllllrx.exe 88 PID 4104 wrote to memory of 512 4104 htthht.exe 89 PID 4104 wrote to memory of 512 4104 htthht.exe 89 PID 4104 wrote to memory of 512 4104 htthht.exe 89 PID 512 wrote to memory of 5064 512 jvppp.exe 90 PID 512 wrote to memory of 5064 512 jvppp.exe 90 PID 512 wrote to memory of 5064 512 jvppp.exe 90 PID 5064 wrote to memory of 3612 5064 xrffrxl.exe 91 PID 5064 wrote to memory of 3612 5064 xrffrxl.exe 91 PID 5064 wrote to memory of 3612 5064 xrffrxl.exe 91 PID 3612 wrote to memory of 1384 3612 htntbb.exe 92 PID 3612 wrote to memory of 1384 3612 htntbb.exe 92 PID 3612 wrote to memory of 1384 3612 htntbb.exe 92 PID 1384 wrote to memory of 3820 1384 vddvp.exe 93 PID 1384 wrote to memory of 3820 1384 vddvp.exe 93 PID 1384 wrote to memory of 3820 1384 vddvp.exe 93 PID 3820 wrote to memory of 1872 3820 djpjj.exe 237 PID 3820 wrote to memory of 1872 3820 djpjj.exe 237 PID 3820 wrote to memory of 1872 3820 djpjj.exe 237 PID 1872 wrote to memory of 4156 1872 rfrlllf.exe 95 PID 1872 wrote to memory of 4156 1872 rfrlllf.exe 95 PID 1872 wrote to memory of 4156 1872 rfrlllf.exe 95 PID 4156 wrote to memory of 4984 4156 btthhn.exe 96 PID 4156 wrote to memory of 4984 4156 btthhn.exe 96 PID 4156 wrote to memory of 4984 4156 btthhn.exe 96 PID 4984 wrote to memory of 2696 4984 htnntt.exe 97 PID 4984 wrote to memory of 2696 4984 htnntt.exe 97 PID 4984 wrote to memory of 2696 4984 htnntt.exe 97 PID 2696 wrote to memory of 2752 2696 pdppp.exe 98 PID 2696 wrote to memory of 2752 2696 pdppp.exe 98 PID 2696 wrote to memory of 2752 2696 pdppp.exe 98 PID 2752 wrote to memory of 1344 2752 xrrxxlx.exe 99 PID 2752 wrote to memory of 1344 2752 xrrxxlx.exe 99 PID 2752 wrote to memory of 1344 2752 xrrxxlx.exe 99 PID 1344 wrote to memory of 2528 1344 bnhhbt.exe 100 PID 1344 wrote to memory of 2528 1344 bnhhbt.exe 100 PID 1344 wrote to memory of 2528 1344 bnhhbt.exe 100 PID 2528 wrote to memory of 3616 2528 7dddd.exe 101 PID 2528 wrote to memory of 3616 2528 7dddd.exe 101 PID 2528 wrote to memory of 3616 2528 7dddd.exe 101 PID 3616 wrote to memory of 3248 3616 vvddd.exe 102 PID 3616 wrote to memory of 3248 3616 vvddd.exe 102 PID 3616 wrote to memory of 3248 3616 vvddd.exe 102 PID 3248 wrote to memory of 5052 3248 rlllxxl.exe 103 PID 3248 wrote to memory of 5052 3248 rlllxxl.exe 103 PID 3248 wrote to memory of 5052 3248 rlllxxl.exe 103 PID 5052 wrote to memory of 1460 5052 bbhtbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b6227b51478fc50c793c1097f9a25270_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\flxxxrx.exec:\flxxxrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\3bbbnt.exec:\3bbbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\thhthb.exec:\thhthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\dppjj.exec:\dppjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\rllllrx.exec:\rllllrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\htthht.exec:\htthht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\jvppp.exec:\jvppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\xrffrxl.exec:\xrffrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\htntbb.exec:\htntbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\vddvp.exec:\vddvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\djpjj.exec:\djpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\rfrlllf.exec:\rfrlllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\btthhn.exec:\btthhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\htnntt.exec:\htnntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\pdppp.exec:\pdppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xrrxxlx.exec:\xrrxxlx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\bnhhbt.exec:\bnhhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\7dddd.exec:\7dddd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vvddd.exec:\vvddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\rlllxxl.exec:\rlllxxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\bbhtbb.exec:\bbhtbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\ddvvd.exec:\ddvvd.exe23⤵
- Executes dropped EXE
PID:1460 -
\??\c:\1ddpd.exec:\1ddpd.exe24⤵
- Executes dropped EXE
PID:3908 -
\??\c:\7fffrff.exec:\7fffrff.exe25⤵
- Executes dropped EXE
PID:4856 -
\??\c:\tttbht.exec:\tttbht.exe26⤵
- Executes dropped EXE
PID:3628 -
\??\c:\jjjjp.exec:\jjjjp.exe27⤵
- Executes dropped EXE
PID:4452 -
\??\c:\lxxrllf.exec:\lxxrllf.exe28⤵
- Executes dropped EXE
PID:3076 -
\??\c:\xfxxlfx.exec:\xfxxlfx.exe29⤵
- Executes dropped EXE
PID:4084 -
\??\c:\bhbbbb.exec:\bhbbbb.exe30⤵
- Executes dropped EXE
PID:4672 -
\??\c:\7dppj.exec:\7dppj.exe31⤵
- Executes dropped EXE
PID:1480 -
\??\c:\llffffl.exec:\llffffl.exe32⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rxlrlxf.exec:\rxlrlxf.exe33⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tbbbhh.exec:\tbbbhh.exe34⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3dvpp.exec:\3dvpp.exe35⤵
- Executes dropped EXE
PID:4488 -
\??\c:\fxrrrxx.exec:\fxrrrxx.exe36⤵
- Executes dropped EXE
PID:820 -
\??\c:\thnhhh.exec:\thnhhh.exe37⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pjvvj.exec:\pjvvj.exe38⤵
- Executes dropped EXE
PID:3104 -
\??\c:\jpddd.exec:\jpddd.exe39⤵
- Executes dropped EXE
PID:4660 -
\??\c:\frrllll.exec:\frrllll.exe40⤵
- Executes dropped EXE
PID:4648 -
\??\c:\hnnhbh.exec:\hnnhbh.exe41⤵
- Executes dropped EXE
PID:440 -
\??\c:\djppj.exec:\djppj.exe42⤵
- Executes dropped EXE
PID:4204 -
\??\c:\ffllrrx.exec:\ffllrrx.exe43⤵
- Executes dropped EXE
PID:4404 -
\??\c:\9httnn.exec:\9httnn.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pjvjd.exec:\pjvjd.exe45⤵
- Executes dropped EXE
PID:2428 -
\??\c:\3jpjd.exec:\3jpjd.exe46⤵
- Executes dropped EXE
PID:3580 -
\??\c:\xffflfr.exec:\xffflfr.exe47⤵
- Executes dropped EXE
PID:1268 -
\??\c:\bbbhbb.exec:\bbbhbb.exe48⤵
- Executes dropped EXE
PID:3196 -
\??\c:\pjvvd.exec:\pjvvd.exe49⤵
- Executes dropped EXE
PID:3384 -
\??\c:\rfxxrrl.exec:\rfxxrrl.exe50⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7ntttt.exec:\7ntttt.exe51⤵
- Executes dropped EXE
PID:680 -
\??\c:\djjdp.exec:\djjdp.exe52⤵
- Executes dropped EXE
PID:3804 -
\??\c:\xfxrlrl.exec:\xfxrlrl.exe53⤵
- Executes dropped EXE
PID:4480 -
\??\c:\rfxxrrf.exec:\rfxxrrf.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nhhbtt.exec:\nhhbtt.exe55⤵
- Executes dropped EXE
PID:3980 -
\??\c:\1pdvp.exec:\1pdvp.exe56⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fllxxxr.exec:\fllxxxr.exe57⤵
