Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 00:18
Behavioral task
behavioral1
Sample
28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe
-
Size
82KB
-
MD5
28dafbfb70746a46d5c57b7b03416ed0
-
SHA1
388896c5a9a354c074f6bccaf549387ba8bc62cd
-
SHA256
fe3ed9ef1414624e5972a1e302523b7d0623b5a254d139013ec29ac06aaeb618
-
SHA512
137627af8eea2d016e63bcf132426281b31414a35adfd9c307e9db8e941d654c4000131d3b4dcd878f318321c6214a6a45130af7c5366022d3e6a83f66fe25cd
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TQpCi1PC:zhOmTsF93UYfwC6GIoutiTU2HVS64NC
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4796-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2740-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5864-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5196-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/648-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5172-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5488-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1332-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5372-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5948-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5256-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5716-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5444-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1240-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5380-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5796-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5764-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5248-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5292-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-860-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-909-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2740 jvvpv.exe 2736 rfrfrxr.exe 5864 frfrxlx.exe 2672 nbnnnh.exe 1176 3hbtth.exe 1384 vvdpj.exe 3624 xxllfxx.exe 1524 tnhbbn.exe 3260 1nhnbn.exe 660 xfrrrlf.exe 4952 xfrlxxl.exe 60 hhthnb.exe 5744 pddvd.exe 4112 frrllfr.exe 5196 lrlrfxf.exe 4124 nttbbt.exe 4564 jvdvj.exe 5076 fxrxflr.exe 2248 btnhbb.exe 3612 nhtbth.exe 2992 ddpdp.exe 3640 ffxlxrl.exe 3916 bnhhnt.exe 648 dpppd.exe 3648 lrxfrll.exe 4604 hbbtnb.exe 2020 jdddj.exe 5172 vvppv.exe 5588 9flrfrx.exe 3752 tnbhnt.exe 4544 nbttth.exe 2124 jjdpj.exe 5628 rrxrxff.exe 2372 hthntb.exe 3620 jpdvd.exe 5488 xffrflr.exe 3776 7nhntt.exe 4980 5bbthn.exe 944 dpppp.exe 3344 llffxxl.exe 1988 rxfllrx.exe 2168 bbtnhh.exe 3784 jpdpj.exe 2968 lffffrl.exe 2316 ffrrlfr.exe 1676 nttnbb.exe 5044 pvjdv.exe 1332 xxflxxf.exe 2568 9xlxllf.exe 2060 nbhnbt.exe 5372 jjppj.exe 2056 lrfrlxf.exe 2552 rxflrrx.exe 1744 hbthtt.exe 4072 dddpp.exe 5948 pjjdd.exe 3180 ffxrxlf.exe 2952 fllxflf.exe 5040 tthbht.exe 5060 jjjvp.exe 1728 xrffxrl.exe 4088 xfxrlfx.exe 5256 thnbnb.exe 4432 bthhnt.exe -
