Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 13:37
Behavioral task
behavioral1
Sample
66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe
Resource
win7-20240508-en
7 signatures
150 seconds
General
-
Target
66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe
-
Size
169KB
-
MD5
5e832c1cf14a3dbd44c14e2616169af0
-
SHA1
66f568676d2d0e72dd86575b6855389e51d097e0
-
SHA256
66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f
-
SHA512
558f581ba47fe998c0c20e0c80ad58f9ba46d74473394883d993bc4684b6b1f84630f028248ade60b56fe6e5120d9780ace49d4695713822d094a65249896c6c
-
SSDEEP
1536:HvQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7FK4O8A1o4XEc3YtxD8/Ai2p:HhOmTsF93UYfwC6GIoutX8Ki3c3YT8V2
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4420-6-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4344-7-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3224-19-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4520-20-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/884-30-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4936-44-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4784-38-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2684-32-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/216-59-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4688-64-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2040-69-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3020-76-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3628-82-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1920-90-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2368-96-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2036-105-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3184-110-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3668-114-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/432-122-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2000-132-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1156-138-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4860-147-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5044-157-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3684-163-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3888-170-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2856-178-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3788-184-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1624-190-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1568-199-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3536-206-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3812-219-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/760-223-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1864-225-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5004-238-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3468-258-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5068-262-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4244-268-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1572-271-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1964-278-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3224-282-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4324-293-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4784-298-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3312-304-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2904-317-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4176-331-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5080-356-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1508-361-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/432-368-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1744-383-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2636-390-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4968-406-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3736-420-