Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 00:26
Behavioral task
behavioral1
Sample
5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe
-
Size
79KB
-
MD5
5c564f440fdf2cbff8f8288192ff6eb0
-
SHA1
6b43a548e106349e23c4f40e2d9ccba47eb41d13
-
SHA256
4f14a8811874722b45e093a72fc3a1678d4a8e7c65056fb803af396b5812fae5
-
SHA512
e9e50113bc4afdd220124dbe67e256f15a6961e483684f0fb7a2ee219037248cc28854672958113b26a7aafe0a760952ea8f808127cbac609cfe810e85dbd2b2
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7A:zhOmTsF93UYfwC6GIoutiTU2HVS63A
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4688-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2804-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/788-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/696-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/684-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/696-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-530-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2804 fxrrlll.exe 2836 flffxfx.exe 3392 nbhhhh.exe 2852 rrlllrr.exe 4960 hnntnn.exe 4776 9jpdd.exe 1600 3fffrxr.exe 4576 thbtnn.exe 3632 nnttnn.exe 2060 xfxxrxx.exe 1392 rfrfffr.exe 4428 ntbtnt.exe 3452 5jpjd.exe 2788 ffxxllx.exe 4912 rrxffxx.exe 3664 tntbth.exe 4928 jjpjp.exe 3440 rffrlxr.exe 2880 bnbhtt.exe 4480 tttntb.exe 2152 lxlffll.exe 3444 1lrrllf.exe 4052 1hhbhb.exe 4572 ddvpp.exe 4864 5rlxrlf.exe 788 1nhntn.exe 2464 vpjjp.exe 2328 9jppj.exe 4008 hnhbbt.exe 2636 ppjdd.exe 696 9frlfff.exe 1176 lflrlfx.exe 632 tnthbt.exe 4468 dpvvp.exe 4564 9vjpd.exe 4644 xrrlxxr.exe 1068 frfxxxx.exe 3508 thtnhh.exe 3008 ddvpd.exe 2584 jdpjj.exe 4760 rlfrrrl.exe 2036 nbbnhh.exe 4936 7dppd.exe 1436 7ddvj.exe 4868 rflffxr.exe 4980 hnnbtt.exe 1312 5nnbnh.exe 4336 5pjdv.exe 448 pjjdv.exe 964 lfrfllr.exe 408 1nhbnn.exe 4604 9nnbtt.exe 2764 jppjd.exe 4824 vvpjp.exe 2364 lflxxrl.exe 1448 nhbnth.exe 440 5dvjv.exe 1388 pvpjv.exe 3524 rlfxxxl.exe 4364 bbhtbt.exe 2840 htnnbb.exe 4620 vvjjv.exe 1560 lxrfxrl.exe 2620 fffrlfr.exe -
resource yara_rule behavioral2/memory/4688-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023284-3.dat upx behavioral2/memory/4688-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2804-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023416-9.dat upx behavioral2/memory/2836-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-12.dat upx behavioral2/memory/3392-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2836-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-20.dat upx behavioral2/memory/2852-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-26.dat upx behavioral2/memory/4960-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-30.dat upx behavioral2/memory/4776-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-35.dat upx behavioral2/files/0x0007000000023423-39.dat upx behavioral2/memory/1600-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4576-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-45.dat upx behavioral2/memory/4576-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-50.dat upx behavioral2/memory/3632-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2060-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-55.dat