resource yara_rule behavioral2/memory/4796-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023298-3.dat upx behavioral2/memory/2740-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023412-8.dat upx behavioral2/memory/2736-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-10.dat upx behavioral2/memory/5864-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-18.dat upx behavioral2/memory/2672-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-24.dat upx behavioral2/memory/1176-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-28.dat upx behavioral2/memory/1176-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-33.dat upx behavioral2/memory/1384-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3624-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-41.dat upx behavioral2/memory/3624-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1524-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-45.dat upx behavioral2/memory/3260-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-49.dat upx behavioral2/memory/660-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-55.dat upx behavioral2/memory/660-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4952-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-61.dat upx behavioral2/memory/60-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-67.dat upx behavioral2/memory/5744-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-71.dat upx behavioral2/files/0x000700000002342f-75.dat upx behavioral2/files/0x0007000000023430-79.dat upx behavioral2/memory/5196-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4124-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-85.dat upx behavioral2/files/0x0007000000023432-89.dat upx behavioral2/files/0x0007000000023433-93.dat upx behavioral2/files/0x0007000000023434-97.dat upx behavioral2/memory/2248-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-102.dat upx behavioral2/memory/3612-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-107.dat upx behavioral2/memory/2992-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023437-112.dat upx behavioral2/memory/3916-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-117.dat upx behavioral2/files/0x0007000000023439-122.dat upx behavioral2/memory/648-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343a-126.dat upx behavioral2/memory/4604-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343b-131.dat upx behavioral2/files/0x000700000002343c-137.dat upx behavioral2/memory/2020-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5172-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002341b-141.dat upx behavioral2/memory/5172-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343d-146.dat upx behavioral2/files/0x000700000002343e-150.dat upx behavioral2/memory/3752-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4544-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343f-156.dat upx behavioral2/memory/2372-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5488-168-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 2740 4796 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 81 PID 4796 wrote to memory of 2740 4796 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 81 PID 4796 wrote to memory of 2740 4796 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 81 PID 2740 wrote to memory of 2736 2740 jvvpv.exe 82 PID 2740 wrote to memory of 2736 2740 jvvpv.exe 82 PID 2740 wrote to memory of 2736 2740 jvvpv.exe 82 PID 2736 wrote to memory of 5864 2736 rfrfrxr.exe 83 PID 2736 wrote to memory of 5864 2736 rfrfrxr.exe 83 PID 2736 wrote to memory of 5864 2736 rfrfrxr.exe 83 PID 5864 wrote to memory of 2672 5864 frfrxlx.exe 84 PID 5864 wrote to memory of 2672 5864 frfrxlx.exe 84 PID 5864 wrote to memory of 2672 5864 