Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 18:01
Behavioral task
behavioral1
Sample
0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe
-
Size
400KB
-
MD5
0796a93ef6c63cdacc00d4f1e15442a0
-
SHA1
c99e9e53e241a149f0cb18d1a21df95d1275207c
-
SHA256
c83151cb9efce4dd25d26f27ba613ba4b1a55e95db6cd40ae198bb48d298b0a1
-
SHA512
c09fa5a7f4240600ae6df433c1f1579a69b9e72e7683cde9e5d83200d93032073bbc8449f01551636c5fcb3c0a7ebea732079f2f0be3df7f6c779a48cc4d4d03
-
SSDEEP
6144:Jcm4FmowdHoSEubDcAkOCOu0EajNVBZr6y2WXxLO1UqW9E3R:T4wFHoSEubD2P3R
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2392-5-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3480-11-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2136-13-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4156-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/752-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1584-31-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5108-43-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5116-50-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1692-57-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5004-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4896-77-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1492-81-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3224-87-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1520-100-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1844-106-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3616-114-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4068-122-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1168-139-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3956-137-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/664-156-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4412-155-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4252-154-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1500-167-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2896-176-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2468-189-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1612-191-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3468-195-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4544-209-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4528-216-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1880-224-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2260-232-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3332-239-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2720-242-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2168-255-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4408-259-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1016-264-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3420-273-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4052-286-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1844-302-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4416-307-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4068-313-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2304-336-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2840-342-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3796-370-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1424-378-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2756-417-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3420-421-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3584-431-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3252-441-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1340-460-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2304-486-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1428-500-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4704-513-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3844-552-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2244-