upx behavioral2/files/0x0007000000023427-60.dat upx behavioral2/memory/1392-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4428-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-67.dat upx behavioral2/memory/3452-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-71.dat upx behavioral2/memory/3452-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2788-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-77.dat upx behavioral2/memory/4912-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-82.dat upx behavioral2/memory/3664-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-86.dat upx behavioral2/files/0x000700000002342d-91.dat upx behavioral2/files/0x000700000002342e-95.dat upx behavioral2/memory/2880-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-100.dat upx behavioral2/files/0x0007000000023430-104.dat upx behavioral2/memory/4480-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-110.dat upx behavioral2/memory/3444-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-114.dat upx behavioral2/files/0x0007000000023433-118.dat upx behavioral2/memory/4052-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-123.dat upx behavioral2/memory/4864-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002341a-128.dat upx behavioral2/files/0x0007000000023436-132.dat upx behavioral2/memory/788-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023437-138.dat upx behavioral2/files/0x0007000000023438-141.dat upx behavioral2/files/0x0007000000023439-145.dat upx behavioral2/memory/696-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343a-150.dat upx behavioral2/memory/2636-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1176-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343b-156.dat upx behavioral2/memory/4468-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4644-169-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4688 wrote to memory of 2804 4688 5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe 82 PID 4688 wrote to memory of 2804 4688 5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe 82 PID 4688 wrote to memory of 2804 4688 5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe 82 PID 2804 wrote to memory of 2836 2804 fxrrlll.exe 83 PID 2804 wrote to memory of 2836 2804 fxrrlll.exe 83 PID 2804 wrote to memory of 2836 2804 fxrrlll.exe 83 PID 2836 wrote to memory of 3392 2836 flffxfx.exe 84 PID 2836 wrote to memory of 3392 2836 flffxfx.exe 84 PID 2836 wrote to memory of 3392 2836 flffxfx.exe 84 PID 3392 wrote to memory of 2852 3392 nbhhhh.exe 85 PID 3392 wrote to memory of 2852 3392 nbhhhh.exe 85 PID 3392 wrote to memory of 2852 3392 nbhhhh.exe 85 PID 2852 wrote to memory of 4960 2852 rrlllrr.exe 86 PID 2852 wrote to memory of 4960 2852 rrlllrr.exe 86 PID 2852 wrote to memory of 4960 2852 rrlllrr.exe 86 PID 4960 wrote to memory of 4776 4960 hnntnn.exe 87 PID 4960 wrote to memory of 4776 4960 hnntnn.exe 87 PID 4960 wrote to memory of 4776 4960 hnntnn.exe 87 PID 4776 wrote to memory of 1600 4776 9jpdd.exe 88 PID 4776 wrote to memory of 1600 4776 9jpdd.exe 88 PID 4776 wrote to memory of 1600 4776 9jpdd.exe 88 PID 1600 wrote to