frfrxlx.exe 84 PID 2672 wrote to memory of 1176 2672 nbnnnh.exe 85 PID 2672 wrote to memory of 1176 2672 nbnnnh.exe 85 PID 2672 wrote to memory of 1176 2672 nbnnnh.exe 85 PID 1176 wrote to memory of 1384 1176 3hbtth.exe 86 PID 1176 wrote to memory of 1384 1176 3hbtth.exe 86 PID 1176 wrote to memory of 1384 1176 3hbtth.exe 86 PID 1384 wrote to memory of 3624 1384 vvdpj.exe 87 PID 1384 wrote to memory of 3624 1384 vvdpj.exe 87 PID 1384 wrote to memory of 3624 1384 vvdpj.exe 87 PID 3624 wrote to memory of 1524 3624 xxllfxx.exe 88 PID 3624 wrote to memory of 1524 3624 xxllfxx.exe 88 PID 3624 wrote to memory of 1524 3624 xxllfxx.exe 88 PID 1524 wrote to memory of 3260 1524 tnhbbn.exe 89 PID 1524 wrote to memory of 3260 1524 tnhbbn.exe 89 PID 1524 wrote to memory of 3260 1524 tnhbbn.exe 89 PID 3260 wrote to memory of 660 3260 1nhnbn.exe 90 PID 3260 wrote to memory of 660 3260 1nhnbn.exe 90 PID 3260 wrote to memory of 660 3260 1nhnbn.exe 90 PID 660 wrote to memory of 4952 660 xfrrrlf.exe 91 PID 660 wrote to memory of 4952 660 xfrrrlf.exe 91 PID 660 wrote to memory of 4952 660 xfrrrlf.exe 91 PID 4952 wrote to memory of 60 4952 xfrlxxl.exe 92 PID 4952 wrote to memory of 60 4952 xfrlxxl.exe 92 PID 4952 wrote to memory of 60 4952 xfrlxxl.exe 92 PID 60 wrote to memory of 5744 60 hhthnb.exe 93 PID 60 wrote to memory of 5744 60 hhthnb.exe 93 PID 60 wrote to memory of 5744 60 hhthnb.exe 93 PID 5744 wrote to memory of 4112 5744 pddvd.exe 94 PID 5744 wrote to memory of 4112 5744 pddvd.exe 94 PID 5744 wrote to memory of 4112 5744 pddvd.exe 94 PID 4112 wrote to memory of 5196 4112 frrllfr.exe 95 PID 4112 wrote to memory of 5196 4112 frrllfr.exe 95 PID 4112 wrote to memory of 5196 4112 frrllfr.exe 95 PID 5196 wrote to memory of 4124 5196 lrlrfxf.exe 96 PID 5196 wrote to memory of 4124 5196 lrlrfxf.exe 96 PID 5196 wrote to memory of 4124 5196 lrlrfxf.exe 96 PID 4124 wrote to memory of 4564 4124 nttbbt.exe 97 PID 4124 wrote to memory of 4564 4124 nttbbt.exe 97 PID 4124 wrote to memory of 4564 4124 nttbbt.exe 97 PID 4564 wrote to memory of 5076 4564 jvdvj.exe 98 PID 4564 wrote to memory of 5076 4564 jvdvj.exe 98 PID 4564 wrote to memory of 5076 4564 jvdvj.exe 98 PID 5076 wrote to memory of 2248 5076 fxrxflr.exe 99 PID 5076 wrote to memory of 2248 5076 fxrxflr.exe 99 PID 5076 wrote to memory of 2248 5076 fxrxflr.exe 99 PID 2248 wrote to memory of 3612 2248 btnhbb.exe 100 PID 2248 wrote to memory of 3612 2248 btnhbb.exe 100 PID 2248 wrote to memory of 3612 2248 btnhbb.exe 100 PID 3612 wrote to memory of 2992 3612 nhtbth.exe 101 PID 3612 wrote to memory of 2992 3612 nhtbth.exe 101 PID 3612 wrote to memory of 2992 3612 nhtbth.exe 101 PID 2992 wrote to memory of 3640 2992 ddpdp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\jvvpv.exec:\jvvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\rfrfrxr.exec:\rfrfrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\frfrxlx.exec:\frfrxlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
