Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 22:59
Behavioral task
behavioral1
Sample
8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe
-
Size
82KB
-
MD5
8b0a1db9fd3c33f10eb4b43412f1bff0
-
SHA1
289bc2ba444dbecf7538925503cebd0a86524ddc
-
SHA256
c12fa0fa2ed9c343136cd53306f3139278663cf7b622bdaa8bae31095ed7dd9e
-
SHA512
fc525cadbb9ac99734dbc68996c9dc83a504b2d16c302c068c0f28c677f55001cb948f1f82ef68ea26fc9aa29a58c294e2d23bc93c7420df2a2298779c21c4de
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOjS0Nytw2SH:9hOmTsF93UYfwC6GIoutyaVszyKd+XYu
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2200-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1076-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/268-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1112-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-384-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2088-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-447-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1536-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1816-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-486-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2800-487-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1848-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-563-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2708-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-734-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-807-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2556-905-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-930-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1476-1001-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1204-1093-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-1305-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2916-1393-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1076 jjvvd.exe 2336 7rxfffl.exe 2972 tnnthn.exe 2580 9hhnbh.exe 2876 dvjpv.exe 2612 xrlxrxx.exe 2628 lflxrxl.exe 1192 hbthnt.exe 2480 vpvpv.exe 2492 xxrrfxr.exe 2960 rlflrxf.exe 2672 bbbnbn.exe 1828 ddvpp.exe 1476 jdpdp.exe 2032 lffrffr.exe 1864 lxlrxff.exe 2796 bbtbnt.exe 1536 9pdjp.exe 2128 5xffffl.exe 1776 9rxlrxl.exe 2024 nnnthn.exe 2104 dvdpp.exe 268 vjdjp.exe 1028 xlfrxxl.exe 1900 hhbthb.exe 1812 7tthtb.exe 1620 1pvvp.exe 2984 3xxfxrf.exe 1112 lxlfxlr.exe 2376 nhhhnb.exe 2896 ppjdd.exe 2180 vppdv.exe 2044 7fxlrfl.exe 848 7fxrflf.exe 2208 bbnbbt.exe 1568 nnhbhh.exe 2852 ppvdd.exe 2808 pjvvd.exe 2972 rrrflrx.exe 2604 7rllflr.exe 2712 9bnbnt.exe 2740 5nhthh.exe 2736 ppvpv.exe 2620 rlrfffl.exe 2720 htnntn.exe 2524 3tbtbt.exe 1656 vjpvv.exe 1984 7ddjj.exe 2692 3lfflrf.exe 2088 9nnttt.exe 2348 htbbtt.exe 2676 vjppj.exe 1312 pjdvj.exe 2032 rlrlfll.exe 2804 ffrflrf.exe 2800 3tnbhb.exe 1556 jdvvd.exe 1536 dpvpd.exe 2940 dvppd.exe 2968 9fxxffl.exe 1816 7flxlfr.exe 2024 htnttt.exe 2820 jjvjp.exe 268 dvpvp.exe -
