Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 03:01
Behavioral task
behavioral1
Sample
cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe
-
Size
349KB
-
MD5
cfeb716a9ca10c4a5293eaf5ec521aa0
-
SHA1
348d8b870803825098b767092f2a68bcabfccad9
-
SHA256
00ff73b1e1520673ed2827d236dcf9d6562e08697142cfe5854fbe59d711c67e
-
SHA512
8962ce9ccb162c0941842fcb3dd739150a0e8987e1ea64a4f926bc6cef663f4644490465e86a59d5ea20c460ddbde834fb0902bb8bf5760ac2cc0fc9b5536608
-
SSDEEP
6144:bcm4FmowdHoSgWrXD486jCpoAhlq1mEjBqLyOSlhNFF25:h4wFHoSgWj168w1VjsyvhNFF25
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4728-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/828-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1700-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4176-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1208-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-569-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-626-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-662-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-682-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-722-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2264 hhnnhh.exe 2180 9ddvv.exe 4940 llrllll.exe 4012 jvvvp.exe 4568 vvpjj.exe 4172 xxrfrlf.exe 4912 rxxxxlf.exe 2016 bntttt.exe 3836 frrrlfl.exe 828 nbbttt.exe 3924 vvpjv.exe 2384 3frrrxx.exe 4388 jjpjv.exe 916 xxrrxxx.exe 3024 dpvvv.exe 3536 xxfxrrl.exe 960 nhtnnh.exe 2000 pjpdv.exe 2848 lflxfll.exe 3136 fllrflf.exe 3940 5fllrrf.exe 1232 bthhnn.exe 2028 jpjdp.exe 2236 ppdvj.exe 2304 xrxlllx.exe 3568 nbthhn.exe 4852 pppjj.exe 220 xrrrllf.exe 2464 thnhbb.exe 4608 vpvvv.exe 2496 thbbbt.exe 3444 rflfrll.exe 4684 tntthh.exe 2892 vjdvp.exe 3588 frlfrlx.exe 3636 hthnhn.exe 4324 bthhtn.exe 2032 5pvpj.exe 1872 xrxrlrl.exe 3428 bhthtb.exe 1700 ppddp.exe 4172 dvjjp.exe 2400 rllxxrl.exe 3828 vdjpj.exe 512 1ppjv.exe 632 rlxrlff.exe 4964 ttnbtn.exe 828 tttttn.exe 3880 jvdpv.exe 3160 xrlflxf.exe 4528 hbtbtb.exe 4388 9pjvp.exe 916 vppdp.exe 4616 xrrlrrl.exe 3760 bttbbt.exe 4368 vjjdv.exe 960 5dvpj.exe 2992 3xxrllx.exe 4596 lfxxrxr.exe 2936 hbhbtn.exe 4476 9ddpj.exe 1588 frxrrlr.exe 2060 tnnbbt.exe 4732 jppjd.exe -
resource yara_rule behavioral2/memory/4728-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002363b-3.dat upx behavioral2/memory/2264-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023641-8.dat upx behavioral2/memory/2180-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023642-10.dat upx behavioral2/memory/4940-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023643-18.dat upx behavioral2/files/0x0007000000023644-23.dat upx behavioral2/memory/4568-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4012-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023645-28.dat upx behavioral2/memory/4172-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4172-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023646-33.dat upx behavioral2/files/0x0007000000023647-38.dat upx behavioral2/memory/4912-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023648-43.dat upx behavioral2/memory/2016-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3836-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023649-50.dat