\??\c:\nbnnnh.exec:\nbnnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\3hbtth.exec:\3hbtth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\vvdpj.exec:\vvdpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\xxllfxx.exec:\xxllfxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\tnhbbn.exec:\tnhbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\1nhnbn.exec:\1nhnbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\xfrrrlf.exec:\xfrrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\xfrlxxl.exec:\xfrlxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\hhthnb.exec:\hhthnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\pddvd.exec:\pddvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
\??\c:\frrllfr.exec:\frrllfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\lrlrfxf.exec:\lrlrfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
\??\c:\nttbbt.exec:\nttbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\jvdvj.exec:\jvdvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\fxrxflr.exec:\fxrxflr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\btnhbb.exec:\btnhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\nhtbth.exec:\nhtbth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\ddpdp.exec:\ddpdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\ffxlxrl.exec:\ffxlxrl.exe23⤵
- Executes dropped EXE
PID:3640 -
\??\c:\bnhhnt.exec:\bnhhnt.exe24⤵
- Executes dropped EXE
PID:3916 -
\??\c:\dpppd.exec:\dpppd.exe25⤵
- Executes dropped EXE
PID:648 -
\??\c:\lrxfrll.exec:\lrxfrll.exe26⤵
- Executes dropped EXE
PID:3648 -
\??\c:\hbbtnb.exec:\hbbtnb.exe27⤵
- Executes dropped EXE
PID:4604 -
\??\c:\jdddj.exec:\jdddj.exe28⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vvppv.exec:\vvppv.exe29⤵
- Executes dropped EXE
PID:5172 -
\??\c:\9flrfrx.exec:\9flrfrx.exe30⤵
- Executes dropped EXE
PID:5588 -
\??\c:\tnbhnt.exec:\tnbhnt.exe31⤵
- Executes dropped EXE
PID:3752 -
\??\c:\nbttth.exec:\nbttth.exe32⤵
- Executes dropped EXE
PID:4544 -
\??\c:\jjdpj.exec:\jjdpj.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rrxrxff.exec:\rrxrxff.exe34⤵
- Executes dropped EXE
PID:5628 -
\??\c:\hthntb.exec:\hthntb.exe35⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jpdvd.exec:\jpdvd.exe36⤵
- Executes dropped EXE
PID:3620 -
\??\c:\xffrflr.exec:\xffrflr.exe37⤵
- Executes dropped EXE
PID:5488 -
\??\c:\7nhntt.exec:\7nhntt.exe38⤵
- Executes dropped EXE
PID:3776 -
\??\c:\5bbthn.exec:\5bbthn.exe39⤵
- Executes dropped EXE
PID:4980 -
\??\c:\dpppp.exec:\dpppp.exe40⤵
- Executes dropped EXE
PID:944 -
\??\c:\llffxxl.exec:\llffxxl.exe41⤵
- Executes dropped EXE
PID:3344 -
\??\c:\rxfllrx.exec:\rxfllrx.exe42⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bbtnhh.exec:\bbtnhh.exe43⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jpdpj.exec:\jpdpj.exe44⤵
- Executes dropped EXE
PID:3784 -
\??\c:\lffffrl.exec:\lffffrl.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ffrrlfr.exec:\ffrrlfr.exe46⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nttnbb.exec:\nttnbb.exe47⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pvjdv.exec:\pvjdv.exe48⤵
- Executes dropped EXE
PID:5044 -
\??\c:\xxflxxf.exec:\xxflxxf.exe49⤵
- Executes dropped EXE
PID:1332 -
\??\c:\9xlxllf.exec:\9xlxllf.exe50⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nbhnbt.exec:\nbhnbt.exe51⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jjppj.exec:\jjppj.exe52⤵
- Executes dropped EXE
PID:5372 -
\??\c:\lrfrlxf.exec:\lrfrlxf.exe53⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rxflrrx.exec:\rxflrrx.exe54⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hbthtt.exec:\hbthtt.exe55⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dddpp.exec:\dddpp.exe56⤵