- Executes dropped EXE
PID:4432 -
\??\c:\nbhbbt.exec:\nbhbbt.exe58⤵
- Executes dropped EXE
PID:4052 -
\??\c:\3nnhbb.exec:\3nnhbb.exe59⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jvvvp.exec:\jvvvp.exe60⤵
- Executes dropped EXE
PID:4984 -
\??\c:\lllxxrl.exec:\lllxxrl.exe61⤵
- Executes dropped EXE
PID:4880 -
\??\c:\ntntbt.exec:\ntntbt.exe62⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pvvjv.exec:\pvvjv.exe63⤵
- Executes dropped EXE
PID:4136 -
\??\c:\fllxrrl.exec:\fllxrrl.exe64⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hbtttb.exec:\hbtttb.exe65⤵
- Executes dropped EXE
PID:3248 -
\??\c:\tthbnh.exec:\tthbnh.exe66⤵PID:3388
-
\??\c:\ddddv.exec:\ddddv.exe67⤵PID:1316
-
\??\c:\lfflfxr.exec:\lfflfxr.exe68⤵PID:2704
-
\??\c:\5ttnhh.exec:\5ttnhh.exe69⤵PID:3292
-
\??\c:\jjjpj.exec:\jjjpj.exe70⤵PID:3656
-
\??\c:\rfllrrl.exec:\rfllrrl.exe71⤵PID:2836
-
\??\c:\llxrlfx.exec:\llxrlfx.exe72⤵PID:1920
-
\??\c:\nhhbbn.exec:\nhhbbn.exe73⤵PID:2052
-
\??\c:\pvvvp.exec:\pvvvp.exe74⤵PID:1668
-
\??\c:\5fxrllf.exec:\5fxrllf.exe75⤵PID:1480
-
\??\c:\lfflfrr.exec:\lfflfrr.exe76⤵PID:1956
-
\??\c:\btttnh.exec:\btttnh.exe77⤵PID:1836
-
\??\c:\jpddd.exec:\jpddd.exe78⤵PID:2996
-
\??\c:\7pppp.exec:\7pppp.exe79⤵PID:3620
-
\??\c:\rxfffll.exec:\rxfffll.exe80⤵PID:2084
-
\??\c:\tnhhhb.exec:\tnhhhb.exe81⤵PID:3372
-
\??\c:\dddjp.exec:\dddjp.exe82⤵PID:1992
-
\??\c:\7rfxxxx.exec:\7rfxxxx.exe83⤵PID:3900
-
\??\c:\xfrrffr.exec:\xfrrffr.exe84⤵PID:1408
-
\??\c:\btbhtn.exec:\btbhtn.exe85⤵PID:1960
-
\??\c:\1pjpv.exec:\1pjpv.exe86⤵PID:3564
-
\??\c:\flflfrf.exec:\flflfrf.exe87⤵PID:1456
-
\??\c:\7nhbhh.exec:\7nhbhh.exe88⤵PID:2428
-
\??\c:\nhntnn.exec:\nhntnn.exe89⤵PID:3476
-
\??\c:\ddddd.exec:\ddddd.exe90⤵PID:1216
-
\??\c:\xrrrrfl.exec:\xrrrrfl.exe91⤵PID:3196
-
\??\c:\lrxxxxf.exec:\lrxxxxf.exe92⤵PID:3380
-
\??\c:\3httth.exec:\3httth.exe93⤵PID:1852
-
\??\c:\jpvdd.exec:\jpvdd.exe94⤵PID:4524
-
\??\c:\ddjdv.exec:\ddjdv.exe95⤵PID:860
-
\??\c:\rrrrrxr.exec:\rrrrrxr.exe96⤵PID:3440
-
\??\c:\bhhhnn.exec:\bhhhnn.exe97⤵PID:2236
-
\??\c:\djjpj.exec:\djjpj.exe98⤵PID:3820
-
\??\c:\pjvpp.exec:\pjvpp.exe99⤵PID:5032
-
\??\c:\fxrrrff.exec:\fxrrrff.exe100⤵PID:4208
-
\??\c:\1bnhhn.exec:\1bnhhn.exe101⤵PID:1000
-
\??\c:\jvdvv.exec:\jvdvv.exe102⤵PID:2696
-
\??\c:\jddjv.exec:\jddjv.exe103⤵PID:2872
-
\??\c:\lxrrlrr.exec:\lxrrlrr.exe104⤵PID:5072
-
\??\c:\bbnbhb.exec:\bbnbhb.exe105⤵PID:4616
-
\??\c:\bntthb.exec:\bntthb.exe106⤵PID:1728
-
\??\c:\9vvvp.exec:\9vvvp.exe107⤵PID:2596
-
\??\c:\1frllfr.exec:\1frllfr.exe108⤵PID:1528
-
\??\c:\nhnntn.exec:\nhnntn.exe109⤵PID:1368
-
\??\c:\vpppp.exec:\vpppp.exe110⤵PID:1316
-
\??\c:\1pddv.exec:\1pddv.exe111⤵PID:4796
-
\??\c:\xrrrlll.exec:\xrrrlll.exe112⤵PID:4448
-
\??\c:\nnhbnn.exec:\nnhbnn.exe113⤵PID:4724
-
\??\c:\3bhhnt.exec:\3bhhnt.exe114⤵PID:4640
-
\??\c:\ddddv.exec:\ddddv.exe115⤵PID:2928
-
\??\c:\xflllll.exec:\xflllll.exe116⤵PID:3872
-
\??\c:\bthhtb.exec:\bthhtb.exe117⤵PID:4056
-
\??\c:\bbnhnn.exec:\bbnhnn.exe118⤵PID:2960
-
\??\c:\vdppv.exec:\vdppv.exe119⤵PID:3956
-
\??\c:\3rffrxl.exec:\3rffrxl.exe120⤵PID:3908
-
\??\c:\xxrrfff.exec:\xxrrfff.exe121⤵PID:4856
-
\??\c:\bbnbhh.exec:\bbnbhh.exe122⤵PID:4808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-