upx behavioral2/memory/828-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002364a-54.dat upx behavioral2/memory/3924-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002364b-60.dat upx behavioral2/memory/2384-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002364c-64.dat upx behavioral2/memory/4388-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4388-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002364d-70.dat upx behavioral2/files/0x000700000002364e-74.dat upx behavioral2/memory/916-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002364f-79.dat upx behavioral2/memory/3024-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3536-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023650-85.dat upx behavioral2/files/0x0007000000023651-89.dat upx behavioral2/files/0x000800000002363f-93.dat upx behavioral2/files/0x0007000000023652-97.dat upx behavioral2/memory/2848-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023653-102.dat upx behavioral2/files/0x0007000000023654-106.dat upx behavioral2/memory/3940-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1232-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023655-113.dat upx behavioral2/files/0x0007000000023656-116.dat upx behavioral2/files/0x0007000000023657-120.dat upx behavioral2/files/0x0007000000023658-124.dat upx behavioral2/files/0x0007000000023659-128.dat upx behavioral2/memory/3568-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4852-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002365a-134.dat upx behavioral2/memory/220-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002365b-140.dat upx behavioral2/memory/2464-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002365c-144.dat upx behavioral2/files/0x000700000002365d-148.dat upx behavioral2/memory/2496-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002365e-153.dat upx behavioral2/memory/3444-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4684-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3588-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4324-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1872-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4728 wrote to memory of 2264 4728 cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe 89 PID 4728 wrote to memory of 2264 4728 cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe 89 PID 4728 wrote to memory of 2264 4728 cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe 89 PID 2264 wrote to memory of 2180 2264 hhnnhh.exe 90 PID 2264 wrote to memory of 2180 2264 hhnnhh.exe 90 PID 2264 wrote to memory of 2180 2264 hhnnhh.exe 90 PID 2180 wrote to memory of 4940 2180 9ddvv.exe 91 PID 2180 wrote to memory of 4940 2180 9ddvv.exe 91 PID 2180 wrote to memory of 4940 2180 9ddvv.exe 91 PID 4940 wrote to memory of 4012 4940 llrllll.exe 92 PID 4940 wrote to memory of 4012 4940 llrllll.exe 92 PID 4940 wrote to memory of 4012 4940 llrllll.exe 92 PID 4012 wrote to memory of 4568 4012 jvvvp.exe 93 PID 4012 wrote to memory of 4568 4012 jvvvp.exe 93 PID 4012 wrote to memory of 4568 4012 jvvvp.exe 93 PID 4568 wrote to memory of 4172 4568 vvpjj.exe 94 PID 4568 wrote to memory of 4172 4568 vvpjj.exe 94 PID 4568 wrote