565-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3436-578-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3684-588-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2992-592-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2956-635-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1548-673-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4052-701-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3500-733-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2356-824-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2064-1015-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3480 lfllrlf.exe 2136 lfxrxrx.exe 4156 rrffrrf.exe 752 djvvv.exe 1584 rxffxxl.exe 5108 ppdvv.exe 3864 bhtnhh.exe 5116 dpjdd.exe 1692 nnhbbn.exe 5004 djpjp.exe 3132 ththbh.exe 4896 3flfrlf.exe 1492 hthbhh.exe 3224 jpvdd.exe 436 hthnhb.exe 4712 jvddv.exe 1520 ddvpj.exe 1844 pjddv.exe 3616 ffrrllf.exe 872 rfrrffr.exe 4068 jvjdv.exe 2948 rflfxxr.exe 1168 pdddv.exe 3956 fxffxfx.exe 4252 hnbtnn.exe 4412 pjpjd.exe 664 xrllfxr.exe 1500 hbtbnn.exe 4168 tnnbnb.exe 2896 tbhhhb.exe 4668 xrxxrlf.exe 2468 3xxrllr.exe 1612 vjpdv.exe 3468 rrlrlrr.exe 1192 nbbtnb.exe 2580 7hnbnt.exe 4544 vjvpj.exe 2392 xrfxxrl.exe 4528 nthbnh.exe 4956 jvjvv.exe 1716 rflfxxl.exe 1880 nbtnbb.exe 4156 vvdvp.exe 2260 lxfxrlf.exe 2180 rrrlffx.exe 3332 3nbbbb.exe 2720 pdpjd.exe 2008 fxxrrxx.exe 4924 7hnhbb.exe 2168 5jjdv.exe 4408 rfxxrrr.exe 3868 bthbtb.exe 1016 vpppj.exe 2344 rfrxrrr.exe 3420 nhhhhn.exe 4420 pdjdd.exe 3996 lrfllff.exe 2356 3hbbnn.exe 4052 lfrxlrx.exe 2668 nttttt.exe 4948 bbhhht.exe 3024 pjdpj.exe 2912 flfxrrl.exe 1844 rxffxrl.exe -
resource yara_rule behavioral2/memory/2392-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002328e-3.dat upx behavioral2/memory/2392-5-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3480-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023400-9.dat upx behavioral2/memory/2136-13-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023401-14.dat upx behavioral2/memory/4156-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023402-22.dat upx behavioral2/memory/752-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023403-28.dat upx behavioral2/memory/1584-31-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023404-34.dat upx behavioral2/memory/5108-37-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023405-40.dat upx behavioral2/memory/5108-43-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023406-47.dat upx behavioral2/memory/5116-50-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3864-44-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023407-54.dat upx behavioral2/memory/1692-57-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023408-59.dat upx behavioral2/files/0x0007000000023409-64.dat upx behavioral2/memory/5004-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002340a-69.dat upx behavioral2/files/0x000700000002340b-74.dat upx behavioral2/memory/4896-77-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x00080000000233fd-80.dat upx behavioral2/memory/1492-81-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002340c-85.dat upx behavioral2/memory/3224-87-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002340d-92.dat upx behavioral2/files/0x000700000002340f-97.dat upx behavioral2/memory/1520-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023410-102.dat upx behavioral2/memory/1844-106-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023411-110.dat upx behavioral2/files/0x0007000000023412-115.dat upx behavioral2/memory/3616-114-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023413-119.dat upx behavioral2/memory/4068-122-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023414-125.dat upx behavioral2/files/0x0007000000023415-131.dat upx behavioral2/files/0x0007000000023416-135.dat upx behavioral2/memory/1168-139-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3956-137-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023417-142.dat