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4080-427-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4360-440-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4472-456-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3272-562-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2744-637-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/228-650-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2516-654-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4520-722-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3100-880-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4124-899-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4300-986-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4300-989-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4344 thtntt.exe 3224 xlxxrll.exe 4520 xrxrxxx.exe 884 bttbnn.exe 2684 dvvvd.exe 4784 xrxrrrl.exe 4936 rxffxxx.exe 1740 nnnntb.exe 216 pdppp.exe 4688 jjvpp.exe 2040 flrrrxx.exe 3020 bbhhbb.exe 3628 ffrrflx.exe 3272 vjjpp.exe 1920 vjppv.exe 2368 lrxrrrr.exe 2036 nbnnhn.exe 3184 1dvjp.exe 3668 ntnbnh.exe 432 vdjjd.exe 2468 xlrrfll.exe 2000 vppjp.exe 1156 lxxxrff.exe 4860 nnbnnn.exe 2400 9lrrflr.exe 5044 9xfxrxr.exe 3684 rrlxrff.exe 3888 tbbthh.exe 4912 bbtbtn.exe 2856 jddvv.exe 3788 1vvvp.exe 1624 llxfffr.exe 4620 nhtttt.exe 1568 ppjpj.exe 2408 flxxllr.exe 3536 tthbbt.exe 3492 dvddv.exe 4056 ppjjp.exe 3792 rfrlllf.exe 3812 xfrxlfx.exe 760 nhthhh.exe 1864 ddjjj.exe 5024 djddv.exe 3828 rrlxffl.exe 5004 nhnbbb.exe 1904 3nbtbb.exe 4512 vpjdp.exe 2124 fllllff.exe 4760 xxrrrxr.exe 2412 ttbbbb.exe 4280 pdjpd.exe 3468 lxrllff.exe 5068 fffllrr.exe 4244 1bhbtt.exe 1572 5xffffx.exe 3960 nhhhhh.exe 1964 ttnhnn.exe 3224 pppdd.exe 4520 fxfxxrl.exe 4684 3rrrrxr.exe 4324 bhttnn.exe 2112 vvvvv.exe 4784 ffxlrll.exe 3312 3hbbnn.exe -
resource yara_rule behavioral2/memory/4420-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4420-6-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0008000000022f51-4.dat upx behavioral2/memory/4344-7-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000900000002340a-10.dat upx behavioral2/files/0x0007000000023413-13.dat upx behavioral2/memory/3224-19-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4520-20-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023414-23.dat upx behavioral2/memory/884-30-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023418-40.dat upx behavioral2/files/0x0007000000023419-46.dat upx behavioral2/memory/4936-44-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4784-38-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023417-35.dat upx behavioral2/memory/2684-32-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023416-29.dat upx behavioral2/files/0x000700000002341a-51.dat upx behavioral2/files/0x000700000002341b-56.dat upx behavioral2/memory/216-59-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4688-60-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000700000002341c-63.dat upx behavioral2/memory/4688-64-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2040-69-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000700000002341d-70.dat upx behavioral2/files/0x000700000002341e-74.dat upx behavioral2/memory/3020-76-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000700000002341f-80.dat upx behavioral2/memory/3628-82-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023420-87.dat upx behavioral2/memory/1920-90-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023421-92.dat upx behavioral2/memory/2368-96-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023422-99.dat upx behavioral2/files/0x0007000000023423-103.dat upx behavioral2/memory/2036-105-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3184-110-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023424-111.dat upx behavioral2/memory/3668-114-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023425-116.dat upx