to memory of 4172 4568 vvpjj.exe 94 PID 4172 wrote to memory of 4912 4172 xxrfrlf.exe 95 PID 4172 wrote to memory of 4912 4172 xxrfrlf.exe 95 PID 4172 wrote to memory of 4912 4172 xxrfrlf.exe 95 PID 4912 wrote to memory of 2016 4912 rxxxxlf.exe 96 PID 4912 wrote to memory of 2016 4912 rxxxxlf.exe 96 PID 4912 wrote to memory of 2016 4912 rxxxxlf.exe 96 PID 2016 wrote to memory of 3836 2016 bntttt.exe 97 PID 2016 wrote to memory of 3836 2016 bntttt.exe 97 PID 2016 wrote to memory of 3836 2016 bntttt.exe 97 PID 3836 wrote to memory of 828 3836 frrrlfl.exe 98 PID 3836 wrote to memory of 828 3836 frrrlfl.exe 98 PID 3836 wrote to memory of 828 3836 frrrlfl.exe 98 PID 828 wrote to memory of 3924 828 nbbttt.exe 99 PID 828 wrote to memory of 3924 828 nbbttt.exe 99 PID 828 wrote to memory of 3924 828 nbbttt.exe 99 PID 3924 wrote to memory of 2384 3924 vvpjv.exe 100 PID 3924 wrote to memory of 2384 3924 vvpjv.exe 100 PID 3924 wrote to memory of 2384 3924 vvpjv.exe 100 PID 2384 wrote to memory of 4388 2384 3frrrxx.exe 101 PID 2384 wrote to memory of 4388 2384 3frrrxx.exe 101 PID 2384 wrote to memory of 4388 2384 3frrrxx.exe 101 PID 4388 wrote to memory of 916 4388 jjpjv.exe 102 PID 4388 wrote to memory of 916 4388 jjpjv.exe 102 PID 4388 wrote to memory of 916 4388 jjpjv.exe 102 PID 916 wrote to memory of 3024 916 xxrrxxx.exe 104 PID 916 wrote to memory of 3024 916 xxrrxxx.exe 104 PID 916 wrote to memory of 3024 916 xxrrxxx.exe 104 PID 3024 wrote to memory of 3536 3024 dpvvv.exe 106 PID 3024 wrote to memory of 3536 3024 dpvvv.exe 106 PID 3024 wrote to memory of 3536 3024 dpvvv.exe 106 PID 3536 wrote to memory of 960 3536 xxfxrrl.exe 107 PID 3536 wrote to memory of 960 3536 xxfxrrl.exe 107 PID 3536 wrote to memory of 960 3536 xxfxrrl.exe 107 PID 960 wrote to memory of 2000 960 nhtnnh.exe 108 PID 960 wrote to memory of 2000 960 nhtnnh.exe 108 PID 960 wrote to memory of 2000 960 nhtnnh.exe 108 PID 2000 wrote to memory of 2848 2000 pjpdv.exe 110 PID 2000 wrote to memory of 2848 2000 pjpdv.exe 110 PID 2000 wrote to memory of 2848 2000 pjpdv.exe 110 PID 2848 wrote to memory of 3136 2848 lflxfll.exe 111 PID 2848 wrote to memory of 3136 2848 lflxfll.exe 111 PID 2848 wrote to memory of 3136 2848 lflxfll.exe 111 PID 3136 wrote to memory of 3940 3136 fllrflf.exe 112 PID 3136 wrote to memory of 3940 3136 fllrflf.exe 112 PID 3136 wrote to memory of 3940 3136 fllrflf.exe 112 PID 3940 wrote to memory of 1232 3940 5fllrrf.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cfeb716a9ca10c4a5293eaf5ec521aa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\hhnnhh.exec:\hhnnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\9ddvv.exec:\9ddvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\llrllll.exec:\llrllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\jvvvp.exec:\jvvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\vvpjj.exec:\vvpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\xxrfrlf.exec:\xxrfrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\rxxxxlf.exec:\rxxxxlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\bntttt.exec:\bntttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\frrrlfl.exec:\frrrlfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\nbbttt.exec:\nbbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\vvpjv.exec:\vvpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\3frrrxx.exec:\3frrrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\jjpjv.exec:\jjpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\xxrrxxx.exec:\xxrrxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\dpvvv.exec:\dpvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\nhtnnh.exec:\nhtnnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\pjpdv.exec:\pjpdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\lflxfll.exec:\lflxfll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\fllrflf.exec:\fllrflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\5fllrrf.exec:\5fllrrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\bthhnn.exec:\bthhnn.exe23⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jpjdp.exec:\jpjdp.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ppdvj.exec:\ppdvj.exe25⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xrxlllx.exec:\xrxlllx.exe26⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nbthhn.exec:\nbthhn.exe27⤵
- Executes dropped EXE
PID:3568 -
\??\c:\pppjj.exec:\pppjj.exe28⤵
- Executes dropped EXE
PID:4852 -
\??\c:\xrrrllf.exec:\xrrrllf.exe29⤵
- Executes dropped EXE
PID:220 -
\??\c:\thnhbb.exec:\thnhbb.exe30⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vpvvv.exec:\vpvvv.exe31⤵
- Executes dropped EXE
PID:4608 -
\??\c:\thbbbt.exec:\thbbbt.exe32⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rflfrll.exec:\rflfrll.exe33⤵
- Executes dropped EXE
PID:3444 -
\??\c:\tntthh.exec:\tntthh.exe34⤵
- Executes dropped EXE
PID:4684 -
\??\c:\vjdvp.exec:\vjdvp.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\frlfrlx.exec:\frlfrlx.exe36⤵
- Executes dropped EXE
PID:3588 -
\??\c:\hthnhn.exec:\hthnhn.exe37⤵
- Executes dropped EXE
PID:3636 -
\??\c:\bthhtn.exec:\bthhtn.exe38⤵
- Executes dropped EXE
PID:4324 -
\??\c:\5pvpj.exec:\5pvpj.exe39⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xrxrlrl.exec:\xrxrlrl.exe40⤵
- Executes dropped EXE
PID:1872 -
\??\c:\bhthtb.exec:\bhthtb.exe41⤵
- Executes dropped EXE
PID:3428 -
\??\c:\ppddp.exec:\ppddp.exe42⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dvjjp.exec:\dvjjp.exe43⤵
- Executes dropped EXE
PID:4172 -
\??\c:\rllxxrl.exec:\rllxxrl.exe44⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vdjpj.exec:\vdjpj.exe45⤵
- Executes dropped EXE
PID:3828 -
\??\c:\1ppjv.exec:\1ppjv.exe46⤵
- Executes dropped EXE
PID:512 -
\??\c:\rlxrlff.exec:\rlxrlff.exe47⤵
- Executes dropped EXE
PID:632 -
\??\c:\ttnbtn.exec:\ttnbtn.exe48⤵
- Executes dropped EXE
PID:4964 -
\??\c:\tttttn.exec:\tttttn.exe49⤵
- Executes dropped EXE
PID:828 -
\??\c:\jvdpv.exec:\jvdpv.exe50⤵
- Executes dropped EXE
PID:3880 -
\??\c:\xrlflxf.exec:\xrlflxf.exe51⤵
- Executes dropped EXE
PID:3160 -
\??\c:\hbtbtb.exec:\hbtbtb.exe52⤵
- Executes dropped EXE
PID:4528 -
\??\c:\9pjvp.exec:\9pjvp.exe53⤵
- Executes dropped EXE
PID:4388 -
\??\c:\vppdp.exec:\vppdp.exe54⤵
- Executes dropped EXE
PID:916 -
\??\c:\xrrlrrl.exec:\xrrlrrl.exe55⤵
- Executes dropped EXE
PID:4616 -
\??\c:\bttbbt.exec:\bttbbt.exe56⤵
- Executes dropped EXE
PID:3760 -
\??\c:\vjjdv.exec:\vjjdv.exe57⤵
- Executes dropped EXE