upx behavioral2/files/0x0007000000023418-148.dat upx behavioral2/files/0x0007000000023419-152.dat upx behavioral2/memory/664-156-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4412-155-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4252-154-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000400000002296c-160.dat upx behavioral2/memory/1500-163-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0003000000022974-168.dat upx behavioral2/memory/1500-167-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000c000000023367-173.dat upx behavioral2/memory/2896-176-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000a00000002336a-178.dat upx behavioral2/files/0x000700000002341a-184.dat upx behavioral2/memory/2468-189-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1612-191-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3468-195-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2580-201-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 3480 2392 0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe 82 PID 2392 wrote to memory of 3480 2392 0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe 82 PID 2392 wrote to memory of 3480 2392 0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe 82 PID 3480 wrote to memory of 2136 3480 lfllrlf.exe 83 PID 3480 wrote to memory of 2136 3480 lfllrlf.exe 83 PID 3480 wrote to memory of 2136 3480 lfllrlf.exe 83 PID 2136 wrote to memory of 4156 2136 lfxrxrx.exe 84 PID 2136 wrote to memory of 4156 2136 lfxrxrx.exe 84 PID 2136 wrote to memory of 4156 2136 lfxrxrx.exe 84 PID 4156 wrote to memory of 752 4156 rrffrrf.exe 85 PID 4156 wrote to memory of 752 4156 rrffrrf.exe 85 PID 4156 wrote to memory of 752 4156 rrffrrf.exe 85 PID 752 wrote to memory of 1584 752 djvvv.exe 86 PID 752 wrote to memory of 1584 752 djvvv.exe 86 PID 752 wrote to memory of 1584 752 djvvv.exe 86 PID 1584 wrote to memory of 5108 1584 rxffxxl.exe 87 PID 1584 wrote to memory of 5108 1584 rxffxxl.exe 87 PID 1584 wrote to memory of 5108 1584 rxffxxl.exe 87 PID 5108 wrote to memory of 3864 5108 ppdvv.exe 88 PID 5108 wrote to memory of 3864 5108 ppdvv.exe 88 PID 5108 wrote to memory of 3864 5108 ppdvv.exe 88 PID 3864 wrote to memory of 5116 3864 bhtnhh.exe 90 PID 3864 wrote to memory of 5116 3864 bhtnhh.exe 90 PID 3864 wrote to memory of 5116 3864 bhtnhh.exe 90 PID 5116 wrote to memory of 1692 5116 dpjdd.exe 91 PID 5116 wrote to memory of 1692 5116 dpjdd.exe 91 PID 5116 wrote to memory of 1692 5116 dpjdd.exe 91 PID 1692 wrote to memory of 5004 1692 nnhbbn.exe 92 PID 1692 wrote to memory of 5004 1692 nnhbbn.exe 92 PID 1692 wrote to memory of 5004 1692 nnhbbn.exe 92 PID 5004 wrote to memory of 3132 5004 djpjp.exe 93 PID 5004 wrote to memory of 3132 5004 djpjp.exe 93 PID 5004 wrote to memory of 3132 5004 djpjp.exe 93 PID 3132 wrote to memory of 4896 3132 ththbh.exe 95 PID 3132 wrote to memory of 4896 3132 ththbh.exe 95 PID 3132 wrote to memory of 4896 3132 ththbh.exe 95 PID 4896 wrote to memory of 1492 4896 3flfrlf.exe 96 PID 4896 wrote to memory of 1492 4896 3flfrlf.exe 96 PID 4896 wrote to memory of 1492 4896 3flfrlf.exe 96 PID 1492 wrote to memory of 3224 1492 hthbhh.exe 97 PID 1492 wrote to memory of 3224 1492 hthbhh.exe 97 PID 1492 wrote to memory of 3224 1492 hthbhh.exe 97 PID 3224 wrote to memory of 436 3224 jpvdd.exe 98 PID 3224 wrote to memory of 436 3224 jpvdd.exe 98 PID 3224 wrote to memory of 436 3224 jpvdd.exe 98 PID 436 wrote to memory of 4712 436 hthnhb.exe 100 PID 436 wrote to memory of 4712 436 hthnhb.exe 100 PID 436 wrote to memory of 4712 436 hthnhb.exe 100 PID 4712 wrote to memory of 1520 4712 jvddv.exe 101 PID 4712 wrote to memory of 1520 4712 jvddv.exe 101 PID 4712 wrote to memory of 1520 4712 jvddv.exe 101 PID 1520 wrote to memory of 1844 1520 ddvpj.exe 102 PID 1520 wrote to memory of 1844 1520 ddvpj.exe 102 PID 1520 wrote to memory