behavioral2/memory/432-122-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0009000000023410-124.dat upx behavioral2/memory/2468-125-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023426-128.dat upx behavioral2/memory/2000-132-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023427-134.dat upx behavioral2/memory/1156-138-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023428-140.dat upx behavioral2/files/0x0007000000023429-145.dat upx behavioral2/files/0x000700000002342a-152.dat upx behavioral2/memory/4860-147-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000700000002342b-158.dat upx behavioral2/memory/5044-157-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000700000002342c-164.dat upx behavioral2/memory/3684-163-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000700000002342d-168.dat upx behavioral2/memory/3888-170-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000700000002342e-175.dat upx behavioral2/memory/2856-178-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000700000002342f-179.dat upx behavioral2/memory/3788-184-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023430-186.dat upx behavioral2/memory/1624-190-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1568-199-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4420 wrote to memory of 4344 4420 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe 81 PID 4420 wrote to memory of 4344 4420 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe 81 PID 4420 wrote to memory of 4344 4420 66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe 81 PID 4344 wrote to memory of 3224 4344 thtntt.exe 82 PID 4344 wrote to memory of 3224 4344 thtntt.exe 82 PID 4344 wrote to memory of 3224 4344 thtntt.exe 82 PID 3224 wrote to memory of 4520 3224 xlxxrll.exe 83 PID 3224 wrote to memory of 4520 3224 xlxxrll.exe 83 PID 3224 wrote to memory of 4520 3224 xlxxrll.exe 83 PID 4520 wrote to memory of 884 4520 xrxrxxx.exe 84 PID 4520 wrote to memory of 884 4520 xrxrxxx.exe 84 PID 4520 wrote to memory of 884 4520 xrxrxxx.exe 84 PID 884 wrote to memory of 2684 884 bttbnn.exe 85 PID 884 wrote to memory of 2684 884 bttbnn.exe 85 PID 884 wrote to memory of 2684 884 bttbnn.exe 85 PID 2684 wrote to memory of 4784 2684 dvvvd.exe 86 PID 2684 wrote to memory of 4784 2684 dvvvd.exe 86 PID 2684 wrote to memory of 4784 2684 dvvvd.exe 86 PID 4784 wrote to memory of 4936 4784 xrxrrrl.exe 87 PID 4784 wrote to memory of 4936 4784 xrxrrrl.exe 87 PID 4784 wrote to memory of 4936 4784 xrxrrrl.exe 87 PID 4936 wrote to memory of 1740 4936 rxffxxx.exe 88 PID 4936 wrote to memory of 1740 4936 rxffxxx.exe 88 PID 4936 wrote to memory of 1740 4936 rxffxxx.exe 88 PID 1740 wrote to memory of 216 1740 nnnntb.exe 89 PID 1740 wrote to memory of 216 1740 nnnntb.exe 89 PID 1740 wrote to memory of 216 1740 nnnntb.exe 89 PID 216 wrote to memory of 4688 216 pdppp.exe 90 PID 216 wrote to memory of 4688 216 pdppp.exe 90 PID 216 wrote to memory of 4688 216 pdppp.exe 90 PID 4688 wrote to memory of 2040 4688 jjvpp.exe 91 PID 4688 wrote to memory of 2040 4688 jjvpp.exe 91 PID 4688 wrote to memory of 2040 4688 jjvpp.exe 91 PID 2040 wrote to memory of 3020 2040 flrrrxx.exe 92 PID 2040 wrote to memory of 3020 2040 flrrrxx.exe 92 PID 2040 wrote to memory of 3020 2040 flrrrxx.exe 92 PID 3020 wrote to memory of 3628 3020 bbhhbb.exe 93 PID 3020 wrote to memory of 3628 3020 bbhhbb.exe 93 PID 3020 wrote to memory of 3628 3020 bbhhbb.exe 93 PID 3628 wrote to memory of 3272 3628 ffrrflx.exe 94 PID 3628 wrote to memory of 3272 3628 ffrrflx.exe 94 PID 3628 wrote to memory of 3272 3628 ffrrflx.exe 94 PID 3272 wrote to memory of 1920 3272 vjjpp.exe 95 PID 3272 wrote to memory of 1920 3272 vjjpp.exe 95 PID 3272 wrote to memory of 1920 3272 vjjpp.exe 95 PID 1920 wrote to memory of 2368 1920 vjppv.exe 96 PID 1920 wrote to memory of 2368 1920 vjppv.exe 96 PID 1920 wrote to memory of 2368 1920 vjppv.exe 96 PID 2368 wrote to memory of 2036 2368 lrxrrrr.exe 97 