resource yara_rule behavioral1/memory/2200-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2200-3-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x000c0000000141c0-6.dat upx behavioral1/memory/2200-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1076-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000143ec-18.dat upx behavioral1/memory/2336-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2336-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014539-26.dat upx behavioral1/memory/2972-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014667-37.dat upx behavioral1/memory/2580-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000146a2-44.dat upx behavioral1/memory/2876-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000146b8-55.dat upx behavioral1/files/0x00090000000146c0-62.dat upx behavioral1/memory/2612-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000014825-74.dat upx behavioral1/files/0x00070000000149f5-81.dat upx behavioral1/memory/1192-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014abe-92.dat upx behavioral1/files/0x0007000000014af6-99.dat upx behavioral1/memory/2960-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014b31-109.dat upx behavioral1/files/0x0006000000014b70-116.dat upx behavioral1/files/0x0006000000014de9-124.dat upx behavioral1/memory/1476-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000014ef8-132.dat upx behavioral1/files/0x0006000000015018-142.dat upx behavioral1/memory/1864-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155ed-149.dat upx behavioral1/memory/2796-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155f3-159.dat upx behavioral1/memory/1536-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000155f7-167.dat upx behavioral1/memory/2128-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015605-177.dat upx behavioral1/files/0x0006000000015616-185.dat upx behavioral1/files/0x0006000000015626-192.dat upx behavioral1/memory/2024-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015b6f-201.dat upx behavioral1/memory/2104-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c3d-212.dat upx behavioral1/memory/268-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1028-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c52-221.dat upx behavioral1/memory/1900-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c6b-230.dat upx behavioral1/memory/1812-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c78-239.dat upx behavioral1/memory/1620-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c83-248.dat upx behavioral1/files/0x0006000000015c9f-257.dat upx behavioral1/memory/2984-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1112-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cb6-266.dat upx behavioral1/files/0x0006000000015cce-273.dat upx behavioral1/files/0x0006000000015cee-282.dat upx behavioral1/memory/2180-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2044-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2180-291-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 1076 2200 8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe 28 PID 2200 wrote to memory of 1076 2200 8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe 28 PID 2200 wrote to memory of 1076 2200 8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe 28 PID 2200 wrote to memory of 1076 2200 8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe 28 PID 1076 wrote to memory of 2336 1076 jjvvd.exe 29 PID 1076 wrote to memory of 2336 1076 jjvvd.exe 29 PID 1076 wrote to memory of 2336 1076 jjvvd.exe 29 PID 1076 wrote to memory of 2336 1076 jjvvd.exe 29 PID 2336 wrote to memory of 2972 2336 7rxfffl.exe 30 PID 2336 wrote to memory of 2972 2336 7rxfffl.exe 30 PID 2336 wrote to memory of 2972 2336 7rxfffl.exe 30 PID 2336 wrote to memory of 2972 