of 1844 1520 ddvpj.exe 102 PID 1844 wrote to memory of 3616 1844 pjddv.exe 103 PID 1844 wrote to memory of 3616 1844 pjddv.exe 103 PID 1844 wrote to memory of 3616 1844 pjddv.exe 103 PID 3616 wrote to memory of 872 3616 ffrrllf.exe 104 PID 3616 wrote to memory of 872 3616 ffrrllf.exe 104 PID 3616 wrote to memory of 872 3616 ffrrllf.exe 104 PID 872 wrote to memory of 4068 872 rfrrffr.exe 105 PID 872 wrote to memory of 4068 872 rfrrffr.exe 105 PID 872 wrote to memory of 4068 872 rfrrffr.exe 105 PID 4068 wrote to memory of 2948 4068 jvjdv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0796a93ef6c63cdacc00d4f1e15442a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\lfllrlf.exec:\lfllrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\lfxrxrx.exec:\lfxrxrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\rrffrrf.exec:\rrffrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\djvvv.exec:\djvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\rxffxxl.exec:\rxffxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\ppdvv.exec:\ppdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\bhtnhh.exec:\bhtnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\dpjdd.exec:\dpjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\nnhbbn.exec:\nnhbbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\djpjp.exec:\djpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\ththbh.exec:\ththbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\3flfrlf.exec:\3flfrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\hthbhh.exec:\hthbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\jpvdd.exec:\jpvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\hthnhb.exec:\hthnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\jvddv.exec:\jvddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\ddvpj.exec:\ddvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\pjddv.exec:\pjddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\ffrrllf.exec:\ffrrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\rfrrffr.exec:\rfrrffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\jvjdv.exec:\jvjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\rflfxxr.exec:\rflfxxr.exe23⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pdddv.exec:\pdddv.exe24⤵
- Executes dropped EXE
PID:1168 -
\??\c:\fxffxfx.exec:\fxffxfx.exe25⤵
- Executes dropped EXE
PID:3956 -
\??\c:\hnbtnn.exec:\hnbtnn.exe26⤵
- Executes dropped EXE
PID:4252 -
\??\c:\pjpjd.exec:\pjpjd.exe27⤵
- Executes dropped EXE
PID:4412 -
\??\c:\xrllfxr.exec:\xrllfxr.exe28⤵
- Executes dropped EXE
PID:664 -
\??\c:\hbtbnn.exec:\hbtbnn.exe29⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tnnbnb.exec:\tnnbnb.exe30⤵
- Executes dropped EXE
PID:4168 -
\??\c:\tbhhhb.exec:\tbhhhb.exe31⤵
- Executes dropped EXE
PID:2896 -
\??\c:\xrxxrlf.exec:\xrxxrlf.exe32⤵
- Executes dropped EXE
PID:4668 -
\??\c:\3xxrllr.exec:\3xxrllr.exe33⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vjpdv.exec:\vjpdv.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rrlrlrr.exec:\rrlrlrr.exe35⤵
- Executes dropped EXE
PID:3468 -
\??\c:\nbbtnb.exec:\nbbtnb.exe36⤵
- Executes dropped EXE
PID:1192 -
\??\c:\7hnbnt.exec:\7hnbnt.exe37⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vjvpj.exec:\vjvpj.exe38⤵
- Executes dropped EXE
PID:4544 -
\??\c:\xrfxxrl.exec:\xrfxxrl.exe39⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nthbnh.exec:\nthbnh.exe40⤵
- Executes dropped EXE
PID:4528 -
\??\c:\jvjvv.exec:\jvjvv.exe41⤵
- Executes dropped EXE
PID:4956 -
\??\c:\rflfxxl.exec:\rflfxxl.exe42⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nbtnbb.exec:\nbtnbb.exe43⤵
- Executes dropped EXE
PID:1880 -
\??\c:\vvdvp.exec:\vvdvp.exe44⤵
- Executes dropped EXE
PID:4156 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe45⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rrrlffx.exec:\rrrlffx.exe46⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3nbbbb.exec:\3nbbbb.exe47⤵