PID 2368 wrote to memory of 2036 2368 lrxrrrr.exe 97 PID 2368 wrote to memory of 2036 2368 lrxrrrr.exe 97 PID 2036 wrote to memory of 3184 2036 nbnnhn.exe 98 PID 2036 wrote to memory of 3184 2036 nbnnhn.exe 98 PID 2036 wrote to memory of 3184 2036 nbnnhn.exe 98 PID 3184 wrote to memory of 3668 3184 1dvjp.exe 99 PID 3184 wrote to memory of 3668 3184 1dvjp.exe 99 PID 3184 wrote to memory of 3668 3184 1dvjp.exe 99 PID 3668 wrote to memory of 432 3668 ntnbnh.exe 100 PID 3668 wrote to memory of 432 3668 ntnbnh.exe 100 PID 3668 wrote to memory of 432 3668 ntnbnh.exe 100 PID 432 wrote to memory of 2468 432 vdjjd.exe 101 PID 432 wrote to memory of 2468 432 vdjjd.exe 101 PID 432 wrote to memory of 2468 432 vdjjd.exe 101 PID 2468 wrote to memory of 2000 2468 xlrrfll.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\66c38a85d4873e171d0538bdecad163d204b3c4790e0c1731a05d1d870589b8f_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\thtntt.exec:\thtntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\xlxxrll.exec:\xlxxrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\xrxrxxx.exec:\xrxrxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\bttbnn.exec:\bttbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\dvvvd.exec:\dvvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\rxffxxx.exec:\rxffxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\nnnntb.exec:\nnnntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\pdppp.exec:\pdppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\jjvpp.exec:\jjvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\flrrrxx.exec:\flrrrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\bbhhbb.exec:\bbhhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\ffrrflx.exec:\ffrrflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\vjjpp.exec:\vjjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\vjppv.exec:\vjppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\nbnnhn.exec:\nbnnhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\1dvjp.exec:\1dvjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\ntnbnh.exec:\ntnbnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\vdjjd.exec:\vdjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\xlrrfll.exec:\xlrrfll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\vppjp.exec:\vppjp.exe23⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lxxxrff.exec:\lxxxrff.exe24⤵
- Executes dropped EXE
PID:1156 -
\??\c:\nnbnnn.exec:\nnbnnn.exe25⤵
- Executes dropped EXE
PID:4860 -
\??\c:\9lrrflr.exec:\9lrrflr.exe26⤵
- Executes dropped EXE
PID:2400 -
\??\c:\9xfxrxr.exec:\9xfxrxr.exe27⤵
- Executes dropped EXE
PID:5044 -
\??\c:\rrlxrff.exec:\rrlxrff.exe28⤵
- Executes dropped EXE
PID:3684 -
\??\c:\tbbthh.exec:\tbbthh.exe29⤵
- Executes dropped EXE
PID:3888 -
\??\c:\bbtbtn.exec:\bbtbtn.exe30⤵
- Executes dropped EXE
PID:4912 -
\??\c:\jddvv.exec:\jddvv.exe31⤵
- Executes dropped EXE
PID:2856 -
\??\c:\1vvvp.exec:\1vvvp.exe32⤵
- Executes dropped EXE
PID:3788 -
\??\c:\llxfffr.exec:\llxfffr.exe33⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nhtttt.exec:\nhtttt.exe34⤵
- Executes dropped EXE
PID:4620 -
\??\c:\ppjpj.exec:\ppjpj.exe35⤵
- Executes dropped EXE
PID:1568 -
\??\c:\flxxllr.exec:\flxxllr.exe36⤵
- Executes dropped EXE
PID:2408 -
\??\c:\tthbbt.exec:\tthbbt.exe37⤵
- Executes dropped EXE
PID:3536 -
\??\c:\dvddv.exec:\dvddv.exe38⤵
- Executes dropped EXE
PID:3492 -
\??\c:\ppjjp.exec:\ppjjp.exe39⤵
- Executes dropped EXE
PID:4056 -
\??\c:\rfrlllf.exec:\rfrlllf.exe40⤵
- Executes dropped EXE
PID:3792 -
\??\c:\xfrxlfx.exec:\xfrxlfx.exe41⤵
- Executes dropped EXE
PID:3812 -
\??\c:\nhthhh.exec:\nhthhh.exe42⤵
- Executes dropped EXE
PID:760 -
\??\c:\ddjjj.exec:\ddjjj.exe43⤵
- Executes dropped EXE
PID:1864 -
\??\c:\djddv.exec:\djddv.exe44⤵
- Executes dropped EXE
PID:5024 -
\??\c:\rrlxffl.exec:\rrlxffl.exe45⤵
- Executes dropped EXE
PID:3828 -
\??\c:\nhnbbb.exec:\nhnbbb.exe46⤵
- Executes dropped EXE