2336 7rxfffl.exe 30 PID 2972 wrote to memory of 2580 2972 tnnthn.exe 31 PID 2972 wrote to memory of 2580 2972 tnnthn.exe 31 PID 2972 wrote to memory of 2580 2972 tnnthn.exe 31 PID 2972 wrote to memory of 2580 2972 tnnthn.exe 31 PID 2580 wrote to memory of 2876 2580 9hhnbh.exe 32 PID 2580 wrote to memory of 2876 2580 9hhnbh.exe 32 PID 2580 wrote to memory of 2876 2580 9hhnbh.exe 32 PID 2580 wrote to memory of 2876 2580 9hhnbh.exe 32 PID 2876 wrote to memory of 2612 2876 dvjpv.exe 33 PID 2876 wrote to memory of 2612 2876 dvjpv.exe 33 PID 2876 wrote to memory of 2612 2876 dvjpv.exe 33 PID 2876 wrote to memory of 2612 2876 dvjpv.exe 33 PID 2612 wrote to memory of 2628 2612 xrlxrxx.exe 34 PID 2612 wrote to memory of 2628 2612 xrlxrxx.exe 34 PID 2612 wrote to memory of 2628 2612 xrlxrxx.exe 34 PID 2612 wrote to memory of 2628 2612 xrlxrxx.exe 34 PID 2628 wrote to memory of 1192 2628 lflxrxl.exe 35 PID 2628 wrote to memory of 1192 2628 lflxrxl.exe 35 PID 2628 wrote to memory of 1192 2628 lflxrxl.exe 35 PID 2628 wrote to memory of 1192 2628 lflxrxl.exe 35 PID 1192 wrote to memory of 2480 1192 hbthnt.exe 36 PID 1192 wrote to memory of 2480 1192 hbthnt.exe 36 PID 1192 wrote to memory of 2480 1192 hbthnt.exe 36 PID 1192 wrote to memory of 2480 1192 hbthnt.exe 36 PID 2480 wrote to memory of 2492 2480 vpvpv.exe 37 PID 2480 wrote to memory of 2492 2480 vpvpv.exe 37 PID 2480 wrote to memory of 2492 2480 vpvpv.exe 37 PID 2480 wrote to memory of 2492 2480 vpvpv.exe 37 PID 2492 wrote to memory of 2960 2492 xxrrfxr.exe 38 PID 2492 wrote to memory of 2960 2492 xxrrfxr.exe 38 PID 2492 wrote to memory of 2960 2492 xxrrfxr.exe 38 PID 2492 wrote to memory of 2960 2492 xxrrfxr.exe 38 PID 2960 wrote to memory of 2672 2960 rlflrxf.exe 39 PID 2960 wrote to memory of 2672 2960 rlflrxf.exe 39 PID 2960 wrote to memory of 2672 2960 rlflrxf.exe 39 PID 2960 wrote to memory of 2672 2960 rlflrxf.exe 39 PID 2672 wrote to memory of 1828 2672 bbbnbn.exe 40 PID 2672 wrote to memory of 1828 2672 bbbnbn.exe 40 PID 2672 wrote to memory of 1828 2672 bbbnbn.exe 40 PID 2672 wrote to memory of 1828 2672 bbbnbn.exe 40 PID 1828 wrote to memory of 1476 1828 ddvpp.exe 41 PID 1828 wrote to memory of 1476 1828 ddvpp.exe 41 PID 1828 wrote to memory of 1476 1828 ddvpp.exe 41 PID 1828 wrote to memory of 1476 1828 ddvpp.exe 41 PID 1476 wrote to memory of 2032 1476 jdpdp.exe 42 PID 1476 wrote to memory of 2032 1476 jdpdp.exe 42 PID 1476 wrote to memory of 2032 1476 jdpdp.exe 42 PID 1476 wrote to memory of 2032 1476 jdpdp.exe 42 PID 2032 wrote to memory of 1864 2032 lffrffr.exe 43 PID 2032 wrote to memory of 1864 2032 lffrffr.exe 43 PID 2032 wrote to memory of 1864 2032 lffrffr.exe 43 PID 2032 wrote to memory of 1864 2032 lffrffr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\8b0a1db9fd3c33f10eb4b43412f1bff0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\jjvvd.exec:\jjvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\7rxfffl.exec:\7rxfffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\tnnthn.exec:\tnnthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\9hhnbh.exec:\9hhnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\dvjpv.exec:\dvjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xrlxrxx.exec:\xrlxrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\lflxrxl.exec:\lflxrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\hbthnt.exec:\hbthnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\vpvpv.exec:\vpvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\xxrrfxr.exec:\xxrrfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\rlflrxf.exec:\rlflrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\bbbnbn.exec:\bbbnbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\ddvpp.exec:\ddvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\jdpdp.exec:\jdpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\lffrffr.exec:\lffrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\lxlrxff.exec:\lxlrxff.exe17⤵
- Executes dropped EXE
PID:1864 -
\??\c:\bbtbnt.exec:\bbtbnt.exe18⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9pdjp.exec:\9pdjp.exe19⤵
- Executes dropped EXE
PID:1536 -
\??\c:\5xffffl.exec:\5xffffl.exe20⤵
- Executes dropped EXE
PID:2128 -
\??\c:\9rxlrxl.exec:\9rxlrxl.exe21⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nnnthn.exec:\nnnthn.exe22⤵
- Executes dropped EXE
PID:2024 -
\??\c:\dvdpp.exec:\dvdpp.exe23⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vjdjp.exec:\vjdjp.exe24⤵
- Executes dropped EXE
PID:268 -
\??\c:\xlfrxxl.exec:\xlfrxxl.exe25⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hhbthb.exec:\hhbthb.exe26⤵
- Executes dropped EXE
PID:1900 -
\??\c:\7tthtb.exec:\7tthtb.exe27⤵
- Executes dropped EXE
PID:1812 -
\??\c:\1pvvp.exec:\1pvvp.exe28⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3xxfxrf.exec:\3xxfxrf.exe29⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lxlfxlr.exec:\lxlfxlr.exe30⤵
- Executes dropped EXE
PID:1112 -
\??\c:\nhhhnb.exec:\nhhhnb.exe31⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ppjdd.exec:\ppjdd.exe32⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vppdv.exec:\vppdv.exe33⤵
- Executes dropped EXE
PID:2180 -
\??\c:\7fxlrfl.exec:\7fxlrfl.exe34⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7fxrflf.exec:\7fxrflf.exe35⤵
- Executes dropped EXE
PID:848 -
\??\c:\bbnbbt.exec:\bbnbbt.exe36⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nnhbhh.exec:\nnhbhh.exe37⤵
- Executes dropped EXE
PID:1568 -
\??\c:\ppvdd.exec:\ppvdd.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pjvvd.exec:\pjvvd.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rrrflrx.exec:\rrrflrx.exe40⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7rllflr.exec:\7rllflr.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9bnbnt.exec:\9bnbnt.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5nhthh.exec:\5nhthh.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ppvpv.exec:\ppvpv.exe44⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rlrfffl.exec:\rlrfffl.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\htnntn.exec:\htnntn.exe46⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3tbtbt.exec:\3tbtbt.exe47⤵
- Executes dropped EXE
PID:2524 -
\??\c:\vjpvv.exec:\vjpvv.exe48⤵
- Executes dropped EXE
PID:1656 -
\??\c:\7ddjj.exec:\7ddjj.exe49⤵
- Executes dropped EXE
PID:1984 -
\??\c:\3lfflrf.exec:\3lfflrf.exe50⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9nnttt.exec:\9nnttt.exe51⤵
- Executes dropped EXE
PID:2088 -
\??\c:\htbbtt.exec:\htbbtt.exe52⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vjppj.exec:\vjppj.exe53⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pjdvj.exec:\pjdvj.exe54⤵
- Executes dropped EXE
PID:1312 -