memory of 4576 1600 3fffrxr.exe 89 PID 1600 wrote to memory of 4576 1600 3fffrxr.exe 89 PID 1600 wrote to memory of 4576 1600 3fffrxr.exe 89 PID 4576 wrote to memory of 3632 4576 thbtnn.exe 90 PID 4576 wrote to memory of 3632 4576 thbtnn.exe 90 PID 4576 wrote to memory of 3632 4576 thbtnn.exe 90 PID 3632 wrote to memory of 2060 3632 nnttnn.exe 91 PID 3632 wrote to memory of 2060 3632 nnttnn.exe 91 PID 3632 wrote to memory of 2060 3632 nnttnn.exe 91 PID 2060 wrote to memory of 1392 2060 xfxxrxx.exe 92 PID 2060 wrote to memory of 1392 2060 xfxxrxx.exe 92 PID 2060 wrote to memory of 1392 2060 xfxxrxx.exe 92 PID 1392 wrote to memory of 4428 1392 rfrfffr.exe 93 PID 1392 wrote to memory of 4428 1392 rfrfffr.exe 93 PID 1392 wrote to memory of 4428 1392 rfrfffr.exe 93 PID 4428 wrote to memory of 3452 4428 ntbtnt.exe 94 PID 4428 wrote to memory of 3452 4428 ntbtnt.exe 94 PID 4428 wrote to memory of 3452 4428 ntbtnt.exe 94 PID 3452 wrote to memory of 2788 3452 5jpjd.exe 95 PID 3452 wrote to memory of 2788 3452 5jpjd.exe 95 PID 3452 wrote to memory of 2788 3452 5jpjd.exe 95 PID 2788 wrote to memory of 4912 2788 ffxxllx.exe 96 PID 2788 wrote to memory of 4912 2788 ffxxllx.exe 96 PID 2788 wrote to memory of 4912 2788 ffxxllx.exe 96 PID 4912 wrote to memory of 3664 4912 rrxffxx.exe 97 PID 4912 wrote to memory of 3664 4912 rrxffxx.exe 97 PID 4912 wrote to memory of 3664 4912 rrxffxx.exe 97 PID 3664 wrote to memory of 4928 3664 tntbth.exe 98 PID 3664 wrote to memory of 4928 3664 tntbth.exe 98 PID 3664 wrote to memory of 4928 3664 tntbth.exe 98 PID 4928 wrote to memory of 3440 4928 jjpjp.exe 99 PID 4928 wrote to memory of 3440 4928 jjpjp.exe 99 PID 4928 wrote to memory of 3440 4928 jjpjp.exe 99 PID 3440 wrote to memory of 2880 3440 rffrlxr.exe 101 PID 3440 wrote to memory of 2880 3440 rffrlxr.exe 101 PID 3440 wrote to memory of 2880 3440 rffrlxr.exe 101 PID 2880 wrote to memory of 4480 2880 bnbhtt.exe 102 PID 2880 wrote to memory of 4480 2880 bnbhtt.exe 102 PID 2880 wrote to memory of 4480 2880 bnbhtt.exe 102 PID 4480 wrote to memory of 2152 4480 tttntb.exe 103 PID 4480 wrote to memory of 2152 4480 tttntb.exe 103 PID 4480 wrote to memory of 2152 4480 tttntb.exe 103 PID 2152 wrote to memory of 3444 2152 lxlffll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5c564f440fdf2cbff8f8288192ff6eb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\fxrrlll.exec:\fxrrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\flffxfx.exec:\flffxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\nbhhhh.exec:\nbhhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\rrlllrr.exec:\rrlllrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\hnntnn.exec:\hnntnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\9jpdd.exec:\9jpdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\3fffrxr.exec:\3fffrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\thbtnn.exec:\thbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\nnttnn.exec:\nnttnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\xfxxrxx.exec:\xfxxrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\rfrfffr.exec:\rfrfffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\ntbtnt.exec:\ntbtnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\5jpjd.exec:\5jpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\ffxxllx.exec:\ffxxllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rrxffxx.exec:\rrxffxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\tntbth.exec:\tntbth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\jjpjp.exec:\jjpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\rffrlxr.exec:\rffrlxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\bnbhtt.exec:\bnbhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\tttntb.exec:\tttntb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\lxlffll.exec:\lxlffll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\1lrrllf.exec:\1lrrllf.exe23⤵
- Executes dropped EXE
PID:3444 -
\??\c:\1hhbhb.exec:\1hhbhb.exe24⤵
- Executes dropped EXE
PID:4052 -
\??\c:\ddvpp.exec:\ddvpp.exe25⤵
- Executes dropped EXE
PID:4572 -
\??\c:\5rlxrlf.exec:\5rlxrlf.exe26⤵
- Executes dropped EXE
PID:4864 -
\??\c:\1nhntn.exec:\1nhntn.exe27⤵
- Executes dropped EXE
PID:788 -
\??\c:\vpjjp.exec:\vpjjp.exe28⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9jppj.exec:\9jppj.exe29⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hnhbbt.exec:\hnhbbt.exe30⤵
- Executes dropped EXE
PID:4008 -
\??\c:\ppjdd.exec:\ppjdd.exe31⤵
- Executes dropped EXE
PID:2636 -
\??\c:\9frlfff.exec:\9frlfff.exe32⤵
- Executes dropped EXE
PID:696 -
\??\c:\lflrlfx.exec:\lflrlfx.exe33⤵
- Executes dropped EXE
PID:1176 -
\??\c:\tnthbt.exec:\tnthbt.exe34⤵
- Executes dropped EXE
PID:632 -
\??\c:\dpvvp.exec:\dpvvp.exe35⤵
- Executes dropped EXE
PID:4468 -
\??\c:\9vjpd.exec:\9vjpd.exe36⤵
- Executes dropped EXE
PID:4564 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe37⤵
- Executes dropped EXE
PID:4644 -
\??\c:\frfxxxx.exec:\frfxxxx.exe38⤵
- Executes dropped EXE
PID:1068 -
\??\c:\thtnhh.exec:\thtnhh.exe39⤵
- Executes dropped EXE
PID:3508 -
\??\c:\ddvpd.exec:\ddvpd.exe40⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jdpjj.exec:\jdpjj.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rlfrrrl.exec:\rlfrrrl.exe42⤵
- Executes dropped EXE
PID:4760 -
\??\c:\nbbnhh.exec:\nbbnhh.exe43⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7dppd.exec:\7dppd.exe44⤵
- Executes dropped EXE
PID:4936 -
\??\c:\7ddvj.exec:\7ddvj.exe45⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rflffxr.exec:\rflffxr.exe46⤵
- Executes dropped EXE
PID:4868 -
\??\c:\hnnbtt.exec:\hnnbtt.exe47⤵
- Executes dropped EXE
PID:4980 -
\??\c:\5nnbnh.exec:\5nnbnh.exe48⤵
- Executes dropped EXE
PID:1312 -
\??\c:\5pjdv.exec:\5pjdv.exe49⤵
- Executes dropped EXE
PID:4336 -
\??\c:\pjjdv.exec:\pjjdv.exe50⤵
- Executes dropped EXE
PID:448 -
\??\c:\lfrfllr.exec:\lfrfllr.exe51⤵
- Executes dropped EXE
PID:964 -
\??\c:\rxrxrrl.exec:\rxrxrrl.exe52⤵PID:2804
-
\??\c:\1nhbnn.exec:\1nhbnn.exe53⤵
- Executes dropped EXE
PID:408 -
\??\c:\9nnbtt.exec:\9nnbtt.exe54⤵
- Executes dropped EXE
PID:4604 -
\??\c:\jppjd.exec:\jppjd.exe55⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vvpjp.exec:\vvpjp.exe56⤵
- Executes dropped EXE
PID:4824 -
\??\c:\lflxxrl.exec:\lflxxrl.exe57⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nhbnth.exec:\nhbnth.exe58⤵