PID:5004 -
\??\c:\3nbtbb.exec:\3nbtbb.exe47⤵
- Executes dropped EXE
PID:1904 -
\??\c:\vpjdp.exec:\vpjdp.exe48⤵
- Executes dropped EXE
PID:4512 -
\??\c:\fllllff.exec:\fllllff.exe49⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xxrrrxr.exec:\xxrrrxr.exe50⤵
- Executes dropped EXE
PID:4760 -
\??\c:\ttbbbb.exec:\ttbbbb.exe51⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pdjpd.exec:\pdjpd.exe52⤵
- Executes dropped EXE
PID:4280 -
\??\c:\lxrllff.exec:\lxrllff.exe53⤵
- Executes dropped EXE
PID:3468 -
\??\c:\fffllrr.exec:\fffllrr.exe54⤵
- Executes dropped EXE
PID:5068 -
\??\c:\1bhbtt.exec:\1bhbtt.exe55⤵
- Executes dropped EXE
PID:4244 -
\??\c:\5xffffx.exec:\5xffffx.exe56⤵
- Executes dropped EXE
PID:1572 -
\??\c:\nhhhhh.exec:\nhhhhh.exe57⤵
- Executes dropped EXE
PID:3960 -
\??\c:\ttnhnn.exec:\ttnhnn.exe58⤵
- Executes dropped EXE
PID:1964 -
\??\c:\pppdd.exec:\pppdd.exe59⤵
- Executes dropped EXE
PID:3224 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe60⤵
- Executes dropped EXE
PID:4520 -
\??\c:\3rrrrxr.exec:\3rrrrxr.exe61⤵
- Executes dropped EXE
PID:4684 -
\??\c:\bhttnn.exec:\bhttnn.exe62⤵
- Executes dropped EXE
PID:4324 -
\??\c:\vvvvv.exec:\vvvvv.exe63⤵
- Executes dropped EXE
PID:2112 -
\??\c:\ffxlrll.exec:\ffxlrll.exe64⤵
- Executes dropped EXE
PID:4784 -
\??\c:\3hbbnn.exec:\3hbbnn.exe65⤵
- Executes dropped EXE
PID:3312 -
\??\c:\pvpjv.exec:\pvpjv.exe66⤵PID:3364
-
\??\c:\lfrllfr.exec:\lfrllfr.exe67⤵PID:1000
-
\??\c:\7lllflf.exec:\7lllflf.exe68⤵PID:2416
-
\??\c:\nnbhhh.exec:\nnbhhh.exe69⤵PID:2904
-
\??\c:\vpppv.exec:\vpppv.exe70⤵PID:2688
-
\??\c:\frrlfrx.exec:\frrlfrx.exe71⤵PID:860
-
\??\c:\9nbbtb.exec:\9nbbtb.exe72⤵PID:5040
-
\??\c:\tnhbnn.exec:\tnhbnn.exe73⤵PID:4804
-
\??\c:\pvjdv.exec:\pvjdv.exe74⤵PID:4176
-
\??\c:\3pvdv.exec:\3pvdv.exe75⤵PID:4832
-
\??\c:\9rlfrlf.exec:\9rlfrlf.exe76⤵PID:3272
-
\??\c:\nhbbhn.exec:\nhbbhn.exe77⤵PID:4980
-
\??\c:\ttbbtb.exec:\ttbbtb.exe78⤵PID:3716
-
\??\c:\pvjpv.exec:\pvjpv.exe79⤵PID:2772
-
\??\c:\jdpjd.exec:\jdpjd.exe80⤵PID:5064
-
\??\c:\9ffxrrl.exec:\9ffxrrl.exe81⤵PID:5080
-
\??\c:\nnntth.exec:\nnntth.exe82⤵PID:2344
-
\??\c:\vpjjd.exec:\vpjjd.exe83⤵PID:1508
-
\??\c:\pvvpp.exec:\pvvpp.exe84⤵PID:2184
-
\??\c:\frrfrrr.exec:\frrfrrr.exe85⤵PID:432
-
\??\c:\bntbtb.exec:\bntbtb.exe86⤵PID:2468
-
\??\c:\3vppp.exec:\3vppp.exe87⤵PID:4084
-
\??\c:\jdpdd.exec:\jdpdd.exe88⤵PID:3148
-
\??\c:\rllrffx.exec:\rllrffx.exe89⤵PID:1744
-
\??\c:\nhtnnb.exec:\nhtnnb.exe90⤵PID:864
-
\??\c:\nnbthh.exec:\nnbthh.exe91⤵PID:2636
-
\??\c:\9dppv.exec:\9dppv.exe92⤵PID:428
-
\??\c:\ppddj.exec:\ppddj.exe93⤵PID:4440
-
\??\c:\9rrrrxf.exec:\9rrrrxf.exe94⤵PID:1956
-
\??\c:\bbnhht.exec:\bbnhht.exe95⤵PID:2484
-
\??\c:\vdpdv.exec:\vdpdv.exe96⤵PID:4968
-
\??\c:\dvvjv.exec:\dvvjv.exe97⤵PID:1040
-
\??\c:\5ffxxxx.exec:\5ffxxxx.exe98⤵PID:3876
-
\??\c:\1htnhh.exec:\1htnhh.exe99⤵PID:1524
-
\??\c:\tbbnth.exec:\tbbnth.exe100⤵PID:4640
-
\??\c:\ppppp.exec:\ppppp.exe101⤵PID:3736
-
\??\c:\1pvpp.exec:\1pvpp.exe102⤵PID:2272
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe103⤵PID:4080
-
\??\c:\flfxrlf.exec:\flfxrlf.exe104⤵PID:2192
-
\??\c:\jdjvv.exec:\jdjvv.exe105⤵PID:3688
-
\??\c:\vpddv.exec:\vpddv.exe106⤵PID:4360
-
\??\c:\flrrxrf.exec:\flrrxrf.exe107⤵PID:4408
-
\??\c:\tbhhnh.exec:\tbhhnh.exe108⤵PID:4184
-
\??\c:\bbhnhh.exec:\bbhnhh.exe109⤵PID:1360
-
\??\c:\dpppp.exec:\dpppp.exe110⤵PID:4484
-
\??\c:\vjvvv.exec:\vjvvv.exe111⤵PID:4472
-
\??\c:\lllfrrf.exec:\lllfrrf.exe112⤵PID:4932
-
\??\c:\nbtthh.exec:\nbtthh.exe113⤵PID:4356
-
\??\c:\tttbnn.exec:\tttbnn.exe114⤵PID:876
-
\??\c:\dddvp.exec:\dddvp.exe115⤵PID:872
-
\??\c:\xxlfxfr.exec:\xxlfxfr.exe116⤵PID:832
-
\??\c:\xfxfxxl.exec:\xfxfxxl.exe117⤵PID:4692
-
\??\c:\5bhhtt.exec:\5bhhtt.exe118⤵PID:1716
-
\??\c:\dvvvp.exec:\dvvvp.exe119⤵PID:4800
-
\??\c:\9dvvd.exec:\9dvvd.exe120⤵PID:4992
-
\??\c:\pdpvp.exec:\pdpvp.exe121⤵PID:5116
-
\??\c:\lxrrlll.exec:\lxrrlll.exe122⤵PID:5068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-