PID:4368 -
\??\c:\5dvpj.exec:\5dvpj.exe58⤵
- Executes dropped EXE
PID:960 -
\??\c:\3xxrllx.exec:\3xxrllx.exe59⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lfxxrxr.exec:\lfxxrxr.exe60⤵
- Executes dropped EXE
PID:4596 -
\??\c:\hbhbtn.exec:\hbhbtn.exe61⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9ddpj.exec:\9ddpj.exe62⤵
- Executes dropped EXE
PID:4476 -
\??\c:\frxrrlr.exec:\frxrrlr.exe63⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tnnbbt.exec:\tnnbbt.exe64⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jppjd.exec:\jppjd.exe65⤵
- Executes dropped EXE
PID:4732 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe66⤵PID:1452
-
\??\c:\hntbhb.exec:\hntbhb.exe67⤵PID:2236
-
\??\c:\hhntth.exec:\hhntth.exe68⤵PID:1892
-
\??\c:\pjdjv.exec:\pjdjv.exe69⤵PID:3424
-
\??\c:\1rrfxrl.exec:\1rrfxrl.exe70⤵PID:3264
-
\??\c:\ffrxxrf.exec:\ffrxxrf.exe71⤵PID:4852
-
\??\c:\tnnbnb.exec:\tnnbnb.exe72⤵PID:3712
-
\??\c:\bthtbb.exec:\bthtbb.exe73⤵PID:2592
-
\??\c:\vvvpj.exec:\vvvpj.exe74⤵PID:4176
-
\??\c:\rxfrrlr.exec:\rxfrrlr.exe75⤵PID:4608
-
\??\c:\bhthbh.exec:\bhthbh.exe76⤵PID:2496
-
\??\c:\djdjj.exec:\djdjj.exe77⤵PID:4448
-
\??\c:\vjjvj.exec:\vjjvj.exe78⤵PID:2520
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe79⤵PID:4728
-
\??\c:\nbhbbb.exec:\nbhbbb.exe80⤵PID:1188
-
\??\c:\tnnhbb.exec:\tnnhbb.exe81⤵PID:2024
-
\??\c:\dvjdd.exec:\dvjdd.exe82⤵PID:3636
-
\??\c:\llffffx.exec:\llffffx.exe83⤵PID:4324
-
\??\c:\ntbnht.exec:\ntbnht.exe84⤵PID:2032
-
\??\c:\7flllrr.exec:\7flllrr.exe85⤵PID:4636
-
\??\c:\tntttt.exec:\tntttt.exe86⤵PID:4220
-
\??\c:\dppjd.exec:\dppjd.exe87⤵PID:3224
-
\??\c:\lrxrflf.exec:\lrxrflf.exe88⤵PID:4308
-
\??\c:\lxrxrfx.exec:\lxrxrfx.exe89⤵PID:3716
-
\??\c:\tbnhbt.exec:\tbnhbt.exe90⤵PID:3828
-
\??\c:\jvpjj.exec:\jvpjj.exe91⤵PID:2312
-
\??\c:\vdjvd.exec:\vdjvd.exe92⤵PID:840
-
\??\c:\rfxxxxr.exec:\rfxxxxr.exe93⤵PID:1020
-
\??\c:\hnbthh.exec:\hnbthh.exe94⤵PID:2692
-
\??\c:\jvvvv.exec:\jvvvv.exe95⤵PID:3872
-
\??\c:\frxrrrx.exec:\frxrrrx.exe96⤵PID:3160
-
\??\c:\rfrlfrr.exec:\rfrlfrr.exe97⤵PID:4528
-
\??\c:\nbbtnn.exec:\nbbtnn.exe98⤵PID:4520
-
\??\c:\jddpj.exec:\jddpj.exe99⤵PID:824
-
\??\c:\lrlxfrf.exec:\lrlxfrf.exe100⤵PID:4572
-
\??\c:\hntbtt.exec:\hntbtt.exe101⤵PID:516
-
\??\c:\vvvvv.exec:\vvvvv.exe102⤵PID:1728
-
\??\c:\dvdvp.exec:\dvdvp.exe103⤵PID:960
-
\??\c:\llrfxxr.exec:\llrfxxr.exe104⤵PID:2992
-
\??\c:\1hhbtt.exec:\1hhbtt.exe105⤵PID:4272
-
\??\c:\nbhbbh.exec:\nbhbbh.exe106⤵PID:3204
-
\??\c:\vpdvp.exec:\vpdvp.exe107⤵PID:1588
-
\??\c:\lxffrxr.exec:\lxffrxr.exe108⤵PID:2060
-
\??\c:\bththt.exec:\bththt.exe109⤵PID:4732
-
\??\c:\nbbhbb.exec:\nbbhbb.exe110⤵PID:4984
-
\??\c:\vdddd.exec:\vdddd.exe111⤵PID:2236
-
\??\c:\xfxrfxl.exec:\xfxrfxl.exe112⤵PID:1868
-
\??\c:\btbttb.exec:\btbttb.exe113⤵PID:4920
-
\??\c:\ppvvv.exec:\ppvvv.exe114⤵PID:3264
-
\??\c:\vpvpp.exec:\vpvpp.exe115⤵PID:2852
-
\??\c:\fxfrllf.exec:\fxfrllf.exe116⤵PID:804
-
\??\c:\tbbtnh.exec:\tbbtnh.exe117⤵PID:1712
-
\??\c:\9djjj.exec:\9djjj.exe118⤵PID:3268
-
\??\c:\lflrlxl.exec:\lflrlxl.exe119⤵PID:5044
-
\??\c:\9hnhhn.exec:\9hnhhn.exe120⤵PID:4464
-
\??\c:\jdvdp.exec:\jdvdp.exe121⤵PID:2556
-
\??\c:\rlfxffr.exec:\rlfxffr.exe122⤵PID:684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-