- Executes dropped EXE
PID:1448 -
\??\c:\5dvjv.exec:\5dvjv.exe59⤵
- Executes dropped EXE
PID:440 -
\??\c:\pvpjv.exec:\pvpjv.exe60⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rlfxxxl.exec:\rlfxxxl.exe61⤵
- Executes dropped EXE
PID:3524 -
\??\c:\bbhtbt.exec:\bbhtbt.exe62⤵
- Executes dropped EXE
PID:4364 -
\??\c:\htnnbb.exec:\htnnbb.exe63⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vvjjv.exec:\vvjjv.exe64⤵
- Executes dropped EXE
PID:4620 -
\??\c:\lxrfxrl.exec:\lxrfxrl.exe65⤵
- Executes dropped EXE
PID:1560 -
\??\c:\fffrlfr.exec:\fffrlfr.exe66⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bnttth.exec:\bnttth.exe67⤵PID:4624
-
\??\c:\ttbbbb.exec:\ttbbbb.exe68⤵PID:3668
-
\??\c:\3djdp.exec:\3djdp.exe69⤵PID:3640
-
\??\c:\rfrlllf.exec:\rfrlllf.exe70⤵PID:2040
-
\??\c:\lrfxrlx.exec:\lrfxrlx.exe71⤵PID:2580
-
\??\c:\nhhhhn.exec:\nhhhhn.exe72⤵PID:884
-
\??\c:\jvvpd.exec:\jvvpd.exe73⤵PID:4784
-
\??\c:\dpvvp.exec:\dpvvp.exe74⤵PID:2568
-
\??\c:\fflxrlf.exec:\fflxrlf.exe75⤵PID:3440
-
\??\c:\ntbtnh.exec:\ntbtnh.exe76⤵PID:4548
-
\??\c:\vjjjv.exec:\vjjjv.exe77⤵PID:684
-
\??\c:\dpdvp.exec:\dpdvp.exe78⤵PID:4392
-
\??\c:\llrrlfr.exec:\llrrlfr.exe79⤵PID:3904
-
\??\c:\tttthn.exec:\tttthn.exe80⤵PID:3444
-
\??\c:\dppjv.exec:\dppjv.exe81⤵PID:1644
-
\??\c:\1jddv.exec:\1jddv.exe82⤵PID:4052
-
\??\c:\rxxrffx.exec:\rxxrffx.exe83⤵PID:976
-
\??\c:\9xxxrlf.exec:\9xxxrlf.exe84⤵PID:4572
-
\??\c:\hhhbhb.exec:\hhhbhb.exe85⤵PID:4864
-
\??\c:\7jjdp.exec:\7jjdp.exe86⤵PID:452
-
\??\c:\ppvvj.exec:\ppvvj.exe87⤵PID:4536
-
\??\c:\lfffllr.exec:\lfffllr.exe88⤵PID:5116
-
\??\c:\lllxfrr.exec:\lllxfrr.exe89⤵PID:3672
-
\??\c:\5tnhbt.exec:\5tnhbt.exe90⤵PID:3916
-
\??\c:\hnnhbb.exec:\hnnhbb.exe91⤵PID:4296
-
\??\c:\ddjvv.exec:\ddjvv.exe92⤵PID:3040
-
\??\c:\1rrfrlx.exec:\1rrfrlx.exe93⤵PID:696
-
\??\c:\llxrffl.exec:\llxrffl.exe94⤵PID:1180
-
\??\c:\nttttt.exec:\nttttt.exe95⤵PID:3352
-
\??\c:\nbbnbt.exec:\nbbnbt.exe96⤵PID:4268
-
\??\c:\ddvpj.exec:\ddvpj.exe97⤵PID:548
-
\??\c:\xxxlxlf.exec:\xxxlxlf.exe98⤵PID:3800
-
\??\c:\rfxrllf.exec:\rfxrllf.exe99⤵PID:3944
-
\??\c:\tbhnhb.exec:\tbhnhb.exe100⤵PID:2228
-
\??\c:\ppjdv.exec:\ppjdv.exe101⤵PID:1544
-
\??\c:\ppjjv.exec:\ppjjv.exe102⤵PID:2032
-
\??\c:\xrllxrl.exec:\xrllxrl.exe103⤵PID:3860
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe104⤵PID:4996
-
\??\c:\7ntnhb.exec:\7ntnhb.exe105⤵PID:5016
-
\??\c:\tnbnhb.exec:\tnbnhb.exe106⤵PID:1796
-
\??\c:\pddvj.exec:\pddvj.exe107⤵PID:2784
-
\??\c:\rrxrllf.exec:\rrxrllf.exe108⤵PID:3176
-
\??\c:\lflrlll.exec:\lflrlll.exe109⤵PID:1308
-
\??\c:\llfrxrr.exec:\llfrxrr.exe110⤵PID:4868
-
\??\c:\5tbttn.exec:\5tbttn.exe111⤵PID:4980
-
\??\c:\thhbnn.exec:\thhbnn.exe112⤵PID:532
-
\??\c:\5dvjj.exec:\5dvjj.exe113⤵PID:4284
-
\??\c:\rxxllrf.exec:\rxxllrf.exe114⤵PID:2604
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe115⤵PID:828
-
\??\c:\hhtnnn.exec:\hhtnnn.exe116⤵PID:4456
-
\??\c:\thhbnn.exec:\thhbnn.exe117⤵PID:1416
-
\??\c:\1tnbhb.exec:\1tnbhb.exe118⤵PID:1020
-
\??\c:\vppjv.exec:\vppjv.exe119⤵PID:3624
-
\??\c:\frxrfff.exec:\frxrfff.exe120⤵PID:940
-
\??\c:\xrxflfx.exec:\xrxflfx.exe121⤵PID:4776
-
\??\c:\hbbtnn.exec:\hbbtnn.exe122⤵PID:3472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-