- Executes dropped EXE
PID:4072 -
\??\c:\pjjdd.exec:\pjjdd.exe57⤵
- Executes dropped EXE
PID:5948 -
\??\c:\ffxrxlf.exec:\ffxrxlf.exe58⤵
- Executes dropped EXE
PID:3180 -
\??\c:\fllxflf.exec:\fllxflf.exe59⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tthbht.exec:\tthbht.exe60⤵
- Executes dropped EXE
PID:5040 -
\??\c:\jjjvp.exec:\jjjvp.exe61⤵
- Executes dropped EXE
PID:5060 -
\??\c:\xrffxrl.exec:\xrffxrl.exe62⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe63⤵
- Executes dropped EXE
PID:4088 -
\??\c:\thnbnb.exec:\thnbnb.exe64⤵
- Executes dropped EXE
PID:5256 -
\??\c:\bthhnt.exec:\bthhnt.exe65⤵
- Executes dropped EXE
PID:4432 -
\??\c:\pjjjd.exec:\pjjjd.exe66⤵PID:2044
-
\??\c:\pdvpj.exec:\pdvpj.exe67⤵PID:4960
-
\??\c:\7rxxrrx.exec:\7rxxrrx.exe68⤵PID:3692
-
\??\c:\flxrxxl.exec:\flxrxxl.exe69⤵PID:4188
-
\??\c:\nnhbnh.exec:\nnhbnh.exe70⤵PID:1184
-
\??\c:\nhtthb.exec:\nhtthb.exe71⤵PID:916
-
\??\c:\pdvvv.exec:\pdvvv.exe72⤵PID:5716
-
\??\c:\xxlfrxx.exec:\xxlfrxx.exe73⤵PID:5392
-
\??\c:\ntnthb.exec:\ntnthb.exe74⤵PID:5444
-
\??\c:\dvdjp.exec:\dvdjp.exe75⤵PID:2360
-
\??\c:\frlrlxl.exec:\frlrlxl.exe76⤵PID:2756
-
\??\c:\3bnnnb.exec:\3bnnnb.exe77⤵PID:3168
-
\??\c:\vpjjp.exec:\vpjjp.exe78⤵PID:1436
-
\??\c:\1xfrlrx.exec:\1xfrlrx.exe79⤵PID:4216
-
\??\c:\nnhntb.exec:\nnhntb.exe80⤵PID:1784
-
\??\c:\bbtnbt.exec:\bbtnbt.exe81⤵PID:5296
-
\??\c:\pdpjd.exec:\pdpjd.exe82⤵PID:3464
-
\??\c:\fxffffx.exec:\fxffffx.exe83⤵PID:2228
-
\??\c:\tbhhbh.exec:\tbhhbh.exe84⤵PID:5052
-
\??\c:\tbhhbh.exec:\tbhhbh.exe85⤵PID:212
-
\??\c:\jdddp.exec:\jdddp.exe86⤵PID:5780
-
\??\c:\pdvvj.exec:\pdvvj.exe87⤵PID:2964
-
\??\c:\lrrlllf.exec:\lrrlllf.exe88⤵PID:3416
-
\??\c:\llfxrrl.exec:\llfxrrl.exe89⤵PID:4472
-
\??\c:\ttnhhh.exec:\ttnhhh.exe90⤵PID:4044
-
\??\c:\vdpvp.exec:\vdpvp.exe91⤵PID:1240
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe92⤵PID:4552
-
\??\c:\nhtbbn.exec:\nhtbbn.exe93⤵PID:384
-
\??\c:\ntbtht.exec:\ntbtht.exe94⤵PID:4360
-
\??\c:\pdjjj.exec:\pdjjj.exe95⤵PID:4740
-
\??\c:\pvvpp.exec:\pvvpp.exe96⤵PID:3720
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe97⤵PID:372
-
\??\c:\9bbbbt.exec:\9bbbbt.exe98⤵PID:1392
-
\??\c:\tththn.exec:\tththn.exe99⤵PID:1628
-
\??\c:\pdpdd.exec:\pdpdd.exe100⤵PID:5380
-
\??\c:\rlfxllf.exec:\rlfxllf.exe101⤵PID:4068
-
\??\c:\llxxrfr.exec:\llxxrfr.exe102⤵PID:5232
-
\??\c:\httnnn.exec:\httnnn.exe103⤵PID:3100
-
\??\c:\nhnhhn.exec:\nhnhhn.exe104⤵PID:2004
-
\??\c:\vvvpj.exec:\vvvpj.exe105⤵PID:5860
-
\??\c:\vppvd.exec:\vppvd.exe106⤵PID:5452
-
\??\c:\lxrrrxx.exec:\lxrrrxx.exe107⤵PID:5608
-
\??\c:\bhhtnt.exec:\bhhtnt.exe108⤵PID:1640
-
\??\c:\nbhbnh.exec:\nbhbnh.exe109⤵PID:4972
-
\??\c:\bbhhhh.exec:\bbhhhh.exe110⤵PID:668
-
\??\c:\3jjdv.exec:\3jjdv.exe111⤵PID:4124
-
\??\c:\7xlrxrf.exec:\7xlrxrf.exe112⤵PID:4688
-
\??\c:\xlxlxxx.exec:\xlxlxxx.exe113⤵PID:4992
-
\??\c:\nthhhh.exec:\nthhhh.exe114⤵PID:1684
-
\??\c:\xrlrfrl.exec:\xrlrfrl.exe115⤵PID:3444
-
\??\c:\7btnhh.exec:\7btnhh.exe116⤵PID:3224
-
\??\c:\hnbtnn.exec:\hnbtnn.exe117⤵PID:1484
-
\??\c:\jdjvd.exec:\jdjvd.exe118⤵PID:5332
-
\??\c:\xflxlfl.exec:\xflxlfl.exe119⤵PID:1992
-
\??\c:\fxxxrxl.exec:\fxxxrxl.exe120⤵PID:2428
-
\??\c:\htbttt.exec:\htbttt.exe121⤵PID:5012
-
\??\c:\nbnnbh.exec:\nbnnbh.exe122⤵PID:1896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-