\??\c:\rlrlfll.exec:\rlrlfll.exe55⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ffrflrf.exec:\ffrflrf.exe56⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3tnbhb.exec:\3tnbhb.exe57⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jdvvd.exec:\jdvvd.exe58⤵
- Executes dropped EXE
PID:1556 -
\??\c:\dpvpd.exec:\dpvpd.exe59⤵
- Executes dropped EXE
PID:1536 -
\??\c:\dvppd.exec:\dvppd.exe60⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9fxxffl.exec:\9fxxffl.exe61⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7flxlfr.exec:\7flxlfr.exe62⤵
- Executes dropped EXE
PID:1816 -
\??\c:\htnttt.exec:\htnttt.exe63⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jjvjp.exec:\jjvjp.exe64⤵
- Executes dropped EXE
PID:2820 -
\??\c:\dvpvp.exec:\dvpvp.exe65⤵
- Executes dropped EXE
PID:268 -
\??\c:\fxrxlfr.exec:\fxrxlfr.exe66⤵PID:1020
-
\??\c:\lxlxxxf.exec:\lxlxxxf.exe67⤵PID:1788
-
\??\c:\9tbtnn.exec:\9tbtnn.exe68⤵PID:1472
-
\??\c:\htnntb.exec:\htnntb.exe69⤵PID:1532
-
\??\c:\3vvdj.exec:\3vvdj.exe70⤵PID:980
-
\??\c:\vppjp.exec:\vppjp.exe71⤵PID:2884
-
\??\c:\rfrrflx.exec:\rfrrflx.exe72⤵PID:1848
-
\??\c:\frxlrrf.exec:\frxlrrf.exe73⤵PID:900
-
\??\c:\bnhtnn.exec:\bnhtnn.exe74⤵PID:2908
-
\??\c:\ttbhtt.exec:\ttbhtt.exe75⤵PID:2140
-
\??\c:\jddvd.exec:\jddvd.exe76⤵PID:1016
-
\??\c:\jdddj.exec:\jdddj.exe77⤵PID:3052
-
\??\c:\lfrfrxr.exec:\lfrfrxr.exe78⤵PID:2044
-
\??\c:\lxlxxff.exec:\lxlxxff.exe79⤵PID:3000
-
\??\c:\1nnthh.exec:\1nnthh.exe80⤵PID:2536
-
\??\c:\nbnhnt.exec:\nbnhnt.exe81⤵PID:1692
-
\??\c:\vpdpd.exec:\vpdpd.exe82⤵PID:2212
-
\??\c:\1ddvp.exec:\1ddvp.exe83⤵PID:3012
-
\??\c:\llxxxfl.exec:\llxxxfl.exe84⤵PID:2708
-
\??\c:\5xrxrxl.exec:\5xrxrxl.exe85⤵PID:2240
-
\??\c:\3nnhtn.exec:\3nnhtn.exe86⤵PID:2484
-
\??\c:\nbttbh.exec:\nbttbh.exe87⤵PID:2596
-
\??\c:\vpjvd.exec:\vpjvd.exe88⤵PID:3032
-
\??\c:\vdvvv.exec:\vdvvv.exe89⤵PID:2564
-
\??\c:\lfxllrx.exec:\lfxllrx.exe90⤵PID:2496
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe91⤵PID:2464
-
\??\c:\nhthhn.exec:\nhthhn.exe92⤵PID:2572
-
\??\c:\7bnbhn.exec:\7bnbhn.exe93⤵PID:936
-
\??\c:\vpjpp.exec:\vpjpp.exe94⤵PID:2960
-
\??\c:\vdppp.exec:\vdppp.exe95⤵PID:2692
-
\??\c:\9rfxlxf.exec:\9rfxlxf.exe96⤵PID:2176
-
\??\c:\3xxffxx.exec:\3xxffxx.exe97⤵PID:2348
-
\??\c:\fxxflrf.exec:\fxxflrf.exe98⤵PID:932
-
\??\c:\htnbbt.exec:\htnbbt.exe99⤵PID:2636
-
\??\c:\thhnbn.exec:\thhnbn.exe100⤵PID:2340
-
\??\c:\vdjpj.exec:\vdjpj.exe101⤵PID:2804
-
\??\c:\frfrrxl.exec:\frfrrxl.exe102⤵PID:2696
-
\??\c:\rfflrlx.exec:\rfflrlx.exe103⤵PID:2936
-
\??\c:\tnbbhn.exec:\tnbbhn.exe104⤵PID:1536
-
\??\c:\9bnnnh.exec:\9bnnnh.exe105⤵PID:1440
-
\??\c:\5nhthn.exec:\5nhthn.exe106⤵PID:2964
-
\??\c:\vpdjj.exec:\vpdjj.exe107⤵PID:1816
-
\??\c:\7jdpv.exec:\7jdpv.exe108⤵PID:2284
-
\??\c:\rlffrxf.exec:\rlffrxf.exe109⤵PID:2820
-
\??\c:\lxxxxxl.exec:\lxxxxxl.exe110⤵PID:832
-
\??\c:\thtttb.exec:\thtttb.exe111⤵PID:1424
-
\??\c:\3nbhhh.exec:\3nbhhh.exe112⤵PID:1792
-
\??\c:\djdjj.exec:\djdjj.exe113⤵PID:2064
-
\??\c:\dvpdp.exec:\dvpdp.exe114⤵PID:1128
-
\??\c:\frxxxxx.exec:\frxxxxx.exe115⤵PID:1844
-
\??\c:\5xrxlrx.exec:\5xrxlrx.exe116⤵PID:2976
-
\??\c:\7bbbtt.exec:\7bbbtt.exe117⤵PID:960
-
\??\c:\3ttbhh.exec:\3ttbhh.exe118⤵PID:2376
-
\??\c:\9dppp.exec:\9dppp.exe119⤵PID:2080
-
\??\c:\1jdpd.exec:\1jdpd.exe120⤵PID:2888
-
\??\c:\pdddj.exec:\pdddj.exe121⤵PID:2992
-
\??\c:\9fllffr.exec:\9fllffr.exe122⤵PID:2932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-