- Executes dropped EXE
PID:3332 -
\??\c:\pdpjd.exec:\pdpjd.exe48⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fxxrrxx.exec:\fxxrrxx.exe49⤵
- Executes dropped EXE
PID:2008 -
\??\c:\7hnhbb.exec:\7hnhbb.exe50⤵
- Executes dropped EXE
PID:4924 -
\??\c:\5jjdv.exec:\5jjdv.exe51⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rfxxrrr.exec:\rfxxrrr.exe52⤵
- Executes dropped EXE
PID:4408 -
\??\c:\bthbtb.exec:\bthbtb.exe53⤵
- Executes dropped EXE
PID:3868 -
\??\c:\vpppj.exec:\vpppj.exe54⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rfrxrrr.exec:\rfrxrrr.exe55⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nhhhhn.exec:\nhhhhn.exe56⤵
- Executes dropped EXE
PID:3420 -
\??\c:\pdjdd.exec:\pdjdd.exe57⤵
- Executes dropped EXE
PID:4420 -
\??\c:\lrfllff.exec:\lrfllff.exe58⤵
- Executes dropped EXE
PID:3996 -
\??\c:\3hbbnn.exec:\3hbbnn.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\lfrxlrx.exec:\lfrxlrx.exe60⤵
- Executes dropped EXE
PID:4052 -
\??\c:\nttttt.exec:\nttttt.exe61⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bbhhht.exec:\bbhhht.exe62⤵
- Executes dropped EXE
PID:4948 -
\??\c:\pjdpj.exec:\pjdpj.exe63⤵
- Executes dropped EXE
PID:3024 -
\??\c:\flfxrrl.exec:\flfxrrl.exe64⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rxffxrl.exec:\rxffxrl.exe65⤵
- Executes dropped EXE
PID:1844 -
\??\c:\hnhbnh.exec:\hnhbnh.exe66⤵PID:4488
-
\??\c:\jjpdd.exec:\jjpdd.exe67⤵PID:4416
-
\??\c:\vpvvp.exec:\vpvvp.exe68⤵PID:1160
-
\??\c:\xxffffr.exec:\xxffffr.exe69⤵PID:4068
-
\??\c:\nnbbhh.exec:\nnbbhh.exe70⤵PID:4468
-
\??\c:\vpdvv.exec:\vpdvv.exe71⤵PID:3464
-
\??\c:\3pvpj.exec:\3pvpj.exe72⤵PID:3500
-
\??\c:\1rfxrrl.exec:\1rfxrrl.exe73⤵PID:4056
-
\??\c:\tbbbtn.exec:\tbbbtn.exe74⤵PID:980
-
\??\c:\dvddj.exec:\dvddj.exe75⤵PID:4720
-
\??\c:\lfrlffl.exec:\lfrlffl.exe76⤵PID:2304
-
\??\c:\ntbthh.exec:\ntbthh.exe77⤵PID:3248
-
\??\c:\jddvj.exec:\jddvj.exe78⤵PID:2840
-
\??\c:\7ppjv.exec:\7ppjv.exe79⤵PID:2888
-
\??\c:\lrfrrrx.exec:\lrfrrrx.exe80⤵PID:4264
-
\??\c:\5thhtn.exec:\5thhtn.exe81⤵PID:4072
-
\??\c:\dvdvp.exec:\dvdvp.exe82⤵PID:4668
-
\??\c:\vdpdv.exec:\vdpdv.exe83⤵PID:1360
-
\??\c:\xrfxlll.exec:\xrfxlll.exe84⤵PID:2512
-
\??\c:\bhhbbb.exec:\bhhbbb.exe85⤵PID:4952
-
\??\c:\jvjdd.exec:\jvjdd.exe86⤵PID:3796
-
\??\c:\7jpjd.exec:\7jpjd.exe87⤵PID:4316
-
\??\c:\xxrlxfl.exec:\xxrlxfl.exe88⤵PID:4444
-
\??\c:\nhttbb.exec:\nhttbb.exe89⤵PID:1424
-
\??\c:\thtnhh.exec:\thtnhh.exe90⤵PID:336
-
\??\c:\3pjjd.exec:\3pjjd.exe91⤵PID:2128
-
\??\c:\5xffxxr.exec:\5xffxxr.exe92⤵PID:4456
-
\??\c:\htnnbb.exec:\htnnbb.exe93⤵PID:4156
-
\??\c:\nnnhtn.exec:\nnnhtn.exe94⤵PID:2260
-
\??\c:\vjvpp.exec:\vjvpp.exe95⤵PID:60
-
\??\c:\lffxxxr.exec:\lffxxxr.exe96⤵PID:1980
-
\??\c:\htbbtt.exec:\htbbtt.exe97⤵PID:4796
-
\??\c:\tnhbtt.exec:\tnhbtt.exe98⤵PID:3272
-
\??\c:\pdpvj.exec:\pdpvj.exe99⤵PID:5000
-
\??\c:\1rlfxfx.exec:\1rlfxfx.exe100⤵PID:1132
-
\??\c:\ffrlfff.exec:\ffrlfff.exe101⤵PID:2756
-
\??\c:\tthttb.exec:\tthttb.exe102⤵PID:3420
-
\??\c:\jdddv.exec:\jdddv.exe103⤵PID:2680
-
\??\c:\llffxxx.exec:\llffxxx.exe104⤵PID:3288
-
\??\c:\nbtttt.exec:\nbtttt.exe105⤵PID:3584
-
\??\c:\ntbttt.exec:\ntbttt.exe106⤵PID:3732
-
\??\c:\djjjd.exec:\djjjd.exe107⤵PID:2996
-
\??\c:\1xlflfx.exec:\1xlflfx.exe108⤵PID:3252
-
\??\c:\pvddv.exec:\pvddv.exe109⤵PID:3024
-
\??\c:\llxrxfl.exec:\llxrxfl.exe110⤵PID:2912
-
\??\c:\nnttbb.exec:\nnttbb.exe111⤵PID:452
-
\??\c:\vjjpd.exec:\vjjpd.exe112⤵PID:4920
-
\??\c:\9lfxrrl.exec:\9lfxrrl.exe113⤵PID:2980
-
\??\c:\nhnhbb.exec:\nhnhbb.exe114⤵PID:3196
-
\??\c:\5jpjv.exec:\5jpjv.exe115⤵PID:1340
-
\??\c:\vpvpj.exec:\vpvpj.exe116⤵PID:4228
-
\??\c:\lfxllrr.exec:\lfxllrr.exe117⤵PID:1648
-
\??\c:\htbhbb.exec:\htbhbb.exe118⤵PID:896
-
\??\c:\ppvpp.exec:\ppvpp.exe119⤵PID:4056
-
\??\c:\fxlffff.exec:\fxlffff.exe120⤵PID:428
-
\??\c:\flxxrxr.exec:\flxxrxr.exe121⤵PID:4044
-
\??\c:\hbhbbb.exec:\hbhbbb.exe122⤵PID:2304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-